patchrelay 0.75.2 → 0.76.0

package/dist/run-orchestrator.js

@@ -26,6 +26,11 @@ import { CodexThreadMaterializingError, isThreadMaterializingError } from "./cod
 import { emitTelemetry, noopTelemetry } from "./telemetry.js";
 import { LinearIssueProjectionService } from "./linear-issue-projection.js";
 import { RunAdmissionController } from "./run-admission-controller.js";
+const WRITER = "run-orchestrator";
+// A terminal run must hold the active slot for at least this long before
+// the orchestrator force-clears it, so we never race the normal
+// notification-driven finalize that runs within seconds of completion.
+const DANGLING_ACTIVE_RUN_MIN_AGE_MS = 2 * 60_000;
 function lowerCaseFirst(value) {
     return value ? `${value.slice(0, 1).toLowerCase()}${value.slice(1)}` : value;
 }
@@ -220,14 +225,21 @@ export class RunOrchestrator {
             try {
                 const triage = await this.issueTriage.classify({ issue, childIssues });
                 if (triage) {
-                    return this.db.issues.upsertIssue({
-                        projectId: issue.projectId,
-                        linearIssueId: issue.linearIssueId,
-                        issueClass: triage.issueClass,
-                        issueClassSource: "triage",
-                        issueTriageHash: triageHash,
-                        issueTriageResultJson: JSON.stringify(triage),
+                    // The triage verdict is an external classifier response; persist it
+                    // unconditionally so a benign version bump during the (slow) triage
+                    // call cannot discard the result.
+                    const triageCommit = this.db.issueSessions.commitIssueState({
+                        writer: WRITER,
+                        update: {
+                            projectId: issue.projectId,
+                            linearIssueId: issue.linearIssueId,
+                            issueClass: triage.issueClass,
+                            issueClassSource: "triage",
+                            issueTriageHash: triageHash,
+                            issueTriageResultJson: JSON.stringify(triage),
+                        },
                     });
+                    return triageCommit.outcome === "applied" ? triageCommit.issue : issue;
                 }
             }
             catch (error) {
@@ -238,12 +250,22 @@ export class RunOrchestrator {
         const fallbackClassification = classification.issueClassSource === "triage" && !triageCacheFresh
             ? { issueClass: "implementation", issueClassSource: "heuristic" }
             : classification;
-        return this.db.issues.upsertIssue({
-            projectId: issue.projectId,
-            linearIssueId: issue.linearIssueId,
-            issueClass: fallbackClassification.issueClass,
-            issueClassSource: fallbackClassification.issueClassSource,
+        const fallbackCommit = this.db.issueSessions.commitIssueState({
+            writer: WRITER,
+            expectedVersion: issue.version,
+            update: {
+                projectId: issue.projectId,
+                linearIssueId: issue.linearIssueId,
+                issueClass: fallbackClassification.issueClass,
+                issueClassSource: fallbackClassification.issueClassSource,
+            },
+            // A concurrent writer is newer truth; the next pass reclassifies.
+            onConflict: () => undefined,
         });
+        if (fallbackCommit.outcome === "applied") {
+            return fallbackCommit.issue;
+        }
+        return (fallbackCommit.outcome === "conflict_skipped" ? fallbackCommit.issue : undefined) ?? issue;
     }
     // ─── Run ────────────────────────────────────────────────────────
     async run(item) {
@@ -305,7 +327,11 @@ export class RunOrchestrator {
             return;
         }
         if (issue.prState === "merged") {
-            this.db.issueSessions.upsertIssueWithLease({ projectId: issue.projectId, linearIssueId: issue.linearIssueId, leaseId }, { projectId: issue.projectId, linearIssueId: issue.linearIssueId, pendingRunType: null, factoryState: "done" });
+            this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                lease: { projectId: issue.projectId, linearIssueId: issue.linearIssueId, leaseId },
+                update: { projectId: issue.projectId, linearIssueId: issue.linearIssueId, pendingRunType: null, factoryState: "done" },
+            });
             this.leaseService.release(item.projectId, item.issueId);
             return;
         }
@@ -475,11 +501,15 @@ export class RunOrchestrator {
         }
         // Reset zombie recovery counter — this run started successfully
         if (issue.zombieRecoveryAttempts > 0) {
-            this.db.issueSessions.upsertIssueWithLease({ projectId: item.projectId, linearIssueId: item.issueId, leaseId }, {
-                projectId: item.projectId,
-                linearIssueId: item.issueId,
-                zombieRecoveryAttempts: 0,
-                lastZombieRecoveryAt: null,
+            this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                lease: { projectId: item.projectId, linearIssueId: item.issueId, leaseId },
+                update: {
+                    projectId: item.projectId,
+                    linearIssueId: item.issueId,
+                    zombieRecoveryAttempts: 0,
+                    lastZombieRecoveryAt: null,
+                },
             });
         }
         this.logger.info({ issueKey: issue.issueKey, runType, threadId, turnId }, `Started ${runType} run`);
@@ -559,6 +589,10 @@ export class RunOrchestrator {
         for (const run of this.db.runs.listRunningRuns()) {
             await this.reconcileRun(run);
         }
+        // Free any issue whose active slot is pinned to an already-terminal
+        // run (post-run finalize interrupted by restart). Must run before the
+        // idle reconciler so the freed issue is routed in this same pass.
+        this.finalizeDanglingActiveRuns();
         // Preemptively detect stuck merge-queue PRs (conflicts visible on
         // GitHub) and dispatch queue_repair before the Steward evicts.
         await this.queueHealthMonitor.reconcile();
@@ -584,6 +618,75 @@ export class RunOrchestrator {
             isRequestedChangesRunType,
         });
     }
+    // Clear a dangling active slot: an issue still pointing at an
+    // already-terminal run via `activeRunId`. The post-run finalize was
+    // interrupted (almost always a restart between marking the run
+    // terminal and clearing the slot), so the run can never drive the
+    // session forward, yet every idle/recovery pass skips the issue
+    // because `activeRunId` is set. We re-read under the issue-session
+    // lease and null the slot; the idle reconciler then routes the issue
+    // from GitHub truth (e.g. a missed changes_requested → review_fix).
+    finalizeDanglingActiveRuns() {
+        for (const issue of this.db.issues.listIssuesWithTerminalActiveRun()) {
+            if (issue.activeRunId === undefined)
+                continue;
+            const run = this.db.runs.getRunById(issue.activeRunId);
+            // The query already filters to terminal runs; this guards against a
+            // race where the run advanced back to active between query and read.
+            if (!run || run.status === "running" || run.status === "queued")
+                continue;
+            // Hold off until the run has been terminal long enough that the
+            // normal notification-driven finalize has demonstrably not run —
+            // avoids racing a live completion that is milliseconds from clearing
+            // the slot itself.
+            const endedAtMs = run.endedAt ? Date.parse(run.endedAt) : Number.NaN;
+            if (Number.isFinite(endedAtMs) && Date.now() - endedAtMs < DANGLING_ACTIVE_RUN_MIN_AGE_MS)
+                continue;
+            const lease = this.claimLeaseForReconciliation(run.projectId, run.linearIssueId);
+            // "skip" → a live lease owns the session (a real run is in flight);
+            // leave it alone. "owned" → an outer local scope holds it, so we
+            // must not release it here.
+            if (lease === "skip")
+                continue;
+            try {
+                const cleared = this.withHeldIssueSessionLease(run.projectId, run.linearIssueId, (held) => {
+                    const fresh = this.db.issues.getIssue(run.projectId, run.linearIssueId);
+                    if (!fresh || fresh.activeRunId !== run.id)
+                        return false;
+                    const danglingClear = {
+                        projectId: run.projectId,
+                        linearIssueId: run.linearIssueId,
+                        activeRunId: null,
+                    };
+                    const commit = this.db.issueSessions.commitIssueState({
+                        writer: WRITER,
+                        lease: held,
+                        expectedVersion: fresh.version,
+                        update: danglingClear,
+                        // Never clear a slot a concurrent writer re-pointed elsewhere.
+                        onConflict: (current) => (current.activeRunId === run.id ? danglingClear : undefined),
+                    });
+                    return commit.outcome === "applied";
+                });
+                if (cleared) {
+                    this.logger.warn({ issueKey: issue.issueKey, runId: run.id, runType: run.runType, runStatus: run.status }, "Cleared dangling active-run slot left by a terminal run; idle reconcile will resume the issue");
+                    this.feed?.publish({
+                        level: "warn",
+                        kind: "workflow",
+                        issueKey: issue.issueKey,
+                        projectId: run.projectId,
+                        stage: run.runType,
+                        status: "recovered",
+                        summary: `Cleared stuck active slot: run #${run.id} was ${run.status} but still held the issue`,
+                    });
+                }
+            }
+            finally {
+                if (lease !== "owned")
+                    this.releaseIssueSessionLease(run.projectId, run.linearIssueId);
+            }
+        }
+    }
     async reconcileRun(run) {
         const issue = this.db.issues.getIssue(run.projectId, run.linearIssueId);
         if (!issue)

package/dist/run-reconciler.js

@@ -8,6 +8,7 @@ import { resolveEffectiveActiveRun } from "./effective-active-run.js";
 import { isThreadMaterializingError } from "./codex-thread-errors.js";
 import { fetchPullRequestSnapshot } from "./reconcile-pr-fetch.js";
 const THREAD_MATERIALIZATION_GRACE_MS = 10 * 60_000;
+const WRITER = "run-reconciler";
 function isWithinThreadMaterializationGrace(run, nowMs = Date.now()) {
     const startedAtMs = Date.parse(run.startedAt);
     if (!Number.isFinite(startedAtMs))
@@ -50,13 +51,26 @@ export class RunReconciler {
             latestRun: run,
         });
         if (effectiveActiveRun?.id === run.id && issue.activeRunId !== run.id) {
-            effectiveIssue = this.withHeldLease(run.projectId, run.linearIssueId, () => this.db.issues.upsertIssue({
+            const reattachUpdate = {
                 projectId: run.projectId,
                 linearIssueId: run.linearIssueId,
                 activeRunId: run.id,
                 ...(run.threadId ? { threadId: run.threadId } : {}),
-            })) ?? effectiveIssue;
-            this.logger.info({ issueKey: effectiveIssue.issueKey, runId: run.id, runType: run.runType }, "Reattached detached active run during reconciliation");
+            };
+            const commit = this.withHeldLease(run.projectId, run.linearIssueId, () => this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                expectedVersion: issue.version,
+                update: reattachUpdate,
+                // Never steal the slot from a run that was attached concurrently.
+                onConflict: (current) => (current.activeRunId == null ? reattachUpdate : undefined),
+            }));
+            if (commit?.outcome === "applied") {
+                effectiveIssue = commit.issue;
+                this.logger.info({ issueKey: effectiveIssue.issueKey, runId: run.id, runType: run.runType }, "Reattached detached active run during reconciliation");
+            }
+            else if (commit?.outcome === "conflict_skipped" && commit.issue) {
+                effectiveIssue = commit.issue;
+            }
         }
         if (!effectiveIssue.delegatedToPatchRelay) {
             const authority = await this.confirmDelegationAuthorityBeforeRelease(run, effectiveIssue);
@@ -69,9 +83,18 @@ export class RunReconciler {
             }
         }
         if (TERMINAL_STATES.has(effectiveIssue.factoryState)) {
+            const terminalClear = { projectId: run.projectId, linearIssueId: run.linearIssueId, activeRunId: null };
             this.withHeldLease(run.projectId, run.linearIssueId, () => {
+                const commit = this.db.issueSessions.commitIssueState({
+                    writer: WRITER,
+                    expectedVersion: effectiveIssue.version,
+                    update: terminalClear,
+                    // Re-check the release predicate against the fresh row.
+                    onConflict: (current) => TERMINAL_STATES.has(current.factoryState) && current.activeRunId === run.id ? terminalClear : undefined,
+                });
+                if (commit.outcome !== "applied")
+                    return;
                 this.db.runs.finishRun(run.id, { status: "released", failureReason: "Issue reached terminal state during active run" });
-                this.db.issues.upsertIssue({ projectId: run.projectId, linearIssueId: run.linearIssueId, activeRunId: null });
             });
             this.logger.info({ issueKey: effectiveIssue.issueKey, runId: run.id, factoryState: effectiveIssue.factoryState }, "Reconciliation: released run on terminal issue");
             const releasedIssue = this.db.issues.getIssue(run.projectId, run.linearIssueId) ?? effectiveIssue;
@@ -88,9 +111,17 @@ export class RunReconciler {
                 return;
             }
             this.logger.warn({ issueKey: effectiveIssue.issueKey, runId: run.id, runType: run.runType }, "Zombie run detected (no thread)");
+            const zombieClear = { projectId: run.projectId, linearIssueId: run.linearIssueId, activeRunId: null };
             this.withHeldLease(run.projectId, run.linearIssueId, () => {
+                const commit = this.db.issueSessions.commitIssueState({
+                    writer: WRITER,
+                    expectedVersion: effectiveIssue.version,
+                    update: zombieClear,
+                    onConflict: (current) => (current.activeRunId === run.id ? zombieClear : undefined),
+                });
+                if (commit.outcome !== "applied")
+                    return;
                 this.db.runs.finishRun(run.id, { status: "failed", failureReason: "Zombie: never started (no thread after restart)" });
-                this.db.issues.upsertIssue({ projectId: run.projectId, linearIssueId: run.linearIssueId, activeRunId: null });
             });
             this.recoverOrEscalate(effectiveIssue, run.runType, "zombie");
             const recoveredIssue = this.db.issues.getIssue(run.projectId, run.linearIssueId) ?? effectiveIssue;
@@ -113,9 +144,17 @@ export class RunReconciler {
                 return;
             }
             this.logger.warn({ issueKey: effectiveIssue.issueKey, runId: run.id, runType: run.runType, threadId: run.threadId }, "Stale thread during reconciliation");
+            const staleClear = { projectId: run.projectId, linearIssueId: run.linearIssueId, activeRunId: null };
             this.withHeldLease(run.projectId, run.linearIssueId, () => {
+                const commit = this.db.issueSessions.commitIssueState({
+                    writer: WRITER,
+                    expectedVersion: effectiveIssue.version,
+                    update: staleClear,
+                    onConflict: (current) => (current.activeRunId === run.id ? staleClear : undefined),
+                });
+                if (commit.outcome !== "applied")
+                    return;
                 this.db.runs.finishRun(run.id, { status: "failed", failureReason: "Stale thread after restart" });
-                this.db.issues.upsertIssue({ projectId: run.projectId, linearIssueId: run.linearIssueId, activeRunId: null });
             });
             this.recoverOrEscalate(effectiveIssue, run.runType, "stale_thread");
             const recoveredIssue = this.db.issues.getIssue(run.projectId, run.linearIssueId) ?? effectiveIssue;
@@ -130,15 +169,25 @@ export class RunReconciler {
             if (linearIssue) {
                 const stopState = resolveAuthoritativeLinearStopState(linearIssue);
                 if (stopState?.isFinal) {
+                    const stopUpdate = {
+                        projectId: run.projectId,
+                        linearIssueId: run.linearIssueId,
+                        activeRunId: null,
+                        currentLinearState: stopState.stateName,
+                        factoryState: "done",
+                    };
                     this.withHeldLease(run.projectId, run.linearIssueId, () => {
-                        this.db.runs.finishRun(run.id, { status: "released" });
-                        this.db.issues.upsertIssue({
-                            projectId: run.projectId,
-                            linearIssueId: run.linearIssueId,
-                            activeRunId: null,
-                            currentLinearState: stopState.stateName,
-                            factoryState: "done",
+                        const commit = this.db.issueSessions.commitIssueState({
+                            writer: WRITER,
+                            expectedVersion: effectiveIssue.version,
+                            // The Linear stop state is authoritative; only the run-slot
+                            // ownership needs re-checking on conflict.
+                            update: stopUpdate,
+                            onConflict: (current) => (current.activeRunId === run.id ? stopUpdate : undefined),
                         });
+                        if (commit.outcome !== "applied")
+                            return;
+                        this.db.runs.finishRun(run.id, { status: "released" });
                     });
                     this.feed?.publish({
                         level: "info",
@@ -198,21 +247,31 @@ export class RunReconciler {
         return true;
     }
     releaseMergedRun(run, issue, reason) {
+        const mergedUpdate = {
+            projectId: run.projectId,
+            linearIssueId: run.linearIssueId,
+            activeRunId: null,
+            factoryState: "done",
+            prState: "merged",
+            pendingRunType: null,
+            pendingRunContextJson: null,
+        };
         this.withHeldLease(run.projectId, run.linearIssueId, () => {
+            const commit = this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                expectedVersion: issue.version,
+                // The merge itself is external truth; only re-check that the run
+                // slot still belongs to this run before clearing it.
+                update: mergedUpdate,
+                onConflict: (current) => (current.activeRunId === run.id ? mergedUpdate : undefined),
+            });
+            if (commit.outcome !== "applied")
+                return;
             this.db.issueSessions.clearPendingIssueSessionEvents(run.projectId, run.linearIssueId);
             this.db.runs.finishRun(run.id, {
                 status: "released",
                 failureReason: reason,
             });
-            this.db.issues.upsertIssue({
-                projectId: run.projectId,
-                linearIssueId: run.linearIssueId,
-                activeRunId: null,
-                factoryState: "done",
-                prState: "merged",
-                pendingRunType: null,
-                pendingRunContextJson: null,
-            });
         });
         this.feed?.publish({
             level: "info",
@@ -287,19 +346,26 @@ export class RunReconciler {
             },
         });
         if (delegated) {
-            const repairedIssue = this.withHeldLease(run.projectId, run.linearIssueId, () => this.db.issues.upsertIssue({
-                projectId: run.projectId,
-                linearIssueId: run.linearIssueId,
-                delegatedToPatchRelay: true,
-                ...(linearIssue.identifier ? { issueKey: linearIssue.identifier } : {}),
-                ...(linearIssue.title ? { title: linearIssue.title } : {}),
-                ...(linearIssue.description ? { description: linearIssue.description } : {}),
-                ...(linearIssue.url ? { url: linearIssue.url } : {}),
-                ...(linearIssue.priority != null ? { priority: linearIssue.priority } : {}),
-                ...(linearIssue.estimate != null ? { estimate: linearIssue.estimate } : {}),
-                ...(linearIssue.stateName ? { currentLinearState: linearIssue.stateName } : {}),
-                ...(linearIssue.stateType ? { currentLinearStateType: linearIssue.stateType } : {}),
-            })) ?? issue;
+            // Live Linear is the authority on delegation; commit unconditionally.
+            const repairedIssue = this.withHeldLease(run.projectId, run.linearIssueId, () => {
+                const commit = this.db.issueSessions.commitIssueState({
+                    writer: WRITER,
+                    update: {
+                        projectId: run.projectId,
+                        linearIssueId: run.linearIssueId,
+                        delegatedToPatchRelay: true,
+                        ...(linearIssue.identifier ? { issueKey: linearIssue.identifier } : {}),
+                        ...(linearIssue.title ? { title: linearIssue.title } : {}),
+                        ...(linearIssue.description ? { description: linearIssue.description } : {}),
+                        ...(linearIssue.url ? { url: linearIssue.url } : {}),
+                        ...(linearIssue.priority != null ? { priority: linearIssue.priority } : {}),
+                        ...(linearIssue.estimate != null ? { estimate: linearIssue.estimate } : {}),
+                        ...(linearIssue.stateName ? { currentLinearState: linearIssue.stateName } : {}),
+                        ...(linearIssue.stateType ? { currentLinearStateType: linearIssue.stateType } : {}),
+                    },
+                });
+                return commit.outcome === "applied" ? commit.issue : undefined;
+            }) ?? issue;
             return { issue: repairedIssue, released: false };
         }
         appendRunReleasedAuthorityEvent(this.db, {
@@ -315,22 +381,27 @@ export class RunReconciler {
             },
         });
         this.withHeldLease(run.projectId, run.linearIssueId, () => {
-            this.db.runs.finishRun(run.id, { status: "released", failureReason: "Issue was un-delegated during active run" });
-            this.db.issues.upsertIssue({
-                projectId: run.projectId,
-                linearIssueId: run.linearIssueId,
-                activeRunId: null,
-                factoryState: issue.factoryState,
-                delegatedToPatchRelay: false,
-                ...(linearIssue.identifier ? { issueKey: linearIssue.identifier } : {}),
-                ...(linearIssue.title ? { title: linearIssue.title } : {}),
-                ...(linearIssue.description ? { description: linearIssue.description } : {}),
-                ...(linearIssue.url ? { url: linearIssue.url } : {}),
-                ...(linearIssue.priority != null ? { priority: linearIssue.priority } : {}),
-                ...(linearIssue.estimate != null ? { estimate: linearIssue.estimate } : {}),
-                ...(linearIssue.stateName ? { currentLinearState: linearIssue.stateName } : {}),
-                ...(linearIssue.stateType ? { currentLinearStateType: linearIssue.stateType } : {}),
+            // Undelegation confirmed against live Linear — external truth, commit
+            // unconditionally; the run release rides in the same transaction.
+            this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                update: {
+                    projectId: run.projectId,
+                    linearIssueId: run.linearIssueId,
+                    activeRunId: null,
+                    factoryState: issue.factoryState,
+                    delegatedToPatchRelay: false,
+                    ...(linearIssue.identifier ? { issueKey: linearIssue.identifier } : {}),
+                    ...(linearIssue.title ? { title: linearIssue.title } : {}),
+                    ...(linearIssue.description ? { description: linearIssue.description } : {}),
+                    ...(linearIssue.url ? { url: linearIssue.url } : {}),
+                    ...(linearIssue.priority != null ? { priority: linearIssue.priority } : {}),
+                    ...(linearIssue.estimate != null ? { estimate: linearIssue.estimate } : {}),
+                    ...(linearIssue.stateName ? { currentLinearState: linearIssue.stateName } : {}),
+                    ...(linearIssue.stateType ? { currentLinearStateType: linearIssue.stateType } : {}),
+                },
             });
+            this.db.runs.finishRun(run.id, { status: "released", failureReason: "Issue was un-delegated during active run" });
         });
         return { issue, released: true };
     }

package/dist/run-recovery-service.js

@@ -1,5 +1,6 @@
 import { buildRunFailureActivity } from "./linear-session-reporting.js";
 import { getRemainingZombieRecoveryDelayMs } from "./zombie-recovery.js";
+const WRITER = "run-recovery-service";
 const DEFAULT_ZOMBIE_RECOVERY_BUDGET = 5;
 export class RunRecoveryService {
     db;
@@ -30,12 +31,16 @@ export class RunRecoveryService {
         if (params.isRequestedChangesRunType(runType)) {
             const updated = this.withHeldLease(fresh.projectId, fresh.linearIssueId, (lease) => {
                 this.db.issueSessions.clearPendingIssueSessionEventsWithLease(lease);
-                this.db.issueSessions.upsertIssueWithLease(lease, {
-                    projectId: fresh.projectId,
-                    linearIssueId: fresh.linearIssueId,
-                    pendingRunType: null,
-                    pendingRunContextJson: null,
-                    factoryState: "escalated",
+                this.db.issueSessions.commitIssueState({
+                    writer: WRITER,
+                    lease,
+                    update: {
+                        projectId: fresh.projectId,
+                        linearIssueId: fresh.linearIssueId,
+                        pendingRunType: null,
+                        pendingRunContextJson: null,
+                        factoryState: "escalated",
+                    },
                 });
                 return true;
             });
@@ -59,12 +64,16 @@ export class RunRecoveryService {
         }
         if (fresh.prState === "merged") {
             const updated = this.withHeldLease(fresh.projectId, fresh.linearIssueId, (lease) => {
-                this.db.issueSessions.upsertIssueWithLease(lease, {
-                    projectId: fresh.projectId,
-                    linearIssueId: fresh.linearIssueId,
-                    factoryState: "done",
-                    zombieRecoveryAttempts: 0,
-                    lastZombieRecoveryAt: null,
+                this.db.issueSessions.commitIssueState({
+                    writer: WRITER,
+                    lease,
+                    update: {
+                        projectId: fresh.projectId,
+                        linearIssueId: fresh.linearIssueId,
+                        factoryState: "done",
+                        zombieRecoveryAttempts: 0,
+                        lastZombieRecoveryAt: null,
+                    },
                 });
                 return true;
             });
@@ -80,10 +89,14 @@ export class RunRecoveryService {
         const attempts = fresh.zombieRecoveryAttempts + 1;
         if (attempts > DEFAULT_ZOMBIE_RECOVERY_BUDGET) {
             const updated = this.withHeldLease(fresh.projectId, fresh.linearIssueId, (lease) => {
-                this.db.issueSessions.upsertIssueWithLease(lease, {
-                    projectId: fresh.projectId,
-                    linearIssueId: fresh.linearIssueId,
-                    factoryState: "escalated",
+                this.db.issueSessions.commitIssueState({
+                    writer: WRITER,
+                    lease,
+                    update: {
+                        projectId: fresh.projectId,
+                        linearIssueId: fresh.linearIssueId,
+                        factoryState: "escalated",
+                    },
                 });
                 return true;
             });
@@ -116,14 +129,23 @@ export class RunRecoveryService {
             }
         }
         const requeued = this.withHeldLease(fresh.projectId, fresh.linearIssueId, (lease) => {
-            this.db.issueSessions.upsertIssueWithLease(lease, {
+            // `attempts` is read-modify-write against the fresh row read above; on
+            // conflict recompute the counter from the current row.
+            const buildRequeueUpdate = (record) => ({
                 projectId: fresh.projectId,
                 linearIssueId: fresh.linearIssueId,
                 pendingRunType: null,
                 pendingRunContextJson: null,
-                zombieRecoveryAttempts: attempts,
+                zombieRecoveryAttempts: record.zombieRecoveryAttempts + 1,
                 lastZombieRecoveryAt: new Date().toISOString(),
             });
+            this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                lease,
+                expectedVersion: fresh.version,
+                update: buildRequeueUpdate(fresh),
+                onConflict: (current) => buildRequeueUpdate(current),
+            });
             return this.appendWakeEventWithLease(lease, fresh, runType, undefined, `recovery:${attempts}`);
         });
         if (!requeued) {
@@ -138,18 +160,27 @@ export class RunRecoveryService {
         const { issue, runType, reason } = params;
         this.logger.warn({ issueKey: issue.issueKey, runType, reason }, "Escalating to human");
         const escalated = this.withHeldLease(issue.projectId, issue.linearIssueId, (lease) => {
+            // Escalation is an operator-facing decision: the issue write and the
+            // run release ride in the held-lease transaction, with the run gated
+            // on the issue commit.
+            const commit = this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                lease,
+                update: {
+                    projectId: issue.projectId,
+                    linearIssueId: issue.linearIssueId,
+                    pendingRunType: null,
+                    pendingRunContextJson: null,
+                    activeRunId: null,
+                    factoryState: "escalated",
+                },
+            });
+            if (commit.outcome !== "applied")
+                return false;
             if (issue.activeRunId) {
-                this.db.issueSessions.finishRunWithLease(lease, issue.activeRunId, { status: "released" });
+                this.db.runs.finishRun(issue.activeRunId, { status: "released" });
             }
             this.db.issueSessions.clearPendingIssueSessionEventsWithLease(lease);
-            this.db.issueSessions.upsertIssueWithLease(lease, {
-                projectId: issue.projectId,
-                linearIssueId: issue.linearIssueId,
-                pendingRunType: null,
-                pendingRunContextJson: null,
-                activeRunId: null,
-                factoryState: "escalated",
-            });
             return true;
         });
         if (!escalated) {
@@ -177,16 +208,22 @@ export class RunRecoveryService {
     failRunAndClear(params) {
         const { run, message, nextState } = params;
         const updated = this.withHeldLease(run.projectId, run.linearIssueId, (lease) => {
+            const commit = this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                update: {
+                    projectId: run.projectId,
+                    linearIssueId: run.linearIssueId,
+                    activeRunId: null,
+                    factoryState: nextState,
+                },
+            });
+            if (commit.outcome !== "applied") {
+                return false;
+            }
             this.db.runs.finishRun(run.id, { status: "failed", failureReason: message });
             if (nextState === "failed" || nextState === "escalated" || nextState === "awaiting_input" || nextState === "done") {
                 this.db.issueSessions.clearPendingIssueSessionEventsWithLease(lease);
             }
-            this.db.issues.upsertIssue({
-                projectId: run.projectId,
-                linearIssueId: run.linearIssueId,
-                activeRunId: null,
-                factoryState: nextState,
-            });
             return true;
         });
         if (!updated) {