fix(worker): survive bead-only commits; hand off only on real binary replacement [ddx-65d3ba51]

ddx work --watch compared its build commit against the installed binary's
ddx-version commit and exited whenever they differed. Because ddx bead
create/update auto-commit to .ddx/beads.jsonl, the ddx repo HEAD advances
constantly, so any path that rebaked the version commit made the worker
self-terminate (without reliably spawning a replacement). Gate the hand-off on
the replacement binary file actually being replaced on disk (size+mtime) since
the worker started: bead-only commits no longer kill the worker, while an
intentional reinstall still triggers a refresh.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ddx-checkpoint

cli/cmd/work_binary_refresh.go

@@ -26,8 +26,21 @@ func (f *CommandFactory) buildWorkBinaryRefreshCheck(cmd *cobra.Command, project
 	if currentCommit == "" {
 		return nil
 	}
+	exe := resolveReplacementDDXPath()
+	baseline, haveBaseline := snapshotBinary(exe)
 	return func(ctx context.Context) (bool, error) {
-		exe := resolveReplacementDDXPath()
+		// Only hand off when the replacement binary file has actually been
+		// replaced on disk since this worker started (an intentional
+		// reinstall). Bead-only auto-commits (chore(beads): ... doc-stamp)
+		// advance the ddx repo HEAD but never rewrite the binary, so they must
+		// not terminate the worker (ddx-65d3ba51).
+		if !haveBaseline {
+			return false, nil
+		}
+		current, ok := snapshotBinary(exe)
+		if !ok || current.equal(baseline) {
+			return false, nil
+		}
 		checkCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
 		defer cancel()
 		installedCommit, err := installedDDXCommit(checkCtx, exe)
@@ -100,6 +113,27 @@ func shouldRefreshDDXBinary(currentCommit, installedCommit string) bool {
 	return true
 }
 
+// binarySnapshot captures the on-disk identity of an executable so a worker can
+// tell whether the file was replaced (reinstalled) versus unchanged. It
+// deliberately does not look at git/version metadata — repo HEAD advances from
+// bead commits must not read as a binary change.
+type binarySnapshot struct {
+	size    int64
+	modTime time.Time
+}
+
+func snapshotBinary(path string) (binarySnapshot, bool) {
+	info, err := os.Stat(path)
+	if err != nil {
+		return binarySnapshot{}, false
+	}
+	return binarySnapshot{size: info.Size(), modTime: info.ModTime()}, true
+}
+
+func (b binarySnapshot) equal(o binarySnapshot) bool {
+	return b.size == o.size && b.modTime.Equal(o.modTime)
+}
+
 func resolveReplacementDDXPath() string {
 	if len(os.Args) > 0 && os.Args[0] != "" {
 		if path, err := exec.LookPath(os.Args[0]); err == nil {

cli/cmd/work_binary_refresh_test.go

@@ -1,9 +1,13 @@
 package cmd
 
 import (
+	"os"
+	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestParseDDXVersionCommit(t *testing.T) {
@@ -25,3 +29,35 @@ func TestWorkBinaryRefreshEnabledOnlyForInstalledDDX(t *testing.T) {
 	assert.False(t, workBinaryRefreshEnabled([]string{"/tmp/go-build123/cmd.test", "-test.run=TestWork"}))
 	assert.False(t, workBinaryRefreshEnabled(nil))
 }
+
+// TestBinarySnapshotSurvivesBeadCommitsDetectsReinstall verifies the signal the
+// worker now uses to decide whether to hand off: a bead-only commit never
+// rewrites the binary (snapshot unchanged → worker stays put), while a real
+// reinstall rewrites it (snapshot differs → worker hands off). See
+// ddx-65d3ba51.
+func TestBinarySnapshotSurvivesBeadCommitsDetectsReinstall(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "ddx")
+	require.NoError(t, os.WriteFile(path, []byte("ddx-binary-v1"), 0o755))
+
+	base, ok := snapshotBinary(path)
+	require.True(t, ok)
+
+	// A `ddx bead create` advances the ddx repo HEAD but does not touch the
+	// worker's binary: the snapshot is unchanged, so the worker must not exit.
+	unchanged, ok := snapshotBinary(path)
+	require.True(t, ok)
+	assert.True(t, base.equal(unchanged), "unchanged binary must compare equal so the worker survives bead commits")
+
+	// An intentional reinstall rewrites the binary: the snapshot differs, so the
+	// worker still hands off to the new build.
+	time.Sleep(10 * time.Millisecond)
+	require.NoError(t, os.WriteFile(path, []byte("ddx-binary-v2-reinstalled"), 0o755))
+	reinstalled, ok := snapshotBinary(path)
+	require.True(t, ok)
+	assert.False(t, base.equal(reinstalled), "a replaced binary must compare not-equal so the worker upgrades")
+
+	// A missing binary yields no snapshot; the worker stays put rather than dying.
+	_, ok = snapshotBinary(filepath.Join(dir, "absent"))
+	assert.False(t, ok)
+}