@deksden-com/dd-flow-cli 0.9.0-beta.14 → 0.9.0-beta.140

package/dist/services/lifecycle-invocations.js

@@ -0,0 +1,2007 @@
+import crypto from "node:crypto";
+import { checkRepairDisposition } from "./check-runner-evidence.js";
+import path from "node:path";
+import fs from "node:fs";
+import { quote } from "shell-quote";
+import { setTimeout as delay } from "node:timers/promises";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { shortEntityReference } from "../shared/entity-references.js";
+import { resolveWorkReference } from "../storage/work-references.js";
+import { commandOption, commandPosition, continuationCommand, lifecycleCommandFromPayload, parseLifecycleCommand, shellSuffixOffset } from "./lifecycle-command.js";
+import { requireProjectByRoot } from "./projects.js";
+import { assertRunMutationAllowed, assertStageSettlementAllowed, assertWorkSettlementAllowed, recoveryGuard, recoveryPacketReceipt } from "./run-recovery.js";
+import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
+import { managedProcessStatus, processIsAlive, processStartedAt } from "./managed-processes.js";
+import { appendEvent } from "./run-controller-state.js";
+import { recoverCommittedWorkStart } from "./work-registry.js";
+import { observeCommandHook } from "./hooks.js";
+import { runtimeHarness } from "./execution-policy.js";
+import { normalizedPathAlias, resolveContextualPaths } from "./command-context.js";
+import { isRegisteredRepair } from "./repair-intents.js";
+import { stageAttempt } from "./stage-work-graph.js";
+import { contextualPathOptionsForLifecycle } from "../cli/command-inputs.js";
+import { canonicalPath } from "../storage/paths.js";
+import { runtimeCommand, shellArgument } from "./runtime-command.js";
+// Process-local custody: an executing SQL row or ambient variable alone cannot
+// recreate admission after a CLI restart, or in another resource database.
+const currentAdmissions = new WeakMap();
+export function currentLifecycleAdmission(context, id) {
+    const owned = currentAdmissions.get(context.db)?.get(id);
+    if (!owned || context.env.DD_FLOW_CURRENT_INVOCATION !== id || owned.pid !== process.pid
+        || process.cwd() !== owned.cwd)
+        return null;
+    // This private module cannot survive owner death/restart/PID reuse. Its
+    // captured physical birth + exact PID/CWD/store remain a lifetime proof;
+    // revalidation reads SQL only, including inside the atomic claim writer.
+    const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id=?", [id]);
+    if (!row || row.status !== "executing" || row.event_key !== owned.eventKey || row.identity_json !== owned.identity
+        || row.scope_json !== owned.scope || row.command !== owned.command || row.updated_at !== owned.admittedAt)
+        return null;
+    return { admittedAt: owned.admittedAt };
+}
+/** Auxiliary commands have no invocation capability, but may not escape their
+ * native daemon's project/RUN. Context aliases never grant mutation authority. */
+export function assertAuxiliaryCommandScope(context, command, projectRoot) {
+    const auxiliary = continuationCommand(command);
+    const daemonId = context.env.DD_FLOW_DAEMON_ID;
+    if (!auxiliary || !daemonId)
+        return;
+    const event = observedLifecycleNativeEvent(context, command, daemonId);
+    if (!event)
+        throw new AppError("invocation_receipt_missing", "Auxiliary command has no exact native receipt", 1, { phase: "prepare", effect: "no_effect" });
+    const project = context.db.get("SELECT root FROM projects WHERE id = ?", [event.project_id]);
+    if (!project || !projectRoot || canonicalPath(projectRoot, false) !== project.root)
+        throw new AppError("invocation_scope_mismatch", "Auxiliary command differs from its native project scope", 1, { phase: "prepare", effect: "no_effect" });
+    for (const record of managedProcessStatus(context)) {
+        if (record.project_id !== event.project_id || !record.run_id || !record.kind.endsWith("-daemon"))
+            continue;
+        const metadata = JSON.parse(record.metadata_json);
+        if (typeof metadata.state_dir !== "string")
+            continue;
+        let state;
+        try {
+            state = readNativeDaemonState(metadata.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (state.daemon_id !== daemonId)
+            continue;
+        requireManagedDaemonBinding(context, { stateDir: metadata.state_dir, projectId: event.project_id, runId: record.run_id });
+        const reference = auxiliary.args.options.get("run")?.[0] ?? auxiliary.args.positional[2];
+        const run = context.db.get("SELECT id FROM runs WHERE project_id = ? AND (id = ? OR short_id = ?)", [event.project_id, reference, reference]);
+        if (run?.id !== record.run_id)
+            throw new AppError("invocation_scope_mismatch", "Auxiliary command differs from its native RUN scope", 1, { phase: "prepare", effect: "no_effect" });
+        assertRunMutationAllowed(context, event.project_id, record.run_id, metadata.run_generation);
+        return;
+    }
+    throw new AppError("invocation_scope_unavailable", "Auxiliary command has no live managed daemon binding", 1, { phase: "prepare", effect: "no_effect" });
+}
+function sameNativeCall(left, right) {
+    const a = JSON.parse(left), b = JSON.parse(right);
+    // Parent and execution route are immutable facts, not a different call ID.
+    return [0, 1, 2, 4].every(index => a[index] === b[index]);
+}
+// Conclusive result/check rejections, never transport, ownership, registry or
+// unknown-effect failures. These validators reject before accepting the result.
+export function isRetryableLifecycleRejection(code, details = {}) {
+    if (code.startsWith("native_hook_") || code === "invocation_receipt_timeout")
+        return false;
+    if (code === "fresh_session_required" || details.recoverable === false || details.handoff_required === true || details.effect === "unknown" || details.effect === "committed")
+        return false;
+    if (code === "validation" || code === "schema_validation")
+        return details.phase === "prepare" && details.effect === "no_effect" && details.recoverable === true;
+    if (["invocation_command_mismatch", "invocation_argument_mismatch"].includes(code))
+        return details.recoverable !== false;
+    if (["work_checks_failed", "code_gate_failed", "code_review_gate_failed", "merge_gate_failed"].includes(code))
+        return Array.isArray(details.failures) && details.failures.length > 0 && details.failures.every(receipt => checkRepairDisposition(receipt) === "source_repair");
+    return details.recoverable === true || ["review_repair_incomplete", "plan_review_incomplete", "semantic_result_invalid",
+        "review_evidence_invalid", "evidence_obligation_unknown", "invalid_evidence_ref",
+        "evidence_ref_missing", "evidence_line_out_of_range", "document_update_missing",
+        "document_update_not_materialized", "review_repair_no_change"].includes(code)
+        || (code === "invalid_work_state" && details.retryable_no_effect === true);
+}
+/** A correctable rejection either publishes an exact replacement command or
+ * proves that the controller must hand the existing Work to another Session.
+ * The latter is deliberately not retryable in the caller that just failed. */
+export function isCorrectableLifecycleRejection(code, details = {}) {
+    if (details.recoverable === false || details.effect === "unknown" || details.effect === "committed")
+        return false;
+    return isRetryableLifecycleRejection(code, details)
+        || (code === "fresh_session_required" && details.handoff_required === true
+            && details.recoverable === true);
+}
+function registeredLifecycleContinuation(context, error, projectId, runId) {
+    if (runId && isRegisteredRepair(context, error.details.continuation, { projectId, runId }))
+        return true;
+    return error.code === "fresh_session_required" && error.details.handoff_required === true && runId !== null
+        && typeof error.details.work_id === "string" && Boolean(context.db.get("SELECT 1 FROM works WHERE project_id = ? AND run_id = ? AND work_id = ? AND launch_policy = 'fresh_agent_required' AND status IN ('created','running','paused')", [projectId, runId, error.details.work_id]));
+}
+function storage(context) {
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'")) {
+        throw new AppError("invocation_storage_unprepared", "Lifecycle invocation storage is not prepared; start dd-flow normally before issuing native work", 1);
+    }
+}
+function invocation(command) {
+    const parsed = parseLifecycleCommand(command);
+    if (parsed.kind !== "standalone" || parsed.invocation.wrapped) {
+        throw new AppError("invocation_command_invalid", "A lifecycle attempt requires one direct standalone command", 1);
+    }
+    return parsed.invocation;
+}
+function launchExpression(parsed) {
+    const executable = parsed.executable === "$DD_FLOW_BIN" ? '"$DD_FLOW_BIN"' : quote([parsed.executable]);
+    return parsed.launcher ? `${quote([parsed.launcher])} ${executable}` : executable;
+}
+// Input data may be supplied later (stdin/file contents); authority is bound to
+// the exact operation and literal argv. Existing lifecycle validation owns data.
+function fingerprint(parsed) {
+    const projected = publicInvocationArgs(parsed);
+    const publicParsed = invocation(`${launchExpression(parsed)} ${quoteModelFacingArgs(projected)}`);
+    const options = [...publicParsed.args.options].filter(([key]) => !["invocation-id", "hook-event-id", "json", "progress-jsonl"].includes(key))
+        .map(([key, values]) => [key, key === "reason" ? ["<semantic-reason>"] : values.map(value => normalizedInvocationValue(key, value))])
+        .sort(([a], [b]) => a.localeCompare(b));
+    return crypto.createHash("sha256").update(JSON.stringify([parsed.operation, publicParsed.args.positional.map(value => normalizedInvocationValue("positional", value)), options])).digest("hex");
+}
+const runtimeOwnedOptions = {
+    stage_start: new Set(["project-root", "context-file", "context-sha256", "response-file", "require-session-binding"]),
+    stage_finish: new Set(["project-root", "result-file", "decision-file", "verification-file"]),
+    stage_pause: new Set(["project-root"]), stage_resume: new Set(["project-root", "answer-file"]),
+    work_start: new Set(["project-root", "recovery-id"]),
+    work_finish: new Set(["project-root"]), work_fail: new Set(["project-root"]),
+    merge_apply: new Set(["project-root"]), merge_repair: new Set(["project-root"]),
+    recovery_accept: new Set(["project-root"])
+};
+function publicInvocationArgs(parsed) {
+    const hidden = runtimeOwnedOptions[parsed.operation] ?? new Set();
+    const args = [];
+    for (let index = 0; index < parsed.argv.length; index += 1) {
+        const value = parsed.argv[index];
+        if (!value.startsWith("--")) {
+            args.push(value);
+            continue;
+        }
+        const key = value.slice(2).split("=", 1)[0];
+        const inline = value.includes("=");
+        const next = parsed.argv[index + 1];
+        if (hidden.has(key) || key === "invocation-id" || key === "hook-event-id") {
+            if (!inline && next && !next.startsWith("--"))
+                index += 1;
+            continue;
+        }
+        args.push(value);
+        if (!inline && next && !next.startsWith("--"))
+            args.push(parsed.argv[++index]);
+    }
+    // A managed coordinator Session is already bound to its RUN. Work IDs stay
+    // public because sibling Work assignments can coexist under one native root.
+    const operationOffset = parsed.operation === "recovery_accept" ? 3 : 2;
+    if (["stage_start", "stage_finish", "recovery_accept"].includes(parsed.operation)
+        && !parsed.args.options.has("bootstrap") && args[operationOffset] && !args[operationOffset].startsWith("--"))
+        args.splice(operationOffset, 1);
+    return args;
+}
+function normalizedInvocationValue(key, value) {
+    value = normalizedPathAlias(value);
+    if (key === "project-root" && (path.isAbsolute(value) || value === "@project"))
+        return "@project";
+    if (["result-file", "decision-file", "verification-file"].includes(key))
+        return "<validated-input-path>";
+    if (value.startsWith("@project") || value.startsWith("@workspace") || value.startsWith("@run"))
+        return value.replace(/\\/g, "/");
+    if (["result-file", "decision-file", "verification-file", "context-file"].includes(key) && path.isAbsolute(value)) {
+        const runRelative = value.replace(/\\/g, "/").match(/\/(?:runs\/)?RUN-[^/]+\/(.+)$/)?.[1];
+        if (runRelative)
+            return `@run/${runRelative}`;
+    }
+    if (["positional", "work", "run"].includes(key))
+        return shortEntityReference(value);
+    return key === "retry-check" ? /(?:^|\/)(RCP-\d{3,})$/.exec(value)?.[1] ?? value : value;
+}
+/** Shell/JSON builders sometimes preserve the shell escape before an alias.
+ * Accept it only for the small declared alias vocabulary. */
+function quoteModelFacingArgs(argv) {
+    return argv.map(value => /^@(project|workspace|run)(?:\/.*)?$/.test(value)
+        ? `'${value.replaceAll("'", `'\\''`)}'`
+        : quote([value])).join(" ");
+}
+function withoutInvocationId(command, aliases) {
+    const parsed = invocation(command);
+    const argv = publicInvocationArgs(parsed);
+    for (let index = 0; index < argv.length; index += 1) {
+        const option = argv[index - 1]?.replace(/^--/, "");
+        if (option === "project-root")
+            argv[index] = "@project";
+        else if (option === "work" || option === "run")
+            argv[index] = shortEntityReference(argv[index]);
+        else if (option && aliases && ["result-file", "decision-file", "verification-file", "context-file"].includes(option) && path.isAbsolute(argv[index])) {
+            for (const [name, root] of [["run", aliases.run], ["workspace", aliases.workspace], ["project", aliases.project]]) {
+                if (!root)
+                    continue;
+                const relative = path.relative(root, argv[index]);
+                if (relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative))) {
+                    argv[index] = `@${name}${relative ? `/${relative.replaceAll(path.sep, "/")}` : ""}`;
+                    break;
+                }
+            }
+        }
+        else if (!argv[index - 1]?.startsWith("--") && !argv[index].startsWith("--"))
+            argv[index] = normalizedInvocationValue("positional", argv[index]);
+    }
+    const env = Object.fromEntries(Object.entries(parsed.env).filter(([key]) => !["DD_FLOW_INVOCATION_SCOPE", "DD_FLOW_HOME", "DD_FLOW_BIN"].includes(key)));
+    const executable = launchExpression(parsed);
+    const prefix = Object.entries(env).map(([key, value]) => `${key}=${quote([value])}`).join(" ");
+    const suffix = command.slice(shellSuffixOffset(command)).trimStart();
+    return `${prefix ? `${prefix} ` : ""}${executable}${argv.length ? ` ${quoteModelFacingArgs(argv)}` : ""}${suffix ? ` ${suffix}` : ""}`.trim();
+}
+function publicInvocationCommand(context, row, command) {
+    assertPrivateStageStartContract(row, command);
+    if (!commandOption(invocation(command), "project-root"))
+        command = retainedCommandWithoutInvocationId(row);
+    const rendered = renderInvocationCommand(row, command);
+    const scope = JSON.parse(row.scope_json);
+    const run = scope.runId ? context.db.get("SELECT workspace_root, run_root FROM runs WHERE id = ?", [scope.runId]) : undefined;
+    context.captureLifecycleAssignment?.(row.id);
+    return withoutInvocationId(rendered, { project: scope.projectRoot, ...(run?.workspace_root ? { workspace: run.workspace_root } : {}), ...(run?.run_root ? { run: run.run_root } : {}) });
+}
+/** Public fingerprints recognize a command; they do not replace its private
+ * controller contract when an issuer renders the same public operation. */
+function assertPrivateStageStartContract(row, command) {
+    const actual = invocation(command), retained = invocation(row.command);
+    if (actual.operation !== "stage_start")
+        return;
+    const lifecycleAssignment = { issuer: "dd-flow", phase: "issuance", scope: JSON.parse(row.scope_json) };
+    if (commandPosition(actual, 0) !== commandPosition(retained, 0))
+        throw new AppError("invocation_argument_mismatch", "Retained Stage entry has a different RUN target", 1, { invocation_id: row.id, phase: "prepare", effect: "no_effect", recoverable: false, lifecycle_assignment: lifecycleAssignment });
+    for (const key of ["context-file", "context-sha256", "response-file", "require-session-binding"]) {
+        const supplied = commandOption(actual, key), expected = commandOption(retained, key);
+        const normalized = (value) => ["context-file", "response-file"].includes(key) && path.isAbsolute(value) ? path.normalize(value) : normalizedInvocationValue(key, value);
+        if ((supplied === undefined) !== (expected === undefined)
+            || supplied !== undefined && normalized(supplied) !== normalized(expected)) {
+            throw new AppError("invocation_argument_mismatch", `Retained Stage entry has a different --${key} contract`, 1, { invocation_id: row.id, parameter: key, phase: "prepare", effect: "no_effect", recoverable: false, lifecycle_assignment: lifecycleAssignment });
+        }
+    }
+}
+/** Bind issued commands to the exact bytes sent to the model, not to an
+ * internal marker which is intentionally absent from that prompt. */
+export function bindLifecyclePacketAssignments(context, prompt, ids) {
+    const unique = [...new Set(ids)];
+    if (!unique.length)
+        return;
+    const digest = crypto.createHash("sha256").update(prompt).digest("hex");
+    context.db.writeTransaction(() => {
+        for (const id of unique) {
+            const row = load(context, id);
+            if (row.status !== "issued")
+                throw new AppError("invocation_packet_conflict", "Packet contains a lifecycle assignment already in flight", 1, { invocation_id: id });
+            context.db.run("INSERT OR IGNORE INTO lifecycle_packet_assignments (packet_sha256, invocation_id) VALUES (?, ?)", [digest, id]);
+        }
+    });
+}
+/** Stage renderers issue their commands before the final packet is assembled.
+ * Bind only issued commands visibly present in that exact published packet. */
+export function bindLifecyclePublishedPacket(context, prompt) {
+    const scope = context.env.DD_FLOW_INVOCATION_SCOPE;
+    if (!scope)
+        return;
+    const issued = context.db.all("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND status = 'issued' ORDER BY rowid", [scope]);
+    const ids = issued.filter(row => prompt.includes(publicInvocationCommand(context, row, retainedCommandWithoutInvocationId(row)))).map(row => row.id);
+    bindLifecyclePacketAssignments(context, prompt, ids);
+}
+function retainedCommandWithoutInvocationId(row) {
+    const marker = ` --invocation-id ${row.id}`;
+    const at = row.command.indexOf(marker);
+    if (at < 0 || row.command.indexOf(marker, at + marker.length) >= 0)
+        throw new AppError("invocation_command_invalid", "Retained issued command has an ambiguous invocation marker", 1);
+    return `${row.command.slice(0, at)}${row.command.slice(at + marker.length)}`;
+}
+/** Resolve the small, declared alias vocabulary used by model-facing lifecycle commands.
+ * Both native-hook admission and CLI execution call this function so they cannot
+ * disagree about the command that an alias denotes. */
+export function expandLifecycleInvocationArgs(context, args, scope, operation) {
+    const pathOptions = contextualPathOptionsForLifecycle(operation);
+    const run = scope.runId ? context.db.get("SELECT id, short_id, workspace_root, run_root FROM runs WHERE id = ?", [scope.runId]) : undefined;
+    const roots = { project: scope.projectRoot, workspace: run?.workspace_root, run: run?.run_root };
+    return resolveContextualPaths(args.map((value, index) => {
+        if (run && !args[index - 1]?.startsWith("--") && [run.short_id, normalizedInvocationValue("positional", run.id)].includes(value) && !operation.startsWith("work_"))
+            return run.id;
+        return value;
+    }), pathOptions, roots);
+}
+/** Validate alias spelling before native-receipt lookup, so a correctable
+ * command typo is never reported as missing infrastructure evidence. */
+export function validateLifecyclePathAliases(args, operation) {
+    const pathOptions = contextualPathOptionsForLifecycle(operation);
+    for (let index = 0; index < args.length; index += 1) {
+        const option = args[index - 1]?.replace(/^--/, "");
+        if (!option || !pathOptions.has(option))
+            continue;
+        const original = args[index];
+        const value = normalizedPathAlias(original);
+        if ((original.startsWith("\\") && original.replace(/^\\+/, "").startsWith("@") && value === original)
+            || (value.startsWith("@") && !/^@(project|workspace|run)(?:\/.*)?$/.test(value))) {
+            throw new AppError("usage", `Unknown path alias: ${original}`, 2, { phase: "prepare", effect: "no_effect", recoverable: true, parameter: option });
+        }
+    }
+}
+function canonicalManagedCommand(context, command, scope) {
+    const parsed = invocation(command);
+    const argv = expandLifecycleInvocationArgs(context, parsed.argv, scope, parsed.operation);
+    const env = { ...parsed.env, DD_FLOW_INVOCATION_SCOPE: JSON.stringify(scope) };
+    const prefix = Object.entries(env).map(([key, value]) => `${key}=${quote([value])}`).join(" ");
+    const executable = launchExpression(parsed);
+    const suffix = command.slice(shellSuffixOffset(command)).trimStart();
+    return `${prefix} ${executable}${argv.length ? ` ${quote(argv)}` : ""}${suffix ? ` ${suffix}` : ""}`.trim();
+}
+function load(context, id) {
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'")) {
+        throw new AppError("invocation_unknown", "This runtime has no issued lifecycle attempt for the requested operation; use a current runtime-issued command without adding an invocation ID", 1, { invocation_id: id, effect: "no_effect" });
+    }
+    const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [id]);
+    if (!row)
+        throw new AppError("invocation_unknown", "Lifecycle attempt was not issued by this runtime; use a current runtime-issued command without adding an invocation ID", 1, { invocation_id: id, effect: "no_effect" });
+    return row;
+}
+export function lifecycleInvocationScope(context, id) {
+    return JSON.parse(load(context, id).scope_json);
+}
+/** Read-only controller observation of a retained lifecycle outcome. */
+export function lifecycleInvocationOutcome(context, id) {
+    const row = load(context, id);
+    return { status: row.status, outcome: row.outcome_json ? JSON.parse(row.outcome_json) : null };
+}
+/** Current failures are read from runtime authority, never from model text. */
+export function assertLifecycleOutcomes(context, scope) {
+    const project = requireProjectByRoot(context, scope.projectRoot);
+    const diagnostics = lifecycleDiagnostics(context, project.id, scope.runId, scope.generation);
+    if (fs.existsSync(diagnostics)) {
+        for (const name of fs.readdirSync(diagnostics).filter(name => name.endsWith(".json"))) {
+            const record = JSON.parse(fs.readFileSync(path.join(diagnostics, name), "utf8"));
+            if (record.project_id !== project.id || record.run_id !== scope.runId || record.generation !== scope.generation)
+                throw new AppError("lifecycle_outcome_conflict", "Lifecycle diagnostic scope differs", 1);
+            throw new AppError(record.error?.code ?? "lifecycle_outcome_unknown", record.error?.message ?? "Lifecycle settlement could not be persisted", 1, { ...record.error?.details, lifecycle_outcome: record, diagnostic_artifact: path.join(diagnostics, name) });
+        }
+    }
+    const columns = context.db.all("PRAGMA table_info(hook_events)");
+    if (columns.some(column => column.name === "outcome_json")) {
+        for (const row of context.db.all("SELECT outcome_json FROM hook_events WHERE project_id = ? AND json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ? ORDER BY id", [project.id, scope.runId, scope.generation])) {
+            const outcome = JSON.parse(row.outcome_json);
+            if (outcome.disposition === "retrying" && outcome.deadline <= Date.now())
+                throw new AppError("lifecycle_outcome_unknown", "Storage retry has no terminal receipt; reconcile its committed evidence", 1, { lifecycle_outcome: outcome, effect: "unknown" });
+            if (outcome.disposition === "fatal" && !isRegisteredRepair(context, outcome.error?.details?.continuation, { projectId: project.id, runId: scope.runId }))
+                throw new AppError(outcome.error?.code ?? "lifecycle_outcome_unknown", outcome.error?.message || "Mandatory lifecycle failed (historical receipt has no message)", 1, { ...outcome.error?.details, lifecycle_outcome: outcome });
+        }
+    }
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'"))
+        return;
+    const rows = context.db.all(`SELECT a.* FROM lifecycle_invocations a
+    WHERE json_extract(a.scope_json, '$.projectRoot') = ? AND json_extract(a.scope_json, '$.runId') = ?
+      AND json_extract(a.scope_json, '$.generation') = ? AND a.status = 'settled'
+      AND NOT EXISTS (SELECT 1 FROM lifecycle_invocations newer WHERE newer.scope_json = a.scope_json AND newer.fingerprint = a.fingerprint AND newer.rowid > a.rowid)
+    ORDER BY a.rowid`, [scope.projectRoot, scope.runId, scope.generation]);
+    for (const row of rows) {
+        const error = (row.outcome_json ? JSON.parse(row.outcome_json) : null)?.error;
+        if (typeof error?.code === "string" && !isCorrectableLifecycleRejection(error.code, error.details) && !isRegisteredRepair(context, error.details?.continuation, { projectId: project.id, runId: scope.runId }))
+            throw new AppError(error.code, typeof error.message === "string" ? error.message : "Mandatory lifecycle failed", 1, { ...(error.details ?? {}), invocation_id: row.id });
+    }
+}
+/** Hooks already own native identity. Retain command outcomes there, with an
+ * atomic controller notification; missing notifications reconcile from the row. */
+export function observeLifecycleCommand(context, command, nativeEvent) {
+    const parsed = parseLifecycleCommand(command);
+    const auxiliary = continuationCommand(command);
+    if (parsed.kind !== "standalone" && !auxiliary)
+        return () => { };
+    let anchor;
+    context.observeLifecycleHook = (projectId, eventId) => {
+        if (anchor)
+            return;
+        const event = context.db.get("SELECT session_id, provider_session_id, parent_session_id, daemon_id, harness FROM hook_events WHERE id = ? AND project_id = ?", [eventId, projectId]);
+        if (!event)
+            return;
+        let runId = context.db.get("SELECT run_id FROM sessions WHERE project_id = ? AND harness = ? AND (session_id = ? OR session_id = ? OR provider_session_id = ?) AND run_id IS NOT NULL ORDER BY session_id = ? DESC LIMIT 1", [projectId, event.harness, event.session_id, event.parent_session_id, event.parent_session_id, event.session_id])?.run_id;
+        let generation;
+        let correlation = {};
+        // A first Stage command precedes logical Session binding. Its native root
+        // is already owned by the controller's retained create receipt.
+        if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'")) {
+            const owners = context.db.all("SELECT run_id, generation, state_json FROM run_controllers WHERE project_id = ? AND status NOT IN ('completed','cancelled','superseded')", [projectId]).filter(owner => {
+                const state = JSON.parse(owner.state_json);
+                return state.sessions?.some(session => [event.provider_session_id ?? event.session_id, event.parent_session_id].includes(session.id) && runtimeHarness(session.profile) === event.harness);
+            });
+            if (owners.length > 1)
+                return;
+            if (owners.length === 1) {
+                if (runId && runId !== owners[0].run_id)
+                    return;
+                runId = owners[0].run_id;
+                generation = owners[0].generation;
+                const current = JSON.parse(owners[0].state_json);
+                correlation = { stage: current.stage, ...(current.stage ? { attempt: stageAttempt(context, projectId, runId, current.stage) } : {}), controller_turn: current.turns };
+            }
+        }
+        if (event.daemon_id) {
+            for (const record of managedProcessStatus(context)) {
+                if (record.project_id !== projectId || !record.run_id || !record.kind.endsWith("-daemon"))
+                    continue;
+                const metadata = JSON.parse(record.metadata_json);
+                if (typeof metadata.state_dir !== "string")
+                    continue;
+                let daemonId;
+                try {
+                    daemonId = readNativeDaemonState(metadata.state_dir).daemon_id;
+                }
+                catch {
+                    continue;
+                } // Discovery of unrelated historical daemons is not authority.
+                if (daemonId !== event.daemon_id)
+                    continue;
+                const binding = requireManagedDaemonBinding(context, { stateDir: metadata.state_dir, projectId, runId: record.run_id });
+                if (binding.state.daemon_id !== event.daemon_id)
+                    continue;
+                runId = record.run_id;
+                generation = metadata.run_generation;
+                break;
+            }
+        }
+        if (!runId)
+            return;
+        anchor = { project_id: projectId, run_id: runId, generation: generation ?? recoveryGuard(context, projectId, runId)?.generation ?? 0, hook_event_id: eventId, session_id: event.session_id, harness: event.harness, operation: parsed.kind === "standalone" ? parsed.invocation.operation : auxiliary.operation, ...correlation, ...(auxiliary ? { auxiliary: true } : {}) };
+    };
+    if (nativeEvent)
+        context.observeLifecycleHook(nativeEvent.project_id, nativeEvent.id);
+    else
+        observeCommandHook(context, command);
+    const invocationId = parsed.kind === "standalone" ? commandOption(parsed.invocation, "invocation-id") : undefined;
+    if (!anchor && invocationId && !nativeEvent) {
+        const attempt = load(context, invocationId);
+        checkCommand(attempt, command);
+        if (attempt.event_key && ["observed", "executing"].includes(attempt.status)) {
+            const scope = JSON.parse(attempt.scope_json);
+            const project = requireProjectByRoot(context, scope.projectRoot);
+            const event = context.db.get("SELECT id FROM hook_events WHERE project_id = ? AND event_key = ?", [project.id, attempt.event_key]);
+            if (event)
+                context.observeLifecycleHook(project.id, event.id);
+        }
+        if (!anchor)
+            throw new AppError("invocation_receipt_missing", "Managed lifecycle command has no committed native receipt", 1, { invocation_id: invocationId, effect: "no_effect" });
+    }
+    return outcome => {
+        delete context.observeLifecycleHook;
+        if (!anchor)
+            return;
+        let error = outcome.error ? errorRecord(outcome.error) : undefined;
+        // The exact committed event can diagnose a broken transport, but cannot
+        // grant execution authority or select an assignment by command similarity.
+        if (error && parsed.kind === "standalone" && (nativeEvent || commandOption(parsed.invocation, "hook-event-id"))) {
+            const event = context.db.get("SELECT event_key, daemon_id, provider_session_id FROM hook_events WHERE id = ? AND project_id = ?", [anchor.hook_event_id, anchor.project_id]);
+            const assigned = event && context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'lifecycle_invocations'")
+                ? context.db.all("SELECT * FROM lifecycle_invocations WHERE event_key = ? AND status = 'observed'", [event.event_key]) : [];
+            if (assigned.length === 1 && event?.daemon_id && context.env.DD_FLOW_DAEMON_ID !== event.daemon_id) {
+                const scope = JSON.parse(assigned[0].scope_json);
+                const identity = assigned[0].identity_json ? JSON.parse(assigned[0].identity_json) : null;
+                const project = context.db.get("SELECT root FROM projects WHERE id = ?", [anchor.project_id]);
+                if (assigned[0].fingerprint === fingerprint(parsed.invocation) && scope.projectRoot === project?.root && scope.daemonId === event.daemon_id && scope.runId === anchor.run_id && scope.generation === anchor.generation
+                    && Array.isArray(identity) && identity[0] === event.daemon_id && identity[1] === scope.rootSessionId && identity[2] === (event.provider_session_id ?? anchor.session_id))
+                    error = errorRecord(new AppError("invocation_scope_unproven", "Managed shell did not receive its native daemon binding", 1, {
+                        reason: "managed_shell_context_missing", phase: "prepare", effect: "no_effect", recoverable: false,
+                        cause: { code: error.code, parameter: error.details.parameter, reason: error.details.reason }
+                    }));
+            }
+        }
+        const registeredContinuation = error && registeredLifecycleContinuation(context, error, anchor.project_id, anchor.run_id);
+        const retainedSuccessor = error && typeof error.details.retry_command === "string"
+            && typeof error.details.rejection_signature === "string"
+            && context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'lifecycle_invocations'")
+            && context.db.get(`SELECT 1 FROM lifecycle_invocations a JOIN hook_events h ON h.event_key = a.event_key
+        JOIN projects p ON p.id = h.project_id WHERE h.id = ? AND h.project_id = ? AND a.status = 'settled'
+        AND json_extract(a.scope_json,'$.projectRoot') = p.root AND json_extract(a.scope_json,'$.runId') = ?
+        AND json_extract(a.scope_json,'$.generation') = ? AND json_extract(a.outcome_json,'$.error.details.retry_command') = ?
+        AND json_extract(a.outcome_json,'$.error.details.rejection_signature') = ?`, [anchor.hook_event_id, anchor.project_id, anchor.run_id, anchor.generation, error.details.retry_command, error.details.rejection_signature]);
+        const hookOnlyArgumentDefect = error && !invocationId && !context.env.DD_FLOW_INVOCATION_SCOPE
+            && !retainedSuccessor
+            && ["missing_required_option", "missing_option_value", "empty_option_value", "invalid_number", "invalid_choice", "duplicate_option"].includes(String(error.details.reason));
+        const hookOnlyCorrection = error && parsed.kind === "standalone" && !auxiliary && !invocationId && !context.env.DD_FLOW_INVOCATION_SCOPE
+            && !retainedSuccessor && !hookOnlyArgumentDefect
+            && error.details.effect === "no_effect" && isRetryableLifecycleRejection(error.code, error.details)
+            && error.code !== "usage" && !["invocation_command_mismatch", "invocation_argument_mismatch"].includes(error.code)
+            && parsed.invocation.argv.some(value => /^(?:--(?:(?:result|semantic|decision|verification|context|answer|intake|question|reason)-file|data))(?:=|$)/.test(value))
+            && !isRegisteredRepair(context, error.details.continuation, { projectId: anchor.project_id, runId: anchor.run_id });
+        let correctionCwd;
+        if (error && hookOnlyCorrection) {
+            const receipt = context.db.get("SELECT sanitized_summary FROM hook_events WHERE id = ? AND project_id = ?", [anchor.hook_event_id, anchor.project_id]);
+            let payload = {};
+            try {
+                const decoded = JSON.parse(receipt?.sanitized_summary ?? "{}");
+                if (decoded && typeof decoded === "object" && !Array.isArray(decoded))
+                    payload = decoded;
+            }
+            catch { /* Truncated summaries cannot supply a route. */ }
+            if (payload.lifecycle_execution_cwd !== undefined) {
+                let confirmed = false;
+                const cwd = payload.lifecycle_execution_cwd;
+                if (typeof cwd === "string" && path.isAbsolute(cwd) && payload.lifecycle_execution_cwd_provenance === "literal_cd_intent_requires_cli_confirmation") {
+                    try {
+                        confirmed = fs.realpathSync(cwd) === fs.realpathSync(process.cwd());
+                    }
+                    catch { /* No physical confirmation, no executable correction. */ }
+                }
+                if (confirmed)
+                    correctionCwd = cwd;
+                else
+                    error = errorRecord(new AppError("invocation_directory_mismatch", "Hook-only correction has no confirmed native execution directory", 1, {
+                        reason: "literal_execution_cwd_unconfirmed", phase: "prepare", effect: "no_effect", recoverable: false,
+                        cause: { code: error.code, parameter: error.details.parameter, reason: error.details.reason }
+                    }));
+            }
+        }
+        const correctable = error && !hookOnlyArgumentDefect && error.details.recoverable !== false && error.details.effect !== "unknown"
+            && (registeredContinuation || error.details.effect === "no_effect" && isCorrectableLifecycleRejection(error.code, error.details)
+                && typeof error.details.retry_command === "string");
+        const correlationKey = parsed.kind === "standalone" ? fingerprint(parsed.invocation)
+            : JSON.stringify([auxiliary.operation, auxiliary.operation === "stage_block" ? auxiliary.args.positional[2] ?? null : auxiliary.args.options.get("run")?.[0] ?? null, auxiliary.args.options.get("stage")?.[0] ?? null]);
+        const record = { ...anchor, stage: anchor.stage ?? null, attempt: anchor.attempt ?? null, correlation_key: correlationKey, ...(parsed.kind === "standalone" ? { fingerprint: correlationKey } : {}), ...(error ? { error } : outcome), effect: error ? error.details.effect ?? (correctable ? "no_effect" : "unknown") : "committed", disposition: error ? auxiliary ? "pending_continuation" : correctable ? "correctable" : "fatal" : "completed" };
+        try {
+            context.db.writeTransaction(() => {
+                const retained = context.db.get("SELECT outcome_json FROM hook_events WHERE id = ?", [anchor.hook_event_id]);
+                const previous = retained?.outcome_json ? JSON.parse(retained.outcome_json) : null;
+                if (previous?.disposition !== "retrying" && previous?.error && error && previous.correlation_key === correlationKey
+                    && preparationRejectionSignature(new AppError(previous.error.code, previous.error.message, 1, previous.error.details))
+                        === preparationRejectionSignature(new AppError(error.code, error.message, 1, error.details))) {
+                    error = previous.error;
+                    Object.assign(record, previous);
+                    return;
+                }
+                if (error && parsed.kind === "standalone" && hookOnlyCorrection && error.details.recoverable !== false) {
+                    const signature = preparationRejectionSignature(new AppError(error.code, error.message, 1, error.details));
+                    error.details.hook_retry_signature = signature;
+                    const repeated = context.db.get(`SELECT 1 FROM hook_events WHERE project_id = ? AND id <> ?
+          AND json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ?
+          AND json_extract(outcome_json, '$.operation') = ? AND json_extract(outcome_json, '$.fingerprint') = ?
+          AND json_extract(outcome_json, '$.harness') = ? AND json_extract(outcome_json, '$.session_id') = ?
+          AND json_type(outcome_json, '$.stage') IS NOT NULL AND json_type(outcome_json, '$.attempt') IS NOT NULL
+          AND json_extract(outcome_json, '$.stage') IS ? AND json_extract(outcome_json, '$.attempt') IS ?
+          AND json_extract(outcome_json, '$.error.details.hook_retry_signature') = ? LIMIT 1`, [anchor.project_id, anchor.hook_event_id, anchor.run_id, anchor.generation, anchor.operation, correlationKey,
+                        anchor.harness, anchor.session_id, anchor.stage ?? null, anchor.attempt ?? null, signature]);
+                    if (!repeated) {
+                        const argv = parsed.invocation.argv.filter((value, index, all) => !/^--(?:hook-event-id|invocation-id)(?:=|$)/.test(value)
+                            && !/^--(?:hook-event-id|invocation-id)$/.test(all[index - 1] ?? ""));
+                        error.details.retry_command = `${correctionCwd ? `cd ${shellArgument(correctionCwd)} && ` : ""}${runtimeCommand(context, argv)}`;
+                        error.details.retry_instruction = "Correct the evidenced input, then execute the exact supplied retry_command once in this Session without changing its launch route. The rejected attempt had no lifecycle effect.";
+                        error.details.recoverable = true;
+                        record.disposition = "correctable";
+                    }
+                    else {
+                        error.details.recoverable = false;
+                        error.details.repeated_without_progress = true;
+                        record.disposition = "fatal";
+                    }
+                }
+                if (error && !auxiliary && record.disposition === "fatal") {
+                    error.details.recoverable = false;
+                    delete error.details.retry_command;
+                    delete error.details.retry_instruction;
+                }
+                if (previous?.storage_retry === 1)
+                    Object.assign(record, { storage_retry: 1, work_id: previous.work_id });
+                const encoded = JSON.stringify(record);
+                if (retained?.outcome_json && previous?.disposition !== "retrying") {
+                    if (retained.outcome_json !== encoded)
+                        throw new AppError("lifecycle_outcome_conflict", "Hook outcome cannot change", 1, { hook_event_id: anchor.hook_event_id });
+                    return;
+                }
+                context.db.run("UPDATE hook_events SET outcome_json = ? WHERE id = ?", [encoded, anchor.hook_event_id]);
+                if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'"))
+                    for (const controller of context.db.all("SELECT controller_id FROM run_controllers WHERE project_id = ? AND run_id = ? AND generation = ?", [anchor.project_id, anchor.run_id, anchor.generation]))
+                        appendEvent(context, controller.controller_id, "lifecycle_outcome", record);
+            });
+        }
+        catch (persistence) {
+            if (persistence instanceof AppError && persistence.code === "lifecycle_outcome_conflict")
+                throw persistence;
+            if (error) {
+                error.details.recoverable = false;
+                delete error.details.retry_command;
+                delete error.details.retry_instruction;
+            }
+            // Diagnostic evidence is not replay authority. If SQL is unavailable,
+            // the controller still sees this failure and fences instead of waiting
+            // for a model to report it or invent a new invocation.
+            const directory = lifecycleDiagnostics(context, anchor.project_id, anchor.run_id, anchor.generation);
+            try {
+                fs.mkdirSync(directory, { recursive: true });
+                fs.writeFileSync(path.join(directory, `${anchor.hook_event_id}.json`), JSON.stringify({ ...record, disposition: "fatal", persistence_error: String(persistence) }), { flag: "wx", mode: 0o600, flush: true });
+            }
+            catch (diagnostic) {
+                if (diagnostic.code !== "EEXIST")
+                    process.stderr.write(`${JSON.stringify({ primary: record.error ?? { effect: "committed" }, persistence: String(persistence), diagnostic: String(diagnostic) })}\n`);
+            }
+            throw persistence;
+        }
+        // Serializers intentionally clone JSON-safe diagnostics. These response
+        // fields are the deliberate API overlay on the original rejection, only
+        // after its exact durable hook outcome has committed.
+        if (outcome.error && error) {
+            outcome.error.code = error.code;
+            outcome.error.message = error.message;
+            Object.assign(outcome.error.details, error.details);
+            if (record.disposition === "fatal") {
+                delete outcome.error.details.retry_command;
+                delete outcome.error.details.retry_instruction;
+            }
+        }
+    };
+}
+function lifecycleDiagnostics(context, projectId, runId, generation) {
+    return path.join(context.ddFlowHome, "diagnostics", "lifecycle", encodeURIComponent(projectId), encodeURIComponent(runId), String(generation));
+}
+/** Current, explicitly-issued replacements for commands from the resumed stage.
+ * Original prompts remain immutable evidence; callers may present this small
+ * overlay after a state transition made an earlier no-effect rejection retryable. */
+export function lifecycleRetryCommands(context, stage) {
+    const scope = context.env.DD_FLOW_INVOCATION_SCOPE;
+    if (!scope || !context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'"))
+        return [];
+    return [...new Set(context.db.all("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND status = 'settled' ORDER BY rowid", [scope])
+            .flatMap((row) => {
+            try {
+                const outcome = row.outcome_json ? JSON.parse(row.outcome_json) : null;
+                const retry = outcome?.error?.details?.retry_command;
+                const parsed = invocation(row.command);
+                if (typeof retry !== "string" || parsed.operation !== "stage_finish" || commandOption(parsed, "stage") !== stage)
+                    return [];
+                const latest = context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [row.scope_json, row.fingerprint]);
+                return latest?.status === "issued" && (latest.deadline === null || latest.deadline > Date.now()) ? [retry] : [];
+            }
+            catch {
+                return [];
+            }
+        }))];
+}
+export function managedInvocationContext(context, input) {
+    const env = { ...context.env, DD_FLOW_CURRENT_INVOCATION: undefined, DD_FLOW_INVOCATION_SCOPE: undefined };
+    if (!["zcode-acp", "codex-desktop", "grok-acp", "antigravity-cli", "droid-cli", "opencode-server"].includes(input.harness))
+        return { ...context, env };
+    const project = requireProjectByRoot(context, input.projectRoot);
+    const { state, process: daemon } = requireManagedDaemonBinding(context, { stateDir: input.stateDir, projectId: project.id, runId: input.runId });
+    if (JSON.parse(daemon.metadata_json).run_generation !== input.generation)
+        throw new AppError("invocation_generation_stale", "Managed daemon belongs to another RUN generation", 1);
+    const session = state.sessions?.find(session => typeof session === "string" ? session === input.sessionId : session.adapter_session_id === input.sessionId || session.provider_session_id === input.sessionId);
+    // Codex owns a single root Session per controller and persists that root as
+    // a string. Child agent_id values arrive later through the native hook and
+    // are checked against this root scope; they are not controller Sessions.
+    const rootSessionId = input.harness !== "zcode-acp"
+        ? (typeof session === "string" ? session : session?.root_provider_session_id ?? session?.provider_session_id ?? null)
+        : (typeof session === "string" ? null : session?.root_provider_session_id ?? null);
+    if (!state.daemon_id || !rootSessionId)
+        throw new AppError("invocation_scope_unproven", "Managed native Session has no persisted native root binding", 1);
+    const scope = { projectRoot: project.root, daemonId: state.daemon_id, rootSessionId, runId: input.runId, generation: input.generation };
+    env.DD_FLOW_INVOCATION_SCOPE = JSON.stringify(scope);
+    return { ...context, env };
+}
+/** Generated commands retain their attempt across repeated rendering. Execution
+ * can issue a retry; accepted HITL intent can replace an unobserved placeholder
+ * or issue the next pause's assignment after successful settlement. */
+export function managedLifecycleCommand(context, command, options = {}) {
+    const configured = context.env.DD_FLOW_INVOCATION_SCOPE;
+    if (!configured)
+        return command;
+    const scope = JSON.parse(configured);
+    command = canonicalManagedCommand(context, command, scope);
+    const parsed = invocation(command);
+    if (options.freshWorkAttempt && !["work_finish", "work_fail"].includes(parsed.operation))
+        throw new AppError("invocation_command_mismatch", "Fresh Work packet may only issue Work settlement commands", 1);
+    const suppliedId = commandOption(parsed, "invocation-id");
+    // An invocation id is authority, never decorative text.  In particular,
+    // callers that add arguments after rendering must not be able to reuse an
+    // issued id for a different command.
+    if (suppliedId) {
+        const retained = load(context, suppliedId);
+        if (retained.scope_json !== JSON.stringify(scope)) {
+            throw new AppError("invocation_scope_mismatch", "Lifecycle attempt belongs to another managed scope", 1, { invocation_id: suppliedId });
+        }
+        assertPrivateStageStartContract(retained, command);
+        checkCommand(retained, command);
+        assertRenderableInvocation(retained);
+        return publicInvocationCommand(context, retained, command);
+    }
+    if (!context.db.writable || context.env.DD_FLOW_INVOCATION_READONLY === "1") {
+        const retained = context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'")
+            ? context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [JSON.stringify(scope), fingerprint(parsed)]) : undefined;
+        if (!retained)
+            throw new AppError("invocation_command_unprepared", "The controller has not issued this lifecycle operation yet. End this Turn and await its next assignment; do not add or reuse an internal invocation ID.", 1);
+        return publicInvocationCommand(context, retained, command);
+    }
+    storage(context);
+    return context.db.writeTransaction(() => {
+        const prior = options.freshWorkAttempt ? undefined : context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [JSON.stringify(scope), fingerprint(parsed)]);
+        if (prior && prior.id !== context.env.DD_FLOW_CURRENT_INVOCATION) {
+            const replacesAnswer = options.replaceUnobservedAnswer && parsed.operation === "stage_resume"
+                && (prior.status === "settled" || commandOption(invocation(prior.command), "answer-file") !== commandOption(parsed, "answer-file"));
+            if (!replacesAnswer)
+                return publicInvocationCommand(context, prior, command);
+            // The pause packet can prepare a placeholder before the controller has
+            // accepted an answer. Replace only an unobserved assignment; never change
+            // the authority of a native call already in flight.
+            const completed = prior.status === "settled" && prior.outcome_json && !JSON.parse(prior.outcome_json).error;
+            if (prior.status !== "issued" && !completed)
+                throw new AppError("invocation_answer_conflict", "Cannot replace an answer while its lifecycle assignment is in flight or failed", 1, { invocation_id: prior.id });
+            if (prior.status === "issued")
+                context.db.run("UPDATE lifecycle_invocations SET status = 'expired' WHERE id = ?", [prior.id]);
+        }
+        if (context.env.DD_FLOW_INVOCATION_READONLY === "1")
+            throw new AppError("invocation_command_unprepared", "No prepared lifecycle command is available; read-only inspection cannot issue one", 1);
+        const issued = issueLifecycleInvocation(context, command, scope);
+        return publicInvocationCommand(context, load(context, issued.id), command);
+    });
+}
+export function retryLifecycleInvocationCommand(context, id, checkReceiptId) {
+    const prior = load(context, id);
+    if (prior.status !== "executing")
+        throw new AppError("invocation_retry_not_authorized", "Only the executing lifecycle operation can publish its next attempt", 1);
+    return successorLifecycleInvocationCommand(context, prior, checkReceiptId);
+}
+/** A predecessor may publish exactly one successor only while the caller has
+ * proved that no lifecycle effect was admitted. Shared by CLI argument
+ * validation and conclusive lifecycle/result rejection, never by hooks. */
+function successorLifecycleInvocationCommand(context, prior, checkReceiptId) {
+    const parsed = invocation(prior.command);
+    const argv = [...parsed.argv];
+    const at = argv.indexOf("--invocation-id");
+    if (at < 0 || argv[at + 1] !== prior.id)
+        throw new AppError("invocation_command_invalid", "Retained issued command lost its invocation marker", 1);
+    // The parser proves the marker belongs to argv. Remove that one rendered
+    // token from the retained text so response-file/stdin/heredoc presentation
+    // remains byte-for-byte stable across a retry.
+    let command = retainedCommandWithoutInvocationId(prior);
+    if (checkReceiptId) {
+        // Keep the trusted route and all stdin/redirection bytes. Replace only
+        // already-parsed literal retry options; ambiguous rendering fails closed.
+        let retained = prior.command;
+        for (const key of ["retry-check", "reason", "reason-file"]) {
+            const value = commandOption(parsed, key);
+            if (value === undefined)
+                continue;
+            const spellings = [...new Set([shellArgument(value), quote([value]), JSON.stringify(value)])];
+            const fragments = spellings.flatMap(rendered => [` --${key} ${rendered}`, ` --${key}=${rendered}`]).filter(fragment => retained.includes(fragment));
+            if (fragments.length !== 1 || retained.indexOf(fragments[0]) !== retained.lastIndexOf(fragments[0]))
+                throw new AppError("invocation_command_invalid", "Retained retry option cannot be rewritten unambiguously", 1);
+            retained = retained.replace(fragments[0], "");
+        }
+        command = retained.replace(` --invocation-id ${prior.id}`, ` --retry-check ${shellArgument(checkReceiptId)} --reason ${shellArgument("Recheck after candidate-source correction")}`);
+    }
+    return managedLifecycleCommand({ ...context, env: { ...context.env, DD_FLOW_INVOCATION_SCOPE: prior.scope_json, DD_FLOW_CURRENT_INVOCATION: prior.id } }, command);
+}
+// Caller holds the write transaction and has checked authority. Issued (or
+// legacy expired) attempts have never admitted an effect; observed/executing
+// attempts must never receive an automatic replacement.
+function settleUnadmittedInvocation(context, prior, error) {
+    if (!["issued", "expired"].includes(prior.status))
+        throw new AppError("invocation_rejection_conflict", "Attempt already admitted native execution", 1);
+    const details = { ...error.details, effect: "no_effect", recoverable: false };
+    if (context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ? AND status = ?", [JSON.stringify({ error: { ...error, details } }), context.now(), prior.id, prior.status]).changes !== 1) {
+        throw new AppError("invocation_settlement_conflict", "Lifecycle rejection could not be committed", 1, { invocation_id: prior.id });
+    }
+    return details;
+}
+const receiptTimeout = (id) => ({ code: "invocation_receipt_timeout", message: "No native confirmation before the receipt deadline; lifecycle state was not changed", exitCode: 1, details: { invocation_id: id } });
+/** Settle a conclusive rejection and publish its only legal successor atomically.
+ * A crash must leave either the old attempt executing, or both the settled
+ * outcome and its successor; never a usable successor beside an unknown effect. */
+export function settleLifecycleRejection(context, id, error) {
+    storage(context);
+    // Only this settlement may publish a successor; inherited help is not authority.
+    delete error.details.retry_command;
+    delete error.details.retry_instruction;
+    const details = { ...error.details };
+    try {
+        context.db.writeTransaction(() => {
+            const prior = load(context, id);
+            if (prior.status !== "executing")
+                throw new AppError("invocation_settlement_conflict", "Attempt is no longer executing", 1, { invocation_id: id });
+            const storageRetry = error.code === "storage_write_failed" && error.details.effect === "no_effect"
+                && !context.db.get("SELECT 1 FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND json_extract(outcome_json, '$.error.details.storage_retry') = 1 LIMIT 1", [prior.scope_json, prior.fingerprint]);
+            if (isRetryableLifecycleRejection(error.code, error.details) || storageRetry) {
+                const failures = ["work_checks_failed", "code_gate_failed", "code_review_gate_failed", "merge_gate_failed"].includes(error.code) ? error.details.failures : undefined;
+                const retry = retryLifecycleInvocationCommand(context, id, failures?.[0]?.id);
+                details.retry_command = retry;
+                details.effect = "no_effect";
+                details.recoverable = true;
+                if (storageRetry)
+                    details.storage_retry = 1;
+                details.retry_instruction = isRegisteredRepair(context, details.continuation)
+                    ? "The repair is already registered. End this coordinator turn so the controller can launch its fresh child. Use retry_command only after that repair completes, with fresh semantic verification."
+                    : "Correct only the evidenced defect, then use retry_command with the required result input. Reissuing the old command only reads its retained outcome.";
+                if (["memory_review_corrections_required", "memory_correction_checks_invalid"].includes(error.code) && typeof details.correction_instruction === "string")
+                    details.retry_instruction = details.correction_instruction;
+            }
+            else if (isCorrectableLifecycleRejection(error.code, error.details)
+                && registeredLifecycleContinuation(context, error, requireProjectByRoot(context, JSON.parse(prior.scope_json).projectRoot).id, JSON.parse(prior.scope_json).runId)) {
+                details.effect = "no_effect";
+                details.recoverable = true;
+                details.handoff_required = true;
+                details.recovery_instruction = "Do not retry this command in the current Session. End the coordinator Turn; the controller will launch the already-registered Work in a fresh child Session.";
+            }
+            else {
+                details.recoverable = false;
+            }
+            settleLifecycleInvocation(context, id, { error: { ...error, details } });
+        });
+    }
+    catch (persistence) {
+        error.details.recoverable = false;
+        throw persistence;
+    }
+    Object.assign(error.details, details);
+}
+/** Recovery preserves the original packet as evidence. Only its retained,
+ * never-executed commands receive new authority; unknown effects never replay. */
+export function hasLifecyclePacketAssignments(context, originalPrompt) {
+    const digest = crypto.createHash("sha256").update(originalPrompt).digest("hex");
+    return Boolean(context.db.get("SELECT 1 FROM lifecycle_packet_assignments WHERE packet_sha256 = ? LIMIT 1", [digest]));
+}
+export function recoverLifecycleCommands(context, originalPrompt, scope) {
+    const digest = crypto.createHash("sha256").update(originalPrompt).digest("hex");
+    const ids = context.db.all("SELECT invocation_id FROM lifecycle_packet_assignments WHERE packet_sha256 = ? ORDER BY rowid", [digest]).map(row => row.invocation_id);
+    if (!ids.length)
+        throw new AppError("invocation_recovery_unbound", "Original packet has no verified lifecycle assignment binding; reconcile it before continuing", 1);
+    const recovered = [];
+    for (const id of ids) {
+        let prior = load(context, id);
+        const oldScope = JSON.parse(prior.scope_json);
+        if (oldScope.projectRoot !== scope.projectRoot || oldScope.runId !== scope.runId
+            || oldScope.rootSessionId !== scope.rootSessionId || oldScope.generation >= scope.generation) {
+            throw new AppError("invocation_recovery_scope_mismatch", "Retained command does not belong to the recovered root and an earlier generation", 1, { invocation_id: id });
+        }
+        // The immutable prompt can predate several recoveries. Follow the newest
+        // retained attempt, including an unknown successor, rather than reviving
+        // an older unexecuted command after the successor already produced effects.
+        prior = context.db.get(`SELECT * FROM lifecycle_invocations WHERE fingerprint = ?
+      AND json_extract(scope_json, '$.projectRoot') = ? AND json_extract(scope_json, '$.runId') IS ?
+      AND json_extract(scope_json, '$.rootSessionId') = ? AND json_extract(scope_json, '$.generation') < ?
+      ORDER BY json_extract(scope_json, '$.generation') DESC, rowid DESC LIMIT 1`, [prior.fingerprint, scope.projectRoot, scope.runId, scope.rootSessionId, scope.generation]);
+        if (prior.status === "executing" || prior.status === "settled") {
+            const outcome = prior.outcome_json ? JSON.parse(prior.outcome_json) : null;
+            recovered.push({ invocation_id: id, status: prior.status, outcome,
+                instruction: prior.status === "executing" ? "Outcome unknown: reconcile retained operation evidence; do not reissue this command." : "Read the retained outcome; do not repeat completed effects." });
+            continue;
+        }
+        const parsed = invocation(prior.command);
+        const argv = [...parsed.argv];
+        const at = argv.indexOf("--invocation-id");
+        if (at < 0 || argv[at + 1] !== prior.id)
+            throw new AppError("invocation_command_invalid", "Retained command lost its exact invocation marker", 1);
+        argv.splice(at, 2);
+        const env = { ...parsed.env, DD_FLOW_INVOCATION_SCOPE: JSON.stringify(scope) };
+        const command = `${Object.entries(env).map(([key, value]) => `${key}=${quote([value])}`).join(" ")} ${launchExpression(parsed)} ${quote(argv)} ${prior.command.slice(shellSuffixOffset(prior.command))}`.trim();
+        const prepared = managedLifecycleCommand({ ...context, env: { ...context.env, DD_FLOW_INVOCATION_SCOPE: JSON.stringify(scope), DD_FLOW_CURRENT_INVOCATION: undefined } }, command);
+        recovered.push({ invocation_id: id, status: "replaced_unexecuted", command: prepared });
+    }
+    return recovered;
+}
+export function assertLifecycleInvocationCurrent(context, scope, command) {
+    const parsed = invocation(command);
+    if (!scope.runId) {
+        if ((parsed.operation === "stage_start" && parsed.args.options.has("bootstrap")) || parsed.operation === "session_register")
+            return;
+        throw new AppError("invocation_scope_invalid", "This lifecycle operation requires an issued RUN scope", 1);
+    }
+    const project = requireProjectByRoot(context, scope.projectRoot);
+    let workId;
+    if (parsed.operation.startsWith("work_")) {
+        const target = parsed.args.positional[0] ?? "";
+        try {
+            workId = resolveWorkReference(context, target, { projectId: project.id, runId: scope.runId }).work_id;
+        }
+        catch (error) {
+            if (!(error instanceof AppError) || !["not_found", "ambiguous_work_alias"].includes(error.code))
+                throw error;
+            throw new AppError("invocation_scope_mismatch", "Work does not belong unambiguously to the issued RUN scope", 1);
+        }
+    }
+    else if (parsed.operation.startsWith("merge_")) {
+        const request = context.db.get("SELECT project_id, run_id FROM merge_requests WHERE merge_request_id = ?", [parsed.args.positional[0] ?? ""]);
+        if (!request || request.project_id !== project.id || request.run_id !== scope.runId)
+            throw new AppError("invocation_scope_mismatch", "MERGE request does not belong to the issued RUN scope", 1);
+    }
+    else if (parsed.operation !== "session_register" && !parsed.args.options.has("bootstrap")) {
+        const target = parsed.args.positional[0];
+        const run = context.db.get("SELECT id FROM runs WHERE project_id = ? AND (id = ? OR short_id = ?)", [project.id, target ?? null, target ?? null]);
+        if (run?.id !== scope.runId)
+            throw new AppError("invocation_scope_mismatch", "Command does not belong to the issued RUN scope", 1);
+    }
+    const guard = recoveryGuard(context, project.id, scope.runId);
+    // A cooperative pause advances the fence but explicitly admits settlement
+    // of the captured WorkSession/Stage attempt. Reuse that exact authority;
+    // never turn the invocation layer into a stricter, divergent pause policy.
+    if (guard?.status === "draining" && guard.generation === scope.generation + 1) {
+        if (workId && ["work_finish", "work_fail"].includes(parsed.operation))
+            return assertWorkSettlementAllowed(context, project.id, scope.runId, workId);
+        if (parsed.operation === "stage_finish") {
+            assertStageSettlementAllowed(context, project.id, scope.runId, commandOption(parsed, "stage") ?? "");
+            return;
+        }
+    }
+    if ((guard?.generation ?? 0) !== scope.generation)
+        throw new AppError("invocation_generation_stale", "Lifecycle attempt belongs to another recovery generation", 1);
+    if (parsed.operation !== "recovery_accept")
+        assertRunMutationAllowed(context, project.id, scope.runId);
+}
+function checkCommand(row, command) {
+    const parsed = invocation(command);
+    assertSuppliedLifecycleTarget(row, parsed);
+    const scope = JSON.parse(row.scope_json);
+    if (commandOption(parsed, "invocation-id") !== row.id || fingerprint(parsed) !== row.fingerprint
+        || path.resolve(commandOption(parsed, "project-root") ?? "") !== scope.projectRoot) {
+        throw new AppError("invocation_command_mismatch", "Lifecycle attempt belongs to another command or project", 1, { invocation_id: row.id });
+    }
+}
+/** Public commands may omit the coordinator RUN. A supplied target remains
+ * input to validate, not text to silently overwrite with retained authority. */
+function assertSuppliedLifecycleTarget(row, actual) {
+    if (!["stage_start", "stage_finish", "recovery_accept"].includes(actual.operation) || actual.args.options.has("bootstrap"))
+        return;
+    const supplied = commandPosition(actual, 0), expected = commandPosition(invocation(row.command), 0);
+    if (supplied === undefined)
+        return;
+    if (!expected || ![expected, shortEntityReference(expected)].includes(supplied))
+        throw new AppError("invocation_argument_mismatch", "Supplied RUN target differs from its retained lifecycle assignment", 2, { invocation_id: row.id, parameter: "run", phase: "prepare", effect: "no_effect", recoverable: true });
+}
+/** Explicit issuance; callers retain this command. Read-only show/status must
+ * return that retained value, not issue a replacement on every observation. */
+export function prepareLifecycleIssuance(command, value) {
+    if (typeof command !== "string" || !command.trim() || !value || typeof value !== "object" || Array.isArray(value)) {
+        throw new AppError("invocation_scope_invalid", "Lifecycle issuance requires command and managed scope", 1);
+    }
+    const scope = value;
+    const parsed = invocation(command);
+    if (typeof scope.daemonId !== "string" || !scope.daemonId.trim() || typeof scope.rootSessionId !== "string" || !scope.rootSessionId.trim() || !Number.isSafeInteger(scope.generation) || scope.generation < 0
+        || (scope.runId !== null && (typeof scope.runId !== "string" || !scope.runId.trim()))
+        || typeof scope.projectRoot !== "string" || !path.isAbsolute(scope.projectRoot) || commandOption(parsed, "project-root") !== scope.projectRoot
+        || commandOption(parsed, "invocation-id") || commandOption(parsed, "hook-event-id")) {
+        throw new AppError("invocation_scope_invalid", "Lifecycle issuance requires explicit managed scope and a new command", 1);
+    }
+    return { command, scope, parsed };
+}
+export function issueLifecycleInvocation(context, command, scope) {
+    const { parsed } = prepareLifecycleIssuance(command, scope);
+    storage(context);
+    const id = crypto.randomUUID();
+    const prepared = commandWithInvocationId(command, id);
+    // Validate the actual inserted argv, including quoted heredoc boundaries.
+    const row = { id, command: prepared, scope_json: JSON.stringify(scope), fingerprint: fingerprint(parsed) };
+    checkCommand(row, prepared);
+    context.db.run("INSERT INTO lifecycle_invocations (id, scope_json, command, fingerprint, status, created_at, updated_at) VALUES (?, ?, ?, ?, 'issued', ?, ?)", [id, row.scope_json, prepared, row.fingerprint, context.now(), context.now()]);
+    return { id, command: prepared };
+}
+/** Prepare outside a write transaction; the Work retry CAS owns issuance. */
+export function prepareWorkStartAuthority(context, command, previousId) {
+    const prior = previousId ? load(context, previousId) : null;
+    const configured = context.env.DD_FLOW_INVOCATION_SCOPE;
+    if (!configured && !prior)
+        return null;
+    const scope = JSON.parse(configured ?? prior.scope_json);
+    if (prior && prior.scope_json !== JSON.stringify(scope))
+        throw new AppError("invocation_scope_mismatch", "Work start belongs to another controller scope", 1);
+    command = canonicalManagedCommand(context, command, scope);
+    const { parsed } = prepareLifecycleIssuance(command, scope);
+    if (parsed.operation !== "work_start")
+        throw new AppError("invocation_command_mismatch", "Work authority must start its Work", 1);
+    if (prior && prior.fingerprint !== fingerprint(parsed))
+        throw new AppError("invocation_command_mismatch", "Retained Work start authority belongs to a different Work", 1, { invocation_id: prior.id });
+    assertLifecycleInvocationCurrent(context, scope, command);
+    return { command, scope };
+}
+/** Caller owns the retry CAS. Preserve settled outcomes; never steal an
+ * observed/executing terminal operation from the previous Work attempt. */
+export function retireWorkPacketAuthorities(context, workId) {
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'lifecycle_packet_assignments'"))
+        return;
+    const attempts = context.db.all("SELECT DISTINCT li.* FROM lifecycle_invocations li JOIN lifecycle_packet_assignments pa ON pa.invocation_id=li.id JOIN work_sessions ws ON pa.packet_sha256=json_extract(ws.start_receipt_json,'$.prompt_sha256') WHERE ws.work_id=?", [workId]);
+    for (const attempt of attempts) {
+        if (!["work_finish", "work_fail"].includes(invocation(attempt.command).operation))
+            continue;
+        if (["observed", "executing"].includes(attempt.status))
+            throw new AppError("work_retry_incomplete", "Previous Work settlement still has native authority in flight", 1, { work_id: workId, invocation_id: attempt.id });
+        if (attempt.status === "issued")
+            context.db.run("UPDATE lifecycle_invocations SET status='expired',updated_at=? WHERE id=? AND status='issued'", [context.now(), attempt.id]);
+    }
+}
+function commandWithInvocationId(command, id) {
+    const at = shellSuffixOffset(command);
+    const suffix = command.slice(at);
+    return `${command.slice(0, at)} --invocation-id ${id}${suffix ? /^\s/.test(suffix) ? suffix : ` ${suffix}` : ""}`;
+}
+/** The attempt owns authority; the caller owns presentation-only shell input.
+ * Preserve current stdin/heredoc/response-file text while validating that it
+ * still names the exact persisted operation and project. */
+function assertRenderableInvocation(row) {
+    const outcome = row.outcome_json ? JSON.parse(row.outcome_json) : null;
+    if (row.status === "settled" && outcome?.error)
+        throw new AppError("invocation_command_blocked", "Failed lifecycle authority cannot be advertised as an executable command", 1, { invocation_id: row.id, outcome });
+    if (row.status === "expired" || row.status === "issued" && row.deadline !== null && row.deadline <= Date.now()) {
+        throw new AppError("invocation_expired", "Retained lifecycle attempt has expired; inspection cannot grant a new attempt", 1, { invocation_id: row.id, status: row.status, outcome: row.outcome_json ? JSON.parse(row.outcome_json) : null });
+    }
+}
+function renderInvocationCommand(row, command) {
+    assertRenderableInvocation(row);
+    const parsed = invocation(command);
+    if (commandOption(parsed, "invocation-id")) {
+        checkCommand(row, command);
+        return command;
+    }
+    const rendered = commandWithInvocationId(command, row.id);
+    checkCommand(row, rendered);
+    return rendered;
+}
+/** Native observer and receipt writer commit together. Never await I/O inside
+ * this transaction; the callback must write to this same SQLite connection. */
+function checkNativeIdentity(scope, identity, id) {
+    if (identity.daemonId !== scope.daemonId || identity.rootSessionId !== scope.rootSessionId
+        || !identity.sessionId || !identity.toolCallId
+        || (identity.sessionId === scope.rootSessionId ? identity.parentSessionId !== null : !identity.parentSessionId)) {
+        throw new AppError("invocation_identity_mismatch", "Native identity does not belong to the issued managed scope", 1, { invocation_id: id });
+    }
+}
+function managedNativeOwner(context, identity, harness, projectId) {
+    const nativeRoot = (stateDir, sessionId) => {
+        try {
+            const state = readNativeDaemonState(stateDir);
+            if (state.daemon_id !== identity.daemonId)
+                return null;
+            const native = state.sessions?.find(native => typeof native === "string" ? native === sessionId : native.adapter_session_id === sessionId || native.provider_session_id === sessionId);
+            return typeof native === "string" ? native : native?.root_provider_session_id ?? native?.provider_session_id ?? null;
+        }
+        catch {
+            return null;
+        }
+    };
+    const owners = [];
+    const hasTable = (name) => Boolean(context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?", [name]));
+    if (hasTable("run_controllers")) {
+        const controllers = context.db.all("SELECT c.controller_id, c.run_id, r.status AS run_status, c.status, c.generation, c.state_json FROM run_controllers c JOIN runs r ON r.project_id = c.project_id AND r.id = c.run_id WHERE c.project_id = ?", [projectId]);
+        for (const controller of controllers) {
+            const state = JSON.parse(controller.state_json);
+            for (const [index, session] of (state.sessions ?? []).entries()) {
+                if (typeof session.state_dir !== "string")
+                    continue;
+                const root = nativeRoot(session.state_dir, session.id);
+                if (root !== identity.rootSessionId)
+                    continue;
+                owners.push({ runId: controller.run_id, rootSessionId: session.id,
+                    stateDir: session.state_dir, harness: runtimeHarness(session.profile), generation: controller.generation, ownerId: controller.controller_id,
+                    active: ["running", "paused", "waiting_for_user", "blocked"].includes(controller.run_status)
+                        && !["completed", "cancelled", "superseded"].includes(controller.status)
+                        && state.current_session === index && session.stopped !== true });
+            }
+        }
+    }
+    if (hasTable("work_launches")) {
+        const launches = context.db.all("SELECT w.run_id, r.status AS run_status, l.work_id, l.operation_id, l.status, l.state_dir, l.provider_session_id, l.profile_json FROM work_launches l JOIN works w ON w.work_id = l.work_id JOIN runs r ON r.project_id = w.project_id AND r.id = w.run_id WHERE w.project_id = ?", [projectId]);
+        for (const launch of launches) {
+            if (nativeRoot(launch.state_dir, launch.provider_session_id) !== identity.rootSessionId)
+                continue;
+            // Cooperative pause/drain may retain an admitted Work settlement while
+            // the RUN is paused; only terminal RUN states retire its native root.
+            const active = ["running", "paused", "waiting_for_user", "blocked"].includes(launch.run_status)
+                && ["launching", "start_requested"].includes(launch.status);
+            if (!active)
+                throw new AppError("invocation_scope_unproven", "External Work native root is no longer active", 1, { effect: "no_effect" });
+            const profile = JSON.parse(launch.profile_json);
+            const owner = profile.runtime_adapter?.owner;
+            if (!owner || owner.owner_id !== `run:${launch.run_id}:work:${launch.work_id}` || owner.project_id !== projectId
+                || owner.run_id !== launch.run_id || owner.work_id !== launch.work_id || owner.operation_id !== launch.operation_id || owner.state_dir !== launch.state_dir) {
+                throw new AppError("invocation_scope_unproven", "External Work has no matching persisted runtime owner", 1, { effect: "no_effect" });
+            }
+            owners.push({ runId: launch.run_id, rootSessionId: launch.provider_session_id, stateDir: launch.state_dir,
+                harness: runtimeHarness(profile.worker), ownerId: owner.owner_id, active });
+        }
+    }
+    if (hasTable("merge_requests")) {
+        const requests = context.db.all("SELECT m.merge_request_id, m.run_id, r.status AS run_status, m.status, m.executor_work_id, m.dispatch_owner, m.dispatch_lease_token, m.adapter_receipt_json FROM merge_requests m JOIN runs r ON r.project_id = m.project_id AND r.id = m.run_id WHERE m.project_id = ? AND m.execution_route = 'server' AND json_valid(m.adapter_receipt_json)", [projectId]);
+        for (const request of requests) {
+            const retained = JSON.parse(request.adapter_receipt_json);
+            if (!retained.session_id || !retained.state_dir || nativeRoot(retained.state_dir, retained.session_id) !== identity.rootSessionId)
+                continue;
+            const active = ["running", "paused", "waiting_for_user", "blocked"].includes(request.run_status)
+                && ["dispatching", "active", "waiting_user", "action_required", "recovery_required"].includes(request.status);
+            if (!active)
+                throw new AppError("invocation_scope_unproven", "Server MERGE native root is no longer active", 1, { effect: "no_effect" });
+            const receipt = JSON.parse(request.adapter_receipt_json);
+            if (receipt.controller_id) {
+                const controller = context.db.get("SELECT generation, status, state_json FROM run_controllers WHERE controller_id = ? AND project_id = ? AND run_id = ?", [receipt.controller_id, projectId, request.run_id]);
+                const state = controller && JSON.parse(controller.state_json);
+                const session = state?.current_session === undefined || state.current_session === null ? undefined : state.sessions?.[state.current_session];
+                if (!request.dispatch_lease_token || request.dispatch_owner !== receipt.controller_id
+                    || !controller || ["completed", "cancelled", "superseded"].includes(controller.status)
+                    || state?.merge_claim?.request_id !== request.merge_request_id || state.merge_claim.token !== request.dispatch_lease_token
+                    || state.merge_claim.work_id !== request.executor_work_id || !session || session.stopped === true
+                    || session.id !== receipt.session_id || session.state_dir !== receipt.state_dir || !receipt.profile
+                    || JSON.stringify(session.profile) !== JSON.stringify(receipt.profile)) {
+                    throw new AppError("invocation_scope_unproven", "Controller MERGE root does not match its dispatch lease and retained Session", 1, { effect: "no_effect" });
+                }
+                // The controller Session above is already an owner candidate; its
+                // daemon binding and generation are checked once in the common loop.
+                continue;
+            }
+            const owner = receipt.owner;
+            if (!receipt.session_id || !receipt.state_dir || !receipt.profile || !owner
+                || owner.owner_id !== `run:${request.run_id}:merge:${request.merge_request_id}` || owner.project_id !== projectId
+                || owner.run_id !== request.run_id || owner.work_id !== request.executor_work_id || owner.state_dir !== receipt.state_dir
+                || owner.operation_id !== `${request.merge_request_id}:${request.dispatch_lease_token}`) {
+                throw new AppError("invocation_scope_unproven", "Server MERGE has no matching persisted runtime owner", 1, { effect: "no_effect" });
+            }
+            owners.push({ runId: request.run_id, rootSessionId: receipt.session_id, stateDir: receipt.state_dir,
+                harness: runtimeHarness(receipt.profile), ownerId: owner.owner_id, active });
+        }
+    }
+    if (owners.length > 1)
+        throw new AppError("invocation_scope_unproven", "Native root has more than one persisted owner", 1, { effect: "no_effect" });
+    for (const owner of owners) {
+        if (!owner.active)
+            throw new AppError("invocation_scope_unproven", "Managed native root is no longer active", 1, { effect: "no_effect" });
+        if (owner.harness !== harness)
+            throw new AppError("invocation_scope_unproven", "Native root belongs to another managed harness", 1, { effect: "no_effect" });
+        const binding = requireManagedDaemonBinding(context, { stateDir: owner.stateDir, projectId, runId: owner.runId, ...(owner.ownerId ? { ownerId: owner.ownerId } : {}) });
+        const kind = { "grok-acp": "grok-daemon", "antigravity-cli": "agy-daemon", "zcode-acp": "zcode-daemon", "codex-desktop": "codex-daemon", "droid-cli": "droid-daemon", "opencode-server": "opencode-daemon" }[harness];
+        if (binding.process.kind !== kind) {
+            throw new AppError("invocation_scope_unproven", "Native daemon kind differs from its persisted harness", 1, { effect: "no_effect" });
+        }
+        if (binding.state.daemon_id !== identity.daemonId)
+            throw new AppError("invocation_scope_unproven", "Native daemon differs from its persisted launch", 1, { effect: "no_effect" });
+        const root = binding.state.sessions?.some(native => typeof native === "string" ? native === identity.rootSessionId
+            : native.provider_session_id === identity.rootSessionId && (native.root_provider_session_id ?? identity.rootSessionId) === identity.rootSessionId);
+        const generation = JSON.parse(binding.process.metadata_json).run_generation;
+        if (!root || !Number.isSafeInteger(generation) || generation < 0 || owner.generation !== undefined && generation !== owner.generation) {
+            throw new AppError("invocation_scope_unproven", "Managed native root or RUN generation is not persisted", 1, { effect: "no_effect" });
+        }
+        return { projectId, runId: owner.runId, generation, ...(owner.ownerId ? { ownerId: owner.ownerId } : {}) };
+    }
+    return null;
+}
+/** Manual recovery retains native receipt authority, not controller issuance.
+ * Recognize only the existing pinned recovery dispatch and its live root. */
+export function manualRecoveryInvocationScope(context, projectRoot, identity, harness) {
+    if (identity.sessionId !== identity.rootSessionId || identity.parentSessionId !== null
+        || !context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_recovery_bindings'"))
+        return null;
+    const project = context.db.get("SELECT id,root FROM projects WHERE root = ?", [canonicalPath(projectRoot)]);
+    if (!project)
+        return null;
+    let resolved = null;
+    for (const record of managedProcessStatus(context)) {
+        if (record.project_id !== project.id || !record.run_id || !record.kind.endsWith("-daemon"))
+            continue;
+        const metadata = JSON.parse(record.metadata_json);
+        if (typeof metadata.state_dir !== "string")
+            continue;
+        let state;
+        try {
+            state = readNativeDaemonState(metadata.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (state.daemon_id !== identity.daemonId)
+            continue;
+        const guard = recoveryGuard(context, project.id, record.run_id);
+        if (!guard || !["resuming", "recovered"].includes(guard.status) || metadata.run_generation !== guard.generation)
+            return null;
+        const run = context.db.get("SELECT status FROM runs WHERE project_id = ? AND id = ?", [project.id, record.run_id]);
+        if (!run || !["running", "paused", "waiting_for_user", "blocked"].includes(run.status))
+            return null;
+        if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'")
+            && context.db.get("SELECT 1 FROM run_controllers WHERE project_id = ? AND run_id = ? AND generation = ? AND status NOT IN ('completed','cancelled','superseded')", [project.id, record.run_id, guard.generation]))
+            return null;
+        const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ?", [guard.recovery_id]);
+        if (!binding || binding.daemon_id !== identity.daemonId || binding.provider_session_id !== identity.rootSessionId || binding.harness !== harness
+            || binding.status !== (guard.status === "resuming" ? "prepared" : "accepted") || !binding.runtime_dispatch_json)
+            return null;
+        const dispatch = JSON.parse(binding.runtime_dispatch_json);
+        if (dispatch.process_id !== record.id || dispatch.owner_id !== record.owner_id || dispatch.state_dir !== metadata.state_dir
+            || dispatch.daemon_id !== identity.daemonId || record.state !== "running" || record.lease_expires_at <= context.now() || !processIsAlive(record))
+            return null;
+        const physical = requireManagedDaemonBinding(context, { stateDir: metadata.state_dir, projectId: project.id, runId: record.run_id, ownerId: dispatch.owner_id });
+        const kind = { "codex-desktop": "codex-daemon", "zcode-acp": "zcode-daemon", "grok-acp": "grok-daemon", "antigravity-cli": "agy-daemon", "droid-cli": "droid-daemon", "opencode-server": "opencode-daemon" }[harness];
+        if (physical.process.id !== dispatch.process_id || physical.process.kind !== kind || !physical.state.sessions?.some(native => typeof native === "string" ? native === identity.rootSessionId
+            : native.provider_session_id === identity.rootSessionId && (native.root_provider_session_id ?? native.provider_session_id) === identity.rootSessionId))
+            return null;
+        const packet = recoveryPacketReceipt(binding).packet;
+        if (packet.run_id !== record.run_id || packet.generation !== guard.generation || packet.recovery_id !== guard.recovery_id)
+            return null;
+        if (resolved)
+            throw new AppError("invocation_scope_unproven", "Manual recovery native root has more than one physical owner", 1, { effect: "no_effect" });
+        resolved = { projectRoot: project.root, runId: record.run_id, generation: guard.generation, daemonId: identity.daemonId, rootSessionId: identity.rootSessionId };
+    }
+    return resolved;
+}
+/** Hook-only recovery commands must carry their own target, not acquire one
+ * through assignment expansion. Existing recovery/Work guards own mutation. */
+export function assertManualRecoveryInvocationTarget(context, scope, command) {
+    const parsed = invocation(command);
+    const projectRoot = commandOption(parsed, "project-root");
+    if (!["recovery_accept", "stage_start", "stage_finish", "stage_pause", "stage_resume", "work_start", "work_finish", "work_fail", "merge_apply", "merge_repair"].includes(parsed.operation)
+        || parsed.args.options.has("bootstrap") || !commandPosition(parsed, 0) || !projectRoot
+        || projectRoot !== "@project" && (!path.isAbsolute(projectRoot) || canonicalPath(projectRoot) !== scope.projectRoot)) {
+        throw new AppError("invocation_scope_mismatch", "Manual recovery requires an explicit owned target and project", 1, { effect: "no_effect" });
+    }
+    if (parsed.operation === "recovery_accept" && commandOption(parsed, "recovery-id") !== recoveryGuard(context, requireProjectByRoot(context, scope.projectRoot).id, scope.runId)?.recovery_id)
+        throw new AppError("invocation_scope_mismatch", "Recovery acknowledgement targets another recovery generation", 1, { effect: "no_effect" });
+    assertLifecycleInvocationCurrent(context, scope, command);
+}
+/** Resolve scope from the physical runtime owner, never from a command match. */
+export function managedNativeInvocationScope(context, projectRoot, identity, harness) {
+    const project = context.db.get("SELECT id,root FROM projects WHERE root = ?", [canonicalPath(projectRoot)]);
+    // Bootstrap native hooks precede project registration. They may retain
+    // evidence, but have no managed RUN authority to resolve yet.
+    if (!project)
+        return null;
+    const owner = managedNativeOwner(context, identity, harness, project.id);
+    if (owner)
+        return { projectRoot: project.root, daemonId: identity.daemonId, rootSessionId: identity.rootSessionId, runId: owner.runId, generation: owner.generation };
+    const manualRecovery = manualRecoveryInvocationScope(context, project.root, identity, harness);
+    if (manualRecovery)
+        return manualRecovery;
+    for (const record of managedProcessStatus(context)) {
+        const metadata = JSON.parse(record.metadata_json);
+        if (!record.kind.endsWith("-daemon") || typeof metadata.state_dir !== "string")
+            continue;
+        let state;
+        try {
+            state = readNativeDaemonState(metadata.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (state.daemon_id === identity.daemonId && state.config?.runtime_owner)
+            throw new AppError("invocation_scope_unproven", "Managed daemon has no retained native owner", 1, { effect: "no_effect" });
+    }
+    return null;
+}
+export function cliManagedInvocationScope(context) {
+    const daemonId = context.env.DD_FLOW_DAEMON_ID;
+    if (!daemonId)
+        return null;
+    const scopes = [];
+    for (const record of managedProcessStatus(context)) {
+        const metadata = JSON.parse(record.metadata_json);
+        if (!record.kind.endsWith("-daemon") || typeof metadata.state_dir !== "string")
+            continue;
+        let state;
+        try {
+            state = readNativeDaemonState(metadata.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (state.daemon_id !== daemonId || !record.project_id || !record.run_id)
+            continue;
+        const harness = { "codex-daemon": "codex-desktop", "zcode-daemon": "zcode-acp", "grok-daemon": "grok-acp", "agy-daemon": "antigravity-cli", "droid-daemon": "droid-cli", "opencode-daemon": "opencode-server" }[record.kind];
+        const project = context.db.get("SELECT root FROM projects WHERE id = ?", [record.project_id]);
+        if (!harness || !project)
+            continue;
+        requireManagedDaemonBinding(context, { stateDir: metadata.state_dir, projectId: record.project_id, runId: record.run_id });
+        const roots = new Set((state.sessions ?? []).flatMap(native => typeof native === "string" ? [native] : native.root_provider_session_id ? [native.root_provider_session_id] : native.provider_session_id ? [native.provider_session_id] : []));
+        for (const rootSessionId of roots) {
+            let scope;
+            try {
+                scope = managedNativeInvocationScope(context, project.root, { daemonId, rootSessionId, sessionId: rootSessionId, parentSessionId: null, toolCallId: "cli-scope-inspection" }, harness);
+            }
+            catch (error) {
+                if (error instanceof AppError && error.code === "invocation_scope_unproven")
+                    continue;
+                throw error;
+            }
+            if (scope && !scopes.some(prior => JSON.stringify(prior) === JSON.stringify(scope)))
+                scopes.push(scope);
+        }
+    }
+    if (scopes.length !== 1)
+        throw new AppError("invocation_scope_unproven", "CLI has no unique persisted current managed native scope", 1, { effect: "no_effect" });
+    return scopes[0];
+}
+export function isControllerManagedInvocation(context, projectRoot, runId) {
+    const configured = context.env.DD_FLOW_INVOCATION_SCOPE;
+    if (!configured)
+        return false;
+    const scope = JSON.parse(configured);
+    if (context.env.DD_FLOW_CURRENT_INVOCATION) {
+        const current = load(context, context.env.DD_FLOW_CURRENT_INVOCATION);
+        const identity = current.identity_json && JSON.parse(current.identity_json);
+        if (identity && identity[2] !== scope.rootSessionId)
+            throw new AppError("invocation_scope_unproven", "A native child cannot issue coordinator Stage successors", 1);
+    }
+    if (scope.projectRoot !== canonicalPath(projectRoot) || scope.runId !== runId)
+        throw new AppError("invocation_scope_mismatch", "Successor differs from retained lifecycle scope", 1);
+    const projectId = requireProjectByRoot(context, projectRoot).id;
+    const rows = context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'")
+        ? context.db.all("SELECT controller_id,generation,status,state_json FROM run_controllers WHERE project_id = ? AND run_id = ?", [projectId, runId]) : [];
+    let matches = 0;
+    for (const row of rows) {
+        const state = JSON.parse(row.state_json);
+        const session = state.sessions?.[state.current_session];
+        if (!session)
+            continue;
+        let nativeState;
+        try {
+            nativeState = readNativeDaemonState(session.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (nativeState.daemon_id !== scope.daemonId)
+            continue;
+        const binding = requireManagedDaemonBinding(context, { stateDir: session.state_dir, projectId, runId, ownerId: row.controller_id });
+        if (binding.state.daemon_id !== scope.daemonId)
+            continue;
+        const native = binding.state.sessions?.find(native => typeof native === "string" ? native === session.id && native === scope.rootSessionId
+            : (native.adapter_session_id === session.id || native.provider_session_id === session.id) && (native.root_provider_session_id ?? native.provider_session_id) === scope.rootSessionId);
+        const generation = JSON.parse(binding.process.metadata_json).run_generation;
+        if (!native || session.stopped || ["completed", "cancelled", "superseded"].includes(row.status) || row.generation !== scope.generation || generation !== scope.generation)
+            throw new AppError("invocation_scope_unproven", "Controller successor owner is stale or unproven", 1);
+        matches += 1;
+    }
+    if (matches > 1)
+        throw new AppError("invocation_scope_unproven", "Stage successor has multiple coordinator owners", 1);
+    if (matches === 1)
+        return true;
+    for (const record of managedProcessStatus(context)) {
+        const metadata = JSON.parse(record.metadata_json);
+        if (!record.kind.endsWith("-daemon") || typeof metadata.state_dir !== "string")
+            continue;
+        let state;
+        try {
+            state = readNativeDaemonState(metadata.state_dir);
+        }
+        catch {
+            continue;
+        }
+        if (state.daemon_id !== scope.daemonId)
+            continue;
+        if (/^run:.+:(?:work|merge):/.test(record.owner_id))
+            return false;
+        throw new AppError("invocation_scope_unproven", "Managed coordinator has no retained current controller Session", 1);
+    }
+    throw new AppError("invocation_scope_unproven", "Managed successor has no proven physical owner", 1);
+}
+/** recordReceipt is a synchronous SQL-only hook ingress callback. Native
+ * adapters must prepare any filesystem or process evidence before calling. */
+export function observeLifecycleInvocation(context, input) {
+    const priorReceipt = input.currentEventKey && input.projectId
+        && context.db.get("SELECT 1 FROM hook_events WHERE project_id = ? AND event_key = ?", [input.projectId, input.currentEventKey]);
+    const result = observeLifecycleInvocationReceipt(context, input);
+    // Hook-only calls have no invocation row, but their immutable receipt still
+    // distinguishes a repeated native delivery from a new observation.
+    if (priorReceipt && result.disposition === "admitted" && result.eventKey === input.currentEventKey) {
+        result.disposition = "replay";
+        result.duplicate = true;
+    }
+    return { ...result, currentEventKey: input.currentEventKey ?? null, authoritativeEventKey: result.eventKey ?? null };
+}
+function observeLifecycleInvocationReceipt(context, input) {
+    storage(context);
+    const projectRoot = input.projectId ? context.db.get("SELECT root FROM projects WHERE id = ?", [input.projectId])?.root : undefined;
+    const provenScope = projectRoot && input.harness ? managedNativeInvocationScope(context, projectRoot, input.identity, input.harness) : null;
+    const owner = provenScope && input.harness && input.projectId ? managedNativeOwner(context, input.identity, input.harness, input.projectId) : null;
+    const ownerSnapshot = () => {
+        if (!provenScope?.runId || !input.projectId)
+            return null;
+        const rows = [context.db.get("SELECT status FROM runs WHERE project_id = ? AND id = ?", [input.projectId, provenScope.runId])];
+        if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_controllers'"))
+            rows.push(context.db.all("SELECT controller_id,generation,status,owner_token,state_json FROM run_controllers WHERE project_id = ? AND run_id = ? AND controller_id = ? ORDER BY controller_id", [input.projectId, provenScope.runId, owner?.ownerId ?? ""]).map(row => {
+                const state = JSON.parse(row.state_json), session = state.sessions?.[state.current_session];
+                return [row.controller_id, row.generation, row.status, row.owner_token, state.current_session, session && [session.id, session.state_dir, session.stopped, session.owner]];
+            }));
+        for (const [table, query] of [
+            ["work_launches", "SELECT l.status,l.provider_session_id,l.profile_json FROM work_launches l JOIN works w ON w.work_id = l.work_id WHERE w.project_id = ? AND w.run_id = ? AND CASE WHEN json_valid(l.profile_json) THEN json_extract(l.profile_json, '$.runtime_adapter.owner.owner_id') END = ? ORDER BY l.operation_id"],
+            ["merge_requests", "SELECT status,dispatch_owner,dispatch_lease_token,adapter_receipt_json FROM merge_requests WHERE project_id = ? AND run_id = ? AND (dispatch_owner = ? OR CASE WHEN json_valid(adapter_receipt_json) THEN json_extract(adapter_receipt_json, '$.owner.owner_id') END = ?) ORDER BY merge_request_id"]
+        ])
+            if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = ?", [table]))
+                rows.push(context.db.all(query, table === "merge_requests" ? [input.projectId, provenScope.runId, owner?.ownerId ?? "", owner?.ownerId ?? ""] : [input.projectId, provenScope.runId, owner?.ownerId ?? ""]));
+        if (context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'run_recovery_bindings'"))
+            rows.push(context.db.all("SELECT g.recovery_id,g.generation,g.status,b.* FROM run_recovery_guards g JOIN run_recovery_bindings b ON b.recovery_id = g.recovery_id WHERE g.project_id = ? AND g.run_id = ? ORDER BY g.generation", [input.projectId, provenScope.runId]));
+        return JSON.stringify(rows);
+    };
+    const retainedOwner = ownerSnapshot();
+    const supplied = input.id ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [input.id]) : undefined;
+    const analysis = parseLifecycleCommand(input.command);
+    if (analysis.kind === "none" || analysis.supported === false) {
+        let issuedBarrier;
+        const singleLeaf = analysis.kind !== "none" && (analysis.invocations?.length ?? 1) === 1 && !(analysis.kind === "compound" && analysis.reason === "multiple_lifecycle_invocations");
+        const refused = singleLeaf ? context.db.all("SELECT * FROM lifecycle_invocations WHERE status = 'issued'").filter(row => {
+            const scope = JSON.parse(row.scope_json);
+            if (scope.daemonId !== input.identity.daemonId || scope.rootSessionId !== input.identity.rootSessionId || provenScope && row.scope_json !== JSON.stringify(provenScope))
+                return false;
+            try {
+                return fingerprint(invocation(canonicalManagedCommand(context, analysis.invocation.command, scope))) === row.fingerprint;
+            }
+            catch {
+                return false;
+            }
+        }) : [];
+        const correction = supplied ?? (refused.length === 1 ? refused[0] : undefined);
+        if (singleLeaf && correction && correction.status === "issued" && (correction.deadline === null || correction.deadline > Date.now())) {
+            const scope = JSON.parse(correction.scope_json);
+            checkNativeIdentity(scope, input.identity, correction.id);
+            assertSuppliedLifecycleTarget(correction, invocation(canonicalManagedCommand(context, analysis.invocation.command, scope)));
+            if ((!provenScope || correction.scope_json === JSON.stringify(provenScope)) && fingerprint(invocation(canonicalManagedCommand(context, analysis.invocation.command, scope))) === correction.fingerprint)
+                issuedBarrier = { issued_invocation_id: correction.id, cli_admission_barrier: true };
+        }
+        const eventKey = input.recordReceipt();
+        if (analysis.kind !== "none") {
+            const retained = context.db.get("SELECT outcome_json FROM hook_events WHERE event_key = ?", [eventKey]);
+            let outcome = {};
+            try {
+                outcome = retained?.outcome_json ? JSON.parse(retained.outcome_json) : {};
+            }
+            catch {
+                outcome = {};
+            }
+            context.db.run("UPDATE hook_events SET outcome_json = ? WHERE event_key = ?", [JSON.stringify({
+                    ...outcome,
+                    lifecycle_observation: {
+                        code: "lifecycle_shell_syntax_invalid",
+                        reason: analysis.kind === "compound" ? analysis.reason : "unsupported_lifecycle_command",
+                        command_fingerprint: fingerprint(analysis.invocation),
+                        effect: "no_effect",
+                        recoverable: true
+                    }
+                }), eventKey]);
+        }
+        if (analysis.kind !== "none")
+            throw new AppError("lifecycle_shell_syntax_invalid", "This shell form cannot bind exactly one lifecycle execution; use the exact issued lifecycle command without the unsupported shell context", 1, { phase: "prepare", effect: "no_effect", recoverable: true, disposition: "pre_cli_shell_refusal", reason: analysis.kind === "compound" ? analysis.reason : "unsupported_lifecycle_command", event_key: eventKey, ...issuedBarrier });
+        return { eventKey, duplicate: false, disposition: "admitted", invocationId: null };
+    }
+    // Admit the one parsed leaf, never execute or fingerprint the prefix/suffix.
+    const leafCommand = analysis.invocation.command;
+    if (input.executionCwd !== undefined && !path.isAbsolute(input.executionCwd))
+        throw new AppError("invocation_directory_mismatch", "Bound lifecycle execution cwd must be absolute", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+    const deliveredIdentity = JSON.stringify([input.identity.daemonId, input.identity.rootSessionId, input.identity.sessionId, input.identity.parentSessionId, input.identity.toolCallId,
+        ...(input.executionCwd === undefined ? [] : [{ executionCwd: canonicalPath(input.executionCwd) }])]);
+    const matching = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing','settled') ORDER BY rowid DESC")
+        .filter(row => {
+        const scope = JSON.parse(row.scope_json);
+        if (scope.daemonId !== input.identity.daemonId || scope.rootSessionId !== input.identity.rootSessionId)
+            return false;
+        if (provenScope && row.scope_json !== JSON.stringify(provenScope))
+            return false;
+        try {
+            if (fingerprint(invocation(canonicalManagedCommand(context, leafCommand, scope))) !== row.fingerprint)
+                return false;
+        }
+        catch {
+            return false;
+        }
+        if (row.identity_json && row.identity_json !== deliveredIdentity
+            && sameNativeCall(row.identity_json, deliveredIdentity)) {
+            throw new AppError("invocation_identity_mismatch", "The same native tool call changed its bound execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+        }
+        if (row.status === "executing" && row.identity_json !== deliveredIdentity)
+            return false;
+        if (row.status === "settled" && row.outcome_json && JSON.parse(row.outcome_json).error && row.identity_json !== deliveredIdentity)
+            return false;
+        return true;
+    });
+    const candidates = lifecycleCandidates(matching, deliveredIdentity);
+    // A known explicit ID remains a compatibility path. A missing or mistyped
+    // public ID is corrected only by an exact operation/target match inside the
+    // trusted native root. Never fuzzy-match UUID text or select a global latest.
+    const initial = supplied ?? (candidates.length === 1 ? candidates[0] : undefined);
+    if (!supplied && candidates.length > 1) {
+        input.recordReceipt();
+        throw new AppError("invocation_ambiguous", "More than one issued lifecycle attempt matches this native command", 1, { effect: "no_effect", matches: candidates.map(row => row.id), ...(provenScope ? { lifecycle_assignment: { issuer: "dd-flow", scope: provenScope } } : {}) });
+    }
+    if (owner) {
+        if (!initial)
+            throw new AppError("invocation_assignment_missing", "Managed native lifecycle call has no issued assignment", 1, { effect: "no_effect", recoverable: false });
+        const scope = JSON.parse(initial.scope_json);
+        if (requireProjectByRoot(context, scope.projectRoot).id !== owner.projectId || scope.runId !== owner.runId || scope.generation !== owner.generation) {
+            throw new AppError("invocation_scope_mismatch", "Native daemon owner does not match issued RUN authority", 1, { effect: "no_effect", recoverable: false });
+        }
+    }
+    if (!initial) {
+        if (provenScope)
+            assertManualRecoveryInvocationTarget(context, provenScope, leafCommand);
+        return context.db.writeTransaction(() => {
+            if (retainedOwner !== ownerSnapshot())
+                throw new AppError("invocation_scope_unproven", "Native owner changed before hook-only recovery receipt", 1, { effect: "no_effect" });
+            const eventKey = input.recordReceipt();
+            return { eventKey, duplicate: false, disposition: "admitted", invocationId: null };
+        });
+    }
+    const resolved = input.id === initial.id ? {} : { invocationId: initial.id };
+    assertSuppliedLifecycleTarget(initial, invocation(canonicalManagedCommand(context, leafCommand, JSON.parse(initial.scope_json))));
+    const scope = JSON.parse(initial.scope_json);
+    checkNativeIdentity(scope, input.identity, initial.id);
+    // A completed invocation is a read, even from a new native tool call after
+    // reattach. Do not manufacture a new receipt or reject that read as a second
+    // executor; the CLI returns the immutable stored outcome without dispatch.
+    if (initial.status === "settled")
+        return { eventKey: initial.event_key, duplicate: true, disposition: initial.identity_json === deliveredIdentity ? "replay" : "settled_read", ...resolved };
+    const project = requireProjectByRoot(context, scope.projectRoot);
+    const identity = input.identity;
+    const identityJson = deliveredIdentity;
+    return context.db.writeTransaction(() => {
+        const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [initial.id]);
+        if (retainedOwner !== ownerSnapshot())
+            throw new AppError("invocation_scope_unproven", "Native owner changed before admission receipt", 1, { effect: "no_effect" });
+        if (row.scope_json !== initial.scope_json)
+            throw new AppError("invocation_scope_mismatch", "Lifecycle scope changed before native receipt", 1, { effect: "no_effect" });
+        if (row.status === "settled")
+            return { eventKey: row.event_key, duplicate: true, disposition: row.identity_json === identityJson ? "replay" : "settled_read", ...resolved };
+        // Observation records native facts only. CLI owns deadline, argument and
+        // RUN-state validation, including decisions about retrying an invocation.
+        if (row.status === "expired" || (row.deadline !== null && row.deadline <= Date.now() && !row.event_key)) {
+            return { eventKey: row.event_key, duplicate: true, disposition: "expired", ...resolved };
+        }
+        if (row.identity_json === identityJson) {
+            return { eventKey: row.event_key, duplicate: true, disposition: "replay", ...resolved };
+        }
+        if (row.identity_json && sameNativeCall(row.identity_json, identityJson)) {
+            throw new AppError("invocation_identity_mismatch", "The same native tool call changed its bound execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+        }
+        const eventKey = input.recordReceipt({ projectRoot: scope.projectRoot, runId: scope.runId, command: initial.command });
+        // A native hook may execute from a provider worktree while the issued
+        // lifecycle scope is anchored to the stable project root. Project
+        // identity is the canonical boundary; comparing raw cwd would reject a
+        // valid receipt before the CLI can run (Codex does this in particular).
+        const receipt = eventKey && context.db.get("SELECT provider_session_id, daemon_id, status, harness FROM hook_events WHERE event_key = ? AND harness = ? AND project_id = ?", [eventKey, input.harness ?? "zcode-acp", project.id]);
+        if (!receipt || receipt.provider_session_id !== identity.sessionId || receipt.daemon_id !== identity.daemonId || receipt.status !== "observed") {
+            throw new AppError("invocation_receipt_missing", "Native observer did not persist the matching unclaimed receipt", 1);
+        }
+        // The hook observes intent; it does not own execution. A native shell may
+        // reject a tool call before the CLI process exists (for example because
+        // its workdir is invalid), after which repeating the same issued command
+        // is safe. Keep the newest receipt until the CLI claims the attempt. The
+        // observed -> executing compare-and-swap remains the exactly-once boundary.
+        const updated = context.db.run("UPDATE lifecycle_invocations SET identity_json = ?, event_key = ?, status = 'observed', updated_at = ? WHERE id = ? AND status IN ('issued', 'observed')", [identityJson, eventKey, context.now(), initial.id]);
+        // Once execution has been claimed, later PreToolUse observations are
+        // retained as hook evidence but cannot replace the executor's receipt.
+        return { eventKey: updated.changes === 1 ? eventKey : row.event_key, duplicate: updated.changes !== 1, disposition: updated.changes === 1 ? "admitted" : "in_flight", ...resolved };
+    });
+}
+/** Correlate exact native argv for diagnostics, independently of assignment
+ * matching. A hook-added event key must name the same persisted native call. */
+export function observedLifecycleNativeEvent(context, command, daemonId) {
+    const signature = (value) => {
+        const parsed = parseLifecycleCommand(value);
+        const candidate = parsed.kind !== "none" && parsed.supported ? parsed.invocation : continuationCommand(value);
+        if (!candidate)
+            return null;
+        return JSON.stringify([candidate.operation, candidate.args.positional,
+            [...candidate.args.options].filter(([key]) => !["json", "progress-jsonl", "hook-event-id"].includes(key)).sort(([a], [b]) => a.localeCompare(b))]);
+    };
+    const expected = signature(command);
+    if (!expected)
+        return null;
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE name = 'hook_events'"))
+        return null;
+    const parsed = parseLifecycleCommand(command);
+    const eventKey = parsed.kind === "standalone" ? commandOption(parsed.invocation, "hook-event-id") : undefined;
+    const matches = context.db.all(daemonId
+        ? "SELECT project_id, id, event_key, sanitized_summary FROM hook_events WHERE daemon_id = ? AND status = 'observed' AND outcome_json IS NULL"
+        : eventKey
+            ? "SELECT project_id, id, event_key, sanitized_summary FROM hook_events WHERE event_key = ? AND status = 'observed' AND outcome_json IS NULL"
+            : "SELECT project_id, id, event_key, sanitized_summary FROM hook_events WHERE harness IN ('antigravity-cli','codex-desktop') AND status = 'observed' AND outcome_json IS NULL", daemonId || eventKey ? [daemonId ?? eventKey] : []).filter(row => {
+        if (eventKey && row.event_key !== eventKey)
+            return false;
+        try {
+            const observed = lifecycleCommandFromPayload(JSON.parse(row.sanitized_summary));
+            return typeof observed === "string" && signature(observed) === expected;
+        }
+        catch {
+            return false;
+        }
+    });
+    // Diagnostic correlation only: never use this as execution authority, and
+    // never choose the latest of several identical native calls.
+    return matches.length === 1 ? { project_id: matches[0].project_id, id: matches[0].id } : null;
+}
+/** Keep shell diagnostics distinct from genuinely absent native delivery. */
+export function observedLifecycleDiagnostic(context, command, daemonId, invocationId) {
+    const analysis = parseLifecycleCommand(command);
+    if (analysis.kind !== "standalone")
+        return null;
+    const commandFingerprint = fingerprint(analysis.invocation);
+    const issuedAt = invocationId ? context.db.get("SELECT created_at FROM lifecycle_invocations WHERE id = ?", [invocationId])?.created_at : undefined;
+    const rows = context.db.all(`SELECT id, event_key, outcome_json FROM hook_events WHERE daemon_id = ? AND status = 'observed' AND outcome_json IS NOT NULL
+      ${issuedAt ? "AND created_at >= ?" : ""} ORDER BY id DESC LIMIT 20`, issuedAt ? [daemonId, issuedAt] : [daemonId]).flatMap(row => {
+        try {
+            const outcome = JSON.parse(row.outcome_json);
+            return outcome.lifecycle_observation?.command_fingerprint === commandFingerprint ? [{ ...outcome.lifecycle_observation, event_key: row.event_key, hook_event_id: row.id }] : [];
+        }
+        catch {
+            return [];
+        }
+    });
+    if (!rows.length)
+        return null;
+    const reasons = new Set(rows.map(row => `${String(row.code)}\0${String(row.reason)}`));
+    if (reasons.size !== 1)
+        return null;
+    return { ...rows[0], matching_events: rows.map(row => row.event_key) };
+}
+/** Resolve only a command that a native hook has already bound to an issued
+ * attempt. This is the CLI-side half of admission for model-facing commands
+ * that intentionally omit the internal UUID. */
+export function observedLifecycleInvocation(context, command, scopeConstraint, correlation) {
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'"))
+        return null;
+    const analysis = parseLifecycleCommand(command);
+    if (analysis.kind === "none" || analysis.supported === false)
+        return null;
+    const leafCommand = analysis.invocation.command;
+    const suppliedId = commandOption(analysis.invocation, "invocation-id");
+    const retainedId = suppliedId && context.db.get("SELECT id FROM lifecycle_invocations WHERE id = ?", [suppliedId]) ? suppliedId : undefined;
+    // `issued` is a rendezvous, not authority: the CLI still blocks in
+    // awaitLifecycleInvocation until the native observer commits the receipt.
+    const matching = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing','settled') ORDER BY rowid DESC")
+        .filter(row => {
+        try {
+            const explicitId = retainedId;
+            const eventKey = commandOption(analysis.invocation, "hook-event-id") ?? correlation?.eventKey;
+            if (explicitId && row.id !== explicitId || eventKey && row.event_key !== eventKey)
+                return false;
+            if (row.status === "settled" && (!row.outcome_json || JSON.parse(row.outcome_json).error) && !explicitId && !eventKey && !correlation?.identity)
+                return false;
+            const scope = JSON.parse(row.scope_json);
+            const constraint = typeof scopeConstraint === "string" ? { daemonId: scopeConstraint } : scopeConstraint;
+            if (constraint && Object.entries(constraint).some(([key, value]) => scope[key] !== value))
+                return false;
+            return fingerprint(invocation(canonicalManagedCommand(context, leafCommand, scope))) === row.fingerprint;
+        }
+        catch {
+            return false;
+        }
+    });
+    const identity = correlation?.identity;
+    const matches = lifecycleCandidates(matching, identity ? JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId]) : undefined, true);
+    if (!matches.length)
+        return null;
+    if (matches.length !== 1)
+        throw new AppError("invocation_ambiguous", "More than one observed lifecycle attempt matches this command", 1, { effect: "no_effect", matches: matches.map(row => row.id) });
+    return { id: matches[0].id, scope: JSON.parse(matches[0].scope_json) };
+}
+/** A new native call may consume a successor, but never a historical result.
+ * Exact native delivery replays its immutable assignment. CLI lookup without
+ * native correlation remains ambiguous when history and a successor coexist. */
+function lifecycleCandidates(rows, identity, lookup = false) {
+    if (identity) {
+        const replay = rows.filter(row => {
+            if (!row.identity_json)
+                return false;
+            if (row.identity_json === identity)
+                return true;
+            if (!lookup)
+                return false;
+            try {
+                const retained = JSON.parse(row.identity_json);
+                return Array.isArray(retained) && JSON.stringify(retained.slice(0, 5)) === identity;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (replay.length)
+            return replay;
+    }
+    const active = rows.filter(row => row.status !== "settled");
+    return (!lookup || identity) && active.length ? active : rows;
+}
+/** Restore private assignment arguments without discarding the provider's
+ * verified public input. The fingerprint deliberately projects semantic
+ * values such as a Work failure reason and a Work result-file path. */
+export function resolveObservedLifecycleArgs(context, id, actualArgs) {
+    const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [id]);
+    if (!row)
+        throw new AppError("invocation_unknown", "Lifecycle invocation is not registered", 1, { invocation_id: id });
+    const retained = invocation(row.command), actual = invocation(`${launchExpression(retained)} ${quoteModelFacingArgs(actualArgs)}`);
+    assertSuppliedLifecycleTarget(row, actual);
+    if (fingerprint(actual) !== row.fingerprint)
+        throw new AppError("invocation_command_mismatch", "Lifecycle command does not match its issued assignment", 2, { phase: "prepare", effect: "no_effect", recoverable: true });
+    for (const key of runtimeOwnedOptions[retained.operation] ?? []) {
+        const supplied = commandOption(actual, key), expected = commandOption(retained, key);
+        const exactInput = ["result-file", "decision-file", "verification-file"].includes(key);
+        const actualValue = exactInput && supplied !== undefined
+            ? commandOption(invocation(`${launchExpression(retained)} ${quote(expandLifecycleInvocationArgs(context, actual.argv, JSON.parse(row.scope_json), retained.operation))}`), key)
+            : supplied;
+        if (supplied !== undefined && (exactInput ? path.resolve(actualValue ?? "") !== path.resolve(expected ?? "")
+            : normalizedInvocationValue(key, supplied) !== normalizedInvocationValue(key, expected ?? ""))) {
+            throw new AppError("invocation_argument_mismatch", `--${key} is owned by the managed assignment and does not match it`, 2, { phase: "prepare", effect: "no_effect", recoverable: true, parameter: key });
+        }
+    }
+    const argv = [...retained.argv];
+    const publicKey = retained.operation === "work_fail" ? "reason" : retained.operation === "work_finish" ? "result-file" : null;
+    if (publicKey && commandOption(actual, publicKey) !== undefined) {
+        const index = argv.indexOf(`--${publicKey}`);
+        if (index >= 0 && index + 1 < argv.length)
+            argv[index + 1] = commandOption(actual, publicKey);
+        else {
+            const inline = argv.findIndex(value => value.startsWith(`--${publicKey}=`));
+            if (inline >= 0)
+                argv[inline] = `--${publicKey}=${commandOption(actual, publicKey)}`;
+        }
+    }
+    return argv;
+}
+/** Once native admission is committed, retain the actual public semantics so
+ * an authorized successor cannot silently revert to the issued placeholder. */
+export function retainObservedLifecycleSemantics(context, id, argv) {
+    const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [id]);
+    if (!row || row.status !== "executing")
+        throw new AppError("invocation_settlement_conflict", "Lifecycle attempt is not executing", 1, { invocation_id: id });
+    const parsed = invocation(row.command);
+    if (!["work_fail", "work_finish"].includes(parsed.operation))
+        return;
+    const prefix = Object.entries(parsed.env).map(([key, value]) => `${key}=${quote([value])}`).join(" ");
+    const executable = launchExpression(parsed);
+    const suffix = row.command.slice(shellSuffixOffset(row.command)).trimStart();
+    const command = `${prefix ? `${prefix} ` : ""}${executable} ${quote(argv)}${suffix ? ` ${suffix}` : ""}`;
+    checkCommand(row, command);
+    if (context.db.run("UPDATE lifecycle_invocations SET command = ?, updated_at = ? WHERE id = ? AND status = 'executing'", [command, context.now(), id]).changes !== 1) {
+        throw new AppError("invocation_settlement_conflict", "Lifecycle attempt changed before its public input was retained", 1, { invocation_id: id });
+    }
+}
+export function settleLifecyclePreparationRejection(context, id, error) {
+    delete error.details.retry_command;
+    delete error.details.retry_instruction;
+    try {
+        return context.db.writeTransaction(() => {
+            const row = load(context, id);
+            if (row.status === "settled") {
+                const details = row.outcome_json ? JSON.parse(row.outcome_json)?.error?.details : undefined;
+                return details?.effect === "no_effect" && details.retry_command ? details : { effect: "unknown", recoverable: false };
+            }
+            if (!["issued", "observed"].includes(row.status))
+                return { effect: "unknown", recoverable: false };
+            const scope = JSON.parse(row.scope_json);
+            if (scope.runId)
+                assertLifecycleInvocationCurrent(context, scope, row.command);
+            const signature = preparationRejectionSignature(error);
+            const repeated = context.db.all("SELECT outcome_json FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND id <> ? AND status = 'settled'", [row.scope_json, row.fingerprint, row.id])
+                .some(prior => { try {
+                return JSON.parse(prior.outcome_json ?? "null")?.error?.details?.rejection_signature === signature;
+            }
+            catch {
+                return false;
+            } });
+            const retryable = !repeated && isRetryableLifecycleRejection(error.code, error.details);
+            const details = { ...error.details, effect: "no_effect", recoverable: retryable, rejection_signature: signature,
+                ...(repeated ? { repeated_without_progress: true } : {}),
+                ...(retryable ? {
+                    retry_command: successorLifecycleInvocationCommand(context, row),
+                    retry_instruction: "Correct the reported input, then execute retry_command verbatim in this same Session. The rejected call changed no lifecycle state."
+                } : {}) };
+            context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ?", [JSON.stringify({ error: { ...errorRecord(error), details } }), context.now(), row.id]);
+            return details;
+        });
+    }
+    catch (persistence) {
+        error.details.recoverable = false;
+        throw persistence;
+    }
+}
+function preparationRejectionSignature(error) {
+    const omitted = new Set(["retry_command", "retry_instruction", "invocation_id", "hook_event_id", "rejection_signature", "hook_retry_signature", "event_key", "tool_call_id", "controller_turn", "timestamp", "created_at", "updated_at", "repeated_without_progress", "recoverable"]);
+    const normalize = (value) => {
+        if (Array.isArray(value))
+            return value.map(normalize);
+        if (!value || typeof value !== "object")
+            return value;
+        return Object.fromEntries(Object.entries(value).filter(([key]) => !omitted.has(key)).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => [key, normalize(item)]));
+    };
+    return crypto.createHash("sha256").update(JSON.stringify([error.code, normalize(error.details)])).digest("hex");
+}
+export function currentLifecycleFailure(context, input) {
+    if (input.turn !== undefined) {
+        const hooks = context.db.all(`SELECT id, outcome_json FROM hook_events
+      WHERE json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ?
+        AND json_extract(outcome_json, '$.stage') = ? AND json_extract(outcome_json, '$.controller_turn') = ?
+        ${input.projectId ? "AND project_id = ?" : ""}
+      ORDER BY id DESC`, [input.runId, input.generation, input.stage, input.turn, ...(input.projectId ? [input.projectId] : [])]);
+        const completed = new Set();
+        const activeAttempt = input.projectId ? stageAttempt(context, input.projectId, input.runId, input.stage) : null;
+        for (const hook of hooks) {
+            let outcome;
+            try {
+                outcome = JSON.parse(hook.outcome_json);
+            }
+            catch {
+                continue;
+            }
+            if (activeAttempt && outcome.attempt && outcome.attempt !== activeAttempt)
+                continue;
+            const key = JSON.stringify([outcome.operation ?? "", outcome.session_id ?? null, outcome.correlation_key ?? outcome.fingerprint ?? hook.id]);
+            if (outcome.disposition === "completed") {
+                completed.add(key);
+                continue;
+            }
+            if (completed.has(key) || !outcome.error?.code)
+                continue;
+            const continuation = outcome.error.details?.continuation;
+            if (continuation && typeof continuation === "object"
+                && continuation.run_id === input.runId
+                && continuation.stage === input.stage
+                && isRegisteredRepair(context, continuation, input.projectId ? { projectId: input.projectId, runId: input.runId } : undefined))
+                continue;
+            return { code: outcome.error.code, message: outcome.error.message ?? "Lifecycle command failed", details: outcome.error.details ?? {}, hook_event_id: hook.id };
+        }
+    }
+    const attempts = context.db.all("SELECT * FROM lifecycle_invocations ORDER BY updated_at DESC, rowid DESC");
+    const scoped = attempts.filter(row => {
+        try {
+            const scope = JSON.parse(row.scope_json);
+            return scope.runId === input.runId && scope.generation === input.generation && (!input.projectRoot || scope.projectRoot === input.projectRoot);
+        }
+        catch {
+            return false;
+        }
+    });
+    const fingerprints = [...new Set(scoped.map(row => row.fingerprint))];
+    for (const fingerprint of fingerprints) {
+        const rows = scoped.filter(row => row.fingerprint === fingerprint);
+        // An issued successor has not performed the correction. Once the Turn
+        // ended it cannot erase the predecessor's actual rejection.
+        if (rows.some(row => ["observed", "executing"].includes(row.status)))
+            continue;
+        const row = rows.find(candidate => candidate.status === "settled");
+        if (!row)
+            continue;
+        let outcome;
+        try {
+            outcome = JSON.parse(row.outcome_json ?? "null") ?? {};
+        }
+        catch {
+            continue;
+        }
+        if (!outcome.error?.code || !outcome.error.message)
+            continue;
+        let parsed;
+        try {
+            parsed = invocation(row.command);
+        }
+        catch {
+            continue;
+        }
+        let stage = parsed.operation.startsWith("merge_") ? "merge" : commandOption(parsed, "stage");
+        if (!stage && parsed.operation.startsWith("work_") && input.runId) {
+            try {
+                const work = resolveWorkReference(context, commandPosition(parsed, 0) ?? "", { runId: input.runId });
+                const membership = context.db.get("SELECT stage FROM stage_work_memberships WHERE run_id = ? AND work_id = ? ORDER BY rowid DESC LIMIT 1", [input.runId, work.work_id]);
+                stage = membership?.stage;
+            }
+            catch { /* A stale or unbound Work is not evidence for this Stage. */ }
+        }
+        if (stage !== input.stage)
+            continue;
+        const continuation = outcome.error.details?.continuation;
+        if (continuation && typeof continuation === "object"
+            && continuation.run_id === input.runId
+            && continuation.stage === input.stage
+            && isRegisteredRepair(context, continuation, input.projectId ? { projectId: input.projectId, runId: input.runId } : undefined))
+            continue;
+        return { code: outcome.error.code, message: outcome.error.message, details: outcome.error.details ?? {}, invocation_id: row.id };
+    }
+    return null;
+}
+/** One caller owns execution; a lost process leaves an explicit unknown
+ * outcome, never an automatic replay. Existing recovery decides the next step. */
+export async function awaitLifecycleInvocation(context, input) {
+    const initial = load(context, input.id);
+    try {
+        if (initial.status === "settled") {
+            checkCommand(initial, input.command);
+            return { outcome: JSON.parse(initial.outcome_json), replay: true };
+        }
+        input.validateArgs?.();
+        checkCommand(initial, input.command);
+        // A terminal command is immutable evidence.  Do not require a now-gone
+        // caller payload merely to replay its recorded result.
+    }
+    catch (error) {
+        if (!(error instanceof AppError) || !(["usage", "invocation_command_mismatch", "invocation_command_invalid"].includes(error.code) || error.details.phase === "prepare"))
+            throw error;
+        Object.assign(error.details, settleLifecyclePreparationRejection(context, input.id, error));
+        throw error;
+    }
+    if (["issued", "observed"].includes(initial.status)) {
+        try {
+            await input.prepare?.();
+        }
+        catch (error) {
+            if (!(error instanceof AppError) || (error.details.effect !== undefined && error.details.effect !== "no_effect"))
+                throw error;
+            const details = { ...error.details, phase: "prepare", effect: "no_effect" };
+            const recoverable = error.exitCode === 2 && ["validation", "schema_validation"].includes(error.code)
+                ? error.details.recoverable !== false
+                : isRetryableLifecycleRejection(error.code, details);
+            Object.assign(error.details, { phase: "prepare", effect: "no_effect", recoverable });
+            Object.assign(error.details, settleLifecyclePreparationRejection(context, input.id, error));
+            throw error;
+        }
+    }
+    const timeoutMs = input.timeoutMs ?? 30000;
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60000)
+        throw new AppError("invocation_timeout_invalid", "Receipt timeout must be within 1..60000 ms", 1);
+    context.db.run("UPDATE lifecycle_invocations SET deadline = COALESCE(deadline, ?), updated_at = ? WHERE id = ? AND status = 'issued'", [Date.now() + timeoutMs, context.now(), input.id]);
+    for (;;) {
+        const row = load(context, input.id);
+        if (row.status === "settled")
+            return { outcome: JSON.parse(row.outcome_json), replay: true };
+        if (row.status === "executing") {
+            const scope = JSON.parse(row.scope_json);
+            if (invocation(row.command).operation === "work_start" && row.event_key) {
+                input.assertCurrent(scope);
+                const result = recoverCommittedWorkStart(context, row.id, row.event_key, scope.generation);
+                if (result) {
+                    const outcome = { result, effect: "committed" };
+                    settleLifecycleInvocation(context, row.id, outcome);
+                    return { outcome, replay: true };
+                }
+            }
+            throw new AppError("invocation_outcome_pending", "This attempt already started; inspect its retained operation outcome before retrying", 1, { invocation_id: input.id, effect: "unknown" });
+        }
+        input.assertCurrent(JSON.parse(row.scope_json));
+        if (row.status === "observed") {
+            if (row.identity_json) {
+                // Receipt display text is bounded/redacted and may not be valid JSON.
+                // Only the native admission's typed identity binds an execution route.
+                const identity = JSON.parse(row.identity_json);
+                const route = identity[5]?.executionCwd;
+                if (identity.length > 5 && (typeof route !== "string" || !path.isAbsolute(route)))
+                    throw new AppError("invocation_directory_mismatch", "Bound lifecycle execution cwd is invalid", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+                if (typeof route === "string" && canonicalPath(process.cwd()) !== canonicalPath(route))
+                    throw new AppError("invocation_directory_mismatch", "Reached CLI cwd differs from the bound shell execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false, expected: route, actual: process.cwd(), actual_provenance: "cli_process_cwd" });
+            }
+            // Another native observation can replace an unclaimed receipt. Claim
+            // exactly the identity/route checked above, or reload and validate it.
+            const workStart = invocation(row.command).operation === "work_start";
+            const birth = workStart ? processStartedAt(process.pid) : null, cwd = workStart ? process.cwd() : "";
+            input.assertCurrent(JSON.parse(row.scope_json));
+            let admittedAt = "";
+            const claimed = context.db.writeTransaction(() => {
+                // Acquire the writer before taking the anchor; waiting for SQLite or
+                // physical birth observation must not make an old Hook appear fresh.
+                admittedAt = context.now();
+                return context.db.run("UPDATE lifecycle_invocations SET status = 'executing', updated_at = ? WHERE id = ? AND status = 'observed' AND event_key IS ? AND identity_json IS ? AND scope_json=? AND command=?", [admittedAt, input.id, row.event_key, row.identity_json, row.scope_json, row.command]);
+            });
+            if (claimed.changes === 1) {
+                if (birth) {
+                    let owned = currentAdmissions.get(context.db);
+                    if (!owned) {
+                        owned = new Map();
+                        currentAdmissions.set(context.db, owned);
+                    }
+                    if (owned.size >= 256)
+                        owned.delete(owned.keys().next().value);
+                    owned.set(input.id, { eventKey: row.event_key, identity: row.identity_json, scope: row.scope_json, command: row.command, cwd, pid: process.pid, birth, admittedAt });
+                }
+                return { eventKey: row.event_key, replay: false };
+            }
+            continue;
+        }
+        if (row.status === "expired" || (row.deadline !== null && row.deadline <= Date.now())) {
+            context.db.writeTransaction(() => {
+                const current = load(context, input.id);
+                if (["issued", "expired"].includes(current.status)) {
+                    input.assertCurrent(JSON.parse(current.scope_json));
+                    settleUnadmittedInvocation(context, current, receiptTimeout(input.id));
+                }
+            });
+            continue;
+        }
+        await delay(Math.min(25, Math.max(1, (row.deadline ?? Date.now() + 25) - Date.now())));
+    }
+}
+export function settleLifecycleInvocation(context, id, outcome) {
+    currentAdmissions.get(context.db)?.delete(id);
+    const encoded = JSON.stringify(outcome);
+    if (encoded === undefined)
+        throw new AppError("invocation_outcome_invalid", "Invocation outcome must be JSON", 1);
+    const changed = context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ? AND status = 'executing'", [encoded, context.now(), id]);
+    if (changed.changes !== 1) {
+        const row = load(context, id);
+        if (row.status !== "settled" || row.outcome_json !== encoded)
+            throw new AppError("invocation_settlement_conflict", "Attempt cannot be settled with a different outcome", 1, { invocation_id: id });
+    }
+}