fix: JSON encode errors, encrypt under lock, docs accuracy (PR review round 3)

- Handle JSON encoding errors in retry.go and run.go instead of discarding
- Move credential encryption inside advisory lock in store.Create to prevent
  race with concurrent RotateAll
- Fix misleading --force error example in CLI docs

Not applied: --output flag registration (already exists as persistent flag on
root command), max_concurrent_executions_per_team default of 10 (spec says
0 = unlimited, Go zero value is correct)

Author: michaelmcnees

packages/engine/internal/cli/retry.go

@@ -92,7 +92,9 @@ and everything downstream re-execute.`,
 
 			// JSON output mode.
 			if outputFormat == "json" {
-				_ = json.NewEncoder(cmd.OutOrStdout()).Encode(result)
+				if encErr := json.NewEncoder(cmd.OutOrStdout()).Encode(result); encErr != nil {
+					return fmt.Errorf("encoding JSON output: %w", encErr)
+				}
 				return exitErr
 			}
 

packages/engine/internal/cli/run.go

@@ -111,7 +111,9 @@ func newRunCommand() *cobra.Command {
 
 			// JSON output mode.
 			if outputFormat == "json" {
-				_ = json.NewEncoder(cmd.OutOrStdout()).Encode(result)
+				if encErr := json.NewEncoder(cmd.OutOrStdout()).Encode(result); encErr != nil {
+					return fmt.Errorf("encoding JSON output: %w", encErr)
+				}
 				return exitErr
 			}
 

packages/engine/internal/secret/store.go

@@ -31,15 +31,11 @@ func (s *Store) Create(ctx context.Context, name, typeName string, data map[stri
 		return nil, fmt.Errorf("marshaling credential data: %w", err)
 	}
 
-	ciphertext, nonce, err := s.Encryptor.Encrypt(plaintext)
-	if err != nil {
-		return nil, fmt.Errorf("encrypting credential: %w", err)
-	}
-
 	teamID := auth.TeamIDFromContext(ctx)
 
 	// Use a transaction with the same advisory lock as RotateAll to serialize
-	// credential writes with key rotation.
+	// credential writes with key rotation. Encryption happens inside the lock
+	// to prevent a concurrent RotateAll from changing keys between encrypt and insert.
 	tx, err := s.DB.BeginTx(ctx, nil)
 	if err != nil {
 		return nil, fmt.Errorf("starting transaction: %w", err)
@@ -50,6 +46,11 @@ func (s *Store) Create(ctx context.Context, name, typeName string, data map[stri
 		return nil, fmt.Errorf("acquiring advisory lock: %w", err)
 	}
 
+	ciphertext, nonce, err := s.Encryptor.Encrypt(plaintext)
+	if err != nil {
+		return nil, fmt.Errorf("encrypting credential: %w", err)
+	}
+
 	var cred Credential
 	err = tx.QueryRowContext(ctx,
 		`INSERT INTO credentials (name, type, encrypted_data, nonce, team_id)

packages/site/src/content/docs/cli-reference/workflow-commands.md

@@ -322,7 +322,7 @@ Execution ghi789-jkl012: completed
 If the execution is not in a failed state:
 
 ```text
-Error: execution abc123-def456 is not in a failed state (status: completed). Use --force to retry anyway.
+Error: execution abc123-def456 is not in a failed state (status: completed).
 ```
 
 If `--from-step` references a step that does not exist: