@deksden-com/dd-flow-cli 0.9.0-beta.62 → 0.9.0-beta.64

package/dist/services/lifecycle-invocations.js

@@ -1,12 +1,18 @@
 import crypto from "node:crypto";
 import path from "node:path";
+import fs from "node:fs";
 import { quote } from "shell-quote";
 import { setTimeout as delay } from "node:timers/promises";
 import { AppError } from "../shared/errors.js";
 import { commandOption, parseLifecycleCommand, shellSuffixOffset } from "./lifecycle-command.js";
 import { requireProjectByRoot } from "./projects.js";
 import { assertRunMutationAllowed, assertStageSettlementAllowed, assertWorkSettlementAllowed, recoveryGuard } from "./run-recovery.js";
-import { requireManagedDaemonBinding } from "./managed-daemon-binding.js";
+import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
+import { managedProcessStatus } from "./managed-processes.js";
+import { appendEvent } from "./run-controller-state.js";
+import { recoverCommittedWorkStart } from "./work-registry.js";
+import { observeCommandHook } from "./hooks.js";
+import { runtimeHarness } from "./execution-policy.js";
 // Conclusive result/check rejections, never transport, ownership, registry or
 // unknown-effect failures. These validators reject before accepting the result.
 export function isRetryableLifecycleRejection(code, details = {}) {
@@ -52,6 +58,164 @@ function load(context, id) {
 export function lifecycleInvocationScope(context, id) {
     return JSON.parse(load(context, id).scope_json);
 }
+/** Read-only controller observation of a retained lifecycle outcome. */
+export function lifecycleInvocationOutcome(context, id) {
+    const row = load(context, id);
+    return { status: row.status, outcome: row.outcome_json ? JSON.parse(row.outcome_json) : null };
+}
+/** Current failures are read from runtime authority, never from model text. */
+export function assertLifecycleOutcomes(context, scope) {
+    const project = requireProjectByRoot(context, scope.projectRoot);
+    const diagnostics = lifecycleDiagnostics(context, project.id, scope.runId, scope.generation);
+    if (fs.existsSync(diagnostics)) {
+        for (const name of fs.readdirSync(diagnostics).filter(name => name.endsWith(".json"))) {
+            const record = JSON.parse(fs.readFileSync(path.join(diagnostics, name), "utf8"));
+            if (record.project_id !== project.id || record.run_id !== scope.runId || record.generation !== scope.generation)
+                throw new AppError("lifecycle_outcome_conflict", "Lifecycle diagnostic scope differs", 1);
+            throw new AppError(record.error?.code ?? "lifecycle_outcome_unknown", record.error?.message ?? "Lifecycle settlement could not be persisted", 1, { ...record.error?.details, lifecycle_outcome: record, diagnostic_artifact: path.join(diagnostics, name) });
+        }
+    }
+    const columns = context.db.all("PRAGMA table_info(hook_events)");
+    if (columns.some(column => column.name === "outcome_json")) {
+        for (const row of context.db.all("SELECT outcome_json FROM hook_events WHERE project_id = ? AND json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ? ORDER BY id", [project.id, scope.runId, scope.generation])) {
+            const outcome = JSON.parse(row.outcome_json);
+            if (outcome.disposition === "retrying" && outcome.deadline <= Date.now())
+                throw new AppError("lifecycle_outcome_unknown", "Storage retry has no terminal receipt; reconcile its committed evidence", 1, { lifecycle_outcome: outcome, effect: "unknown" });
+            if (outcome.disposition === "fatal")
+                throw new AppError(outcome.error.code, outcome.error.message, 1, { ...outcome.error.details, lifecycle_outcome: outcome });
+        }
+    }
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'"))
+        return;
+    const rows = context.db.all(`SELECT a.* FROM lifecycle_invocations a
+    WHERE json_extract(a.scope_json, '$.projectRoot') = ? AND json_extract(a.scope_json, '$.runId') = ?
+      AND json_extract(a.scope_json, '$.generation') = ? AND a.status = 'settled'
+      AND NOT EXISTS (SELECT 1 FROM lifecycle_invocations newer WHERE newer.scope_json = a.scope_json AND newer.fingerprint = a.fingerprint AND newer.rowid > a.rowid)
+    ORDER BY a.rowid`, [scope.projectRoot, scope.runId, scope.generation]);
+    for (const row of rows) {
+        const error = (row.outcome_json ? JSON.parse(row.outcome_json) : null)?.error;
+        if (typeof error?.code === "string" && typeof error.details?.retry_command !== "string")
+            throw new AppError(error.code, typeof error.message === "string" ? error.message : "Mandatory lifecycle failed", 1, { ...(error.details ?? {}), invocation_id: row.id });
+    }
+}
+/** Hooks already own native identity. Retain command outcomes there, with an
+ * atomic controller notification; missing notifications reconcile from the row. */
+export function observeLifecycleCommand(context, command) {
+    const parsed = parseLifecycleCommand(command);
+    if (parsed.kind !== "standalone")
+        return () => { };
+    let anchor;
+    context.observeLifecycleHook = (projectId, eventId) => {
+        if (anchor)
+            return;
+        const event = context.db.get("SELECT session_id, provider_session_id, parent_session_id, daemon_id, harness FROM hook_events WHERE id = ? AND project_id = ?", [eventId, projectId]);
+        if (!event)
+            return;
+        let runId = context.db.get("SELECT run_id FROM sessions WHERE project_id = ? AND harness = ? AND (session_id = ? OR session_id = ? OR provider_session_id = ?) AND run_id IS NOT NULL ORDER BY session_id = ? DESC LIMIT 1", [projectId, event.harness, event.session_id, event.parent_session_id, event.parent_session_id, event.session_id])?.run_id;
+        let generation;
+        // A first Stage command precedes logical Session binding. Its native root
+        // is already owned by the controller's retained create receipt.
+        if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'")) {
+            const owners = context.db.all("SELECT run_id, generation, state_json FROM run_controllers WHERE project_id = ? AND status NOT IN ('completed','cancelled','superseded')", [projectId]).filter(owner => {
+                const state = JSON.parse(owner.state_json);
+                return state.sessions?.some(session => [event.provider_session_id ?? event.session_id, event.parent_session_id].includes(session.id) && runtimeHarness(session.profile) === event.harness);
+            });
+            if (owners.length > 1)
+                return;
+            if (owners.length === 1) {
+                if (runId && runId !== owners[0].run_id)
+                    return;
+                runId = owners[0].run_id;
+                generation = owners[0].generation;
+            }
+        }
+        if (event.daemon_id) {
+            for (const record of managedProcessStatus(context)) {
+                if (record.project_id !== projectId || !record.run_id || !record.kind.endsWith("-daemon"))
+                    continue;
+                const metadata = JSON.parse(record.metadata_json);
+                if (typeof metadata.state_dir !== "string")
+                    continue;
+                let daemonId;
+                try {
+                    daemonId = readNativeDaemonState(metadata.state_dir).daemon_id;
+                }
+                catch {
+                    continue;
+                } // Discovery of unrelated historical daemons is not authority.
+                if (daemonId !== event.daemon_id)
+                    continue;
+                const binding = requireManagedDaemonBinding(context, { stateDir: metadata.state_dir, projectId, runId: record.run_id });
+                if (binding.state.daemon_id !== event.daemon_id)
+                    continue;
+                runId = record.run_id;
+                generation = metadata.run_generation;
+                break;
+            }
+        }
+        if (!runId)
+            return;
+        anchor = { project_id: projectId, run_id: runId, generation: generation ?? recoveryGuard(context, projectId, runId)?.generation ?? 0, hook_event_id: eventId, session_id: event.session_id, harness: event.harness, operation: parsed.invocation.operation };
+    };
+    observeCommandHook(context, command);
+    const invocationId = commandOption(parsed.invocation, "invocation-id");
+    if (!anchor && invocationId) {
+        const attempt = load(context, invocationId);
+        checkCommand(attempt, command);
+        if (attempt.event_key && ["observed", "executing"].includes(attempt.status)) {
+            const scope = JSON.parse(attempt.scope_json);
+            const project = requireProjectByRoot(context, scope.projectRoot);
+            const event = context.db.get("SELECT id FROM hook_events WHERE project_id = ? AND event_key = ?", [project.id, attempt.event_key]);
+            if (event)
+                context.observeLifecycleHook(project.id, event.id);
+        }
+    }
+    return outcome => {
+        delete context.observeLifecycleHook;
+        if (!anchor)
+            return;
+        const retryable = outcome.error && (isRetryableLifecycleRejection(outcome.error.code, outcome.error.details) || typeof outcome.error.details.retry_command === "string");
+        const record = { ...anchor, ...outcome, effect: outcome.error ? outcome.error.details.effect ?? (retryable ? "no_effect" : "unknown") : "committed", disposition: outcome.error ? retryable ? "correctable" : "fatal" : "completed" };
+        try {
+            context.db.writeTransaction(() => {
+                const retained = context.db.get("SELECT outcome_json FROM hook_events WHERE id = ?", [anchor.hook_event_id]);
+                const previous = retained?.outcome_json ? JSON.parse(retained.outcome_json) : null;
+                if (previous?.storage_retry === 1)
+                    Object.assign(record, { storage_retry: 1, work_id: previous.work_id });
+                const encoded = JSON.stringify(record);
+                if (retained?.outcome_json && previous?.disposition !== "retrying") {
+                    if (retained.outcome_json !== encoded)
+                        throw new AppError("lifecycle_outcome_conflict", "Hook outcome cannot change", 1, { hook_event_id: anchor.hook_event_id });
+                    return;
+                }
+                context.db.run("UPDATE hook_events SET outcome_json = ? WHERE id = ?", [encoded, anchor.hook_event_id]);
+                if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'"))
+                    for (const controller of context.db.all("SELECT controller_id FROM run_controllers WHERE project_id = ? AND run_id = ? AND generation = ?", [anchor.project_id, anchor.run_id, anchor.generation]))
+                        appendEvent(context, controller.controller_id, "lifecycle_outcome", record);
+            });
+        }
+        catch (persistence) {
+            if (persistence instanceof AppError && persistence.code === "lifecycle_outcome_conflict")
+                throw persistence;
+            // Diagnostic evidence is not replay authority. If SQL is unavailable,
+            // the controller still sees this failure and fences instead of waiting
+            // for a model to report it or invent a new invocation.
+            const directory = lifecycleDiagnostics(context, anchor.project_id, anchor.run_id, anchor.generation);
+            try {
+                fs.mkdirSync(directory, { recursive: true });
+                fs.writeFileSync(path.join(directory, `${anchor.hook_event_id}.json`), JSON.stringify({ ...record, disposition: "fatal", persistence_error: String(persistence) }), { flag: "wx", mode: 0o600, flush: true });
+            }
+            catch (diagnostic) {
+                if (diagnostic.code !== "EEXIST")
+                    process.stderr.write(`${JSON.stringify({ primary: record.error ?? { effect: "committed" }, persistence: String(persistence), diagnostic: String(diagnostic) })}\n`);
+            }
+            throw persistence;
+        }
+    };
+}
+function lifecycleDiagnostics(context, projectId, runId, generation) {
+    return path.join(context.ddFlowHome, "diagnostics", "lifecycle", encodeURIComponent(projectId), encodeURIComponent(runId), String(generation));
+}
 /** Current, explicitly-issued replacements for commands from the resumed stage.
  * Original prompts remain immutable evidence; callers may present this small
  * overlay after a state transition made an earlier no-effect rejection retryable. */
@@ -120,25 +284,15 @@ export function managedLifecycleCommand(context, command) {
         return renderInvocationCommand(retained, command);
     }
     storage(context);
-    context.db.exec("SAVEPOINT invocation_command");
-    try {
+    return context.db.writeTransaction(() => {
         const prior = context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [JSON.stringify(scope), fingerprint(parsed)]);
         if (prior && prior.id !== context.env.DD_FLOW_CURRENT_INVOCATION) {
-            const rendered = renderInvocationCommand(prior, command);
-            context.db.exec("RELEASE invocation_command");
-            return rendered;
+            return renderInvocationCommand(prior, command);
         }
         if (context.env.DD_FLOW_INVOCATION_READONLY === "1")
             throw new AppError("invocation_command_unprepared", "No prepared lifecycle command is available; read-only inspection cannot issue one", 1);
-        const prepared = issueLifecycleInvocation(context, command, scope);
-        context.db.exec("RELEASE invocation_command");
-        return prepared.command;
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK TO invocation_command");
-        context.db.exec("RELEASE invocation_command");
-        throw error;
-    }
+        return issueLifecycleInvocation(context, command, scope).command;
+    });
 }
 export function retryLifecycleInvocationCommand(context, id) {
     const prior = load(context, id);
@@ -170,7 +324,7 @@ function successorLifecycleInvocationCommand(context, prior) {
  * callers must never time out merely because the observer rejected syntax. */
 export function settleLifecycleNoEffectRejection(context, id, command, error, identity) {
     storage(context);
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const prior = load(context, id);
         checkCommand(prior, command);
@@ -211,14 +365,18 @@ const receiptTimeout = (id) => ({ code: "invocation_receipt_timeout", message: "
 export function settleLifecycleRejection(context, id, error) {
     storage(context);
     const details = { ...error.details };
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const prior = load(context, id);
         if (prior.status !== "executing")
             throw new AppError("invocation_settlement_conflict", "Attempt is no longer executing", 1, { invocation_id: id });
-        if (isRetryableLifecycleRejection(error.code, error.details)) {
+        const storageRetry = error.code === "storage_write_failed" && error.details.effect === "no_effect"
+            && !context.db.get("SELECT 1 FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND json_extract(outcome_json, '$.error.details.storage_retry') = 1 LIMIT 1", [prior.scope_json, prior.fingerprint]);
+        if (isRetryableLifecycleRejection(error.code, error.details) || storageRetry) {
             const retry = retryLifecycleInvocationCommand(context, id);
             details.retry_command = retry;
+            if (storageRetry)
+                details.storage_retry = 1;
             details.retry_instruction = "Correct only the evidenced defect, then use retry_command with the required result input. Reissuing the old command only reads its retained outcome.";
         }
         settleLifecycleInvocation(context, id, { error: { ...error, details } });
@@ -339,6 +497,9 @@ function commandWithInvocationId(command, id) {
  * Preserve current stdin/heredoc/response-file text while validating that it
  * still names the exact persisted operation and project. */
 function assertRenderableInvocation(row) {
+    const outcome = row.outcome_json ? JSON.parse(row.outcome_json) : null;
+    if (row.status === "settled" && outcome?.error)
+        throw new AppError("invocation_command_blocked", "Failed lifecycle authority cannot be advertised as an executable command", 1, { invocation_id: row.id, outcome });
     if (row.status === "expired" || row.status === "issued" && row.deadline !== null && row.deadline <= Date.now()) {
         throw new AppError("invocation_expired", "Retained lifecycle attempt has expired; inspection cannot grant a new attempt", 1, { invocation_id: row.id, status: row.status, outcome: row.outcome_json ? JSON.parse(row.outcome_json) : null });
     }
@@ -373,7 +534,7 @@ export function observeLifecycleInvocation(context, input) {
     const identity = input.identity;
     checkNativeIdentity(scope, identity, input.id);
     const identityJson = JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId]);
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [input.id]);
         if (row.status === "settled") {
@@ -420,8 +581,19 @@ export async function awaitLifecycleInvocation(context, input) {
         const row = load(context, input.id);
         if (row.status === "settled")
             return { outcome: JSON.parse(row.outcome_json), replay: true };
-        if (row.status === "executing")
-            throw new AppError("invocation_outcome_pending", "This attempt already started; inspect its retained operation outcome before retrying", 1, { invocation_id: input.id });
+        if (row.status === "executing") {
+            const scope = JSON.parse(row.scope_json);
+            if (invocation(row.command).operation === "work_start" && row.event_key) {
+                input.assertCurrent(scope);
+                const result = recoverCommittedWorkStart(context, row.id, row.event_key, scope.generation);
+                if (result) {
+                    const outcome = { result, effect: "committed" };
+                    settleLifecycleInvocation(context, row.id, outcome);
+                    return { outcome, replay: true };
+                }
+            }
+            throw new AppError("invocation_outcome_pending", "This attempt already started; inspect its retained operation outcome before retrying", 1, { invocation_id: input.id, effect: "unknown" });
+        }
         input.assertCurrent(JSON.parse(row.scope_json));
         if (row.status === "observed") {
             const claimed = context.db.run("UPDATE lifecycle_invocations SET status = 'executing', updated_at = ? WHERE id = ? AND status = 'observed'", [context.now(), input.id]);
@@ -430,7 +602,7 @@ export async function awaitLifecycleInvocation(context, input) {
             continue;
         }
         if (row.status === "expired" || (row.deadline !== null && row.deadline <= Date.now())) {
-            context.db.exec("BEGIN IMMEDIATE");
+            context.db.beginWriteTransaction();
             try {
                 const current = load(context, input.id);
                 if (["issued", "expired"].includes(current.status)) {

package/dist/services/managed-processes.js

@@ -47,7 +47,7 @@ export function registerManagedProcess(context, input) {
     if (!input.operationId)
         throw new Error("Unique managed operation requires operationId");
     const db = registry(context);
-    db.exec("BEGIN IMMEDIATE");
+    db.beginWriteTransaction();
     try {
         const existing = db.get("SELECT * FROM managed_processes WHERE operation_id = ? AND state IN ('starting','running','stopping','orphaned')", [input.operationId]);
         if (existing)
@@ -154,7 +154,7 @@ export function managedOwnerIsAlive(record) {
 export function claimExpiredManagedProcesses(context, ownerId) {
     const db = registry(context);
     const now = context.now();
-    db.exec("BEGIN IMMEDIATE");
+    db.beginWriteTransaction();
     try {
         const candidates = db.all("SELECT * FROM managed_processes WHERE state IN ('starting','running','stopping','orphaned') AND lease_expires_at < ? ORDER BY lease_expires_at, id", [now]);
         const claimed = [];

package/dist/services/merge-queue.js

@@ -36,7 +36,7 @@ export function claimNextMergeJob(context, input) {
     });
     const now = context.now();
     let claimedProtocolId = null;
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const job = context.db.get(`SELECT * FROM merge_queue
        WHERE project_id = ? AND status IN ('ready', 'requeued')
@@ -90,7 +90,7 @@ export function claimMergeJob(context, input) {
         workspacePath: input.workspacePath
     });
     const now = context.now();
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const job = queueJobByProtocol(context, project.id, input.protocolId);
         if (!job || !["ready", "requeued"].includes(job.status)) {
@@ -141,7 +141,7 @@ export function claimMergeBundle(context, input) {
         workspacePath: input.workspacePath
     });
     const now = context.now();
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         for (const protocolId of protocolIds) {
             const update = context.db.run(`UPDATE merge_queue
@@ -381,7 +381,7 @@ export function completeMergeBundle(context, input) {
         });
     }
     const now = context.now();
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         for (const protocolId of protocolIds) {
             const protocol = requireProtocol(context, protocolId, project.id);
@@ -517,7 +517,7 @@ export function failMergeBundle(context, input) {
     }
     const now = context.now();
     const status = input.requeue ? "requeued" : "failed";
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         for (const protocolId of protocolIds) {
             const protocol = requireProtocol(context, protocolId, project.id);
@@ -574,7 +574,7 @@ export function cancelMergeQueueJob(context, input) {
         throw new AppError("validation", "merge-queue cancel requires --reason", 2);
     }
     const now = context.now();
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const job = queueJobByProtocol(context, protocol.project_id, protocol.id);
         if (!job) {

package/dist/services/merge-server.js

@@ -63,7 +63,7 @@ export function stopMergeServer(context, input) { const changed = context.db.run
     throw new AppError("not_found", "Running merge-server was not found", 1, { server_id: input.serverId }); return { ok: true, server_id: input.serverId, status: "stopping" }; }
 /** Both dispatchers enter the same project FIFO before creating any provider Session. */
 export function claimQueuedMergeRequest(context, input) {
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const request = context.db.get("SELECT merge_request_id, project_id, run_id, executor_work_id, target_workspace, execution_route, status, created_at FROM merge_requests WHERE merge_request_id = ?", [input.requestId]);
         if (!request)

package/dist/services/migrations.js

@@ -217,7 +217,7 @@ export function applyMigration(context, input) {
         chain: chain.steps.map((step) => ({ ...step, status: "applied" }))
     };
     try {
-        writeDb.exec("BEGIN IMMEDIATE");
+        writeDb.beginWriteTransaction();
         writeDb.run(`INSERT INTO runtime_config (key, value_json, created_at, updated_at) VALUES (?, ?, ?, ?)`, [applyKey(project.id, sourceVersion, targetVersion), JSON.stringify(result), context.now(), context.now()]);
         writeDb.exec("COMMIT");
     }

package/dist/services/projects.js

@@ -140,7 +140,7 @@ export function migrateProjectIds(context, input) {
         throw new AppError("conflict", `Target project id already exists: ${target.id}`, 1, plan);
     }
     context.db.exec("PRAGMA foreign_keys = OFF");
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         context.db.run("UPDATE projects SET id = ?, short_id = ?, slug = ?, state_root = ?, updated_at = ? WHERE id = ?", [target.id, target.short_id, target.slug, target.state_root, now, oldId]);
         for (const table of projectReferenceTables()) {

package/dist/services/protocols.js

@@ -416,7 +416,7 @@ export function syncProtocolFromRun(context, input) {
         next_action: nextActionForSyncedTarget(targetStage),
         updated_at: now
     };
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         persistProtocolState(context, protocol, nextState);
         if (targetStage === "ready_for_merge") {
@@ -486,7 +486,7 @@ export function cancelProtocol(context, input) {
     const now = context.now();
     const worktree = context.db.get("SELECT worktree_path, status FROM worktree_records WHERE project_id = ? AND protocol_id = ?", [protocol.project_id, protocol.id]);
     const worktreeRemoval = input.worktree === "remove" ? removeProtocolWorktreeBeforeCancel(protocol, state, worktree, input.force) : undefined;
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const nextState = {
             ...state,

package/dist/services/run-control-worker.js

@@ -57,7 +57,7 @@ async function launchControlWorker(context, input) {
     // Reclaim only a proven dead launcher or admitted worker. Lease expiry
     // never proves death or authorizes a second physical owner.
     let claimed = false;
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         claimed = context.db.run("INSERT OR IGNORE INTO run_control_workers (control_id, owner_token, status, resource_home, state_dir, created_at, updated_at) VALUES (?, ?, 'starting', ?, ?, ?, ?)", [input.controlId, token, home, directory, now, now]).changes === 1;
         if (claimed) {
@@ -163,7 +163,7 @@ function reclaimControlWorker(context, input, projectId, token, home) {
     // and a crash before the RUN CAS leaves the same dead owner reconcilable.
     if (record && !finishManagedProcess(context, { id: record.id, leaseToken: record.lease_token, state: "stopped", reason: "control_owner_crash_reconciled" }))
         return false;
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const changed = context.db.run(`UPDATE run_control_workers SET owner_token = ?, owner_pid = NULL, status = 'starting', process_id = NULL, process_lease_token = NULL, updated_at = ?
       WHERE control_id = ? AND owner_token = ? AND process_id IS ? AND owner_pid IS ? AND status = ?
@@ -202,7 +202,7 @@ export async function serveRunControl(context, input) {
         throw new AppError("run_control_owner_mismatch", "Control registration is not authorized", 1);
     // Physical identity is committed with the sole RUN claim, before the worker
     // registers itself in the separate resource store or performs any dispatch.
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const claimed = context.db.run("UPDATE run_control_workers SET status = 'running', owner_pid = ?, updated_at = ? WHERE control_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [process.pid, context.now(), input.controlId, worker.owner_token]);
         if (claimed.changes !== 1)

package/dist/services/run-control.js

@@ -413,10 +413,29 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
         }
         unresolved.push({ check_id: check.id, status: "pending", reason });
     }
+    const uncreatedDirectories = new Map();
     const sessionNodes = Promise.all([...targets.values()].map(async ({ session, executable, harness }) => {
         const env = { ...context.env, DD_FLOW_HOME: context.ddFlowHome };
         delete env.DD_FLOW_CONTROLLER_TOKEN;
         delete env.DD_FLOW_CONTROL_TOKEN;
+        // An explicit pre-registration rejection proves there is no Session to
+        // cancel. A missing id or an arbitrary startup failure does not.
+        if (!session.id && !session.create_operation_id && !daemonInventories.has(session.state_dir) && !unsafeDaemons.has(canonicalPath(session.state_dir, false)) && !fs.existsSync(path.join(session.state_dir, "daemon.json"))) {
+            const operations = context.db.all("SELECT o.operation_id, o.input_json FROM run_controller_operations o JOIN run_controllers c ON c.controller_id = o.controller_id WHERE c.project_id = ? AND c.run_id = ? AND json_extract(o.input_json, '$.state_dir') = ?", [project.id, input.runId, session.state_dir]);
+            if (operations.length === 1)
+                try {
+                    const operation = operations[0];
+                    const saved = JSON.parse(operation.input_json);
+                    const journal = retainedDaemonOperations(session.state_dir);
+                    const receipt = journal.length === 1 ? journal[0] : null;
+                    const error = receipt?.error;
+                    if (saved.executable === executable && saved.owner === session.owner.owner_id && saved.args?.[0] === "daemon" && saved.args?.[1] === "start" && receipt?.operation_id === operation.operation_id && receipt.operation === "daemon.start" && receipt.predecessor_daemon_id === null && receipt.state === "failed" && error?.details?.startup_resources === "not_created" && !registeredProcesses.some(({ record }) => JSON.parse(record.metadata_json).state_dir === session.state_dir)) {
+                        uncreatedDirectories.set(session.state_dir, JSON.stringify(journal));
+                        return { state_dir: session.state_dir, status: "completed", receipt: { source: "startup_resources_not_created", operation_id: operation.operation_id, error } };
+                    }
+                }
+                catch { /* Incomplete evidence retains the normal unknown outcome. */ }
+        }
         if (!session.id && session.create_operation_id) {
             try {
                 assertCurrent();
@@ -622,7 +641,7 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
         };
         bindings = readBindings();
         for (const target of targets.values())
-            if (!daemonInventories.has(target.session.state_dir))
+            if (!daemonInventories.has(target.session.state_dir) && !uncreatedDirectories.has(target.session.state_dir))
                 unresolved.push({ state_dir: target.session.state_dir, status: "pending", reason: "runtime_inventory_unverified" });
         for (const node of nodes)
             if ("harness" in node && "session_id" in node && typeof node.session_id === "string" && bindings.some(binding => foreign(binding) && underRoot(binding, node.session_id, node.harness ?? null)))
@@ -647,6 +666,9 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
         const processVersion = (items) => JSON.stringify(items.map(({ home, record }) => [home, record.id, record.kind, record.owner_id, record.project_id, record.run_id, record.work_id, record.check_id, record.operation_id, record.pid, record.pid_started_at, record.lease_token, record.state, record.metadata_json]).sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right))));
         verifyInventory = () => {
             assertCurrent();
+            for (const [directory, journal] of uncreatedDirectories)
+                if (fs.existsSync(path.join(directory, "daemon.json")) || JSON.stringify(retainedDaemonOperations(directory)) !== journal)
+                    throw new AppError("owned_inventory_changed", "Rejected startup acquired new runtime evidence", 1);
             const currentProcesses = [...resourceHomes].flatMap(home => managedProcessStatus({ ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: home } }).filter(record => record.project_id === project.id && record.run_id === input.runId && [null, context.ddFlowHome].includes(managedProcessRuntimeHome(record, context))).map(record => ({ home, record })));
             if (initialDatabaseVersion !== databaseVersion() || processVersion(registeredProcesses) !== processVersion(currentProcesses) || [...nativeVersions].some(([directory, version]) => version !== nativeInventoryVersion(directory)) || [...importVersions].some(([file, version]) => crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") !== version))
                 throw new AppError("owned_inventory_changed", "Owned writers changed after their settlement observation", 1);
@@ -726,7 +748,7 @@ export function recordRunControlIntent(context, input) {
     const request = { project_root: project.root, run_id: input.runId, action: input.action, ...(input.action === "pause" ? { grace_ms: input.graceMs ?? 30_000, escalate: input.escalate ?? null } : { force: input.force ?? false }) };
     const requestHash = crypto.createHash("sha256").update(JSON.stringify(request)).digest("hex");
     ensureRunControlStorage(context.db);
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const existing = context.db.get("SELECT * FROM run_controls WHERE project_id = ? AND run_id = ? AND request_id = ?", [project.id, input.runId, input.requestId]);
         if (existing) {

package/dist/services/run-controller-adapter.js

@@ -50,7 +50,7 @@ export function controllerEnvironment(context, manifest, session) {
         env.CODEX_HOME = session.codex_home;
     return env;
 }
-export async function controllerAdapter(context, row, manifest, session, args, assertOwner, retainedOperationId) {
+export async function controllerAdapter(context, row, manifest, session, args, assertOwner, retainedOperationId, signal) {
     assertOwner?.();
     const operationId = retainedOperationId ?? `${row.controller_id}:${crypto.randomUUID()}`;
     const executable = manifest.adapters[runtimeHarness(session.profile)].executable;
@@ -60,7 +60,7 @@ export async function controllerAdapter(context, row, manifest, session, args, a
     appendEvent(context, row.controller_id, "operation_requested", { operation_id: operationId, operation: args.slice(0, 2), session_id: session.id || null });
     try {
         assertOwner?.();
-        const receipt = await runHarnessAdapter({ executable, args, env: controllerEnvironment(context, manifest, session), operationId, runtimeOwner: session.owner, timeoutMs: args[0] === "session" && args[1] === "prompt" ? 2 * 60 * 60_000 : 120_000 });
+        const receipt = await runHarnessAdapter({ executable, args, env: controllerEnvironment(context, manifest, session), operationId, runtimeOwner: session.owner, timeoutMs: args[0] === "session" && args[1] === "prompt" ? 2 * 60 * 60_000 : 120_000, ...(signal ? { signal } : {}) });
         context.db.run("UPDATE run_controller_operations SET receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(receipt), context.now(), operationId]);
         const target = args[args.indexOf("--session-id") + 1];
         if (args[0] === "session" && args.includes("--session-id") && adapterSessionId(receipt) !== target)
@@ -73,7 +73,12 @@ export async function controllerAdapter(context, row, manifest, session, args, a
         return receipt;
     }
     catch (error) {
-        context.db.run("UPDATE run_controller_operations SET status = CASE WHEN status = 'dispatching' THEN 'outcome_unknown' ELSE status END, error_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(errorRecord(error)), context.now(), operationId]);
+        try {
+            context.db.run("UPDATE run_controller_operations SET status = CASE WHEN status = 'dispatching' THEN 'outcome_unknown' ELSE status END, error_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(errorRecord(error)), context.now(), operationId]);
+        }
+        catch (persistence) {
+            process.stderr.write(`${JSON.stringify({ operation_id: operationId, primary: errorRecord(error), persistence_error: errorRecord(persistence) })}\n`);
+        }
         throw error;
     }
 }

package/dist/services/run-controller-capture.js

@@ -35,7 +35,7 @@ export async function captureControllerBoundary(context, row, manifest, stage, n
             throw error;
         }
     }
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         assertPhysicalOwner();
         assertRunMutationAllowed(context, row.project_id, row.run_id, row.generation);
@@ -112,7 +112,7 @@ export async function captureControllerBoundary(context, row, manifest, stage, n
                 await delay(observationBudget.nextDelay());
             }
         }
-        context.db.exec("BEGIN IMMEDIATE");
+        context.db.beginWriteTransaction();
         try {
             assertCurrent();
             context.db.run("UPDATE run_controller_operations SET status = 'completed', receipt_json = ?, error_json = NULL, updated_at = ? WHERE operation_id = ?", [JSON.stringify(receipt), context.now(), operationId]);

package/dist/services/run-controller-process.js

@@ -92,7 +92,7 @@ function prepareSpawn(context, row) {
         return null;
     if (launch.value.retired_process)
         retire(resourceContext, row, launch.value.retired_process);
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         assertLaunchAllowed(context, row);
         const changed = context.db.run(`UPDATE run_controllers SET owner_token = ?, owner_pid = NULL, process_id = NULL, process_lease_token = NULL, status = 'starting', last_error_json = NULL, updated_at = ?
@@ -121,7 +121,7 @@ export function claimControllerProcess(context, row) {
     const launch = launchRecord(context, row);
     if (!launch && (!row.process_id || !row.process_lease_token))
         throw new AppError("controller_owner_mismatch", "Managed registration is not authorized", 1);
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         const claimed = context.db.run("UPDATE run_controllers SET owner_pid = ?, status = 'running', updated_at = ? WHERE controller_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [process.pid, context.now(), row.controller_id, row.owner_token]);
         if (claimed.changes !== 1)

package/dist/services/run-controller-recovery.js

@@ -78,7 +78,7 @@ export function recordControllerResume(context, input) {
         if (!previousOwner || previousOwner.lease_token !== row.process_lease_token || previousOwner.kind !== "run-controller" || previousOwner.owner_id !== row.controller_id || previousOwner.project_id !== project.id || previousOwner.run_id !== run.id || managedProcessRuntimeHome(previousOwner, context) !== context.ddFlowHome || !previousOwner.pid || !previousOwner.pid_started_at || processTreeIsAlive(previousOwner))
             throw new AppError("controller_owner_unsettled", "Resume requires proof that the previous physical controller has exited", 1);
         const token = crypto.randomUUID(), now = context.now();
-        context.db.exec("BEGIN IMMEDIATE");
+        context.db.beginWriteTransaction();
         try {
             const duplicate = context.db.get("SELECT input_hash, status FROM run_controller_operations WHERE operation_id = ?", [operationId]);
             if (duplicate) {
@@ -168,7 +168,7 @@ export async function resumeControllerSession(context, row, manifest, state, ass
         throw new AppError("recovery_session_unsettled", "Retained native Session is not ready for same-Session recovery", 1);
     assertRecoveryOwner();
     const prepared = { prepared: true, recovery_id: recovery.recovery_id, session_id: session.id, daemon_id: daemonId, process_id: dispatch.process_id, resume_operation_id: dispatch.resume_operation_id };
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         assertRecoveryOwner();
         const binding = requireManagedDaemonBinding(executionContext, { stateDir: session.state_dir, projectId: row.project_id, runId: row.run_id, ownerId: session.owner.owner_id });
@@ -195,7 +195,7 @@ export async function resumeControllerSession(context, row, manifest, state, ass
     assertRecoveryOwner();
     if (recoveryGuard(context, row.project_id, row.run_id)?.status !== "recovered")
         throw new AppError("trusted_recovery_acceptance_required", "Recovery Turn ended without its native acknowledgement", 1);
-    context.db.exec("BEGIN IMMEDIATE");
+    context.db.beginWriteTransaction();
     try {
         assertRecoveryOwner();
         context.db.run("UPDATE run_controls SET status = 'resumed', updated_at = ? WHERE control_id = ? AND status = 'resuming'", [context.now(), recovery.control_id]);