@deksden-com/dd-flow-cli 0.9.0-beta.104 → 0.9.0-beta.105

package/dist/services/run-controller-process.js

@@ -14,9 +14,9 @@ const processOperation = (context, row) => `controller:${digest({ database: cont
 const birth = () => ({ pid: process.pid, pid_started_at: processStartedAt(process.pid) });
 const dead = (value) => Boolean(value && Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.pid_started_at === "string" && value.pid_started_at && !processIsAlive(value));
 /** Called inside the RUN intent transaction, before the client can disappear. */
-export function recordControllerLauncher(context, row, retired) {
+export function recordControllerLauncher(context, row, retired, identity = birth()) {
     const request = { action: "controller_owner_launch", owner_id: launchId(row) };
-    const receipt = { ...birth(), registration: "controller_self@1", ...(retired ? { retired_process: { id: retired.id, lease_token: retired.lease_token, pid: retired.pid, pid_started_at: retired.pid_started_at } } : {}) };
+    const receipt = { ...identity, registration: "controller_self@1", ...(retired ? { retired_process: { id: retired.id, lease_token: retired.lease_token, pid: retired.pid, pid_started_at: retired.pid_started_at } } : {}) };
     const now = context.now();
     context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, receipt_json, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'completed', ?, ?, ?)", [launchId(row), row.controller_id, row.generation, digest(request), JSON.stringify(request), JSON.stringify(receipt), now, now]);
 }
@@ -92,48 +92,37 @@ function prepareSpawn(context, row) {
         return null;
     if (launch.value.retired_process)
         retire(resourceContext, row, launch.value.retired_process);
-    context.db.beginWriteTransaction();
-    try {
+    const launcher = birth();
+    return context.db.writeTransaction(() => {
         assertLaunchAllowed(context, row);
         const changed = context.db.run(`UPDATE run_controllers SET owner_token = ?, owner_pid = NULL, process_id = NULL, process_lease_token = NULL, status = 'starting', last_error_json = NULL, updated_at = ?
       WHERE controller_id = ? AND owner_token = ? AND owner_pid IS ? AND process_id IS ? AND status = ? AND state_json = ?
         AND (SELECT receipt_json FROM run_controller_operations WHERE operation_id = ?) = ?`, [token, context.now(), row.controller_id, row.owner_token, row.owner_pid, row.process_id, row.status, row.state_json, launchId(row), launch.receipt_json]);
-        if (changed.changes !== 1) {
-            context.db.exec("ROLLBACK");
+        if (changed.changes !== 1)
             return null;
-        }
         const current = requireController(context, row.controller_id);
         if (!ours) {
-            recordControllerLauncher(context, current);
+            recordControllerLauncher(context, current, undefined, launcher);
             appendEvent(context, row.controller_id, "launch_owner_reconciled", { prior_launch: launchId(row), generation: row.generation, prior_process_id: row.process_id });
         }
         context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.spawn_started', json('true')), updated_at = ? WHERE operation_id = ?", [context.now(), launchId(current)]);
-        context.db.exec("COMMIT");
         return current;
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 /** The physical child records its own birth before resource registration. */
 export function claimControllerProcess(context, row) {
     const launch = launchRecord(context, row);
     if (!launch && (!row.process_id || !row.process_lease_token))
         throw new AppError("controller_owner_mismatch", "Managed registration is not authorized", 1);
-    context.db.beginWriteTransaction();
-    try {
+    const owner = birth();
+    context.db.writeTransaction(() => {
         const claimed = context.db.run("UPDATE run_controllers SET owner_pid = ?, status = 'running', updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [process.pid, context.now(), row.controller_id, row.owner_token]);
         if (claimed.changes !== 1)
             throw new AppError("controller_already_owned", "Managed owner has already claimed this launch", 1);
         if (launch)
-            context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.owner', json(?)), updated_at = ? WHERE operation_id = ?", [JSON.stringify(birth()), context.now(), launchId(row)]);
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+            context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.owner', json(?)), updated_at = ? WHERE operation_id = ?", [JSON.stringify(owner), context.now(), launchId(row)]);
+    });
+    row.owner_pid = process.pid;
     if (!row.process_id) {
         const manifest = JSON.parse(row.manifest_json);
         const resourceContext = { ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: manifest.resource_home } };
@@ -173,16 +162,18 @@ export async function spawnController(context, row) {
         return controllerReceipt(requireController(context, controllerId));
     }
     catch (error) {
-        context.db.exec("SAVEPOINT controller_spawn_status");
         try {
-            const changed = context.db.run("UPDATE run_controllers SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [JSON.stringify(errorRecord(error)), context.now(), controllerId, token]);
-            if (changed.changes && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation)
-                setFlowRunRecoveryPaused(context, row.project_id, row.run_id, true);
-            context.db.exec("RELEASE controller_spawn_status");
+            context.db.writeTransaction(() => {
+                const changed = context.db.run("UPDATE run_controllers SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [JSON.stringify(errorRecord(error)), context.now(), controllerId, token]);
+                if (changed.changes && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation)
+                    setFlowRunRecoveryPaused(context, row.project_id, row.run_id, true);
+            });
         }
         catch (failure) {
-            context.db.exec("ROLLBACK TO controller_spawn_status; RELEASE controller_spawn_status");
-            throw failure;
+            const secondary = { status_persistence_error: errorRecord(failure) };
+            if (error instanceof AppError)
+                throw new AppError(error.code, error.message, error.exitCode, { ...error.details, ...secondary });
+            throw new AppError("controller_spawn_failed", error instanceof Error ? error.message : String(error), 1, { cause: errorRecord(error), ...secondary });
         }
         throw error;
     }

package/dist/services/run-controller-recovery.js

@@ -10,7 +10,7 @@ import { verifyRecoverySnapshot } from "./eval-snapshots.js";
 import { recoveryGuard, resumeRunRecovery } from "./run-recovery.js";
 import { prepareRunRecoveryDispatch } from "./run-recovery-runtime.js";
 import { runtimeHarness } from "./execution-policy.js";
-import { managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive } from "./managed-processes.js";
+import { managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, processStartedAt } from "./managed-processes.js";
 import { requireRun, requireController, controllerReceipt, appendEvent, saveState, digest, errorRecord } from "./run-controller-state.js";
 import { controllerAdapter, sessionArguments } from "./run-controller-adapter.js";
 import { spawnController, recordControllerLauncher } from "./run-controller-process.js";
@@ -18,6 +18,7 @@ import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-da
 import { managedInvocationContext } from "./lifecycle-invocations.js";
 import { runControlStatus } from "./run-control.js";
 import { runtimeBudgetStatus, waitForRuntimeScopeRecovery } from "./runtime-budget.js";
+import { prepareControllerPublication } from "./run-controller-capture.js";
 /** CLI observation is bounded; the physical controller owns the recovery work. */
 export async function resumeRunController(context, input) {
     if (input.waitMs !== undefined && (!Number.isSafeInteger(input.waitMs) || input.waitMs < 0 || input.waitMs > 60_000))
@@ -35,6 +36,11 @@ export async function resumeRunController(context, input) {
 }
 /** Retain the logical controller and its receipts; replace only its dead owner. */
 export function recordControllerResume(context, input) {
+    return prepareControllerResume(context, input)();
+}
+/** Verify immutable recovery evidence before a caller reserves the registry
+ * writer. The returned operation rechecks SQL ownership under the RUN CAS. */
+export function prepareControllerResume(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.requestId) || !input.controlId.trim())
         throw new AppError("usage", "Resume requires request-id and the exact source control", 2);
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
@@ -53,7 +59,7 @@ export function recordControllerResume(context, input) {
     };
     const prior = findPrior();
     if (prior)
-        return prior;
+        return () => findPrior() ?? prior;
     try {
         const row = context.db.get("SELECT * FROM run_controllers WHERE project_id = ? AND run_id = ? AND status NOT IN ('completed','cancelled','superseded')", [project.id, run.id]);
         if (!row)
@@ -78,18 +84,20 @@ export function recordControllerResume(context, input) {
         if (!previousOwner || previousOwner.lease_token !== row.process_lease_token || previousOwner.kind !== "run-controller" || previousOwner.owner_id !== row.controller_id || previousOwner.project_id !== project.id || previousOwner.run_id !== run.id || managedProcessRuntimeHome(previousOwner, context) !== context.ddFlowHome || !previousOwner.pid || !previousOwner.pid_started_at || processTreeIsAlive(previousOwner))
             throw new AppError("controller_owner_unsettled", "Resume requires proof that the previous physical controller has exited", 1);
         const token = crypto.randomUUID(), now = context.now();
-        context.db.beginWriteTransaction();
-        try {
+        const launcher = { pid: process.pid, pid_started_at: processStartedAt(process.pid) };
+        return () => context.db.writeTransaction(() => {
             const duplicate = context.db.get("SELECT input_hash, status FROM run_controller_operations WHERE operation_id = ?", [operationId]);
             if (duplicate) {
                 if (duplicate.input_hash !== hash)
                     throw new AppError("runtime_request_conflict", "Resume request id has different inputs", 1);
-                context.db.exec("COMMIT");
                 return { controller: requireController(context, row.controller_id), operationId };
             }
             const current = recoveryGuard(context, project.id, run.id);
             if (current?.recovery_id !== guard.recovery_id || current.generation !== guard.generation || current.status !== "sealed" || current.capture_path !== guard.capture_path)
                 throw new AppError("run_control_superseded", "Control changed before resume could be accepted", 1);
+            const currentOwner = managedProcessStatus(resourceContext).find(record => record.id === previousOwner.id);
+            if (!currentOwner || digest(managedProcessBinding(currentOwner, manifest.resource_home)) !== digest(managedProcessBinding(previousOwner, manifest.resource_home)))
+                throw new AppError("controller_owner_unsettled", "Retired controller binding changed while recovery was prepared", 1);
             if (!["running", "paused", "waiting_for_user"].includes(requireRun(context, project.id, run.id).status))
                 throw new AppError("invalid_run_state", "RUN became terminal before resume could be accepted", 1);
             const changed = context.db.run("UPDATE run_controls SET status = 'resuming', updated_at = ? WHERE control_id = ? AND recovery_id = ? AND status = 'settled'", [now, input.controlId, guard.recovery_id]);
@@ -100,22 +108,17 @@ export function recordControllerResume(context, input) {
             if (claimed.changes !== 1)
                 throw new AppError("controller_owner_mismatch", "Controller changed before resume could claim its next physical owner", 1);
             context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'accepted', ?, ?)", [operationId, row.controller_id, guard.generation, hash, JSON.stringify(request), now, now]);
-            recordControllerLauncher(context, requireController(context, row.controller_id), previousOwner);
+            recordControllerLauncher(context, requireController(context, row.controller_id), previousOwner, launcher);
             appendEvent(context, row.controller_id, "resume_requested", { operation_id: operationId, control_id: input.controlId, recovery_id: guard.recovery_id, generation: guard.generation, retired_process_id: previousOwner.id, retained_session_id: state.sessions[state.current_session].id });
-            context.db.exec("COMMIT");
-        }
-        catch (error) {
-            context.db.exec("ROLLBACK");
-            throw error;
-        }
-        return { controller: requireController(context, row.controller_id), operationId, retiredProcess: previousOwner };
+            return { controller: requireController(context, row.controller_id), operationId, retiredProcess: previousOwner };
+        });
     }
     catch (error) {
         // A concurrent identical client may commit between our first lookup and
         // validation. Its durable request wins even if our preflight saw the fence.
         const concurrent = findPrior();
         if (concurrent)
-            return concurrent;
+            return () => concurrent;
         throw error;
     }
 }
@@ -126,8 +129,9 @@ export async function resumeControllerSession(context, row, manifest, state, ass
         throw new AppError("recovery_owner_missing", "Recovery lost its retained coordinator Session", 1);
     let executionContext = { ...context, env: { ...context.env, DD_FLOW_BIN: manifest.flow_executable, DD_FLOW_RESOURCE_HOME: manifest.resource_home } };
     const scopeControl = manifest.budget ? runtimeBudgetStatus(executionContext, manifest.budget.scope_id).control : null;
-    const assertRecoveryOwner = () => {
-        assertPhysicalOwner();
+    const assertRecoveryOwner = (physical = true) => {
+        if (physical)
+            assertPhysicalOwner();
         const guard = recoveryGuard(context, row.project_id, row.run_id);
         if (guard?.generation !== row.generation || guard.recovery_id !== recovery.recovery_id)
             throw new AppError("run_recovery_generation_stale", "A newer control superseded this recovery owner", 1);
@@ -168,22 +172,21 @@ export async function resumeControllerSession(context, row, manifest, state, ass
         throw new AppError("recovery_session_unsettled", "Retained native Session is not ready for same-Session recovery", 1);
     assertRecoveryOwner();
     const prepared = { prepared: true, recovery_id: recovery.recovery_id, session_id: session.id, daemon_id: daemonId, process_id: dispatch.process_id, resume_operation_id: dispatch.resume_operation_id };
-    context.db.beginWriteTransaction();
-    try {
-        assertRecoveryOwner();
-        const binding = requireManagedDaemonBinding(executionContext, { stateDir: session.state_dir, projectId: row.project_id, runId: row.run_id, ownerId: session.owner.owner_id });
-        if (binding.process.id !== dispatch.process_id || binding.state.daemon_id !== daemonId || binding.process.state !== "running" || !processIsAlive(binding.process))
-            throw new AppError("recovery_runtime_mismatch", "Prepared recovery lost its physical Session owner", 1);
+    const binding = requireManagedDaemonBinding(executionContext, { stateDir: session.state_dir, projectId: row.project_id, runId: row.run_id, ownerId: session.owner.owner_id });
+    if (binding.process.id !== dispatch.process_id || binding.state.daemon_id !== daemonId || binding.process.state !== "running" || !processIsAlive(binding.process))
+        throw new AppError("recovery_runtime_mismatch", "Prepared recovery lost its physical Session owner", 1);
+    const assertPreparedOwner = prepareControllerPublication(executionContext, row, assertPhysicalOwner);
+    context.db.writeTransaction(() => {
+        assertPreparedOwner();
+        assertRecoveryOwner(false);
+        const currentNative = managedProcessStatus(executionContext).find(item => item.id === binding.process.id);
+        if (!currentNative || currentNative.state !== "running" || currentNative.lease_expires_at <= context.now() || digest(managedProcessBinding(currentNative, manifest.resource_home)) !== digest(managedProcessBinding(binding.process, manifest.resource_home)))
+            throw new AppError("recovery_runtime_mismatch", "Prepared recovery lost its current native lease", 1);
         const recorded = context.db.run("UPDATE run_controller_operations SET receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'accepted'", [JSON.stringify(prepared), context.now(), recovery.operation_id, row.controller_id, row.generation]);
         if (recorded.changes !== 1)
             throw new AppError("run_recovery_generation_stale", "Recovery preparation no longer owns its operation", 1);
         appendEvent(context, row.controller_id, "recovery_prepared", prepared);
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
     if (scopeControl && manifest.budget) {
         await waitForRuntimeScopeRecovery(executionContext, { scopeId: manifest.budget.scope_id, generation: scopeControl.generation, controllerId: row.controller_id, operationId: recovery.operation_id }, assertRecoveryOwner);
     }
@@ -195,9 +198,10 @@ export async function resumeControllerSession(context, row, manifest, state, ass
     assertRecoveryOwner();
     if (recoveryGuard(context, row.project_id, row.run_id)?.status !== "recovered")
         throw new AppError("trusted_recovery_acceptance_required", "Recovery Turn ended without its native acknowledgement", 1);
-    context.db.beginWriteTransaction();
-    try {
-        assertRecoveryOwner();
+    const assertAcceptedOwner = prepareControllerPublication(executionContext, row, assertPhysicalOwner);
+    context.db.writeTransaction(() => {
+        assertAcceptedOwner();
+        assertRecoveryOwner(false);
         context.db.run("UPDATE run_controls SET status = 'resumed', updated_at = ? WHERE control_id = ? AND status = 'resuming'", [context.now(), recovery.control_id]);
         context.db.run("UPDATE run_controller_operations SET status = 'completed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND status = 'accepted'", [JSON.stringify({ resumed: true, recovery_id: recovery.recovery_id, session_id: session.id, daemon_id: daemonId }), context.now(), recovery.operation_id]);
         state.last_receipt = receipt;
@@ -205,12 +209,7 @@ export async function resumeControllerSession(context, row, manifest, state, ass
         delete state.recovery;
         saveState(context, row, state);
         appendEvent(context, row.controller_id, "recovery_resumed", { control_id: recovery.control_id, recovery_id: recovery.recovery_id, session_id: session.id, daemon_id: daemonId, generation: row.generation });
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 export function failControllerRecovery(context, row, state, error) {
     if (state.recovery) {

package/dist/services/run-controller.js

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import { quote } from "shell-quote";
 import { ensureRunControllerStorage, getDatabase } from "../storage/database.js";
 import { canonicalPath, resolveProjectRoot } from "../storage/paths.js";
+import { publishImmutableInput } from "../storage/immutable-input.js";
 import { AppError } from "../shared/errors.js";
 import { prepareFileBytes, prepareJsonText } from "../cli/input-preparation.js";
 import { parseRuntimeBudget } from "./runtime-budget.js";
@@ -15,10 +16,10 @@ import { assertRunMutationAllowed, recoveryGuard } from "./run-recovery.js";
 import { getFlowRunStatus, setFlowRunRecoveryPaused } from "./runs.js";
 import { loadExternalStageContext } from "./stage-context.js";
 import { flowCommand } from "./stage-pause.js";
-import { resolveStageTransition, sameSessionProfile, runtimeHarness } from "./execution-policy.js";
+import { resolveStageTransition, sameSessionProfile, stageExecutionCwd, runtimeHarness } from "./execution-policy.js";
 import { resolveHarnessCommand, harnessRuntimeArguments } from "./harness-config.js";
 import { adapterSessionId, prepareHarnessFlowExecutable, runHarnessAdapter } from "./harness-adapter.js";
-import { confirmManagedProcess, heartbeatManagedProcess, finishManagedProcess, processTreeIsAlive, resourceHome } from "./managed-processes.js";
+import { assertManagedProcessLease, confirmManagedProcess, heartbeatManagedProcess, finishManagedProcess, processStartedAt, processTreeIsAlive, resourceHome } from "./managed-processes.js";
 import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 import { initCodexHome } from "./hooks.js";
 import { launchExternalWork } from "./external-work-launch.js";
@@ -98,13 +99,12 @@ export async function launchRunController(context, input, prepared = prepareRunC
     const token = crypto.randomUUID();
     const now = context.now();
     const state = { stage: null, sessions: [], current_session: null, turns: 0, last_continuation: null };
-    context.db.beginWriteTransaction();
-    try {
+    const launcher = { pid: process.pid, pid_started_at: processStartedAt(process.pid) };
+    const duplicate = context.db.writeTransaction(() => {
         const duplicate = context.db.get("SELECT * FROM run_controllers WHERE project_id = ? AND run_id = ? AND request_id = ?", [project.id, run.id, input.requestId]);
         if (duplicate) {
             if (duplicate.request_hash !== requestHash)
                 throw new AppError("runtime_request_conflict", "Managed launch request id has different inputs", 1);
-            context.db.exec("COMMIT");
             return { ...controllerReceipt(duplicate), reused: true };
         }
         assertRunMutationAllowed(context, project.id, run.id, generation);
@@ -116,14 +116,12 @@ export async function launchRunController(context, input, prepared = prepareRunC
         if (context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.status = 'running' LIMIT 1", [project.id, run.id]))
             throw new AppError("controller_attach_required", "A WorkSession acquired the RUN before managed launch", 1);
         context.db.run("INSERT INTO run_controllers (controller_id, project_id, run_id, request_id, request_hash, generation, status, owner_token, manifest_json, state_json, state_dir, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, 'starting', ?, ?, ?, ?, ?, ?)", [controllerId, project.id, run.id, input.requestId, requestHash, generation, token, JSON.stringify(manifest), JSON.stringify(state), root, now, now]);
-        recordControllerLauncher(context, requireController(context, controllerId));
+        recordControllerLauncher(context, requireController(context, controllerId), undefined, launcher);
         appendEvent(context, controllerId, "launch_requested", { request_id: input.requestId, generation, request_hash: requestHash });
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+        return null;
+    });
+    if (duplicate)
+        return duplicate;
     return await spawnController(context, requireController(context, controllerId));
 }
 /**
@@ -136,24 +134,34 @@ export async function launchRunController(context, input, prepared = prepareRunC
 export function controllerLeaseMonitor(heartbeat) {
     let lost = false;
     let unconfirmed = null;
+    let confirmedUntil = 0;
     const lostError = () => new AppError("controller_lease_lost", "Managed owner lease could not be confirmed", 1);
+    const uncertainError = () => new AppError("controller_lease_unconfirmed", "Managed owner lease requires renewal outside the RUN writer", 1);
     return {
         tick() {
             try {
                 if (!heartbeat())
                     lost = true;
-                else
+                else {
                     unconfirmed = null;
+                    confirmedUntil = Date.now() + 14 * 60_000;
+                }
             }
             catch (error) {
                 unconfirmed = error;
             }
         },
-        isConfirmed() { return !lost && unconfirmed === null; },
+        isConfirmed() { return !lost && unconfirmed === null && Date.now() < confirmedUntil; },
+        assertNoRenewal() {
+            if (lost)
+                throw lostError();
+            if (unconfirmed !== null || Date.now() >= confirmedUntil)
+                throw uncertainError();
+        },
         assertConfirmed() {
             if (lost)
                 throw lostError();
-            if (unconfirmed === null)
+            if (unconfirmed === null && Date.now() < confirmedUntil)
                 return;
             try {
                 if (!heartbeat()) {
@@ -161,6 +169,7 @@ export function controllerLeaseMonitor(heartbeat) {
                     throw lostError();
                 }
                 unconfirmed = null;
+                confirmedUntil = Date.now() + 14 * 60_000;
             }
             catch (error) {
                 if (error instanceof AppError)
@@ -194,6 +203,7 @@ export async function serveRunController(context, input) {
         throw new AppError("controller_owner_mismatch", "Managed owner has no resource lease", 1);
     confirmManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
     const lease = controllerLeaseMonitor(() => heartbeatManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token }));
+    lease.assertConfirmed();
     const heartbeat = setInterval(() => {
         try {
             lease.tick();
@@ -209,7 +219,8 @@ export async function serveRunController(context, input) {
     const manifest = JSON.parse(row.manifest_json);
     const state = JSON.parse(row.state_json);
     const assertPhysicalOwner = () => {
-        lease.assertConfirmed();
+        lease.assertNoRenewal();
+        assertManagedProcessLease(context, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid });
         const current = requireController(context, row.controller_id);
         if (current.owner_pid !== process.pid || current.owner_token !== row.owner_token || !["running", "capturing", "waiting_for_user", "waiting_for_context", "waiting_for_children", "waiting_for_capacity", "waiting_for_merge"].includes(current.status))
             throw new AppError("controller_owner_mismatch", "Controller no longer owns productive dispatch", 1);
@@ -220,21 +231,15 @@ export async function serveRunController(context, input) {
         process.stderr.write(`${JSON.stringify({ controller_id: row.controller_id, phase, primary: errorRecord(primaryFailure), secondary: errorRecord(error) })}\n`);
     };
     try {
-        context.db.exec("SAVEPOINT controller_ready_status");
-        try {
+        context.db.writeTransaction(() => {
             markControllerDispatchReady(context, row);
             if (!state.recovery && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation && requireRun(context, row.project_id, row.run_id).status === "paused")
                 setFlowRunRecoveryPaused(context, row.project_id, row.run_id, false);
-            context.db.exec("RELEASE controller_ready_status");
-        }
-        catch (error) {
-            context.db.exec("ROLLBACK TO controller_ready_status; RELEASE controller_ready_status");
-            throw error;
-        }
+        });
         appendEvent(context, row.controller_id, "owner_started", { pid: process.pid, generation: row.generation });
         if (state.recovery)
             await resumeControllerSession(context, row, manifest, state, assertPhysicalOwner);
-        await executeController(context, row, manifest, state, assertOwner, assertPhysicalOwner);
+        await executeController(context, row, manifest, state, assertOwner, assertPhysicalOwner, () => lease.assertConfirmed());
         return controllerReceipt(requireController(context, row.controller_id));
     }
     catch (error) {
@@ -258,25 +263,19 @@ export async function serveRunController(context, input) {
                     return controllerReceipt(requireController(context, row.controller_id));
                 }
             }
-            context.db.exec("SAVEPOINT controller_failure_status");
             try {
-                // A failed capture must not reopen admission when this process exits.
-                const changed = context.db.run("UPDATE run_controllers SET status = CASE WHEN status IN ('capturing','capture_failed') THEN 'capture_failed' ELSE 'recovery_required' END, last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status NOT IN ('completed','cancelled','superseded')", [JSON.stringify(errorRecord(error)), context.now(), row.controller_id, row.owner_token]);
-                context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE project_id = ? AND run_id = ? AND dispatch_owner = ? AND status IN ('dispatching','active')", [JSON.stringify(errorRecord(error)), context.now(), row.project_id, row.run_id, row.controller_id]);
-                if (changed.changes && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation) {
-                    setFlowRunRecoveryPaused(context, row.project_id, row.run_id, true);
-                }
-                appendEvent(context, row.controller_id, "recovery_required", errorRecord(error));
-                context.db.exec("RELEASE controller_failure_status");
+                context.db.writeTransaction(() => {
+                    // A failed capture must not reopen admission when this process exits.
+                    const changed = context.db.run("UPDATE run_controllers SET status = CASE WHEN status IN ('capturing','capture_failed') THEN 'capture_failed' ELSE 'recovery_required' END, last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status NOT IN ('completed','cancelled','superseded')", [JSON.stringify(errorRecord(error)), context.now(), row.controller_id, row.owner_token]);
+                    context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE project_id = ? AND run_id = ? AND dispatch_owner = ? AND status IN ('dispatching','active')", [JSON.stringify(errorRecord(error)), context.now(), row.project_id, row.run_id, row.controller_id]);
+                    if (changed.changes && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation) {
+                        setFlowRunRecoveryPaused(context, row.project_id, row.run_id, true);
+                    }
+                    appendEvent(context, row.controller_id, "recovery_required", errorRecord(error));
+                });
             }
             catch (failure) {
                 retainSecondary("persist_controller_failure", failure);
-                try {
-                    context.db.exec("ROLLBACK TO controller_failure_status; RELEASE controller_failure_status");
-                }
-                catch (rollback) {
-                    retainSecondary("rollback_controller_failure", rollback);
-                }
             }
         }
         catch (secondary) {
@@ -321,7 +320,9 @@ export function prepareRunControllerAnswer(context, input) {
     const operationId = `${row.controller_id}:answer:${input.requestId}`;
     const answerHash = digestBytes(bytes);
     const hash = digest({ pause_id: input.pauseId, answer_sha256: answerHash });
-    prepareControllerAnswerAcceptance(context, input, project.id, row, operationId, hash);
+    const previous = prepareControllerAnswerAcceptance(context, input, project.id, row, operationId, hash);
+    if (previous.prior)
+        return { kind: "replay", operationId, status: previous.prior.status };
     return { kind: "create", project, row, bytes, operationId, answerHash, hash };
 }
 function prepareControllerAnswerAcceptance(context, input, projectId, row, operationId, hash) {
@@ -350,37 +351,26 @@ export function answerRunController(context, input, prepared = prepareRunControl
     if (prepared.kind === "replay")
         return { ok: true, operation_id: prepared.operationId, status: prepared.status, reused: true };
     const { project, row, bytes, operationId, answerHash, hash } = prepared;
-    context.db.beginWriteTransaction();
-    try {
+    const previous = prepareControllerAnswerAcceptance(context, input, project.id, row, operationId, hash);
+    if (previous.prior)
+        return { ok: true, operation_id: operationId, status: previous.prior.status, reused: true };
+    const file = path.join(row.state_dir, `answer-${digest(operationId)}-${answerHash}.md`);
+    publishImmutableInput(file, bytes, "runtime_request_conflict");
+    return context.db.writeTransaction(() => {
         // Recheck only mutable acceptance state under the write transaction; bytes are already prepared.
         const acceptance = prepareControllerAnswerAcceptance(context, input, project.id, row, operationId, hash);
         if (acceptance.prior) {
-            context.db.exec("COMMIT");
             return { ok: true, operation_id: operationId, status: acceptance.prior.status, reused: true };
         }
         const { run, stage, workId } = acceptance;
-        const file = path.join(row.state_dir, `answer-${digest(operationId)}.md`);
-        try {
-            fs.writeFileSync(file, bytes, { flag: "wx", mode: 0o600 });
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            // A crash before COMMIT may leave the immutable answer file behind.
-            if (!fs.readFileSync(file).equals(bytes))
-                throw new AppError("runtime_request_conflict", "Persisted answer bytes differ from this retry", 1);
-        }
+        if (requireController(context, row.controller_id).state_dir !== row.state_dir)
+            throw new AppError("controller_owner_mismatch", "Controller input directory changed before acceptance", 1);
         const now = context.now();
         const generation = recoveryGuard(context, project.id, run.id)?.generation ?? row.generation;
         context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'accepted', ?, ?)", [operationId, row.controller_id, generation, hash, JSON.stringify({ action: "user_answer", pause_id: input.pauseId, stage: stage.stage, work_id: workId, file, sha256: answerHash }), now, now]);
         appendEvent(context, row.controller_id, "answer_accepted", { operation_id: operationId, pause_id: input.pauseId, answer_sha256: answerHash });
-        context.db.exec("COMMIT");
         return { ok: true, operation_id: operationId, status: "accepted" };
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 export function prepareRunControllerContext(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.requestId) || !/^[a-z][a-z-]*$/.test(input.stage) || !/^[a-f0-9]{64}$/.test(input.contextSha256))
@@ -405,8 +395,19 @@ export function supplyRunControllerContext(context, input, prepared = prepareRun
     if (prepared.kind === "replay")
         return { ok: true, operation_id: prepared.operationId, status: prepared.status, reused: true };
     const { project, operationId, hash, bytes } = prepared;
-    context.db.beginWriteTransaction();
-    try {
+    const preparedOwner = requireController(context, input.controllerId);
+    if (preparedOwner.project_id !== project.id || preparedOwner.run_id !== input.runId)
+        throw new AppError("controller_owner_mismatch", "Context submission belongs to another RUN", 1);
+    const existing = context.db.get("SELECT input_hash, status FROM run_controller_operations WHERE operation_id = ?", [operationId]);
+    if (existing) {
+        if (existing.input_hash !== hash)
+            throw new AppError("runtime_request_conflict", "Context request id has different inputs", 1);
+        return { ok: true, operation_id: operationId, status: existing.status, reused: true };
+    }
+    availableControllerContext(context, input, preparedOwner);
+    const file = path.join(preparedOwner.state_dir, `${input.stage}-${input.contextSha256}.context.json`);
+    publishImmutableInput(file, bytes, "stage_context_replacement");
+    return context.db.writeTransaction(() => {
         const row = requireController(context, input.controllerId);
         if (row.project_id !== project.id || row.run_id !== input.runId)
             throw new AppError("controller_owner_mismatch", "Context submission belongs to another RUN", 1);
@@ -414,32 +415,18 @@ export function supplyRunControllerContext(context, input, prepared = prepareRun
         if (prior) {
             if (prior.input_hash !== hash)
                 throw new AppError("runtime_request_conflict", "Context request id has different inputs", 1);
-            context.db.exec("COMMIT");
             return { ok: true, operation_id: operationId, status: prior.status, reused: true };
         }
         const manifest = availableControllerContext(context, input, row);
-        const file = path.join(row.state_dir, `${input.stage}.context.json`);
-        try {
-            fs.writeFileSync(file, bytes, { flag: "wx", mode: 0o600 });
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            if (!fs.readFileSync(file).equals(bytes))
-                throw new AppError("stage_context_replacement", "Unpublished context bytes differ from this request", 1);
-        }
+        if (row.state_dir !== preparedOwner.state_dir)
+            throw new AppError("controller_owner_mismatch", "Controller input directory changed before acceptance", 1);
         manifest.contexts[input.stage] = { file, sha256: input.contextSha256 };
         const now = context.now();
         context.db.run("UPDATE run_controllers SET manifest_json = ?, updated_at = ? WHERE controller_id = ?", [JSON.stringify(manifest), now, row.controller_id]);
         context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'accepted', ?, ?)", [operationId, row.controller_id, row.generation, hash, JSON.stringify({ action: "stage_context", stage: input.stage, file, sha256: input.contextSha256 }), now, now]);
         appendEvent(context, row.controller_id, "context_accepted", { operation_id: operationId, stage: input.stage, context_sha256: input.contextSha256 });
-        context.db.exec("COMMIT");
         return { ok: true, operation_id: operationId, status: "accepted" };
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 function availableControllerContext(context, input, row) {
     assertRunMutationAllowed(context, row.project_id, input.runId, row.generation);
@@ -450,7 +437,7 @@ function availableControllerContext(context, input, row) {
         throw new AppError("stage_context_replacement", "Controller already has an immutable context for this stage", 1);
     return manifest;
 }
-async function executeController(context, row, manifest, state, assertOwnership, assertPhysicalOwner) {
+async function executeController(context, row, manifest, state, assertOwnership, assertPhysicalOwner, renewLease) {
     assertOwnership();
     const observer = { ...context, db: getDatabase(context.ddFlowHome, "read_existing") };
     const checkOutcomes = () => assertLifecycleOutcomes(observer, { projectRoot: manifest.request.project_root, runId: row.run_id, generation: row.generation });
@@ -578,6 +565,9 @@ async function executeController(context, row, manifest, state, assertOwnership,
     monitor.unref();
     try {
         for (;;) {
+            // Renewal touches the resource registry; never do it from a callback that
+            // may already own the RUN writer.
+            renewLease();
             assertOwner();
             if (state.current_session !== null && !state.sessions[state.current_session].stopped)
                 bindInvocationScope(state.sessions[state.current_session]);
@@ -650,7 +640,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 loadExternalStageContext({ file: stageContext.file, expectedSha256: stageContext.sha256, stage: next.stage });
                 const continuation = JSON.stringify(["start_stage", next.stage, next.attempt ?? null]);
                 retainControllerContinuation(state, continuation, { code: "stage_entry_nonprogressing", message: "The coordinator returned without starting the assigned Stage", details: { stage: next.stage, attempt: next.attempt ?? null, last_receipt: state.last_receipt ?? null } });
-                const transition = resolveStageTransition({ ddFlowHome: context.ddFlowHome, policy, profiles, ...(state.stage ? { fromStage: state.stage } : {}), stage: next.stage, stageSessionMode: manifest.execution_profile.settings.stage_session_mode, mergeMode: manifest.execution_profile.settings.merge_mode });
+                const transition = resolveStageTransition({ ddFlowHome: context.ddFlowHome, policy, profiles, ...(state.stage ? { fromStage: state.stage } : {}), stage: next.stage, projectRoot: run.project_root, workspaceRoot: run.workspace_root, stageSessionMode: manifest.execution_profile.settings.stage_session_mode, mergeMode: manifest.execution_profile.settings.merge_mode });
                 if (next.stage === "merge" && manifest.execution_profile.settings.merge_mode === "server" && !state.merge_claim) {
                     const request = context.db.get("SELECT merge_request_id, status FROM merge_requests WHERE project_id = ? AND run_id = ? ORDER BY created_at DESC, merge_request_id DESC LIMIT 1", [row.project_id, row.run_id]);
                     if (!request || request.status !== "queued")
@@ -665,8 +655,12 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     saveState(context, row, state);
                     appendEvent(context, row.controller_id, "merge_claimed", { request_id: claim.request.merge_request_id });
                 }
+                const stageCwd = stageExecutionCwd({ stage: next.stage, projectRoot: run.project_root, workspaceRoot: run.workspace_root, ...(state.merge_claim ? { mergeTargetWorkspace: state.merge_claim.target_workspace } : {}) });
                 let session = state.current_session === null ? null : state.sessions[state.current_session];
-                if (!session || transition.session_mode === "new_session" || !sameSessionProfile(session.profile, transition.coordinator)) {
+                if (session && next.stage === "merge" && manifest.execution_profile.settings.merge_mode === "same_session" && path.resolve(session.cwd) !== stageCwd) {
+                    throw new AppError("merge_session_workspace_conflict", "Same-session MERGE cannot change the native Session working directory", 1, { session_cwd: session.cwd, target_cwd: stageCwd });
+                }
+                if (!session || transition.session_mode === "new_session" || !sameSessionProfile(session.profile, transition.coordinator) || path.resolve(session.cwd) !== stageCwd) {
                     if (session)
                         await stopSession(session);
                     assertOwner();
@@ -677,7 +671,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                         owner.role = "merge";
                         owner.work_id = state.merge_claim.work_id;
                     }
-                    session = { id: "", profile: transition.coordinator, state_dir: directory, cwd: next.stage === "merge" && state.merge_claim ? state.merge_claim.target_workspace : run.workspace_root, journal: path.join(directory, "adapter.events.jsonl"), owner };
+                    session = { id: "", profile: transition.coordinator, state_dir: directory, cwd: stageCwd, journal: path.join(directory, "adapter.events.jsonl"), owner };
                     if (runtimeHarness(session.profile) === "codex-desktop") {
                         session.codex_home = path.join(directory, "codex-home");
                         initCodexHome(context, { projectRoot: run.project_root, profile: `controller-${digest(directory).slice(0, 16)}`, targetHome: session.codex_home, ...(context.env.CODEX_HOME ? { sourceHome: context.env.CODEX_HOME } : {}) });
@@ -722,9 +716,10 @@ async function executeController(context, row, manifest, state, assertOwnership,
             const fanout = await nextControllerFanout(executionContext, { projectRoot: run.project_root, runId: run.id, stage: next.stage, harness: runtimeHarness(session.profile), sessionId: session.id, children, policy, profiles });
             assertOwner();
             if (fanout.kind === "none") {
-                const cause = currentLifecycleFailure(executionContext, { runId: run.id, generation: row.generation, stage: next.stage });
+                assertNoCorrelatedRejection(context, { projectId: row.project_id, runId: row.run_id, generation: row.generation, stage: next.stage, turn: state.turns });
+                const cause = currentLifecycleFailure(executionContext, { runId: run.id, generation: row.generation, stage: next.stage, turn: state.turns, projectId: row.project_id, projectRoot: run.project_root });
                 if (cause)
-                    throw new AppError(cause.code, cause.message, 1, { ...cause.details, invocation_id: cause.invocation_id, controller_wrapper: "incomplete_subject_turn", stage: next.stage });
+                    throw new AppError(cause.code, cause.message, 1, { ...cause.details, ...(cause.invocation_id ? { invocation_id: cause.invocation_id } : {}), ...(cause.hook_event_id ? { hook_event_id: cause.hook_event_id } : {}), controller_wrapper: "incomplete_subject_turn", stage: next.stage });
                 throw new AppError("incomplete_subject_turn", "Managed Turn ended without a completed Stage or declared continuation", 1, { stage: next.stage });
             }
             if (fanout.kind === "wait") {