okengine 0.23.0 → 0.23.2

package/src/drivers/journal-postgres.ts

@@ -3,8 +3,9 @@
  *
  * Same concurrency physics as Signal's `once` delivery and Clock's postgres
  * CronStore: claim with `FOR UPDATE SKIP LOCKED`; a crashed holder's lease is
- * reclaimed lazily on the next claim attempt (no sweeper, no fencing token —
- * completed journal steps replay instead of re-running).
+ * reclaimed lazily on the next claim attempt (no sweeper). Each acquire bumps
+ * a fencing token; writes from a previous holder are rejected. Entries are
+ * append-only rows, not a rewritten JSON blob.
  */
 
 import {
@@ -22,6 +23,7 @@ import {
 } from "../kernel/idempotency-store.ts";
 import type { DecisionLabelStore } from "../kernel/decision-label-store.ts";
 import type { AgentEventStore } from "../kernel/agent-event-store.ts";
+import { throwOke } from "../kernel/errors.ts";
 import { lazyRequire } from "../kernel/lazy-require.ts";
 import {
   JOURNAL_DEFAULT_LEASE_MS,
@@ -29,6 +31,7 @@ import {
   type JournalLeaseStore,
   type JournalRun,
   type JournalStore,
+  type JournalWriteFence,
 } from "../kernel/journal.ts";
 import {
   resolvePostgresUrl,
@@ -53,6 +56,19 @@ interface JournalDbRow {
   created_at: number;
   updated_at: number;
   tenant: string | null;
+  lease_token: number | null;
+  code_version: string | null;
+}
+
+/** One append-only journal entry row. */
+interface JournalEntryDbRow {
+  run_id: string;
+  seq: number;
+  kind: string;
+  name: string | null;
+  resource: string | null;
+  value: string | null;
+  at: number;
 }
 
 /** Minimal SQL + transaction surface for the postgres journal store. */
@@ -85,7 +101,45 @@ const CLAIM_DUE_SQL = `SELECT * FROM oke_journal_runs WHERE status='sleeping' AN
 /** Boot-time orphan discovery: running/sleeping runs with no live lease. */
 const ORPHANS_SQL = `SELECT * FROM oke_journal_runs WHERE (status='running' OR status='sleeping' OR status='compensating') AND ((locked_by IS NULL) OR (lease_expires_at IS NOT NULL AND lease_expires_at<=?))`;
 
-const UPDATE_LEASE_SQL = `UPDATE oke_journal_runs SET locked_by = ?, lease_expires_at = ? WHERE id = ?`;
+const UPDATE_LEASE_SQL = `UPDATE oke_journal_runs SET locked_by = ?, lease_expires_at = ?, lease_token = COALESCE(lease_token, 0) + 1 WHERE id = ?`;
+
+const HEARTBEAT_SQL = `UPDATE oke_journal_runs SET lease_expires_at = GREATEST(COALESCE(lease_expires_at, 0), ?) WHERE id = ? AND locked_by = ? AND lease_token = ? AND lease_expires_at > ?`;
+
+const INSERT_ENTRY_SQL = `INSERT INTO oke_journal_entries (run_id, seq, kind, name, resource, value, at) VALUES (?, ?, ?, ?, ?, ?, ?) ON CONFLICT (run_id, seq) DO NOTHING`;
+
+/** One entry row, inserted only while the caller's fence still holds. */
+const APPEND_ENTRY_FENCED_SQL = `INSERT INTO oke_journal_entries (run_id, seq, kind, name, resource, value, at) SELECT ?, ?, ?, ?, ?, ?, ? WHERE EXISTS (SELECT 1 FROM oke_journal_runs WHERE id = ? AND locked_by = ? AND lease_token = ? AND lease_expires_at > ? FOR SHARE) ON CONFLICT (run_id, seq) DO NOTHING`;
+
+const UPDATE_ENTRY_FENCED_SQL = `UPDATE oke_journal_entries SET kind = ?, name = ?, resource = ?, value = ?, at = ? WHERE run_id = ? AND seq = ? AND EXISTS (SELECT 1 FROM oke_journal_runs WHERE id = ? AND locked_by = ? AND lease_token = ? AND lease_expires_at > ? FOR SHARE)`;
+
+const FENCED_HEADER_SQL = `UPDATE oke_journal_runs SET flow = ?, input = ?, status = ?, entries = ?, wake_at = ?, error = ?, output = ?, locked_by = ?, lease_expires_at = ?, updated_at = ?, tenant = ?, lease_token = GREATEST(COALESCE(lease_token, 0), ?), code_version = ? WHERE id = ? AND locked_by = ? AND lease_token = ? AND lease_expires_at > ?`;
+
+/** Header write inside `cas`, which already holds the row `FOR UPDATE`. */
+const CAS_HEADER_SQL = `UPDATE oke_journal_runs SET flow = ?, input = ?, status = ?, entries = ?, wake_at = ?, error = ?, output = ?, locked_by = ?, lease_expires_at = ?, updated_at = ?, tenant = ?, lease_token = GREATEST(COALESCE(lease_token, 0), ?), code_version = ? WHERE id = ? AND COALESCE(lease_token, 0) = ?`;
+
+/**
+ * Every statement the journal driver sends. The in-memory fake must match
+ * each one; a new statement that misses every branch fails the driver tests.
+ */
+export function postgresJournalStatements(): readonly string[] {
+  return [
+    CLAIM_LEASE_SQL,
+    CLAIM_DUE_SQL,
+    ORPHANS_SQL,
+    UPDATE_LEASE_SQL,
+    HEARTBEAT_SQL,
+    INSERT_ENTRY_SQL,
+    APPEND_ENTRY_FENCED_SQL,
+    UPDATE_ENTRY_FENCED_SQL,
+    FENCED_HEADER_SQL,
+    CAS_HEADER_SQL,
+    SELECT_ENTRIES_SQL,
+    RELEASE_LEASE_SQL,
+    UPSERT_SQL,
+  ];
+}
+
+const SELECT_ENTRIES_SQL = `SELECT * FROM oke_journal_entries WHERE run_id = ? ORDER BY seq ASC`;
 
 /** Guarded release — never clears another holder's lease. */
 const RELEASE_LEASE_SQL = `UPDATE oke_journal_runs SET locked_by = NULL, lease_expires_at = NULL WHERE id = ? AND locked_by = ?`;
@@ -171,9 +225,118 @@ function rowToRun(row: Record<string, unknown>): JournalRun {
   if (r.tenant !== null && r.tenant !== undefined && String(r.tenant).length > 0) {
     run.tenant = String(r.tenant);
   }
+  const leaseToken = numOrNull(r.lease_token);
+  if (leaseToken !== null) run.leaseToken = leaseToken;
+  if (
+    r.code_version !== null &&
+    r.code_version !== undefined &&
+    String(r.code_version).length > 0
+  ) {
+    run.codeVersion = String(r.code_version);
+  }
   return run;
 }
 
+function sameEntry(a: JournalEntry, b: JournalEntry): boolean {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+
+function fencedHeaderParams(run: JournalRun, fence: JournalWriteFence): unknown[] {
+  const base = runToParams(run);
+  return [
+    base[1],
+    base[2],
+    base[3],
+    JSON.stringify([]),
+    base[5],
+    base[6],
+    base[7],
+    base[8],
+    base[9],
+    base[11],
+    base[12],
+    fence.leaseToken,
+    base[14],
+    run.id,
+    fence.lockedBy,
+    fence.leaseToken,
+    fence.now,
+  ];
+}
+
+function casHeaderParams(run: JournalRun, heldToken: number): unknown[] {
+  const base = runToParams(run);
+  return [
+    base[1],
+    base[2],
+    base[3],
+    JSON.stringify([]),
+    base[5],
+    base[6],
+    base[7],
+    base[8],
+    base[9],
+    base[11],
+    base[12],
+    run.leaseToken ?? heldToken,
+    base[14],
+    run.id,
+    heldToken,
+  ];
+}
+
+function entryToParams(runId: string, seq: number, entry: JournalEntry): unknown[] {
+  if (entry.kind === "step") {
+    return [runId, seq, "step", entry.name, null, JSON.stringify(entry.value ?? null), entry.at];
+  }
+  if (entry.kind === "sleep") {
+    return [
+      runId,
+      seq,
+      "sleep",
+      entry.label,
+      entry.duration,
+      JSON.stringify(entry.wakeAt),
+      entry.at,
+    ];
+  }
+  return [
+    runId,
+    seq,
+    "effect",
+    entry.effectKind,
+    entry.resource,
+    JSON.stringify(entry.value ?? null),
+    entry.at,
+  ];
+}
+
+function entryFromRow(row: Record<string, unknown>): JournalEntry {
+  const kind = String(row.kind);
+  const at = Number(row.at);
+  const value =
+    row.value === null || row.value === undefined ? null : JSON.parse(String(row.value));
+  if (kind === "step") {
+    return { kind: "step", name: String(row.name ?? ""), value, at };
+  }
+  if (kind === "sleep") {
+    return {
+      kind: "sleep",
+      label: String(row.name ?? ""),
+      duration: String(row.resource ?? ""),
+      wakeAt: Number(value),
+      at,
+    };
+  }
+  return {
+    kind: "effect",
+    effectKind: String(row.name ?? ""),
+    resource: String(row.resource ?? ""),
+    value,
+    at,
+  };
+}
+
 function runToParams(run: JournalRun): unknown[] {
   return [
     run.id,
@@ -189,6 +352,8 @@ function runToParams(run: JournalRun): unknown[] {
     run.createdAt,
     run.updatedAt,
     run.tenant ?? null,
+    run.leaseToken ?? null,
+    run.codeVersion ?? null,
   ];
 }
 
@@ -209,6 +374,18 @@ async function ensureSchema(sql: PostgresJournalSql): Promise<void> {
     tenant TEXT
   )`);
   await sql.exec(`ALTER TABLE oke_journal_runs ADD COLUMN IF NOT EXISTS tenant TEXT`);
+  await sql.exec(`ALTER TABLE oke_journal_runs ADD COLUMN IF NOT EXISTS lease_token BIGINT`);
+  await sql.exec(`ALTER TABLE oke_journal_runs ADD COLUMN IF NOT EXISTS code_version TEXT`);
+  await sql.exec(`CREATE TABLE IF NOT EXISTS oke_journal_entries (
+    run_id TEXT NOT NULL,
+    seq BIGINT NOT NULL,
+    kind TEXT NOT NULL,
+    name TEXT,
+    resource TEXT,
+    value TEXT,
+    at BIGINT NOT NULL,
+    PRIMARY KEY (run_id, seq)
+  )`);
   await sql.exec(
     `CREATE INDEX IF NOT EXISTS oke_journal_runs_wake ON oke_journal_runs (status, wake_at)`,
   );
@@ -290,6 +467,7 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
       event_type: string | null;
       event_name: string | null;
     }[];
+    entries: JournalEntryDbRow[];
   };
 
   let committed: State = {
@@ -300,6 +478,7 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
     candidates: [],
     agentRuns: [],
     agentEvents: [],
+    entries: [],
   };
   let active: { state: State; locked: Set<string>; done: boolean } | null = null;
   /** Run ids held by other active transactions (SKIP LOCKED). */
@@ -320,6 +499,7 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
       candidates: s.candidates.map((r) => ({ ...r })),
       agentRuns: s.agentRuns.map((r) => ({ ...r })),
       agentEvents: s.agentEvents.map((r) => ({ ...r })),
+      entries: s.entries.map((r) => ({ ...r })),
     };
   }
 
@@ -342,6 +522,50 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
     return r.locked_by === null || (r.lease_expires_at !== null && r.lease_expires_at <= cutoff);
   }
 
+  function fenceHolds(
+    state: { rows: JournalDbRow[] },
+    id: string,
+    lockedBy: string,
+    token: number,
+    now: number,
+  ): boolean {
+    const row = state.rows.find((r) => r.id === id);
+    if (!row || row.locked_by !== lockedBy) return false;
+    if ((row.lease_token ?? 0) !== token) return false;
+    return row.lease_expires_at !== null && row.lease_expires_at > now;
+  }
+
+  function applyFencedHeader(
+    state: { rows: JournalDbRow[] },
+    text: string,
+    params: readonly unknown[],
+  ): { changes: number } {
+    const tokenOnly = /COALESCE\(lease_token,\s*0\)\s*=\s*\?/i.test(text);
+    const id = String(params[13]);
+    const row = state.rows.find((r) => r.id === id);
+    if (!row) return { changes: 0 };
+    if (tokenOnly) {
+      if ((row.lease_token ?? 0) !== Number(params[14])) return { changes: 0 };
+    } else if (!fenceHolds(state, id, String(params[14]), Number(params[15]), Number(params[16]))) {
+      return { changes: 0 };
+    }
+    row.flow = String(params[0]);
+    row.input = params[1] === null || params[1] === undefined ? null : String(params[1]);
+    row.status = String(params[2]);
+    row.entries = String(params[3] ?? "[]");
+    row.wake_at = params[4] === null || params[4] === undefined ? null : Number(params[4]);
+    row.error = params[5] === null || params[5] === undefined ? null : String(params[5]);
+    row.output = params[6] === null || params[6] === undefined ? null : String(params[6]);
+    row.locked_by = params[7] === null || params[7] === undefined ? null : String(params[7]);
+    row.lease_expires_at = params[8] === null || params[8] === undefined ? null : Number(params[8]);
+    row.updated_at = Number(params[9] ?? 0);
+    row.tenant = params[10] === null || params[10] === undefined ? null : String(params[10]);
+    row.lease_token = Math.max(row.lease_token ?? 0, Number(params[11] ?? 0));
+    row.code_version =
+      params[12] === null || params[12] === undefined ? row.code_version : String(params[12]);
+    return { changes: 1 };
+  }
+
   function tryLock(id: string): boolean {
     if (heldByTxn.has(id) && !(active?.locked.has(id) ?? false)) return false;
     if (active) {
@@ -481,6 +705,15 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
           .map((row) => ({ ...row }));
       }
 
+      if (/FROM\s+oke_journal_entries/i.test(text)) {
+        const runId = String(params[0] ?? "");
+        const seq = /seq\s*=\s*\?/i.test(text) ? Number(params[1]) : undefined;
+        return state.entries
+          .filter((row) => row.run_id === runId && (seq === undefined || row.seq === seq))
+          .sort((a, b) => a.seq - b.seq)
+          .map((row) => ({ ...row }));
+      }
+
       throw new Error(`postgres journal fake: unsupported query: ${sql}`);
     },
     async exec(sql, params = []) {
@@ -518,23 +751,110 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
           created_at: Number(record.created_at ?? 0),
           updated_at: Number(record.updated_at ?? 0),
           tenant: (record.tenant as string | null) ?? null,
+          lease_token: (() => {
+            const prev = state.rows.find((r) => r.id === String(record.id))?.lease_token ?? 0;
+            const incoming =
+              record.lease_token === undefined || record.lease_token === null
+                ? prev
+                : Number(record.lease_token);
+            return Math.max(prev, incoming);
+          })(),
+          code_version:
+            record.code_version === undefined || record.code_version === null
+              ? (state.rows.find((r) => r.id === String(record.id))?.code_version ?? null)
+              : String(record.code_version),
         };
         const idx = state.rows.findIndex((r) => r.id === next.id);
-        if (idx >= 0) state.rows[idx] = next;
-        else state.rows.push(next);
+        if (idx >= 0) {
+          const prev = state.rows[idx]!;
+          next.created_at = prev.created_at;
+          state.rows[idx] = next;
+        } else state.rows.push(next);
+        return { changes: 1 };
+      }
+
+      if (/^UPDATE\s+oke_journal_runs\s+SET\s+lease_expires_at\s*=\s*GREATEST/i.test(text)) {
+        const id = String(params[1]);
+        const row = state.rows.find((r) => r.id === id);
+        if (
+          !row ||
+          !fenceHolds(state, id, String(params[2]), Number(params[3]), Number(params[4]))
+        ) {
+          return { changes: 0 };
+        }
+        const next = Number(params[0]);
+        row.lease_expires_at = Math.max(row.lease_expires_at ?? 0, next);
         return { changes: 1 };
       }
 
       const updLease =
-        /^UPDATE\s+oke_journal_runs\s+SET\s+locked_by\s*=\s*\?,\s*lease_expires_at\s*=\s*\?\s+WHERE\s+id\s*=\s*\?\s*$/i.exec(
+        /^UPDATE\s+oke_journal_runs\s+SET\s+locked_by\s*=\s*\?,\s*lease_expires_at\s*=\s*\?/i.exec(
           text,
         );
-      if (updLease) {
-        const row = state.rows.find((r) => r.id === params[2]);
+      if (updLease && /WHERE\s+id\s*=\s*\?/i.test(text) && !/locked_by\s*=\s*NULL/i.test(text)) {
+        const id = String(params[params.length - 1]);
+        const row = state.rows.find((r) => r.id === id);
         if (!row) return { changes: 0 };
         row.locked_by = params[0] === null ? null : String(params[0]);
         row.lease_expires_at =
           params[1] === null || params[1] === undefined ? null : Number(params[1]);
+        if (/lease_token/i.test(text)) row.lease_token = (row.lease_token ?? 0) + 1;
+        return { changes: 1 };
+      }
+
+      if (/^UPDATE\s+oke_journal_runs\s+SET\s+flow\s*=/i.test(text)) {
+        return applyFencedHeader(state, text, params);
+      }
+
+      if (/^UPDATE\s+oke_journal_entries\s+SET\s+kind\s*=/i.test(text)) {
+        const runId = String(params[5]);
+        const seq = Number(params[6]);
+        const fenceRun = String(params[7]);
+        const lockedBy = String(params[8]);
+        const token = Number(params[9]);
+        const at = Number(params[10]);
+        if (!fenceHolds(state, fenceRun, lockedBy, token, at)) return { changes: 0 };
+        const idx = state.entries.findIndex((e) => e.run_id === runId && e.seq === seq);
+        if (idx < 0) return { changes: 0 };
+        const row = state.entries[idx]!;
+        row.kind = String(params[0]);
+        row.name = params[1] === null || params[1] === undefined ? null : String(params[1]);
+        row.resource = params[2] === null || params[2] === undefined ? null : String(params[2]);
+        row.value = params[3] === null || params[3] === undefined ? null : String(params[3]);
+        row.at = Number(params[4]);
+        return { changes: 1 };
+      }
+
+      if (/^INSERT\s+INTO\s+oke_journal_entries\b/i.test(text)) {
+        const fenced = /WHERE\s+EXISTS/i.test(text);
+        const row: JournalEntryDbRow = {
+          run_id: String(params[0]),
+          seq: Number(params[1]),
+          kind: String(params[2]),
+          name: params[3] === null || params[3] === undefined ? null : String(params[3]),
+          resource: params[4] === null || params[4] === undefined ? null : String(params[4]),
+          value: params[5] === null || params[5] === undefined ? null : String(params[5]),
+          at: Number(params[6]),
+        };
+        if (
+          fenced &&
+          !fenceHolds(
+            state,
+            String(params[7]),
+            String(params[8]),
+            Number(params[9]),
+            Number(params[10]),
+          )
+        ) {
+          return { changes: 0 };
+        }
+        const idx = state.entries.findIndex((e) => e.run_id === row.run_id && e.seq === row.seq);
+        if (idx >= 0) {
+          if (/DO\s+NOTHING/i.test(text)) return { changes: 0 };
+          state.entries[idx] = row;
+          return { changes: 1 };
+        }
+        state.entries.push(row);
         return { changes: 1 };
       }
 
@@ -807,12 +1127,14 @@ export function createPostgresJournalFake(): PostgresJournalSql & {
   return api;
 }
 
-const UPSERT_SQL = `INSERT INTO oke_journal_runs (id, flow, input, status, entries, wake_at, error, output, locked_by, lease_expires_at, created_at, updated_at, tenant) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (id) DO UPDATE SET flow = EXCLUDED.flow, input = EXCLUDED.input, status = EXCLUDED.status, entries = EXCLUDED.entries, wake_at = EXCLUDED.wake_at, error = EXCLUDED.error, output = EXCLUDED.output, locked_by = EXCLUDED.locked_by, lease_expires_at = EXCLUDED.lease_expires_at, created_at = EXCLUDED.created_at, updated_at = EXCLUDED.updated_at, tenant = EXCLUDED.tenant`;
+const UPSERT_SQL = `INSERT INTO oke_journal_runs (id, flow, input, status, entries, wake_at, error, output, locked_by, lease_expires_at, created_at, updated_at, tenant, lease_token, code_version) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT (id) DO UPDATE SET flow = EXCLUDED.flow, input = EXCLUDED.input, status = EXCLUDED.status, entries = EXCLUDED.entries, wake_at = EXCLUDED.wake_at, error = EXCLUDED.error, output = EXCLUDED.output, locked_by = EXCLUDED.locked_by, lease_expires_at = EXCLUDED.lease_expires_at, created_at = oke_journal_runs.created_at, updated_at = EXCLUDED.updated_at, tenant = EXCLUDED.tenant, lease_token = GREATEST(COALESCE(oke_journal_runs.lease_token, 0), COALESCE(EXCLUDED.lease_token, 0)), code_version = EXCLUDED.code_version`;
 
 /** Postgres journal store with run-level lease coordination. */
 export type PostgresJournalStore = JournalStore &
   JournalLeaseStore & {
     readonly sql: PostgresJournalSql;
+    /** Bytes written for entry rows plus header entry payloads. */
+    readonly writeBytes: number;
     close(): Promise<void>;
   };
 
@@ -888,22 +1210,100 @@ export async function createPostgresJournalStore(
 
   await ensureSchema(sql);
 
+  let writeBytes = 0;
+
+  async function hydrate(row: Record<string, unknown>): Promise<JournalRun> {
+    const run = rowToRun(row);
+    const entryRows = await sql.query(SELECT_ENTRIES_SQL, [run.id]);
+    if (entryRows.length > 0) {
+      (run as { entries: JournalEntry[] }).entries = entryRows.map((entry) => entryFromRow(entry));
+      return run;
+    }
+    if (run.entries.length > 0) {
+      for (let seq = 0; seq < run.entries.length; seq++) {
+        const entry = run.entries[seq];
+        if (!entry) continue;
+        const params = entryToParams(run.id, seq, entry);
+        writeBytes += JSON.stringify(entry).length;
+        await sql.exec(INSERT_ENTRY_SQL, params);
+      }
+    }
+    return run;
+  }
+
   const store: PostgresJournalStore = {
     sql,
+    get writeBytes() {
+      return writeBytes;
+    },
     idempotency: createPostgresIdempotencyStore(sql),
     decisions: lazyDecisionLabels(sql),
     agentEvents: lazyAgentEvents(sql),
     async get(runId) {
       const rows = await sql.query(`SELECT * FROM oke_journal_runs WHERE id = ?`, [runId]);
       if (!rows[0]) return undefined;
-      return rowToRun(rows[0]);
+      return hydrate(rows[0]);
     },
-    async put(run) {
+    async put(run, fence) {
+      writeBytes += JSON.stringify(run.entries).length;
+      if (fence) {
+        const wrote = await sql.exec(FENCED_HEADER_SQL, fencedHeaderParams(run, fence));
+        if (wrote.changes === 0) throwOke("JOURNAL_STALE_LEASE", { runId: run.id });
+        return;
+      }
       await sql.exec(UPSERT_SQL, runToParams(run));
+      for (let seq = 0; seq < run.entries.length; seq++) {
+        const entry = run.entries[seq];
+        if (!entry) continue;
+        writeBytes += JSON.stringify(entry).length;
+        await sql.exec(INSERT_ENTRY_SQL, entryToParams(run.id, seq, entry));
+      }
+    },
+    async appendEntry(runId, seq, entry, fence) {
+      writeBytes += JSON.stringify(entry).length;
+      if (!fence) {
+        await sql.exec(INSERT_ENTRY_SQL, entryToParams(runId, seq, entry));
+        return;
+      }
+      const wrote = await sql.exec(APPEND_ENTRY_FENCED_SQL, [
+        ...entryToParams(runId, seq, entry),
+        runId,
+        fence.lockedBy,
+        fence.leaseToken,
+        fence.now,
+      ]);
+      if (wrote.changes === 1) return;
+      const stored = await sql.query(
+        `SELECT * FROM oke_journal_entries WHERE run_id = ? AND seq = ?`,
+        [runId, seq],
+      );
+      const row = stored[0];
+      if (row && sameEntry(entryFromRow(row), entry)) return;
+      throwOke("JOURNAL_STALE_LEASE", { runId });
+    },
+    async updateEntry(runId, seq, entry, fence) {
+      writeBytes += JSON.stringify(entry).length;
+      const params = entryToParams(runId, seq, entry);
+      const wrote = await sql.exec(UPDATE_ENTRY_FENCED_SQL, [
+        params[2],
+        params[3],
+        params[4],
+        params[5],
+        params[6],
+        runId,
+        seq,
+        runId,
+        fence.lockedBy,
+        fence.leaseToken,
+        fence.now,
+      ]);
+      if (wrote.changes === 0) throwOke("JOURNAL_STALE_LEASE", { runId });
     },
     async list() {
       const rows = await sql.query(`SELECT * FROM oke_journal_runs`);
-      return rows.map((r) => rowToRun(r));
+      const runs: JournalRun[] = [];
+      for (const row of rows) runs.push(await hydrate(row));
+      return runs;
     },
     async acquireLease(runId, instanceId, now, leaseMs) {
       return sql.begin(async (tx) => {
@@ -925,13 +1325,70 @@ export async function createPostgresJournalStore(
           return { lease: true, leaseExpiresAt: current.leaseExpiresAt };
         }
         const current = rowToRun(row);
+        const entryRows = await tx.query(SELECT_ENTRIES_SQL, [runId]);
+        if (entryRows.length > 0) {
+          (current as { entries: JournalEntry[] }).entries = entryRows.map((entry) =>
+            entryFromRow(entry),
+          );
+        }
         const next = update(current) ?? current;
+        const heldToken = current.leaseToken ?? 0;
+        const renew =
+          current.lockedBy === instanceId &&
+          current.leaseExpiresAt !== undefined &&
+          current.leaseExpiresAt > now &&
+          current.leaseToken !== undefined;
         next.lockedBy = instanceId;
         next.leaseExpiresAt = now + leaseMs;
-        await tx.exec(UPSERT_SQL, runToParams(next));
+        next.leaseToken = renew ? heldToken : heldToken + 1;
+        const header = { ...next, entries: [] as JournalEntry[] };
+        const wrote = await tx.exec(CAS_HEADER_SQL, casHeaderParams(header, heldToken));
+        if (wrote.changes === 0) throwOke("JOURNAL_STALE_LEASE", { runId });
+        const fence = { lockedBy: instanceId, leaseToken: next.leaseToken, now };
+        for (let seq = 0; seq < next.entries.length; seq++) {
+          const entry = next.entries[seq];
+          if (!entry) continue;
+          const prev = current.entries[seq];
+          if (!prev) {
+            const inserted = await tx.exec(APPEND_ENTRY_FENCED_SQL, [
+              ...entryToParams(runId, seq, entry),
+              runId,
+              fence.lockedBy,
+              fence.leaseToken,
+              fence.now,
+            ]);
+            if (inserted.changes === 0) throwOke("JOURNAL_STALE_LEASE", { runId });
+          } else if (!sameEntry(prev, entry)) {
+            const params = entryToParams(runId, seq, entry);
+            const updated = await tx.exec(UPDATE_ENTRY_FENCED_SQL, [
+              params[2],
+              params[3],
+              params[4],
+              params[5],
+              params[6],
+              runId,
+              seq,
+              runId,
+              fence.lockedBy,
+              fence.leaseToken,
+              fence.now,
+            ]);
+            if (updated.changes === 0) throwOke("JOURNAL_STALE_LEASE", { runId });
+          }
+        }
         return "ok";
       });
     },
+    async renewLeaseExpiry(runId, expiresAt, fence) {
+      const wrote = await sql.exec(HEARTBEAT_SQL, [
+        expiresAt,
+        runId,
+        fence.lockedBy,
+        fence.leaseToken,
+        fence.now,
+      ]);
+      return wrote.changes === 1;
+    },
     async releaseLease(runId, instanceId) {
       await sql.exec(RELEASE_LEASE_SQL, [runId, instanceId]);
     },
@@ -941,7 +1398,11 @@ export async function createPostgresJournalStore(
         const row = rows[0];
         if (!row) return undefined;
         await tx.exec(UPDATE_LEASE_SQL, [instanceId, now + leaseMs, String(row.id)]);
-        return rowToRun(row);
+        const run = rowToRun(row);
+        run.lockedBy = instanceId;
+        run.leaseExpiresAt = now + leaseMs;
+        run.leaseToken = (run.leaseToken ?? 0) + 1;
+        return run;
       });
     },
     async listOrphans(now) {