@deksden-com/dd-flow-cli 0.9.0-beta.104 → 0.9.0-beta.106

package/dist/services/run-controller.js

@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 import { quote } from "shell-quote";
 import { ensureRunControllerStorage, getDatabase } from "../storage/database.js";
 import { canonicalPath, resolveProjectRoot } from "../storage/paths.js";
+import { publishImmutableInput } from "../storage/immutable-input.js";
 import { AppError } from "../shared/errors.js";
 import { prepareFileBytes, prepareJsonText } from "../cli/input-preparation.js";
 import { parseRuntimeBudget } from "./runtime-budget.js";
@@ -15,14 +16,14 @@ import { assertRunMutationAllowed, recoveryGuard } from "./run-recovery.js";
 import { getFlowRunStatus, setFlowRunRecoveryPaused } from "./runs.js";
 import { loadExternalStageContext } from "./stage-context.js";
 import { flowCommand } from "./stage-pause.js";
-import { resolveStageTransition, sameSessionProfile, runtimeHarness } from "./execution-policy.js";
+import { resolveStageTransition, sameSessionProfile, stageExecutionCwd, runtimeHarness } from "./execution-policy.js";
 import { resolveHarnessCommand, harnessRuntimeArguments } from "./harness-config.js";
 import { adapterSessionId, prepareHarnessFlowExecutable, runHarnessAdapter } from "./harness-adapter.js";
-import { confirmManagedProcess, heartbeatManagedProcess, finishManagedProcess, processTreeIsAlive, resourceHome } from "./managed-processes.js";
+import { assertManagedProcessLease, confirmManagedProcess, heartbeatManagedProcess, finishManagedProcess, processStartedAt, processTreeIsAlive, resourceHome } from "./managed-processes.js";
 import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 import { initCodexHome } from "./hooks.js";
 import { launchExternalWork } from "./external-work-launch.js";
-import { controllerNativeChildren, controllerStageEntryPrompt, nextControllerFanout } from "./controller-fanout.js";
+import { controllerNativeChildren, controllerStageEntryPrompt, controllerStageResumePrompt, nextControllerFanout } from "./controller-fanout.js";
 import { claimQueuedMergeRequest } from "./merge-server.js";
 import { prepareVnextCodeWorkspace } from "./vnext-code.js";
 import { requireRun, requireController, controllerReceipt, appendEvent, saveState, retainControllerContinuation, digest, digestBytes, errorRecord } from "./run-controller-state.js";
@@ -98,13 +99,12 @@ export async function launchRunController(context, input, prepared = prepareRunC
     const token = crypto.randomUUID();
     const now = context.now();
     const state = { stage: null, sessions: [], current_session: null, turns: 0, last_continuation: null };
-    context.db.beginWriteTransaction();
-    try {
+    const launcher = { pid: process.pid, pid_started_at: processStartedAt(process.pid) };
+    const duplicate = context.db.writeTransaction(() => {
         const duplicate = context.db.get("SELECT * FROM run_controllers WHERE project_id = ? AND run_id = ? AND request_id = ?", [project.id, run.id, input.requestId]);
         if (duplicate) {
             if (duplicate.request_hash !== requestHash)
                 throw new AppError("runtime_request_conflict", "Managed launch request id has different inputs", 1);
-            context.db.exec("COMMIT");
             return { ...controllerReceipt(duplicate), reused: true };
         }
         assertRunMutationAllowed(context, project.id, run.id, generation);
@@ -116,14 +116,12 @@ export async function launchRunController(context, input, prepared = prepareRunC
         if (context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.status = 'running' LIMIT 1", [project.id, run.id]))
             throw new AppError("controller_attach_required", "A WorkSession acquired the RUN before managed launch", 1);
         context.db.run("INSERT INTO run_controllers (controller_id, project_id, run_id, request_id, request_hash, generation, status, owner_token, manifest_json, state_json, state_dir, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, 'starting', ?, ?, ?, ?, ?, ?)", [controllerId, project.id, run.id, input.requestId, requestHash, generation, token, JSON.stringify(manifest), JSON.stringify(state), root, now, now]);
-        recordControllerLauncher(context, requireController(context, controllerId));
+        recordControllerLauncher(context, requireController(context, controllerId), undefined, launcher);
         appendEvent(context, controllerId, "launch_requested", { request_id: input.requestId, generation, request_hash: requestHash });
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+        return null;
+    });
+    if (duplicate)
+        return duplicate;
     return await spawnController(context, requireController(context, controllerId));
 }
 /**
@@ -136,24 +134,34 @@ export async function launchRunController(context, input, prepared = prepareRunC
 export function controllerLeaseMonitor(heartbeat) {
     let lost = false;
     let unconfirmed = null;
+    let confirmedUntil = 0;
     const lostError = () => new AppError("controller_lease_lost", "Managed owner lease could not be confirmed", 1);
+    const uncertainError = () => new AppError("controller_lease_unconfirmed", "Managed owner lease requires renewal outside the RUN writer", 1);
     return {
         tick() {
             try {
                 if (!heartbeat())
                     lost = true;
-                else
+                else {
                     unconfirmed = null;
+                    confirmedUntil = Date.now() + 14 * 60_000;
+                }
             }
             catch (error) {
                 unconfirmed = error;
             }
         },
-        isConfirmed() { return !lost && unconfirmed === null; },
+        isConfirmed() { return !lost && unconfirmed === null && Date.now() < confirmedUntil; },
+        assertNoRenewal() {
+            if (lost)
+                throw lostError();
+            if (unconfirmed !== null || Date.now() >= confirmedUntil)
+                throw uncertainError();
+        },
         assertConfirmed() {
             if (lost)
                 throw lostError();
-            if (unconfirmed === null)
+            if (unconfirmed === null && Date.now() < confirmedUntil)
                 return;
             try {
                 if (!heartbeat()) {
@@ -161,6 +169,7 @@ export function controllerLeaseMonitor(heartbeat) {
                     throw lostError();
                 }
                 unconfirmed = null;
+                confirmedUntil = Date.now() + 14 * 60_000;
             }
             catch (error) {
                 if (error instanceof AppError)
@@ -194,6 +203,7 @@ export async function serveRunController(context, input) {
         throw new AppError("controller_owner_mismatch", "Managed owner has no resource lease", 1);
     confirmManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
     const lease = controllerLeaseMonitor(() => heartbeatManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token }));
+    lease.assertConfirmed();
     const heartbeat = setInterval(() => {
         try {
             lease.tick();
@@ -209,7 +219,8 @@ export async function serveRunController(context, input) {
     const manifest = JSON.parse(row.manifest_json);
     const state = JSON.parse(row.state_json);
     const assertPhysicalOwner = () => {
-        lease.assertConfirmed();
+        lease.assertNoRenewal();
+        assertManagedProcessLease(context, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid });
         const current = requireController(context, row.controller_id);
         if (current.owner_pid !== process.pid || current.owner_token !== row.owner_token || !["running", "capturing", "waiting_for_user", "waiting_for_context", "waiting_for_children", "waiting_for_capacity", "waiting_for_merge"].includes(current.status))
             throw new AppError("controller_owner_mismatch", "Controller no longer owns productive dispatch", 1);
@@ -220,21 +231,15 @@ export async function serveRunController(context, input) {
         process.stderr.write(`${JSON.stringify({ controller_id: row.controller_id, phase, primary: errorRecord(primaryFailure), secondary: errorRecord(error) })}\n`);
     };
     try {
-        context.db.exec("SAVEPOINT controller_ready_status");
-        try {
+        context.db.writeTransaction(() => {
             markControllerDispatchReady(context, row);
             if (!state.recovery && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation && requireRun(context, row.project_id, row.run_id).status === "paused")
                 setFlowRunRecoveryPaused(context, row.project_id, row.run_id, false);
-            context.db.exec("RELEASE controller_ready_status");
-        }
-        catch (error) {
-            context.db.exec("ROLLBACK TO controller_ready_status; RELEASE controller_ready_status");
-            throw error;
-        }
+        });
         appendEvent(context, row.controller_id, "owner_started", { pid: process.pid, generation: row.generation });
         if (state.recovery)
             await resumeControllerSession(context, row, manifest, state, assertPhysicalOwner);
-        await executeController(context, row, manifest, state, assertOwner, assertPhysicalOwner);
+        await executeController(context, row, manifest, state, assertOwner, assertPhysicalOwner, () => lease.assertConfirmed());
         return controllerReceipt(requireController(context, row.controller_id));
     }
     catch (error) {
@@ -258,25 +263,19 @@ export async function serveRunController(context, input) {
                     return controllerReceipt(requireController(context, row.controller_id));
                 }
             }
-            context.db.exec("SAVEPOINT controller_failure_status");
             try {
-                // A failed capture must not reopen admission when this process exits.
-                const changed = context.db.run("UPDATE run_controllers SET status = CASE WHEN status IN ('capturing','capture_failed') THEN 'capture_failed' ELSE 'recovery_required' END, last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status NOT IN ('completed','cancelled','superseded')", [JSON.stringify(errorRecord(error)), context.now(), row.controller_id, row.owner_token]);
-                context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE project_id = ? AND run_id = ? AND dispatch_owner = ? AND status IN ('dispatching','active')", [JSON.stringify(errorRecord(error)), context.now(), row.project_id, row.run_id, row.controller_id]);
-                if (changed.changes && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation) {
-                    setFlowRunRecoveryPaused(context, row.project_id, row.run_id, true);
-                }
-                appendEvent(context, row.controller_id, "recovery_required", errorRecord(error));
-                context.db.exec("RELEASE controller_failure_status");
+                context.db.writeTransaction(() => {
+                    // A failed capture must not reopen admission when this process exits.
+                    const changed = context.db.run("UPDATE run_controllers SET status = CASE WHEN status IN ('capturing','capture_failed') THEN 'capture_failed' ELSE 'recovery_required' END, last_error_json = ?, updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status NOT IN ('completed','cancelled','superseded')", [JSON.stringify(errorRecord(error)), context.now(), row.controller_id, row.owner_token]);
+                    context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE project_id = ? AND run_id = ? AND dispatch_owner = ? AND status IN ('dispatching','active')", [JSON.stringify(errorRecord(error)), context.now(), row.project_id, row.run_id, row.controller_id]);
+                    if (changed.changes && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation) {
+                        setFlowRunRecoveryPaused(context, row.project_id, row.run_id, true);
+                    }
+                    appendEvent(context, row.controller_id, "recovery_required", errorRecord(error));
+                });
             }
             catch (failure) {
                 retainSecondary("persist_controller_failure", failure);
-                try {
-                    context.db.exec("ROLLBACK TO controller_failure_status; RELEASE controller_failure_status");
-                }
-                catch (rollback) {
-                    retainSecondary("rollback_controller_failure", rollback);
-                }
             }
         }
         catch (secondary) {
@@ -321,7 +320,9 @@ export function prepareRunControllerAnswer(context, input) {
     const operationId = `${row.controller_id}:answer:${input.requestId}`;
     const answerHash = digestBytes(bytes);
     const hash = digest({ pause_id: input.pauseId, answer_sha256: answerHash });
-    prepareControllerAnswerAcceptance(context, input, project.id, row, operationId, hash);
+    const previous = prepareControllerAnswerAcceptance(context, input, project.id, row, operationId, hash);
+    if (previous.prior)
+        return { kind: "replay", operationId, status: previous.prior.status };
     return { kind: "create", project, row, bytes, operationId, answerHash, hash };
 }
 function prepareControllerAnswerAcceptance(context, input, projectId, row, operationId, hash) {
@@ -350,37 +351,26 @@ export function answerRunController(context, input, prepared = prepareRunControl
     if (prepared.kind === "replay")
         return { ok: true, operation_id: prepared.operationId, status: prepared.status, reused: true };
     const { project, row, bytes, operationId, answerHash, hash } = prepared;
-    context.db.beginWriteTransaction();
-    try {
+    const previous = prepareControllerAnswerAcceptance(context, input, project.id, row, operationId, hash);
+    if (previous.prior)
+        return { ok: true, operation_id: operationId, status: previous.prior.status, reused: true };
+    const file = path.join(row.state_dir, `answer-${digest(operationId)}-${answerHash}.md`);
+    publishImmutableInput(file, bytes, "runtime_request_conflict");
+    return context.db.writeTransaction(() => {
         // Recheck only mutable acceptance state under the write transaction; bytes are already prepared.
         const acceptance = prepareControllerAnswerAcceptance(context, input, project.id, row, operationId, hash);
         if (acceptance.prior) {
-            context.db.exec("COMMIT");
             return { ok: true, operation_id: operationId, status: acceptance.prior.status, reused: true };
         }
         const { run, stage, workId } = acceptance;
-        const file = path.join(row.state_dir, `answer-${digest(operationId)}.md`);
-        try {
-            fs.writeFileSync(file, bytes, { flag: "wx", mode: 0o600 });
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            // A crash before COMMIT may leave the immutable answer file behind.
-            if (!fs.readFileSync(file).equals(bytes))
-                throw new AppError("runtime_request_conflict", "Persisted answer bytes differ from this retry", 1);
-        }
+        if (requireController(context, row.controller_id).state_dir !== row.state_dir)
+            throw new AppError("controller_owner_mismatch", "Controller input directory changed before acceptance", 1);
         const now = context.now();
         const generation = recoveryGuard(context, project.id, run.id)?.generation ?? row.generation;
         context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'accepted', ?, ?)", [operationId, row.controller_id, generation, hash, JSON.stringify({ action: "user_answer", pause_id: input.pauseId, stage: stage.stage, work_id: workId, file, sha256: answerHash }), now, now]);
         appendEvent(context, row.controller_id, "answer_accepted", { operation_id: operationId, pause_id: input.pauseId, answer_sha256: answerHash });
-        context.db.exec("COMMIT");
         return { ok: true, operation_id: operationId, status: "accepted" };
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 export function prepareRunControllerContext(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.requestId) || !/^[a-z][a-z-]*$/.test(input.stage) || !/^[a-f0-9]{64}$/.test(input.contextSha256))
@@ -405,8 +395,19 @@ export function supplyRunControllerContext(context, input, prepared = prepareRun
     if (prepared.kind === "replay")
         return { ok: true, operation_id: prepared.operationId, status: prepared.status, reused: true };
     const { project, operationId, hash, bytes } = prepared;
-    context.db.beginWriteTransaction();
-    try {
+    const preparedOwner = requireController(context, input.controllerId);
+    if (preparedOwner.project_id !== project.id || preparedOwner.run_id !== input.runId)
+        throw new AppError("controller_owner_mismatch", "Context submission belongs to another RUN", 1);
+    const existing = context.db.get("SELECT input_hash, status FROM run_controller_operations WHERE operation_id = ?", [operationId]);
+    if (existing) {
+        if (existing.input_hash !== hash)
+            throw new AppError("runtime_request_conflict", "Context request id has different inputs", 1);
+        return { ok: true, operation_id: operationId, status: existing.status, reused: true };
+    }
+    availableControllerContext(context, input, preparedOwner);
+    const file = path.join(preparedOwner.state_dir, `${input.stage}-${input.contextSha256}.context.json`);
+    publishImmutableInput(file, bytes, "stage_context_replacement");
+    return context.db.writeTransaction(() => {
         const row = requireController(context, input.controllerId);
         if (row.project_id !== project.id || row.run_id !== input.runId)
             throw new AppError("controller_owner_mismatch", "Context submission belongs to another RUN", 1);
@@ -414,32 +415,18 @@ export function supplyRunControllerContext(context, input, prepared = prepareRun
         if (prior) {
             if (prior.input_hash !== hash)
                 throw new AppError("runtime_request_conflict", "Context request id has different inputs", 1);
-            context.db.exec("COMMIT");
             return { ok: true, operation_id: operationId, status: prior.status, reused: true };
         }
         const manifest = availableControllerContext(context, input, row);
-        const file = path.join(row.state_dir, `${input.stage}.context.json`);
-        try {
-            fs.writeFileSync(file, bytes, { flag: "wx", mode: 0o600 });
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            if (!fs.readFileSync(file).equals(bytes))
-                throw new AppError("stage_context_replacement", "Unpublished context bytes differ from this request", 1);
-        }
+        if (row.state_dir !== preparedOwner.state_dir)
+            throw new AppError("controller_owner_mismatch", "Controller input directory changed before acceptance", 1);
         manifest.contexts[input.stage] = { file, sha256: input.contextSha256 };
         const now = context.now();
         context.db.run("UPDATE run_controllers SET manifest_json = ?, updated_at = ? WHERE controller_id = ?", [JSON.stringify(manifest), now, row.controller_id]);
         context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'accepted', ?, ?)", [operationId, row.controller_id, row.generation, hash, JSON.stringify({ action: "stage_context", stage: input.stage, file, sha256: input.contextSha256 }), now, now]);
         appendEvent(context, row.controller_id, "context_accepted", { operation_id: operationId, stage: input.stage, context_sha256: input.contextSha256 });
-        context.db.exec("COMMIT");
         return { ok: true, operation_id: operationId, status: "accepted" };
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
 }
 function availableControllerContext(context, input, row) {
     assertRunMutationAllowed(context, row.project_id, input.runId, row.generation);
@@ -450,7 +437,7 @@ function availableControllerContext(context, input, row) {
         throw new AppError("stage_context_replacement", "Controller already has an immutable context for this stage", 1);
     return manifest;
 }
-async function executeController(context, row, manifest, state, assertOwnership, assertPhysicalOwner) {
+async function executeController(context, row, manifest, state, assertOwnership, assertPhysicalOwner, renewLease) {
     assertOwnership();
     const observer = { ...context, db: getDatabase(context.ddFlowHome, "read_existing") };
     const checkOutcomes = () => assertLifecycleOutcomes(observer, { projectRoot: manifest.request.project_root, runId: row.run_id, generation: row.generation });
@@ -578,6 +565,9 @@ async function executeController(context, row, manifest, state, assertOwnership,
     monitor.unref();
     try {
         for (;;) {
+            // Renewal touches the resource registry; never do it from a callback that
+            // may already own the RUN writer.
+            renewLease();
             assertOwner();
             if (state.current_session !== null && !state.sessions[state.current_session].stopped)
                 bindInvocationScope(state.sessions[state.current_session]);
@@ -623,7 +613,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 // The accepted answer is logical intent; only its generation-bound
                 // adapter operation represents a physical dispatch that stop must drain.
                 const command = managedLifecycleCommand(executionContext, `${flowCommand(executionContext)} stage resume ${run.id} --stage ${next.stage} --work ${input.work_id} --project-root ${quote([run.project_root])} --answer-file ${quote([input.file])} --json`, { replaceUnobservedAnswer: true });
-                const receipt = await prompt(state.sessions[state.current_session], `The user supplied the raw answer for pause ${pause.id}. Your first tool call must be this exact standalone command:\n\n${command}\n\nDo not alter the answer. Follow the returned packet, then stop at this Stage boundary.`, `${answer.operation_id}:prompt:${row.generation}`);
+                const receipt = await prompt(state.sessions[state.current_session], controllerStageResumePrompt(pause.id, command), `${answer.operation_id}:prompt:${row.generation}`);
                 const afterAnswer = getFlowRunStatus(executionContext, { projectRoot: run.project_root, runId: run.id });
                 if (afterAnswer.index.stage_runs.some(stage => stage.status === "paused" && stage.pause?.id === pause.id)) {
                     throw new AppError("controller_answer_not_applied", "The answer Turn completed without resuming the assigned HITL pause", 1, { pause_id: pause.id, operation_id: answer.operation_id, stage: next.stage, effect: "no_progress" });
@@ -650,7 +640,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 loadExternalStageContext({ file: stageContext.file, expectedSha256: stageContext.sha256, stage: next.stage });
                 const continuation = JSON.stringify(["start_stage", next.stage, next.attempt ?? null]);
                 retainControllerContinuation(state, continuation, { code: "stage_entry_nonprogressing", message: "The coordinator returned without starting the assigned Stage", details: { stage: next.stage, attempt: next.attempt ?? null, last_receipt: state.last_receipt ?? null } });
-                const transition = resolveStageTransition({ ddFlowHome: context.ddFlowHome, policy, profiles, ...(state.stage ? { fromStage: state.stage } : {}), stage: next.stage, stageSessionMode: manifest.execution_profile.settings.stage_session_mode, mergeMode: manifest.execution_profile.settings.merge_mode });
+                const transition = resolveStageTransition({ ddFlowHome: context.ddFlowHome, policy, profiles, ...(state.stage ? { fromStage: state.stage } : {}), stage: next.stage, projectRoot: run.project_root, workspaceRoot: run.workspace_root, stageSessionMode: manifest.execution_profile.settings.stage_session_mode, mergeMode: manifest.execution_profile.settings.merge_mode });
                 if (next.stage === "merge" && manifest.execution_profile.settings.merge_mode === "server" && !state.merge_claim) {
                     const request = context.db.get("SELECT merge_request_id, status FROM merge_requests WHERE project_id = ? AND run_id = ? ORDER BY created_at DESC, merge_request_id DESC LIMIT 1", [row.project_id, row.run_id]);
                     if (!request || request.status !== "queued")
@@ -665,8 +655,12 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     saveState(context, row, state);
                     appendEvent(context, row.controller_id, "merge_claimed", { request_id: claim.request.merge_request_id });
                 }
+                const stageCwd = stageExecutionCwd({ stage: next.stage, projectRoot: run.project_root, workspaceRoot: run.workspace_root, ...(state.merge_claim ? { mergeTargetWorkspace: state.merge_claim.target_workspace } : {}) });
                 let session = state.current_session === null ? null : state.sessions[state.current_session];
-                if (!session || transition.session_mode === "new_session" || !sameSessionProfile(session.profile, transition.coordinator)) {
+                if (session && next.stage === "merge" && manifest.execution_profile.settings.merge_mode === "same_session" && path.resolve(session.cwd) !== stageCwd) {
+                    throw new AppError("merge_session_workspace_conflict", "Same-session MERGE cannot change the native Session working directory", 1, { session_cwd: session.cwd, target_cwd: stageCwd });
+                }
+                if (!session || transition.session_mode === "new_session" || !sameSessionProfile(session.profile, transition.coordinator) || path.resolve(session.cwd) !== stageCwd) {
                     if (session)
                         await stopSession(session);
                     assertOwner();
@@ -677,7 +671,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                         owner.role = "merge";
                         owner.work_id = state.merge_claim.work_id;
                     }
-                    session = { id: "", profile: transition.coordinator, state_dir: directory, cwd: next.stage === "merge" && state.merge_claim ? state.merge_claim.target_workspace : run.workspace_root, journal: path.join(directory, "adapter.events.jsonl"), owner };
+                    session = { id: "", profile: transition.coordinator, state_dir: directory, cwd: stageCwd, journal: path.join(directory, "adapter.events.jsonl"), owner };
                     if (runtimeHarness(session.profile) === "codex-desktop") {
                         session.codex_home = path.join(directory, "codex-home");
                         initCodexHome(context, { projectRoot: run.project_root, profile: `controller-${digest(directory).slice(0, 16)}`, targetHome: session.codex_home, ...(context.env.CODEX_HOME ? { sourceHome: context.env.CODEX_HOME } : {}) });
@@ -722,9 +716,10 @@ async function executeController(context, row, manifest, state, assertOwnership,
             const fanout = await nextControllerFanout(executionContext, { projectRoot: run.project_root, runId: run.id, stage: next.stage, harness: runtimeHarness(session.profile), sessionId: session.id, children, policy, profiles });
             assertOwner();
             if (fanout.kind === "none") {
-                const cause = currentLifecycleFailure(executionContext, { runId: run.id, generation: row.generation, stage: next.stage });
+                assertNoCorrelatedRejection(context, { projectId: row.project_id, runId: row.run_id, generation: row.generation, stage: next.stage, turn: state.turns });
+                const cause = currentLifecycleFailure(executionContext, { runId: run.id, generation: row.generation, stage: next.stage, turn: state.turns, projectId: row.project_id, projectRoot: run.project_root });
                 if (cause)
-                    throw new AppError(cause.code, cause.message, 1, { ...cause.details, invocation_id: cause.invocation_id, controller_wrapper: "incomplete_subject_turn", stage: next.stage });
+                    throw new AppError(cause.code, cause.message, 1, { ...cause.details, ...(cause.invocation_id ? { invocation_id: cause.invocation_id } : {}), ...(cause.hook_event_id ? { hook_event_id: cause.hook_event_id } : {}), controller_wrapper: "incomplete_subject_turn", stage: next.stage });
                 throw new AppError("incomplete_subject_turn", "Managed Turn ended without a completed Stage or declared continuation", 1, { stage: next.stage });
             }
             if (fanout.kind === "wait") {

package/dist/services/run-fork.js

@@ -4,8 +4,9 @@ import path from "node:path";
 import { createContext } from "../runtime/context.js";
 import { AppError } from "../shared/errors.js";
 import { canonicalPath } from "../storage/paths.js";
+import { importGuardPath, rearmCompletedSnapshotImport } from "../storage/import-guard.js";
 import { installCurrentEngine, upgradeForkedRunEngine, prepareForkEngine } from "./engines.js";
-import { restoreEvalRunSnapshot, prepareEvalRunSnapshot, prepareEvalRunRestore } from "./eval-snapshots.js";
+import { restoreEvalRunSnapshot, prepareEvalRunSnapshot, prepareEvalRunRestore, restoredWorkspaceRoot } from "./eval-snapshots.js";
 export function prepareRunFork(input) {
     const requestId = requireId(input.requestId, "request-id");
     const snapshot = canonicalPath(input.snapshot, false);
@@ -47,7 +48,8 @@ function assertForkOutput(output, intentFile, intent) {
     if (fs.existsSync(output) && fs.readdirSync(output).length > 0) {
         if (!fs.existsSync(intentFile) || hash(readJson(intentFile).intent) !== hash(intent))
             throw new AppError("fork_output_not_empty", "Fork output must be empty", 2, { output });
-        const unknown = fs.readdirSync(output).filter(name => ![".fork-intent.json", "project", "dd-flow-home"].includes(name));
+        const guardName = path.basename(importGuardPath(path.join(output, "dd-flow-home")));
+        const unknown = fs.readdirSync(output).filter(name => ![".fork-intent.json", "project", "dd-flow-home", guardName].includes(name));
         if (unknown.length)
             throw new AppError("fork_retry_inspect_required", "Fork output contains data not owned by the interrupted fork", 1, { output, unknown });
     }
@@ -57,16 +59,18 @@ export function forkRunFromSnapshot(context, input, prepared = prepareRunFork(in
         return prepared.receipt;
     const { manifest, snapshot, output, intent, intentFile, receiptFile, requestId } = prepared;
     assertForkOutput(output, intentFile, intent);
+    const projectRoot = path.join(output, "project");
+    const home = path.join(output, "dd-flow-home");
+    const prearmedImportId = rearmCompletedSnapshotImport({ home, projectRoot,
+        workspaceRoot: restoredWorkspaceRoot(manifest, projectRoot, home), sourceManifestSha256: intent.snapshot_sha256 });
     for (const name of ["project", "dd-flow-home"])
         fs.rmSync(path.join(output, name), { recursive: true, force: true });
     fs.mkdirSync(output, { recursive: true, mode: 0o700 });
     writeJsonAtomic(intentFile, { schema_id: "dd-flow/run-fork-intent@1", intent });
-    const projectRoot = path.join(output, "project");
-    const home = path.join(output, "dd-flow-home");
     fs.mkdirSync(projectRoot, { recursive: true, mode: 0o700 });
-    const targetContext = createContext({ ...context.env, DD_FLOW_HOME: home, DD_FLOW_ENGINE_MODE: "1" });
+    const targetContext = createContext({ ...context.env, DD_FLOW_HOME: home, DD_FLOW_ENGINE_MODE: "1" }, "initialize", prearmedImportId ?? undefined);
     const restoreInput = { snapshot, projectRoot };
-    const restored = restoreEvalRunSnapshot(targetContext, restoreInput, prepareEvalRunRestore(targetContext, restoreInput, manifest));
+    const restored = restoreEvalRunSnapshot(targetContext, restoreInput, prepareEvalRunRestore(targetContext, restoreInput, manifest), prearmedImportId ?? undefined);
     const restoredContext = createContext({ ...context.env, DD_FLOW_HOME: home, DD_FLOW_ENGINE_MODE: "1" });
     try {
         const runHome = String(restored.run_home);

package/dist/services/run-projection.js

@@ -1,8 +1,13 @@
-import fs from "node:fs";
 import path from "node:path";
 import { reconcileSessionCoverageRows } from "../domain/session-coverage.js";
 import { publicSessionIdentity } from "./session-identity.js";
+import { publishRunProjections } from "./runs.js";
 export function refreshRunSessionProjection(context, projectId, runId) {
+    // Review children can finish concurrently in separate processes. Reserve the
+    // writer before reading the RUN index so a sibling cannot invalidate it.
+    context.db.writeTransaction(() => refreshRunSessionProjectionLocked(context, projectId, runId), "run-projection.refresh");
+}
+function refreshRunSessionProjectionLocked(context, projectId, runId) {
     const run = context.db.get("SELECT id, flow_kind, status, project_root, subject_type, subject_id, runtime_path, run_index_path, index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
     if (!run)
         return;
@@ -27,7 +32,7 @@ export function refreshRunSessionProjection(context, projectId, runId) {
         missing: coverage.missing_unit_ids,
         diagnostics: coverage.diagnostics
     };
-    const plan = run.subject_type === "protocol" ? planProjection(context, projectId, run.subject_id, run.project_root) : {};
+    const plan = run.subject_type === "protocol" ? planProjection(context, projectId, run.subject_id, run.project_root, index) : {};
     const workers = workerProjection(context, projectId, runId);
     const vnext = run.flow_kind === "vnext_specify" || run.flow_kind === "vnext_protocolize";
     const hadLegacyCoverage = vnext && ("session_coverage" in index || "usage_coverage" in index);
@@ -42,8 +47,8 @@ export function refreshRunSessionProjection(context, projectId, runId) {
         && JSON.stringify(index.works ?? []) === JSON.stringify(works)
         && index.root_work_id === rootWorkId
         && (vnext || JSON.stringify(index.session_coverage) === JSON.stringify(sessionCoverage))
-        && JSON.stringify(index.plan_ref) === JSON.stringify(plan.plan_ref)
-        && JSON.stringify(index.plan_progress) === JSON.stringify(plan.plan_progress)
+        && (!plan.plan_ref || JSON.stringify(index.plan_ref) === JSON.stringify(plan.plan_ref))
+        && (!plan.plan_progress || JSON.stringify(index.plan_progress) === JSON.stringify(plan.plan_progress))
         && (vnext || JSON.stringify(index.workers ?? {}) === JSON.stringify(workers))
         && !hadLegacyCoverage)
         return;
@@ -59,44 +64,23 @@ export function refreshRunSessionProjection(context, projectId, runId) {
     if (!vnext)
         index.workers = workers;
     index.updated_at = context.now();
-    const runtime = readJson(run.runtime_path);
-    const runtimeRevision = typeof runtime?.runtime_revision === "number"
-        ? runtime.runtime_revision + 1
-        : typeof index.runtime_revision === "number"
-            ? index.runtime_revision + 1
-            : 1;
-    index.runtime_revision = runtimeRevision;
-    const authoritative = { ...(runtime ?? {}), ...index, schema_id: String(index.schema_id ?? runtime?.schema_id ?? "dd-flow/flow-run@3") };
-    authoritative.sessions = sessions;
-    authoritative.works = works;
-    authoritative.root_work_id = rootWorkId;
-    if (vnext) {
-        delete authoritative.session_coverage;
-        delete authoritative.usage_coverage;
-        delete authoritative.workers;
-        delete authoritative.current_stage;
-        delete authoritative.attempts;
-    }
-    else
-        authoritative.session_coverage = sessionCoverage;
-    if (plan.plan_ref)
-        authoritative.plan_ref = plan.plan_ref;
-    if (plan.plan_progress)
-        authoritative.plan_progress = plan.plan_progress;
-    if (!vnext)
-        authoritative.workers = workers;
-    authoritative.updated_at = index.updated_at;
-    authoritative.runtime_revision = runtimeRevision;
-    if (run.status !== "discarded" || fs.existsSync(run.runtime_path))
-        writeJson(run.runtime_path, authoritative);
-    context.db.run("UPDATE runs SET index_json = ?, updated_at = ? WHERE project_id = ? AND id = ?", [JSON.stringify(index), index.updated_at, projectId, runId]);
+    index.runtime_revision = typeof index.runtime_revision === "number" ? index.runtime_revision + 1 : 1;
+    const updated = context.db.run("UPDATE runs SET index_json = ?, updated_at = ? WHERE project_id = ? AND id = ? AND index_json = ?", [JSON.stringify(index), index.updated_at, projectId, runId, run.index_json]);
+    if (updated.changes !== 1)
+        throw new Error("RUN projection changed during preparation");
+    context.db.afterCommit(() => publishRunProjections(context, projectId, runId));
 }
-function planProjection(context, projectId, protocolId, projectRoot) {
-    const binding = context.db.get("SELECT plan_path, plan_revision, plan_sha256 FROM plan_bindings WHERE project_id = ? AND protocol_id = ?", [projectId, protocolId]);
+function planProjection(context, projectId, protocolId, projectRoot, index) {
+    const binding = context.db.get("SELECT plan_id, plan_path, plan_revision, plan_sha256 FROM plan_bindings WHERE project_id = ? AND protocol_id = ?", [projectId, protocolId]);
     if (!binding)
         return {};
     const planPath = path.relative(projectRoot, binding.plan_path).split(path.sep).join("/");
-    const planId = readPlanId(binding.plan_path);
+    const priorRef = index.plan_ref && typeof index.plan_ref === "object" && !Array.isArray(index.plan_ref) ? index.plan_ref : {};
+    const planId = binding.plan_id ?? (typeof priorRef.plan_id === "string" ? priorRef.plan_id : null);
+    // A pre-migration binding without a RUN plan_ref needs canonical rebind before
+    // this projection can be updated; never invent a plan identifier.
+    if (!planId)
+        return {};
     const progress = Object.fromEntries(context.db.all("SELECT item_id, status, summary, evidence_json FROM plan_progress WHERE project_id = ? AND protocol_id = ? ORDER BY item_id", [projectId, protocolId]).map((row) => [row.item_id, {
             status: row.status,
             ...(row.summary ? { summary: row.summary } : {}),
@@ -112,18 +96,6 @@ function planProjection(context, projectId, protocolId, projectRoot) {
         plan_progress: progress
     };
 }
-function readPlanId(planPath) {
-    try {
-        const value = JSON.parse(fs.readFileSync(planPath, "utf8"));
-        if (value && typeof value === "object" && !Array.isArray(value) && typeof value.plan_id === "string") {
-            return value.plan_id;
-        }
-    }
-    catch {
-        // The canonical validator owns malformed-plan errors; projection stays bounded.
-    }
-    return "unknown-plan";
-}
 function workerProjection(context, projectId, runId) {
     return Object.fromEntries(context.db.all(`SELECT j.job_id, j.plan_item_id, j.status, j.worker_session_id, s.harness, s.provider_session_id
        FROM flow_jobs j LEFT JOIN sessions s ON s.project_id = j.project_id AND s.session_id = j.worker_session_id
@@ -182,17 +154,3 @@ function parseCoverageUnits(value) {
         return [];
     }
 }
-function readJson(file) {
-    try {
-        return fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, "utf8")) : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function writeJson(file, value) {
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    const temporary = `${file}.tmp-${process.pid}-${Date.now()}`;
-    fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`);
-    fs.renameSync(temporary, file);
-}

package/dist/services/run-recovery-runtime.js

@@ -4,16 +4,17 @@ import { AppError } from "../shared/errors.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { requireProjectByRoot } from "./projects.js";
 import { acceptanceCommand, recoveryGuard, recoveryPacketReceipt, requireRecoveryRun } from "./run-recovery.js";
-import { processIsAlive } from "./managed-processes.js";
+import { managedProcessBinding, processIsAlive, resourceHome } from "./managed-processes.js";
+import { getResourceDatabase } from "../storage/database.js";
 import { requireManagedDaemonBinding } from "./managed-daemon-binding.js";
+import { lifecycleRetryInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
 /** Pin retained Session loading and its first acknowledgement Turn, never a general fence bypass. */
 export function prepareRunRecoveryDispatch(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(input.operationId) || !path.isAbsolute(input.stateDir))
         throw new AppError("usage", "Recovery dispatch requires an operation id and absolute state directory", 2);
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const run = requireRecoveryRun(context, project.id, input.runId);
-    context.db.beginWriteTransaction();
-    try {
+    const prepared = context.db.readSnapshot(() => {
         const guard = recoveryGuard(context, project.id, run.id);
         const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ?", [input.recoveryId]);
         if (!guard || guard.recovery_id !== input.recoveryId || !binding || !["resuming", "recovered"].includes(guard.status))
@@ -23,8 +24,7 @@ export function prepareRunRecoveryDispatch(context, input) {
             const prior = JSON.parse(binding.runtime_dispatch_json);
             if (prior.state_dir !== input.stateDir || prior.operation_id !== input.operationId)
                 throw new AppError("recovery_binding_mismatch", "Recovery dispatch is already pinned to another operation", 1);
-            context.db.exec("COMMIT");
-            return prior;
+            return { dispatch: prior, guard, binding };
         }
         if (guard.status !== "resuming" || binding.status !== "prepared")
             throw new AppError("recovery_state_changed", "Recovery acknowledgement is no longer awaiting dispatch", 1);
@@ -34,16 +34,27 @@ export function prepareRunRecoveryDispatch(context, input) {
         const metadata = JSON.parse(record.metadata_json);
         if (metadata.state_dir !== input.stateDir || metadata.run_generation !== guard.generation || metadata.dispatch_barrier !== "run-generation@1" || !["subject", "merge"].includes(metadata.role ?? ""))
             throw new AppError("recovery_runtime_mismatch", "Replacement daemon lacks this recovery generation's native dispatch barrier", 1);
-        const prompt = `Resume this retained RUN in its existing native Session. Your first tool call must be this exact standalone command:\n\n${acceptanceCommand(context, run.id, guard.recovery_id, run.project_root)}\n\nFollow the verified recovery packet returned by that command. Preserve completed Work and existing HITL; do not start a successor Stage yourself. Stop at the Stage or declared Work-graph boundary.\n`;
-        const dispatch = { process_id: record.id, owner_id: record.owner_id, state_dir: input.stateDir, daemon_id: binding.daemon_id, operation_id: input.operationId, resume_operation_id: `${input.operationId}:load`, prompt_sha256: crypto.createHash("sha256").update(prompt).digest("hex"), prompt };
-        context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND status = 'prepared' AND runtime_dispatch_json IS NULL", [JSON.stringify(dispatch), binding.recovery_id]);
-        context.db.exec("COMMIT");
-        return dispatch;
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
+        return { guard, binding, record };
+    });
+    let dispatch = prepared.dispatch;
+    if (!dispatch) {
+        const prompt = `Resume this retained RUN in its existing native Session. Your first tool call must be this exact standalone command:\n\n${acceptanceCommand(context, run.id, prepared.guard.recovery_id, run.project_root)}\n\nFollow the verified recovery packet returned by that command. Preserve completed Work and existing HITL; do not start a successor Stage yourself. Stop at the Stage or declared Work-graph boundary.\n\n${lifecycleRetryInstruction}\n`;
+        dispatch = { process_id: prepared.record.id, owner_id: prepared.record.owner_id, state_dir: input.stateDir, daemon_id: prepared.binding.daemon_id, operation_id: input.operationId, resume_operation_id: `${input.operationId}:load`, prompt_sha256: crypto.createHash("sha256").update(prompt).digest("hex"), prompt };
     }
+    const registry = prepared.record ? getResourceDatabase(resourceHome(context)) : undefined;
+    return context.db.writeTransaction(() => {
+        const guard = recoveryGuard(context, project.id, run.id);
+        const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ?", [input.recoveryId]);
+        if (JSON.stringify(guard) !== JSON.stringify(prepared.guard) || JSON.stringify(binding) !== JSON.stringify(prepared.binding))
+            throw new AppError("recovery_state_changed", "Recovery generation changed while dispatch was prepared", 1);
+        if (prepared.record) {
+            const current = registry.get("SELECT * FROM managed_processes WHERE id = ?", [prepared.record.id]);
+            if (!current || current.state !== "running" || current.lease_expires_at <= context.now() || managedProcessBinding(current, resourceHome(context)).registration_sha256 !== managedProcessBinding(prepared.record, resourceHome(context)).registration_sha256)
+                throw new AppError("recovery_runtime_mismatch", "Recovery replacement daemon lease changed before dispatch publication", 1);
+            context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND status = 'prepared' AND runtime_dispatch_json IS NULL", [JSON.stringify(dispatch), prepared.binding.recovery_id]);
+        }
+        return dispatch;
+    });
 }
 /** The caller has already checked PID/start/lease and runtime-home identity. */
 export function recoveryRuntimeAdmission(context, record, input) {