@deksden-com/dd-flow-cli 0.9.0-beta.103 → 0.9.0-beta.105

package/dist/services/protocols.js

@@ -1,5 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
+import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { parse as parseYaml } from "yaml";
 import { canTransition } from "../domain/contracts.js";
@@ -9,8 +10,9 @@ import { AppError } from "../shared/errors.js";
 import { prepareJsonFile } from "../cli/input-preparation.js";
 import { ensureDir, planJsonPath, resolveProjectRoot, resolveProtocolPlanPath, runtimeProtocolDir, runtimeStateJsonPath } from "../storage/paths.js";
 import { appendAudit, getAuditEvents } from "./audit.js";
+import { withProjectionLock } from "../storage/projection-lock.js";
 import { requireProjectByRoot } from "./projects.js";
-import { ensureRuntimeProtocolFiles, readStateFile, writeState } from "../protocol/local-files.js";
+import { prepareRuntimeProtocolFiles, publishRuntimeProtocolMetadata, readStateFile, writeState } from "../protocol/local-files.js";
 import { planSummary, planWithProgress, readCanonicalPlan } from "./plan-runtime.js";
 import { activeCodexSessionBindingsForProject, activeFlowSessionBindingsForProject, codexHomeProfilesForProject, codexHookEventsForProject, hookStatusForProject } from "./hooks.js";
 import { buildProtocolFlowGuidance } from "./flow-guidance.js";
@@ -30,7 +32,7 @@ export function prepareProtocolRegistration(context, input) {
 export function registerProtocol(context, input) {
     const { projectRoot, project, workspacePath, protocolId, runtimeDir } = prepareProtocolRegistration(context, input);
     const now = context.now();
-    const state = ensureRuntimeProtocolFiles({
+    const initialized = prepareRuntimeProtocolFiles({
         runtimeDir,
         protocolId,
         projectRoot,
@@ -38,25 +40,27 @@ export function registerProtocol(context, input) {
         workspacePath,
         now
     });
-    const existing = findProtocol(context, protocolId, project.id);
-    const params = [
-        protocolId,
-        input.handshakeId,
-        project.id,
-        projectRoot,
-        state.status,
-        state.stage,
-        state.next_action,
-        JSON.stringify(state.route),
-        JSON.stringify(state.workspace),
-        JSON.stringify(state.blockers),
-        JSON.stringify(state.active_def),
-        runtimeStateJsonPath(context.ddFlowHome, project.id, protocolId),
-        planJsonPath(workspacePath ?? projectRoot, protocolId),
-        existing?.created_at ?? now,
-        now
-    ];
-    context.db.run(`INSERT INTO protocols
+    return context.db.writeTransaction(() => {
+        const existing = findProtocol(context, protocolId, project.id);
+        const state = existing ? latestProtocolProjection(context, project.id, protocolId) ?? initialized : initialized;
+        const params = [
+            protocolId,
+            input.handshakeId,
+            project.id,
+            projectRoot,
+            state.status,
+            state.stage,
+            state.next_action,
+            JSON.stringify(state.route),
+            JSON.stringify(state.workspace),
+            JSON.stringify(state.blockers),
+            JSON.stringify(state.active_def),
+            runtimeStateJsonPath(context.ddFlowHome, project.id, protocolId),
+            planJsonPath(workspacePath ?? projectRoot, protocolId),
+            existing?.created_at ?? now,
+            now
+        ];
+        context.db.run(`INSERT INTO protocols
       (id, handshake_id, project_id, project_root, status, stage, next_action,
        route_json, workspace_json, blockers_json, active_def_json, state_path, plan_path,
        created_at, updated_at)
@@ -75,19 +79,23 @@ export function registerProtocol(context, input) {
        state_path = excluded.state_path,
        plan_path = excluded.plan_path,
        updated_at = excluded.updated_at`, params);
-    appendAudit(context, {
-        protocolId,
-        projectId: project.id,
-        eventType: existing ? "protocol.registration_refreshed" : "protocol.registered",
-        payload: {
-            protocol_id: protocolId,
-            handshake_id: input.handshakeId,
-            project_root: projectRoot,
-            workspace_path: workspacePath ?? null,
-            runtime_dir: runtimeDir
-        }
-    });
-    return { ok: true, protocol: protocolStatusPayload(requireProtocol(context, protocolId, project.id)), state };
+        appendAudit(context, { protocolId, projectId: project.id, eventType: "protocol.state_projection", payload: { state } });
+        context.db.afterCommit(() => publishProtocolProjection(context, project.id, protocolId));
+        context.db.afterCommit(() => publishRuntimeProtocolMetadata({ runtimeDir, protocolId, handshakeId: input.handshakeId, projectRoot }));
+        appendAudit(context, {
+            protocolId,
+            projectId: project.id,
+            eventType: existing ? "protocol.registration_refreshed" : "protocol.registered",
+            payload: {
+                protocol_id: protocolId,
+                handshake_id: input.handshakeId,
+                project_root: projectRoot,
+                workspace_path: workspacePath ?? null,
+                runtime_dir: runtimeDir
+            }
+        });
+        return { ok: true, protocol: protocolStatusPayload(requireProtocol(context, protocolId, project.id)), state };
+    }, "protocol.register");
 }
 export function getProtocolStatus(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
@@ -438,8 +446,7 @@ export function syncProtocolFromRun(context, input) {
         next_action: nextActionForSyncedTarget(targetStage),
         updated_at: now
     };
-    context.db.beginWriteTransaction();
-    try {
+    context.db.writeTransaction(() => {
         persistProtocolState(context, protocol, nextState);
         if (targetStage === "ready_for_merge") {
             context.db.run(`INSERT INTO merge_queue
@@ -471,12 +478,7 @@ export function syncProtocolFromRun(context, input) {
                 stage_chain: stageChain(index)
             }
         });
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    }, "protocols.syncFromRun");
     return {
         ok: true,
         protocol_id: protocol.id,
@@ -508,8 +510,7 @@ export function cancelProtocol(context, input) {
     const now = context.now();
     const worktree = context.db.get("SELECT worktree_path, status FROM worktree_records WHERE project_id = ? AND protocol_id = ?", [protocol.project_id, protocol.id]);
     const worktreeRemoval = input.worktree === "remove" ? removeProtocolWorktreeBeforeCancel(protocol, state, worktree, input.force) : undefined;
-    context.db.beginWriteTransaction();
-    try {
+    return context.db.writeTransaction(() => {
         const nextState = {
             ...state,
             stage: "cancelled",
@@ -570,7 +571,6 @@ export function cancelProtocol(context, input) {
                 worktree_outcome: worktreeOutcome
             }
         });
-        context.db.exec("COMMIT");
         return {
             ok: true,
             protocol_id: protocol.id,
@@ -582,11 +582,7 @@ export function cancelProtocol(context, input) {
             worktree_outcome: worktreeOutcome,
             worktree: context.db.get("SELECT * FROM worktree_records WHERE project_id = ? AND protocol_id = ?", [protocol.project_id, protocol.id]) ?? null
         };
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    }, "protocols.cancel");
 }
 export function requireProtocol(context, protocolId, projectId) {
     const matches = projectId
@@ -761,6 +757,9 @@ export function readProtocolRuntimeState(context, protocol) {
     const expected = runtimeStateJsonPath(context.ddFlowHome, protocol.project_id, protocol.id);
     if (protocol.state_path !== expected)
         throw new AppError("protocol_state_migration_required", "Protocol runtime path requires explicit cleanup scan/apply before use", 1, { protocol_id: protocol.id, path: protocol.state_path, expected_path: expected });
+    const accepted = latestProtocolProjection(context, protocol.project_id, protocol.id);
+    if (accepted)
+        return { state: accepted, diagnostics: [] };
     return resolveProtocolRuntimeState(context, { ...protocol }, false);
 }
 /** Explicit cleanup migration; productive readers accept only the current path. */
@@ -772,6 +771,19 @@ export function repairProtocolRuntimeState(context, protocol) {
         Object.assign(protocol, stored);
     return resolveProtocolRuntimeState(context, protocol, true);
 }
+/** Read-only repair preparation; caller CASes paths, then persists this state. */
+export function prepareProtocolRuntimeRepair(context, protocol) {
+    const stored = context.db.get("SELECT * FROM protocols WHERE project_id = ? AND id = ?", [protocol.project_id, protocol.id]);
+    if (!stored)
+        throw new AppError("not_found", "Protocol is not registered", 1, { protocol_id: protocol.id });
+    const state = latestProtocolProjection(context, stored.project_id, stored.id) ?? resolveProtocolRuntimeState(context, { ...stored }, false).state;
+    return {
+        state,
+        statePath: runtimeStateJsonPath(context.ddFlowHome, stored.project_id, stored.id),
+        planPath: planJsonPath(stored.project_root, stored.id),
+        previousStatePath: stored.state_path
+    };
+}
 function resolveProtocolRuntimeState(context, protocol, repair) {
     const diagnostics = [];
     normalizeProtocolPlanPath(context, protocol, diagnostics, repair);
@@ -890,31 +902,49 @@ export function protocolRunDiagnostics(context, protocol, state) {
     return { latest_run: latestWithStages, diagnostics };
 }
 export function persistProtocolState(context, protocol, state) {
-    ensureDir(path.dirname(protocol.state_path));
-    writeState(protocol.state_path, state);
-    context.db.run(`UPDATE protocols SET
+    context.db.writeTransaction(() => {
+        context.db.run(`UPDATE protocols SET
        status = ?, stage = ?, next_action = ?, route_json = ?, workspace_json = ?,
        blockers_json = ?, active_def_json = ?, updated_at = ?
      WHERE project_id = ? AND id = ?`, [
-        state.status,
-        state.stage,
-        state.next_action,
-        JSON.stringify(state.route),
-        JSON.stringify(state.workspace),
-        JSON.stringify(state.blockers),
-        JSON.stringify(state.active_def),
-        state.updated_at,
-        protocol.project_id,
-        protocol.id
-    ]);
-    if (state.status === "closed" || state.stage === "closed") {
-        const now = context.now();
-        context.db.run(`UPDATE sessions
+            state.status,
+            state.stage,
+            state.next_action,
+            JSON.stringify(state.route),
+            JSON.stringify(state.workspace),
+            JSON.stringify(state.blockers),
+            JSON.stringify(state.active_def),
+            state.updated_at,
+            protocol.project_id,
+            protocol.id
+        ]);
+        appendAudit(context, { protocolId: protocol.id, projectId: protocol.project_id, eventType: "protocol.state_projection", payload: { state } });
+        if (state.status === "closed" || state.stage === "closed") {
+            const now = context.now();
+            context.db.run(`UPDATE sessions
        SET status = 'stopped', stop_reason = 'protocol closed', updated_at = ?, stopped_at = ?
        WHERE project_id = ?
          AND protocol_id = ?
          AND status IN ('pending', 'active', 'waiting_user', 'blocked', 'stopping')`, [now, now, protocol.project_id, protocol.id]);
-    }
+        }
+        context.db.afterCommit(() => publishProtocolProjection(context, protocol.project_id, protocol.id));
+    }, "protocols.persistProtocolState");
+}
+function latestProtocolProjection(context, projectId, protocolId) {
+    const row = context.db.get("SELECT payload_json FROM audit_events WHERE project_id = ? AND protocol_id = ? AND event_type = 'protocol.state_projection' ORDER BY id DESC LIMIT 1", [projectId, protocolId]);
+    return row ? JSON.parse(row.payload_json).state : null;
+}
+export function publishProtocolProjection(context, projectId, protocolId) {
+    const protocol = requireProtocol(context, protocolId, projectId);
+    ensureDir(path.dirname(protocol.state_path));
+    withProjectionLock(`${protocol.state_path}.publish-lock`, () => {
+        const accepted = latestProtocolProjection(context, projectId, protocolId);
+        if (!accepted)
+            throw new AppError("runtime_state_missing", "Protocol has no accepted SQL state", 1, { protocol_id: protocolId });
+        const temporary = `${protocol.state_path}.tmp-${process.pid}-${crypto.randomUUID()}`;
+        fs.writeFileSync(temporary, `${JSON.stringify(accepted, null, 2)}\n`);
+        fs.renameSync(temporary, protocol.state_path);
+    });
 }
 function findProtocol(context, protocolId, projectId) {
     if (projectId) {

package/dist/services/recovery-snapshot-database.js

@@ -4,14 +4,16 @@ import path from "node:path";
 import { AppError } from "../shared/errors.js";
 import { registerStoreWriter } from "../storage/writer-contract.js";
 import { managedProcessRuntimeHome } from "./managed-processes.js";
+import { cleanupScopeWriters } from "./scope-writer-cleanup.js";
 /** Export one RUN's relational evidence, never mutate the live authority. */
 export function captureRecoveryDatabase(source, output, projectId, runId, protocolIds = []) {
     source.exec(`VACUUM INTO '${output.replace(/'/g, "''")}'`);
     const db = new DatabaseSync(output);
-    let complete = false;
+    let complete = false, held = false, failed = false, primary;
     try {
         registerStoreWriter(db);
         db.exec("PRAGMA foreign_keys = OFF; PRAGMA secure_delete = ON; BEGIN IMMEDIATE");
+        held = true;
         db.exec("CREATE TEMP TABLE capture_scope (project_id TEXT, run_id TEXT)");
         db.prepare("INSERT INTO capture_scope VALUES (?, ?)").run(projectId, runId);
         db.exec("CREATE TEMP TABLE capture_protocols (id TEXT)");
@@ -40,6 +42,7 @@ export function captureRecoveryDatabase(source, output, projectId, runId, protoc
             work_recovery_segments: `work_id IN (${works})`,
             run_recovery_bindings: `recovery_id IN (SELECT recovery_id FROM run_recovery_guards WHERE ${ownRun})`,
             lifecycle_invocations: invocations,
+            lifecycle_packet_assignments: `invocation_id IN (SELECT id FROM lifecycle_invocations WHERE ${invocations})`,
             hook_events: `${ownProject} AND (session_id IN (${sessions}) OR (harness, provider_session_id) IN (${nativeSessions})${invocationReceipts})`,
             harness_usage_snapshots: `${ownProject} AND (harness, provider_session_id) IN (${nativeSessions})`,
             protocols: `${ownProject} AND id IN (${protocols})`,
@@ -71,13 +74,31 @@ export function captureRecoveryDatabase(source, output, projectId, runId, protoc
         const issues = db.prepare("PRAGMA foreign_key_check").all();
         if (issues.length)
             throw new AppError("snapshot_scope_inconsistent", "Scoped recovery export has unresolved relational references", 1, { issues });
-        db.exec("COMMIT; VACUUM");
+        db.exec("COMMIT");
+        held = false;
+        db.exec("VACUUM");
         complete = true;
     }
-    finally {
-        db.close();
-        if (!complete)
+    catch (error) {
+        primary = error;
+        failed = true;
+    }
+    const cleanup = cleanupScopeWriters([{ name: output, db, rollback: held, close: "always" }]);
+    if (!complete) {
+        try {
             fs.rmSync(output, { force: true });
+        }
+        catch (error) {
+            cleanup.push({ target: output, phase: "remove_incomplete_output", message: String(error) });
+        }
+    }
+    if (failed || cleanup.length) {
+        if (primary instanceof AppError) {
+            if (cleanup.length)
+                primary.details.snapshot_cleanup_errors = cleanup;
+            throw primary;
+        }
+        throw new AppError("snapshot_database_failed", primary instanceof Error ? primary.message : "Snapshot database cleanup failed", 1, { ...(failed ? { cause: String(primary) } : {}), snapshot_cleanup_errors: cleanup });
     }
 }
 /** Physical leases are evidence, not authority to resurrect on another host. */
@@ -87,8 +108,10 @@ export function readRecoveryResourceEvidence(resourceHome, projectId, runId, aut
     if (!fs.existsSync(file))
         return { ...scope, database_present: false, processes: [], resources: [] };
     const db = new DatabaseSync(file, { readOnly: true });
+    let held = false, failed = false, primary, result;
     try {
         db.exec("PRAGMA busy_timeout = 4000; BEGIN");
+        held = true;
         const candidates = db.prepare("SELECT * FROM managed_processes WHERE project_id = ? AND run_id = ? ORDER BY id").all(projectId, runId).map(record => ({ record, home: managedProcessRuntimeHome(record, authority) }));
         if (candidates.some(item => item.home === null))
             throw new AppError("snapshot_resource_scope_unproven", "A retained process has no proven runtime-home identity", 1, { resource_home: resourceHome });
@@ -99,9 +122,21 @@ export function readRecoveryResourceEvidence(resourceHome, projectId, runId, aut
         if (unbound)
             throw new AppError("snapshot_resource_scope_unproven", "A retained resource has no process binding proving its RUN scope", 1, { resource_home: resourceHome });
         db.exec("COMMIT");
-        return { ...scope, database_present: true, processes, resources };
+        held = false;
+        result = { ...scope, database_present: true, processes, resources };
     }
-    finally {
-        db.close();
+    catch (error) {
+        primary = error;
+        failed = true;
+    }
+    const cleanup = cleanupScopeWriters([{ name: file, db, rollback: held, close: "always" }]);
+    if (failed || cleanup.length) {
+        if (primary instanceof AppError) {
+            if (cleanup.length)
+                primary.details.snapshot_cleanup_errors = cleanup;
+            throw primary;
+        }
+        throw new AppError("snapshot_resource_evidence_failed", primary instanceof Error ? primary.message : "Resource evidence cleanup failed", 1, { ...(failed ? { cause: String(primary) } : {}), snapshot_cleanup_errors: cleanup });
     }
+    return result;
 }

package/dist/services/run-control-worker.js

@@ -56,21 +56,16 @@ async function launchControlWorker(context, input) {
     const home = resourceHome(context);
     // Reclaim only a proven dead launcher or admitted worker. Lease expiry
     // never proves death or authorizes a second physical owner.
+    const launcherBirth = processStartedAt(process.pid);
     let claimed = false;
-    context.db.beginWriteTransaction();
-    try {
+    context.db.writeTransaction(() => {
         claimed = context.db.run("INSERT OR IGNORE INTO run_control_workers (control_id, owner_token, status, resource_home, state_dir, created_at, updated_at) VALUES (?, ?, 'starting', ?, ?, ?, ?)", [input.controlId, token, home, directory, now, now]).changes === 1;
         if (claimed) {
-            recordControlLauncher(context, input.controlId, token);
+            recordControlLauncher(context, input.controlId, token, launcherBirth);
             if (input.reconcileId)
                 context.db.run("UPDATE run_control_workers SET snapshot_json = ? WHERE control_id = ?", [JSON.stringify(renewRecoveryObservation({}, input.reconcileId)), input.controlId]);
         }
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
     if (!claimed && !reclaimControlWorker(context, input, project.id, token, home))
         return;
     try {
@@ -123,9 +118,9 @@ export async function waitForControlWorkerAdmission(context, controlId, ownerTok
     }
 }
 const launchOperationId = (controlId, token) => `${controlId}:worker-launch:${crypto.createHash("sha256").update(token).digest("hex")}`;
-function recordControlLauncher(context, controlId, token) {
+function recordControlLauncher(context, controlId, token, launcherBirth) {
     const now = context.now();
-    context.db.run("INSERT INTO run_control_operations (operation_id, control_id, target_json, status, receipt_json, created_at, updated_at) VALUES (?, ?, ?, 'completed', ?, ?, ?)", [launchOperationId(controlId, token), controlId, JSON.stringify({ kind: "control_worker_launch_claim" }), JSON.stringify({ pid: process.pid, pid_started_at: processStartedAt(process.pid), registration: "worker_self@1" }), now, now]);
+    context.db.run("INSERT INTO run_control_operations (operation_id, control_id, target_json, status, receipt_json, created_at, updated_at) VALUES (?, ?, ?, 'completed', ?, ?, ?)", [launchOperationId(controlId, token), controlId, JSON.stringify({ kind: "control_worker_launch_claim" }), JSON.stringify({ pid: process.pid, pid_started_at: launcherBirth, registration: "worker_self@1" }), now, now]);
 }
 function reclaimControlWorker(context, input, projectId, token, home) {
     const previous = context.db.get("SELECT * FROM run_control_workers WHERE control_id = ?", [input.controlId]);
@@ -187,32 +182,25 @@ function reclaimControlWorker(context, input, projectId, token, home) {
     // and a crash before the RUN CAS leaves the same dead owner reconcilable.
     if (record && !finishManagedProcess(context, { id: record.id, leaseToken: record.lease_token, state: "stopped", reason: "control_owner_crash_reconciled" }))
         return false;
-    context.db.beginWriteTransaction();
-    try {
+    const launcherBirth = processStartedAt(process.pid);
+    return context.db.writeTransaction(() => {
         const changed = context.db.run(`UPDATE run_control_workers SET owner_token = ?, owner_pid = NULL, status = 'starting', process_id = NULL, process_lease_token = NULL, updated_at = ?
       WHERE control_id = ? AND owner_token = ? AND process_id IS ? AND owner_pid IS ? AND status = ?
         AND (SELECT receipt_json FROM run_control_operations WHERE operation_id = ?) IS ?
         AND EXISTS (SELECT 1 FROM run_controls c JOIN run_recovery_guards g ON g.recovery_id = c.recovery_id
           WHERE c.control_id = run_control_workers.control_id AND c.status = 'requested' AND g.status IN ('draining','sealed')
             AND g.generation = (SELECT MAX(generation) FROM run_recovery_guards WHERE project_id = g.project_id AND run_id = g.run_id))`, [token, context.now(), input.controlId, previous.owner_token, previous.process_id, previous.owner_pid, previous.status, operationId, launch?.receipt_json ?? null]);
-        if (changed.changes !== 1) {
-            context.db.exec("ROLLBACK");
+        if (changed.changes !== 1)
             return false;
-        }
         if (input.reconcileId) {
             const snapshot = renewRecoveryObservation(JSON.parse(previous.snapshot_json ?? "{}"), input.reconcileId);
             context.db.run("UPDATE run_control_workers SET snapshot_json = ?, error_json = NULL WHERE control_id = ? AND owner_token = ?", [JSON.stringify(snapshot), input.controlId, token]);
         }
         const now = context.now();
         context.db.run("INSERT INTO run_control_operations (operation_id, control_id, target_json, status, receipt_json, created_at, updated_at) VALUES (?, ?, ?, 'completed', ?, ?, ?)", [`${launchOperationId(input.controlId, previous.owner_token)}:reconciled`, input.controlId, JSON.stringify({ kind: "control_worker_reconciliation", process_id: record?.id ?? null, resource_home: home }), JSON.stringify({ process_id: record?.id ?? null, pid: record?.pid ?? null, pid_started_at: record?.pid_started_at ?? null, prior_status: previous.status, snapshot: JSON.parse(previous.snapshot_json ?? "null"), error: JSON.parse(previous.error_json ?? "null") }), now, now]);
-        recordControlLauncher(context, input.controlId, token);
-        context.db.exec("COMMIT");
+        recordControlLauncher(context, input.controlId, token, launcherBirth);
         return true;
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 export async function serveRunControl(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
@@ -226,19 +214,14 @@ export async function serveRunControl(context, input) {
         throw new AppError("run_control_owner_mismatch", "Control registration is not authorized", 1);
     // Physical identity is committed with the sole RUN claim, before the worker
     // registers itself in the separate resource store or performs any dispatch.
-    context.db.beginWriteTransaction();
-    try {
+    const workerBirth = processStartedAt(process.pid);
+    context.db.writeTransaction(() => {
         const claimed = context.db.run("UPDATE run_control_workers SET status = 'running', owner_pid = ?, updated_at = ? WHERE control_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [process.pid, context.now(), input.controlId, worker.owner_token]);
         if (claimed.changes !== 1)
             throw new AppError("run_control_already_owned", "A control owner has already claimed this request", 1);
         const now = context.now();
-        context.db.run("INSERT INTO run_control_operations (operation_id, control_id, target_json, status, receipt_json, created_at, updated_at) VALUES (?, ?, ?, 'completed', ?, ?, ?)", [`${launchOperationId(input.controlId, worker.owner_token)}:worker-claim`, input.controlId, JSON.stringify({ kind: "control_worker_self_claim" }), JSON.stringify({ pid: process.pid, pid_started_at: processStartedAt(process.pid) }), now, now]);
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+        context.db.run("INSERT INTO run_control_operations (operation_id, control_id, target_json, status, receipt_json, created_at, updated_at) VALUES (?, ?, ?, 'completed', ?, ?, ?)", [`${launchOperationId(input.controlId, worker.owner_token)}:worker-claim`, input.controlId, JSON.stringify({ kind: "control_worker_self_claim" }), JSON.stringify({ pid: process.pid, pid_started_at: workerBirth }), now, now]);
+    });
     const resourceContext = { ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: worker.resource_home } };
     let leaseLost = false;
     const heartbeat = setInterval(() => {

package/dist/services/run-control.js

@@ -19,13 +19,7 @@ export function runControlStatus(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     // One read snapshot prevents a concurrent stop/resume from mixing generations
     // across the request, arbiter and worker projections. Savepoints also nest.
-    context.db.exec("SAVEPOINT run_control_status");
-    try {
-        return readControlStatus(context, input, project);
-    }
-    finally {
-        context.db.exec("RELEASE run_control_status");
-    }
+    return context.db.readSnapshot(() => readControlStatus(context, input, project));
 }
 function readControlStatus(context, input, project) {
     const run = context.db.get("SELECT status FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]);
@@ -822,20 +816,17 @@ export function recordRunControlIntent(context, input) {
     const request = { project_root: project.root, run_id: input.runId, action: input.action, ...(input.action === "pause" ? { grace_ms: input.graceMs ?? 30_000, escalate: input.escalate ?? null } : { force: input.force ?? false }) };
     const requestHash = crypto.createHash("sha256").update(JSON.stringify(request)).digest("hex");
     ensureRunControlStorage(context.db);
-    context.db.beginWriteTransaction();
-    try {
+    return context.db.writeTransaction(() => {
         const existing = context.db.get("SELECT * FROM run_controls WHERE project_id = ? AND run_id = ? AND request_id = ?", [project.id, input.runId, input.requestId]);
         if (existing) {
             if (existing.request_hash !== requestHash)
                 throw new AppError("runtime_request_conflict", "Control request id has different inputs", 1);
-            context.db.exec("COMMIT");
             return { ok: true, control_id: existing.control_id, recovery_id: existing.recovery_id, action: existing.action, status: existing.status, reused: true };
         }
         const run = context.db.get("SELECT status FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]);
         if (!run)
             throw new AppError("not_found", "RUN is not registered", 1);
         if (["done", "failed", "cancelled"].includes(run.status)) {
-            context.db.exec("COMMIT");
             return { ok: true, terminal: true, status: run.status, control_id: null };
         }
         const prior = recoveryGuard(context, project.id, input.runId);
@@ -866,11 +857,6 @@ export function recordRunControlIntent(context, input) {
       WHERE r.project_id = ? AND r.id = ? AND json_extract(stage.value, '$.status') = 'running'
         AND EXISTS (SELECT 1 FROM run_control_admissions a JOIN sessions s ON s.session_id = a.session_id AND s.project_id = r.project_id WHERE a.control_id = ? AND s.current_stage = json_extract(stage.value, '$.stage'))`, [controlId, controlId, project.id, input.runId, controlId]);
         setFlowRunRecoveryPaused(context, project.id, input.runId, true);
-        context.db.exec("COMMIT");
         return { ok: true, control_id: controlId, recovery_id: recoveryId, generation, action: input.action, status: "requested", settled: false };
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }

package/dist/services/run-controller-capture.js

@@ -8,6 +8,25 @@ import { assertRunMutationAllowed, recoveryGuard } from "./run-recovery.js";
 import { appendEvent, digest, errorRecord, requireController, requireRun } from "./run-controller-state.js";
 import { getFlowRunStatus } from "./runs.js";
 import { recoveryObservationBudget, withRecoveryObservation } from "./recovery-observation-budget.js";
+import { getResourceDatabase } from "../storage/database.js";
+import { managedProcessBinding, resourceHome } from "./managed-processes.js";
+/** Physical probes precede reservation; the accepted publisher still checks
+ * exact owner identity and fresh lease expiry after waiting for the writer. */
+export function prepareControllerPublication(context, row, assertPhysicalOwner) {
+    assertPhysicalOwner();
+    const registry = getResourceDatabase(resourceHome(context));
+    const owner = registry.get("SELECT * FROM managed_processes WHERE id = ?", [row.process_id]);
+    if (!owner || owner.lease_token !== row.process_lease_token || owner.pid !== row.owner_pid || owner.owner_id !== row.controller_id)
+        throw new AppError("controller_owner_mismatch", "Controller publication lacks its physical owner", 1, { process_id: row.process_id, controller_id: row.controller_id, owner_found: Boolean(owner), lease_matches: owner?.lease_token === row.process_lease_token, pid_matches: owner?.pid === row.owner_pid, owner_matches: owner?.owner_id === row.controller_id, resource_home: resourceHome(context) });
+    const binding = managedProcessBinding(owner, resourceHome(context));
+    return () => {
+        const current = requireController(context, row.controller_id), process = registry.get("SELECT * FROM managed_processes WHERE id = ?", [owner.id]);
+        if (current.owner_token !== row.owner_token || current.owner_pid !== row.owner_pid || current.process_id !== row.process_id || current.process_lease_token !== row.process_lease_token || current.generation !== row.generation
+            || !["running", "capturing", "waiting_for_user", "waiting_for_context", "waiting_for_children", "waiting_for_capacity", "waiting_for_merge"].includes(current.status)
+            || !process || process.state !== "running" || process.lease_expires_at <= context.now() || digest(managedProcessBinding(process, resourceHome(context))) !== digest(binding))
+            throw new AppError("controller_owner_mismatch", "Controller publication lost its current physical lease", 1);
+    };
+}
 /** Capture is performed by the productive owner, before it releases the next
  * Stage. An observer never races the controller to copy a completed boundary. */
 export async function captureControllerBoundary(context, row, manifest, stage, nextStage, assertPhysicalOwner) {
@@ -30,27 +49,29 @@ export async function captureControllerBoundary(context, row, manifest, stage, n
             return;
         }
         catch (error) {
-            assertPhysicalOwner();
-            context.db.run("UPDATE run_controllers SET status = 'capture_failed', last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ?", [JSON.stringify(errorRecord(error)), context.now(), row.controller_id, row.owner_token]);
+            try {
+                assertPhysicalOwner();
+                context.db.run("UPDATE run_controllers SET status = 'capture_failed', last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ?", [JSON.stringify(errorRecord(error)), context.now(), row.controller_id, row.owner_token]);
+            }
+            catch (recordError) {
+                if (error instanceof AppError)
+                    error.details.capture_error_recording = errorRecord(recordError);
+            }
             throw error;
         }
     }
-    context.db.beginWriteTransaction();
-    try {
-        assertPhysicalOwner();
+    const assertStartOwner = prepareControllerPublication(context, row, assertPhysicalOwner);
+    context.db.writeTransaction(() => {
+        assertStartOwner();
         assertRunMutationAllowed(context, row.project_id, row.run_id, row.generation);
         const now = context.now();
         context.db.run("UPDATE run_controllers SET status = 'capturing', updated_at = ? WHERE controller_id = ? AND owner_token = ?", [now, row.controller_id, row.owner_token]);
         context.db.run("INSERT INTO run_controller_operations (operation_id,controller_id,generation,input_hash,input_json,status,created_at,updated_at) VALUES (?,?,?,?,?,'capturing',?,?) ON CONFLICT(operation_id) DO UPDATE SET generation = excluded.generation, status = 'capturing', error_json = NULL, updated_at = excluded.updated_at", [operationId, row.controller_id, row.generation, boundaryKey, JSON.stringify({ action: "boundary_capture", ...identity(stage), stage_entry: nextStage, output }), now, now]);
         appendEvent(context, row.controller_id, "boundary_capture_requested", { operation_id: operationId, boundary_key: boundaryKey, stage: stage.stage, stage_entry: nextStage });
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
-    const assertCurrent = () => {
-        assertPhysicalOwner();
+    });
+    const assertCurrent = (physical = true) => {
+        if (physical)
+            assertPhysicalOwner();
         const guard = recoveryGuard(context, row.project_id, row.run_id);
         if ((guard?.generation ?? 0) !== row.generation || ["draining", "sealed", "resuming"].includes(guard?.status ?? ""))
             throw new AppError("run_recovery_guarded", "Recovery or operator control superseded boundary capture", 1);
@@ -60,9 +81,11 @@ export async function captureControllerBoundary(context, row, manifest, stage, n
         const current = index.stage_runs.find(item => item.stage === stage.stage);
         if (!current || !["done", "skipped"].includes(current.status) || digest(identity(current)) !== boundaryKey)
             throw new AppError("controller_boundary_changed", "Stage identity changed after its capture fence", 1);
-        const continuation = getFlowRunStatus(context, scope).continuation;
-        if (nextStage ? continuation.kind !== "start_stage" || continuation.stage !== nextStage : continuation.kind !== "terminal")
-            throw new AppError("controller_boundary_changed", "Stage successor changed after its capture fence", 1);
+        if (physical) {
+            const continuation = getFlowRunStatus(context, scope).continuation;
+            if (nextStage ? continuation.kind !== "start_stage" || continuation.stage !== nextStage : continuation.kind !== "terminal")
+                throw new AppError("controller_boundary_changed", "Stage successor changed after its capture fence", 1);
+        }
     };
     let priorObservation = null;
     try {
@@ -114,23 +137,31 @@ export async function captureControllerBoundary(context, row, manifest, stage, n
                 await delay(observationBudget.nextDelay());
             }
         }
-        context.db.beginWriteTransaction();
-        try {
-            assertCurrent();
+        assertCurrent();
+        const assertFinishOwner = prepareControllerPublication(context, row, assertPhysicalOwner);
+        const preparedIndex = requireRun(context, row.project_id, row.run_id).index_json;
+        context.db.writeTransaction(() => {
+            assertFinishOwner();
+            assertCurrent(false);
+            if (requireRun(context, row.project_id, row.run_id).index_json !== preparedIndex)
+                throw new AppError("controller_boundary_changed", "RUN changed before capture publication", 1);
             context.db.run("UPDATE run_controller_operations SET status = 'completed', receipt_json = ?, error_json = NULL, updated_at = ? WHERE operation_id = ?", [JSON.stringify(receipt), context.now(), operationId]);
             appendEvent(context, row.controller_id, "boundary_captured", { ...identity(stage), boundary_key: boundaryKey, operation_id: operationId, ...receipt });
             context.db.run("UPDATE run_controllers SET status = 'running', updated_at = ? WHERE controller_id = ? AND owner_token = ?", [context.now(), row.controller_id, row.owner_token]);
-            context.db.exec("COMMIT");
-        }
-        catch (error) {
-            context.db.exec("ROLLBACK");
-            throw error;
-        }
+        });
     }
     catch (error) {
         observationBudget.exhausted();
-        context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(COALESCE(receipt_json, '{}'), '$.recovery_observation', json(?)) WHERE operation_id = ?", [JSON.stringify(observationBudget.state()), operationId]);
-        context.db.run("UPDATE run_controller_operations SET status = 'failed', error_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(errorRecord(error)), context.now(), operationId]);
+        try {
+            context.db.writeTransaction(() => {
+                context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(COALESCE(receipt_json, '{}'), '$.recovery_observation', json(?)) WHERE operation_id = ?", [JSON.stringify(observationBudget.state()), operationId]);
+                context.db.run("UPDATE run_controller_operations SET status = 'failed', error_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(errorRecord(error)), context.now(), operationId]);
+            });
+        }
+        catch (recordError) {
+            if (error instanceof AppError)
+                error.details.capture_error_recording = errorRecord(recordError);
+        }
         throw error;
     }
 }