@deksden-com/dd-flow-cli 0.9.0-beta.137 → 0.9.0-beta.139

package/dist/services/work-registry.js

@@ -1,5 +1,17 @@
 import { bindLifecyclePacketAssignments, managedLifecycleCommand, prepareWorkStartAuthority, issueLifecycleInvocation, retireWorkPacketAuthorities } from "./lifecycle-invocations.js";
-import { bindStageWork, currentStageWorkIds, stageWorkIds } from "./stage-work-graph.js";
+import { bindStageWork, currentStageWorkIds, stageWorkIds, stageGraphScope } from "./stage-work-graph.js";
+import { PreparedRegisteredMemoryCompositionWorkResult } from "./memory-composition-work-custody.js";
+import { prepareMemoryReviewWorkInput } from "./memory-review-work-input.js";
+import { prepareExternalMemoryRepairCopyFromStage, restoreStartedMemoryRepairCopyFromStage, prepareMemoryRepairDispatchFromStage, prepareMemorySecondRepairDispatchFromStage, prepareMemorySecondRepairLaunchFromStage, restoreStartedMemorySecondRepairLaunchFromStage } from "./memory-review-handler.js";
+import { PreparedSecondMemoryRepairLaunch } from "./memory-second-repair-launch.js";
+import { PreparedRegisteredMemoryReviewWorkResult } from "./memory-review-work-custody.js";
+import { PreparedPublishedMemoryRepairWorkResult } from "./memory-repair-work-custody.js";
+import { prepareMemoryRepairWorkCompletion, publishMemoryRepairWorkCompletion } from "./memory-repair-work-completion.js";
+import { prepareRegisteredMemoryWorkResult } from "./memory-work-result-preparation.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { memoryRepairExecutionIdentity } from "./memory-repair-physical-binding.js";
+import { prepareMemoryNativeReviewCopy } from "./memory-native-review-copy.js";
+import { readDescriptorStageInput } from "./descriptor-stage-coordinator.js";
 import { runtimeCommand } from "./runtime-command.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -14,8 +26,8 @@ import { prepareAgentOutputFile } from "../storage/agent-output.js";
 import { refreshRunSessionProjection } from "./run-projection.js";
 import { assertSourceRepairEligible, ignoredWorkspacePaths, normalizeWorkspacePath, readCodeCheckProfile, runCodeChecks, validateCheckDeclaration, validateFailedCheckRetry, workspaceFingerprint } from "./code-checks.js";
 import { nextWorkId, nextWorkIds } from "./ids.js";
-import { appendFlowRunTimelineEvent } from "./runs.js";
-import { resolveStageTransition } from "./execution-policy.js";
+import { appendFlowRunTimelineEvent, publishRunProjections, assertRunBundleSqlAuthority, assertPreparedRunBundleSqlAuthority, readFlowRunExecutionBundle } from "./runs.js";
+import { resolveStageTransition, runtimeHarness } from "./execution-policy.js";
 import { appendAudit } from "./audit.js";
 import { flowCommand } from "./stage-pause.js";
 import { assertPortableArtifactRef } from "./portable-refs.js";
@@ -28,7 +40,7 @@ import { acceptedDecisionPrecedence, loadExternalStageContext, renderRetainedSta
 import { reviewEnvironmentAllowed, reviewExecutionCopyHash, reviewSourceHash, reviewSourcePaths } from "./review-copy.js";
 import { latestRunVerificationMatrix, verificationMatrixInstruction, verificationMatrixContract } from "./verification-matrix.js";
 const workColumns = "work_id, project_id, run_id, parent_work_id, task, launch_policy, result_schema, payload_json, depends_on_json, status, result, created_at, started_at, updated_at, completed_at";
-export function ensureWorkRegistry(context) { context.db.exec("SELECT 1 FROM works LIMIT 1"); context.db.exec("SELECT 1 FROM work_sessions LIMIT 1"); }
+export function ensureWorkRegistry(context) { context.db.get("SELECT 1 FROM works LIMIT 1"); context.db.get("SELECT 1 FROM work_sessions LIMIT 1"); }
 function ownsPhysicalWorkSession(context, projectId, owner, identity) {
     if (identity.sessionId !== owner.session_id)
         return false;
@@ -50,6 +62,15 @@ export function assertStageLifecycleOwner(context, input) {
     if (!project)
         throw new AppError("not_found", "Project is not registered", 1, { project_root: projectRoot });
     requireRun(context, project.id, input.runId);
+    const runIndex = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]).index_json);
+    const boundScope = assertRunBundleSqlAuthority(context, { projectId: project.id, runId: input.runId }, runIndex.execution_bundle)
+        ? stageGraphScope(context, project.id, input.runId, input.stage) : null;
+    if (boundScope && (runIndex.current_stage !== input.stage || !runIndex.stage_runs.some(stage => stage.stage === input.stage))) {
+        throw new AppError("trusted_session_binding_required", "Stage lifecycle command does not belong to the current frozen stage", 1, { run_id: input.runId, stage: input.stage, reason: "inactive_stage" });
+    }
+    const boundOwnerClause = boundScope ? `AND s.run_id = ? AND s.current_stage = ?
+    AND EXISTS (SELECT 1 FROM stage_work_memberships m WHERE m.project_id = w.project_id AND m.run_id = w.run_id
+      AND m.work_id = w.work_id AND m.stage = ? AND m.attempt = ? AND m.cycle = ?)` : "";
     const scopedWork = input.workId ? requireWork(context, input.workId, { projectId: project.id, runId: input.runId }) : undefined;
     let owner = context.db.get(`SELECT ws.id, ws.work_id, ws.session_id, ws.hook_event_id
        FROM work_sessions ws
@@ -57,8 +78,9 @@ export function assertStageLifecycleOwner(context, input) {
        JOIN sessions s ON s.project_id = w.project_id AND s.session_id = ws.session_id
       WHERE w.project_id = ? AND w.run_id = ? AND ws.status = 'running'
         AND w.status IN ('running', 'paused') AND (w.parent_work_id IS NULL OR s.current_stage = ?)
+        ${boundOwnerClause}
         ${scopedWork ? "AND w.work_id = ?" : ""}
-      ORDER BY ws.created_at DESC LIMIT 1`, scopedWork ? [project.id, input.runId, input.stage, scopedWork.work_id] : [project.id, input.runId, input.stage]);
+      ORDER BY ws.created_at DESC LIMIT 1`, [project.id, input.runId, input.stage, ...(boundScope ? [input.runId, input.stage, input.stage, boundScope.attempt, boundScope.cycle] : []), ...(scopedWork ? [scopedWork.work_id] : [])]);
     if (!owner && input.operation === "stage_finish" && ["code", "code-review"].includes(input.stage)) {
         const row = context.db.get("SELECT run_root, index_json FROM runs WHERE project_id = ? AND id = ?", [project.id, input.runId]);
         const index = row ? JSON.parse(row.index_json) : null;
@@ -83,6 +105,11 @@ export function assertStageLifecycleOwner(context, input) {
                 : [project.id, input.runId, path.join(root, completed.data)]);
         }
     }
+    // Completed-stage replay branches above retain their historical receipts, but
+    // cannot borrow a Session or coordinator that has moved to another bound scope.
+    if (owner && boundScope && (!context.db.get("SELECT 1 FROM sessions WHERE project_id = ? AND session_id = ? AND run_id = ? AND current_stage = ?", [project.id, owner.session_id, input.runId, input.stage])
+        || !context.db.get("SELECT 1 FROM stage_work_memberships WHERE project_id = ? AND run_id = ? AND work_id = ? AND stage = ? AND attempt = ? AND cycle = ?", [project.id, input.runId, owner.work_id, input.stage, boundScope.attempt, boundScope.cycle])))
+        owner = undefined;
     if (!owner)
         throw new AppError("trusted_session_binding_required", "Stage lifecycle command has no running coordinator Work/Session binding", 1, { run_id: input.runId, stage: input.stage, ...(input.workId ? { work_id: input.workId } : {}) });
     const identity = claimStageLifecycleHookEvent(context, {
@@ -157,6 +184,7 @@ export function validateWorkBatch(value) {
     assertNoParentCycles(items.filter((item) => Boolean(item.parent)).map((item) => ({ id: item.key, parent: item.parent })));
 }
 export function prepareWorkBatch(context, input) {
+    validateBatchRequest(input);
     if (input.file !== undefined && input.value !== undefined)
         throw new AppError("usage", "Work batch accepts either file or value, not both", 2);
     if (input.file === undefined && input.value === undefined)
@@ -191,11 +219,20 @@ function prepareBatchParent(context, parentWorkId, items) {
     return parent;
 }
 export function addWorkBatch(context, input) {
+    validateBatchRequest(input);
     const items = input.prepared ?? prepareWorkBatch(context, input);
     return context.db.writeTransaction(() => {
         // Only mutable authority/references are rechecked under the write lock.
         // Caller bytes were read once, before admission, and are never reopened.
         const parent = prepareBatchParent(context, input.parentWorkId, items);
+        const registration = input.requestKey ? batchRegistration(context, input, parent, items) : null;
+        if (registration?.prior) {
+            // The SQL commit may have succeeded while its prior projection failed.
+            // An unchanged index must still republish derived files on owned replay.
+            context.db.afterCommit(() => publishRunProjections(context, parent.project_id, parent.run_id));
+            scheduleObsoleteWorkProjectionCleanup(context, parent.project_id, parent.run_id);
+            return { ok: true, work_ids: registration.prior, replayed: true };
+        }
         const now = context.now();
         const allocated = nextWorkIds(context, parent.project_id, items.map((item) => item.key));
         const ids = new Map(items.map((item, index) => [item.key, allocated[index]]));
@@ -205,7 +242,9 @@ export function addWorkBatch(context, input) {
         assertNoParentCycles(proposed.map((item) => ({ id: item.id, parent: item.parentId })));
         for (const item of proposed)
             context.db.run(`INSERT INTO works (work_id, project_id, run_id, parent_work_id, task, launch_policy, result_schema, payload_json, depends_on_json, status, result, started_at, created_at, updated_at, completed_at)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'created', NULL, NULL, ?, ?, NULL)`, [item.id, parent.project_id, parent.run_id, item.parentId, item.task, item.launch_policy ?? "reuse_allowed", item.result_schema ?? null, item.payload ? JSON.stringify(item.payload) : null, JSON.stringify(item.dependencies), now, now]);
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'created', NULL, NULL, ?, ?, NULL)`, [item.id, parent.project_id, parent.run_id, item.parentId, item.task, item.launch_policy ?? "reuse_allowed", item.result_schema ?? null,
+                registration ? JSON.stringify({ ...item.payload, _dd_flow_batch_request: { request_sha256: registration.requestSha256, batch_sha256: registration.batchSha256, item_key: item.key } })
+                    : item.payload ? JSON.stringify(item.payload) : null, JSON.stringify(item.dependencies), now, now]);
         const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [parent.project_id, parent.run_id]);
         const stages = run ? (JSON.parse(run.index_json).stage_runs ?? []) : [];
         const ownerStage = input.stage ?? [...stages].reverse().find(stage => stage.status === "running")?.stage;
@@ -215,9 +254,115 @@ export function addWorkBatch(context, input) {
             appendFlowRunTimelineEvent(context, parent.project_id, parent.run_id, { type: "work_materialized", work_id: item.id, parent_work_id: item.parentId, depends_on: item.dependencies, launch_policy: item.launch_policy ?? "reuse_allowed" });
         }
         refreshRunWorkProjection(context, parent.project_id, parent.run_id);
-        return { ok: true, work_ids: Object.fromEntries(ids) };
+        const workIds = Object.fromEntries(ids);
+        if (registration)
+            appendAudit(context, { projectId: parent.project_id, eventType: "work.batch_registration", payload: {
+                    run_id: parent.run_id, scope: registration.scope, request_sha256: registration.requestSha256, batch_sha256: registration.batchSha256, work_ids: workIds,
+                    work_sha256: Object.fromEntries(proposed.map(item => [item.id, immutableBatchWorkDigest(requireWork(context, item.id))]))
+                } });
+        return { ok: true, work_ids: workIds, ...(registration ? { replayed: false } : {}) };
     });
 }
+function immutableBatchWorkDigest(work) {
+    return hybridDigest({ work_id: work.work_id, project_id: work.project_id, run_id: work.run_id,
+        parent_work_id: work.parent_work_id, task: work.task, launch_policy: work.launch_policy,
+        result_schema: work.result_schema, payload: work.payload_json === null ? null : JSON.parse(work.payload_json),
+        depends_on: JSON.parse(work.depends_on_json) });
+}
+/** Independent allocation custody only: this does not attest Session settlement,
+ * semantic acceptance, or that the retained stage is still active. Historical
+ * receipts without immutable hashes remain replayable but cannot grant custody.
+ */
+export function readWorkBatchCustody(context, id) {
+    const work = requireWork(context, id);
+    try {
+        const marker = JSON.parse(work.payload_json ?? "null")?._dd_flow_batch_request;
+        if (!marker || typeof marker.request_sha256 !== "string" || typeof marker.batch_sha256 !== "string" || typeof marker.item_key !== "string")
+            throw new Error("Missing ownership marker");
+        const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id = ? AND event_type = 'work.batch_registration' AND json_extract(payload_json, '$.request_sha256') = ?", [work.project_id, marker.request_sha256]);
+        if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 1024 * 1024)
+            throw new Error("Missing or ambiguous receipt");
+        const receipt = JSON.parse(rows[0].payload_json);
+        const scope = receipt.scope;
+        if (!scope || scope.project_id !== work.project_id || scope.run_id !== work.run_id || receipt.run_id !== work.run_id
+            || typeof scope.stage !== "string" || typeof scope.attempt !== "string" || typeof scope.cycle !== "string"
+            || typeof scope.parent_work_id !== "string" || typeof scope.request_key !== "string"
+            || receipt.request_sha256 !== marker.request_sha256 || hybridDigest(scope) !== marker.request_sha256
+            || receipt.batch_sha256 !== marker.batch_sha256
+            || !Object.hasOwn(receipt.work_ids ?? {}, marker.item_key) || receipt.work_ids[marker.item_key] !== work.work_id
+            || !Object.hasOwn(receipt.work_sha256 ?? {}, work.work_id) || receipt.work_sha256[work.work_id] !== immutableBatchWorkDigest(work)
+            || !context.db.get("SELECT 1 FROM works WHERE project_id = ? AND run_id = ? AND work_id = ?", [work.project_id, work.run_id, scope.parent_work_id])
+            || !context.db.get("SELECT 1 FROM works WHERE project_id = ? AND run_id = ? AND work_id = ?", [work.project_id, work.run_id, work.parent_work_id])
+            || !context.db.get("SELECT 1 FROM stage_work_memberships WHERE project_id = ? AND run_id = ? AND work_id = ? AND stage = ? AND attempt = ? AND cycle = ?", [work.project_id, work.run_id, work.work_id, scope.stage, scope.attempt, scope.cycle]))
+            throw new Error("Changed allocation binding");
+        return { work_id: work.work_id, item_key: marker.item_key, scope: { ...scope },
+            work_ids: { ...receipt.work_ids },
+            request_sha256: marker.request_sha256, batch_sha256: marker.batch_sha256,
+            work_sha256: receipt.work_sha256[work.work_id] };
+    }
+    catch {
+        throw new AppError("work_batch_custody_invalid", "Independent batch receipt cannot attest this Work allocation", 1, { work_id: work.work_id });
+    }
+}
+function validateBatchRequest(input) {
+    if (input.requestKey === undefined)
+        return;
+    if (typeof input.requestKey !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(input.requestKey)
+        || typeof input.stage !== "string" || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/.test(input.stage))
+        throw new AppError("work_batch_request_invalid", "Replayable batch requires a bounded request key and explicit stage", 2);
+}
+/** Optional request-owned registration for generic flows. Receipt and Work allocation
+ * commit in one writer transaction; mutable Work state may advance on replay, but
+ * immutable task/dependency/scope bytes may not be replaced or rediscovered.
+ */
+function batchRegistration(context, input, parent, items) {
+    const scope = stageGraphScope(context, parent.project_id, parent.run_id, input.stage);
+    const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [parent.project_id, parent.run_id]);
+    const index = run ? JSON.parse(run.index_json) : null;
+    if (!index || index.current_stage !== input.stage || !index.stage_runs.some(stage => stage.stage === input.stage && stage.status === "running")
+        || input.cycle !== undefined && input.cycle !== scope.cycle
+        || index.execution_bundle && !stageWorkIds(context, parent.project_id, parent.run_id, input.stage).has(parent.work_id)) {
+        throw new AppError("work_batch_scope_invalid", "Batch registration does not belong to the active coordinator stage", 1);
+    }
+    if (items.some(item => item.payload && Object.hasOwn(item.payload, "_dd_flow_batch_request")))
+        throw new AppError("work_batch_request_invalid", "Batch ownership marker is CLI-owned", 2);
+    const requestScope = { ...scope, stage: input.stage, parent_work_id: parent.work_id, request_key: input.requestKey };
+    const requestSha256 = hybridDigest(requestScope);
+    const batchSha256 = hybridDigest(items);
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id = ? AND event_type = 'work.batch_registration' AND json_extract(payload_json, '$.request_sha256') = ?", [parent.project_id, requestSha256]);
+    const owned = context.db.all(`SELECT ${workColumns} FROM works WHERE project_id = ? AND run_id = ? AND json_extract(payload_json, '$._dd_flow_batch_request.request_sha256') = ?`, [parent.project_id, parent.run_id, requestSha256]);
+    const invalid = (code) => { throw new AppError(code, "Retained batch registration cannot authorize allocation or replay", 1); };
+    if (!rows.length) {
+        if (owned.length)
+            invalid("work_batch_receipt_missing");
+        return { requestSha256, batchSha256, scope: requestScope, prior: null };
+    }
+    if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json, "utf8") > 1024 * 1024)
+        invalid("work_batch_receipt_invalid");
+    const receipt = JSON.parse(rows[0].payload_json);
+    if (receipt.run_id !== parent.run_id || hybridDigest(receipt.scope) !== requestSha256)
+        invalid("work_batch_receipt_invalid");
+    if (receipt.batch_sha256 !== batchSha256)
+        invalid("work_batch_request_conflict");
+    const ids = receipt.work_ids;
+    if (!ids || typeof ids !== "object" || Array.isArray(ids) || Object.keys(ids).length !== items.length
+        || new Set(Object.values(ids)).size !== items.length || owned.length !== items.length)
+        invalid("work_batch_receipt_invalid");
+    const resolve = (key) => Object.hasOwn(ids, key) ? ids[key] : key;
+    for (const item of items) {
+        if (!Object.hasOwn(ids, item.key))
+            invalid("work_batch_receipt_invalid");
+        const work = owned.find(row => row.work_id === ids[item.key]);
+        if (!work || work.parent_work_id !== (item.parent ? resolve(item.parent) : parent.work_id) || work.task !== item.task
+            || work.launch_policy !== (item.launch_policy ?? "reuse_allowed") || work.result_schema !== (item.result_schema ?? null)
+            || hybridDigest(JSON.parse(work.depends_on_json)) !== hybridDigest((item.depends_on ?? []).map(resolve))
+            || hybridDigest(JSON.parse(work.payload_json)) !== hybridDigest({ ...item.payload, _dd_flow_batch_request: { request_sha256: requestSha256, batch_sha256: batchSha256, item_key: item.key } })
+            || receipt.work_sha256 !== undefined && (!Object.hasOwn(receipt.work_sha256, work.work_id) || receipt.work_sha256[work.work_id] !== immutableBatchWorkDigest(work))
+            || !context.db.get("SELECT 1 FROM stage_work_memberships WHERE project_id = ? AND run_id = ? AND work_id = ? AND stage = ? AND attempt = ? AND cycle = ?", [parent.project_id, parent.run_id, work.work_id, input.stage, scope.attempt, scope.cycle]))
+            invalid("work_batch_receipt_invalid");
+    }
+    return { requestSha256, batchSha256, scope: requestScope, prior: ids };
+}
 export function listWorks(context, input) {
     ensureWorkRegistry(context);
     if (!input.runId && !input.parentWorkId)
@@ -241,7 +386,7 @@ export function listWorks(context, input) {
     const filtered = input.ready ? rows.filter(ready) : rows;
     return { works: filtered.slice(0, input.limit ?? filtered.length).map((work) => {
             const isReadyNow = ready(work);
-            return { ...work, payload: parsePayload(work), payload_json: undefined, depends_on: parseDependencies(work), ready: isReadyNow, ...(isReadyNow ? { start_command: workStartCommand(context, work) } : {}), ...(input.includeResults ? {} : { result: undefined }) };
+            return { ...work, payload: parsePayload(work), payload_json: undefined, depends_on: parseDependencies(work), ready: isReadyNow, ...(isReadyNow ? { start_command: workStartCommand(context, work, { preview: true }) } : {}), ...(input.includeResults ? {} : { result: undefined }) };
         }) };
 }
 export function showWork(context, id) { const work = requireWork(context, id); const sessions = context.db.all("SELECT ws.id, ws.work_id, ws.session_id, ws.hook_event_id, ws.status, ws.prompt_path, ws.result_path, ws.created_at, ws.completed_at, s.harness AS harness_id, COALESCE(s.provider_session_id, s.session_id) AS native_session_id FROM work_sessions ws LEFT JOIN sessions s ON s.project_id = ? AND s.session_id = ws.session_id WHERE ws.work_id = ? ORDER BY ws.created_at", [work.project_id, work.work_id]); return { work: { ...work, short_id: shortWorkId(work.work_id), payload: parsePayload(work), payload_json: undefined, depends_on: parseDependencies(work), sessions: sessions.map(({ session_id, harness_id, native_session_id, ...session }) => ({ ...session, ...(harness_id && native_session_id ? { session: publicSessionIdentity({ harness: harness_id, provider_session_id: native_session_id, session_id }) } : {}) })) } }; }
@@ -429,6 +574,8 @@ export function prepareWorkDeps(context, input) {
     if (dependencies.has(work.work_id))
         throw new AppError("validation", "Work cannot depend on itself", 2);
     assertNoCycles(context.db.all(`SELECT ${workColumns} FROM works WHERE project_id = ? AND run_id = ?`, [work.project_id, work.run_id]).map((row) => ({ id: row.work_id, dependencies: row.work_id === work.work_id ? [...dependencies] : parseDependencies(row) })));
+    if (parsePayload(work)?._dd_flow_batch_request && hybridDigest([...dependencies]) !== hybridDigest(parseDependencies(work)))
+        throw new AppError("validation", "This Work belongs to a registered batch: use its registered graph; dependencies are declared during allocation", 2, { phase: "prepare", effect: "no_effect", recoverable: true, work_id: work.work_id, depends_on: parseDependencies(work) });
     return { work, dependencies: [...dependencies] };
 }
 export function prepareWorkDelete(context, id) {
@@ -453,8 +600,11 @@ function rawWorkStartCommand(context, work) {
     const run = requireRun(context, work.project_id, work.run_id), recovery = recoveryGuard(context, work.project_id, work.run_id);
     return runtimeCommand(context, ["work", "start", shortWorkId(work.work_id), "--project-root", run.project_root, ...(recovery ? ["--recovery-id", recovery.recovery_id] : []), "--json"]);
 }
-export function workStartCommand(context, work) {
+export function workStartCommand(context, work, options = {}) {
     const command = rawWorkStartCommand(context, work);
+    // Graph/readiness projections do not choose the future executor's scope.
+    if (options.preview)
+        return command;
     const retained = context.db.get("SELECT status,current_start_invocation_id FROM works WHERE work_id = ?", [work.work_id]);
     if (retained?.current_start_invocation_id) {
         const prepared = prepareWorkStartAuthority(context, command, retained.current_start_invocation_id);
@@ -489,9 +639,19 @@ export function assertWorkLaunchReady(context, id) {
         throw new AppError("invalid_work_state", "Work is not created", 2, { work_id: id, status: work.status });
     if (!isReady(context, work)) {
         const blockers = readinessBlockers(context, work);
-        const ready = context.db.all(`SELECT ${workColumns} FROM works WHERE project_id = ? AND run_id = ? AND status = 'created' ORDER BY created_at, work_id`, [work.project_id, work.run_id]).filter((candidate) => currentStageWorkIds(context, candidate.project_id, candidate.run_id)?.has(candidate.work_id) !== false && isReady(context, candidate)).map((candidate) => ({ work_id: candidate.work_id, start_command: workStartCommand(context, candidate) }));
+        const ready = context.db.all(`SELECT ${workColumns} FROM works WHERE project_id = ? AND run_id = ? AND status = 'created' ORDER BY created_at, work_id`, [work.project_id, work.run_id]).filter((candidate) => currentStageWorkIds(context, candidate.project_id, candidate.run_id)?.has(candidate.work_id) !== false && isReady(context, candidate)).map((candidate) => ({ work_id: candidate.work_id, start_command: workStartCommand(context, candidate, { preview: true }) }));
         throw new AppError("work_not_ready", "Work cannot start until dependencies complete and overlapping planned coordination areas are free", 2, { work_id: id, blockers, ready });
     }
+    const run = requireRun(context, work.project_id, work.run_id);
+    const wave = registeredMemoryRepairWave(context, work, run);
+    if (wave) {
+        const launched = context.db.get("SELECT 1 FROM sqlite_master WHERE type='table' AND name='work_launches'")
+            && context.db.get("SELECT 1 FROM work_launches WHERE work_id=?", [work.work_id]);
+        if (launched)
+            prepareMemoryRepairStartOwner(context, work, run, wave);
+        else
+            (wave === 1 ? prepareMemoryRepairDispatchFromStage : prepareMemorySecondRepairDispatchFromStage)(context, { projectRoot: run.project_root, runId: work.run_id, workId: work.work_id });
+    }
     if (parsePayload(work)?.read_only === true)
         assertSharedReviewInput(context, work, requireRun(context, work.project_id, work.run_id));
     return work;
@@ -563,39 +723,105 @@ export function bindRunningWorkSession(context, input) {
     refreshRunWorkProjection(context, work.project_id, work.run_id);
     return { work_session_id: id, session_id: identity.sessionId };
 }
+function preparedCoordinatorRoute(context, work, input, snapshot) {
+    const bound = assertRunBundleSqlAuthority(context, { projectId: work.project_id, runId: work.run_id }, snapshot.execution_bundle);
+    const admitted = context.stageBindingBundle;
+    if (admitted && !bound)
+        throw new AppError("run_bundle_anchor_invalid", "Prepared coordinator bundle lost its RUN anchor", 1);
+    if (bound && (!admitted || admitted.stage !== input.stage || admitted.contextSha256 !== input.contextSha256))
+        throw new AppError("frozen_stage_binding_required", "Coordinator binding requires its prepared frozen stage bundle", 1);
+    if (bound) {
+        // The request-local bundle was admitted before coordinator dispatch. The
+        // independently retained RUN authority fences it again without compiling
+        // descriptor schemas under this (possibly caller-owned) SQL writer.
+        assertPreparedRunBundleSqlAuthority(context, { projectId: work.project_id, runId: work.run_id }, admitted.bundle);
+        if (admitted.bundle.descriptor.descriptor.id === "mb-init") {
+            const retained = readDescriptorStageInput(context, { projectId: work.project_id, runId: work.run_id, stage: input.stage }, admitted.bundle);
+            const payload = retained.input.payload_base64;
+            if (typeof payload !== "string")
+                throw new AppError("stage_context_binding_invalid", "Memory Stage context has no retained payload", 1);
+            const bytes = Buffer.from(payload, "base64");
+            if (bytes.toString("base64") !== payload || (bytes.length ? sha256(bytes) !== input.contextSha256 : input.contextSha256 !== undefined))
+                throw new AppError("stage_context_binding_invalid", "Coordinator context checksum differs from retained Memory Stage bytes", 1);
+        }
+        const currentStage = snapshot.current_stage ?? (admitted.bundle.descriptor.descriptor.id === "sdlc" ? snapshot.stage_runs.at(-1)?.stage : undefined);
+        if (currentStage !== input.stage || !snapshot.stage_runs.some(stage => stage.stage === input.stage && stage.status === "running")
+            || !context.db.get("SELECT 1 FROM works WHERE project_id = ? AND run_id = ? AND work_id = ?", [work.project_id, work.run_id, work.work_id])
+            || !stageWorkIds(context, work.project_id, work.run_id, input.stage).has(work.work_id))
+            throw new AppError("stage_work_scope_invalid", "Coordinator does not belong to the active frozen stage", 1);
+    }
+    return bound ? admitted.bundle.execution.stage(input.stage) : null;
+}
 /** A stage coordinator is launched by `stage start`, not by an invented nested `work start`. */
 export function bindStageCoordinatorWork(context, input) {
     const work = requireWork(context, input.workId);
     assertRunMutationAllowed(context, work.project_id, work.run_id);
     const run = requireRun(context, work.project_id, work.run_id);
     const snapshot = JSON.parse((context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [work.project_id, work.run_id])?.index_json) ?? "{}");
-    const profile = snapshot.execution_profile;
-    if (profile && input.contextSha256) {
-        const file = path.join(path.dirname(input.promptPath), "stage-context.json");
-        if (!fs.existsSync(file) || sha256(fs.readFileSync(file, "utf8")) !== input.contextSha256)
-            throw new AppError("context_checksum_mismatch", "Retained Stage context changed before coordinator binding", 2);
-        const item = { path: path.relative(requireRunHome(run), file), sha256: input.contextSha256 };
-        const prior = profile.stage_context_inputs?.[input.stage];
-        if (prior && JSON.stringify(prior) !== JSON.stringify(item))
-            throw new AppError("stage_context_replacement", "Stage already has a different accepted context", 2);
-        profile.stage_context_inputs = { ...profile.stage_context_inputs, [input.stage]: item };
-        context.db.run("UPDATE runs SET index_json = ? WHERE id = ? AND project_id = ?", [JSON.stringify(snapshot), run.id, work.project_id]);
-    }
-    const previous = context.db.get("SELECT ws.session_id, s.current_stage FROM work_sessions ws JOIN sessions s ON s.project_id = ? AND s.session_id = ws.session_id WHERE ws.work_id = ? AND ws.status = 'running' ORDER BY ws.created_at DESC LIMIT 1", [work.project_id, work.work_id]);
-    let sessionMode = profile?.settings.stage_session_mode ?? "same_session";
-    if (profile?.settings.execution) {
-        if (!profile.agent_profiles)
-            throw new AppError("execution_profile_not_frozen", "Stage handoff requires frozen RUN profiles", 1);
-        sessionMode = resolveStageTransition({ ddFlowHome: context.ddFlowHome, policy: profile.settings.execution, profiles: profile.agent_profiles, projectRoot: run.project_root, workspaceRoot: run.workspace_root, ...(previous?.current_stage ? { fromStage: previous.current_stage } : {}), stage: input.stage, stageSessionMode: sessionMode, mergeMode: profile.settings.merge_mode }).session_mode;
-    }
-    const identity = hookSessionIdentity(context, work.project_id, input.hookEventId);
-    if (previous?.current_stage && previous.current_stage !== input.stage && sessionMode === "new_session" && previous.session_id === identity.sessionId)
-        throw new AppError("stage_handoff_required", "This stage requires a fresh coordinator Session under its frozen execution policy", 1, { from_stage: previous.current_stage, stage: input.stage });
-    claimStageStartHookEvent(context, { projectId: work.project_id, eventKey: input.hookEventId, runId: work.run_id, stage: input.stage, projectRoot: run.project_root, ...(input.contextSha256 ? { contextSha256: input.contextSha256 } : {}) });
-    const binding = bindRunningWorkSession(context, { ...input, allowStageHandoff: sessionMode === "new_session" });
-    context.db.run("UPDATE sessions SET current_stage = ?, updated_at = ? WHERE project_id = ? AND session_id = ?", [input.stage, context.now(), work.project_id, binding.session_id]);
-    refreshRunSessionProjection(context, work.project_id, work.run_id);
-    return binding;
+    const frozenRoute = preparedCoordinatorRoute(context, work, input, snapshot), bound = frozenRoute !== null;
+    const bind = () => {
+        assertRunMutationAllowed(context, work.project_id, work.run_id);
+        if (bound)
+            preparedCoordinatorRoute(context, work, input, JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [work.project_id, work.run_id]).index_json));
+        const profile = snapshot.execution_profile;
+        if (!bound && profile && input.contextSha256) {
+            const file = path.join(path.dirname(input.promptPath), "stage-context.json");
+            if (!fs.existsSync(file) || sha256(fs.readFileSync(file, "utf8")) !== input.contextSha256)
+                throw new AppError("context_checksum_mismatch", "Retained Stage context changed before coordinator binding", 2);
+            const item = { path: path.relative(requireRunHome(run), file), sha256: input.contextSha256 };
+            const prior = profile.stage_context_inputs?.[input.stage];
+            if (prior && JSON.stringify(prior) !== JSON.stringify(item))
+                throw new AppError("stage_context_replacement", "Stage already has a different accepted context", 2);
+            profile.stage_context_inputs = { ...profile.stage_context_inputs, [input.stage]: item };
+            context.db.run("UPDATE runs SET index_json = ? WHERE id = ? AND project_id = ?", [JSON.stringify(snapshot), run.id, work.project_id]);
+        }
+        // A stage may settle its Session while the RUN's root Work remains running.
+        // Completion must not erase the frozen handoff policy for the next stage.
+        const previous = context.db.get(`SELECT ws.id, ws.status, ws.session_id, ws.hook_event_id, s.current_stage, ws.result_path FROM work_sessions ws JOIN sessions s ON s.project_id = ? AND s.session_id = ws.session_id WHERE ws.work_id = ? AND ${bound ? "ws.status IN ('running', 'completed')" : "ws.status = 'running'"} ORDER BY ws.created_at DESC, ws.rowid DESC LIMIT 1`, [work.project_id, work.work_id]);
+        let sessionMode = frozenRoute?.session_mode ?? profile?.settings.stage_session_mode ?? "same_session";
+        if (!bound && profile?.settings.execution) {
+            if (!profile.agent_profiles)
+                throw new AppError("execution_profile_not_frozen", "Stage handoff requires frozen RUN profiles", 1);
+            sessionMode = resolveStageTransition({ ddFlowHome: context.ddFlowHome, policy: profile.settings.execution, profiles: profile.agent_profiles, projectRoot: run.project_root, workspaceRoot: run.workspace_root, ...(previous?.current_stage ? { fromStage: previous.current_stage } : {}), stage: input.stage, stageSessionMode: sessionMode, mergeMode: profile.settings.merge_mode }).session_mode;
+        }
+        const identity = hookSessionIdentity(context, work.project_id, input.hookEventId);
+        if (frozenRoute && runtimeHarness(frozenRoute.profile) !== identity.harness)
+            throw new AppError("stage_profile_mismatch", "Coordinator hook belongs to another frozen harness route", 1);
+        if (bound && previous && sessionMode === "same_session" && !ownsPhysicalWorkSession(context, work.project_id, previous, identity)) {
+            // Boundary recovery intentionally retains the terminal WorkSession. Only
+            // its explicitly accepted current-generation replacement may change daemon.
+            const guard = recoveryGuard(context, work.project_id, work.run_id);
+            const recoveredOwner = previous.status === "completed" && previous.session_id === identity.sessionId && guard?.status === "recovered" && context.db.get(`SELECT b.recovery_id FROM run_recovery_bindings b JOIN hook_events h ON h.project_id = ? AND h.event_key = b.hook_event_key AND h.status = 'claimed' AND h.daemon_id = b.daemon_id AND h.session_id = b.session_id WHERE b.recovery_id = ? AND b.status = 'accepted' AND b.work_id = ? AND b.prior_work_session_id = ? AND b.session_id = ? AND b.harness = ? AND b.provider_session_id = ? AND b.daemon_id = ?`, [work.project_id, guard.recovery_id, work.work_id, previous.id, identity.sessionId, identity.harness, identity.providerSessionId, identity.daemonId ?? null]);
+            if (!recoveredOwner)
+                throw new AppError("handoff_session_mismatch", "Frozen same-session handoff must retain the preceding coordinator's physical Session", 1, { stage: input.stage });
+        }
+        if (frozenRoute?.session_mode === "new_session")
+            assertFreshCoordinatorSession(context, work, input.stage, identity);
+        if (previous && sessionMode === "new_session" && previous.session_id === identity.sessionId
+            && (previous.current_stage && previous.current_stage !== input.stage || bound && path.resolve(previous.result_path ?? "") !== path.resolve(input.resultPath ?? "")))
+            throw new AppError("stage_handoff_required", "This stage requires a fresh coordinator Session under its frozen execution policy", 1, { from_stage: previous.current_stage, stage: input.stage });
+        claimStageStartHookEvent(context, { projectId: work.project_id, eventKey: input.hookEventId, runId: work.run_id, stage: input.stage, projectRoot: run.project_root, ...(input.contextSha256 ? { contextSha256: input.contextSha256 } : {}) });
+        const binding = bindRunningWorkSession(context, { ...input, allowStageHandoff: sessionMode === "new_session" });
+        context.db.run("UPDATE sessions SET current_stage = ?, updated_at = ? WHERE project_id = ? AND session_id = ?", [input.stage, context.now(), work.project_id, binding.session_id]);
+        if (frozenRoute)
+            appendAudit(context, { projectId: work.project_id, eventType: "stage.coordinator_binding", payload: {
+                    run_id: work.run_id, scope: { ...stageGraphScope(context, work.project_id, work.run_id, input.stage), stage: input.stage },
+                    work_id: work.work_id, work_session_id: binding.work_session_id, session_id: identity.sessionId,
+                    harness: identity.harness, provider_session_id: identity.providerSessionId,
+                    execution_sha256: context.stageBindingBundle.bundle.execution.sha256,
+                    profile_id: frozenRoute.profile.id, profile_sha256: hybridDigest(frozenRoute.profile), session_mode: frozenRoute.session_mode,
+                    ...(input.contextSha256 ? { context_sha256: input.contextSha256 } : {})
+                } });
+        refreshRunSessionProjection(context, work.project_id, work.run_id);
+        return binding;
+    };
+    return bound ? context.db.writeTransaction(bind, "stage.bindFrozenCoordinator") : bind();
+}
+function assertFreshCoordinatorSession(context, work, stage, identity) {
+    const prior = context.db.get("SELECT 1 FROM audit_events WHERE project_id = ? AND event_type = 'stage.coordinator_binding' AND json_extract(payload_json, '$.run_id') = ? AND json_extract(payload_json, '$.harness') = ? AND json_extract(payload_json, '$.provider_session_id') = ? AND json_extract(payload_json, '$.scope.stage') <> ? LIMIT 1", [work.project_id, work.run_id, identity.harness, identity.providerSessionId, stage]);
+    const current = context.db.get("SELECT current_stage FROM sessions WHERE project_id = ? AND session_id = ? AND run_id = ?", [work.project_id, identity.sessionId, work.run_id]);
+    if (prior || current?.current_stage && current.current_stage !== stage)
+        throw new AppError("stage_handoff_required", "Frozen stage requires a coordinator Session not used by another stage", 1, { stage });
 }
 /** Starts a created coordinator Work from its trusted `stage start` event. */
 export function startStageCoordinatorWork(context, input) {
@@ -606,12 +832,26 @@ export function startStageCoordinatorWork(context, input) {
     const run = requireRun(context, work.project_id, work.run_id);
     if (input.projectRoot && resolveProjectRoot(input.projectRoot) !== resolveProjectRoot(run.project_root))
         throw new AppError("project_mismatch", "stage coordinator project root does not match its RUN", 1, { work_id: work.work_id });
-    const binding = startBoundWork(context, work, run, () => claimStageStartHookEvent(context, { projectId: work.project_id, eventKey: input.hookEventId, runId: work.run_id, stage: input.stage, projectRoot: run.project_root, ...(input.contextSha256 ? { contextSha256: input.contextSha256 } : {}) }), input.hookEventId, input.stage);
+    const snapshot = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [work.project_id, work.run_id]).index_json);
+    const frozenRoute = preparedCoordinatorRoute(context, work, input, snapshot);
+    const binding = startBoundWork(context, work, run, () => {
+        if (frozenRoute) {
+            const current = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [work.project_id, work.run_id]).index_json);
+            preparedCoordinatorRoute(context, work, input, current);
+            const identity = hookSessionIdentity(context, work.project_id, input.hookEventId);
+            if (identity.harness !== runtimeHarness(frozenRoute.profile))
+                throw new AppError("stage_profile_mismatch", "Coordinator hook belongs to another frozen harness route", 1);
+            if (frozenRoute.session_mode === "new_session")
+                assertFreshCoordinatorSession(context, work, input.stage, identity);
+        }
+        return claimStageStartHookEvent(context, { projectId: work.project_id, eventKey: input.hookEventId, runId: work.run_id, stage: input.stage, projectRoot: run.project_root, ...(input.contextSha256 ? { contextSha256: input.contextSha256 } : {}) });
+    }, input.hookEventId, input.stage);
     refreshRunSessionProjection(context, work.project_id, work.run_id);
     return binding;
 }
 /** Claim, command authority and binding commit together; only packet projection follows. */
 export function startBoundWork(context, work, run, claimIdentity, hookEventId, stage) {
+    const repairWave = registeredMemoryRepairWave(context, work, run);
     const generation = assertRunMutationAllowed(context, work.project_id, work.run_id);
     const directory = path.join(requireRunHome(run), "works", work.work_id);
     const linkId = `WS-${crypto.randomUUID()}`;
@@ -621,12 +861,18 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
     const promptPath = path.join(packetDirectory, "prompt.md"), resultPath = path.join(directory, "result.json");
     // The first reviewer freezes shared inputs in the same transaction as its claim.
     const readOnly = parsePayload(work)?.read_only === true;
-    const workerRun = readOnly && context.env.DD_FLOW_READ_ONLY_WORKSPACE
-        ? { ...run, workspace_root: path.resolve(context.env.DD_FLOW_READ_ONLY_WORKSPACE) }
-        : run;
-    const preparedReviewInput = readOnly ? assertSharedReviewInput(context, work, run, generation) : null;
+    const repairPreparationContext = { ...context, env: { ...context.env, DD_FLOW_MEMORY_REPAIR_HOOK_EVENT: hookEventId } };
+    const preparedRepairCopy = repairWave ? prepareMemoryRepairStartOwner(repairPreparationContext, work, run, repairWave) : null;
+    const preparedMemoryReview = readOnly && parsePayload(work)?.kind === "memory-review"
+        ? prepareMemoryReviewWorkInput(context, work, run, generation) : null;
+    const nativeReviewCopy = preparedMemoryReview?.bundle.execution.work("review").delegation.mode === "native"
+        ? prepareMemoryNativeReviewCopy(context, work.work_id, false, preparedMemoryReview) : null;
+    const workerRun = preparedRepairCopy ? { ...run, workspace_root: preparedRepairCopy.root() }
+        : nativeReviewCopy ? { ...run, workspace_root: nativeReviewCopy.root } : readOnly && context.env.DD_FLOW_READ_ONLY_WORKSPACE
+            ? { ...run, workspace_root: path.resolve(context.env.DD_FLOW_READ_ONLY_WORKSPACE) } : run;
+    const preparedReviewInput = preparedMemoryReview?.input ?? (readOnly ? assertSharedReviewInput(context, work, run, generation) : null);
     const reviewPaths = preparedReviewInput?.run_inputs.filter(item => item.root === "workspace").map(item => item.path) ?? [];
-    const preparedCopy = readOnly && context.env.DD_FLOW_READ_ONLY_WORKSPACE ? prepareBoundReviewCopy(context, work, run, context.env.DD_FLOW_READ_ONLY_WORKSPACE, reviewPaths) : null;
+    const preparedCopy = nativeReviewCopy ?? (readOnly && context.env.DD_FLOW_READ_ONLY_WORKSPACE ? prepareBoundReviewCopy(context, work, run, context.env.DD_FLOW_READ_ONLY_WORKSPACE, reviewPaths) : null);
     const fingerprint = readOnly ? preparedReviewInput?.source_sha256 ?? preparedReviewInput?.workspace_fingerprint ?? legacyReviewFingerprint(work, run) ?? workspaceFingerprint(run.workspace_root) : undefined;
     const preparedDependencies = parseDependencies(work).map(dependency => context.db.get("SELECT work_id, result FROM works WHERE work_id = ?", [dependency])).filter(Boolean);
     const preparedRecovery = recoveryPromptForWork(context, work.work_id);
@@ -634,7 +880,7 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
     const finishMarker = `DD_FLOW_FINISH_${crypto.randomUUID()}`;
     const failMarker = `DD_FLOW_FAIL_${crypto.randomUUID()}`;
     const workspaceView = preparedCopy ? { work_id: work.work_id, from: run.workspace_root, to: reviewInputPath(requireRunHome(run), preparedCopy.copy.root), source_sha256: preparedCopy.copy.source_sha256, copy_sha256: preparedCopy.copy.sha256 } : undefined;
-    let promptTemplate = renderWorkerPrompt(context, work, workerRun, preparedDependencies, { finish: finishMarker, fail: failMarker }, workspaceView);
+    let promptTemplate = renderWorkerPrompt(context, work, workerRun, preparedDependencies, { finish: finishMarker, fail: failMarker }, workspaceView, preparedReviewInput ?? undefined);
     if (preparedRecovery)
         promptTemplate = `${recoveryPrompt(preparedRecovery)}\n\n${promptTemplate}`;
     let binding;
@@ -646,17 +892,36 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
                 throw new AppError("conflict", "Work was claimed concurrently", 1, { work_id: current.work_id, status: current.status });
             if (Object.keys(current).some(key => current[key] !== work[key]))
                 throw new AppError("work_not_ready", "Work inputs changed while preparing its start packet", 2, { work_id: current.work_id });
+            preparedMemoryReview?.assertCustody(context);
             if (!isReady(context, current))
                 throw new AppError("work_not_ready", "Work dependencies are not ready", 2, { work_id: current.work_id, blockers: readinessBlockers(context, current) });
             if (retryPending)
                 throw new AppError("work_retry_incomplete", "Complete the interrupted Work retry before starting its next attempt", 1, { work_id: work.work_id });
-            const identity = claimIdentity();
+            const claimedIdentity = claimIdentity();
+            const nativeReviewExecution = nativeReviewCopy ? memoryRepairExecutionIdentity(context, { projectId: current.project_id, runId: current.run_id,
+                workId: current.work_id, eventKey: hookEventId, root: nativeReviewCopy.root }) : null;
+            const identity = preparedRepairCopy ? memoryRepairExecutionIdentity(context, { projectId: current.project_id,
+                runId: current.run_id, workId: current.work_id, eventKey: hookEventId, root: preparedRepairCopy.root() }).identity
+                : nativeReviewExecution?.identity ?? claimedIdentity;
+            if (identity.hookEventId !== claimedIdentity.hookEventId || identity.sessionId !== claimedIdentity.sessionId)
+                throw new AppError("memory_repair_native_binding_invalid", "Repair execution proof differs from the claimed Hook", 1, { effect: "no_effect" });
             assertRecoveryHookCurrent(context, current.project_id, current.run_id, identity);
+            if (PreparedSecondMemoryRepairLaunch.isPrepared(preparedRepairCopy))
+                preparedRepairCopy.assertClaimIdentity(context, hookEventId, identity);
+            else
+                preparedRepairCopy?.assertClaimIdentity(context, identity);
             if (readOnly && !context.env.DD_FLOW_READ_ONLY_WORKSPACE
                 && context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'work_launches'")
                 && context.db.get("SELECT 1 FROM work_launches WHERE work_id = ? AND status IN ('launching','start_requested')", [current.work_id]))
                 throw new AppError("read_only_workspace_unbound", "External reviewer did not inherit its qualified execution workspace", 1, { work_id: current.work_id });
-            if (preparedCopy) {
+            if (nativeReviewCopy) {
+                nativeReviewCopy.assertCustody(context);
+                const worker = nativeReviewCopy.route.worker;
+                if (identity.harness !== runtimeHarness(worker) || identity.model !== worker.model
+                    || identity.provider && identity.provider !== worker.provider)
+                    throw new AppError("read_only_workspace_unbound", "Native review Hook differs from the frozen worker profile", 1, { effect: "no_effect" });
+            }
+            else if (preparedCopy && 'providerSessionId' in preparedCopy) {
                 const launch = context.db.get("SELECT provider_session_id, profile_json FROM work_launches WHERE work_id = ? AND status IN ('launching','start_requested')", [current.work_id]);
                 if (!launch || launch.provider_session_id !== identity.providerSessionId || launch.provider_session_id !== preparedCopy.providerSessionId || launch.profile_json !== preparedCopy.profileJson)
                     throw new AppError("read_only_workspace_unbound", "Read-only execution copy belongs to another physical Session or launch revision", 1, { work_id: current.work_id });
@@ -676,7 +941,7 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
             const commands = workerLifecycleCommands({ ...context, captureLifecycleAssignment: (id) => assignments.add(id) }, current, workerRun, true);
             const prompt = promptTemplate.replace(finishMarker, commands.finish).replace(failMarker, commands.fail);
             bindLifecyclePacketAssignments(context, prompt, assignments);
-            const workContext = { schema_id: "dd-flow/work-context@1", run_id: current.run_id, work_id: current.work_id, parent_work_id: current.parent_work_id, project_root: run.project_root, workspace_root: workerRun.workspace_root, run_root: requireRunHome(run), depends_on: parseDependencies(current), launch_policy: current.launch_policy, result_schema: current.result_schema, read_only: readOnly, ...(recovery ? { recovery } : {}), ...(readOnly ? { workspace_fingerprint: fingerprint, ...(reviewInput ? { review_input: reviewInput } : {}), ...(reviewCopy ? { review_copy: reviewCopy } : {}) } : {}) };
+            const workContext = { schema_id: "dd-flow/work-context@1", run_id: current.run_id, work_id: current.work_id, parent_work_id: current.parent_work_id, project_root: run.project_root, workspace_root: workerRun.workspace_root, run_root: requireRunHome(run), depends_on: parseDependencies(current), launch_policy: current.launch_policy, result_schema: current.result_schema, read_only: readOnly, ...(preparedRepairCopy ? { memory_repair_input: preparedRepairCopy.input() } : {}), ...(recovery ? { recovery } : {}), ...(readOnly ? { workspace_fingerprint: fingerprint, ...(reviewInput ? { review_input: reviewInput } : {}), ...(reviewCopy ? { review_copy: reviewCopy } : {}) } : {}) };
             const contextBytes = `${JSON.stringify(workContext, null, 2)}\n`;
             const response = { ok: true, work_id: current.work_id, work_session_id: linkId, worker_prompt_markdown: prompt, prompt_path: promptPath, ...(recovery ? { recovery } : {}), session_binding: { source: "PreToolUse", session: { harness_id: identity.harness, session_id: identity.nativeSessionId } } };
             const receipt = JSON.stringify({ version: 2, prompt, context: contextBytes, prompt_sha256: sha256(prompt), context_sha256: sha256(contextBytes), response, response_sha256: sha256(JSON.stringify(response)), generation, invocation_id: context.env.DD_FLOW_CURRENT_INVOCATION ?? null });
@@ -687,8 +952,26 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
             if (context.db.run("UPDATE works SET status = 'running', started_at = COALESCE(started_at, ?), updated_at = ? WHERE work_id = ? AND status = 'created'", [now, now, current.work_id]).changes !== 1)
                 throw new AppError("conflict", "Work was claimed concurrently", 1, { work_id: current.work_id });
             context.db.run("INSERT INTO work_sessions (id, work_id, session_id, hook_event_id, status, prompt_path, result_path, start_receipt_json, start_publication_status, created_at, updated_at, completed_at) VALUES (?, ?, ?, ?, 'running', ?, ?, ?, 'pending', ?, ?, NULL)", [linkId, current.work_id, identity.sessionId, hookEventId, promptPath, resultPath, receipt, now, now]);
+            preparedRepairCopy?.recordStart(context, linkId);
+            if (nativeReviewCopy)
+                appendAudit(context, { projectId: current.project_id, eventType: "memory.native_review_binding", payload: {
+                        run_id: current.run_id, work_id: current.work_id, work_session_id: linkId, hook_event_key: hookEventId,
+                        session_id: identity.sessionId, provider_session_id: identity.providerSessionId, invocation_id: nativeReviewExecution?.invocationId ?? null,
+                        copy: nativeReviewCopy.copy
+                    } });
             if (stage)
                 context.db.run("UPDATE sessions SET current_stage = ?, updated_at = ? WHERE project_id = ? AND session_id = ?", [stage, now, current.project_id, identity.sessionId]);
+            if (stage && context.stageBindingBundle) {
+                const route = context.stageBindingBundle.bundle.execution.stage(stage);
+                appendAudit(context, { projectId: current.project_id, eventType: "stage.coordinator_binding", payload: {
+                        run_id: current.run_id, scope: { ...stageGraphScope(context, current.project_id, current.run_id, stage), stage },
+                        work_id: current.work_id, work_session_id: linkId, session_id: identity.sessionId,
+                        harness: identity.harness, provider_session_id: identity.providerSessionId,
+                        execution_sha256: context.stageBindingBundle.bundle.execution.sha256,
+                        profile_id: route.profile.id, profile_sha256: hybridDigest(route.profile), session_mode: route.session_mode,
+                        ...(context.stageBindingBundle.contextSha256 ? { context_sha256: context.stageBindingBundle.contextSha256 } : {})
+                    } });
+            }
             if (recovery)
                 activateRecoveryWork(context, current.work_id);
             return response;
@@ -716,6 +999,7 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
         throw error;
     }
     try {
+        preparedRepairCopy?.revalidateCommittedStart(context, linkId);
         if (readOnly) {
             const committedWork = requireWork(context, work.work_id);
             assertSharedReviewInput(context, committedWork, run, generation);
@@ -736,13 +1020,37 @@ export function startBoundWork(context, work, run, claimIdentity, hookEventId, s
 }
 /** Read the exact committed reply, never bind another Session or regenerate a packet. */
 export function recoverCommittedWorkStart(context, invocationId, eventKey, generation, workId) {
-    const row = context.db.get("SELECT ws.start_receipt_json, w.project_id, w.run_id FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE ws.start_receipt_json IS NOT NULL AND ws.hook_event_id = ? AND json_extract(ws.start_receipt_json, '$.invocation_id') IS ? AND (? IS NULL OR w.work_id = ?)", [eventKey, invocationId, workId ?? null, workId ?? null]);
+    const row = context.db.get("SELECT ws.start_receipt_json, w.project_id, w.run_id, w.work_id, ws.id AS work_session_id, w.result_schema, w.payload_json FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE ws.start_receipt_json IS NOT NULL AND ws.hook_event_id = ? AND json_extract(ws.start_receipt_json, '$.invocation_id') IS ? AND (? IS NULL OR w.work_id = ?)", [eventKey, invocationId, workId ?? null, workId ?? null]);
     if (!row)
         return undefined;
+    // Replay restores registered physical start custody, never prelaunch admission.
+    memoryRepairWave(row);
+    const retainedRun = requireRun(context, row.project_id, row.run_id);
+    const repairWave = registeredMemoryRepairWave(context, row, retainedRun);
     const receipt = JSON.parse(row.start_receipt_json);
     if (receipt.generation !== generation || !receipt.response || receipt.response_sha256 !== sha256(JSON.stringify(receipt.response)))
         throw new AppError("work_start_receipt_invalid", "Committed reply identity or checksum differs", 1, { invocation_id: invocationId });
     assertRunMutationAllowed(context, row.project_id, row.run_id, generation);
+    if (repairWave) {
+        let workspaceRoot;
+        try {
+            if (typeof receipt.context !== "string" || Buffer.byteLength(receipt.context) > 16 * 1024 * 1024)
+                throw new Error("Invalid retained context");
+            const input = JSON.parse(receipt.context);
+            if (typeof input.workspace_root !== "string")
+                throw new Error("Missing retained workspace");
+            workspaceRoot = input.workspace_root;
+        }
+        catch {
+            throw new AppError("work_start_receipt_invalid", "Committed repair context is unavailable", 1, { effect: "no_effect" });
+        }
+        const scope = { projectRoot: retainedRun.project_root, runId: row.run_id, workId: row.work_id, workspaceRoot, workSessionId: row.work_session_id };
+        const owner = repairWave === 1 ? restoreStartedMemoryRepairCopyFromStage(context, scope)
+            : restoreStartedMemorySecondRepairLaunchFromStage(context, scope);
+        if (owner.root() !== workspaceRoot)
+            throw new AppError("work_start_receipt_invalid", "Retained repair workspace differs from its physical start", 1, { effect: "no_effect" });
+        owner.revalidateCommittedStart(context, row.work_session_id);
+    }
     materializePendingWorkStarts(context, row.project_id, row.run_id);
     return receipt.response;
 }
@@ -760,17 +1068,66 @@ export function finishStageCoordinatorWork(context, id, result) {
     context.db.run("UPDATE sessions SET status = 'idle', updated_at = ? WHERE project_id = ? AND session_id = ? AND NOT EXISTS (SELECT 1 FROM work_sessions WHERE session_id = ? AND status = 'running')", [context.now(), work.project_id, link.session_id, link.session_id]);
     settleRecoveryWork(context, id, "completed");
 }
-export function finishWork(context, id, result, progress, retry) { return settle(context, id, "completed", result, progress, retry); }
+export async function finishWork(context, id, result, progress, retry) {
+    const work = requireWork(context, id);
+    if (work.result_schema === "dd-flow/memory-repair-work-result@1") {
+        if (retry)
+            throw new AppError("usage", "Memory repair completion uses retained publication recovery, not code-check retry", 2, { effect: "no_effect" });
+        prepareWorkSettlement(context, id, "completed", result);
+        const published = publishMemoryRepairWorkCompletion(context, work, result);
+        try {
+            return await finishPublishedMemoryRepairWork(context, published);
+        }
+        catch (error) {
+            throw new AppError("memory_repair_completion_pending", "Repair publication completed but Work settlement requires reconciliation", 1, { effect: error instanceof AppError && error.details.effect === "unknown" ? "unknown" : "partial",
+                run_id: work.run_id, work_id: work.work_id, result_sha256: published.sha256,
+                cause: error instanceof Error ? error.message : String(error) });
+        }
+    }
+    const prepared = prepareRegisteredMemoryWorkResult(context, work, result);
+    return settle(context, id, "completed", result, progress, retry, prepared ?? undefined);
+}
+/** Controller-selected registration/result preparation, never an agent-provided binding. */
+export function finishRegisteredMemoryCompositionWork(context, prepared) {
+    if (!(prepared instanceof PreparedRegisteredMemoryCompositionWorkResult))
+        throw new AppError("memory_work_result_preparation_required", "Memory Work completion requires admitted registered output", 1);
+    return settle(context, prepared.workId, "completed", prepared.bytes().toString("utf8"), undefined, undefined, prepared);
+}
+export function finishRegisteredMemoryReviewWork(context, prepared) {
+    if (!(prepared instanceof PreparedRegisteredMemoryReviewWorkResult))
+        throw new AppError("memory_work_result_preparation_required", "Memory reviewer completion requires registered input and independent Session proof", 1);
+    return settle(context, prepared.workId, "completed", prepared.bytes().toString("utf8"), undefined, undefined, prepared);
+}
+export function finishPublishedMemoryRepairWork(context, prepared) {
+    if (!PreparedPublishedMemoryRepairWorkResult.isPrepared(prepared))
+        throw new AppError("memory_work_result_preparation_required", "Repair completion requires independently published registered output", 1, { effect: "no_effect" });
+    return settle(context, prepared.workId, "completed", prepared.bytes().toString("utf8"), undefined, undefined, prepared);
+}
 /** Structured fan-in closes a parent after its Session was handed to a child. */
-export function finishFanInWork(context, id, result) { const work = requireWork(context, id); assertRunMutationAllowed(context, work.project_id, work.run_id); if (work.status !== "running")
-    throw new AppError("invalid_work_state", "Fan-in Work is not running", 2, { work_id: work.work_id, status: work.status }); if (context.db.get("SELECT 1 FROM works WHERE parent_work_id = ? AND status IN ('created','running','paused') LIMIT 1", [work.work_id]))
-    throw new AppError("active_child_work", "Fan-in Work still has active children", 2, { work_id: work.work_id }); const now = context.now(); context.db.run("UPDATE works SET status = 'completed', result = ?, completed_at = ?, updated_at = ? WHERE work_id = ?", [result, now, now, work.work_id]); context.db.run("UPDATE work_sessions SET status = 'completed', completed_at = COALESCE(completed_at, ?), updated_at = ? WHERE work_id = ? AND status = 'running'", [now, now, work.work_id]); refreshRunWorkProjection(context, work.project_id, work.run_id); appendFlowRunTimelineEvent(context, work.project_id, work.run_id, { type: "work_completed", work_id: work.work_id, fan_in: true }); return { ok: true, work_id: work.work_id, status: "completed", fan_in: true }; }
+export function finishFanInWork(context, id, result) {
+    const work = requireWork(context, id);
+    assertMemoryRepairWritePrepared(work);
+    if (["dd-flow/memory-composition-work-result@1", "dd-flow/memory-review-work-result@1"].includes(work.result_schema ?? ""))
+        throw new AppError("memory_work_result_preparation_required", "Memory Work cannot bypass registered result settlement through fan-in", 1);
+    assertRunMutationAllowed(context, work.project_id, work.run_id);
+    if (work.status !== "running")
+        throw new AppError("invalid_work_state", "Fan-in Work is not running", 2, { work_id: work.work_id, status: work.status });
+    if (context.db.get("SELECT 1 FROM works WHERE parent_work_id = ? AND status IN ('created','running','paused') LIMIT 1", [work.work_id]))
+        throw new AppError("active_child_work", "Fan-in Work still has active children", 2, { work_id: work.work_id });
+    const now = context.now();
+    context.db.run("UPDATE works SET status = 'completed', result = ?, completed_at = ?, updated_at = ? WHERE work_id = ?", [result, now, now, work.work_id]);
+    context.db.run("UPDATE work_sessions SET status = 'completed', completed_at = COALESCE(completed_at, ?), updated_at = ? WHERE work_id = ? AND status = 'running'", [now, now, work.work_id]);
+    refreshRunWorkProjection(context, work.project_id, work.run_id);
+    appendFlowRunTimelineEvent(context, work.project_id, work.run_id, { type: "work_completed", work_id: work.work_id, fan_in: true });
+    return { ok: true, work_id: work.work_id, status: "completed", fan_in: true };
+}
 export function failWork(context, id, reason) { return settle(context, id, "failed", reason); }
 export function cancelWork(context, id, reason) { return settle(context, id, "cancelled", reason); }
 export function prepareWorkSettlement(context, id, status, result) {
     if (status !== "completed" && (typeof result !== "string" || !result.trim()))
         throw new AppError("usage", "Work settlement requires a nonempty --reason", 2);
     const work = requireWork(context, id);
+    assertMemoryRepairTerminalFailureAllowed(context, work, status);
     assertWorkSettlementAllowed(context, work.project_id, work.run_id, work.work_id);
     if (work.status !== "running" && !(status === "cancelled" && work.status === "created"))
         throw new AppError("invalid_work_state", "Work is not running", 2, { status: work.status });
@@ -978,6 +1335,11 @@ function legacyReviewFingerprint(work, run) {
 }
 function assertSharedReviewInput(context, work, run, generation = recoveryGuard(context, work.project_id, work.run_id)?.generation ?? 0) {
     const payload = parsePayload(work), kind = payload?.kind;
+    if (kind === "memory-review") {
+        const input = prepareMemoryReviewWorkInput(context, work, run, generation).input;
+        assertReviewSiblingBaseline(context, work, input, generation);
+        return input;
+    }
     const relative = kind === "code-review" ? "06-code-review/review-context.json" : kind === "plan-review" ? "04-plan-review/work-context.json" : null;
     if (!relative || !work.parent_work_id)
         return null;
@@ -1099,7 +1461,7 @@ function assertReviewSiblingBaseline(context, work, current, generation) {
         break;
     }
 }
-async function settle(context, id, status, result, progress, retry) {
+async function settle(context, id, status, result, progress, retry, memoryResult) {
     const { work, run, link } = prepareWorkSettlement(context, id, status, result);
     id = work.work_id;
     let receipts = [];
@@ -1123,7 +1485,23 @@ async function settle(context, id, status, result, progress, retry) {
         }
     };
     if (status === "completed") {
-        validateWorkResult(work, result, run.project_root, run.workspace_root, requireRunHome(run), run.id, link?.result_path ?? null);
+        if (!PreparedPublishedMemoryRepairWorkResult.isPrepared(memoryResult))
+            assertMemoryRepairWritePrepared(work);
+        if (["dd-flow/memory-composition-work-result@1", "dd-flow/memory-review-work-result@1", "dd-flow/memory-repair-work-result@1"].includes(work.result_schema ?? "")) {
+            const correctOwner = work.result_schema === "dd-flow/memory-composition-work-result@1"
+                ? memoryResult instanceof PreparedRegisteredMemoryCompositionWorkResult
+                : work.result_schema === "dd-flow/memory-review-work-result@1" ? memoryResult instanceof PreparedRegisteredMemoryReviewWorkResult
+                    : PreparedPublishedMemoryRepairWorkResult.isPrepared(memoryResult);
+            if (!correctOwner || !memoryResult || memoryResult.workId !== work.work_id || !link)
+                throw new AppError("memory_work_result_preparation_required", "Memory Work completion requires admitted registered output", 1);
+            memoryResult.revalidate(context);
+            memoryResult.assertSettlementScope(context, link.session_id, link.id);
+        }
+        else {
+            if (memoryResult)
+                throw new AppError("memory_work_result_preparation_required", "Prepared memory output cannot settle another Work schema", 1);
+            validateWorkResult(work, result, run.project_root, run.workspace_root, requireRunHome(run), run.id, link?.result_path ?? null);
+        }
         const packet = codePacket(work);
         if (packet) {
             // CODE packets are projected from a PLAN that already validated this
@@ -1158,6 +1536,9 @@ async function settle(context, id, status, result, progress, retry) {
     const now = context.now();
     context.db.writeTransaction(() => {
         assertWorkSettlementAllowed(context, work.project_id, work.run_id, work.work_id);
+        assertMemoryRepairTerminalFailureAllowed(context, requireWork(context, work.work_id), status);
+        if (memoryResult)
+            memoryResult.recordSettlement(context, link.session_id, link.id);
         if (link && !context.db.get("SELECT 1 FROM work_sessions WHERE id = ? AND status = 'running'", [link.id]))
             throw new AppError("work_generation_stale", "Work Session was interrupted or superseded while checks ran", 1, { work_id: id });
         if (link && context.db.get("SELECT start_publication_status FROM work_sessions WHERE id = ?", [link.id])?.start_publication_status && !context.db.get("SELECT 1 FROM work_sessions WHERE id = ? AND start_publication_status = 'published'", [link.id]))
@@ -1165,7 +1546,8 @@ async function settle(context, id, status, result, progress, retry) {
         if (context.db.run("UPDATE works SET status = ?, result = ?, completed_at = ?, updated_at = ? WHERE work_id = ? AND status = ? AND updated_at = ?", [status, result, now, now, id, work.status, work.updated_at]).changes !== 1)
             throw new AppError("work_generation_stale", "Work changed while its result and review inputs were prepared", 1, { work_id: id });
         if (link) {
-            context.db.run("UPDATE work_sessions SET status = ?, result_receipt_json = ?, completed_at = ?, updated_at = ? WHERE id = ?", [status, resultReceipt, now, now, link.id]);
+            if (context.db.run("UPDATE work_sessions SET status = ?, result_receipt_json = ?, completed_at = ?, updated_at = ? WHERE id = ? AND work_id = ? AND session_id = ? AND status = 'running'", [status, resultReceipt, now, now, link.id, work.work_id, link.session_id]).changes !== 1)
+                throw new AppError("work_generation_stale", "Work Session changed or refused settlement while its result was committed", 1, { work_id: id });
             const stillRunning = context.db.get("SELECT 1 FROM work_sessions WHERE session_id = ? AND status = 'running' LIMIT 1", [link.session_id]);
             if (!stillRunning)
                 context.db.run("UPDATE sessions SET status = 'idle', updated_at = ? WHERE project_id = ? AND session_id = ?", [now, work.project_id, link.session_id]);
@@ -1175,7 +1557,7 @@ async function settle(context, id, status, result, progress, retry) {
     settleRecoveryWork(context, work.work_id, status);
     refreshRunWorkProjection(context, work.project_id, work.run_id);
     const control = runControlDirective(context, work.project_id, work.run_id);
-    const newlyReady = control ? [] : context.db.all(`SELECT ${workColumns} FROM works WHERE project_id = ? AND run_id = ? AND status = 'created' ORDER BY created_at, work_id`, [work.project_id, work.run_id]).filter((candidate) => isReady(context, candidate)).map((candidate) => ({ work_id: candidate.work_id, launch_policy: candidate.launch_policy, start_command: workStartCommand(context, candidate) }));
+    const newlyReady = control ? [] : context.db.all(`SELECT ${workColumns} FROM works WHERE project_id = ? AND run_id = ? AND status = 'created' ORDER BY created_at, work_id`, [work.project_id, work.run_id]).filter((candidate) => isReady(context, candidate)).map((candidate) => ({ work_id: candidate.work_id, launch_policy: candidate.launch_policy, start_command: workStartCommand(context, candidate, { preview: true }) }));
     appendFlowRunTimelineEvent(context, work.project_id, work.run_id, { type: `work_${status}`, work_id: work.work_id, session_id: link?.session_id ?? null, ...(coordinationDrift.length ? { coordination_drift: coordinationDrift } : {}) });
     if (status === "completed")
         for (const ready of newlyReady) {
@@ -1240,9 +1622,25 @@ export function bindSessionForResume(context, workId, identity, now) {
 function reactivateBoundSession(context, projectId, sessionId, now) {
     context.db.run("UPDATE sessions SET status = 'active', stop_reason = NULL, stopped_at = NULL, updated_at = ? WHERE project_id = ? AND session_id = ?", [now, projectId, sessionId]);
 }
+export function workResultByteLimit(context, id) {
+    const schema = requireWork(context, id).result_schema;
+    return ["dd-flow/memory-composition-work-result@1", "dd-flow/memory-review-work-result@1", "dd-flow/memory-repair-work-result@1"].includes(schema ?? "") ? 1024 * 1024 : undefined;
+}
 export function prepareWorkResult(context, id, result) {
     try {
         const { work, run, link } = prepareWorkSettlement(context, id, "completed", result);
+        if (work.result_schema === "dd-flow/memory-repair-work-result@1") {
+            prepareMemoryRepairWorkCompletion(context, work, result);
+            return;
+        }
+        const memoryResult = prepareRegisteredMemoryWorkResult(context, work, result);
+        if (memoryResult) {
+            if (!link)
+                throw new AppError("memory_work_result_preparation_required", "Memory Work completion requires an active Work Session", 1);
+            memoryResult.revalidate(context);
+            memoryResult.assertSettlementScope(context, link.session_id, link.id);
+            return;
+        }
         validateWorkResult(work, result, run.project_root, run.workspace_root, requireRunHome(run), run.id, link?.result_path ?? null);
     }
     catch (error) {
@@ -1250,8 +1648,11 @@ export function prepareWorkResult(context, id, result) {
     }
 }
 function validateWorkResult(work, result, projectRoot, workspaceRoot, runHome, runId, resultPath) {
+    assertMemoryRepairWritePrepared(work);
     if (!work.result_schema)
         return;
+    if (["dd-flow/memory-composition-work-result@1", "dd-flow/memory-review-work-result@1"].includes(work.result_schema ?? ""))
+        throw new AppError("memory_work_result_preparation_required", "Memory Work completion requires admitted registered output, not a mutable schema lookup", 1);
     if (!resultPath)
         throw new AppError("runtime_missing", "Work result path is unavailable", 1, { work_id: work.work_id });
     let parsed;
@@ -1269,6 +1670,73 @@ function validateWorkResult(work, result, projectRoot, workspaceRoot, runHome, r
     if (work.result_schema === "dd-flow/plan-review-result@1")
         validatePlanReviewResult(work, parsed, { workspaceRoot, runHome, runId });
 }
+/** Allocation is not write admission. Registered repairs must not reach a
+ * provider, claim a Session or use generic mutable-schema settlement before
+ * their private writer baseline/delta owner is integrated. The memory handler
+ * group stays unregistered during that implementation; no permissive fallback.
+ */
+function assertMemoryRepairWritePrepared(work) {
+    const payload = parsePayload(work);
+    if (work.result_schema === "dd-flow/memory-repair-work-result@1" || payload?.kind === "memory-repair" || payload?.memory_repair) {
+        throw new AppError("memory_repair_write_preparation_required", "Repair execution requires registered writer baseline and bounded delta custody", 1, { effect: "no_effect" });
+    }
+}
+/** Recognizing packet metadata never grants launch or claim authority. Every
+ * supported wave must subsequently acquire its actual private owner. */
+/** Intent presence is a conservative denial, never publication authority.
+ * Fail/cancel must not discard the physical WorkSession required to reconcile
+ * an independently reserved repair. Recheck inside the settlement writer. */
+function assertMemoryRepairTerminalFailureAllowed(context, work, status) {
+    if (status === "completed")
+        return;
+    const payload = parsePayload(work);
+    if (work.result_schema !== "dd-flow/memory-repair-work-result@1" && payload?.kind !== "memory-repair" && !payload?.memory_repair)
+        return;
+    if (context.db.get("SELECT 1 FROM audit_events WHERE project_id=? AND event_type='memory.repair_publication_intent' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? LIMIT 1", [work.project_id, work.run_id, work.work_id])) {
+        throw new AppError("memory_repair_completion_pending", "Reconcile the retained repair publication before terminal failure or cancellation", 1, { effect: "no_effect", run_id: work.run_id, work_id: work.work_id,
+            next_action: "Preserve the running physical WorkSession and exact publication bytes; reconcile through the controller." });
+    }
+}
+function memoryRepairWave(work) {
+    const payload = parsePayload(work);
+    if (work.result_schema !== "dd-flow/memory-repair-work-result@1" && payload?.kind !== "memory-repair" && !payload?.memory_repair)
+        return null;
+    const wave = payload?.memory_repair?.wave;
+    if (work.result_schema !== "dd-flow/memory-repair-work-result@1" || payload?.kind !== "memory-repair" || payload.read_only !== false || wave !== 1 && wave !== 2)
+        assertMemoryRepairWritePrepared(work);
+    return wave;
+}
+function registeredMemoryRepairWave(context, work, run) {
+    const wave = memoryRepairWave(work);
+    if (!wave)
+        return null;
+    const bundle = readFlowRunExecutionBundle(context, { projectRoot: run.project_root, runId: work.run_id });
+    if (bundle?.descriptor.descriptor.id !== "mb-init")
+        assertMemoryRepairWritePrepared(work);
+    return wave;
+}
+function prepareMemoryRepairStartOwner(context, work, run, wave) {
+    // A native child owns no external adapter environment. Its independently
+    // observed Hook CWD is still only a candidate: the copy/route owner below
+    // must admit it before any claim or filesystem projection.
+    const hookKey = context.env.DD_FLOW_MEMORY_REPAIR_HOOK_EVENT;
+    const retained = readFlowRunExecutionBundle(context, { projectRoot: run.project_root, runId: work.run_id });
+    const selectedWork = requireWork(context, work.work_id);
+    const override = parsePayload(selectedWork)?.execution_override;
+    const native = retained?.execution.work("review", override?.agent_profile_id).delegation.mode === "native";
+    const scope = { projectRoot: run.project_root, runId: work.run_id, workId: work.work_id };
+    const workspaceRoot = context.env.DD_FLOW_MEMORY_REPAIR_WORKSPACE ?? (native && hookKey
+        ? (wave === 1 ? prepareMemoryRepairDispatchFromStage : prepareMemorySecondRepairDispatchFromStage)(context, scope).copy_root : null) ?? "";
+    const input = { projectRoot: run.project_root, runId: work.run_id, workId: work.work_id, workspaceRoot };
+    const owner = wave === 1 ? prepareExternalMemoryRepairCopyFromStage(context, input) : prepareMemorySecondRepairLaunchFromStage(context, input);
+    if (owner.root() !== workspaceRoot)
+        throw new AppError("memory_repair_workspace_unbound", "Repair start must inherit its exact independently prepared private copy", 1, { effect: "no_effect" });
+    // The second-wave factory already verifies the private copy and shared
+    // sources before returning; no mutation occurs between that and this return.
+    if (wave === 1)
+        owner.revalidate(context);
+    return owner;
+}
 function validateCodeWorkResult(work, value, projectRoot, runHome, runId) {
     const result = value;
     const changedPaths = (result.changed_paths ?? []).map((item) => normalizeWorkspacePath(projectRoot, item));
@@ -1319,7 +1787,32 @@ export function validateReviewResolutions(workId, assigned, resolutions) {
     if (missing.length || unexpected.length || duplicate)
         throw new AppError("review_repair_incomplete", "Review repair must include exactly one resolution for each assigned finding reference", 2, { work_id: workId, missing, unexpected, duplicate });
 }
-function renderWorkerPrompt(context, work, run, dependencies, commands, workspaceView) {
+function renderWorkerPrompt(context, work, run, dependencies, commands, workspaceView, reviewInput) {
+    const payload = parsePayload(work);
+    const runIndex = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id=? AND id=?", [work.project_id, work.run_id]).index_json);
+    if (runIndex.execution_bundle?.flow_id === "mb-init" && (payload?.memory_composition || payload?.kind === "memory-review" || payload?.kind === "memory-repair")) {
+        assertRunBundleSqlAuthority(context, { projectId: work.project_id, runId: work.run_id }, runIndex.execution_bundle);
+        // Memory Work owns a descriptor packet, not a missing SDLC SPECIFY or PLAN.
+        // Reviewer assignment custody is admitted before rendering and rechecked
+        // by the Work claim writer; composition settlement owns its output proof.
+        const packet = payload.memory_review ?? payload.memory_repair ?? payload.memory_composition;
+        const reviewPacket = payload.kind === "memory-review" ? packet : null;
+        if (reviewPacket && !reviewInput)
+            throw new AppError("memory_review_input_invalid", "Reviewer prompt requires independently prepared wave inputs", 1);
+        return ["<memory_work_packet>", JSON.stringify(packet, null, 2), "</memory_work_packet>", "",
+            ...(payload.memory_composition ? ["<code_check_profile_contract>",
+                "The existing CLI contract for .memory-bank/spec/engineering/code-check-profile.json is dd-flow/code-check-profile@6 (or an existing @7 runner-evidence profile). The installed project-check-profiles@1 schema is a different contract, not a prerequisite for authoring this file.",
+                "This is a shape template, not an assignment or permission to execute checks. Author this file only when your registered task requires it and its path is inside your exact write_scopes. Preserve valid existing @6/@7 bindings; do not downgrade an existing profile or invent runner-evidence contracts.",
+                "```json", JSON.stringify({ schema_id: "dd-flow/code-check-profile@6",
+                    aliases: { "@check/project-tests": "<observed explicitly requested command>" }, require_alias_for: {},
+                    mandatory_by_gate: { readiness: ["@check/project-tests"] } }, null, 2), "```",
+                "aliases maps @check/name to an actual observed, explicitly requested command; replace the placeholder before submission. require_alias_for maps guarded raw command prefixes to an existing alias and may be empty. mandatory_by_gate maps work/code/readiness/merge/release to arrays of defined aliases; explicitly requested init checks belong at readiness. Optional inputs_by_alias maps defined aliases to existing workspace-relative files/directories used by that command. Do not copy example paths, invent commands, edit package scripts, install dependencies, grant network access or select deployment checks. Profile authoring does not run checks or prove a passed receipt; VERIFY executes the selected readiness checks.",
+                "</code_check_profile_contract>", ""] : []),
+            ...(reviewPacket ? ["<frozen_review_criteria>", Buffer.from(reviewPacket.instruction.base64, "base64").toString("utf8"), "</frozen_review_criteria>", "",
+                "<registered_review_inputs>", JSON.stringify(reviewInput?.run_inputs, null, 2),
+                "Workspace references resolve inside workspace_root, including the isolated copy; RUN references resolve inside run_home. These are accepted input bytes, not permission to mutate them.", "</registered_review_inputs>", ""] : []),
+            renderWorkerPromptBody(context, work, run, dependencies, commands)].join("\n");
+    }
     const profile = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [work.project_id, work.run_id]).index_json).execution_profile;
     const operational = profile?.operational_contract ? renderRunOperationalContext(requireRunHome(run), profile.operational_contract.sha256, profile.operational_contract.path) : "";
     const kind = parsePayload(work)?.kind;
@@ -1350,25 +1843,69 @@ function renderWorkerPromptBody(context, work, run, dependencies, commands) {
     const finishWorkCommand = lifecycleCommands.finish;
     const failWorkCommand = lifecycleCommands.fail;
     const mergeWork = parsePayload(work)?.kind === "merge";
+    const repairPacket = parsePayload(work)?.kind === "memory-repair" ? parsePayload(work)?.memory_repair : null;
     const writeBoundary = readOnly
-        ? [`Review inputs under workspace_root (${run.workspace_root}) and run_home are read-only. After Work start, work from workspace_root and do not edit project source, PLAN, aspect maps, CODE evidence, or another Work's files.`, "Do not write inside workspace_root, including an isolated review copy. Write only this Work's declared result-input.json and explicitly assigned Work-owned evidence paths under run_home. Report changed or inaccessible review inputs as a blocker; do not repair them."]
-        : mergeWork
-            ? ["MERGE does not own product-code repair. Use only the stage packet's merge apply command; resolve only paths that Git reports as unmerged. Do not edit integration code, tests, documentation or configuration to make a gate pass.", "RUN artifacts are read-only evidence: refer to them with run:// URIs and let dd-flow persist your submitted result."]
-            : [`HARD RULE: project source reads and writes must remain under ${run.workspace_root}.`, "Do not write through project_root, outside workspace_root, into another RUN, or into Git/worktree control data. Do not create, switch, merge or delete branches/worktrees.", "RUN artifacts are read-only evidence: refer to them with run:// URIs and let dd-flow persist your submitted result. Accepted requirements, non-goals and stop_conditions are semantic hard boundaries. planned_write_areas is not."];
+        ? [`Review inputs under workspace_root (${run.workspace_root}) and run_home are read-only. Use workspace_root for Work start and project evidence reads. Finish/Fail use explicit owned paths and may run from RUN home. Do not edit project source, PLAN, aspect maps, CODE evidence, or another Work's files.`, "Do not write inside workspace_root, including an isolated review copy. Write only this Work's declared result-input.json and explicitly assigned Work-owned evidence paths under run_home. Report changed or inaccessible review inputs as a blocker; do not repair them."]
+        : repairPacket
+            ? [`Work only inside the registered private workspace_root (${run.workspace_root}). Edit only these exact MB paths: ${JSON.stringify(repairPacket.write_paths)}. This is a hard allowlist, not a coordination hint.`,
+                "Do not write through project_root or shared checkout paths. Do not edit canonical dd-flow/mbb, environment files, Git/worktree data, non-MB source, another Work or any other RUN. Do not install tools, commit, merge, or publish your changes; the CLI owns publication and integration.",
+                "Workspace evidence resolves inside this private copy. RUN evidence is read-only. Write only this Work's result-input.json and assigned Work-owned evidence under run_home; neither a result JSON nor a private edit proves accepted publication or finding closure."]
+            : mergeWork
+                ? ["MERGE does not own product-code repair. Use only the stage packet's merge apply command; resolve only paths that Git reports as unmerged. Do not edit integration code, tests, documentation or configuration to make a gate pass.", "RUN artifacts are read-only evidence: refer to them with run:// URIs and let dd-flow persist your submitted result."]
+                : [`HARD RULE: project source reads and writes must remain under ${run.workspace_root}.`, "Do not write through project_root, outside workspace_root, into another RUN, or into Git/worktree control data. Do not create, switch, merge or delete branches/worktrees.", "RUN artifacts are read-only evidence: refer to them with run:// URIs and let dd-flow persist your submitted result. Accepted requirements, non-goals and stop_conditions are semantic hard boundaries. planned_write_areas is not."];
     const completionRepair = readOnly
         ? ["If Finish reports input drift or an infrastructure failure, report the exact receipt and stop. Do not change the reviewed files to make the check pass."]
-        : mergeWork
-            ? ["A failed integration check is evidence for a source-repair cycle, not permission to repair the integration workspace. Follow the exact merge repair command returned by dd-flow."]
-            : ["Read the failed receipt and its stdout/stderr. Fix project-owned source, migration, test, formatting, or configuration errors in this same Work, then use the returned retry_command with your result. Internal invocation IDs are runtime-owned; do not copy or invent them. Do not invent a cause that does not appear in the retained output."];
+        : repairPacket
+            ? ["On input drift, custody loss or publication/infrastructure failure, retain the exact receipt and stop. Do not edit shared files, reconstruct authority, change unassigned paths, or retry by starting another Session. A needed path outside write_paths is an assignment conflict, not permission to widen the repair."]
+            : mergeWork
+                ? ["A failed integration check is evidence for a source-repair cycle, not permission to repair the integration workspace. Follow the exact merge repair command returned by dd-flow."]
+                : ["Read the failed receipt and its stdout/stderr. Fix project-owned source, migration, test, formatting, or configuration errors in this same Work, then use the returned retry_command with your result. Internal invocation IDs are runtime-owned; do not copy or invent them. Do not invent a cause that does not appear in the retained output."];
     const codeContext = packet ? ["<semantic_spine>", JSON.stringify(packet.semantic_spine, null, 2), "</semantic_spine>", "", ...(packet.repair ? ["<repair_context>", JSON.stringify(packet.repair, null, 2), "Read the failed receipt and its linked stdout/stderr before editing. Preserve the accepted origin context and fix only the evidenced failure.", "</repair_context>", ""] : []), "<accepted_requirements>", JSON.stringify(packet.requirements, null, 2), "</accepted_requirements>", "", "<write_boundary_invariant>", "For a mutation guarded by membership, ownership, authorization or parent lifecycle state, preserve that predicate in the write statement or make guard and write one explicit transaction with the needed lock. A prior read may diagnose an error but never proves a later write remains allowed. Apply this to create, update, delete and parent-state mutations.", "</write_boundary_invariant>", "", "<acceptance_context>", "The criteria below are end-to-end context. Complete this Work's semantic contribution and declared checks; another ordered Work may own a different acceptance surface.", JSON.stringify(packet.acceptance, null, 2), "</acceptance_context>", "", "<required_read>", "These are mandatory starting sources, not a read allowlist. Read any additional project files needed to implement the Work correctly.", ...packet.required_read.map((item) => `- ${resolveRunReferences(item, work.run_id, requireRunHome(run))}`), "</required_read>", "", "<discovery_boundary>", "These are likely discovery areas, not a hard boundary. Expand project-local investigation when required and report material additions.", ...packet.discovery_boundary.map((item) => `- ${item}`), "</discovery_boundary>", "", "<planned_write_areas>", "SOFT COORDINATION HINT ONLY. These paths help the coordinator avoid concurrent collisions. They do not grant or deny write permission and do not limit the files needed for this Work. You may create or change any project file under workspace_root that is necessary and in semantic scope; report every actual changed path.", ...(packet.planned_write_areas.length ? packet.planned_write_areas.map((item) => `- ${item}`) : ["- none predicted; derive the necessary files from the task"]), "</planned_write_areas>", "", ...(packet.provides_checks.length ? ["<provided_checks>", ...packet.provides_checks.map((item) => `- ${item.id}: materialize ${item.command}${item.definition ? ` as ${item.definition}` : ""}; it is not usable until this Work finishes.`), "Update the declared project command or alias before Work finish. The CLI verifies materialization at Work finish. Execution occurs at its declared run_at gate, not necessarily in this Work.", "</provided_checks>", ""] : []), "<verification>", ...packet.checks.map((item) => `- ${item.id} at ${item.run_at}: ${item.command} — ${item.purpose}`), "The CLI executes work-scoped checks and retains their receipts. Report semantic evidence only; do not rerun declared checks manually.", "</verification>", "", "<stop_conditions>", ...packet.stop_conditions.map((item) => `- ${item}`), "</stop_conditions>", ""] : [];
     if (packet)
         codeContext.push("<document_updates>", JSON.stringify(packet.document_updates, null, 2), "Materialize every listed update. dd-flow verifies the resulting file against its PLAN-time baseline.", "</document_updates>", "", "<completion_contract>", "Successful completion requires empty deviations and blockers and every assigned document update in changed_paths. A necessary path outside planned_write_areas is normal coordination drift, not a blocker; include it in changed_paths and continue.", "</completion_contract>", "");
     if (packet)
         codeContext.push("<temporary_services>", "Prefer the declared check launcher: it already owns check resources. If the planned scenario genuinely requires an interactive HTTP service, use the managed supervisor below. This is a template: replace the project service command, port names and readiness path from the plan/project instructions; do not invent a fixed port.", `${command} runtime process start --run ${run.id} --project-root ${JSON.stringify(run.project_root)} --command '<project-service-command>' --ports api --ready-port api --ready-path /health --json --progress-jsonl`, "The service receives DD_FLOW_PORT_API (and equivalent variables for all declared names). The command stays running as its supervisor. Retain its tool handle; wait for the service ready event and read its service.json receipt. Pass those exact ports and the same project environment to reset/seed, API and browser operations.", "A ready receipt proves service readiness only. Record the scenario outcome and real evidence separately. After the scenario, execute the exact stop_command from that receipt, then wait for the supervisor to exit. Never use pkill/killall or stop a sibling's process. If cleanup fails, retain the process id and report the failure; do not claim the resource is free.", "</temporary_services>", "");
-    return ["<work>", `- work_id: ${work.work_id}`, `- run_id: ${work.run_id}`, `- project_root: ${run.project_root}`, `- workspace_root: ${run.workspace_root}`, `- run_home: ${requireRunHome(run)}`, "</work>", "", "<cli_context>", `- Work commands use the short ID ${shortWorkId(work.work_id)}; dd-flow binds it to this RUN.`, `- @project = ${run.project_root}`, `- @workspace = ${run.workspace_root}`, `- @run = ${requireRunHome(run)}`, "- @ aliases are accepted only by declared dd-flow path parameters. Copy the quoted alias literally; do not add backslashes. Shell tools such as cat and rg require ordinary paths relative to cwd or absolute paths.", "- Lifecycle invocation IDs are internal runtime authority and are intentionally omitted from commands.", "</cli_context>", "", "<hard_write_boundary>", ...writeBoundary, "</hard_write_boundary>", "", ...codeContext, "<dependency_results>", JSON.stringify(dependencies.filter(Boolean), null, 2), "</dependency_results>", "", "<task>", resolveRunReferences(work.task, work.run_id, requireRunHome(run)), "</task>", "", ...(work.result_schema ? ["<result_contract>", `Return JSON matching \`${work.result_schema}\`.`, ...resultSchemaGuidance(work, run.id), `Write the completed JSON to ${resultInputPath}. This is an attempt input, not the canonical result.json receipt. dd-flow validates the file and atomically stores the canonical receipt.`, "</result_contract>", ""] : []), "<completion>", packet?.repair?.verification_check_refs?.length ? "Work finish runs its normal work-scoped checks plus the listed causal repair checks. Their original run_at remains an aggregate obligation; this is the additional proof required before accepting this repair." : "Work finish runs only declared run_at=work checks. Stage finish owns readiness/code/merge gates; successful Work completion does not mean those gates have passed.", "A failed receipt means only that the check failed; it is not proof of an engine, harness, dependency, or environment blocker.", ...completionRepair, lifecycleRetryInstruction, "Use Fail only for a concrete external blocker after deterministic bootstrap or a contradiction with an accepted requirement/non-goal. Never fail merely because a necessary project path was absent from planned_write_areas.", "Finish may run for several minutes. Preserve the shell tool's process/session handle and poll that same invocation until it exits; progress arrives as JSONL on stderr. Never reissue Finish merely because final stdout has not arrived.", `First write only the result JSON to ${resultInputPath}. Then run this standalone command:\n${finishWorkCommand}`, `Fail only for an evidenced external or semantic-contract blocker: ${failWorkCommand}`, "</completion>", ""].join("\n");
+    return ["<work>", `- work_id: ${work.work_id}`, `- run_id: ${work.run_id}`, `- project_root: ${run.project_root}`, `- workspace_root: ${run.workspace_root}`, `- run_home: ${requireRunHome(run)}`, "</work>", "", "<cli_context>", `- Work commands use the short ID ${shortWorkId(work.work_id)}; dd-flow binds it to this RUN.`, `- @project = ${run.project_root}`, `- @workspace = ${run.workspace_root}`, `- @run = ${requireRunHome(run)}`, "- @ aliases are accepted only by declared dd-flow path parameters. Copy the quoted alias literally; do not add backslashes. Shell tools such as cat and rg require ordinary paths relative to cwd or absolute paths.", "- Lifecycle invocation IDs are internal runtime authority and are intentionally omitted from commands.", "</cli_context>", "", "<hard_write_boundary>", ...writeBoundary, "</hard_write_boundary>", "", ...codeContext, "<dependency_results>", JSON.stringify(dependencies.filter(Boolean), null, 2), "</dependency_results>", "", "<task>", resolveRunReferences(work.task, work.run_id, requireRunHome(run)), "</task>", "", ...(work.result_schema ? ["<result_contract>", `Return JSON matching \`${work.result_schema}\`.`, ...resultSchemaGuidance(work, run.id), `Write the completed JSON to ${resultInputPath}. This is an attempt input, not the canonical result.json receipt. dd-flow validates the file and atomically stores the canonical receipt.`, "</result_contract>", ""] : []), "<completion>", repairPacket ? "Repair Finish validates and publishes the exact private delta before Work settlement. Independent re-review, correction checks and Stage/RUN acceptance remain separate obligations." : packet?.repair?.verification_check_refs?.length ? "Work finish runs its normal work-scoped checks plus the listed causal repair checks. Their original run_at remains an aggregate obligation; this is the additional proof required before accepting this repair." : "Work finish runs only declared run_at=work checks. Stage finish owns readiness/code/merge gates; successful Work completion does not mean those gates have passed.", "A failed receipt means only that the check failed; it is not proof of an engine, harness, dependency, or environment blocker.", ...completionRepair, ...(repairPacket ? [] : [lifecycleRetryInstruction]), repairPacket ? "Use Fail for an evidenced external blocker or assignment conflict, including any required edit outside the exact write_paths allowlist. Never expand that allowlist or edit the shared checkout." : "Use Fail only for a concrete external blocker after deterministic bootstrap or a contradiction with an accepted requirement/non-goal. Never fail merely because a necessary project path was absent from planned_write_areas.", "Finish may run for several minutes. Preserve the shell tool's process/session handle and poll that same invocation until it exits; progress arrives as JSONL on stderr. Never reissue Finish merely because final stdout has not arrived.", `First write only the result JSON to ${resultInputPath}. Then run this standalone command:\n${finishWorkCommand}`, `Fail only for an evidenced external or semantic-contract blocker: ${failWorkCommand}`, "</completion>", ""].join("\n");
 }
 export function resultSchemaGuidance(work, runId) {
     const schema = work.result_schema;
+    if (schema === "dd-flow/memory-composition-work-result@1") {
+        const packet = parsePayload(work)?.memory_composition;
+        if (!packet || typeof packet.packet_sha256 !== "string" || !Array.isArray(packet.unit_ids) || !packet.unit_ids.length
+            || packet.unit_ids.some(id => typeof id !== "string" || !id) || !Array.isArray(packet.write_scopes) || !packet.write_scopes.length
+            || packet.write_scopes.some(scope => !scope || !["workspace", "run"].includes(scope.root) || typeof scope.path !== "string" || !scope.path))
+            throw new AppError("memory_composition_input_invalid", "Composition result guidance requires its registered assignment", 1);
+        const { packet_sha256 } = packet;
+        const scope = packet.write_scopes[0];
+        return ["This is a shape template, not a completed result. Return only JSON with the fields shown; do not add agent metadata, evidence, findings or changed_paths. Keep the assigned run_id, work_id and packet_sha256 unchanged and include every assigned unit exactly once.",
+            `Exact write_scopes: ${JSON.stringify(packet.write_scopes)}. Each unit needs a summary and nonempty artifacts with exactly root, path and sha256. Artifact root is workspace or run; path is relative to that root and must name an actual regular output file within an assigned write_scope. Compute sha256 from its current bytes. Replace the example path when it names a directory, and replace the zero hash; never invent output hashes or cite the old bootstrap template as current output.`,
+            "Use accepted only after completing the assigned documents. For an evidenced blocker, retain the evidence and use the assigned Fail command, not a blocked result with Finish. Work settlement does not accept Stage/RUN or independent review.",
+            "```json", JSON.stringify({ schema_id: schema, run_id: runId, work_id: work.work_id, packet_sha256, outcome: "accepted", summary: "Describe the actual completed documents.",
+                units: packet.unit_ids.map(id => ({ id, summary: "Describe this unit's actual output.", artifacts: [{ root: scope.root, path: scope.path === "." ? "replace-with-assigned-output.md" : scope.path, sha256: "0".repeat(64) }] })) }, null, 2), "```"];
+    }
+    if (schema === "dd-flow/memory-repair-work-result@1") {
+        const packet = parsePayload(work)?.memory_repair;
+        if (!packet || typeof packet.packet_sha256 !== "string" || !Array.isArray(packet.write_paths) || !Array.isArray(packet.findings))
+            throw new AppError("memory_repair_input_invalid", "Repair guidance requires its registered packet", 1);
+        return ["This is a shape template, not a completed repair. Return only JSON matching the frozen schema. Use accepted only with a nonempty exact physical create/update/delete delta and one causal resolution for every assigned finding. Only registered write_paths may change. before_sha256 comes from the original registered start view; after_sha256 comes from the actual private output bytes; null means absent or deleted. Never invent hashes, paths, findings, source refs or completion.",
+            `Assigned finding ids: ${JSON.stringify(packet.findings.map(finding => finding.id))}. Exact write_paths: ${JSON.stringify(packet.write_paths)}.`,
+            "Each resolution needs finding_id, summary, nonempty delta_paths and nonempty evidence with exact root/path/sha256. A surviving changed output must be cited with its after hash. A deletion-only resolution needs registered retained RUN evidence. Unchanged evidence must match registered input hashes. Accepted does not claim independent re-review or closure.",
+            "Use blocked only when the MB copy is unchanged and changes/resolutions are empty. If a blocker occurs after edits, preserve the private partial outcome and use Fail; do not conceal those edits as a clean blocked result or mutate shared files.",
+            "Repair completion is publication, not the generic CODE check/retry path. Submit only an accepted private result to the assigned managed work finish command. The CLI independently verifies your bounded UTF-8 result (maximum 1 MiB), exact original start/delta and current publication custody, reserves or restores publication, applies its finite retained plan, then settles Work. Do not run memory repair publication-* commands manually or use --retry-check. Successful Work settlement does not close findings, accept independent re-review, or finish Stage/RUN.",
+            "For a clean blocked result, retain its evidence and use the assigned managed Fail command with the concrete reason; do not submit blocked to Finish. Before any publication attempt, an evidenced blocker after private edits also uses Fail while preserving those private bytes. Once Finish reports partial, unknown, memory_repair_publication_pending or memory_repair_completion_pending, do not use Fail, replace result bytes, reissue Finish, or start another Session: retain the exact operation/WorkSession/receipt and await controller reconciliation. A pending publication is not a new semantic blocker.",
+            "Poll the original Finish tool handle until terminal. A missing reply, timeout or observation failure is not permission to repeat the command. Resume only through the controller's exact retained-invocation recovery assignment; never invent invocation IDs, adopt today's shared bytes as a new baseline, or treat generic check-retry guidance as repair-publication recovery.",
+            "```json", JSON.stringify({ schema_id: schema, run_id: runId, work_id: work.work_id, packet_sha256: packet.packet_sha256,
+                wave: packet.wave, outcome: "blocked", summary: "Replace with the concrete evidenced outcome.", changes: [], resolutions: [] }, null, 2), "```"];
+    }
+    if (schema === "dd-flow/memory-review-work-result@1") {
+        const packet = parsePayload(work)?.memory_review;
+        if (!packet?.unit || typeof packet.unit.id !== "string" || typeof packet.packet_sha256 !== "string")
+            throw new AppError("memory_review_input_invalid", "Reviewer result guidance requires its registered assignment", 1);
+        return ["The template below is not a completed review. Replace the summary with an evidence-backed assessment and choose accepted, needs_repair or blocked. Populate assessment evidence with nonempty exact root/path/sha256 references from the registered wave inputs, including an assigned unit output and, when present, an assigned baseline source; project sources use the registered workspace alias. Findings require the assigned unit_id, a concrete problem, minor/major/critical severity and nonempty exact registered references. A material finding cannot accompany accepted. Choose needs_repair only when reporting a major or critical finding. Do not claim another unit or invent references.",
+            "```json", JSON.stringify({ schema_id: schema, run_id: runId, work_id: work.work_id,
+                packet_sha256: packet.packet_sha256, unit_id: packet.unit.id, wave: packet.wave,
+                outcome: "accepted", summary: "Replace with the actual independent assessment.", evidence: [], findings: [] }, null, 2), "```"];
+    }
     const refs = `Evidence refs for project source are relative to workspace_root; RUN evidence uses run://${runId}/path/to/artifact.`;
     if (schema === "dd-flow/code-work-result@3") {
         const packet = codePacket(work);
@@ -1533,12 +2070,20 @@ function validateItem(value, requireExecutionContext = false) { if (!value || ty
     throw new AppError("validation", "result_schema must be a non-empty schema id", 2); const payload = code ? item : (item.payload && typeof item.payload === "object" && !Array.isArray(item.payload) ? item.payload : undefined); return { key: item.key, task: item.task, ...(Array.isArray(item.depends_on) ? { depends_on: item.depends_on } : {}), ...(typeof item.parent === "string" ? { parent: item.parent } : {}), ...(typeof item.launch_policy === "string" ? { launch_policy: item.launch_policy } : {}), ...(typeof item.result_schema === "string" ? { result_schema: item.result_schema } : {}), ...(payload ? { payload } : {}) }; }
 function allowsEmptyRepairChecks(item) { const repair = item.repair; if (!repair || typeof repair !== "object" || Array.isArray(repair))
     return false; const value = repair; return typeof value.check_receipt_id === "string" || (Array.isArray(value.review_findings) && value.review_findings.some((finding) => typeof finding === "object" && finding !== null && Array.isArray(finding.check_refs) && finding.check_refs.some((ref) => typeof ref === "string"))) || (Array.isArray(value.semantic_unresolved) && value.semantic_unresolved.some((item) => typeof item === "string")); }
-export function refreshRunWorkProjection(context, projectId, runId) { refreshRunSessionProjection(context, projectId, runId); const run = context.db.get("SELECT run_root FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]); if (run?.run_root) {
-    const obsolete = path.join(run.run_root, "work.json");
-    if (fs.existsSync(obsolete))
-        fs.rmSync(obsolete);
-} }
-export function codeWorkGraph(context, projectId, runId) { const index = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId])?.index_json ?? "{}"); const active = index.stage_runs?.some(item => item.stage === "code-review" && item.status === "running") ? "code-review" : "code"; const members = index.stage_runs?.length ? stageWorkIds(context, projectId, runId, active) : null; const works = context.db.all(`SELECT ${workColumns} FROM works WHERE project_id = ? AND run_id = ? ORDER BY created_at, work_id`, [projectId, runId]).filter((work) => Boolean(codePacket(work)) && (!members || members.has(work.work_id))); const ready = works.filter((work) => isReady(context, work)); return { total: works.length, created: works.filter((work) => work.status === "created").length, running: works.filter((work) => work.status === "running").length, completed: works.filter((work) => work.status === "completed").length, failed: works.filter((work) => work.status === "failed").length, ready: ready.map((work) => ({ work_id: work.work_id, task: work.task, launch_policy: work.launch_policy, start_command: workStartCommand(context, work) })), blocked: works.filter((work) => work.status === "created" && !ready.includes(work)).map((work) => ({ work_id: work.work_id, depends_on: parseDependencies(work) })) }; }
+export function refreshRunWorkProjection(context, projectId, runId) {
+    refreshRunSessionProjection(context, projectId, runId);
+    scheduleObsoleteWorkProjectionCleanup(context, projectId, runId);
+}
+function scheduleObsoleteWorkProjectionCleanup(context, projectId, runId) {
+    const run = context.db.get("SELECT run_root FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]);
+    if (run?.run_root) {
+        const obsolete = path.join(run.run_root, "work.json");
+        // A failed allocation/settlement must not remove a pre-existing projection.
+        // Like publication, filesystem cleanup belongs after the outer SQL commit.
+        context.db.afterCommit(() => fs.rmSync(obsolete, { force: true }));
+    }
+}
+export function codeWorkGraph(context, projectId, runId) { const index = JSON.parse(context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [projectId, runId])?.index_json ?? "{}"); const active = index.stage_runs?.some(item => item.stage === "code-review" && item.status === "running") ? "code-review" : "code"; const members = index.stage_runs?.length ? stageWorkIds(context, projectId, runId, active) : null; const works = context.db.all(`SELECT ${workColumns} FROM works WHERE project_id = ? AND run_id = ? ORDER BY created_at, work_id`, [projectId, runId]).filter((work) => Boolean(codePacket(work)) && (!members || members.has(work.work_id))); const ready = works.filter((work) => isReady(context, work)); return { total: works.length, created: works.filter((work) => work.status === "created").length, running: works.filter((work) => work.status === "running").length, completed: works.filter((work) => work.status === "completed").length, failed: works.filter((work) => work.status === "failed").length, ready: ready.map((work) => ({ work_id: work.work_id, task: work.task, launch_policy: work.launch_policy, start_command: workStartCommand(context, work, { preview: true }) })), blocked: works.filter((work) => work.status === "created" && !ready.includes(work)).map((work) => ({ work_id: work.work_id, depends_on: parseDependencies(work) })) }; }
 function parsePayload(work) { if (!work.payload_json)
     return null; try {
     const value = JSON.parse(work.payload_json);