From fa58d4a5ce89ad599911ad7fe5c8d85b72f34d6c Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Tue, 3 Nov 2026 15:46:58 -0600
Subject: [PATCH] Keep ordinary blocker reads bounded during recovery checks

---
 server/src/services/execution-blocker.ts                 | 2 +-
 .../src/services/legacy-workspace-recovery-migration.ts  | 9 ++++++++-
 server/src/services/workspace-recovery-receipt.ts        | 3 ++-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/server/src/services/execution-blocker.ts b/server/src/services/execution-blocker.ts
index 4e57d9b0c88..cb519621c9c 100644
--- a/server/src/services/execution-blocker.ts
+++ b/server/src/services/execution-blocker.ts
@@ -16,7 +16,7 @@ import { hasVerifiedWorkspaceRepair, workspaceRecoveryDisplay } from "./workspac
 
 const blockerContextKeys = ["issueId", "taskId", "source", "connectionIntentResolution",
   "interactionKind", "interactionStatus", "mutation", "interactionId"] as const;
-const blockerProfileKeys = ["adapterDispatch", "nativeExecutionInput", "nativeWorkspaceSync", "remoteWorkspace"] as const;
+const blockerProfileKeys = ["adapterDispatch", "nativeExecutionInput", "nativeWorkspaceSync", "remoteWorkspace", "legacyWorkspaceRecoveryMigration"] as const;
 const blockerContextColumn = sql<Record<string, unknown> | null>`case
   when ${heartbeatRuns.contextSnapshot} is null then null else (
     select coalesce(jsonb_object_agg(field.key, field.value), '{}'::jsonb)
diff --git a/server/src/services/legacy-workspace-recovery-migration.ts b/server/src/services/legacy-workspace-recovery-migration.ts
index 02f6e633dbc..8d014facfe4 100644
--- a/server/src/services/legacy-workspace-recovery-migration.ts
+++ b/server/src/services/legacy-workspace-recovery-migration.ts
@@ -64,7 +64,14 @@ export async function readMigratedLegacyWorkspaceSource(db: Pick<Db, "select">,
   companyId: string; runId: string; reference: NativeWorkspaceSyncReference | null;
 }): Promise<LegacyWorkspaceRecoverySource | null> {
   if (input.reference && input.reference.state !== "prepared") return null;
-  const [run] = await db.select().from(heartbeatRuns).where(and(
+  const [run] = await db.select({ id: heartbeatRuns.id, companyId: heartbeatRuns.companyId,
+    nativeIssueId: heartbeatRuns.nativeIssueId,
+    resultJson: sql<Record<string, unknown>>`jsonb_build_object('workspaceRestoreRecovery', ${heartbeatRuns.resultJson}->'workspaceRestoreRecovery')`,
+    runnerProfileJson: sql<Record<string, unknown>>`jsonb_build_object(
+      'legacyWorkspaceRecoveryMigration', ${heartbeatRuns.runnerProfileJson}->'legacyWorkspaceRecoveryMigration',
+      'nativeWorkspaceSync', ${heartbeatRuns.runnerProfileJson}->'nativeWorkspaceSync',
+      'remoteWorkspace', ${heartbeatRuns.runnerProfileJson}->'remoteWorkspace')`,
+  }).from(heartbeatRuns).where(and(
     eq(heartbeatRuns.companyId, input.companyId), eq(heartbeatRuns.id, input.runId),
   ));
   const runMarker = run?.runnerProfileJson?.legacyWorkspaceRecoveryMigration as { workspaceId?: unknown } | undefined;
diff --git a/server/src/services/workspace-recovery-receipt.ts b/server/src/services/workspace-recovery-receipt.ts
index 6ef2c7af4fb..be127ec9798 100644
--- a/server/src/services/workspace-recovery-receipt.ts
+++ b/server/src/services/workspace-recovery-receipt.ts
@@ -45,7 +45,8 @@ export async function verifiedWorkspaceRepairReceipt(db: Db, run: Pick<typeof he
   const parsedRemote = remoteWorkspaceRunReferenceSchema.safeParse(run.runnerProfileJson?.remoteWorkspace);
   const remote = parsedRemote.success && parsedRemote.data.state === "saved" ? parsedRemote.data : null;
   if ((run.runnerProfileJson?.remoteWorkspace != null && !parsedRemote.success) || reference && parsedRemote.success) return null;
-  if (typeof issueId === "string" && (reference?.state === "prepared" || !reference && !parsedRemote.success)) {
+  if (typeof issueId === "string" && (reference?.state === "prepared" || !reference && !parsedRemote.success
+    && run.runnerProfileJson?.legacyWorkspaceRecoveryMigration != null)) {
     let migrated;
     try { migrated = await readMigratedLegacyWorkspaceSource(db, { companyId: run.companyId, runId: run.id, reference }); }
     catch (error) { if (error instanceof Error && error.message === "legacy_workspace_migration_receipt_invalid") return null; throw error; }