@deksden-com/dd-flow-cli 0.9.0-beta.47 → 0.9.0-beta.49

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.49
+
+### Patch Changes
+
+- Treat a completed CODE gate command that returns `code_gate_failed` as terminal
+  recovery evidence, so the coordinator creates the returned repair Work instead
+  of waiting indefinitely or duplicating the aggregate gate.
+
+## 0.9.0-beta.48
+
+### Patch Changes
+
+- Recheck a controller lease after a transient runtime-registry write failure before
+  dispatching more work, while retaining the hard stop for an explicit lease loss.
+
 ## 0.9.0-beta.47
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.47",
-  "cli_commit": "c6ad5bc48196d4f9a616667b737363c04d837e4e",
-  "built_at": "2026-09-10T20:41:49.668Z",
+  "cli_version": "0.9.0-beta.49",
+  "cli_commit": "111629d923b54e718a4bb1466416f5089c59bed2",
+  "built_at": "2026-09-11T08:14:51.272Z",
   "built_with_canon": {
     "version": "4.1.0",
     "commit": "ef349bf47cba1c987468e51d73a0dbadbd48dc1f",

package/dist/services/run-controller.js

@@ -111,6 +111,50 @@ export async function launchRunController(context, input) {
     }
     return await spawnController(context, requireController(context, controllerId));
 }
+/**
+ * A registry write can be temporarily unavailable while another runtime client
+ * owns SQLite's writer lock.  That is not evidence that this controller lost
+ * its lease.  Productive dispatch still requires a successful recheck before
+ * proceeding, while an explicit negative renewal remains a hard ownership
+ * loss.
+ */
+export function controllerLeaseMonitor(heartbeat) {
+    let lost = false;
+    let unconfirmed = null;
+    const lostError = () => new AppError("controller_lease_lost", "Managed owner lease could not be confirmed", 1);
+    return {
+        tick() {
+            try {
+                if (!heartbeat())
+                    lost = true;
+                else
+                    unconfirmed = null;
+            }
+            catch (error) {
+                unconfirmed = error;
+            }
+        },
+        isConfirmed() { return !lost && unconfirmed === null; },
+        assertConfirmed() {
+            if (lost)
+                throw lostError();
+            if (unconfirmed === null)
+                return;
+            try {
+                if (!heartbeat()) {
+                    lost = true;
+                    throw lostError();
+                }
+                unconfirmed = null;
+            }
+            catch (error) {
+                if (error instanceof AppError)
+                    throw error;
+                throw new AppError("controller_lease_unconfirmed", "Managed owner lease could not be refreshed", 1, { cause: error instanceof Error ? error.message : String(error) });
+            }
+        }
+    };
+}
 /** No initialization, provider calls or lease takeover on the observation path. */
 export function runControllerStatus(context, input) {
     if (input.after !== undefined && (!Number.isSafeInteger(input.after) || input.after < 0))
@@ -134,27 +178,23 @@ export async function serveRunController(context, input) {
     if (!row.process_id || !row.process_lease_token)
         throw new AppError("controller_owner_mismatch", "Managed owner has no resource lease", 1);
     confirmManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token, pid: process.pid, processGroupId: process.pid, ownerPid: process.pid });
-    let leaseLost = false;
+    const lease = controllerLeaseMonitor(() => heartbeatManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token }));
     const heartbeat = setInterval(() => {
         try {
-            if (!heartbeatManagedProcess(context, { id: row.process_id, leaseToken: row.process_lease_token }))
-                leaseLost = true;
-            if (!leaseLost) {
+            lease.tick();
+            if (lease.isConfirmed()) {
                 const guard = recoveryGuard(context, row.project_id, row.run_id);
                 if ((guard?.generation ?? 0) === row.generation && !["draining", "sealed", "resuming"].includes(guard?.status ?? ""))
                     context.db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE project_id = ? AND run_id = ? AND dispatch_owner = ? AND status = 'dispatching'", [new Date(Date.now() + 120_000).toISOString(), context.now(), row.project_id, row.run_id, row.controller_id]);
             }
         }
-        catch {
-            leaseLost = true;
-        }
+        catch { /* The lease monitor distinguishes renewal uncertainty from loss. */ }
     }, 30_000);
     heartbeat.unref();
     const manifest = JSON.parse(row.manifest_json);
     const state = JSON.parse(row.state_json);
     const assertPhysicalOwner = () => {
-        if (leaseLost)
-            throw new AppError("controller_lease_lost", "Managed owner lease could not be confirmed", 1);
+        lease.assertConfirmed();
         const current = requireController(context, row.controller_id);
         if (current.owner_pid !== process.pid || current.owner_token !== row.owner_token || !["running", "capturing", "waiting_for_user", "waiting_for_context", "waiting_for_children", "waiting_for_capacity", "waiting_for_merge"].includes(current.status))
             throw new AppError("controller_owner_mismatch", "Controller no longer owns productive dispatch", 1);

package/dist/services/vnext-code.js

@@ -455,7 +455,7 @@ function coordinatorPrompt(context, input) {
         "",
         "<execution_commands>",
         "Launch only entries listed in graph.ready. Use at most the known available slot count. Every registered CODE Work runs in a fresh child Session, including a serial dependency chain; the coordinator owns dispatch and the stage conclusion, not implementation Work. Every child starts with its exact start_command and receives its complete packet from dd-flow. After a Work finishes, use the graph returned by work finish to launch newly ready Work. To refresh the parent graph yourself use the exact command: " + `${flowCommand(context)} work ls --run ${input.run.id} --ready --project-root ${JSON.stringify(input.projectRoot)} --json`,
-        "A quiet child is still running until the harness reports its turn completed, failed, cancelled or explicitly needs attention. An elapsed nominal wait, silence, or no new artifact is not an unresponsive-worker failure. Never interrupt, replace, relaunch, or stage-block a still-running child for that reason, even if an external controller asks. Long work finish and stage finish commands emit check progress on stderr. After you issue the exact CODE stage finish command, wait for that same command to return: do not inspect its PID, start a second finish command, or infer failure from quiet output. Close a disposable child only after its Work is accepted or explicitly failed/cancelled and the harness reports the turn settled.",
+        "A quiet child is still running until the harness reports its turn completed, failed, cancelled or explicitly needs attention. An elapsed nominal wait, silence, or no new artifact is not an unresponsive-worker failure. Never interrupt, replace, relaunch, or stage-block a still-running child for that reason, even if an external controller asks. Long work finish and stage finish commands emit check progress on stderr. After you issue the exact CODE stage finish command, wait for that same command to return once: a completed command with a non-zero exit and structured `code_gate_failed` output is its terminal result, not a reason to keep waiting. Read that returned error and run its repair command; do not inspect its PID, start a second finish command, or infer failure from quiet output. Close a disposable child only after its Work is accepted or explicitly failed/cancelled and the harness reports the turn settled.",
         `A repairable engine, harness, or environment failure is not a user question. Record it without finishing CODE: ${flowCommand(context)} stage block ${input.run.id} --stage code --work ${input.rootWork.work_id} --kind <engine|harness|environment> --code <stable-code> --summary-stdin --retryable --project-root ${JSON.stringify(input.projectRoot)} --json. Repair it externally, then run the exact unblock_command returned by dd-flow and continue this same stage.`,
         `When every CODE and repair Work is completed, write ${path.join(input.root, "code-verification.json")} using the exact contract below. Mark passed only when all accepted requirements and current-gate acceptance criteria are implemented or explicitly evidenced; list every remaining issue in unresolved. Every evidence_refs item must already exist as a relative workspace path or run://${input.run.id}/ path. Do not claim a browser or other check receipt that was not retained. Then finish: ${finishCommand(context, input.run.id, input.projectRoot, path.join(input.root, "code-verification.json"))}`,
         "If the aggregate gate fails, do not stop after `code_gate_failed`: that rejected finish does not create a repair Work. In the same coordinator Turn, use its returned repair command with the relevant completed origin Work IDs and a concise repair objective, then stop so the runner can dispatch the newly declared repair. Do not edit invisibly in the root orchestrator.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.47",
+  "version": "0.9.0-beta.49",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {