@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.139

package/dist/services/vnext-execution-profile.js

@@ -93,8 +93,8 @@ export function validateVnextExecutionProfile(value) {
         || profile.merge_delivery?.strategy !== "local"
         || !["retain", "delete_after_success"].includes(String(profile.merge_cleanup?.source))
         || !["code_completed", "code_review_completed", "merge_completed"].includes(String(profile.stop_target))
-        || !profile.code_bootstrap || typeof profile.code_bootstrap.command !== "string" || !profile.code_bootstrap.command.trim()
-        || typeof profile.code_bootstrap.policy_ref !== "string" || !profile.code_bootstrap.policy_ref.trim()
+        || (profile.code_bootstrap !== undefined && (!profile.code_bootstrap || typeof profile.code_bootstrap.command !== "string" || !profile.code_bootstrap.command.trim()
+            || typeof profile.code_bootstrap.policy_ref !== "string" || !profile.code_bootstrap.policy_ref.trim()))
         || (profile.execution === undefined ? profile.schema_id === "dd-flow/project-execution@3" : !isExecutionRouting(profile.execution))) {
         throw new AppError("execution_profile_invalid", "Project execution profile does not match its supported dd-flow schema", 1);
     }

package/dist/services/vnext-fanout.js

@@ -3,14 +3,17 @@ import path from "node:path";
 import { AppError } from "../shared/errors.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { requireProjectByRoot } from "./projects.js";
-import { getFlowRunVariables, appendFlowRunTimelineEvent } from "./runs.js";
+import { getFlowRunVariables, appendFlowRunTimelineEvent, readFlowRunExecutionBundle } from "./runs.js";
 import { resolveExecutionPolicy } from "./execution-policy.js";
-import { listWorks, failWork, cancelWork } from "./work-registry.js";
+import { listWorks, failWork, cancelWork, readWorkBatchCustody } from "./work-registry.js";
 import { storageSessionId } from "./session-identity.js";
 import { reconcileUnfinishedChecks } from "./code-checks.js";
 import { vnextStageDirectory } from "../domain/stage-catalog.js";
 import { stageWorkIds, stageGraphScope } from "./stage-work-graph.js";
-import { eligibleCodexChildOverload } from "./codex-capacity.js";
+import { eligibleProviderChildOverload } from "./provider-capacity.js";
+import { renderNativeChildFollowupInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { readDescriptorRootWork } from "./descriptor-root-work.js";
+import { selectMemoryCompositionRegistration } from "./memory-composition-registration.js";
 import { safeNativeFailure } from "../harness-runtime/lib/native-children.mjs";
 export const subagentCapacityKey = "runtime.subagent.available_slots";
 /** External concurrency is policy, never evidence of native child qualification. */
@@ -20,17 +23,29 @@ export function getStageFanoutCapacity(context, input) {
     const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]);
     if (!run)
         throw new AppError("not_found", "RUN is unavailable", 1);
-    const frozen = JSON.parse(run.index_json).execution_profile;
-    if (frozen?.settings.execution) {
+    const index = JSON.parse(run.index_json);
+    const bundle = index.execution_bundle ? readFlowRunExecutionBundle(context, { projectRoot, runId: input.runId }) : null;
+    const generic = bundle?.execution.work(input.stage).delegation;
+    if (generic?.mode === "external")
+        return input.nativeOnly
+            ? { run_key: null, available_slots: null, source: "harness_qualification" }
+            : { run_key: null, available_slots: generic.max_parallel, source: "external_policy" };
+    // Generic native admission already requires a scoped capacity receipt whose
+    // observed count covers this frozen limit. Mutable legacy variables cannot
+    // replace that receipt or silently prevent its productive dispatch.
+    if (generic?.mode === "native")
+        return { run_key: null, available_slots: generic.max_parallel, source: "harness_qualification" };
+    const frozen = index.execution_profile;
+    if (!bundle && frozen?.settings.execution) {
         if (!frozen.agent_profiles)
             throw new AppError("execution_profile_not_frozen", "Fan-out needs the RUN's frozen profiles", 1);
         const resolved = resolveExecutionPolicy({ ddFlowHome: context.ddFlowHome, policy: frozen.settings.execution, profiles: frozen.agent_profiles, stage: input.stage });
-        if (resolved.delegation.mode === "external")
+        if (resolved.delegation.mode === "external" && !input.nativeOnly)
             return { run_key: null, available_slots: resolved.delegation.max_parallel, source: "external_policy" };
     }
     const variables = getFlowRunVariables(context, { projectRoot, runId: input.runId });
     const available = variables.variables[subagentCapacityKey];
-    return { run_key: subagentCapacityKey, available_slots: typeof available === "number" && Number.isInteger(available) && available >= 0 ? available : null, source: "harness_qualification" };
+    return { run_key: subagentCapacityKey, available_slots: typeof available === "number" && Number.isInteger(available) && available >= 0 ? Math.min(available, generic?.max_parallel ?? available) : null, source: "harness_qualification" };
 }
 function nativeFailureController(context, projectId, runId, stage, parent) {
     if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type='table' AND name='run_controllers'"))
@@ -113,17 +128,64 @@ export function readFanoutDescriptor(stageRoot) {
     }
     return value;
 }
+/** Memory graphs are SQL-owned; a mutable/missing fanout.json is not their
+ * dispatch authority. Domain registrations and Work launch owners still fence
+ * productive assignments, including reviewer/correction waves.
+ */
+export function memoryStageFanoutDescriptor(context, input) {
+    if (!["compose", "review"].includes(input.stage))
+        return null;
+    const project = requireProjectByRoot(context, resolveProjectRoot(input.projectRoot));
+    const run = context.db.get("SELECT flow_kind,index_json FROM runs WHERE project_id=? AND id=?", [project.id, input.runId]);
+    if (run?.flow_kind !== "mb-init")
+        return null;
+    const bundle = readFlowRunExecutionBundle(context, input);
+    if (!bundle || bundle.descriptor.descriptor.id !== "mb-init")
+        throw new AppError("stage_graph_compatibility_required", "Memory graph requires its admitted RUN bundle", 1);
+    const index = JSON.parse(run.index_json);
+    if (index.current_stage !== input.stage || !index.stage_runs.some(stage => stage.stage === input.stage && stage.status === "running"))
+        return null;
+    const root = readDescriptorRootWork(context, { projectId: project.id, runId: input.runId }, bundle);
+    const scope = stageGraphScope(context, project.id, input.runId, input.stage), members = stageWorkIds(context, project.id, input.runId, input.stage);
+    if (root.status !== "running" || !members.has(root.workId))
+        throw new AppError("stage_graph_conflict", "Memory graph lost its active coordinator", 1);
+    for (const id of members) {
+        if (id === root.workId)
+            continue;
+        const work = context.db.get("SELECT parent_work_id,result_schema FROM works WHERE project_id=? AND run_id=? AND work_id=?", [project.id, input.runId, id]);
+        const schemas = input.stage === "compose" ? ["dd-flow/memory-composition-work-result@1"] : ["dd-flow/memory-review-work-result@1", "dd-flow/memory-repair-work-result@1"];
+        if (!work || work.parent_work_id !== root.workId || !schemas.includes(work.result_schema ?? ""))
+            throw new AppError("stage_graph_conflict", "Memory graph contains an unassigned Work", 1);
+        const custody = readWorkBatchCustody(context, id);
+        if (custody.scope.project_id !== scope.project_id || custody.scope.run_id !== scope.run_id || custody.scope.attempt !== scope.attempt
+            || custody.scope.cycle !== scope.cycle || custody.scope.stage !== input.stage || custody.scope.parent_work_id !== root.workId)
+            throw new AppError("stage_graph_conflict", "Memory graph contains foreign allocation custody", 1);
+    }
+    if (input.stage === "compose") {
+        const children = context.db.all("SELECT work_id FROM works WHERE project_id=? AND run_id=? AND parent_work_id=?", [project.id, input.runId, root.workId]).filter(work => members.has(work.work_id));
+        const registered = context.db.get("SELECT 1 FROM audit_events WHERE project_id=? AND event_type='memory.composition_registration' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.scope.attempt')=? AND json_extract(payload_json,'$.scope.cycle')=? LIMIT 1", [project.id, input.runId, scope.attempt, scope.cycle]);
+        if (children.length || registered) {
+            const registration = selectMemoryCompositionRegistration(context, { ...scope, stage: "compose", parent_work_id: root.workId });
+            const ids = new Set(Object.values(registration.work_ids));
+            if (ids.size !== children.length || children.some(work => !ids.has(work.work_id)))
+                throw new AppError("stage_graph_conflict", "Memory composition differs from its registered graph", 1);
+        }
+    }
+    return { schema_id: "dd-flow/work-fanout@2", kind: "work_fanout", scope, stage: input.stage, parent_work_id: root.workId, dispatch: "none", capacity_required: true };
+}
 /** Read-only projection for an external orchestrator.  dd-flow keeps the graph authority. */
 export function getVnextFanoutStatus(context, input) {
     const projectRoot = resolveProjectRoot(input.projectRoot);
     const project = requireProjectByRoot(context, projectRoot);
-    const run = context.db.get("SELECT run_root FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]);
+    const run = context.db.get("SELECT run_root, index_json FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]);
     if (!run)
         throw new AppError("not_found", "RUN is not registered", 1, { run_id: input.runId });
     if (!run.run_root)
         throw new AppError("runtime_artifact_missing", "RUN artifact root is unavailable", 1, { run_id: input.runId });
-    const stageRoot = path.join(run.run_root, vnextStageDirectory(input.stage));
-    let descriptor = readFanoutDescriptor(stageRoot);
+    const index = JSON.parse(run.index_json);
+    const bundle = index.execution_bundle ? readFlowRunExecutionBundle(context, { projectRoot, runId: input.runId }) : null;
+    const stageRoot = path.join(run.run_root, bundle ? bundle.descriptor.stage(input.stage).directory : vnextStageDirectory(input.stage));
+    let descriptor = memoryStageFanoutDescriptor(context, input) ?? readFanoutDescriptor(stageRoot);
     // Registration is authoritative even if projection publication was interrupted,
     // or an otherwise review-off stage acquired an aggregate repair graph.
     if (!descriptor && context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'repair_intents'")) {
@@ -201,7 +263,7 @@ export async function reconcileVnextFanout(context, input) {
             continue;
         }
         const link = active[0];
-        if (value.harness_id === "codex-desktop" && eligibleCodexChildOverload(child, value.parent_session_id)) {
+        if (renderNativeChildFollowupInstruction(String(value.harness_id), String(child.session_id)) && eligibleProviderChildOverload(child, value.parent_session_id)) {
             issues.push({ code: "child_capacity_pending", work_id: link.work_id, session_id: child.session_id });
             continue;
         }

package/dist/services/vnext-merge.js

@@ -232,6 +232,7 @@ export function applyVnextMerge(context, input) {
             throw new AppError("merge_apply_receipt_invalid", "Existing merge apply receipt does not match the active request", 1, { receipt_path: receiptFile });
         return receipt;
     }
+    requireBootstrapCommand(requireRun(context, request.project_id, request.run_id));
     heartbeatLaneLock(context, { projectRoot: input.projectRoot, lane: "merge", workerId: request.executor_work_id, workspacePath: request.target_workspace, ttlSeconds: 7200 });
     assertExecutionBaseline(request);
     input.progress?.(`applying ${request.source_commit} to ${request.target_branch}`);
@@ -316,7 +317,7 @@ export async function finishVnextMerge(context, input, prepared = prepareVnextMe
     if (failed.length) {
         context.db.run("UPDATE merge_requests SET status = 'action_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "merge_gate_failed", failures: failed }), context.now(), request.merge_request_id]);
         const sourceRepair = failed.every(receipt => checkRepairDisposition(receipt) === "source_repair");
-        throw new AppError("merge_gate_failed", "Integrated target checks failed. Only assertion-backed failures permit source repair; tooling or unknown evidence requires diagnosis/settlement first.", 2, { failures: failed, ...(sourceRepair ? { repair_command: repairCommand(context, request, projectRoot) } : { outcome: "blocked", recoverable: false }), continuation: { ...recoveryEvidenceInput(run.run_root, failed[0].id), command_after_input: finishCommand(context, run.id, request, projectRoot, failed[0].id) } });
+        throw new AppError("merge_gate_failed", "Integrated target checks failed. Only candidate-source-backed failures permit source repair; tooling or unknown evidence requires diagnosis/settlement first.", 2, { failures: failed, ...(sourceRepair ? { repair_command: repairCommand(context, request, projectRoot), continuation: { ...recoveryEvidenceInput(run.run_root, failed[0].id), command_after_input: finishCommand(context, run.id, request, projectRoot, failed[0].id) } } : { outcome: "blocked", recoverable: false }) });
     }
     const passedRefs = new Set(receipts.flatMap((receipt) => receipt.check_refs));
     const missingRefs = frozenGateRefs(gate).filter((ref) => !passedRefs.has(ref));
@@ -567,10 +568,14 @@ function protocolIds(home) { const root = path.join(home, "03-plan"); if (!fs.ex
 function workspaceRoute(home) { const file = path.join(home, "02-protocolize", "workspace-route.json"); const value = JSON.parse(fs.readFileSync(file, "utf8")); if (!value.policy?.integration_branch)
     throw new AppError("workspace_route_missing", "MERGE requires the frozen integration branch", 1, { file }); return { integration_branch: value.policy.integration_branch }; }
 function executionSettings(run) { return JSON.parse(run.index_json).execution_profile?.settings ?? {}; }
-async function runBootstrap(context, run, cwd, mergeId, progress) {
+function requireBootstrapCommand(run) {
     const command = executionSettings(run).code_bootstrap?.command;
     if (!command)
-        throw new AppError("execution_profile_invalid", "MERGE requires a frozen workspace bootstrap command", 2);
+        throw new AppError("execution_profile_invalid", "MERGE requires an evidenced bootstrap command in the frozen RUN profile; configure code_bootstrap before starting a code-ready RUN", 2);
+    return command;
+}
+async function runBootstrap(context, run, cwd, mergeId, progress) {
+    const command = requireBootstrapCommand(run);
     const result = await runWorkspaceBootstrap(context, { projectId: run.project_id, runId: run.id, runHome: requireHome(run), workspaceRoot: cwd, command, artifactDir: `${stageDir}/${mergeId}/readiness`, progress });
     if (result.exit_code !== 0 || result.error)
         throw new AppError("merge_bootstrap_failed", "Integrated target bootstrap failed; inspect its retained logs", 2, { command, ...result });

package/dist/services/vnext-plan-review.js

@@ -1,6 +1,6 @@
 import { managedLifecycleCommand } from "./lifecycle-invocations.js";
 import crypto from "node:crypto";
-import { withStageSettlement, prepareFlowRunStageAttachment, prepareFlowRunStageCompletion } from "./runs.js";
+import { withStageSettlement, prepareFlowRunStageAttachment, prepareFlowRunStageCompletion, readFlowRunExecutionBundle } from "./runs.js";
 import fs from "node:fs";
 import path from "node:path";
 import { AppError } from "../shared/errors.js";
@@ -50,7 +50,7 @@ export function prepareVnextPlanReviewStart(context, input) {
             return { ...common, state: "terminal", report, outcome };
         throw new AppError("invalid_work_state", "PLAN-REVIEW is already terminal; corrections are applied in the same review Work and are not re-reviewed automatically", 2, { run_id: run.id, outcome });
     }
-    const workspaceRoute = requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: home, workspaceRoot: run.workspace_root, stage: "plan-review" });
+    const workspaceRoute = requireVnextWorkspaceRoute(context, { projectRoot, runId: run.id, runHome: home, workspaceRoot: run.workspace_root, stage: "plan-review" });
     if (!fs.existsSync(path.join(planRoot, "stage-report.json")) || !fs.existsSync(batch))
         throw new AppError("runtime_artifact_missing", "PLAN-REVIEW requires the accepted PLAN report and proposed CODE batch", 1);
     const requested = requestedMode(run);
@@ -132,6 +132,7 @@ export function startVnextPlanReview(context, input, prepared = prepareVnextPlan
         commitVerificationMatrixStart(context, prepared.matrix, () => attachFlowRunStage(context, attachmentInput, attachment));
         const reportGit = gitFacts(run.workspace_root);
         const next = codeSuccessor(context, run.id, projectRoot);
+        const completionBundle = readFlowRunExecutionBundle(context, { projectRoot, runId: run.id });
         return withStageSettlement(context, () => {
             const registered = addWorkBatch(context, { parentWorkId: rootWork, prepared: prepared.codeItems, stage: "code" });
             const report = reportFor(context, { run, mode: effective, requested, outcome: "off", groups: [], batchChecksum, planChecksum, code: registered, now, projectRoot, flow: flowCommand(context), git: reportGit, ...(next.command ? { nextCommand: next.command } : {}) });
@@ -141,7 +142,7 @@ export function startVnextPlanReview(context, input, prepared = prepareVnextPlan
             const preparedReport = prepareStageReport(report);
             acceptStageReport(context, { projectId: project.id, runId: run.id, stage, root, prepared: preparedReport });
             const completionInput = { projectRoot, runId: run.id, stage, status: "done", data: "stage-report.json", dataSchemaId: "dd-flow/stage-report@1", report: "stage-report.md", stageReport: "stage-report.html", dataSha256: preparedReport.sha256, git: reportGit };
-            completeFlowRunStage(context, completionInput, prepareFlowRunStageCompletion(context, completionInput));
+            completeFlowRunStage(context, completionInput, prepareFlowRunStageCompletion(context, completionInput, completionBundle));
             advanceFlowRun(context, { settlementStage: "plan-review", projectRoot, runId: run.id, status: "running", verdict: "plan_review_off", nextAction: "start_code" });
             appendFlowRunTimelineEvent(context, project.id, run.id, { type: "plan_review_opened", mode: effective, outcome: "off" });
             return { ok: true, run_id: run.id, stage, outcome: "review_off", ...(externalContext ? { external_context: externalContext } : {}), plan_review: { requested_mode: requested, effective_mode: effective, policy_source: policySource(run), reason: "No applicable independent review group." }, next };
@@ -209,7 +210,7 @@ export function dispatchVnextPlanReview(context, input) {
     }
     const created = context.db.all("SELECT work_id, task, status, launch_policy, created_at FROM works WHERE project_id = ? AND run_id = ? AND parent_work_id = ?", [project.id, run.id, parent.work_id]);
     const reviews = groups.map((group) => { const work = created.find((item) => item.task === group.task); if (!work)
-        throw new AppError("runtime_missing", "Reviewer Work was not created", 1, { group: group.key }); const ready = work.status === "created" && isReviewWorkReady(context, work.work_id); return { group: group.key, work_id: work.work_id, status: work.status, depends_on: group.depends_on, ready, ...(ready ? { start_command: workStartCommand(context, { ...work, project_id: project.id, run_id: run.id }) } : {}) }; });
+        throw new AppError("runtime_missing", "Reviewer Work was not created", 1, { group: group.key }); const ready = work.status === "created" && isReviewWorkReady(context, work.work_id); return { group: group.key, work_id: work.work_id, status: work.status, depends_on: group.depends_on, ready, ...(ready ? { start_command: workStartCommand(context, { ...work, project_id: project.id, run_id: run.id }, { preview: true }) } : {}) }; });
     refreshRunWorkProjection(context, project.id, run.id);
     appendFlowRunTimelineEvent(context, project.id, run.id, { type: "plan_review_dispatched", work_id: parent.work_id, groups: reviews.map((item) => ({ group: item.group, work_id: item.work_id })) });
     const waves = plannedReviewWaves(groups, capacity.availableSlots);
@@ -329,6 +330,7 @@ function finishPlanReviewOwned(context, input) {
     const reportGit = gitFacts(run.workspace_root);
     const next = codeSuccessor(context, run.id, projectRoot);
     const matrix = prepareRunVerificationMatrix(context, { projectId: project.id, runId: run.id, stage, role: "output", semanticFile: decisionPath });
+    const completionBundle = readFlowRunExecutionBundle(context, { projectRoot, runId: run.id });
     return withStageSettlement(context, () => {
         const registered = addWorkBatch(context, { parentWorkId: codeParentId, prepared: codeItems, stage: "code" });
         const now = context.now();
@@ -343,7 +345,7 @@ function finishPlanReviewOwned(context, input) {
         acceptStagePacket(context, { projectId: project.id, runId: run.id, stage, prepared: decisionReceipt });
         acceptStageReport(context, { projectId: project.id, runId: run.id, stage, root, prepared: preparedReport });
         const completionInput = { projectRoot, runId: run.id, stage, status: "done", data: "stage-report.json", dataSchemaId: "dd-flow/stage-report@1", report: "stage-report.md", stageReport: "stage-report.html", dataSha256: preparedReport.sha256, git: reportGit };
-        completeFlowRunStage(context, completionInput, prepareFlowRunStageCompletion(context, completionInput));
+        completeFlowRunStage(context, completionInput, prepareFlowRunStageCompletion(context, completionInput, completionBundle));
         refreshRunWorkProjection(context, project.id, run.id);
         advanceFlowRun(context, { settlementStage: "plan-review", projectRoot, runId: run.id, status: "running", verdict: "plan_review_accepted", nextAction: "start_code" });
         appendFlowRunTimelineEvent(context, project.id, run.id, { type: "plan_review_accepted", work_id: parent.work_id, code: registered });

package/dist/services/vnext-plan.js

@@ -33,7 +33,7 @@ export function prepareVnextPlanStart(context, input) {
     const project = requireProjectByRoot(context, projectRoot);
     const run = requireRun(context, projectRoot, input.runId);
     const home = requireHome(run);
-    const workspaceRoute = requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: home, workspaceRoot: run.workspace_root, stage: "plan" });
+    const workspaceRoute = requireVnextWorkspaceRoute(context, { projectRoot, runId: run.id, runHome: home, workspaceRoot: run.workspace_root, stage: "plan" });
     const protocols = protocolIds(home);
     if (!protocols.length)
         throw new AppError("runtime_artifact_missing", "PLAN requires accepted PROTOCOLIZE protocols", 1);
@@ -136,7 +136,7 @@ export function startVnextPlan(context, input, prepared = prepareVnextPlanStart(
 export function prepareVnextPlanFinish(context, input) {
     const projectRoot = resolveProjectRoot(input.projectRoot);
     const run = requireRun(context, projectRoot, input.runId), home = requireHome(run);
-    requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: home, workspaceRoot: run.workspace_root, stage: "plan" });
+    requireVnextWorkspaceRoute(context, { projectRoot, runId: run.id, runHome: home, workspaceRoot: run.workspace_root, stage: "plan" });
     const protocols = protocolIds(home);
     assertProtocolWorkspace(run.workspace_root, protocols);
     const prepared = prepareVnextPlanArtifacts(context, { projectRoot, workspaceRoot: run.workspace_root, runId: run.id, home, protocols });
@@ -153,7 +153,7 @@ function finishVnextPlanOwned(context, input) {
     const run = requireRun(context, projectRoot, input.runId);
     const home = requireHome(run);
     const root = path.join(home, "03-plan");
-    requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: home, workspaceRoot: run.workspace_root, stage: "plan" });
+    requireVnextWorkspaceRoute(context, { projectRoot, runId: run.id, runHome: home, workspaceRoot: run.workspace_root, stage: "plan" });
     const protocols = protocolIds(home);
     if (!protocols.length)
         throw new AppError("runtime_artifact_missing", "PLAN requires accepted PROTOCOLIZE protocols", 1);

package/dist/services/vnext-protocolize.js

@@ -10,7 +10,7 @@ import { projectFeatureWorktreePath, resolveProjectRoot } from "../storage/paths
 import { previewNextEntityId } from "./ids.js";
 import { registerProtocol } from "./protocols.js";
 import { requireProjectByRoot } from "./projects.js";
-import { advanceFlowRun, appendFlowRunTimelineEvent, attachFlowRunStage, completeFlowRunStage, prepareFlowRunStageAttachment, prepareFlowRunStageCompletion, withStageSettlement, gitFacts, rebindFlowRunWorkspace } from "./runs.js";
+import { advanceFlowRun, appendFlowRunTimelineEvent, attachFlowRunStage, completeFlowRunStage, prepareFlowRunStageAttachment, prepareFlowRunStageCompletion, withStageSettlement, gitFacts, rebindFlowRunWorkspace, publishRunProjections } from "./runs.js";
 import { resolveStageTransition, stageExecutionCwd } from "./execution-policy.js";
 import { validateSchema } from "./schema-validation.js";
 import { assertStageStartHookEvent, hookSessionIdentity } from "./hooks.js";
@@ -21,6 +21,8 @@ import { loadVnextWorkspacePolicy, requireVnextWorkspaceRoute, vnextRunBranch }
 import { readVnextSpecifyResult } from "./vnext-specify.js";
 import { flowCommand, stagePauseCommand, stagePauseCommandTemplate } from "./stage-pause.js";
 import { acceptStageReport, prepareStageReport, publishStageReport } from "./stage-report-renderer.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { assertRunMutationAllowed } from "./run-recovery.js";
 import { currentStagePrompt, applyExternalStageContext, prepareExternalStageContext, renderRunOperationalContext } from "./stage-context.js";
 import { prepareJsonSchema, prepareOutputFile } from "../cli/input-preparation.js";
 import { stageLifecycleInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
@@ -202,7 +204,7 @@ export async function finishVnextProtocolize(context, input) {
             throw new AppError("protocolize_intent_conflict", "Completed PROTOCOLIZE result differs from accepted input", 1, { run_id: run.id });
         const currentStage = acceptedIndex.current_stage ?? [...acceptedIndex.stage_runs].reverse().find(item => item.status === "running" || item.status === "done")?.stage;
         const activeReplay = currentStage === stage && acceptedIndex.status === "running";
-        const resolvedPolicy = activeReplay ? requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" }) : accepted.mechanical?.workspace_route;
+        const resolvedPolicy = activeReplay ? requireVnextWorkspaceRoute(context, { projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" }) : accepted.mechanical?.workspace_route;
         if (activeReplay) {
             if (acceptedIndex.verdict !== "protocolized")
                 advanceFlowRun(context, { settlementStage: "protocolize", projectRoot, runId: run.id, status: "running", verdict: "protocolized", nextAction: "start_plan" });
@@ -212,7 +214,7 @@ export async function finishVnextProtocolize(context, input) {
         return { ok: true, outcome: "protocolized", run_id: run.id, protocol_ids: accepted.semantic.acceptance, workspace_root: run.workspace_root, git_policy: resolvedPolicy, next_action: activeReplay ? "await_plan" : acceptedIndex.next_action, ...("command" in next && next.command ? { next_command: next.command } : {}), next,
             artifacts: { result: resultFile, report_json: file, report_markdown: path.join(root, "stage-report.md"), report_html: path.join(root, "stage-report.html"), protocols: accepted.semantic.acceptance.map(id => path.join(run.workspace_root, ".memory-bank/protocol", id, "summary.md")) } };
     }
-    const resolvedPolicy = requireVnextWorkspaceRoute({ projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" });
+    const resolvedPolicy = requireVnextWorkspaceRoute(context, { projectRoot, runId: run.id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, stage: "protocolize" });
     const acceptedObligations = acceptedSpecifyObligations(context, projectRoot, run.id, path.join(requireRunHome(run), "01-specify", "specify.json"));
     let obligations;
     try {
@@ -699,6 +701,11 @@ function renderPrompt(input) {
     return ["<work_context>", `- RUN: ${input.runId}`, `- Work: ${input.workId}`, `- Accepted SPECIFY JSON: ${input.specifyPath}`, `- Handoff: ${input.handoff.stage_handoff.effective}`, "</work_context>", "", "<accepted_obligations>", obligationList, "</accepted_obligations>", "", "<frozen_git_policy>", `- route: ${input.policy.route}`, `- integration branch: ${input.policy.integration_branch ?? "not applicable"}`, `- base ref: ${input.policy.base_ref ?? "not applicable"}`, `- feature branch: ${input.policy.feature_branch ?? "not applicable"}`, `- service worktree: ${input.policy.worktree_path ?? "not applicable"}`, `- bootstrap: ${input.policy.bootstrap_status}`, `- decision: ${input.policy.reason}`, "The CLI already created and bootstrapped this workspace at PROTOCOLIZE start. Do not create branches, worktrees, protocol files or Git commits yourself. This transition Work may run from the stable session; edit only the supplied RUN result file.", "</frozen_git_policy>", "", "<catalog>", input.catalog.length ? input.catalog.map((x) => `- ${x}`).join("\n") : "- inactive", "</catalog>", "", "<stage_instructions>", input.template.trim(), "</stage_instructions>", "", "<output_contract>", `Edit only ${input.resultPath}. Keep this exact JSON shape; CLI allocates ids and writes PRT/PSET/feature documents in the already provisioned workspace:\n\n\`\`\`json\n${JSON.stringify(resultTemplate(input.obligations), null, 2)}\n\`\`\``, "obligation_id values and their one-per-obligation entries are prefilled by the CLI. Preserve those IDs exactly; change only member_keys when semantic ownership requires it. The CLI rejects unknown, duplicate or missing obligations, and every member must own at least one AC-*.", "If PROTOCOLIZE itself exposes a material user decision with no reasonable default, do not finish and do not return to SPECIFY. Write the question packet to the named text file, then run the separate standalone lifecycle command below. Do not combine file creation and dd-flow in one shell command:", "```sh", input.pauseCommandTemplate, "```", "Ask the returned user_message and stop. Resume this same PROTOCOLIZE Work using the exact command returned by pause.", `When the answer is incorporated and the result is protocolized, finish:\n\n${input.finishCommand}`, stageLifecycleInstruction, "</output_contract>", ""].join("\n");
 }
 function prepareWorkspaceForProtocolize(context, projectRoot, projectId, run, stageRoot) {
+    // A committed rebind may have survived a projection crash. Repair only from
+    // its SQL authority before considering physical creation again.
+    const stored = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, run.id]);
+    if (stored && JSON.parse(stored.index_json).workspace_route)
+        publishRunProjections(context, projectId, run.id);
     const receiptPath = path.join(stageRoot, "workspace-route.json");
     if (fs.existsSync(receiptPath))
         return { kind: "retained", policy: readWorkspaceRouteReceipt(stageRoot).policy };
@@ -727,7 +734,9 @@ function prepareWorkspaceForProtocolize(context, projectRoot, projectId, run, st
         throw error;
     }
     prepareManagedWorktreeBootstrapSources(projectRoot);
-    return { kind: "feature", receiptPath, config, stableFacts, sessionMode, branch, create };
+    return { kind: "feature", receiptPath, config, stableFacts, sessionMode, branch, create,
+        expectedRevision: stored ? JSON.parse(stored.index_json).runtime_revision ?? 0 : 0,
+        expectedGeneration: assertRunMutationAllowed(context, projectId, run.id) };
 }
 async function provisionWorkspaceForProtocolize(context, projectRoot, run, prepared) {
     if (prepared.kind === "retained")
@@ -740,9 +749,14 @@ async function provisionWorkspaceForProtocolize(context, projectRoot, run, prepa
     const { config, stableFacts, sessionMode, branch, create } = prepared;
     const created = await createManagedWorktree(context, create, create);
     const bootstrap = await bootstrapManagedWorktree(context, { projectRoot, worktreePath: created.worktreePath });
-    rebindFlowRunWorkspace(context, { projectRoot, runId: run.id, workspaceRoot: created.worktreePath, reason: "PROTOCOLIZE start provisioned the configured feature-worktree route" });
     const policy = { route: "feature_worktree", integration_branch: config.workspace.integration_branch, base_ref: stableFacts.head, feature_branch: branch, worktree_path: created.worktreePath, reason: "Project workspace configuration requires a managed feature worktree before durable protocol documents exist.", provision_stage: "protocolize_start", stage_session_mode: sessionMode, provisioned: true, bootstrap_status: bootstrap.status };
-    writeJson(receiptPath, { schema_id: "dd-flow/vnext-workspace-route@1", policy, created, bootstrap });
+    const receipt = { schema_id: "dd-flow/vnext-workspace-route@1", policy,
+        created: { worktreePath: created.worktreePath, worktrunk: created.worktrunk, command: [], result: { exit_code: 0, stdout: "", stderr: "" }, response: { workspace_path: created.worktreePath } },
+        bootstrap: { status: bootstrap.status, commands: [] },
+        proof: { creation_sha256: hybridDigest(created), bootstrap_sha256: hybridDigest(bootstrap) } };
+    rebindFlowRunWorkspace(context, { projectRoot, runId: run.id, workspaceRoot: created.worktreePath, routeReceipt: receipt,
+        expectedRevision: prepared.expectedRevision, expectedGeneration: prepared.expectedGeneration,
+        reason: "PROTOCOLIZE start provisioned the configured feature-worktree route" });
     return policy;
 }
 function readWorkspaceRouteReceipt(root) {

package/dist/services/vnext-workspace-policy.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
 import { AppError } from "../shared/errors.js";
-import { gitFacts } from "./runs.js";
+import { gitFacts, publishRunProjections } from "./runs.js";
 const configRelativePath = path.join(".memory-bank", "dd-flow", "project-workspace.json");
 /** The runtime reads explicit configuration; it never attempts to infer route from policy prose. */
 export function loadVnextWorkspacePolicy(projectRoot) {
@@ -53,8 +53,13 @@ export function vnextRunBranch(policy, run) {
  * The route receipt is the single source of truth after PROTOCOLIZE provisions
  * the workspace. Every later mutating vNext stage calls this before it opens.
  */
-export function requireVnextWorkspaceRoute(input) {
+export function requireVnextWorkspaceRoute(context, input) {
     const file = path.join(input.runHome, "02-protocolize", "workspace-route.json");
+    const stored = context.db.get("SELECT project_id,index_json FROM runs WHERE project_root = ? AND id = ?", [input.projectRoot, input.runId]);
+    // Productive lifecycle readback repairs only SQL-committed projections. The
+    // status command never calls this path and cannot mutate historical files.
+    if (stored && JSON.parse(stored.index_json).workspace_route)
+        publishRunProjections(context, stored.project_id, input.runId);
     let receipt;
     try {
         receipt = JSON.parse(fs.readFileSync(file, "utf8"));