@deksden-com/dd-flow-cli 0.9.0-beta.47 → 0.9.0-beta.48

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.48
+
+### Patch Changes
+
+- Recheck a controller lease after a transient runtime-registry write failure before
+  dispatching more work, while retaining the hard stop for an explicit lease loss.
+
 ## 0.9.0-beta.47
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.47",
-  "cli_commit": "c6ad5bc48196d4f9a616667b737363c04d837e4e",
-  "built_at": "2026-09-10T20:41:49.668Z",
+  "cli_version": "0.9.0-beta.48",
+  "cli_commit": "ee8c219ce0fbc3943b6d3b1fcc5463c190469aaa",
+  "built_at": "2026-09-11T05:39:36.931Z",
   "built_with_canon": {
     "version": "4.1.0",
     "commit": "ef349bf47cba1c987468e51d73a0dbadbd48dc1f",

package/dist/services/run-controller.js

@@ -111,6 +111,50 @@ export async function launchRunController(context, input) {
     }
     return await spawnController(context, requireController(context, controllerId));
 }
+/**
+ * A registry write can be temporarily unavailable while another runtime client
+ * owns SQLite's writer lock.  That is not evidence that this controller lost
+ * its lease.  Productive dispatch still requires a successful recheck before
+ * proceeding, while an explicit negative renewal remains a hard ownership
+ * loss.
+ */
+export function controllerLeaseMonitor(heartbeat) {
+    let lost = false;
+    let unconfirmed = null;
+    const lostError = () => new AppError("controller_lease_lost", "Managed owner lease could not be confirmed", 1);
+    return {
+        tick() {
+            try {
+                if (!heartbeat())
+                    lost = true;
+                else
+                    unconfirmed = null;
+            }
+            catch (error) {
+                unconfirmed = error;
+            }
+        },
+        isConfirmed() { return !lost && unconfirmed === null; },
+        assertConfirmed() {
+            if (lost)
+                throw lostError();
+            if (unconfirmed === null)
+                return;
+            try {
+                if (!heartbeat()) {
+                    lost = true;
+                    throw lostError();
+                }
+                unconfirmed = null;
+            }
+            catch (error) {
+                if (error instanceof AppError)
+                    throw error;
+                throw new AppError("controller_lease_unconfirmed", "Managed owner lease could not be refreshed", 1, { cause: error instanceof Error ? error.message : String(error) });
+            }
+        }
+    };
+}
 /** No initialization, provider calls or lease takeover on the observation path. */
 export function runControllerStatus(context, input) {
     if (input.after !== undefined && (!Number.isSafeInteger(input.after) || input.after < 0))
@@ -134,27 +178,23 @@ export async function serveRunController(context, input) {
     if (!row.process_id || !row.process_lease_token)
         throw new AppError("controller_owner_mismatch", "Managed owner has no resource lease", 1);
     confirmManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
-    let leaseLost = false;
+    const lease = controllerLeaseMonitor(() => heartbeatManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token }));
     const heartbeat = setInterval(() => {
         try {
-            if (!heartbeatManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token }))
-                leaseLost = true;
-            if (!leaseLost) {
+            lease.tick();
+            if (lease.isConfirmed()) {
                 const guard = recoveryGuard(context, row.project_id, row.run_id);
                 if ((guard?.generation ?? 0) === row.generation && !["draining", "sealed", "resuming"].includes(guard?.status ?? ""))
                     context.db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE project_id = ? AND run_id = ? AND dispatch_owner = ? AND status = 'dispatching'", [new Date(Date.now() + 120_000).toISOString(), context.now(), row.project_id, row.run_id, row.controller_id]);
             }
         }
-        catch {
-            leaseLost = true;
-        }
+        catch { /* The lease monitor distinguishes renewal uncertainty from loss. */ }
     }, 30_000);
     heartbeat.unref();
     const manifest = JSON.parse(row.manifest_json);
     const state = JSON.parse(row.state_json);
     const assertPhysicalOwner = () => {
-        if (leaseLost)
-            throw new AppError("controller_lease_lost", "Managed owner lease could not be confirmed", 1);
+        lease.assertConfirmed();
         const current = requireController(context, row.controller_id);
         if (current.owner_pid !== process.pid || current.owner_token !== row.owner_token || !["running", "capturing", "waiting_for_user", "waiting_for_context", "waiting_for_children", "waiting_for_capacity", "waiting_for_merge"].includes(current.status))
             throw new AppError("controller_owner_mismatch", "Controller no longer owns productive dispatch", 1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.47",
+  "version": "0.9.0-beta.48",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {