Commit Workspace mutations and journal results atomically

[taras]

Story

As a workflow host implementor, I want every Workspace-local effect to publish its mutation and journal result atomically, so interruption cannot expose a filesystem state the durable Effection tree does not record.

Contract

The Deno workflow adapter owns one authoritative DOFS connection for each WorkflowRun SQLite database and serializes Workspace-local effects on it. One expansion produces one effect and one top-level SQLite transaction:

BEGIN IMMEDIATE
 apply the Workspace mutation
 publish the resulting logical Workspace root
 append the already-filtered journal result
COMMIT

Known effect failure may roll back an effect-local savepoint and append one failed result before committing. Host interruption leaves the transaction uncommitted, so SQLite recovery publishes neither mutation nor result.

Shared production code uses contextual storage and transaction APIs. It contains no Deno, SQLite, DOFS, or Cloudflare runtime detection.

Acceptance

• One host-owned DOFS connection is authoritative for a workflow database.
• Workspace-local effects are serialized on that connection.
• The transaction coordinator admits a caller-owned DOFS mutation and an already-filtered journal append to the same transaction.
• A successful file write and its result become visible together.
• Known failure retains one failed result while publishing no mutation.
• A real host crash after mutation but before result publication leaves neither mutation nor result after restart.
• Nested DOFS operations use savepoints without creating another top-level effect transaction.
• A second long-lived connection cannot retain stale negative path-cache state across commits.
• Tests prove commit, rollback, cancellation, crash recovery, and stale-request fencing.

Intentionally excluded

• Worker Shell, which consumes this boundary in Run shell blocks in xmd workflows #363.
• External effects such as Prompt, Git push, pull requests, and issues.
• Public workflow CLI lifecycle.
• Native subprocesses, writable FUSE, or bundled workerd.

Dependencies

• Store WorkflowRuns and filtered journals in SQLite #291 supplies the WorkflowRun database and filtered journal store.
• Spike: host Cloudflare DOFS directly in Deno with SQLite and FUSE #349 / PR 🔬 Spike: host Cloudflare DOFS directly in Deno with SQLite (#349) #350 and Spike: make Worker Shell effects transactional with the workflow journal #357 / PR 🔬 Spike: make Worker Shell effects transactional (#357) #362 are unmerged experimental evidence, not production source.
• PR 📝 Specify retained workflow Workspaces #358 supplies the retained Workspace transaction contract.
• End goal: ✨ Compose and certify the supervised adversarial implementation workflow #181.