@deksden-com/dd-flow-cli 0.9.0-beta.123 → 0.9.0-beta.127

package/dist/services/lifecycle-invocations.js

@@ -8,9 +8,9 @@ import { shortEntityReference } from "../shared/entity-references.js";
 import { resolveWorkReference } from "../storage/work-references.js";
 import { commandOption, commandPosition, continuationCommand, lifecycleCommandFromPayload, parseLifecycleCommand, shellSuffixOffset } from "./lifecycle-command.js";
 import { requireProjectByRoot } from "./projects.js";
-import { assertRunMutationAllowed, assertStageSettlementAllowed, assertWorkSettlementAllowed, recoveryGuard } from "./run-recovery.js";
+import { assertRunMutationAllowed, assertStageSettlementAllowed, assertWorkSettlementAllowed, recoveryGuard, recoveryPacketReceipt } from "./run-recovery.js";
 import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
-import { managedProcessStatus } from "./managed-processes.js";
+import { managedProcessStatus, processIsAlive } from "./managed-processes.js";
 import { appendEvent } from "./run-controller-state.js";
 import { recoverCommittedWorkStart } from "./work-registry.js";
 import { observeCommandHook } from "./hooks.js";
@@ -205,6 +205,7 @@ function withoutInvocationId(command, aliases) {
     return `${prefix ? `${prefix} ` : ""}${executable}${argv.length ? ` ${quoteModelFacingArgs(argv)}` : ""}${suffix ? ` ${suffix}` : ""}`.trim();
 }
 function publicInvocationCommand(context, row, command) {
+    assertPrivateStageStartContract(row, command);
     if (!commandOption(invocation(command), "project-root"))
         command = retainedCommandWithoutInvocationId(row);
     const rendered = renderInvocationCommand(row, command);
@@ -213,6 +214,24 @@ function publicInvocationCommand(context, row, command) {
     context.captureLifecycleAssignment?.(row.id);
     return withoutInvocationId(rendered, { project: scope.projectRoot, ...(run?.workspace_root ? { workspace: run.workspace_root } : {}), ...(run?.run_root ? { run: run.run_root } : {}) });
 }
+/** Public fingerprints recognize a command; they do not replace its private
+ * controller contract when an issuer renders the same public operation. */
+function assertPrivateStageStartContract(row, command) {
+    const actual = invocation(command), retained = invocation(row.command);
+    if (actual.operation !== "stage_start")
+        return;
+    const lifecycleAssignment = { issuer: "dd-flow", phase: "issuance", scope: JSON.parse(row.scope_json) };
+    if (commandPosition(actual, 0) !== commandPosition(retained, 0))
+        throw new AppError("invocation_argument_mismatch", "Retained Stage entry has a different RUN target", 1, { invocation_id: row.id, phase: "prepare", effect: "no_effect", recoverable: false, lifecycle_assignment: lifecycleAssignment });
+    for (const key of ["context-file", "context-sha256", "response-file", "require-session-binding"]) {
+        const supplied = commandOption(actual, key), expected = commandOption(retained, key);
+        const normalized = (value) => ["context-file", "response-file"].includes(key) && path.isAbsolute(value) ? path.normalize(value) : normalizedInvocationValue(key, value);
+        if ((supplied === undefined) !== (expected === undefined)
+            || supplied !== undefined && normalized(supplied) !== normalized(expected)) {
+            throw new AppError("invocation_argument_mismatch", `Retained Stage entry has a different --${key} contract`, 1, { invocation_id: row.id, parameter: key, phase: "prepare", effect: "no_effect", recoverable: false, lifecycle_assignment: lifecycleAssignment });
+        }
+    }
+}
 /** Bind issued commands to the exact bytes sent to the model, not to an
  * internal marker which is intentionally absent from that prompt. */
 export function bindLifecyclePacketAssignments(context, prompt, ids) {
@@ -479,6 +498,14 @@ export function observeLifecycleCommand(context, command, nativeEvent) {
             }
             throw persistence;
         }
+        // Serializers intentionally clone JSON-safe diagnostics. These response
+        // fields are the deliberate API overlay on the original rejection, only
+        // after its exact durable hook outcome has committed.
+        if (outcome.error && error)
+            for (const field of ["hook_retry_signature", "retry_command", "retry_instruction", "recoverable", "repeated_without_progress"]) {
+                if (Object.prototype.hasOwnProperty.call(error.details, field))
+                    outcome.error.details[field] = error.details[field];
+            }
     };
 }
 function lifecycleDiagnostics(context, projectId, runId, generation) {
@@ -509,7 +536,7 @@ export function lifecycleRetryCommands(context, stage) {
 }
 export function managedInvocationContext(context, input) {
     const env = { ...context.env, DD_FLOW_CURRENT_INVOCATION: undefined, DD_FLOW_INVOCATION_SCOPE: undefined };
-    if (!["zcode-acp", "codex-desktop", "grok-acp", "antigravity-cli"].includes(input.harness))
+    if (!["zcode-acp", "codex-desktop", "grok-acp", "antigravity-cli", "droid-cli", "opencode-server"].includes(input.harness))
         return { ...context, env };
     const project = requireProjectByRoot(context, input.projectRoot);
     const { state, process: daemon } = requireManagedDaemonBinding(context, { stateDir: input.stateDir, projectId: project.id, runId: input.runId });
@@ -547,6 +574,7 @@ export function managedLifecycleCommand(context, command, options = {}) {
         if (retained.scope_json !== JSON.stringify(scope)) {
             throw new AppError("invocation_scope_mismatch", "Lifecycle attempt belongs to another managed scope", 1, { invocation_id: suppliedId });
         }
+        assertPrivateStageStartContract(retained, command);
         checkCommand(retained, command);
         assertRenderableInvocation(retained);
         return publicInvocationCommand(context, retained, command);
@@ -742,12 +770,24 @@ export function assertLifecycleInvocationCurrent(context, scope, command) {
 }
 function checkCommand(row, command) {
     const parsed = invocation(command);
+    assertSuppliedLifecycleTarget(row, parsed);
     const scope = JSON.parse(row.scope_json);
     if (commandOption(parsed, "invocation-id") !== row.id || fingerprint(parsed) !== row.fingerprint
         || path.resolve(commandOption(parsed, "project-root") ?? "") !== scope.projectRoot) {
         throw new AppError("invocation_command_mismatch", "Lifecycle attempt belongs to another command or project", 1, { invocation_id: row.id });
     }
 }
+/** Public commands may omit the coordinator RUN. A supplied target remains
+ * input to validate, not text to silently overwrite with retained authority. */
+function assertSuppliedLifecycleTarget(row, actual) {
+    if (!["stage_start", "stage_finish", "recovery_accept"].includes(actual.operation) || actual.args.options.has("bootstrap"))
+        return;
+    const supplied = commandPosition(actual, 0), expected = commandPosition(invocation(row.command), 0);
+    if (supplied === undefined)
+        return;
+    if (!expected || ![expected, shortEntityReference(expected)].includes(supplied))
+        throw new AppError("invocation_argument_mismatch", "Supplied RUN target differs from its retained lifecycle assignment", 2, { invocation_id: row.id, parameter: "run", phase: "prepare", effect: "no_effect", recoverable: true });
+}
 /** Explicit issuance; callers retain this command. Read-only show/status must
  * return that retained value, not issue a replacement on every observation. */
 export function prepareLifecycleIssuance(command, value) {
@@ -770,7 +810,7 @@ export function issueLifecycleInvocation(context, command, scope) {
     const id = crypto.randomUUID();
     const prepared = commandWithInvocationId(command, id);
     // Validate the actual inserted argv, including quoted heredoc boundaries.
-    const row = { id, scope_json: JSON.stringify(scope), fingerprint: fingerprint(parsed) };
+    const row = { id, command: prepared, scope_json: JSON.stringify(scope), fingerprint: fingerprint(parsed) };
     checkCommand(row, prepared);
     context.db.run("INSERT INTO lifecycle_invocations (id, scope_json, command, fingerprint, status, created_at, updated_at) VALUES (?, ?, ?, ?, 'issued', ?, ?)", [id, row.scope_json, prepared, row.fingerprint, context.now(), context.now()]);
     return { id, command: prepared };
@@ -810,19 +850,32 @@ function checkNativeIdentity(scope, identity, id) {
     }
 }
 function managedNativeOwner(context, identity, harness, projectId) {
+    const nativeRoot = (stateDir, sessionId) => {
+        try {
+            const state = readNativeDaemonState(stateDir);
+            if (state.daemon_id !== identity.daemonId)
+                return null;
+            const native = state.sessions?.find(native => typeof native === "string" ? native === sessionId : native.adapter_session_id === sessionId || native.provider_session_id === sessionId);
+            return typeof native === "string" ? native : native?.root_provider_session_id ?? native?.provider_session_id ?? null;
+        }
+        catch {
+            return null;
+        }
+    };
     const owners = [];
     const hasTable = (name) => Boolean(context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?", [name]));
     if (hasTable("run_controllers")) {
-        const controllers = context.db.all("SELECT c.run_id, r.status AS run_status, c.status, c.generation, c.state_json FROM run_controllers c JOIN runs r ON r.project_id = c.project_id AND r.id = c.run_id WHERE c.project_id = ?", [projectId]);
+        const controllers = context.db.all("SELECT c.controller_id, c.run_id, r.status AS run_status, c.status, c.generation, c.state_json FROM run_controllers c JOIN runs r ON r.project_id = c.project_id AND r.id = c.run_id WHERE c.project_id = ?", [projectId]);
         for (const controller of controllers) {
-            if (!controller.state_json.includes(identity.rootSessionId))
-                continue;
             const state = JSON.parse(controller.state_json);
             for (const [index, session] of (state.sessions ?? []).entries()) {
-                if (session.id !== identity.rootSessionId)
+                if (typeof session.state_dir !== "string")
+                    continue;
+                const root = nativeRoot(session.state_dir, session.id);
+                if (root !== identity.rootSessionId)
                     continue;
                 owners.push({ runId: controller.run_id, rootSessionId: session.id,
-                    stateDir: session.state_dir, harness: runtimeHarness(session.profile), generation: controller.generation,
+                    stateDir: session.state_dir, harness: runtimeHarness(session.profile), generation: controller.generation, ownerId: controller.controller_id,
                     active: ["running", "paused", "waiting_for_user", "blocked"].includes(controller.run_status)
                         && !["completed", "cancelled", "superseded"].includes(controller.status)
                         && state.current_session === index && session.stopped !== true });
@@ -830,8 +883,10 @@ function managedNativeOwner(context, identity, harness, projectId) {
         }
     }
     if (hasTable("work_launches")) {
-        const launches = context.db.all("SELECT w.run_id, r.status AS run_status, l.work_id, l.operation_id, l.status, l.state_dir, l.provider_session_id, l.profile_json FROM work_launches l JOIN works w ON w.work_id = l.work_id JOIN runs r ON r.project_id = w.project_id AND r.id = w.run_id WHERE w.project_id = ? AND l.provider_session_id = ?", [projectId, identity.rootSessionId]);
+        const launches = context.db.all("SELECT w.run_id, r.status AS run_status, l.work_id, l.operation_id, l.status, l.state_dir, l.provider_session_id, l.profile_json FROM work_launches l JOIN works w ON w.work_id = l.work_id JOIN runs r ON r.project_id = w.project_id AND r.id = w.run_id WHERE w.project_id = ?", [projectId]);
         for (const launch of launches) {
+            if (nativeRoot(launch.state_dir, launch.provider_session_id) !== identity.rootSessionId)
+                continue;
             // Cooperative pause/drain may retain an admitted Work settlement while
             // the RUN is paused; only terminal RUN states retire its native root.
             const active = ["running", "paused", "waiting_for_user", "blocked"].includes(launch.run_status)
@@ -849,8 +904,11 @@ function managedNativeOwner(context, identity, harness, projectId) {
         }
     }
     if (hasTable("merge_requests")) {
-        const requests = context.db.all("SELECT m.merge_request_id, m.run_id, r.status AS run_status, m.status, m.executor_work_id, m.dispatch_owner, m.dispatch_lease_token, m.adapter_receipt_json FROM merge_requests m JOIN runs r ON r.project_id = m.project_id AND r.id = m.run_id WHERE m.project_id = ? AND m.execution_route = 'server' AND CASE WHEN json_valid(m.adapter_receipt_json) THEN json_extract(m.adapter_receipt_json, '$.session_id') = ? ELSE 0 END", [projectId, identity.rootSessionId]);
+        const requests = context.db.all("SELECT m.merge_request_id, m.run_id, r.status AS run_status, m.status, m.executor_work_id, m.dispatch_owner, m.dispatch_lease_token, m.adapter_receipt_json FROM merge_requests m JOIN runs r ON r.project_id = m.project_id AND r.id = m.run_id WHERE m.project_id = ? AND m.execution_route = 'server' AND json_valid(m.adapter_receipt_json)", [projectId]);
         for (const request of requests) {
+            const retained = JSON.parse(request.adapter_receipt_json);
+            if (!retained.session_id || !retained.state_dir || nativeRoot(retained.state_dir, retained.session_id) !== identity.rootSessionId)
+                continue;
             const active = ["running", "paused", "waiting_for_user", "blocked"].includes(request.run_status)
                 && ["dispatching", "active", "waiting_user", "action_required", "recovery_required"].includes(request.status);
             if (!active)
@@ -883,13 +941,16 @@ function managedNativeOwner(context, identity, harness, projectId) {
                 harness: runtimeHarness(receipt.profile), ownerId: owner.owner_id, active });
         }
     }
+    if (owners.length > 1)
+        throw new AppError("invocation_scope_unproven", "Native root has more than one persisted owner", 1, { effect: "no_effect" });
     for (const owner of owners) {
         if (!owner.active)
             throw new AppError("invocation_scope_unproven", "Managed native root is no longer active", 1, { effect: "no_effect" });
         if (owner.harness !== harness)
             throw new AppError("invocation_scope_unproven", "Native root belongs to another managed harness", 1, { effect: "no_effect" });
         const binding = requireManagedDaemonBinding(context, { stateDir: owner.stateDir, projectId, runId: owner.runId, ...(owner.ownerId ? { ownerId: owner.ownerId } : {}) });
-        if (binding.process.kind !== (harness === "grok-acp" ? "grok-daemon" : "agy-daemon")) {
+        const kind = { "grok-acp": "grok-daemon", "antigravity-cli": "agy-daemon", "zcode-acp": "zcode-daemon", "codex-desktop": "codex-daemon", "droid-cli": "droid-daemon", "opencode-server": "opencode-daemon" }[harness];
+        if (binding.process.kind !== kind) {
             throw new AppError("invocation_scope_unproven", "Native daemon kind differs from its persisted harness", 1, { effect: "no_effect" });
         }
         if (binding.state.daemon_id !== identity.daemonId)
@@ -900,17 +961,266 @@ function managedNativeOwner(context, identity, harness, projectId) {
         if (!root || !Number.isSafeInteger(generation) || generation < 0 || owner.generation !== undefined && generation !== owner.generation) {
             throw new AppError("invocation_scope_unproven", "Managed native root or RUN generation is not persisted", 1, { effect: "no_effect" });
         }
-        return { projectId, runId: owner.runId, generation };
+        return { projectId, runId: owner.runId, generation, ...(owner.ownerId ? { ownerId: owner.ownerId } : {}) };
     }
     return null;
 }
+/** Manual recovery retains native receipt authority, not controller issuance.
+ * Recognize only the existing pinned recovery dispatch and its live root. */
+export function manualRecoveryInvocationScope(context, projectRoot, identity, harness) {
+    if (identity.sessionId !== identity.rootSessionId || identity.parentSessionId !== null
+        || !context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_recovery_bindings'"))
+        return null;
+    const project = context.db.get("SELECT id,root FROM projects WHERE root = ?", [canonicalPath(projectRoot)]);
+    if (!project)
+        return null;
+    let resolved = null;
+    for (const record of managedProcessStatus(context)) {
+        if (record.project_id !== project.id || !record.run_id || !record.kind.endsWith("-daemon"))
+            continue;
+        const metadata = JSON.parse(record.metadata_json);
+        if (typeof metadata.state_dir !== "string")
+            continue;
+        let state;
+        try {
+            state = readNativeDaemonState(metadata.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (state.daemon_id !== identity.daemonId)
+            continue;
+        const guard = recoveryGuard(context, project.id, record.run_id);
+        if (!guard || !["resuming", "recovered"].includes(guard.status) || metadata.run_generation !== guard.generation)
+            return null;
+        const run = context.db.get("SELECT status FROM runs WHERE project_id = ? AND id = ?", [project.id, record.run_id]);
+        if (!run || !["running", "paused", "waiting_for_user", "blocked"].includes(run.status))
+            return null;
+        if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'")
+            && context.db.get("SELECT 1 FROM run_controllers WHERE project_id = ? AND run_id = ? AND generation = ? AND status NOT IN ('completed','cancelled','superseded')", [project.id, record.run_id, guard.generation]))
+            return null;
+        const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ?", [guard.recovery_id]);
+        if (!binding || binding.daemon_id !== identity.daemonId || binding.provider_session_id !== identity.rootSessionId || binding.harness !== harness
+            || binding.status !== (guard.status === "resuming" ? "prepared" : "accepted") || !binding.runtime_dispatch_json)
+            return null;
+        const dispatch = JSON.parse(binding.runtime_dispatch_json);
+        if (dispatch.process_id !== record.id || dispatch.owner_id !== record.owner_id || dispatch.state_dir !== metadata.state_dir
+            || dispatch.daemon_id !== identity.daemonId || record.state !== "running" || record.lease_expires_at <= context.now() || !processIsAlive(record))
+            return null;
+        const physical = requireManagedDaemonBinding(context, { stateDir: metadata.state_dir, projectId: project.id, runId: record.run_id, ownerId: dispatch.owner_id });
+        const kind = { "codex-desktop": "codex-daemon", "zcode-acp": "zcode-daemon", "grok-acp": "grok-daemon", "antigravity-cli": "agy-daemon", "droid-cli": "droid-daemon", "opencode-server": "opencode-daemon" }[harness];
+        if (physical.process.id !== dispatch.process_id || physical.process.kind !== kind || !physical.state.sessions?.some(native => typeof native === "string" ? native === identity.rootSessionId
+            : native.provider_session_id === identity.rootSessionId && (native.root_provider_session_id ?? native.provider_session_id) === identity.rootSessionId))
+            return null;
+        const packet = recoveryPacketReceipt(binding).packet;
+        if (packet.run_id !== record.run_id || packet.generation !== guard.generation || packet.recovery_id !== guard.recovery_id)
+            return null;
+        if (resolved)
+            throw new AppError("invocation_scope_unproven", "Manual recovery native root has more than one physical owner", 1, { effect: "no_effect" });
+        resolved = { projectRoot: project.root, runId: record.run_id, generation: guard.generation, daemonId: identity.daemonId, rootSessionId: identity.rootSessionId };
+    }
+    return resolved;
+}
+/** Hook-only recovery commands must carry their own target, not acquire one
+ * through assignment expansion. Existing recovery/Work guards own mutation. */
+export function assertManualRecoveryInvocationTarget(context, scope, command) {
+    const parsed = invocation(command);
+    const projectRoot = commandOption(parsed, "project-root");
+    if (!["recovery_accept", "stage_start", "stage_finish", "stage_pause", "stage_resume", "work_start", "work_finish", "work_fail", "merge_apply", "merge_repair"].includes(parsed.operation)
+        || parsed.args.options.has("bootstrap") || !commandPosition(parsed, 0) || !projectRoot
+        || projectRoot !== "@project" && (!path.isAbsolute(projectRoot) || canonicalPath(projectRoot) !== scope.projectRoot)) {
+        throw new AppError("invocation_scope_mismatch", "Manual recovery requires an explicit owned target and project", 1, { effect: "no_effect" });
+    }
+    if (parsed.operation === "recovery_accept" && commandOption(parsed, "recovery-id") !== recoveryGuard(context, requireProjectByRoot(context, scope.projectRoot).id, scope.runId)?.recovery_id)
+        throw new AppError("invocation_scope_mismatch", "Recovery acknowledgement targets another recovery generation", 1, { effect: "no_effect" });
+    assertLifecycleInvocationCurrent(context, scope, command);
+}
+/** Resolve scope from the physical runtime owner, never from a command match. */
+export function managedNativeInvocationScope(context, projectRoot, identity, harness) {
+    const project = context.db.get("SELECT id,root FROM projects WHERE root = ?", [canonicalPath(projectRoot)]);
+    // Bootstrap native hooks precede project registration. They may retain
+    // evidence, but have no managed RUN authority to resolve yet.
+    if (!project)
+        return null;
+    const owner = managedNativeOwner(context, identity, harness, project.id);
+    if (owner)
+        return { projectRoot: project.root, daemonId: identity.daemonId, rootSessionId: identity.rootSessionId, runId: owner.runId, generation: owner.generation };
+    const manualRecovery = manualRecoveryInvocationScope(context, project.root, identity, harness);
+    if (manualRecovery)
+        return manualRecovery;
+    for (const record of managedProcessStatus(context)) {
+        const metadata = JSON.parse(record.metadata_json);
+        if (!record.kind.endsWith("-daemon") || typeof metadata.state_dir !== "string")
+            continue;
+        let state;
+        try {
+            state = readNativeDaemonState(metadata.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (state.daemon_id === identity.daemonId && state.config?.runtime_owner)
+            throw new AppError("invocation_scope_unproven", "Managed daemon has no retained native owner", 1, { effect: "no_effect" });
+    }
+    return null;
+}
+export function cliManagedInvocationScope(context) {
+    const daemonId = context.env.DD_FLOW_DAEMON_ID;
+    if (!daemonId)
+        return null;
+    const scopes = [];
+    for (const record of managedProcessStatus(context)) {
+        const metadata = JSON.parse(record.metadata_json);
+        if (!record.kind.endsWith("-daemon") || typeof metadata.state_dir !== "string")
+            continue;
+        let state;
+        try {
+            state = readNativeDaemonState(metadata.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (state.daemon_id !== daemonId || !record.project_id || !record.run_id)
+            continue;
+        const harness = { "codex-daemon": "codex-desktop", "zcode-daemon": "zcode-acp", "grok-daemon": "grok-acp", "agy-daemon": "antigravity-cli", "droid-daemon": "droid-cli", "opencode-daemon": "opencode-server" }[record.kind];
+        const project = context.db.get("SELECT root FROM projects WHERE id = ?", [record.project_id]);
+        if (!harness || !project)
+            continue;
+        requireManagedDaemonBinding(context, { stateDir: metadata.state_dir, projectId: record.project_id, runId: record.run_id });
+        const roots = new Set((state.sessions ?? []).flatMap(native => typeof native === "string" ? [native] : native.root_provider_session_id ? [native.root_provider_session_id] : native.provider_session_id ? [native.provider_session_id] : []));
+        for (const rootSessionId of roots) {
+            let scope;
+            try {
+                scope = managedNativeInvocationScope(context, project.root, { daemonId, rootSessionId, sessionId: rootSessionId, parentSessionId: null, toolCallId: "cli-scope-inspection" }, harness);
+            }
+            catch (error) {
+                if (error instanceof AppError && error.code === "invocation_scope_unproven")
+                    continue;
+                throw error;
+            }
+            if (scope && !scopes.some(prior => JSON.stringify(prior) === JSON.stringify(scope)))
+                scopes.push(scope);
+        }
+    }
+    if (scopes.length !== 1)
+        throw new AppError("invocation_scope_unproven", "CLI has no unique persisted current managed native scope", 1, { effect: "no_effect" });
+    return scopes[0];
+}
+export function isControllerManagedInvocation(context, projectRoot, runId) {
+    const configured = context.env.DD_FLOW_INVOCATION_SCOPE;
+    if (!configured)
+        return false;
+    const scope = JSON.parse(configured);
+    if (context.env.DD_FLOW_CURRENT_INVOCATION) {
+        const current = load(context, context.env.DD_FLOW_CURRENT_INVOCATION);
+        const identity = current.identity_json && JSON.parse(current.identity_json);
+        if (identity && identity[2] !== scope.rootSessionId)
+            throw new AppError("invocation_scope_unproven", "A native child cannot issue coordinator Stage successors", 1);
+    }
+    if (scope.projectRoot !== canonicalPath(projectRoot) || scope.runId !== runId)
+        throw new AppError("invocation_scope_mismatch", "Successor differs from retained lifecycle scope", 1);
+    const projectId = requireProjectByRoot(context, projectRoot).id;
+    const rows = context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'")
+        ? context.db.all("SELECT controller_id,generation,status,state_json FROM run_controllers WHERE project_id = ? AND run_id = ?", [projectId, runId]) : [];
+    let matches = 0;
+    for (const row of rows) {
+        const state = JSON.parse(row.state_json);
+        const session = state.sessions?.[state.current_session];
+        if (!session)
+            continue;
+        let nativeState;
+        try {
+            nativeState = readNativeDaemonState(session.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (nativeState.daemon_id !== scope.daemonId)
+            continue;
+        const binding = requireManagedDaemonBinding(context, { stateDir: session.state_dir, projectId, runId, ownerId: row.controller_id });
+        if (binding.state.daemon_id !== scope.daemonId)
+            continue;
+        const native = binding.state.sessions?.find(native => typeof native === "string" ? native === session.id && native === scope.rootSessionId
+            : (native.adapter_session_id === session.id || native.provider_session_id === session.id) && (native.root_provider_session_id ?? native.provider_session_id) === scope.rootSessionId);
+        const generation = JSON.parse(binding.process.metadata_json).run_generation;
+        if (!native || session.stopped || ["completed", "cancelled", "superseded"].includes(row.status) || row.generation !== scope.generation || generation !== scope.generation)
+            throw new AppError("invocation_scope_unproven", "Controller successor owner is stale or unproven", 1);
+        matches += 1;
+    }
+    if (matches > 1)
+        throw new AppError("invocation_scope_unproven", "Stage successor has multiple coordinator owners", 1);
+    if (matches === 1)
+        return true;
+    for (const record of managedProcessStatus(context)) {
+        const metadata = JSON.parse(record.metadata_json);
+        if (!record.kind.endsWith("-daemon") || typeof metadata.state_dir !== "string")
+            continue;
+        let state;
+        try {
+            state = readNativeDaemonState(metadata.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (state.daemon_id !== scope.daemonId)
+            continue;
+        if (/^run:.+:(?:work|merge):/.test(record.owner_id))
+            return false;
+        throw new AppError("invocation_scope_unproven", "Managed coordinator has no retained current controller Session", 1);
+    }
+    throw new AppError("invocation_scope_unproven", "Managed successor has no proven physical owner", 1);
+}
 /** recordReceipt is a synchronous SQL-only hook ingress callback. Native
  * adapters must prepare any filesystem or process evidence before calling. */
 export function observeLifecycleInvocation(context, input) {
     storage(context);
+    const projectRoot = input.projectId ? context.db.get("SELECT root FROM projects WHERE id = ?", [input.projectId])?.root : undefined;
+    const provenScope = projectRoot && input.harness ? managedNativeInvocationScope(context, projectRoot, input.identity, input.harness) : null;
+    const owner = provenScope && input.harness && input.projectId ? managedNativeOwner(context, input.identity, input.harness, input.projectId) : null;
+    const ownerSnapshot = () => {
+        if (!provenScope?.runId || !input.projectId)
+            return null;
+        const rows = [context.db.get("SELECT status FROM runs WHERE project_id = ? AND id = ?", [input.projectId, provenScope.runId])];
+        if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'"))
+            rows.push(context.db.all("SELECT controller_id,generation,status,owner_token,state_json FROM run_controllers WHERE project_id = ? AND run_id = ? AND controller_id = ? ORDER BY controller_id", [input.projectId, provenScope.runId, owner?.ownerId ?? ""]).map(row => {
+                const state = JSON.parse(row.state_json), session = state.sessions?.[state.current_session];
+                return [row.controller_id, row.generation, row.status, row.owner_token, state.current_session, session && [session.id, session.state_dir, session.stopped, session.owner]];
+            }));
+        for (const [table, query] of [
+            ["work_launches", "SELECT l.status,l.provider_session_id,l.profile_json FROM work_launches l JOIN works w ON w.work_id = l.work_id WHERE w.project_id = ? AND w.run_id = ? AND CASE WHEN json_valid(l.profile_json) THEN json_extract(l.profile_json, '$.runtime_adapter.owner.owner_id') END = ? ORDER BY l.operation_id"],
+            ["merge_requests", "SELECT status,dispatch_owner,dispatch_lease_token,adapter_receipt_json FROM merge_requests WHERE project_id = ? AND run_id = ? AND (dispatch_owner = ? OR CASE WHEN json_valid(adapter_receipt_json) THEN json_extract(adapter_receipt_json, '$.owner.owner_id') END = ?) ORDER BY merge_request_id"]
+        ])
+            if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = ?", [table]))
+                rows.push(context.db.all(query, table === "merge_requests" ? [input.projectId, provenScope.runId, owner?.ownerId ?? "", owner?.ownerId ?? ""] : [input.projectId, provenScope.runId, owner?.ownerId ?? ""]));
+        if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_recovery_bindings'"))
+            rows.push(context.db.all("SELECT g.recovery_id,g.generation,g.status,b.* FROM run_recovery_guards g JOIN run_recovery_bindings b ON b.recovery_id = g.recovery_id WHERE g.project_id = ? AND g.run_id = ? ORDER BY g.generation", [input.projectId, provenScope.runId]));
+        return JSON.stringify(rows);
+    };
+    const retainedOwner = ownerSnapshot();
     const supplied = input.id ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [input.id]) : undefined;
     const analysis = parseLifecycleCommand(input.command);
     if (analysis.kind === "none" || analysis.supported === false) {
+        let issuedBarrier;
+        const singleLeaf = analysis.kind !== "none" && (analysis.invocations?.length ?? 1) === 1 && !(analysis.kind === "compound" && analysis.reason === "multiple_lifecycle_invocations");
+        const refused = singleLeaf ? context.db.all("SELECT * FROM lifecycle_invocations WHERE status = 'issued'").filter(row => {
+            const scope = JSON.parse(row.scope_json);
+            if (scope.daemonId !== input.identity.daemonId || scope.rootSessionId !== input.identity.rootSessionId || provenScope && row.scope_json !== JSON.stringify(provenScope))
+                return false;
+            try {
+                return fingerprint(invocation(canonicalManagedCommand(context, analysis.invocation.command, scope))) === row.fingerprint;
+            }
+            catch {
+                return false;
+            }
+        }) : [];
+        const correction = supplied ?? (refused.length === 1 ? refused[0] : undefined);
+        if (singleLeaf && correction && correction.status === "issued" && (correction.deadline === null || correction.deadline > Date.now())) {
+            const scope = JSON.parse(correction.scope_json);
+            checkNativeIdentity(scope, input.identity, correction.id);
+            assertSuppliedLifecycleTarget(correction, invocation(canonicalManagedCommand(context, analysis.invocation.command, scope)));
+            if ((!provenScope || correction.scope_json === JSON.stringify(provenScope)) && fingerprint(invocation(canonicalManagedCommand(context, analysis.invocation.command, scope))) === correction.fingerprint)
+                issuedBarrier = { issued_invocation_id: correction.id, cli_admission_barrier: true };
+        }
         const eventKey = input.recordReceipt();
         if (analysis.kind !== "none") {
             const retained = context.db.get("SELECT outcome_json FROM hook_events WHERE event_key = ?", [eventKey]);
@@ -933,7 +1243,7 @@ export function observeLifecycleInvocation(context, input) {
                 }), eventKey]);
         }
         if (analysis.kind !== "none")
-            throw new AppError("lifecycle_shell_syntax_invalid", "This shell form cannot bind exactly one lifecycle execution; use the exact issued lifecycle command without the unsupported shell context", 1, { phase: "prepare", effect: "no_effect", recoverable: true, disposition: "pre_cli_shell_refusal", reason: analysis.kind === "compound" ? analysis.reason : "unsupported_lifecycle_command", event_key: eventKey });
+            throw new AppError("lifecycle_shell_syntax_invalid", "This shell form cannot bind exactly one lifecycle execution; use the exact issued lifecycle command without the unsupported shell context", 1, { phase: "prepare", effect: "no_effect", recoverable: true, disposition: "pre_cli_shell_refusal", reason: analysis.kind === "compound" ? analysis.reason : "unsupported_lifecycle_command", event_key: eventKey, ...issuedBarrier });
         return { eventKey, duplicate: false, invocationId: null };
     }
     // Admit the one parsed leaf, never execute or fingerprint the prefix/suffix.
@@ -942,26 +1252,39 @@ export function observeLifecycleInvocation(context, input) {
         throw new AppError("invocation_directory_mismatch", "Bound lifecycle execution cwd must be absolute", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
     const deliveredIdentity = JSON.stringify([input.identity.daemonId, input.identity.rootSessionId, input.identity.sessionId, input.identity.parentSessionId, input.identity.toolCallId,
         ...(input.executionCwd === undefined ? [] : [{ executionCwd: canonicalPath(input.executionCwd) }])]);
-    const candidates = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing','settled') ORDER BY rowid DESC")
+    const matching = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing','settled') ORDER BY rowid DESC")
         .filter(row => {
-        if (["executing", "settled"].includes(row.status) && row.identity_json !== deliveredIdentity)
-            return false;
         const scope = JSON.parse(row.scope_json);
         if (scope.daemonId !== input.identity.daemonId || scope.rootSessionId !== input.identity.rootSessionId)
             return false;
+        if (provenScope && row.scope_json !== JSON.stringify(provenScope))
+            return false;
         try {
-            return fingerprint(invocation(canonicalManagedCommand(context, leafCommand, scope))) === row.fingerprint;
+            if (fingerprint(invocation(canonicalManagedCommand(context, leafCommand, scope))) !== row.fingerprint)
+                return false;
         }
         catch {
             return false;
         }
+        if (row.identity_json && row.identity_json !== deliveredIdentity
+            && JSON.stringify(JSON.parse(row.identity_json).slice(0, 5)) === JSON.stringify(JSON.parse(deliveredIdentity).slice(0, 5))) {
+            throw new AppError("invocation_identity_mismatch", "The same native tool call changed its bound execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+        }
+        if (row.status === "executing" && row.identity_json !== deliveredIdentity)
+            return false;
+        if (row.status === "settled" && row.outcome_json && JSON.parse(row.outcome_json).error && row.identity_json !== deliveredIdentity)
+            return false;
+        return true;
     });
+    const candidates = lifecycleCandidates(matching, deliveredIdentity);
     // A known explicit ID remains a compatibility path. A missing or mistyped
     // public ID is corrected only by an exact operation/target match inside the
     // trusted native root. Never fuzzy-match UUID text or select a global latest.
     const initial = supplied ?? (candidates.length === 1 ? candidates[0] : undefined);
-    const owner = ["grok-acp", "antigravity-cli"].includes(input.harness ?? "") && input.projectId
-        ? managedNativeOwner(context, input.identity, input.harness, input.projectId) : null;
+    if (!supplied && candidates.length > 1) {
+        input.recordReceipt();
+        throw new AppError("invocation_ambiguous", "More than one issued lifecycle attempt matches this native command", 1, { effect: "no_effect", matches: candidates.map(row => row.id), ...(provenScope ? { lifecycle_assignment: { issuer: "dd-flow", scope: provenScope } } : {}) });
+    }
     if (owner) {
         if (!initial)
             throw new AppError("invocation_assignment_missing", "Managed native lifecycle call has no issued assignment", 1, { effect: "no_effect", recoverable: false });
@@ -971,24 +1294,33 @@ export function observeLifecycleInvocation(context, input) {
         }
     }
     if (!initial) {
-        const eventKey = input.recordReceipt();
-        if (candidates.length > 1)
-            throw new AppError("invocation_ambiguous", "More than one issued lifecycle attempt matches this native command", 1, { effect: "no_effect", matches: candidates.map(row => row.id) });
-        return { eventKey, duplicate: false, invocationId: null };
+        if (provenScope)
+            assertManualRecoveryInvocationTarget(context, provenScope, leafCommand);
+        return context.db.writeTransaction(() => {
+            if (retainedOwner !== ownerSnapshot())
+                throw new AppError("invocation_scope_unproven", "Native owner changed before hook-only recovery receipt", 1, { effect: "no_effect" });
+            const eventKey = input.recordReceipt();
+            return { eventKey, duplicate: false, invocationId: null };
+        });
     }
     const resolved = input.id === initial.id ? {} : { invocationId: initial.id };
+    assertSuppliedLifecycleTarget(initial, invocation(canonicalManagedCommand(context, leafCommand, JSON.parse(initial.scope_json))));
+    const scope = JSON.parse(initial.scope_json);
+    checkNativeIdentity(scope, input.identity, initial.id);
     // A completed invocation is a read, even from a new native tool call after
     // reattach. Do not manufacture a new receipt or reject that read as a second
     // executor; the CLI returns the immutable stored outcome without dispatch.
     if (initial.status === "settled")
         return { eventKey: initial.event_key, duplicate: true, ...resolved };
-    const scope = JSON.parse(initial.scope_json);
     const project = requireProjectByRoot(context, scope.projectRoot);
     const identity = input.identity;
-    checkNativeIdentity(scope, identity, initial.id);
     const identityJson = deliveredIdentity;
     return context.db.writeTransaction(() => {
         const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [initial.id]);
+        if (retainedOwner !== ownerSnapshot())
+            throw new AppError("invocation_scope_unproven", "Native owner changed before admission receipt", 1, { effect: "no_effect" });
+        if (row.scope_json !== initial.scope_json)
+            throw new AppError("invocation_scope_mismatch", "Lifecycle scope changed before native receipt", 1, { effect: "no_effect" });
         if (row.status === "settled")
             return { eventKey: row.event_key, duplicate: true, ...resolved };
         // Observation records native facts only. CLI owns deadline, argument and
@@ -1025,8 +1357,6 @@ export function observeLifecycleInvocation(context, input) {
 /** Correlate exact native argv for diagnostics, independently of assignment
  * matching. A hook-added event key must name the same persisted native call. */
 export function observedLifecycleNativeEvent(context, command, daemonId) {
-    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'hook_events'"))
-        return null;
     const signature = (value) => {
         const parsed = parseLifecycleCommand(value);
         const candidate = parsed.kind !== "none" && parsed.supported ? parsed.invocation : continuationCommand(value);
@@ -1038,6 +1368,8 @@ export function observedLifecycleNativeEvent(context, command, daemonId) {
     const expected = signature(command);
     if (!expected)
         return null;
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'hook_events'"))
+        return null;
     const parsed = parseLifecycleCommand(command);
     const eventKey = parsed.kind === "standalone" ? commandOption(parsed.invocation, "hook-event-id") : undefined;
     const matches = context.db.all(daemonId
@@ -1086,20 +1418,29 @@ export function observedLifecycleDiagnostic(context, command, daemonId, invocati
 /** Resolve only a command that a native hook has already bound to an issued
  * attempt. This is the CLI-side half of admission for model-facing commands
  * that intentionally omit the internal UUID. */
-export function observedLifecycleInvocation(context, command, daemonId) {
+export function observedLifecycleInvocation(context, command, scopeConstraint, correlation) {
     if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'"))
         return null;
     const analysis = parseLifecycleCommand(command);
     if (analysis.kind === "none" || analysis.supported === false)
         return null;
     const leafCommand = analysis.invocation.command;
+    const suppliedId = commandOption(analysis.invocation, "invocation-id");
+    const retainedId = suppliedId && context.db.get("SELECT id FROM lifecycle_invocations WHERE id = ?", [suppliedId]) ? suppliedId : undefined;
     // `issued` is a rendezvous, not authority: the CLI still blocks in
     // awaitLifecycleInvocation until the native observer commits the receipt.
-    const matches = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing') ORDER BY rowid DESC")
+    const matching = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing','settled') ORDER BY rowid DESC")
         .filter(row => {
         try {
+            const explicitId = retainedId;
+            const eventKey = commandOption(analysis.invocation, "hook-event-id") ?? correlation?.eventKey;
+            if (explicitId && row.id !== explicitId || eventKey && row.event_key !== eventKey)
+                return false;
+            if (row.status === "settled" && (!row.outcome_json || JSON.parse(row.outcome_json).error) && !explicitId && !eventKey && !correlation?.identity)
+                return false;
             const scope = JSON.parse(row.scope_json);
-            if (daemonId && scope.daemonId !== daemonId)
+            const constraint = typeof scopeConstraint === "string" ? { daemonId: scopeConstraint } : scopeConstraint;
+            if (constraint && Object.entries(constraint).some(([key, value]) => scope[key] !== value))
                 return false;
             return fingerprint(invocation(canonicalManagedCommand(context, leafCommand, scope))) === row.fingerprint;
         }
@@ -1107,12 +1448,40 @@ export function observedLifecycleInvocation(context, command, daemonId) {
             return false;
         }
     });
+    const identity = correlation?.identity;
+    const matches = lifecycleCandidates(matching, identity ? JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId]) : undefined, true);
     if (!matches.length)
         return null;
     if (matches.length !== 1)
         throw new AppError("invocation_ambiguous", "More than one observed lifecycle attempt matches this command", 1, { effect: "no_effect", matches: matches.map(row => row.id) });
     return { id: matches[0].id, scope: JSON.parse(matches[0].scope_json) };
 }
+/** A new native call may consume a successor, but never a historical result.
+ * Exact native delivery replays its immutable assignment. CLI lookup without
+ * native correlation remains ambiguous when history and a successor coexist. */
+function lifecycleCandidates(rows, identity, lookup = false) {
+    if (identity) {
+        const replay = rows.filter(row => {
+            if (!row.identity_json)
+                return false;
+            if (row.identity_json === identity)
+                return true;
+            if (!lookup)
+                return false;
+            try {
+                const retained = JSON.parse(row.identity_json);
+                return Array.isArray(retained) && JSON.stringify(retained.slice(0, 5)) === identity;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (replay.length)
+            return replay;
+    }
+    const active = rows.filter(row => row.status !== "settled");
+    return (!lookup || identity) && active.length ? active : rows;
+}
 /** Restore private assignment arguments without discarding the provider's
  * verified public input. The fingerprint deliberately projects semantic
  * values such as a Work failure reason and a Work result-file path. */
@@ -1121,6 +1490,7 @@ export function resolveObservedLifecycleArgs(context, id, actualArgs) {
     if (!row)
         throw new AppError("invocation_unknown", "Lifecycle invocation is not registered", 1, { invocation_id: id });
     const retained = invocation(row.command), actual = invocation(`${launchExpression(retained)} ${quoteModelFacingArgs(actualArgs)}`);
+    assertSuppliedLifecycleTarget(row, actual);
     if (fingerprint(actual) !== row.fingerprint)
         throw new AppError("invocation_command_mismatch", "Lifecycle command does not match its issued assignment", 2, { phase: "prepare", effect: "no_effect", recoverable: true });
     for (const key of runtimeOwnedOptions[retained.operation] ?? []) {
@@ -1369,7 +1739,9 @@ export async function awaitLifecycleInvocation(context, input) {
                 if (typeof route === "string" && canonicalPath(process.cwd()) !== canonicalPath(route))
                     throw new AppError("invocation_directory_mismatch", "Reached CLI cwd differs from the bound shell execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false, expected: route, actual: process.cwd(), actual_provenance: "cli_process_cwd" });
             }
-            const claimed = context.db.run("UPDATE lifecycle_invocations SET status = 'executing', updated_at = ? WHERE id = ? AND status = 'observed'", [context.now(), input.id]);
+            // Another native observation can replace an unclaimed receipt. Claim
+            // exactly the identity/route checked above, or reload and validate it.
+            const claimed = context.db.run("UPDATE lifecycle_invocations SET status = 'executing', updated_at = ? WHERE id = ? AND status = 'observed' AND event_key IS ? AND identity_json IS ?", [context.now(), input.id, row.event_key, row.identity_json]);
             if (claimed.changes === 1)
                 return { eventKey: row.event_key, replay: false };
             continue;