@deksden-com/dd-flow-cli 0.9.0-beta.123 → 0.9.0-beta.127

package/dist/services/run-recovery-guard.js

@@ -0,0 +1,75 @@
+import { AppError } from "../shared/errors.js";
+import { CAPACITY_POLICY, overloadBurst } from "../harness-runtime/lib/codex-capacity-policy.mjs";
+export function recoveryGuard(context, projectId, runId) { return context.db.get("SELECT recovery_id, project_id, run_id, generation, status, interruption_json, settlement_json, capture_path, created_at, updated_at, sealed_at, resumed_at FROM run_recovery_guards WHERE project_id = ? AND run_id = ? ORDER BY generation DESC LIMIT 1", [projectId, runId]) ?? null; }
+export function assertRunRecoveryAllowed(context, projectId, runId, expectedGeneration) {
+    const guard = recoveryGuard(context, projectId, runId);
+    const generation = guard?.generation ?? 0;
+    if (expectedGeneration !== undefined && generation !== expectedGeneration)
+        throw new AppError("run_recovery_generation_stale", "RUN execution generation changed while the operation was in flight", 1, { run_id: runId, expected_generation: expectedGeneration, generation });
+    if (guard && ["draining", "sealed", "resuming"].includes(guard.status))
+        throw new AppError("run_recovery_guarded", "RUN is retained for recovery; reconcile or resume its recovery operation before accepting a new lifecycle mutation", 1, { run_id: runId, recovery_id: guard.recovery_id, generation, status: guard.status });
+    return generation;
+}
+export function assertRunMutationAllowed(context, projectId, runId, expectedGeneration) {
+    const generation = assertRunRecoveryAllowed(context, projectId, runId, expectedGeneration);
+    if (context.db.get("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'run_controllers'")
+        && context.db.get("SELECT 1 FROM run_controllers WHERE project_id = ? AND run_id = ? AND status IN ('capturing','capture_failed') LIMIT 1", [projectId, runId]))
+        throw new AppError("run_boundary_capturing", "RUN writers are fenced while its controller captures a Stage boundary", 1, { run_id: runId });
+    return generation;
+}
+/** The caller has already checked PID/start/lease and runtime-home identity. */
+export function recoveryRuntimeAdmission(context, record, input) {
+    if (!record.project_id || !record.run_id || !input.daemonId)
+        return false;
+    const guard = recoveryGuard(context, record.project_id, record.run_id);
+    if (!guard || !["resuming", "recovered"].includes(guard.status))
+        return false;
+    const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ? AND daemon_id = ?", [guard.recovery_id, input.daemonId]);
+    if (!binding?.runtime_dispatch_json)
+        return false;
+    const dispatch = JSON.parse(binding.runtime_dispatch_json);
+    if (dispatch.process_id !== record.id || dispatch.owner_id !== record.owner_id || dispatch.state_dir !== input.stateDir || dispatch.daemon_id !== input.daemonId)
+        return false;
+    const metadata = JSON.parse(record.metadata_json);
+    if (metadata.run_generation !== guard.generation)
+        return false;
+    if (guard.status === "recovered" && binding.status === "accepted")
+        return !input.operationId?.startsWith(`${dispatch.operation_id}:capacity:`);
+    if (guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.resume")
+        return typeof dispatch.resume_operation_id === "string" && input.operationId === dispatch.resume_operation_id && input.nativeSessionId === binding.provider_session_id;
+    const active = dispatch.capacity_intents?.at(-1);
+    if (active) {
+        const ordinal = dispatch.capacity_intents.length;
+        const predecessor = ordinal === 1 ? dispatch.operation_id : dispatch.capacity_intents[ordinal - 2].operation_id;
+        if (active.policy !== CAPACITY_POLICY || active.ordinal !== ordinal || active.root_operation_id !== dispatch.operation_id || active.session_id !== binding.provider_session_id
+            || active.predecessor !== predecessor || active.operation_id !== `${dispatch.operation_id}:capacity:${ordinal}:session.prompt`
+            || active.refusal?.policy !== CAPACITY_POLICY || active.refusal.ordinal !== ordinal - 1 || active.refusal.turn_id !== active.turn_id
+            || active.refusal.session_id !== binding.provider_session_id || active.deadline !== null || !Number.isFinite(Date.parse(active.not_before)))
+            return false;
+        const failure = dispatch.capacity_failures?.find(item => item.ordinal === ordinal - 1);
+        if (!failure || JSON.stringify(failure) !== JSON.stringify(active.refusal))
+            return false;
+        try {
+            if (overloadBurst(dispatch.capacity_failures))
+                return false;
+        }
+        catch {
+            return false;
+        }
+        const predecessorRow = context.db.get("SELECT status,receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [predecessor, record.owner_id, guard.generation]);
+        if (predecessorRow?.status !== "failed")
+            return false;
+        try {
+            if (JSON.stringify(JSON.parse(predecessorRow.receipt_json).capacity_intent) !== JSON.stringify(active))
+                return false;
+        }
+        catch {
+            return false;
+        }
+    }
+    if (active && active.not_before > context.now())
+        return false;
+    return guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.prompt"
+        && input.operationId === (active?.operation_id ?? dispatch.operation_id) && input.nativeSessionId === binding.provider_session_id
+        && input.promptSha256 === (active?.prompt_sha256 ?? dispatch.prompt_sha256);
+}

package/dist/services/run-recovery-runtime.js

@@ -8,6 +8,7 @@ import { managedProcessBinding, processIsAlive, resourceHome } from "./managed-p
 import { getResourceDatabase } from "../storage/database.js";
 import { requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 import { lifecycleRetryInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { CAPACITY_POLICY, overloadBurst } from "../harness-runtime/lib/codex-capacity-policy.mjs";
 /** Pin retained Session loading and its first acknowledgement Turn, never a general fence bypass. */
 export function prepareRunRecoveryDispatch(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(input.operationId) || !path.isAbsolute(input.stateDir))
@@ -59,7 +60,9 @@ export function prepareRunRecoveryDispatch(context, input) {
 /** Publish only an exact successor to a failed, effect-free recovery ACK Turn. */
 export function retainRecoveryCapacityIntent(context, input) {
     const { intent } = input;
-    if (![1, 2].includes(intent.ordinal) || !intent.turn_id || !intent.not_before)
+    if (!Number.isSafeInteger(intent.ordinal) || intent.ordinal < 1 || !intent.turn_id || !Number.isFinite(Date.parse(intent.not_before)) || intent.policy !== CAPACITY_POLICY
+        || !intent.refusal || intent.refusal.policy !== CAPACITY_POLICY || intent.refusal.ordinal !== intent.ordinal - 1 || intent.refusal.turn_id !== intent.turn_id
+        || !Number.isFinite(Date.parse(intent.refusal.first_observed_at)) || intent.deadline !== null)
         throw new AppError("recovery_capacity_intent_invalid", "Recovery capacity successor is invalid", 1);
     context.db.writeTransaction(() => {
         const guard = recoveryGuard(context, input.projectId, input.runId);
@@ -71,12 +74,26 @@ export function retainRecoveryCapacityIntent(context, input) {
         if (controller?.generation !== input.generation || ["completed", "cancelled", "superseded"].includes(controller.status) || control?.status !== "resuming")
             throw new AppError("recovery_capacity_owner_changed", "Recovery controller or control changed before successor publication", 1);
         const dispatch = JSON.parse(binding.runtime_dispatch_json);
+        if (intent.root_operation_id !== dispatch.operation_id || intent.session_id !== binding.provider_session_id || intent.refusal.session_id !== binding.provider_session_id)
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery capacity intent belongs to another root or Session", 1);
         const currentProcess = getResourceDatabase(resourceHome(context)).get("SELECT * FROM managed_processes WHERE id = ?", [dispatch.process_id]);
         if (!currentProcess || currentProcess.state !== "running" || currentProcess.lease_expires_at <= context.now() || currentProcess.owner_id !== dispatch.owner_id
             || currentProcess.project_id !== input.projectId || currentProcess.run_id !== input.runId)
             throw new AppError("recovery_capacity_owner_changed", "Replacement daemon lease changed before successor publication", 1);
         const prior = dispatch.capacity_intents ?? [];
-        const predecessor = intent.ordinal === 1 ? dispatch.operation_id : prior[0]?.operation_id;
+        for (let index = 0; index < prior.length; index++) {
+            const retained = prior[index];
+            if (retained.policy !== CAPACITY_POLICY || retained.ordinal !== index + 1 || retained.root_operation_id !== dispatch.operation_id || retained.session_id !== binding.provider_session_id
+                || retained.predecessor !== (index === 0 ? dispatch.operation_id : prior[index - 1].operation_id)
+                || retained.operation_id !== `${dispatch.operation_id}:capacity:${index + 1}:session.prompt` || retained.refusal?.ordinal !== index
+                || retained.refusal.turn_id !== retained.turn_id || retained.refusal.session_id !== binding.provider_session_id)
+                throw new AppError("recovery_capacity_intent_conflict", "Retained recovery capacity chain is invalid", 1);
+        }
+        const refusals = dispatch.capacity_failures ?? [];
+        const observed = refusals.find(item => item.ordinal === intent.refusal.ordinal);
+        if (!observed || JSON.stringify(observed) !== JSON.stringify(intent.refusal) || overloadBurst(refusals))
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery successor lacks an immutable non-burst refusal binding", 1);
+        const predecessor = intent.ordinal === 1 ? dispatch.operation_id : prior[intent.ordinal - 2]?.operation_id;
         if (prior.length !== intent.ordinal - 1 || predecessor !== intent.predecessor || intent.operation_id !== `${dispatch.operation_id}:capacity:${intent.ordinal}:session.prompt`)
             throw new AppError("recovery_capacity_intent_conflict", "Recovery capacity successor does not extend the pinned ACK", 1);
         const failed = context.db.get("SELECT status FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [intent.predecessor, input.controllerId, input.generation]);
@@ -87,35 +104,9 @@ export function retainRecoveryCapacityIntent(context, input) {
         const changed = context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared' AND runtime_dispatch_json = ?", [JSON.stringify(updated), input.recoveryId, input.daemonId, binding.runtime_dispatch_json]);
         if (changed.changes !== 1)
             throw new AppError("recovery_capacity_intent_conflict", "Recovery dispatch changed before successor publication", 1);
-        const marked = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_intent: next }), context.now(), intent.predecessor, input.controllerId, input.generation]);
+        const marked = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_failure: next.refusal, capacity_intent: next }), context.now(), intent.predecessor, input.controllerId, input.generation]);
         if (marked.changes !== 1)
             throw new AppError("recovery_capacity_intent_conflict", "Recovery predecessor changed before successor publication", 1);
     });
 }
-/** The caller has already checked PID/start/lease and runtime-home identity. */
-export function recoveryRuntimeAdmission(context, record, input) {
-    if (!record.project_id || !record.run_id || !input.daemonId)
-        return false;
-    const guard = recoveryGuard(context, record.project_id, record.run_id);
-    if (!guard || !["resuming", "recovered"].includes(guard.status))
-        return false;
-    const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ? AND daemon_id = ?", [guard.recovery_id, input.daemonId]);
-    if (!binding?.runtime_dispatch_json)
-        return false;
-    const dispatch = JSON.parse(binding.runtime_dispatch_json);
-    if (dispatch.process_id !== record.id || dispatch.owner_id !== record.owner_id || dispatch.state_dir !== input.stateDir || dispatch.daemon_id !== input.daemonId)
-        return false;
-    const metadata = JSON.parse(record.metadata_json);
-    if (metadata.run_generation !== guard.generation)
-        return false;
-    if (guard.status === "recovered" && binding.status === "accepted")
-        return !input.operationId?.startsWith(`${dispatch.operation_id}:capacity:`);
-    if (guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.resume")
-        return typeof dispatch.resume_operation_id === "string" && input.operationId === dispatch.resume_operation_id && input.nativeSessionId === binding.provider_session_id;
-    const active = dispatch.capacity_intents?.at(-1);
-    if (active && active.not_before > context.now())
-        return false;
-    return guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.prompt"
-        && input.operationId === (active?.operation_id ?? dispatch.operation_id) && input.nativeSessionId === binding.provider_session_id
-        && input.promptSha256 === (active?.prompt_sha256 ?? dispatch.prompt_sha256);
-}
+export { recoveryRuntimeAdmission } from "./run-recovery-guard.js";

package/dist/services/run-recovery.js

@@ -1,4 +1,6 @@
 import { hasLifecyclePacketAssignments, managedLifecycleCommand, recoverLifecycleCommands } from "./lifecycle-invocations.js";
+import { recoveryGuard, assertRunMutationAllowed } from "./run-recovery-guard.js";
+export { recoveryGuard, assertRunMutationAllowed, assertRunRecoveryAllowed } from "./run-recovery-guard.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -11,6 +13,7 @@ import { verifyRecoverySnapshot } from "./eval-snapshots.js";
 import { findRecentMatchingHookEvent, hookSessionIdentity, recoveryAcceptMatchKey } from "./hooks.js";
 import { flowCommand } from "./stage-pause.js";
 import { materializePendingWorkResults } from "./work-registry.js";
+import { currentStagePrompt } from "./stage-context.js";
 export function recoveryPacketReceipt(binding) {
     if (!binding.packet_json || !binding.packet_sha256 || crypto.createHash("sha256").update(binding.packet_json).digest("hex") !== binding.packet_sha256)
         throw new AppError("recovery_packet_missing", "Recovery requires its original verified Work packet", 1);
@@ -30,12 +33,15 @@ function rootRecoveryPacket(context, run, guard, owner) {
             throw new AppError("recovery_evidence_missing", "Captured root prompt is missing or uses an unsafe link", 1);
     }
     const prompt = fs.readFileSync(promptPath, "utf8");
+    const currentPrompt = currentStagePrompt(context, session.prompt_path, run.run_root, prompt);
     const dependencies = JSON.parse(work.depends_on_json);
     return JSON.stringify({
         schema_id: "dd-flow/root-recovery-packet@1", recovery_id: guard.recovery_id, generation: guard.generation, run_id: run.id, work_id: owner.work_id,
         mode: "same-session", continuation: boundary ? "stage_boundary" : "unfinished_work", retained_work_status: work.status, retained_session_status: session.status, retained_result: work.result,
         original_task: work.task, original_task_sha256: crypto.createHash("sha256").update(work.task).digest("hex"),
         original_prompt: { path: promptPath, text: prompt, sha256: crypto.createHash("sha256").update(prompt).digest("hex") },
+        ...(currentPrompt.worker_prompt_markdown !== prompt ? { current_prompt: { path: currentPrompt.prompt_path, text: currentPrompt.worker_prompt_markdown, sha256: crypto.createHash("sha256").update(currentPrompt.worker_prompt_markdown).digest("hex") } } : {}),
+        ...(currentPrompt.worker_prompt_markdown !== prompt ? { current_prompt_instruction: "Use current_prompt for current operational authority and input paths; original_prompt is immutable historical provenance. Neither prompt grants new command authority: retain the existing lifecycle recovery acknowledgement and replacement-command rules." } : {}),
         result_schema: work.result_schema, payload: work.payload_json ? JSON.parse(work.payload_json) : null, paused: work.status === "paused",
         dependency_results: dependencies.map((id) => context.db.get("SELECT work_id, status, result FROM works WHERE work_id = ?", [id])),
         capture_path: guard.capture_path, observed_at: guard.created_at, sealed_at: guard.sealed_at,
@@ -67,19 +73,6 @@ export function prepareRecoveryPayload(value, label) {
         throw new AppError("recovery_not_settled", "Recovery capture requires an explicit settled tree receipt", 1);
     return payload;
 }
-export function recoveryGuard(context, projectId, runId) { return context.db.get("SELECT recovery_id, project_id, run_id, generation, status, interruption_json, settlement_json, capture_path, created_at, updated_at, sealed_at, resumed_at FROM run_recovery_guards WHERE project_id = ? AND run_id = ? ORDER BY generation DESC LIMIT 1", [projectId, runId]) ?? null; }
-export function assertRunMutationAllowed(context, projectId, runId, expectedGeneration) {
-    const guard = recoveryGuard(context, projectId, runId);
-    const generation = guard?.generation ?? 0;
-    if (expectedGeneration !== undefined && generation !== expectedGeneration)
-        throw new AppError("run_recovery_generation_stale", "RUN execution generation changed while the operation was in flight", 1, { run_id: runId, expected_generation: expectedGeneration, generation });
-    if (guard && ["draining", "sealed", "resuming"].includes(guard.status))
-        throw new AppError("run_recovery_guarded", "RUN is retained for recovery; reconcile or resume its recovery operation before accepting a new lifecycle mutation", 1, { run_id: runId, recovery_id: guard.recovery_id, generation, status: guard.status });
-    if (context.db.get("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'run_controllers'")
-        && context.db.get("SELECT 1 FROM run_controllers WHERE project_id = ? AND run_id = ? AND status IN ('capturing','capture_failed') LIMIT 1", [projectId, runId]))
-        throw new AppError("run_boundary_capturing", "RUN writers are fenced while its controller captures a Stage boundary", 1, { run_id: runId });
-    return generation;
-}
 /** A cooperative drain permits only the WorkSession present at its fence. */
 export function assertWorkSettlementAllowed(context, projectId, runId, workId) {
     const guard = recoveryGuard(context, projectId, runId);
@@ -188,6 +181,7 @@ export function prepareRunRecoveryResume(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const run = requireRecoveryRun(context, project.id, input.runId);
     const guard = recoveryGuard(context, project.id, run.id);
+    assertRecoveryRunCanResume(context, project.id, run.id);
     if (!guard || guard.recovery_id !== input.recoveryId)
         throw new AppError("recovery_not_found", "Recovery operation is not registered for this RUN", 1, { recovery_id: input.recoveryId, run_id: run.id });
     if (["resuming", "recovered"].includes(guard.status)) {
@@ -212,6 +206,7 @@ export function prepareRunRecoveryResume(context, input) {
 }
 export function resumeRunRecovery(context, input, prepared = prepareRunRecoveryResume(context, input)) {
     const { project, run, guard } = prepared;
+    assertRecoveryRunCanResume(context, project.id, run.id);
     const acceptCommand = acceptanceCommand(context, run.id, guard.recovery_id, run.project_root);
     if (prepared.reused)
         return { ok: true, recovery_id: guard.recovery_id, generation: guard.generation, resumed: guard.status === "recovered", awaiting_acceptance: guard.status === "resuming", accept_command: acceptCommand, reused: true };
@@ -226,6 +221,7 @@ export function resumeRunRecovery(context, input, prepared = prepareRunRecoveryR
         context.db.all("SELECT b.recovery_id FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND b.daemon_id = ? ORDER BY b.recovery_id", [project.id, input.daemonId])
     ]);
     const publication = context.db.readSnapshot(() => {
+        assertRecoveryRunCanResume(context, project.id, run.id);
         const signature = authority();
         const current = recoveryGuard(context, project.id, run.id);
         if (!current || current.recovery_id !== guard.recovery_id || current.generation !== guard.generation || current.status !== "sealed" || current.capture_path !== guard.capture_path)
@@ -258,6 +254,7 @@ export function resumeRunRecovery(context, input, prepared = prepareRunRecoveryR
     context.db.writeTransaction(() => {
         if (authority() !== publication.signature)
             throw new AppError("recovery_state_changed", "Recovery inputs changed while its packet was prepared", 1, { recovery_id: guard.recovery_id });
+        assertRecoveryRunCanResume(context, project.id, run.id);
         const now = context.now();
         context.db.run("INSERT INTO run_recovery_bindings (recovery_id, work_id, prior_work_session_id, session_id, harness, provider_session_id, daemon_id, status, created_at, packet_json, packet_sha256) VALUES (?, ?, ?, ?, ?, ?, ?, 'prepared', ?, ?, ?)", [guard.recovery_id, owner.work_id, owner.id, owner.session_id, input.harness, input.nativeSessionId, input.daemonId, now, packet, crypto.createHash("sha256").update(packet).digest("hex")]);
         for (const work of running)
@@ -276,11 +273,13 @@ export function resumeRunRecovery(context, input, prepared = prepareRunRecoveryR
 export function acceptRunRecovery(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const run = requireRecoveryRun(context, project.id, input.runId);
+    assertRecoveryRunCanResume(context, project.id, run.id);
     const matchKey = entityReferenceVariants(run.id).map((reference) => recoveryAcceptMatchKey(reference, input.recoveryId, run.project_root));
     const eventKey = input.hookEventId ?? findRecentMatchingHookEvent(context, { projectId: project.id, matchKey, errorCode: "trusted_recovery_acceptance_required", operation: "run recovery accept" }).eventKey;
     const identity = hookSessionIdentity(context, project.id, eventKey);
     const now = context.now();
     const result = context.db.writeTransaction(() => {
+        assertRecoveryRunCanResume(context, project.id, run.id);
         const guard = recoveryGuard(context, project.id, run.id);
         const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ?", [input.recoveryId]);
         const hook = context.db.get("SELECT status, match_key FROM hook_events WHERE id = ?", [identity.hookEventId]);
@@ -324,6 +323,11 @@ export function acceptRunRecovery(context, input) {
     appendFlowRunTimelineEvent(context, project.id, run.id, { type: "run_recovery_accepted", recovery_id: input.recoveryId, daemon_id: identity.daemonId, hook_event_key: eventKey });
     return result;
 }
+function assertRecoveryRunCanResume(context, projectId, runId) {
+    const run = context.db.get("SELECT status FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+    if (run && ["done", "failed", "cancelled"].includes(run.status))
+        throw new AppError("invalid_run_state", "A terminal RUN permits settlement, not productive recovery", 1, { run_id: runId, status: run.status });
+}
 function recoveryEvidencePath(context, run, guard, workId) {
     // The verified capture is already immutable evidence. Referencing it avoids
     // a second filesystem copy whose partial result could survive SQL rollback.

package/dist/services/runs.js

@@ -16,7 +16,7 @@ import { recalculateRunUsage } from "./usage.js";
 import { refreshRunSessionProjection } from "./run-projection.js";
 import { resolveCanonRoot } from "./canon.js";
 import { bindCurrentEngineToRun } from "./engines.js";
-import { executionProfilePath, loadVnextExecutionProfile } from "./vnext-execution-profile.js";
+import { assertOperationalDecisionSource, executionProfilePath, loadVnextExecutionProfileSnapshot } from "./vnext-execution-profile.js";
 import { loadVnextWorkspacePolicy } from "./vnext-workspace-policy.js";
 import { assertSameSessionMerge, loadExecutionRoutingInput, resolveStageTransition, snapshotAgentProfiles } from "./execution-policy.js";
 import { isLegalVnextTransition, vnextStageDirectory, vnextStages } from "../domain/stage-catalog.js";
@@ -54,7 +54,7 @@ export function prepareFlowRunStart(context, input) {
     if (input.executionRoutingFile !== undefined && !vnext)
         throw new AppError("usage", "Execution routing input is supported only for vNext RUNs", 2);
     const routingInput = input.executionRoutingFile !== undefined ? loadExecutionRoutingInput(input.executionRoutingFile) : undefined;
-    const executionProfile = vnext ? snapshotVnextExecutionProfile(projectRoot, context.ddFlowHome, routingInput) : undefined;
+    const executionProfile = vnext ? snapshotVnextExecutionProfile(projectRoot, context.ddFlowHome, routingInput, context.now()) : undefined;
     const flowContract = input.flowKind === "mb-upgrade"
         ? loadUpgradeFlowContract(context, projectRoot)
         : loadProjectFlowContract(projectRoot);
@@ -73,6 +73,14 @@ export function prepareFlowRunStart(context, input) {
 }
 export function startFlowRun(context, input, prepared = prepareFlowRunStart(context, input)) {
     const { projectRoot, flowKind, routingInput, executionProfile, workspaceRoot, slug, subjectId, subjectType, now, flowFlags } = prepared;
+    // Ordinary settings are already frozen by preparation; only scoped authority
+    // requires its live acceptance source to survive final binding unchanged.
+    if (executionProfile?.operational_decision) {
+        if (crypto.createHash("sha256").update(fs.readFileSync(executionProfile.source_path)).digest("hex") !== executionProfile.source_checksum)
+            throw new AppError("execution_profile_changed", "Execution profile changed after RUN preparation", 2);
+        if (executionProfile.operational_decision)
+            assertOperationalDecisionSource(executionProfile.operational_decision, projectRoot, context.now());
+    }
     registerProject(context, { root: projectRoot });
     const project = requireProjectByRoot(context, projectRoot);
     const runId = nextRunId(context, project.id, slug);
@@ -80,12 +88,20 @@ export function startFlowRun(context, input, prepared = prepareFlowRunStart(cont
     const runHome = projectRunHome(context.ddFlowHome, project.id, runId);
     const runDirRelative = path.posix.join("runs", runId);
     const runtimePath = projectRunJsonPath(context.ddFlowHome, project.id, runId);
+    const policyBytes = executionProfile?.operational_decision ? fs.readFileSync(path.resolve(projectRoot, executionProfile.operational_decision.policy.path)) : undefined;
+    const policySource = policyBytes ? { path: "operational-policy.source.md", sha256: crypto.createHash("sha256").update(policyBytes).digest("hex") } : undefined;
+    if (policySource && policySource.sha256 !== executionProfile?.operational_decision?.policy.sha256)
+        throw new AppError("operational_decision_policy_changed", "Policy changed during final RUN binding", 2);
+    const binding = { project_id: project.id, run_id: runId, project_root: projectRoot, ...(executionProfile?.operational_decision?.scope.eval_id ? { eval_id: executionProfile.operational_decision.scope.eval_id } : {}), ...(executionProfile?.operational_decision?.scope.execution_id ? { execution_id: executionProfile.operational_decision.scope.execution_id } : {}) };
+    const operationalBytes = executionProfile ? `${JSON.stringify({ schema_id: "dd-flow/run-operational-contract@1", binding, settings: { merge_delivery: executionProfile.settings.merge_delivery, merge_cleanup: executionProfile.settings.merge_cleanup }, ...(executionProfile.operational_decision ? { decision: executionProfile.operational_decision, policy_source: policySource } : {}) }, null, 2)}\n` : undefined;
+    if (executionProfile && operationalBytes)
+        executionProfile.operational_contract = { path: "operational-contract.json", sha256: crypto.createHash("sha256").update(operationalBytes).digest("hex"), ...(policySource ? { policy_source: policySource } : {}), binding };
     const index = {
         schema_id: runSchemaId,
         run_id: runId,
         short_id: shortId,
         flow_kind: flowKind,
-        ...(["vnext_specify", "vnext_protocolize"].includes(flowKind) ? { verification_matrix_contract: "dd-flow/verification-matrix@1" } : {}),
+        ...(["vnext_specify", "vnext_protocolize"].includes(flowKind) ? { verification_matrix_contract: "dd-flow/verification-matrix@1", final_check_coverage_contract: "dd-flow/final-check-coverage@1" } : {}),
         subject: {
             id: subjectId,
             title: subjectId
@@ -144,6 +160,10 @@ export function startFlowRun(context, input, prepared = prepareFlowRunStart(cont
     };
     ensureDir(path.dirname(runtimePath));
     ensureDir(runHome);
+    if (policyBytes && policySource)
+        fs.writeFileSync(path.join(runHome, policySource.path), policyBytes, { flag: "wx" });
+    if (operationalBytes)
+        fs.writeFileSync(path.join(runHome, "operational-contract.json"), operationalBytes, { flag: "wx" });
     if (routingInput)
         fs.writeFileSync(path.join(runHome, "execution-routing.input.json"), routingInput.bytes, { flag: "wx", mode: 0o600 });
     bindCurrentEngineToRun(context, { projectRoot, runId, runRoot: runHome });
@@ -193,13 +213,16 @@ export function startFlowRun(context, input, prepared = prepareFlowRunStart(cont
     });
     return { ok: true, run: flowRunSummary(requireRunById(context, project.id, runId)), index };
 }
-function snapshotVnextExecutionProfile(projectRoot, ddFlowHome, routingInput) {
-    const profile = loadVnextExecutionProfile(projectRoot);
+function snapshotVnextExecutionProfile(projectRoot, ddFlowHome, routingInput, now = new Date().toISOString()) {
+    const { profile, bytes } = loadVnextExecutionProfileSnapshot(projectRoot);
+    if (profile.operational_decision)
+        assertOperationalDecisionSource(profile.operational_decision, projectRoot, now);
     const sourcePath = executionProfilePath(projectRoot);
     const frozen = freezeRunExecutionRouting(ddFlowHome, {
         schema_id: "dd-flow/run-execution-profile@1",
         source_path: sourcePath,
-        source_checksum: crypto.createHash("sha256").update(fs.readFileSync(sourcePath)).digest("hex"),
+        source_checksum: crypto.createHash("sha256").update(bytes).digest("hex"),
+        ...(profile.operational_decision ? { operational_decision: profile.operational_decision } : {}),
         settings: {
             stage_session_mode: profile.stage_session_mode,
             plan_review_mode: profile.plan_review_mode,
@@ -659,6 +682,16 @@ export function prepareFlowRunStageCompletion(context, input) {
         throw new AppError("validation", "Stage data SHA-256 is invalid", 2);
     return { project, run, index, stage, status, existing, dataSha256, git: input.git ?? gitFacts(run.workspace_root), generation: ["done", "failed", "skipped"].includes(status) ? assertStageSettlementAllowed(context, project.id, run.id, stage) : assertRunMutationAllowed(context, project.id, run.id) };
 }
+function stageUsageProjection(context, run, stage, startedAt) {
+    if (!startedAt)
+        return { status: "unavailable", input_tokens: null, cached_input_tokens: null, output_tokens: null, total_tokens: null, session_count: 0, observed_at: context.now() };
+    const value = recalculateRunUsage(context, { projectId: run.project_id, runId: run.id, stage: { name: stage, startedAt, completedAt: context.now() } });
+    const totals = value.totals, coverage = value.coverage;
+    const count = (name) => typeof coverage?.[name] === "number" ? coverage[name] : 0;
+    const measured = count("measured"), other = Object.values(coverage ?? {}).reduce((total, item) => total + (typeof item === "number" ? item : 0), 0) - measured;
+    const tokens = (name) => typeof totals?.[name] === "number" ? totals[name] : null;
+    return { status: measured === 0 ? "unavailable" : other > 0 || ["input_tokens", "cache_read_input_tokens", "output_tokens", "total_tokens"].some(name => tokens(name) === null) ? "partial" : "measured", input_tokens: tokens("input_tokens"), cached_input_tokens: tokens("cache_read_input_tokens"), output_tokens: tokens("output_tokens"), total_tokens: tokens("total_tokens"), session_count: Array.isArray(value.sessions) ? value.sessions.length : 0, observed_at: typeof value.observed_at === "string" ? value.observed_at : context.now() };
+}
 export function completeFlowRunStage(context, input, prepared = prepareFlowRunStageCompletion(context, input)) {
     const { project, run, stage, status, dataSha256, git, generation } = prepared;
     const completed = context.db.writeTransaction(() => {
@@ -681,7 +714,7 @@ export function completeFlowRunStage(context, input, prepared = prepareFlowRunSt
             ...(dataSha256 ? { data_sha256: dataSha256 } : {}),
             ...(input.dataSchemaId ? { data_schema_id: input.dataSchemaId } : {}),
             ...(input.report ? { report: input.report } : {}),
-            ...(input.usage ? { usage: input.usage } : {}),
+            usage: input.usage ?? stageUsageProjection(context, latest, stage, existing.started_at),
             ...(input.aliases && input.aliases.length > 0 ? { artifact_aliases: input.aliases } : {}),
             updated_at: now,
             ...(status === "done" || status === "waiting_for_user" || status === "blocked" || status === "failed" || status === "skipped"

package/dist/services/runtime-budget.js

@@ -6,8 +6,8 @@ import { setTimeout as delay } from "node:timers/promises";
 import { getResourceDatabase, withResourceReadSnapshot } from "../storage/database.js";
 import { AppError } from "../shared/errors.js";
 import { harnessKey } from "./harness-config.js";
-import { managedProcessBinding, resourceHome, processIsAlive } from "./managed-processes.js";
-import { recoveryRuntimeAdmission } from "./run-recovery-runtime.js";
+import { managedProcessBinding, assertManagedProcessAdmission, resourceHome, processIsAlive } from "./managed-processes.js";
+import { recoveryRuntimeAdmission } from "./run-recovery-guard.js";
 import { prepareTextFile, prepareJsonFile, prepareError } from "../cli/input-preparation.js";
 const digest = (value) => crypto.createHash("sha256").update(value).digest("hex");
 export function validateRuntimeScopeManifest(value, scopeId) {
@@ -47,7 +47,7 @@ export function validateRetainedRuntimeScopeManifest(value, scopeId) {
 /** Prepared native owners cannot send the first recovery Turn until the scope
  * arbiter publishes their exact release. Fence disappearance alone is not ACK. */
 export async function waitForRuntimeScopeRecovery(context, input, assertOwner) {
-    const db = getResourceDatabase(resourceHome(context));
+    const db = getResourceDatabase(resourceHome(context), context.resourceDatabaseMode, context.databaseDeadlineAt);
     for (;;) {
         assertOwner();
         const snapshot = db.readSnapshot(() => {
@@ -110,7 +110,7 @@ export function requestRuntimeScopeControl(context, scopeId, requestId, mode, ma
     if (prepared.receipt)
         return prepared.receipt;
     const declaration = prepared.manifest;
-    const db = getResourceDatabase(resourceHome(context));
+    const db = getResourceDatabase(resourceHome(context), context.resourceDatabaseMode, context.databaseDeadlineAt);
     const requestKey = digest(JSON.stringify([scopeId, requestId]));
     return db.writeTransaction(() => {
         const prior = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control-request' AND resource_key = ?", [requestKey]);
@@ -145,7 +145,7 @@ export function requestRuntimeScopeControl(context, scopeId, requestId, mode, ma
     });
 }
 function assertScopeAdmission(context, scopeId) {
-    const db = getResourceDatabase(resourceHome(context));
+    const db = getResourceDatabase(resourceHome(context), context.resourceDatabaseMode, context.databaseDeadlineAt);
     if (db.get("SELECT 1 FROM managed_resources WHERE resource_kind = 'provider-fence' AND resource_key = ?", [scopeId]))
         throw new AppError("runtime_scope_stopped", "This runtime scope no longer admits productive dispatch", 1, { scope_id: scopeId });
     const control = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control' AND resource_key = ?", [scopeId]);
@@ -166,7 +166,7 @@ export function scopeLocalProcessRole(record) {
 export function admitRuntimeCheck(context, id, leaseToken) {
     if (typeof id !== "string" || !id.trim() || typeof leaseToken !== "string" || !leaseToken.trim())
         throw new AppError("validation", "Check admission requires a process ID and lease token", 2);
-    const db = getResourceDatabase(resourceHome(context), "read_existing");
+    const db = getResourceDatabase(resourceHome(context), "read_existing", context.databaseDeadlineAt);
     try {
         // One statement observes the owner and both admission fences together,
         // without taking a writer lock or initializing an absent registry.
@@ -176,6 +176,7 @@ export function admitRuntimeCheck(context, id, leaseToken) {
       FROM managed_processes p WHERE p.id = ?`, [id]);
         if (!record || record.lease_token !== leaseToken || !["eval-baseline", "eval-observer", "check"].includes(record.kind) || record.state !== "running" || !processIsAlive(record))
             throw new AppError("process_ownership_unknown", "Local process requires its confirmed live owner", 1);
+        assertManagedProcessAdmission(context, record);
         let budget;
         try {
             const metadata = JSON.parse(record.metadata_json);
@@ -231,7 +232,7 @@ export function prepareRuntimeScopeFence(scopeId, requestId) {
 }
 export function fenceRuntimeBudget(context, scopeId, requestId) {
     prepareRuntimeScopeFence(scopeId, requestId);
-    const db = getResourceDatabase(resourceHome(context));
+    const db = getResourceDatabase(resourceHome(context), context.resourceDatabaseMode, context.databaseDeadlineAt);
     return db.writeTransaction(() => {
         const existing = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'provider-fence' AND resource_key = ?", [scopeId]);
         const now = context.now();
@@ -277,19 +278,32 @@ export function parseRuntimeBudget(raw) {
 export function reserveProviderTurn(context, record, input) {
     const metadata = JSON.parse(record.metadata_json);
     const budget = parseRuntimeBudget(metadata.budget === undefined ? undefined : JSON.stringify(metadata.budget));
-    if (!budget)
-        return { admitted: true };
+    if (!budget) {
+        const reader = getResourceDatabase(resourceHome(context), "read_existing", context.databaseDeadlineAt);
+        try {
+            const current = reader.get("SELECT * FROM managed_processes WHERE id=?", [record.id]);
+            if (!current || current.state !== "running" || !processIsAlive(current) || managedProcessBinding(current, resourceHome(context)).registration_sha256 !== managedProcessBinding(record, resourceHome(context)).registration_sha256)
+                throw new AppError("process_ownership_unknown", "Owner changed before unbudgeted admission", 1);
+            assertManagedProcessAdmission(context, current);
+            return { admitted: true };
+        }
+        finally {
+            reader.close?.();
+        }
+    }
     if (!metadata.harness || !metadata.state_dir || !input.operationId || !["session.create", "session.prompt", "session.start", "session.fork", "session.resume"].includes(input.operation))
         throw new AppError("runtime_budget_invalid", "Budget admission requires a frozen harness and productive operation", 2);
     const harness = harnessKey(metadata.harness), limit = budget.per_harness[harness] ?? 1;
-    const db = getResourceDatabase(resourceHome(context));
+    const db = getResourceDatabase(resourceHome(context), context.resourceDatabaseMode, context.databaseDeadlineAt);
     const key = digest(JSON.stringify([record.id, input.operationId]));
     const policy = JSON.stringify(budget), now = context.now();
-    const recoveryOwnerAlive = input.operation === "session.resume" && processIsAlive(record);
+    const ownerAlive = processIsAlive(record);
+    const recoveryOwnerAlive = input.operation === "session.resume" && ownerAlive;
     return db.writeTransaction(() => {
         const current = db.get("SELECT * FROM managed_processes WHERE id = ?", [record.id]);
-        if (current?.lease_token !== record.lease_token || current.state !== "running" || current.lease_expires_at <= context.now() || managedProcessBinding(current, resourceHome(context)).registration_sha256 !== managedProcessBinding(record, resourceHome(context)).registration_sha256)
+        if (current?.lease_token !== record.lease_token || current.state !== "running" || !ownerAlive || managedProcessBinding(current, resourceHome(context)).registration_sha256 !== managedProcessBinding(record, resourceHome(context)).registration_sha256)
             throw new AppError("process_ownership_unknown", "Budget owner changed before admission", 1);
+        assertManagedProcessAdmission(context, current);
         try {
             assertScopeAdmission(context, budget.scope_id);
         }
@@ -306,6 +320,9 @@ export function reserveProviderTurn(context, record, input) {
         if (prior) {
             if (prior.lease_token !== record.lease_token)
                 throw new AppError("process_ownership_unknown", "Retained budget claim belongs to another physical owner", 1);
+            const retained = JSON.parse(prior.metadata_json);
+            if (retained.operation_id !== input.operationId || retained.operation !== input.operation || retained.session_id !== (input.sessionId ?? null) || retained.state_dir !== metadata.state_dir || retained.daemon_id !== (input.daemonId ?? null) || retained.prompt_sha256 !== (input.promptSha256 ?? null) || retained.registration_sha256 !== managedProcessBinding(record, resourceHome(context)).registration_sha256)
+                throw new AppError("runtime_budget_conflict", "Retained admission fingerprint differs; reconcile rather than replay", 1, { operation_id: input.operationId });
             return { admitted: true, budget_scope: budget.scope_id, reused: true };
         }
         const activeTurns = db.all("SELECT process_id, metadata_json FROM managed_resources WHERE resource_kind = 'provider-turn' AND json_extract(metadata_json, '$.scope_id') = ? AND json_extract(metadata_json, '$.harness') = ? ORDER BY created_at, resource_key", [budget.scope_id, harness]);
@@ -317,7 +334,7 @@ export function reserveProviderTurn(context, record, input) {
             });
             return { admitted: false, reason: "provider_capacity", budget_scope: budget.scope_id, harness, limit, active, blocking_turns };
         }
-        db.run("INSERT INTO managed_resources (resource_kind, resource_key, owner_id, lease_token, lease_expires_at, process_id, metadata_json, created_at, updated_at) VALUES ('provider-turn', ?, ?, ?, ?, ?, ?, ?, ?)", [key, record.owner_id, record.lease_token, record.lease_expires_at, record.id, JSON.stringify({ scope_id: budget.scope_id, harness, operation_id: input.operationId, operation: input.operation, session_id: input.sessionId ?? null, state_dir: metadata.state_dir }), now, now]);
+        db.run("INSERT INTO managed_resources (resource_kind, resource_key, owner_id, lease_token, lease_expires_at, process_id, metadata_json, created_at, updated_at) VALUES ('provider-turn', ?, ?, ?, ?, ?, ?, ?, ?)", [key, record.owner_id, record.lease_token, record.lease_expires_at, record.id, JSON.stringify({ scope_id: budget.scope_id, harness, operation_id: input.operationId, operation: input.operation, session_id: input.sessionId ?? null, state_dir: metadata.state_dir, daemon_id: input.daemonId ?? null, prompt_sha256: input.promptSha256 ?? null, registration_sha256: managedProcessBinding(record, resourceHome(context)).registration_sha256 }), now, now]);
         return { admitted: true, budget_scope: budget.scope_id, harness, limit, active: active + 1 };
     });
 }
@@ -325,7 +342,7 @@ function scopeRecoveryLoadAllowed(context, scopeId, record, input, physicalOwner
     const metadata = JSON.parse(record.metadata_json);
     if (input.operation !== "session.resume" || !input.daemonId || !metadata.state_dir || metadata.dd_flow_home !== context.ddFlowHome || !physicalOwnerAlive)
         return false;
-    const db = getResourceDatabase(resourceHome(context));
+    const db = getResourceDatabase(resourceHome(context), context.resourceDatabaseMode, context.databaseDeadlineAt);
     const control = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control' AND resource_key = ?", [scopeId]);
     const row = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume' AND resource_key = ?", [scopeId]);
     const intent = row ? JSON.parse(row.metadata_json) : null;
@@ -405,7 +422,7 @@ export function releaseProviderTurns(context, record, input, prepared = prepareP
             throw new AppError("runtime_budget_evidence_invalid", "Only a completed Session creation can release without a tree observation", 1);
         operationIds = [input.operationId];
     }
-    const db = getResourceDatabase(resourceHome(context));
+    const db = getResourceDatabase(resourceHome(context), context.resourceDatabaseMode, context.databaseDeadlineAt);
     let released = 0;
     for (const operationId of operationIds)
         released += db.run("DELETE FROM managed_resources WHERE resource_kind = 'provider-turn' AND process_id = ? AND lease_token = ? AND json_extract(metadata_json, '$.operation_id') = ? AND (? IS NULL OR json_extract(metadata_json, '$.session_id') = ?)", [record.id, record.lease_token, operationId, sessionId, sessionId]).changes;

package/dist/services/runtime-scope-control.js

@@ -21,6 +21,7 @@ const scopeInventoryIdentity = (records) => JSON.stringify(records.map(record =>
  * allowed while publishing: RUN resume and late registration cannot interleave.
  */
 export function retainScopeDrain(context, control, processes, runs, native, probes) {
+    context.assertControlOwner?.();
     const registry = getResourceDatabase(resourceHome(context));
     const targets = new Map();
     const heldTargets = new Set();
@@ -111,6 +112,7 @@ export function retainScopeDrain(context, control, processes, runs, native, prob
             heldTargets.add(target);
         }
         const current = runtimeBudgetStatus(context, control.scope_id);
+        context.assertControlOwner?.();
         if (current.fence || current.control?.generation !== control.generation
             || scopeInventoryIdentity(processes) !== scopeInventoryIdentity(current.processes) || current.provider_turns.length
             || JSON.stringify(current.manifest) !== JSON.stringify(latest.manifest))
@@ -173,6 +175,7 @@ export async function controlRuntimeScopeLocalProbes(context, scopeId, generatio
     return await Promise.all(inventory.filter(record => ["eval-baseline", "eval-observer"].includes(record.kind)).map(async (record) => {
         try {
             const validate = () => {
+                context.assertControlOwner?.();
                 const head = registry.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control' AND resource_key = ?", [scopeId]);
                 if (!head || JSON.parse(head.metadata_json).generation !== generation || JSON.parse(head.metadata_json).requested_mode !== mode || registry.get("SELECT 1 FROM managed_resources WHERE resource_kind = 'provider-fence' AND resource_key = ?", [scopeId]))
                     throw new AppError("runtime_scope_control_superseded", "Local probe control belongs to an old generation", 1);
@@ -210,6 +213,7 @@ export async function controlRuntimeScopeLocalProbes(context, scopeId, generatio
 export async function controlRuntimeScopeNativeOwners(context, scopeId, generation, action = "observe") {
     const registry = getResourceDatabase(resourceHome(context));
     const assertCurrent = () => {
+        context.assertControlOwner?.();
         const row = registry.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control' AND resource_key = ?", [scopeId]);
         if (!row || JSON.parse(row.metadata_json).generation !== generation || action === "stop" && JSON.parse(row.metadata_json).requested_mode !== "stop" || registry.get("SELECT 1 FROM managed_resources WHERE resource_kind = 'provider-fence' AND resource_key = ?", [scopeId]))
             throw new AppError("runtime_scope_control_superseded", "Scope observation belongs to an old generation", 1);
@@ -323,6 +327,7 @@ export async function controlRuntimeScopeNativeOwners(context, scopeId, generati
 }
 /** Scope routing only: existing RUN workers own physical drain and capture. */
 export async function controlRuntimeScopeRuns(context, scopeId, requestId, mode, reconcileId) {
+    context.assertControlOwner?.();
     const control = requestRuntimeScopeControl(context, scopeId, requestId, mode);
     const registry = getResourceDatabase(resourceHome(context));
     const inventory = runtimeBudgetStatus(context, scopeId).processes;
@@ -348,6 +353,7 @@ export async function controlRuntimeScopeRuns(context, scopeId, requestId, mode,
             // Lock order is resource registry then RUN database. No provider or await
             // occurs here; a newer scope request cannot interleave RUN intent creation.
             withDeferredPublications(() => registry.writeTransaction(() => {
+                context.assertControlOwner?.();
                 const current = registry.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control' AND resource_key = ?", [scopeId]);
                 if (!current || JSON.parse(current.metadata_json).generation !== control.generation || registry.get("SELECT 1 FROM managed_resources WHERE resource_kind = 'provider-fence' AND resource_key = ?", [scopeId]))
                     throw new AppError("runtime_scope_control_superseded", "Scope request no longer owns admission", 1);
@@ -363,6 +369,7 @@ export async function controlRuntimeScopeRuns(context, scopeId, requestId, mode,
                 recordRunControlIntent(target, input);
             }));
             seen.add(key);
+            context.assertControlOwner?.();
             const receipt = await requestRunControl(target, { ...input, waitMs: 0, ...(reconcileId ? { reconcileId: crypto.createHash("sha256").update(JSON.stringify([scopeId, control.generation, reconcileId])).digest("hex") } : {}) });
             runs.push({ runtime_home: metadata.dd_flow_home, project_id: record.project_id, run_id: record.run_id, request_id: input.requestId, receipt });
         }
@@ -379,6 +386,7 @@ export async function controlRuntimeScopeRuns(context, scopeId, requestId, mode,
         controlRuntimeScopeNativeOwners(context, scopeId, control.generation, mode === "stop" ? "stop" : "observe"),
         controlRuntimeScopeLocalProbes(context, scopeId, control.generation, mode)
     ]);
+    context.assertControlOwner?.();
     for (const run of runs) {
         if (run.pending || typeof run.runtime_home !== "string" || typeof run.run_id !== "string")
             continue;