apply review: discriminating test, one-line changeset, trimmed comments

- delete policy-transactional-visibility.test.ts (passed with main's
  executor.ts swapped in - not discriminating; sequential awaits are no
  concurrency proof)
- add a real concurrent-creates case to policies.test.ts (verified to
  fail on main, pass here)
- changeset to one sentence per repo norm
- shorten the two executor.ts comment blocks to one line each

Author: pt-act

.changeset/policy-transactional-visibility.md

@@ -2,18 +2,4 @@
 "@executor-js/sdk": patch
 ---
 
-fix: make tool-policy writes transactional
-
-`policiesCreate` and `policiesUpdate` previously ran their read-decide-write
-(existing-row scan → position computation → create, or existence check →
-update → re-read) as unsequenced statements. Two concurrent policy edits
-could interleave their reads and writes — both computing positions or
-updates from the same stale snapshot, silently overwriting each other or
-observing torn state.
-
-Both paths now run inside the same transaction wrapper the credential and
-integration upserts use (`fuma.transaction`, real BEGIN/COMMIT on
-libSQL/Postgres). Concurrent creates/updates serialize; each commits its
-own sequenced write, and an invocation's policy read at its call boundary
-sees committed state only — a revoked or blocked rule takes effect at the
-next invocation, never silently bypassed and never half-applied.
+Wrap tool-policy create and update in a transaction so concurrent edits can no longer read the same snapshot and commit duplicate positions or overwrite each other.

packages/core/sdk/src/executor.ts

@@ -5396,13 +5396,7 @@ export const createExecutor = <const TPlugins extends readonly AnyPlugin[] = rea
           try: () => ownedKeys(input.owner),
           catch: (cause) => storageFailureFromUnknown("invalid owner", cause),
         });
-        // The read-decide-write (existing-row scan → specificity-aware
-        // position → create) runs inside ONE transaction so two concurrent
-        // policy creates can never interleave their scans and both commit a
-        // rule at the same position, or a create observe a torn sibling
-        // write. Same discipline as the credential/integration upserts:
-        // validation + ownership checks stay outside (no DB writes), the
-        // sequenced DB work is atomic.
+        // Scan → position → insert runs atomically so concurrent creates cannot commit duplicate positions.
         return yield* transaction(
           Effect.gen(function* () {
             const existing = yield* core.findMany("tool_policy", {
@@ -5444,11 +5438,7 @@ export const createExecutor = <const TPlugins extends readonly AnyPlugin[] = rea
           });
         }
         const where = (b: AnyCb) => b.and(byOwner(input.owner)(b), b("id", "=", input.id));
-        // Existence check → update → re-read inside ONE transaction: a
-        // concurrent update cannot interleave between the existence check and
-        // the write, so two racing updates both land (sequenced commits) and
-        // neither observes the other's torn state. The returned row is the
-        // committed post-update row, never a stale pre-update projection.
+        // Existence check, write, and re-read commit together.
         return yield* transaction(
           Effect.gen(function* () {
             const existing = yield* core.findFirst("tool_policy", { where });

packages/core/sdk/src/policies.test.ts

@@ -428,6 +428,23 @@ describe("executor.policies", () => {
     }),
   );
 
+  it.live("concurrent creates of equally specific rules get distinct positions", () =>
+    Effect.gen(function* () {
+      const executor = yield* setupExecutor();
+      yield* Effect.all(
+        [
+          executor.policies.create({ owner: "org", pattern: "vercel.dns.create", action: "block" }),
+          executor.policies.create({ owner: "org", pattern: "vercel.dns.delete", action: "block" }),
+        ],
+        { concurrency: "unbounded" },
+      );
+
+      const rules = yield* executor.policies.list();
+      expect(rules).toHaveLength(2);
+      expect(new Set(rules.map((r) => r.position)).size).toBe(2);
+    }),
+  );
+
   it.effect("create stores rules at the requested owner", () =>
     Effect.gen(function* () {
       const executor = yield* setupExecutor();