@deksden-com/dd-flow-cli 0.9.0-beta.139 → 0.9.0-beta.140

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.140
+
+- Compare observable birth after EPERM so a foreign reused PID is not mistaken for the retained owner; unknown identity remains conservative.
+
+- Separate pre-reboot physical retirement of controllers and waiting probes from their retained logical outcome.
+
+- Preserve legacy resource writer contracts during terminal retirement and recognize retained resource aliases without changing their historical bytes.
+- Retire structurally validated registries predating writer contracts without installing a new schema or fence definition.
+
+### Patch Changes
+
+- Retire validated pre-reboot legacy daemon processes without claiming native Session success or signalling reused PIDs.
+
 ## 0.9.0-beta.139
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.139",
-  "cli_commit": "bf550ff8ffdc8ce96dac783d0cfb0000a3b83e74",
-  "built_at": "2026-10-17T07:23:43.465Z",
+  "cli_version": "0.9.0-beta.140",
+  "cli_commit": "995243962934773092d9d2a127b0e1224baa622d",
+  "built_at": "2026-10-17T10:10:08.823Z",
   "built_with_canon": {
     "version": "4.1.2",
     "commit": "1ddedf9d3f086e046f8e7b194c739ec386e7c8b9",

package/dist/cli/run-cli.js

@@ -232,6 +232,8 @@ async function runCliRequest(args, io, env) {
         // Registration may bootstrap the resource registry, but never the unrelated
         // RUN store. Its caller's absolute deadline also bounds that first open.
         const maintenanceOptions = isRuntimeMaintenance(output.args) ? { resourceDatabaseMode: output.args[2] === "register" ? "initialize" : output.args[2] === "status" ? "read_existing" : "prepared_existing", ...(env.DD_FLOW_HOOK_DEADLINE_AT ? { databaseDeadlineAt: Number(env.DD_FLOW_HOOK_DEADLINE_AT) } : {}) } : {};
+        if (output.args[0] === "runtime" && output.args[1] === "scope" && ["fence", "stop"].includes(output.args[2] ?? ""))
+            maintenanceOptions.resourceDatabaseMode = "retirement";
         // Keep ordinary CLI JSON/stderr compatibility; bounded maintenance callers
         // provide this request's deadline and consume its structured phase evidence.
         if (maintenanceOptions.databaseDeadlineAt !== undefined)

package/dist/runtime/context.js

@@ -11,7 +11,7 @@ export function createRouterContext(env, deadlineAt) {
 }
 export function createContext(env, mode = "initialize", importPermitId, options = {}) {
     const ddFlowHome = resolveDdFlowHome(env);
-    if (options.resourceDatabaseMode === "prepared_existing" || options.resourceDatabaseMode === "initialize" || options.resourceDatabaseMode === "create_new")
+    if (options.resourceDatabaseMode === "prepared_existing" || options.resourceDatabaseMode === "initialize" || options.resourceDatabaseMode === "create_new" || options.resourceDatabaseMode === "retirement")
         assertImportAdmission(ddFlowHome, importPermitId);
     return {
         ddFlowHome,

package/dist/services/managed-processes.js

@@ -20,6 +20,19 @@ const defaultLeaseMs = 15 * 60_000;
 export function resourceHome(context) {
     return context.env?.DD_FLOW_RESOURCE_HOME ?? context.ddFlowHome ?? "/tmp/dd-flow-runtime";
 }
+/** Retained owners may name the same registry through a historical alias. */
+export function retainedResourceHomeMatches(context, retained) {
+    if (retained === resourceHome(context))
+        return true;
+    if (typeof retained !== "string" || !path.isAbsolute(retained))
+        return false;
+    try {
+        return fs.realpathSync(retained) === fs.realpathSync(resourceHome(context));
+    }
+    catch {
+        return false;
+    }
+}
 /** Runtime IDs are home-local; a shared host registry needs this extra scope. */
 export function managedProcessRuntimeHome(record, authority) {
     const metadata = parseMetadata(record.metadata_json);
@@ -300,7 +313,13 @@ export function processIsAlive(record) {
         process.kill(record.pid, 0);
     }
     catch (error) {
-        return error.code !== "ESRCH";
+        const code = error.code;
+        if (code === "ESRCH")
+            return false;
+        // A reused PID may now belong to another user. EPERM proves presence,
+        // not identity; still compare its observed birth before calling it ours.
+        if (code !== "EPERM")
+            return true;
     }
     const metadata = record.metadata_json ? parseMetadata(record.metadata_json) : {};
     if (Object.hasOwn(metadata, "process_birth")) {
@@ -319,7 +338,11 @@ export function managedProcessObservation(record) {
         process.kill(record.pid, 0);
     }
     catch (error) {
-        return error.code === 'ESRCH' ? 'absent' : 'unknown';
+        const code = error.code;
+        if (code === "ESRCH")
+            return "absent";
+        if (code !== "EPERM")
+            return "unknown";
     }
     const reply = spawnSync('ps', ['-o', 'lstart=,stat=', '-p', String(record.pid)], { encoding: 'utf8', timeout: 1000, env: { ...process.env, TZ: 'UTC', LC_ALL: 'C' } });
     if (reply.status !== 0 || !reply.stdout.trim())

package/dist/services/native-daemon-history.js

@@ -2,7 +2,7 @@ import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
-import { managedProcessBinding, managedProcessStatus, processTreeIsAlive, resourceHome } from "./managed-processes.js";
+import { managedProcessBinding, managedProcessStatus, processTreeIsAlive, resourceHome, retainedResourceHomeMatches } from "./managed-processes.js";
 import { retainedDaemonOperations } from "./run-control.js";
 import { managedProviderBelongsToDaemon } from "./managed-daemon-binding.js";
 /** A replaced daemon is a settled resource, never another Session to resume. */
@@ -26,7 +26,7 @@ export function historicalDaemonSettlement(context, scopeId, record) {
     if (matches.length !== 1)
         throw new AppError("runtime_scope_owner_unknown", "Previous daemon has no unique retained receipt", 1);
     const { file, bytes, state } = matches[0], owner = state.config?.runtime_owner;
-    if (!state.daemon_id || path.basename(file) !== `${state.daemon_id}.json` || !owner || owner.budget?.scope_id !== scopeId || owner.owner_id !== record.owner_id || owner.role !== metadata.role || owner.state_dir !== metadata.state_dir || owner.adapter_executable !== metadata.adapter_executable || owner.dd_flow_home !== metadata.dd_flow_home || owner.resource_home !== resourceHome(context) || (owner.project_id ?? null) !== record.project_id || (owner.run_id ?? null) !== record.run_id || (owner.work_id ?? null) !== record.work_id || !record.operation_id?.startsWith(`${owner.operation_id}:`) || state.resource_process?.lease_token !== record.lease_token || state.pid !== record.pid)
+    if (!state.daemon_id || path.basename(file) !== `${state.daemon_id}.json` || !owner || owner.budget?.scope_id !== scopeId || owner.owner_id !== record.owner_id || owner.role !== metadata.role || owner.state_dir !== metadata.state_dir || owner.adapter_executable !== metadata.adapter_executable || owner.dd_flow_home !== metadata.dd_flow_home || !retainedResourceHomeMatches(context, owner.resource_home) || (owner.project_id ?? null) !== record.project_id || (owner.run_id ?? null) !== record.run_id || (owner.work_id ?? null) !== record.work_id || !record.operation_id?.startsWith(`${owner.operation_id}:`) || state.resource_process?.lease_token !== record.lease_token || state.pid !== record.pid)
         throw new AppError("runtime_scope_owner_unknown", "Archived daemon does not match its registration", 1);
     const closed = state.shutdown_state === "clean" && state.active_tree === false
         ? retainedDaemonOperations(metadata.state_dir).find(operation => operation.daemon_id === state.daemon_id && operation.operation === "daemon.stop" && operation.state === "completed" && operation.result?.stopped === true && operation.result?.clean === true) : undefined;

package/dist/services/runtime-scope-stop.js

@@ -1,10 +1,11 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import os from "node:os";
 import { createContext } from "../runtime/context.js";
 import { AppError } from "../shared/errors.js";
 import { runHarnessAdapter } from "./harness-adapter.js";
-import { managedLeaseReleased, managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, stopManagedProcess } from "./managed-processes.js";
+import { managedLeaseReleased, managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, retainedResourceHomeMatches, stopManagedProcess } from "./managed-processes.js";
 import { terminalCheckSettled } from "./code-checks.js";
 import { fenceRuntimeBudget, runtimeBudgetStatus, scopeLocalProcessRole } from "./runtime-budget.js";
 import { retainedDaemonOperations } from "./run-control.js";
@@ -26,7 +27,7 @@ export async function stopRuntimeScope(context, scopeId, requestId) {
             const read = () => JSON.parse(fs.readFileSync(file, "utf8"));
             const state = read();
             const owner = state.config?.runtime_owner;
-            if (!state.daemon_id || !owner || owner.budget?.scope_id !== scopeId || owner.owner_id !== record.owner_id || owner.role !== metadata.role || owner.state_dir !== metadata.state_dir || owner.adapter_executable !== metadata.adapter_executable || owner.resource_home !== resourceHome(context) || (owner.project_id ?? null) !== record.project_id || (owner.run_id ?? null) !== record.run_id || (owner.work_id ?? null) !== record.work_id || !record.operation_id?.startsWith(`${owner.operation_id}:`) || state.resource_process?.id !== record.id || state.resource_process.lease_token !== record.lease_token || state.pid !== record.pid)
+            if (!state.daemon_id || !owner || owner.budget?.scope_id !== scopeId || owner.owner_id !== record.owner_id || owner.role !== metadata.role || owner.state_dir !== metadata.state_dir || owner.adapter_executable !== metadata.adapter_executable || !retainedResourceHomeMatches(context, owner.resource_home) || (owner.project_id ?? null) !== record.project_id || (owner.run_id ?? null) !== record.run_id || (owner.work_id ?? null) !== record.work_id || !record.operation_id?.startsWith(`${owner.operation_id}:`) || state.resource_process?.id !== record.id || state.resource_process.lease_token !== record.lease_token || state.pid !== record.pid)
                 throw new AppError("runtime_scope_owner_unknown", "Native owner does not match its registration", 1);
             const closed = state.shutdown_state === "clean" && state.active_tree === false && !processTreeIsAlive(record)
                 ? retainedDaemonOperations(metadata.state_dir).find(operation => operation.daemon_id === state.daemon_id && operation.operation === "daemon.stop" && operation.state === "completed" && operation.result?.stopped === true && operation.result?.clean === true) : undefined;
@@ -38,7 +39,7 @@ export async function stopRuntimeScope(context, scopeId, requestId) {
                 throw new AppError("runtime_scope_owner_changed", "Native registration changed before control", 1);
             if (!prior && !processIsAlive(current))
                 throw new AppError("runtime_scope_outcome_unknown", "Dead native owner requires retained shutdown evidence", 1);
-            const env = { ...context.env, DD_FLOW_HOME: owner.dd_flow_home, DD_FLOW_BIN: owner.dd_flow_bin, DD_FLOW_RESOURCE_HOME: owner.resource_home };
+            const env = { ...context.env, DD_FLOW_HOME: owner.dd_flow_home, DD_FLOW_BIN: owner.dd_flow_bin, DD_FLOW_RESOURCE_HOME: resourceHome(context) };
             delete env.DD_FLOW_CONTROL_TOKEN;
             delete env.DD_FLOW_CONTROLLER_TOKEN;
             const receipt = await runHarnessAdapter({ executable: metadata.adapter_executable,
@@ -109,6 +110,10 @@ export async function stopRuntimeScope(context, scopeId, requestId) {
             nodes.push({ process_id: record.id, state_dir: metadata.state_dir ?? "", settled: true, operation_id: operationId, owner_operation_id: operationId });
             continue;
         }
+        if (scopeLocalProcessRole(record) && previousBoot(record)) {
+            nodes.push({ process_id: record.id, settled: false, native_settled: false, physical_stopped: true, reason: "runtime_scope_outcome_unknown", message: "Physical owner predates host boot; logical outcome is retained" });
+            continue;
+        }
         if (scopeLocalProcessRole(record) && record.operation_id && record.pid && record.pid_started_at) {
             try {
                 await stopManagedProcess(context, { id: record.id, leaseToken: record.lease_token, force: false, graceMs: 500, reason: `scope-stop:${scopeId}` });
@@ -128,6 +133,8 @@ export async function stopRuntimeScope(context, scopeId, requestId) {
             const retired = nodes.find(node => node.physical_stopped === true && node.state_dir === metadata.state_dir && node.processes?.some(item => item.process_id === record.id && JSON.stringify(item.binding) === binding));
             if (retired && !processTreeIsAlive(record))
                 nodes.push({ process_id: record.id, ...(metadata.state_dir ? { state_dir: metadata.state_dir } : {}), settled: false, native_settled: false, physical_stopped: true, ...(retired.reason ? { reason: retired.reason } : {}) });
+            else if (previousBoot(record))
+                nodes.push({ process_id: record.id, settled: false, native_settled: false, physical_stopped: true, reason: "runtime_scope_outcome_unknown", message: "Physical owner predates host boot; logical outcome is retained" });
             else
                 nodes.push({ process_id: record.id, settled: false, reason: "runtime_scope_resource_unsettled", message: "Resource needs its own settlement proof" });
         }
@@ -152,7 +159,7 @@ async function stopVerifiedNativeProcesses(context, scopeId, daemon) {
     if (!owner || !current || current.lease_token !== daemon.lease_token || current.pid !== daemon.pid || current.pid_started_at !== daemon.pid_started_at
         || !daemon.pid || !daemon.pid_started_at || owner.budget?.scope_id !== scopeId || owner.owner_id !== daemon.owner_id
         || owner.state_dir !== metadata.state_dir || owner.role !== metadata.role || owner.adapter_executable !== metadata.adapter_executable
-        || owner.dd_flow_home !== metadata.dd_flow_home || owner.resource_home !== resourceHome(context)
+        || owner.dd_flow_home !== metadata.dd_flow_home || !retainedResourceHomeMatches(context, owner.resource_home)
         || state.resource_process?.id !== daemon.id || state.resource_process.lease_token !== daemon.lease_token
         || (state.pid !== daemon.pid && !(state.pid == null && state.shutdown_state === "starting")))
         return { stopped: null };
@@ -166,6 +173,12 @@ async function stopVerifiedNativeProcesses(context, scopeId, daemon) {
             && child.dispatch_barrier === "run-generation@1" && child.budget?.scope_id === scopeId;
     }) : [];
     const provider = providers.length === 1 ? providers[0] : unpublished.length === 1 ? unpublished[0] : undefined;
+    if (provider && previousBoot(daemon) && previousBoot(provider))
+        return { stopped: true, provider };
+    // Legacy daemons did not register their provider. A host reboot proves local
+    // process exit, not native Session completion. Never signal a reused PID.
+    if (providers.length === 0 && unpublished.length === 0 && !state.provider_process && !state.provider_pid && previousBoot(daemon))
+        return { stopped: true };
     if (providers.length > 1 || unpublished.length > 1 || state.provider_pid && !provider || !provider && state.shutdown_state !== "starting")
         return { stopped: null };
     try {
@@ -178,3 +191,20 @@ async function stopVerifiedNativeProcesses(context, scopeId, daemon) {
         return { stopped: false, ...(provider ? { provider } : {}), error: { code: cleanup.code ?? "physical_stop_failed", message: String(cleanup) } };
     }
 }
+function previousBoot(record) {
+    const metadata = JSON.parse(record.metadata_json);
+    // A waiting, unconfirmed launch cannot outlive the pre-boot owner that alone
+    // could release it. This is physical retirement, not a successful launch.
+    const identity = record.pid ? record : record.state === "starting" && Number.isSafeInteger(metadata.owner_pid) && metadata.owner_pid > 0 && metadata.owner_pid_started_at
+        ? { pid: metadata.owner_pid, pid_started_at: metadata.owner_pid_started_at, metadata_json: JSON.stringify(metadata.owner_birth ? { process_birth: metadata.owner_birth } : {}) } : null;
+    if (!identity || processIsAlive(identity))
+        return false;
+    // Legacy lstart has no timezone. Keep a conservative 26-hour ambiguity
+    // margin; recent/malformed identities must use ordinary ownership proof.
+    const started = Date.parse(record.started_at);
+    const birth = identity.pid_started_at && /^\w{3} \w{3}\s+\d{1,2} \d{2}:\d{2}:\d{2} \d{4}$/.test(identity.pid_started_at)
+        ? Date.parse(`${identity.pid_started_at} UTC`) : NaN;
+    const uptime = os.uptime();
+    const boundary = Date.now() - uptime * 1000 - 26 * 60 * 60 * 1000;
+    return Number.isFinite(uptime) && uptime > 0 && Number.isFinite(started) && Number.isFinite(birth) && started < boundary && birth < boundary;
+}

package/dist/storage/database.js

@@ -531,6 +531,8 @@ export function getResourceDatabase(resourceHome, mode = "initialize", deadlineA
     const deadline = requestDeadline(deadlineAt);
     deadline?.("resource_open");
     const dbPath = path.join(resourceHome, "runtime.sqlite");
+    if (mode === "retirement" && !fs.existsSync(dbPath))
+        return getResourceDatabase(resourceHome, "initialize", deadlineAt);
     const cached = resourceDatabases.get(dbPath);
     if (mode === "create_new") {
         if (cached)
@@ -562,29 +564,38 @@ export function getResourceDatabase(resourceHome, mode = "initialize", deadlineA
     if (mode === "prepared_existing" && !fs.existsSync(dbPath))
         throw new AppError("resource_storage_unprepared", "Prepare the resource registry before maintenance", 1);
     if (cached) {
-        if (mode === "prepared_existing")
+        if (mode === "prepared_existing" || mode === "retirement")
             assertResourceDatabaseIdentity(cached);
         const bounded = deadlineAt === undefined ? cached : cached.withDeadline(deadlineAt);
-        if (mode === "prepared_existing")
-            assertResourceStoreReady({ prepare: sql => ({ get: (...params) => bounded.get(sql, params), all: (...params) => bounded.all(sql, params), run: (...params) => bounded.run(sql, params) }) });
+        const reader = { prepare: (sql) => ({ get: (...params) => bounded.get(sql, params), all: (...params) => bounded.all(sql, params), run: (...params) => bounded.run(sql, params) }) };
+        if (mode === "prepared_existing" || mode === "retirement")
+            assertResourceStoreReady(reader, mode === "retirement");
+        else {
+            const required = readStoreWriterContract(reader);
+            if (required !== null && required !== STORE_WRITER_VERSION)
+                throw new AppError("store_writer_incompatible", "Retirement writer cannot admit productive resource operations", 1, { required, supported: STORE_WRITER_VERSION });
+        }
         return bounded;
     }
-    if (mode !== "prepared_existing")
+    if (mode !== "prepared_existing" && mode !== "retirement")
         ensureDir(resourceHome);
     channel("dd-flow.sqlite.ingress").publish({ phase: "store_connection", store_kind: "resource" });
     const db = new DatabaseSync(dbPath);
     try {
         channel("dd-flow.sqlite.ingress").publish({ phase: "store_writer_registration", store_kind: "resource" });
         db.exec(`PRAGMA busy_timeout = ${deadline?.("resource_open") ?? 4000}`);
-        registerStoreWriter(db);
+        if (mode === "retirement")
+            registerReconciliationWriter(db);
+        else
+            registerStoreWriter(db);
     }
     catch (error) {
         return closeAfterOpenFailure(db, error);
     }
     channel("dd-flow.sqlite.ingress").publish({ phase: "store_validation", store_kind: "resource" });
     try {
-        if (mode === "prepared_existing")
-            assertResourceStoreReady(db);
+        if (mode === "prepared_existing" || mode === "retirement")
+            assertResourceStoreReady(db, mode === "retirement");
         else
             configureDatabase(db, "initialize", deadline);
     }
@@ -600,7 +611,7 @@ export function getResourceDatabase(resourceHome, mode = "initialize", deadlineA
         return closeAfterOpenFailure(db, error);
     }
     try {
-        if (mode !== "prepared_existing")
+        if (mode !== "prepared_existing" && mode !== "retirement")
             executeStoreSchema(db, `
     CREATE TABLE IF NOT EXISTS managed_processes (
       id TEXT PRIMARY KEY,
@@ -669,11 +680,11 @@ function requestDeadline(at) {
     return phase => { const remaining = at - Date.now(); if (remaining <= 0)
         throw new AppError("process_heartbeat_timeout", "Maintenance storage deadline expired", 1, { phase, deadline_at: at, effect: "unknown" }); return Math.max(1, Math.min(4000, remaining)); };
 }
-function assertResourceStoreReady(db) {
+function assertResourceStoreReady(db, retirement = false) {
     const version = readStoreWriterContract(db);
-    if (version === null)
+    if (version === null && !retirement)
         throw new AppError("resource_storage_unprepared", "Prepare the resource registry writer contract before maintenance", 1);
-    if (version !== STORE_WRITER_VERSION)
+    if (version !== null && version !== STORE_WRITER_VERSION && !(retirement && version === 1))
         throw new AppError("store_writer_incompatible", "This CLI cannot maintain the resource registry's required contract", 1, { required: version, supported: STORE_WRITER_VERSION });
     for (const [table, columns] of Object.entries({ managed_processes: "id,kind,pid,pid_started_at,owner_id,lease_token,lease_expires_at,project_id,run_id,work_id,check_id,operation_id,stdout_path,stderr_path,state,started_at,updated_at,finished_at,termination_reason,metadata_json", managed_resources: "resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at" })) {
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.139",
+  "version": "0.9.0-beta.140",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",