@deksden-com/dd-flow-cli 0.9.0-beta.120 → 0.9.0-beta.121

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.120",
-  "cli_commit": "a9385404a7a9fced5e4cfdcdb656e534c06d1401",
-  "built_at": "2026-09-28T22:25:15.635Z",
+  "cli_version": "0.9.0-beta.121",
+  "cli_commit": "2e7bef9a7813bd003855d94b394e63d8aa5f6419",
+  "built_at": "2026-09-29T16:13:36.621Z",
   "built_with_canon": {
     "version": "4.1.1",
     "commit": "678daa038287c948ada5b2d785a6dcc925c7b891",

package/dist/harness-runtime/lib/dd-grok-daemon.mjs

@@ -315,7 +315,7 @@ export class Runtime {
     // creation/end_turn receipt can then establish an idle root. Dispatch
     // clears that receipt before sending any subsequent productive request.
     const receipt = this.sessions.get(result?.provider_session_id)?.native_root_receipt;
-    if (status === "unknown" && ["created", "end_turn", "cancelled"].includes(receipt?.kind)) return false;
+    if (status === "unknown" && ["created", "end_turn", "cancelled", "failed"].includes(receipt?.kind)) return false;
     return !["completed", "failed", "cancelled", "stopped", "idle"].includes(status);
   }
   async refreshTree(cancel = false) {
@@ -356,7 +356,17 @@ export class Runtime {
       const running = name === "session.archive" ? false : this.treeRunning(result);
       await this.persist({ active_tree: running, active_operation: null });
       return { ...result, descendants: this.topology(result.provider_session_id), settled: !running };
-    } catch (error) { await this.persist({ active_tree: true, active_operation: null }); throw error; }
+    } catch (error) {
+      // A matched JSON-RPC error completes this native prompt request. It is
+      // root-turn proof, not proof that any descendants have stopped. A lost
+      // response, bridge error, or failure before dispatch earns no receipt.
+      const response = error?.details?.terminal_response;
+      if (name === "session.prompt" && response?.method === "session/prompt" && response.session_id === sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (session) session.native_root_receipt = { kind: "failed", daemon_id: this.state.daemon_id, request_id: response.request_id };
+      }
+      await this.persist({ active_tree: true, active_operation: null }); throw error;
+    }
     finally { this.active = null; }
   }
   async dispatch(operation, params) {

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -270,7 +270,9 @@ export class AcpBridge {
         const unknown = ["native_timeout", "native_backend_dead", "native_backend_pipe_broken", "native_outcome_unknown"].includes(nativeCode);
         error.code = unknown ? nativeCode : /payment required|quota|usage balance exhausted|insufficient.?credit|billing/i.test(messageText) ? "provider_quota_exhausted" : /rate.?limit|too many requests/i.test(messageText) ? "provider_rate_limited" : /\b429\b/.test(messageText) ? "provider_limit_unknown" : "acp_request_failed";
         error.retryable = error.code === "provider_rate_limited";
-        error.details = { acp_code: message.error.code ?? null, ...(data ? { native: data } : {}), ...(details ? { provider_details: details } : {}), ...(providerDetails ? { provider_update: provider } : {}) };
+        error.details = { acp_code: message.error.code ?? null,
+          terminal_response: { method: pending.method, session_id: pending.sessionId, request_id: message.id },
+          ...(data ? { native: data } : {}), ...(details ? { provider_details: details } : {}), ...(providerDetails ? { provider_update: provider } : {}) };
         pending.reject(error);
       }
       else { pending.resolve(message.result ?? {}); }

package/dist/services/code-checks.js

@@ -9,11 +9,51 @@ import { assertRunMutationAllowed } from "./run-recovery.js";
 import { AppError } from "../shared/errors.js";
 import { confirmManagedProcess, finishManagedProcess, heartbeatManagedProcess, managedProcessStatus, managedProcessRuntimeHome, managedOwnerIsAlive, processTreeIsAlive, registerManagedProcess, reservePorts } from "./managed-processes.js";
 import { admitRuntimeCheck, runtimeBudgetForRun } from "./runtime-budget.js";
+import { getResourceDatabase } from "../storage/database.js";
 const profileRelativePath = path.join(".memory-bank", "spec", "engineering", "code-check-profile.json");
 // Receipt reservation precedes child spawn so an interrupted CLI leaves an
 // auditable attempt. A second caller must not mistake that small handoff window
 // for a dead check and overwrite its outcome.
 const receiptStartingGraceMs = 30_000;
+/** The check writer proves an empty tree before marking its registration terminal. */
+export function terminalCheckSettled(context, record) {
+    if (record.kind !== "check" || !record.check_id || record.owner_id !== `check:${record.check_id}` || !record.project_id || !record.run_id
+        || !record.pid || !record.pid_started_at || !["stopped", "failed"].includes(record.state) || !record.finished_at)
+        return null;
+    let metadata;
+    try {
+        metadata = JSON.parse(record.metadata_json);
+    }
+    catch {
+        return null;
+    }
+    if (metadata.role !== "check" || managedProcessRuntimeHome(record, context) !== context.ddFlowHome)
+        return null;
+    let resource;
+    try {
+        resource = getResourceDatabase(context.env.DD_FLOW_RESOURCE_HOME ?? context.ddFlowHome, "read_existing");
+    }
+    catch {
+        return null;
+    }
+    try {
+        const current = resource.get("SELECT * FROM managed_processes WHERE id = ?", [record.id]);
+        if (!current || current.lease_token !== record.lease_token || current.owner_id !== record.owner_id || current.pid !== record.pid
+            || current.pid_started_at !== record.pid_started_at || current.metadata_json !== record.metadata_json || current.state !== record.state
+            || current.project_id !== record.project_id || current.run_id !== record.run_id || current.work_id !== record.work_id
+            || current.check_id !== record.check_id || current.finished_at !== record.finished_at)
+            return null;
+        const receipt = context.db.get("SELECT status, finished_at, work_id FROM check_receipts WHERE id = ? AND project_id = ? AND run_id = ?", [record.check_id, record.project_id, record.run_id]);
+        return receipt && receipt.work_id === record.work_id && ["passed", "failed", "aborted"].includes(receipt.status) && receipt.finished_at
+            ? { status: receipt.status, finished_at: receipt.finished_at } : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        resource.close?.();
+    }
+}
 export function codeExecutionEnvironment(workspaceRoot) {
     const suffix = crypto.createHash("sha256").update(path.resolve(workspaceRoot)).digest("hex").slice(0, 12);
     // The managed CLI's Node must win over a provider app's PATH: a Rosetta

package/dist/services/managed-processes.js

@@ -61,7 +61,12 @@ export function prepareManagedProcessRegistration(context, input) {
         throw new AppError("validation", "Unique managed operation requires operationId", 2);
     let metadataJson;
     try {
-        metadataJson = JSON.stringify({ ...input.metadata, dd_flow_home: context.ddFlowHome, ...(input.ownerPid ? { owner_pid: input.ownerPid, owner_pid_started_at: processStartedAt(input.ownerPid) } : {}) });
+        const metadata = { ...input.metadata, dd_flow_home: context.ddFlowHome, ...(input.ownerPid ? { owner_pid: input.ownerPid, owner_pid_started_at: processStartedAt(input.ownerPid) } : {}) };
+        delete metadata.process_birth;
+        delete metadata.owner_birth;
+        if (input.ownerPid)
+            metadata.owner_birth = stableProcessBirth(input.ownerPid);
+        metadataJson = JSON.stringify(metadata);
     }
     catch {
         throw new AppError("validation", "metadata must be JSON-serializable", 2);
@@ -86,7 +91,8 @@ export function registerManagedProcess(context, rawInput) {
     if (!input.uniqueActiveOperation)
         return insertManagedProcess(context, input, metadataJson);
     const db = registry(context);
-    if (observer && !processIsAlive({ pid: input.pid, pid_started_at: observerBirth }))
+    const observerProcessBirth = observer ? stableProcessBirth(input.pid) : null;
+    if (observer && !processIsAlive({ pid: input.pid, pid_started_at: observerBirth, metadata_json: JSON.stringify({ process_birth: observerProcessBirth }) }))
         throw new AppError("process_ownership_unknown", "EVAL observer changed before registration", 1);
     return db.writeTransaction(() => {
         const existing = db.get("SELECT * FROM managed_processes WHERE operation_id = ? AND state IN ('starting','running','stopping','orphaned')", [input.operationId]);
@@ -97,6 +103,7 @@ export function registerManagedProcess(context, rawInput) {
             const metadata = JSON.parse(metadataJson);
             if (input.processGroupId)
                 metadata.process_group_id = input.processGroupId;
+            metadata.process_birth = observerProcessBirth;
             const now = context.now();
             db.run("UPDATE managed_processes SET pid = ?, pid_started_at = ?, state = 'running', lease_expires_at = ?, updated_at = ?, metadata_json = ? WHERE id = ? AND lease_token = ? AND state = 'starting'", [input.pid, observerBirth, leaseExpiry(now, input.leaseMs), now, JSON.stringify(metadata), result.id, result.lease_token]);
             result = requireProcess(db, result.id);
@@ -137,9 +144,11 @@ export function confirmManagedProcess(context, input) {
     const metadata = parseMetadata(current.metadata_json);
     if (input.processGroupId)
         metadata.process_group_id = input.processGroupId;
+    metadata.process_birth = stableProcessBirth(input.pid);
     if (input.ownerPid) {
         metadata.owner_pid = input.ownerPid;
         metadata.owner_pid_started_at = processStartedAt(input.ownerPid);
+        metadata.owner_birth = stableProcessBirth(input.ownerPid);
     }
     const result = db.run(`UPDATE managed_processes
      SET pid = ?, pid_started_at = ?, state = 'running', lease_expires_at = ?, updated_at = ?, metadata_json = ?
@@ -216,6 +225,11 @@ export function processIsAlive(record) {
     catch (error) {
         return error.code !== "ESRCH";
     }
+    const metadata = record.metadata_json ? parseMetadata(record.metadata_json) : {};
+    if (Object.hasOwn(metadata, "process_birth")) {
+        const birth = parseBirth(metadata.process_birth), observed = stableProcessBirth(record.pid);
+        return !birth || !observed || observed === birth;
+    }
     const started = processStartedAt(record.pid);
     return !record.pid_started_at || !started || record.pid_started_at === started;
 }
@@ -223,6 +237,17 @@ export function processTreeIsAlive(record) {
     if (processIsAlive(record))
         return true;
     const group = parseMetadata(record.metadata_json).process_group_id;
+    const birth = parseBirth(parseMetadata(record.metadata_json).process_birth);
+    // POSIX cannot reuse a leader PID while its old process group survives.
+    if (process.platform !== "win32" && group === record.pid && record.pid && birth) {
+        try {
+            process.kill(record.pid, 0);
+        }
+        catch { /* A missing leader can still have living children. */ }
+        const observed = stableProcessBirth(record.pid);
+        if (observed && observed !== birth)
+            return false;
+    }
     if (process.platform !== "win32" && typeof group === "number") {
         try {
             process.kill(-group, 0);
@@ -238,7 +263,7 @@ export function managedOwnerIsAlive(record) {
     const metadata = parseMetadata(record.metadata_json);
     if (typeof metadata.owner_pid !== "number")
         return null;
-    return processIsAlive({ pid: metadata.owner_pid, pid_started_at: typeof metadata.owner_pid_started_at === "string" ? metadata.owner_pid_started_at : null });
+    return processIsAlive({ pid: metadata.owner_pid, pid_started_at: typeof metadata.owner_pid_started_at === "string" ? metadata.owner_pid_started_at : null, metadata_json: JSON.stringify({ process_birth: metadata.owner_birth }) });
 }
 /**
  * Expiry proves that observation stopped, not that the owner died.  A live PID
@@ -413,16 +438,27 @@ function leaseExpiry(now, leaseMs = defaultLeaseMs) {
     return new Date(Date.parse(now) + leaseMs).toISOString();
 }
 export function processStartedAt(pid) { const result = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8", timeout: 1_000 }); const value = result.status === 0 ? result.stdout.trim() : ""; return value || null; }
+function stableProcessBirth(pid) {
+    const result = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8", timeout: 1_000, env: { ...process.env, TZ: "UTC", LC_ALL: "C" } });
+    const value = result.status === 0 ? result.stdout.trim() : "";
+    return value ? `ps-lstart-utc-c@1:${value}` : null;
+}
+function parseBirth(value) { return typeof value === "string" && value.startsWith("ps-lstart-utc-c@1:") && value.length > "ps-lstart-utc-c@1:".length ? value : null; }
 function releasePortClaims(db, claims) { for (const claim of claims)
     db.run("DELETE FROM managed_resources WHERE resource_kind = 'port' AND resource_key = ? AND lease_token = ?", [claim.key, claim.token]); }
 function terminateOwnedProcess(record, signal) {
     // Never signal a group merely because its former leader PID was once ours.
     // PID reuse or a departed leader makes group ownership unprovable.
-    if (!record.pid || !record.pid_started_at || processStartedAt(record.pid) !== record.pid_started_at)
+    if (!record.pid || !record.pid_started_at)
         return;
-    const group = parseMetadata(record.metadata_json).process_group_id;
+    const metadata = parseMetadata(record.metadata_json);
+    const birth = parseBirth(metadata.process_birth);
+    if (Object.hasOwn(metadata, "process_birth") ? !birth || stableProcessBirth(record.pid) !== birth : processStartedAt(record.pid) !== record.pid_started_at)
+        return;
+    const group = metadata.process_group_id;
+    // A non-leader PID does not establish ownership of its whole process group.
     try {
-        process.kill(process.platform === "win32" || typeof group !== "number" ? record.pid : -group, signal);
+        process.kill(process.platform === "win32" || group !== record.pid ? record.pid : -group, signal);
     }
     catch { /* inspect again below */ }
 }

package/dist/services/run-control.js

@@ -11,7 +11,7 @@ import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { harnessKey } from "./harness-config.js";
 import { finishManagedProcess, managedLeaseReleased, managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, stopManagedProcess } from "./managed-processes.js";
-import { reconcileUnfinishedChecks } from "./code-checks.js";
+import { reconcileUnfinishedChecks, terminalCheckSettled } from "./code-checks.js";
 import { controlStatusReceipt } from "./run-control-receipt.js";
 import { assertNativeCancellationReceipt, cancelControlledNativeSession, inspectControlledNativeSession } from "./native-session-control.js";
 /** Durable projection only: status never probes a provider or acquires an owner. */
@@ -545,6 +545,12 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             return { process_id: record.id, kind: record.kind, status: "pending", reason: "managed_lease_unsettled" };
         if (!record.pid || !record.pid_started_at)
             return { process_id: record.id, kind: record.kind, status: "pending", reason: "managed_process_identity_unknown" };
+        // Code checks mark their process terminal only after proving its tree is
+        // empty, then publish the exact check receipt. A later PGID reuse cannot
+        // turn that already-settled check back into an owned live process.
+        const check = record.kind === "check" && record.project_id === project.id && record.run_id === input.runId ? terminalCheckSettled(context, record) : null;
+        if (check)
+            return { process_id: record.id, kind: record.kind, status: "completed", receipt: { source: "terminal_check_tree_settled", ...managedProcessBinding(record, home), check_id: record.check_id, finished_at: check.finished_at } };
         if (!interrupt && processTreeIsAlive(record))
             return { process_id: record.id, kind: record.kind, status: "pending", reason: "managed_process_running" };
         if (boundary)

package/dist/services/runtime-scope-stop.js

@@ -1,9 +1,11 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { createContext } from "../runtime/context.js";
 import { AppError } from "../shared/errors.js";
 import { runHarnessAdapter } from "./harness-adapter.js";
-import { managedLeaseReleased, managedProcessBinding, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, stopManagedProcess } from "./managed-processes.js";
+import { managedLeaseReleased, managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, stopManagedProcess } from "./managed-processes.js";
+import { terminalCheckSettled } from "./code-checks.js";
 import { fenceRuntimeBudget, runtimeBudgetStatus, scopeLocalProcessRole } from "./runtime-budget.js";
 import { retainedDaemonOperations } from "./run-control.js";
 import { historicalDaemonSettlement } from "./native-daemon-history.js";
@@ -80,10 +82,29 @@ export async function stopRuntimeScope(context, scopeId, requestId) {
         const metadata = JSON.parse(record.metadata_json);
         // RUN control owns active controllers/checks. Adopt only its already-finished
         // physical registrations here; death alone is not a completed RUN operation.
+        const terminalCheck = record.kind === "check" && metadata.role === "check" && record.check_id && record.project_id && record.run_id
+            ? (() => {
+                const home = managedProcessRuntimeHome(record, context);
+                if (!home)
+                    return null;
+                let reader;
+                try {
+                    reader = createContext({ ...context.env, DD_FLOW_HOME: home }, "read_existing");
+                }
+                catch {
+                    return null;
+                }
+                try {
+                    return terminalCheckSettled(reader, record);
+                }
+                finally {
+                    reader.db.close?.();
+                }
+            })() : null;
         if ((record.kind === "run-controller" && metadata.role === "controller" && record.operation_id
             || record.kind === "check" && metadata.role === "check" && record.check_id)
             && record.project_id && record.run_id && ["stopped", "failed"].includes(record.state)
-            && record.pid && record.pid_started_at && !processTreeIsAlive(record)) {
+            && record.pid && record.pid_started_at && (terminalCheck || !processTreeIsAlive(record))) {
             const operationId = record.operation_id ?? record.check_id;
             nodes.push({ process_id: record.id, state_dir: metadata.state_dir ?? "", settled: true, operation_id: operationId, owner_operation_id: operationId });
             continue;

package/dist/services/vnext-code.js

@@ -582,7 +582,13 @@ export function verificationProjection(works, receipts, options = {}) {
             if (item.obligation_ref)
                 rawEvidence.set(item.obligation_ref, unique([...(rawEvidence.get(item.obligation_ref) ?? []), ...(item.refs ?? [])]));
     }
-    const acceptance = uniqueBy(packets.flatMap((value) => value.acceptance), (value) => value.criterion_id);
+    const byCriterionGate = new Map();
+    for (const entry of packets.flatMap((value) => value.acceptance)) {
+        const key = JSON.stringify([entry.criterion_id, entry.gate]);
+        const previous = byCriterionGate.get(key);
+        byCriterionGate.set(key, { criterion_id: entry.criterion_id, gate: entry.gate, check_refs: unique([...(previous?.check_refs ?? []), ...entry.check_refs]) });
+    }
+    const acceptance = [...byCriterionGate.values()];
     const historicalReceiptRefs = new Set((options.historicalReceipts ?? receipts).flatMap((receipt) => receiptReferences(receipt, options)));
     const acceptanceEvidence = new Map(acceptance.map((item) => {
         const reported = rawEvidence.get(item.criterion_id) ?? [];

package/dist/services/vnext-plan.js

@@ -201,6 +201,7 @@ export function prepareVnextPlanArtifacts(context, input) {
     const batch = path.join(input.home, "03-plan", "code-work-batch.json");
     const ownership = protocolOwnership(input.home, input.protocols);
     const obligations = acceptedObligations(input.home);
+    const mergeEnding = runEndsAtMerge(context, input.projectRoot, input.runId);
     const frozenDocumentBaselines = input.publishBatch === false && fs.existsSync(batch)
         ? new Map(readJson(batch).works?.flatMap((work) => typeof work.key === "string" ? (work.document_updates ?? []).flatMap((update) => typeof update.path === "string" && (typeof update.baseline_sha256 === "string" || update.baseline_sha256 === null)
             ? [[`${work.key}\u0000${update.path}`, update.baseline_sha256]]
@@ -214,7 +215,7 @@ export function prepareVnextPlanArtifacts(context, input) {
         try {
             const { value } = prepareJsonSchema(file, "PLAN", { schemaName: "vnext-protocol-plan", projectRoot: workspaceRoot, ddFlowHome: context.ddFlowHome, runId: input.runId, runRoot: input.home });
             assertPlanIdentity(value, planIdentity(input.home, input.runId, protocolId, ownership.get(protocolId) ?? []), file);
-            validatePlanSemantics(file, value, new Set(ownership.get(protocolId) ?? []), obligations);
+            validatePlanSemantics(file, value, new Set(ownership.get(protocolId) ?? []), obligations, mergeEnding);
             validateCodeCheckCommands(workspaceRoot, value.checks.filter((check) => check.availability === "available").map((check) => check.command));
             for (const check of value.checks.filter((item) => item.availability === "available"))
                 validateCheckDeclaration(workspaceRoot, check);
@@ -481,7 +482,7 @@ function normalizedAspectMapRefs(file, bytes, projectRoot, runHome, runId) {
             aspect.planned_artifact_refs = aspect.planned_artifact_refs.map(normalize);
     return changed ? `${JSON.stringify(map, null, 2)}\n` : bytes;
 }
-function projectCodeWorkBatch(input) {
+export function projectCodeWorkBatch(input) {
     const obligationMap = acceptedObligationMap(input.home);
     const orientation = projectOrientation(input.workspaceRoot);
     const works = input.plans.flatMap(({ protocolId, file, value }) => value.items.map((item) => {
@@ -516,10 +517,9 @@ function projectCodeWorkBatch(input) {
                 ])],
             discovery_boundary: item.execution_context.discovery_boundary,
             planned_write_areas: [...new Set([...item.execution_context.planned_write_areas, ...documentPaths])],
-            // A criterion belongs to every listed Work. Its proof must travel with
-            // those Work packets as well as item-local verification; otherwise CODE
-            // silently loses readiness/code checks declared only by acceptance.
-            checks: value.checks.filter((check) => itemCheckRefs(item, value.acceptance).includes(check.id)),
+            // CODE still needs acceptance-only aggregate declarations in its packets;
+            // work checks belong only to the item that explicitly verifies them.
+            checks: value.checks.filter((check) => itemCheckRefs(item, value.acceptance, value.checks).includes(check.id)),
             provides_checks: value.checks.filter((check) => check.availability === "planned" && check.provided_by === item.id),
             stop_conditions: item.execution_context.stop_conditions,
             depends_on: item.depends_on.map((dependency) => `${protocolId}:${dependency}`),
@@ -548,10 +548,15 @@ function projectCodeWorkBatch(input) {
     const ordered = [...works].sort((a, b) => a.key.localeCompare(b.key));
     return { schema_id: "dd-flow/code-work-batch@5", sources: input.plans.map(({ protocolId, file, value }) => ({ plan_id: value.plan_id, protocol_id: protocolId, revision: value.revision, sha256: checksum(file) })), works: ordered };
 }
-function itemCheckRefs(item, acceptance) {
-    return [...new Set([...item.verification.check_refs, ...acceptance.filter((entry) => entry.plan_item_ids.includes(item.id)).flatMap((entry) => entry.check_refs)])];
+function itemCheckRefs(item, acceptance, catalog) {
+    const aggregate = new Set(catalog.filter((check) => check.run_at !== "work").map((check) => check.id));
+    return [...new Set([...item.verification.check_refs, ...acceptance.filter((entry) => entry.plan_item_ids.includes(item.id)).flatMap((entry) => entry.check_refs.filter((ref) => aggregate.has(ref)))])];
+}
+function renderCodeTask(item, catalog, acceptance = []) {
+    const local = catalog.filter((check) => check.run_at === "work" && item.verification.check_refs.includes(check.id));
+    const aggregate = catalog.filter((check) => check.run_at !== "work" && itemCheckRefs(item, acceptance, catalog).includes(check.id));
+    return [item.title, item.summary, item.details, `Preserve: ${item.semantic_spine.must_preserve.join("; ")}`, `Work checks: ${local.map((check) => `${check.id}:${check.command}`).join("; ")}`, `Later aggregate checks (CODE/MERGE; do not run in this Work): ${aggregate.map((check) => `${check.id}:${check.command}`).join("; ")}`, `Stop: ${item.execution_context.stop_conditions.join("; ")}`].join("\n\n");
 }
-function renderCodeTask(item, catalog, acceptance = []) { const checks = catalog.filter((check) => itemCheckRefs(item, acceptance).includes(check.id)); return [item.title, item.summary, item.details, `Preserve: ${item.semantic_spine.must_preserve.join("; ")}`, `Checks: ${checks.map((check) => `${check.id}:${check.command}`).join("; ")}`, `Stop: ${item.execution_context.stop_conditions.join("; ")}`].join("\n\n"); }
 function validateProjectedPaths(batch, workspaceRoot, home, runId) {
     for (const work of batch.works) {
         for (const write of work.planned_write_areas)
@@ -595,7 +600,7 @@ function resolvePortablePath(value, workspaceRoot, home, runId) {
 }
 function writeJson(file, value) { const temporary = `${file}.${crypto.randomUUID()}.tmp`; fs.writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`); fs.renameSync(temporary, file); }
 function runRef(runId, runHome, file) { return `run://${runId}/${path.relative(runHome, file).split(path.sep).join("/")}`; }
-function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
+function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs, mergeEnding) {
     const items = plan.items ?? [];
     const ids = new Set(items.map((item) => item.id).filter((id) => Boolean(id)));
     if (ids.size !== items.length)
@@ -608,6 +613,8 @@ function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
     for (const check of plan.checks ?? []) {
         if (checks.has(check.id))
             throw new AppError("validation", "PLAN check ids must be unique", 2, { file, check_id: check.id });
+        if (mergeEnding && check.run_at === "release")
+            throw new AppError("check_gate_unreachable", "A RUN ending at MERGE cannot execute RELEASE checks", 2, { file, check_id: check.id });
         if (check.availability === "planned" && (!check.provided_by || !ids.has(check.provided_by)))
             throw new AppError("planned_check_provider_missing", "A planned check must name a PLAN item that provides it", 2, { file, check_id: check.id, provided_by: check.provided_by ?? null });
         if (check.availability === "planned" && !check.command.startsWith("@check/"))
@@ -616,6 +623,8 @@ function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
             throw new AppError("planned_check_definition_missing", "A planned check must declare its exact alias definition", 2, { file, check_id: check.id });
         checks.set(check.id, check);
     }
+    const localChecks = new Set(items.flatMap((item) => item.verification.check_refs));
+    const acceptanceIds = new Set();
     const ancestors = (itemId, seen = new Set()) => {
         for (const dependency of items.find((item) => item.id === itemId)?.depends_on ?? [])
             if (!seen.has(dependency)) {
@@ -639,7 +648,7 @@ function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
             const check = checks.get(checkId);
             if (!check)
                 throw new AppError("check_reference_unknown", "PLAN item references an unknown check", 2, { file, item: item.id, check_id: checkId });
-            if (check.availability === "planned" && check.provided_by !== item.id && !ancestors(item.id).has(check.provided_by))
+            if (check.run_at === "work" && check.availability === "planned" && check.provided_by !== item.id && !ancestors(item.id).has(check.provided_by))
                 throw new AppError("check_consumer_not_ordered_after_provider", "A Work may consume a planned check only after its provider", 2, { file, item: item.id, check_id: checkId, provider: check.provided_by });
         }
     }
@@ -655,6 +664,11 @@ function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
     for (const acceptance of plan.acceptance ?? []) {
         if (!acceptance.criterion_id || !acceptance.criterion_id.startsWith("AC-") || !ownedRefs.has(acceptance.criterion_id))
             throw new AppError("validation", "PLAN acceptance references an AC-* owned by this protocol", 2, { file, criterion_id: acceptance.criterion_id });
+        if (acceptanceIds.has(acceptance.criterion_id))
+            throw new AppError("duplicate_plan_criterion", "PLAN acceptance criterion ids must be unique within a protocol", 2, { file, criterion_id: acceptance.criterion_id });
+        acceptanceIds.add(acceptance.criterion_id);
+        if (mergeEnding && acceptance.gate === "release")
+            throw new AppError("check_gate_unreachable", "A RUN ending at MERGE cannot prove RELEASE acceptance", 2, { file, criterion_id: acceptance.criterion_id });
         for (const id of acceptance.plan_item_ids ?? [])
             if (!ids.has(id))
                 throw new AppError("validation", "PLAN acceptance references an unknown item", 2, { file, criterion_id: acceptance.criterion_id, plan_item_id: id });
@@ -662,9 +676,10 @@ function validatePlanSemantics(file, plan, ownedRefs, acceptedRefs) {
             const check = checks.get(id);
             if (!check)
                 throw new AppError("check_reference_unknown", "PLAN acceptance references an unknown check", 2, { file, criterion_id: acceptance.criterion_id, check_id: id });
-            for (const itemId of acceptance.plan_item_ids ?? [])
-                if (check.availability === "planned" && check.provided_by !== itemId && !ancestors(itemId).has(check.provided_by))
-                    throw new AppError("check_consumer_not_ordered_after_provider", "Acceptance may consume a planned check only after its provider", 2, { file, criterion_id: acceptance.criterion_id, item: itemId, check_id: id, provider: check.provided_by });
+            if ((acceptance.gate !== "release" && check.run_at === "release") || (!["merge", "release"].includes(acceptance.gate) && check.run_at === "merge"))
+                throw new AppError("check_gate_unreachable", "PLAN acceptance references a check after its gate", 2, { file, criterion_id: acceptance.criterion_id, check_id: id, gate: acceptance.gate, run_at: check.run_at });
+            if (check.run_at === "work" && !localChecks.has(id))
+                throw new AppError("work_check_unassigned", "A work check referenced by acceptance needs an explicit verifying PLAN item", 2, { file, criterion_id: acceptance.criterion_id, check_id: id });
         }
     }
     for (const obligation of ownedRefs)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.120",
+  "version": "0.9.0-beta.121",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {