@deksden-com/dd-flow-cli 0.9.0-beta.14 → 0.9.0-beta.140

package/dist/services/code-checks.js

@@ -1,25 +1,97 @@
 import crypto from "node:crypto";
+import { candidateFailureFiles, checkRepairDisposition, readRunnerEvidence, readRunnerProgress, runnerContractsValid, runnerEvidencePass, runnerObservationDurations } from "./check-runner-evidence.js";
+export { assertSourceRepairEligible, checkRepairDisposition } from "./check-runner-evidence.js";
+import { isGitlessWorkspace, ownedWorkspaceHookPath, projectServicePathFilter, workspaceGitFiles } from "./workspace-files.js";
 import { spawn, spawnSync } from "node:child_process";
+import { ObservationClock, validateObservationDuration } from "../harness-runtime/lib/observation-clock.mjs";
 import fs from "node:fs";
 import path from "node:path";
-import { AppError } from "../shared/errors.js";
-import { confirmManagedProcess, finishManagedProcess, heartbeatManagedProcess, managedProcessStatus, managedOwnerIsAlive, processTreeIsAlive, registerManagedProcess, reservePorts } from "./managed-processes.js";
+import { isDeepStrictEqual } from "node:util";
+import { parse } from "shell-quote";
+import { assertRunMutationAllowed } from "./run-recovery.js";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { stopProcessGroup } from "../harness-runtime/lib/managed-daemon.mjs";
+import { createRenewalState, maintenanceRetryable, renewalConfirmed, renewalDelay, renewalFailure, renewalRemaining, RENEWAL_POLICY } from "../harness-runtime/lib/lease-renewal.mjs";
+import { confirmManagedProcess, finishManagedProcess, renewManagedProcess, managedProcessStatus, managedProcessRuntimeHome, managedOwnerIsAlive, processTreeIsAlive, registerManagedProcess, reservePorts } from "./managed-processes.js";
+import { admitRuntimeCheck, runtimeBudgetForRun } from "./runtime-budget.js";
+import { getResourceDatabase } from "../storage/database.js";
+import { readBoundedReleaseFile } from "./release-source.js";
 const profileRelativePath = path.join(".memory-bank", "spec", "engineering", "code-check-profile.json");
 // Receipt reservation precedes child spawn so an interrupted CLI leaves an
 // auditable attempt. A second caller must not mistake that small handoff window
 // for a dead check and overwrite its outcome.
 const receiptStartingGraceMs = 30_000;
-export function codeExecutionEnvironment(workspaceRoot) { const suffix = crypto.createHash("sha256").update(path.resolve(workspaceRoot)).digest("hex").slice(0, 12); return { ...process.env, DD_FLOW_LOCAL_DATABASE_SUFFIX: suffix }; }
+/** The check writer proves an empty tree before marking its registration terminal. */
+export function terminalCheckSettled(context, record) {
+    if (record.kind !== "check" || !record.check_id || record.owner_id !== `check:${record.check_id}` || !record.project_id || !record.run_id
+        || !record.pid || !record.pid_started_at || !["stopped", "failed"].includes(record.state) || !record.finished_at)
+        return null;
+    let metadata;
+    try {
+        metadata = JSON.parse(record.metadata_json);
+    }
+    catch {
+        return null;
+    }
+    if (metadata.role !== "check" || managedProcessRuntimeHome(record, context) !== context.ddFlowHome)
+        return null;
+    let resource;
+    try {
+        resource = getResourceDatabase(context.env.DD_FLOW_RESOURCE_HOME ?? context.ddFlowHome, "read_existing");
+    }
+    catch {
+        return null;
+    }
+    try {
+        const current = resource.get("SELECT * FROM managed_processes WHERE id = ?", [record.id]);
+        if (!current || current.lease_token !== record.lease_token || current.owner_id !== record.owner_id || current.pid !== record.pid
+            || current.pid_started_at !== record.pid_started_at || current.metadata_json !== record.metadata_json || current.state !== record.state
+            || current.project_id !== record.project_id || current.run_id !== record.run_id || current.work_id !== record.work_id
+            || current.check_id !== record.check_id || current.finished_at !== record.finished_at)
+            return null;
+        const receipt = context.db.get("SELECT status, finished_at, work_id FROM check_receipts WHERE id = ? AND project_id = ? AND run_id = ?", [record.check_id, record.project_id, record.run_id]);
+        return receipt && receipt.work_id === record.work_id && ["passed", "failed", "aborted"].includes(receipt.status) && receipt.finished_at
+            ? { status: receipt.status, finished_at: receipt.finished_at } : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        resource.close?.();
+    }
+}
+export function codeExecutionEnvironment(workspaceRoot, checkEnvironment) {
+    if (checkEnvironment !== undefined && (!checkEnvironment || typeof checkEnvironment !== "object" || Array.isArray(checkEnvironment)
+        || Object.keys(checkEnvironment).length !== 1 || typeof checkEnvironment.CODEX_HOME !== "string"
+        || checkEnvironment.CODEX_HOME.length > 4096 || checkEnvironment.CODEX_HOME.includes("\0") || !path.isAbsolute(checkEnvironment.CODEX_HOME)))
+        throw new AppError("invalid_check_environment", "Owned check environment must name one absolute Codex home", 2, { effect: "no_effect" });
+    const suffix = crypto.createHash("sha256").update(path.resolve(workspaceRoot)).digest("hex").slice(0, 12);
+    // The managed CLI's Node must win over a provider app's PATH: a Rosetta
+    // provider can otherwise run x64 checks against arm64-installed modules.
+    const environment = { ...process.env, PATH: `${path.dirname(process.execPath)}${path.delimiter}${process.env.PATH ?? ""}`, DD_FLOW_LOCAL_DATABASE_SUFFIX: suffix };
+    delete environment.NODE_PATH;
+    for (const key of ["DD_FLOW_CHECK_RUNNER_EVIDENCE_PATH", "DD_FLOW_CHECK_RUNNER_PROGRESS_PATH", "DD_FLOW_CHECK_INVOCATION_ID", "DD_FLOW_CHECK_ID", "DD_FLOW_CHECK_INPUT_HASH", "DD_FLOW_CHECK_VERIFICATION_EPOCH", "DD_FLOW_CHECK_COMMAND"])
+        delete environment[key];
+    if (checkEnvironment)
+        environment.CODEX_HOME = checkEnvironment.CODEX_HOME;
+    return environment;
+}
+export function workspaceOperationId(workspaceRoot) { return `workspace:${crypto.createHash("sha256").update(path.resolve(workspaceRoot)).digest("hex")}`; }
 export function readCodeCheckProfile(workspaceRoot) {
     const file = path.join(workspaceRoot, profileRelativePath);
     if (!fs.existsSync(file))
         return { profile: null, hash: null, file };
     const bytes = fs.readFileSync(file);
     const value = JSON.parse(bytes.toString("utf8"));
-    if (value.schema_id !== "dd-flow/code-check-profile@6")
-        throw new AppError("invalid_code_check_profile", "CODE check profile has an unsupported schema", 2, { file, schema_id: value.schema_id ?? null, required: "dd-flow/code-check-profile@6" });
-    if (!isStringRecord(value.aliases) || !isStringRecord(value.require_alias_for) || !isGateRecord(value.mandatory_by_gate) || !isPortAliasRecord(value.ports_by_alias))
-        throw new AppError("invalid_code_check_profile", "CODE check profile aliases, require_alias_for, mandatory_by_gate or ports_by_alias are invalid", 2, { file });
+    if (!["dd-flow/code-check-profile@6", "dd-flow/code-check-profile@7"].includes(value.schema_id ?? ""))
+        throw new AppError("invalid_code_check_profile", "CODE check profile has an unsupported schema", 2, { file, schema_id: value.schema_id ?? null, supported: ["dd-flow/code-check-profile@6", "dd-flow/code-check-profile@7"] });
+    if (!runnerContractsValid(value.runner_evidence_by_alias) || value.schema_id === "dd-flow/code-check-profile@6" && value.runner_evidence_by_alias !== undefined)
+        throw new AppError("invalid_code_check_profile", "Runner evidence requires valid profile@7 relative artifact contracts", 2, { file });
+    for (const alias of Object.keys(value.runner_evidence_by_alias ?? {}))
+        if (!value.aliases?.[alias])
+            throw new AppError("invalid_code_check_profile", "Runner evidence references an unknown alias", 2, { file, alias });
+    if (!isStringRecord(value.aliases) || !isStringRecord(value.require_alias_for) || !isGateRecord(value.mandatory_by_gate) || !isPortAliasRecord(value.ports_by_alias) || !isInputAliasRecord(workspaceRoot, value.inputs_by_alias))
+        throw new AppError("invalid_code_check_profile", "CODE check profile aliases, require_alias_for, mandatory_by_gate, ports_by_alias or inputs_by_alias are invalid", 2, { file });
     for (const [gate, aliases] of Object.entries(value.mandatory_by_gate))
         for (const alias of aliases ?? [])
             if (!value.aliases[alias])
@@ -27,19 +99,76 @@ export function readCodeCheckProfile(workspaceRoot) {
     for (const alias of Object.keys(value.ports_by_alias ?? {}))
         if (!value.aliases[alias])
             throw new AppError("invalid_code_check_profile", "A port declaration references an unknown alias", 2, { file, alias });
+    for (const alias of Object.keys(value.inputs_by_alias ?? {}))
+        if (!value.aliases[alias])
+            throw new AppError("invalid_code_check_profile", "An input declaration references an unknown alias", 2, { file, alias });
     return { profile: value, hash: crypto.createHash("sha256").update(bytes).digest("hex"), file };
 }
+/**
+ * Planned aliases are qualification-owned extensions: their provider Work is
+ * expected to materialize them after PLAN.  Freeze the project policy and
+ * existing aliases, while still validating every planned alias definition at
+ * execution time.  Unknown edits and changes to existing policy remain part
+ * of the hash and therefore fail closed.
+ */
+export function codeCheckProfileHash(workspaceRoot, checks = []) {
+    const { profile } = readCodeCheckProfile(workspaceRoot);
+    if (!profile)
+        return null;
+    const planned = new Set(checks.filter(check => check.availability === "planned" && check.command.startsWith("@check/")).map(check => check.command));
+    const serialize = (value) => profile.schema_id === "dd-flow/code-check-profile@7"
+        ? JSON.stringify(value, (_key, item) => item && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([left], [right]) => left.localeCompare(right))) : item)
+        : JSON.stringify(value);
+    if (!planned.size)
+        return crypto.createHash("sha256").update(serialize(profile)).digest("hex");
+    const canonical = {
+        ...profile,
+        aliases: Object.fromEntries(Object.entries(profile.aliases).filter(([alias]) => !planned.has(alias))),
+        ports_by_alias: Object.fromEntries(Object.entries(profile.ports_by_alias ?? {}).filter(([alias]) => !planned.has(alias))),
+        inputs_by_alias: Object.fromEntries(Object.entries(profile.inputs_by_alias ?? {}).filter(([alias]) => !planned.has(alias))),
+        ...(profile.schema_id === "dd-flow/code-check-profile@7" ? { runner_evidence_by_alias: Object.fromEntries(Object.entries(profile.runner_evidence_by_alias ?? {}).filter(([alias]) => !planned.has(alias))) } : {})
+    };
+    return crypto.createHash("sha256").update(serialize(canonical)).digest("hex");
+}
+/** The integration target starts at its baseline profile; the reviewed source
+ * may add aliases, but must not change existing check policy or bindings. */
+export function mergeCheckProfileHash(sourceWorkspace, targetWorkspace, checks) {
+    const source = readCodeCheckProfile(sourceWorkspace).profile;
+    const target = readCodeCheckProfile(targetWorkspace).profile;
+    if (!source && !target)
+        return null;
+    if (!source || !target)
+        throw new AppError("check_profile_drift", "Source and integration check profiles differ", 1);
+    const retained = structuredClone(source);
+    for (const field of ["aliases", "ports_by_alias", "inputs_by_alias", "runner_evidence_by_alias"]) {
+        const old = target[field];
+        if (!old) {
+            delete retained[field];
+            continue;
+        }
+        const current = source[field] ?? {};
+        retained[field] = Object.fromEntries(Object.keys(old).filter(key => key in current).map(key => [key, current[key]]));
+    }
+    const existingAliases = new Set(Object.keys(target.aliases));
+    const changedExistingMetadata = ["ports_by_alias", "inputs_by_alias", "runner_evidence_by_alias"].some(field => Object.keys(source[field] ?? {}).some(alias => existingAliases.has(alias) && !(alias in (target[field] ?? {}))));
+    if (changedExistingMetadata || !isDeepStrictEqual(retained, target)) {
+        throw new AppError("check_profile_drift", "Source check profile changes existing integration policy", 1, { source_profile_hash: codeCheckProfileHash(sourceWorkspace, checks), target_profile_hash: codeCheckProfileHash(targetWorkspace, checks) });
+    }
+    return codeCheckProfileHash(sourceWorkspace, checks);
+}
 export function validateCodeCheckCommands(workspaceRoot, commands) {
     const { profile, file } = readCodeCheckProfile(workspaceRoot);
-    if (!profile)
-        return [...commands];
-    return commands.map((command) => { if (command.startsWith("@check/")) {
-        if (!profile.aliases[command]?.trim())
-            throw new AppError("unknown_code_check_alias", "CODE check alias is not defined by the project profile", 2, { alias: command, file });
+    return commands.map((command) => {
+        if (command.startsWith("@check/")) {
+            if (!profile?.aliases[command]?.trim())
+                throw new AppError("unknown_code_check_alias", "CODE check alias is not defined by the project profile", 2, { alias: command, file });
+            return command;
+        }
+        for (const [prefix, alias] of Object.entries(profile?.require_alias_for ?? {}))
+            if (command === prefix || command.startsWith(`${prefix} `))
+                throw new AppError("raw_code_check_forbidden", "CODE check must use the project alias instead of a raw guarded command", 2, { command, required_alias: alias, file });
         return command;
-    } for (const [prefix, alias] of Object.entries(profile.require_alias_for))
-        if (command === prefix || command.startsWith(`${prefix} `))
-            throw new AppError("raw_code_check_forbidden", "CODE check must use the project alias instead of a raw guarded command", 2, { command, required_alias: alias, file }); return command; });
+    });
 }
 export function resolveCodeCheckCommands(workspaceRoot, runId, commands) {
     const validated = validateCodeCheckCommands(workspaceRoot, commands);
@@ -50,7 +179,11 @@ export function resolveCodeCheckCommands(workspaceRoot, runId, commands) {
 }
 export function projectPolicyCheckDeclarations(workspaceRoot, gate) {
     const { profile } = readCodeCheckProfile(workspaceRoot);
-    return (profile?.mandatory_by_gate[gate] ?? []).map((alias) => { const ref = `POLICY/${gate}/${alias.slice(7).replace(/[^a-z0-9]+/gi, "-").replace(/^-|-$/g, "").toLowerCase()}`; return { id: ref, canonical_ref: ref, source: "project_policy", command: alias, purpose: `Mandatory project ${gate} gate.`, run_at: gate, availability: "available", ...(profile?.ports_by_alias?.[alias] ? { ports: profile.ports_by_alias[alias] } : {}) }; });
+    return projectPolicyCheckDeclarationsFromProfile(profile, gate);
+}
+/** The caller may already have independently admitted exact profile bytes. */
+export function projectPolicyCheckDeclarationsFromProfile(profile, gate) {
+    return (profile?.mandatory_by_gate[gate] ?? []).map((alias) => { const ref = `POLICY/${gate}/${alias.slice(7).replace(/[^a-z0-9]+/gi, "-").replace(/^-|-$/g, "").toLowerCase()}`; return { id: ref, canonical_ref: ref, source: "project_policy", command: alias, purpose: `Mandatory project ${gate} gate.`, run_at: gate, availability: "available", ...(profile?.ports_by_alias?.[alias] ? { ports: profile.ports_by_alias[alias] } : {}), ...(profile?.inputs_by_alias?.[alias] ? { inputs: profile.inputs_by_alias[alias] } : {}) }; });
 }
 export function effectiveCheckDeclarations(workspaceRoot, declared, gates) { return gates.flatMap((gate) => [...declared.filter((check) => check.run_at === gate), ...projectPolicyCheckDeclarations(workspaceRoot, gate)]); }
 export function aggregateCheckDeclarations(workspaceRoot) { return projectPolicyCheckDeclarations(workspaceRoot, "code"); }
@@ -60,12 +193,21 @@ export function validateCheckPlacement(workspaceRoot, checks) { const { profile
     if (check.run_at === "work" && aggregateCommands.has(check.command))
         throw new AppError("aggregate_check_requires_code_gate", "A project aggregate check must run at CODE or readiness, not inside one scoped Work", 2, { check_id: check.id, command: check.command, run_at: check.run_at }); }
 export function validateCheckDeclaration(workspaceRoot, check) {
-    if (check.run_at === "external")
-        return;
+    if ((check.required_artifacts ?? []).some(file => path.posix.normalize(file.replaceAll("\\", "/")).split("/")[0] === "engine-outcome.json"))
+        throw new AppError("invalid_code_check_profile", "engine-outcome.json is reserved for engine execution evidence, not a candidate artifact", 2, { check_id: check.id });
+    if (!["work", "code", "readiness", "merge", "release"].includes(check.run_at))
+        throw new AppError("unsupported_check_gate", "Check requires an autonomous executable gate; replan the incompatible declaration", 2, { check_id: check.id, run_at: check.run_at });
+    if (check.runner_evidence !== undefined && !runnerContractsValid({ "@check/declaration": check.runner_evidence }))
+        throw new AppError("invalid_code_check_profile", "Check runner evidence contract is invalid", 2, { check_id: check.id });
     const { profile } = readCodeCheckProfile(workspaceRoot);
+    const resolvedCommand = profile?.aliases[check.command] ?? check.command;
+    validateTerminatingCheckCommand(resolvedCommand, check.id);
     if (check.availability === "planned" && check.command.startsWith("@check/") && !profile?.aliases[check.command])
         throw new AppError("planned_check_not_materialized", "A planned check alias was not materialized by its provider Work", 2, { check_id: check.id, command: check.command, provider: check.provided_by ?? null });
     validateCodeCheckCommands(workspaceRoot, [check.command]);
+    if (check.availability === "available" && !check.command.startsWith("@check/"))
+        assertDirectCheckExecutable(workspaceRoot, check.command, check.id);
+    validateCheckInputs(workspaceRoot, check.inputs ?? []);
     if (check.command.startsWith("@check/") && check.definition && profile?.aliases[check.command] !== check.definition)
         throw new AppError("check_definition_drift", "The accepted check alias definition differs from the current project profile", 2, { check_id: check.id, alias: check.command, expected: check.definition, actual: profile?.aliases[check.command] ?? null });
     if (check.availability !== "planned")
@@ -77,36 +219,379 @@ export function validateCheckDeclaration(workspaceRoot, check) {
     if (!profile?.aliases[check.command])
         throw new AppError("planned_check_not_materialized", "A planned check alias was not materialized by its provider Work", 2, { check_id: check.id, command: check.command, provider: check.provided_by ?? null });
 }
+export function validateTerminatingCheckCommand(command, checkId) {
+    if (isBareServiceScript(command))
+        throw new AppError("non_terminating_check", "A check must terminate; run a finite test instead of a bare dev/start/serve/watch service script", 2, { check_id: checkId, command });
+}
+function isBareServiceScript(command) {
+    const words = parse(command.trim());
+    if (words.some((word) => typeof word !== "string"))
+        return false;
+    let args = words;
+    while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(args[0] ?? ""))
+        args = args.slice(1);
+    const manager = path.basename(args.shift() ?? "");
+    if (!["pnpm", "npm", "yarn", "bun"].includes(manager))
+        return false;
+    while (args.length && ["--filter", "-F", "--dir", "-C", "--cwd"].includes(args[0]))
+        args.splice(0, 2);
+    if (args[0] === "run")
+        args.shift();
+    return ["dev", "start", "serve", "watch"].includes(args[0] ?? "");
+}
+/** Reject a plan-time typo or a fictitious "manual" command before it becomes
+ * a late shell exit. Compound shell programs remain valid: only a simple,
+ * directly named executable is preflighted here. */
+function assertDirectCheckExecutable(workspaceRoot, command, checkId) {
+    const trimmed = command.trim();
+    // A shell operator or expansion makes the launch path dynamic. Do not
+    // guess there; this preflight is deliberately limited to a direct program
+    // with ordinary arguments and optional literal environment assignments.
+    if (/[|&;<>()`$\n\r~]/.test(trimmed))
+        return;
+    const parsed = parse(trimmed);
+    if (parsed.some(word => typeof word !== "string"))
+        return;
+    const words = parsed;
+    let index = 0;
+    const env = codeExecutionEnvironment(workspaceRoot);
+    while (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[index] ?? "")) {
+        const assignment = words[index++];
+        const equals = assignment.indexOf("=");
+        env[assignment.slice(0, equals)] = assignment.slice(equals + 1);
+    }
+    const program = words[index];
+    if (!program)
+        return;
+    const probe = spawnSync("/bin/sh", ["-c", "command -v -- \"$1\" >/dev/null", "dd-flow-check", program], { cwd: workspaceRoot, env, encoding: "utf8", timeout: 5000 });
+    if (probe.error || probe.signal)
+        throw new AppError("check_command_probe_unavailable", "Executable probe could not be observed; availability is unknown", 2, { check_id: checkId, executable: program, cause: probe.error?.message, signal: probe.signal });
+    if (probe.status !== 0)
+        throw new AppError("check_command_unavailable", "Available CODE check names an executable that is unavailable in this environment", 2, { check_id: checkId, command, executable: program });
+}
+// An owning handler supplies this identity; it is a reuse boundary, not an
+// authority proof. Omitting it preserves the historical SDLC input hash.
+function validateCheckEvidenceContext(value) {
+    if (value !== undefined && (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9:._-]{0,255}$/.test(value)))
+        throw new AppError("check_evidence_context_invalid", "Check evidence context must be a bounded opaque identifier", 2, { effect: "no_effect" });
+}
+const evidenceDigest = (value) => crypto.createHash("sha256").update(JSON.stringify(value)).digest("hex");
+/** Prepares current physical evidence outside a writer and retains an exact
+ * SQL-only fence. Declarations must come from the owning handler/policy, never
+ * from the result whose acceptance is being decided. This does not supply
+ * semantic acceptance or choose a memory verification policy.
+ */
+export class PreparedCheckEvidence {
+    #input;
+    #snapshot;
+    #generation;
+    #references;
+    #artifacts;
+    #completions = [];
+    #passed;
+    constructor(input, snapshot, generation, references, artifacts, passed) {
+        this.#input = structuredClone({ projectId: input.projectId, runId: input.runId, runHome: input.runHome, workspaceRoot: input.workspaceRoot, scope: input.scope, checks: input.checks,
+            ...(input.mode === undefined ? {} : { mode: input.mode }), ...(input.workId === undefined ? {} : { workId: input.workId }), ...(input.expectedProfileHash === undefined ? {} : { expectedProfileHash: input.expectedProfileHash }), ...(input.evidenceContext === undefined ? {} : { evidenceContext: input.evidenceContext }), ...(input.checkEnvironment === undefined ? {} : { checkEnvironment: input.checkEnvironment }) });
+        this.#snapshot = snapshot;
+        this.#generation = generation;
+        this.#references = references;
+        this.#artifacts = artifacts;
+        this.#passed = passed;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        validateCheckEvidenceContext(input.evidenceContext);
+        const fail = () => { throw new AppError("check_evidence_stale", "Current declared checks lack owned passed evidence", 2, { effect: "no_effect" }); };
+        if (!input.checks.length || (input.scope === "work") !== Boolean(input.workId) || input.mode !== undefined && input.mode !== "diagnostic")
+            fail();
+        const generation = assertRunMutationAllowed(context, input.projectId, input.runId);
+        const snapshot = checkEvidenceSqlSnapshot(context, input);
+        const selected = JSON.parse(snapshot);
+        if (!selected.run || fs.realpathSync.native(selected.run.workspace_root) !== fs.realpathSync.native(input.workspaceRoot)
+            || fs.realpathSync.native(selected.run.run_root ?? selected.run.run_dir) !== fs.realpathSync.native(input.runHome))
+            fail();
+        const rows = selected.receipts;
+        const root = fs.realpathSync.native(input.runHome);
+        for (const row of rows) {
+            const relative = path.relative(path.resolve(input.runHome), row.receipt_path);
+            if (!path.isAbsolute(row.receipt_path) || relative.startsWith(`..${path.sep}`) || relative === ".." || path.isAbsolute(relative))
+                fail();
+            if (fs.existsSync(row.receipt_path)) {
+                const physical = path.relative(root, fs.realpathSync.native(row.receipt_path));
+                if (physical.startsWith(`..${path.sep}`) || physical === ".." || path.isAbsolute(physical))
+                    fail();
+            }
+        }
+        for (const check of input.checks)
+            validateCheckDeclaration(input.workspaceRoot, check);
+        const { profile } = readCodeCheckProfile(input.workspaceRoot), profileHash = codeCheckProfileHash(input.workspaceRoot, input.checks);
+        if (input.expectedProfileHash !== undefined && profileHash !== input.expectedProfileHash)
+            fail();
+        const checks = input.checks.map(check => {
+            const runner = profile?.runner_evidence_by_alias?.[check.command] ?? check.runner_evidence;
+            return { ...check, ports: check.ports ?? profile?.ports_by_alias?.[check.command] ?? [], inputs: check.inputs ?? profile?.inputs_by_alias?.[check.command] ?? [],
+                ...(runner ? { runner_evidence: runner, required_artifacts: [...new Set([...(check.required_artifacts ?? []), runner.path])] } : {}) };
+        });
+        const commands = resolveCodeCheckCommands(input.workspaceRoot, input.runId, checks.map(check => check.command));
+        assertConsistentDeclarations(checks, commands);
+        const state = workspaceState(input.workspaceRoot, [input.runHome]);
+        const receipts = rows.map(projectCheckReceiptRow);
+        const artifacts = [], completions = [];
+        let passed = true;
+        const references = deduplicate(checks, commands).map(group => {
+            const inputHash = checkInputHash(input.workspaceRoot, group, profileHash, workspaceInputFingerprint(input.workspaceRoot, state.files, group.inputs, [input.runHome]), input.evidenceContext, input.checkEnvironment);
+            const receipt = receipts.filter(item => item.input_hash === inputHash && item.profile_hash === profileHash && item.scope === input.scope && item.work_id === (input.workId ?? null)).at(-1);
+            if (!receipt || !checkReceiptEvidenceValidForMode(bindReceipt(receipt, group), input.mode))
+                fail();
+            passed = passed && receipt.status === "passed";
+            for (const artifact of receipt.artifacts)
+                artifacts.push({ root: "run", path: path.relative(input.runHome, path.join(path.dirname(receipt.receipt_path), "artifacts", artifact.path)).split(path.sep).join("/"), sha256: artifact.sha256 });
+            const bytes = fs.readFileSync(receipt.receipt_path);
+            completions.push({ root: "run", path: path.relative(input.runHome, receipt.completion_path).split(path.sep).join("/"), sha256: crypto.createHash("sha256").update(fs.readFileSync(receipt.completion_path)).digest("hex") });
+            return { id: receipt.id, path: receipt.receipt_path, sha256: crypto.createHash("sha256").update(bytes).digest("hex") };
+        });
+        const prepared = new PreparedCheckEvidence(input, snapshot, generation, references, artifacts, passed);
+        prepared.#completions = completions;
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    references() { return structuredClone(this.#references); }
+    artifactReferences() { return structuredClone(this.#artifacts); }
+    sourceReferences() { return [...this.artifactReferences(), ...structuredClone(this.#completions), ...this.resultReferences().map(reference => ({ root: "run", ...reference }))]; }
+    qualityPassed() { return this.#passed; }
+    resultReferences() {
+        return this.#references.map(reference => ({ path: path.relative(this.#input.runHome, reference.path).split(path.sep).join("/"), sha256: reference.sha256 }));
+    }
+    /** For an owning acceptance writer to retain independently of agent bytes.
+     * The row digest pins historical execution, not later workspace policy.
+     */
+    retainedReferences(context) {
+        return context.db.readSnapshot(() => {
+            this.assertCustody(context);
+            return this.#references.map(reference => ({ id: reference.id, path: path.relative(this.#input.runHome, reference.path).split(path.sep).join("/"), sha256: reference.sha256,
+                sql_sha256: evidenceDigest(context.db.get("SELECT * FROM check_receipts WHERE project_id=? AND run_id=? AND id=?", [this.#input.projectId, this.#input.runId, reference.id])) }));
+        });
+    }
+    assertOwner(scope) {
+        if (scope.projectId !== this.#input.projectId || scope.runId !== this.#input.runId || scope.scope !== undefined && scope.scope !== this.#input.scope)
+            throw new AppError("check_receipt_changed", "Prepared checks belong to another RUN or scope", 2, { effect: "no_effect" });
+    }
+    assertCustody(context) {
+        assertRunMutationAllowed(context, this.#input.projectId, this.#input.runId, this.#generation);
+        if (checkEvidenceSqlSnapshot(context, this.#input) !== this.#snapshot)
+            throw new AppError("check_receipt_changed", "Prepared check SQL custody changed", 2, { effect: "no_effect" });
+    }
+    revalidate(context) {
+        const current = PreparedCheckEvidence.prepare(context, this.#input);
+        if (!isDeepStrictEqual(current.sourceReferences(), this.sourceReferences()) || !isDeepStrictEqual(current.#references, this.#references) || current.#snapshot !== this.#snapshot)
+            throw new AppError("check_evidence_stale", "Prepared check evidence changed", 2, { effect: "no_effect" });
+        this.assertCustody(context);
+    }
+}
+/** Historical aggregate execution proof. Selectors must come from an owning
+ * committed acceptance receipt, not a proposed result. This reader does not
+ * select current declarations, inspect the current workspace or execute checks.
+ * Relocation of SQL path fields still requires explicit receipt projection.
+ */
+export class PreparedRetainedCheckEvidence {
+    #input;
+    #snapshot;
+    #generation;
+    constructor(input, snapshot, generation) {
+        this.#input = structuredClone(input);
+        this.#snapshot = snapshot;
+        this.#generation = generation;
+        Object.freeze(this);
+    }
+    static prepare(context, input) {
+        const fail = () => { throw new AppError("retained_check_evidence_invalid", "Accepted checks lack exact historical execution proof", 2, { effect: "no_effect" }); };
+        if (!Array.isArray(input.references) || !input.references.length || input.references.length > 4096
+            || new Set(input.references.map(reference => reference?.id)).size !== input.references.length
+            || input.references.some(reference => !reference || typeof reference.id !== "string" || !reference.id
+                || typeof reference.path !== "string" || !/^[a-f0-9]{64}$/.test(reference.sha256) || !/^[a-f0-9]{64}$/.test(reference.sql_sha256)))
+            fail();
+        const generation = assertRunMutationAllowed(context, input.projectId, input.runId), snapshot = retainedCheckSqlSnapshot(context, input);
+        const selected = JSON.parse(snapshot);
+        if (!selected.run || selected.receipts.some(row => !row))
+            fail();
+        const runRoot = selected.run.run_root ?? selected.run.run_dir;
+        if (!path.isAbsolute(runRoot) || fs.realpathSync.native(runRoot) !== path.resolve(runRoot))
+            fail();
+        for (let index = 0; index < input.references.length; index++) {
+            const reference = input.references[index], row = selected.receipts[index];
+            if (row.scope !== "aggregate" || row.work_id !== null || evidenceDigest(row) !== reference.sql_sha256
+                || row.receipt_path !== path.join(runRoot, reference.path))
+                fail();
+            // Admit contained regular receipt/completion files before any helper
+            // reads them; escaping paths and symlink parents are rejected.
+            const bytes = readRetainedCheckFile(runRoot, reference.path);
+            readRetainedCheckFile(runRoot, path.posix.join(path.posix.dirname(reference.path), "completion.json"));
+            if (crypto.createHash("sha256").update(bytes).digest("hex") !== reference.sha256 || !checkReceiptEvidenceValidForMode(projectCheckReceiptRow(row), input.mode))
+                fail();
+        }
+        const prepared = new PreparedRetainedCheckEvidence(input, snapshot, generation);
+        prepared.assertCustody(context);
+        return prepared;
+    }
+    assertCustody(context) {
+        assertRunMutationAllowed(context, this.#input.projectId, this.#input.runId, this.#generation);
+        if (retainedCheckSqlSnapshot(context, this.#input) !== this.#snapshot)
+            throw new AppError("retained_check_evidence_invalid", "Accepted check SQL custody changed", 2, { effect: "no_effect" });
+    }
+    revalidate(context) {
+        const current = PreparedRetainedCheckEvidence.prepare(context, this.#input);
+        if (current.#snapshot !== this.#snapshot)
+            throw new AppError("retained_check_evidence_invalid", "Accepted check proof changed", 2, { effect: "no_effect" });
+        this.assertCustody(context);
+    }
+}
+function readRetainedCheckFile(root, relative) {
+    const fail = () => { throw new AppError("retained_check_evidence_invalid", "Accepted check file is not a contained regular file", 2, { effect: "no_effect" }); };
+    if (!relative || path.posix.isAbsolute(relative) || path.win32.isAbsolute(relative) || relative.includes("\\") || relative.includes("\0")
+        || relative.split("/").some(segment => !segment || segment === "." || segment === ".."))
+        fail();
+    try {
+        let parent = root;
+        if (!fs.lstatSync(parent).isDirectory())
+            fail();
+        for (const segment of relative.split("/").slice(0, -1)) {
+            parent = path.join(parent, segment);
+            if (!fs.lstatSync(parent).isDirectory())
+                fail();
+        }
+        return readBoundedReleaseFile(path.join(root, relative), 16 * 1024 * 1024);
+    }
+    catch {
+        return fail();
+    }
+}
+function retainedCheckSqlSnapshot(context, input) {
+    return context.db.readSnapshot(() => JSON.stringify({
+        run: context.db.get("SELECT project_id,id,workspace_root,run_root,run_dir FROM runs WHERE project_id=? AND id=?", [input.projectId, input.runId]) ?? null,
+        receipts: input.references.map(reference => context.db.get("SELECT * FROM check_receipts WHERE project_id=? AND run_id=? AND id=?", [input.projectId, input.runId, reference.id]) ?? null)
+    }));
+}
+function checkEvidenceSqlSnapshot(context, input) {
+    return context.db.readSnapshot(() => JSON.stringify({
+        run: context.db.get("SELECT project_id,id,workspace_root,run_root,run_dir FROM runs WHERE project_id=? AND id=?", [input.projectId, input.runId]),
+        receipts: context.db.all("SELECT * FROM check_receipts WHERE project_id=? AND run_id=? ORDER BY reservation_sequence,rowid", [input.projectId, input.runId])
+    }));
+}
 export async function runCodeChecks(context, input) {
-    reconcileUnfinishedChecks(context, input);
+    validateCheckEvidenceContext(input.evidenceContext);
+    const generation = assertRunMutationAllowed(context, input.projectId, input.runId);
+    let gate;
+    for (;;) {
+        assertRunMutationAllowed(context, input.projectId, input.runId, generation);
+        reconcileUnfinishedChecks(context, input);
+        reconcileWorkspaceOwnership(context, input.workspaceRoot);
+        try {
+            gate = acquireWorkspaceGate(context, input);
+            break;
+        }
+        catch (error) {
+            const sameRunGate = managedProcessStatus(context).find(item => item.kind === "workspace-gate" && item.operation_id === workspaceOperationId(input.workspaceRoot) && ["starting", "running", "stopping"].includes(item.state) && item.project_id === input.projectId && item.run_id === input.runId);
+            if (input.scope !== "work" || !input.workId || !(error instanceof AppError) || !["check_in_progress", "managed_operation_in_progress"].includes(error.code) || !sameRunGate)
+                throw error;
+            await new Promise(resolve => setTimeout(resolve, 500));
+        }
+    }
+    try {
+        return await runCodeChecksOwned(context, input, gate.id, generation);
+    }
+    finally {
+        finishManagedProcess(context, { id: gate.id, leaseToken: gate.lease_token, state: "stopped", reason: "workspace_gate_settled" });
+    }
+}
+async function runCodeChecksOwned(context, input, workspaceGateId, generation) {
+    assertRunMutationAllowed(context, input.projectId, input.runId, generation);
     for (const check of input.checks)
         validateCheckDeclaration(input.workspaceRoot, check);
-    const { hash: profileHash, profile } = readCodeCheckProfile(input.workspaceRoot);
-    const checks = input.checks.map((check) => { const ports = profile?.ports_by_alias?.[check.command]; return check.ports || !ports ? check : { ...check, ports }; });
+    const { profile } = readCodeCheckProfile(input.workspaceRoot);
+    const profileHash = codeCheckProfileHash(input.workspaceRoot, input.checks);
+    if (input.expectedProfileHash !== undefined && input.expectedProfileHash !== profileHash)
+        throw new AppError("check_profile_drift", "The frozen check profile differs from the workspace profile", 1, { expected_profile_hash: input.expectedProfileHash, actual_profile_hash: profileHash });
+    const checks = input.checks.map(check => {
+        const ports = profile?.ports_by_alias?.[check.command], inputs = profile?.inputs_by_alias?.[check.command];
+        const runner = profile?.runner_evidence_by_alias?.[check.command] ?? check.runner_evidence;
+        if (runner && !runnerContractsValid({ "@check/declaration": runner }))
+            throw new AppError("invalid_code_check_profile", "Check runner evidence contract is invalid", 2, { check_id: check.id });
+        return { ...check, ...(check.ports || !ports ? {} : { ports }), ...(check.inputs || !inputs ? {} : { inputs }), ...(runner ? { runner_evidence: runner, required_artifacts: [...new Set([...(check.required_artifacts ?? []), runner.path])] } : {}) };
+    });
     const resolved = resolveCodeCheckCommands(input.workspaceRoot, input.runId, checks.map((check) => check.command));
-    const groups = deduplicate(checks, resolved);
-    const receipts = [];
+    assertConsistentDeclarations(checks, resolved);
+    const groups = deduplicate(checks, resolved), receipts = [];
+    const retryIds = [...new Set([...(input.retryReceiptId ? [input.retryReceiptId] : []), ...(input.retryReceiptIds ?? [])])];
+    const retries = new Map();
+    for (const receiptId of retryIds) {
+        const predecessor = validateFailedCheckRetry(context, { projectId: input.projectId, runId: input.runId, receiptId, declarations: checks, reason: input.retryReason });
+        const snapshot = workspaceState(input.workspaceRoot, [input.runHome]);
+        const group = groups.find(candidate => candidate.declarations.some(check => check.run_at === predecessor.gate)
+            && (checkInputHash(input.workspaceRoot, { ...candidate, gate: predecessor.gate }, profileHash, workspaceInputFingerprint(input.workspaceRoot, snapshot.files, candidate.inputs, [input.runHome]), input.evidenceContext, input.checkEnvironment) === predecessor.input_hash
+                || sourceRepairContractMatches(predecessor, candidate, profileHash)));
+        if (!group || retries.has(group))
+            throw new AppError("retry_check_invalid", "Retry must match exactly one current execution contract", 2, { check_receipt_id: receiptId });
+        // Preserve the identity of a pre-deduplication failed execution when an
+        // upgraded RUN retries it; the new receipt still proves every grouped ref.
+        group.gate = predecessor.gate;
+        retries.set(group, receiptId);
+    }
     for (let index = 0; index < groups.length; index += 1) {
         const group = groups[index];
         const before = workspaceState(input.workspaceRoot, [input.runHome]);
         const startedAt = context.now();
-        const inputHash = crypto.createHash("sha256").update(JSON.stringify({ gate: group.gate, command: group.command, environment: String(codeExecutionEnvironment(input.workspaceRoot).DD_FLOW_LOCAL_DATABASE_SUFFIX), required_artifacts: group.requiredArtifacts, ports: [...group.ports].sort() })).digest("hex");
+        const inputFingerprint = workspaceInputFingerprint(input.workspaceRoot, before.files, group.inputs, [input.runHome]);
+        const inputHash = checkInputHash(input.workspaceRoot, group, profileHash, inputFingerprint, input.evidenceContext, input.checkEnvironment);
         const epoch = crypto.createHash("sha256").update(`${group.gate}\0${before.fingerprint}`).digest("hex");
-        const reserved = reserveReceipt(context, { ...input, group, before, profileHash, inputHash, epoch, startedAt });
+        const reservationInput = { ...input, retryReceiptIds: retries.has(group) ? [retries.get(group)] : [], generation, group, before, profileHash, inputHash, epoch, startedAt };
+        delete reservationInput.retryReceiptId;
+        const decision = reserveOrReuseReceipt(context, reservationInput);
+        if (decision.receipt) {
+            receipts.push(bindReceipt(decision.receipt, group));
+            input.progress?.(`check ${index + 1}/${groups.length} ${decision.receipt.status === "passed" ? "reused" : "requires repair"}: ${group.command}`);
+            continue;
+        }
+        const reserved = decision.reserved;
         const { id, evidenceDir, stdoutPath, stderrPath, receiptPath, completionPath } = reserved;
         let resources = {};
         let result = { exitCode: null, error: "check did not start", aborted: true };
         try {
             fs.mkdirSync(evidenceDir, { recursive: true });
-            writeReceipt(receiptPath, receiptFor({ ...reserved, resources, result, status: "running", after: before, mutationPaths: [], artifacts: [] }));
-            const managed = registerManagedProcess(context, { kind: "check", ownerPid: process.pid, ownerId: `check:${id}`, projectId: input.projectId, runId: input.runId, workId: input.workId ?? null, checkId: id, stdoutPath, stderrPath, metadata: { command: group.command } });
+            const startingReceipt = receiptFor({ ...reserved, resources, result, status: "running", after: before, mutationPaths: [], artifacts: [] });
+            if (group.runnerEvidence)
+                startingReceipt.runner_evidence_required = group.runnerEvidence;
+            writeReceipt(receiptPath, startingReceipt);
+            const budget = runtimeBudgetForRun(context, input.projectId, input.runId);
+            if (group.runnerEvidence) {
+                // Reject configuration before acquiring a check lease/ports, so there
+                // is no unconfirmed managed child to strand on a validation error.
+                runnerObservationDurations(process.env);
+            }
+            const managed = registerManagedProcess(context, { kind: "check", ownerPid: process.pid, ownerId: `check:${id}`, operationId: workspaceOperationId(input.workspaceRoot), projectId: input.projectId, runId: input.runId, workId: input.workId ?? null, checkId: id, stdoutPath, stderrPath, metadata: { command: group.command, role: "check", workspace_root: input.workspaceRoot, workspace_gate_id: workspaceGateId, budget } });
             const allocation = await reservePorts(context, { ownerId: managed.owner_id, processId: managed.id, names: group.ports });
             resources = allocation.ports;
-            input.progress?.(`check ${index + 1}/${groups.length} started: ${group.command}`);
+            try {
+                input.progress?.(`check ${index + 1}/${groups.length} preparing: ${group.command}`);
+                assertRunMutationAllowed(context, input.projectId, input.runId, generation);
+            }
+            catch (error) {
+                allocation.release();
+                finishManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, state: "failed", reason: "dispatch_fenced_before_spawn" });
+                throw error;
+            }
             const stdout = fs.openSync(stdoutPath, "a");
             const stderr = fs.openSync(stderrPath, "a");
+            let confirmedExpiry = null;
             try {
-                result = await runCheck(group.command, input.workspaceRoot, { ...codeExecutionEnvironment(input.workspaceRoot), DD_FLOW_EVIDENCE_DIR: evidenceDir, DD_FLOW_CHECK_COMPLETION_FILE: completionPath, ...portEnvironment(resources) }, stdout, stderr, (elapsed) => input.progress?.(`check ${index + 1}/${groups.length} still running (${elapsed}s): ${group.command}`), (pid) => confirmManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, pid, processGroupId: process.platform === "win32" ? null : pid }), () => heartbeatManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token }));
+                const runnerEnvironment = group.runnerEvidence ? { DD_FLOW_CHECK_RUNNER_EVIDENCE_PATH: path.join(evidenceDir, group.runnerEvidence.path), DD_FLOW_CHECK_RUNNER_PROGRESS_PATH: path.join(evidenceDir, "runner-progress.jsonl"), DD_FLOW_CHECK_INVOCATION_ID: id, DD_FLOW_CHECK_ID: id, DD_FLOW_CHECK_INPUT_HASH: inputHash, DD_FLOW_CHECK_VERIFICATION_EPOCH: epoch } : {};
+                if (group.runnerEvidence)
+                    fs.mkdirSync(path.dirname(path.join(evidenceDir, group.runnerEvidence.path)), { recursive: true });
+                result = await runCheck(group.command, input.workspaceRoot, { ...codeExecutionEnvironment(input.workspaceRoot, input.checkEnvironment), DD_FLOW_EVIDENCE_DIR: evidenceDir, DD_FLOW_CHECK_COMPLETION_FILE: completionPath, ...runnerEnvironment, ...portEnvironment(resources) }, stdout, stderr, (elapsed) => input.progress?.(`check ${index + 1}/${groups.length} still running (${elapsed}s): ${group.command}`), (pid) => {
+                    confirmedExpiry = confirmManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, pid, processGroupId: process.platform === "win32" ? null : pid }).lease_expires_at;
+                    assertRunMutationAllowed(context, input.projectId, input.runId, generation);
+                    if (budget)
+                        admitRuntimeCheck(context, managed.id, managed.lease_token);
+                }, attemptMs => renewManagedProcess({ ...context, resourceDatabaseMode: "prepared_existing", databaseDeadlineAt: Date.now() + attemptMs }, { id: managed.id, leaseToken: managed.lease_token }), { leaseExpiresAt: () => confirmedExpiry });
             }
             finally {
                 fs.closeSync(stdout);
@@ -116,7 +601,8 @@ export async function runCodeChecks(context, input) {
             if (processTreeIsAlive(current))
                 throw new AppError("check_in_progress", "The check shell exited but its process tree is still live; retain this receipt and its resources until settlement", 2, { process_id: managed.id, check_receipt_id: id });
             allocation.release();
-            finishManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, state: result.aborted || result.exitCode !== 0 || Boolean(result.error) ? "failed" : "stopped", reason: result.error });
+            if (!result.cleanupUnconfirmed)
+                finishManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, state: result.aborted || result.exitCode !== 0 || Boolean(result.error) ? "failed" : "stopped", reason: result.error });
         }
         catch (error) {
             if (error instanceof AppError && error.code === "check_in_progress")
@@ -125,7 +611,7 @@ export async function runCodeChecks(context, input) {
         }
         const after = workspaceState(input.workspaceRoot, [input.runHome]);
         const mutationPaths = changedPaths(before.files, after.files);
-        const artifacts = collectRequiredArtifacts(evidenceDir, group.requiredArtifacts);
+        let artifacts = collectCheckArtifacts(evidenceDir, group.requiredArtifacts);
         if (fs.existsSync(stderrPath)) {
             if (!artifacts.complete)
                 fs.appendFileSync(stderrPath, `\nmissing required evidence artifacts: ${artifacts.missing.join(", ")}\n`);
@@ -134,13 +620,40 @@ export async function runCodeChecks(context, input) {
             if (mutationPaths.length)
                 fs.appendFileSync(stderrPath, `\ncheck mutated project workspace: ${mutationPaths.join(", ")}\n`);
         }
-        const status = result.aborted ? "aborted" : result.exitCode === 0 && !result.error && artifacts.complete && mutationPaths.length === 0 ? "passed" : "failed";
+        const runnerEvidence = group.runnerEvidence ? readRunnerEvidence(evidenceDir, group.runnerEvidence, { invocation_id: id, check_id: id, command: group.command, input_hash: inputHash, verification_epoch: epoch }) : undefined;
+        const physicalFailures = executionFailures({ exitCode: result.exitCode, launcherError: result.error ?? undefined, cleanupUnconfirmed: result.cleanupUnconfirmed, missing: artifacts.missing, mutations: mutationPaths, invalidRunner: Boolean(group.runnerEvidence && !runnerEvidence) });
+        const candidateFiles = candidateFailureFiles(runnerEvidence, input.workspaceRoot);
+        if (group.runnerEvidence)
+            retainExecutionOutcome(evidenceDir, { id, command: group.command, input_hash: inputHash, verification_epoch: epoch }, input.workspaceRoot, physicalFailures, candidateFiles);
+        const requiredArtifacts = [...new Set([...group.requiredArtifacts, ...(group.runnerEvidence ? ["engine-outcome.json"] : [])])];
+        artifacts = collectCheckArtifacts(evidenceDir, requiredArtifacts);
+        const status = result.aborted ? "aborted" : result.exitCode === 0 && !result.error && artifacts.complete && mutationPaths.length === 0 && (!group.runnerEvidence || runnerEvidencePass(runnerEvidence)) ? "passed" : "failed";
         const receipt = receiptFor({ ...reserved, resources, result, status, after, mutationPaths, artifacts: artifacts.items });
+        receipt.required_artifacts = requiredArtifacts;
+        receipt.candidate_root = input.workspaceRoot;
+        receipt.candidate_files = candidateFiles;
+        receipt.execution_failures = physicalFailures;
+        if (group.runnerEvidence) {
+            receipt.runner_evidence_required = group.runnerEvidence;
+            receipt.runner_evidence = runnerEvidence ?? null;
+        }
         context.db.run("UPDATE check_receipts SET status = ?, exit_code = ?, after_fingerprint = ?, mutation_paths_json = ?, artifacts_json = ?, finished_at = ? WHERE id = ? AND project_id = ? AND status = 'running'", [receipt.status, receipt.exit_code, receipt.after_fingerprint, JSON.stringify(receipt.mutation_paths), JSON.stringify(receipt.artifacts), receipt.finished_at, id, input.projectId]);
         writeReceipt(receiptPath, receipt);
+        if (status === "failed")
+            receipt.diagnostic_evidence_valid = checkReceiptEvidenceValidForMode(receipt, "diagnostic");
         receipts.push(receipt);
         input.progress?.(`check ${index + 1}/${groups.length} ${status}: ${group.command}`);
     }
+    if (receipts.every(receipt => receipt.status === "passed")) {
+        const current = workspaceState(input.workspaceRoot, [input.runHome]), currentProfileHash = codeCheckProfileHash(input.workspaceRoot, input.checks);
+        for (const receipt of receipts) {
+            const group = groups.find(candidate => candidate.declarations.some(check => receipt.check_refs.includes(checkRef(check))));
+            const currentHash = group ? checkInputHash(input.workspaceRoot, group, currentProfileHash, workspaceInputFingerprint(input.workspaceRoot, current.files, group.inputs, [input.runHome]), input.evidenceContext, input.checkEnvironment) : null;
+            if (!group || !checkReceiptEvidenceValid(receipt) || receipt.input_hash !== currentHash)
+                throw new AppError("check_evidence_stale", "Check evidence changed before the gate could be accepted", 1, { check_receipt_id: receipt.id });
+        }
+        assertRunMutationAllowed(context, input.projectId, input.runId, generation);
+    }
     return receipts;
 }
 /**
@@ -149,62 +662,143 @@ export async function runCodeChecks(context, input) {
  * a dead/terminal process becomes an explicit aborted receipt that can retry.
  */
 export function reconcileUnfinishedChecks(context, input) {
-    const where = input.workId ? "project_id = ? AND run_id = ? AND work_id = ? AND status = 'running'" : "project_id = ? AND run_id = ? AND status = 'running'";
+    let where = input.workId ? "project_id = ? AND run_id = ? AND work_id = ? AND status = 'running'" : "project_id = ? AND run_id = ? AND status = 'running'";
     const params = input.workId ? [input.projectId, input.runId, input.workId] : [input.projectId, input.runId];
+    if (input.receiptId) {
+        where += " AND id = ?";
+        params.push(input.receiptId);
+    }
     const pending = context.db.all(`SELECT id, receipt_path, started_at FROM check_receipts WHERE ${where}`, params);
     if (pending.length === 0)
         return [];
     const processes = managedProcessStatus(context);
     const reconciled = [];
     for (const pendingReceipt of pending) {
-        const process = processes.filter((item) => item.check_id === pendingReceipt.id).at(-1);
+        const process = processes.filter((item) => item.check_id === pendingReceipt.id && item.project_id === input.projectId && item.run_id === input.runId).at(-1);
         const receipt = readReceipt(pendingReceipt.receipt_path);
         const completion = receipt ? readCompletion(receipt.completion_path || path.join(path.dirname(pendingReceipt.receipt_path), "completion.json")) : null;
         // A stale lease after host sleep is not permission to duplicate a living
         // check.  Its durable completion marker or explicit reconciliation decides
         // the outcome before another invocation may start.
-        if (process && ["starting", "running", "stopping"].includes(process.state) && (processTreeIsAlive(process) || (process.state === "starting" && (managedOwnerIsAlive(process) !== false || Date.parse(process.lease_expires_at) > Date.parse(context.now()))))) {
+        // A confirmed PID plus its birth time is sufficient to prove that this
+        // exact check writer is gone. Do not retain a dead receipt merely because
+        // older registrations lack the optional parent-owner identity.
+        const processProvenDead = Boolean(process?.pid && process.pid_started_at && !processTreeIsAlive(process));
+        if (process && !processProvenDead && (processTreeIsAlive(process) || (["starting", "running", "stopping", "orphaned"].includes(process.state) && managedOwnerIsAlive(process) !== false))) {
             throw new AppError("check_in_progress", "A previous check invocation is still running", 1, { check_receipt_id: pendingReceipt.id, process_id: process.id, pid: process.pid });
         }
         if (!process && !completion && Date.now() - Date.parse(pendingReceipt.started_at) < receiptStartingGraceMs) {
             throw new AppError("check_in_progress", "A previous check invocation is still initializing", 1, { check_receipt_id: pendingReceipt.id, initializing: true });
         }
         const after = workspaceState(input.workspaceRoot, input.runHome ? [input.runHome] : []);
-        const artifacts = receipt ? collectRequiredArtifacts(path.join(path.dirname(receipt.completion_path || pendingReceipt.receipt_path), "artifacts"), receipt.required_artifacts ?? []) : { complete: false, missing: [], items: [] };
+        let artifacts = receipt ? collectCheckArtifacts(path.join(path.dirname(receipt.completion_path || pendingReceipt.receipt_path), "artifacts"), receipt.required_artifacts ?? []) : { complete: false, missing: [], items: [] };
         const workspaceUnchanged = receipt?.before_fingerprint === after.fingerprint;
-        const status = completion === null ? "aborted" : completion.exit_code === 0 && workspaceUnchanged && artifacts.complete ? "passed" : "failed";
+        const runnerEvidence = receipt?.runner_evidence_required ? readRunnerEvidence(path.join(path.dirname(pendingReceipt.receipt_path), "artifacts"), receipt.runner_evidence_required, { invocation_id: receipt.id, check_id: receipt.id, command: receipt.command, input_hash: receipt.input_hash, verification_epoch: receipt.verification_epoch }) : undefined;
         const exitCode = completion?.exit_code ?? null;
         const finishedAt = completion?.finished_at ?? context.now();
+        const physicalFailures = executionFailures({ exitCode, missing: artifacts.missing.filter(file => file !== "engine-outcome.json"), mutations: workspaceUnchanged ? [] : ["<workspace changed while detached check ran>"], invalidRunner: Boolean(receipt?.runner_evidence_required && !runnerEvidence) });
+        let candidateFiles = candidateFailureFiles(runnerEvidence, input.workspaceRoot);
+        if (receipt?.runner_evidence_required) {
+            const evidenceDir = path.join(path.dirname(pendingReceipt.receipt_path), "artifacts");
+            if (fs.existsSync(path.join(evidenceDir, "engine-outcome.json"))) {
+                // A completed live writer's bound proof is already authoritative. Never erase its blockers during reconciliation.
+                const retained = context.db.get("SELECT artifacts_json FROM check_receipts WHERE id = ?", [pendingReceipt.id]);
+                const proven = resolvedReceiptArtifacts(pendingReceipt.receipt_path, retained ? JSON.parse(retained.artifacts_json) : [], receipt);
+                if (proven.candidate_root) {
+                    physicalFailures.push(...(proven.execution_failures ?? []));
+                    candidateFiles = proven.candidate_files ?? candidateFiles;
+                }
+                else {
+                    physicalFailures.push({ code: "engine_outcome_unbound", message: "Existing execution outcome is not bound to retained inventory; prior launcher/cleanup outcome is unknown" });
+                    fs.renameSync(path.join(evidenceDir, "engine-outcome.json"), path.join(evidenceDir, `engine-outcome-unconfirmed-${crypto.randomUUID()}.json`));
+                }
+            }
+            retainExecutionOutcome(evidenceDir, receipt, input.workspaceRoot, physicalFailures, candidateFiles);
+            receipt.required_artifacts = [...new Set([...(receipt.required_artifacts ?? []), "engine-outcome.json"])];
+            artifacts = collectCheckArtifacts(evidenceDir, receipt.required_artifacts);
+        }
+        const status = completion === null ? "aborted" : completion.exit_code === 0 && workspaceUnchanged && artifacts.complete && physicalFailures.length === 0 && (!receipt?.runner_evidence_required || runnerEvidencePass(runnerEvidence)) ? "passed" : "failed";
         context.db.run("UPDATE check_receipts SET status = ?, exit_code = ?, after_fingerprint = ?, mutation_paths_json = ?, artifacts_json = ?, finished_at = ? WHERE id = ? AND project_id = ? AND status = 'running'", [status, exitCode, after.fingerprint, JSON.stringify(workspaceUnchanged ? [] : ["<workspace changed while detached check ran>"]), JSON.stringify(artifacts.items), finishedAt, pendingReceipt.id, input.projectId]);
         if (process)
             finishManagedProcess(context, { id: process.id, leaseToken: process.lease_token, state: status === "passed" ? "stopped" : "failed", reason: status === "passed" ? "reconciled_completion" : completion === null ? "completion_marker_missing" : "reconciled_check_failed" });
         if (receipt) {
-            const repaired = { ...receipt, completion_path: receipt.completion_path || path.join(path.dirname(pendingReceipt.receipt_path), "completion.json"), required_artifacts: receipt.required_artifacts ?? [], status, exit_code: exitCode, after_fingerprint: after.fingerprint, mutation_paths: workspaceUnchanged ? [] : ["<workspace changed while detached check ran>"], artifacts: artifacts.items, finished_at: finishedAt };
+            const repaired = { ...receipt, ...(receipt.runner_evidence_required ? { runner_evidence: runnerEvidence ?? null } : {}), completion_path: receipt.completion_path || path.join(path.dirname(pendingReceipt.receipt_path), "completion.json"), required_artifacts: receipt.required_artifacts ?? [], ...(status === "aborted" ? { abort_reason: "completion_marker_missing" } : {}), status, exit_code: exitCode, after_fingerprint: after.fingerprint, mutation_paths: workspaceUnchanged ? [] : ["<workspace changed while detached check ran>"], artifacts: artifacts.items, finished_at: finishedAt };
+            repaired.candidate_root = input.workspaceRoot;
+            repaired.candidate_files = candidateFiles;
+            repaired.execution_failures = physicalFailures;
             writeReceipt(pendingReceipt.receipt_path, repaired);
+            if (status === "failed")
+                repaired.diagnostic_evidence_valid = checkReceiptEvidenceValidForMode(repaired, "diagnostic");
             reconciled.push(repaired);
         }
     }
     return reconciled;
 }
-function reserveReceipt(context, input) {
-    context.db.exec("BEGIN IMMEDIATE");
-    try {
-        const rows = context.db.all("SELECT id FROM check_receipts WHERE work_id IS ? AND run_id = ?", [input.workId ?? null, input.runId]);
-        const ordinal = rows.reduce((max, row) => Math.max(max, Number(/\/RCP-(\d+)$/.exec(row.id)?.[1] ?? 0)), 0) + 1;
-        const localId = `RCP-${String(ordinal).padStart(3, "0")}`;
-        const id = `${input.workId ?? input.runId}/${localId}`;
+function reserveOrReuseReceipt(context, input) {
+    // Receipt files and artifact hashes are prepared before reserving SQLite.
+    // The compact SQL snapshot below fences races with another check settlement.
+    const snapshotSql = "SELECT id, status, exit_code, input_hash, profile_hash, command, gate, retry_of_receipt_id, receipt_path FROM check_receipts WHERE project_id = ? AND run_id = ? ORDER BY reservation_sequence, rowid";
+    const snapshot = JSON.stringify(context.db.all(snapshotSql, [input.projectId, input.runId]));
+    const receipts = checkReceipts(context, { projectId: input.projectId, runId: input.runId });
+    if (JSON.stringify(context.db.all(snapshotSql, [input.projectId, input.runId])) !== snapshot)
+        throw new AppError("check_receipt_changed", "Check receipts changed during evidence preparation", 1);
+    const prior = receipts.filter((receipt) => receipt.input_hash === input.inputHash && receipt.profile_hash === input.profileHash).at(-1) ?? null;
+    const reusablePrior = prior?.status === "passed" && checkReceiptEvidenceValid(prior);
+    const retryIds = new Set([...(input.retryReceiptId ? [input.retryReceiptId] : []), ...(input.retryReceiptIds ?? [])]);
+    const successor = retryIds.size === 1 ? receipts.find((receipt) => receipt.retry_of_receipt_id === [...retryIds][0] && receipt.input_hash === input.inputHash && receipt.profile_hash === input.profileHash) : null;
+    const reusableSuccessor = successor?.status === "passed" && checkReceiptEvidenceValid(successor);
+    const retryPredecessor = receipts.find(receipt => retryIds.has(receipt.id));
+    const sourceCorrection = Boolean(retryPredecessor && sourceRepairContractMatches(retryPredecessor, input.group, input.profileHash));
+    const latestContract = receipts.filter(receipt => receipt.command === input.group.command && receipt.profile_hash === input.profileHash && receipt.gate === input.group.gate && receipt.scope === input.scope && receipt.work_id === (input.workId ?? null)).at(-1);
+    return context.db.writeTransaction(() => {
+        assertRunMutationAllowed(context, input.projectId, input.runId, input.generation);
+        if (JSON.stringify(context.db.all(snapshotSql, [input.projectId, input.runId])) !== snapshot)
+            throw new AppError("check_receipt_changed", "Check receipts changed before reservation", 1);
+        if (prior?.status === "running")
+            throw new AppError("check_in_progress", "A matching check invocation is still running", 1, { check_receipt_id: prior.id });
+        if (retryIds.size > 1)
+            throw new AppError("retry_check_invalid", "A check execution accepts exactly one retry predecessor", 2);
+        const retryId = [...retryIds][0];
+        if (retryId) {
+            if (!input.retryReason?.trim())
+                throw new AppError("retry_check_invalid", "A check retry requires the restored-condition reason", 2, { check_receipt_id: retryId });
+            const predecessor = receipts.find(receipt => receipt.id === retryId);
+            if (!predecessor || !["failed", "aborted"].includes(predecessor.status) || predecessor.input_hash !== input.inputHash && !sourceCorrection || predecessor.profile_hash !== input.profileHash || predecessor.command !== input.group.command || predecessor.gate !== input.group.gate)
+                throw new AppError("retry_check_invalid", "Retry predecessor does not match this exact check contract", 2, { check_receipt_id: retryId });
+            if ((sourceCorrection ? latestContract?.id : prior?.id) !== (successor?.id ?? predecessor.id))
+                throw new AppError("retry_check_invalid", "This retry was superseded by a newer check outcome; inspect the latest receipt", 2, { check_receipt_id: retryId, latest_check_receipt_id: prior?.id ?? null, latest_status: prior?.status ?? null });
+            if (successor?.status === "running")
+                throw new AppError("check_in_progress", "The requested retry is already running", 1, { check_receipt_id: successor.id, retry_of_receipt_id: retryId });
+            if (successor) {
+                if (reusableSuccessor)
+                    return { receipt: successor };
+                throw new AppError("retry_check_invalid", "The requested retry already has a terminal outcome; choose its failed receipt for another retry", 2, { check_receipt_id: successor.id, retry_of_receipt_id: retryId, status: successor.status });
+            }
+        }
+        // An unchanged failed contract needs a concrete restored-condition retry,
+        // not repeated coordinator finish until it happens to become green.
+        if (prior && ["failed", "aborted"].includes(prior.status) && !retryId)
+            return { receipt: prior };
+        if (prior?.status === "passed" && !retryIds.has(prior.id) && input.group.reusable && reusablePrior)
+            return { receipt: prior };
+        let ordinal = (context.db.get("SELECT COALESCE(MAX(reservation_sequence), 0) + 1 AS sequence FROM check_receipts WHERE project_id = ? AND run_id = ?", [input.projectId, input.runId])?.sequence ?? 1);
+        let localId = `RCP-${String(ordinal).padStart(3, "0")}`, id = `${input.workId ?? input.runId}/${localId}`;
+        while (context.db.get("SELECT 1 FROM check_receipts WHERE id = ?", [id])) {
+            ordinal += 1;
+            localId = `RCP-${String(ordinal).padStart(3, "0")}`;
+            id = `${input.workId ?? input.runId}/${localId}`;
+        }
         const directory = path.join(input.runHome, input.artifactDir ?? "05-code", "checks", localId);
-        const reserved = { id, localId, directory, evidenceDir: path.join(directory, "artifacts"), stdoutPath: path.join(directory, "stdout.log"), stderrPath: path.join(directory, "stderr.log"), receiptPath: path.join(directory, "receipt.json"), completionPath: path.join(directory, "completion.json"), group: input.group, before: input.before, profileHash: input.profileHash, inputHash: input.inputHash, epoch: input.epoch, startedAt: input.startedAt, scope: input.scope, ...(input.workId ? { workId: input.workId } : {}), projectId: input.projectId, runId: input.runId };
-        context.db.run("INSERT INTO check_receipts (id, project_id, run_id, work_id, scope, declaration_id, check_refs_json, gate, command, input_hash, verification_epoch, status, exit_code, stdout_path, stderr_path, receipt_path, workspace_fingerprint, before_fingerprint, after_fingerprint, profile_hash, mutation_paths_json, artifacts_json, started_at, finished_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'running', NULL, ?, ?, ?, ?, ?, ?, ?, '[]', '[]', ?, ?)", [id, input.projectId, input.runId, input.workId ?? null, input.scope, input.group.declarations[0].id, JSON.stringify(input.group.declarations.map(checkRef)), input.group.gate, input.group.command, input.inputHash, input.epoch, reserved.stdoutPath, reserved.stderrPath, reserved.receiptPath, input.before.fingerprint, input.before.fingerprint, input.before.fingerprint, input.profileHash, input.startedAt, input.startedAt]);
-        context.db.exec("COMMIT");
-        return reserved;
-    }
-    catch (error) {
-        context.db.exec("ROLLBACK");
-        throw error;
-    }
+        const reserved = { id, localId, directory, evidenceDir: path.join(directory, "artifacts"), stdoutPath: path.join(directory, "stdout.log"), stderrPath: path.join(directory, "stderr.log"), receiptPath: path.join(directory, "receipt.json"), completionPath: path.join(directory, "completion.json"), group: input.group, before: input.before, profileHash: input.profileHash, inputHash: input.inputHash, epoch: input.epoch, startedAt: input.startedAt, scope: input.scope, ...(retryId ? { retryOf: retryId, retryReason: input.retryReason } : {}), ...(input.workId ? { workId: input.workId } : {}), projectId: input.projectId, runId: input.runId };
+        context.db.run("INSERT INTO check_receipts (id, project_id, run_id, work_id, scope, declaration_id, check_refs_json, gate, command, input_hash, verification_epoch, reservation_sequence, retry_of_receipt_id, retry_reason, status, exit_code, stdout_path, stderr_path, receipt_path, workspace_fingerprint, before_fingerprint, after_fingerprint, profile_hash, mutation_paths_json, artifacts_json, started_at, finished_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'running', NULL, ?, ?, ?, ?, ?, ?, ?, '[]', '[]', ?, ?)", [id, input.projectId, input.runId, input.workId ?? null, input.scope, input.group.declarations[0].id, JSON.stringify(input.group.declarations.map(checkRef).sort()), input.group.gate, input.group.command, input.inputHash, input.epoch, ordinal, reserved.retryOf ?? null, reserved.retryReason ?? null, reserved.stdoutPath, reserved.stderrPath, reserved.receiptPath, input.before.fingerprint, input.before.fingerprint, input.before.fingerprint, input.profileHash, input.startedAt, input.startedAt]);
+        return { reserved };
+    }, "checks.reserveOrReuseReceipt");
+}
+function sourceRepairContractMatches(receipt, group, profileHash) {
+    return checkRepairDisposition(receipt) === "source_repair" && group.command === receipt.command && profileHash === receipt.profile_hash && isDeepStrictEqual(group.inputs, receipt.inputs)
+        && isDeepStrictEqual([...group.requiredArtifacts].sort(), receipt.required_artifacts.filter(file => file !== "engine-outcome.json").sort()) && isDeepStrictEqual([...group.ports].sort(), Object.keys(receipt.resources.ports).sort());
 }
-function receiptFor(input) { return { id: input.id, local_id: input.localId, declaration_id: input.group.declarations[0].id, check_refs: input.group.declarations.map(checkRef), gate: input.group.gate, scope: input.scope, work_id: input.workId ?? null, command: input.group.command, input_hash: input.inputHash, verification_epoch: input.epoch, status: input.status, exit_code: input.status === "running" ? null : input.result.exitCode, stdout_path: input.stdoutPath, stderr_path: input.stderrPath, receipt_path: input.receiptPath, completion_path: input.completionPath, required_artifacts: input.group.requiredArtifacts, workspace_fingerprint: input.before.fingerprint, before_fingerprint: input.before.fingerprint, after_fingerprint: input.after.fingerprint, profile_hash: input.profileHash, mutation_paths: input.mutationPaths, artifacts: input.artifacts, resources: { ports: input.resources }, started_at: input.startedAt, finished_at: input.status === "running" ? input.startedAt : new Date().toISOString() }; }
+function receiptFor(input) { return { id: input.id, local_id: input.localId, declaration_id: input.group.declarations[0].id, check_refs: input.group.declarations.map(checkRef), gate: input.group.gate, scope: input.scope, work_id: input.workId ?? null, command: input.group.command, input_hash: input.inputHash, verification_epoch: input.epoch, retry_of_receipt_id: input.retryOf ?? null, retry_reason: input.retryReason ?? null, status: input.status, ...(input.status === "aborted" ? { abort_reason: input.result.error } : {}), exit_code: input.status === "running" ? null : input.result.exitCode, stdout_path: input.stdoutPath, stderr_path: input.stderrPath, receipt_path: input.receiptPath, completion_path: input.completionPath, required_artifacts: input.group.requiredArtifacts, inputs: input.group.inputs, workspace_fingerprint: input.before.fingerprint, before_fingerprint: input.before.fingerprint, after_fingerprint: input.after.fingerprint, profile_hash: input.profileHash, mutation_paths: input.mutationPaths, artifacts: input.artifacts, resources: { ports: input.resources }, started_at: input.startedAt, finished_at: input.status === "running" ? input.startedAt : new Date().toISOString() }; }
 function writeReceipt(file, receipt) { const temporary = `${file}.tmp-${process.pid}-${crypto.randomUUID()}`; fs.writeFileSync(temporary, `${JSON.stringify(receipt, null, 2)}\n`); fs.renameSync(temporary, file); }
 function readReceipt(file) { try {
     return JSON.parse(fs.readFileSync(file, "utf8"));
@@ -220,30 +814,365 @@ function readCompletion(file) { try {
 catch {
     return null;
 } }
-export function unchangedFinalGateFailures(context, input) { const wanted = new Set(input.declarations.flatMap((check) => [check.id, checkRef(check)])); const current = workspaceFingerprint(input.workspaceRoot); const latest = new Map(); for (const receipt of checkReceipts(context, { projectId: input.projectId, runId: input.runId }).filter((item) => item.scope === "aggregate" && item.check_refs.some((ref) => wanted.has(ref))))
-    for (const ref of receipt.check_refs)
-        latest.set(ref, receipt); return [...new Set(latest.values())].filter((receipt) => receipt.status === "failed" && receipt.before_fingerprint === current); }
+/** Validate an explicit retry; the caller still executes a fresh real gate and retains a new receipt. */
+export function validateFailedCheckRetry(context, input) {
+    if (!input.reason?.trim())
+        throw new AppError("retry_check_invalid", "--retry-check requires --reason describing the restored environment", 2);
+    const receipt = checkReceipts(context, { projectId: input.projectId, runId: input.runId }).find((item) => item.id === input.receiptId);
+    if (!receipt || !["failed", "aborted"].includes(receipt.status))
+        throw new AppError("retry_check_invalid", "--retry-check must name a failed or aborted receipt in this RUN", 2, { check_receipt_id: input.receiptId });
+    const declared = new Set(input.declarations.flatMap((check) => [check.id, checkRef(check)]));
+    if (!receipt.check_refs.some((ref) => declared.has(ref)))
+        throw new AppError("retry_check_invalid", "--retry-check does not belong to this stage gate", 2, { check_receipt_id: input.receiptId, check_refs: receipt.check_refs });
+    return receipt;
+}
 export function checkReceipts(context, input) {
     const where = input.workId ? "project_id = ? AND run_id = ? AND work_id = ?" : "project_id = ? AND run_id = ?";
     const params = input.workId ? [input.projectId, input.runId, input.workId] : [input.projectId, input.runId];
-    return context.db.all(`SELECT id, declaration_id, check_refs_json, gate, scope, work_id, command, input_hash, verification_epoch, status, exit_code, stdout_path, stderr_path, receipt_path, workspace_fingerprint, before_fingerprint, after_fingerprint, profile_hash, mutation_paths_json, artifacts_json, started_at, finished_at FROM check_receipts WHERE ${where} ORDER BY started_at, id`, params).map((row) => ({ ...row, local_id: row.id.slice(row.id.lastIndexOf("/") + 1), check_refs: parseArray(row.check_refs_json, [row.declaration_id]), mutation_paths: parseArray(row.mutation_paths_json, []), artifacts: JSON.parse(row.artifacts_json), resources: readReceiptResources(row.receipt_path) }));
+    return context.db.all(`SELECT id, declaration_id, check_refs_json, gate, scope, work_id, command, input_hash, verification_epoch, retry_of_receipt_id, retry_reason, status, exit_code, stdout_path, stderr_path, receipt_path, workspace_fingerprint, before_fingerprint, after_fingerprint, profile_hash, mutation_paths_json, artifacts_json, started_at, finished_at FROM check_receipts WHERE ${where} ORDER BY reservation_sequence, rowid`, params).map(projectCheckReceiptRow);
+}
+function projectCheckReceiptRow(row) {
+    const receipt = { ...row, local_id: row.id.slice(row.id.lastIndexOf("/") + 1), check_refs: parseArray(row.check_refs_json, [row.declaration_id]), mutation_paths: parseArray(row.mutation_paths_json, []), resources: readReceiptResources(row.receipt_path), ...resolvedReceiptArtifacts(row.receipt_path, JSON.parse(row.artifacts_json), row) };
+    if (receipt.status === "failed")
+        receipt.diagnostic_evidence_valid = checkReceiptEvidenceValidForMode(receipt, "diagnostic");
+    return receipt;
+}
+/** File bytes remain immutable; only the reader projects their current location. */
+function resolvedReceiptArtifacts(receiptPath, artifacts, binding) {
+    let original = {};
+    try {
+        const value = JSON.parse(fs.readFileSync(receiptPath, "utf8"));
+        if (value && typeof value === "object" && !Array.isArray(value))
+            original = value;
+    }
+    catch { /* Historical missing receipts remain visibly incomplete. */ }
+    const currentRoot = path.dirname(receiptPath);
+    const oldRoot = typeof original.receipt_path === "string" ? path.dirname(original.receipt_path) : currentRoot;
+    const relocate = (file) => {
+        const relative = path.relative(oldRoot, file);
+        return !path.isAbsolute(relative) && relative !== ".." && !relative.startsWith(`..${path.sep}`) ? path.join(currentRoot, relative) : file;
+    };
+    let evidence = null;
+    if (original.runner_evidence_required && original.id && original.command && original.input_hash && original.verification_epoch) {
+        const root = path.join(currentRoot, "artifacts");
+        const retained = collectCheckArtifacts(root, [original.runner_evidence_required.path]);
+        if (retained.complete && retained.items.every(item => artifacts.some(artifact => relocate(artifact.path) === item.path && artifact.sha256 === item.sha256)))
+            evidence = readRunnerEvidence(root, original.runner_evidence_required, { invocation_id: binding.id, check_id: binding.id, command: binding.command, input_hash: binding.input_hash, verification_epoch: binding.verification_epoch });
+    }
+    let outcome = {};
+    const outcomePath = path.join(currentRoot, "artifacts", "engine-outcome.json");
+    const retainedOutcome = collectCheckArtifacts(path.join(currentRoot, "artifacts"), ["engine-outcome.json"]);
+    if (retainedOutcome.complete && retainedOutcome.items.every(item => artifacts.some(artifact => relocate(artifact.path) === item.path && artifact.sha256 === item.sha256))) {
+        try {
+            const value = JSON.parse(fs.readFileSync(outcomePath, "utf8"));
+            if (value.schema_id === "dd-flow/check-execution-outcome@1" && value.id === binding.id && value.command === binding.command && value.input_hash === binding.input_hash && value.verification_epoch === binding.verification_epoch && typeof value.candidate_root === "string" && path.isAbsolute(value.candidate_root) && (value.candidate_files === undefined || Array.isArray(value.candidate_files) && value.candidate_files.length <= 64 && value.candidate_files.every((file) => typeof file === "string" && path.isAbsolute(file) && Buffer.byteLength(file) <= 4096)) && Array.isArray(value.execution_failures) && value.execution_failures.every((failure) => failure && typeof failure === "object" && typeof failure.code === "string" && typeof failure.message === "string"))
+                outcome = value;
+        }
+        catch { /* Missing physical proof cannot grant attribution. */ }
+    }
+    return { completion_path: path.join(currentRoot, "completion.json"), required_artifacts: original.required_artifacts ?? [], inputs: original.inputs ?? [], artifacts: artifacts.map((artifact) => ({ ...artifact, path: relocate(artifact.path) })), ...(original.runner_evidence_required ? { runner_evidence_required: original.runner_evidence_required, runner_evidence: evidence } : {}), execution_failures: outcome.execution_failures ?? [], ...(outcome.candidate_root ? { candidate_root: outcome.candidate_root } : {}), ...(outcome.candidate_files ? { candidate_files: outcome.candidate_files } : {}) };
+}
+function executionFailures(input) {
+    const failures = [];
+    if (input.exitCode === null)
+        failures.push({ code: "completion_unknown", message: "Check completion is unknown" });
+    if (input.launcherError)
+        failures.push({ code: "launcher_error", message: input.launcherError });
+    if (input.cleanupUnconfirmed)
+        failures.push({ code: "cleanup_unconfirmed", message: "Check process cleanup is not confirmed" });
+    if (input.missing.length)
+        failures.push({ code: "missing_required_artifact", message: input.missing.join(", ") });
+    if (input.mutations.length)
+        failures.push({ code: "check_input_mutated", message: input.mutations.join(", ") });
+    if (input.invalidRunner)
+        failures.push({ code: "invalid_runner_evidence", message: "Required runner evidence is unavailable or invalid" });
+    return failures;
+}
+function retainExecutionOutcome(evidenceDir, binding, candidateRoot, failures, candidateFiles) {
+    const temporary = path.join(evidenceDir, `.engine-outcome-${crypto.randomUUID()}.tmp`);
+    if (!fs.lstatSync(evidenceDir).isDirectory() || fs.lstatSync(evidenceDir).isSymbolicLink())
+        throw new AppError("check_evidence_stale", "Check evidence directory was replaced", 1);
+    fs.writeFileSync(temporary, JSON.stringify({ schema_id: "dd-flow/check-execution-outcome@1", id: binding.id, command: binding.command, input_hash: binding.input_hash, verification_epoch: binding.verification_epoch, candidate_root: candidateRoot, candidate_files: candidateFiles, execution_failures: failures }), { flag: "wx", mode: 0o600 });
+    fs.renameSync(temporary, path.join(evidenceDir, "engine-outcome.json"));
 }
 export function workspaceFingerprint(root) { return workspaceState(root).fingerprint; }
-export function workspaceChangedPaths(root) { const status = spawnSync("git", ["status", "--porcelain=v1", "-z", "--untracked-files=all"], { cwd: root, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }); if (status.status !== 0)
-    return null; return status.stdout.split("\0").filter(Boolean).map((entry) => entry.slice(3)).filter(Boolean).sort(); }
-function deduplicate(checks, commands) { const groups = new Map(); checks.forEach((check, index) => { const artifacts = [...(check.required_artifacts ?? [])].sort(); const ports = [...(check.ports ?? [])].sort(); const key = JSON.stringify([check.run_at, commands[index], artifacts, ports]); const current = groups.get(key); if (current)
-    current.declarations.push(check);
-else
-    groups.set(key, { gate: check.run_at, command: commands[index], declarations: [check], requiredArtifacts: artifacts, ports }); }); return [...groups.values()]; }
-function workspaceState(root, ignoredRoots = []) { const git = spawnSync("git", ["ls-files", "-co", "--exclude-standard", "-z"], { cwd: root, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }); const ignored = ignoredRoots.map((entry) => path.resolve(entry)); const listing = (git.status === 0 ? git.stdout.split("\0").filter(Boolean).sort() : listFiles(root)).filter((relative) => { const file = path.resolve(root, relative); return !ignored.some((ignoredRoot) => file === ignoredRoot || file.startsWith(`${ignoredRoot}${path.sep}`)); }); const files = new Map(); const hash = crypto.createHash("sha256"); for (const relative of listing) {
-    const file = path.join(root, relative);
-    const content = fs.existsSync(file) && fs.statSync(file).isFile() ? fs.readFileSync(file) : Buffer.from("<missing>");
-    const digest = crypto.createHash("sha256").update(content).digest("hex");
-    files.set(relative, digest);
-    hash.update(relative).update("\0").update(digest).update("\0");
-} return { fingerprint: hash.digest("hex"), files }; }
+/** One NUL-aware source of truth for paths differing from HEAD. Rename/copy
+ * records carry a second path; retain both because the old side is a deletion. */
+export function workspaceChangedPaths(root) {
+    const status = spawnSync("git", ["status", "--porcelain=v1", "-z", "--untracked-files=all"], { cwd: root, encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+    // A workspace can be intentionally gitless. Keep the same conservative
+    // file inventory used for fingerprints instead of making result validation
+    // fail before the work contract can report its actual error.
+    if (isGitlessWorkspace(root, status))
+        return listFiles(root);
+    if (status.status !== 0 || status.error)
+        throw new AppError("workspace_status_failed", "Could not determine changed workspace paths", 1, { workspace_root: root, stderr: status.stderr || null, cause: status.error?.message ?? null });
+    const records = status.stdout.split("\0");
+    const paths = [];
+    for (let index = 0; index < records.length; index += 1) {
+        const record = records[index];
+        if (!record)
+            continue;
+        if (record.length < 4 || record[2] !== " ")
+            throw new AppError("workspace_status_invalid", "Git returned an invalid porcelain-v1 record", 1, { workspace_root: root, record });
+        paths.push(normalizeWorkspacePath(root, record.slice(3)));
+        if (record[0] === "R" || record[0] === "C" || record[1] === "R" || record[1] === "C") {
+            const prior = records[++index];
+            if (!prior)
+                throw new AppError("workspace_status_invalid", "Git rename/copy record is missing its second path", 1, { workspace_root: root, record });
+            paths.push(normalizeWorkspacePath(root, prior));
+        }
+    }
+    const ownedHook = paths.includes(".agents/hooks.json") ? ownedWorkspaceHookPath(root) : null;
+    return [...new Set(paths)].filter(file => file !== ownedHook).sort();
+}
+/** Ignored machine state cannot be reported as a product change. Tracked paths
+ * remain eligible regardless of their directory name. */
+export function ignoredWorkspacePaths(root, paths) {
+    const normalized = [...new Set(paths.map((item) => normalizeWorkspacePath(root, item)))];
+    if (!normalized.length)
+        return [];
+    const status = spawnSync("git", ["check-ignore", "-z", "--stdin"], { cwd: root, encoding: "utf8", input: `${normalized.join("\0")}\0`, maxBuffer: 64 * 1024 * 1024 });
+    // The canonical owned hook has one meaning across Git status, check cache
+    // and MERGE, without changing a sibling worktree's shared Git excludes.
+    const gitless = isGitlessWorkspace(root, status);
+    if (!gitless && (![0, 1].includes(status.status ?? -1) || status.error))
+        throw new AppError("workspace_ignore_check_failed", "Could not classify reported workspace paths", 1, { workspace_root: root, stderr: status.stderr || null, cause: status.error?.message ?? null });
+    const ownedHook = normalized.includes(".agents/hooks.json") ? ownedWorkspaceHookPath(root, gitless ? [] : undefined) : null;
+    if (gitless)
+        return ownedHook ? [ownedHook] : [];
+    return [...new Set([...status.stdout.split("\0").filter(Boolean).map((item) => normalizeWorkspacePath(root, item)), ...(ownedHook ? [ownedHook] : [])])].sort();
+}
+export function normalizeWorkspacePath(root, value) {
+    if (typeof value !== "string" || !value || value.includes("\0") || path.isAbsolute(value))
+        throw new AppError("workspace_path_invalid", "Workspace path must be a non-empty relative path", 2, { path: value });
+    const resolvedRoot = path.resolve(root);
+    const resolved = path.resolve(resolvedRoot, value);
+    const relative = path.relative(resolvedRoot, resolved);
+    if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+        throw new AppError("workspace_path_invalid", "Workspace path escapes its root", 2, { path: value, workspace_root: root });
+    return relative.split(path.sep).join("/");
+}
+function deduplicate(checks, commands) {
+    const groups = new Map();
+    checks.forEach((check, index) => {
+        const artifacts = [...(check.required_artifacts ?? [])].sort(), ports = [...(check.ports ?? [])].sort(), inputs = normalizedInputs(check.inputs ?? []);
+        const reusable = check.reuse === "deterministic";
+        // Stage labels identify obligations, not different processes in this gate.
+        // Cross-invocation reuse still requires the explicit deterministic contract.
+        const environmentInputs = normalizedEnvironmentInputs(check.environment_inputs);
+        const key = JSON.stringify([commands[index], artifacts, ports, inputs, reusable, environmentInputs, check.runner_evidence ?? null]);
+        const current = groups.get(key);
+        if (current)
+            current.declarations.push(check);
+        else
+            groups.set(key, { gate: check.run_at, command: commands[index], declarations: [check], requiredArtifacts: artifacts, ports, inputs, reusable, ...(environmentInputs === undefined ? {} : { environmentInputs }), ...(check.runner_evidence ? { runnerEvidence: check.runner_evidence } : {}) });
+    });
+    return [...groups.values()].map(group => ({ ...group, gate: [...group.declarations].map(check => check.run_at).sort()[0], declarations: [...group.declarations].sort((left, right) => checkRef(left).localeCompare(checkRef(right))) }));
+}
+function workspaceState(root, ignoredRoots = []) {
+    const git = workspaceGitFiles(root, ["-co", "--exclude-standard"]);
+    const ignored = ignoredRoots.map(entry => path.resolve(entry));
+    const listing = [...new Set(git ?? listFiles(root))].sort();
+    const ownedHook = listing.includes(".agents/hooks.json") ? ownedWorkspaceHookPath(root, git ? undefined : []) : null;
+    const files = new Map(), hash = crypto.createHash("sha256");
+    for (const relative of listing) {
+        if (relative === ownedHook)
+            continue;
+        const file = path.resolve(root, relative);
+        if (ignored.some(ignoredRoot => file === ignoredRoot || file.startsWith(`${ignoredRoot}${path.sep}`)))
+            continue;
+        // Deleted tracked paths are absent content, both before and after commit.
+        // Do not mask other IO errors as an unchanged workspace.
+        let stat;
+        try {
+            stat = fs.lstatSync(file);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+        const content = stat.isSymbolicLink() ? Buffer.from(`symlink\0${fs.readlinkSync(file)}`) : stat.isFile() ? fs.readFileSync(file) : Buffer.from("<directory>");
+        const digest = crypto.createHash("sha256").update(content).digest("hex");
+        files.set(relative, digest);
+        hash.update(relative).update("\0").update(digest).update("\0");
+    }
+    return { fingerprint: hash.digest("hex"), files };
+}
+function workspaceInputFingerprint(root, files, inputs, ignoredRoots) {
+    const selected = new Map(inputs.length === 0 || inputs.includes(".") ? files : []);
+    for (const [file, digest] of explicitInputFiles(root, inputs.filter(input => input !== "."), ignoredRoots))
+        selected.set(file, digest);
+    const hash = crypto.createHash("sha256");
+    for (const [file, digest] of [...selected].sort(([left], [right]) => left.localeCompare(right)))
+        hash.update(file).update("\0").update(digest).update("\0");
+    return hash.digest("hex");
+}
 function changedPaths(before, after) { return [...new Set([...before.keys(), ...after.keys()])].filter((key) => before.get(key) !== after.get(key)).sort(); }
 function checkRef(check) { return check.canonical_ref ?? check.id; }
+function assertConsistentDeclarations(checks, commands) {
+    const seen = new Map();
+    for (const [index, check] of checks.entries()) {
+        const contract = JSON.stringify([check.run_at, commands[index], [...(check.required_artifacts ?? [])].sort(), [...(check.ports ?? [])].sort(), normalizedInputs(check.inputs ?? []), check.reuse ?? null, normalizedEnvironmentInputs(check.environment_inputs), check.runner_evidence ?? null]);
+        const ref = checkRef(check), prior = seen.get(ref);
+        if (prior && prior !== contract)
+            throw new AppError("check_declaration_conflict", "The same check reference has conflicting execution definitions", 2, { check_ref: ref });
+        seen.set(ref, contract);
+    }
+}
+function normalizedEnvironmentInputs(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || !value.length || value.length > 64 || value.some(name => typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*\*?$/.test(name)))
+        throw new AppError("invalid_check_environment_inputs", "Internal check environment inputs must be bounded names or prefixes", 2, { effect: "no_effect" });
+    return [...new Set(value)].sort();
+}
+function environmentFingerprint(workspaceRoot, inputs, checkEnvironment) {
+    const environment = codeExecutionEnvironment(workspaceRoot, checkEnvironment);
+    // Invocation authority is checked by its own owners, not an application check
+    // input. Preserve arbitrary application variables (including DD_FLOW_PORT_*)
+    // and tool selection; omit only known process/control bookkeeping.
+    const bookkeeping = new Set(["PWD", "OLDPWD", "SHLVL", "_", "DD_FLOW_DAEMON_ID",
+        "DD_FLOW_CURRENT_INVOCATION", "DD_FLOW_INVOCATION_READONLY", "DD_FLOW_INVOCATION_SCOPE", "DD_FLOW_CODEX_STATE_DIR",
+        "DD_FLOW_RUNTIME_OWNER", "DD_FLOW_CONTROLLER_TOKEN", "DD_FLOW_CONTROL_TOKEN", "DD_FLOW_SCOPE_CONTROL_TOKEN",
+        "DD_FLOW_BIN", "DD_FLOW_ENGINE_HOME", "DD_FLOW_RUNTIME_BUDGET", "DD_FLOW_WORK_ID", "DD_FLOW_SESSION_ID", "CODEX_THREAD_ID", "DD_EVAL_OPERATION_ID",
+        "CODEX_PERMISSION_PROFILE", "CODEX_SESSION_ID", "CODEX_VERSION"]);
+    return crypto.createHash("sha256").update(JSON.stringify(Object.entries(environment)
+        .filter(([name, value]) => value !== undefined && !bookkeeping.has(name)
+        && (inputs === undefined || inputs.some(input => input.endsWith("*") ? name.startsWith(input.slice(0, -1)) : name === input)))
+        .sort(([left], [right]) => left.localeCompare(right)))).digest("hex");
+}
+function acquireWorkspaceGate(context, input) {
+    const operationId = workspaceOperationId(input.workspaceRoot);
+    const active = managedProcessStatus(context).find(item => item.operation_id === operationId && ["starting", "running", "stopping"].includes(item.state));
+    if (active)
+        throw new AppError("check_in_progress", "The workspace is owned by another bootstrap or check; observe it before starting a new check", 1, { process_id: active.id, operation_id: operationId });
+    return registerManagedProcess(context, { kind: "workspace-gate", ownerPid: process.pid, ownerId: `workspace-gate:${crypto.randomUUID()}`, operationId, uniqueActiveOperation: true, projectId: input.projectId, runId: input.runId, metadata: { workspace_root: input.workspaceRoot, role: "check_gate" } });
+}
+export function reconcileWorkspaceOwnership(context, workspaceRoot) {
+    const operationId = workspaceOperationId(workspaceRoot);
+    const active = managedProcessStatus(context).filter(item => item.operation_id === operationId && ["starting", "running", "stopping", "orphaned"].includes(item.state));
+    if (active.some(item => processTreeIsAlive(item) || managedOwnerIsAlive(item) !== false))
+        return;
+    // Registry IDs are host-wide, whereas receipts belong to one runtime DB.
+    // An unknown/foreign home must not be settled against this client's rows.
+    if (active.some(item => managedProcessRuntimeHome(item, context) !== context.ddFlowHome))
+        return;
+    for (const child of active.filter(item => item.kind !== "workspace-gate")) {
+        if (child.kind !== "check" || !child.project_id || !child.run_id || !child.check_id)
+            return;
+        const run = context.db.get("SELECT run_root FROM runs WHERE project_id = ? AND id = ?", [child.project_id, child.run_id]);
+        if (!run?.run_root || !context.db.get("SELECT 1 FROM check_receipts WHERE id = ? AND project_id = ? AND run_id = ?", [child.check_id, child.project_id, child.run_id]))
+            return;
+        reconcileUnfinishedChecks(context, { projectId: child.project_id, runId: child.run_id, workspaceRoot, runHome: run.run_root, receiptId: child.check_id });
+        // A crash may occur after receipt settlement but before registry settlement.
+        const current = managedProcessStatus(context).find(item => item.id === child.id);
+        if (!current || current.lease_token !== child.lease_token)
+            return;
+        if (!["stopped", "failed"].includes(current.state) && !finishManagedProcess(context, { id: child.id, leaseToken: child.lease_token, state: "stopped", reason: "workspace_check_owner_reconciled" }))
+            return;
+    }
+    for (const gate of active.filter(item => item.kind === "workspace-gate"))
+        finishManagedProcess(context, { id: gate.id, leaseToken: gate.lease_token, state: "stopped", reason: "workspace_gate_owner_reconciled" });
+}
+function normalizedInputs(inputs) { for (const input of inputs)
+    validateCheckInputSyntax(input); return [...new Set(inputs.map((input) => { const normalized = path.posix.normalize(input.replaceAll("\\", "/")).replace(/^\.\/$/, ""); return normalized === "" || normalized === "." ? "." : normalized.replace(/\/$/, ""); }))].sort(); }
+function validateCheckInputs(workspaceRoot, inputs) { const root = fs.realpathSync.native(workspaceRoot); for (const input of normalizedInputs(inputs)) {
+    if (input === ".git" || input.startsWith(".git/"))
+        throw new AppError("invalid_check_input", "Check inputs cannot include Git internals", 2, { input });
+    const candidate = path.resolve(workspaceRoot, input);
+    if (candidate !== workspaceRoot && !candidate.startsWith(`${workspaceRoot}${path.sep}`))
+        throw new AppError("invalid_check_input", "Check inputs must stay within the workspace", 2, { input });
+    if (fs.existsSync(candidate))
+        validateInputTree(root, candidate, input, new Set());
+    else
+        validateMissingInputParent(root, candidate, input);
+} }
+function validateCheckInputSyntax(input) { if (typeof input !== "string" || !input.trim() || path.isAbsolute(input) || input.split(/[\\/]/).includes(".."))
+    throw new AppError("invalid_check_input", "Check inputs must be non-empty relative workspace paths", 2, { input }); }
+function validateMissingInputParent(root, candidate, input) { let parent = candidate; while (!fs.existsSync(parent))
+    parent = path.dirname(parent); const resolved = fs.realpathSync.native(parent); if (resolved !== root && !resolved.startsWith(`${root}${path.sep}`))
+    throw new AppError("invalid_check_input", "Check input parent symlink escapes the workspace", 2, { input }); }
+function validateInputTree(root, candidate, input, seen) {
+    const resolved = fs.realpathSync.native(candidate);
+    if (resolved !== root && !resolved.startsWith(`${root}${path.sep}`))
+        throw new AppError("invalid_check_input", "Check input symlink escapes the workspace", 2, { input });
+    if (seen.has(resolved))
+        throw new AppError("invalid_check_input", "Check input contains a symbolic-link cycle", 2, { input });
+    seen.add(resolved);
+    const stat = fs.statSync(candidate);
+    if (stat.isDirectory())
+        for (const entry of fs.readdirSync(candidate))
+            validateInputTree(root, path.join(candidate, entry), input, seen);
+    seen.delete(resolved);
+}
+function explicitInputFiles(root, inputs, ignoredRoots) {
+    const rootReal = fs.realpathSync.native(root), ignored = ignoredRoots.map(entry => path.resolve(entry)), result = new Map();
+    const visit = (file, relative, seen) => {
+        if (ignored.some(entry => file === entry || file.startsWith(`${entry}${path.sep}`)))
+            return;
+        if (!fs.existsSync(file)) {
+            result.set(relative, "<missing>");
+            return;
+        }
+        const resolved = fs.realpathSync.native(file);
+        if (resolved !== rootReal && !resolved.startsWith(`${rootReal}${path.sep}`))
+            throw new AppError("invalid_check_input", "Check input symlink escapes the workspace", 2, { input: relative });
+        if (seen.has(resolved))
+            throw new AppError("invalid_check_input", "Check input contains a symbolic-link cycle", 2, { input: relative });
+        const stat = fs.statSync(file);
+        if (stat.isDirectory()) {
+            seen.add(resolved);
+            for (const entry of fs.readdirSync(file).sort())
+                visit(path.join(file, entry), path.posix.join(relative, entry), seen);
+            seen.delete(resolved);
+        }
+        else if (stat.isFile())
+            result.set(relative, crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex"));
+    };
+    for (const input of inputs)
+        visit(path.resolve(root, input), input, new Set());
+    return [...result.entries()];
+}
+function checkInputHash(workspaceRoot, group, profileHash, inputFingerprint, evidenceContext, checkEnvironment) { return crypto.createHash("sha256").update(JSON.stringify({ workspace_root: path.resolve(workspaceRoot), gate: group.reusable ? null : group.gate, command: group.command, required_artifacts: group.requiredArtifacts, ports: group.ports, inputs: group.inputs, ...(group.runnerEvidence ? { runner_evidence: group.runnerEvidence } : {}), profile_hash: profileHash, environment: environmentFingerprint(workspaceRoot, group.environmentInputs, checkEnvironment), input_fingerprint: inputFingerprint, ...(group.environmentInputs === undefined ? {} : { environment_inputs: group.environmentInputs }), ...(evidenceContext === undefined ? {} : { evidence_context: evidenceContext }) })).digest("hex"); }
+function bindReceipt(receipt, group) { return { ...receipt, gate: group.gate, declaration_id: group.declarations[0].id, check_refs: group.declarations.map(checkRef), required_artifacts: [...new Set([...group.requiredArtifacts, ...(receipt.required_artifacts.includes("engine-outcome.json") ? ["engine-outcome.json"] : [])])], inputs: group.inputs }; }
+export function checkReceiptEvidenceValid(receipt) { return checkReceiptEvidenceValidForMode(receipt); }
+function checkReceiptEvidenceValidForMode(receipt, mode) {
+    try {
+        if (!(receipt.status === "passed" && receipt.exit_code === 0 || mode === "diagnostic" && receipt.status === "failed" && typeof receipt.exit_code === "number" && receipt.exit_code !== 0) || receipt.before_fingerprint !== receipt.after_fingerprint
+            || receipt.mutation_paths.length !== 0 || receipt.completion_path !== path.join(path.dirname(receipt.receipt_path), "completion.json")
+            || readCompletion(receipt.completion_path)?.exit_code !== receipt.exit_code)
+            return false;
+        const stored = readReceipt(receipt.receipt_path);
+        if (!stored || typeof stored !== "object" || Array.isArray(stored)
+            || typeof stored.receipt_path !== "string" || !path.isAbsolute(stored.receipt_path)
+            || path.basename(stored.receipt_path) !== "receipt.json"
+            || stored.completion_path !== path.join(path.dirname(stored.receipt_path), "completion.json"))
+            return false;
+        // Gate/ref labels may be rebound for explicit deterministic reuse. Physical
+        // execution identity and settled SQL evidence must never be rebound from a
+        // mutable receipt file, including after recovery relocates the RUN home.
+        const fields = ["id", "scope", "work_id", "command", "input_hash", "verification_epoch", "status", "exit_code",
+            "workspace_fingerprint", "before_fingerprint", "after_fingerprint", "profile_hash", "started_at", "finished_at"];
+        if (fields.some(field => stored[field] !== receipt[field]) || !Array.isArray(stored.artifacts)
+            || !Array.isArray(stored.mutation_paths) || stored.mutation_paths.length !== 0
+            || JSON.stringify(stored.required_artifacts) !== JSON.stringify(receipt.required_artifacts)
+            || JSON.stringify(stored.inputs) !== JSON.stringify(receipt.inputs))
+            return false;
+        const retained = resolvedReceiptArtifacts(receipt.receipt_path, stored.artifacts, receipt).artifacts;
+        if (JSON.stringify(retained) !== JSON.stringify(receipt.artifacts))
+            return false;
+        const root = path.join(path.dirname(receipt.receipt_path), "artifacts");
+        if (stored.runner_evidence_required && mode !== "diagnostic" && !runnerEvidencePass(readRunnerEvidence(root, stored.runner_evidence_required, { invocation_id: receipt.id, check_id: receipt.id, command: receipt.command, input_hash: receipt.input_hash, verification_epoch: receipt.verification_epoch })))
+            return false;
+        const artifacts = collectCheckArtifacts(root, receipt.required_artifacts);
+        return artifacts.complete && JSON.stringify(artifacts.items) === JSON.stringify(retained);
+    }
+    catch {
+        return false;
+    }
+}
 function parseArray(value, fallback) { try {
     const parsed = JSON.parse(value);
     return Array.isArray(parsed) && parsed.every((item) => typeof item === "string") ? parsed : fallback;
@@ -252,8 +1181,14 @@ catch {
     return fallback;
 } }
 function isStringRecord(value) { return Boolean(value) && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((item) => typeof item === "string" && item.trim().length > 0); }
-function isGateRecord(value) { return Boolean(value) && typeof value === "object" && !Array.isArray(value) && Object.entries(value).every(([gate, aliases]) => ["work", "code", "readiness", "merge", "release", "external"].includes(gate) && Array.isArray(aliases) && aliases.every((item) => typeof item === "string" && item.startsWith("@check/"))); }
+function isGateRecord(value) { return Boolean(value) && typeof value === "object" && !Array.isArray(value) && Object.entries(value).every(([gate, aliases]) => ["work", "code", "readiness", "merge", "release"].includes(gate) && Array.isArray(aliases) && aliases.every((item) => typeof item === "string" && item.startsWith("@check/"))); }
 function isPortAliasRecord(value) { return value === undefined || (Boolean(value) && typeof value === "object" && !Array.isArray(value) && Object.entries(value).every(([alias, ports]) => alias.startsWith("@check/") && Array.isArray(ports) && ports.length > 0 && new Set(ports).size === ports.length && ports.every((port) => typeof port === "string" && /^[A-Za-z][A-Za-z0-9_]*$/.test(port)))); }
+function isInputAliasRecord(workspaceRoot, value) { try {
+    return value === undefined || (Boolean(value) && typeof value === "object" && !Array.isArray(value) && Object.entries(value).every(([alias, inputs]) => alias.startsWith("@check/") && Array.isArray(inputs) && (validateCheckInputs(workspaceRoot, inputs), true)));
+}
+catch {
+    return false;
+} }
 function portEnvironment(ports) { return Object.fromEntries(Object.entries(ports).map(([name, value]) => [`DD_FLOW_PORT_${name.toUpperCase()}`, String(value)])); }
 function readReceiptResources(file) { try {
     const value = JSON.parse(fs.readFileSync(file, "utf8"));
@@ -262,26 +1197,63 @@ function readReceiptResources(file) { try {
 catch {
     return { ports: {} };
 } }
-function collectRequiredArtifacts(root, required) { const missing = []; const items = []; for (const relative of required) {
-    if (path.isAbsolute(relative) || relative.split(/[\\/]/).includes(".."))
-        throw new AppError("invalid_evidence_path", "Required evidence paths must be relative to DD_FLOW_EVIDENCE_DIR", 2, { path: relative });
-    const file = path.join(root, relative);
-    if (!fs.existsSync(file) || !fs.statSync(file).isFile()) {
-        missing.push(relative);
-        continue;
-    }
-    items.push({ path: relative, sha256: crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") });
-} return { complete: missing.length === 0, missing, items }; }
-function listFiles(root, current = root) { return fs.readdirSync(current, { withFileTypes: true }).flatMap((entry) => { if ([".git", "node_modules"].includes(entry.name))
-    return []; const absolute = path.join(current, entry.name); return entry.isDirectory() ? listFiles(root, absolute) : [path.relative(root, absolute)]; }).sort(); }
-export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, onSpawn, renewLease) {
+function collectCheckArtifacts(root, required) {
+    for (const relative of required) {
+        if (path.isAbsolute(relative) || relative.split(/[\\/]/).includes(".."))
+            throw new AppError("invalid_evidence_path", "Required evidence paths must be relative to DD_FLOW_EVIDENCE_DIR", 2, { path: relative });
+    }
+    // Required paths are minimum obligations; retain all explicit check evidence.
+    // Never follow symlinks, including a replaced evidence root.
+    const items = [];
+    const visit = (directory) => {
+        for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+            const file = path.join(directory, entry.name);
+            if (entry.isDirectory())
+                visit(file);
+            else if (entry.isFile())
+                items.push({ path: path.relative(root, file), sha256: crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") });
+        }
+    };
+    if (fs.existsSync(root) && fs.lstatSync(root).isDirectory())
+        visit(root);
+    items.sort((a, b) => a.path.localeCompare(b.path));
+    const retained = new Set(items.map((item) => item.path));
+    const missing = required.filter((relative) => !retained.has(path.normalize(relative)));
+    return { complete: missing.length === 0, missing, items };
+}
+function listFiles(root) {
+    const allowed = projectServicePathFilter(root, [], []);
+    const ownedHook = ownedWorkspaceHookPath(root, []);
+    const visit = (current) => fs.readdirSync(current, { withFileTypes: true }).flatMap(entry => {
+        const absolute = path.join(current, entry.name);
+        if ([".git", "node_modules"].includes(entry.name) || !allowed(absolute))
+            return [];
+        return entry.isDirectory() ? visit(absolute) : [path.relative(root, absolute)];
+    });
+    return visit(root).filter(file => file.split(path.sep).join("/") !== ownedHook).sort();
+}
+export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, onSpawn, renewLease, observation = {}) {
+    const inactivityTimeoutMs = validateObservationDuration(observation.inactivityTimeoutMs ?? 30 * 60_000);
+    const { startupMs: runnerStartupMs, executionMs: runnerExecutionMs } = runnerObservationDurations(environment.DD_FLOW_CHECK_RUNNER_PROGRESS_PATH ? environment : {});
     return new Promise((resolve) => {
         const started = Date.now();
-        const child = spawn("/bin/sh", ["-lc", checkShellScript()], { cwd, env: { ...environment, DD_FLOW_CHECK_COMMAND: command }, stdio: ["ignore", stdout, stderr], detached: process.platform !== "win32" });
+        const child = spawn("/bin/sh", ["-c", checkShellScript()], { cwd, env: { ...environment, DD_FLOW_CHECK_COMMAND: command }, stdio: ["pipe", "pipe", "pipe"], detached: process.platform !== "win32" });
         let error = null;
         let stopping = false;
+        let closed = false;
         let progress;
-        let escalation;
+        let cleanup;
+        let cleanupUnconfirmed = false;
+        const renewal = createRenewalState();
+        let renewalTimer;
+        const clock = new ObservationClock({ timeoutMs: inactivityTimeoutMs });
+        let outputCursor = 0;
+        let runnerSequence = 0;
+        let runnerPhase = "startup";
+        const runnerProgress = environment.DD_FLOW_CHECK_RUNNER_PROGRESS_PATH;
+        const runnerClock = runnerProgress ? new ObservationClock({ timeoutMs: runnerStartupMs }) : null;
+        const outputs = [fs.createWriteStream("", { fd: stdout, autoClose: false }), fs.createWriteStream("", { fd: stderr, autoClose: false })];
+        const flushed = outputs.map(output => new Promise(resolve => { output.once("finish", resolve); output.once("error", () => resolve()); }));
         const stop = (cause) => {
             if (stopping)
                 return;
@@ -291,22 +1263,57 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
                 clearInterval(progress);
                 progress = undefined;
             }
-            if (child.pid) {
-                terminateProcessGroup(child.pid, "SIGTERM");
-                escalation = setTimeout(() => terminateProcessGroup(child.pid, "SIGKILL"), 5_000);
-            }
+            if (renewalTimer)
+                clearTimeout(renewalTimer);
+            if (observationTimer)
+                clearInterval(observationTimer);
+            cleanup = stopProcessGroup(child, 5_000).catch(cause => {
+                cleanupUnconfirmed = true;
+                error = `${error}; cleanup: ${JSON.stringify(errorRecord(cause))}`;
+                resolve({ exitCode: null, error, aborted: true, cleanupUnconfirmed });
+            });
         };
+        const observationTimer = setInterval(() => {
+            if (stopping || closed || observation.phase?.() === "serving")
+                return;
+            if (runnerClock && runnerProgress) {
+                for (const event of readRunnerProgress(runnerProgress, environment.DD_FLOW_CHECK_INVOCATION_ID ?? "", runnerSequence)) {
+                    runnerSequence = event.sequence;
+                    runnerPhase = event.phase;
+                    runnerClock.sample(runnerSequence, Date.parse(event.at));
+                }
+                // The outer guard includes the runner's bounded cleanup tail.
+                runnerClock.timeoutMs = runnerPhase === "execution" ? runnerExecutionMs : runnerStartupMs;
+                if (runnerClock.sample(runnerSequence))
+                    stop(new AppError("operation_observation_lost", "Structured test runner stopped making progress", 1, { phase: runnerPhase, sequence: runnerSequence }));
+                return;
+            }
+            if (clock.sample(outputCursor))
+                stop(new AppError("operation_observation_lost", "Owned command has no confirmed progress within its inactivity window", 1, { phase: observation.phase?.() ?? "finite", inactivity_timeout_ms: inactivityTimeoutMs }));
+        }, Math.min(1000, inactivityTimeoutMs));
         // Register handlers before checking pid or calling persistence callbacks.
         // Failure is not completion until the spawned process has actually closed.
         child.once("error", (value) => { error = value.message; });
-        child.once("close", (exitCode, signal) => {
+        for (const [index, stream] of [child.stdout, child.stderr].entries()) {
+            outputs[index].once("error", stop);
+            stream.on("data", () => { if (!runnerClock) {
+                outputCursor++;
+                clock.sample(outputCursor);
+            } });
+            stream.pipe(outputs[index]);
+        }
+        child.stdin.on("error", stop);
+        child.once("close", async (exitCode, signal) => {
+            closed = true;
             if (progress)
                 clearInterval(progress);
-            if (escalation)
-                clearTimeout(escalation);
-            if (stopping)
-                terminateProcessGroup(child.pid, "SIGKILL");
-            resolve({ exitCode, error: error ?? (signal ? `terminated by ${signal}` : null), aborted: stopping || Boolean(signal) || Boolean(error) });
+            if (renewalTimer)
+                clearTimeout(renewalTimer);
+            if (observationTimer)
+                clearInterval(observationTimer);
+            await cleanup;
+            await Promise.all(flushed);
+            resolve({ exitCode, error: error ?? (signal ? `terminated by ${signal}` : null), aborted: stopping || Boolean(signal) || Boolean(error), ...(cleanupUnconfirmed ? { cleanupUnconfirmed } : {}) });
         });
         if (!child.pid) {
             error = "check process did not provide a PID";
@@ -319,31 +1326,73 @@ export function runCheck(command, cwd, environment, stdout, stderr, heartbeat, o
             stop(cause);
             return;
         }
-        progress = setInterval(() => {
+        if (observation.leaseExpiresAt) {
+            const expiry = observation.leaseExpiresAt();
+            if (!expiry || !renewalConfirmed(renewal, performance.now(), expiry)) {
+                stop("check confirmation has no current authority");
+                return;
+            }
+        }
+        child.stdin.end("admitted\n");
+        clock.sample(outputCursor);
+        const renew = () => {
+            if (stopping || closed)
+                return;
+            if (renewalTimer) {
+                clearTimeout(renewalTimer);
+                renewalTimer = undefined;
+            }
             try {
-                if (!renewLease()) {
+                renewal.uncertainSince ??= performance.now();
+                const remaining = renewalRemaining(renewal);
+                if (!remaining) {
+                    stop("managed process renewal budget exhausted");
+                    return;
+                }
+                const receipt = renewLease(Math.min(RENEWAL_POLICY.attemptMs, remaining));
+                if (receipt === false || typeof receipt === "object" && !receipt.owned) {
                     stop("managed process lease lost");
                     return;
                 }
+                if (typeof receipt === "object" && receipt.owned) {
+                    const expiry = Date.parse(receipt.lease_expires_at);
+                    if (!Number.isFinite(expiry))
+                        throw new AppError("managed_lease_receipt_invalid", "Check renewal returned invalid expiry", 1);
+                    if (expiry <= Date.now())
+                        throw Object.assign(new Error("Check renewal receipt expired before acknowledgement"), { code: "process_maintenance_timeout" });
+                }
+                if (!renewalConfirmed(renewal, performance.now(), typeof receipt === "object" && receipt.owned ? receipt.lease_expires_at : null)) {
+                    stop("managed process renewal budget exhausted");
+                    return;
+                }
+            }
+            catch (cause) {
+                if (!maintenanceRetryable(cause) || !renewalFailure(renewal)) {
+                    stop(cause);
+                    return;
+                }
+                renewalTimer = setTimeout(renew, Math.min(renewalDelay(renewal), renewalRemaining(renewal)));
+                return;
+            }
+            // A progress callback error is not a retryable renewal failure.
+            try {
                 heartbeat(Math.floor((Date.now() - started) / 1000));
             }
             catch (cause) {
                 stop(cause);
             }
-        }, 15_000);
+        };
+        progress = setInterval(renew, 15_000);
     });
 }
 function checkShellScript() {
     return [
+        // The actual command cannot run before PID ownership and admission persist.
+        'IFS= read -r admission && [ "$admission" = admitted ] || exit 125',
         'completion="${DD_FLOW_CHECK_COMPLETION_FILE:-}"',
-        '/bin/sh -lc "$DD_FLOW_CHECK_COMMAND"',
+        '/bin/sh -c "$DD_FLOW_CHECK_COMMAND"',
         "code=$?",
         'if [ -n "$completion" ]; then temporary="$completion.tmp.$$"; printf \'{"exit_code":%s,"finished_at":"%s"}\\n\' "$code" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$temporary" && mv "$temporary" "$completion"; fi',
         'exit "$code"'
     ].join("\n");
 }
-function terminateProcessGroup(pid, signal) { if (!pid)
-    return; try {
-    process.kill(process.platform === "win32" ? pid : -pid, signal);
-}
-catch { /* already exited */ } }