@deksden-com/dd-flow-cli 0.9.0-beta.7 → 0.9.0-beta.74

package/dist/services/runtime-scope-resume.js

@@ -0,0 +1,543 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { createContext } from "../runtime/context.js";
+import { AppError } from "../shared/errors.js";
+import { getResourceDatabase } from "../storage/database.js";
+import { managedProcessBinding, processIsAlive, processTreeIsAlive, resourceHome } from "./managed-processes.js";
+import { runtimeBudgetStatus, scopeLocalProcessRole, validateRuntimeScopeManifest } from "./runtime-budget.js";
+import { nativeInventoryVersion, retainedDaemonOperations } from "./run-control.js";
+import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
+import { recordControllerResume, resumeRunController } from "./run-controller-recovery.js";
+import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
+import { assertHistoricalDaemonSettlement } from "./native-daemon-history.js";
+const hash = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const nativeLaunchEnvironmentKeys = ["CODEX_HOME", "DD_FLOW_CONFIG_HOME", "DD_FLOW_HOME", "DD_FLOW_BIN", "DD_FLOW_RESOURCE_HOME"];
+function nativeLaunchEnvironment(context, saved) {
+    const env = { ...context.env };
+    for (const name of ["DD_FLOW_CONTROLLER_TOKEN", "DD_FLOW_CONTROL_TOKEN", "DD_FLOW_SCOPE_CONTROL_TOKEN", "DD_FLOW_DAEMON_ID", "DD_FLOW_RUNTIME_OWNER"])
+        delete env[name];
+    if (!saved || Object.keys(saved).some(name => !nativeLaunchEnvironmentKeys.includes(name)))
+        throw new AppError("runtime_scope_native_launch_required", "Native launch has an unsupported environment", 1);
+    for (const name of nativeLaunchEnvironmentKeys) {
+        if (saved[name] === null)
+            delete env[name];
+        else if (typeof saved[name] === "string")
+            env[name] = saved[name];
+        else
+            throw new AppError("runtime_scope_native_launch_required", "Native launch must retain explicit configuration presence", 1);
+    }
+    return env;
+}
+/** The existing detached scope owner drives preparation; clients never own
+ * the lifecycle. All-role release remains distinct from these RUN receipts. */
+export async function prepareRuntimeScopeResume(context, scopeId, generation, releaseRequestId) {
+    const db = getResourceDatabase(resourceHome(context));
+    const assertCurrent = () => {
+        const latest = runtimeBudgetStatus(context, scopeId);
+        if (latest.fence || latest.control?.generation !== generation)
+            throw new AppError("runtime_scope_control_superseded", "Scope resume preparation lost its generation", 1);
+    };
+    const row = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume' AND resource_key = ?", [scopeId]);
+    if (!row)
+        return null;
+    const intent = JSON.parse(row.metadata_json);
+    if (intent.generation !== generation)
+        return null;
+    if (releaseRequestId !== undefined && releaseRequestId !== intent.request_id)
+        throw new AppError("runtime_scope_resume_conflict", "Release belongs to another resume request", 1);
+    if (releaseRequestId !== undefined && intent.status === "released") {
+        const prior = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume-release' AND resource_key = ?", [hash(JSON.stringify([scopeId, generation]))]);
+        if (!prior)
+            throw new AppError("runtime_scope_release_unproven", "Released scope lost its retained grant", 1);
+        const latest = runtimeBudgetStatus(context, scopeId);
+        const last = db.get("SELECT MAX(json_extract(metadata_json, '$.generation')) AS generation FROM managed_resources WHERE resource_kind = 'scope-control-request' AND owner_id = ?", [scopeId]);
+        return { ...JSON.parse(prior.metadata_json), status: "released", dispatch_blocked: latest.dispatch_blocked, current: !latest.fence && !latest.control && last?.generation === generation, settled: false, reused: true };
+    }
+    assertCurrent();
+    const runs = [];
+    for (const source of intent.runs) {
+        let target;
+        try {
+            target = createContext({ ...context.env, DD_FLOW_HOME: source.runtime_home, DD_FLOW_RESOURCE_HOME: resourceHome(context), DD_FLOW_ENGINE_MODE: "1" });
+            const project = target.db.get("SELECT root FROM projects WHERE id = ?", [source.project_id]);
+            const controller = target.db.get("SELECT manifest_json FROM run_controllers WHERE project_id = ? AND run_id = ? AND status NOT IN ('completed','cancelled','superseded')", [source.project_id, source.run_id]);
+            const manifest = controller ? JSON.parse(controller.manifest_json) : null;
+            if (!project || manifest?.budget?.scope_id !== scopeId || manifest.resource_home !== resourceHome(context))
+                throw new AppError("runtime_scope_owner_unknown", "Resume RUN no longer belongs to this retained scope", 1);
+            const input = { projectRoot: project.root, runId: source.run_id, requestId: source.resume_request_id, controlId: source.control_id };
+            db.beginWriteTransaction();
+            try {
+                assertCurrent();
+                recordControllerResume(target, input);
+                db.exec("COMMIT");
+            }
+            catch (error) {
+                db.exec("ROLLBACK");
+                throw error;
+            }
+            assertCurrent();
+            const receipt = await resumeRunController(target, { ...input, waitMs: 0 });
+            assertCurrent();
+            runs.push({ ...source, receipt });
+        }
+        catch (error) {
+            runs.push({ ...source, pending: true, reason: error instanceof AppError ? error.code : "runtime_scope_resume_failed", message: String(error) });
+        }
+        finally {
+            target?.db.close?.();
+        }
+    }
+    const native = [];
+    for (const source of intent.native) {
+        try {
+            const key = hash(JSON.stringify([scopeId, generation, source.process_id]));
+            const saved = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [key]);
+            const restarting = saved && ["starting", "restarted"].includes(JSON.parse(saved.metadata_json).status);
+            const retired = restarting ? null : await retireScopeNative(context, intent, source, assertCurrent);
+            native.push(restarting || retired?.status === "retired" ? await restartScopeNative(context, intent, source, assertCurrent) : retired);
+        }
+        catch (error) {
+            native.push({ ...source, pending: true, reason: error instanceof AppError ? error.code : "runtime_scope_resume_failed", message: String(error) });
+        }
+    }
+    assertCurrent();
+    // Recheck all RUNs together after asynchronous preparation of every role.
+    // These locks will also be the boundary for the eventual release publication.
+    const lockedRuns = new Map(), heldRuns = [];
+    let registryHeld = false, runPreparationConsistent = false;
+    let released = null, releaseError = null, releaseMessage = null;
+    try {
+        for (const home of [...new Set(intent.runs.map((source) => source.runtime_home))].sort())
+            lockedRuns.set(home, createContext({ ...context.env, DD_FLOW_HOME: home, DD_FLOW_RESOURCE_HOME: resourceHome(context), DD_FLOW_ENGINE_MODE: "1" }));
+        db.beginWriteTransaction();
+        registryHeld = true;
+        for (const target of lockedRuns.values()) {
+            target.db.beginWriteTransaction();
+            heldRuns.push(target);
+        }
+        assertCurrent();
+        for (const [index, source] of intent.runs.entries()) {
+            const target = lockedRuns.get(source.runtime_home);
+            const proof = preparedScopeRun(target, { scopeId, requestId: source.resume_request_id, projectId: source.project_id, runId: source.run_id, controlId: source.control_id, recoveryId: source.recovery_id }, assertCurrent);
+            runs[index] = { ...runs[index], ...proof, ...(proof.prepared === true ? { pending: false, reason: null } : {}) };
+        }
+        runPreparationConsistent = true;
+        if (releaseRequestId !== undefined) {
+            const receipt = publishScopeRelease(context, intent, runs, native);
+            db.exec("COMMIT");
+            registryHeld = false;
+            released = receipt;
+        }
+    }
+    catch (error) {
+        releaseError = error instanceof AppError ? error.code : "scope_writer_boundary_unavailable";
+        releaseMessage = error instanceof Error ? error.message : String(error);
+        for (const [index, run] of runs.entries())
+            runs[index] = { ...run, prepared: false, pending: true, reason: error instanceof AppError ? error.code : "scope_writer_boundary_unavailable" };
+    }
+    finally {
+        try {
+            for (const target of heldRuns.reverse())
+                target.db.exec("ROLLBACK");
+        }
+        finally {
+            try {
+                if (registryHeld)
+                    db.exec("ROLLBACK");
+            }
+            finally {
+                for (const target of lockedRuns.values())
+                    target.db.close?.();
+            }
+        }
+    }
+    if (released)
+        return { ...released, status: "released", dispatch_blocked: false, current: true, settled: false, reused: false };
+    assertCurrent();
+    return { scope_id: scopeId, generation, request_id: intent.request_id, status: "preparing", dispatch_blocked: true, settled: false, release_error: releaseError ? { code: releaseError, message: releaseMessage } : null, run_preparation_consistent: runPreparationConsistent, runs, native, probes: intent.probes, pending_reasons: [...new Set(["scope_release_required", ...(releaseError ? [releaseError] : []), ...(!runPreparationConsistent ? ["scope_writer_boundary_unavailable"] : []), ...(runs.some(item => item.prepared !== true) ? ["run_recovery_required"] : []), ...(native.some(item => item?.prepared !== true) ? ["non_work_recovery_required"] : []), ...(intent.probes.length ? ["probe_reconciliation_required"] : [])])] };
+}
+/** Called only inside the registry + all-RUN writer boundary above. */
+function publishScopeRelease(context, intent, runs, native) {
+    const db = getResourceDatabase(resourceHome(context));
+    if (runs.some(run => run.prepared !== true) || native.some(owner => owner?.prepared !== true))
+        throw new AppError("runtime_scope_preparation_required", "Every owned RUN and native Session must be prepared", 1);
+    const manifest = validateRuntimeScopeManifest(intent.manifest, intent.scope_id);
+    const artifactRow = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control-capture' AND resource_key = ?", [intent.capture_key]);
+    const artifact = artifactRow ? JSON.parse(artifactRow.metadata_json) : null;
+    const journal = path.join(path.dirname(manifest.manifest_path), "events.jsonl");
+    if (artifact?.scope_id !== intent.scope_id || artifact.generation !== intent.generation || artifact.journal_source !== journal || typeof artifact.journal_bytes !== "string" || !fs.readFileSync(journal).equals(Buffer.from(artifact.journal_bytes)))
+        throw new AppError("runtime_scope_journal_changed", "Release source changed after capture", 1);
+    const operations = new Map();
+    const events = artifact.journal_bytes.trimEnd().split("\n").map((line) => JSON.parse(line));
+    for (const event of events) {
+        if (!event.type.startsWith("dev.dd.eval.operation."))
+            continue;
+        const phase = event.type.slice("dev.dd.eval.operation.".length), id = event.data.operation_id;
+        const prior = operations.get(id);
+        if (typeof id !== "string" || !id || typeof event.data.operation !== "string" || !event.data.operation || !["requested", "started", "suspended", "observation_lost", "completed", "failed", "cancelled"].includes(phase) || !["requested", "started"].includes(phase) && !prior?.started || prior?.terminal && ["requested", "started"].includes(phase))
+            throw new AppError("runtime_scope_journal_invalid", "Release operation has invalid dispatch history", 1);
+        if (prior && (prior.operation !== event.data.operation || prior.execution !== (event.executionid ?? null)))
+            throw new AppError("runtime_scope_journal_invalid", "Release operation changed its ownership", 1);
+        const terminal = ["completed", "failed", "cancelled"].includes(phase) ? phase : null;
+        const terminalHash = terminal ? hash(JSON.stringify({ terminal, result: terminal === "completed" ? event.data.result : { error: event.data.error ?? null } })) : null;
+        if (terminal && prior?.terminal && (prior.terminal !== terminal || prior.terminal_hash !== terminalHash))
+            throw new AppError("runtime_scope_journal_invalid", "Release operation has conflicting terminal outcomes", 1);
+        operations.set(id, { operation: event.data.operation, execution: event.executionid ?? null, started: prior?.started === true || phase === "started", terminal: terminal ?? prior?.terminal ?? null, terminal_hash: terminalHash ?? prior?.terminal_hash ?? null });
+    }
+    const probes = intent.probes.map(raw => {
+        const probe = raw;
+        const record = db.get("SELECT * FROM managed_processes WHERE id = ?", [probe?.process_id ?? ""]);
+        if (record?.kind === "eval-observer") {
+            if (scopeLocalProcessRole(record) !== "observer" || record.owner_id !== intent.scope_id || probe.physical_settled !== true || processTreeIsAlive(record))
+                throw new AppError("scope_operation_reconciliation_required", "EVAL observer requires its retired physical owner", 1);
+            // This proves only local writer retirement. The operation loop below
+            // still requires every interrupted experiment operation to reconcile.
+            return { process_id: record.id, operation_id: record.operation_id, role: "observer", outcome: "retired", reconciliation: "captured_journal" };
+        }
+        const execution = manifest.execution_ids.find(id => record?.operation_id?.startsWith(`${intent.scope_id}:${id}:launch:`));
+        const operationId = execution ? `${intent.scope_id}:${execution}:launch` : "", checkId = record?.operation_id?.slice(operationId.length + 1);
+        const parent = operations.get(operationId);
+        const references = events.filter((event) => event.type === "dev.dd.eval.execution.context_prepared" && event.executionid === execution).map((event) => event.data.baseline_admission);
+        const reference = references[0], file = execution ? path.join(path.dirname(manifest.manifest_path), "executions", execution, "baseline-admission", "receipt.json") : "";
+        if (!record || record.kind !== "eval-baseline" || record.owner_id !== intent.scope_id || JSON.parse(record.metadata_json).role !== "probe" || probe.physical_settled !== true || processTreeIsAlive(record) || !execution || !checkId || !/^[a-z0-9-]+$/.test(checkId) || !parent?.started || parent.operation !== `execution.${execution}.launch` || parent.execution !== execution || !reference || reference.file !== file || !/^[a-f0-9]{64}$/.test(reference.sha256 ?? "") || references.some((item) => JSON.stringify(item) !== JSON.stringify(reference)))
+            throw new AppError("probe_reconciliation_required", "Local probe has no retained baseline admission outcome", 1);
+        const bytes = fs.readFileSync(file), receipt = JSON.parse(bytes.toString("utf8"));
+        const source = JSON.parse(artifact.manifest_bytes);
+        if (hash(bytes) !== reference.sha256 || receipt.schema_id !== "dd-eval/baseline-admission@1" || receipt.status !== "passed" || receipt.checkpoint_id !== source.input_checkpoint?.id || receipt.checkpoint_sha256 !== source.input_checkpoint?.sha256 || !receipt.checkpoint_id || !receipt.checkpoint_sha256 || receipt.policy_sha256 !== reference.policy_sha256 || !/^[a-f0-9]{64}$/.test(receipt.policy_sha256 ?? "") || !Array.isArray(receipt.checks) || receipt.checks.filter((check) => check.id === checkId).length !== 1 || receipt.checks.some((check) => check.exit_code !== 0 || check.timed_out !== false))
+            throw new AppError("probe_reconciliation_required", "Local probe baseline evidence is incomplete or changed", 1);
+        return { process_id: record.id, operation_id: record.operation_id, parent_operation_id: operationId, outcome: "completed", receipt_file: file, receipt_sha256: reference.sha256 };
+    });
+    for (const [id, operation] of operations) {
+        if (!operation.started || operation.terminal === "completed" || operation.terminal === "cancelled")
+            continue;
+        if (operation.terminal || !operation.execution || !manifest.execution_ids.includes(operation.execution) || operation.operation !== `execution.${operation.execution}.launch` || id !== `${intent.scope_id}:${operation.execution}:launch`)
+            throw new AppError("scope_operation_reconciliation_required", "Release has an unresolved EVAL operation", 1);
+        const retained = JSON.parse(fs.readFileSync(path.join(path.dirname(manifest.manifest_path), "executions", operation.execution, "managed-runtime.json"), "utf8"));
+        if (retained.schema_id !== "dd-eval/managed-runtime@1" || !runs.some(run => run.runtime_home === retained.runtime_root && run.run_id === retained.run_id))
+            throw new AppError("scope_operation_reconciliation_required", "Unresolved execution has no prepared retained RUN", 1);
+    }
+    const current = runtimeBudgetStatus(context, intent.scope_id);
+    if (current.fence || current.control?.generation !== intent.generation || current.provider_turns.length)
+        throw new AppError("runtime_scope_inventory_changed", "Release lost its scope generation or provider settlement", 1);
+    const bindings = [...intent.process_bindings];
+    for (const run of runs)
+        bindings.push(...run.process_bindings);
+    for (const owner of native)
+        bindings.push(owner.replacement_binding);
+    for (const proof of [...runs.map(run => run.native), ...native]) {
+        if (nativeInventoryVersion(proof.state_dir) !== proof.inventory_version)
+            throw new AppError("runtime_scope_inventory_changed", "Native preparation changed before release", 1);
+        const state = readNativeDaemonState(proof.state_dir);
+        if (state.provider_process) {
+            const daemon = db.get("SELECT * FROM managed_processes WHERE id = ?", [state.resource_process?.id ?? ""]);
+            const provider = db.get("SELECT * FROM managed_processes WHERE id = ?", [state.provider_process.id ?? ""]);
+            const daemonMetadata = daemon ? JSON.parse(daemon.metadata_json) : null, providerMetadata = provider ? JSON.parse(provider.metadata_json) : null;
+            if (!daemon || !provider || !bindings.some(binding => JSON.stringify(binding) === JSON.stringify(managedProcessBinding(daemon, resourceHome(context))))
+                || daemon.pid !== state.pid || daemon.lease_token !== state.resource_process?.lease_token
+                || provider.kind !== daemon.kind.replace(/-daemon$/, "-provider") || provider.pid !== state.provider_pid || !provider.pid || !provider.pid_started_at || provider.lease_token !== state.provider_process.lease_token
+                || provider.owner_id !== daemon.owner_id || provider.project_id !== daemon.project_id || provider.run_id !== daemon.run_id || provider.work_id !== daemon.work_id
+                || providerMetadata.owner_pid !== daemon.pid || providerMetadata.owner_pid_started_at !== daemon.pid_started_at
+                || providerMetadata.state_dir !== proof.state_dir || providerMetadata.dd_flow_home !== daemonMetadata.dd_flow_home || providerMetadata.role !== daemonMetadata.role || JSON.stringify(providerMetadata.budget) !== JSON.stringify(daemonMetadata.budget))
+                throw new AppError("runtime_scope_owner_unknown", "Native provider has no exact prepared daemon ownership", 1);
+            bindings.push(managedProcessBinding(provider, resourceHome(context)));
+        }
+        if (nativeInventoryVersion(proof.state_dir) !== proof.inventory_version)
+            throw new AppError("runtime_scope_inventory_changed", "Native preparation changed while checking its provider", 1);
+    }
+    const actual = current.processes.map(record => managedProcessBinding(record, resourceHome(context)));
+    if (actual.some(binding => !bindings.some(expected => JSON.stringify(binding) === JSON.stringify(expected))) || bindings.some(expected => !actual.some(binding => JSON.stringify(binding) === JSON.stringify(expected))))
+        throw new AppError("runtime_scope_inventory_changed", "Release has an unverified process registration", 1);
+    const key = hash(JSON.stringify([intent.scope_id, intent.generation])), now = context.now();
+    const receipt = { scope_id: intent.scope_id, generation: intent.generation, request_id: intent.request_id, source_request_id: intent.source_request_id, capture_key: intent.capture_key, journal_sha256: hash(artifact.journal_bytes), run_operations: runs.map(run => run.run_operation), native, probes, process_bindings: actual, released_at: now };
+    db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume-release',?,?,?,?,NULL,?,?,?)", [key, intent.scope_id, key, now, JSON.stringify(receipt), now, now]);
+    if (db.run("DELETE FROM managed_resources WHERE resource_kind = 'scope-control' AND resource_key = ? AND json_extract(metadata_json, '$.generation') = ?", [intent.scope_id, intent.generation]).changes !== 1)
+        throw new AppError("runtime_scope_control_superseded", "Release lost its control generation", 1);
+    db.run("UPDATE managed_resources SET metadata_json = json_set(metadata_json, '$.status', 'released'), updated_at = ? WHERE resource_kind = 'scope-resume' AND resource_key = ?", [now, intent.scope_id]);
+    return receipt;
+}
+/** A preparation snapshot, not an unfence. The release arbiter must repeat
+ * these reads while holding every participating RUN writer boundary. */
+function preparedScopeRun(context, input, assertCurrent) {
+    const registry = getResourceDatabase(resourceHome(context));
+    registry.exec("SAVEPOINT scope_run_registry");
+    let readingRun = false;
+    try {
+        context.db.exec("SAVEPOINT scope_run_preparation");
+        readingRun = true;
+        assertCurrent();
+        const controller = context.db.get("SELECT * FROM run_controllers WHERE project_id = ? AND run_id = ? AND status NOT IN ('completed','cancelled','superseded')", [input.projectId, input.runId]);
+        if (!controller)
+            throw new AppError("runtime_scope_owner_unknown", "Prepared RUN lost its controller", 1);
+        const state = JSON.parse(controller.state_json), manifest = JSON.parse(controller.manifest_json);
+        const operation = context.db.get(`SELECT o.operation_id, o.receipt_json FROM run_controller_operations o
+      JOIN run_controls ctl ON ctl.control_id = ? AND ctl.project_id = ? AND ctl.run_id = ?
+      JOIN run_recovery_guards g ON g.recovery_id = ctl.recovery_id
+      WHERE o.controller_id = ? AND o.generation = ? AND o.status = 'accepted'
+        AND ctl.status = 'resuming' AND ctl.recovery_id = ? AND g.generation = o.generation AND g.status = 'resuming'
+        AND json_extract(o.input_json, '$.action') = 'control_resume' AND json_extract(o.input_json, '$.request_id') = ?`, [input.controlId, input.projectId, input.runId, controller.controller_id, controller.generation, input.recoveryId, input.requestId]);
+        const prepared = operation?.receipt_json ? JSON.parse(operation.receipt_json) : null;
+        if (prepared?.prepared !== true)
+            return { prepared: false, pending: true, reason: "run_recovery_preparation_required" };
+        const session = state.current_session === null ? null : state.sessions[state.current_session];
+        const owner = registry.get("SELECT * FROM managed_processes WHERE id = ?", [controller.process_id]);
+        if (!session || manifest.budget?.scope_id !== input.scopeId || manifest.resource_home !== resourceHome(context) || state.recovery?.operation_id !== operation.operation_id || state.recovery?.control_id !== input.controlId || state.recovery?.recovery_id !== input.recoveryId || prepared.recovery_id !== input.recoveryId || prepared.session_id !== session.id || !owner || owner.lease_token !== controller.process_lease_token || owner.pid !== controller.owner_pid || owner.owner_id !== controller.controller_id || !processIsAlive(owner))
+            throw new AppError("runtime_scope_owner_unknown", "RUN preparation lost its current owner or Session", 1);
+        const native = requireManagedDaemonBinding(context, { stateDir: session.state_dir, projectId: input.projectId, runId: input.runId, ownerId: session.owner.owner_id });
+        const loaded = context.db.get("SELECT receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'completed'", [prepared.resume_operation_id, controller.controller_id, controller.generation]);
+        const loadReceipt = loaded?.receipt_json ? JSON.parse(loaded.receipt_json) : null;
+        if (!processIsAlive(native.process) || native.process.id !== prepared.process_id || native.state.daemon_id !== prepared.daemon_id || loadReceipt?.settled !== true || adapterSessionId(loadReceipt) !== session.id)
+            throw new AppError("runtime_scope_owner_unknown", "RUN preparation has no current native load acknowledgement", 1);
+        return { prepared: true, run_operation: { runtime_home: context.ddFlowHome, controller_id: controller.controller_id, operation_id: operation.operation_id }, process_bindings: [managedProcessBinding(owner, resourceHome(context)), managedProcessBinding(native.process, resourceHome(context))], native: { state_dir: session.state_dir, daemon_id: prepared.daemon_id, session_id: session.id, inventory_version: nativeInventoryVersion(session.state_dir) } };
+    }
+    finally {
+        try {
+            if (readingRun)
+                context.db.exec("RELEASE scope_run_preparation");
+        }
+        finally {
+            registry.exec("RELEASE scope_run_registry");
+        }
+    }
+}
+async function restartScopeNative(context, intent, source, assertCurrent) {
+    const db = getResourceDatabase(resourceHome(context)), key = hash(JSON.stringify([intent.scope_id, intent.generation, source.process_id]));
+    const saved = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [key]);
+    const operation = JSON.parse(saved.metadata_json);
+    const startup = source.operations.find(item => item.operation === "daemon.start" && item.result?.daemon_id === source.daemon_id);
+    const launch = startup.launch;
+    const state = () => JSON.parse(fs.readFileSync(path.join(source.state_dir, "daemon.json"), "utf8"));
+    const assertRetired = () => {
+        assertCurrent();
+        const old = db.get("SELECT * FROM managed_processes WHERE id = ?", [source.process_id]);
+        if (!old || processTreeIsAlive(old) || JSON.stringify(managedProcessBinding(old, resourceHome(context))) !== JSON.stringify(intent.process_bindings.find(item => item.process_id === source.process_id)))
+            throw new AppError("runtime_scope_owner_unknown", "The retired native tree changed or is still alive", 1);
+    };
+    assertRetired();
+    let dispatch = false;
+    db.beginWriteTransaction();
+    try {
+        assertRetired();
+        if (operation.status === "retired") {
+            const old = state();
+            if (old.daemon_id !== source.daemon_id || old.shutdown_state !== "clean")
+                throw new AppError("runtime_scope_owner_unknown", "Native restart lost its clean predecessor", 1);
+            operation.status = "starting";
+            operation.restart_operation_id = `scope-restart:${key}`;
+            dispatch = true;
+            db.run("UPDATE managed_resources SET metadata_json = ?, updated_at = ? WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [JSON.stringify(operation), context.now(), key]);
+        }
+        db.exec("COMMIT");
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+    if (!operation.restart_receipt) {
+        if (dispatch) {
+            const env = nativeLaunchEnvironment(context, launch.env);
+            assertRetired();
+            operation.restart_receipt = await runHarnessAdapter({ executable: launch.executable, args: launch.args, cwd: launch.cwd, env, runtimeOwner: source.runtime_owner, operationId: operation.restart_operation_id, timeoutMs: 30_000 });
+        }
+        else {
+            const retained = retainedDaemonOperations(source.state_dir).find(item => item.operation_id === operation.restart_operation_id && item.operation === "daemon.start" && item.predecessor_daemon_id === source.daemon_id && item.state === "completed");
+            if (!retained)
+                return { ...source, ...operation, pending: true, reason: "native_restart_outcome_unknown" };
+            operation.restart_receipt = retained.result;
+        }
+    }
+    assertRetired();
+    const daemon = state(), replacement = db.get("SELECT * FROM managed_processes WHERE id = ?", [daemon.resource_process?.id ?? ""]);
+    const metadata = replacement ? JSON.parse(replacement.metadata_json) : null;
+    if (!replacement || !replacement.kind.endsWith("-daemon") || replacement.id === source.process_id || !processIsAlive(replacement) || replacement.pid !== daemon.pid || replacement.lease_token !== daemon.resource_process?.lease_token || replacement.owner_id !== source.runtime_owner.owner_id || replacement.run_id || replacement.work_id || replacement.project_id !== (source.runtime_owner.project_id ?? null) || metadata?.role !== source.role || metadata?.state_dir !== source.state_dir || metadata?.dd_flow_home !== source.runtime_owner.dd_flow_home || metadata?.adapter_executable !== launch.executable || JSON.stringify(metadata?.budget) !== JSON.stringify(source.runtime_owner.budget) || daemon.daemon_id === source.daemon_id || daemon.daemon_id !== operation.restart_receipt.daemon_id || operation.restart_receipt.already_running === true || JSON.stringify(daemon.config?.runtime_owner) !== JSON.stringify(source.runtime_owner))
+        throw new AppError("runtime_scope_owner_unknown", "Native restart has no fresh bound physical owner", 1);
+    const binding = managedProcessBinding(replacement, resourceHome(context));
+    if (operation.replacement_binding && JSON.stringify(operation.replacement_binding) !== JSON.stringify(binding))
+        throw new AppError("runtime_scope_owner_unknown", "Native replacement registration changed", 1);
+    operation.status = "restarted";
+    operation.replacement_binding = binding;
+    db.run("UPDATE managed_resources SET metadata_json = ?, updated_at = ? WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [JSON.stringify(operation), context.now(), key]);
+    const assertReplacement = () => {
+        assertRetired();
+        const current = db.get("SELECT * FROM managed_processes WHERE id = ?", [replacement.id]), latest = state();
+        if (!current || !processIsAlive(current) || JSON.stringify(managedProcessBinding(current, resourceHome(context))) !== JSON.stringify(binding) || latest.daemon_id !== daemon.daemon_id || latest.resource_process?.id !== current.id || latest.resource_process?.lease_token !== current.lease_token || JSON.stringify(latest.config?.runtime_owner) !== JSON.stringify(source.runtime_owner))
+            throw new AppError("runtime_scope_owner_unknown", "Session loading lost its native replacement", 1);
+    };
+    if (!Array.isArray(source.sessions) || !source.sessions.length || source.sessions.some(item => typeof item.session_id !== "string" || !item.session_id) || new Set(source.sessions.map(item => item.session_id)).size !== source.sessions.length)
+        throw new AppError("runtime_scope_owner_unknown", "Native recovery has no exact Session inventory", 1);
+    const sessions = [];
+    for (const session of source.sessions) {
+        const operationId = `scope-load:${hash(JSON.stringify([intent.scope_id, intent.generation, source.process_id, session.session_id]))}`;
+        let load, dispatchLoad = false;
+        db.beginWriteTransaction();
+        try {
+            assertReplacement();
+            const row = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume-native-load' AND resource_key = ?", [operationId]);
+            if (row)
+                load = JSON.parse(row.metadata_json);
+            else {
+                load = { scope_id: intent.scope_id, generation: intent.generation, request_id: intent.request_id, source_process_id: source.process_id, process_id: replacement.id, daemon_id: daemon.daemon_id, session_id: session.session_id, status: "dispatching" };
+                const now = context.now();
+                db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume-native-load',?,?,?,?,NULL,?,?,?)", [operationId, intent.scope_id, operationId, now, JSON.stringify(load), now, now]);
+                dispatchLoad = true;
+            }
+            if (load.scope_id !== intent.scope_id || load.generation !== intent.generation || load.request_id !== intent.request_id || load.source_process_id !== source.process_id || load.process_id !== replacement.id || load.daemon_id !== daemon.daemon_id || load.session_id !== session.session_id)
+                throw new AppError("runtime_scope_owner_unknown", "Retained Session load belongs to another physical owner", 1);
+            db.exec("COMMIT");
+        }
+        catch (error) {
+            db.exec("ROLLBACK");
+            throw error;
+        }
+        if (!load.receipt) {
+            if (dispatchLoad) {
+                assertReplacement();
+                const args = launch.args.slice(2).filter((value, index, all) => value !== "--session-id" && all[index - 1] !== "--session-id");
+                load.receipt = await runHarnessAdapter({ executable: launch.executable, args: ["session", "resume", ...args, "--session-id", session.session_id, "--json"], cwd: launch.cwd, env: nativeLaunchEnvironment(context, launch.env), runtimeOwner: source.runtime_owner, operationId, timeoutMs: 30_000 });
+            }
+            else {
+                const retained = retainedDaemonOperations(source.state_dir).find(item => item.operation_id === operationId && item.operation === "session.resume" && item.daemon_id === daemon.daemon_id && item.session_id === session.session_id && item.state === "completed");
+                if (!retained)
+                    return { ...source, ...operation, sessions, pending: true, reason: "native_session_load_outcome_unknown" };
+                load.receipt = retained.result;
+            }
+        }
+        assertReplacement();
+        if (adapterSessionId(load.receipt) !== session.session_id || load.receipt.settled !== true)
+            throw new AppError("runtime_scope_session_unsettled", "Native load did not confirm the same settled Session", 1);
+        load.status = "prepared";
+        db.run("UPDATE managed_resources SET metadata_json = ?, updated_at = ? WHERE resource_kind = 'scope-resume-native-load' AND resource_key = ?", [JSON.stringify(load), context.now(), operationId]);
+        sessions.push({ session_id: session.session_id, operation_id: operationId, receipt: load.receipt, prepared: true });
+    }
+    return { ...source, ...operation, inventory_version: nativeInventoryVersion(source.state_dir), sessions, prepared: true, pending: true, reason: "scope_release_required" };
+}
+async function retireScopeNative(context, intent, source, assertCurrent) {
+    const db = getResourceDatabase(resourceHome(context)), key = hash(JSON.stringify([intent.scope_id, intent.generation, source.process_id]));
+    const record = db.get("SELECT * FROM managed_processes WHERE id = ?", [source.process_id]);
+    const frozen = intent.process_bindings.find((binding) => binding.process_id === source.process_id);
+    const state = () => JSON.parse(fs.readFileSync(path.join(source.state_dir, "daemon.json"), "utf8"));
+    const assertOwner = () => {
+        assertCurrent();
+        const current = db.get("SELECT * FROM managed_processes WHERE id = ?", [source.process_id]), daemon = state();
+        if (!current || current.run_id || !["judge", "probe"].includes(source.role) || JSON.stringify(managedProcessBinding(current, resourceHome(context))) !== JSON.stringify(frozen) || daemon.daemon_id !== source.daemon_id || daemon.resource_process?.id !== current.id || daemon.resource_process?.lease_token !== current.lease_token || JSON.stringify(daemon.config?.runtime_owner) !== JSON.stringify(source.runtime_owner))
+            throw new AppError("runtime_scope_owner_unknown", "Native retirement lost its frozen physical owner", 1);
+    };
+    assertOwner();
+    const startup = source.operations?.filter(operation => operation.operation === "daemon.start" && operation.state === "completed" && operation.result?.daemon_id === source.daemon_id);
+    const launch = (startup?.length === 1 ? startup[0].launch : null);
+    let launchOwner;
+    try {
+        launchOwner = JSON.parse(launch?.runtime_owner ?? "null");
+    }
+    catch {
+        launchOwner = null;
+    }
+    if (!launch || launch.schema_id !== "dd-flow/native-launch@1" || launch.executable !== source.runtime_owner?.adapter_executable || !path.isAbsolute(launch.executable) || !path.isAbsolute(launch.cwd) || !Array.isArray(launch.args) || launch.args[0] !== "daemon" || launch.args[1] !== "start" || launch.args[launch.args.indexOf("--state-dir") + 1] !== source.state_dir || !isDeepStrictEqual(launchOwner, source.runtime_owner))
+        throw new AppError("runtime_scope_native_launch_required", "Native recovery requires the original owned launch contract", 1);
+    if (!launch.env || Object.keys(launch.env).some(name => !nativeLaunchEnvironmentKeys.includes(name)) || nativeLaunchEnvironmentKeys.some(name => launch.env[name] !== null && typeof launch.env[name] !== "string") || launch.args.some(arg => typeof arg !== "string"))
+        throw new AppError("runtime_scope_native_launch_required", "Native recovery requires explicit configuration presence before retiring its owner", 1);
+    let operation;
+    let dispatch = false;
+    db.beginWriteTransaction();
+    try {
+        assertOwner();
+        const saved = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [key]);
+        if (saved)
+            operation = JSON.parse(saved.metadata_json);
+        else {
+            if (nativeInventoryVersion(source.state_dir) !== source.inventory_version)
+                throw new AppError("runtime_scope_inventory_changed", "Native owner changed before retirement", 1);
+            operation = { scope_id: intent.scope_id, generation: intent.generation, request_id: intent.request_id, process_id: source.process_id, daemon_id: source.daemon_id, operation_id: `scope-retire:${key}`, status: "retiring" };
+            const now = context.now();
+            db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume-native',?,?,?,?,NULL,?,?,?)", [key, intent.scope_id, key, now, JSON.stringify(operation), now, now]);
+            dispatch = true;
+        }
+        db.exec("COMMIT");
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+    if (!operation.receipt) {
+        if (dispatch) {
+            assertOwner();
+            operation.receipt = await runHarnessAdapter({ executable: launch.executable, args: ["daemon", "stop", "--state-dir", source.state_dir, "--json"], env: { ...context.env, DD_FLOW_HOME: source.runtime_owner.dd_flow_home, DD_FLOW_RESOURCE_HOME: resourceHome(context) }, operationId: operation.operation_id, timeoutMs: 30_000 });
+        }
+        else {
+            const retained = retainedDaemonOperations(source.state_dir).find(item => item.operation_id === operation.operation_id && item.operation === "daemon.stop" && item.daemon_id === source.daemon_id && item.state === "completed");
+            if (!retained)
+                return { ...source, ...operation, pending: true, reason: "native_retirement_outcome_unknown" };
+            operation.receipt = retained.result;
+        }
+        assertOwner();
+        db.run("UPDATE managed_resources SET metadata_json = ?, updated_at = ? WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [JSON.stringify(operation), context.now(), key]);
+    }
+    if (operation.receipt.stopped !== true || operation.receipt.clean !== true || state().shutdown_state !== "clean" || processTreeIsAlive(record))
+        return { ...source, ...operation, pending: true, reason: "native_retirement_settlement_required" };
+    assertOwner();
+    operation.status = "retired";
+    db.run("UPDATE managed_resources SET metadata_json = ?, updated_at = ? WHERE resource_kind = 'scope-resume-native' AND resource_key = ?", [JSON.stringify(operation), context.now(), key]);
+    return { ...source, ...operation, pending: true, reason: "native_restart_required" };
+}
+/** Freeze the preparation plan under the same arbiter as stop. This accepts
+ * ownership work, not productive dispatch; only all-role release may unfence. */
+export function recordRuntimeScopeResume(context, input) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.requestId) || !Number.isSafeInteger(input.generation) || input.generation < 1 || !/^[a-f0-9]{64}$/.test(input.captureKey))
+        throw new AppError("runtime_scope_resume_invalid", "Scope resume requires its exact generation, capture and request identity", 2);
+    const db = getResourceDatabase(resourceHome(context)), key = hash(JSON.stringify([input.scopeId, input.requestId]));
+    db.beginWriteTransaction();
+    try {
+        const latest = runtimeBudgetStatus(context, input.scopeId);
+        const control = latest.control;
+        const prior = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume-request' AND resource_key = ?", [key]);
+        if (prior) {
+            const receipt = JSON.parse(prior.metadata_json);
+            if (receipt.generation !== input.generation || receipt.capture_key !== input.captureKey)
+                throw new AppError("runtime_scope_resume_conflict", "Resume request identity was used for another source", 1);
+            const active = latest.resume;
+            const sameRequest = active?.generation === input.generation && active.request_id === input.requestId;
+            db.exec("COMMIT");
+            return { ...receipt, ...(sameRequest ? active : {}), ...(sameRequest && active.status === "released" ? { release: latest.release } : {}), current: sameRequest && active.current === true, reused: true };
+        }
+        if (latest.fence || control?.generation !== input.generation)
+            throw new AppError("runtime_scope_control_superseded", "Resume source is not the current recoverable scope control", 1);
+        const existing = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-resume' AND resource_key = ?", [input.scopeId]);
+        if (existing && JSON.parse(existing.metadata_json).generation === input.generation)
+            throw new AppError("runtime_scope_resume_conflict", "This scope generation already has a resume owner", 1);
+        const drainRow = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control-drain' AND resource_key = ?", [hash(JSON.stringify([input.scopeId, input.generation]))]);
+        const drain = drainRow ? JSON.parse(drainRow.metadata_json) : null;
+        if (drain?.scope_id !== input.scopeId || drain.generation !== input.generation || drain.requested_mode !== control.requested_mode || drain.physical_settled !== true || drain.capture?.journal?.artifact_key !== input.captureKey || drain.capture.journal.trailing_bytes !== 0 || !Array.isArray(drain.capture.run_captures) || drain.capture.run_captures.some((run) => run.status !== "verified"))
+            throw new AppError("runtime_scope_capture_required", "Resume requires a complete all-role drain and verified RUN captures", 1);
+        const manifest = validateRuntimeScopeManifest(drain.capture.manifest, input.scopeId);
+        if (JSON.stringify(manifest) !== JSON.stringify(latest.manifest))
+            throw new AppError("runtime_scope_manifest_changed", "Resume scope manifest changed after capture", 1);
+        const bindings = latest.processes.map(record => managedProcessBinding(record, resourceHome(context)));
+        const ordered = (items) => JSON.stringify([...items].sort((a, b) => a.process_id.localeCompare(b.process_id)));
+        if (!Array.isArray(drain.process_bindings) || ordered(bindings) !== ordered(drain.process_bindings) || latest.provider_turns.length)
+            throw new AppError("runtime_scope_inventory_changed", "Owned process or provider inventory changed after capture", 1);
+        for (const owner of drain.native ?? []) {
+            if (owner.historical === true) {
+                assertHistoricalDaemonSettlement(context, input.scopeId, owner);
+                continue;
+            }
+            if (typeof owner.state_dir !== "string" || owner.native_settled !== true || nativeInventoryVersion(owner.state_dir) !== owner.inventory_version)
+                throw new AppError("runtime_scope_inventory_changed", "Native owner changed after capture", 1);
+        }
+        const artifactRow = db.get("SELECT metadata_json FROM managed_resources WHERE resource_kind = 'scope-control-capture' AND resource_key = ?", [input.captureKey]);
+        const artifact = artifactRow ? JSON.parse(artifactRow.metadata_json) : null;
+        if (artifact?.scope_id !== input.scopeId || artifact.generation !== input.generation || typeof artifact.manifest_bytes !== "string" || typeof artifact.journal_bytes !== "string" || artifact.journal_source !== path.join(path.dirname(manifest.manifest_path), "events.jsonl") || hash(artifact.manifest_bytes) !== manifest.manifest_sha256 || hash(JSON.stringify([input.scopeId, input.generation, manifest.manifest_sha256, hash(artifact.journal_bytes)])) !== input.captureKey || !fs.readFileSync(artifact.journal_source).equals(Buffer.from(artifact.journal_bytes)))
+            throw new AppError("runtime_scope_journal_changed", "Resume requires the current immutable EVAL journal capture", 1);
+        const runs = drain.capture.run_captures.map((run) => ({ ...run, resume_request_id: `scope-resume:${hash(JSON.stringify([input.scopeId, input.generation, input.requestId, run.runtime_home, run.project_id, run.run_id]))}` }));
+        const receipt = { scope_id: input.scopeId, generation: input.generation, request_id: input.requestId, source_request_id: control.request_id, capture_key: input.captureKey, status: "preparing", dispatch_blocked: true, manifest, process_bindings: bindings, runs, native: drain.capture.native_bindings, probes: drain.capture.probe_operations, requested_at: context.now() };
+        const payload = JSON.stringify(receipt), now = context.now();
+        db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume-request',?,?,?,?,NULL,?,?,?)", [key, input.scopeId, key, now, payload, now, now]);
+        db.run("INSERT INTO managed_resources (resource_kind,resource_key,owner_id,lease_token,lease_expires_at,process_id,metadata_json,created_at,updated_at) VALUES ('scope-resume',?,?,?,?,NULL,?,?,?) ON CONFLICT(resource_kind,resource_key) DO UPDATE SET lease_token = excluded.lease_token, metadata_json = excluded.metadata_json, updated_at = excluded.updated_at", [input.scopeId, input.scopeId, key, now, payload, now, now]);
+        db.exec("COMMIT");
+        return { ...receipt, current: true, reused: false };
+    }
+    catch (error) {
+        db.exec("ROLLBACK");
+        throw error;
+    }
+}