@deksden-com/dd-flow-cli 0.9.0-beta.144 → 0.9.0-beta.145

package/CHANGELOG.md

@@ -1,5 +1,64 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.145
+
+### Patch Changes
+
+- Normalize Git diagnostics for gitless workspace inventories without masking damaged repositories; keep integration fixture tools on an explicitly selected PATH and scope simulated journal stalls to failure persistence.
+
+- Select Gemini's encoded reasoning level without an unsupported AGY `--effort` override; reject conflicting requested levels before native launch, while retaining explicit effort for other model families.
+
+- Preserve the effective environment across pinned engine dispatch. Isolate package-consumer routing and own executable test discovery; reduce duplicate gate preparation without removing release guarantees.
+
+- ea4e88e: Add hybrid mb-upgrade with retained current/target selection, scoped migration
+  bootstrap, preserved old-bank evidence, independent Work review and marker-free
+  ordinary flow readiness. Keep existing RUN engine bindings and reconcile partial
+  startup and publication through their original requests.
+
+  Retain bounded Codex admission phase diagnostics and separate native-host startup
+  headroom from the shared admission deadline. Refuse writer migration while a
+  MERGE request remains unresolved, including same-session integration without a
+  live process; terminal historical requests do not block migration.
+
+  Preserve project lint exclusions while independently checking affected active
+  Markdown through a separate mb-lint configuration when needed (`--config`
+  support required). Retain both reports and the effective configuration as check
+  evidence. Allow malformed terminal proposal JSON to be corrected through the
+  existing no-effect lifecycle successor without repeating Git integration.
+  Align generated FINISH guidance with the minimal proposal and CLI-owned sealed
+  coverage, findings and evidence for both initialization and upgrade.
+  Keep exact source-canon spec/protocol provenance relations distinct from
+  consumer-owned link targets when checking customized guidance. Derive scoped
+  exceptions from retained target bytes; new project/body links and Git-aware
+  ignored-target checks remain active, and project configuration stays unchanged.
+  Reject malformed bounded JSON at the shared Memory finish ingress as a
+  correctable proposal before stage-specific projections can misclassify it as
+  retained-custody corruption. Reuse the existing issued lifecycle successor;
+  empty/oversized input, unknown stages and downstream identity/effect checks
+  remain strict. Never repair proposal bytes or rerun settled work implicitly.
+
+  Keep the native hook's per-call deadline out of project-check input identity so
+  VERIFY can accept unchanged passed checks across ordinary CLI and hook calls.
+  Continue to invalidate evidence when application environment, files, policy or
+  physical receipts change.
+
+  Check retained process birth after a permission-denied existence probe, so a
+  reused macOS system PID cannot keep an already closed agent scope unresolved.
+  Unknown identity remains conservative and foreign processes are never signaled.
+
+  Validate a current completed correction wave as one synchronous SQL snapshot,
+  sharing private successful proofs across its registration and settled histories.
+  Fresh traversals, failures, allocation fences and physical file checks remain
+  independent; no proof is reused across commands or asynchronous boundaries.
+
+- 481702b: Keep native hook admission within its qualified shared deadline without loading execution/recovery graphs. Retain matched late native terminal outcomes before shutdown, support AGY ordered stream request evidence and recovered lifecycle boundaries, and publish exact current instruction packets as readable Markdown without replaying committed lifecycle operations.
+
+  Distinguish repeated real checksum scans from duplicate progress notifications. Retry only effect-free physical self-start observations within the existing owner-bound startup horizon, without relaunching processes or renewing unconfirmed leases.
+
+  Allow an initially bound maintenance cancellation signal to drain its owned heartbeat transport during daemon shutdown.
+
+  Retain startup failures only for the exact physical owner, preventing duplicate workers from overwriting or cleaning up a winner. Keep setup progress distinct across owned CLI producers without admitting stale or duplicate notifications.
+
 ## 0.9.0-beta.144
 
 ### Patch Changes

package/README.md

@@ -161,6 +161,8 @@ dd-flow canon status --json
 
 `canon resolve` checks explicit `--root`, then `DD_MEMORYBANK`, then the globally registered value in `DD_FLOW_HOME`, then known nearby `dd-memorybank` checkouts from the current working directory. If two different valid canonical roots are discovered, it fails closed with structured blockers and bootstrap hints. Use `DD_MEMORYBANK` for the local canonical `dd-memorybank` checkout.
 
+With no explicit, environment or registered source, the release installed by `setup` in `DD_FLOW_HOME` takes precedence over nearby checkouts. Archive provenance comes from its retained release manifest. A degraded installation does not silently fall back to a local checkout. Discovery remains read-only and does not open SQLite before runtime context admission.
+
 Register a project:
 
 ```bash
@@ -508,22 +510,25 @@ remain invalid and receive a standalone retry.
 
 ## Verification
 
-Local verification for this repository:
+For a code merge, start with the cheap common contracts, then select affected
+storage/process/flow checks explicitly and record the selection reason:
 
 ```bash
-pnpm typecheck
-pnpm lint
-pnpm build
-pnpm test
+pnpm gate:merge
 ```
 
-Build once before testing: release contracts and native fixtures verify the
-copied `dist` bytes. `pnpm test` remains release → integration → runtime-sensitive.
+For release acceptance, freeze source/canon, build once, then use
+`DD_FLOW_GATE_REPORT_ROOT=/absolute/external/report pnpm gate:release`.
+Node family selection lives in `package.json`, Vitest membership in
+`vitest.config.ts`, and required release receipts in `scripts/release-candidate.mjs`.
+The local and CI profiles cover the same required guarantees; qualification-only
+cases report their prerequisites/skips separately. Tests invoking compiled CLI
+must use the current frozen build, even for a partial merge check.
 For development use `pnpm test:fast`, `pnpm test:core` or `pnpm test:flow` plus
 the affected native contracts; these subsets are not full acceptance.
 New files default to serial core execution. A forced serial fallback is
 `pnpm test:integration --no-file-parallelism --maxWorkers=1`.
-The [test-suite verification runbook](https://github.com/deksden-com/dd-eval/blob/docs/066-test-suite-optimization/runbooks/flow-test-suite-verification.md)
+The [test-suite verification runbook](https://github.com/deksden-com/dd-eval/blob/main/runbooks/flow-test-suite-verification.md)
 owns group qualification, complete reports and cross-repository commands.
 
 Manual smoke checks should use a temporary `DD_FLOW_HOME` when they do not intentionally inspect the operator's real local state.

package/dist/build-info.json

@@ -1,15 +1,15 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.144",
-  "cli_commit": "fc729af5d6f9865bab178e40b34dd9b0a99a0318",
-  "built_at": "2026-10-20T05:55:05.754Z",
+  "cli_version": "0.9.0-beta.145",
+  "cli_commit": "52851c6a5c8419e93b543fd6a53e71f9aa359d9f",
+  "built_at": "2026-10-21T17:32:05.034Z",
   "built_with_canon": {
     "version": "4.1.2",
-    "commit": "a1cfe8b06329c691c314064b6ea6a3da6628cceb",
+    "commit": "51f7d7155f578e877e4db5c3d022772084ecea5a",
     "flow_contract": "dd-flow-canonical-2026-08",
-    "repo_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-plan092",
-    "memorybank_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-plan092/.memory-bank",
-    "flow_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-plan092/.memory-bank/dd-flow",
+    "repo_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-release-145",
+    "memorybank_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-release-145/.memory-bank",
+    "flow_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-release-145/.memory-bank/dd-flow",
     "layout": "dot_memory_bank"
   }
 }

package/dist/cli/command-inputs.js

@@ -15,7 +15,7 @@ const control = "project-root run";
 const protocolTransitionInput = route(1, "to", `${scoped} payload-file json-file reason`, "force");
 const setupInput = route(0, "request-id trust-file", "canon-source canon-version release-registry channel profile profile-file save-profile-intent", "non-interactive skip-agent-setup", "", { channel: ["stable", "preview", "development"] });
 const memoryInitInput = route(0, "project-root workspace-root request-id", "intake-file intake-sha256 profile profile-file stage-profile work-profile max-parallel delegation native-config-home git-route integration-branch", "detach non-interactive prepare-only allow-live-probe", "stage-profile work-profile", { "git-route": ["integration_branch_direct", "feature_worktree"], delegation: ["external", "native"] });
-export const commandAliases = { transition: "protocol transition", init: "flow mb-init" };
+export const commandAliases = { transition: "protocol transition", init: "flow mb-init", upgrade: "flow mb-upgrade" };
 /** Path-shaped arguments default to physical paths unless the route explicitly
  * opts into contextualPaths. This inventory does not expand arbitrary strings. */
 export const physicalPathOptions = new Set(words("canon-source trust-file root project-root workspace-root workspace-path workspace-path path dir file schema-dir output result-file semantic-file data decision-file verification-file reason-file task-file intake-file context-file observations-file observation-file summary-file question-file answer-file payload-file json-file task-profile-file execution-routing-file protocol-override-file manifest-file routing-file config-file input-file report-file snapshot-file output-dir state-dir capture-root capture-path destination source archive snapshot plan-file backup-path database backup source-home target-home stdout stderr adapter-executable memory-bank flow stage-report dashboard report"));
@@ -33,8 +33,12 @@ export const commandInputs = {
     "flow show": route(1),
     "flow mb-init": memoryInitInput,
     "init": memoryInitInput,
-    "runtime storage admit": route(0, "operation", "", "", "", { operation: ["memory-init"] }),
-    "runtime flow admit": route(0, "operation", "", "", "", { operation: ["memory-init"] }),
+    "flow mb-upgrade": memoryInitInput,
+    "upgrade": memoryInitInput,
+    "runtime storage admit": route(0, "operation", "", "", "", { operation: ["memory-init", "memory-upgrade"] }),
+    "runtime storage qualify": route(0, "operation", "", "", "", { operation: ["memory-upgrade"] }),
+    "runtime storage transition": route(0, "action project-root workspace-root request-id selection-sha256", "expected-sha256 recovery-id", "offline", "", { action: ["plan", "apply", "status", "recovery-plan", "recover", "recovery-status"] }),
+    "runtime flow admit": route(0, "operation", "", "", "", { operation: ["memory-init", "memory-upgrade"] }),
     "completion bash": route(0),
     "completion zsh": route(0),
     "completion fish": route(0),
@@ -218,6 +222,7 @@ export const commandInputs = {
     "canon status": route(0, "", "root"),
     "canon resolve": route(0, "", "root"),
     "migration impact": route(0, project, "target-version mode"),
+    "migration readiness": route(0, `${project} workspace-root request-id`),
     "migration plan": route(0, project, "source-version target-version run backup-path backup-created-at"),
     "migration report": route(0, project, "source-version target-version run backup-path backup-created-at"),
     "migration verify": route(0, "file"),
@@ -265,6 +270,7 @@ export const commandInputs = {
     "schema validate": { ...route(0, "schema file", "schema-dir project-root run"), contextualPaths: words("project-root file") },
     "memory permissions preflight": route(0, "root memory-bank flow mode", "tasks"),
     "memory compose register": route(0, "project-root run request-key result-file"),
+    "memory upgrade publish": route(0, "project-root run"),
     "memory verify checks": route(0, "project-root run"),
     "memory review register": route(0, "project-root run"),
     "memory review collect": route(0, "project-root run"),

package/dist/cli/command-metadata.js

@@ -63,8 +63,11 @@ const memoryInitOptions = {
 const commandOptionDescriptions = {
     "flow mb-init": memoryInitOptions,
     init: memoryInitOptions,
-    "runtime storage admit": { operation: "Operation-specific writable-connection admission: memory-init only. Requires explicit canonical DD_FLOW_HOME and an existing compatible resource registry. Never initializes, migrates, repairs or starts agents." },
-    "runtime flow admit": { operation: "Memory-init handler admission in the executing engine. Reads bounded UTF-8 JSON stdin with source and source_sha256; optional startup_input_schema additionally requires support by this engine's startup reader. Validates the exact six-stage descriptor using actual registered handlers. Does not establish release trust, storage/provider readiness or semantic completion, and never creates Home, RUN or agents." },
+    "flow mb-upgrade": { ...memoryInitOptions, "stage-profile": "Repeatable stage=profile assignment for preflight, diff-analysis, upgrade, verify, review or finish. The original selection is frozen before dispatch.", "prepare-only": "Prepare or replay the upgrade RUN and accepted storage/bootstrap selection without launching its controller or a productive Session. This is not a dry run; it does not publish the upgraded canonical layer or accept semantic preservation." },
+    upgrade: { ...memoryInitOptions, "stage-profile": "Repeatable stage=profile assignment for preflight, diff-analysis, upgrade, verify, review or finish. The original selection is frozen before dispatch.", "prepare-only": "Prepare or replay the upgrade RUN and accepted storage/bootstrap selection without launching its controller or a productive Session. This is not a dry run; it does not publish the upgraded canonical layer or accept semantic preservation." },
+    "runtime storage admit": { operation: "Operation-specific writable-connection admission: memory-init or memory-upgrade. Upgrade also checks retained request storage. Requires explicit canonical DD_FLOW_HOME and an existing compatible resource registry. Never initializes, migrates, repairs or starts agents." },
+    "runtime storage qualify": { operation: "memory-upgrade only. Qualify the selected engine before a native probe. Incompatible drained stores are copied privately with committed WAL; the actual transition and operation admission run on those copies. Requires both explicit canonical Homes. Never migrates real stores, grants productive admission, creates a RUN or starts agents." },
+    "runtime flow admit": { operation: "Handler admission for memory-init or memory-upgrade in the executing engine. Reads bounded UTF-8 JSON stdin with source and source_sha256; memory-init additionally accepts startup_input_schema to require its startup reader. Validates the matching six-stage descriptor using actual registered handlers. Does not establish release trust, storage/provider readiness or semantic completion, and never creates Home, RUN or agents." },
     "profiles create": { file: "Regular UTF-8 JSON file containing one complete validated agent profile. The ID must be unused. Credentials and unknown fields are refused; creation uses --expected-revision and never starts a model Turn." },
     "profiles edit": { file: "Regular UTF-8 JSON file containing the complete replacement agent profile, not a patch. Its ID must already exist. Revision conflicts refuse the edit; retained RUN snapshots are unchanged." },
     "profiles alias": {
@@ -79,6 +82,11 @@ const commandOptionDescriptions = {
     },
     "schema validate": { file: "JSON document to validate against --schema in the selected schema directory. Validation does not execute a flow or accept semantic completion." },
     "migration verify": { file: "Existing dd-flow/mb-upgrade-migration-report@1 JSON report to verify against migration evidence; verification does not apply a storage migration." },
+    "migration readiness": {
+        "request-id": "Stable upgrade request ID. Retains a physically verified content-only storage proof; identical replay reuses it and changed inputs refuse. Does not create a RUN, sync content or migrate stores.",
+        "workspace-root": "Existing canonical absolute assigned workspace. Recorded with the project and request; this storage-only operation does not establish Git/workspace eligibility for the full upgrade.",
+        "project-root": "Registered active project requiring a complete release-impact chain and valid current provenance. Existing compatible run/resource stores are mandatory; this command never initializes or repairs them. Explicit mb-upgrade mode is required."
+    },
     "migration apply": { file: "Explicit migration report JSON file used for admission to the requested apply operation; backup and ownership gates remain mandatory." },
     "prompt render": { profile: "Prompt profile name required by the assigned Work execution context; not an operator executor profile ID or a Codex home profile." },
     "runtime process register": { harness: "Harness family associated with the registered process/budget; registration is not a discovery or doctor probe.", "state-dir": "Adapter runtime state directory retained with the physical process for later ownership/admission checks." },
@@ -105,17 +113,28 @@ const commandOptionDescriptions = {
     "run control resume": { from: "Exact retained pause/stop control ID whose captured state authorizes this resume request; not a snapshot path." },
     "stage block": { kind: "Blocker category: engine, harness or environment; code and summary identify the actionable cause." },
     "migration impact": { mode: "Optional full_migration request forces the strict full-migration assessment; otherwise impact evidence determines patch, targeted_minor or full_migration." },
+    "runtime storage transition": {
+        "selection-sha256": "Exact independently retained full upgrade selection; checked before any storage effect. Commands issued by the selected engine include this value.",
+        action: "Selected frozen engine transport: plan retains the pair; apply performs its explicit cutover; status observes it. recovery-plan selects and fences separate recovery; recover executes it; recovery-status observes recovery. No command starts a model or RUN.",
+        "expected-sha256": "Exact retained migration request SHA for apply/status/recovery-plan, or retained recovery request SHA for recover/recovery-status. Not a fresh selector or permission to replace a request.",
+        "recovery-id": "Explicit recovery identity (1..86 safe ASCII characters); required only for recovery-plan. Recovery aborts the original apply.",
+        offline: "Required for apply, recovery-plan and recover after all local/external writers are drained. The engine independently checks registered logical and physical owners; it never kills them.",
+        "project-root": "Original retained upgrade project identity. No project or database is initialized by this transport.",
+        "workspace-root": "Original assigned upgrade workspace; must match the frozen request.",
+        "request-id": "Original upgrade request identity; the engine and migration files come only from that request."
+    },
     "memory permissions preflight": { mode: "Permission contour to check: read, write, repair or report_only; write checks may create temporary permission probes.", flow: "Workflow permission contour: mb-init, mb-upgrade, mb-audit, mb-fix, mb-upgrade-review or custom. Not a filesystem path." },
-    "memory compose register": { "run": "Active registered mb-init RUN whose accepted discovery and immutable execution bind the composition graph.", "request-key": "Stable composition registration identity; exact replay retains the original Work graph.", "result-file": "Bounded proposed composition JSON. Bytes are prepared before registration; agent fields do not grant Work or write authority." },
-    "memory verify checks": { "run": "Active registered mb-init RUN. Execute only its independently selected declared verification checks." },
-    "memory review register": { "run": "Active registered mb-init RUN with accepted verification. Register initial independent reviewers; this does not launch providers." },
-    "memory review collect": { "run": "Active registered mb-init RUN. Collect genuine registered initial-wave results without accepting the Stage or granting correction authority." },
-    "memory finish evidence": { "run": "Active registered mb-init finish RUN. Publish independently prepared coverage, integration and readiness evidence; publication does not complete Stage or RUN." },
-    "memory finish integrate": { "run": "Active mb-init finish RUN. Commit only accepted Memory Bank and owned lint files under retained Git policy, then integrate the admitted workspace locally. Preserve unrelated staged/dirty files; never push. Lost-response replay observes the original effects without another commit." },
-    "memory corrections register": { run: "Active registered mb-init review RUN. Register only the correction plan bound to the independently retained preceding review.", wave: "Correction wave 1 follows initial review; wave 2 requires settled first selective review. A third wave is unsupported.", "result-file": "Bounded correction-plan JSON prepared before graph registration; exact retained replay cannot substitute another plan." },
-    "memory corrections checks": { run: "Active registered mb-init review RUN with a genuinely settled correction view.", wave: "Run only the independently selected finite check profile for correction wave 1 or 2; this does not accept semantic quality." },
-    "memory review selective-register": { run: "Active registered mb-init review RUN. Allocate selective reviewers only after their wave's committed checks.", wave: "Select correction wave 1 or 2. Unaffected accepted units remain retained; registration does not launch providers." },
-    "memory review selective-collect": { run: "Active registered mb-init review RUN. Return genuine selective reviewer references, not Stage or RUN acceptance.", wave: "Select independently registered review of correction wave 1 or 2; missing wave custody never falls back to initial review." },
+    "memory compose register": { "run": "Active mb-init or mb-upgrade RUN whose accepted discovery/diff-analysis and immutable execution bind the composition graph.", "request-key": "Stable composition registration identity; exact replay retains the original Work graph.", "result-file": "Bounded proposed composition JSON. Bytes are prepared before registration; agent fields do not grant Work or write authority." },
+    "memory upgrade publish": { run: "Active mb-upgrade authoring Stage with a registered blueprint and settled Work. Apply only its retained canonical publication plan and recovery archive; this does not accept the Stage or complete the RUN." },
+    "memory verify checks": { "run": "Active mb-init or mb-upgrade RUN. Execute only its independently selected declared verification checks." },
+    "memory review register": { "run": "Active mb-init or mb-upgrade RUN with accepted verification. Register initial independent reviewers; this does not launch providers." },
+    "memory review collect": { "run": "Active mb-init or mb-upgrade RUN. Collect genuine registered initial-wave results without accepting the Stage or granting correction authority." },
+    "memory finish evidence": { "run": "Active mb-init or mb-upgrade finish RUN. Publish independently prepared coverage, integration and readiness evidence; publication does not complete Stage or RUN." },
+    "memory finish integrate": { "run": "Active mb-init or mb-upgrade finish RUN. Commit only accepted Memory Bank and owned lint files under retained Git policy, then integrate the admitted workspace locally. Preserve unrelated staged/dirty files; never push. Lost-response replay observes the original effects without another commit." },
+    "memory corrections register": { run: "Active mb-init or mb-upgrade review RUN. Register only the correction plan bound to the independently retained preceding review.", wave: "Correction wave 1 follows initial review; wave 2 requires settled first selective review. A third wave is unsupported.", "result-file": "Bounded correction-plan JSON prepared before graph registration; exact retained replay cannot substitute another plan." },
+    "memory corrections checks": { run: "Active mb-init or mb-upgrade review RUN with a genuinely settled correction view.", wave: "Run only the independently selected finite check profile for correction wave 1 or 2; this does not accept semantic quality." },
+    "memory review selective-register": { run: "Active mb-init or mb-upgrade review RUN. Allocate selective reviewers only after their wave's committed checks.", wave: "Select correction wave 1 or 2. Unaffected accepted units remain retained; registration does not launch providers." },
+    "memory review selective-collect": { run: "Active mb-init or mb-upgrade review RUN. Return genuine selective reviewer references, not Stage or RUN acceptance.", wave: "Select independently registered review of correction wave 1 or 2; missing wave custody never falls back to initial review." },
     "memory repair baseline": { ...memoryRepairOptions, work: "Register the immutable prelaunch baseline for this repair Work; dependent/peer changes require explicit current-view registration first. Does not launch providers." },
     "memory repair copy-reserve": { ...memoryRepairOptions, work: "Reserve the owned private copy for this repair Work after its committed baseline; reservation does not create the copy or launch providers." },
     "memory repair copy-materialize": { ...memoryRepairOptions, work: "Materialize the reserved private copy for this repair Work with retained build/ready receipts; no provider launch or shared document publication." },
@@ -162,8 +181,8 @@ export function optionsForCommandTree(command) {
 /** One exact native routing classification shared by router and compatibility admission. */
 export function routerNativeRoute(key) {
     return key === "version" || key.startsWith("engine ") || key === "schema validate"
-        || key === "flow list" || key === "flow show" || key === "flow mb-init" || key === "init"
-        || key === "run reconcile" || key === "runtime storage admit"
+        || key === "flow list" || key === "flow show" || key === "flow mb-init" || key === "init" || key === "flow mb-upgrade" || key === "upgrade"
+        || key === "run reconcile" || key === "runtime storage admit" || key === "runtime storage qualify" || key === "runtime storage transition"
         || key === "runtime flow admit"
         || key.startsWith("profiles ") || key.startsWith("models ") || key.startsWith("harnesses ") || key.startsWith("completion ") || key === "setup" || key.startsWith("setup ")
         || key === "storage migrate-writer" || key === "codex hook handle"

package/dist/cli/help.js

@@ -2,6 +2,35 @@ import { AppError } from "../shared/errors.js";
 import { commandInputs, commandAliases } from "./command-inputs.js";
 import { commandKeyForPositions, globalOptionDocumentation, optionsForCommandTree, routerNativeRoute } from "./command-metadata.js";
 const helpPages = new Map([
+    ["runtime storage qualify", `dd-flow runtime storage qualify - pre-probe selected-engine capability
+
+--operation memory-upgrade checks existing storage with the executing engine.
+Compatible stores use ordinary operation admission. Otherwise, drained source
+stores are copied with committed WAL to a private temporary directory; actual
+migration and target operation admission run only on those copies.
+
+Requires explicit canonical DD_FLOW_HOME and DD_FLOW_RESOURCE_HOME. The result
+is capability only: it does not authorize writes, create a RUN, publish migration
+evidence for real stores or start a model. Original storage is never migrated.
+Public upgrade still requires a separately retained plan and explicit apply.`],
+    ["runtime storage transition", `dd-flow runtime storage transition - selected-engine pre-context storage transport
+
+Normal project entry remains dd-flow upgrade. This transport executes only in
+the immutable entrypoint selected by the original retained upgrade request.
+It requires explicit DD_FLOW_HOME and DD_FLOW_RESOURCE_HOME and never initializes
+storage, chooses another engine, starts a model or allocates a RUN.
+
+--action plan retains both store snapshots and returns exact apply/status commands.
+apply requires the retained --expected-sha256 and --offline; both backups are
+verified before the first schema change. Unknown effects require exact-request
+status/reconciliation, not a new selector or replacement plan.
+
+recovery-plan requires the migration SHA, --recovery-id and --offline. Selecting
+recovery fences both stores and aborts the old apply; recover and recovery-status
+use the returned recovery SHA. Restoration is never automatic.
+
+The offline switch acknowledges external drain; logical and physical registered
+owners are checked independently. No owner is terminated by this transport.`],
     ["flow mb-init", `dd-flow init / flow mb-init - managed project Memory Bank initialization
 
 Usage:
@@ -332,7 +361,7 @@ Examples:
     ],
     [
         "canon",
-        `dd-flow canon - register and resolve the canonical Memory Bank checkout
+        `dd-flow canon - register and resolve the canonical Memory Bank source
 
 Usage:
   dd-flow canon register --root <canonical-dd-memorybank-root> --json
@@ -341,6 +370,8 @@ Usage:
 
 Discovery order is explicit --root, then DD_MEMORYBANK, then the globally registered runtime value in DD_FLOW_HOME, then known nearby dd-memorybank checkouts from the current working directory. Explicit --root is the only source considered for that command. If multiple different valid canonical checkouts are found, resolve fails closed with blockers so the caller chooses intentionally.
 
+Without an explicit, environment or registered source, the release installed by setup in DD_FLOW_HOME takes precedence over nearby checkouts. Its commit comes from the retained release manifest, not ancestor Git history. A degraded installation is reported; it never silently falls back to a nearby checkout.
+
 A valid canonical root contains dd-flow/README.md, mbb/index.md, protocol/index.md, and canonical-only entrypoints such as dd-flow/mb-init.md, dd-flow/mb-upgrade.md, and dd-flow/mb-distill.md. Current canon runs mb-upgrade review as the 05-review stage inside mb-upgrade, not as a top-level mb-upgrade-review.md entrypoint.
 
 Examples:

package/dist/cli/hook-ingress.js

@@ -1,10 +1,11 @@
 import { fileURLToPath } from "node:url";
 import { performance } from "node:perf_hooks";
+import { channel } from "node:diagnostics_channel";
 import { parseCommandArgs, parseLifecycleCommand, lifecycleCommandFromPayload, continuationCommand } from "../services/lifecycle-command.js";
 import { errorRecord, AppError } from "../shared/errors.js";
 import { parseJsonObject } from "../shared/json.js";
 const workerFile = fileURLToPath(import.meta.url);
-const ingressBudgetMs = 20_000; // Native host timeout is 30s; this includes cold module/DB open.
+const ingressBudgetMs = 20_000; // Shared admission budget; host separately allows cold CLI startup/cleanup.
 const { hookBudget, readNativeHookInput } = await import("../harness-runtime/lib/native-hook-command.mjs");
 /** Lightweight entry: unrelated hooks never load the router or open storage. */
 export async function runHookIngress(args) {
@@ -46,15 +47,32 @@ export async function runHookIngress(args) {
 }
 // A bounded CLI subprocess, not a detached writer: its successful reply follows COMMIT.
 if (process.argv[1] === workerFile) {
+    const started = performance.now();
+    const timing = channel("dd-flow.sqlite.ingress");
+    let previousPhase;
+    const trace = (value) => {
+        const record = value;
+        if (record.phase === previousPhase)
+            return;
+        previousPhase = record.phase;
+        process.stderr.write(`${JSON.stringify({ kind: "native_hook_phase", phase: record.phase, elapsed_ms: Math.round(performance.now() - started), ...(record.remaining_ms !== undefined ? { remaining_ms: record.remaining_ms } : {}) })}\n`);
+    };
+    timing.subscribe(trace);
     try {
-        const stdin = await readNativeHookInput(process.stdin, hookBudget(ingressBudgetMs, process.env.DD_FLOW_HOOK_DEADLINE_AT ? Number(process.env.DD_FLOW_HOOK_DEADLINE_AT) : null));
+        const budget = hookBudget(ingressBudgetMs, process.env.DD_FLOW_HOOK_DEADLINE_AT ? Number(process.env.DD_FLOW_HOOK_DEADLINE_AT) : null);
+        const phase = (name) => trace({ phase: name, remaining_ms: budget.remaining(name) });
+        phase("input");
+        const stdin = await readNativeHookInput(process.stdin, budget);
         const payload = parseJsonObject(stdin, "native hook stdin");
-        const started = performance.now();
+        phase("verification");
         const { verifyCodexHookDelivery } = await import("../services/codex-hook-delivery.js");
         const proof = await verifyCodexHookDelivery(process.env, payload);
         const verified = performance.now();
+        phase("import");
         const [{ createContext }, { handleCodexHook }] = await Promise.all([import("../runtime/context.js"), import("../services/hooks.js")]);
+        phase("imported");
         const loaded = performance.now();
+        phase("store_open");
         const context = createContext(process.env, "hook");
         const opened = performance.now();
         try {
@@ -62,7 +80,10 @@ if (process.argv[1] === workerFile) {
                 context.codexHookProof = proof;
             const parsed = parseCommandArgs(process.argv.slice(5));
             const projectRoot = parsed.options.get("project-root")?.[0];
+            phase("receipt");
             const result = handleCodexHook(context, { event: "PreToolUse", ...(projectRoot ? { projectRoot } : {}), stdin });
+            phase("committed");
+            phase("ack");
             process.stdout.write(`${JSON.stringify({ ...(result.hookSpecificOutput ? { hookSpecificOutput: result.hookSpecificOutput } : {}), timing: {
                     verify_ms: Math.round(verified - started), load_ms: Math.round(loaded - verified), open_ms: Math.round(opened - loaded), receipt_ms: Math.round(performance.now() - opened)
                 } })}\n`);
@@ -75,4 +96,7 @@ if (process.argv[1] === workerFile) {
         process.stderr.write(`${JSON.stringify({ ok: false, error: errorRecord(error) })}\n`);
         process.exitCode = 1;
     }
+    finally {
+        timing.unsubscribe(trace);
+    }
 }

package/dist/cli/memory-flow-admission.js

@@ -20,8 +20,9 @@ export async function runMemoryFlowAdmissionCli(args, io = process) {
             throw new AppError("usage", "Flow admission requires an exact source snapshot and independent digest", 2, { effect: "no_effect" });
         }
         const selected = input;
+        const flowId = route.parsed.options.get("operation")?.[0] === "memory-upgrade" ? "mb-upgrade" : "mb-init";
         const startupSchema = memoryInitStartupInputSchemas.find(schema => schema === selected.startup_input_schema);
-        if (Object.hasOwn(selected, "startup_input_schema") && startupSchema === undefined) {
+        if (Object.hasOwn(selected, "startup_input_schema") && (startupSchema === undefined || flowId !== "mb-init")) {
             throw new AppError("usage", "Executing engine does not support the requested startup input schema", 2, { effect: "no_effect" });
         }
         if (typeof selected.source_sha256 !== "string" || !/^[a-f0-9]{64}$/.test(selected.source_sha256)) {
@@ -29,9 +30,12 @@ export async function runMemoryFlowAdmissionCli(args, io = process) {
         }
         const source = PreparedInstalledFlowSource.restoreRetained(selected.source, selected.source_sha256);
         const flow = source.resolveRegisteredFlow();
-        const facts = { schema_id: startupSchema === undefined ? "dd-flow/memory-init-engine-flow@1" : "dd-flow/memory-init-engine-flow@2",
+        if (flow.descriptor.id !== flowId)
+            throw new AppError("usage", "Flow source does not match the requested engine admission operation", 2, { effect: "no_effect" });
+        const facts = { schema_id: flowId === "mb-upgrade" ? "dd-flow/memory-upgrade-engine-flow@1"
+                : startupSchema === undefined ? "dd-flow/memory-init-engine-flow@1" : "dd-flow/memory-init-engine-flow@2",
             ...(startupSchema === undefined ? {} : { startup_input_schema: startupSchema }),
-            flow_id: "mb-init", source_sha256: source.sha256,
+            flow_id: flowId, source_sha256: source.sha256,
             descriptor_sha256: source.descriptorReference().sha256, stages: flow.descriptor.stages.map(stage => stage.id) };
         io.stdout.write(`${JSON.stringify({ ok: true, action: "runtime_flow_admit", facts, sha256: hybridDigest(facts) }, null, output.json ? undefined : 2)}\n`);
         return 0;

package/dist/cli/memory-init-invocation.js

@@ -3,15 +3,22 @@ import { AppError } from "../shared/errors.js";
 import { hybridDigest } from "../services/hybrid-contracts.js";
 import { prepareCommandRoute } from "./command-inputs.js";
 const stages = new Set(["preflight", "discover", "compose", "verify", "review", "finish"]);
+const upgradeStages = new Set(["preflight", "diff-analysis", "upgrade", "verify", "review", "finish"]);
 function refuse(message) {
     throw new AppError("usage", message, 2, { phase: "prepare", effect: "no_effect" });
 }
 /** Pure invocation preparation. File bytes, stored replay and productive
  * authority remain with their existing owners; no ambient defaults here. */
 export function prepareMemoryInitInvocation(args) {
+    return prepareMemoryInvocation(args, "mb-init");
+}
+export function prepareMemoryUpgradeInvocation(args) {
+    return prepareMemoryInvocation(args, "mb-upgrade");
+}
+function prepareMemoryInvocation(args, flowId) {
     const route = prepareCommandRoute(args);
-    if (!["init", "flow mb-init"].includes(route.key))
-        refuse("Use init or flow mb-init");
+    if (!(flowId === "mb-init" ? ["init", "flow mb-init"] : ["upgrade", "flow mb-upgrade"]).includes(route.key))
+        refuse(`Use ${flowId === "mb-init" ? "init" : "upgrade"} or flow ${flowId}`);
     const options = route.parsed.options;
     const value = (name) => options.get(name)?.[0];
     const scope = { projectRoot: value("project-root"), workspaceRoot: value("workspace-root"), requestId: value("request-id") };
@@ -38,7 +45,7 @@ export function prepareMemoryInitInvocation(args) {
         execution.rootProfile = profile;
     for (const assignment of options.get("stage-profile") ?? []) {
         const at = assignment.indexOf("="), stage = assignment.slice(0, at), profile = assignment.slice(at + 1);
-        if (at < 1 || !stages.has(stage) || !profile.trim() || execution.stageProfiles?.[stage] !== undefined)
+        if (at < 1 || !(flowId === "mb-init" ? stages : upgradeStages).has(stage) || !profile.trim() || execution.stageProfiles?.[stage] !== undefined)
             refuse("--stage-profile requires a unique stage=profile assignment");
         (execution.stageProfiles ??= {})[stage] = profile;
     }