Problem

The plugin issues 100+ write transactions across 40+ files against ONE shared SQLite file (context.db), opened by multiple processes (OpenCode + Pi, or two OpenCode instances). Each hand-rolled BEGIN IMMEDIATE / COMMIT / finally-ROLLBACK block contends for the single WAL writer lock. Three problems:

1. Inconsistent SQLITE_BUSY handling: when a sibling process held the writer lock past busy_timeout, the thrown SQLITE_BUSY propagated up and surfaced as failed to load plugin ... database is locked or Hit a transient issue comparting history this turn. Some sites retried, some swallowed, some propagated — unpredictable under real multi-process load.

2. Duplicated transaction plumbing: every BEGIN IMMEDIATE site reimplemented the same try/commit/finally-rollback pattern, slightly differently, sometimes without the rollback path. Bugs leaked in at the edges.

3. No retry on transient contention: a long-running sibling transaction (large migration, dreamer run, Channel-2 bulk delivery) made the plugin disable itself for the run instead of waiting.

Fix

A single shared runWriteTransaction(db, body) helper (packages/plugin/src/shared/write-transaction.ts) that:

• Wraps the BEGIN IMMEDIATE / COMMIT in a bounded SQLITE_BUSY retry loop (4 attempts, 100ms backoff) so transient cross-process contention makes us wait-and-retry instead of throwing.
• Composition-safe: if called inside an existing db.transaction() or another runWriteTransaction, the body runs inline WITHOUT issuing a nested BEGIN (SQLite doesn't allow nested BEGIN; the outer transaction already holds the writer lock). Detected via the bun:sqlite inTransaction flag or the node:sqlite shim's isTransaction flag.
• Centralizes one correct transaction plumbing pattern instead of 9 slightly-different copies.

Also adds runWriteTransactionAsync for async call sites (same retry + composition semantics, body may be async).

Sites converted (9 sync write paths)

inject-compartments.ts is intentionally NOT converted: its two BEGIN IMMEDIATE blocks have complex early-return-with-rollback-and-fallback-read patterns (Phase 3 materialization contention retry, soft-refresh cache replay) that don't map cleanly onto the shared helper without significant restructuring. The helper is still a net win across the 9 simpler sites.

Removed

Two duplicate local runImmediate functions (in dreamer/lease.ts and git-commits/sweep-coordinator.ts) and the local isInTransaction helper in workspaces.ts — all subsumed by the shared helper.

Verification

• bun run typecheck (tsc --noEmit + scripts) passes
• bun run lint (biome check) passes
• 12 new unit tests for runWriteTransaction / runWriteTransactionAsync pass
• All existing tests in converted files' suites pass (dreamer/lease, git-commits, compartment-storage-atomic, compartment-runner-recomp-fk, key-files, workspaces, storage-db, message-index)

Relationship to the cold-start fix

This complements the cold-start database is locked fix (db3213e5, also in this branch's history). That commit fixed the cold-open race (busy_timeout installed before the first read). This PR fixes the steady-state write contention (bounded retry on transient SQLITE_BUSY during normal operation). Together they eliminate both the startup and runtime sources of the database is locked plugin-disable failures.

Branch maintenance

This branch (external-memory-backend-concurrency) is rebased onto external-memory-backend each time upstream advances, so it always represents the delta of concurrency fixes on top of the latest external-memory-backend work.

Net: −199 lines / +40 lines across the 9 converted sites; +201 lines for the shared helper; +156 lines for its tests.