@ricsam/r5d-worker 0.0.123 → 0.0.125

package/dist/mjs/main.mjs

@@ -4,7 +4,9 @@ import { getWorkerPlanPath, getWorkerPlansPath, validatePlanId } from "./plan-pa
 import { createPlanMarkdown, updateTaskCheckbox } from "./plan-parser.mjs";
 import { lintPlans, formatPlanLintErrors } from "./plan-lint.mjs";
 import fs from "node:fs";
-import { WorkerRecoveryStore, workerOperationDigest } from "./recovery-store.mjs";
+import { WorkerRecoveryJournal, WorkerRecoveryJournalBusyError } from "./recovery-journal.mjs";
+import { SessionFileMutationTracker } from "./session-file-mutations.mjs";
+import { workerOperationDigest } from "./recovery-store.mjs";
 import { WorkerOutputWindow } from "./recovery-output-window.mjs";
 import {
   createWorkerCommandLauncher,
@@ -58,9 +60,11 @@ import {
   runWorkspaceCommand
 } from "./workspace-command-sync-policy.mjs";
 import { WorkspaceMutationGate } from "./workspace-mutation-gate.mjs";
+import { WorkspaceMountHoldAbortedError, WorkspaceMountHoldFence } from "./workspace-mount-hold-fence.mjs";
+import { installWorkspaceFilesystemExecutorFailureHandler, workspaceFilesystemExecutor } from "./workspace-filesystem-executor.mjs";
 import { WorkspaceProjectionLedger } from "./workspace-projection-ledger.mjs";
 import { WorkspaceSyncCoalescer } from "./workspace-sync-coalescer.mjs";
-import { checkoutPathMovePublicationComplete, preserveProjectCheckoutPathMove } from "./workspace-path-move.mjs";
+import { checkoutPathMovePublicationComplete } from "./workspace-path-move.mjs";
 import { busyProjectConfigurationChangeIds, deferredProjectConfigurationPendingBranches } from "./workspace-project-config-policy.mjs";
 import { creatorLocalProjectBranchIsAuthorized, workerProjectBranchDisposition } from "./workspace-preserve-only-policy.mjs";
 import { assertProjectBranchDeletionIncarnation } from "./workspace-branch-incarnation-policy.mjs";
@@ -90,6 +94,7 @@ import {
   deleteProjectMirrorBranch,
   ensureProjectWorktrees,
   inventoryProjectCheckouts,
+  PROJECT_WORKTREE_SNAPSHOT_OWNER_SESSION_ID,
   observeProjectMirrorHeads,
   projectBranchMayExistAfterCreateFailure,
   projectOriginBranchName,
@@ -102,11 +107,6 @@ import {
   parseProjectMirrorRefsTokensMessage,
   planProjectMirrorObservationFetch
 } from "./project-mirror-fetch-policy.mjs";
-import {
-  PROJECT_SNAPSHOT_RECOVERY_HELPER_COMMAND,
-  recoverProjectSnapshotsInChild,
-  runProjectSnapshotRecoveryHelper
-} from "./project-snapshot-recovery-runner.mjs";
 import {
   ProjectWorkspacePendingBranchPathChangeError,
   ProjectWorkspaceStateStore,
@@ -135,7 +135,7 @@ function workerServerHeartbeatAction(input) {
   return input.probeElapsedMs >= input.timeoutMs ? "terminate" : "wait";
 }
 const WORKSPACE_HYDRATION_LEASE_OPERATION_PREFIX = "hydration:";
-function createWorkspaceHydrationLeaseHooks(send, options = {}) {
+function createWorkspaceHydrationLeaseHooks(send, options) {
   const yieldToEventLoop = options.yieldToEventLoop ?? (() => new Promise((resolve) => setImmediate(resolve)));
   const log = options.log ?? ((line) => process.stdout.write(`${line}
 `));
@@ -156,13 +156,17 @@ function createWorkspaceHydrationLeaseHooks(send, options = {}) {
       log(
         `[r5d-worker] released hydration lease ${context.transactionId} after ${startedAt === void 0 ? "?" : Math.round(now() - startedAt)}ms`
       );
+    },
+    holdMounts(mountIds, description) {
+      return options.fence.hold(mountIds, description);
     }
   };
 }
 const workerLifecycleTestHarness = {
   boundedWorkerLifecycleProgress,
   workerServerHeartbeatAction,
-  createWorkspaceHydrationLeaseHooks
+  createWorkspaceHydrationLeaseHooks,
+  workerCommandHasWorkspaceEffect
 };
 class ProjectWorkspaceConfigurationDeferredError extends Error {
 }
@@ -215,7 +219,7 @@ const workspaceSyncPriorityPtyTargets = /* @__PURE__ */ new Map();
 let currentWorkerSocket = null;
 const workerRuntimeId = crypto.randomUUID();
 const workerOutputWindow = new WorkerOutputWindow();
-let recoveryStore;
+let recoveryJournal;
 let workerReconnectAttempt = 0;
 let workerRecoveryId;
 let workerExecutionLeaseDeadline = 0;
@@ -227,13 +231,13 @@ let runtimeExitPromise;
 function fenceWorkerRuntimeOperations() {
   launcherFailureInProgress = true;
   workerAdmissionGeneration += 1;
-  for (const operation of recoveryStore?.operations() ?? []) {
-    if (operation.state !== "completed") recoveryStore?.unknown(operation.requestId);
+  for (const operation of recoveryJournal?.activeAndPendingOperations() ?? []) {
+    if (operation.state !== "completed") recoveryJournal?.unknown(operation.requestId);
   }
   for (const runId of workerCommandLauncher?.activeIds ?? []) {
     infrastructureStoppedRunIds.add(runId);
     cancelledProcessRuns.add(runId);
-    recoveryStore?.unknownRun(runId);
+    recoveryJournal?.unknownRun(runId);
   }
   for (const runId of activeProcesses.keys()) infrastructureStoppedRunIds.add(runId);
 }
@@ -242,13 +246,21 @@ function exitWorkerRuntime(code) {
   fenceWorkerRuntimeOperations();
   runtimeExitPromise = (async () => {
     await Promise.race([
-      Promise.allSettled([terminateActiveCredentialBearingChildren(), workerCommandLauncher?.close()]),
+      Promise.allSettled([terminateActiveCredentialBearingChildren(), workerCommandLauncher?.close(), recoveryJournal?.flush()]),
       Bun.sleep(4e3)
     ]);
     process.exit(code);
   })();
   return runtimeExitPromise;
 }
+function handleRecoveryJournalFailure(error) {
+  if (launcherFailureInProgress) return;
+  fenceWorkerRuntimeOperations();
+  process.stderr.write(`[r5d-worker] ${error.message}; stopping runtime for recovery journal restart
+`);
+  currentWorkerSocket?.close(1012, "Recovery journal failure");
+  void exitWorkerRuntime(WORKER_RECONNECT_EXIT_CODE);
+}
 function handleWorkerCommandLauncherFailure(error) {
   if (!workerCommandLauncher || launcherFailureInProgress) return;
   fenceWorkerRuntimeOperations();
@@ -269,7 +281,7 @@ async function retryWorkerServerRead(read) {
     try {
       return await read();
     } catch (error) {
-      if (!recoveryStore || !isWorkerCommunicationFailure(error instanceof Error ? error.message : String(error))) throw error;
+      if (!recoveryJournal || !isWorkerCommunicationFailure(error instanceof Error ? error.message : String(error))) throw error;
       deadline ??= Date.now() + WORKER_RECOVERY_TIMEOUT_MS;
       if (workerLeaseExpired || Date.now() >= deadline) throw new WorkerServerUnavailableError("Worker communication recovery expired");
       currentWorkerSocket?.close(1012, "Communication recovery");
@@ -291,9 +303,10 @@ function renewWorkerExecutionLease(leaseMs) {
 `);
       });
       closeAllPtys();
-      for (const operation of recoveryStore?.operations() ?? []) {
+      for (const operation of recoveryJournal?.activeAndPendingOperations() ?? []) {
         if (operation.sessionId && operation.state !== "completed") {
-          recoveryStore?.cancelSession(operation.sessionId);
+          void recoveryJournal?.cancelSession(operation.sessionId);
+          abortPendingReservations("Execution lease expired before command start", operation.sessionId);
           void workerCommandLauncher?.cancelSession(operation.sessionId).catch((error) => {
             process.stderr.write(`[r5d-worker] expired command launcher cancellation failed: ${error}
 `);
@@ -303,7 +316,7 @@ function renewWorkerExecutionLease(leaseMs) {
       for (const [runId, active] of activeProcesses) {
         if (!active.sessionId) continue;
         infrastructureStoppedRunIds.add(runId);
-        recoveryStore?.unknownRun(runId);
+        recoveryJournal?.unknownRun(runId);
         cancelledProcessRuns.add(runId);
         closeProcessStdin(active);
         void terminateProcessTree(active.process).catch(
@@ -318,6 +331,32 @@ function renewWorkerExecutionLease(leaseMs) {
 }
 let workerAdmissionGeneration = 0;
 const workspaceMutationGate = new WorkspaceMutationGate();
+const workspaceMountHoldFence = new WorkspaceMountHoldFence();
+const projectMountId = (projectId, branchName) => `project:${projectId}:${encodeURIComponent(branchName)}`;
+const pendingReservationAborts = /* @__PURE__ */ new Map();
+const sessionFileMutations = new SessionFileMutationTracker();
+function registerPendingReservation(key, sessionId) {
+  abortPendingReservation(key, "Reservation superseded by a newer request with the same id");
+  const controller = new AbortController();
+  pendingReservationAborts.set(key, { controller, sessionId });
+  return controller;
+}
+function unregisterPendingReservation(key, controller) {
+  if (pendingReservationAborts.get(key)?.controller === controller) pendingReservationAborts.delete(key);
+}
+function abortPendingReservation(key, reason) {
+  const pending = pendingReservationAborts.get(key);
+  if (!pending) return false;
+  pendingReservationAborts.delete(key);
+  pending.controller.abort(new WorkspaceMountHoldAbortedError(reason));
+  return true;
+}
+function abortPendingReservations(reason, sessionId) {
+  for (const [key, pending] of [...pendingReservationAborts]) {
+    if (sessionId !== void 0 && pending.sessionId !== sessionId) continue;
+    abortPendingReservation(key, reason);
+  }
+}
 let workspaceSyncQueue = Promise.resolve();
 let startupProjectSnapshotRecoveryCompleted = false;
 const checkoutGarbageCollectors = /* @__PURE__ */ new Map();
@@ -352,6 +391,17 @@ const workspaceSyncSingleFlight = {
   },
   afterCurrent() {
     return workspaceSyncQueue;
+  },
+  mountHold(target, signal) {
+    if (target.type !== "project") return null;
+    const mountIds = [projectMountId(target.projectId, target.branchName)];
+    if (!workspaceMountHoldFence.isHeld(mountIds)) return null;
+    const holder = workspaceMountHoldFence.describeHold(mountIds);
+    process.stdout.write(
+      `[r5d-worker] command for ${target.projectId}/${target.branchName} waits for ${holder ?? "a workspace filesystem job"}
+`
+    );
+    return workspaceMountHoldFence.waitForRelease(mountIds, { signal });
   }
 };
 let githubCredential = null;
@@ -1008,14 +1058,15 @@ async function runGitAsync(args, options = {}) {
     env: workerGitProcessEnvironment(),
     ...bounded ? { detached: true } : {}
   });
-  const completion = Promise.all([
-    new Response(subprocess.stdout).text(),
-    new Response(subprocess.stderr).text(),
-    subprocess.exited
-  ]).then(([stdout, stderr, exitCode]) => ({ stdout, stderr, exitCode }));
+  const completion = Promise.all([new Response(subprocess.stdout).text(), new Response(subprocess.stderr).text(), subprocess.exited]).then(
+    ([stdout, stderr, exitCode]) => ({ stdout, stderr, exitCode })
+  );
   let timer;
   const timedOut = bounded ? new Promise((_resolve, reject) => {
-    timer = setTimeout(() => reject(new GitTransportTimeoutError(`git ${args.join(" ")} timed out after ${options.timeoutMs}ms`)), options.timeoutMs);
+    timer = setTimeout(
+      () => reject(new GitTransportTimeoutError(`git ${args.join(" ")} timed out after ${options.timeoutMs}ms`)),
+      options.timeoutMs
+    );
   }) : null;
   try {
     const { stdout, stderr, exitCode } = timedOut ? await Promise.race([completion, timedOut]) : await completion;
@@ -2104,12 +2155,12 @@ async function streamCommandOutput(stream, onData) {
       }
       const text = decoder.decode(chunk.value, { stream: true });
       if (text.length > 0) {
-        onData(text);
+        await onData(text);
       }
     }
     const trailing = decoder.decode();
     if (trailing.length > 0) {
-      onData(trailing);
+      await onData(trailing);
     }
   } finally {
     reader.releaseLock();
@@ -2248,12 +2299,21 @@ function mutationQueueKey(target, resolved) {
   }
   return `${describeWorkerSessionTarget(target)}:${path.posix.normalize(resolved.repoRelativePath)}`;
 }
-function readWorkerTextFile(branchPath, filePath, offset, limit, builtInPaths) {
+async function statIfExists(targetPath) {
+  try {
+    return await fs.promises.stat(targetPath);
+  } catch (error) {
+    const code = error.code;
+    if (code === "ENOENT" || code === "ENOTDIR") return null;
+    throw error;
+  }
+}
+async function readWorkerTextFile(branchPath, filePath, offset, limit, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
-  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isFile()) {
     throw new Error(`File not found: ${resolved.displayPath}`);
   }
-  const buffer = fs.readFileSync(resolved.absolutePath);
+  const buffer = await fs.promises.readFile(resolved.absolutePath);
   const formatted = formatLineNumberedContent(buffer.toString("utf8"), offset, limit);
   return {
     type: "read",
@@ -2263,25 +2323,25 @@ function readWorkerTextFile(branchPath, filePath, offset, limit, builtInPaths) {
     ...formatted
   };
 }
-function writeWorkerTextFile(branchPath, filePath, content, builtInPaths) {
+async function writeWorkerTextFile(branchPath, filePath, content, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
-  fs.mkdirSync(path.dirname(resolved.absolutePath), { recursive: true });
-  fs.writeFileSync(resolved.absolutePath, content, "utf8");
+  await fs.promises.mkdir(path.dirname(resolved.absolutePath), { recursive: true });
+  await fs.promises.writeFile(resolved.absolutePath, content, "utf8");
   return {
     type: "write",
     file: resolved.displayPath,
     gitBlobHash: getGitBlobHashForContent(content)
   };
 }
-function editWorkerTextFile(branchPath, filePath, edits, builtInPaths) {
+async function editWorkerTextFile(branchPath, filePath, edits, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
   if (!Array.isArray(edits) || edits.length === 0) {
     throw new Error("edit requires at least one replacement");
   }
-  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isFile()) {
     throw new Error(`File not found: ${resolved.displayPath}`);
   }
-  const originalContent = fs.readFileSync(resolved.absolutePath, "utf8");
+  const originalContent = await fs.promises.readFile(resolved.absolutePath, "utf8");
   const ranges = edits.map((edit, index) => {
     if (edit.oldText === edit.newText) {
       throw new Error(`edits[${index}].oldText and edits[${index}].newText must be different`);
@@ -2313,7 +2373,7 @@ function editWorkerTextFile(branchPath, filePath, edits, builtInPaths) {
   for (const range of [...sortedRanges].reverse()) {
     nextContent = nextContent.slice(0, range.start) + range.edit.newText + nextContent.slice(range.end);
   }
-  fs.writeFileSync(resolved.absolutePath, nextContent, "utf8");
+  await fs.promises.writeFile(resolved.absolutePath, nextContent, "utf8");
   return {
     type: "edit",
     file: resolved.displayPath,
@@ -2346,7 +2406,7 @@ async function executePlanOperation(input) {
       let created = false;
       if (message.createIfMissing) {
         try {
-          fs.writeFileSync(resolved.absolutePath, createPlanMarkdown(message.planId), { encoding: "utf8", flag: "wx" });
+          await fs.promises.writeFile(resolved.absolutePath, createPlanMarkdown(message.planId), { encoding: "utf8", flag: "wx" });
           created = true;
         } catch (error) {
           if (error.code !== "EEXIST") throw error;
@@ -2355,11 +2415,16 @@ async function executePlanOperation(input) {
       return {
         type: "read_plan",
         created,
-        read: readWorkerTextFile(resolvedTarget.rootPath, filePath, void 0, void 0, builtInPaths)
+        read: await readWorkerTextFile(resolvedTarget.rootPath, filePath, void 0, void 0, builtInPaths)
       };
     }
-    const content = fs.readFileSync(resolved.absolutePath, "utf8");
-    writeWorkerTextFile(resolvedTarget.rootPath, filePath, updateTaskCheckbox(content, message.taskId, message.checked), builtInPaths);
+    const content = await fs.promises.readFile(resolved.absolutePath, "utf8");
+    await writeWorkerTextFile(
+      resolvedTarget.rootPath,
+      filePath,
+      updateTaskCheckbox(content, message.taskId, message.checked),
+      builtInPaths
+    );
     return {
       type: "update_task_status",
       planId: message.planId,
@@ -2380,7 +2445,11 @@ async function executeReadFileOperation(input) {
     rootDir: input.rootDir,
     access: "read"
   });
-  return readWorkerTextFile(input.resolvedTarget.rootPath, input.message.filePath, input.message.offset, input.message.limit, builtInPaths);
+  const resolved = resolveWorkerFilePath(input.resolvedTarget.rootPath, input.message.filePath, builtInPaths);
+  return withFileMutationQueue(
+    mutationQueueKey(input.resolvedTarget.target, resolved),
+    () => readWorkerTextFile(input.resolvedTarget.rootPath, input.message.filePath, input.message.offset, input.message.limit, builtInPaths)
+  );
 }
 async function executeWriteFileOperation(input) {
   const builtInPaths = await prepareBuiltInToolPathsForTarget({
@@ -2433,16 +2502,16 @@ function wildcardToRegex(pattern) {
 function normalizeFindPattern(pattern) {
   return /[*?]/.test(pattern) ? pattern : `*${pattern}*`;
 }
-function walkWorkerEntries(branchPath, start) {
+async function walkWorkerEntries(branchPath, start) {
   const entries = [];
   const visitedDirectories = /* @__PURE__ */ new Set();
-  const realVirtualRoot = start.scope === "virtual" ? fs.realpathSync(start.virtualRootPath) : null;
-  const visit = (absolutePath, isRoot) => {
+  const realVirtualRoot = start.scope === "virtual" ? await fs.promises.realpath(start.virtualRootPath) : null;
+  const visit = async (absolutePath, isRoot) => {
     let stat;
     try {
-      stat = fs.statSync(absolutePath);
+      stat = await fs.promises.stat(absolutePath);
       if (realVirtualRoot) {
-        assertInsideRoot(realVirtualRoot, fs.realpathSync(absolutePath), `${start.displayPath} path`);
+        assertInsideRoot(realVirtualRoot, await fs.promises.realpath(absolutePath), `${start.displayPath} path`);
       }
     } catch (error) {
       if (isRoot) throw error;
@@ -2455,7 +2524,7 @@ function walkWorkerEntries(branchPath, start) {
     if (!stat.isDirectory()) return;
     let realDirectoryPath;
     try {
-      realDirectoryPath = fs.realpathSync(absolutePath);
+      realDirectoryPath = await fs.promises.realpath(absolutePath);
     } catch (error) {
       if (isRoot) throw error;
       return;
@@ -2464,25 +2533,25 @@ function walkWorkerEntries(branchPath, start) {
     visitedDirectories.add(realDirectoryPath);
     let children;
     try {
-      children = fs.readdirSync(absolutePath, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+      children = (await fs.promises.readdir(absolutePath, { withFileTypes: true })).sort((a, b) => a.name.localeCompare(b.name));
     } catch (error) {
       if (isRoot) throw error;
       return;
     }
     for (const child of children) {
       if (IGNORED_ENTRY_NAMES.has(child.name)) continue;
-      visit(path.join(absolutePath, child.name), false);
+      await visit(path.join(absolutePath, child.name), false);
     }
   };
-  visit(start.absolutePath, true);
+  await visit(start.absolutePath, true);
   return entries;
 }
 function isProbablyText(bytes) {
   return !bytes.subarray(0, Math.min(bytes.length, 4096)).includes(0);
 }
-function grepWorkerFiles(branchPath, input, builtInPaths) {
+async function grepWorkerFiles(branchPath, input, builtInPaths) {
   const start = resolveWorkerFilePath(branchPath, input.path ?? ".", builtInPaths);
-  if (!fs.existsSync(start.absolutePath)) {
+  if (!await statIfExists(start.absolutePath)) {
     throw new Error(`Path not found: ${start.displayPath}`);
   }
   const limit = normalizeToolLimit(input.limit, 100, 1e3);
@@ -2492,12 +2561,12 @@ function grepWorkerFiles(branchPath, input, builtInPaths) {
   const lines = [];
   let matchCount = 0;
   let truncated = false;
-  for (const entry of walkWorkerEntries(branchPath, start)) {
+  for (const entry of await walkWorkerEntries(branchPath, start)) {
     if (!entry.stat.isFile()) continue;
     if (globRegex && !globRegex.test(entry.matchPath)) continue;
     let bytes;
     try {
-      bytes = fs.readFileSync(entry.absolutePath);
+      bytes = await fs.promises.readFile(entry.absolutePath);
     } catch {
       continue;
     }
@@ -2550,9 +2619,9 @@ async function executeGrepOperation(input) {
     builtInPaths
   );
 }
-function findWorkerFiles(branchPath, input, builtInPaths) {
+async function findWorkerFiles(branchPath, input, builtInPaths) {
   const start = resolveWorkerFilePath(branchPath, input.path ?? ".", builtInPaths);
-  if (!fs.existsSync(start.absolutePath) || !fs.statSync(start.absolutePath).isDirectory()) {
+  if (!(await statIfExists(start.absolutePath))?.isDirectory()) {
     throw new Error(`Directory not found: ${start.displayPath}`);
   }
   const pattern = normalizeFindPattern(input.pattern ?? "*");
@@ -2562,7 +2631,7 @@ function findWorkerFiles(branchPath, input, builtInPaths) {
   const matches = [];
   let count = 0;
   let truncated = false;
-  for (const entry of walkWorkerEntries(branchPath, start)) {
+  for (const entry of await walkWorkerEntries(branchPath, start)) {
     if (entry.absolutePath === start.absolutePath) continue;
     const isDirectory = entry.stat.isDirectory();
     if (entryType === "file" && !entry.stat.isFile()) continue;
@@ -2607,13 +2676,13 @@ async function executeFindOperation(input) {
     builtInPaths
   );
 }
-function listWorkerDirectory(branchPath, inputPath = ".", inputLimit, builtInPaths) {
+async function listWorkerDirectory(branchPath, inputPath = ".", inputLimit, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, inputPath, builtInPaths);
-  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isDirectory()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isDirectory()) {
     throw new Error(`Directory not found: ${resolved.displayPath}`);
   }
   const limit = normalizeToolLimit(inputLimit, 200, 1e3);
-  const entries = fs.readdirSync(resolved.absolutePath, { withFileTypes: true }).filter((entry) => !IGNORED_ENTRY_NAMES.has(entry.name)).sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name));
+  const entries = (await fs.promises.readdir(resolved.absolutePath, { withFileTypes: true })).filter((entry) => !IGNORED_ENTRY_NAMES.has(entry.name)).sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name));
   const displayed = entries.slice(0, limit).map((entry) => `${entry.name}${entry.isDirectory() ? "/" : ""}`);
   const truncated = entries.length > displayed.length;
   const hint = truncated ? "\n... truncated. Increase limit to continue." : "";
@@ -2664,36 +2733,40 @@ function resolveWorkerCodePath(branchPath, inputPath) {
   }
   return { absolutePath, displayPath };
 }
-function listWorkerCodeDirectory(branchPath, inputPath) {
+async function listWorkerCodeDirectory(branchPath, inputPath) {
   const resolved = resolveWorkerCodePath(branchPath, inputPath);
-  if (!fs.statSync(resolved.absolutePath).isDirectory()) {
+  if (!(await fs.promises.stat(resolved.absolutePath)).isDirectory()) {
     throw new Error(`Code directory not found: ${resolved.displayPath}`);
   }
-  const entries = fs.readdirSync(resolved.absolutePath, { withFileTypes: true }).filter((entry) => entry.name.toLowerCase() !== ".git").flatMap((entry) => {
+  const listed = (await fs.promises.readdir(resolved.absolutePath, { withFileTypes: true })).filter(
+    (entry) => entry.name.toLowerCase() !== ".git"
+  );
+  const entries = [];
+  for (const entry of listed) {
     const entryPath = path.posix.join(resolved.displayPath, entry.name);
     try {
       const resolvedEntry = resolveWorkerCodePath(branchPath, entryPath);
-      const stats = fs.statSync(resolvedEntry.absolutePath);
-      if (!stats.isFile() && !stats.isDirectory()) return [];
-      return [
-        {
-          name: entry.name,
-          type: stats.isDirectory() ? "directory" : "file",
-          size: stats.isDirectory() ? null : stats.size,
-          mtime: stats.mtime.toISOString()
-        }
-      ];
+      const stats = await fs.promises.stat(resolvedEntry.absolutePath);
+      if (!stats.isFile() && !stats.isDirectory()) continue;
+      entries.push({
+        name: entry.name,
+        type: stats.isDirectory() ? "directory" : "file",
+        size: stats.isDirectory() ? null : stats.size,
+        mtime: stats.mtime.toISOString()
+      });
     } catch {
-      return [];
     }
-  }).sort((left, right) => Number(right.type === "directory") - Number(left.type === "directory") || left.name.localeCompare(right.name));
+  }
+  entries.sort(
+    (left, right) => Number(right.type === "directory") - Number(left.type === "directory") || left.name.localeCompare(right.name)
+  );
   return { type: "code_list", path: resolved.displayPath, entries };
 }
-function readWorkerCodeFile(branchPath, inputPath) {
+async function readWorkerCodeFile(branchPath, inputPath) {
   const resolved = resolveWorkerCodePath(branchPath, inputPath);
-  const stats = fs.statSync(resolved.absolutePath);
+  const stats = await fs.promises.stat(resolved.absolutePath);
   if (!stats.isFile()) throw new Error(`Code file not found: ${resolved.displayPath}`);
-  const bytes = fs.readFileSync(resolved.absolutePath);
+  const bytes = await fs.promises.readFile(resolved.absolutePath);
   return {
     type: "code_read",
     path: resolved.displayPath,
@@ -2702,17 +2775,17 @@ function readWorkerCodeFile(branchPath, inputPath) {
     base64: bytes.toString("base64")
   };
 }
-function executeCodeListOperation(input) {
+async function executeCodeListOperation(input) {
   if (input.resolvedTarget.target.type !== "project") throw new Error("Code listing requires a project branch target");
   return listWorkerCodeDirectory(input.resolvedTarget.rootPath, input.message.path);
 }
-function executeCodeReadOperation(input) {
+async function executeCodeReadOperation(input) {
   if (input.resolvedTarget.target.type !== "project") throw new Error("Code reading requires a project branch target");
   return readWorkerCodeFile(input.resolvedTarget.rootPath, input.message.path);
 }
-function readWorkerImageFile(branchPath, filePath, builtInPaths) {
+async function readWorkerImageFile(branchPath, filePath, builtInPaths) {
   const resolved = resolveWorkerFilePath(branchPath, filePath, builtInPaths);
-  if (!fs.existsSync(resolved.absolutePath) || !fs.statSync(resolved.absolutePath).isFile()) {
+  if (!(await statIfExists(resolved.absolutePath))?.isFile()) {
     throw new Error(`File not found: ${resolved.displayPath}`);
   }
   const extension = path.extname(resolved.absolutePath).toLowerCase();
@@ -2720,7 +2793,7 @@ function readWorkerImageFile(branchPath, filePath, builtInPaths) {
   if (!mediaType) {
     throw new Error("read supports PNG and JPEG image inputs only");
   }
-  const bytes = fs.readFileSync(resolved.absolutePath);
+  const bytes = await fs.promises.readFile(resolved.absolutePath);
   const dimensions = readImageDimensions(bytes, mediaType);
   return {
     type: "view_file_bytes",
@@ -3047,26 +3120,28 @@ async function executeStreamingCommand(input) {
     }
     const [exitCode] = await Promise.all([
       subprocess.exited,
-      streamCommandOutput(subprocess.stdout, (data) => {
-        sendWorkerMessage(input.ws, {
+      streamCommandOutput(
+        subprocess.stdout,
+        (data) => sendWorkerOutput(input.ws, {
           type: "exec_output",
           runId: input.message.runId,
           stream: "stdout",
           data
-        });
-      }),
-      streamCommandOutput(subprocess.stderr, (data) => {
-        sendWorkerMessage(input.ws, {
+        })
+      ),
+      streamCommandOutput(
+        subprocess.stderr,
+        (data) => sendWorkerOutput(input.ws, {
           type: "exec_output",
           runId: input.message.runId,
           stream: "stderr",
           data
-        });
-      })
+        })
+      )
     ]);
     const diagnostic = await input.resources.diagnose();
     if (diagnostic) {
-      sendWorkerMessage(input.ws, {
+      await sendWorkerOutput(input.ws, {
         type: "exec_output",
         runId: input.message.runId,
         stream: "stderr",
@@ -3138,6 +3213,39 @@ async function reapCompletedCredentialBearingProcessGroup(runId, subprocess) {
     );
   }
 }
+async function cancelProcessRun(runId, scope) {
+  const spawned = activeProcesses.get(runId);
+  if (scope === "unstarted" && spawned) return { cancelled: false, message: `${spawned.command} already started`, outcome: "started" };
+  if (!spawned) cancelledProcessRuns.add(runId);
+  const revocation = workerCommandLauncher?.cancel(runId);
+  let resourceCancellationError;
+  let launchRevoked = false;
+  try {
+    launchRevoked = await revocation ?? false;
+  } catch (error) {
+    resourceCancellationError = error instanceof Error ? error.message : String(error);
+  }
+  let cancelled = resourceCancellationError === void 0;
+  let cancelMessage;
+  let outcome;
+  if (spawned) {
+    outcome = "stopped";
+    try {
+      closeProcessStdin(spawned);
+      await terminateProcessTree(spawned.process);
+      cancelMessage = `Stopped ${spawned.command}`;
+    } catch (error) {
+      cancelled = false;
+      cancelMessage = `Failed to stop ${spawned.command}: ${error instanceof Error ? error.message : String(error)}`;
+    }
+  } else {
+    const reservationAborted = abortPendingReservation(`run:${runId}`, "Cancellation queued before command start");
+    outcome = launchRevoked || reservationAborted ? "unstarted" : "unknown";
+    cancelMessage = "Cancellation queued before command start";
+  }
+  if (resourceCancellationError) cancelMessage += `; job resource termination failed: ${resourceCancellationError}`;
+  return { cancelled, message: cancelMessage, outcome };
+}
 function closeProcessStdin(active) {
   if (!active?.stdin) {
     return;
@@ -3163,21 +3271,35 @@ function sendReplayWorkerMessage(ws, message) {
 }
 function sendWorkerMessage(ws, message) {
   if (launcherFailureInProgress) return;
-  if (recoveryStore && "requestId" in message && typeof message.requestId === "string" && recoveryStore.isUnknown(message.requestId))
-    return;
   const transportError = "error" in message && typeof message.error === "string" ? message.error : message.type === "workspace_sync_result" && message.result.outcome === "failed" ? message.result.error : void 0;
-  if (recoveryStore && transportError && isWorkerCommunicationFailure(transportError) && "requestId" in message && typeof message.requestId === "string") {
-    recoveryStore.unknown(message.requestId);
+  if (recoveryJournal && transportError && isWorkerCommunicationFailure(transportError) && "requestId" in message && typeof message.requestId === "string") {
+    recoveryJournal.unknown(message.requestId);
     currentWorkerSocket?.close(1012, "Communication recovery");
     return;
   }
-  const recorded = recoveryStore?.record(message) ?? message;
-  if ((message.type === "exec_exit" || message.type === "exec_error") && infrastructureStoppedRunIds.has(message.runId)) {
-    recoveryStore?.unknownRun(message.runId);
+  if (!recoveryJournal) {
+    sendReplayWorkerMessage(ws, message);
     return;
   }
-  if (message.type === "exec_output" && workerRecoveryId !== void 0) return;
-  sendReplayWorkerMessage(ws, recorded);
+  recoveryJournal.send(message);
+}
+function sendWorkerOutput(ws, frame) {
+  if (launcherFailureInProgress) return Promise.resolve();
+  if (!recoveryJournal) {
+    sendReplayWorkerMessage(ws, frame);
+    return Promise.resolve();
+  }
+  return recoveryJournal.sendOutput(frame);
+}
+function deliverJournaledWorkerMessage(message) {
+  const target = currentWorkerSocket;
+  if ((message.type === "exec_exit" || message.type === "exec_error") && typeof message.runId === "string" && infrastructureStoppedRunIds.has(message.runId)) {
+    recoveryJournal?.unknownRun(message.runId);
+    return true;
+  }
+  if (!target || target.readyState !== WebSocket.OPEN) return false;
+  if (message.type === "exec_output" && workerRecoveryId !== void 0) return false;
+  return sendReplayWorkerMessage(target, message);
 }
 function sendSerializedWorkerMessage(ws, serialized) {
   sendWorkerMessage(ws, JSON.parse(serialized));
@@ -3740,9 +3862,19 @@ async function startWorker(options, projectRuntime = {
 `);
   }
   const rootDir = path.resolve(options.rootDir ?? process.env.R5D_ROOT ?? defaultRootDir());
-  recoveryStore ??= new WorkerRecoveryStore(
-    path.join(rootDir, ".worker-recovery", createHash("sha256").update(`${baseUrl}\0${label}`).digest("hex"), "protocol.sqlite")
-  );
+  if (!recoveryJournal) {
+    const journal = await WorkerRecoveryJournal.open({
+      filename: path.join(
+        rootDir,
+        ".worker-recovery",
+        createHash("sha256").update(`${baseUrl}\0${label}`).digest("hex"),
+        "protocol.sqlite"
+      )
+    });
+    journal.deliver = deliverJournaledWorkerMessage;
+    journal.onFailure = handleRecoveryJournalFailure;
+    recoveryJournal = journal;
+  }
   const projectsRoot = path.join(rootDir, "projects");
   const syncRoot = path.join(rootDir, "sync");
   const workspaceShadowRoot = path.join(syncRoot, "workspace");
@@ -3845,7 +3977,6 @@ async function startWorker(options, projectRuntime = {
   const bearerAuthHeader = `Authorization: Bearer ${token}`;
   const workerCredentialUsername = credentialUsernameForAuthHeader(bearerAuthHeader);
   const projectBranchKey = (projectId, branchName) => `${projectId}\0${branchName}`;
-  const projectMountId = (projectId, branchName) => `project:${projectId}:${encodeURIComponent(branchName)}`;
   const projectPlanMountId = (projectId, branchName) => `plan:${projectId}:${encodeURIComponent(branchName)}`;
   const workspaceProjectRelativePath = (projectId, branchName) => path.posix.join("projects", projectId, "branches", encodeURIComponent(branchName));
   const workspacePlanRelativePath = (projectId, branchName) => path.posix.join("plans", projectId, encodeURIComponent(branchName));
@@ -3928,7 +4059,8 @@ async function startWorker(options, projectRuntime = {
       sourcePath: configuredProjectBranchPath(projectsRoot, project, branchName),
       planSourcePath: path.join(planRoot, project.projectId, ...branchName.split("/"))
     }));
-    removeProjectWorktrees({ projectRoot, branchNames: branches.map(({ branchName }) => branchName) });
+    const removed = removeProjectWorktrees({ projectsRoot, projectRoot, branchNames: branches.map(({ branchName }) => branchName) });
+    if (removed.stagedForCollectionPath) checkoutGarbageCollector.enqueue(removed.stagedForCollectionPath);
     for (const branch of branches) {
       fs.rmSync(branch.planSourcePath, { recursive: true, force: true });
       const key = projectBranchKey(project.projectId, branch.branchName);
@@ -4016,14 +4148,14 @@ async function startWorker(options, projectRuntime = {
       )
     };
   };
-  const stageDurableWorkspaceDeletions = () => {
+  const stageDurableWorkspaceDeletions = async () => {
     for (const deletion of projectWorkspaceState.pendingTreeDeletions) {
       const cleanupConfig = cleanupConfigForDurableDeletion(deletion);
       if (deletion.kind === "project") {
         if (!deletion.projectDeleted) {
           const nextProject = projectConfigById.get(deletion.projectId);
           if (!nextProject) throw new Error(`Checkout-path move lost desired project ${deletion.projectId}`);
-          preserveProjectCheckoutPathMove({
+          await workspaceFilesystemExecutor().run("project_checkout_path_move", {
             oldProjectRoot: deletion.managedPath,
             newProjectRoot: configuredProjectRoot(projectsRoot, nextProject),
             projectsDurabilityRoot: projectsRoot,
@@ -4390,7 +4522,7 @@ async function startWorker(options, projectRuntime = {
           }
         }
         if (transitionReseedRequired) {
-          projectWorkspaceState = projectWorkspaceStateStore.recordEnabledRepositoryTransition({
+          projectWorkspaceState = await projectWorkspaceStateStore.recordEnabledRepositoryTransition({
             projectId: project.projectId,
             transitionId: project.repositoryTransitionId
           });
@@ -4559,7 +4691,7 @@ async function startWorker(options, projectRuntime = {
       )
     ];
     if (publishedTombstoneIds.length > 0) {
-      projectWorkspaceState = projectWorkspaceStateStore.recordTreePublication({
+      projectWorkspaceState = await projectWorkspaceStateStore.recordTreePublication({
         tombstoneIds: publishedTombstoneIds,
         publishedHead
       });
@@ -4578,7 +4710,7 @@ async function startWorker(options, projectRuntime = {
         forgetLocalProjectMirrorRefsTokens(deletion.projectId, deletion.branchName);
       }
       if (deletion.tombstoneId && !deletion.projectDeleted) {
-        projectWorkspaceState = projectWorkspaceStateStore.recordMirrorRefDeletion({
+        projectWorkspaceState = await projectWorkspaceStateStore.recordMirrorRefDeletion({
           tombstoneId: deletion.tombstoneId,
           branchName: deletion.branchName
         });
@@ -4775,7 +4907,10 @@ async function startWorker(options, projectRuntime = {
     };
   };
   const workspaceHydrationTransactionHooks = createWorkspaceHydrationLeaseHooks(
-    (message) => sendWorkerMessageFromCurrentSource(ws, message)
+    (message) => sendWorkerMessageFromCurrentSource(ws, message),
+    {
+      fence: workspaceMountHoldFence
+    }
   );
   const performWorkspaceSync = async (input) => {
     if (!workspaceRemoteUrl || !workspaceCredentialHelper || !workspaceCredentialUsername || !workspaceGitIdentity) {
@@ -5433,7 +5568,7 @@ async function startWorker(options, projectRuntime = {
           (project) => project.preserveOnlyBranches.map(({ branchId, branchName }) => ({ branchId, projectId: project.projectId, branchName }))
         );
         if (!incidentDeferral.incidentId) {
-          projectWorkspaceState = projectWorkspaceStateStore.reconcile({
+          projectWorkspaceState = await projectWorkspaceStateStore.reconcile({
             desiredProjects: message.projects,
             preserveOnlyBranches
           });
@@ -5444,7 +5579,7 @@ async function startWorker(options, projectRuntime = {
               (candidate) => candidate.projectId === project.projectId && candidate.branchName === branch.branchName
             );
             if (pending2 && pending2.branchId === branch.branchId) {
-              projectWorkspaceState = projectWorkspaceStateStore.clearPendingCreatedBranch(pending2);
+              projectWorkspaceState = await projectWorkspaceStateStore.clearPendingCreatedBranch(pending2);
             }
           }
         }
@@ -5612,7 +5747,7 @@ async function startWorker(options, projectRuntime = {
         for (const projectId of [...readyProjectIds]) {
           if (!projectConfigById.has(projectId)) readyProjectIds.delete(projectId);
         }
-        stageDurableWorkspaceDeletions();
+        await stageDurableWorkspaceDeletions();
         const mountsBeforeGit = buildWorkspaceMounts();
         await hydrateWorkspaceGitMounts(
           workspaceShadowRoot,
@@ -5658,7 +5793,12 @@ async function startWorker(options, projectRuntime = {
         const connectSyncMs = Date.now() - connectSyncStartedAtMs;
         const result = syncResult.telemetry ? syncResult : {
           ...syncResult,
-          telemetry: { totalMs: connectSyncMs, queueMs: 0, prepareMs: lastWorkspaceSyncMirrorObservationMs, synchronizeMs: connectSyncMs }
+          telemetry: {
+            totalMs: connectSyncMs,
+            queueMs: 0,
+            prepareMs: lastWorkspaceSyncMirrorObservationMs,
+            synchronizeMs: connectSyncMs
+          }
         };
         assertConfigurationSyncStillAdmitted();
         if (receiptGeneration !== workspaceConfigurationReceiptGeneration) {
@@ -5677,7 +5817,7 @@ async function startWorker(options, projectRuntime = {
             ) ? [deletion.tombstoneId] : []
           );
           if (layoutCleanupIds.length > 0) {
-            projectWorkspaceState = projectWorkspaceStateStore.recordTreePublication({
+            projectWorkspaceState = await projectWorkspaceStateStore.recordTreePublication({
               tombstoneIds: layoutCleanupIds,
               publishedHead
             });
@@ -5784,26 +5924,33 @@ async function startWorker(options, projectRuntime = {
     if (startupProjectSnapshotRecoveryCompleted) return;
     sendLifecycleProgress({ phase: "recovering", operationId, detail: "Checking interrupted workspace transactions" });
     const snapshotRecovery = await workspaceSyncSingleFlight.runExclusive(
-      async () => await recoverProjectSnapshotsInChild({
-        projectsRoot,
-        snapshotRoot: projectWorktreeSnapshotsRoot,
-        onProgress: (progress) => {
-          const lifecycleProgress = {
-            phase: "recovering",
-            operationId,
-            detail: describeSnapshotProgress(progress),
-            completedBytes: progress.completedBytes,
-            completedItems: progress.completedBranches,
-            totalItems: progress.totalBranches,
-            ...progress.totalBytes === void 0 ? {} : { totalBytes: progress.totalBytes }
-          };
-          sendLifecycleProgress(lifecycleProgress);
-          process.stdout.write(
-            `[r5d-worker] ${lifecycleProgress.detail}: ${progress.completedBranches}/${progress.totalBranches} branch(es), ${progress.completedBytes}/${progress.totalBytes ?? "?"} bytes
+      async () => await workspaceFilesystemExecutor().run(
+        "project_snapshots_recover",
+        {
+          projectsRoot,
+          temporaryRoot: projectWorktreeSnapshotsRoot,
+          currentProcessId: process.pid,
+          currentOwnerSessionId: PROJECT_WORKTREE_SNAPSHOT_OWNER_SESSION_ID
+        },
+        {
+          onProgress: (progress) => {
+            const lifecycleProgress = {
+              phase: "recovering",
+              operationId,
+              detail: describeSnapshotProgress(progress),
+              completedBytes: progress.completedBytes,
+              completedItems: progress.completedBranches,
+              totalItems: progress.totalBranches,
+              ...progress.totalBytes === void 0 ? {} : { totalBytes: progress.totalBytes }
+            };
+            sendLifecycleProgress(lifecycleProgress);
+            process.stdout.write(
+              `[r5d-worker] ${lifecycleProgress.detail}: ${progress.completedBranches}/${progress.totalBranches} branch(es), ${progress.completedBytes}/${progress.totalBytes ?? "?"} bytes
 `
-          );
+            );
+          }
         }
-      })
+      )
     );
     if (snapshotRecovery.restored.length > 0) {
       process.stdout.write(`[r5d-worker] restored ${snapshotRecovery.restored.length} interrupted project snapshot(s)
@@ -5898,7 +6045,7 @@ async function startWorker(options, projectRuntime = {
       type: "hello",
       resumableProtocol: WORKER_RESUMABLE_PROTOCOL,
       runtimeId: workerRuntimeId,
-      ledgerId: recoveryStore.ledgerId,
+      ledgerId: recoveryJournal.ledgerId,
       startupReady: startupRecoveryComplete,
       hostInfo: {
         hostname: hostname(),
@@ -5926,16 +6073,39 @@ async function startWorker(options, projectRuntime = {
       }
     };
     sendSerializedWorkerMessage(ws, JSON.stringify(hello));
+    let outputPumpInFlight = false;
     outputReplayTimer = setInterval(() => {
-      if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws) return;
-      for (const output of recoveryStore.output()) {
-        if (!sendReplayWorkerMessage(ws, output)) break;
-      }
+      if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws || outputPumpInFlight || !recoveryJournal) return;
+      outputPumpInFlight = true;
+      void (async () => {
+        try {
+          for await (const page of recoveryJournal.outputReplay(void 0)) {
+            for (const output of page) {
+              if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws || !sendReplayWorkerMessage(ws, output)) return;
+            }
+          }
+        } catch (error) {
+          process.stderr.write(`[r5d-worker] output replay pump failed: ${error instanceof Error ? error.message : String(error)}
+`);
+        } finally {
+          outputPumpInFlight = false;
+        }
+      })();
     }, 250);
     outputReplayTimer.unref();
+    let terminalPumpInFlight = false;
     terminalReplayTimer = setInterval(() => {
-      if (workerRecoveryId !== void 0) return;
-      for (const terminal of recoveryStore?.terminals() ?? []) sendReplayWorkerMessage(ws, terminal);
+      if (workerRecoveryId !== void 0 || terminalPumpInFlight || !recoveryJournal) return;
+      terminalPumpInFlight = true;
+      void recoveryJournal.terminals().then((terminals) => {
+        if (workerRecoveryId !== void 0 || currentWorkerSocket !== ws) return;
+        for (const terminal of terminals) sendReplayWorkerMessage(ws, terminal);
+      }).catch((error) => {
+        process.stderr.write(`[r5d-worker] terminal replay pump failed: ${error instanceof Error ? error.message : String(error)}
+`);
+      }).finally(() => {
+        terminalPumpInFlight = false;
+      });
     }, 5e3);
     terminalReplayTimer.unref();
     process.stdout.write("[r5d-worker] connected\n");
@@ -5948,28 +6118,37 @@ async function startWorker(options, projectRuntime = {
       if (message.type === "recovery_request") {
         workerRecoveryId = message.recoveryId;
         sendActiveProcessReport(ws);
-        sendWorkerMessage(ws, {
-          type: "recovery_state",
-          recoveryId: message.recoveryId,
-          runtimeId: workerRuntimeId,
-          ledgerId: recoveryStore.ledgerId,
-          operations: recoveryStore.operations()
-        });
-        const cursors = new Map(recoveryStore.outputCursors().map((cursor) => [cursor.runId, cursor]));
-        for (const cursor of message.outputOffsets) cursors.set(cursor.runId, cursor);
-        workerOutputWindow.reset([...cursors.values()]);
-        for (const response of recoveryStore.responses(message.requests)) sendReplayWorkerMessage(ws, response);
-        for (const output of recoveryStore.output(message.outputOffsets)) {
-          while (true) {
-            if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId || ws.readyState !== WebSocket.OPEN || workerLeaseExpired)
-              return;
-            if (sendReplayWorkerMessage(ws, output)) break;
-            await Bun.sleep(10);
+        recoveryJournal.pauseDelivery();
+        try {
+          const state = await recoveryJournal.recoveryState(message.requests);
+          if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId) return;
+          sendWorkerMessage(ws, {
+            type: "recovery_state",
+            recoveryId: message.recoveryId,
+            runtimeId: workerRuntimeId,
+            ledgerId: recoveryJournal.ledgerId,
+            operations: state.operations
+          });
+          const cursors = new Map(state.cursors.map((cursor) => [cursor.runId, cursor]));
+          for (const cursor of message.outputOffsets) cursors.set(cursor.runId, cursor);
+          workerOutputWindow.reset([...cursors.values()]);
+          for (const response of state.responses) sendReplayWorkerMessage(ws, response);
+          for await (const page of recoveryJournal.outputReplay(message.outputOffsets)) {
+            for (const output of page) {
+              while (true) {
+                if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId || ws.readyState !== WebSocket.OPEN || workerLeaseExpired)
+                  return;
+                if (sendReplayWorkerMessage(ws, output)) break;
+                await Bun.sleep(10);
+              }
+            }
           }
+          if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId) return;
+          for (const terminal of state.terminals) sendReplayWorkerMessage(ws, terminal);
+          sendWorkerMessage(ws, { type: "recovery_complete", recoveryId: message.recoveryId });
+        } finally {
+          recoveryJournal.resumeDelivery();
         }
-        if (currentWorkerSocket !== ws || workerRecoveryId !== message.recoveryId) return;
-        for (const terminal of recoveryStore.terminals()) sendReplayWorkerMessage(ws, terminal);
-        sendWorkerMessage(ws, { type: "recovery_complete", recoveryId: message.recoveryId });
         return;
       }
       if (message.type === "recovery_ready") {
@@ -5984,17 +6163,23 @@ async function startWorker(options, projectRuntime = {
         return;
       }
       if (message.type === "operation_result_ack") {
-        recoveryStore.acknowledgeResult(message.requestId);
+        recoveryJournal.acknowledgeResult(message.requestId);
         return;
       }
       if (message.type === "exec_output_ack") {
-        recoveryStore.acknowledgeOutput(message.runId, message.stream, message.nextOffset);
+        recoveryJournal.acknowledgeOutput(message.runId, message.stream, message.nextOffset);
         workerOutputWindow.acknowledge(message.runId, message.stream, message.nextOffset);
         return;
       }
       if (message.type === "cancel_session") {
-        recoveryStore.cancelSession(message.sessionId);
+        const durableCancellation = recoveryJournal.cancelSession(message.sessionId);
+        abortPendingReservations("Session cancelled before command start", message.sessionId);
         await Promise.all([
+          durableCancellation,
+          // File writes already in flight for the session settle before the
+          // acknowledgement; queued ones re-check the cancellation before
+          // their first write and never start.
+          sessionFileMutations.settled(message.sessionId),
           workerCommandLauncher?.cancelSession(message.sessionId),
           ...[...activeProcesses].filter(([, active]) => active.sessionId === message.sessionId).map(async ([runId, active]) => {
             cancelledProcessRuns.add(runId);
@@ -6009,27 +6194,75 @@ async function startWorker(options, projectRuntime = {
       if (!startupRecoveryComplete && message.type !== "ping") return;
       if (currentWorkerSocket !== ws) return;
       const operationRequestId = "requestId" in message && typeof message.requestId === "string" && message.type !== "workspace_config" ? message.requestId : void 0;
+      if (message.type === "cancel") {
+        const admission = recoveryJournal.admit({ ...message, requestId: message.requestId });
+        const cancelled = await cancelProcessRun(message.runId, message.scope);
+        let admitted;
+        try {
+          admitted = await admission;
+        } catch (error) {
+          if (!(error instanceof WorkerRecoveryJournalBusyError)) throw error;
+          process.stderr.write(`[r5d-worker] cancel ${message.runId} stopped the run but was not durably admitted: ${error.message}
+`);
+          return;
+        }
+        if (admitted.admission === "conflict") {
+          ws.close(1008, "Operation identity conflict");
+          return;
+        }
+        sendWorkerMessage(ws, { type: "operation_received", requestId: message.requestId });
+        if (admitted.admission !== "new") {
+          if (admitted.response && admitted.admission !== "unknown") sendReplayWorkerMessage(ws, admitted.response);
+          return;
+        }
+        sendSerializedWorkerMessage(
+          ws,
+          JSON.stringify({
+            type: "cancel_result",
+            requestId: message.requestId,
+            runId: message.runId,
+            cancelled: cancelled.cancelled,
+            message: cancelled.message,
+            outcome: cancelled.outcome
+          })
+        );
+        return;
+      }
       if (operationRequestId) {
-        const admission = recoveryStore.admit({ ...message, requestId: operationRequestId });
-        if (admission === "conflict") {
+        let admitted;
+        try {
+          admitted = await recoveryJournal.admit({ ...message, requestId: operationRequestId });
+        } catch (error) {
+          if (!(error instanceof WorkerRecoveryJournalBusyError)) throw error;
+          process.stderr.write(`[r5d-worker] ${message.type} ${operationRequestId} was not admitted: ${error.message}
+`);
+          return;
+        }
+        if (admitted.admission === "conflict") {
           ws.close(1008, "Operation identity conflict");
           return;
         }
         sendWorkerMessage(ws, { type: "operation_received", requestId: operationRequestId });
-        if (admission !== "new") {
-          const response = recoveryStore.response(operationRequestId);
-          if (response && admission !== "unknown") sendReplayWorkerMessage(ws, response);
-          if (!(admission === "unknown" && message.type === "delete_project_branch" && recoveryStore.readmitUnknownBranchDeletion(operationRequestId))) {
+        if (admitted.admission !== "new") {
+          if (admitted.response && admitted.admission !== "unknown") sendReplayWorkerMessage(ws, admitted.response);
+          if (!(admitted.admission === "unknown" && message.type === "delete_project_branch" && await recoveryJournal.readmitUnknownBranchDeletion(
+            operationRequestId,
+            "sessionId" in message && typeof message.sessionId === "string" ? message.sessionId : void 0
+          ))) {
             return;
           }
         }
+        if (recoveryJournal.isRequestCancelled(operationRequestId)) {
+          recoveryJournal.unknown(operationRequestId);
+          return;
+        }
       }
       const messageAdmissionGeneration = workerAdmissionGeneration;
       const admissionCredentials = configuredCredentialGenerationFingerprint;
       const assertMessageAdmission = () => {
         if (operationRequestId) {
-          if (workerLeaseExpired || recoveryStore.isRequestCancelled(operationRequestId) || admissionCredentials !== configuredCredentialGenerationFingerprint || shutdownAfterClose || !workspaceConfigured) {
-            recoveryStore.unknown(operationRequestId);
+          if (workerLeaseExpired || recoveryJournal.isRequestCancelled(operationRequestId) || admissionCredentials !== configuredCredentialGenerationFingerprint || shutdownAfterClose || !workspaceConfigured) {
+            recoveryJournal.unknown(operationRequestId);
             throw new StaleWorkerAdmissionError();
           }
           return;
@@ -6166,7 +6399,7 @@ async function startWorker(options, projectRuntime = {
           }
           recoveryDeadline ??= Date.now() + WORKER_RECOVERY_TIMEOUT_MS;
           if (workerLeaseExpired || Date.now() >= recoveryDeadline) {
-            recoveryStore.unknown(message.requestId);
+            recoveryJournal.unknown(message.requestId);
             return;
           }
           currentWorkerSocket?.close(1012, "Communication recovery");
@@ -6196,7 +6429,7 @@ async function startWorker(options, projectRuntime = {
             projectId: message.projectId,
             branchName: message.targetBranch
           };
-          const created = await workspaceSyncSingleFlight.runBranchMutation(() => {
+          const created = await workspaceSyncSingleFlight.runBranchMutation(async () => {
             if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
               throw new Error(
                 `Project branch creation was fenced while queued by workspace incident ${deferredWorkspaceConfiguration?.incidentId ?? activeWorkspaceIncidentId}`
@@ -6211,7 +6444,7 @@ async function startWorker(options, projectRuntime = {
             const pendingWasRecorded = projectWorkspaceState.locallyPendingCreatedBranches.some(
               ({ projectId, branchName }) => projectId === message.projectId && branchName === message.targetBranch
             );
-            projectWorkspaceState = projectWorkspaceStateStore.recordPendingCreatedBranch(pendingBranch);
+            projectWorkspaceState = await projectWorkspaceStateStore.recordPendingCreatedBranch(pendingBranch);
             let gitBranchCreated = false;
             try {
               if (!readyProjectIds.has(project.projectId)) {
@@ -6232,7 +6465,7 @@ async function startWorker(options, projectRuntime = {
                 }
                 return { branchPath: existingPath, baseCommitHash: existingBranch.baseCommitHash };
               }
-              const createdBranch = createOrRetryLinkedProjectBranch({
+              const createdBranch = await createOrRetryLinkedProjectBranch({
                 projectRoot: configuredProjectRoot(projectsRoot, project),
                 primaryBranchName: primaryProjectBranch(project),
                 sourceBranchName: message.sourceBranch,
@@ -6257,7 +6490,7 @@ async function startWorker(options, projectRuntime = {
               return createdBranch;
             } catch (error) {
               if (!pendingWasRecorded && !gitBranchCreated && !projectBranchMayExistAfterCreateFailure(error)) {
-                projectWorkspaceState = projectWorkspaceStateStore.rollbackPendingCreatedBranch(pendingBranch);
+                projectWorkspaceState = await projectWorkspaceStateStore.rollbackPendingCreatedBranch(pendingBranch);
               }
               throw error;
             }
@@ -6301,7 +6534,7 @@ async function startWorker(options, projectRuntime = {
         });
         try {
           const deletionKey = projectBranchKey(message.projectId, message.branchName);
-          const deletionNeedsSync = await workspaceSyncSingleFlight.runBranchMutation(() => {
+          const deletionNeedsSync = await workspaceSyncSingleFlight.runBranchMutation(async () => {
             if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
               throw new Error(
                 `Project branch deletion was fenced while queued by workspace incident ${deferredWorkspaceConfiguration?.incidentId ?? activeWorkspaceIncidentId}`
@@ -6328,12 +6561,12 @@ async function startWorker(options, projectRuntime = {
             if (!configuredBranch && !pendingLocalBranch && !hasDurableTombstone && !pendingMirrorDeletes.has(deletionKey)) {
               return false;
             }
-            projectWorkspaceState = projectWorkspaceStateStore.beginBranchDeletion({
+            projectWorkspaceState = await projectWorkspaceStateStore.beginBranchDeletion({
               projectId: message.projectId,
               branchName: message.branchName
             });
             if (pendingLocalBranch) {
-              projectWorkspaceState = projectWorkspaceStateStore.clearPendingCreatedBranch(pendingLocalBranch);
+              projectWorkspaceState = await projectWorkspaceStateStore.clearPendingCreatedBranch(pendingLocalBranch);
             }
             pendingCreatedBranchPublicationNotBefore.delete(pendingCreatedBranchKey(message.projectId, message.branchName));
             if (pendingMirrorDeletes.has(deletionKey)) return true;
@@ -6437,7 +6670,7 @@ async function startWorker(options, projectRuntime = {
       }
       if (message.type === "exec_terminal_ack") {
         pendingProcessTerminals.delete(message.runId);
-        recoveryStore.acknowledgeTerminal(message.runId);
+        recoveryJournal.acknowledgeTerminal(message.runId);
         return;
       }
       if (message.type === "port_forward_connect") {
@@ -6492,42 +6725,6 @@ async function startWorker(options, projectRuntime = {
         sendSerializedWorkerMessage(ws, JSON.stringify({ type: "pong" }));
         return;
       }
-      if (message.type === "cancel") {
-        let resourceCancellationError;
-        try {
-          await workerCommandLauncher?.cancel(message.runId);
-        } catch (error) {
-          resourceCancellationError = error instanceof Error ? error.message : String(error);
-        }
-        const active = activeProcesses.get(message.runId);
-        let cancelled = resourceCancellationError === void 0;
-        let cancelMessage;
-        if (active) {
-          try {
-            closeProcessStdin(active);
-            await terminateProcessTree(active.process);
-            cancelMessage = `Stopped ${active.command}`;
-          } catch (error) {
-            cancelled = false;
-            cancelMessage = `Failed to stop ${active.command}: ${error instanceof Error ? error.message : String(error)}`;
-          }
-        } else {
-          cancelledProcessRuns.add(message.runId);
-          cancelMessage = "Cancellation queued before command start";
-        }
-        if (resourceCancellationError) cancelMessage += `; job resource termination failed: ${resourceCancellationError}`;
-        sendSerializedWorkerMessage(
-          ws,
-          JSON.stringify({
-            type: "cancel_result",
-            requestId: message.requestId,
-            runId: message.runId,
-            cancelled,
-            message: cancelMessage
-          })
-        );
-        return;
-      }
       if (message.type === "exec_stdin") {
         const sendAck = (payload) => sendSerializedWorkerMessage(
           ws,
@@ -6608,10 +6805,20 @@ async function startWorker(options, projectRuntime = {
         let mutationLeaseTransferred = false;
         try {
           resources = await acquireWorkerCommandLaunch(ws, message, assertMessageAdmission);
-          await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
-            workspaceSyncPriorityPtyTargets.set(message.ptyId, message.target);
-            if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
-          });
+          const reservationAbort = registerPendingReservation(`pty:${message.ptyId}`, void 0);
+          try {
+            await reserveWorkspaceCommandAfterCurrentSync(
+              message.target,
+              workspaceSyncSingleFlight,
+              () => {
+                workspaceSyncPriorityPtyTargets.set(message.ptyId, message.target);
+                if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
+              },
+              { signal: reservationAbort.signal }
+            );
+          } finally {
+            unregisterPendingReservation(`pty:${message.ptyId}`, reservationAbort);
+          }
           releaseWorkspaceMutation = await acquireWorkspaceCommandMutation(message.target, workspaceSyncSingleFlight);
           if (workspaceOperationsAreFenced(deferredWorkspaceConfiguration, activeWorkspaceIncidentId)) {
             throw new Error(
@@ -6676,6 +6883,7 @@ async function startWorker(options, projectRuntime = {
       }
       if (message.type === "pty_close") {
         const activePty = activePtys.get(message.ptyId);
+        abortPendingReservation(`pty:${message.ptyId}`, "Shell closed before it started");
         await closePty(message);
         if (activePty && targetMayMutateVisibleWorkspace(activePty.target)) {
           markWorkspaceDirty({ type: "process_terminal", detail: `pty ${message.ptyId} closed` }, true, activePty.target);
@@ -6712,11 +6920,21 @@ async function startWorker(options, projectRuntime = {
         try {
           resources = await acquireWorkerCommandLaunch(ws, message, assertMessageAdmission);
           if (hasWorkspaceEffect) {
-            await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
-              workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
-              targetReserved = true;
-              if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
-            });
+            const reservationAbort = registerPendingReservation(`run:${message.runId}`, message.sessionId);
+            try {
+              await reserveWorkspaceCommandAfterCurrentSync(
+                message.target,
+                workspaceSyncSingleFlight,
+                () => {
+                  workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
+                  targetReserved = true;
+                  if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
+                },
+                { signal: reservationAbort.signal }
+              );
+            } finally {
+              unregisterPendingReservation(`run:${message.runId}`, reservationAbort);
+            }
           }
           const runCommand = async () => {
             if (!workspaceCommandTransportIsAllowed(deferredWorkspaceConfiguration, activeWorkspaceIncidentId, "exec")) {
@@ -6768,7 +6986,7 @@ async function startWorker(options, projectRuntime = {
           cancelledProcessRuns.delete(message.runId);
         }
         if (infrastructureStoppedRunIds.has(message.runId)) {
-          recoveryStore.unknown(message.requestId);
+          recoveryJournal.unknown(message.requestId);
           return;
         }
         sendSerializedWorkerMessage(ws, JSON.stringify(result));
@@ -6842,11 +7060,21 @@ async function startWorker(options, projectRuntime = {
           try {
             resources = await acquireWorkerCommandLaunch(ws, message, assertMessageAdmission);
             if (hasWorkspaceEffect) {
-              await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
-                workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
-                targetReserved = true;
-                if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
-              });
+              const reservationAbort = registerPendingReservation(`run:${message.runId}`, message.sessionId);
+              try {
+                await reserveWorkspaceCommandAfterCurrentSync(
+                  message.target,
+                  workspaceSyncSingleFlight,
+                  () => {
+                    workspaceSyncPriorityProcessTargets.set(message.runId, message.target);
+                    targetReserved = true;
+                    if (targetMayMutateVisibleWorkspace(message.target)) recordVisibleWorkspaceMutation(message.target);
+                  },
+                  { signal: reservationAbort.signal }
+                );
+              } finally {
+                unregisterPendingReservation(`run:${message.runId}`, reservationAbort);
+              }
             }
             await runReservedWorkspaceCommand(message.target, workspaceSyncSingleFlight, runCommand, () => {
               if (targetReserved) {
@@ -6881,16 +7109,40 @@ async function startWorker(options, projectRuntime = {
           return;
         }
         const reservesVisibleWorkspace = targetMayMutateVisibleWorkspace(message.target);
-        const mutatesVisibleWorkspace = (message.type === "write" || message.type === "edit" || message.type === "update_task_status" || message.type === "read_plan" && message.createIfMissing) && targetMayMutateVisibleWorkspace(message.target);
+        const mutatesFiles = message.type === "write" || message.type === "edit" || message.type === "update_task_status" || message.type === "read_plan" && message.createIfMissing;
+        const mutatesVisibleWorkspace = mutatesFiles && targetMayMutateVisibleWorkspace(message.target);
         if (reservesVisibleWorkspace) {
-          await reserveWorkspaceCommandAfterCurrentSync(message.target, workspaceSyncSingleFlight, () => {
-            workspaceSyncPriorityOperationTargets.set(message.requestId, message.target);
-            if (mutatesVisibleWorkspace) recordVisibleWorkspaceMutation(message.target);
-          });
+          const reservationAbort = registerPendingReservation(
+            `op:${message.requestId}`,
+            "sessionId" in message && typeof message.sessionId === "string" ? message.sessionId : void 0
+          );
+          try {
+            await reserveWorkspaceCommandAfterCurrentSync(
+              message.target,
+              workspaceSyncSingleFlight,
+              () => {
+                workspaceSyncPriorityOperationTargets.set(message.requestId, message.target);
+                if (mutatesVisibleWorkspace) recordVisibleWorkspaceMutation(message.target);
+              },
+              { signal: reservationAbort.signal }
+            );
+          } catch (error) {
+            sendSerializedWorkerMessage(
+              ws,
+              JSON.stringify({
+                type: "operation_result",
+                requestId: message.requestId,
+                error: error instanceof Error ? error.message : String(error)
+              })
+            );
+            return;
+          } finally {
+            unregisterPendingReservation(`op:${message.requestId}`, reservationAbort);
+          }
         }
         let dirtyTrigger;
         try {
-          const result = await runWorkspaceCommand(message.target, workspaceSyncSingleFlight, async () => {
+          const operation = runWorkspaceCommand(message.target, workspaceSyncSingleFlight, async () => {
             const resolvedTarget = resolveMessageTarget(message.target);
             return await executeOperation({
               message,
@@ -6901,6 +7153,8 @@ async function startWorker(options, projectRuntime = {
               assertAdmission: assertMessageAdmission
             });
           });
+          if (mutatesFiles && typeof message.sessionId === "string") sessionFileMutations.track(message.sessionId, operation);
+          const result = await operation;
           sendSerializedWorkerMessage(
             ws,
             JSON.stringify({
@@ -6984,6 +7238,7 @@ async function startWorker(options, projectRuntime = {
       projectRuntime.configuration.deferred = deferredWorkspaceConfiguration;
     }
     if (currentWorkerSocket === ws) currentWorkerSocket = null;
+    abortPendingReservations("Worker connection closed before command start");
     workerRecoveryId = "reconnecting";
     const reason = event.reason ? `: ${event.reason}` : "";
     process.stderr.write(`[r5d-worker] disconnected (${event.code}${reason})
@@ -7017,6 +7272,11 @@ async function startWorker(options, projectRuntime = {
   });
 }
 function installWorkerRuntimeFailureLogging() {
+  installWorkspaceFilesystemExecutorFailureHandler((error) => {
+    process.stderr.write(`[r5d-worker] ${error.message}; restarting the worker runtime
+`);
+    void exitWorkerRuntime(WORKER_RECONNECT_EXIT_CODE);
+  });
   process.on("uncaughtException", (error) => {
     process.stderr.write(`[r5d-worker] uncaught exception: ${error instanceof Error ? error.stack ?? error.message : String(error)}
 `);
@@ -7029,11 +7289,6 @@ function installWorkerRuntimeFailureLogging() {
   });
 }
 async function main() {
-  if (process.argv[2] === PROJECT_SNAPSHOT_RECOVERY_HELPER_COMMAND) {
-    const exitCode2 = runProjectSnapshotRecoveryHelper(process.argv.slice(3));
-    if (exitCode2 !== 0) process.exit(exitCode2);
-    return;
-  }
   const parsed = parseArgs(process.argv.slice(2));
   if (parsed.command === "help") {
     printHelp();