Summary

• A rocky run --idempotency-key <KEY> that errored before reaching persist_run_record() left its InFlight stamp in place until the in_flight_ttl_hours sweep reaped it (24h default). Retries with the same key returned skipped_in_flight for up to 24h instead of proceeding.
• Wrap the post-claim body of run() in an async { ... }.await block, and on Err call a new finalize_idempotency_on_error helper that stamps the claim as Failed. Under the default dedup_on = "success" policy that deletes the entry, so the next retry with the same key proceeds immediately.
• Change the existing finalize_idempotency to take &mut Option<IdempotencyCtx> and .take() the ctx on the first call. One-shot semantics prevent the outer error-path wrapper from ever clobbering a Succeeded stamp with a Failed one (which under dedup_on = "success" would silently strip a genuinely-successful run's idempotency record — a regression that was trivially reachable via budget_result?).

Before / after

Before. Claim InFlight → body errors (e.g. no discovery adapter configured, state-store open failure, bad pipeline config) → InFlight entry stays → next retry with same key = skipped_in_flight for up to 24h.

After. Claim InFlight → body errors → wrapper calls finalize_idempotency_on_error → entry deleted (success policy) → next retry = Proceed immediately.

Why option (a) over (b)

The plan (FR-004 §11) preferred option (a) — extract run_inner() — over (b) — tokio::spawn drop guard — as the lower-magic choice. A literal fn run_inner extraction would need to move ~2100 lines of body and thread dozens of locals. An async { ... }.await block gives the same semantics with a fraction of the diff and no signature churn: return from inside the block returns from the block (not run()), ? propagates to the block's Result, and the outer run() catches whatever the block produced.

The drop-guard route would have required a tokio::spawn on drop (since Drop::drop is sync), plus coordination with the existing sweep cadence. Strictly more magic and harder to test — skipped.

Test plan

• cd engine && cargo build --release — clean.
• cd engine && cargo test -p rocky-cli — 235/235 pass (3 new tests under commands::run::tests).
• cd engine && cargo test -p rocky-core --lib — 1046/1046 pass.
• cd engine && cargo test -p rocky-core --test e2e — 30/30 pass.
• cd engine && cargo clippy --all-targets --all-features -- -D warnings — clean.
• cd engine && cargo fmt --all -- --check — clean.

New tests — proving retry works immediately after error

commands::run::tests::finalize_on_error_releases_inflight_claim_allowing_immediate_retry is the direct proof of the F1 guarantee:

1. Claim test-key-error-path → InFlight entry for run-crashed-before-finalize.
2. Call finalize_idempotency_on_error (simulating the wrapper firing on ? / bail!).
3. Assert the entry is gone (deleted under dedup_on = "success" + Failed).
4. Claim again with the same key → IdempotencyCheck::Proceed (not SkipInFlight).

Two supporting tests pin the one-shot contract:

• finalize_on_error_is_one_shot_and_idempotent_when_ctx_already_taken — calling the helper with an already-None ctx is a no-op; calling with Some drains it to None.
• finalize_idempotency_is_one_shot_take — the happy-path helper also drains the ctx, which is the guarantee the wrapper relies on to skip its error-path call after a Succeeded finalize.

Scope notes for review

1. Indentation. The ~2100-line body is not reindented inside the new async { ... }.await, so the visible diff stays ~290 lines (instead of ~2200 if reindented). Happy to push a fmt-only follow-up commit if that's preferred — just didn't want to bury the load-bearing change under reformatting churn.

2. F2 follow-up (not in this PR). The Transformation / Quality / Snapshot / Load dispatches at the top of run() never called finalize_idempotency on success in the first place — they still leak InFlight on the happy path until the 24h TTL sweep, for pipelines of those types run with --idempotency-key. Orthogonal to F1 (errors do now clean up correctly for them too, via this wrapper). Tracking as F2.

Files touched

• engine/crates/rocky-cli/src/commands/run.rs — wrapper + new helper + one-shot finalize_idempotency + 3 tests.

No schema / codegen cascade (no changes to *Output structs or RunStatus variants).