@deksden-com/dd-flow-cli 0.9.0-beta.104 → 0.9.0-beta.105

package/dist/services/runtime-scope-resume.js

@@ -9,9 +9,10 @@ import { managedProcessBinding, processIsAlive, processTreeIsAlive, resourceHome
 import { runtimeBudgetStatus, scopeLocalProcessRole, validateRetainedRuntimeScopeManifest, prepareRuntimeScopeFence } from "./runtime-budget.js";
 import { nativeInventoryVersion, retainedDaemonOperations } from "./run-control.js";
 import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
-import { recordControllerResume, resumeRunController } from "./run-controller-recovery.js";
+import { prepareControllerResume, resumeRunController } from "./run-controller-recovery.js";
 import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 import { assertHistoricalDaemonSettlement } from "./native-daemon-history.js";
+import { cleanupScopeWriters } from "./scope-writer-cleanup.js";
 const hash = (value) => crypto.createHash("sha256").update(value).digest("hex");
 const nativeLaunchEnvironmentKeys = ["CODEX_HOME", "DD_FLOW_CONFIG_HOME", "DD_FLOW_HOME", "DD_FLOW_BIN", "DD_FLOW_RESOURCE_HOME"];
 function nativeLaunchEnvironment(context, saved) {
@@ -67,16 +68,8 @@ export async function prepareRuntimeScopeResume(context, scopeId, generation, re
             if (!project || manifest?.budget?.scope_id !== scopeId || manifest.resource_home !== resourceHome(context))
                 throw new AppError("runtime_scope_owner_unknown", "Resume RUN no longer belongs to this retained scope", 1);
             const input = { projectRoot: project.root, runId: source.run_id, requestId: source.resume_request_id, controlId: source.control_id };
-            db.beginWriteTransaction();
-            try {
-                assertCurrent();
-                recordControllerResume(target, input);
-                db.exec("COMMIT");
-            }
-            catch (error) {
-                db.exec("ROLLBACK");
-                throw error;
-            }
+            const commitResume = prepareControllerResume(target, input);
+            db.writeTransaction(() => { assertCurrent(); commitResume(); });
             assertCurrent();
             const receipt = await resumeRunController(target, { ...input, waitMs: 0 });
             assertCurrent();
@@ -108,9 +101,19 @@ export async function prepareRuntimeScopeResume(context, scopeId, generation, re
     const lockedRuns = new Map(), heldRuns = [];
     let registryHeld = false, runPreparationConsistent = false;
     let released = null, releaseError = null, releaseMessage = null;
+    let cleanupErrors = [];
     try {
         for (const home of [...new Set(intent.runs.map((source) => source.runtime_home))].sort())
             lockedRuns.set(home, createContext({ ...context.env, DD_FLOW_HOME: home, DD_FLOW_RESOURCE_HOME: resourceHome(context), DD_FLOW_ENGINE_MODE: "1" }));
+        const checks = [];
+        for (const [index, source] of intent.runs.entries()) {
+            const target = lockedRuns.get(source.runtime_home);
+            const prepared = preparedScopeRun(target, { scopeId, requestId: source.resume_request_id, projectId: source.project_id, runId: source.run_id, controlId: source.control_id, recoveryId: source.recovery_id }, assertCurrent);
+            const proof = prepared.proof;
+            checks.push(prepared.assertUnchanged);
+            runs[index] = { ...runs[index], ...proof, ...(proof.prepared === true ? { pending: false, reason: null } : {}) };
+        }
+        const commitRelease = releaseRequestId === undefined ? null : prepareScopeRelease(context, intent, runs, native);
         db.beginWriteTransaction();
         registryHeld = true;
         for (const target of lockedRuns.values()) {
@@ -118,14 +121,11 @@ export async function prepareRuntimeScopeResume(context, scopeId, generation, re
             heldRuns.push(target);
         }
         assertCurrent();
-        for (const [index, source] of intent.runs.entries()) {
-            const target = lockedRuns.get(source.runtime_home);
-            const proof = preparedScopeRun(target, { scopeId, requestId: source.resume_request_id, projectId: source.project_id, runId: source.run_id, controlId: source.control_id, recoveryId: source.recovery_id }, assertCurrent);
-            runs[index] = { ...runs[index], ...proof, ...(proof.prepared === true ? { pending: false, reason: null } : {}) };
-        }
+        for (const check of checks)
+            check();
         runPreparationConsistent = true;
-        if (releaseRequestId !== undefined) {
-            const receipt = publishScopeRelease(context, intent, runs, native);
+        if (commitRelease) {
+            const receipt = commitRelease();
             db.exec("COMMIT");
             registryHeld = false;
             released = receipt;
@@ -138,28 +138,21 @@ export async function prepareRuntimeScopeResume(context, scopeId, generation, re
             runs[index] = { ...run, prepared: false, pending: true, reason: error instanceof AppError ? error.code : "scope_writer_boundary_unavailable" };
     }
     finally {
-        try {
-            for (const target of heldRuns.reverse())
-                target.db.exec("ROLLBACK");
-        }
-        finally {
-            try {
-                if (registryHeld)
-                    db.exec("ROLLBACK");
-            }
-            finally {
-                for (const target of lockedRuns.values())
-                    target.db.close?.();
-            }
-        }
+        cleanupErrors = cleanupScopeWriters([
+            ...[...lockedRuns.values()].reverse().map(target => ({ name: target.ddFlowHome, db: target.db, rollback: heldRuns.includes(target), close: "always" })),
+            { name: resourceHome(context), db, rollback: registryHeld, close: "on_error" }
+        ]);
     }
     if (released)
-        return { ...released, status: "released", dispatch_blocked: false, current: true, settled: false, reused: false };
+        return { ...released, status: "released", dispatch_blocked: false, current: true, settled: false, reused: false, ...(cleanupErrors.length ? { cleanup_errors: cleanupErrors } : {}) };
+    if (cleanupErrors.length)
+        throw new AppError(releaseError ?? "scope_writer_cleanup_failed", releaseMessage ?? "Scope preparation cleanup failed", 1, { scope_cleanup_errors: cleanupErrors });
     assertCurrent();
     return { scope_id: scopeId, generation, request_id: intent.request_id, status: "preparing", dispatch_blocked: true, settled: false, release_error: releaseError ? { code: releaseError, message: releaseMessage } : null, run_preparation_consistent: runPreparationConsistent, runs, native, probes: intent.probes, pending_reasons: [...new Set(["scope_release_required", ...(releaseError ? [releaseError] : []), ...(!runPreparationConsistent ? ["scope_writer_boundary_unavailable"] : []), ...(runs.some(item => item.prepared !== true) ? ["run_recovery_required"] : []), ...(native.some(item => item?.prepared !== true) ? ["non_work_recovery_required"] : []), ...(intent.probes.length ? ["probe_reconciliation_required"] : [])])] };
 }
-/** Called only inside the registry + all-RUN writer boundary above. */
-function publishScopeRelease(context, intent, runs, native) {
+/** Read filesystem/native evidence before reserving writers. The returned
+ * SQL-only commit is called with registry -> all-RUN barriers held. */
+function prepareScopeRelease(context, intent, runs, native) {
     const db = getResourceDatabase(resourceHome(context));
     if (runs.some(run => run.prepared !== true) || native.some(owner => owner?.prepared !== true))
         throw new AppError("runtime_scope_preparation_required", "Every owned RUN and native Session must be prepared", 1);
@@ -251,27 +244,42 @@ function publishScopeRelease(context, intent, runs, native) {
         throw new AppError("runtime_scope_inventory_changed", "Release has an unverified process registration", 1);
     const key = hash(JSON.stringify([intent.scope_id, intent.generation])), now = context.now();
     const receipt = { scope_id: intent.scope_id, generation: intent.generation, request_id: intent.request_id, source_request_id: intent.source_request_id, capture_key: intent.capture_key, journal_sha256: hash(artifact.journal_bytes), run_operations: runs.map(run => run.run_operation), native, probes, process_bindings: actual, released_at: now };
-    db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume-release',?,?,?,?,NULL,?,?,?)", [key, intent.scope_id, key, now, JSON.stringify(receipt), now, now]);
-    if (db.run("DELETE FROM managed_resources WHERE resource_kind = 'scope-control' AND resource_key = ? AND json_extract(metadata_json, '$.generation') = ?", [intent.scope_id, intent.generation]).changes !== 1)
-        throw new AppError("runtime_scope_control_superseded", "Release lost its control generation", 1);
-    db.run("UPDATE managed_resources SET metadata_json = json_set(metadata_json, '$.status', 'released'), updated_at = ? WHERE resource_kind = 'scope-resume' AND resource_key = ?", [now, intent.scope_id]);
-    return receipt;
+    const resumeRow = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume' AND resource_key = ?", [intent.scope_id]);
+    return () => {
+        const latest = runtimeBudgetStatus(context, intent.scope_id);
+        const latestBindings = latest.processes.map(record => managedProcessBinding(record, resourceHome(context)));
+        if (latest.fence || latest.control?.generation !== intent.generation || latest.provider_turns.length
+            || !isDeepStrictEqual(latestBindings, actual)
+            || db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control-capture' AND resource_key = ?", [intent.capture_key])?.metadata_json !== artifactRow.metadata_json
+            || db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume' AND resource_key = ?", [intent.scope_id])?.metadata_json !== resumeRow?.metadata_json)
+            throw new AppError("runtime_scope_inventory_changed", "Scope changed while release evidence was prepared", 1);
+        db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume-release',?,?,?,?,NULL,?,?,?)", [key, intent.scope_id, key, now, JSON.stringify(receipt), now, now]);
+        if (db.run("DELETE FROM managed_resources WHERE resource_kind = 'scope-control' AND resource_key = ? AND json_extract(metadata_json, '$.generation') = ?", [intent.scope_id, intent.generation]).changes !== 1)
+            throw new AppError("runtime_scope_control_superseded", "Release lost its control generation", 1);
+        db.run("UPDATE managed_resources SET metadata_json = json_set(metadata_json, '$.status', 'released'), updated_at = ? WHERE resource_kind = 'scope-resume' AND resource_key = ?", [now, intent.scope_id]);
+        return receipt;
+    };
 }
 /** A preparation snapshot, not an unfence. The release arbiter must repeat
  * these reads while holding every participating RUN writer boundary. */
 function preparedScopeRun(context, input, assertCurrent) {
     const registry = getResourceDatabase(resourceHome(context));
-    registry.exec("SAVEPOINT scope_run_registry");
-    let readingRun = false;
-    try {
-        context.db.exec("SAVEPOINT scope_run_preparation");
-        readingRun = true;
+    const checks = [];
+    const read = (sql, params) => {
+        const value = context.db.get(sql, params);
+        checks.push(() => { if (!isDeepStrictEqual(context.db.get(sql, params), value))
+            throw new AppError("runtime_scope_inventory_changed", "RUN preparation changed before release", 1); });
+        return value;
+    };
+    const finish = (proof) => ({ proof, assertUnchanged: () => { assertCurrent(); for (const check of checks)
+            check(); } });
+    return registry.readSnapshot(() => context.db.readSnapshot(() => {
         assertCurrent();
-        const controller = context.db.get("SELECT * FROM run_controllers WHERE project_id = ? AND run_id = ? AND status NOT IN ('completed','cancelled','superseded')", [input.projectId, input.runId]);
+        const controller = read("SELECT * FROM run_controllers WHERE project_id = ? AND run_id = ? AND status NOT IN ('completed','cancelled','superseded')", [input.projectId, input.runId]);
         if (!controller)
             throw new AppError("runtime_scope_owner_unknown", "Prepared RUN lost its controller", 1);
         const state = JSON.parse(controller.state_json), manifest = JSON.parse(controller.manifest_json);
-        const operation = context.db.get(`SELECT o.operation_id, o.receipt_json FROM run_controller_operations o
+        const operation = read(`SELECT o.operation_id, o.receipt_json FROM run_controller_operations o
       JOIN run_controls ctl ON ctl.control_id = ? AND ctl.project_id = ? AND ctl.run_id = ?
       JOIN run_recovery_guards g ON g.recovery_id = ctl.recovery_id
       WHERE o.controller_id = ? AND o.generation = ? AND o.status = 'accepted'
@@ -279,61 +287,57 @@ function preparedScopeRun(context, input, assertCurrent) {
         AND json_extract(o.input_json, '$.action') = 'control_resume' AND json_extract(o.input_json, '$.request_id') = ?`, [input.controlId, input.projectId, input.runId, controller.controller_id, controller.generation, input.recoveryId, input.requestId]);
         const prepared = operation?.receipt_json ? JSON.parse(operation.receipt_json) : null;
         if (prepared?.prepared !== true)
-            return { prepared: false, pending: true, reason: "run_recovery_preparation_required" };
+            return finish({ prepared: false, pending: true, reason: "run_recovery_preparation_required" });
         const session = state.current_session === null ? null : state.sessions[state.current_session];
         const owner = registry.get("SELECT * FROM managed_processes WHERE id = ?", [controller.process_id]);
         if (!session || manifest.budget?.scope_id !== input.scopeId || manifest.resource_home !== resourceHome(context) || state.recovery?.operation_id !== operation.operation_id || state.recovery?.control_id !== input.controlId || state.recovery?.recovery_id !== input.recoveryId || prepared.recovery_id !== input.recoveryId || prepared.session_id !== session.id || !owner || owner.lease_token !== controller.process_lease_token || owner.pid !== controller.owner_pid || owner.owner_id !== controller.controller_id || !processIsAlive(owner))
             throw new AppError("runtime_scope_owner_unknown", "RUN preparation lost its current owner or Session", 1);
         const native = requireManagedDaemonBinding(context, { stateDir: session.state_dir, projectId: input.projectId, runId: input.runId, ownerId: session.owner.owner_id });
-        const loaded = context.db.get("SELECT receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'completed'", [prepared.resume_operation_id, controller.controller_id, controller.generation]);
+        const loaded = read("SELECT receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'completed'", [prepared.resume_operation_id, controller.controller_id, controller.generation]);
         const loadReceipt = loaded?.receipt_json ? JSON.parse(loaded.receipt_json) : null;
         if (!processIsAlive(native.process) || native.process.id !== prepared.process_id || native.state.daemon_id !== prepared.daemon_id || loadReceipt?.settled !== true || adapterSessionId(loadReceipt) !== session.id)
             throw new AppError("runtime_scope_owner_unknown", "RUN preparation has no current native load acknowledgement", 1);
-        return { prepared: true, run_operation: { runtime_home: context.ddFlowHome, controller_id: controller.controller_id, operation_id: operation.operation_id }, process_bindings: [managedProcessBinding(owner, resourceHome(context)), managedProcessBinding(native.process, resourceHome(context))], native: { state_dir: session.state_dir, daemon_id: prepared.daemon_id, session_id: session.id, inventory_version: nativeInventoryVersion(session.state_dir) } };
-    }
-    finally {
-        try {
-            if (readingRun)
-                context.db.exec("RELEASE scope_run_preparation");
-        }
-        finally {
-            registry.exec("RELEASE scope_run_registry");
+        for (const record of [owner, native.process]) {
+            const expected = managedProcessBinding(record, resourceHome(context));
+            checks.push(() => {
+                const latest = registry.get("SELECT * FROM managed_processes WHERE id = ?", [record.id]);
+                if (!latest || !isDeepStrictEqual(managedProcessBinding(latest, resourceHome(context)), expected))
+                    throw new AppError("runtime_scope_owner_unknown", "Prepared RUN lost its process binding", 1);
+            });
         }
-    }
+        return finish({ prepared: true, run_operation: { runtime_home: context.ddFlowHome, controller_id: controller.controller_id, operation_id: operation.operation_id }, process_bindings: [managedProcessBinding(owner, resourceHome(context)), managedProcessBinding(native.process, resourceHome(context))], native: { state_dir: session.state_dir, daemon_id: prepared.daemon_id, session_id: session.id, inventory_version: nativeInventoryVersion(session.state_dir) } });
+    }));
 }
 async function restartScopeNative(context, intent, source, assertCurrent) {
     const db = getResourceDatabase(resourceHome(context)), key = hash(JSON.stringify([intent.scope_id, intent.generation, source.process_id]));
     const saved = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [key]);
-    const operation = JSON.parse(saved.metadata_json);
+    let operation = JSON.parse(saved.metadata_json);
     const startup = source.operations.find(item => item.operation === "daemon.start" && item.result?.daemon_id === source.daemon_id);
     const launch = startup.launch;
     const state = () => JSON.parse(fs.readFileSync(path.join(source.state_dir, "daemon.json"), "utf8"));
-    const assertRetired = () => {
+    const assertRetired = (physical = true) => {
         assertCurrent();
         const old = db.get("SELECT * FROM managed_processes WHERE id = ?", [source.process_id]);
-        if (!old || processTreeIsAlive(old) || JSON.stringify(managedProcessBinding(old, resourceHome(context))) !== JSON.stringify(intent.process_bindings.find(item => item.process_id === source.process_id)))
+        if (!old || physical && processTreeIsAlive(old) || JSON.stringify(managedProcessBinding(old, resourceHome(context))) !== JSON.stringify(intent.process_bindings.find(item => item.process_id === source.process_id)))
             throw new AppError("runtime_scope_owner_unknown", "The retired native tree changed or is still alive", 1);
     };
     assertRetired();
+    const predecessor = operation.status === "retired" ? state() : null;
+    if (predecessor && (predecessor.daemon_id !== source.daemon_id || predecessor.shutdown_state !== "clean"))
+        throw new AppError("runtime_scope_owner_unknown", "Native restart lost its clean predecessor", 1);
     let dispatch = false;
-    db.beginWriteTransaction();
-    try {
-        assertRetired();
+    db.writeTransaction(() => {
+        assertRetired(false);
+        operation = JSON.parse(db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [key]).metadata_json);
         if (operation.status === "retired") {
-            const old = state();
-            if (old.daemon_id !== source.daemon_id || old.shutdown_state !== "clean")
-                throw new AppError("runtime_scope_owner_unknown", "Native restart lost its clean predecessor", 1);
+            if (!predecessor)
+                throw new AppError("runtime_scope_inventory_changed", "Native retirement changed during restart preparation", 1);
             operation.status = "starting";
             operation.restart_operation_id = `scope-restart:${key}`;
             dispatch = true;
             db.run("UPDATE managed_resources SET metadata_json = ?, updated_at = ? WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [JSON.stringify(operation), context.now(), key]);
         }
-        db.exec("COMMIT");
-    }
-    catch (error) {
-        db.exec("ROLLBACK");
-        throw error;
-    }
+    });
     if (!operation.restart_receipt) {
         if (dispatch) {
             const env = nativeLaunchEnvironment(context, launch.env);
@@ -358,10 +362,11 @@ async function restartScopeNative(context, intent, source, assertCurrent) {
     operation.status = "restarted";
     operation.replacement_binding = binding;
     db.run("UPDATE managed_resources SET metadata_json = ?, updated_at = ? WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [JSON.stringify(operation), context.now(), key]);
-    const assertReplacement = () => {
-        assertRetired();
-        const current = db.get("SELECT * FROM managed_processes WHERE id = ?", [replacement.id]), latest = state();
-        if (!current || !processIsAlive(current) || JSON.stringify(managedProcessBinding(current, resourceHome(context))) !== JSON.stringify(binding) || latest.daemon_id !== daemon.daemon_id || latest.resource_process?.id !== current.id || latest.resource_process?.lease_token !== current.lease_token || JSON.stringify(latest.config?.runtime_owner) !== JSON.stringify(source.runtime_owner))
+    const assertReplacement = (physical = true) => {
+        assertRetired(physical);
+        const current = db.get("SELECT * FROM managed_processes WHERE id = ?", [replacement.id]), latest = physical ? state() : null;
+        if (!current || JSON.stringify(managedProcessBinding(current, resourceHome(context))) !== JSON.stringify(binding)
+            || physical && (!processIsAlive(current) || latest.daemon_id !== daemon.daemon_id || latest.resource_process?.id !== current.id || latest.resource_process?.lease_token !== current.lease_token || JSON.stringify(latest.config?.runtime_owner) !== JSON.stringify(source.runtime_owner)))
             throw new AppError("runtime_scope_owner_unknown", "Session loading lost its native replacement", 1);
     };
     if (!Array.isArray(source.sessions) || !source.sessions.length || source.sessions.some(item => typeof item.session_id !== "string" || !item.session_id) || new Set(source.sessions.map(item => item.session_id)).size !== source.sessions.length)
@@ -369,10 +374,11 @@ async function restartScopeNative(context, intent, source, assertCurrent) {
     const sessions = [];
     for (const session of source.sessions) {
         const operationId = `scope-load:${hash(JSON.stringify([intent.scope_id, intent.generation, source.process_id, session.session_id]))}`;
-        let load, dispatchLoad = false;
-        db.beginWriteTransaction();
-        try {
-            assertReplacement();
+        let dispatchLoad = false;
+        assertReplacement();
+        const load = db.writeTransaction(() => {
+            let load;
+            assertReplacement(false);
             const row = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume-native-load' AND resource_key = ?", [operationId]);
             if (row)
                 load = JSON.parse(row.metadata_json);
@@ -384,12 +390,8 @@ async function restartScopeNative(context, intent, source, assertCurrent) {
             }
             if (load.scope_id !== intent.scope_id || load.generation !== intent.generation || load.request_id !== intent.request_id || load.source_process_id !== source.process_id || load.process_id !== replacement.id || load.daemon_id !== daemon.daemon_id || load.session_id !== session.session_id)
                 throw new AppError("runtime_scope_owner_unknown", "Retained Session load belongs to another physical owner", 1);
-            db.exec("COMMIT");
-        }
-        catch (error) {
-            db.exec("ROLLBACK");
-            throw error;
-        }
+            return load;
+        });
         if (!load.receipt) {
             if (dispatchLoad) {
                 assertReplacement();
@@ -417,10 +419,11 @@ async function retireScopeNative(context, intent, source, assertCurrent) {
     const record = db.get("SELECT * FROM managed_processes WHERE id = ?", [source.process_id]);
     const frozen = intent.process_bindings.find((binding) => binding.process_id === source.process_id);
     const state = () => JSON.parse(fs.readFileSync(path.join(source.state_dir, "daemon.json"), "utf8"));
-    const assertOwner = () => {
+    const assertOwner = (physical = true) => {
         assertCurrent();
-        const current = db.get("SELECT * FROM managed_processes WHERE id = ?", [source.process_id]), daemon = state();
-        if (!current || current.run_id || !["judge", "probe"].includes(source.role) || JSON.stringify(managedProcessBinding(current, resourceHome(context))) !== JSON.stringify(frozen) || daemon.daemon_id !== source.daemon_id || daemon.resource_process?.id !== current.id || daemon.resource_process?.lease_token !== current.lease_token || JSON.stringify(daemon.config?.runtime_owner) !== JSON.stringify(source.runtime_owner))
+        const current = db.get("SELECT * FROM managed_processes WHERE id = ?", [source.process_id]), daemon = physical ? state() : null;
+        if (!current || current.run_id || !["judge", "probe"].includes(source.role) || JSON.stringify(managedProcessBinding(current, resourceHome(context))) !== JSON.stringify(frozen)
+            || physical && (daemon.daemon_id !== source.daemon_id || daemon.resource_process?.id !== current.id || daemon.resource_process?.lease_token !== current.lease_token || JSON.stringify(daemon.config?.runtime_owner) !== JSON.stringify(source.runtime_owner)))
             throw new AppError("runtime_scope_owner_unknown", "Native retirement lost its frozen physical owner", 1);
     };
     assertOwner();
@@ -437,28 +440,24 @@ async function retireScopeNative(context, intent, source, assertCurrent) {
         throw new AppError("runtime_scope_native_launch_required", "Native recovery requires the original owned launch contract", 1);
     if (!launch.env || Object.keys(launch.env).some(name => !nativeLaunchEnvironmentKeys.includes(name)) || nativeLaunchEnvironmentKeys.some(name => launch.env[name] !== null && typeof launch.env[name] !== "string") || launch.args.some(arg => typeof arg !== "string"))
         throw new AppError("runtime_scope_native_launch_required", "Native recovery requires explicit configuration presence before retiring its owner", 1);
-    let operation;
     let dispatch = false;
-    db.beginWriteTransaction();
-    try {
-        assertOwner();
+    const preparedInventory = db.get("SELECT 1 FROM managed_resources WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [key]) ? null : nativeInventoryVersion(source.state_dir);
+    const operation = db.writeTransaction(() => {
+        let operation;
+        assertOwner(false);
         const saved = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [key]);
         if (saved)
             operation = JSON.parse(saved.metadata_json);
         else {
-            if (nativeInventoryVersion(source.state_dir) !== source.inventory_version)
+            if (preparedInventory !== source.inventory_version)
                 throw new AppError("runtime_scope_inventory_changed", "Native owner changed before retirement", 1);
             operation = { scope_id: intent.scope_id, generation: intent.generation, request_id: intent.request_id, process_id: source.process_id, daemon_id: source.daemon_id, operation_id: `scope-retire:${key}`, status: "retiring" };
             const now = context.now();
             db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume-native',?,?,?,?,NULL,?,?,?)", [key, intent.scope_id, key, now, JSON.stringify(operation), now, now]);
             dispatch = true;
         }
-        db.exec("COMMIT");
-    }
-    catch (error) {
-        db.exec("ROLLBACK");
-        throw error;
-    }
+        return operation;
+    });
     if (!operation.receipt) {
         if (dispatch) {
             assertOwner();
@@ -539,27 +538,40 @@ export function prepareRuntimeScopeResumeRequest(context, input) {
     }
 }
 export function recordRuntimeScopeResume(context, input) {
-    const prepared = prepareRuntimeScopeResumeRequest(context, input);
-    if (prepared.reused)
-        return prepared;
-    const db = getResourceDatabase(resourceHome(context)), key = hash(JSON.stringify([input.scopeId, input.requestId]));
-    db.beginWriteTransaction();
+    prepareRuntimeScopeResumeInput(input);
+    let db = getResourceDatabase(resourceHome(context), "read_existing");
+    const key = hash(JSON.stringify([input.scopeId, input.requestId]));
+    const authority = () => {
+        const status = runtimeBudgetStatus(context, input.scopeId);
+        return {
+            records: db.all("SELECT resource_kind, resource_key, metadata_json FROM managed_resources WHERE (resource_kind = 'scope-control' AND resource_key = ?) OR (resource_kind = 'scope-resume' AND resource_key = ?) OR (resource_kind = 'scope-control-drain' AND resource_key = ?) OR (resource_kind = 'scope-control-capture' AND resource_key = ?) ORDER BY resource_kind, resource_key", [input.scopeId, input.scopeId, hash(JSON.stringify([input.scopeId, input.generation])), input.captureKey]),
+            fence: status.fence, manifest: status.manifest, turns: status.provider_turns,
+            processes: status.processes.map(record => managedProcessBinding(record, resourceHome(context)))
+        };
+    };
+    let before, prepared;
     try {
-        // Recheck mutable capture/ownership authority under the existing arbiter.
-        const result = prepareRuntimeScopeResumeRequest(context, input);
-        if (!result.reused) {
-            const receipt = { ...result };
-            delete receipt.current;
-            delete receipt.reused;
-            const payload = JSON.stringify(receipt), now = context.now();
-            db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume-request',?,?,?,?,NULL,?,?,?)", [key, input.scopeId, key, now, payload, now, now]);
-            db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume',?,?,?,?,NULL,?,?,?) ON CONFLICT(resource_kind,resource_key) DO UPDATE SET lease_token = excluded.lease_token, metadata_json = excluded.metadata_json, updated_at = excluded.updated_at", [input.scopeId, input.scopeId, key, now, payload, now, now]);
-        }
-        db.exec("COMMIT");
-        return result;
+        before = authority();
+        prepared = prepareRuntimeScopeResumeRequest(context, input);
     }
-    catch (error) {
-        db.exec("ROLLBACK");
-        throw error;
+    finally {
+        db.close?.();
     }
+    if (prepared.reused)
+        return prepared;
+    db = getResourceDatabase(resourceHome(context));
+    return db.writeTransaction(() => {
+        // This branch is SQL-only: an existing request bypasses evidence reads.
+        if (db.get("SELECT 1 FROM managed_resources WHERE resource_kind = 'scope-resume-request' AND resource_key = ?", [key]))
+            return prepareRuntimeScopeResumeRequest(context, input);
+        if (!isDeepStrictEqual(authority(), before))
+            throw new AppError("runtime_scope_inventory_changed", "Resume authority changed while evidence was prepared", 1);
+        const receipt = { ...prepared };
+        delete receipt.current;
+        delete receipt.reused;
+        const payload = JSON.stringify(receipt), now = context.now();
+        db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume-request',?,?,?,?,NULL,?,?,?)", [key, input.scopeId, key, now, payload, now, now]);
+        db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume',?,?,?,?,NULL,?,?,?) ON CONFLICT(resource_kind,resource_key) DO UPDATE SET lease_token = excluded.lease_token, metadata_json = excluded.metadata_json, updated_at = excluded.updated_at", [input.scopeId, input.scopeId, key, now, payload, now, now]);
+        return prepared;
+    });
 }

package/dist/services/runtime-scope-worker.js

@@ -53,45 +53,49 @@ export async function reconcileRuntimeScopeControl(context, scopeId, generation,
 }
 export async function launchRuntimeScopeControl(context, scopeId, requestId, mode, manifest, reconcileId, resumeId, prepared) {
     const control = requestRuntimeScopeControl(context, scopeId, requestId, mode, manifest, prepared), db = getResourceDatabase(resourceHome(context)), key = keyFor(scopeId, control.generation);
-    let worker;
-    db.beginWriteTransaction();
-    try {
-        const current = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control' AND resource_key = ?", [scopeId]);
-        const prior = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control-worker' AND resource_key = ?", [key]);
-        const existing = prior ? JSON.parse(prior.metadata_json) : null;
-        if (existing) {
-            const identity = existing.owner ?? existing.launcher;
-            if (!identity || !Number.isSafeInteger(identity.pid) || identity.pid < 1 || typeof identity.pid_started_at !== "string" || !identity.pid_started_at || !["starting", "running", "completed", "failed", "superseded"].includes(existing.status))
-                throw new AppError("runtime_scope_owner_unknown", "Retained scope owner has no verifiable birth identity", 1);
-        }
-        if (!current || JSON.parse(current.metadata_json).generation !== control.generation || db.get("SELECT 1 FROM managed_resources WHERE resource_kind = 'provider-fence' AND resource_key = ?", [scopeId])) {
-            db.exec("COMMIT");
-            return { scope_id: scopeId, control, current: false, settled: false, worker: existing ? publicRuntimeScopeWorker(existing) : null };
-        }
-        if (existing && (existing.owner ? processIsAlive(existing.owner) : existing.status !== "failed" && processIsAlive(existing.launcher))) {
-            db.exec("COMMIT");
-            return { scope_id: scopeId, control, current: true, settled: false, worker: publicRuntimeScopeWorker(existing) };
-        }
-        if (existing?.status === "completed" && !reconcileId && !resumeId) {
-            db.exec("COMMIT");
-            return { scope_id: scopeId, control, current: true, settled: false, worker: publicRuntimeScopeWorker(existing) };
-        }
-        const renewal = resumeId ? `resume:${resumeId}` : reconcileId;
-        const snapshot = renewal ? renewRecoveryObservation(existing?.snapshot ?? {}, renewal) : existing?.snapshot;
-        if (existing && recoveryObservationBudget(snapshot).state().remaining_ms === 0) {
-            db.exec("COMMIT");
-            return { scope_id: scopeId, control, current: true, settled: false, worker: publicRuntimeScopeWorker(existing) };
+    const launcher = birth();
+    const publication = (() => {
+        for (let attempt = 0;; attempt++) {
+            const prior = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control-worker' AND resource_key = ?", [key]);
+            const existing = prior ? JSON.parse(prior.metadata_json) : null;
+            if (existing) {
+                const identity = existing.owner ?? existing.launcher;
+                if (!identity || !Number.isSafeInteger(identity.pid) || identity.pid < 1 || typeof identity.pid_started_at !== "string" || !identity.pid_started_at || !["starting", "running", "completed", "failed", "superseded"].includes(existing.status))
+                    throw new AppError("runtime_scope_owner_unknown", "Retained scope owner has no verifiable birth identity", 1);
+            }
+            const existingAlive = !!existing && (existing.owner ? processIsAlive(existing.owner) : existing.status !== "failed" && processIsAlive(existing.launcher));
+            try {
+                return db.writeTransaction(() => {
+                    const current = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control' AND resource_key = ?", [scopeId]);
+                    if (db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control-worker' AND resource_key = ?", [key])?.metadata_json !== prior?.metadata_json)
+                        throw new AppError("runtime_scope_owner_changed", "Scope owner changed while its physical identity was checked", 1);
+                    if (!current || JSON.parse(current.metadata_json).generation !== control.generation || db.get("SELECT 1 FROM managed_resources WHERE resource_kind = 'provider-fence' AND resource_key = ?", [scopeId]))
+                        return { current: false, existing };
+                    if (existing && existingAlive)
+                        return { current: true, existing };
+                    if (existing?.status === "completed" && !reconcileId && !resumeId)
+                        return { current: true, existing };
+                    const renewal = resumeId ? `resume:${resumeId}` : reconcileId;
+                    const snapshot = renewal ? renewRecoveryObservation(existing?.snapshot ?? {}, renewal) : existing?.snapshot;
+                    if (existing && recoveryObservationBudget(snapshot).state().remaining_ms === 0)
+                        return { current: true, existing };
+                    const cleanupRequest = resumeId ? undefined : reconcileId ?? existing?.reconcile_id;
+                    const worker = { scope_id: scopeId, generation: control.generation, request_id: requestId, mode, token: crypto.randomUUID(), status: "starting", launcher, ...(snapshot ? { snapshot } : {}), ...(cleanupRequest ? { reconcile_id: cleanupRequest } : {}) };
+                    const now = context.now();
+                    db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-control-worker',?,?,?,?,NULL,?,?,?) ON CONFLICT(resource_kind,resource_key) DO UPDATE SET lease_token = excluded.lease_token, metadata_json = excluded.metadata_json, updated_at = excluded.updated_at", [key, scopeId, worker.token, now, JSON.stringify(worker), now, now]);
+                    return { worker };
+                }, "runtimeScope.workerReserve");
+            }
+            catch (error) {
+                // No worker has spawned yet. Recheck physical identity after a racing update.
+                if (!(error instanceof AppError) || error.code !== "runtime_scope_owner_changed" || attempt >= 3)
+                    throw error;
+            }
         }
-        const cleanupRequest = resumeId ? undefined : reconcileId ?? existing?.reconcile_id;
-        worker = { scope_id: scopeId, generation: control.generation, request_id: requestId, mode, token: crypto.randomUUID(), status: "starting", launcher: birth(), ...(snapshot ? { snapshot } : {}), ...(cleanupRequest ? { reconcile_id: cleanupRequest } : {}) };
-        const now = context.now();
-        db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-control-worker',?,?,?,?,NULL,?,?,?) ON CONFLICT(resource_kind,resource_key) DO UPDATE SET lease_token = excluded.lease_token, metadata_json = excluded.metadata_json, updated_at = excluded.updated_at", [key, scopeId, worker.token, now, JSON.stringify(worker), now, now]);
-        db.exec("COMMIT");
-    }
-    catch (error) {
-        db.exec("ROLLBACK");
-        throw error;
-    }
+    })();
+    if (!publication.worker)
+        return { scope_id: scopeId, control, current: publication.current, settled: false, worker: publication.existing ? publicRuntimeScopeWorker(publication.existing) : null };
+    const worker = publication.worker;
     try {
         const entry = fileURLToPath(new URL("../cli.js", import.meta.url));
         if (!fs.existsSync(entry))
@@ -145,19 +149,14 @@ function requireStartingScopeWorker(db, key, token) {
 export async function serveRuntimeScopeControl(context, scopeId, generation) {
     const { key, token } = prepareRuntimeScopeServing(context, scopeId, generation);
     const db = getResourceDatabase(resourceHome(context));
-    let worker;
-    db.beginWriteTransaction();
-    try {
-        worker = requireStartingScopeWorker(db, key, token);
-        worker.owner = birth();
+    const owner = birth();
+    const worker = db.writeTransaction(() => {
+        const worker = requireStartingScopeWorker(db, key, token);
+        worker.owner = owner;
         worker.status = "running";
         db.run("UPDATE managed_resources SET metadata_json = ?, updated_at = ? WHERE resource_kind = 'scope-control-worker' AND resource_key = ? AND lease_token = ?", [JSON.stringify(worker), context.now(), key, token]);
-        db.exec("COMMIT");
-    }
-    catch (error) {
-        db.exec("ROLLBACK");
-        throw error;
-    }
+        return worker;
+    });
     let heartbeat;
     // A fence must never be held indefinitely by an observer that cannot obtain
     // fresh provider evidence. A later operator request continues the retained

package/dist/services/scope-writer-cleanup.js

@@ -0,0 +1,26 @@
+/** Cleanup is secondary to the arbiter's known commit outcome. Always visit
+ * every connection, including after a failed rollback or close. */
+export function cleanupScopeWriters(targets) {
+    const errors = [];
+    for (const target of targets) {
+        let failed = false;
+        if (target.rollback) {
+            try {
+                target.db.exec("ROLLBACK");
+            }
+            catch (error) {
+                failed = true;
+                errors.push({ target: target.name, phase: "rollback", message: String(error) });
+            }
+        }
+        if (target.close === "always" || failed) {
+            try {
+                target.db.close?.();
+            }
+            catch (error) {
+                errors.push({ target: target.name, phase: "close", message: String(error) });
+            }
+        }
+    }
+    return errors;
+}

package/dist/services/stage-context.js

@@ -3,6 +3,8 @@ import fs from "node:fs";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
 import { prepareFileBytes, prepareJsonText, prepareOutputFile } from "../cli/input-preparation.js";
+/** One precedence rule for coordinator and delegated Work packets. */
+export const acceptedDecisionPrecedence = "Read the accepted RUN decisions before applying older general project rules. An accepted, explicitly scoped user decision supersedes a conflicting general rule only within that scope; preserve the rule elsewhere. Do not ask the user again about a decision already settled in those artifacts or invent a broader exception.";
 export function loadExternalStageContext(input) {
     const { file: sourcePath, bytes } = prepareFileBytes(input.file, "Stage context");
     const materializedSha256 = sha256(bytes);
@@ -81,7 +83,10 @@ export function renderExternalStageContext(input) {
         "</project_context>", "",
         "<accepted_decisions>",
         ...(decisions.length ? decisions.map((item) => `- ${typeof item === "string" ? item : `${item.id ? `${item.id}: ` : ""}${item.statement ?? ""}`}`) : ["- No additional accepted decisions."]),
-        "</accepted_decisions>"
+        "</accepted_decisions>", "",
+        "<source_precedence>",
+        acceptedDecisionPrecedence,
+        "</source_precedence>"
     ].join("\n");
 }
 function validateContext(value, expectedStage) {

package/dist/services/stage-lifecycle.js

@@ -172,7 +172,7 @@ export function startStage(context, input, prepared = prepareLegacyStageStart(co
                 continuation_policy: "go_router",
                 session_kind: "orchestrator",
                 current_stage: input.stage,
-                cwd: attached.run.workspace_root
+                cwd: identity?.cwd ?? null
             })
         });
     }