@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.138

package/dist/services/lifecycle-invocations.js

@@ -11,7 +11,7 @@ import { commandOption, commandPosition, continuationCommand, lifecycleCommandFr
 import { requireProjectByRoot } from "./projects.js";
 import { assertRunMutationAllowed, assertStageSettlementAllowed, assertWorkSettlementAllowed, recoveryGuard, recoveryPacketReceipt } from "./run-recovery.js";
 import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
-import { managedProcessStatus, processIsAlive } from "./managed-processes.js";
+import { managedProcessStatus, processIsAlive, processStartedAt } from "./managed-processes.js";
 import { appendEvent } from "./run-controller-state.js";
 import { recoverCommittedWorkStart } from "./work-registry.js";
 import { observeCommandHook } from "./hooks.js";
@@ -21,7 +21,24 @@ import { isRegisteredRepair } from "./repair-intents.js";
 import { stageAttempt } from "./stage-work-graph.js";
 import { contextualPathOptionsForLifecycle } from "../cli/command-inputs.js";
 import { canonicalPath } from "../storage/paths.js";
-import { runtimeCommand } from "./runtime-command.js";
+import { runtimeCommand, shellArgument } from "./runtime-command.js";
+// Process-local custody: an executing SQL row or ambient variable alone cannot
+// recreate admission after a CLI restart, or in another resource database.
+const currentAdmissions = new WeakMap();
+export function currentLifecycleAdmission(context, id) {
+    const owned = currentAdmissions.get(context.db)?.get(id);
+    if (!owned || context.env.DD_FLOW_CURRENT_INVOCATION !== id || owned.pid !== process.pid
+        || process.cwd() !== owned.cwd)
+        return null;
+    // This private module cannot survive owner death/restart/PID reuse. Its
+    // captured physical birth + exact PID/CWD/store remain a lifetime proof;
+    // revalidation reads SQL only, including inside the atomic claim writer.
+    const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id=?", [id]);
+    if (!row || row.status !== "executing" || row.event_key !== owned.eventKey || row.identity_json !== owned.identity
+        || row.scope_json !== owned.scope || row.command !== owned.command || row.updated_at !== owned.admittedAt)
+        return null;
+    return { admittedAt: owned.admittedAt };
+}
 /** Auxiliary commands have no invocation capability, but may not escape their
  * native daemon's project/RUN. Context aliases never grant mutation authority. */
 export function assertAuxiliaryCommandScope(context, command, projectRoot) {
@@ -94,6 +111,12 @@ export function isCorrectableLifecycleRejection(code, details = {}) {
         || (code === "fresh_session_required" && details.handoff_required === true
             && details.recoverable === true);
 }
+function registeredLifecycleContinuation(context, error, projectId, runId) {
+    if (runId && isRegisteredRepair(context, error.details.continuation, { projectId, runId }))
+        return true;
+    return error.code === "fresh_session_required" && error.details.handoff_required === true && runId !== null
+        && typeof error.details.work_id === "string" && Boolean(context.db.get("SELECT 1 FROM works WHERE project_id = ? AND run_id = ? AND work_id = ? AND launch_policy = 'fresh_agent_required' AND status IN ('created','running','paused')", [projectId, runId, error.details.work_id]));
+}
 function storage(context) {
     if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'")) {
         throw new AppError("invocation_storage_unprepared", "Lifecycle invocation storage is not prepared; start dd-flow normally before issuing native work", 1);
@@ -447,24 +470,106 @@ export function observeLifecycleCommand(context, command, nativeEvent) {
         delete context.observeLifecycleHook;
         if (!anchor)
             return;
-        const error = outcome.error ? errorRecord(outcome.error) : undefined;
-        const correctable = error && isCorrectableLifecycleRejection(error.code, error.details);
+        let error = outcome.error ? errorRecord(outcome.error) : undefined;
+        // The exact committed event can diagnose a broken transport, but cannot
+        // grant execution authority or select an assignment by command similarity.
+        if (error && parsed.kind === "standalone" && (nativeEvent || commandOption(parsed.invocation, "hook-event-id"))) {
+            const event = context.db.get("SELECT event_key, daemon_id, provider_session_id FROM hook_events WHERE id = ? AND project_id = ?", [anchor.hook_event_id, anchor.project_id]);
+            const assigned = event && context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'lifecycle_invocations'")
+                ? context.db.all("SELECT * FROM lifecycle_invocations WHERE event_key = ? AND status = 'observed'", [event.event_key]) : [];
+            if (assigned.length === 1 && event?.daemon_id && context.env.DD_FLOW_DAEMON_ID !== event.daemon_id) {
+                const scope = JSON.parse(assigned[0].scope_json);
+                const identity = assigned[0].identity_json ? JSON.parse(assigned[0].identity_json) : null;
+                const project = context.db.get("SELECT root FROM projects WHERE id = ?", [anchor.project_id]);
+                if (assigned[0].fingerprint === fingerprint(parsed.invocation) && scope.projectRoot === project?.root && scope.daemonId === event.daemon_id && scope.runId === anchor.run_id && scope.generation === anchor.generation
+                    && Array.isArray(identity) && identity[0] === event.daemon_id && identity[1] === scope.rootSessionId && identity[2] === (event.provider_session_id ?? anchor.session_id))
+                    error = errorRecord(new AppError("invocation_scope_unproven", "Managed shell did not receive its native daemon binding", 1, {
+                        reason: "managed_shell_context_missing", phase: "prepare", effect: "no_effect", recoverable: false,
+                        cause: { code: error.code, parameter: error.details.parameter, reason: error.details.reason }
+                    }));
+            }
+        }
+        const registeredContinuation = error && registeredLifecycleContinuation(context, error, anchor.project_id, anchor.run_id);
+        const retainedSuccessor = error && typeof error.details.retry_command === "string"
+            && typeof error.details.rejection_signature === "string"
+            && context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'lifecycle_invocations'")
+            && context.db.get(`SELECT 1 FROM lifecycle_invocations a JOIN hook_events h ON h.event_key = a.event_key
+        JOIN projects p ON p.id = h.project_id WHERE h.id = ? AND h.project_id = ? AND a.status = 'settled'
+        AND json_extract(a.scope_json,'$.projectRoot') = p.root AND json_extract(a.scope_json,'$.runId') = ?
+        AND json_extract(a.scope_json,'$.generation') = ? AND json_extract(a.outcome_json,'$.error.details.retry_command') = ?
+        AND json_extract(a.outcome_json,'$.error.details.rejection_signature') = ?`, [anchor.hook_event_id, anchor.project_id, anchor.run_id, anchor.generation, error.details.retry_command, error.details.rejection_signature]);
+        const hookOnlyArgumentDefect = error && !invocationId && !context.env.DD_FLOW_INVOCATION_SCOPE
+            && !retainedSuccessor
+            && ["missing_required_option", "missing_option_value", "empty_option_value", "invalid_number", "invalid_choice", "duplicate_option"].includes(String(error.details.reason));
+        const hookOnlyCorrection = error && parsed.kind === "standalone" && !auxiliary && !invocationId && !context.env.DD_FLOW_INVOCATION_SCOPE
+            && !retainedSuccessor && !hookOnlyArgumentDefect
+            && error.details.effect === "no_effect" && isRetryableLifecycleRejection(error.code, error.details)
+            && error.code !== "usage" && !["invocation_command_mismatch", "invocation_argument_mismatch"].includes(error.code)
+            && parsed.invocation.argv.some(value => /^(?:--(?:(?:result|semantic|decision|verification|context|answer|intake|question|reason)-file|data))(?:=|$)/.test(value))
+            && !isRegisteredRepair(context, error.details.continuation, { projectId: anchor.project_id, runId: anchor.run_id });
+        let correctionCwd;
+        if (error && hookOnlyCorrection) {
+            const receipt = context.db.get("SELECT sanitized_summary FROM hook_events WHERE id = ? AND project_id = ?", [anchor.hook_event_id, anchor.project_id]);
+            let payload = {};
+            try {
+                const decoded = JSON.parse(receipt?.sanitized_summary ?? "{}");
+                if (decoded && typeof decoded === "object" && !Array.isArray(decoded))
+                    payload = decoded;
+            }
+            catch { /* Truncated summaries cannot supply a route. */ }
+            if (payload.lifecycle_execution_cwd !== undefined) {
+                let confirmed = false;
+                const cwd = payload.lifecycle_execution_cwd;
+                if (typeof cwd === "string" && path.isAbsolute(cwd) && payload.lifecycle_execution_cwd_provenance === "literal_cd_intent_requires_cli_confirmation") {
+                    try {
+                        confirmed = fs.realpathSync(cwd) === fs.realpathSync(process.cwd());
+                    }
+                    catch { /* No physical confirmation, no executable correction. */ }
+                }
+                if (confirmed)
+                    correctionCwd = cwd;
+                else
+                    error = errorRecord(new AppError("invocation_directory_mismatch", "Hook-only correction has no confirmed native execution directory", 1, {
+                        reason: "literal_execution_cwd_unconfirmed", phase: "prepare", effect: "no_effect", recoverable: false,
+                        cause: { code: error.code, parameter: error.details.parameter, reason: error.details.reason }
+                    }));
+            }
+        }
+        const correctable = error && !hookOnlyArgumentDefect && error.details.recoverable !== false && error.details.effect !== "unknown"
+            && (registeredContinuation || error.details.effect === "no_effect" && isCorrectableLifecycleRejection(error.code, error.details)
+                && typeof error.details.retry_command === "string");
         const correlationKey = parsed.kind === "standalone" ? fingerprint(parsed.invocation)
             : JSON.stringify([auxiliary.operation, auxiliary.operation === "stage_block" ? auxiliary.args.positional[2] ?? null : auxiliary.args.options.get("run")?.[0] ?? null, auxiliary.args.options.get("stage")?.[0] ?? null]);
-        const record = { ...anchor, correlation_key: correlationKey, ...(parsed.kind === "standalone" ? { fingerprint: correlationKey } : {}), ...(error ? { error } : outcome), effect: error ? error.details.effect ?? (correctable ? "no_effect" : "unknown") : "committed", disposition: error ? auxiliary ? "pending_continuation" : correctable ? "correctable" : "fatal" : "completed" };
+        const record = { ...anchor, stage: anchor.stage ?? null, attempt: anchor.attempt ?? null, correlation_key: correlationKey, ...(parsed.kind === "standalone" ? { fingerprint: correlationKey } : {}), ...(error ? { error } : outcome), effect: error ? error.details.effect ?? (correctable ? "no_effect" : "unknown") : "committed", disposition: error ? auxiliary ? "pending_continuation" : correctable ? "correctable" : "fatal" : "completed" };
         try {
             context.db.writeTransaction(() => {
-                if (error && parsed.kind === "standalone" && !auxiliary && !invocationId && !context.env.DD_FLOW_INVOCATION_SCOPE
-                    && error.details.effect === "no_effect" && isRetryableLifecycleRejection(error.code, error.details)
-                    && !isRegisteredRepair(context, error.details.continuation, { projectId: anchor.project_id, runId: anchor.run_id })) {
+                const retained = context.db.get("SELECT outcome_json FROM hook_events WHERE id = ?", [anchor.hook_event_id]);
+                const previous = retained?.outcome_json ? JSON.parse(retained.outcome_json) : null;
+                if (previous?.disposition !== "retrying" && previous?.error && error && previous.correlation_key === correlationKey
+                    && preparationRejectionSignature(new AppError(previous.error.code, previous.error.message, 1, previous.error.details))
+                        === preparationRejectionSignature(new AppError(error.code, error.message, 1, error.details))) {
+                    error = previous.error;
+                    Object.assign(record, previous);
+                    return;
+                }
+                if (error && parsed.kind === "standalone" && hookOnlyCorrection && error.details.recoverable !== false) {
                     const signature = preparationRejectionSignature(new AppError(error.code, error.message, 1, error.details));
                     error.details.hook_retry_signature = signature;
-                    const repeated = context.db.get("SELECT 1 FROM hook_events WHERE project_id = ? AND id <> ? AND json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ? AND json_extract(outcome_json, '$.operation') = ? AND json_extract(outcome_json, '$.error.details.hook_retry_signature') = ? LIMIT 1", [anchor.project_id, anchor.hook_event_id, anchor.run_id, anchor.generation, anchor.operation, signature]);
+                    const repeated = context.db.get(`SELECT 1 FROM hook_events WHERE project_id = ? AND id <> ?
+          AND json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ?
+          AND json_extract(outcome_json, '$.operation') = ? AND json_extract(outcome_json, '$.fingerprint') = ?
+          AND json_extract(outcome_json, '$.harness') = ? AND json_extract(outcome_json, '$.session_id') = ?
+          AND json_type(outcome_json, '$.stage') IS NOT NULL AND json_type(outcome_json, '$.attempt') IS NOT NULL
+          AND json_extract(outcome_json, '$.stage') IS ? AND json_extract(outcome_json, '$.attempt') IS ?
+          AND json_extract(outcome_json, '$.error.details.hook_retry_signature') = ? LIMIT 1`, [anchor.project_id, anchor.hook_event_id, anchor.run_id, anchor.generation, anchor.operation, correlationKey,
+                        anchor.harness, anchor.session_id, anchor.stage ?? null, anchor.attempt ?? null, signature]);
                     if (!repeated) {
-                        const argv = parsed.invocation.argv.filter((value, index, all) => value !== "--hook-event-id" && all[index - 1] !== "--hook-event-id" && value !== "--invocation-id" && all[index - 1] !== "--invocation-id");
-                        error.details.retry_command = runtimeCommand(context, argv);
-                        error.details.retry_instruction = "Correct the evidenced input, then run retry_command once as a standalone command in this Session. The rejected attempt had no lifecycle effect.";
+                        const argv = parsed.invocation.argv.filter((value, index, all) => !/^--(?:hook-event-id|invocation-id)(?:=|$)/.test(value)
+                            && !/^--(?:hook-event-id|invocation-id)$/.test(all[index - 1] ?? ""));
+                        error.details.retry_command = `${correctionCwd ? `cd ${shellArgument(correctionCwd)} && ` : ""}${runtimeCommand(context, argv)}`;
+                        error.details.retry_instruction = "Correct the evidenced input, then execute the exact supplied retry_command once in this Session without changing its launch route. The rejected attempt had no lifecycle effect.";
                         error.details.recoverable = true;
+                        record.disposition = "correctable";
                     }
                     else {
                         error.details.recoverable = false;
@@ -472,8 +577,11 @@ export function observeLifecycleCommand(context, command, nativeEvent) {
                         record.disposition = "fatal";
                     }
                 }
-                const retained = context.db.get("SELECT outcome_json FROM hook_events WHERE id = ?", [anchor.hook_event_id]);
-                const previous = retained?.outcome_json ? JSON.parse(retained.outcome_json) : null;
+                if (error && !auxiliary && record.disposition === "fatal") {
+                    error.details.recoverable = false;
+                    delete error.details.retry_command;
+                    delete error.details.retry_instruction;
+                }
                 if (previous?.storage_retry === 1)
                     Object.assign(record, { storage_retry: 1, work_id: previous.work_id });
                 const encoded = JSON.stringify(record);
@@ -491,6 +599,11 @@ export function observeLifecycleCommand(context, command, nativeEvent) {
         catch (persistence) {
             if (persistence instanceof AppError && persistence.code === "lifecycle_outcome_conflict")
                 throw persistence;
+            if (error) {
+                error.details.recoverable = false;
+                delete error.details.retry_command;
+                delete error.details.retry_instruction;
+            }
             // Diagnostic evidence is not replay authority. If SQL is unavailable,
             // the controller still sees this failure and fences instead of waiting
             // for a model to report it or invent a new invocation.
@@ -508,11 +621,15 @@ export function observeLifecycleCommand(context, command, nativeEvent) {
         // Serializers intentionally clone JSON-safe diagnostics. These response
         // fields are the deliberate API overlay on the original rejection, only
         // after its exact durable hook outcome has committed.
-        if (outcome.error && error)
-            for (const field of ["hook_retry_signature", "retry_command", "retry_instruction", "recoverable", "repeated_without_progress"]) {
-                if (Object.prototype.hasOwnProperty.call(error.details, field))
-                    outcome.error.details[field] = error.details[field];
+        if (outcome.error && error) {
+            outcome.error.code = error.code;
+            outcome.error.message = error.message;
+            Object.assign(outcome.error.details, error.details);
+            if (record.disposition === "fatal") {
+                delete outcome.error.details.retry_command;
+                delete outcome.error.details.retry_instruction;
             }
+        }
     };
 }
 function lifecycleDiagnostics(context, projectId, runId, generation) {
@@ -618,16 +735,16 @@ export function managedLifecycleCommand(context, command, options = {}) {
         return publicInvocationCommand(context, load(context, issued.id), command);
     });
 }
-export function retryLifecycleInvocationCommand(context, id) {
+export function retryLifecycleInvocationCommand(context, id, checkReceiptId) {
     const prior = load(context, id);
     if (prior.status !== "executing")
         throw new AppError("invocation_retry_not_authorized", "Only the executing lifecycle operation can publish its next attempt", 1);
-    return successorLifecycleInvocationCommand(context, prior);
+    return successorLifecycleInvocationCommand(context, prior, checkReceiptId);
 }
 /** A predecessor may publish exactly one successor only while the caller has
  * proved that no lifecycle effect was admitted. Shared by CLI argument
  * validation and conclusive lifecycle/result rejection, never by hooks. */
-function successorLifecycleInvocationCommand(context, prior) {
+function successorLifecycleInvocationCommand(context, prior, checkReceiptId) {
     const parsed = invocation(prior.command);
     const argv = [...parsed.argv];
     const at = argv.indexOf("--invocation-id");
@@ -636,7 +753,23 @@ function successorLifecycleInvocationCommand(context, prior) {
     // The parser proves the marker belongs to argv. Remove that one rendered
     // token from the retained text so response-file/stdin/heredoc presentation
     // remains byte-for-byte stable across a retry.
-    const command = retainedCommandWithoutInvocationId(prior);
+    let command = retainedCommandWithoutInvocationId(prior);
+    if (checkReceiptId) {
+        // Keep the trusted route and all stdin/redirection bytes. Replace only
+        // already-parsed literal retry options; ambiguous rendering fails closed.
+        let retained = prior.command;
+        for (const key of ["retry-check", "reason", "reason-file"]) {
+            const value = commandOption(parsed, key);
+            if (value === undefined)
+                continue;
+            const spellings = [...new Set([shellArgument(value), quote([value]), JSON.stringify(value)])];
+            const fragments = spellings.flatMap(rendered => [` --${key} ${rendered}`, ` --${key}=${rendered}`]).filter(fragment => retained.includes(fragment));
+            if (fragments.length !== 1 || retained.indexOf(fragments[0]) !== retained.lastIndexOf(fragments[0]))
+                throw new AppError("invocation_command_invalid", "Retained retry option cannot be rewritten unambiguously", 1);
+            retained = retained.replace(fragments[0], "");
+        }
+        command = retained.replace(` --invocation-id ${prior.id}`, ` --retry-check ${shellArgument(checkReceiptId)} --reason ${shellArgument("Recheck after candidate-source correction")}`);
+    }
     return managedLifecycleCommand({ ...context, env: { ...context.env, DD_FLOW_INVOCATION_SCOPE: prior.scope_json, DD_FLOW_CURRENT_INVOCATION: prior.id } }, command);
 }
 // Caller holds the write transaction and has checked authority. Issued (or
@@ -657,31 +790,48 @@ const receiptTimeout = (id) => ({ code: "invocation_receipt_timeout", message: "
  * outcome and its successor; never a usable successor beside an unknown effect. */
 export function settleLifecycleRejection(context, id, error) {
     storage(context);
+    // Only this settlement may publish a successor; inherited help is not authority.
+    delete error.details.retry_command;
+    delete error.details.retry_instruction;
     const details = { ...error.details };
-    context.db.writeTransaction(() => {
-        const prior = load(context, id);
-        if (prior.status !== "executing")
-            throw new AppError("invocation_settlement_conflict", "Attempt is no longer executing", 1, { invocation_id: id });
-        const storageRetry = error.code === "storage_write_failed" && error.details.effect === "no_effect"
-            && !context.db.get("SELECT 1 FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND json_extract(outcome_json, '$.error.details.storage_retry') = 1 LIMIT 1", [prior.scope_json, prior.fingerprint]);
-        if (isRetryableLifecycleRejection(error.code, error.details) || storageRetry) {
-            const retry = retryLifecycleInvocationCommand(context, id);
-            details.retry_command = retry;
-            details.recoverable = true;
-            if (storageRetry)
-                details.storage_retry = 1;
-            details.retry_instruction = isRegisteredRepair(context, details.continuation)
-                ? "The repair is already registered. End this coordinator turn so the controller can launch its fresh child. Use retry_command only after that repair completes, with fresh semantic verification."
-                : "Correct only the evidenced defect, then use retry_command with the required result input. Reissuing the old command only reads its retained outcome.";
-        }
-        else if (isCorrectableLifecycleRejection(error.code, error.details)) {
-            details.effect = "no_effect";
-            details.recoverable = true;
-            details.handoff_required = true;
-            details.recovery_instruction = "Do not retry this command in the current Session. End the coordinator Turn; the controller will launch the already-registered Work in a fresh child Session.";
-        }
-        settleLifecycleInvocation(context, id, { error: { ...error, details } });
-    });
+    try {
+        context.db.writeTransaction(() => {
+            const prior = load(context, id);
+            if (prior.status !== "executing")
+                throw new AppError("invocation_settlement_conflict", "Attempt is no longer executing", 1, { invocation_id: id });
+            const storageRetry = error.code === "storage_write_failed" && error.details.effect === "no_effect"
+                && !context.db.get("SELECT 1 FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND json_extract(outcome_json, '$.error.details.storage_retry') = 1 LIMIT 1", [prior.scope_json, prior.fingerprint]);
+            if (isRetryableLifecycleRejection(error.code, error.details) || storageRetry) {
+                const failures = ["work_checks_failed", "code_gate_failed", "code_review_gate_failed", "merge_gate_failed"].includes(error.code) ? error.details.failures : undefined;
+                const retry = retryLifecycleInvocationCommand(context, id, failures?.[0]?.id);
+                details.retry_command = retry;
+                details.effect = "no_effect";
+                details.recoverable = true;
+                if (storageRetry)
+                    details.storage_retry = 1;
+                details.retry_instruction = isRegisteredRepair(context, details.continuation)
+                    ? "The repair is already registered. End this coordinator turn so the controller can launch its fresh child. Use retry_command only after that repair completes, with fresh semantic verification."
+                    : "Correct only the evidenced defect, then use retry_command with the required result input. Reissuing the old command only reads its retained outcome.";
+                if (["memory_review_corrections_required", "memory_correction_checks_invalid"].includes(error.code) && typeof details.correction_instruction === "string")
+                    details.retry_instruction = details.correction_instruction;
+            }
+            else if (isCorrectableLifecycleRejection(error.code, error.details)
+                && registeredLifecycleContinuation(context, error, requireProjectByRoot(context, JSON.parse(prior.scope_json).projectRoot).id, JSON.parse(prior.scope_json).runId)) {
+                details.effect = "no_effect";
+                details.recoverable = true;
+                details.handoff_required = true;
+                details.recovery_instruction = "Do not retry this command in the current Session. End the coordinator Turn; the controller will launch the already-registered Work in a fresh child Session.";
+            }
+            else {
+                details.recoverable = false;
+            }
+            settleLifecycleInvocation(context, id, { error: { ...error, details } });
+        });
+    }
+    catch (persistence) {
+        error.details.recoverable = false;
+        throw persistence;
+    }
     Object.assign(error.details, details);
 }
 /** Recovery preserves the original packet as evidence. Only its retained,
@@ -1593,38 +1743,46 @@ export function retainObservedLifecycleSemantics(context, id, argv) {
     }
 }
 export function settleLifecyclePreparationRejection(context, id, error) {
-    return context.db.writeTransaction(() => {
-        const row = load(context, id);
-        if (row.status === "settled") {
-            const details = row.outcome_json ? JSON.parse(row.outcome_json)?.error?.details : undefined;
-            return details?.effect === "no_effect" && details.retry_command ? details : { effect: "unknown", recoverable: false };
-        }
-        if (!["issued", "observed"].includes(row.status))
-            return { effect: "unknown", recoverable: false };
-        const scope = JSON.parse(row.scope_json);
-        if (scope.runId)
-            assertLifecycleInvocationCurrent(context, scope, row.command);
-        const signature = preparationRejectionSignature(error);
-        const repeated = context.db.all("SELECT outcome_json FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND id <> ? AND status = 'settled'", [row.scope_json, row.fingerprint, row.id])
-            .some(prior => { try {
-            return JSON.parse(prior.outcome_json ?? "null")?.error?.details?.rejection_signature === signature;
-        }
-        catch {
-            return false;
-        } });
-        const retryable = !repeated && isRetryableLifecycleRejection(error.code, error.details);
-        const details = { ...error.details, effect: "no_effect", recoverable: retryable, rejection_signature: signature,
-            ...(repeated ? { repeated_without_progress: true } : {}),
-            ...(retryable ? {
-                retry_command: successorLifecycleInvocationCommand(context, row),
-                retry_instruction: "Correct the reported input, then execute retry_command verbatim in this same Session. The rejected call changed no lifecycle state."
-            } : {}) };
-        context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ?", [JSON.stringify({ error: { ...errorRecord(error), details } }), context.now(), row.id]);
-        return details;
-    });
+    delete error.details.retry_command;
+    delete error.details.retry_instruction;
+    try {
+        return context.db.writeTransaction(() => {
+            const row = load(context, id);
+            if (row.status === "settled") {
+                const details = row.outcome_json ? JSON.parse(row.outcome_json)?.error?.details : undefined;
+                return details?.effect === "no_effect" && details.retry_command ? details : { effect: "unknown", recoverable: false };
+            }
+            if (!["issued", "observed"].includes(row.status))
+                return { effect: "unknown", recoverable: false };
+            const scope = JSON.parse(row.scope_json);
+            if (scope.runId)
+                assertLifecycleInvocationCurrent(context, scope, row.command);
+            const signature = preparationRejectionSignature(error);
+            const repeated = context.db.all("SELECT outcome_json FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND id <> ? AND status = 'settled'", [row.scope_json, row.fingerprint, row.id])
+                .some(prior => { try {
+                return JSON.parse(prior.outcome_json ?? "null")?.error?.details?.rejection_signature === signature;
+            }
+            catch {
+                return false;
+            } });
+            const retryable = !repeated && isRetryableLifecycleRejection(error.code, error.details);
+            const details = { ...error.details, effect: "no_effect", recoverable: retryable, rejection_signature: signature,
+                ...(repeated ? { repeated_without_progress: true } : {}),
+                ...(retryable ? {
+                    retry_command: successorLifecycleInvocationCommand(context, row),
+                    retry_instruction: "Correct the reported input, then execute retry_command verbatim in this same Session. The rejected call changed no lifecycle state."
+                } : {}) };
+            context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ?", [JSON.stringify({ error: { ...errorRecord(error), details } }), context.now(), row.id]);
+            return details;
+        });
+    }
+    catch (persistence) {
+        error.details.recoverable = false;
+        throw persistence;
+    }
 }
 function preparationRejectionSignature(error) {
-    const omitted = new Set(["retry_command", "retry_instruction", "invocation_id", "hook_event_id", "rejection_signature", "hook_retry_signature"]);
+    const omitted = new Set(["retry_command", "retry_instruction", "invocation_id", "hook_event_id", "rejection_signature", "hook_retry_signature", "event_key", "tool_call_id", "controller_turn", "timestamp", "created_at", "updated_at", "repeated_without_progress", "recoverable"]);
     const normalize = (value) => {
         if (Array.isArray(value))
             return value.map(normalize);
@@ -1797,9 +1955,29 @@ export async function awaitLifecycleInvocation(context, input) {
             }
             // Another native observation can replace an unclaimed receipt. Claim
             // exactly the identity/route checked above, or reload and validate it.
-            const claimed = context.db.run("UPDATE lifecycle_invocations SET status = 'executing', updated_at = ? WHERE id = ? AND status = 'observed' AND event_key IS ? AND identity_json IS ?", [context.now(), input.id, row.event_key, row.identity_json]);
-            if (claimed.changes === 1)
+            const workStart = invocation(row.command).operation === "work_start";
+            const birth = workStart ? processStartedAt(process.pid) : null, cwd = workStart ? process.cwd() : "";
+            input.assertCurrent(JSON.parse(row.scope_json));
+            let admittedAt = "";
+            const claimed = context.db.writeTransaction(() => {
+                // Acquire the writer before taking the anchor; waiting for SQLite or
+                // physical birth observation must not make an old Hook appear fresh.
+                admittedAt = context.now();
+                return context.db.run("UPDATE lifecycle_invocations SET status = 'executing', updated_at = ? WHERE id = ? AND status = 'observed' AND event_key IS ? AND identity_json IS ? AND scope_json=? AND command=?", [admittedAt, input.id, row.event_key, row.identity_json, row.scope_json, row.command]);
+            });
+            if (claimed.changes === 1) {
+                if (birth) {
+                    let owned = currentAdmissions.get(context.db);
+                    if (!owned) {
+                        owned = new Map();
+                        currentAdmissions.set(context.db, owned);
+                    }
+                    if (owned.size >= 256)
+                        owned.delete(owned.keys().next().value);
+                    owned.set(input.id, { eventKey: row.event_key, identity: row.identity_json, scope: row.scope_json, command: row.command, cwd, pid: process.pid, birth, admittedAt });
+                }
                 return { eventKey: row.event_key, replay: false };
+            }
             continue;
         }
         if (row.status === "expired" || (row.deadline !== null && row.deadline <= Date.now())) {
@@ -1816,6 +1994,7 @@ export async function awaitLifecycleInvocation(context, input) {
     }
 }
 export function settleLifecycleInvocation(context, id, outcome) {
+    currentAdmissions.get(context.db)?.delete(id);
     const encoded = JSON.stringify(outcome);
     if (encoded === undefined)
         throw new AppError("invocation_outcome_invalid", "Invocation outcome must be JSON", 1);

package/dist/services/memory-accepted-composition.js

@@ -0,0 +1,77 @@
+import { AppError } from "../shared/errors.js";
+import { createHash } from "node:crypto";
+import { RetainedExecutionBundle } from "./execution-bundles.js";
+import { assertPreparedRunBundleSqlAuthority } from "./runs.js";
+import { readDescriptorRootWork } from "./descriptor-root-work.js";
+import { stageGraphScope } from "./stage-work-graph.js";
+import { selectMemoryCompositionRegistration } from "./memory-composition-registration.js";
+import { PreparedMemoryResultBinding } from "./memory-result-binding.js";
+import { PreparedMemoryStageResult, memorySourceKey } from "./memory-stage-results.js";
+import { PreparedMemoryCompositionAcceptance } from "./memory-composition-acceptance.js";
+import { captureMemoryCompositionSources } from "./memory-compose-handler.js";
+import { readAcceptedStageData } from "./stage-report-renderer.js";
+function refuse(reason) {
+    throw new AppError("memory_accepted_composition_invalid", "Accepted composition lacks original plan and current settled output custody", 2, { reason, effect: "no_effect" });
+}
+/** Shared current-document authority for VERIFY and initial REVIEW. Historical
+ * replay uses separate retained receipts; repaired outputs cannot masquerade
+ * as the original composition. This helper writes nothing and dispatches no Work.
+ */
+export class PreparedAcceptedMemoryComposition {
+    #bundle;
+    #runRoot;
+    #blueprint;
+    #binding;
+    #outputs;
+    #result;
+    constructor(bundle, runRoot, blueprint, binding, outputs, result) {
+        this.#bundle = bundle;
+        this.#runRoot = runRoot;
+        this.#blueprint = blueprint;
+        this.#binding = binding;
+        this.#outputs = outputs;
+        this.#result = result;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        const { scope, bundle } = input;
+        if (!(bundle instanceof RetainedExecutionBundle) || bundle.descriptor.descriptor.id !== "mb-init")
+            refuse("registered_memory_bundle_required");
+        const run = assertPreparedRunBundleSqlAuthority(context, scope, bundle), root = readDescriptorRootWork(context, scope, bundle);
+        const registration = selectMemoryCompositionRegistration(context, { ...stageGraphScope(context, scope.projectId, scope.runId, "compose"), stage: "compose", parent_work_id: root.workId });
+        const blueprint = PreparedMemoryResultBinding.prepareRegisteredComposition(context, { ...scope, flow: bundle.descriptor, execution: bundle.execution, bundle, acceptedReplay: true,
+            registrationScope: registration.scope });
+        const outputs = PreparedMemoryCompositionAcceptance.prepare(context, { scope: registration.scope, flow: bundle.descriptor, engine: bundle.engine(), binding: blueprint.binding() });
+        const composed = readAcceptedStageData(context, { ...scope, stage: "compose" }), runRoot = run.run_root ?? run.run_dir;
+        const binding = PreparedMemoryResultBinding.prepare(context, { ...scope, stage: "compose", flow: bundle.descriptor, execution: bundle.execution, bundle, acceptedReplay: true,
+            sources: captureMemoryCompositionSources(context, bundle, runRoot, composed.bytes, outputs), historicalEvidence: outputs.historicalEvidence() });
+        if (!binding.acceptedBytes()?.equals(composed.bytes))
+            refuse("accepted_composition_changed");
+        const result = PreparedMemoryStageResult.prepare(composed.bytes, bundle.descriptor, binding.binding());
+        outputs.assertResult(result);
+        const prepared = new PreparedAcceptedMemoryComposition(bundle, runRoot, blueprint, binding, outputs, result);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    result() { return this.#result; }
+    outputReferences() {
+        const hashes = this.#outputs.outputHashes();
+        return this.#outputs.outputLocations().map(location => ({ ...location, sha256: hashes.get(memorySourceKey(location.root, location.path)) }));
+    }
+    historicalEvidence() { return this.#outputs.historicalEvidence(); }
+    captureSources(context, bytes, checks) {
+        return captureMemoryCompositionSources(context, this.#bundle, this.#runRoot, bytes, this.#outputs, checks, createHash("sha256").update(bytes).digest("hex"));
+    }
+    assertCustody(context) {
+        this.#blueprint.assertCustody(context);
+        this.#binding.assertCustody(context);
+        this.#outputs.assertCustody(context);
+        this.#outputs.assertResult(this.#result);
+    }
+    revalidate(context) {
+        this.#blueprint.revalidate(context);
+        this.#binding.revalidate(context);
+        this.#outputs.revalidate(context);
+        this.assertCustody(context);
+    }
+}

package/dist/services/memory-baseline-preservation.js

@@ -0,0 +1,65 @@
+import { AppError } from "../shared/errors.js";
+import { FrozenGenericExecution } from "./generic-execution.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { readMemoryInitBootstrapReadiness } from "./memory-init-bootstrap-readiness.js";
+import { readMemoryInitProjectBootstrap } from "./memory-init-project-bootstrap.js";
+import { assertPublishedMemoryLayerOwnership } from "./memory-layer-publication.js";
+import { observeMemoryInitSourceInventory } from "./memory-init-preflight.js";
+function refuse(reason) {
+    throw new AppError("memory_baseline_preservation_invalid", "Composition cannot accept changed bootstrap sources", 1, { reason, effect: "no_effect" });
+}
+/** Pre-integration source preservation, not semantic scope or stage authority.
+ * Only the accepted publisher's ownership is checked before using its MB exclusion.
+ * This admits no caller-supplied baseline and never repairs or republishes files.
+ */
+export class PreparedMemoryBaselinePreservation {
+    sourceSha256;
+    #execution;
+    #authoritySha256;
+    #inventorySha256;
+    constructor(execution, authoritySha256, inventorySha256, sourceSha256) {
+        this.#execution = execution;
+        this.#authoritySha256 = authoritySha256;
+        this.#inventorySha256 = inventorySha256;
+        this.sourceSha256 = sourceSha256;
+        Object.freeze(this);
+    }
+    static accepted(context, execution) {
+        if (!(execution instanceof FrozenGenericExecution) || execution.settings.flow_id !== "mb-init")
+            refuse("unprepared_execution");
+        const scope = execution.snapshot().scope;
+        const accepted = readMemoryInitBootstrapReadiness(context, { requestId: scope.requestId, projectRoot: scope.projectRoot, workspaceRoot: scope.workspace });
+        if (!accepted || accepted.authority.binding.execution_sha256 !== execution.sha256)
+            refuse("accepted_bootstrap_required");
+        return accepted;
+    }
+    static observe(context, accepted) {
+        const binding = accepted.authority.binding, scope = binding.scope;
+        const registered = readMemoryInitProjectBootstrap(context, scope);
+        if (!registered)
+            refuse("accepted_bootstrap_required");
+        assertPublishedMemoryLayerOwnership(context.ddFlowHome, { ...scope, targetSha256: registered.receipt.target_sha256,
+            layerSha256: registered.receipt.layer_sha256, packSha256: binding.pack_sha256, installationSha256: binding.installation_manifest_sha256 }, binding.target, registered.receipt.layer_publication_sha256, registered.receipt.draft_identity_sha256);
+        return observeMemoryInitSourceInventory(binding.target, accepted.authority.receipt.baseline_sha256, context.env);
+    }
+    static prepare(context, execution) {
+        const accepted = this.accepted(context, execution);
+        const inventory = this.observe(context, accepted);
+        const prepared = new PreparedMemoryBaselinePreservation(execution, hybridDigest(accepted.authority), inventory.sha256, accepted.authority.binding.target.source_sha256);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    /** SQL-only acceptance fence. Physical checks must precede the writer. */
+    assertCustody(context) {
+        if (hybridDigest(PreparedMemoryBaselinePreservation.accepted(context, this.#execution).authority) !== this.#authoritySha256)
+            refuse("bootstrap_authority_changed");
+    }
+    revalidate(context) {
+        this.assertCustody(context);
+        const accepted = PreparedMemoryBaselinePreservation.accepted(context, this.#execution);
+        const inventory = PreparedMemoryBaselinePreservation.observe(context, accepted);
+        if (inventory.sha256 !== this.#inventorySha256)
+            refuse("baseline_inventory_changed");
+        this.assertCustody(context);
+    }
+}