@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.138

package/dist/services/run-control.js

@@ -292,6 +292,34 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
     const nativeVersions = new Map();
     for (const [directory, { state, records }] of daemonInventories) {
         let failedStart = null;
+        // Explicit stop can reconcile a retired owner whose last bookkeeping ACK
+        // failed. This is physical retirement, not a fabricated clean shutdown.
+        if (control?.action === "stop" && state.shutdown_state === "cleanup_failed")
+            try {
+                const daemonId = state.daemon_id ?? state.config?.daemonId;
+                const daemon = records.filter(record => record.kind.endsWith("-daemon"));
+                const provider = records.filter(record => record.kind.endsWith("-provider"));
+                const operations = retainedDaemonOperations(directory);
+                const owner = state.config?.runtime_owner;
+                if (daemonId && !conflicts.has(directory) && !unsafeDaemons.has(canonicalPath(directory, false))
+                    && state.active_tree === false && !state.active_operation && state.shutdown?.daemon_id === daemonId
+                    && state.shutdown.phases?.tree === true && state.shutdown.phases.provider === true
+                    && daemon.length === 1 && provider.length === 1 && records.length === 2
+                    && daemon[0].id === state.resource_process?.id && daemon[0].lease_token === state.resource_process.lease_token && daemon[0].pid === state.pid
+                    && provider[0].id === state.provider_process?.id && provider[0].lease_token === state.provider_process.lease_token && provider[0].pid === state.provider_pid
+                    && JSON.parse(daemon[0].metadata_json).dispatch_barrier === "run-generation@1"
+                    && records.every(record => record.pid && record.pid_started_at && ["stopped", "failed"].includes(record.state) && record.finished_at && !processTreeIsAlive(record))
+                    && operations.length > 0 && operations.every(operation => ["completed", "failed", "interrupted"].includes(String(operation.state))
+                    && (operation.operation === "daemon.start" ? operation.daemon_id === null && operation.launch?.runtime_owner === JSON.stringify(owner)
+                        : operation.daemon_id === daemonId && ["daemon.stop", "daemon.status", "session.create", "session.prompt", "session.start", "session.fork", "session.resume", "session.cancel", "session.inspect"].includes(String(operation.operation))
+                            && (operation.session_id == null || state.sessions.some(item => (typeof item === "string" ? item : adapterSessionId(item)) === operation.session_id))))) {
+                    nativeVersions.set(directory, nativeInventoryVersion(directory, operations));
+                    closedDaemons.set(directory, { source: "observed_owned_retirement", daemon_id: daemonId, stopped: true, settled: true,
+                        session_ids: state.sessions.map(item => typeof item === "string" ? item : adapterSessionId(item)),
+                        processes: records.map(record => ({ process_id: record.id, pid: record.pid, pid_started_at: record.pid_started_at })) });
+                }
+            }
+            catch { /* Invalid or unfinished evidence remains on the existing recovery path. */ }
         if (!interrupt) {
             try {
                 const nativeOperations = retainedDaemonOperations(directory);
@@ -309,16 +337,48 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
                     const saved = JSON.parse(operation.input_json);
                     return saved.owner === owner?.owner_id && saved.executable === directoryAdapters.get(directory) && saved.args?.[0] === "daemon" && saved.args?.[1] === "start" && saved.args.includes("--state-dir") && saved.args[saved.args.indexOf("--state-dir") + 1] === directory;
                 });
+                const cleanup = start?.error?.details;
+                const proof = cleanup?.startup_child_cleanup;
+                let ownedChildGone = false;
+                if (proof && !cleanup?.provider_cleanup_failed && !cleanup?.cleanup_failed && provider.length === 0 && !state.provider_process && state.provider_pid == null
+                    && daemon.length === 1 && daemon[0].pid === null && daemon[0].pid_started_at === null
+                    && proof.settled === true && proof.physical_exit === "ESRCH" && proof.daemon_id === state.daemon_id
+                    && proof.process_id === daemon[0].id
+                    && proof.pid === state.pid && Number.isSafeInteger(proof.pid) && Number(proof.pid) > 0
+                    && proof.pgid === (process.platform === "win32" ? null : proof.pid)
+                    && typeof proof.observed_at === "string" && Number.isFinite(Date.parse(proof.observed_at))
+                    && proof.owner_id === owner?.owner_id && proof.project_id === project.id && proof.run_id === input.runId
+                    && proof.operation_id === start?.operation_id && proof.operation_id === owner?.operation_id && proof.state_dir === directory) {
+                    let leaderGone = false;
+                    try {
+                        process.kill(Number(proof.pid), 0);
+                    }
+                    catch (error) {
+                        leaderGone = error.code === "ESRCH";
+                    }
+                    if (leaderGone) {
+                        if (process.platform === "win32")
+                            ownedChildGone = true;
+                        else {
+                            try {
+                                process.kill(-Number(proof.pgid), 0);
+                            }
+                            catch (error) {
+                                ownedChildGone = error.code === "ESRCH";
+                            }
+                        }
+                    }
+                }
                 if (state.shutdown_state === "starting" && state.sessions?.length === 0 && state.active_tree !== true && !state.active_operation
                     && start?.operation === "daemon.start" && start.state === "failed" && start.predecessor_daemon_id === null && start.daemon_id === null
                     && typeof state.daemon_id === "string" && controllerStarts.length === 1 && starts.length === 1 && starts[0].operation_id === start.operation_id
                     && launch?.runtime_owner === JSON.stringify(owner)
                     && daemon.length === 1 && provider.length <= 1 && records.length === daemon.length + provider.length
                     && daemon[0].id === state.resource_process?.id && daemon[0].lease_token === state.resource_process.lease_token
-                    && (state.pid == null || state.pid === daemon[0].pid)
+                    && (state.pid == null || state.pid === daemon[0].pid || ownedChildGone)
                     && (!state.provider_process && state.provider_pid == null && provider.length === 0 || provider.length === 1 && provider[0].id === state.provider_process?.id && provider[0].lease_token === state.provider_process.lease_token && state.provider_pid === provider[0].pid)
-                    && records.every(record => record.pid && record.pid_started_at && !processTreeIsAlive(record) && ["stopped", "failed"].includes(record.state) && Boolean(record.finished_at))) {
-                    failedStart = { source: "failed_start_without_create", daemon_id: state.daemon_id, operation_id: start.operation_id, session_ids: [], processes: records.map(record => ({ process_id: record.id, pid: record.pid, pid_started_at: record.pid_started_at })) };
+                    && records.every(record => (record.pid && record.pid_started_at && !processTreeIsAlive(record) || ownedChildGone && record === daemon[0]) && ["stopped", "failed"].includes(record.state) && Boolean(record.finished_at))) {
+                    failedStart = { source: "failed_start_without_create", daemon_id: state.daemon_id, operation_id: start.operation_id, session_ids: [], processes: records.map(record => ({ process_id: record.id, pid: record.pid, pid_started_at: record.pid_started_at })), ...(ownedChildGone ? { startup_child_cleanup: proof } : {}) };
                     closedDaemons.set(directory, failedStart);
                 }
                 for (const operation of nativeOperations)
@@ -331,6 +391,8 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
                 unresolved.push({ state_dir: directory, status: "pending", reason: "daemon_operation_inventory_invalid" });
             }
         }
+        if (closedDaemons.get(directory)?.source === "observed_owned_retirement")
+            continue;
         if (state.shutdown_state !== "clean") {
             if (state.shutdown_state === "unclean")
                 unresolved.push({ state_dir: directory, status: "pending", reason: "native_shutdown_unclean" });
@@ -634,11 +696,17 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
         const nativeOperations = retainedDaemonOperations(directory);
         const targetList = [...targets.values()];
         const sessionsSettled = ids.every(id => nodes.some((node, index) => targetList[index]?.session.state_dir === directory && targetList[index]?.session.id === id && node.status === "completed"));
-        // A confirmed failed tree guard admits a new shutdown attempt only after
-        // fresh tree settlement. Unknown outcomes retain their original ID.
+        // A confirmed failure may retry the same incarnation's settled tree or
+        // remaining idempotent resource finish. Unknown outcomes keep their ID.
         if (sessionsSettled) {
+            const remainingFinish = state.shutdown_state === "cleanup_failed" && state.active_tree === false
+                && state.shutdown?.daemon_id === daemonId && state.shutdown.phases?.tree === true
+                && state.shutdown.required_phases?.includes("daemon_resource")
+                && state.shutdown.phases.daemon_resource !== true
+                && state.shutdown.required_phases.every(phase => phase === "daemon_resource" || state.shutdown.phases[phase] === true);
             while (nativeOperations.some(operation => operation.operation_id === operationId && operation.daemon_id === daemonId && operation.operation === "daemon.stop"
-                && operation.state === "failed" && operation.error?.code === "tree_not_settled"))
+                && operation.state === "failed" && (operation.error?.code === "tree_not_settled"
+                || remainingFinish && operation.error?.code === "process_maintenance_timeout")))
                 operationId += ":finalize";
         }
         assertCurrent();
@@ -697,11 +765,13 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             const executable = directoryAdapters.get(directory);
             if (!inventory)
                 continue;
+            const pending = retainedDaemonOperations(directory).filter(operation => operation.daemon_id === daemonId && ["running", "awaiting_provider"].includes(String(operation.state)) && ["session.create", "session.prompt", "session.start", "session.fork", "session.resume"].includes(String(operation.operation)) && typeof operation.operation_id === "string");
+            if (!pending.length)
+                continue;
             if (!daemonId || !executable || !node.operation_id) {
                 terminalizedOperations.push({ state_dir: directory, status: "pending", reason: "operation_terminalization_binding_unknown" });
                 continue;
             }
-            const pending = retainedDaemonOperations(directory).filter(operation => operation.daemon_id === daemonId && ["running", "awaiting_provider"].includes(String(operation.state)) && ["session.create", "session.prompt", "session.start", "session.fork", "session.resume"].includes(String(operation.operation)) && typeof operation.operation_id === "string");
             terminalizedOperations.push(...await Promise.all(pending.map(async (operation) => {
                 try {
                     const operationId = operation.operation_id, sessionId = typeof operation.session_id === "string" ? operation.session_id : null;
@@ -795,7 +865,8 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             verifyInventory();
         }
         catch (error) {
-            unresolved.push({ status: "pending", reason: error instanceof AppError && error.code === "owned_inventory_changed" ? error.code : "owned_inventory_recheck_failed" });
+            unresolved.push({ status: "pending", reason: error instanceof AppError && error.code === "owned_inventory_changed" ? error.code : "owned_inventory_recheck_failed",
+                ...(error instanceof AppError && error.code === "owned_inventory_changed" ? { components: error.details.components } : {}) });
         }
     }
     assertCurrent();
@@ -818,7 +889,7 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
 }
 export function nativeInventoryVersion(directory, operations = retainedDaemonOperations(directory)) {
     const state = JSON.parse(fs.readFileSync(path.join(directory, "daemon.json"), "utf8"));
-    const keys = ["schema_id", "daemon_id", "config", "pid", "provider_pid", "shutdown_state", "active_operation", "active_tree", "sessions", "descendants", "root_session_id", "resource_process", "provider_process", "owned_processes"];
+    const keys = ["schema_id", "daemon_id", "config", "pid", "provider_pid", "shutdown_state", "shutdown", "active_operation", "active_tree", "sessions", "descendants", "root_session_id", "resource_process", "provider_process", "owned_processes"];
     // Only these native verbs are read-only. Unknown verbs remain guarded.
     const productive = operations.filter(operation => !isObservationOperation(operation.operation));
     return crypto.createHash("sha256").update(JSON.stringify([Object.fromEntries(keys.map(key => [key, state[key]])), productive])).digest("hex");

package/dist/services/run-controller-capture.js

@@ -6,7 +6,7 @@ import { createEvalRunSnapshot, verifyControllerBoundarySnapshot } from "./eval-
 import { observeControllerBoundary } from "./run-control.js";
 import { assertRunMutationAllowed, recoveryGuard } from "./run-recovery.js";
 import { appendEvent, digest, errorRecord, requireController, requireRun } from "./run-controller-state.js";
-import { getFlowRunStatus } from "./runs.js";
+import { getFlowRunStatus, readFlowRunExecutionBundle } from "./runs.js";
 import { recoveryObservationBudget, withRecoveryObservation } from "./recovery-observation-budget.js";
 import { getResourceDatabase } from "../storage/database.js";
 import { managedProcessBinding, resourceHome } from "./managed-processes.js";
@@ -60,6 +60,7 @@ export async function captureControllerBoundary(context, row, manifest, stage, n
             throw error;
         }
     }
+    const preparedBundle = readFlowRunExecutionBundle(context, scope);
     const assertStartOwner = prepareControllerPublication(context, row, assertPhysicalOwner);
     context.db.writeTransaction(() => {
         assertStartOwner();
@@ -82,7 +83,7 @@ export async function captureControllerBoundary(context, row, manifest, stage, n
         if (!current || !["done", "skipped"].includes(current.status) || digest(identity(current)) !== boundaryKey)
             throw new AppError("controller_boundary_changed", "Stage identity changed after its capture fence", 1);
         if (physical) {
-            const continuation = getFlowRunStatus(context, scope).continuation;
+            const continuation = getFlowRunStatus(context, scope, preparedBundle ?? undefined).continuation;
             const stoppedAtTarget = nextStage === null && manifest.request.stop_after === stage.stage && continuation.kind === "start_stage";
             if (nextStage ? continuation.kind !== "start_stage" || continuation.stage !== nextStage : continuation.kind !== "terminal" && !stoppedAtTarget)
                 throw new AppError("controller_boundary_changed", "Stage successor changed after its capture fence", 1);
@@ -123,7 +124,13 @@ export async function captureControllerBoundary(context, row, manifest, stage, n
                 assertCurrent();
                 context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(COALESCE(receipt_json, '{}'), '$.recovery_observation', json(?)), updated_at = ? WHERE operation_id = ?", [JSON.stringify(observationBudget.state()), context.now(), operationId]);
                 let verify = () => { throw new AppError("controller_boundary_unsettled", "Boundary has no stable writer observation", 1); };
-                const observation = await withRecoveryObservation(observationBudget, () => observeControllerBoundary(context, { ...scope, controllerId: row.controller_id, operationId, assertCurrent, retainVerification: value => { verify = value; } }));
+                const observation = await withRecoveryObservation(observationBudget, () => observeControllerBoundary(context, { ...scope, controllerId: row.controller_id, operationId, assertCurrent, retainVerification: value => {
+                        verify = () => {
+                            value();
+                            if (readFlowRunExecutionBundle(context, scope)?.sha256 !== preparedBundle?.sha256)
+                                throw new AppError("controller_boundary_changed", "Frozen bundle changed before snapshot publication", 1);
+                        };
+                    } }));
                 if (observation.settled === true) {
                     try {
                         createEvalRunSnapshot(context, { ...scope, output, ...(nextStage ? { stageEntry: nextStage } : { candidate: true }), boundary: { controllerId: row.controller_id, operationId, boundaryKey, observation, verify } });

package/dist/services/run-controller-process.js

@@ -48,6 +48,22 @@ export function assertControllerRecoveryAllowed(context, row) {
         || !context.db.get("SELECT 1 FROM run_controls WHERE control_id = ? AND recovery_id = ? AND status = 'resuming'", [state.recovery.control_id, state.recovery.recovery_id]))
         throw new AppError("run_control_superseded", "Controller launch no longer owns the accepted recovery", 1);
 }
+/** An admitted physical owner may renew while closing a terminal RUN. This
+ * does not admit a new owner or release a recovery/generation fence. */
+export function assertControllerLeaseAllowed(context, row) {
+    const current = requireController(context, row.controller_id);
+    if (current.owner_token !== row.owner_token || current.generation !== row.generation
+        || current.owner_pid !== process.pid || current.process_id !== row.process_id
+        || current.process_lease_token !== row.process_lease_token || !current.process_id || !current.process_lease_token
+        || !["running", "capturing", "waiting_for_user", "waiting_for_context", "waiting_for_children", "waiting_for_capacity", "waiting_for_merge"].includes(current.status))
+        throw new AppError("controller_owner_mismatch", "Lease renewal no longer owns this physical controller", 1);
+    const run = requireRun(context, current.project_id, current.run_id);
+    if ((["done", "failed", "cancelled"].includes(run.status) || current.status === "capturing") && launchRecord(context, current)?.value.dispatch_ready === true) {
+        assertControllerRecoveryAllowed(context, current);
+        return;
+    }
+    assertLaunchAllowed(context, current);
+}
 function retire(context, row, identity) {
     const record = managedProcessStatus(context).find(item => item.id === identity.id);
     if (!record || record.kind !== "run-controller" || record.owner_id !== row.controller_id || record.project_id !== row.project_id || record.run_id !== row.run_id
@@ -123,6 +139,10 @@ export function claimControllerProcess(context, row) {
         throw new AppError("controller_owner_mismatch", "Managed registration is not authorized", 1);
     const owner = birth();
     context.db.writeTransaction(() => {
+        // Recovery fences are reconciled by serve's retained failure boundary;
+        // only terminal admission must reject before claiming a physical owner.
+        if (["done", "failed", "cancelled"].includes(requireRun(context, row.project_id, row.run_id).status))
+            throw new AppError("invalid_run_state", "A terminal RUN cannot start a physical controller", 1);
         const claimed = context.db.run("UPDATE run_controllers SET owner_pid = ?, status = 'running', updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [process.pid, context.now(), row.controller_id, row.owner_token]);
         if (claimed.changes !== 1)
             throw new AppError("controller_already_owned", "Managed owner has already claimed this launch", 1);
@@ -142,6 +162,7 @@ export function claimControllerProcess(context, row) {
     }
 }
 export function markControllerDispatchReady(context, row) {
+    assertLaunchAllowed(context, row);
     context.db.run("UPDATE run_controller_operations SET receipt_json = json_set(receipt_json, '$.dispatch_ready', json('true')), updated_at = ? WHERE operation_id = ?", [context.now(), launchId(row)]);
 }
 export async function spawnController(context, row) {

package/dist/services/run-controller-recovery.js

@@ -10,6 +10,7 @@ import { verifyRecoverySnapshot } from "./eval-snapshots.js";
 import { recoveryGuard, resumeRunRecovery } from "./run-recovery.js";
 import { prepareRunRecoveryDispatch, retainRecoveryCapacityIntent } from "./run-recovery-runtime.js";
 import { runtimeHarness } from "./execution-policy.js";
+import { selectControllerExecution } from "./controller-execution.js";
 import { managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, processStartedAt } from "./managed-processes.js";
 import { requireRun, requireController, controllerReceipt, appendEvent, saveState, digest, errorRecord } from "./run-controller-state.js";
 import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
@@ -74,7 +75,8 @@ export function prepareControllerResume(context, input) {
         if (!guard || guard.recovery_id !== control?.recovery_id || guard.status !== "sealed" || control.status !== "settled" || !guard.capture_path || JSON.parse(guard.settlement_json ?? "{}").settled !== true)
             throw new AppError("run_control_not_resumable", "Resume requires the current settled control and its immutable recovery capture", 1);
         const manifest = JSON.parse(row.manifest_json), state = JSON.parse(row.state_json);
-        if (!manifest.execution_profile?.settings.execution || !manifest.execution_profile.agent_profiles || !path.isAbsolute(manifest.resource_home) || !path.isAbsolute(manifest.flow_executable))
+        selectControllerExecution(context, run, manifest);
+        if (!path.isAbsolute(manifest.resource_home) || !path.isAbsolute(manifest.flow_executable))
             throw new AppError("controller_manifest_invalid", "Resume requires the original frozen controller manifest", 1);
         if (state.current_session === null || !state.sessions[state.current_session]?.id)
             throw new AppError("recovery_owner_missing", "Resume requires the retained coordinator Session", 1);

package/dist/services/run-controller-state.js

@@ -3,7 +3,7 @@ import { AppError, errorRecord as structuredErrorRecord } from "../shared/errors
 import { runtimeHarness } from "./execution-policy.js";
 import { managedProcessRuntimeHome, managedProcessStatus, processTreeIsAlive } from "./managed-processes.js";
 export function requireRun(context, projectId, runId) {
-    const run = context.db.get("SELECT id, project_id, project_root, workspace_root, run_root, status, index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+    const run = context.db.get("SELECT id, project_id, flow_kind, project_root, workspace_root, run_root, status, index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
     if (!run?.run_root)
         throw new AppError("not_found", "Managed RUN has no materialized root", 1, { run_id: runId });
     return run;

package/dist/services/run-controller.js

@@ -1,4 +1,9 @@
 import { assertLifecycleOutcomes, currentLifecycleFailure, managedInvocationContext, managedLifecycleCommand } from "./lifecycle-invocations.js";
+export function recoveryPacketMatchesStage(packet, scope) {
+    return packet.schema_id === 'dd-flow/root-recovery-packet@1' && packet.continuation === 'unfinished_work'
+        && packet.run_id === scope.runId && packet.generation === scope.generation && packet.stage === scope.stage
+        && packet.work_id === scope.workId && packet.paused === false;
+}
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -13,10 +18,11 @@ import { prepareFileBytes, prepareJsonText } from "../cli/input-preparation.js";
 import { parseRuntimeBudget } from "./runtime-budget.js";
 import { requireProjectByRoot } from "./projects.js";
 import { assertRunMutationAllowed, recoveryGuard } from "./run-recovery.js";
-import { getFlowRunStatus, setFlowRunRecoveryPaused } from "./runs.js";
+import { getFlowRunStatus, setFlowRunRecoveryPaused, assertPreparedRunBundleSqlAuthority } from "./runs.js";
 import { loadExternalStageContext } from "./stage-context.js";
 import { flowCommand } from "./stage-pause.js";
-import { resolveStageTransition, sameSessionProfile, stageExecutionCwd, runtimeHarness } from "./execution-policy.js";
+import { sameSessionProfile, runtimeHarness } from "./execution-policy.js";
+import { selectControllerExecution } from "./controller-execution.js";
 import { resolveHarnessCommand, harnessRuntimeArguments } from "./harness-config.js";
 import { adapterSessionId, prepareHarnessFlowExecutable, runHarnessAdapter } from "./harness-adapter.js";
 import { assertManagedProcessLease, confirmManagedProcess, renewManagedProcess, finishManagedProcess, processStartedAt, processTreeIsAlive, resourceHome } from "./managed-processes.js";
@@ -29,7 +35,7 @@ import { claimQueuedMergeRequest } from "./merge-server.js";
 import { prepareVnextCodeWorkspace } from "./vnext-code.js";
 import { requireRun, requireController, controllerReceipt, appendEvent, saveState, retainControllerContinuation, retainControllerCapacityIntent, digest, digestBytes, errorRecord } from "./run-controller-state.js";
 import { assertNoCorrelatedRejection } from "./continuation-outcome.js";
-import { spawnController, recordControllerLauncher, claimControllerProcess, markControllerDispatchReady, assertControllerRecoveryAllowed } from "./run-controller-process.js";
+import { spawnController, recordControllerLauncher, claimControllerProcess, markControllerDispatchReady, assertControllerLeaseAllowed } from "./run-controller-process.js";
 import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
 import { retainedChildObserver } from "./controller-child-observer.js";
 import { capacityDelay, continueCodexCapacity, eligibleCodexChildOverload } from "./codex-capacity.js";
@@ -40,6 +46,11 @@ import { storageSessionId } from "./session-identity.js";
 import { CAPACITY_POLICY, nativeItemsSettled, overloadBurst, refusalObservation, terminalCodexOverload } from "../harness-runtime/lib/codex-capacity-policy.mjs";
 import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
 export { resumeRunController } from "./run-controller-recovery.js";
+const preparedLaunchInputs = new WeakMap();
+function launchInputDigest(input) {
+    return digest([input.projectRoot, input.runId, input.requestId, input.contextFile, input.contextSha256,
+        input.stopAfter ?? null, input.captureRoot ?? null]);
+}
 export function prepareRunControllerLaunch(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.requestId) || !/^[a-f0-9]{64}$/.test(input.contextSha256))
         throw new AppError("usage", "Managed launch needs a request id and context SHA-256", 2);
@@ -60,58 +71,79 @@ export function prepareRunControllerLaunch(context, input) {
     if (existing) {
         if (existing.request_hash !== requestHash)
             throw new AppError("runtime_request_conflict", "Managed launch request id has different inputs", 1);
-        return { kind: "replay", existing };
+        selectControllerExecution(context, run, JSON.parse(existing.manifest_json));
+        const prepared = { kind: "replay", existing };
+        preparedLaunchInputs.set(prepared, { home: context.ddFlowHome, sha256: launchInputDigest(input) });
+        return prepared;
     }
     const generation = assertRunMutationAllowed(context, project.id, run.id);
     if (run.status !== "running")
         throw new AppError("invalid_run_state", "Managed launch requires a running logical RUN", 1, { status: run.status });
-    const index = JSON.parse(run.index_json);
-    const execution = index.execution_profile;
-    if (!execution?.settings.execution || !execution.agent_profiles)
-        throw new AppError("execution_profile_not_frozen", "Managed launch requires the RUN's frozen execution profiles", 1);
+    const routing = selectControllerExecution(context, run);
     const contexts = readContexts(input.contextFile, input.contextSha256);
+    if (routing.bundle) {
+        for (const stage of [...Object.keys(contexts), ...(input.stopAfter ? [input.stopAfter] : [])])
+            routing.bundle.descriptor.stage(stage);
+    }
     const next = getFlowRunStatus(context, { projectRoot: project.root, runId: run.id }).continuation;
     if (next.kind !== "start_stage" || !next.stage)
         throw new AppError("controller_attach_required", "Managed launch cannot replace an attached or unfinished coordinator; reconcile its existing owner", 1, { continuation: next });
     if (!contexts[next.stage])
         throw new AppError("controller_context_missing", "Managed context omits the first stage", 2, { stage: next.stage });
     const adapters = {};
-    for (const profile of Object.values(execution.agent_profiles)) {
+    for (const profile of Object.values(routing.profiles)) {
         const harness = runtimeHarness(profile);
         adapters[harness] = { executable: resolveHarnessCommand(context.ddFlowHome, harness, "adapter"), runtime_args: harnessRuntimeArguments(context.ddFlowHome, harness) };
     }
     const entry = fileURLToPath(new URL("../cli.js", import.meta.url));
     if (!fs.existsSync(entry))
         throw new AppError("harness_runtime_unbuilt", "Build the CLI before launching its detached controller", 1);
-    return { kind: "create", project, run, request, requestHash, generation, budget, execution, contexts, adapters };
+    const prepared = { kind: "create", project, run, request, requestHash, generation, budget, routing, contexts, adapters };
+    preparedLaunchInputs.set(prepared, { home: context.ddFlowHome, sha256: launchInputDigest(input) });
+    return prepared;
 }
-export async function launchRunController(context, input, prepared = prepareRunControllerLaunch(context, input)) {
-    if (prepared.kind === "replay")
-        return { ...await spawnController(context, prepared.existing), reused: true };
-    const { project, run, request, requestHash, generation, budget, execution, contexts, adapters } = prepared;
+/** Retain the existing launch intent and frozen inputs without starting a
+ * process. Dispatch remains exclusively owned by launchRunController. */
+export function retainRunControllerLaunch(context, input, prepared = prepareRunControllerLaunch(context, input)) {
+    const selection = preparedLaunchInputs.get(prepared);
+    if (!selection || selection.home !== context.ddFlowHome || selection.sha256 !== launchInputDigest(input)) {
+        throw new AppError("runtime_request_conflict", "Controller launch differs from its prepared request", 1, { effect: "no_effect" });
+    }
+    if (prepared.kind === "replay") {
+        const current = requireController(context, prepared.existing.controller_id);
+        if (current.request_hash !== prepared.existing.request_hash)
+            throw new AppError("runtime_request_conflict", "Controller launch authority changed after replay preparation", 1);
+        selectControllerExecution(context, requireRun(context, current.project_id, current.run_id), JSON.parse(current.manifest_json));
+        return { controller: current, reused: true };
+    }
+    const { project, run, request, requestHash, generation, budget, routing, contexts, adapters } = prepared;
     assertRunMutationAllowed(context, project.id, run.id, generation);
     ensureRunControllerStorage(context.db);
     const controllerId = `DRV-${crypto.randomUUID()}`;
     const root = path.join(run.run_root, "controllers", controllerId);
     fs.mkdirSync(root, { recursive: true, mode: 0o700 });
-    const flowExecutable = prepareHarnessFlowExecutable(context, root);
+    const flowExecutable = prepareHarnessFlowExecutable(context, root, routing.bundle?.engine());
     const frozenContexts = {};
     for (const [stage, value] of Object.entries(contexts)) {
         const file = path.join(root, `${stage}.context.json`);
         fs.writeFileSync(file, value.bytes, { flag: "wx", mode: 0o600 });
         frozenContexts[stage] = { file, sha256: value.sha256 };
     }
-    const manifest = { schema_id: "dd-flow/run-controller-manifest@1", request, execution_profile: execution, contexts: frozenContexts, adapters, flow_executable: flowExecutable, resource_home: resourceHome(context), budget };
+    const manifest = { schema_id: routing.kind === "descriptor" ? "dd-flow/run-controller-manifest@2" : "dd-flow/run-controller-manifest@1", request,
+        ...(routing.kind === "descriptor" ? { execution_binding: routing.binding } : { execution_profile: routing.legacy }),
+        contexts: frozenContexts, adapters, flow_executable: flowExecutable, resource_home: resourceHome(context), budget };
     const token = crypto.randomUUID();
     const now = context.now();
     const state = { stage: null, sessions: [], current_session: null, turns: 0, last_continuation: null };
     const launcher = { pid: process.pid, pid_started_at: processStartedAt(process.pid) };
     const duplicate = context.db.writeTransaction(() => {
+        if (routing.bundle)
+            assertPreparedRunBundleSqlAuthority(context, { projectId: project.id, runId: run.id }, routing.bundle);
         const duplicate = context.db.get("SELECT * FROM run_controllers WHERE project_id = ? AND run_id = ? AND request_id = ?", [project.id, run.id, input.requestId]);
         if (duplicate) {
             if (duplicate.request_hash !== requestHash)
                 throw new AppError("runtime_request_conflict", "Managed launch request id has different inputs", 1);
-            return { ...controllerReceipt(duplicate), reused: true };
+            return duplicate;
         }
         assertRunMutationAllowed(context, project.id, run.id, generation);
         if (requireRun(context, project.id, run.id).status !== "running")
@@ -126,9 +158,16 @@ export async function launchRunController(context, input, prepared = prepareRunC
         appendEvent(context, controllerId, "launch_requested", { request_id: input.requestId, generation, request_hash: requestHash });
         return null;
     });
-    if (duplicate)
-        return duplicate;
-    return await spawnController(context, requireController(context, controllerId));
+    return { controller: duplicate ?? requireController(context, controllerId), reused: duplicate !== null };
+}
+export async function launchRunController(context, input, prepared = prepareRunControllerLaunch(context, input)) {
+    const retained = retainRunControllerLaunch(context, input, prepared);
+    // A simultaneous publisher already owns dispatch. Preserve the original
+    // race behavior: only an explicit replay may reconcile that existing owner.
+    if (prepared.kind === "create" && retained.reused)
+        return { ...controllerReceipt(retained.controller), reused: true };
+    const receipt = await spawnController(context, retained.controller);
+    return retained.reused ? { ...receipt, reused: true } : receipt;
 }
 /**
  * A registry write can be temporarily unavailable while another runtime client
@@ -179,6 +218,7 @@ export async function serveRunController(context, input) {
         throw new AppError("controller_owner_mismatch", "Managed owner has no resource lease", 1);
     const confirmed = confirmManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
     const lease = controllerLeaseMonitor(attemptMs => renewManagedProcess({ ...context, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: Date.now() + attemptMs }, { id: row.process_id, leaseToken: row.process_lease_token }), confirmed.lease_expires_at);
+    const state = JSON.parse(row.state_json);
     // Resource and RUN commits are distinct effects. A RUN keepalive failure must
     // neither erase a resource receipt nor grant RUN dispatch authority.
     const mergeLease = controllerLeaseMonitor(attemptMs => {
@@ -194,21 +234,19 @@ export async function serveRunController(context, input) {
         return { owned: true, lease_expires_at: expiry };
     });
     const assertLeaseFence = () => {
-        const current = requireController(context, row.controller_id);
-        if (current.owner_token !== row.owner_token || current.generation !== row.generation)
-            throw new AppError("controller_owner_mismatch", "Lease renewal no longer owns this controller generation", 1);
-        assertControllerRecoveryAllowed(context, current);
+        assertControllerLeaseAllowed(context, row);
     };
     const heartbeat = setInterval(() => {
         lease.background(assertLeaseFence, () => { });
-        mergeLease.background(assertLeaseFence, () => { });
+        if (state.merge_claim)
+            mergeLease.background(assertLeaseFence, () => { });
     }, 30_000);
     heartbeat.unref();
     const manifest = JSON.parse(row.manifest_json);
-    const state = JSON.parse(row.state_json);
     const assertPhysicalOwner = () => {
         lease.assertNoRenewal();
-        mergeLease.assertNoRenewal();
+        if (state.merge_claim)
+            mergeLease.assertNoRenewal();
         assertManagedProcessLease({ ...context, databaseDeadlineAt: Date.now() + 5_000 }, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid });
         const current = requireController(context, row.controller_id);
         if (current.owner_pid !== process.pid || current.owner_token !== row.owner_token || !["running", "capturing", "waiting_for_user", "waiting_for_context", "waiting_for_children", "waiting_for_capacity", "waiting_for_merge"].includes(current.status))
@@ -221,7 +259,8 @@ export async function serveRunController(context, input) {
     };
     try {
         await lease.ensureConfirmed(assertLeaseFence);
-        await mergeLease.ensureConfirmed(assertLeaseFence);
+        if (state.merge_claim)
+            await mergeLease.ensureConfirmed(assertLeaseFence);
         context.db.writeTransaction(() => {
             markControllerDispatchReady(context, row);
             if (!state.recovery && (recoveryGuard(context, row.project_id, row.run_id)?.generation ?? 0) === row.generation && requireRun(context, row.project_id, row.run_id).status === "paused")
@@ -230,7 +269,8 @@ export async function serveRunController(context, input) {
         appendEvent(context, row.controller_id, "owner_started", { pid: process.pid, generation: row.generation });
         if (state.recovery && !["done", "failed", "cancelled"].includes(requireRun(context, row.project_id, row.run_id).status))
             await resumeControllerSession(context, row, manifest, state, assertPhysicalOwner);
-        await executeController(context, row, manifest, state, assertOwner, assertPhysicalOwner, async () => { await lease.ensureConfirmed(assertLeaseFence); await mergeLease.ensureConfirmed(assertLeaseFence); });
+        await executeController(context, row, manifest, state, assertOwner, assertPhysicalOwner, async () => { await lease.ensureConfirmed(assertLeaseFence); if (state.merge_claim)
+            await mergeLease.ensureConfirmed(assertLeaseFence); });
         return controllerReceipt(requireController(context, row.controller_id));
     }
     catch (error) {
@@ -449,8 +489,9 @@ async function executeController(context, row, manifest, state, assertOwnership,
             }
         }
     };
-    const policy = manifest.execution_profile.settings.execution;
-    const profiles = manifest.execution_profile.agent_profiles;
+    const routing = selectControllerExecution(context, requireRun(context, row.project_id, row.run_id), manifest);
+    const policy = routing.policy;
+    const profiles = routing.profiles;
     let executionContext = { ...context, env: { ...context.env, DD_FLOW_BIN: manifest.flow_executable, DD_FLOW_RESOURCE_HOME: manifest.resource_home, DD_FLOW_RUNTIME_BUDGET: manifest.budget ? JSON.stringify(manifest.budget) : undefined, DD_FLOW_CODE_READINESS_OWNER: row.controller_id } };
     const bindInvocationScope = (session) => {
         executionContext = managedInvocationContext(executionContext, { harness: runtimeHarness(session.profile), stateDir: session.state_dir, sessionId: session.id,
@@ -745,7 +786,10 @@ async function executeController(context, row, manifest, state, assertOwnership,
             if (state.current_session !== null && !state.sessions[state.current_session].stopped)
                 bindInvocationScope(state.sessions[state.current_session]);
             const run = requireRun(context, row.project_id, row.run_id);
-            if (state.pending_capacity && !["done", "failed", "cancelled"].includes(run.status)) {
+            const view = getFlowRunStatus(executionContext, { projectRoot: run.project_root, runId: run.id });
+            const next = view.continuation;
+            terminalFinalization = next.kind === "terminal";
+            if (state.pending_capacity && next.kind !== "terminal" && !["done", "failed", "cancelled"].includes(run.status)) {
                 const pending = state.pending_capacity;
                 const session = state.sessions.find(item => item.id === pending.session_id && !item.stopped);
                 const operation = context.db.get("SELECT input_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [pending.root_operation_id, row.controller_id, row.generation]);
@@ -757,9 +801,6 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 await prompt(session, fs.readFileSync(file, "utf8"), pending.root_operation_id, pending.kind === "stage" ? undefined : pending.kind);
                 continue;
             }
-            const view = getFlowRunStatus(executionContext, { projectRoot: run.project_root, runId: run.id });
-            const next = view.continuation;
-            terminalFinalization = next.kind === "terminal";
             const completed = state.stage && view.index.stage_runs.find(stage => stage.stage === state.stage && ["done", "skipped"].includes(stage.status));
             if (state.current_session !== null && (completed || next.stage !== state.stage) && childObserver(state.sessions[state.current_session])?.failed().length)
                 throw new AppError("fanout_dispatch_fenced", "A retained child failure forbids completing or advancing its Stage", 1);
@@ -833,8 +874,8 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 loadExternalStageContext({ file: stageContext.file, expectedSha256: stageContext.sha256, stage: next.stage });
                 const continuation = JSON.stringify(["start_stage", next.stage, next.attempt ?? null]);
                 retainControllerContinuation(state, continuation, { code: "stage_entry_nonprogressing", message: "The coordinator returned without starting the assigned Stage", details: { stage: next.stage, attempt: next.attempt ?? null, last_receipt: state.last_receipt ?? null } });
-                const transition = resolveStageTransition({ ddFlowHome: context.ddFlowHome, policy, profiles, ...(state.stage ? { fromStage: state.stage } : {}), stage: next.stage, projectRoot: run.project_root, workspaceRoot: run.workspace_root, stageSessionMode: manifest.execution_profile.settings.stage_session_mode, mergeMode: manifest.execution_profile.settings.merge_mode });
-                if (next.stage === "merge" && manifest.execution_profile.settings.merge_mode === "server" && !state.merge_claim) {
+                const transition = routing.transition(next.stage, state.stage ?? undefined);
+                if (routing.kind === "sdlc" && next.stage === "merge" && routing.mergeMode === "server" && !state.merge_claim) {
                     const request = context.db.get("SELECT merge_request_id, status FROM merge_requests WHERE project_id = ? AND run_id = ? ORDER BY created_at DESC, merge_request_id DESC LIMIT 1", [row.project_id, row.run_id]);
                     if (!request || request.status !== "queued")
                         throw new AppError("controller_attach_required", "Managed MERGE needs an unclaimed queued request; reconcile an existing owner", 1, { request });
@@ -847,10 +888,11 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     state.merge_claim = { request_id: claim.request.merge_request_id, token: claim.token, target_workspace: claim.request.target_workspace, work_id: claim.request.executor_work_id };
                     saveState(context, row, state);
                     appendEvent(context, row.controller_id, "merge_claimed", { request_id: claim.request.merge_request_id });
+                    await renewLease();
                 }
-                const stageCwd = stageExecutionCwd({ stage: next.stage, projectRoot: run.project_root, workspaceRoot: run.workspace_root, ...(state.merge_claim ? { mergeTargetWorkspace: state.merge_claim.target_workspace } : {}) });
+                const stageCwd = routing.cwd(next.stage, state.merge_claim?.target_workspace);
                 let session = state.current_session === null ? null : state.sessions[state.current_session];
-                if (session && next.stage === "merge" && manifest.execution_profile.settings.merge_mode === "same_session" && path.resolve(session.cwd) !== stageCwd) {
+                if (session && routing.kind === "sdlc" && next.stage === "merge" && routing.mergeMode === "same_session" && path.resolve(session.cwd) !== stageCwd) {
                     throw new AppError("merge_session_workspace_conflict", "Same-session MERGE cannot change the native Session working directory", 1, { session_cwd: session.cwd, target_cwd: stageCwd });
                 }
                 if (!session || transition.session_mode === "new_session" || !sameSessionProfile(session.profile, transition.coordinator) || path.resolve(session.cwd) !== stageCwd) {
@@ -890,7 +932,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 state.child_capacity = {};
                 saveState(context, row, state);
                 setStatus("running");
-                if (next.stage === "code" || next.stage === "code-review") {
+                if (routing.kind === "sdlc" && (next.stage === "code" || next.stage === "code-review")) {
                     // A CODE_REVIEW fork has source files but intentionally no installed
                     // dependencies. Its repair Work executes checks just like CODE Work.
                     const readiness = await prepareVnextCodeWorkspace(executionContext, { projectRoot: run.project_root, runId: run.id, ownerId: row.controller_id, stage: next.stage });
@@ -1016,6 +1058,25 @@ async function executeController(context, row, manifest, state, assertOwnership,
             const fanout = await nextControllerFanout(executionContext, { projectRoot: run.project_root, runId: run.id, stage: next.stage, harness: runtimeHarness(session.profile), sessionId: session.id, children, policy, profiles, dispatchFence: retainedFailures.length > 0 });
             assertOwner();
             if (fanout.kind === "none") {
+                // An ACK-only recovery Turn may leave the original root Work unfinished.
+                // Continue that retained packet once; never restart its Stage or repeat
+                // an unknown productive dispatch merely because the observer reattached.
+                const recovery = context.db.get(`SELECT o.operation_id,b.packet_json,b.packet_sha256,b.work_id
+        FROM run_controller_operations o JOIN run_recovery_bindings b ON b.recovery_id=json_extract(o.receipt_json,'$.recovery_id')
+        JOIN run_recovery_guards g ON g.recovery_id=b.recovery_id
+        WHERE o.controller_id=? AND o.generation=? AND o.status='completed' AND json_extract(o.input_json,'$.action')='control_resume'
+          AND b.status='accepted' AND g.status='recovered' AND g.project_id=? AND g.run_id=?
+          AND b.provider_session_id=? AND b.daemon_id=json_extract(o.receipt_json,'$.daemon_id') ORDER BY o.created_at DESC LIMIT 1`, [row.controller_id, row.generation, row.project_id, row.run_id, session.id]);
+                if (recovery && digestBytes(recovery.packet_json) === recovery.packet_sha256) {
+                    const packet = JSON.parse(recovery.packet_json);
+                    const operationId = `${recovery.operation_id}:unfinished-root`;
+                    const work = context.db.get('SELECT status FROM works WHERE work_id=? AND project_id=? AND run_id=? AND parent_work_id IS NULL', [recovery.work_id, row.project_id, row.run_id]);
+                    if (recoveryPacketMatchesStage(packet, { runId: row.run_id, generation: row.generation, stage: next.stage, workId: recovery.work_id }) && work?.status === 'running'
+                        && !context.db.get('SELECT 1 FROM run_controller_operations WHERE operation_id=?', [operationId])) {
+                        await prompt(session, `Continue the original unfinished root Work from this accepted recovery packet. Inspect retained receipts and partial effects first. Do not restart the Stage, repeat observed lifecycle operations, create another Work or start a successor Stage. Preserve the packet write scope and result schema; stop at its original boundary.\n\nAccepted recovery packet (JSON data):\n${recovery.packet_json}`, operationId);
+                        continue;
+                    }
+                }
                 assertNoCorrelatedRejection(context, { projectId: row.project_id, runId: row.run_id, generation: row.generation, stage: next.stage, turn: state.turns });
                 const cause = currentLifecycleFailure(executionContext, { runId: run.id, generation: row.generation, stage: next.stage, turn: state.turns, projectId: row.project_id, projectRoot: run.project_root });
                 if (cause)

package/dist/services/run-recovery-guard.js

@@ -1,5 +1,6 @@
 import { AppError } from "../shared/errors.js";
 import { CAPACITY_POLICY, overloadBurst } from "../harness-runtime/lib/codex-capacity-policy.mjs";
+import { assertRunStartupSettled } from "./run-start-custody.js";
 export function recoveryGuard(context, projectId, runId) { return context.db.get("SELECT recovery_id, project_id, run_id, generation, status, interruption_json, settlement_json, capture_path, created_at, updated_at, sealed_at, resumed_at FROM run_recovery_guards WHERE project_id = ? AND run_id = ? ORDER BY generation DESC LIMIT 1", [projectId, runId]) ?? null; }
 export function assertRunRecoveryAllowed(context, projectId, runId, expectedGeneration) {
     const guard = recoveryGuard(context, projectId, runId);
@@ -11,6 +12,7 @@ export function assertRunRecoveryAllowed(context, projectId, runId, expectedGene
     return generation;
 }
 export function assertRunMutationAllowed(context, projectId, runId, expectedGeneration) {
+    assertRunStartupSettled(context, projectId, runId);
     const generation = assertRunRecoveryAllowed(context, projectId, runId, expectedGeneration);
     if (context.db.get("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'run_controllers'")
         && context.db.get("SELECT 1 FROM run_controllers WHERE project_id = ? AND run_id = ? AND status IN ('capturing','capture_failed') LIMIT 1", [projectId, runId]))