fix(orchestrator): prevent concurrent double-run duplicating messages; reflect errors in status

internal/store/tasks.go

@@ -55,3 +55,14 @@ func (s *Store) SetTaskStatus(ctx context.Context, id int64, status string) erro
 	_, err := s.Pool.Exec(ctx, `UPDATE tasks SET status=$2 WHERE id=$1`, id, status)
 	return err
 }
+
+// TryMarkTaskRunning atomically sets status='running' only if the task is not already running.
+// Returns true if this call acquired the run (status was not 'running' before), false otherwise.
+func (s *Store) TryMarkTaskRunning(ctx context.Context, id int64) (bool, error) {
+	ct, err := s.Pool.Exec(ctx,
+		`UPDATE tasks SET status='running' WHERE id=$1 AND status<>'running'`, id)
+	if err != nil {
+		return false, err
+	}
+	return ct.RowsAffected() == 1, nil
+}

internal/store/tasks_test.go

@@ -0,0 +1,32 @@
+package store
+
+import (
+	"context"
+	"testing"
+)
+
+func TestTryMarkTaskRunningIsExclusive(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	epSrc, _ := s.CreateEndpoint(ctx, Endpoint{RoleLabel: "src", Host: "a", Port: 993, TLSMode: "ssl"})
+	epDst, _ := s.CreateEndpoint(ctx, Endpoint{RoleLabel: "dst", Host: "b", Port: 993, TLSMode: "ssl"})
+	taskID, _ := s.CreateTask(ctx, Task{Name: "t", SrcEndpointID: epSrc, DstEndpointID: epDst})
+
+	first, err := s.TryMarkTaskRunning(ctx, taskID)
+	if err != nil || !first {
+		t.Fatalf("first acquire must succeed: ok=%v err=%v", first, err)
+	}
+	second, err := s.TryMarkTaskRunning(ctx, taskID)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if second {
+		t.Fatal("second acquire must fail while running")
+	}
+	// after completion, a re-run may acquire again
+	_ = s.SetTaskStatus(ctx, taskID, "done")
+	third, _ := s.TryMarkTaskRunning(ctx, taskID)
+	if !third {
+		t.Fatal("acquire after completion must succeed")
+	}
+}