@rashidee/co2 1.3.18 → 1.3.20

package/dist/index.js

@@ -6809,7 +6809,7 @@ var {
 // package.json
 var package_default = {
   name: "@rashidee/co2",
-  version: "1.3.18",
+  version: "1.3.20",
   description: "Compound Context Studio \u2014 self-hosted team context authoring for CO2 projects",
   type: "module",
   license: "MIT",
@@ -21875,6 +21875,7 @@ import { spawn as spawn2 } from "child_process";
 import { randomBytes as randomBytes2 } from "crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
 import { request as httpRequest2 } from "http";
+import { createServer as createNetServer } from "net";
 import { join as join9 } from "path";
 function svcError6(code, status) {
   return Object.assign(new Error(code), { code, status });
@@ -21896,8 +21897,22 @@ process.once("SIGINT", () => {
   killSpawnedApps();
   process.exit(130);
 });
-function cicdGuardTokenValid(projectId, token) {
-  return !!token && guardTokens.get(projectId) === token;
+function persistGuardToken(db, projectId, token) {
+  try {
+    db.update(cicdSetups).set({ guardToken: token, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cicdSetups.projectId, projectId)).run();
+  } catch {
+  }
+}
+function cicdGuardTokenValid(db, projectId, token) {
+  if (!token) return false;
+  const mem = guardTokens.get(projectId);
+  if (mem !== void 0) return mem === token;
+  const row = db.select({ t: cicdSetups.guardToken }).from(cicdSetups).where(eq(cicdSetups.projectId, projectId)).get();
+  if (row?.t) {
+    guardTokens.set(projectId, row.t);
+    return row.t === token;
+  }
+  return false;
 }
 function resolveCicdApp(db, workspacePath, projectId) {
   const project = db.select().from(projects).where(eq(projects.id, projectId)).get();
@@ -21930,6 +21945,49 @@ function probeApp(port, timeoutMs = 1e3) {
     req.end();
   });
 }
+function portFree(port) {
+  return new Promise((resolve5) => {
+    const srv = createNetServer();
+    srv.once("error", () => resolve5(false));
+    srv.once("listening", () => srv.close(() => resolve5(true)));
+    srv.listen(port, "127.0.0.1");
+  });
+}
+function ephemeralPort() {
+  return new Promise((resolve5) => {
+    const srv = createNetServer();
+    srv.once("error", () => resolve5(0));
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      const p = addr && typeof addr === "object" ? addr.port : 0;
+      srv.close(() => resolve5(p));
+    });
+  });
+}
+async function pickFreePort(preferred, avoid) {
+  if (preferred && preferred !== avoid && await portFree(preferred)) return preferred;
+  for (let i = 0; i < 20; i++) {
+    const p = await ephemeralPort();
+    if (p && p !== avoid) return p;
+  }
+  return preferred || DEFAULT_CICD_APP_PORT;
+}
+function persistConfigPort(location, newPort) {
+  if (newPort === location.port) return;
+  const configPath = join9(location.appDir, "cicd.config.json");
+  let config = {};
+  try {
+    config = JSON.parse(readFileSync6(configPath, "utf8"));
+  } catch {
+  }
+  config.port = newPort;
+  try {
+    writeFileSync5(configPath, `${JSON.stringify(config, null, 2)}
+`);
+  } catch {
+  }
+  location.port = newPort;
+}
 function toStatus2(location, running, projectId) {
   return {
     present: location.present,
@@ -21948,26 +22006,13 @@ async function getCicdAppStatus(db, workspacePath, projectId) {
 async function startCicdApp(db, workspacePath, projectId, studioPort, port) {
   const location = resolveCicdApp(db, workspacePath, projectId);
   if (!location.present) throw svcError6("CICD_APP_MISSING", 404);
-  const targetPort = port ?? location.port;
-  if (targetPort !== location.port) {
-    const configPath = join9(location.appDir, "cicd.config.json");
-    let config = {};
-    try {
-      config = JSON.parse(readFileSync6(configPath, "utf8"));
-    } catch {
-    }
-    config.port = targetPort;
-    try {
-      writeFileSync5(configPath, `${JSON.stringify(config, null, 2)}
-`);
-    } catch {
-    }
-    location.port = targetPort;
-  }
-  if (await probeApp(targetPort)) {
-    location.port = targetPort;
+  const savedPort = port ?? location.port;
+  if (await probeApp(savedPort)) {
+    persistConfigPort(location, savedPort);
     return toStatus2(location, true, projectId);
   }
+  const targetPort = port !== void 0 ? port : await pickFreePort(savedPort, studioPort);
+  persistConfigPort(location, targetPort);
   const existing = spawnedApps.get(projectId);
   if (existing && existing.exitCode === null) {
     try {
@@ -21993,20 +22038,22 @@ async function startCicdApp(db, workspacePath, projectId, studioPort, port) {
   child.on("error", () => {
     spawnedApps.delete(projectId);
     guardTokens.delete(projectId);
+    persistGuardToken(db, projectId, null);
   });
   child.on("exit", () => {
     spawnedApps.delete(projectId);
     guardTokens.delete(projectId);
+    persistGuardToken(db, projectId, null);
   });
   spawnedApps.set(projectId, child);
-  db.update(cicdSetups).set({ appPort: location.port, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cicdSetups.projectId, projectId)).run();
+  db.update(cicdSetups).set({ appPort: location.port, guardToken: token, updatedAt: (/* @__PURE__ */ new Date()).toISOString() }).where(eq(cicdSetups.projectId, projectId)).run();
   for (let attempt = 0; attempt < 20; attempt++) {
     if (await probeApp(location.port, 500)) return toStatus2(location, true, projectId);
     await new Promise((r) => setTimeout(r, 250));
   }
   return toStatus2(location, false, projectId);
 }
-function stopCicdApp(projectId) {
+function stopCicdApp(db, projectId) {
   const child = spawnedApps.get(projectId);
   if (!child) return false;
   try {
@@ -22015,6 +22062,7 @@ function stopCicdApp(projectId) {
   }
   spawnedApps.delete(projectId);
   guardTokens.delete(projectId);
+  persistGuardToken(db, projectId, null);
   return true;
 }
 
@@ -22701,6 +22749,7 @@ function pollCicdTracking(db, workspacePath, setupId, kind, notifyUserId) {
       relatedEntityType: "cicd_setup",
       relatedEntityId: setupId
     });
+    stopCicdApp(db, setup.projectId);
     try {
       runProjectGit(
         projectDir2,
@@ -22854,7 +22903,7 @@ function cicdRoutes(db, workspacePath, studioPort) {
     const user = c.get("user");
     try {
       const result = requestPlan(db, workspacePath, projectId, user.id);
-      stopCicdApp(projectId);
+      stopCicdApp(db, projectId);
       return c.json(result, 201);
     } catch (e) {
       return errorResponse3(c, e);
@@ -22910,7 +22959,7 @@ function cicdRoutes(db, workspacePath, studioPort) {
     const projectId = parseProjectId(c);
     if (projectId === null) return c.json({ code: "INVALID_ID" }, 400);
     try {
-      stopCicdApp(projectId);
+      stopCicdApp(db, projectId);
       return c.json(await getCicdAppStatus(db, workspacePath, projectId));
     } catch (e) {
       return errorResponse3(c, e);
@@ -22943,7 +22992,7 @@ function cicdGuardRoutes(db, workspacePath) {
     if (Number.isNaN(projectId)) return c.json({ code: "INVALID_ID" }, 400);
     const bearer = c.req.header("authorization")?.replace(/^Bearer\s+/i, "");
     const token = c.req.query("token") ?? bearer;
-    if (!cicdGuardTokenValid(projectId, token) && !c.get("user")) {
+    if (!cicdGuardTokenValid(db, projectId, token) && !c.get("user")) {
       return c.json({ code: "UNAUTHORIZED" }, 401);
     }
     const rawVersion = c.req.query("versionId");
@@ -25518,7 +25567,7 @@ function isPendingForConductor(s, conductorType) {
   if (conductorType === "prepare") return s.prepareStatus !== "completed";
   if (conductorType === "develop")
     return s.prepareStatus === "completed" && s.developStatus !== "completed";
-  return s.developStatus === "completed" && s.qualityStatus !== "completed";
+  return s.developStatus === "completed";
 }
 function getVersionAffectedAppIds(db, projectId, prdVersionId) {
   const version2 = db.select({ id: prdVersions.id, semver: prdVersions.semver }).from(prdVersions).where(and(eq(prdVersions.id, prdVersionId), eq(prdVersions.projectId, projectId))).limit(1).get();
@@ -25568,7 +25617,7 @@ function getVersionAffectedAppIds(db, projectId, prdVersionId) {
 }
 function getPendingApps(db, projectId, conductorType, prdVersionId) {
   const apps = db.select({ id: applications.id, name: applications.name }).from(applications).where(and(eq(applications.projectId, projectId), eq(applications.isDeleted, 0))).all();
-  const affected = prdVersionId === void 0 ? null : getVersionAffectedAppIds(db, projectId, prdVersionId);
+  const affected = prdVersionId === void 0 || conductorType === "quality" ? null : getVersionAffectedAppIds(db, projectId, prdVersionId);
   const result = [];
   for (const app of apps) {
     if (affected !== null && !affected.has(app.id)) continue;
@@ -25581,7 +25630,7 @@ function getPendingApps(db, projectId, conductorType, prdVersionId) {
 }
 function getPhaseCompletion(db, projectId, conductorType, prdVersionId) {
   const allApps = db.select({ id: applications.id }).from(applications).where(and(eq(applications.projectId, projectId), eq(applications.isDeleted, 0))).all();
-  const affected = prdVersionId === void 0 ? null : getVersionAffectedAppIds(db, projectId, prdVersionId);
+  const affected = prdVersionId === void 0 || conductorType === "quality" ? null : getVersionAffectedAppIds(db, projectId, prdVersionId);
   const apps = affected === null ? allApps : allApps.filter((a) => affected.has(a.id));
   let completed = 0;
   for (const app of apps) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rashidee/co2",
-  "version": "1.3.18",
+  "version": "1.3.20",
   "description": "Compound Context Studio — self-hosted team context authoring for CO2 projects",
   "type": "module",
   "license": "MIT",

package/plugin/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
       "name": "co2-skills",
       "source": "./",
       "description": "Compound Context Skills — generates data models, HTML mockups, technical specifications, test specifications, and orchestrates full-stack development from Agile user stories.",
-      "version": "1.7.0",
+      "version": "1.8.2",
       "author": {
         "name": "Rashidee M.Rashid"
       },

package/plugin/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "co2-skills",
-  "version": "1.7.0",
+  "version": "1.8.2",
   "description": "Compound Context Skills — an opinionated context engineering methodology for AI-driven software development. Generates data models, HTML mockups, technical specifications, test specifications, and orchestrates full-stack development from Agile user stories.",
   "author": {
     "name": "Rashidee M.Rashid"

package/plugin/skills/util-gencicdscript/SKILL.md

@@ -66,10 +66,13 @@ Write `cicd/CICD_GENERATION.md`:
 Read `references/cicd-app-template.md` for the complete file templates. Produce:
 
 1. `cicd/app/cicd.config.json` — from the plan's tables:
-   `{ "port": <CI/CD app port>, "docker": { "registry" } | null, "apps": [{ "name", "folder",
+   `{ "port": <CI/CD app port>, "generatedAt": "<current ISO-8601 UTC>", "docker": { "registry" } | null, "apps": [{ "name", "folder",
    "method", "port", "build", "start", "stop", "deployMethod", "deploy", "health", "image",
    "dockerfile", "configs" }], "infra": [{ "id", "name",
-   "host", "port", "url", "description" }] }` — `docker.registry` comes from the plan's
+   "host", "port", "url", "description" }] }` — `generatedAt` MUST be the actual time you generate
+   this file (a fresh value on EVERY run — never copy a previous one): the running server pins the
+   value it booted with and shows a "restart required" banner when a later regeneration moves it
+   forward, so an in-place-replaced-but-still-running app is self-diagnosing. `docker.registry` comes from the plan's
    `## Docker` section (`null` when the plan says not dockerized); per-app `image` is that
    section's Image column (`null` for non-dockerized apps) and `dockerfile` is
    `{ "path": "Dockerfile", "content": "<body>" }` for a `managed` Dockerfile from the plan's

package/plugin/skills/util-gencicdscript/references/cicd-app-template.md

@@ -41,6 +41,11 @@ const PORT = Number(process.env.PORT || loadConfig().port || 5000)
 const STUDIO = process.env.CO2_STUDIO_URL || 'http://127.0.0.1:3001'
 const PROJECT_ID = process.env.CO2_PROJECT_ID || ''
 const TOKEN = process.env.CO2_GUARD_TOKEN || ''
+// Defect 1 — the build id stamped into cicd.config.json at generation. Pinned at boot; when a
+// regeneration rewrites the config with a newer value while this process keeps running, /api/state
+// reports the drift and the page shows a "running older code — restart" banner. Missing (older
+// configs) → null → never a false positive.
+const BOOT_GENERATED_AT = loadConfig().generatedAt || null
 
 mkdirSync(LOG_DIR, { recursive: true })
 const running = new Map() // app name -> ChildProcess (only processes THIS app spawned)
@@ -63,27 +68,60 @@ function currentBranch() {
 
 // ---- Develop gate (Compound Context Studio) --------------------------------------------
 // An application that never completed a conductor-develop run has nothing to build or run —
-// its tab controls are disabled. Refreshed every 30 s; the last known answer is kept when the
-// studio is briefly unreachable, and `null` (never fetched) disables controls with a hint.
-let guardApps = null // Map lower(name|folder) -> developedOnce
+// its tab controls are disabled. The studio build guard is authoritative; when it is
+// unreachable we fall back to the on-disk develop tracking file, and ONLY a definitive
+// "never developed" (false) disables controls — unknown fails OPEN (Defect 2c/4).
+//
+// Identity differs across the two sides: the studio keys by the CLAUDE.md application name
+// (e.g. `skolafund-web`), while the plan/config carry a display name (`SkolaFund Web`) and a
+// folder (`skolafund_web`). Match on a separator-insensitive key so all three collapse to the
+// same value (Defect 2b) — exact-lowercase matching silently missed every app.
+function norm(s) { return String(s == null ? '' : s).toLowerCase().replace(/[^a-z0-9]+/g, '') }
+let guardApps = null // Map norm(name) -> developedOnce (last good answer, kept across blips)
+// ok | unauthorized | unreachable | http-<code> | not-configured | init — surfaced in the notice
+// so a disabled/unknown control says WHAT actually happened instead of a hard-coded guess.
+let guardStatus = PROJECT_ID ? 'init' : 'not-configured'
 async function refreshGuard() {
-  if (!PROJECT_ID) return
+  if (!PROJECT_ID) { guardStatus = 'not-configured'; return }
   try {
     const r = await fetch(`${STUDIO}/api/cicd-guard/${PROJECT_ID}?token=${TOKEN}`, { signal: AbortSignal.timeout(3000) })
-    if (!r.ok) return
+    if (r.status === 401) { guardStatus = 'unauthorized'; return } // keep last good guardApps
+    if (!r.ok) { guardStatus = 'http-' + r.status; return }
     const g = await r.json()
     if (Array.isArray(g.applications)) {
-      guardApps = new Map()
-      for (const a of g.applications) guardApps.set(String(a.name).toLowerCase(), !!a.developedOnce)
+      const next = new Map()
+      for (const a of g.applications) next.set(norm(a.name), !!a.developedOnce)
+      guardApps = next
+      guardStatus = 'ok'
     }
-  } catch {}
+  } catch { guardStatus = 'unreachable' } // keep last good guardApps
+}
+// On-disk fallback (Defect 2 fix 3) — conductor-feature-develop writes this app's
+// context/develop/IMPLEMENTATION_MASTER.md with `**Status**: COMPLETED` when development
+// finishes. Read it (mtime-cached) so the gate is correct even with the studio down, restarted
+// or renamed. Mirrors the studio's TRACKING_FILE_MAP.develop.
+const developMarkerCache = new Map() // abs path -> { mtimeMs, done }
+function localDeveloped(app) {
+  const p = join(PROJECT_DIR, app.folder || '', 'context', 'develop', 'IMPLEMENTATION_MASTER.md')
+  try {
+    const mtimeMs = statSync(p).mtimeMs
+    const hit = developMarkerCache.get(p)
+    if (hit && hit.mtimeMs === mtimeMs) return hit.done
+    const done = /^\s*\**\s*Status\s*\**\s*:\s*COMPLETED\b/im.test(readFileSync(p, 'utf8'))
+    developMarkerCache.set(p, { mtimeMs, done })
+    return done
+  } catch { return false }
 }
-function developedOnce(app) {
-  if (!guardApps) return null // unknown — controls stay disabled until the studio answers
-  const byName = guardApps.get(app.name.toLowerCase())
-  if (byName !== undefined) return byName
-  const byFolder = guardApps.get(String(app.folder || '').toLowerCase())
-  return byFolder === undefined ? null : byFolder
+// { val: true|false|null, src: 'studio'|'local'|'none' }. Studio wins; local marker fills the gap
+// when the studio has no answer; null only when nobody knows (controls then stay ENABLED).
+function developInfo(app) {
+  if (guardApps) {
+    let v = guardApps.get(norm(app.name))
+    if (v === undefined) v = guardApps.get(norm(app.folder))
+    if (v !== undefined) return { val: v, src: 'studio' }
+  }
+  if (localDeveloped(app)) return { val: true, src: 'local' }
+  return { val: null, src: 'none' }
 }
 refreshGuard()
 setInterval(refreshGuard, 30_000).unref?.()
@@ -140,7 +178,11 @@ function runLogged(app, command, onExit) {
   const log = createWriteStream(logPath(app.name), { flags: 'a' })
   log.write(`\n--- ${new Date().toISOString()} $ ${command}\n`)
   broadcast(app.name, `\n--- ${new Date().toISOString()} $ ${command}\n`)
-  const child = spawn(command, { cwd: join(PROJECT_DIR, app.folder), shell: true, env: process.env })
+  // detached on POSIX so the shell AND everything it forks (a compound `a && b` start command,
+  // pnpm → vite, etc.) share ONE process group we can signal as a unit on Stop. Without it, `sh`
+  // running `a && b` cannot exec into `b`, so killing the shell alone leaves the real server
+  // reparented to init and still holding the port (Defect 3). Windows kills the tree via taskkill.
+  const child = spawn(command, { cwd: join(PROJECT_DIR, app.folder), shell: true, env: process.env, detached: process.platform !== 'win32' })
   const tap = (d) => { log.write(d); broadcast(app.name, d) }
   child.stdout.on('data', tap)
   child.stderr.on('data', tap)
@@ -282,20 +324,27 @@ function startApp(app) {
   saveState()
 }
 
-// shell:true spawns a shell whose grandchildren survive child.kill() on Windows — kill the
-// whole tree there (taskkill /T); plain kill elsewhere.
-function killTree(child) {
-  if (process.platform === 'win32' && child.pid) {
-    try { execFileSync('taskkill', ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore' }) } catch {}
-  } else {
-    try { child.kill() } catch {}
+const delay = (ms) => new Promise((r) => setTimeout(r, ms))
+// A signal-0 probe: alive if it succeeds OR fails with EPERM (exists, not ours to signal).
+function pidAlive(pid) { try { process.kill(Number(pid), 0); return true } catch (e) { return e.code === 'EPERM' } }
+
+// shell:true (and a compound start command) spawns a tree whose grandchildren survive a bare
+// child.kill(). Signal the whole PROCESS GROUP (detached → pgid === the shell's pid), escalating
+// SIGTERM → SIGKILL. Windows: taskkill /T /F kills the tree. Async — the caller awaits it.
+async function killTree(child) {
+  const pid = child && child.pid
+  if (!pid) return
+  if (process.platform === 'win32') {
+    try { execFileSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore' }) } catch {}
+    return
   }
+  try { process.kill(-pid, 'SIGTERM') } catch { try { child.kill('SIGTERM') } catch {} }
+  for (let i = 0; i < 40 && pidAlive(pid); i++) await delay(100) // up to ~4s for a graceful exit
+  if (pidAlive(pid)) { try { process.kill(-pid, 'SIGKILL') } catch { try { child.kill('SIGKILL') } catch {} } }
 }
 
-// Stop an app we DON'T hold a child handle for (started outside this app, or before this app
-// last restarted) by killing whatever process tree is listening on its port — so Stop works
-// for any running app, not only ones this CI/CD app spawned. Returns true if a PID was killed.
-function killByPort(port) {
+// PIDs listening on a TCP port. POSIX: lsof, then fuser — both tolerated absent. Windows: netstat.
+function portListeners(port) {
   try {
     if (process.platform === 'win32') {
       const out = execFileSync('netstat', ['-ano', '-p', 'tcp'], { encoding: 'utf8' })
@@ -304,36 +353,60 @@ function killByPort(port) {
         const m = line.match(/:(\d+)\s+\S+\s+LISTENING\s+(\d+)/)
         if (m && Number(m[1]) === Number(port)) pids.add(m[2])
       }
-      for (const pid of pids) {
-        try { execFileSync('taskkill', ['/pid', pid, '/T', '/F'], { stdio: 'ignore' }) } catch {}
-      }
-      return pids.size > 0
+      return [...pids]
     }
-    const out = execFileSync('sh', ['-c', `lsof -ti tcp:${port} || true`], { encoding: 'utf8' })
-    const pids = out.split(/\s+/).filter(Boolean)
-    for (const pid of pids) { try { process.kill(Number(pid)) } catch {} }
-    return pids.length > 0
-  } catch { return false }
+    for (const cmd of [`lsof -ti tcp:${port}`, `fuser -n tcp ${port} 2>/dev/null`]) {
+      const out = execFileSync('sh', ['-c', `${cmd} || true`], { encoding: 'utf8' })
+      const pids = [...new Set(out.split(/\s+/).map((s) => s.trim()).filter((s) => /^\d+$/.test(s)))]
+      if (pids.length) return pids
+    }
+  } catch {}
+  return []
+}
+// Signal a pid's whole process group (falls back to the bare pid if the group is already gone).
+function killGroup(pid, sig) {
+  let pgid = 0
+  if (process.platform !== 'win32') {
+    try { pgid = Number(execFileSync('ps', ['-o', 'pgid=', '-p', String(pid)], { encoding: 'utf8' }).trim()) } catch {}
+  }
+  try { process.kill(pgid ? -pgid : Number(pid), sig) } catch { try { process.kill(Number(pid), sig) } catch {} }
+}
+
+// Stop whatever is listening on a port even when we hold no child handle for it (started outside
+// this app, or before this app last restarted) — group-kill each listener, escalating
+// SIGTERM → SIGKILL. Returns true when the port ended up FREE.
+async function killByPort(port) {
+  let pids = portListeners(port)
+  if (!pids.length) return true // nothing listening — already free
+  if (process.platform === 'win32') {
+    for (const pid of pids) { try { execFileSync('taskkill', ['/pid', String(pid), '/T', '/F'], { stdio: 'ignore' }) } catch {} }
+    for (let i = 0; i < 20 && portListeners(port).length; i++) await delay(100)
+    return portListeners(port).length === 0
+  }
+  for (const pid of pids) killGroup(pid, 'SIGTERM')
+  for (let i = 0; i < 30 && portListeners(port).length; i++) await delay(100) // ~3s grace
+  for (const pid of portListeners(port)) killGroup(pid, 'SIGKILL')
+  await delay(200)
+  return portListeners(port).length === 0
 }
 
-function stopApp(app) {
+async function stopApp(app) {
   if (app.method === 'container' && app.stop && app.stop !== 'process-kill') {
     const stopCmd = app.stop
     try { execFileSync(stopCmd.split(' ')[0], stopCmd.split(' ').slice(1), { cwd: PROJECT_DIR }) } catch {}
-  } else {
-    const child = running.get(app.name)
-    if (child) {
-      stopping.add(app.name)
-      killTree(child)
-    } else {
-      // No child handle — kill by port so an externally/previously started app still stops.
-      lastError.delete(app.name)
-      if (!killByPort(app.port)) {
-        lastError.set(app.name, `could not stop — nothing found listening on port ${app.port}`)
-      }
-    }
+    running.delete(app.name)
+    saveState()
+    return
   }
+  lastError.delete(app.name)
+  const child = running.get(app.name)
+  if (child) { stopping.add(app.name); await killTree(child) }
   running.delete(app.name)
+  // ALWAYS sweep the port after killing our handle — the child dying is NOT proof the server did
+  // (its reparented grandchildren, or an app started outside this app, can still hold the port).
+  // Report an honest failure if it never frees, instead of the old silent "success" (Defect 3).
+  const free = await killByPort(app.port)
+  if (!free) lastError.set(app.name, `stop failed — port ${app.port} is still in use`)
   saveState()
 }
 
@@ -360,6 +433,7 @@ button{background:#fff;color:#1c2128;border:1px solid #c6cdd6;border-radius:6px;
 button:hover:enabled{background:#eef1f5}
 button:disabled{opacity:.4;cursor:default}
 .notice{padding:4px 12px;font-size:11px;color:#8a5a00;background:#fff7e6;display:none}
+.stale{padding:6px 12px;font-size:12px;color:#fff;background:#c23b3b;font-weight:600;display:none}
 .err{padding:4px 12px;font-size:11px;color:#c23b3b;display:none;white-space:pre-wrap}
 #log{flex:1;margin:0;padding:10px 12px;background:#0f1216;color:#d7dde4;font-size:11px;line-height:1.5;overflow:auto;white-space:pre-wrap}
 .muted{color:#5b6572;font-size:12px}
@@ -378,6 +452,7 @@ button:disabled{opacity:.4;cursor:default}
 </style></head><body>
 <div class="top"><strong>CI/CD</strong><span id="branch" class="meta"></span>
 <span style="flex:1"></span><a id="infralink" class="url" href="infra" target="_blank" rel="noreferrer" style="display:none">Infrastructure ↗</a></div>
+<div class="stale" id="stale"></div>
 <div class="tabs" id="tabs"></div>
 <div class="bar" id="bar"></div>
 <div class="notice" id="notice"></div>
@@ -403,11 +478,19 @@ function renderTabs(){
       <span class="dot \${a.phase}"></span>\${a.name}\${a.developedOnce===false?' 🔒':''}</div>\`).join('')
 }
 
+// A guard answer we could not get, said plainly — the notice names the cause it observed instead
+// of always blaming an unreachable studio (Defect 2c/4).
+function guardReason(s){
+  return ({unauthorized:'studio auth failed',unreachable:'studio unreachable','not-configured':'studio link not set',init:'checking…',ok:'not listed by the studio'})[s]
+    || ('studio error '+String(s||'').replace(/^http-/,''))
+}
 function renderBar(){
   const a = appOf(active)
   if (!a) return
   const url = 'http://'+location.hostname+':'+a.port+'/'
-  const gate = a.developedOnce === true
+  // Fail OPEN — only a definitive "never developed" (false) disables controls; unknown (null)
+  // leaves them enabled so an unverifiable studio never locks the user out (Defect 2c/4).
+  const gate = a.developedOnce !== false
   const busy = a.phase==='building'||a.phase==='deploying'
   document.getElementById('bar').innerHTML = \`
     <span class="badge \${a.phase}">\${a.phase}\${a.external?' (external)':''}</span>
@@ -424,7 +507,10 @@ function renderBar(){
     notice.textContent = 'This application has not been developed through the workflow yet — run conductor-feature-develop first.'
     notice.style.display = 'block'
   } else if (a.developedOnce === null) {
-    notice.textContent = 'Develop status not verified yet (studio unreachable) — controls stay disabled.'
+    notice.textContent = 'Develop status unverified (' + guardReason(state.guardStatus) + ') — controls left enabled.'
+    notice.style.display = 'block'
+  } else if (a.developSource === 'local') {
+    notice.textContent = 'Develop status read from this app’s local tracking file (studio guard unavailable).'
     notice.style.display = 'block'
   } else notice.style.display = 'none'
   const err = document.getElementById('err')
@@ -494,6 +580,10 @@ async function refresh(){
   state = s
   document.getElementById('branch').textContent = s.currentBranch ? 'branch: '+s.currentBranch : ''
   document.getElementById('infralink').style.display = s.hasInfra ? 'inline' : 'none'
+  // Defect 1 — the app was regenerated in place while this process kept serving the old code.
+  const stale = document.getElementById('stale')
+  if (s.regenerated) { stale.textContent = 'This CI/CD app is running older code than was generated — restart it (Stop, then Start).'; stale.style.display = 'block' }
+  else stale.style.display = 'none'
   if (!active && s.apps.length) setActive(s.apps[0].name)
   renderTabs(); renderBar()
 }
@@ -571,18 +661,24 @@ const server = http.createServer(async (req, res) => {
     const apps = await Promise.all(loadConfig().apps.map(async (a) => {
       const healthy = await probe(a)
       const phase = activity.get(a.name) || (healthy ? 'running' : failed.has(a.name) ? 'failed' : 'stopped')
+      const dev = developInfo(a)
       return {
         name: a.name, method: a.method, port: a.port, phase,
         deploy: !!a.deploy, deployMethod: a.deployMethod || 'none',
         image: a.image || null,
         external: healthy && !running.has(a.name),
-        developedOnce: developedOnce(a),
+        developedOnce: dev.val, developSource: dev.src,
         error: lastError.get(a.name) || null,
       }
     }))
+    // Defect 1 — regenerated in place while still running the old code (config's generatedAt
+    // moved past the value pinned at boot).
+    const nowGen = loadConfig().generatedAt || null
     return json(res, 200, {
       currentBranch: currentBranch(),
       hasInfra: (loadConfig().infra || []).length > 0,
+      guardStatus,
+      regenerated: !!(BOOT_GENERATED_AT && nowGen !== BOOT_GENERATED_AT),
       apps,
     })
   }
@@ -597,13 +693,14 @@ const server = http.createServer(async (req, res) => {
   if (m && req.method === 'POST') {
     const app = loadConfig().apps.find((a) => a.name === decodeURIComponent(m[1]))
     if (!app) return json(res, 404, { error: 'unknown app' })
-    if (m[2] !== 'stop' && developedOnce(app) === false) {
+    // Only a DEFINITIVE "never developed" blocks — unknown (null) fails open (Defect 2c/4).
+    if (m[2] !== 'stop' && developInfo(app).val === false) {
       return json(res, 409, { error: 'application has not completed a develop workflow run' })
     }
     if (m[2] === 'build') buildApp(app)
     else if (m[2] === 'start') startApp(app)
     else if (m[2] === 'deploy') deployApp(app)
-    else stopApp(app)
+    else await stopApp(app)
     return json(res, 200, { ok: true })
   }
   json(res, 404, { error: 'not found' })
@@ -642,6 +739,10 @@ server.listen(PORT, () => console.log(`cicd app on :${PORT}`))
 
 `cicd/app/cicd.config.json` shape — one `apps` entry per application from the plan's Deployment
 Decisions table, one `infra` entry per row of the plan's `## Infrastructure` table.
+Top-level `"generatedAt"` is an ISO-8601 UTC timestamp **stamped fresh on every generation**
+(Defect 1): the running server pins the value it booted with and flags a "restart required" banner
+once a regeneration moves it forward, so a stale in-place-replaced process is self-diagnosing. It
+MUST change on each run — use the actual generation time (e.g. `new Date().toISOString()`).
 `deployMethod`/`deploy` come from the plan's Deploy columns (`deploy` is `null` when the method
 is `none`). `infra[].url` is `null` for a headless service (Console URL cell `-`); emit
 `"infra": []` when the plan declares no supporting services.
@@ -669,6 +770,7 @@ verbatim (this is a local dev CI/CD app).
 ```json
 {
   "port": 5000,
+  "generatedAt": "2026-07-24T09:15:00.000Z",
   "docker": { "registry": "registry.example.com/team" },
   "apps": [
     {
@@ -676,7 +778,7 @@ verbatim (this is a local dev CI/CD app).
       "folder": "my-app",
       "method": "process",
       "port": 3000,
-      "build": "pnpm install && pnpm build && docker build -t registry.example.com/team/my-app:latest .",
+      "build": "rm -rf dist && pnpm install && pnpm build && docker build --no-cache -t registry.example.com/team/my-app:latest .",
       "start": "node dist/index.js",
       "stop": "process-kill",
       "deployMethod": "kubernetes",