@deksden-com/dd-flow-cli 0.9.0-beta.120 → 0.9.0-beta.122

package/dist/services/lifecycle-invocations.js

@@ -777,7 +777,8 @@ export function issueLifecycleInvocation(context, command, scope) {
 }
 function commandWithInvocationId(command, id) {
     const at = shellSuffixOffset(command);
-    return `${command.slice(0, at).trimEnd()} --invocation-id ${id} ${command.slice(at)}`.trimEnd();
+    const suffix = command.slice(at);
+    return `${command.slice(0, at)} --invocation-id ${id}${suffix ? /^\s/.test(suffix) ? suffix : ` ${suffix}` : ""}`;
 }
 /** The attempt owns authority; the caller owns presentation-only shell input.
  * Preserve current stdin/heredoc/response-file text while validating that it
@@ -909,11 +910,7 @@ export function observeLifecycleInvocation(context, input) {
     storage(context);
     const supplied = input.id ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [input.id]) : undefined;
     const analysis = parseLifecycleCommand(input.command);
-    if (analysis.kind !== "standalone" || analysis.invocation.wrapped) {
-        if (analysis.kind !== "none" && ["grok-acp", "antigravity-cli"].includes(input.harness ?? "") && input.projectId
-            && managedNativeOwner(context, input.identity, input.harness, input.projectId)) {
-            throw new AppError("invocation_command_invalid", "Managed native lifecycle call must be one direct standalone command", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
-        }
+    if (analysis.kind === "none" || analysis.supported === false) {
         const eventKey = input.recordReceipt();
         if (analysis.kind !== "none") {
             const retained = context.db.get("SELECT outcome_json FROM hook_events WHERE event_key = ?", [eventKey]);
@@ -928,22 +925,32 @@ export function observeLifecycleInvocation(context, input) {
                     ...outcome,
                     lifecycle_observation: {
                         code: "lifecycle_shell_syntax_invalid",
-                        reason: analysis.kind === "compound" ? analysis.reason : "wrapped_lifecycle_command",
+                        reason: analysis.kind === "compound" ? analysis.reason : "unsupported_lifecycle_command",
                         command_fingerprint: fingerprint(analysis.invocation),
                         effect: "no_effect",
                         recoverable: true
                     }
                 }), eventKey]);
         }
+        if (analysis.kind !== "none")
+            throw new AppError("lifecycle_shell_syntax_invalid", "This shell form cannot bind exactly one lifecycle execution; use the exact issued lifecycle command without the unsupported shell context", 1, { phase: "prepare", effect: "no_effect", recoverable: true, disposition: "pre_cli_shell_refusal", reason: analysis.kind === "compound" ? analysis.reason : "unsupported_lifecycle_command", event_key: eventKey });
         return { eventKey, duplicate: false, invocationId: null };
     }
-    const candidates = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed') ORDER BY rowid DESC")
+    // Admit the one parsed leaf, never execute or fingerprint the prefix/suffix.
+    const leafCommand = analysis.invocation.command;
+    if (input.executionCwd !== undefined && !path.isAbsolute(input.executionCwd))
+        throw new AppError("invocation_directory_mismatch", "Bound lifecycle execution cwd must be absolute", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+    const deliveredIdentity = JSON.stringify([input.identity.daemonId, input.identity.rootSessionId, input.identity.sessionId, input.identity.parentSessionId, input.identity.toolCallId,
+        ...(input.executionCwd === undefined ? [] : [{ executionCwd: canonicalPath(input.executionCwd) }])]);
+    const candidates = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing','settled') ORDER BY rowid DESC")
         .filter(row => {
+        if (["executing", "settled"].includes(row.status) && row.identity_json !== deliveredIdentity)
+            return false;
         const scope = JSON.parse(row.scope_json);
         if (scope.daemonId !== input.identity.daemonId || scope.rootSessionId !== input.identity.rootSessionId)
             return false;
         try {
-            return fingerprint(invocation(canonicalManagedCommand(context, input.command, scope))) === row.fingerprint;
+            return fingerprint(invocation(canonicalManagedCommand(context, leafCommand, scope))) === row.fingerprint;
         }
         catch {
             return false;
@@ -979,7 +986,7 @@ export function observeLifecycleInvocation(context, input) {
     const project = requireProjectByRoot(context, scope.projectRoot);
     const identity = input.identity;
     checkNativeIdentity(scope, identity, initial.id);
-    const identityJson = JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId]);
+    const identityJson = deliveredIdentity;
     return context.db.writeTransaction(() => {
         const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [initial.id]);
         if (row.status === "settled")
@@ -992,6 +999,9 @@ export function observeLifecycleInvocation(context, input) {
         if (row.identity_json === identityJson) {
             return { eventKey: row.event_key, duplicate: true, ...resolved };
         }
+        if (row.identity_json && JSON.stringify(JSON.parse(row.identity_json).slice(0, 5)) === JSON.stringify(JSON.parse(identityJson).slice(0, 5))) {
+            throw new AppError("invocation_identity_mismatch", "The same native tool call changed its bound execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+        }
         const eventKey = input.recordReceipt({ projectRoot: scope.projectRoot, runId: scope.runId, command: initial.command });
         // A native hook may execute from a provider worktree while the issued
         // lifecycle scope is anchored to the stable project root. Project
@@ -1019,7 +1029,7 @@ export function observedLifecycleNativeEvent(context, command, daemonId) {
         return null;
     const signature = (value) => {
         const parsed = parseLifecycleCommand(value);
-        const candidate = parsed.kind === "standalone" && !parsed.invocation.wrapped ? parsed.invocation : continuationCommand(value);
+        const candidate = parsed.kind !== "none" && parsed.supported ? parsed.invocation : continuationCommand(value);
         if (!candidate)
             return null;
         return JSON.stringify([candidate.operation, candidate.args.positional,
@@ -1080,8 +1090,9 @@ export function observedLifecycleInvocation(context, command, daemonId) {
     if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'"))
         return null;
     const analysis = parseLifecycleCommand(command);
-    if (analysis.kind !== "standalone" || analysis.invocation.wrapped)
+    if (analysis.kind === "none" || analysis.supported === false)
         return null;
+    const leafCommand = analysis.invocation.command;
     // `issued` is a rendezvous, not authority: the CLI still blocks in
     // awaitLifecycleInvocation until the native observer commits the receipt.
     const matches = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing') ORDER BY rowid DESC")
@@ -1090,7 +1101,7 @@ export function observedLifecycleInvocation(context, command, daemonId) {
             const scope = JSON.parse(row.scope_json);
             if (daemonId && scope.daemonId !== daemonId)
                 return false;
-            return fingerprint(invocation(canonicalManagedCommand(context, command, scope))) === row.fingerprint;
+            return fingerprint(invocation(canonicalManagedCommand(context, leafCommand, scope))) === row.fingerprint;
         }
         catch {
             return false;
@@ -1348,6 +1359,16 @@ export async function awaitLifecycleInvocation(context, input) {
         }
         input.assertCurrent(JSON.parse(row.scope_json));
         if (row.status === "observed") {
+            if (row.identity_json) {
+                // Receipt display text is bounded/redacted and may not be valid JSON.
+                // Only the native admission's typed identity binds an execution route.
+                const identity = JSON.parse(row.identity_json);
+                const route = identity[5]?.executionCwd;
+                if (identity.length > 5 && (typeof route !== "string" || !path.isAbsolute(route)))
+                    throw new AppError("invocation_directory_mismatch", "Bound lifecycle execution cwd is invalid", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+                if (typeof route === "string" && canonicalPath(process.cwd()) !== canonicalPath(route))
+                    throw new AppError("invocation_directory_mismatch", "Reached CLI cwd differs from the bound shell execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false, expected: route, actual: process.cwd(), actual_provenance: "cli_process_cwd" });
+            }
             const claimed = context.db.run("UPDATE lifecycle_invocations SET status = 'executing', updated_at = ? WHERE id = ? AND status = 'observed'", [context.now(), input.id]);
             if (claimed.changes === 1)
                 return { eventKey: row.event_key, replay: false };

package/dist/services/managed-processes.js

@@ -61,7 +61,12 @@ export function prepareManagedProcessRegistration(context, input) {
         throw new AppError("validation", "Unique managed operation requires operationId", 2);
     let metadataJson;
     try {
-        metadataJson = JSON.stringify({ ...input.metadata, dd_flow_home: context.ddFlowHome, ...(input.ownerPid ? { owner_pid: input.ownerPid, owner_pid_started_at: processStartedAt(input.ownerPid) } : {}) });
+        const metadata = { ...input.metadata, dd_flow_home: context.ddFlowHome, ...(input.ownerPid ? { owner_pid: input.ownerPid, owner_pid_started_at: processStartedAt(input.ownerPid) } : {}) };
+        delete metadata.process_birth;
+        delete metadata.owner_birth;
+        if (input.ownerPid)
+            metadata.owner_birth = stableProcessBirth(input.ownerPid);
+        metadataJson = JSON.stringify(metadata);
     }
     catch {
         throw new AppError("validation", "metadata must be JSON-serializable", 2);
@@ -86,7 +91,8 @@ export function registerManagedProcess(context, rawInput) {
     if (!input.uniqueActiveOperation)
         return insertManagedProcess(context, input, metadataJson);
     const db = registry(context);
-    if (observer && !processIsAlive({ pid: input.pid, pid_started_at: observerBirth }))
+    const observerProcessBirth = observer ? stableProcessBirth(input.pid) : null;
+    if (observer && !processIsAlive({ pid: input.pid, pid_started_at: observerBirth, metadata_json: JSON.stringify({ process_birth: observerProcessBirth }) }))
         throw new AppError("process_ownership_unknown", "EVAL observer changed before registration", 1);
     return db.writeTransaction(() => {
         const existing = db.get("SELECT * FROM managed_processes WHERE operation_id = ? AND state IN ('starting','running','stopping','orphaned')", [input.operationId]);
@@ -97,6 +103,7 @@ export function registerManagedProcess(context, rawInput) {
             const metadata = JSON.parse(metadataJson);
             if (input.processGroupId)
                 metadata.process_group_id = input.processGroupId;
+            metadata.process_birth = observerProcessBirth;
             const now = context.now();
             db.run("UPDATE managed_processes SET pid = ?, pid_started_at = ?, state = 'running', lease_expires_at = ?, updated_at = ?, metadata_json = ? WHERE id = ? AND lease_token = ? AND state = 'starting'", [input.pid, observerBirth, leaseExpiry(now, input.leaseMs), now, JSON.stringify(metadata), result.id, result.lease_token]);
             result = requireProcess(db, result.id);
@@ -137,9 +144,11 @@ export function confirmManagedProcess(context, input) {
     const metadata = parseMetadata(current.metadata_json);
     if (input.processGroupId)
         metadata.process_group_id = input.processGroupId;
+    metadata.process_birth = stableProcessBirth(input.pid);
     if (input.ownerPid) {
         metadata.owner_pid = input.ownerPid;
         metadata.owner_pid_started_at = processStartedAt(input.ownerPid);
+        metadata.owner_birth = stableProcessBirth(input.ownerPid);
     }
     const result = db.run(`UPDATE managed_processes
      SET pid = ?, pid_started_at = ?, state = 'running', lease_expires_at = ?, updated_at = ?, metadata_json = ?
@@ -216,6 +225,11 @@ export function processIsAlive(record) {
     catch (error) {
         return error.code !== "ESRCH";
     }
+    const metadata = record.metadata_json ? parseMetadata(record.metadata_json) : {};
+    if (Object.hasOwn(metadata, "process_birth")) {
+        const birth = parseBirth(metadata.process_birth), observed = stableProcessBirth(record.pid);
+        return !birth || !observed || observed === birth;
+    }
     const started = processStartedAt(record.pid);
     return !record.pid_started_at || !started || record.pid_started_at === started;
 }
@@ -223,6 +237,17 @@ export function processTreeIsAlive(record) {
     if (processIsAlive(record))
         return true;
     const group = parseMetadata(record.metadata_json).process_group_id;
+    const birth = parseBirth(parseMetadata(record.metadata_json).process_birth);
+    // POSIX cannot reuse a leader PID while its old process group survives.
+    if (process.platform !== "win32" && group === record.pid && record.pid && birth) {
+        try {
+            process.kill(record.pid, 0);
+        }
+        catch { /* A missing leader can still have living children. */ }
+        const observed = stableProcessBirth(record.pid);
+        if (observed && observed !== birth)
+            return false;
+    }
     if (process.platform !== "win32" && typeof group === "number") {
         try {
             process.kill(-group, 0);
@@ -238,7 +263,7 @@ export function managedOwnerIsAlive(record) {
     const metadata = parseMetadata(record.metadata_json);
     if (typeof metadata.owner_pid !== "number")
         return null;
-    return processIsAlive({ pid: metadata.owner_pid, pid_started_at: typeof metadata.owner_pid_started_at === "string" ? metadata.owner_pid_started_at : null });
+    return processIsAlive({ pid: metadata.owner_pid, pid_started_at: typeof metadata.owner_pid_started_at === "string" ? metadata.owner_pid_started_at : null, metadata_json: JSON.stringify({ process_birth: metadata.owner_birth }) });
 }
 /**
  * Expiry proves that observation stopped, not that the owner died.  A live PID
@@ -413,16 +438,27 @@ function leaseExpiry(now, leaseMs = defaultLeaseMs) {
     return new Date(Date.parse(now) + leaseMs).toISOString();
 }
 export function processStartedAt(pid) { const result = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8", timeout: 1_000 }); const value = result.status === 0 ? result.stdout.trim() : ""; return value || null; }
+function stableProcessBirth(pid) {
+    const result = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8", timeout: 1_000, env: { ...process.env, TZ: "UTC", LC_ALL: "C" } });
+    const value = result.status === 0 ? result.stdout.trim() : "";
+    return value ? `ps-lstart-utc-c@1:${value}` : null;
+}
+function parseBirth(value) { return typeof value === "string" && value.startsWith("ps-lstart-utc-c@1:") && value.length > "ps-lstart-utc-c@1:".length ? value : null; }
 function releasePortClaims(db, claims) { for (const claim of claims)
     db.run("DELETE FROM managed_resources WHERE resource_kind = 'port' AND resource_key = ? AND lease_token = ?", [claim.key, claim.token]); }
 function terminateOwnedProcess(record, signal) {
     // Never signal a group merely because its former leader PID was once ours.
     // PID reuse or a departed leader makes group ownership unprovable.
-    if (!record.pid || !record.pid_started_at || processStartedAt(record.pid) !== record.pid_started_at)
+    if (!record.pid || !record.pid_started_at)
         return;
-    const group = parseMetadata(record.metadata_json).process_group_id;
+    const metadata = parseMetadata(record.metadata_json);
+    const birth = parseBirth(metadata.process_birth);
+    if (Object.hasOwn(metadata, "process_birth") ? !birth || stableProcessBirth(record.pid) !== birth : processStartedAt(record.pid) !== record.pid_started_at)
+        return;
+    const group = metadata.process_group_id;
+    // A non-leader PID does not establish ownership of its whole process group.
     try {
-        process.kill(process.platform === "win32" || typeof group !== "number" ? record.pid : -group, signal);
+        process.kill(process.platform === "win32" || group !== record.pid ? record.pid : -group, signal);
     }
     catch { /* inspect again below */ }
 }

package/dist/services/run-control.js

@@ -11,7 +11,7 @@ import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { harnessKey } from "./harness-config.js";
 import { finishManagedProcess, managedLeaseReleased, managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, stopManagedProcess } from "./managed-processes.js";
-import { reconcileUnfinishedChecks } from "./code-checks.js";
+import { reconcileUnfinishedChecks, terminalCheckSettled } from "./code-checks.js";
 import { controlStatusReceipt } from "./run-control-receipt.js";
 import { assertNativeCancellationReceipt, cancelControlledNativeSession, inspectControlledNativeSession } from "./native-session-control.js";
 /** Durable projection only: status never probes a provider or acquires an owner. */
@@ -545,6 +545,12 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             return { process_id: record.id, kind: record.kind, status: "pending", reason: "managed_lease_unsettled" };
         if (!record.pid || !record.pid_started_at)
             return { process_id: record.id, kind: record.kind, status: "pending", reason: "managed_process_identity_unknown" };
+        // Code checks mark their process terminal only after proving its tree is
+        // empty, then publish the exact check receipt. A later PGID reuse cannot
+        // turn that already-settled check back into an owned live process.
+        const check = record.kind === "check" && record.project_id === project.id && record.run_id === input.runId ? terminalCheckSettled(context, record) : null;
+        if (check)
+            return { process_id: record.id, kind: record.kind, status: "completed", receipt: { source: "terminal_check_tree_settled", ...managedProcessBinding(record, home), check_id: record.check_id, finished_at: check.finished_at } };
         if (!interrupt && processTreeIsAlive(record))
             return { process_id: record.id, kind: record.kind, status: "pending", reason: "managed_process_running" };
         if (boundary)

package/dist/services/runs.js

@@ -85,6 +85,7 @@ export function startFlowRun(context, input, prepared = prepareFlowRunStart(cont
         run_id: runId,
         short_id: shortId,
         flow_kind: flowKind,
+        ...(["vnext_specify", "vnext_protocolize"].includes(flowKind) ? { verification_matrix_contract: "dd-flow/verification-matrix@1" } : {}),
         subject: {
             id: subjectId,
             title: subjectId
@@ -554,63 +555,75 @@ export function listFlowRuns(context, input) {
         .map(flowRunSummary);
     return { ok: true, project, runs };
 }
-export function prepareFlowRunStageAttachment(context, input) {
+export function prepareFlowRunStageAttachment(context, input, archive = false) {
     const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
     const run = resolveRun(context, project.id, input.runId);
-    assertRunMutationAllowed(context, project.id, run.id);
+    const generation = assertRunMutationAllowed(context, project.id, run.id);
     const stage = requiredPlain(input.stage, "stage");
     const dir = prepareStageDirectory(input.dir);
     const index = authoritativeIndex(run);
     const status = parseStageStatus(input.status);
     const existing = index.stage_runs.find((item) => item.stage === stage);
     assertVnextStageStart(run, index, stage, status, existing);
-    return { project, run, index, stage, dir, status, existing };
-}
-export function attachFlowRunStage(context, input) {
-    // Mutable stage state is re-read immediately before archiving/persisting.
-    const { project, run, index, stage, dir, status, existing } = prepareFlowRunStageAttachment(context, input);
-    const runRoot = runArtifactRoot(run);
-    if (fs.existsSync(path.join(runRoot, `.archive-${dir}.json`)))
-        archiveExistingStageAttempt(context, project.id, run.id, runRoot, dir);
-    const now = context.now();
-    if (status === "running" && existing) {
-        archiveExistingStageAttempt(context, project.id, run.id, runRoot, dir);
-    }
-    const stageRun = {
-        ...(existing ?? { order: index.stage_runs.length + 1 }),
-        stage,
-        dir,
-        status,
-        ...(input.inputSha256 ? { input_sha256: input.inputSha256 } : {}),
-        ...(input.dataSchemaId ? { data_schema_id: input.dataSchemaId } : existing?.data_schema_id ? { data_schema_id: existing.data_schema_id } : {}),
-        updated_at: now
-    };
-    if (status === "running") {
-        stageRun.started_at = now;
-        delete stageRun.completed_at;
-        stageRun.duration_ms = null;
-        stageRun.git = gitFacts(run.workspace_root);
-        stageRun.attempt = nextAttempt(existing);
+    if (archive) {
+        const runRoot = runArtifactRoot(run);
+        if (fs.existsSync(path.join(runRoot, `.archive-${dir}.json`)) || status === "running" && existing) {
+            archiveExistingStageAttempt(context, project.id, run.id, runRoot, dir);
+        }
     }
-    upsertStage(index, stageRun);
-    index.current_stage = stage;
-    index.attempts = index.stage_runs.map((item) => ({ stage: item.stage, attempt_number: Number((item.attempt ?? "try-001").replace("try-", "")) || 1, root: item.dir, archive: null, status: item.status, started_at: item.started_at ?? now, finished_at: item.completed_at ?? null }));
-    index.updated_at = now;
-    persistRunState(context, project, run, index);
-    appendAudit(context, {
-        projectId: project.id,
-        eventType: "flow_run.stage_attached",
-        payload: { run_id: run.id, stage, dir, status }
-    });
-    appendRunTimeline(context, project.id, run.id, { at: now, type: "stage_attached", run_id: run.id, stage, status, attempt: stageRun.attempt ?? null });
-    context.db.afterCommit(() => reconcileRunStageReports(context, project.id, run.id, stage));
-    // A stage transition must not rewrite every Session in the RUN.  A RUN may
-    // contain independent reviewer/worker sessions; their stage is set by the
-    // stage/work binding that actually owns that Session.
-    if (status === "running")
-        refreshRunSessionProjection(context, project.id, run.id);
+    return { project, run, index, stage, dir, status, existing, generation, attempt: status === "running" ? nextAttempt(existing) : existing?.attempt ?? "try-001", git: status === "running" ? gitFacts(run.workspace_root) : undefined };
+}
+export function attachFlowRunStage(context, input, prepared = prepareFlowRunStageAttachment(context, input, true)) {
+    // Filesystem archive and Git inspection are preparation, never writer work.
+    const { project, run, stage, dir, status, generation, git } = prepared;
+    const attached = context.db.writeTransaction(() => {
+        assertRunMutationAllowed(context, project.id, run.id, generation);
+        const latest = requireRunById(context, project.id, run.id);
+        const index = authoritativeIndex(latest);
+        const existing = index.stage_runs.find((item) => item.stage === stage);
+        if ((index.runtime_revision ?? 0) !== (prepared.index.runtime_revision ?? 0) || existing?.attempt !== prepared.existing?.attempt) {
+            throw new AppError("stage_revision_changed", "Stage changed during start preparation", 1, { run_id: run.id, stage });
+        }
+        assertVnextStageStart(latest, index, stage, status, existing);
+        const now = context.now();
+        const stageRun = {
+            ...(existing ?? { order: index.stage_runs.length + 1 }),
+            stage,
+            dir,
+            status,
+            ...(input.inputSha256 ? { input_sha256: input.inputSha256 } : {}),
+            ...(input.dataSchemaId ? { data_schema_id: input.dataSchemaId } : existing?.data_schema_id ? { data_schema_id: existing.data_schema_id } : {}),
+            updated_at: now
+        };
+        if (status === "running") {
+            stageRun.started_at = now;
+            delete stageRun.completed_at;
+            stageRun.duration_ms = null;
+            if (git)
+                stageRun.git = git;
+            stageRun.attempt = prepared.attempt;
+        }
+        upsertStage(index, stageRun);
+        index.current_stage = stage;
+        index.attempts = index.stage_runs.map((item) => ({ stage: item.stage, attempt_number: Number((item.attempt ?? "try-001").replace("try-", "")) || 1, root: item.dir, archive: null, status: item.status, started_at: item.started_at ?? now, finished_at: item.completed_at ?? null }));
+        index.updated_at = now;
+        persistRunState(context, project, run, index);
+        appendAudit(context, {
+            projectId: project.id,
+            eventType: "flow_run.stage_attached",
+            payload: { run_id: run.id, stage, dir, status }
+        });
+        appendRunTimeline(context, project.id, run.id, { at: now, type: "stage_attached", run_id: run.id, stage, status, attempt: stageRun.attempt ?? null });
+        context.db.afterCommit(() => reconcileRunStageReports(context, project.id, run.id, stage));
+        // A stage transition must not rewrite every Session in the RUN.  A RUN may
+        // contain independent reviewer/worker sessions; their stage is set by the
+        // stage/work binding that actually owns that Session.
+        if (status === "running")
+            context.db.afterCommit(() => refreshRunSessionProjection(context, project.id, run.id));
+        return { stageRun, index };
+    }, "stage.attach");
     const updatedRun = requireRunById(context, project.id, run.id);
-    return { ok: true, run: flowRunSummary(updatedRun), stage_run: stageRun, index, flow_guidance: guidanceForRun(context, updatedRun, index) };
+    return { ok: true, run: flowRunSummary(updatedRun), stage_run: attached.stageRun, index: attached.index, flow_guidance: guidanceForRun(context, updatedRun, attached.index) };
 }
 /** Keep synchronous stage settlement atomic; files are projections, SQLite is authoritative. */
 export function withStageSettlement(context, operation) {

package/dist/services/runtime-scope-stop.js

@@ -1,9 +1,11 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { createContext } from "../runtime/context.js";
 import { AppError } from "../shared/errors.js";
 import { runHarnessAdapter } from "./harness-adapter.js";
-import { managedLeaseReleased, managedProcessBinding, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, stopManagedProcess } from "./managed-processes.js";
+import { managedLeaseReleased, managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, stopManagedProcess } from "./managed-processes.js";
+import { terminalCheckSettled } from "./code-checks.js";
 import { fenceRuntimeBudget, runtimeBudgetStatus, scopeLocalProcessRole } from "./runtime-budget.js";
 import { retainedDaemonOperations } from "./run-control.js";
 import { historicalDaemonSettlement } from "./native-daemon-history.js";
@@ -80,10 +82,29 @@ export async function stopRuntimeScope(context, scopeId, requestId) {
         const metadata = JSON.parse(record.metadata_json);
         // RUN control owns active controllers/checks. Adopt only its already-finished
         // physical registrations here; death alone is not a completed RUN operation.
+        const terminalCheck = record.kind === "check" && metadata.role === "check" && record.check_id && record.project_id && record.run_id
+            ? (() => {
+                const home = managedProcessRuntimeHome(record, context);
+                if (!home)
+                    return null;
+                let reader;
+                try {
+                    reader = createContext({ ...context.env, DD_FLOW_HOME: home }, "read_existing");
+                }
+                catch {
+                    return null;
+                }
+                try {
+                    return terminalCheckSettled(reader, record);
+                }
+                finally {
+                    reader.db.close?.();
+                }
+            })() : null;
         if ((record.kind === "run-controller" && metadata.role === "controller" && record.operation_id
             || record.kind === "check" && metadata.role === "check" && record.check_id)
             && record.project_id && record.run_id && ["stopped", "failed"].includes(record.state)
-            && record.pid && record.pid_started_at && !processTreeIsAlive(record)) {
+            && record.pid && record.pid_started_at && (terminalCheck || !processTreeIsAlive(record))) {
             const operationId = record.operation_id ?? record.check_id;
             nodes.push({ process_id: record.id, state_dir: metadata.state_dir ?? "", settled: true, operation_id: operationId, owner_operation_id: operationId });
             continue;

package/dist/services/stage-report-renderer.js

@@ -39,8 +39,10 @@ export function acceptStagePacket(context, input) {
     context.db.afterCommit(() => publishStagePacket(context, input.projectId, input.runId, input.stage, input.prepared.file));
 }
 export function publishStagePacket(context, projectId, runId, stage, file) {
+    assertPublicationPath(context, projectId, runId, file);
     fs.mkdirSync(path.dirname(file), { recursive: true });
     withProjectionLock(`${file}.publish-lock`, () => {
+        assertPublicationPath(context, projectId, runId, file);
         const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
         const index = run ? JSON.parse(run.index_json) : null;
         const currentAttempt = index?.stage_runs?.find((item) => item.stage === stage)?.attempt;
@@ -76,7 +78,9 @@ export function acceptStageReport(context, input) {
 }
 /** Replays the latest committed receipt, never an obsolete attempt. */
 export function publishStageReport(context, projectId, runId, stage, root) {
+    assertPublicationPath(context, projectId, runId, root);
     withProjectionLock(`${root}.report-publish-lock`, () => {
+        assertPublicationPath(context, projectId, runId, root);
         const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
         const index = run ? JSON.parse(run.index_json) : null;
         const currentAttempt = index?.stage_runs?.find((item) => item.stage === stage)?.attempt;
@@ -87,6 +91,7 @@ export function publishStageReport(context, projectId, runId, stage, root) {
         fs.mkdirSync(root, { recursive: true });
         for (const [name, bytes] of Object.entries(receipt.bytes)) {
             const file = path.join(root, `stage-report.${name === "json" ? "json" : name === "markdown" ? "md" : "html"}`);
+            assertPublicationPath(context, projectId, runId, file);
             try {
                 fs.writeFileSync(file, bytes, { flag: "wx" });
             }
@@ -99,6 +104,20 @@ export function publishStageReport(context, projectId, runId, stage, root) {
         }
     });
 }
+/** Recheck the actual destination after preparation: a missing leaf may have
+ * an existing symlink ancestor, and retained packet bytes never authorize it. */
+function assertPublicationPath(context, projectId, runId, file) {
+    const run = context.db.get("SELECT run_root FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+    const root = run?.run_root && path.resolve(run.run_root), destination = path.resolve(file);
+    if (!root || !destination.startsWith(`${root}${path.sep}`))
+        throw new AppError("publication_pending", "Stage publication escaped its RUN", 1, { effect: "committed", run_id: runId, file });
+    let ancestor = destination;
+    while (!fs.existsSync(ancestor) && ancestor !== root)
+        ancestor = path.dirname(ancestor);
+    const actual = fs.realpathSync(ancestor), realRoot = fs.realpathSync(root);
+    if (actual !== realRoot && !actual.startsWith(`${realRoot}${path.sep}`))
+        throw new AppError("publication_pending", "Stage publication escaped its RUN through a symlink", 1, { effect: "committed", run_id: runId, file });
+}
 /** Admission repair for predecessor reports; the stage being retried is archived separately. */
 export function reconcileRunStageReports(context, projectId, runId, exceptStage) {
     const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id = ? AND event_type = 'flow_run.stage_report' ORDER BY id DESC", [projectId]);