deepline 0.3.293 → 0.3.295

package/dist/bundling-sources/sdk/src/compat.ts

@@ -1,5 +1,13 @@
 import { SDK_API_CONTRACT, SDK_API_MAJOR, SDK_VERSION } from './version.js';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync,
+} from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 import { sdkCliStateDirPath } from './config.js';
@@ -96,6 +104,21 @@ type CompatCacheFile = {
   >;
 };
 
+function writeCompatibilityCacheFile(
+  path: string,
+  cache: CompatCacheFile,
+): void {
+  mkdirSync(dirname(path), { recursive: true });
+  const tempPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync(tempPath, `${JSON.stringify(cache, null, 2)}\n`);
+    // Concurrent CLI processes must never see a partially written policy.
+    renameSync(tempPath, path);
+  } finally {
+    rmSync(tempPath, { force: true });
+  }
+}
+
 function shouldSkipCompatibilityCheck(): boolean {
   const value =
     process.env.DEEPLINE_SKIP_SDK_COMPAT_CHECK?.trim().toLowerCase();
@@ -273,7 +296,7 @@ function invalidateCachedCompatibility(
     const entries = existing.entries ?? {};
     delete entries[compatibilityCacheKey(baseUrl, command, skillsVersion)];
     delete entries[legacyCompatibilityCacheKey(baseUrl, command)];
-    writeFileSync(cachePath, `${JSON.stringify({ entries }, null, 2)}\n`);
+    writeCompatibilityCacheFile(cachePath, { entries });
   } catch {
     // A cache that cannot be edited simply expires on its own TTL.
   }
@@ -287,16 +310,21 @@ function writeCachedCompatibility(
 ): void {
   try {
     const path = sdkCompatibilityCachePath(baseUrl);
-    const existing = existsSync(path)
-      ? (JSON.parse(readFileSync(path, 'utf8')) as CompatCacheFile)
-      : {};
+    let existing: CompatCacheFile = {};
+    if (existsSync(path)) {
+      try {
+        existing = JSON.parse(readFileSync(path, 'utf8')) as CompatCacheFile;
+      } catch {
+        // A failed or overlapping old write can corrupt the optional cache.
+        // Replace it with this live policy instead of failing every future write.
+      }
+    }
     const entries = existing.entries ?? {};
     entries[compatibilityCacheKey(baseUrl, command, skillsVersion)] = {
       savedAt: Date.now(),
       response,
     };
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify({ entries }, null, 2)}\n`);
+    writeCompatibilityCacheFile(path, { entries });
   } catch {
     // Compatibility checks are advisory unless the server explicitly responds
     // with a blocking policy. Cache failures must not block normal CLI usage.

package/dist/bundling-sources/sdk/src/release.ts

@@ -200,7 +200,7 @@ export const SDK_RELEASE = {
   // getters keep their established compatibility behavior.
   // 0.3.1 deprecated the legacy `deepline enrich` command in favor of Plays.
   // 0.3.90 is the first deliberately versioned SDK release for API v3.
-  version: '0.3.293',
+  version: '0.3.295',
   updateSummary:
     'Play grep now returns concise results with the matched fields and terms. Automatic CLI updates are enabled by default; use `deepline settings autoupdate off` to opt out, `deepline settings autoupdate on` to re-enable updates, or `deepline settings autoupdate pin <version>` to hold an exact release.',
   packageCapabilities: {

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-pool.ts

@@ -374,12 +374,13 @@ export class RuntimeSchedulerPoolAdmission {
   acquire(
     priority: RuntimeSchedulerPoolPriority,
     signal?: AbortSignal,
+    remainingWaitMs: number = this.maxWaitMs,
   ): Promise<() => void> {
     throwIfSchedulerAborted(signal);
     if (this.#active < this.maxActive && this.waitingCount === 0) {
       return Promise.resolve(this.#grant());
     }
-    if (this.waitingCount >= this.maxWaiting) {
+    if (remainingWaitMs <= 0 || this.waitingCount >= this.maxWaiting) {
       throw new RuntimeSchedulerSaturatedError(this.waitingCount);
     }
     return new Promise((resolve, reject) => {
@@ -388,13 +389,16 @@ export class RuntimeSchedulerPoolAdmission {
         resolve,
         reject,
         signal,
-        timeout: setTimeout(() => {
-          const index = this.#waiting[priority].indexOf(waiter);
-          if (index < 0) return;
-          this.#waiting[priority].splice(index, 1);
-          signal?.removeEventListener('abort', waiter.onAbort!);
-          reject(new RuntimeSchedulerSaturatedError(this.waitingCount));
-        }, this.maxWaitMs),
+        timeout: setTimeout(
+          () => {
+            const index = this.#waiting[priority].indexOf(waiter);
+            if (index < 0) return;
+            this.#waiting[priority].splice(index, 1);
+            signal?.removeEventListener('abort', waiter.onAbort!);
+            reject(new RuntimeSchedulerSaturatedError(this.waitingCount));
+          },
+          Math.max(0, Math.min(this.maxWaitMs, remainingWaitMs)),
+        ),
       };
       waiter.onAbort = () => {
         const index = this.#waiting[priority].indexOf(waiter);
@@ -942,291 +946,289 @@ export async function withRuntimeSchedulerClient<T>(
     ),
   );
   const operationStartedAt = performance.now();
-  const admissionStartedAt = performance.now();
-  let releaseAdmission: () => void;
-  try {
-    releaseAdmission = await entry.admission.acquire(
-      trace?.priority ?? 'ordinary',
-      signal,
-    );
-  } catch (error) {
-    if (
-      error instanceof RuntimeSchedulerSaturatedError &&
-      !(signal?.aborted && signal.reason === error)
-    ) {
-      recordAdmissionSaturation(
-        entry,
-        trace?.priority ?? 'ordinary',
-        performance.now() - admissionStartedAt,
-      );
-    }
-    throw error;
-  }
-  const admissionWaitMs = performance.now() - admissionStartedAt;
-  let unsampledAdmissionWaitMs = admissionWaitMs;
+  let admissionWaitMs = 0;
+  let unsampledAdmissionWaitMs = 0;
   let lastError: unknown = null;
-  try {
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
     throwIfSchedulerAborted(signal);
-    for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    if (attempt > 0) {
+      await sleep(jitteredBackoffMs(attempt - 1));
       throwIfSchedulerAborted(signal);
-      const halfOpenProbe = breakerGate(entry);
-      let capacityObserved = false;
+    }
+    const admissionStartedAt = performance.now();
+    let releaseAdmission: () => void;
+    try {
+      releaseAdmission = await entry.admission.acquire(
+        trace?.priority ?? 'ordinary',
+        signal,
+        entry.admission.maxWaitMs - admissionWaitMs,
+      );
+    } catch (error) {
+      if (
+        error instanceof RuntimeSchedulerSaturatedError &&
+        !(signal?.aborted && signal.reason === error)
+      ) {
+        recordAdmissionSaturation(
+          entry,
+          trace?.priority ?? 'ordinary',
+          performance.now() - admissionStartedAt,
+        );
+      }
+      throw error;
+    }
+    const attemptAdmissionWaitMs = performance.now() - admissionStartedAt;
+    admissionWaitMs += attemptAdmissionWaitMs;
+    unsampledAdmissionWaitMs += attemptAdmissionWaitMs;
+    let halfOpenProbe: symbol | null = null;
+    let capacityObserved = false;
+    try {
+      halfOpenProbe = breakerGate(entry);
+      if (entry.pool.waitingCount >= entry.maxAcquireQueueDepth) {
+        entry.stats.saturationRejections += 1;
+        throw new RuntimeSchedulerSaturatedError(entry.pool.waitingCount);
+      }
+      const acquireStart = performance.now();
+      entry.stats.peakTotalClients = Math.max(
+        entry.stats.peakTotalClients,
+        entry.pool.totalCount,
+      );
+      entry.stats.peakWaitingClients = Math.max(
+        entry.stats.peakWaitingClients,
+        entry.pool.waitingCount,
+      );
+      let poolClient;
       try {
-        if (entry.pool.waitingCount >= entry.maxAcquireQueueDepth) {
+        poolClient = await entry.pool.connect();
+      } catch (error) {
+        if (isRuntimeSchedulerLocalAcquireTimeout(error)) {
           entry.stats.saturationRejections += 1;
+          console.warn('[runtime-scheduler-pool.local_acquire_saturated]', {
+            maxClients: entry.maxClients,
+            totalClients: entry.pool.totalCount,
+            idleClients: entry.pool.idleCount,
+            waitingClients: entry.pool.waitingCount,
+          });
           throw new RuntimeSchedulerSaturatedError(entry.pool.waitingCount);
         }
-        const acquireStart = performance.now();
-        entry.stats.peakTotalClients = Math.max(
-          entry.stats.peakTotalClients,
-          entry.pool.totalCount,
-        );
-        entry.stats.peakWaitingClients = Math.max(
-          entry.stats.peakWaitingClients,
-          entry.pool.waitingCount,
+        if (isPgBouncerCapacityError(error)) {
+          recordCapacityRejection(entry, error);
+          capacityObserved = true;
+          throw new RuntimeSchedulerPgBouncerCapacityError(
+            error instanceof Error ? error.message : String(error),
+          );
+        }
+        recordBreakerFailure(entry, error, halfOpenProbe);
+        entry.stats.connectionErrors += 1;
+        lastError = error;
+        if (attempt + 1 < maxAttempts) {
+          entry.stats.retries += 1;
+          continue;
+        }
+        throw error;
+      }
+      entry.stats.acquires += 1;
+      const acquireWaitMs = performance.now() - acquireStart;
+      entry.stats.peakTotalClients = Math.max(
+        entry.stats.peakTotalClients,
+        entry.pool.totalCount,
+      );
+      // The admission gate owns the local queue before pg.Pool sees this
+      // checkout. Carry waits from failed checkouts forward and include each
+      // admission wait once when a client is acquired.
+      pushSample(
+        entry.stats.acquireWait,
+        unsampledAdmissionWaitMs + acquireWaitMs,
+      );
+      unsampledAdmissionWaitMs = 0;
+
+      // A checked-out pg client emits 'error' (not via the pool) when its TCP
+      // connection dies while idle — e.g. a worker holding a client across a
+      // long play execution. With no listener that is an uncaught exception
+      // that kills the process (observed: worker crash mid-150k-row run).
+      // Swallow it here; the next query on the dead client fails normally and
+      // flows through the connection-error retry/poison path below.
+      let checkedOutError: unknown = null;
+      const onCheckedOutError = (error: Error) => {
+        checkedOutError = error;
+        entry.stats.connectionErrors += 1;
+        console.warn('[runtime-scheduler-pool.checked_out_client_error]', {
+          error: error.message,
+        });
+      };
+      poolClient.on('error', onCheckedOutError);
+      let clientReleased = false;
+      const releasePoolClient = (error?: Error) => {
+        if (clientReleased) return;
+        clientReleased = true;
+        poolClient.release(error);
+      };
+      const onAbort = () => releasePoolClient(schedulerAbortReason(signal!));
+      signal?.addEventListener('abort', onAbort, { once: true });
+
+      let queryCount = 0;
+      let queryMs = 0;
+      try {
+        if (!entry.databasePoolAttached) {
+          attachDatabasePool(entry.pool);
+          entry.databasePoolAttached = true;
+        }
+        throwIfSchedulerAborted(signal);
+        const result = await fn({
+          query: async (sql, params) => {
+            throwIfSchedulerAborted(signal);
+            const queryStartedAt = performance.now();
+            queryCount += 1;
+            try {
+              try {
+                const queryResult = await poolClient.query(sql, params);
+                throwIfSchedulerAborted(signal);
+                return { rows: queryResult.rows };
+              } catch (error) {
+                // node-postgres' query timeout and an AbortSignal reject the
+                // promise, but the server may still be processing the SQL.
+                // Never return that socket to the pool: doing so lets the
+                // next retry overlap the first statement on the same backend.
+                if (isRuntimeSchedulerQueryCancellationError(error)) {
+                  releasePoolClient(
+                    error instanceof Error ? error : new Error(String(error)),
+                  );
+                }
+                throw error;
+              }
+            } finally {
+              queryMs += performance.now() - queryStartedAt;
+            }
+          },
+        });
+        throwIfSchedulerAborted(signal);
+        recordBreakerSuccess(entry);
+        signal?.removeEventListener('abort', onAbort);
+        poolClient.removeListener('error', onCheckedOutError);
+        // The connection died mid-fn but fn happened to finish without another
+        // query — destroy the dead connection rather than pooling it.
+        releasePoolClient(
+          checkedOutError instanceof Error ? checkedOutError : undefined,
         );
-        let poolClient;
-        try {
-          poolClient = await entry.pool.connect();
-        } catch (error) {
-          if (isRuntimeSchedulerLocalAcquireTimeout(error)) {
-            entry.stats.saturationRejections += 1;
-            console.warn('[runtime-scheduler-pool.local_acquire_saturated]', {
-              maxClients: entry.maxClients,
-              totalClients: entry.pool.totalCount,
-              idleClients: entry.pool.idleCount,
-              waitingClients: entry.pool.waitingCount,
-            });
-            throw new RuntimeSchedulerSaturatedError(entry.pool.waitingCount);
-          }
-          if (isPgBouncerCapacityError(error)) {
-            recordCapacityRejection(entry, error);
-            capacityObserved = true;
-            throw new RuntimeSchedulerPgBouncerCapacityError(
-              error instanceof Error ? error.message : String(error),
-            );
-          }
+        if (trace) {
+          console.info(
+            '[runtime-scheduler-pool.operation] ' +
+              JSON.stringify({
+                runId: trace.runId,
+                phase: trace.phase,
+                outcome: 'success',
+                attempt: attempt + 1,
+                priority: trace.priority ?? 'ordinary',
+                admissionWaitMs,
+                acquireWaitMs,
+                queryCount,
+                queryMs,
+                totalMs: performance.now() - operationStartedAt,
+              }),
+          );
+        }
+        return result;
+      } catch (error) {
+        if (trace) {
+          console.info(
+            '[runtime-scheduler-pool.operation] ' +
+              JSON.stringify({
+                runId: trace.runId,
+                phase: trace.phase,
+                outcome: 'failed',
+                attempt: attempt + 1,
+                priority: trace.priority ?? 'ordinary',
+                admissionWaitMs,
+                acquireWaitMs,
+                queryCount,
+                queryMs,
+                totalMs: performance.now() - operationStartedAt,
+                errorName: error instanceof Error ? error.name : 'UnknownError',
+              }),
+          );
+        }
+        signal?.removeEventListener('abort', onAbort);
+        poolClient.removeListener('error', onCheckedOutError);
+        if (signal?.aborted) {
+          const cancellation = schedulerAbortReason(signal);
+          releasePoolClient(cancellation);
+          throw cancellation;
+        }
+        if (isPgBouncerCapacityError(error)) {
+          recordCapacityRejection(entry, error);
+          capacityObserved = true;
+          releasePoolClient();
+          throw new RuntimeSchedulerPgBouncerCapacityError(
+            error instanceof Error ? error.message : String(error),
+          );
+        }
+        if (isRuntimeSchedulerQueryCancellationError(error)) {
+          entry.stats.queryErrors += 1;
+          recordBreakerSuccess(entry);
+          releasePoolClient(
+            error instanceof Error ? error : new Error(String(error)),
+          );
+          throw error;
+        }
+        if (isConnectionCategoryError(error)) {
           recordBreakerFailure(entry, error, halfOpenProbe);
           entry.stats.connectionErrors += 1;
           lastError = error;
+          // Destroy the broken connection instead of returning it to the pool.
+          releasePoolClient(
+            error instanceof Error ? error : new Error(String(error)),
+          );
           if (attempt + 1 < maxAttempts) {
             entry.stats.retries += 1;
-            await sleep(jitteredBackoffMs(attempt));
-            throwIfSchedulerAborted(signal);
             continue;
           }
           throw error;
         }
-        entry.stats.acquires += 1;
-        const acquireWaitMs = performance.now() - acquireStart;
-        entry.stats.peakTotalClients = Math.max(
-          entry.stats.peakTotalClients,
-          entry.pool.totalCount,
-        );
-        // The admission gate owns the local queue before pg.Pool sees this
-        // checkout. Include that wait once, on the operation's first acquired
-        // client; retries retain the permit and only add their own connect wait.
-        pushSample(
-          entry.stats.acquireWait,
-          unsampledAdmissionWaitMs + acquireWaitMs,
-        );
-        unsampledAdmissionWaitMs = 0;
-
-        // A checked-out pg client emits 'error' (not via the pool) when its TCP
-        // connection dies while idle — e.g. a worker holding a client across a
-        // long play execution. With no listener that is an uncaught exception
-        // that kills the process (observed: worker crash mid-150k-row run).
-        // Swallow it here; the next query on the dead client fails normally and
-        // flows through the connection-error retry/poison path below.
-        let checkedOutError: unknown = null;
-        const onCheckedOutError = (error: Error) => {
-          checkedOutError = error;
-          entry.stats.connectionErrors += 1;
-          console.warn('[runtime-scheduler-pool.checked_out_client_error]', {
-            error: error.message,
-          });
-        };
-        poolClient.on('error', onCheckedOutError);
-        let clientReleased = false;
-        const releasePoolClient = (error?: Error) => {
-          if (clientReleased) return;
-          clientReleased = true;
-          poolClient.release(error);
-        };
-        const onAbort = () => releasePoolClient(schedulerAbortReason(signal!));
-        signal?.addEventListener('abort', onAbort, { once: true });
-
-        let queryCount = 0;
-        let queryMs = 0;
-        try {
-          if (!entry.databasePoolAttached) {
-            attachDatabasePool(entry.pool);
-            entry.databasePoolAttached = true;
-          }
-          throwIfSchedulerAborted(signal);
-          const result = await fn({
-            query: async (sql, params) => {
-              throwIfSchedulerAborted(signal);
-              const queryStartedAt = performance.now();
-              queryCount += 1;
-              try {
-                try {
-                  const queryResult = await poolClient.query(sql, params);
-                  throwIfSchedulerAborted(signal);
-                  return { rows: queryResult.rows };
-                } catch (error) {
-                  // node-postgres' query timeout and an AbortSignal reject the
-                  // promise, but the server may still be processing the SQL.
-                  // Never return that socket to the pool: doing so lets the
-                  // next retry overlap the first statement on the same backend.
-                  if (isRuntimeSchedulerQueryCancellationError(error)) {
-                    releasePoolClient(
-                      error instanceof Error ? error : new Error(String(error)),
-                    );
-                  }
-                  throw error;
-                }
-              } finally {
-                queryMs += performance.now() - queryStartedAt;
-              }
-            },
-          });
-          throwIfSchedulerAborted(signal);
+        if (isRuntimeSchedulerRetryableTransactionError(error)) {
+          // PostgreSQL has aborted the transaction, so never return this
+          // client to the pool. Re-run the idempotent scheduler operation on a
+          // new session without opening the connection-failure breaker.
+          entry.stats.queryErrors += 1;
           recordBreakerSuccess(entry);
-          signal?.removeEventListener('abort', onAbort);
-          poolClient.removeListener('error', onCheckedOutError);
-          // The connection died mid-fn but fn happened to finish without another
-          // query — destroy the dead connection rather than pooling it.
+          lastError = error;
           releasePoolClient(
-            checkedOutError instanceof Error ? checkedOutError : undefined,
+            error instanceof Error ? error : new Error(String(error)),
           );
-          if (trace) {
-            console.info(
-              '[runtime-scheduler-pool.operation] ' +
-                JSON.stringify({
-                  runId: trace.runId,
-                  phase: trace.phase,
-                  outcome: 'success',
-                  attempt: attempt + 1,
-                  priority: trace.priority ?? 'ordinary',
-                  admissionWaitMs,
-                  acquireWaitMs,
-                  queryCount,
-                  queryMs,
-                  totalMs: performance.now() - operationStartedAt,
-                }),
-            );
-          }
-          return result;
-        } catch (error) {
-          if (trace) {
-            console.info(
-              '[runtime-scheduler-pool.operation] ' +
-                JSON.stringify({
-                  runId: trace.runId,
-                  phase: trace.phase,
-                  outcome: 'failed',
-                  attempt: attempt + 1,
-                  priority: trace.priority ?? 'ordinary',
-                  admissionWaitMs,
-                  acquireWaitMs,
-                  queryCount,
-                  queryMs,
-                  totalMs: performance.now() - operationStartedAt,
-                  errorName:
-                    error instanceof Error ? error.name : 'UnknownError',
-                }),
-            );
-          }
-          signal?.removeEventListener('abort', onAbort);
-          poolClient.removeListener('error', onCheckedOutError);
-          if (signal?.aborted) {
-            const cancellation = schedulerAbortReason(signal);
-            releasePoolClient(cancellation);
-            throw cancellation;
-          }
-          if (isPgBouncerCapacityError(error)) {
-            recordCapacityRejection(entry, error);
-            capacityObserved = true;
-            releasePoolClient();
-            throw new RuntimeSchedulerPgBouncerCapacityError(
-              error instanceof Error ? error.message : String(error),
-            );
-          }
-          if (isRuntimeSchedulerQueryCancellationError(error)) {
-            entry.stats.queryErrors += 1;
-            recordBreakerSuccess(entry);
-            releasePoolClient(
-              error instanceof Error ? error : new Error(String(error)),
-            );
-            throw error;
-          }
-          if (isConnectionCategoryError(error)) {
-            recordBreakerFailure(entry, error, halfOpenProbe);
-            entry.stats.connectionErrors += 1;
-            lastError = error;
-            // Destroy the broken connection instead of returning it to the pool.
-            releasePoolClient(
-              error instanceof Error ? error : new Error(String(error)),
-            );
-            if (attempt + 1 < maxAttempts) {
-              entry.stats.retries += 1;
-              await sleep(jitteredBackoffMs(attempt));
-              throwIfSchedulerAborted(signal);
-              continue;
-            }
-            throw error;
-          }
-          if (isRuntimeSchedulerRetryableTransactionError(error)) {
-            // PostgreSQL has aborted the transaction, so never return this
-            // client to the pool. Re-run the idempotent scheduler operation on a
-            // new session without opening the connection-failure breaker.
-            entry.stats.queryErrors += 1;
-            recordBreakerSuccess(entry);
-            lastError = error;
-            releasePoolClient(
-              error instanceof Error ? error : new Error(String(error)),
-            );
-            if (attempt + 1 < maxAttempts) {
-              entry.stats.retries += 1;
-              await sleep(jitteredBackoffMs(attempt));
-              throwIfSchedulerAborted(signal);
-              continue;
-            }
-            throw error;
+          if (attempt + 1 < maxAttempts) {
+            entry.stats.retries += 1;
+            continue;
           }
-          // Query-level failure on a healthy connection: count it, return the
-          // connection to the pool, surface the error without retry.
-          entry.stats.queryErrors += 1;
-          recordBreakerSuccess(entry);
-          releasePoolClient();
           throw error;
         }
-      } finally {
-        // A canceled, locally saturated, or capacity-rejected trial did not
-        // call either breaker recorder. Never let it own the probe forever.
-        // Only the trial that claimed this token may release it: another
-        // operation can close and reopen the breaker while this one awaits.
-        if (
-          halfOpenProbe !== null &&
-          entry.breaker.halfOpenProbe === halfOpenProbe
-        ) {
-          entry.breaker.halfOpenProbe = null;
-          if (capacityObserved && entry.breaker.openedAt !== null) {
-            // Capacity is not a connection failure. Keep the existing open
-            // state and try once more after the ordinary cooldown instead of
-            // probing the still-full database on every request.
-            entry.breaker.openedAt = Date.now();
-          }
+        // Query-level failure on a healthy connection: count it, return the
+        // connection to the pool, surface the error without retry.
+        entry.stats.queryErrors += 1;
+        recordBreakerSuccess(entry);
+        releasePoolClient();
+        throw error;
+      }
+    } finally {
+      // A canceled, locally saturated, or capacity-rejected trial did not
+      // call either breaker recorder. Never let it own the probe forever.
+      // Only the trial that claimed this token may release it: another
+      // operation can close and reopen the breaker while this one awaits.
+      if (
+        halfOpenProbe !== null &&
+        entry.breaker.halfOpenProbe === halfOpenProbe
+      ) {
+        entry.breaker.halfOpenProbe = null;
+        if (capacityObserved && entry.breaker.openedAt !== null) {
+          // Capacity is not a connection failure. Keep the existing open
+          // state and try once more after the ordinary cooldown instead of
+          // probing the still-full database on every request.
+          entry.breaker.openedAt = Date.now();
         }
       }
+      releaseAdmission();
     }
-    throw lastError instanceof Error
-      ? lastError
-      : new Error('Runtime scheduler pool operation failed after retries.');
-  } finally {
-    releaseAdmission();
   }
+  throw lastError instanceof Error
+    ? lastError
+    : new Error('Runtime scheduler pool operation failed after retries.');
 }
 
 /**
@@ -1293,7 +1295,7 @@ export type RuntimeSchedulerPoolStats = {
   idleCount: number;
   waitingCount: number;
   acquires: number;
-  /** Successful checkout latency, including local admission once per operation. */
+  /** Successful checkout latency, including each local admission wait once. */
   acquireWaitP50Ms: number | null;
   acquireWaitP95Ms: number | null;
   saturationRejections: number;