Problem

The plugin issues 100+ write transactions across 40+ files against ONE shared SQLite file (context.db), opened by multiple processes (OpenCode + Pi, or two OpenCode instances). Each hand-rolled BEGIN IMMEDIATE / COMMIT / finally-ROLLBACK block contends for the single WAL writer lock. Three problems:

1. Inconsistent SQLITE_BUSY handling: when a sibling process held the writer lock past busy_timeout, the thrown SQLITE_BUSY propagated up and surfaced as failed to load plugin ... database is locked or Hit a transient issue comparting history this turn. Some sites retried, some swallowed, some propagated — unpredictable under real multi-process load.

2. Duplicated transaction plumbing: every BEGIN IMMEDIATE site reimplemented the same try/commit/finally-rollback pattern, slightly differently, sometimes without the rollback path. Bugs leaked in at the edges.

3. No retry on transient contention: a long-running sibling transaction (large migration, dreamer run, Channel-2 bulk delivery) made the plugin disable itself for the run instead of waiting.

Fix

A single shared runWriteTransaction(db, body) helper (packages/plugin/src/shared/write-transaction.ts) that:

• Wraps the BEGIN IMMEDIATE / COMMIT in a bounded SQLITE_BUSY retry loop (4 attempts, 100ms backoff) so transient cross-process contention makes us wait-and-retry instead of throwing.
• Composition-safe: if called inside an existing db.transaction() or another runWriteTransaction, the body runs inline WITHOUT issuing a nested BEGIN (SQLite doesn't allow nested BEGIN; the outer transaction already holds the writer lock). Detected via the bun:sqlite inTransaction flag or the node:sqlite shim's isTransaction flag.
• Centralizes one correct transaction plumbing pattern instead of 9 slightly-different copies.

Also adds runWriteTransactionAsync for async call sites (same retry + composition semantics, body may be async).

Sites converted (9 sync write paths)

inject-compartments.ts is intentionally NOT converted: its two BEGIN IMMEDIATE blocks have complex early-return-with-rollback-and-fallback-read patterns (Phase 3 materialization contention retry, soft-refresh cache replay) that don't map cleanly onto the shared helper without significant restructuring. The helper is still a net win across the 9 simpler sites.

Removed

Two duplicate local runImmediate functions (in dreamer/lease.ts and git-commits/sweep-coordinator.ts) and the local isInTransaction helper in workspaces.ts — all subsumed by the shared helper.

Verification

• bun run typecheck (tsc --noEmit + scripts) ✅
• bun run lint (biome check) ✅
• 12 new unit tests for runWriteTransaction / runWriteTransactionAsync ✅
  • BEGIN/COMMIT around body, rollback on throw
  • Transient SQLITE_BUSY retry-and-recover
  • Max-attempts give-up (4 attempts)
  • Nested-transaction composition (no nested BEGIN when inTransaction/isTransaction)
  • Non-transient errors not retried
• All existing tests in converted files' suites pass:
  • dreamer/lease.test.ts (7), git-commits (19), compartment-storage-atomic (8), compartment-storage-v6, compartment-lease, compartment-runner-recomp-fk (4), compartment-runner-partial-recomp, key-files (14), workspaces, storage-db (11), message-index

Relationship to #1

This complements #1 (cold-start database is locked fix). #1 fixed the cold-open race (busy_timeout installed before the first read). This PR fixes the steady-state write contention (bounded retry on transient SQLITE_BUSY during normal operation). Together they eliminate both the startup and runtime sources of the database is locked plugin-disable failures.

Net: −199 lines / +40 lines across the 9 converted sites; +201 lines for the shared helper; +156 lines for its tests.