patchrelay 0.75.3 → 0.77.0

package/dist/run-reconciler.js

@@ -3,11 +3,12 @@ import { TERMINAL_STATES } from "./factory-state.js";
 import { resolveAuthoritativeLinearStopState } from "./linear-workflow.js";
 import { buildRunFailureActivity } from "./linear-session-reporting.js";
 import { getThreadTurns } from "./codex-thread-utils.js";
-import { resolveRecoverablePostRunState } from "./interrupted-run-recovery.js";
 import { resolveEffectiveActiveRun } from "./effective-active-run.js";
 import { isThreadMaterializingError } from "./codex-thread-errors.js";
 import { fetchPullRequestSnapshot } from "./reconcile-pr-fetch.js";
+import { emitTelemetry, noopTelemetry } from "./telemetry.js";
 const THREAD_MATERIALIZATION_GRACE_MS = 10 * 60_000;
+const WRITER = "run-reconciler";
 function isWithinThreadMaterializationGrace(run, nowMs = Date.now()) {
     const startedAtMs = Date.parse(run.startedAt);
     if (!Number.isFinite(startedAtMs))
@@ -19,27 +20,27 @@ export class RunReconciler {
     logger;
     linearProvider;
     linearSync;
-    interruptedRunRecovery;
+    failurePolicy;
     runFinalizer;
     withHeldLease;
     releaseLease;
     readThreadWithRetry;
-    recoverOrEscalate;
     resolveRepoFullName;
     feed;
-    constructor(db, logger, linearProvider, linearSync, interruptedRunRecovery, runFinalizer, withHeldLease, releaseLease, readThreadWithRetry, recoverOrEscalate, resolveRepoFullName = () => undefined, feed) {
+    telemetry;
+    constructor(db, logger, linearProvider, linearSync, failurePolicy, runFinalizer, withHeldLease, releaseLease, readThreadWithRetry, resolveRepoFullName = () => undefined, feed, telemetry = noopTelemetry) {
         this.db = db;
         this.logger = logger;
         this.linearProvider = linearProvider;
         this.linearSync = linearSync;
-        this.interruptedRunRecovery = interruptedRunRecovery;
+        this.failurePolicy = failurePolicy;
         this.runFinalizer = runFinalizer;
         this.withHeldLease = withHeldLease;
         this.releaseLease = releaseLease;
         this.readThreadWithRetry = readThreadWithRetry;
-        this.recoverOrEscalate = recoverOrEscalate;
         this.resolveRepoFullName = resolveRepoFullName;
         this.feed = feed;
+        this.telemetry = telemetry;
     }
     async reconcile(params) {
         const { run, issue, recoveryLease } = params;
@@ -50,13 +51,39 @@ export class RunReconciler {
             latestRun: run,
         });
         if (effectiveActiveRun?.id === run.id && issue.activeRunId !== run.id) {
-            effectiveIssue = this.withHeldLease(run.projectId, run.linearIssueId, () => this.db.issues.upsertIssue({
+            const reattachUpdate = {
                 projectId: run.projectId,
                 linearIssueId: run.linearIssueId,
                 activeRunId: run.id,
                 ...(run.threadId ? { threadId: run.threadId } : {}),
-            })) ?? effectiveIssue;
-            this.logger.info({ issueKey: effectiveIssue.issueKey, runId: run.id, runType: run.runType }, "Reattached detached active run during reconciliation");
+            };
+            const commit = this.withHeldLease(run.projectId, run.linearIssueId, () => this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                expectedVersion: issue.version,
+                update: reattachUpdate,
+                // Never steal the slot from a run that was attached concurrently.
+                onConflict: (current) => (current.activeRunId == null ? reattachUpdate : undefined),
+            }));
+            if (commit?.outcome === "applied") {
+                effectiveIssue = commit.issue;
+                this.logger.info({ issueKey: effectiveIssue.issueKey, runId: run.id, runType: run.runType }, "Reattached detached active run during reconciliation");
+                // Plan §B5: with settleRun idempotent and the launcher persisting the
+                // thread id before startTurn, this reattachment should never fire.
+                // Telemetry observes it for one release before the block is deleted.
+                emitTelemetry(this.telemetry, {
+                    type: "health.invariant",
+                    invariant: "detached_active_run",
+                    status: "repaired",
+                    projectId: run.projectId,
+                    linearIssueId: run.linearIssueId,
+                    ...(effectiveIssue.issueKey ? { issueKey: effectiveIssue.issueKey } : {}),
+                    runId: run.id,
+                    detail: `Reattached detached active ${run.runType} run during reconciliation`,
+                });
+            }
+            else if (commit?.outcome === "conflict_skipped" && commit.issue) {
+                effectiveIssue = commit.issue;
+            }
         }
         if (!effectiveIssue.delegatedToPatchRelay) {
             const authority = await this.confirmDelegationAuthorityBeforeRelease(run, effectiveIssue);
@@ -69,9 +96,18 @@ export class RunReconciler {
             }
         }
         if (TERMINAL_STATES.has(effectiveIssue.factoryState)) {
+            const terminalClear = { projectId: run.projectId, linearIssueId: run.linearIssueId, activeRunId: null };
             this.withHeldLease(run.projectId, run.linearIssueId, () => {
+                const commit = this.db.issueSessions.commitIssueState({
+                    writer: WRITER,
+                    expectedVersion: effectiveIssue.version,
+                    update: terminalClear,
+                    // Re-check the release predicate against the fresh row.
+                    onConflict: (current) => TERMINAL_STATES.has(current.factoryState) && current.activeRunId === run.id ? terminalClear : undefined,
+                });
+                if (commit.outcome !== "applied")
+                    return;
                 this.db.runs.finishRun(run.id, { status: "released", failureReason: "Issue reached terminal state during active run" });
-                this.db.issues.upsertIssue({ projectId: run.projectId, linearIssueId: run.linearIssueId, activeRunId: null });
             });
             this.logger.info({ issueKey: effectiveIssue.issueKey, runId: run.id, factoryState: effectiveIssue.factoryState }, "Reconciliation: released run on terminal issue");
             const releasedIssue = this.db.issues.getIssue(run.projectId, run.linearIssueId) ?? effectiveIssue;
@@ -88,11 +124,14 @@ export class RunReconciler {
                 return;
             }
             this.logger.warn({ issueKey: effectiveIssue.issueKey, runId: run.id, runType: run.runType }, "Zombie run detected (no thread)");
-            this.withHeldLease(run.projectId, run.linearIssueId, () => {
-                this.db.runs.finishRun(run.id, { status: "failed", failureReason: "Zombie: never started (no thread after restart)" });
-                this.db.issues.upsertIssue({ projectId: run.projectId, linearIssueId: run.linearIssueId, activeRunId: null });
+            // Detection only — the failure policy settles the run and decides
+            // retry vs escalate (plan §B4).
+            this.failurePolicy.settleStrandedRunAndRecover({
+                run,
+                issue: effectiveIssue,
+                reason: "zombie",
+                failureReason: "Zombie: never started (no thread after restart)",
             });
-            this.recoverOrEscalate(effectiveIssue, run.runType, "zombie");
             const recoveredIssue = this.db.issues.getIssue(run.projectId, run.linearIssueId) ?? effectiveIssue;
             void this.linearSync.emitActivity(recoveredIssue, buildRunFailureActivity(run.runType, "The Codex turn never started before PatchRelay restarted."));
             void this.linearSync.syncSession(recoveredIssue, { activeRunType: run.runType });
@@ -113,11 +152,14 @@ export class RunReconciler {
                 return;
             }
             this.logger.warn({ issueKey: effectiveIssue.issueKey, runId: run.id, runType: run.runType, threadId: run.threadId }, "Stale thread during reconciliation");
-            this.withHeldLease(run.projectId, run.linearIssueId, () => {
-                this.db.runs.finishRun(run.id, { status: "failed", failureReason: "Stale thread after restart" });
-                this.db.issues.upsertIssue({ projectId: run.projectId, linearIssueId: run.linearIssueId, activeRunId: null });
+            // Detection only — the failure policy settles the run and decides
+            // retry vs escalate (plan §B4).
+            this.failurePolicy.settleStrandedRunAndRecover({
+                run,
+                issue: effectiveIssue,
+                reason: "stale_thread",
+                failureReason: "Stale thread after restart",
             });
-            this.recoverOrEscalate(effectiveIssue, run.runType, "stale_thread");
             const recoveredIssue = this.db.issues.getIssue(run.projectId, run.linearIssueId) ?? effectiveIssue;
             void this.linearSync.emitActivity(recoveredIssue, buildRunFailureActivity(run.runType, "PatchRelay lost the active Codex thread after restart and needs to recover."));
             void this.linearSync.syncSession(recoveredIssue, { activeRunType: run.runType });
@@ -130,15 +172,25 @@ export class RunReconciler {
             if (linearIssue) {
                 const stopState = resolveAuthoritativeLinearStopState(linearIssue);
                 if (stopState?.isFinal) {
+                    const stopUpdate = {
+                        projectId: run.projectId,
+                        linearIssueId: run.linearIssueId,
+                        activeRunId: null,
+                        currentLinearState: stopState.stateName,
+                        factoryState: "done",
+                    };
                     this.withHeldLease(run.projectId, run.linearIssueId, () => {
-                        this.db.runs.finishRun(run.id, { status: "released" });
-                        this.db.issues.upsertIssue({
-                            projectId: run.projectId,
-                            linearIssueId: run.linearIssueId,
-                            activeRunId: null,
-                            currentLinearState: stopState.stateName,
-                            factoryState: "done",
+                        const commit = this.db.issueSessions.commitIssueState({
+                            writer: WRITER,
+                            expectedVersion: effectiveIssue.version,
+                            // The Linear stop state is authoritative; only the run-slot
+                            // ownership needs re-checking on conflict.
+                            update: stopUpdate,
+                            onConflict: (current) => (current.activeRunId === run.id ? stopUpdate : undefined),
                         });
+                        if (commit.outcome !== "applied")
+                            return;
+                        this.db.runs.finishRun(run.id, { status: "released" });
                     });
                     this.feed?.publish({
                         level: "info",
@@ -158,7 +210,7 @@ export class RunReconciler {
         }
         const latestTurn = getThreadTurns(thread).at(-1);
         if (latestTurn?.status === "interrupted") {
-            await this.interruptedRunRecovery.handle(run, effectiveIssue);
+            await this.failurePolicy.handleInterruptedRun(run, effectiveIssue);
             return;
         }
         if (latestTurn?.status === "completed") {
@@ -169,7 +221,6 @@ export class RunReconciler {
                 thread,
                 threadId: run.threadId,
                 ...(latestTurn.id ? { completedTurnId: latestTurn.id } : {}),
-                resolveRecoverableRunState: resolveRecoverablePostRunState,
             });
             return;
         }
@@ -198,21 +249,31 @@ export class RunReconciler {
         return true;
     }
     releaseMergedRun(run, issue, reason) {
+        const mergedUpdate = {
+            projectId: run.projectId,
+            linearIssueId: run.linearIssueId,
+            activeRunId: null,
+            factoryState: "done",
+            prState: "merged",
+            pendingRunType: null,
+            pendingRunContextJson: null,
+        };
         this.withHeldLease(run.projectId, run.linearIssueId, () => {
+            const commit = this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                expectedVersion: issue.version,
+                // The merge itself is external truth; only re-check that the run
+                // slot still belongs to this run before clearing it.
+                update: mergedUpdate,
+                onConflict: (current) => (current.activeRunId === run.id ? mergedUpdate : undefined),
+            });
+            if (commit.outcome !== "applied")
+                return;
             this.db.issueSessions.clearPendingIssueSessionEvents(run.projectId, run.linearIssueId);
             this.db.runs.finishRun(run.id, {
                 status: "released",
                 failureReason: reason,
             });
-            this.db.issues.upsertIssue({
-                projectId: run.projectId,
-                linearIssueId: run.linearIssueId,
-                activeRunId: null,
-                factoryState: "done",
-                prState: "merged",
-                pendingRunType: null,
-                pendingRunContextJson: null,
-            });
         });
         this.feed?.publish({
             level: "info",
@@ -287,19 +348,26 @@ export class RunReconciler {
             },
         });
         if (delegated) {
-            const repairedIssue = this.withHeldLease(run.projectId, run.linearIssueId, () => this.db.issues.upsertIssue({
-                projectId: run.projectId,
-                linearIssueId: run.linearIssueId,
-                delegatedToPatchRelay: true,
-                ...(linearIssue.identifier ? { issueKey: linearIssue.identifier } : {}),
-                ...(linearIssue.title ? { title: linearIssue.title } : {}),
-                ...(linearIssue.description ? { description: linearIssue.description } : {}),
-                ...(linearIssue.url ? { url: linearIssue.url } : {}),
-                ...(linearIssue.priority != null ? { priority: linearIssue.priority } : {}),
-                ...(linearIssue.estimate != null ? { estimate: linearIssue.estimate } : {}),
-                ...(linearIssue.stateName ? { currentLinearState: linearIssue.stateName } : {}),
-                ...(linearIssue.stateType ? { currentLinearStateType: linearIssue.stateType } : {}),
-            })) ?? issue;
+            // Live Linear is the authority on delegation; commit unconditionally.
+            const repairedIssue = this.withHeldLease(run.projectId, run.linearIssueId, () => {
+                const commit = this.db.issueSessions.commitIssueState({
+                    writer: WRITER,
+                    update: {
+                        projectId: run.projectId,
+                        linearIssueId: run.linearIssueId,
+                        delegatedToPatchRelay: true,
+                        ...(linearIssue.identifier ? { issueKey: linearIssue.identifier } : {}),
+                        ...(linearIssue.title ? { title: linearIssue.title } : {}),
+                        ...(linearIssue.description ? { description: linearIssue.description } : {}),
+                        ...(linearIssue.url ? { url: linearIssue.url } : {}),
+                        ...(linearIssue.priority != null ? { priority: linearIssue.priority } : {}),
+                        ...(linearIssue.estimate != null ? { estimate: linearIssue.estimate } : {}),
+                        ...(linearIssue.stateName ? { currentLinearState: linearIssue.stateName } : {}),
+                        ...(linearIssue.stateType ? { currentLinearStateType: linearIssue.stateType } : {}),
+                    },
+                });
+                return commit.outcome === "applied" ? commit.issue : undefined;
+            }) ?? issue;
             return { issue: repairedIssue, released: false };
         }
         appendRunReleasedAuthorityEvent(this.db, {
@@ -315,22 +383,27 @@ export class RunReconciler {
             },
         });
         this.withHeldLease(run.projectId, run.linearIssueId, () => {
-            this.db.runs.finishRun(run.id, { status: "released", failureReason: "Issue was un-delegated during active run" });
-            this.db.issues.upsertIssue({
-                projectId: run.projectId,
-                linearIssueId: run.linearIssueId,
-                activeRunId: null,
-                factoryState: issue.factoryState,
-                delegatedToPatchRelay: false,
-                ...(linearIssue.identifier ? { issueKey: linearIssue.identifier } : {}),
-                ...(linearIssue.title ? { title: linearIssue.title } : {}),
-                ...(linearIssue.description ? { description: linearIssue.description } : {}),
-                ...(linearIssue.url ? { url: linearIssue.url } : {}),
-                ...(linearIssue.priority != null ? { priority: linearIssue.priority } : {}),
-                ...(linearIssue.estimate != null ? { estimate: linearIssue.estimate } : {}),
-                ...(linearIssue.stateName ? { currentLinearState: linearIssue.stateName } : {}),
-                ...(linearIssue.stateType ? { currentLinearStateType: linearIssue.stateType } : {}),
+            // Undelegation confirmed against live Linear — external truth, commit
+            // unconditionally; the run release rides in the same transaction.
+            this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                update: {
+                    projectId: run.projectId,
+                    linearIssueId: run.linearIssueId,
+                    activeRunId: null,
+                    factoryState: issue.factoryState,
+                    delegatedToPatchRelay: false,
+                    ...(linearIssue.identifier ? { issueKey: linearIssue.identifier } : {}),
+                    ...(linearIssue.title ? { title: linearIssue.title } : {}),
+                    ...(linearIssue.description ? { description: linearIssue.description } : {}),
+                    ...(linearIssue.url ? { url: linearIssue.url } : {}),
+                    ...(linearIssue.priority != null ? { priority: linearIssue.priority } : {}),
+                    ...(linearIssue.estimate != null ? { estimate: linearIssue.estimate } : {}),
+                    ...(linearIssue.stateName ? { currentLinearState: linearIssue.stateName } : {}),
+                    ...(linearIssue.stateType ? { currentLinearStateType: linearIssue.stateType } : {}),
+                },
             });
+            this.db.runs.finishRun(run.id, { status: "released", failureReason: "Issue was un-delegated during active run" });
         });
         return { issue, released: true };
     }

package/dist/run-settlement.js

@@ -0,0 +1,57 @@
+const WRITER = "run-settlement";
+const TERMINAL_RUN_STATUSES = new Set(["completed", "failed", "released", "superseded"]);
+export function isTerminalRunStatus(status) {
+    return TERMINAL_RUN_STATUSES.has(status);
+}
+// Phase B1 (core simplification plan): the fast, transactional, idempotent
+// half of run finalization. One transaction marks the run terminal and
+// clears the issue's active slot — the two writes whose separation caused
+// the dangling-active-run freeze (PR #566): a restart landing between them
+// left `activeRunId` pointing at a terminal run forever, hiding the issue
+// from every idle/recovery pass. Safe to call from both the notification
+// finalizer and reconciliation at any time:
+//   - already-terminal run → finishRun skipped;
+//   - slot already cleared or re-pointed at another run → issue untouched;
+//   - non-terminal run with no `finish` outcome → full no-op.
+export function settleRun(params) {
+    const { db, run } = params;
+    return db.transaction(() => {
+        const freshRun = db.runs.getRunById(run.id);
+        if (!freshRun) {
+            return { runFinished: false, slotCleared: false, issue: db.issues.getIssue(run.projectId, run.linearIssueId) };
+        }
+        let runFinished = false;
+        if (!isTerminalRunStatus(freshRun.status)) {
+            if (!params.finish) {
+                return { runFinished: false, slotCleared: false, issue: db.issues.getIssue(run.projectId, run.linearIssueId) };
+            }
+            db.runs.finishRun(run.id, params.finish);
+            runFinished = true;
+        }
+        const current = db.issues.getIssue(run.projectId, run.linearIssueId);
+        if (!current || current.activeRunId !== run.id) {
+            return { runFinished, slotCleared: false, issue: current };
+        }
+        const buildUpdate = (record) => ({
+            projectId: run.projectId,
+            linearIssueId: run.linearIssueId,
+            ...params.buildIssueUpdate?.(record),
+            // After the caller-provided fields so nothing can override the clear.
+            activeRunId: null,
+        });
+        const commit = db.issueSessions.commitIssueState({
+            writer: WRITER,
+            ...(params.lease ? { lease: params.lease } : {}),
+            expectedVersion: current.version,
+            update: buildUpdate(current),
+            // The read above happened inside this same transaction, so a version
+            // conflict cannot normally occur; the predicate keeps the invariant
+            // explicit: never clear a slot that was re-pointed at another run.
+            onConflict: (fresh) => (fresh.activeRunId === run.id ? buildUpdate(fresh) : undefined),
+        });
+        if (commit.outcome !== "applied") {
+            return { runFinished, slotCleared: false, issue: commit.outcome === "conflict_skipped" ? commit.issue : current };
+        }
+        return { runFinished, slotCleared: true, issue: commit.issue };
+    });
+}

package/dist/run-wake-planner.js

@@ -1,5 +1,6 @@
 import { getCiRepairBudget, getQueueRepairBudget, getReviewFixBudget, } from "./run-budgets.js";
 import { buildRequestedChangesWakeIdentity } from "./reactive-wake-keys.js";
+const WRITER = "run-wake-planner";
 export class RunWakePlanner {
     db;
     constructor(db) {
@@ -62,15 +63,19 @@ export class RunWakePlanner {
             ? JSON.parse(issue.pendingRunContextJson)
             : undefined;
         this.appendWakeEventWithLease(lease, issue, issue.pendingRunType, context, "legacy_pending");
-        const updated = this.db.issueSessions.upsertIssueWithLease(lease, {
-            projectId: issue.projectId,
-            linearIssueId: issue.linearIssueId,
-            pendingRunType: null,
-            pendingRunContextJson: null,
+        const commit = this.db.issueSessions.commitIssueState({
+            writer: WRITER,
+            lease,
+            update: {
+                projectId: issue.projectId,
+                linearIssueId: issue.linearIssueId,
+                pendingRunType: null,
+                pendingRunContextJson: null,
+            },
         });
-        if (!updated)
+        if (commit.outcome !== "applied")
             return issue;
-        return this.db.issues.getIssue(issue.projectId, issue.linearIssueId) ?? issue;
+        return commit.issue;
     }
     budgetExceeded(issue, project, runType, isRequestedChangesRunType) {
         const ciRepairBudget = getCiRepairBudget(project);
@@ -88,27 +93,32 @@ export class RunWakePlanner {
         return undefined;
     }
     incrementAttemptCounters(issue, lease, runType, isRequestedChangesRunType) {
-        if (runType === "ci_repair") {
-            return Boolean(this.db.issueSessions.upsertIssueWithLease(lease, {
-                projectId: issue.projectId,
-                linearIssueId: issue.linearIssueId,
-                ciRepairAttempts: issue.ciRepairAttempts + 1,
-            }));
-        }
-        if (runType === "queue_repair") {
-            return Boolean(this.db.issueSessions.upsertIssueWithLease(lease, {
-                projectId: issue.projectId,
-                linearIssueId: issue.linearIssueId,
-                queueRepairAttempts: issue.queueRepairAttempts + 1,
-            }));
-        }
-        if (isRequestedChangesRunType(runType)) {
-            return Boolean(this.db.issueSessions.upsertIssueWithLease(lease, {
-                projectId: issue.projectId,
-                linearIssueId: issue.linearIssueId,
-                reviewFixAttempts: issue.reviewFixAttempts + 1,
-            }));
-        }
-        return true;
+        // The increments are read-modify-write against the issue row (which may
+        // be stale by the time the launch path gets here); on conflict, recompute
+        // from the fresh row instead of writing a counter derived from the stale
+        // read.
+        const buildIncrement = (record) => {
+            if (runType === "ci_repair") {
+                return { projectId: issue.projectId, linearIssueId: issue.linearIssueId, ciRepairAttempts: record.ciRepairAttempts + 1 };
+            }
+            if (runType === "queue_repair") {
+                return { projectId: issue.projectId, linearIssueId: issue.linearIssueId, queueRepairAttempts: record.queueRepairAttempts + 1 };
+            }
+            if (isRequestedChangesRunType(runType)) {
+                return { projectId: issue.projectId, linearIssueId: issue.linearIssueId, reviewFixAttempts: record.reviewFixAttempts + 1 };
+            }
+            return undefined;
+        };
+        const update = buildIncrement(issue);
+        if (!update)
+            return true;
+        const commit = this.db.issueSessions.commitIssueState({
+            writer: WRITER,
+            lease,
+            expectedVersion: issue.version,
+            update,
+            onConflict: (current) => buildIncrement(current),
+        });
+        return commit.outcome === "applied";
     }
 }

package/dist/service-issue-actions.js

@@ -1,5 +1,6 @@
 import { buildOperatorRetryEvent } from "./operator-retry-event.js";
 import { buildManualRetryAttemptReset, resolveRetryTarget } from "./manual-issue-actions.js";
+const WRITER = "service-issue-actions";
 export class ServiceIssueActions {
     config;
     db;
@@ -76,10 +77,13 @@ export class ServiceIssueActions {
             dedupeKey: `operator_stop:${issue.linearIssueId}`,
         });
         this.db.issueSessions.clearPendingIssueSessionEventsRespectingActiveLease(issue.projectId, issue.linearIssueId);
-        this.db.issueSessions.upsertIssueRespectingActiveLease(issue.projectId, issue.linearIssueId, {
-            projectId: issue.projectId,
-            linearIssueId: issue.linearIssueId,
-            factoryState: "awaiting_input",
+        this.db.issueSessions.commitIssueState({
+            writer: WRITER,
+            update: {
+                projectId: issue.projectId,
+                linearIssueId: issue.linearIssueId,
+                factoryState: "awaiting_input",
+            },
         });
         this.feed.publish({
             level: "warn",
@@ -111,19 +115,25 @@ export class ServiceIssueActions {
             lastGitHubFailureSource: issue.lastGitHubFailureSource,
         });
         if (retryTarget.runType === "none") {
-            this.db.issueSessions.upsertIssueRespectingActiveLease(issue.projectId, issue.linearIssueId, {
-                projectId: issue.projectId,
-                linearIssueId: issue.linearIssueId,
-                factoryState: "done",
+            this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                update: {
+                    projectId: issue.projectId,
+                    linearIssueId: issue.linearIssueId,
+                    factoryState: "done",
+                },
             });
             return { issueKey, runType: "none" };
         }
         this.appendOperatorRetryEvent(issue, retryTarget.runType);
-        this.db.issueSessions.upsertIssueRespectingActiveLease(issue.projectId, issue.linearIssueId, {
-            projectId: issue.projectId,
-            linearIssueId: issue.linearIssueId,
-            factoryState: retryTarget.factoryState,
-            ...buildManualRetryAttemptReset(retryTarget.runType),
+        this.db.issueSessions.commitIssueState({
+            writer: WRITER,
+            update: {
+                projectId: issue.projectId,
+                linearIssueId: issue.linearIssueId,
+                factoryState: retryTarget.factoryState,
+                ...buildManualRetryAttemptReset(retryTarget.runType),
+            },
         });
         this.feed.publish({
             level: "info",
@@ -168,22 +178,29 @@ export class ServiceIssueActions {
             dedupeKey: `operator_closed:${issue.linearIssueId}:${terminalState}:${issue.activeRunId ?? "no-run"}`,
         });
         this.db.issueSessions.clearPendingIssueSessionEventsRespectingActiveLease(issue.projectId, issue.linearIssueId);
-        if (run) {
-            this.db.issueSessions.finishRunRespectingActiveLease(issue.projectId, issue.linearIssueId, run.id, {
-                status: "released",
-                failureReason: options?.reason
-                    ? `Operator closed issue as ${terminalState}: ${options.reason}`
-                    : `Operator closed issue as ${terminalState}`,
+        // Operator close is authoritative: the issue terminal write and the run
+        // release ride in one transaction, with the run gated on the issue commit.
+        this.db.transaction(() => {
+            const commit = this.db.issueSessions.commitIssueState({
+                writer: WRITER,
+                update: {
+                    projectId: issue.projectId,
+                    linearIssueId: issue.linearIssueId,
+                    delegatedToPatchRelay: false,
+                    factoryState: terminalState,
+                    activeRunId: null,
+                    pendingRunType: null,
+                    pendingRunContextJson: null,
+                },
             });
-        }
-        this.db.issueSessions.upsertIssueRespectingActiveLease(issue.projectId, issue.linearIssueId, {
-            projectId: issue.projectId,
-            linearIssueId: issue.linearIssueId,
-            delegatedToPatchRelay: false,
-            factoryState: terminalState,
-            activeRunId: null,
-            pendingRunType: null,
-            pendingRunContextJson: null,
+            if (run && commit.outcome === "applied") {
+                this.db.runs.finishRun(run.id, {
+                    status: "released",
+                    failureReason: options?.reason
+                        ? `Operator closed issue as ${terminalState}: ${options.reason}`
+                        : `Operator closed issue as ${terminalState}`,
+                });
+            }
         });
         this.db.issueSessions.releaseIssueSessionLeaseRespectingActiveLease(issue.projectId, issue.linearIssueId);
         this.feed.publish({