specrails-desktop 2.29.0 → 2.29.2

package/server/dist/db.js

@@ -3,9 +3,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKTREE_ENV_NAME_RE = exports.DEFAULT_FREESTYLE_PRE_PROMPT = void 0;
+exports.WORKTREE_ENV_NAME_RE = exports.DEFAULT_FREESTYLE_PRE_PROMPT = exports.JobRecoveryPendingError = void 0;
 exports.initDb = initDb;
 exports.createJob = createJob;
+exports.upsertQueuedJob = upsertQueuedJob;
+exports.deleteQueuedJob = deleteQueuedJob;
 exports.markJobInteractive = markJobInteractive;
 exports.accumulateInteractiveTurn = accumulateInteractiveTurn;
 exports.finalizeInteractiveJob = finalizeInteractiveJob;
@@ -58,6 +60,63 @@ const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const better_sqlite3_1 = __importDefault(require("better-sqlite3"));
 const secure_fs_1 = require("./util/secure-fs");
+/** Backfill only terminal Safe-PR rows whose ticket ownership is unambiguous.
+ * Eligibility is intentionally deferred to the outbox drainer, which freezes
+ * only candidates still parked at on_review in the external ticket JSON. */
+function backfillTerminalRailPrTicketEffects(db) {
+    const terminalRows = db.prepare(`
+    SELECT id, ticket_ids, run_ids, decision, is_continuation,
+           supersedes_delivery_id, pr_url
+      FROM rail_pr_deliveries
+     WHERE decision = 'merged'
+        OR (decision = 'discarded' AND is_continuation = 0
+            AND supersedes_delivery_id IS NULL AND pr_url IS NULL)
+  `).all();
+    const insertEffect = db.prepare(`
+    INSERT OR IGNORE INTO rail_pr_ticket_effects (
+      delivery_id, ticket_ids, causal_owners, target_status, jira_action, pr_url
+    ) VALUES (?, ?, ?, ?, ?, ?)
+  `);
+    const currentOwner = db.prepare(`
+    SELECT owner_id FROM ticket_outcome_ownership WHERE ticket_id = ?
+  `);
+    for (const row of terminalRows) {
+        let ticketIds = [];
+        let runIds = [];
+        try {
+            const parsed = JSON.parse(row.ticket_ids);
+            if (Array.isArray(parsed)) {
+                ticketIds = [...new Set(parsed.filter((id) => Number.isSafeInteger(id) && id > 0))];
+            }
+        }
+        catch { /* malformed historical evidence is not safe to act on */ }
+        try {
+            const parsed = JSON.parse(row.run_ids);
+            if (Array.isArray(parsed)) {
+                runIds = [...new Set(parsed.filter((id) => typeof id === 'string' && id.length > 0))];
+            }
+        }
+        catch { /* absent causal evidence means the historical effect is unsafe */ }
+        if (ticketIds.length === 0 || runIds.length === 0)
+            continue;
+        const allowedOwners = new Set(runIds);
+        const causalOwners = {};
+        ticketIds = ticketIds.filter((ticketId) => {
+            const owner = currentOwner.get(ticketId);
+            if (!owner || !allowedOwners.has(owner.owner_id))
+                return false;
+            causalOwners[String(ticketId)] = owner.owner_id;
+            return true;
+        });
+        if (ticketIds.length === 0)
+            continue;
+        const merged = row.decision === 'merged';
+        insertEffect.run(row.id, JSON.stringify(ticketIds), JSON.stringify(causalOwners), merged ? 'done' : 'todo', 
+        // A v49 fresh discard has lost whether it meant Refine or a real
+        // discard. Recover the backlog status without inventing either cause.
+        merged ? 'merged' : 'backlog', merged ? row.pr_url : null);
+    }
+}
 const MIGRATIONS = [
     // Migration 1: initial schema
     (db) => {
@@ -802,6 +861,550 @@ const MIGRATIONS = [
       INSERT OR IGNORE INTO rail_meta (rail_index, name) VALUES (0, NULL), (1, NULL), (2, NULL);
     `);
     },
+    // Migration 40: durable idempotency ledger for billable job spawns. Clients
+    // can safely retry a timed-out POST (or double-submit) without enqueueing a
+    // second job. Entries are deliberately short-lived and pruned by the route;
+    // the ledger is not job history and therefore has no foreign key to jobs.
+    (db) => {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS job_spawn_requests (
+        idempotency_key TEXT PRIMARY KEY,
+        fingerprint     TEXT NOT NULL,
+        job_id          TEXT NOT NULL,
+        created_at_ms   INTEGER NOT NULL,
+        expires_at_ms   INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_job_spawn_requests_expires
+        ON job_spawn_requests(expires_at_ms);
+    `);
+    },
+    // Migration 41: durable outbox for jobs left RUNNING by an ungraceful
+    // process exit. QueueManager atomically snapshots each orphan here before it
+    // flips the job to failed, then checkpoints accounting and the terminal
+    // domain callback independently. A second crash can therefore resume either
+    // step without duplicating the ai_invocations ledger or losing the callback.
+    (db) => {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS orphan_job_recovery (
+        job_id               TEXT PRIMARY KEY,
+        payload              TEXT NOT NULL,
+        accounting_completed INTEGER NOT NULL DEFAULT 0 CHECK (accounting_completed IN (0, 1)),
+        callback_completed   INTEGER NOT NULL DEFAULT 0 CHECK (callback_completed IN (0, 1)),
+        created_at           TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+      CREATE INDEX IF NOT EXISTS idx_orphan_job_recovery_pending
+        ON orphan_job_recovery(accounting_completed, callback_completed);
+    `);
+    },
+    // Migration 42: persist the provider actually selected for each job and add
+    // a third durable recovery checkpoint for queue/pipeline terminal invariants.
+    // Both ALTERs are guarded so developer databases that already applied the
+    // unreleased orphan-outbox migration can advance safely.
+    (db) => {
+        const jobCols = db.prepare(`PRAGMA table_info(jobs)`).all().map((r) => r.name);
+        if (!jobCols.includes('provider')) {
+            db.exec(`ALTER TABLE jobs ADD COLUMN provider TEXT`);
+        }
+        const recoveryCols = db.prepare(`PRAGMA table_info(orphan_job_recovery)`).all().map((r) => r.name);
+        if (!recoveryCols.includes('terminal_completed')) {
+            db.exec(`
+        ALTER TABLE orphan_job_recovery
+        ADD COLUMN terminal_completed INTEGER NOT NULL DEFAULT 0
+          CHECK (terminal_completed IN (0, 1))
+      `);
+        }
+    },
+    // Migration 43: durable pre-start queue. This is intentionally separate from
+    // jobs: a queue admission is not an execution and therefore has no truthful
+    // jobs.started_at value. createJob atomically promotes a row out of this table
+    // when the provider process actually starts.
+    (db) => {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS queued_jobs (
+        id                TEXT PRIMARY KEY,
+        command           TEXT NOT NULL,
+        queue_position    INTEGER,
+        priority          TEXT NOT NULL DEFAULT 'normal',
+        depends_on_job_id TEXT,
+        pipeline_id       TEXT,
+        provider          TEXT,
+        model             TEXT,
+        profile_name      TEXT,
+        profile_selection_set INTEGER NOT NULL DEFAULT 0
+          CHECK (profile_selection_set IN (0, 1)),
+        interactive       INTEGER CHECK (interactive IN (0, 1)),
+        causal_ownership  INTEGER NOT NULL DEFAULT 0
+          CHECK (causal_ownership IN (0, 1)),
+        enqueued_at       TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+      CREATE INDEX IF NOT EXISTS idx_queued_jobs_position
+        ON queued_jobs(queue_position);
+    `);
+    },
+    // Migration 44: persist which manager owns terminal recovery for each jobs
+    // row. Before this boundary QueueManager swept every RUNNING row, including
+    // LoopRunManager's backing rows, and recorded their already-accounted step
+    // spend again as surface='job'. Existing loop rows are classified by their
+    // durable loop_runs identity; every other historical job remains queue-owned.
+    (db) => {
+        const jobCols = db.prepare(`PRAGMA table_info(jobs)`).all().map((r) => r.name);
+        if (!jobCols.includes('owner')) {
+            db.exec(`
+        ALTER TABLE jobs
+        ADD COLUMN owner TEXT NOT NULL DEFAULT 'queue'
+          CHECK (owner IN ('queue', 'loop'))
+      `);
+        }
+        db.exec(`
+      UPDATE jobs
+         SET owner = 'loop',
+             provider = COALESCE(
+               jobs.provider,
+               (SELECT loop_runs.provider FROM loop_runs WHERE loop_runs.id = jobs.id)
+             )
+       WHERE EXISTS (SELECT 1 FROM loop_runs WHERE loop_runs.id = jobs.id);
+      CREATE INDEX IF NOT EXISTS idx_jobs_owner_status ON jobs(owner, status);
+    `);
+    },
+    // Migration 45: crash-consistent loop terminal/accounting outboxes and
+    // causal ownership for rail/ticket effects.  `loop_runs.ticket_ids_json`
+    // replaces the old startup heuristic ("one active run means scope=all") with
+    // the exact launch set.  The recovery tables intentionally have no FK to
+    // jobs: terminal history is independently deletable while recovery effects
+    // still have to finish.
+    (db) => {
+        const loopCols = db.prepare(`PRAGMA table_info(loop_runs)`).all().map((r) => r.name);
+        if (!loopCols.includes('ticket_ids_json')) {
+            db.exec(`ALTER TABLE loop_runs ADD COLUMN ticket_ids_json TEXT NOT NULL DEFAULT '[]'`);
+        }
+        if (!loopCols.includes('ticket_completion_status')) {
+            db.exec(`
+        ALTER TABLE loop_runs
+        ADD COLUMN ticket_completion_status TEXT NOT NULL DEFAULT 'done'
+          CHECK (ticket_completion_status IN ('done', 'on_review'))
+      `);
+        }
+        if (!loopCols.includes('causal_ownership')) {
+            db.exec(`
+        ALTER TABLE loop_runs
+        ADD COLUMN causal_ownership INTEGER NOT NULL DEFAULT 0
+          CHECK (causal_ownership IN (0, 1))
+      `);
+        }
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS loop_terminal_recovery (
+        run_id             TEXT PRIMARY KEY,
+        payload            TEXT NOT NULL,
+        callback_completed INTEGER NOT NULL DEFAULT 0
+          CHECK (callback_completed IN (0, 1)),
+        created_at         TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+
+      CREATE TABLE IF NOT EXISTS loop_step_recovery (
+        run_id         TEXT NOT NULL,
+        step_key       TEXT NOT NULL,
+        invocation_id  TEXT NOT NULL UNIQUE,
+        payload        TEXT NOT NULL,
+        created_at     TEXT NOT NULL DEFAULT (datetime('now')),
+        PRIMARY KEY (run_id, step_key)
+      );
+      CREATE INDEX IF NOT EXISTS idx_loop_step_recovery_run
+        ON loop_step_recovery(run_id);
+
+      CREATE TABLE IF NOT EXISTS rail_ticket_ownership (
+        rail_index INTEGER NOT NULL,
+        ticket_id  INTEGER NOT NULL,
+        owner_id   TEXT NOT NULL,
+        generation INTEGER NOT NULL DEFAULT 1,
+        claimed_at TEXT NOT NULL DEFAULT (datetime('now')),
+        PRIMARY KEY (rail_index, ticket_id)
+      );
+      CREATE INDEX IF NOT EXISTS idx_rail_ticket_owner
+        ON rail_ticket_ownership(owner_id);
+
+      CREATE TABLE IF NOT EXISTS ticket_outcome_ownership (
+        ticket_id   INTEGER PRIMARY KEY,
+        owner_id    TEXT NOT NULL,
+        generation  INTEGER NOT NULL DEFAULT 1,
+        claimed_at  TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+      CREATE INDEX IF NOT EXISTS idx_ticket_outcome_owner
+        ON ticket_outcome_ownership(owner_id);
+
+      -- Builds from the pre-owner WIP may already have captured loop backing
+      -- rows in QueueManager's outbox, or even checkpointed the resulting
+      -- surface='job' invocation.  Those rows are unambiguously wrong: a jobs
+      -- id that is also a loop_runs id is exclusively loop-owned.
+      DELETE FROM orphan_job_recovery
+       WHERE job_id IN (SELECT id FROM loop_runs);
+      DELETE FROM ai_invocations
+       WHERE surface = 'job'
+         AND EXISTS (
+           SELECT 1 FROM loop_runs
+            WHERE ai_invocations.surface_ref_id = loop_runs.id
+               OR ai_invocations.surface_ref_id LIKE loop_runs.id || '#t%'
+         );
+    `);
+    },
+    // Migration 46: preserve every pre-spawn semantic override across restart.
+    // Nullable provider/model/interactive encode "use the spawn-time default";
+    // profile needs a separate presence bit because NULL itself means the
+    // deliberate force-legacy selection when the bit is set.
+    (db) => {
+        const cols = new Set(db.prepare(`PRAGMA table_info(queued_jobs)`).all()
+            .map((row) => row.name));
+        if (!cols.has('provider')) {
+            db.exec(`ALTER TABLE queued_jobs ADD COLUMN provider TEXT`);
+        }
+        if (!cols.has('model')) {
+            db.exec(`ALTER TABLE queued_jobs ADD COLUMN model TEXT`);
+        }
+        if (!cols.has('profile_name')) {
+            db.exec(`ALTER TABLE queued_jobs ADD COLUMN profile_name TEXT`);
+        }
+        if (!cols.has('profile_selection_set')) {
+            db.exec(`
+        ALTER TABLE queued_jobs
+        ADD COLUMN profile_selection_set INTEGER NOT NULL DEFAULT 0
+          CHECK (profile_selection_set IN (0, 1))
+      `);
+        }
+        if (!cols.has('interactive')) {
+            db.exec(`
+        ALTER TABLE queued_jobs
+        ADD COLUMN interactive INTEGER CHECK (interactive IN (0, 1))
+      `);
+        }
+        if (!cols.has('causal_ownership')) {
+            db.exec(`
+        ALTER TABLE queued_jobs
+        ADD COLUMN causal_ownership INTEGER NOT NULL DEFAULT 0
+          CHECK (causal_ownership IN (0, 1))
+      `);
+        }
+        const jobCols = new Set(db.prepare(`PRAGMA table_info(jobs)`).all()
+            .map((row) => row.name));
+        if (!jobCols.has('causal_ownership')) {
+            db.exec(`
+        ALTER TABLE jobs
+        ADD COLUMN causal_ownership INTEGER NOT NULL DEFAULT 0
+          CHECK (causal_ownership IN (0, 1))
+      `);
+        }
+    },
+    // Migration 47: crash recovery reads the bounded newest provider frontier;
+    // this composite index avoids sorting/scanning an unbounded transcript while
+    // the queue is fail-stopped during startup.
+    (db) => {
+        db.exec(`CREATE INDEX IF NOT EXISTS idx_events_job_seq ON events(job_id, seq)`);
+    },
+    // Migration 48: truthful Safe-PR settlement. Execution truth, delivery
+    // readiness, continuation ownership and decision-operation ownership are
+    // independent durable facts; the old decision/pr_state pair cannot explain
+    // a successful run whose commit/ref/push later failed. Before enforcing the
+    // intended one-active-generation-per-rail invariant, terminalize historical
+    // duplicate rows deterministically (newest rowid wins) so an older iteration
+    // can never resurface after the current one closes.
+    (db) => {
+        const cols = new Set(db.prepare(`PRAGMA table_info(rail_pr_deliveries)`).all()
+            .map((row) => row.name));
+        const add = (name, ddl) => {
+            if (!cols.has(name))
+                db.exec(`ALTER TABLE rail_pr_deliveries ADD COLUMN ${ddl}`);
+        };
+        add('implementation_outcome', `implementation_outcome TEXT NOT NULL DEFAULT 'unknown'`);
+        add('delivery_outcome', `delivery_outcome TEXT NOT NULL DEFAULT 'unknown'`);
+        add('status_code', `status_code TEXT`);
+        add('status_detail', `status_detail TEXT`);
+        add('delivery_sha', `delivery_sha TEXT`);
+        add('is_continuation', `is_continuation INTEGER NOT NULL DEFAULT 0 CHECK (is_continuation IN (0, 1))`);
+        add('supersedes_delivery_id', `supersedes_delivery_id TEXT`);
+        add('operation', `operation TEXT`);
+        add('operation_token', `operation_token TEXT`);
+        add('operation_started_at_ms', `operation_started_at_ms INTEGER`);
+        add('cleanup_warnings', `cleanup_warnings TEXT NOT NULL DEFAULT '[]'`);
+        db.exec(`
+      UPDATE rail_pr_deliveries
+         SET implementation_outcome = CASE decision
+           WHEN 'building' THEN 'running'
+           WHEN 'implementation_failed' THEN 'failed'
+           WHEN 'on_review' THEN 'succeeded'
+           WHEN 'pr_draft' THEN 'succeeded'
+           WHEN 'pr_ready' THEN 'succeeded'
+           WHEN 'pr_failed' THEN 'succeeded'
+           WHEN 'merged' THEN 'succeeded'
+           ELSE implementation_outcome
+         END
+       WHERE implementation_outcome = 'unknown';
+
+      UPDATE rail_pr_deliveries
+         SET delivery_outcome = CASE decision
+           WHEN 'building' THEN 'pending'
+           WHEN 'implementation_failed' THEN 'not_started'
+           WHEN 'on_review' THEN 'ready'
+           WHEN 'pr_draft' THEN 'delivered'
+           WHEN 'pr_ready' THEN 'delivered'
+           WHEN 'pr_failed' THEN 'retryable_failure'
+           WHEN 'merged' THEN 'delivered'
+           ELSE delivery_outcome
+         END
+       WHERE delivery_outcome = 'unknown';
+
+      UPDATE rail_pr_deliveries
+         SET status_code = CASE decision
+           WHEN 'building' THEN 'implementation_running'
+           WHEN 'implementation_failed' THEN 'implementation_failed'
+           WHEN 'on_review' THEN 'ready_for_review'
+           WHEN 'pr_draft' THEN 'pr_draft_ready'
+           WHEN 'pr_ready' THEN 'pr_ready'
+           WHEN 'pr_failed' THEN 'delivery_failed'
+           WHEN 'merged' THEN 'merged'
+           ELSE status_code
+         END
+       WHERE status_code IS NULL;
+
+      UPDATE rail_pr_deliveries
+         SET decision = 'superseded',
+             status_code = 'superseded',
+             updated_at = datetime('now')
+       WHERE decision NOT IN ('merged', 'discarded', 'superseded')
+         AND rowid NOT IN (
+           SELECT MAX(rowid)
+             FROM rail_pr_deliveries
+            WHERE decision NOT IN ('merged', 'discarded', 'superseded')
+            GROUP BY rail_index
+         );
+
+      CREATE UNIQUE INDEX IF NOT EXISTS idx_rail_pr_deliveries_one_active_per_rail
+        ON rail_pr_deliveries(rail_index)
+        WHERE decision NOT IN ('merged', 'discarded', 'superseded');
+    `);
+    },
+    // Migration 49: repair the exact legacy false-failure shape that motivated
+    // the orthogonal lifecycle. Older settlement code could write
+    // decision='implementation_failed' after every loop had durably succeeded,
+    // solely because commit/ref delivery failed. Reclassify only rows whose full
+    // run set is present and terminal; ambiguous rows remain conservative. This
+    // migration also makes truthful no-change acknowledgement (`completed`) a
+    // terminal generation for the one-active-per-rail invariant.
+    (db) => {
+        const legacyRows = db.prepare(`
+      SELECT id, run_ids, branches
+        FROM rail_pr_deliveries
+       WHERE decision = 'implementation_failed'
+    `).all();
+        const update = db.prepare(`
+      UPDATE rail_pr_deliveries
+         SET decision = 'pr_failed',
+             implementation_outcome = ?,
+             delivery_outcome = 'blocked',
+             status_code = 'settlement_interrupted',
+             status_detail = ?,
+             branches = ?,
+             updated_at = datetime('now')
+       WHERE id = ? AND decision = 'implementation_failed'
+    `);
+        for (const row of legacyRows) {
+            let runIds = [];
+            try {
+                const parsed = JSON.parse(row.run_ids);
+                if (Array.isArray(parsed)) {
+                    runIds = [...new Set(parsed.filter((value) => typeof value === 'string' && value.length > 0))];
+                }
+            }
+            catch { /* malformed legacy evidence stays conservative */ }
+            if (runIds.length === 0)
+                continue;
+            const placeholders = runIds.map(() => '?').join(',');
+            const runs = db.prepare(`
+        SELECT id, status, final_outcome
+          FROM loop_runs
+         WHERE id IN (${placeholders})
+      `).all(...runIds);
+            if (runs.length !== runIds.length || runs.some((run) => run.status !== 'completed'))
+                continue;
+            const outcomes = new Map(runs.map((run) => [run.id, run.final_outcome]));
+            const succeeded = runIds.filter((runId) => outcomes.get(runId) === 'success').length;
+            if (succeeded === 0)
+                continue;
+            let branches = [];
+            try {
+                const parsed = JSON.parse(row.branches);
+                if (Array.isArray(parsed))
+                    branches = parsed;
+            }
+            catch { /* retain an empty evidence set rather than malformed JSON */ }
+            const repairedBranches = branches.map((value, index) => {
+                if (!value || typeof value !== 'object')
+                    return value;
+                const unit = value;
+                const runId = runIds[index];
+                const implementationSucceeded = runId ? outcomes.get(runId) === 'success' : succeeded === runIds.length;
+                return {
+                    ...unit,
+                    ...(runId ? { runId } : {}),
+                    implementationOutcome: implementationSucceeded ? 'succeeded' : 'failed',
+                    deliveryOutcome: implementationSucceeded ? 'blocked' : 'not_started',
+                    ...(implementationSucceeded ? { failureCode: 'settlement_interrupted' } : {}),
+                };
+            });
+            update.run(succeeded === runIds.length ? 'succeeded' : 'partially_succeeded', 'Recovered the successful implementation result from durable run logs; legacy delivery settlement was interrupted.', JSON.stringify(repairedBranches), row.id);
+        }
+        db.exec(`
+      DROP INDEX IF EXISTS idx_rail_pr_deliveries_one_active_per_rail;
+      CREATE UNIQUE INDEX idx_rail_pr_deliveries_one_active_per_rail
+        ON rail_pr_deliveries(rail_index)
+        WHERE decision NOT IN ('completed', 'merged', 'discarded', 'superseded');
+    `);
+    },
+    // Migration 50: terminal Safe-PR decisions and their ticket-file mutation
+    // cross SQLite/JSON boundaries. Persist an idempotent outbox row in the same
+    // transaction as the terminal decision so a crash can never leave tickets
+    // parked on_review with no legal action left to replay.
+    (db) => {
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS rail_pr_ticket_effects (
+        delivery_id        TEXT PRIMARY KEY,
+        ticket_ids         TEXT NOT NULL,
+        causal_owners      TEXT NOT NULL DEFAULT '{}',
+        applied_ticket_ids TEXT,
+        target_status      TEXT NOT NULL CHECK (target_status IN ('todo', 'done')),
+        jira_action        TEXT NOT NULL CHECK (jira_action IN ('discard', 'merged', 'completed', 'refine', 'backlog')),
+        pr_url             TEXT,
+        attempts           INTEGER NOT NULL DEFAULT 0,
+        last_error         TEXT,
+        tickets_applied_at TEXT,
+        jira_enqueued_at   TEXT,
+        completed_at       TEXT,
+        created_at         TEXT NOT NULL DEFAULT (datetime('now')),
+        updated_at         TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+      CREATE INDEX IF NOT EXISTS idx_rail_pr_ticket_effects_pending
+        ON rail_pr_ticket_effects(completed_at)
+        WHERE completed_at IS NULL;
+    `);
+        // Keep the migration restart-safe for development DBs that may have run an
+        // earlier migration-50 draft before these phase columns were added. Shipped
+        // migrations remain atomic, but additive guards make local upgrade testing
+        // deterministic as well.
+        const effectCols = new Set(db.prepare(`PRAGMA table_info(rail_pr_ticket_effects)`).all()
+            .map((row) => row.name));
+        if (!effectCols.has('applied_ticket_ids')) {
+            db.exec(`ALTER TABLE rail_pr_ticket_effects ADD COLUMN applied_ticket_ids TEXT`);
+        }
+        if (!effectCols.has('tickets_applied_at')) {
+            db.exec(`ALTER TABLE rail_pr_ticket_effects ADD COLUMN tickets_applied_at TEXT`);
+        }
+        if (!effectCols.has('jira_enqueued_at')) {
+            db.exec(`ALTER TABLE rail_pr_ticket_effects ADD COLUMN jira_enqueued_at TEXT`);
+        }
+        if (!effectCols.has('causal_owners')) {
+            db.exec(`ALTER TABLE rail_pr_ticket_effects ADD COLUMN causal_owners TEXT NOT NULL DEFAULT '{}'`);
+        }
+    },
+    // Migration 51: a development build briefly shipped migration 50 without
+    // phase columns and with a CHECK that allowed only discard/merged. A DB that
+    // already records version 50 will never rerun its edited body, so rebuild the
+    // table once, preserve every row, and install the complete action contract.
+    // Migration 52 owns the causal historical backfill after both schemas exist.
+    (db) => {
+        const table = db.prepare(`
+      SELECT sql FROM sqlite_master
+       WHERE type = 'table' AND name = 'rail_pr_ticket_effects'
+    `).get();
+        const createFullTable = (name) => {
+            db.exec(`
+        CREATE TABLE ${name} (
+          delivery_id        TEXT PRIMARY KEY,
+          ticket_ids         TEXT NOT NULL,
+          causal_owners      TEXT NOT NULL DEFAULT '{}',
+          applied_ticket_ids TEXT,
+          target_status      TEXT NOT NULL CHECK (target_status IN ('todo', 'done')),
+          jira_action        TEXT NOT NULL CHECK (jira_action IN ('discard', 'merged', 'completed', 'refine', 'backlog')),
+          pr_url             TEXT,
+          attempts           INTEGER NOT NULL DEFAULT 0,
+          last_error         TEXT,
+          tickets_applied_at TEXT,
+          jira_enqueued_at   TEXT,
+          completed_at       TEXT,
+          created_at         TEXT NOT NULL DEFAULT (datetime('now')),
+          updated_at         TEXT NOT NULL DEFAULT (datetime('now'))
+        )
+      `);
+        };
+        if (!table) {
+            createFullTable('rail_pr_ticket_effects');
+        }
+        else {
+            const cols = new Set(db.prepare(`PRAGMA table_info(rail_pr_ticket_effects)`).all()
+                .map((row) => row.name));
+            const sql = table.sql ?? '';
+            const complete = ['causal_owners', 'applied_ticket_ids', 'tickets_applied_at', 'jira_enqueued_at']
+                .every((column) => cols.has(column)) &&
+                ['completed', 'refine', 'backlog'].every((action) => sql.includes(`'${action}'`));
+            if (!complete) {
+                db.exec(`DROP TABLE IF EXISTS rail_pr_ticket_effects_v51`);
+                createFullTable('rail_pr_ticket_effects_v51');
+                const value = (column, fallback) => cols.has(column) ? column : fallback;
+                db.exec(`
+          INSERT INTO rail_pr_ticket_effects_v51 (
+            delivery_id, ticket_ids, causal_owners, applied_ticket_ids, target_status,
+            jira_action, pr_url, attempts, last_error, tickets_applied_at,
+            jira_enqueued_at, completed_at, created_at, updated_at
+          )
+          SELECT
+            ${value('delivery_id', "''")},
+            ${value('ticket_ids', "'[]'")},
+            ${value('causal_owners', "'{}'")},
+            ${value('applied_ticket_ids', 'NULL')},
+            ${value('target_status', "'todo'")},
+            ${value('jira_action', "'backlog'")},
+            ${value('pr_url', 'NULL')},
+            ${value('attempts', '0')},
+            ${value('last_error', 'NULL')},
+            ${value('tickets_applied_at', 'NULL')},
+            ${value('jira_enqueued_at', 'NULL')},
+            ${value('completed_at', 'NULL')},
+            ${value('created_at', "datetime('now')")},
+            ${value('updated_at', "datetime('now')")}
+          FROM rail_pr_ticket_effects;
+
+          DROP TABLE rail_pr_ticket_effects;
+          ALTER TABLE rail_pr_ticket_effects_v51 RENAME TO rail_pr_ticket_effects;
+        `);
+            }
+        }
+        db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_rail_pr_ticket_effects_pending
+        ON rail_pr_ticket_effects(completed_at)
+        WHERE completed_at IS NULL
+    `);
+    },
+    // Migration 52: bind every ticket effect to the SQLite ticket-generation
+    // owner that created it. Historical terminal rows are backfilled only when
+    // their run_ids still own the ticket; an old merge/discard can therefore
+    // never mutate a newer iteration merely because it is also on_review.
+    (db) => {
+        // Some development builds recorded migration 45 before its ownership
+        // table was added. Repair that incomplete historical shape before the
+        // causal backfill so one damaged project DB cannot prevent app startup.
+        db.exec(`
+      CREATE TABLE IF NOT EXISTS ticket_outcome_ownership (
+        ticket_id   INTEGER PRIMARY KEY,
+        owner_id    TEXT NOT NULL,
+        generation  INTEGER NOT NULL DEFAULT 1,
+        claimed_at  TEXT NOT NULL DEFAULT (datetime('now'))
+      );
+      CREATE INDEX IF NOT EXISTS idx_ticket_outcome_owner
+        ON ticket_outcome_ownership(owner_id);
+    `);
+        const cols = new Set(db.prepare(`PRAGMA table_info(rail_pr_ticket_effects)`).all()
+            .map((row) => row.name));
+        if (!cols.has('causal_owners')) {
+            db.exec(`ALTER TABLE rail_pr_ticket_effects ADD COLUMN causal_owners TEXT NOT NULL DEFAULT '{}'`);
+        }
+        backfillTerminalRailPrTicketEffects(db);
+    },
 ];
 function applyMigrations(db) {
     // Ensure the migrations table exists (migration 1 creates it, but we need
@@ -854,17 +1457,53 @@ function initDb(dbPath) {
     // transcripts and verbatim terminal command history). After migrations the
     // WAL/SHM files exist, so this covers them too.
     (0, secure_fs_1.secureDbFile)(dbPath);
-    // Orphan sweep: mark any running jobs as failed on startup
-    db.prepare("UPDATE jobs SET status = 'failed', finished_at = ? WHERE status = 'running'").run(new Date().toISOString());
     // Orphan sweep: cancel any in-flight proposals from a previous server session
     db.prepare("UPDATE proposals SET status = 'cancelled', updated_at = ? WHERE status IN ('exploring', 'refining')").run(new Date().toISOString());
     return db;
 }
 function createJob(db, job) {
-    // INSERT OR IGNORE handles the case where the job row already exists (restored from DB
-    // after server restart). The UPDATE that follows always sets status and started_at.
-    db.prepare('INSERT OR IGNORE INTO jobs (id, command, started_at, status, priority, depends_on_job_id, pipeline_id, interactive) VALUES (?, ?, ?, ?, ?, ?, ?, ?)').run(job.id, job.command, job.started_at, 'running', job.priority ?? 'normal', job.depends_on_job_id ?? null, job.pipeline_id ?? null, job.interactive ? 1 : 0);
-    db.prepare('UPDATE jobs SET status = ?, started_at = ?, interactive = ? WHERE id = ?').run('running', job.started_at, job.interactive ? 1 : 0, job.id);
+    // Promotion is atomic: after a crash the job is either still replayable in
+    // queued_jobs or is a running jobs row, never absent from both. INSERT OR
+    // IGNORE preserves idempotency for legacy/restored jobs that already exist.
+    const promote = db.transaction(() => {
+        db.prepare('INSERT OR IGNORE INTO jobs (id, command, started_at, status, provider, owner, priority, depends_on_job_id, pipeline_id, interactive, causal_ownership) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)').run(job.id, job.command, job.started_at, 'running', job.provider ?? null, job.owner ?? 'queue', job.priority ?? 'normal', job.depends_on_job_id ?? null, job.pipeline_id ?? null, job.interactive ? 1 : 0, job.causal_ownership ? 1 : 0);
+        db.prepare('UPDATE jobs SET status = ?, started_at = ?, provider = ?, owner = ?, interactive = ?, causal_ownership = ? WHERE id = ?').run('running', job.started_at, job.provider ?? null, job.owner ?? 'queue', job.interactive ? 1 : 0, job.causal_ownership ? 1 : 0, job.id);
+        db.prepare('DELETE FROM queued_jobs WHERE id = ?').run(job.id);
+    });
+    promote();
+}
+/** Idempotently persist a job that has been admitted but has not started. */
+function upsertQueuedJob(db, job) {
+    db.prepare(`
+    INSERT INTO queued_jobs (
+      id, command, queue_position, priority, depends_on_job_id, pipeline_id,
+      provider, model, profile_name, profile_selection_set, interactive,
+      causal_ownership
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      command = excluded.command,
+      queue_position = excluded.queue_position,
+      priority = excluded.priority,
+      depends_on_job_id = excluded.depends_on_job_id,
+      pipeline_id = excluded.pipeline_id,
+      provider = excluded.provider,
+      model = excluded.model,
+      profile_name = excluded.profile_name,
+      profile_selection_set = excluded.profile_selection_set,
+      interactive = excluded.interactive,
+      causal_ownership = excluded.causal_ownership
+  `).run(job.id, job.command, job.queue_position, job.priority, job.depends_on_job_id ?? null, job.pipeline_id ?? null, job.provider ?? null, job.model ?? null, job.profile_name ?? null, job.profile_selection_set ? 1 : 0, job.interactive == null ? null : (job.interactive ? 1 : 0), job.causal_ownership ? 1 : 0);
+}
+/** Remove a queued admission after cancellation/skip. Idempotent.
+ *
+ * Migration 43 deliberately keeps a read fallback for pre-migration builds
+ * that represented queued work in `jobs`. Remove that legacy representation
+ * too, but only while it is still queued: promotion changes the status to
+ * running before calling this helper, and terminal history must never be
+ * deleted here. */
+function deleteQueuedJob(db, jobId) {
+    db.prepare('DELETE FROM queued_jobs WHERE id = ?').run(jobId);
+    db.prepare("DELETE FROM jobs WHERE id = ? AND status = 'queued'").run(jobId);
 }
 /**
  * Flip a job row's `interactive` flag AFTER creation. Used by the loop engine
@@ -972,6 +1611,15 @@ function getJobEvents(db, jobId) {
         .prepare('SELECT * FROM events WHERE job_id = ? ORDER BY seq ASC')
         .all(jobId);
 }
+class JobRecoveryPendingError extends Error {
+    jobId;
+    constructor(jobId) {
+        super('Job recovery is still pending; retry deletion after recovery completes');
+        this.jobId = jobId;
+        this.name = 'JobRecoveryPendingError';
+    }
+}
+exports.JobRecoveryPendingError = JobRecoveryPendingError;
 function deleteJob(db, jobId) {
     // M7: jobs.depends_on_job_id REFERENCES jobs(id) with no ON DELETE action and
     // foreign_keys=ON, so deleting a pipeline parent throws 'FOREIGN KEY
@@ -979,6 +1627,11 @@ function deleteJob(db, jobId) {
     // references first, in the same transaction as the delete, so it always
     // succeeds (children keep running; they just lose the now-irrelevant pointer).
     const tx = db.transaction((id) => {
+        const pendingLoopStep = db.prepare(`SELECT 1 FROM loop_step_recovery WHERE run_id = ? LIMIT 1`).get(id);
+        const pendingQueueRecovery = db.prepare(`SELECT 1 FROM orphan_job_recovery WHERE job_id = ? LIMIT 1`).get(id);
+        if (pendingLoopStep || pendingQueueRecovery) {
+            throw new JobRecoveryPendingError(id);
+        }
         db.prepare('UPDATE jobs SET depends_on_job_id = NULL WHERE depends_on_job_id = ?').run(id);
         // B41: events/job_phases cascade on the jobs FK, but telemetry_blobs/
         // telemetry_summaries (keyed `jobId`), job_profiles and file_provenance
@@ -993,7 +1646,11 @@ function deleteJob(db, jobId) {
     tx(jobId);
 }
 function purgeJobs(db, opts) {
-    const conditions = ["status IN ('completed', 'failed', 'canceled', 'zombie_terminated', 'skipped')"];
+    const conditions = [
+        "status IN ('completed', 'failed', 'canceled', 'zombie_terminated', 'skipped')",
+        'NOT EXISTS (SELECT 1 FROM loop_step_recovery WHERE loop_step_recovery.run_id = jobs.id)',
+        'NOT EXISTS (SELECT 1 FROM orphan_job_recovery WHERE orphan_job_recovery.job_id = jobs.id)',
+    ];
     const params = [];
     if (opts?.from) {
         conditions.push('started_at >= ?');