@allocator-one/rcl 4.5.7 → 4.5.9

package/dist/index.js

@@ -47,7 +47,9 @@ import { resolveFinding, buildDiscussPrompts, runDiscussion, loadContextDocs, }
 import { DEFAULT_CONVERGE_ATTEMPT_CAP, claimConvergeAttempt, ConvergeAttemptBudgetExceededError, convergeAttemptErrorExitCode, ConvergeAttemptStateError, resolveGitCommonDir, } from './converge/attempt-budget.js';
 import { DEFAULT_CONVERGE_ROUND_CAP, HARD_CONVERGE_ROUND_CAP, processRoundReport, recordVerdicts, findingGatingReason, ConvergeRoundCapError, ConvergeRunStateError, } from './converge/run-state.js';
 import { applyRoundGap, previewRoundGap } from './converge/round-gap.js';
+import { withNativeTarget } from './converge/target-ownership.js';
 import { guardReviewLaunch, ReviewLaunchRefused } from './converge/launch-guard.js';
+import { selectCurrentRecoveredProduction } from './converge/recovered-production.js';
 import { createBoundFixRecovery } from './converge/bound-fix-recovery.js';
 import { openReadSink } from './telemetry/read-sink.js';
 import { reconcileFlushedRun } from './converge/delivery-reconciliation.js';
@@ -79,6 +81,7 @@ import { parseRepoName } from './evidence/target.js';
 import { text } from './evidence/format.js';
 import { loadConvergeRunState } from './converge/run-state.js';
 import { finalizeOrdinaryPendingLaunch, previewOrdinaryPendingLaunch, resumePendingLegacyLaunch } from './converge/pending-legacy-resume.js';
+import { ordinaryPendingGuardedInput } from './converge/ordinary-pending-package.js';
 import { exportOrdinaryPendingPackage, retainOrdinaryLaunchInputs } from './converge/ordinary-pending-export.js';
 import { capturePreparedCouncil } from './dispatch/capture-council.js';
 import { executeCapturedOriginal } from './dispatch/original-execution.js';
@@ -109,7 +112,7 @@ program.hook('preAction', async (_thisCommand, actionCommand) => {
     // Reads and explicit repairs must not flush unrelated evidence, even in preview.
     if (actionCommand.parent?.name() === 'evidence' && (name === 'show' || name === 'status'))
         return;
-    if (name === 'converge-rejected' || name === 'converge-stale' || name === 'converge-gap' || name === 'converge-reconcile-history' || name === 'recover-run' || name === 'recover-finding' || name === 'retriage-finding' || name === 'telemetry' || actionCommand.parent?.name() === 'telemetry' || name.includes('worker'))
+    if (name === 'converge-rejected' || name === 'converge-stale' || name === 'converge-gap' || name === 'converge-reconcile-history' || name === 'recover-run' || name === 'recover-claim' || name === 'recover-finding' || name === 'retriage-finding' || name === 'telemetry' || actionCommand.parent?.name() === 'telemetry' || name.includes('worker'))
         return;
     const flags = actionCommand.opts();
     if (flags.telemetry === false || (process.env['RCL_TELEMETRY'] ?? '').trim().toLowerCase() === 'off')
@@ -233,7 +236,7 @@ program
     .option('--round <n>', 'Converge round number (or RCL_CONVERGE_ROUND)')
     .option('--attempt <n>', 'Converge attempt number (or RCL_CONVERGE_ATTEMPT)')
     .option('--start-over', 'Start an explicitly requested fresh review with a new normal budget; retain all prior evidence and spending')
-    .option('--guarded-converge', 'Validate and claim inside this review process; derive the round from native state')
+    .option('--guarded-converge', 'Validate and claim inside this review process, or consume an exact recovered-v3 --attempt; derive the round from native state')
     .option('--bound-fix-recovery <run-id>', 'Review unchanged inputs once live Harness evidence proves a retained bound fix obligation after this native dismissal-only run')
     .option('--launch-intent <intent>', 'Guarded intent: review, stop-upstream, stop-review, or retry-delivery')
     .option('--retry-report <path>', 'Original legacy report proving an inconclusive launch; the new inputs may differ; requires --retry-reason')
@@ -328,24 +331,31 @@ program
                 throw new ConvergeAttemptStateError('maxAttempts (--max-attempts) must be a positive safe integer.');
             }
         }
-        const claim = await claimConvergeAttempt({
-            gitCommonDir: await resolveGitCommonDir(),
-            target: opts.target,
-            maxAttempts,
+        const gitCommonDir = await resolveGitCommonDir();
+        const claim = await withNativeTarget(gitCommonDir, opts.target, async (ownership) => {
+            const committed = await claimConvergeAttempt({
+                gitCommonDir,
+                target: opts.target,
+                maxAttempts,
+                ownership,
+            });
+            await reportConvergeEvents([
+                buildEvent({
+                    kind: 'attempt_claimed',
+                    convergeTarget: committed.target,
+                    attempt: committed.attempt,
+                    // The claim's local state path and process id stay on this machine.
+                    payload: { attempt: committed.attempt, cap: committed.cap,
+                        ...(committed.cycle ? { cycle_id: committed.cycle.id } : {}) },
+                }),
+                // An explicit --max-attempts is consent evidence, whatever it was before.
+                ...(maxAttempts !== undefined
+                    ? [buildEvent({ kind: 'cap_changed', convergeTarget: committed.target, attempt: committed.attempt,
+                            payload: { kind: 'attempts', to: committed.cap } })]
+                    : []),
+            ]);
+            return committed;
         });
-        await reportConvergeEvents([
-            buildEvent({
-                kind: 'attempt_claimed',
-                convergeTarget: claim.target,
-                attempt: claim.attempt,
-                // The claim's local state path and process id stay on this machine.
-                payload: { attempt: claim.attempt, cap: claim.cap, ...(claim.cycle ? { cycle_id: claim.cycle.id } : {}) },
-            }),
-            // An explicit --max-attempts is consent evidence, whatever it was before.
-            ...(maxAttempts !== undefined
-                ? [buildEvent({ kind: 'cap_changed', convergeTarget: claim.target, attempt: claim.attempt, payload: { kind: 'attempts', to: claim.cap } })]
-                : []),
-        ]);
         if (opts.json) {
             console.log(JSON.stringify(claim));
         }
@@ -595,10 +605,12 @@ program
             }
         }
         let report;
+        let reportJson;
         let reportSha256;
         try {
             const source = await readFile(opts.report);
-            report = JSON.parse(source.toString('utf8'));
+            reportJson = source.toString('utf8');
+            report = JSON.parse(reportJson);
             reportSha256 = sha256(source);
         }
         catch (err) {
@@ -625,48 +637,69 @@ program
         if (reportRunId !== undefined && runId === undefined) {
             console.error(chalk.yellow(`Report run ${reportRunId} ${reportTarget === undefined ? 'carries no converge target' : `belongs to converge target ${reportTarget}`}, not ${opts.target}; the round keeps no run id.`));
         }
-        const result = await processRoundReport({
-            gitCommonDir: await resolveGitCommonDir(),
-            target: opts.target,
-            round,
-            findings: report.findings,
-            reportSha256,
-            cycleId: report.run?.cycle_id,
-            ...(maxRounds !== undefined ? { maxRounds } : {}),
-            ...(runId !== undefined ? { runId } : {}),
-        });
-        const classified = result.findings.map((f) => ({
-            identity: f.identity,
-            status: f.status,
-            gating: findingGatingReason(f.finding),
-            severity: f.finding.severity,
-            file: f.finding.file,
-            startLine: f.finding.startLine,
-            endLine: f.finding.endLine,
-            title: f.finding.title,
-            ...(f.suppressReason ? { suppressReason: f.suppressReason } : {}),
-        }));
-        const actionable = classified.filter((f) => (f.status === 'new' || f.status === 'regating') && f.gating !== 'none');
-        await reportConvergeEvents([
-            buildEvent({
-                kind: 'round_processed',
-                convergeTarget: opts.target,
+        const gitCommonDir = await resolveGitCommonDir();
+        const target = opts.target;
+        const { result, classified, actionable } = await withNativeTarget(gitCommonDir, target, async (ownership) => {
+            const existing = await loadConvergeRunState(gitCommonDir, target);
+            const recoveredReport = existing?.version === 3 || report.run?.gating?.bound_classification_protocol !== undefined;
+            const result = await processRoundReport({
+                gitCommonDir,
+                target,
                 round,
+                findings: recoveredReport
+                    ? [...report.findings, ...(report.belowThresholdFindings ?? [])]
+                    : report.findings,
+                ...(recoveredReport ? { evidence: { reportJson } } : {}),
+                reportSha256,
+                cycleId: report.run?.cycle_id,
+                ownership,
+                ...(maxRounds !== undefined ? { maxRounds } : {}),
                 ...(runId !== undefined ? { runId } : {}),
-                payload: {
+            });
+            const classified = result.findings.map((f) => ({
+                identity: f.identity,
+                status: f.status,
+                gating: f.sighting?.gating ?? findingGatingReason(f.finding),
+                severity: f.finding.severity,
+                file: f.finding.file,
+                startLine: f.finding.startLine,
+                endLine: f.finding.endLine,
+                title: f.finding.title,
+                ...(f.suppressReason ? { suppressReason: f.suppressReason } : {}),
+            }));
+            const actionable = classified.filter((f) => (f.status === 'new' || f.status === 'regating') && f.gating !== 'none');
+            await reportConvergeEvents([
+                buildEvent({
+                    kind: 'round_processed',
+                    convergeTarget: target,
                     round,
-                    round_cap: result.roundCap,
-                    counts: result.counts,
-                    actionable_gating: actionable.length,
-                    // Which identity each sighting was matched to, so the server
-                    // can apply standing verdicts to keys that moved (IO-12601).
-                    identities: roundIdentities(result.findings),
-                },
-            }),
-            ...(maxRounds !== undefined
-                ? [buildEvent({ kind: 'cap_changed', convergeTarget: opts.target, round, payload: { kind: 'rounds', to: result.roundCap } })]
-                : []),
-        ]);
+                    ...(runId !== undefined ? { runId } : {}),
+                    payload: {
+                        round,
+                        round_cap: result.roundCap,
+                        counts: result.counts,
+                        actionable_gating: result.actionableIdentities?.length ?? actionable.length,
+                        ...(result.classificationVersion
+                            ? {
+                                classification_version: result.classificationVersion,
+                                report_json_sha256: result.reportBinding.reportSha256,
+                                ...(result.legacyPendingIdentities
+                                    ? { legacy_pending_identities: result.legacyPendingIdentities }
+                                    : {}),
+                            }
+                            : {}),
+                        // Which identity each sighting was matched to, so the server
+                        // can apply standing verdicts to keys that moved (IO-12601).
+                        identities: roundIdentities(result.findings),
+                    },
+                }),
+                ...(maxRounds !== undefined
+                    ? [buildEvent({ kind: 'cap_changed', convergeTarget: target, round,
+                            payload: { kind: 'rounds', to: result.roundCap } })]
+                    : []),
+            ]);
+            return { result, classified, actionable };
+        });
         if (opts.json) {
             console.log(JSON.stringify({
                 target: opts.target,
@@ -674,8 +707,11 @@ program
                 roundCap: result.roundCap,
                 reviewerHealth: blockingHealthJson(health),
                 counts: result.counts,
-                actionableGating: actionable.length,
+                actionableGating: result.actionableIdentities?.length ?? actionable.length,
                 findings: classified,
+                ...(result.recoveryProjection
+                    ? { recoveryProjection: result.recoveryProjection }
+                    : {}),
             }, null, 2));
             return;
         }
@@ -683,7 +719,7 @@ program
         console.log(`Round ${round}/${result.roundCap} for ${opts.target}: ` +
             `${result.counts.new} new, ${result.counts.repeat} repeat, ` +
             `${result.counts.suppressed} suppressed, ${result.counts.regating} regating · ` +
-            `${actionable.length} actionable gating finding(s)`);
+            `${result.actionableIdentities?.length ?? actionable.length} actionable gating finding(s)`);
         for (const f of actionable) {
             console.log(`  [${f.status}] ${f.identity} ${f.file}:${f.startLine} — ${f.title}`);
         }
@@ -777,68 +813,74 @@ program
         if (new Set(verdicts.map(({ key }) => key)).size !== verdicts.length) {
             throw new ConvergeRunStateError('Pass each finding identity only once, as either fixed or dismissed.');
         }
-        const { entries: updated, resolution, runId: roundRun } = await recordVerdicts({
-            gitCommonDir: await resolveGitCommonDir(),
-            target: opts.target,
-            round,
-            verdicts,
-            runId: opts.runId,
-        });
-        // Feed the cross-run precision history (RCL-27) — fail-soft, the
-        // verdicts above are already durably recorded.
-        try {
-            const ts = new Date().toISOString();
-            await appendOutcomes(updated
-                .filter((e) => e.verdict !== undefined && e.models.length > 0)
-                .map((e) => ({
-                ts,
-                verdict: e.verdict,
-                models: e.models,
-                severity: e.verdictSeverity ?? e.severity,
-                target: opts.target,
-                findingKey: e.key,
-                source: 'live',
-            })));
-        }
-        catch (err) {
-            // Advisory history; verdict recording must not fail over it —
-            // but say so, or a broken store silently stops learning.
-            console.warn(`Model-stats store unavailable (outcomes not recorded): ${String(err)}`);
-        }
-        await reportConvergeEvents([
-            buildEvent({
-                kind: 'verdicts_recorded',
-                convergeTarget: opts.target,
+        const target = opts.target;
+        const gitCommonDir = await resolveGitCommonDir();
+        const { entries: updated, resolution, runId: roundRun } = await withNativeTarget(gitCommonDir, target, async (ownership) => {
+            const recorded = await recordVerdicts({
+                gitCommonDir,
+                target,
                 round,
-                ...(roundRun !== undefined ? { runId: roundRun } : {}),
-                payload: {
-                    verdicts: updated.map((e) => ({
-                        identity_key: e.key,
-                        verdict: e.verdict,
-                        // Verdict reasons are user-authored prose: scrubbed like every other free text that leaves the machine.
-                        ...(e.verdictReason !== undefined ? { reason: scrubText(e.verdictReason, 500) } : {}),
-                        severity: e.verdictSeverity ?? e.severity,
-                        models: e.models,
-                    })),
-                },
-            }),
-            ...(resolution
-                ? [
-                    buildEvent({
-                        kind: 'resolution',
-                        convergeTarget: opts.target,
-                        round,
-                        ...(roundRun !== undefined ? { runId: roundRun } : {}),
-                        payload: {
-                            status: resolution.status,
-                            actionable: resolution.actionable,
-                            unresolved: resolution.unresolved.length,
-                            fixed_this_round: resolution.fixedThisRound,
-                        },
-                    }),
-                ]
-                : []),
-        ]);
+                verdicts,
+                runId: opts.runId,
+                ownership,
+            });
+            // Feed the cross-run precision history (RCL-27) — fail-soft, the
+            // verdicts above are already durably recorded.
+            try {
+                const ts = new Date().toISOString();
+                await appendOutcomes(recorded.entries
+                    .filter((e) => e.verdict !== undefined && e.models.length > 0)
+                    .map((e) => ({
+                    ts,
+                    verdict: e.verdict,
+                    models: e.models,
+                    severity: e.verdictSeverity ?? e.severity,
+                    target,
+                    findingKey: e.key,
+                    source: 'live',
+                })));
+            }
+            catch (err) {
+                // Advisory history; verdict recording must not fail over it —
+                // but say so, or a broken store silently stops learning.
+                console.warn(`Model-stats store unavailable (outcomes not recorded): ${String(err)}`);
+            }
+            await reportConvergeEvents([
+                buildEvent({
+                    kind: 'verdicts_recorded',
+                    convergeTarget: target,
+                    round,
+                    ...(recorded.runId !== undefined ? { runId: recorded.runId } : {}),
+                    payload: {
+                        verdicts: recorded.entries.map((e) => ({
+                            identity_key: e.key,
+                            verdict: e.verdict,
+                            // Verdict reasons are user-authored prose: scrubbed like every other free text that leaves the machine.
+                            ...(e.verdictReason !== undefined ? { reason: scrubText(e.verdictReason, 500) } : {}),
+                            severity: e.verdictSeverity ?? e.severity,
+                            models: e.models,
+                        })),
+                    },
+                }),
+                ...(recorded.resolution
+                    ? [
+                        buildEvent({
+                            kind: 'resolution',
+                            convergeTarget: target,
+                            round,
+                            ...(recorded.runId !== undefined ? { runId: recorded.runId } : {}),
+                            payload: {
+                                status: recorded.resolution.status,
+                                actionable: recorded.resolution.actionable,
+                                unresolved: recorded.resolution.unresolved.length,
+                                fixed_this_round: recorded.resolution.fixedThisRound,
+                            },
+                        }),
+                    ]
+                    : []),
+            ]);
+            return recorded;
+        });
         if (opts.json) {
             console.log(JSON.stringify({
                 target: opts.target,
@@ -885,19 +927,31 @@ const telemetry = program
     .description('Evidence delivery to Harness: credentials, queued deliveries and retained rejected reports');
 telemetry
     .command('recover-reviewer')
-    .description('Deliver one exact retained terminal reviewer report without restarting reviewers or verification')
-    .requiredOption('--target <target>', 'Exact guarded convergence target')
-    .requiredOption('--run <id>', 'Exact retained terminal run UUID')
+    .description('Recover one terminal reviewer delivery without restarting reviewers')
+    .option('--preview', 'Write a pinned manifest without changing the server')
+    .option('--apply', 'Apply one exact reviewed recovery manifest')
+    .option('--resume', 'Resume the same journaled recovery operation')
+    .option('--manifest <path>', 'Immutable recovery manifest path; required for preview, apply or resume')
+    .option('--manifest-sha256 <sha256>', 'Required exact manifest digest for apply or resume')
+    .option('--target <target>', 'Exact guarded convergence target (preview or legacy no-outbox delivery)')
+    .option('--run <id>', 'Exact retained terminal run UUID (preview or legacy no-outbox delivery)')
     .option('--json', 'Output JSON')
     .action(async (opts) => {
     try {
         const runtime = await createTelemetryRuntime({ rclVersion: RCL_VERSION });
-        const result = await deliverTerminalReviewerRun(runtime, { target: opts.target, runId: opts.run });
+        const result = await deliverTerminalReviewerRun(runtime, { preview: opts.preview, apply: opts.apply, resume: opts.resume,
+            manifest: opts.manifest, manifestSha256: opts.manifestSha256, target: opts.target, runId: opts.run });
         if (opts.json)
             console.log(JSON.stringify(result, null, 2));
+        else if (!('status' in result)) {
+            const legacy = result;
+            console.log(`${legacy.outcome.line}\nReport ${legacy.reportSha256}; reviewer artifact ${legacy.reviewerArtifactSha256}`);
+        }
+        else if (result.status === 'prepared')
+            console.log(`Recovery manifest ${result.manifest}\nSHA-256 ${result.manifest_sha256}\nOperation ${result.operation_id}`);
         else
-            console.log(`${result.outcome.line}\nReport ${result.reportSha256}; reviewer artifact ${result.reviewerArtifactSha256}`);
-        process.exitCode = result.outcome.exitCode;
+            console.log(`Reviewer recovery complete for ${result.run_id}\nJournal ${result.journal}\nAcknowledgement ${result.recovery_acknowledgement}`);
+        process.exitCode = !('status' in result) ? result.outcome.exitCode : 0;
     }
     catch (error) {
         const message = scrubText(error instanceof Error ? error.message : String(error), 300);
@@ -1053,6 +1107,22 @@ evidenceCmd
     .action(async (runId, opts) => {
     process.exitCode = await runEvidenceShow(runId ?? '', opts, evidenceDeps());
 });
+evidenceCmd
+    .command('recover-claim')
+    .description('Preview, apply or resume an evidence-backed claim correction on the same target')
+    .option('--preview', 'Read immutable evidence and write an exclusive preview manifest')
+    .option('--apply', 'Apply the explicitly pinned manifest')
+    .option('--resume', 'Resume the same operation after independently reading accepted receipts')
+    .option('--selection <path>', 'Explicit source and claim selection for preview')
+    .option('--adopt-manifest <path>', 'Existing operation manifest to adopt during preview')
+    .option('--adopt-manifest-sha256 <sha256>', 'Exact digest of the existing operation manifest')
+    .requiredOption('--manifest <path>', 'Exclusive preview manifest or existing operation manifest')
+    .option('--manifest-sha256 <sha256>', 'Exact reviewed manifest digest for apply or resume')
+    .option('--json', 'Print machine-readable operation status')
+    .action(async (opts) => {
+    const { runPublicClaimRecovery } = await import('./evidence/recover-claim.js');
+    process.exitCode = await runPublicClaimRecovery(opts, evidenceDeps());
+});
 evidenceCmd
     .command('recover-run')
     .description('Preview, apply or resume delivery of one immutable original asserted run; no review, events or native accounting')
@@ -1359,7 +1429,20 @@ async function prepareCouncil(spinner, opts, fallbackRoles, attestation) {
     const startedAt = new Date();
     // Validate the converge context first: a bad --round must fail before any
     // model time is spent, not after the council has run.
-    const converge = resolveConvergeContext({ convergeTarget: opts.convergeTarget, round: opts.round, attempt: opts.attempt }, reviewConvergeEnvironment(opts));
+    let converge = resolveConvergeContext({ convergeTarget: opts.convergeTarget, round: opts.round, attempt: opts.attempt }, reviewConvergeEnvironment(opts));
+    if (!opts.startOver && opts.guardedConverge && converge && converge.round === undefined) {
+        const state = await loadConvergeRunState(await resolveGitCommonDir(), converge.target);
+        converge = { ...converge, round: Math.max(0, ...(state?.rounds.map(entry => entry.round) ?? [])) + 1 };
+    }
+    const recoveredProduction = converge && !opts.startOver
+        ? await selectCurrentRecoveredProduction(converge)
+        : undefined;
+    if (recoveredProduction && !opts.guardedConverge) {
+        throw new ReviewLaunchRefused('recovery_guard_required', 'Recovered-v3 production requires --guarded-converge so the provider call and report admission remain bound to one durable attempt.');
+    }
+    if (opts.guardedConverge && converge?.attempt !== undefined && !recoveredProduction) {
+        throw new ReviewLaunchRefused('preclaimed_attempt_ineligible', 'An explicit guarded attempt may only hand off the exact standalone claim for recovered-v3 production.');
+    }
     if (!opts.exportPendingPackage)
         await fetchHarnessKeys(spinner, attestation?.credential);
     const config = await loadConfig(opts.config, undefined, { preserveDefaultRoster: opts.guardedConverge });
@@ -1553,7 +1636,10 @@ async function prepareCouncil(spinner, opts, fallbackRoles, attestation) {
         ...(pendingClaimPlan ? { pendingClaimPlan } : {}),
         explicit: explicitReviewers !== undefined,
         coreModels: models,
-        ...(converge ? { converge } : {}),
+        ...(converge ? { converge: { ...converge, ...(recoveredProduction ? { recovery_source: {
+                        version: 1, native_sha256: recoveredProduction.nativeSha256,
+                    } } : {}) } } : {}),
+        ...(recoveredProduction ? { recoveredProduction } : {}),
         startedAt,
     };
 }
@@ -1584,8 +1670,10 @@ async function discoverCycleReview(target, opts) {
     const active = opts.startOver ? undefined : await loadConvergeRunState(common, targetKey);
     if (!opts.startOver && !active?.cycle)
         return opts;
-    if (opts.attempt !== undefined || (opts.startOver && opts.round !== undefined) || opts.attest)
+    const recoveredPreclaim = active?.version === 3 && opts.guardedConverge && opts.attempt !== undefined;
+    if ((opts.attempt !== undefined && !recoveredPreclaim) || (opts.startOver && opts.round !== undefined) || opts.attest) {
         throw new Error('A fresh review assigns its own ordinals and needs an ordinary actor credential');
+    }
     if (opts.telemetry === false)
         throw new Error('Fresh review cycles require Harness evidence');
     const paths = opts.jsonFile ? {} : await freshReviewOutputPaths(common);
@@ -1680,8 +1768,8 @@ async function runReview(target, opts) {
             const converge = resolveConvergeContext(opts, reviewConvergeEnvironment(opts));
             if (!converge)
                 throw new ReviewLaunchRefused('target_required', 'A guarded launch requires --converge-target.');
-            if (converge.attempt !== undefined || opts.attest) {
-                throw new ReviewLaunchRefused('incompatible_launch', 'Guarded review claims its own attempt; do not preclaim, pass --attempt, or combine it with --attest.');
+            if (opts.attest) {
+                throw new ReviewLaunchRefused('incompatible_launch', 'Guarded review cannot be combined with --attest.');
             }
         }
         // Exactly one review source: a positional target, --staged, or --working-tree
@@ -1906,6 +1994,8 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
                 throw new ReviewLaunchRefused('pending_async_binding_invalid', 'Retained async bindings must be comma-separated lowercase SHA-256 digests, or "none" for an empty cycle history.');
             }
             const migrationPackage = opts.ordinaryPendingPackage === undefined ? undefined : JSON.parse((await readStable(opts.ordinaryPendingPackage)).text);
+            const migrationGuardedInput = migrationPackage
+                ? ordinaryPendingGuardedInput(migrationPackage) : undefined;
             if (opts.expectPrHeadSha !== undefined && migrationPackage?.version !== 2) {
                 throw new ReviewLaunchRefused('pending_finalize_incompatible', '--expect-pr-head-sha requires a cycle-backed version-2 pending package.');
             }
@@ -1955,7 +2045,7 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
                 return [...found.values()].sort((a, b) => a.sha256.localeCompare(b.sha256));
             };
             if (opts.previewPending && migrationPackage) {
-                const inputSha256 = guardedInputSha256(migrationPackage.guardedInput);
+                const inputSha256 = guardedInputSha256(migrationGuardedInput);
                 const preview = await previewOrdinaryPendingLaunch({ gitCommonDir: common,
                     target: prepared.converge.target, headSha: extra.target.headSha ?? '', baseSha: extra.target.baseSha ?? '',
                     pendingInputSha256: inputSha256, recoveryInputSha256: inputSha256,
@@ -1974,7 +2064,7 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
                 return undefined;
             }
             if (opts.finalizePendingOnly && migrationPackage) {
-                const inputSha256 = guardedInputSha256(migrationPackage.guardedInput);
+                const inputSha256 = guardedInputSha256(migrationGuardedInput);
                 const result = await finalizeOrdinaryPendingLaunch({ gitCommonDir: common,
                     target: prepared.converge.target, headSha: extra.target.headSha ?? '',
                     baseSha: extra.target.baseSha ?? '', pendingInputSha256: inputSha256,
@@ -2017,7 +2107,7 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
                 .slice(0, MAX_ASYNC_CALLS_PER_ROUND);
             const pendingClaimAsyncPrompts = await Promise.all(pendingClaimAsyncChunks.map(({ assignment, chunk }) => buildPrompt(chunk, assignment.role, { contextDocs: pendingClaimContext, plan: planContext })));
             const claimedInputSha256 = migrationPackage
-                ? guardedInputSha256(migrationPackage.guardedInput)
+                ? guardedInputSha256(migrationGuardedInput)
                 : guardedInputSha256({
                     head: extra.target.headSha, kind: extra.target.kind, repo: extra.target.repo, pr: extra.target.prNumber,
                     diff: diffDigest(diff.files), config: configDigest(config), roster: pendingClaimRoster,
@@ -2119,6 +2209,7 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
             target: prepared.converge.target,
             startOver: opts.startOver, cycleRemote,
             boundFixRecovery,
+            recoverySource: prepared.converge.recovery_source,
             headSha: extra.target.headSha ?? '',
             inputSha256: guardedInputSha256(guardedInput),
             round: prepared.converge.round,
@@ -2127,6 +2218,7 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
             ...(opts.retryReport ? { legacyRetry: { reportPath: opts.retryReport, config, roster,
                     historicalPlan: prepared.historicalRetryPlan === true } } : {}),
             maxAttempts: opts.maxAttempts === undefined ? undefined : Number(opts.maxAttempts),
+            consumeAttempt: prepared.recoveredProduction ? prepared.converge.attempt : undefined,
             maxRounds: opts.maxRounds === undefined ? undefined : Number(opts.maxRounds),
             validate: async () => {
                 validateLaunchProviders(roster.map(entry => entry.provider));
@@ -2144,7 +2236,7 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
                         baseSha: retained.baseSha } };
             },
             onClaim: async (claim) => {
-                if (opts.telemetry !== false)
+                if (!claim.preclaimed && opts.telemetry !== false)
                     await reportConvergeEvents([buildEvent({
                             kind: 'attempt_claimed', convergeTarget: claim.target, attempt: claim.attempt,
                             payload: { attempt: claim.attempt, cap: claim.cap, ...(claim.cycle ? { cycle_id: claim.cycle.id } : {}),
@@ -2441,7 +2533,10 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
         startedAt: extra.pendingResume
             ? new Date(extra.pendingResume.launch.startedAtMs)
             : prepared.startedAt,
-        ...(prepared.converge ? { converge: { target: prepared.converge.target, round: prepared.converge.round, attempt: prepared.converge.attempt }, cycleId: prepared.converge.cycleId } : {}),
+        ...(prepared.converge ? { converge: {
+                target: prepared.converge.target, round: prepared.converge.round, attempt: prepared.converge.attempt,
+                ...(prepared.converge.recovery_source ? { recovery_source: prepared.converge.recovery_source } : {}),
+            }, cycleId: prepared.converge.cycleId } : {}),
     };
     const assemblyDependencies = {
         onStage: postReviewStage,
@@ -2498,7 +2593,7 @@ async function executeCouncil(spinner, prepared, diff, opts, extra, preparedWork
     else
         result = await assembleCompletedReview({
             chunkReviews, arrivedAsync, asyncLaunched, startTime, roleMap, config, diff,
-            gatingConfig: prepared.gatingConfig, modelWeights, run: runInput,
+            gatingConfig: prepared.gatingConfig, recoveredProduction: prepared.recoveredProduction, modelWeights, run: runInput,
         }, assemblyDependencies);
     const { run } = result;
     // The same derivation converge-report and the server apply to this report.