@deksden-com/dd-flow-cli 0.9.0-beta.103 → 0.9.0-beta.105

package/dist/services/run-fork.js

@@ -4,8 +4,9 @@ import path from "node:path";
 import { createContext } from "../runtime/context.js";
 import { AppError } from "../shared/errors.js";
 import { canonicalPath } from "../storage/paths.js";
+import { importGuardPath, rearmCompletedSnapshotImport } from "../storage/import-guard.js";
 import { installCurrentEngine, upgradeForkedRunEngine, prepareForkEngine } from "./engines.js";
-import { restoreEvalRunSnapshot, prepareEvalRunSnapshot, prepareEvalRunRestore } from "./eval-snapshots.js";
+import { restoreEvalRunSnapshot, prepareEvalRunSnapshot, prepareEvalRunRestore, restoredWorkspaceRoot } from "./eval-snapshots.js";
 export function prepareRunFork(input) {
     const requestId = requireId(input.requestId, "request-id");
     const snapshot = canonicalPath(input.snapshot, false);
@@ -47,7 +48,8 @@ function assertForkOutput(output, intentFile, intent) {
     if (fs.existsSync(output) && fs.readdirSync(output).length > 0) {
         if (!fs.existsSync(intentFile) || hash(readJson(intentFile).intent) !== hash(intent))
             throw new AppError("fork_output_not_empty", "Fork output must be empty", 2, { output });
-        const unknown = fs.readdirSync(output).filter(name => ![".fork-intent.json", "project", "dd-flow-home"].includes(name));
+        const guardName = path.basename(importGuardPath(path.join(output, "dd-flow-home")));
+        const unknown = fs.readdirSync(output).filter(name => ![".fork-intent.json", "project", "dd-flow-home", guardName].includes(name));
         if (unknown.length)
             throw new AppError("fork_retry_inspect_required", "Fork output contains data not owned by the interrupted fork", 1, { output, unknown });
     }
@@ -57,16 +59,18 @@ export function forkRunFromSnapshot(context, input, prepared = prepareRunFork(in
         return prepared.receipt;
     const { manifest, snapshot, output, intent, intentFile, receiptFile, requestId } = prepared;
     assertForkOutput(output, intentFile, intent);
+    const projectRoot = path.join(output, "project");
+    const home = path.join(output, "dd-flow-home");
+    const prearmedImportId = rearmCompletedSnapshotImport({ home, projectRoot,
+        workspaceRoot: restoredWorkspaceRoot(manifest, projectRoot, home), sourceManifestSha256: intent.snapshot_sha256 });
     for (const name of ["project", "dd-flow-home"])
         fs.rmSync(path.join(output, name), { recursive: true, force: true });
     fs.mkdirSync(output, { recursive: true, mode: 0o700 });
     writeJsonAtomic(intentFile, { schema_id: "dd-flow/run-fork-intent@1", intent });
-    const projectRoot = path.join(output, "project");
-    const home = path.join(output, "dd-flow-home");
     fs.mkdirSync(projectRoot, { recursive: true, mode: 0o700 });
-    const targetContext = createContext({ ...context.env, DD_FLOW_HOME: home, DD_FLOW_ENGINE_MODE: "1" });
+    const targetContext = createContext({ ...context.env, DD_FLOW_HOME: home, DD_FLOW_ENGINE_MODE: "1" }, "initialize", prearmedImportId ?? undefined);
     const restoreInput = { snapshot, projectRoot };
-    const restored = restoreEvalRunSnapshot(targetContext, restoreInput, prepareEvalRunRestore(targetContext, restoreInput, manifest));
+    const restored = restoreEvalRunSnapshot(targetContext, restoreInput, prepareEvalRunRestore(targetContext, restoreInput, manifest), prearmedImportId ?? undefined);
     const restoredContext = createContext({ ...context.env, DD_FLOW_HOME: home, DD_FLOW_ENGINE_MODE: "1" });
     try {
         const runHome = String(restored.run_home);

package/dist/services/run-projection.js

@@ -1,7 +1,7 @@
-import fs from "node:fs";
 import path from "node:path";
 import { reconcileSessionCoverageRows } from "../domain/session-coverage.js";
 import { publicSessionIdentity } from "./session-identity.js";
+import { publishRunProjections } from "./runs.js";
 export function refreshRunSessionProjection(context, projectId, runId) {
     const run = context.db.get("SELECT id, flow_kind, status, project_root, subject_type, subject_id, runtime_path, run_index_path, index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
     if (!run)
@@ -27,7 +27,7 @@ export function refreshRunSessionProjection(context, projectId, runId) {
         missing: coverage.missing_unit_ids,
         diagnostics: coverage.diagnostics
     };
-    const plan = run.subject_type === "protocol" ? planProjection(context, projectId, run.subject_id, run.project_root) : {};
+    const plan = run.subject_type === "protocol" ? planProjection(context, projectId, run.subject_id, run.project_root, index) : {};
     const workers = workerProjection(context, projectId, runId);
     const vnext = run.flow_kind === "vnext_specify" || run.flow_kind === "vnext_protocolize";
     const hadLegacyCoverage = vnext && ("session_coverage" in index || "usage_coverage" in index);
@@ -42,8 +42,8 @@ export function refreshRunSessionProjection(context, projectId, runId) {
         && JSON.stringify(index.works ?? []) === JSON.stringify(works)
         && index.root_work_id === rootWorkId
         && (vnext || JSON.stringify(index.session_coverage) === JSON.stringify(sessionCoverage))
-        && JSON.stringify(index.plan_ref) === JSON.stringify(plan.plan_ref)
-        && JSON.stringify(index.plan_progress) === JSON.stringify(plan.plan_progress)
+        && (!plan.plan_ref || JSON.stringify(index.plan_ref) === JSON.stringify(plan.plan_ref))
+        && (!plan.plan_progress || JSON.stringify(index.plan_progress) === JSON.stringify(plan.plan_progress))
         && (vnext || JSON.stringify(index.workers ?? {}) === JSON.stringify(workers))
         && !hadLegacyCoverage)
         return;
@@ -59,44 +59,25 @@ export function refreshRunSessionProjection(context, projectId, runId) {
     if (!vnext)
         index.workers = workers;
     index.updated_at = context.now();
-    const runtime = readJson(run.runtime_path);
-    const runtimeRevision = typeof runtime?.runtime_revision === "number"
-        ? runtime.runtime_revision + 1
-        : typeof index.runtime_revision === "number"
-            ? index.runtime_revision + 1
-            : 1;
-    index.runtime_revision = runtimeRevision;
-    const authoritative = { ...(runtime ?? {}), ...index, schema_id: String(index.schema_id ?? runtime?.schema_id ?? "dd-flow/flow-run@3") };
-    authoritative.sessions = sessions;
-    authoritative.works = works;
-    authoritative.root_work_id = rootWorkId;
-    if (vnext) {
-        delete authoritative.session_coverage;
-        delete authoritative.usage_coverage;
-        delete authoritative.workers;
-        delete authoritative.current_stage;
-        delete authoritative.attempts;
-    }
-    else
-        authoritative.session_coverage = sessionCoverage;
-    if (plan.plan_ref)
-        authoritative.plan_ref = plan.plan_ref;
-    if (plan.plan_progress)
-        authoritative.plan_progress = plan.plan_progress;
-    if (!vnext)
-        authoritative.workers = workers;
-    authoritative.updated_at = index.updated_at;
-    authoritative.runtime_revision = runtimeRevision;
-    if (run.status !== "discarded" || fs.existsSync(run.runtime_path))
-        writeJson(run.runtime_path, authoritative);
-    context.db.run("UPDATE runs SET index_json = ?, updated_at = ? WHERE project_id = ? AND id = ?", [JSON.stringify(index), index.updated_at, projectId, runId]);
+    index.runtime_revision = typeof index.runtime_revision === "number" ? index.runtime_revision + 1 : 1;
+    context.db.writeTransaction(() => {
+        const updated = context.db.run("UPDATE runs SET index_json = ?, updated_at = ? WHERE project_id = ? AND id = ? AND index_json = ?", [JSON.stringify(index), index.updated_at, projectId, runId, run.index_json]);
+        if (updated.changes !== 1)
+            throw new Error("RUN projection changed during preparation");
+        context.db.afterCommit(() => publishRunProjections(context, projectId, runId));
+    }, "run-projection.refresh");
 }
-function planProjection(context, projectId, protocolId, projectRoot) {
-    const binding = context.db.get("SELECT plan_path, plan_revision, plan_sha256 FROM plan_bindings WHERE project_id = ? AND protocol_id = ?", [projectId, protocolId]);
+function planProjection(context, projectId, protocolId, projectRoot, index) {
+    const binding = context.db.get("SELECT plan_id, plan_path, plan_revision, plan_sha256 FROM plan_bindings WHERE project_id = ? AND protocol_id = ?", [projectId, protocolId]);
     if (!binding)
         return {};
     const planPath = path.relative(projectRoot, binding.plan_path).split(path.sep).join("/");
-    const planId = readPlanId(binding.plan_path);
+    const priorRef = index.plan_ref && typeof index.plan_ref === "object" && !Array.isArray(index.plan_ref) ? index.plan_ref : {};
+    const planId = binding.plan_id ?? (typeof priorRef.plan_id === "string" ? priorRef.plan_id : null);
+    // A pre-migration binding without a RUN plan_ref needs canonical rebind before
+    // this projection can be updated; never invent a plan identifier.
+    if (!planId)
+        return {};
     const progress = Object.fromEntries(context.db.all("SELECT item_id, status, summary, evidence_json FROM plan_progress WHERE project_id = ? AND protocol_id = ? ORDER BY item_id", [projectId, protocolId]).map((row) => [row.item_id, {
             status: row.status,
             ...(row.summary ? { summary: row.summary } : {}),
@@ -112,18 +93,6 @@ function planProjection(context, projectId, protocolId, projectRoot) {
         plan_progress: progress
     };
 }
-function readPlanId(planPath) {
-    try {
-        const value = JSON.parse(fs.readFileSync(planPath, "utf8"));
-        if (value && typeof value === "object" && !Array.isArray(value) && typeof value.plan_id === "string") {
-            return value.plan_id;
-        }
-    }
-    catch {
-        // The canonical validator owns malformed-plan errors; projection stays bounded.
-    }
-    return "unknown-plan";
-}
 function workerProjection(context, projectId, runId) {
     return Object.fromEntries(context.db.all(`SELECT j.job_id, j.plan_item_id, j.status, j.worker_session_id, s.harness, s.provider_session_id
        FROM flow_jobs j LEFT JOIN sessions s ON s.project_id = j.project_id AND s.session_id = j.worker_session_id
@@ -182,17 +151,3 @@ function parseCoverageUnits(value) {
         return [];
     }
 }
-function readJson(file) {
-    try {
-        return fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, "utf8")) : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-function writeJson(file, value) {
-    fs.mkdirSync(path.dirname(file), { recursive: true });
-    const temporary = `${file}.tmp-${process.pid}-${Date.now()}`;
-    fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`);
-    fs.renameSync(temporary, file);
-}

package/dist/services/run-recovery-runtime.js

@@ -4,7 +4,8 @@ import { AppError } from "../shared/errors.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { requireProjectByRoot } from "./projects.js";
 import { acceptanceCommand, recoveryGuard, recoveryPacketReceipt, requireRecoveryRun } from "./run-recovery.js";
-import { processIsAlive } from "./managed-processes.js";
+import { managedProcessBinding, processIsAlive, resourceHome } from "./managed-processes.js";
+import { getResourceDatabase } from "../storage/database.js";
 import { requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 /** Pin retained Session loading and its first acknowledgement Turn, never a general fence bypass. */
 export function prepareRunRecoveryDispatch(context, input) {
@@ -12,8 +13,7 @@ export function prepareRunRecoveryDispatch(context, input) {
         throw new AppError("usage", "Recovery dispatch requires an operation id and absolute state directory", 2);
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const run = requireRecoveryRun(context, project.id, input.runId);
-    context.db.beginWriteTransaction();
-    try {
+    const prepared = context.db.readSnapshot(() => {
         const guard = recoveryGuard(context, project.id, run.id);
         const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ?", [input.recoveryId]);
         if (!guard || guard.recovery_id !== input.recoveryId || !binding || !["resuming", "recovered"].includes(guard.status))
@@ -23,8 +23,7 @@ export function prepareRunRecoveryDispatch(context, input) {
             const prior = JSON.parse(binding.runtime_dispatch_json);
             if (prior.state_dir !== input.stateDir || prior.operation_id !== input.operationId)
                 throw new AppError("recovery_binding_mismatch", "Recovery dispatch is already pinned to another operation", 1);
-            context.db.exec("COMMIT");
-            return prior;
+            return { dispatch: prior, guard, binding };
         }
         if (guard.status !== "resuming" || binding.status !== "prepared")
             throw new AppError("recovery_state_changed", "Recovery acknowledgement is no longer awaiting dispatch", 1);
@@ -34,16 +33,27 @@ export function prepareRunRecoveryDispatch(context, input) {
         const metadata = JSON.parse(record.metadata_json);
         if (metadata.state_dir !== input.stateDir || metadata.run_generation !== guard.generation || metadata.dispatch_barrier !== "run-generation@1" || !["subject", "merge"].includes(metadata.role ?? ""))
             throw new AppError("recovery_runtime_mismatch", "Replacement daemon lacks this recovery generation's native dispatch barrier", 1);
-        const prompt = `Resume this retained RUN in its existing native Session. Your first tool call must be this exact standalone command:\n\n${acceptanceCommand(context, run.id, guard.recovery_id, run.project_root)}\n\nFollow the verified recovery packet returned by that command. Preserve completed Work and existing HITL; do not start a successor Stage yourself. Stop at the Stage or declared Work-graph boundary.\n`;
-        const dispatch = { process_id: record.id, owner_id: record.owner_id, state_dir: input.stateDir, daemon_id: binding.daemon_id, operation_id: input.operationId, resume_operation_id: `${input.operationId}:load`, prompt_sha256: crypto.createHash("sha256").update(prompt).digest("hex"), prompt };
-        context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND status = 'prepared' AND runtime_dispatch_json IS NULL", [JSON.stringify(dispatch), binding.recovery_id]);
-        context.db.exec("COMMIT");
-        return dispatch;
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
+        return { guard, binding, record };
+    });
+    let dispatch = prepared.dispatch;
+    if (!dispatch) {
+        const prompt = `Resume this retained RUN in its existing native Session. Your first tool call must be this exact standalone command:\n\n${acceptanceCommand(context, run.id, prepared.guard.recovery_id, run.project_root)}\n\nFollow the verified recovery packet returned by that command. Preserve completed Work and existing HITL; do not start a successor Stage yourself. Stop at the Stage or declared Work-graph boundary.\n`;
+        dispatch = { process_id: prepared.record.id, owner_id: prepared.record.owner_id, state_dir: input.stateDir, daemon_id: prepared.binding.daemon_id, operation_id: input.operationId, resume_operation_id: `${input.operationId}:load`, prompt_sha256: crypto.createHash("sha256").update(prompt).digest("hex"), prompt };
     }
+    const registry = prepared.record ? getResourceDatabase(resourceHome(context)) : undefined;
+    return context.db.writeTransaction(() => {
+        const guard = recoveryGuard(context, project.id, run.id);
+        const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ?", [input.recoveryId]);
+        if (JSON.stringify(guard) !== JSON.stringify(prepared.guard) || JSON.stringify(binding) !== JSON.stringify(prepared.binding))
+            throw new AppError("recovery_state_changed", "Recovery generation changed while dispatch was prepared", 1);
+        if (prepared.record) {
+            const current = registry.get("SELECT * FROM managed_processes WHERE id = ?", [prepared.record.id]);
+            if (!current || current.state !== "running" || current.lease_expires_at <= context.now() || managedProcessBinding(current, resourceHome(context)).registration_sha256 !== managedProcessBinding(prepared.record, resourceHome(context)).registration_sha256)
+                throw new AppError("recovery_runtime_mismatch", "Recovery replacement daemon lease changed before dispatch publication", 1);
+            context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND status = 'prepared' AND runtime_dispatch_json IS NULL", [JSON.stringify(dispatch), prepared.binding.recovery_id]);
+        }
+        return dispatch;
+    });
 }
 /** The caller has already checked PID/start/lease and runtime-home identity. */
 export function recoveryRuntimeAdmission(context, record, input) {

package/dist/services/run-recovery.js

@@ -1,4 +1,4 @@
-import { managedLifecycleCommand, recoverLifecycleCommands } from "./lifecycle-invocations.js";
+import { hasLifecyclePacketAssignments, managedLifecycleCommand, recoverLifecycleCommands } from "./lifecycle-invocations.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -91,15 +91,18 @@ export function assertWorkSettlementAllowed(context, projectId, runId, workId) {
     assertRunMutationAllowed(context, projectId, runId);
 }
 /** Completion rights are pinned to the Stage attempt present at the pause fence. */
-export function assertStageSettlementAllowed(context, projectId, runId, stage) {
+export function assertStageSettlementAllowed(context, projectId, runId, stage, expectedGeneration) {
     const guard = recoveryGuard(context, projectId, runId);
+    const generation = guard?.generation ?? 0;
+    if (expectedGeneration !== undefined && generation !== expectedGeneration)
+        throw new AppError("run_recovery_generation_stale", "RUN execution generation changed while the operation was in flight", 1, { run_id: runId, expected_generation: expectedGeneration, generation });
     if (guard?.status === "draining" && context.db.get("SELECT name FROM sqlite_master WHERE type = 'table' AND name = 'run_control_stage_admissions'")) {
         const admitted = context.db.get(`SELECT a.work_session_id FROM run_control_stage_admissions a JOIN run_controls c ON c.control_id = a.control_id JOIN run_control_admissions w ON w.control_id = a.control_id AND w.work_session_id = a.work_session_id JOIN work_sessions ws ON ws.id = w.work_session_id JOIN runs r ON r.project_id = c.project_id AND r.id = c.run_id, json_each(r.index_json, '$.stage_runs') live
       WHERE c.project_id = ? AND c.run_id = ? AND c.recovery_id = ? AND c.action = 'pause' AND c.status = 'requested' AND a.stage = ? AND json_extract(live.value, '$.stage') = a.stage AND COALESCE(json_extract(live.value, '$.attempt'), 'try-001') = a.attempt AND ws.work_id = w.work_id AND ws.session_id = w.session_id AND NOT EXISTS (SELECT 1 FROM work_sessions newer WHERE newer.work_id = w.work_id AND newer.status = 'running' AND newer.id <> ws.id) LIMIT 1`, [projectId, runId, guard.recovery_id, stage]);
         if (admitted)
-            return;
+            return generation;
     }
-    assertRunMutationAllowed(context, projectId, runId);
+    return assertRunMutationAllowed(context, projectId, runId, expectedGeneration);
 }
 /** A recovered RUN never grants the retired process a new execution segment. */
 export function assertRecoveryHookCurrent(context, projectId, runId, identity) {
@@ -117,29 +120,25 @@ export function beginRunRecovery(context, input, interruption = prepareRecoveryP
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const run = requireRecoveryRun(context, project.id, input.runId);
     const recoveryId = `RCV-${crypto.randomUUID()}`, now = context.now();
-    let generation;
-    context.db.beginWriteTransaction();
-    try {
+    const accepted = context.db.writeTransaction(() => {
         const prior = recoveryGuard(context, project.id, run.id);
         const supersedes = prior?.status === "resuming" && interruption.recovery_parent_id === prior.recovery_id;
         if (prior && ["draining", "sealed", "resuming"].includes(prior.status) && !supersedes) {
-            context.db.exec("COMMIT");
             return { ok: true, recovery: { ...prior, interruption: JSON.parse(prior.interruption_json) }, reused: true };
         }
-        generation = (prior?.generation ?? 0) + 1;
+        const generation = (prior?.generation ?? 0) + 1;
         if (supersedes) {
             context.db.run("UPDATE run_recovery_guards SET status = 'abandoned', updated_at = ? WHERE recovery_id = ?", [now, prior.recovery_id]);
             context.db.run("UPDATE run_recovery_bindings SET status = 'abandoned' WHERE recovery_id = ? AND status = 'prepared'", [prior.recovery_id]);
         }
         context.db.run("INSERT INTO run_recovery_guards (recovery_id, project_id, run_id, generation, status, interruption_json, settlement_json, capture_path, created_at, updated_at, sealed_at, resumed_at) VALUES (?, ?, ?, ?, 'draining', ?, NULL, NULL, ?, ?, NULL, NULL)", [recoveryId, project.id, run.id, generation, JSON.stringify(interruption), now, now]);
         setFlowRunRecoveryPaused(context, project.id, run.id, true);
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
-    appendFlowRunTimelineEvent(context, project.id, run.id, { type: "run_recovery_draining", recovery_id: recoveryId, generation, interruption });
+        appendFlowRunTimelineEvent(context, project.id, run.id, { type: "run_recovery_draining", recovery_id: recoveryId, generation, interruption });
+        return { ok: true, recovery: { recovery_id: recoveryId, run_id: run.id, generation, status: "draining", interruption }, reused: false };
+    });
+    if (accepted.reused)
+        return accepted;
+    const generation = accepted.recovery.generation;
     return { ok: true, recovery: { recovery_id: recoveryId, run_id: run.id, generation, status: "draining", interruption } };
 }
 export function sealRunRecovery(context, input, settlement = prepareRecoveryPayload(input.settlement, "settlement")) {
@@ -154,18 +153,12 @@ export function sealRunRecovery(context, input, settlement = prepareRecoveryPayl
         throw new AppError("recovery_invalid_state", "Recovery is not draining", 1, { recovery_id: guard.recovery_id, status: guard.status });
     materializePendingWorkResults(context, project.id, run.id);
     const now = context.now();
-    context.db.exec("SAVEPOINT seal_run_status");
-    try {
+    context.db.writeTransaction(() => {
         const updated = context.db.run("UPDATE run_recovery_guards SET status = 'sealed', settlement_json = ?, sealed_at = ?, updated_at = ? WHERE recovery_id = ? AND status = 'draining' AND generation = (SELECT MAX(generation) FROM run_recovery_guards WHERE project_id = ? AND run_id = ?)", [JSON.stringify(settlement), now, now, guard.recovery_id, project.id, run.id]);
         if (updated.changes !== 1)
             throw new AppError("recovery_state_changed", "Recovery state changed before it could be sealed", 1, { recovery_id: guard.recovery_id });
         setFlowRunRecoveryPaused(context, project.id, run.id, true);
-        context.db.exec("RELEASE seal_run_status");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK TO seal_run_status; RELEASE seal_run_status");
-        throw error;
-    }
+    });
     appendFlowRunTimelineEvent(context, project.id, run.id, { type: "run_recovery_sealed", recovery_id: guard.recovery_id, generation: guard.generation, settlement });
     return { ok: true, recovery: { recovery_id: guard.recovery_id, run_id: run.id, generation: guard.generation, status: "sealed", settlement } };
 }
@@ -222,10 +215,18 @@ export function resumeRunRecovery(context, input, prepared = prepareRunRecoveryR
     const acceptCommand = acceptanceCommand(context, run.id, guard.recovery_id, run.project_root);
     if (prepared.reused)
         return { ok: true, recovery_id: guard.recovery_id, generation: guard.generation, resumed: guard.status === "recovered", awaiting_acceptance: guard.status === "resuming", accept_command: acceptCommand, reused: true };
-    const now = context.now();
-    let running = [];
-    context.db.beginWriteTransaction();
-    try {
+    const authority = () => JSON.stringify([
+        recoveryGuard(context, project.id, run.id), requireRecoveryRun(context, project.id, run.id),
+        context.db.all("SELECT * FROM works WHERE project_id = ? AND run_id = ? ORDER BY work_id", [project.id, run.id]),
+        context.db.all("SELECT ws.* FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? ORDER BY ws.id", [project.id, run.id]),
+        context.db.all("SELECT DISTINCT s.* FROM sessions s JOIN work_sessions ws ON ws.session_id = s.session_id JOIN works w ON w.work_id = ws.work_id AND w.project_id = s.project_id WHERE w.project_id = ? AND w.run_id = ? ORDER BY s.session_id", [project.id, run.id]),
+        context.db.all("SELECT DISTINCT d.work_id, d.status, d.result FROM works w, json_each(w.depends_on_json) dependency JOIN works d ON d.work_id = dependency.value WHERE w.project_id = ? AND w.run_id = ? ORDER BY d.work_id", [project.id, run.id]),
+        context.db.all("SELECT s.* FROM work_recovery_segments s JOIN works w ON w.work_id = s.work_id WHERE w.project_id = ? AND w.run_id = ? ORDER BY s.recovery_id, s.work_id", [project.id, run.id]),
+        context.db.all("SELECT id FROM hook_events WHERE project_id = ? AND daemon_id = ? ORDER BY id", [project.id, input.daemonId]),
+        context.db.all("SELECT b.recovery_id FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND b.daemon_id = ? ORDER BY b.recovery_id", [project.id, input.daemonId])
+    ]);
+    const publication = context.db.readSnapshot(() => {
+        const signature = authority();
         const current = recoveryGuard(context, project.id, run.id);
         if (!current || current.recovery_id !== guard.recovery_id || current.generation !== guard.generation || current.status !== "sealed" || current.capture_path !== guard.capture_path)
             throw new AppError("recovery_state_changed", "Recovery state changed before its resume transaction", 1, { recovery_id: guard.recovery_id });
@@ -249,23 +250,26 @@ export function resumeRunRecovery(context, input, prepared = prepareRunRecoveryR
         if (context.db.get("SELECT id FROM hook_events WHERE project_id = ? AND daemon_id = ? LIMIT 1", [project.id, input.daemonId]) || context.db.get("SELECT b.recovery_id FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND b.daemon_id = ? LIMIT 1", [project.id, input.daemonId]))
             throw new AppError("recovery_daemon_stale", "Replacement daemon already has historical lifecycle authority in this project", 1);
         const packet = rootRecoveryPacket(context, run, guard, owner);
+        const running = context.db.all("SELECT work_id, started_at, status FROM works WHERE project_id = ? AND run_id = ? AND work_id <> ? AND parent_work_id IS NOT NULL AND (status = 'running' OR (status = 'created' AND EXISTS (SELECT 1 FROM work_recovery_segments s WHERE s.work_id = works.work_id AND s.status = 'prepared'))) ORDER BY work_id", [project.id, run.id, owner.work_id]);
+        const evidence = new Map(running.map(work => [work.work_id, recoveryEvidencePath(context, run, guard, work.work_id)]));
+        return { signature, owner, packet, running, evidence };
+    });
+    const { owner, packet, running } = publication;
+    context.db.writeTransaction(() => {
+        if (authority() !== publication.signature)
+            throw new AppError("recovery_state_changed", "Recovery inputs changed while its packet was prepared", 1, { recovery_id: guard.recovery_id });
+        const now = context.now();
         context.db.run("INSERT INTO run_recovery_bindings (recovery_id, work_id, prior_work_session_id, session_id, harness, provider_session_id, daemon_id, status, created_at, packet_json, packet_sha256) VALUES (?, ?, ?, ?, ?, ?, ?, 'prepared', ?, ?, ?)", [guard.recovery_id, owner.work_id, owner.id, owner.session_id, input.harness, input.nativeSessionId, input.daemonId, now, packet, crypto.createHash("sha256").update(packet).digest("hex")]);
-        running = context.db.all("SELECT work_id, started_at, status FROM works WHERE project_id = ? AND run_id = ? AND work_id <> ? AND parent_work_id IS NOT NULL AND (status = 'running' OR (status = 'created' AND EXISTS (SELECT 1 FROM work_recovery_segments s WHERE s.work_id = works.work_id AND s.status = 'prepared'))) ORDER BY work_id", [project.id, run.id, owner.work_id]);
         for (const work of running)
             context.db.run("UPDATE work_recovery_segments SET status = 'superseded', updated_at = ? WHERE work_id = ? AND status = 'prepared'", [now, work.work_id]);
         for (const work of running) {
-            const evidence = recoveryEvidencePath(context, run, guard, work.work_id);
+            const evidence = publication.evidence.get(work.work_id);
             context.db.run("INSERT INTO work_recovery_segments (recovery_id, work_id, generation, prior_started_at, evidence_path, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'prepared', ?, ?)", [guard.recovery_id, work.work_id, guard.generation, work.started_at, evidence, now, now]);
             context.db.run("UPDATE work_sessions SET status = 'interrupted', completed_at = ?, updated_at = ? WHERE work_id = ? AND status = 'running'", [now, now, work.work_id]);
             context.db.run("UPDATE works SET status = 'created', result = NULL, completed_at = NULL, updated_at = ? WHERE work_id = ? AND status = 'running'", [now, work.work_id]);
         }
         context.db.run("UPDATE run_recovery_guards SET status = 'resuming', updated_at = ? WHERE recovery_id = ? AND status = 'sealed'", [now, guard.recovery_id]);
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    });
     appendFlowRunTimelineEvent(context, project.id, run.id, { type: "run_recovery_prepared", recovery_id: guard.recovery_id, generation: guard.generation, daemon_id: input.daemonId, interrupted_works: running.map((work) => work.work_id) });
     return { ok: true, recovery_id: guard.recovery_id, generation: guard.generation, resumed: false, awaiting_acceptance: true, accept_command: acceptCommand, interrupted_works: running.map((work) => work.work_id) };
 }
@@ -276,28 +280,28 @@ export function acceptRunRecovery(context, input) {
     const eventKey = input.hookEventId ?? findRecentMatchingHookEvent(context, { projectId: project.id, matchKey, errorCode: "trusted_recovery_acceptance_required", operation: "run recovery accept" }).eventKey;
     const identity = hookSessionIdentity(context, project.id, eventKey);
     const now = context.now();
-    let packetReceipt;
-    context.db.beginWriteTransaction();
-    try {
+    const result = context.db.writeTransaction(() => {
         const guard = recoveryGuard(context, project.id, run.id);
         const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ?", [input.recoveryId]);
         const hook = context.db.get("SELECT status, match_key FROM hook_events WHERE id = ?", [identity.hookEventId]);
         if (!guard || guard.recovery_id !== input.recoveryId || !binding || binding.session_id !== identity.sessionId || binding.harness !== identity.harness || binding.provider_session_id !== identity.providerSessionId || binding.daemon_id !== identity.daemonId || !hook?.match_key || !matchKey.includes(hook.match_key))
             throw new AppError("recovery_binding_mismatch", "Recovery acknowledgement does not belong to the authorized physical Session and generation", 1);
-        packetReceipt = recoveryPacketReceipt(binding);
-        if (binding.harness === "zcode-acp") {
-            const retained = packetReceipt.packet;
+        const packetReceipt = recoveryPacketReceipt(binding);
+        const retained = packetReceipt.packet;
+        if (binding.harness === "zcode-acp" || (binding.harness === "codex-desktop" && hasLifecyclePacketAssignments(context, retained.original_prompt.text))) {
             const scope = { projectRoot: run.project_root, daemonId: binding.daemon_id, rootSessionId: binding.provider_session_id, runId: run.id, generation: guard.generation };
+            const assignments = new Set();
             packetReceipt.lifecycle_recovery = {
-                commands: retained.continuation === "stage_boundary" ? [] : recoverLifecycleCommands(context, retained.original_prompt.text, scope),
-                instruction: "original_prompt is immutable historical evidence. Do not execute its old invocation IDs or scope. Use only replacement commands below; reconcile unknown outcomes before continuing. At a completed stage boundary return control to the runner.",
+                commands: retained.continuation === "stage_boundary" ? [] : recoverLifecycleCommands({ ...context, captureLifecycleAssignment: id => { assignments.add(id); } }, retained.original_prompt.text, scope),
+                instruction: "original_prompt is immutable historical evidence. Do not execute its old command authority. Use only replacement commands below; reconcile unknown outcomes before continuing. At a completed stage boundary return control to the runner.",
                 work_list_command: `${flowCommand({ ...context, env: { ...context.env, DD_FLOW_INVOCATION_SCOPE: JSON.stringify(scope) } })} work ls --run ${run.id} --ready --project-root ${JSON.stringify(run.project_root)} --json`
             };
+            if (context.captureLifecycleAssignment)
+                context.db.afterCommit(() => { for (const id of assignments)
+                    context.captureLifecycleAssignment(id); });
         }
-        if (guard.status === "recovered" && binding.status === "accepted" && binding.hook_event_key === eventKey && hook.status === "claimed") {
-            context.db.exec("COMMIT");
+        if (guard.status === "recovered" && binding.status === "accepted" && binding.hook_event_key === eventKey && hook.status === "claimed")
             return { ok: true, accepted: true, recovery_id: guard.recovery_id, generation: guard.generation, reused: true, ...packetReceipt };
-        }
         if (guard.status !== "resuming" || binding.status !== "prepared" || hook.status !== "observed")
             throw new AppError("trusted_recovery_acceptance_required", "Recovery requires a fresh native acknowledgement before work can continue", 1);
         const packet = JSON.parse(binding.packet_json);
@@ -313,14 +317,12 @@ export function acceptRunRecovery(context, input) {
         context.db.run("UPDATE run_recovery_bindings SET status = 'accepted', hook_event_key = ?, accepted_at = ? WHERE recovery_id = ?", [eventKey, now, binding.recovery_id]);
         context.db.run("UPDATE run_recovery_guards SET status = 'recovered', resumed_at = ?, updated_at = ? WHERE recovery_id = ?", [now, now, guard.recovery_id]);
         setFlowRunRecoveryPaused(context, project.id, run.id, false);
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+        return { ok: true, accepted: true, recovery_id: input.recoveryId, ...packetReceipt };
+    });
+    if ("reused" in result && result.reused)
+        return result;
     appendFlowRunTimelineEvent(context, project.id, run.id, { type: "run_recovery_accepted", recovery_id: input.recoveryId, daemon_id: identity.daemonId, hook_event_key: eventKey });
-    return { ok: true, accepted: true, recovery_id: input.recoveryId, ...packetReceipt };
+    return result;
 }
 function recoveryEvidencePath(context, run, guard, workId) {
     // The verified capture is already immutable evidence. Referencing it avoids