@deksden-com/dd-flow-cli 0.9.0-beta.11 → 0.9.0-beta.110

package/dist/services/prompts.js

@@ -9,7 +9,8 @@ import { validatePlanItem } from "../domain/validation.js";
 import { AppError } from "../shared/errors.js";
 import { parseJsonObject } from "../shared/json.js";
 import { ensureDir, resolveProjectRoot } from "../storage/paths.js";
-import { planWithProgress } from "./plan-runtime.js";
+import { boundCanonicalPlan, planWithProgress, prepareCanonicalPlan } from "./plan-runtime.js";
+import { prepareTextFile } from "../cli/input-preparation.js";
 import { registerFlowJob } from "./sessions.js";
 const profiles = {
     code_implementation: {
@@ -22,7 +23,7 @@ const profiles = {
         static_files: [".memory-bank/dd-flow/common/worker-session.md", ".memory-bank/dd-flow/workers/verify.md"]
     }
 };
-export function renderWorkerPrompt(context, input) {
+export function prepareWorkerPrompt(context, input) {
     const projectRoot = resolveProjectRoot(input.projectRoot);
     const project = requireProjectByRoot(context, projectRoot);
     const protocol = requireProtocol(context, protocolIdForRun(context, project.id, input.runId), project.id);
@@ -43,8 +44,10 @@ export function renderWorkerPrompt(context, input) {
         projectId: protocol.project_id,
         protocolId: protocol.id,
         planPath: protocol.plan_path
-    });
+    }, { bind: false });
     const plan = planRuntime?.plan ?? null;
+    if (planRuntime)
+        prepareCanonicalPlan(context, { projectId: protocol.project_id, protocolId: protocol.id, planPath: protocol.plan_path }, planRuntime.canonical);
     const genericTask = input.taskFile ? readWorkerTask(input.taskFile, runHomePath(run)) : null;
     const item = genericTask?.item ?? plan?.items.find((candidate) => candidate.id === input.planItemId);
     if (!item)
@@ -64,13 +67,6 @@ export function renderWorkerPrompt(context, input) {
     const profile = profiles[input.profile];
     if (!profile)
         throw new AppError("prompt_profile_unsupported", `Unsupported prompt profile: ${input.profile}`, 2);
-    const job = registerFlowJob(context, {
-        projectId: protocol.project_id,
-        runId: run.id,
-        protocolId: protocol.id,
-        planItemId: item.id,
-        groupId: item.execution_context.planned_write_areas[0] ?? null
-    });
     const staticInputs = profile.static_files.map((file) => readStaticInput(projectRoot, file));
     const requiredRead = item.execution_context.required_read.map((file) => checkedReference(projectRoot, runHomePath(run), file, "required_read", true));
     const discoveryBoundary = item.execution_context.discovery_boundary.map((file) => checkedReference(projectRoot, runHomePath(run), file, "discovery_boundary", false));
@@ -78,7 +74,6 @@ export function renderWorkerPrompt(context, input) {
     const runHome = runHomePath(run);
     const outputDir = path.join(runHome, stage.dir, "subagents", item.id);
     assertWithin(runHome, outputDir, "output directory");
-    ensureDir(outputDir);
     const prompt = renderPrompt({
         item,
         input,
@@ -90,6 +85,20 @@ export function renderWorkerPrompt(context, input) {
         staticInputs,
         ...(genericTask ? { handoff: genericTask.handoff } : {})
     });
+    return { protocol, run, item, plan, planRuntime, genericTask, workspaceRoot, staticInputs, requiredRead, discoveryBoundary, plannedWriteAreas, outputDir, prompt, canonVersion: readCanonVersion(projectRoot) };
+}
+export function renderWorkerPrompt(context, input, prepared = prepareWorkerPrompt(context, input)) {
+    const { protocol, run, item, plan, planRuntime, genericTask, workspaceRoot, staticInputs, requiredRead, discoveryBoundary, plannedWriteAreas, outputDir, prompt, canonVersion } = prepared;
+    if (planRuntime)
+        boundCanonicalPlan(context, { projectId: protocol.project_id, protocolId: protocol.id, planPath: protocol.plan_path }, planRuntime.canonical);
+    const job = registerFlowJob(context, {
+        projectId: protocol.project_id,
+        runId: run.id,
+        protocolId: protocol.id,
+        planItemId: item.id,
+        groupId: item.execution_context.planned_write_areas[0] ?? null
+    });
+    ensureDir(outputDir);
     const promptPath = path.join(outputDir, "launch-prompt.md");
     const stackPath = path.join(outputDir, "prompt-stack.json");
     const reportPath = path.join(outputDir, "render-report.json");
@@ -104,7 +113,7 @@ export function renderWorkerPrompt(context, input) {
         plan_item_id: input.taskFile ? null : item.id,
         task_id: input.taskFile ? item.id : null,
         job_id: job.job_id,
-        canon_version: readCanonVersion(projectRoot),
+        canon_version: canonVersion,
         renderer_version: getCliVersionReport().cli.version,
         static_inputs: staticInputs.map(({ path: inputPath, sha256 }) => ({ path: inputPath, sha256 })),
         validation: { required_read: requiredRead, discovery_boundary: discoveryBoundary, planned_write_areas: plannedWriteAreas },
@@ -143,9 +152,7 @@ function runHomePath(run) {
 function readWorkerTask(taskFile, runHome) {
     const resolved = path.resolve(taskFile);
     assertWithin(runHome, resolved, "worker task file");
-    if (!fs.existsSync(resolved))
-        throw new AppError("not_found", "Worker task file is missing", 1, { path: taskFile });
-    const task = parseJsonObject(fs.readFileSync(resolved, "utf8"), resolved);
+    const task = parseJsonObject(prepareTextFile(resolved, "worker task").text, resolved);
     if (task.schema_id !== "dd-flow/worker-task@1" || !task.task || typeof task.task !== "object") {
         throw new AppError("validation", "Worker task must use dd-flow/worker-task@1 with a task object", 2, { path: taskFile });
     }
@@ -180,7 +187,7 @@ function validateWorkerTaskHandoff(value, runHome) {
         const reportPath = path.resolve(report.report_path);
         assertWithin(runHome, reportPath, "predecessor report");
         if (!fs.existsSync(reportPath))
-            throw new AppError("not_found", "Accepted predecessor report is missing", 1, { path: report.report_path });
+            throw new AppError("runtime_artifact_missing", "Accepted predecessor report is missing", 1, { path: report.report_path });
         return { aspect_id: report.aspect_id, verdict, report_path: reportPath };
     });
     const recovery = handoff.recovery_attempt_paths ?? [];
@@ -293,6 +300,8 @@ function renderPrompt(input) {
         `- Acceptance contribution: ${item.semantic_spine?.acceptance_contribution ?? "not_applicable"}`,
         "",
         "## Hard Write Boundary",
+        "Before editing, change into the project workspace shown below (cd -- WORKSPACE) or use its absolute path when the tool cannot persist cwd.",
+        "Write only the project workspace and the named report directory; never write another RUN/native home or Git/worktree control data.",
         `- All project writes must stay under: \`${input.workspaceRoot}\``,
         "- Do not write outside this workspace, to another RUN, or into Git/worktree control data.",
         "- Accepted requirements and non-goals remain binding; planned write areas do not.",

package/dist/services/protocols.js

@@ -1,31 +1,38 @@
 import fs from "node:fs";
 import path from "node:path";
+import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { parse as parseYaml } from "yaml";
 import { canTransition } from "../domain/contracts.js";
 import { defaultFlowContract, flowContractForState, loadProjectFlowContract } from "../domain/flow-contract.js";
 import { requireStage } from "../domain/validation.js";
 import { AppError } from "../shared/errors.js";
-import { parseJsonObject } from "../shared/json.js";
-import { ensureReadableFile } from "../storage/database.js";
-import { ensureDir, planJsonPath, resolveProjectRoot, runtimeProtocolDir, runtimeStateJsonPath } from "../storage/paths.js";
+import { prepareJsonFile } from "../cli/input-preparation.js";
+import { ensureDir, planJsonPath, resolveProjectRoot, resolveProtocolPlanPath, runtimeProtocolDir, runtimeStateJsonPath } from "../storage/paths.js";
 import { appendAudit, getAuditEvents } from "./audit.js";
+import { withProjectionLock } from "../storage/projection-lock.js";
 import { requireProjectByRoot } from "./projects.js";
-import { ensureRuntimeProtocolFiles, readStateFile, writeState } from "../protocol/local-files.js";
+import { prepareRuntimeProtocolFiles, publishRuntimeProtocolMetadata, readStateFile, writeState } from "../protocol/local-files.js";
 import { planSummary, planWithProgress, readCanonicalPlan } from "./plan-runtime.js";
 import { activeCodexSessionBindingsForProject, activeFlowSessionBindingsForProject, codexHomeProfilesForProject, codexHookEventsForProject, hookStatusForProject } from "./hooks.js";
 import { buildProtocolFlowGuidance } from "./flow-guidance.js";
 import { lifecycleIsTerminalFailure, lifecycleIsTerminalSuccess, normalizeProtocolLifecycle } from "./protocol-lifecycle.js";
 import { getProtocolBranchContext } from "./branch-context.js";
-export function registerProtocol(context, input) {
+export function prepareProtocolRegistration(context, input) {
+    if (typeof input.handshakeId !== "string" || !input.handshakeId.trim() || /[/\\\0]/.test(input.handshakeId) || [".", ".."].includes(input.handshakeId))
+        throw new AppError("validation", "Protocol handshake must be a non-empty identifier, not a path", 2);
     const projectRoot = resolveProjectRoot(input.projectRoot);
     const project = requireProjectByRoot(context, projectRoot);
-    const now = context.now();
     const workspacePath = input.workspacePath ? resolveProjectRoot(input.workspacePath) : undefined;
     const idRoot = workspacePath ?? projectRoot;
     const protocolId = inferProtocolId(idRoot, input.handshakeId);
     const runtimeDir = runtimeProtocolDir(context.ddFlowHome, project.id, protocolId);
-    const state = ensureRuntimeProtocolFiles({
+    return { projectRoot, project, workspacePath, protocolId, runtimeDir };
+}
+export function registerProtocol(context, input) {
+    const { projectRoot, project, workspacePath, protocolId, runtimeDir } = prepareProtocolRegistration(context, input);
+    const now = context.now();
+    const initialized = prepareRuntimeProtocolFiles({
         runtimeDir,
         protocolId,
         projectRoot,
@@ -33,25 +40,27 @@ export function registerProtocol(context, input) {
         workspacePath,
         now
     });
-    const existing = findProtocol(context, protocolId, project.id);
-    const params = [
-        protocolId,
-        input.handshakeId,
-        project.id,
-        projectRoot,
-        state.status,
-        state.stage,
-        state.next_action,
-        JSON.stringify(state.route),
-        JSON.stringify(state.workspace),
-        JSON.stringify(state.blockers),
-        JSON.stringify(state.active_def),
-        runtimeStateJsonPath(context.ddFlowHome, project.id, protocolId),
-        planJsonPath(workspacePath ?? projectRoot, protocolId),
-        existing?.created_at ?? now,
-        now
-    ];
-    context.db.run(`INSERT INTO protocols
+    return context.db.writeTransaction(() => {
+        const existing = findProtocol(context, protocolId, project.id);
+        const state = existing ? latestProtocolProjection(context, project.id, protocolId) ?? initialized : initialized;
+        const params = [
+            protocolId,
+            input.handshakeId,
+            project.id,
+            projectRoot,
+            state.status,
+            state.stage,
+            state.next_action,
+            JSON.stringify(state.route),
+            JSON.stringify(state.workspace),
+            JSON.stringify(state.blockers),
+            JSON.stringify(state.active_def),
+            runtimeStateJsonPath(context.ddFlowHome, project.id, protocolId),
+            planJsonPath(workspacePath ?? projectRoot, protocolId),
+            existing?.created_at ?? now,
+            now
+        ];
+        context.db.run(`INSERT INTO protocols
       (id, handshake_id, project_id, project_root, status, stage, next_action,
        route_json, workspace_json, blockers_json, active_def_json, state_path, plan_path,
        created_at, updated_at)
@@ -70,19 +79,23 @@ export function registerProtocol(context, input) {
        state_path = excluded.state_path,
        plan_path = excluded.plan_path,
        updated_at = excluded.updated_at`, params);
-    appendAudit(context, {
-        protocolId,
-        projectId: project.id,
-        eventType: existing ? "protocol.registration_refreshed" : "protocol.registered",
-        payload: {
-            protocol_id: protocolId,
-            handshake_id: input.handshakeId,
-            project_root: projectRoot,
-            workspace_path: workspacePath ?? null,
-            runtime_dir: runtimeDir
-        }
-    });
-    return { ok: true, protocol: protocolStatusPayload(requireProtocol(context, protocolId, project.id)), state };
+        appendAudit(context, { protocolId, projectId: project.id, eventType: "protocol.state_projection", payload: { state } });
+        context.db.afterCommit(() => publishProtocolProjection(context, project.id, protocolId));
+        context.db.afterCommit(() => publishRuntimeProtocolMetadata({ runtimeDir, protocolId, handshakeId: input.handshakeId, projectRoot }));
+        appendAudit(context, {
+            protocolId,
+            projectId: project.id,
+            eventType: existing ? "protocol.registration_refreshed" : "protocol.registered",
+            payload: {
+                protocol_id: protocolId,
+                handshake_id: input.handshakeId,
+                project_root: projectRoot,
+                workspace_path: workspacePath ?? null,
+                runtime_dir: runtimeDir
+            }
+        });
+        return { ok: true, protocol: protocolStatusPayload(requireProtocol(context, protocolId, project.id)), state };
+    }, "protocol.register");
 }
 export function getProtocolStatus(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
@@ -243,7 +256,22 @@ export function implementProtocol(context, input) {
         }
     };
 }
-export function transitionProtocol(context, input) {
+export function prepareProtocolTransition(context, input) {
+    const { value } = prepareJsonFile(input.jsonFile, "Protocol transition payload");
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new AppError("validation", "Protocol transition payload must be an object", 2);
+    const payload = value;
+    for (const [key, field] of Object.entries(payload)) {
+        const valid = key === "next_action" ? typeof field === "string"
+            : ["route", "workspace"].includes(key) ? Boolean(field && typeof field === "object" && !Array.isArray(field))
+                : ["blockers", "active_def"].includes(key) && Array.isArray(field);
+        if (!valid)
+            throw new AppError("validation", `Unsupported field or invalid value in protocol transition: ${key}`, 2, { file: input.jsonFile, parameter: key });
+    }
+    protocolTransitionState(context, input);
+    return payload;
+}
+function protocolTransitionState(context, input) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const protocol = requireProtocol(context, input.protocolId, project.id);
     const state = readProtocolRuntimeState(context, protocol).state;
@@ -256,8 +284,10 @@ export function transitionProtocol(context, input) {
     if (input.force && (!input.reason || input.reason.trim().length === 0)) {
         throw new AppError("validation", "Forced transitions require --reason", 2);
     }
-    ensureReadableFile(input.jsonFile);
-    const payload = parseJsonObject(fs.readFileSync(input.jsonFile, "utf8"), input.jsonFile);
+    return { project, protocol, state, flowContract, from, to };
+}
+export function transitionProtocol(context, input, payload = prepareProtocolTransition(context, input)) {
+    const { project, protocol, state, flowContract, from, to } = protocolTransitionState(context, input);
     const nextState = {
         ...state,
         stage: to,
@@ -416,8 +446,7 @@ export function syncProtocolFromRun(context, input) {
         next_action: nextActionForSyncedTarget(targetStage),
         updated_at: now
     };
-    context.db.exec("BEGIN IMMEDIATE");
-    try {
+    context.db.writeTransaction(() => {
         persistProtocolState(context, protocol, nextState);
         if (targetStage === "ready_for_merge") {
             context.db.run(`INSERT INTO merge_queue
@@ -449,12 +478,7 @@ export function syncProtocolFromRun(context, input) {
                 stage_chain: stageChain(index)
             }
         });
-        context.db.exec("COMMIT");
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    }, "protocols.syncFromRun");
     return {
         ok: true,
         protocol_id: protocol.id,
@@ -486,8 +510,7 @@ export function cancelProtocol(context, input) {
     const now = context.now();
     const worktree = context.db.get("SELECT worktree_path, status FROM worktree_records WHERE project_id = ? AND protocol_id = ?", [protocol.project_id, protocol.id]);
     const worktreeRemoval = input.worktree === "remove" ? removeProtocolWorktreeBeforeCancel(protocol, state, worktree, input.force) : undefined;
-    context.db.exec("BEGIN IMMEDIATE");
-    try {
+    return context.db.writeTransaction(() => {
         const nextState = {
             ...state,
             stage: "cancelled",
@@ -548,7 +571,6 @@ export function cancelProtocol(context, input) {
                 worktree_outcome: worktreeOutcome
             }
         });
-        context.db.exec("COMMIT");
         return {
             ok: true,
             protocol_id: protocol.id,
@@ -560,11 +582,7 @@ export function cancelProtocol(context, input) {
             worktree_outcome: worktreeOutcome,
             worktree: context.db.get("SELECT * FROM worktree_records WHERE project_id = ? AND protocol_id = ?", [protocol.project_id, protocol.id]) ?? null
         };
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+    }, "protocols.cancel");
 }
 export function requireProtocol(context, protocolId, projectId) {
     const matches = projectId
@@ -579,7 +597,10 @@ export function requireProtocol(context, protocolId, projectId) {
             candidates: matches.map((protocol) => ({ project_id: protocol.project_id, project_root: protocol.project_root }))
         });
     }
-    return matches[0];
+    return resolvedProtocolRecord(matches[0]);
+}
+function resolvedProtocolRecord(protocol) {
+    return { ...protocol, plan_path: resolveProtocolPlanPath(protocol.project_root, protocol.id, protocol.plan_path) };
 }
 function cancelQueueForProtocol(context, protocol, reason, force) {
     const job = context.db.get("SELECT id, status, claimed_by_session_id FROM merge_queue WHERE project_id = ? AND protocol_id = ?", [protocol.project_id, protocol.id]);
@@ -733,9 +754,42 @@ function releaseRelatedMergeLocks(context, protocol, reason) {
     return { ok: true, released: released.length, locks: released };
 }
 export function readProtocolRuntimeState(context, protocol) {
+    const expected = runtimeStateJsonPath(context.ddFlowHome, protocol.project_id, protocol.id);
+    if (protocol.state_path !== expected)
+        throw new AppError("protocol_state_migration_required", "Protocol runtime path requires explicit cleanup scan/apply before use", 1, { protocol_id: protocol.id, path: protocol.state_path, expected_path: expected });
+    const accepted = latestProtocolProjection(context, protocol.project_id, protocol.id);
+    if (accepted)
+        return { state: accepted, diagnostics: [] };
+    return resolveProtocolRuntimeState(context, { ...protocol }, false);
+}
+/** Explicit cleanup migration; productive readers accept only the current path. */
+export function repairProtocolRuntimeState(context, protocol) {
+    // Readers project the canonical plan path without migrating storage. Repair
+    // must start from the stored locations, not that already-normalized view.
+    const stored = context.db.get("SELECT * FROM protocols WHERE project_id = ? AND id = ?", [protocol.project_id, protocol.id]);
+    if (stored)
+        Object.assign(protocol, stored);
+    return resolveProtocolRuntimeState(context, protocol, true);
+}
+/** Read-only repair preparation; caller CASes paths, then persists this state. */
+export function prepareProtocolRuntimeRepair(context, protocol) {
+    const stored = context.db.get("SELECT * FROM protocols WHERE project_id = ? AND id = ?", [protocol.project_id, protocol.id]);
+    if (!stored)
+        throw new AppError("not_found", "Protocol is not registered", 1, { protocol_id: protocol.id });
+    const state = latestProtocolProjection(context, stored.project_id, stored.id) ?? resolveProtocolRuntimeState(context, { ...stored }, false).state;
+    return {
+        state,
+        statePath: runtimeStateJsonPath(context.ddFlowHome, stored.project_id, stored.id),
+        planPath: planJsonPath(stored.project_root, stored.id),
+        previousStatePath: stored.state_path
+    };
+}
+function resolveProtocolRuntimeState(context, protocol, repair) {
     const diagnostics = [];
-    normalizeProtocolPlanPath(context, protocol, diagnostics);
+    normalizeProtocolPlanPath(context, protocol, diagnostics, repair);
     try {
+        if (protocol.state_path !== runtimeStateJsonPath(context.ddFlowHome, protocol.project_id, protocol.id))
+            throw new AppError("protocol_state_migration_required", "Retired state files are not runtime authority", 1);
         return { state: readStateFile(protocol.state_path, protocol.id), diagnostics };
     }
     catch {
@@ -750,7 +804,8 @@ export function readProtocolRuntimeState(context, protocol) {
                 recommended_action: "legacy protocol state_path was moved to stable runtime storage"
             });
             const stablePlanPath = planJsonPath(protocol.project_root, protocol.id);
-            context.db.run("UPDATE protocols SET state_path = ?, plan_path = ? WHERE project_id = ? AND id = ?", [stableStatePath, stablePlanPath, protocol.project_id, protocol.id]);
+            if (repair && context.db.writable)
+                context.db.run("UPDATE protocols SET state_path = ?, plan_path = ? WHERE project_id = ? AND id = ?", [stableStatePath, stablePlanPath, protocol.project_id, protocol.id]);
             protocol.state_path = stableStatePath;
             protocol.plan_path = stablePlanPath;
             return { state: readStateFile(stableStatePath, protocol.id), diagnostics };
@@ -783,7 +838,7 @@ export function readProtocolRuntimeState(context, protocol) {
         flow_contract: flowContract,
         updated_at: protocol.updated_at
     };
-    if (!context.db.writable) {
+    if (!repair || !context.db.writable) {
         return { state, diagnostics };
     }
     const stableStatePath = runtimeStateJsonPath(context.ddFlowHome, protocol.project_id, protocol.id);
@@ -802,9 +857,9 @@ export function readProtocolRuntimeState(context, protocol) {
     });
     return { state, diagnostics };
 }
-function normalizeProtocolPlanPath(context, protocol, diagnostics) {
-    const canonicalPlanPath = planJsonPath(protocol.project_root, protocol.id);
-    if (protocol.plan_path === canonicalPlanPath || !fs.existsSync(canonicalPlanPath))
+function normalizeProtocolPlanPath(context, protocol, diagnostics, repair) {
+    const canonicalPlanPath = resolveProtocolPlanPath(protocol.project_root, protocol.id, protocol.plan_path);
+    if (protocol.plan_path === canonicalPlanPath)
         return;
     diagnostics.push({
         code: "protocol_plan_relocated",
@@ -814,7 +869,7 @@ function normalizeProtocolPlanPath(context, protocol, diagnostics) {
         source: "project_canonical_plan",
         recommended_action: "use the project canonical plan as the sole semantic plan source"
     });
-    if (context.db.writable) {
+    if (repair && context.db.writable) {
         context.db.run("UPDATE protocols SET plan_path = ?, updated_at = ? WHERE project_id = ? AND id = ?", [canonicalPlanPath, context.now(), protocol.project_id, protocol.id]);
     }
     protocol.plan_path = canonicalPlanPath;
@@ -847,38 +902,57 @@ export function protocolRunDiagnostics(context, protocol, state) {
     return { latest_run: latestWithStages, diagnostics };
 }
 export function persistProtocolState(context, protocol, state) {
-    ensureDir(path.dirname(protocol.state_path));
-    writeState(protocol.state_path, state);
-    context.db.run(`UPDATE protocols SET
+    context.db.writeTransaction(() => {
+        context.db.run(`UPDATE protocols SET
        status = ?, stage = ?, next_action = ?, route_json = ?, workspace_json = ?,
        blockers_json = ?, active_def_json = ?, updated_at = ?
      WHERE project_id = ? AND id = ?`, [
-        state.status,
-        state.stage,
-        state.next_action,
-        JSON.stringify(state.route),
-        JSON.stringify(state.workspace),
-        JSON.stringify(state.blockers),
-        JSON.stringify(state.active_def),
-        state.updated_at,
-        protocol.project_id,
-        protocol.id
-    ]);
-    if (state.status === "closed" || state.stage === "closed") {
-        const now = context.now();
-        context.db.run(`UPDATE sessions
+            state.status,
+            state.stage,
+            state.next_action,
+            JSON.stringify(state.route),
+            JSON.stringify(state.workspace),
+            JSON.stringify(state.blockers),
+            JSON.stringify(state.active_def),
+            state.updated_at,
+            protocol.project_id,
+            protocol.id
+        ]);
+        appendAudit(context, { protocolId: protocol.id, projectId: protocol.project_id, eventType: "protocol.state_projection", payload: { state } });
+        if (state.status === "closed" || state.stage === "closed") {
+            const now = context.now();
+            context.db.run(`UPDATE sessions
        SET status = 'stopped', stop_reason = 'protocol closed', updated_at = ?, stopped_at = ?
        WHERE project_id = ?
          AND protocol_id = ?
          AND status IN ('pending', 'active', 'waiting_user', 'blocked', 'stopping')`, [now, now, protocol.project_id, protocol.id]);
-    }
+        }
+        context.db.afterCommit(() => publishProtocolProjection(context, protocol.project_id, protocol.id));
+    }, "protocols.persistProtocolState");
+}
+function latestProtocolProjection(context, projectId, protocolId) {
+    const row = context.db.get("SELECT payload_json FROM audit_events WHERE project_id = ? AND protocol_id = ? AND event_type = 'protocol.state_projection' ORDER BY id DESC LIMIT 1", [projectId, protocolId]);
+    return row ? JSON.parse(row.payload_json).state : null;
+}
+export function publishProtocolProjection(context, projectId, protocolId) {
+    const protocol = requireProtocol(context, protocolId, projectId);
+    ensureDir(path.dirname(protocol.state_path));
+    withProjectionLock(`${protocol.state_path}.publish-lock`, () => {
+        const accepted = latestProtocolProjection(context, projectId, protocolId);
+        if (!accepted)
+            throw new AppError("runtime_state_missing", "Protocol has no accepted SQL state", 1, { protocol_id: protocolId });
+        const temporary = `${protocol.state_path}.tmp-${process.pid}-${crypto.randomUUID()}`;
+        fs.writeFileSync(temporary, `${JSON.stringify(accepted, null, 2)}\n`);
+        fs.renameSync(temporary, protocol.state_path);
+    });
 }
 function findProtocol(context, protocolId, projectId) {
     if (projectId) {
-        return context.db.get("SELECT * FROM protocols WHERE project_id = ? AND id = ?", [projectId, protocolId]);
+        const protocol = context.db.get("SELECT * FROM protocols WHERE project_id = ? AND id = ?", [projectId, protocolId]);
+        return protocol ? resolvedProtocolRecord(protocol) : undefined;
     }
     const matches = context.db.all("SELECT * FROM protocols WHERE id = ? ORDER BY project_id", [protocolId]);
-    return matches.length === 1 ? matches[0] : undefined;
+    return matches.length === 1 ? resolvedProtocolRecord(matches[0]) : undefined;
 }
 function protocolDocumentsForProject(projectRoot) {
     const protocolRoot = path.join(projectRoot, ".memory-bank", "protocol");

package/dist/services/recovery-observation-budget.js

@@ -0,0 +1,61 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { AppError } from "../shared/errors.js";
+export const recoveryObservationBudgetMs = 120_000;
+const activeObservation = new AsyncLocalStorage();
+export const withRecoveryObservation = (budget, action) => activeObservation.run(budget, action);
+export const recoveryRpcTimeout = (maximum) => {
+    const observation = activeObservation.getStore();
+    // An unbounded productive transport wait is still bounded while recovery is
+    // actively reconciling. Outside recovery, its owner policy decides when to
+    // stop rather than a hidden adapter timer.
+    if (maximum === null)
+        return observation ? observation.timeout() : null;
+    return observation?.timeout(maximum ?? 30_000) ?? maximum ?? 30_000;
+};
+/** Call only while holding the existing owner-claim transaction. A replay of
+ * an explicit request never replenishes time, even after another request. */
+export function renewRecoveryObservation(snapshot, requestId) {
+    if (typeof requestId !== "string" || !requestId.trim() || requestId.length > 200)
+        throw new AppError("usage", "Reconciliation requires a nonempty request ID of at most 200 characters", 2);
+    const previous = snapshot.recovery_observation;
+    const ids = previous?.reconciliation_ids ?? [];
+    if (!Array.isArray(ids) || ids.some(id => typeof id !== "string"))
+        throw new AppError("recovery_observation_invalid", "Retained reconciliation identities are malformed", 1);
+    if (ids.includes(requestId))
+        return snapshot;
+    return { ...snapshot, recovery_observation: { budget_ms: recoveryObservationBudgetMs, remaining_ms: recoveryObservationBudgetMs, reconciliation_ids: [...ids, requestId], poll_index: 0 } };
+}
+/**
+ * Measures only time this owner can actually observe. Large scheduler gaps
+ * reset the sample instead of turning host sleep into evidence about a remote
+ * process. Persisting the remaining budget makes a recovered owner continue
+ * reconciliation rather than silently receiving a new unlimited wait.
+ */
+export function recoveryObservationBudget(saved, monotonic = () => performance.now()) {
+    const prior = saved && typeof saved === "object" ? saved.recovery_observation : null;
+    let remaining = typeof prior?.remaining_ms === "number" && Number.isFinite(prior.remaining_ms)
+        ? Math.max(0, Math.min(recoveryObservationBudgetMs, prior.remaining_ms))
+        : prior == null ? recoveryObservationBudgetMs : 0;
+    let last = monotonic();
+    let pollIndex = Number.isSafeInteger(prior?.poll_index) && prior.poll_index >= 0 ? prior.poll_index : 0;
+    const observation = {
+        exhausted: () => {
+            const current = monotonic();
+            const elapsed = current - last;
+            last = current;
+            // A gap means this process was not observing; it never proves progress
+            // or death and therefore does not consume the reconciliation budget.
+            if (elapsed >= 0 && elapsed <= 60_000)
+                remaining = Math.max(0, remaining - elapsed);
+            return remaining === 0;
+        },
+        state: () => ({ budget_ms: recoveryObservationBudgetMs, remaining_ms: Math.ceil(remaining), reconciliation_ids: prior?.reconciliation_ids ?? [], poll_index: pollIndex }),
+        timeout: (maximum = 30_000) => {
+            if (observation.exhausted())
+                throw new AppError("recovery_observation_budget_exhausted", "Recovery observation budget exhausted; explicit reconciliation is required", 1);
+            return Math.max(1, Math.min(maximum, Math.ceil(remaining)));
+        },
+        nextDelay: () => Math.min([1000, 2000, 5000, 10000][Math.min(pollIndex++, 3)], Math.ceil(remaining)),
+    };
+    return observation;
+}