feat(task-state): replace the dot-lock with the kernel-owned SQLite mutex

[unohee]

Summary

Published because this run stopped and needs a human: autonomous execution failed 4 times

It has not been reviewed and is very likely incomplete — this PR is a draft on purpose. It exists so the work is reviewable instead of sitting on a branch that was never pushed.

Change shape

420 file(s): 208 source · 189 test · 3 docs · 20 other

Base freshness

Branch base is 177 commit(s) behind main at publication.

⚠ Conflicts with main in: package-lock.json, package.json
GitHub runs no pull_request workflows on a PR it cannot merge, so any green checks here are not the verification gate. Opened as a draft; rebase before review.

⚠️ File overlap with in-flight work

This branch changes files that other open PRs / active branches also touch. Coordinate before merging to avoid divergent parallel edits (INT-2388 #3):

• PR fix(output): enforce aggregate output budgets across agents, Discord, runners, and TUI — prevent payload rejection and rendering abuse #782 (swarm/AGT-3422-fix-output-enforce-aggregate-output-budg) — 2 file(s): package-lock.json, package.json
• PR fix(integrations): validate provider and CLI boundary data — prevent unsafe redirects, invalid registry entries, and invalid PR state #778 (swarm/AGT-3442-fix-integrations-validate-provider-and-c) — 1 file(s): package-lock.json
• PR fix(graphql-costing): account for aliased expensive mutations — enforce query-cost limits against resolver multiplication #774 (swarm/AGT-3473-fix-graphql-costing-account-for-aliased-) — 2 file(s): package-lock.json, package.json
• PR fix(memory): make retrieval, compaction, and statistics complete at scale — prevent lossy results and quadratic work #772 (swarm/AGT-3491-fix-memory-make-retrieval-compaction-and) — 2 file(s): package-lock.json, package.json
• PR fix(state): make task and graph state updates atomic and validated — prevent lost updates and invalid persisted state #767 (swarm/AGT-3420-fix-state-make-task-and-graph-state-upda) — 3 file(s): package-lock.json, package.json, src/taskState/store.ts
• PR fix(concurrency): make lifecycle and durable state transitions ownership-safe — concurrent actors can corrupt state or act on reused identities #766 (swarm/AGT-3430-fix-concurrency-make-lifecycle-and-durab) — 2 file(s): src/taskState/store.test.ts, src/taskState/store.ts
• PR fix(execution): bound subprocesses and unify cancellation cleanup — prevent hung workers and orphaned processes #765 (swarm/AGT-3423-fix-execution-bound-subprocesses-and-uni) — 1 file(s): package-lock.json
• PR fix(streaming): bound event and subprocess output retention — unbounded clients and frames can exhaust process memory #762 (swarm/AGT-3429-fix-streaming-bound-event-and-subprocess) — 1 file(s): package-lock.json
• PR fix(repository): harden filesystem, Git, and verification boundaries — prevent race conditions, ambiguous rollback, and unsafe execution #759 (swarm/AGT-3447-fix-repository-harden-filesystem-git-and) — 1 file(s): package-lock.json
• PR fix(output): sanitize and budget rendered content — prevent prompt injection, invalid embeds, terminal corruption, and HTML injection #758 (swarm/AGT-3446-fix-output-sanitize-and-budget-rendered-) — 2 file(s): package-lock.json, package.json
• PR fix(automation-state): make workflow and bridge mutations concurrency-safe and recoverable — preserve durable execution correctness #757 (swarm/AGT-3468-fix-automation-state-make-workflow-and-b) — 3 file(s): package-lock.json, src/taskState/store.test.ts, src/taskState/store.ts
• branch origin/swarm/AGT-3417-fix-async-ui-contain-rejected-commands-a — 1 file(s): package-lock.json
• branch origin/swarm/AGT-3434-perf-knowledge-memory-bound-graph-discov — 2 file(s): package-lock.json, package.json
• branch origin/swarm/AGT-3444-fix-state-protect-persisted-issue-memory — 2 file(s): package-lock.json, package.json
• branch origin/swarm/AGT-3457-fix-state-persistence-make-state-transit — 3 file(s): package-lock.json, src/taskState/store.test.ts, src/taskState/store.ts
• branch origin/swarm/AGT-3486-fix-tool-boundaries-harden-command-guard — 2 file(s): package-lock.json, package.json
• branch origin/swarm/AGT-3492-fix-network-access-restrict-notification — 2 file(s): package-lock.json, package.json
• branch origin/swarm/AGT-3495-fix-auto-linking-release-deadline-limite — 1 file(s): package-lock.json
• branch origin/swarm/AGT-4008-feature-implement-authenticated-github-r — 1 file(s): package-lock.json
• branch origin/swarm/AGT-4027-bug-an-operator-reply-queues-behind-agen — 1 file(s): package-lock.json
• branch origin/swarm/AGT-4045-feat — 2 file(s): package-lock.json, package.json
• branch origin/swarm/AGT-4059-bug-dashboard-s-latestaddressable-can-ta — 1 file(s): package-lock.json
• branch origin/swarm/AGT-4128-feature-warehouse-a-single-agent-explora — 1 file(s): package-lock.json
• branch origin/swarm/AGT-4153-bug-coordinationtools-test-asserts-an-un — 1 file(s): package-lock.json
• branch origin/swarm/AGT-4160-fix-security-audit-remove-codeql-from-th — 1 file(s): package-lock.json
• branch origin/swarm/AGT-4182-meta-autodeploy-lane-on-vela-merged-main — 1 file(s): package-lock.json
• branch origin/swarm/AGT-4232-fix-adapters-provider-role-split — 2 file(s): package-lock.json, package.json
• ⚠️ MERGED PR fix(state-integrity): salvage durable state fences + review quality harness (#757 #771 #773 #777) #786 (salvage/state-review) — not in this branch's history, verify its fix wasn't dropped — 1 file(s): src/taskState/store.ts
• ⚠️ MERGED PR release: publish 0.24.3 #783 (release/0.24.3) — not in this branch's history, verify its fix wasn't dropped — 2 file(s): package-lock.json, package.json
• ⚠️ MERGED PR release: publish 0.24.2 #715 (heewonoh/agt-4484-release-0-24-2) — not in this branch's history, verify its fix wasn't dropped — 2 file(s): package-lock.json, package.json
• ⚠️ MERGED PR fix: fail closed on unparsed review output #713 (heewonoh/agt-3099-release-0-24-1) — not in this branch's history, verify its fix wasn't dropped — 2 file(s): package-lock.json, package.json
• ⚠️ MERGED PR build(deps): bump the npm_and_yarn group across 1 directory with 3 updates #712 (dependabot/npm_and_yarn/npm_and_yarn-b9f059ab8d) — not in this branch's history, verify its fix wasn't dropped — 2 file(s): package-lock.json, package.json

Linear

Closes AGT-4024

---

🤖 Generated with OpenSwarm

[unohee]

Closing: this draft was produced by the same broken autonomous loop (body: 'execution failed 4 times … very likely incomplete'), is now CONFLICTING with main, and proposes a competing redesign of the same concern that #791 already hardened: it replaces the dot-lock with a kernel-owned SQLite mutex by deleting 10 lock-safety tests (the AGT-4068/4071 pid-namespace ownership proofs) while store.ts is exactly the file #791 changes. Two competing designs for one concern would only conflict; the verified, test-preserving one (#791) is what shipped. Reopen from the branch if the SQLite-mutex direction is still wanted — it needs to carry those safety tests forward.