@deksden-com/dd-flow-cli 0.9.0-beta.144 → 0.9.0-beta.149

package/dist/services/external-work-launch.js

@@ -16,7 +16,7 @@ import { reviewExecutionCopyHash, reviewSourceFilter, reviewSourceHash, reviewSo
 import { workspaceGitFiles } from "./workspace-files.js";
 import { qualifyAgyHooks } from "../harness-runtime/lib/dd-agy-daemon.mjs";
 import { lifecycleRetryInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
-import { continueProviderCapacity } from "./provider-capacity.js";
+import { continueProviderCapacity, ownedProviderBoundary } from "./provider-capacity.js";
 import { errorRecord } from "./run-controller-state.js";
 import { readFlowRunExecutionBundle } from "./runs.js";
 import { stageWorkIds } from "./stage-work-graph.js";
@@ -79,7 +79,7 @@ export async function launchExternalWork(context, input) {
     catch { /* Legacy non-memory payload handling remains owned by the Work registry. */ }
     const repairWave = payload?.kind === "memory-repair" ? payload.memory_repair?.wave : undefined;
     if (payload?.kind === "memory-repair" && (payload.read_only !== false || ![1, 2].includes(repairWave ?? 0)
-        || bundle?.descriptor.descriptor.id !== "mb-init" || stage !== "review")) {
+        || (bundle?.descriptor.descriptor.id !== "mb-init" && bundle?.descriptor.descriptor.id !== "mb-upgrade") || stage !== "review")) {
         throw new AppError("memory_repair_launch_invalid", "Repair dispatch requires its registered memory review wave", 2, { phase: "prepare", effect: "no_effect" });
     }
     const repairScope = { projectRoot: run.project_root, runId: work.run_id, workId: work.work_id };
@@ -214,7 +214,9 @@ export async function launchExternalWork(context, input) {
                     if (reviewCopy && reviewSourceHash(run.workspace_root, reviewInputs, reviewBase) !== reviewCopy.source_sha256)
                         throw new AppError("read_only_input_changed", "Authoritative review workspace changed during capacity wait", 2);
                 },
-                decision: () => {
+                decision: (boundary) => {
+                    if (boundary && (!stage || !ownedProviderBoundary(context, { projectId: work.project_id, runId: work.run_id, stage, sessionId, generation, workId: work.work_id, scope: "work" }, boundary)))
+                        return "reconciliation_blocked";
                     const status = context.db.get("SELECT status FROM works WHERE work_id = ?", [work.work_id])?.status;
                     return status === "completed" ? "completed" : status === "paused" ? "paused" : "continue";
                 },

package/dist/services/flow-catalog.js

@@ -1,6 +1,7 @@
 import { vnextStages } from "../domain/stage-catalog.js";
-import { sdlcHandlerIdentities, memoryInitHandlerIdentities } from "../domain/stage-handler-identities.js";
+import { sdlcHandlerIdentities, memoryInitHandlerIdentities, memoryUpgradeHandlerIdentities } from "../domain/stage-handler-identities.js";
 import { AppError } from "../shared/errors.js";
+import { diagnosticFlowStages } from "../domain/diagnostic-flows.js";
 /** Engine-owned catalog, not descriptor discovery or permission to execute a RUN. */
 export function listBundledFlows() {
     return [
@@ -8,9 +9,17 @@ export function listBundledFlows() {
             stages: vnextStages.map(stage => ({ id: stage.id, directory: stage.directory,
                 entry_handler: sdlcHandlerIdentities[stage.id].entryId, finish_handler: sdlcHandlerIdentities[stage.id].finishId })),
             edges: vnextStages.flatMap(stage => stage.next.map((to, index) => ({ from: stage.id, to, on: index ? "not-applicable" : "accepted" }))) },
-        { id: "mb-init", handler_status: "registered", entry_stage: "preflight", terminal_stages: ["finish"],
-            stages: Object.values(memoryInitHandlerIdentities).map((handler, index) => ({ id: handler.stage, directory: `${String(index + 1).padStart(2, "0")}-${handler.stage}`, entry_handler: handler.entryId, finish_handler: handler.finishId })),
-            edges: ["preflight", "discover", "compose", "verify", "review"].flatMap((from, index) => [{ from, to: ["discover", "compose", "verify", "review", "finish"][index], on: "accepted" }, ...(from === "verify" ? [{ from, to: "review", on: "needs_repair" }] : [])]) }
+        ...[{ id: "mb-init", handlers: memoryInitHandlerIdentities }, { id: "mb-upgrade", handlers: memoryUpgradeHandlerIdentities }].map(({ id, handlers }) => {
+            const stages = Object.values(handlers);
+            return { id, handler_status: "registered", entry_stage: "preflight", terminal_stages: ["finish"],
+                stages: stages.map((handler, index) => ({ id: handler.stage, directory: `${String(index + 1).padStart(2, "0")}-${handler.stage}`, entry_handler: handler.entryId, finish_handler: handler.finishId })),
+                edges: stages.slice(0, -1).flatMap((handler, index) => [{ from: handler.stage, to: stages[index + 1].stage, on: "accepted" },
+                    ...(handler.stage === "verify" ? [{ from: handler.stage, to: "review", on: "needs_repair" }] : [])]) };
+        }),
+        ...Object.entries(diagnosticFlowStages).map(([id, stages]) => ({ id, handler_status: "registered", entry_stage: "preflight", terminal_stages: ["report"],
+            stages: stages.map((stage, index) => ({ id: stage, directory: `${String(index + 1).padStart(2, "0")}-${stage}`,
+                entry_handler: "diagnostic-stage-entry", finish_handler: "diagnostic-stage-finish" })),
+            edges: stages.slice(0, -1).map((from, index) => ({ from, to: stages[index + 1], on: "accepted" })) }))
     ];
 }
 export function showBundledFlow(id) {

package/dist/services/frozen-engine.js

@@ -11,8 +11,10 @@ import { hybridDigest } from "./hybrid-contracts.js";
 import { isMemoryInitResourceStorageFacts } from "./memory-init-resource-storage.js";
 import { memoryInitStartupInputSchemas } from "./memory-init-startup-custody.js";
 import { SETUP_STARTUP_MS } from "../harness-runtime/lib/setup-progress.mjs";
+import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
 function storageProbeRefuse(reason, probe) {
-    throw new AppError("frozen_engine_storage_incompatible", "Selected frozen engine cannot admit memory-init storage", 1, { reason, effect: "no_effect", ...(probe ? { probe } : {}) });
+    const summary = probe ? ` (${probe.error_code ?? probe.signal ?? `exit ${probe.status}`})` : "";
+    throw new AppError("frozen_engine_storage_incompatible", `Selected frozen engine cannot admit memory-flow storage${summary}`, 1, { reason, effect: "no_effect", ...(probe ? { probe } : {}) });
 }
 function probeFailure(result) {
     const code = result.error?.code ?? null;
@@ -75,6 +77,37 @@ export class AdmittedFrozenEngine {
             refuse("invalid_selection_identity");
         return AdmittedFrozenEngine.fromIdentity(identity, expectedManifestSha256);
     }
+    /** Physical relocation preserves the original manifest as provenance. It
+     * cannot authorize a different executable or different semantic metadata. */
+    static admitRelocation(binding, retained, expectedSha256, target) {
+        if (hash(retained) !== expectedSha256 || !shape("run-engine-binding", binding)
+            || !shape("run-engine-binding", target) || binding.run_id !== target.run_id)
+            refuse("invalid_relocation_identity");
+        const value = json(retained);
+        if (!shape("engine-manifest", value))
+            refuse("invalid_manifest_shape");
+        const original = value;
+        if (original.snapshot_root !== binding.engine.snapshot_root
+            || original.package_name !== binding.engine.package_name || original.package_version !== binding.engine.package_version
+            || original.engine_version !== binding.engine.engine_version || original.integrity.checksum !== binding.engine.integrity_checksum
+            || Object.entries(binding.engine).some(([key, value]) => key !== "snapshot_root" && value !== target.engine[key])) {
+            refuse("foreign_relocation_identity");
+        }
+        try {
+            const bytes = readBoundedReleaseFile(path.join(target.engine.snapshot_root, "engine.json"), 1024 * 1024);
+            const selected = AdmittedFrozenEngine.admit(target, hash(bytes));
+            const semantic = (manifest) => Object.fromEntries(Object.entries(manifest)
+                .filter(([key]) => !["snapshot_root", "package_root", "installed_at", "install_source"].includes(key)));
+            if (hybridDigest(semantic(original)) !== hybridDigest(semantic(selected.manifest())))
+                refuse("relocated_manifest_changed");
+            return selected;
+        }
+        catch (error) {
+            if (error instanceof AppError && error.code === "frozen_engine_invalid")
+                throw error;
+            return refuse("snapshot_unavailable_or_unreadable");
+        }
+    }
     static fromIdentity(identity, expectedManifestSha256) {
         try {
             const root = path.resolve(identity.snapshot_root);
@@ -119,8 +152,17 @@ export class AdmittedFrozenEngine {
     /** Qualify actual descriptor handlers in this immutable executable, not the
      * invoking CLI catalog. No storage or productive operation is admitted. */
     admitMemoryInitFlow(source, startupInputSchema) {
-        const fail = (reason, probe) => {
-            throw new AppError("frozen_engine_flow_incompatible", "Selected frozen engine cannot admit memory-init handlers", 1, { reason, phase: "prepare", effect: "no_effect", ...(probe ? { probe } : {}) });
+        return this.#admitMemoryFlow(source, "mb-init", startupInputSchema);
+    }
+    admitMemoryUpgradeFlow(source) {
+        return this.#admitMemoryFlow(source, "mb-upgrade");
+    }
+    admitDiagnosticFlow(source, flowId) {
+        return this.#admitMemoryFlow(source, flowId);
+    }
+    #admitMemoryFlow(source, flowId, startupInputSchema) {
+        const fail = (reason, details = {}) => {
+            throw new AppError("frozen_engine_flow_incompatible", `Selected frozen engine cannot admit ${flowId} handlers`, 1, { ...details, reason, phase: "prepare", effect: "no_effect" });
         };
         const revalidate = () => {
             try {
@@ -146,18 +188,25 @@ export class AdmittedFrozenEngine {
             ...(startupInputSchema === undefined ? {} : { startup_input_schema: startupInputSchema }) }));
         if (input.length > 64 * 1024 * 1024)
             fail("unbounded_source");
-        const expected = { schema_id: startupInputSchema === undefined ? "dd-flow/memory-init-engine-flow@1" : "dd-flow/memory-init-engine-flow@2",
+        const flow = source.resolveRegisteredFlow();
+        if (flow.descriptor.id !== flowId)
+            fail("foreign_flow_source");
+        const expected = { schema_id: isDiagnosticFlow(flowId) ? "dd-flow/diagnostic-engine-flow@1" : flowId === "mb-upgrade" ? "dd-flow/memory-upgrade-engine-flow@1"
+                : startupInputSchema === undefined ? "dd-flow/memory-init-engine-flow@1" : "dd-flow/memory-init-engine-flow@2",
             ...(startupInputSchema === undefined ? {} : { startup_input_schema: startupInputSchema }),
-            flow_id: "mb-init", source_sha256: source.sha256,
-            descriptor_sha256: source.descriptorReference().sha256, stages: source.resolveRegisteredFlow().descriptor.stages.map(stage => stage.id) };
+            flow_id: flowId, source_sha256: source.sha256,
+            descriptor_sha256: source.descriptorReference().sha256, stages: flow.descriptor.stages.map(stage => stage.id) };
         revalidate();
         const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["NODE_OPTIONS", "NODE_PATH"].includes(key) && !key.startsWith("DD_FLOW_")));
-        const result = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "flow", "admit", "--operation", "memory-init", "--json"], { input, cwd: this.#manifest.snapshot_root, env: { ...env, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
+        const started = performance.now();
+        const result = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "flow", "admit", "--operation", isDiagnosticFlow(flowId) ? flowId : flowId === "mb-init" ? "memory-init" : "memory-upgrade", "--json"], { input, cwd: this.#manifest.snapshot_root, env: { ...env, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
             // This is cold startup of a selected CLI, not an already-loaded handler.
             // Admission is bounded local validation; no provider operation is started.
             timeout: SETUP_STARTUP_MS, maxBuffer: 1024 * 1024, shell: false, windowsHide: true });
         if (result.error || result.signal || result.status !== 0)
-            fail("selected_engine_probe_failed", probeFailure(result));
+            fail("selected_engine_probe_failed", {
+                ...probeFailure(result), operation: flowId, elapsed_ms: Math.round(performance.now() - started), probe: probeFailure(result)
+            });
         revalidate();
         let response;
         try {
@@ -178,6 +227,91 @@ export class AdmittedFrozenEngine {
      * This qualifies storage connections only, not provider or flow readiness.
      */
     admitMemoryInitStorage(home, resourceHome) {
+        return this.admitMemoryStorage(home, resourceHome, "memory-init");
+    }
+    /** A distinct operation: old engines cannot accidentally claim support for
+     * upgrade request custody merely because init storage admission succeeds. */
+    admitMemoryUpgradeStorage(home, resourceHome) {
+        return this.admitMemoryStorage(home, resourceHome, "memory-upgrade");
+    }
+    /** Execute storage transition in this exact snapshot before AppContext opens
+     * a writer. A timeout or malformed acknowledgement never proves no effect. */
+    qualifyMemoryUpgradeStorage(home, resourceHome) {
+        const intact = () => hash(readBoundedReleaseFile(path.join(this.#manifest.snapshot_root, "engine.json"), 1024 * 1024)) === this.manifestSha256
+            && engineSnapshotChecksum(this.#manifest.snapshot_root) === this.#manifest.integrity.checksum;
+        if (!intact())
+            refuse("engine_changed_before_storage_qualification");
+        const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["NODE_OPTIONS", "NODE_PATH"].includes(key)));
+        const reply = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "storage", "qualify", "--operation", "memory-upgrade", "--json"], { env: { ...env, DD_FLOW_HOME: home, DD_FLOW_RESOURCE_HOME: resourceHome, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
+            encoding: "utf8", timeout: 120000, maxBuffer: 1024 * 1024, shell: false, windowsHide: true });
+        if (!intact())
+            refuse("engine_changed_during_storage_qualification");
+        if (reply.error || reply.signal || reply.status !== 0)
+            storageProbeRefuse("selected_engine_qualification_failed", { status: reply.status, signal: reply.signal });
+        let response;
+        try {
+            response = JSON.parse(reply.stdout);
+        }
+        catch {
+            return storageProbeRefuse("invalid_qualification_json");
+        }
+        const facts = response?.facts;
+        if (response?.ok !== true || response.action !== "runtime_storage_qualify" || facts?.schema_id !== "dd-flow/memory-upgrade-storage-capability@1"
+            || facts.operation !== "memory-upgrade" || !["verified-no-op", "migration"].includes(facts.route) || facts.productive_admission !== false
+            || hybridDigest(facts.source_stores) !== hybridDigest([path.join(home, "db.sqlite"), path.join(resourceHome, "runtime.sqlite")])
+            || response.sha256 !== hybridDigest(facts))
+            storageProbeRefuse("invalid_qualification_facts");
+        return { facts, sha256: response.sha256, engine_manifest_sha256: this.manifestSha256, engine_sha256: this.#manifest.integrity.checksum };
+    }
+    transitionMemoryUpgradeStorage(input) {
+        const intact = () => hash(readBoundedReleaseFile(path.join(this.#manifest.snapshot_root, "engine.json"), 1024 * 1024)) === this.manifestSha256
+            && engineSnapshotChecksum(this.#manifest.snapshot_root) === this.#manifest.integrity.checksum;
+        if (!intact())
+            refuse("engine_changed_before_storage_transition");
+        const args = ["runtime", "storage", "transition", "--action", input.action, "--project-root", input.scope.projectRoot,
+            "--workspace-root", input.scope.workspaceRoot, "--request-id", input.scope.requestId, "--selection-sha256", input.selectionSha256,
+            ...(input.expectedSha256 ? ["--expected-sha256", input.expectedSha256] : []), ...(input.recoveryId ? ["--recovery-id", input.recoveryId] : []),
+            ...(input.offline ? ["--offline"] : []), "--json"];
+        const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["NODE_OPTIONS", "NODE_PATH"].includes(key)));
+        const reply = spawnSync(this.nodeExecutable, [this.entrypoint, ...args], { env: { ...env, DD_FLOW_HOME: input.home, DD_FLOW_RESOURCE_HOME: input.resourceHome,
+                DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root }, encoding: "utf8", timeout: 120000, maxBuffer: 1024 * 1024, shell: false, windowsHide: true });
+        const fail = (reason, details = {}) => {
+            throw new AppError("frozen_engine_storage_transition_failed", "Observe or reconcile the original selected-engine storage request", 1, { reason, effect: "unknown", ...details });
+        };
+        let unchanged = false;
+        try {
+            unchanged = intact();
+        }
+        catch { /* Committed effects remain unknown if code custody is lost. */ }
+        if (!unchanged)
+            fail("engine_changed_during_storage_transition");
+        if (reply.error || reply.signal || reply.status !== 0) {
+            let child = {};
+            try {
+                child = JSON.parse(reply.stderr);
+            }
+            catch { /* Unknown acknowledgements retain unknown effect. */ }
+            fail("selected_engine_transition_failed", { status: reply.status, signal: reply.signal, error_code: reply.error?.code ?? null,
+                child_code: child.error?.code ?? null, child_reason: child.error?.details?.reason ?? null, effect: child.error?.details?.effect === "no_effect" ? "no_effect" : "unknown" });
+        }
+        let response;
+        try {
+            response = JSON.parse(reply.stdout);
+        }
+        catch {
+            return fail("invalid_transition_json");
+        }
+        if (!response || typeof response !== "object" || Array.isArray(response))
+            fail("invalid_transition_response");
+        const selected = response.engine;
+        if (response.ok !== true || response.action !== "runtime_storage_transition" || response.operation !== input.action
+            || !response.scope || typeof response.scope !== "object" || Array.isArray(response.scope)
+            || hybridDigest(response.scope) !== hybridDigest(input.scope) || response.selection_sha256 !== input.selectionSha256
+            || selected?.manifest_sha256 !== this.manifestSha256 || selected.sha256 !== this.#manifest.integrity.checksum)
+            fail("foreign_transition_acknowledgement");
+        return response;
+    }
+    admitMemoryStorage(home, resourceHome, operation) {
         for (const root of [home, resourceHome]) {
             if (!path.isAbsolute(root) || path.resolve(root) !== root || fs.realpathSync(root) !== root)
                 storageProbeRefuse("noncanonical_storage_home");
@@ -189,10 +323,13 @@ export class AdmittedFrozenEngine {
         };
         revalidateEngine();
         const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["NODE_OPTIONS", "NODE_PATH"].includes(key)));
-        const result = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "storage", "admit", "--operation", "memory-init", "--json"], { env: { ...env, DD_FLOW_HOME: home, DD_FLOW_RESOURCE_HOME: resourceHome, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
+        const started = performance.now();
+        const result = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "storage", "admit", "--operation", operation, "--json"], { env: { ...env, DD_FLOW_HOME: home, DD_FLOW_RESOURCE_HOME: resourceHome, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
             timeout: SETUP_STARTUP_MS, maxBuffer: 1024 * 1024, shell: false, windowsHide: true });
         if (result.error || result.signal || result.status !== 0)
-            storageProbeRefuse("selected_engine_probe_failed", probeFailure(result));
+            storageProbeRefuse("selected_engine_probe_failed", {
+                ...probeFailure(result), operation, elapsed_ms: Math.round(performance.now() - started)
+            });
         revalidateEngine();
         let response;
         try {
@@ -206,7 +343,7 @@ export class AdmittedFrozenEngine {
             storageProbeRefuse("invalid_probe_response");
         const facts = response.facts, run = facts?.run;
         if (!facts || Object.keys(facts).sort().join() !== "operation,outcome,resource,route,run,schema_id"
-            || facts.schema_id !== "dd-flow/memory-init-engine-storage@1" || facts.operation !== "memory-init"
+            || facts.schema_id !== `dd-flow/${operation}-engine-storage@1` || facts.operation !== operation
             || facts.route !== "verified-no-op" || facts.outcome !== "no-op" || response.sha256 !== hybridDigest(facts)
             || !isMemoryInitResourceStorageFacts(facts.resource) || facts.resource.store_path !== path.join(resourceHome, "runtime.sqlite")
             || !run || Object.keys(run).sort().join() !== "executing_writer_version,operation,outcome,route,schema_id,schema_sha256,store_dev,store_ino,store_kind,store_path"

package/dist/services/hook-memory-routing.js

@@ -0,0 +1,188 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-digest.js";
+import { assertRunMutationAllowed } from "./run-recovery-guard.js";
+function repairRefuse(reason) { throw new AppError("memory_repair_native_binding_invalid", "Native repair requires its actual direct-child Hook and independently owned copy", 1, { reason, effect: "no_effect" }); }
+function reviewRefuse(reason) { throw new AppError("memory_native_review_copy_invalid", "Native Memory review requires an independently owned immutable execution copy", 1, { reason, effect: "no_effect" }); }
+export function memoryReviewPhysicalDestination(runRoot, relative) {
+    if (fs.realpathSync(runRoot) !== path.resolve(runRoot) || !fs.lstatSync(runRoot).isDirectory())
+        reviewRefuse("noncanonical_run_root");
+    let current = runRoot;
+    for (const part of relative.split("/")) {
+        if (!part || part === "." || part === "..")
+            reviewRefuse("invalid_copy_path");
+        current = path.join(current, part);
+        const stat = fs.lstatSync(current, { throwIfNoEntry: false });
+        if (stat && !stat.isDirectory())
+            reviewRefuse("linked_or_non_directory_copy_path");
+        if (!stat)
+            break;
+    }
+}
+/** Hook ingress selects only an independently prepared repair copy. This
+ * establishes a command's assigned directory, not claim/repair authority. */
+export function memoryRepairAssignedHookCwd(context, input) {
+    const work = context.db.get("SELECT payload_json,result_schema,status FROM works WHERE project_id=? AND run_id=? AND work_id=?", [input.projectId, input.runId, input.workId]);
+    let payload;
+    try {
+        payload = JSON.parse(work?.payload_json ?? "null");
+    }
+    catch {
+        return null;
+    }
+    if (payload?.kind !== "memory-repair" && work?.result_schema !== "dd-flow/memory-repair-work-result@1")
+        return null;
+    const run = context.db.get("SELECT r.run_root,r.run_dir,r.flow_kind,p.root AS project_root FROM runs r JOIN projects p ON p.id=r.project_id WHERE r.project_id=? AND r.id=?", [input.projectId, input.runId]);
+    if (!run || (run.flow_kind !== "mb-init" && run.flow_kind !== "mb-upgrade") || run.project_root !== input.projectRoot || payload.read_only !== false
+        || ![1, 2].includes(payload.memory_repair?.wave ?? 0) || work?.result_schema !== "dd-flow/memory-repair-work-result@1")
+        repairRefuse("registered_memory_repair_required");
+    const generation = assertRunMutationAllowed(context, input.projectId, input.runId), runRoot = run.run_root ?? run.run_dir;
+    const external = context.db.get("SELECT 1 FROM sqlite_schema WHERE type='table' AND name='work_launches'")
+        ? context.db.get("SELECT operation_id,status,profile_json,profile_hash,provider_session_id FROM work_launches WHERE work_id=?", [input.workId]) : undefined;
+    const native = !external;
+    const admitted = (root) => {
+        if (native && input.observedCwd !== root && input.literalExecutionCwd !== root)
+            throw new AppError("memory_repair_native_copy_route_unavailable", "Native repair requires a genuinely observed child execution directory inside its owned writer copy", 1, { phase: "prepare", effect: "no_effect", recoverable: false, expected: root, actual: input.observedCwd ?? null,
+                next_action: "Use only a documented native child/tool capability that establishes this exact directory; otherwise stop and select external delegation in a new RUN." });
+        return { root, native };
+    };
+    if (work.status === "created") {
+        // Routing consumes registered copy custody only. Actual Work start owns
+        // physical source/copy/profile admission after the durable native Hook.
+        const rows = (eventType) => context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? LIMIT 2", [input.projectId, eventType, input.runId, input.workId, generation]);
+        const intents = rows("memory.repair_writer_copy_intent"), copies = rows("memory.repair_writer_copy_ready");
+        if (intents.length !== 1 || copies.length !== 1 || Buffer.byteLength(intents[0].payload_json) > 1024 * 1024
+            || Buffer.byteLength(copies[0].payload_json) > 12 * 1024 * 1024)
+            repairRefuse("owned_ready_copy_required");
+        try {
+            const intent = JSON.parse(intents[0].payload_json), ready = JSON.parse(copies[0].payload_json);
+            const workspace_manifest_sha256 = ready.workspace_manifest_sha256, readyIntent = { ...ready };
+            delete readyIntent.workspace_manifest_sha256;
+            delete readyIntent.workspace_manifest_base64;
+            const relative = `works/${input.workId}/writer-workspaces/generation-${generation}`;
+            if (intent.schema_id !== "dd-flow/memory-repair-writer-copy-intent@1" || intent.project_id !== input.projectId || intent.run_id !== input.runId
+                || intent.work_id !== input.workId || intent.generation !== generation || intent.run_root !== runRoot || !path.isAbsolute(runRoot)
+                || intent.copy_relative !== relative || !/^[a-f0-9]{64}$/.test(intent.baseline_registration_sha256)
+                || !/^[a-f0-9]{64}$/.test(workspace_manifest_sha256) || hybridDigest(readyIntent) !== hybridDigest(intent))
+                repairRefuse("owned_ready_copy_required");
+            if (external) {
+                if (external.provider_session_id !== input.providerSessionId)
+                    repairRefuse("foreign_physical_session");
+                const profile = JSON.parse(external.profile_json), metadata = profile.memory_repair_copy;
+                if (profile.delegation?.mode !== "external" || hybridDigest(metadata) !== hybridDigest({ root: relative, copy_intent_sha256: hybridDigest(intent),
+                    workspace_manifest_sha256, baseline_registration_sha256: intent.baseline_registration_sha256 }))
+                    repairRefuse("native_copy_cwd_mismatch");
+            }
+            if (fs.realpathSync(runRoot) !== path.resolve(runRoot))
+                repairRefuse("owned_ready_copy_required");
+            let destination = runRoot;
+            for (const part of relative.split('/')) {
+                destination = path.join(destination, part);
+                if (!fs.lstatSync(destination).isDirectory())
+                    repairRefuse("owned_ready_copy_required");
+            }
+            return admitted(destination);
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return repairRefuse("owned_ready_copy_required");
+        }
+    }
+    // Running writers retain their committed directory, not today's source bytes.
+    let binding = external;
+    let nativeStart;
+    if (!binding) {
+        const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='memory.repair_native_binding' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? LIMIT 2", [input.projectId, input.runId, input.workId]);
+        if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 1024 * 1024)
+            repairRefuse("native_registered_start_changed");
+        try {
+            const retained = JSON.parse(rows[0].payload_json);
+            if (retained.schema_id !== "dd-flow/memory-repair-native-binding@1" || retained.project_id !== input.projectId || retained.run_id !== input.runId || retained.work_id !== input.workId
+                || typeof retained.work_session_id !== "string" || typeof retained.hook_event_key !== "string")
+                repairRefuse("native_registered_start_changed");
+            binding = retained.binding;
+            nativeStart = retained;
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return repairRefuse("native_registered_start_changed");
+        }
+    }
+    const starts = context.db.all("SELECT ws.id,ws.hook_event_id,ws.start_receipt_json FROM work_sessions ws JOIN sessions s ON s.project_id=? AND s.session_id=ws.session_id WHERE ws.work_id=? AND ws.status='running' AND s.run_id=? AND s.worker_id=? AND s.provider_session_id=? LIMIT 2", [input.projectId, input.workId, input.runId, input.workId, input.providerSessionId]);
+    if (work.status !== "running" || !binding || binding.provider_session_id !== input.providerSessionId || starts.length !== 1)
+        repairRefuse("native_registered_start_changed");
+    if (nativeStart && (nativeStart.work_session_id !== starts[0].id || nativeStart.hook_event_key !== starts[0].hook_event_id
+        || binding.operation_id !== `native-hook:${nativeStart.hook_event_key}`
+        || !context.db.get("SELECT 1 FROM hook_events WHERE project_id=? AND event_key=? AND status='claimed' AND provider_session_id=?", [input.projectId, nativeStart.hook_event_key, input.providerSessionId])))
+        repairRefuse("native_registered_start_changed");
+    try {
+        const text = starts[0].start_receipt_json;
+        if (typeof text !== "string" || Buffer.byteLength(text) > 16 * 1024 * 1024)
+            repairRefuse("native_registered_start_changed");
+        const start = JSON.parse(text), packet = JSON.parse(start.context), profile = JSON.parse(binding.profile_json), metadata = profile.memory_repair_copy;
+        if (profile.delegation?.mode !== (native ? "native" : "external") || start.version !== 2 || createHash("sha256").update(start.context).digest("hex") !== start.context_sha256
+            || typeof metadata?.root !== "string" || metadata.root !== `works/${input.workId}/writer-workspaces/generation-${start.generation}`
+            || packet.work_id !== input.workId || packet.run_id !== input.runId || packet.workspace_root !== path.join(runRoot, metadata.root)
+            || packet.memory_repair_input?.provider_session_id !== input.providerSessionId
+            || packet.memory_repair_input?.launch_operation_id !== binding.operation_id)
+            repairRefuse("native_registered_start_changed");
+        return admitted(packet.workspace_root);
+    }
+    catch (error) {
+        if (error instanceof AppError)
+            throw error;
+        return repairRefuse("native_registered_start_changed");
+    }
+}
+/** Routing is not fresh source admission: an already claimed reviewer retains
+ * its committed private directory even after a later correction changes MB. */
+export function memoryNativeReviewAssignedHookCwd(context, input) {
+    const work = context.db.get("SELECT status,payload_json FROM works WHERE project_id=? AND run_id=? AND work_id=?", [input.projectId, input.runId, input.workId]);
+    const payload = JSON.parse(work?.payload_json ?? "null");
+    if (payload?.kind !== "memory-review" || payload.read_only !== true)
+        return null;
+    const ready = context.db.get("SELECT 1 FROM audit_events WHERE project_id=? AND event_type='memory.native_review_copy_ready' AND json_extract(payload_json,'$.intent.run_id')=? AND json_extract(payload_json,'$.intent.work_id')=?", [input.projectId, input.runId, input.workId]);
+    if (!ready)
+        return null;
+    if (work?.status === "created") {
+        // Hook ingress routes an already allocated copy. Source admission belongs
+        // to the actual work-start owner, not a second physical graph in the Hook.
+        const generation = assertRunMutationAllowed(context, input.projectId, input.runId);
+        const run = context.db.get("SELECT run_root,run_dir FROM runs WHERE project_id=? AND id=?", [input.projectId, input.runId]);
+        if (!run)
+            reviewRefuse("owned_run_required");
+        const rows = (event) => context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND COALESCE(json_extract(payload_json,'$.run_id'),json_extract(payload_json,'$.intent.run_id'))=? AND COALESCE(json_extract(payload_json,'$.work_id'),json_extract(payload_json,'$.intent.work_id'))=? AND COALESCE(json_extract(payload_json,'$.generation'),json_extract(payload_json,'$.intent.generation'))=? LIMIT 2", [input.projectId, event, input.runId, input.workId, generation]);
+        const intents = rows("memory.native_review_copy_intent"), copies = rows("memory.native_review_copy_ready");
+        if (intents.length !== 1 || copies.length !== 1)
+            reviewRefuse("registered_copy_required");
+        const intent = JSON.parse(intents[0].payload_json), copy = JSON.parse(copies[0].payload_json);
+        const relative = `works/${input.workId}/native-review-workspaces/generation-${generation}`, runRoot = run.run_root ?? run.run_dir;
+        if (intent.schema_id !== "dd-flow/memory-native-review-copy@1" || intent.project_id !== input.projectId || intent.run_id !== input.runId
+            || intent.work_id !== input.workId || intent.generation !== generation || intent.root !== relative
+            || !/^[a-f0-9]{64}$/.test(intent.input_sha256) || !/^[a-f0-9]{64}$/.test(intent.source_sha256)
+            || hybridDigest(copy.intent) !== hybridDigest(intent) || !/^[a-f0-9]{64}$/.test(copy.sha256))
+            reviewRefuse("registered_copy_changed");
+        memoryReviewPhysicalDestination(runRoot, relative);
+        const root = path.join(runRoot, relative);
+        if (!fs.lstatSync(root, { throwIfNoEntry: false })?.isDirectory())
+            reviewRefuse("registered_copy_required");
+        return root;
+    }
+    const rows = context.db.all("SELECT ws.start_receipt_json,r.run_root,r.run_dir,s.cwd FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN runs r ON r.project_id=w.project_id AND r.id=w.run_id JOIN sessions s ON s.project_id=w.project_id AND s.session_id=ws.session_id WHERE w.project_id=? AND w.run_id=? AND w.work_id=? AND s.provider_session_id=? AND s.worker_id=w.work_id AND EXISTS(SELECT 1 FROM audit_events a WHERE a.project_id=w.project_id AND a.event_type='memory.native_review_binding' AND json_extract(a.payload_json,'$.work_session_id')=ws.id AND json_extract(a.payload_json,'$.run_id')=w.run_id AND json_extract(a.payload_json,'$.work_id')=w.work_id) LIMIT 2", [input.projectId, input.runId, input.workId, input.providerSessionId]);
+    if (rows.length !== 1)
+        reviewRefuse("registered_session_required");
+    const row = rows[0];
+    if (typeof row.start_receipt_json !== "string" || Buffer.byteLength(row.start_receipt_json) > 16 * 1024 * 1024)
+        reviewRefuse("registered_copy_required");
+    const receipt = JSON.parse(row.start_receipt_json), packet = JSON.parse(receipt.context);
+    const relative = `works/${input.workId}/native-review-workspaces/generation-${receipt.generation}`, root = path.join(row.run_root ?? row.run_dir, relative);
+    if (receipt.version !== 2 || createHash("sha256").update(receipt.context).digest("hex") !== receipt.context_sha256
+        || packet.work_id !== input.workId || packet.run_id !== input.runId || packet.workspace_root !== root
+        || packet.review_copy?.root !== relative || row.cwd !== root)
+        reviewRefuse("registered_copy_changed");
+    return root;
+}

package/dist/services/hook-recovery-guard.js

@@ -0,0 +1,14 @@
+import { AppError } from "../shared/errors.js";
+import { assertRunMutationAllowed } from "./run-recovery-guard.js";
+/** A recovered RUN never grants the retired process a new execution segment. */
+export function assertRecoveryHookCurrent(context, projectId, runId, identity) {
+    const generation = assertRunMutationAllowed(context, projectId, runId);
+    if (!generation)
+        return;
+    const current = identity.daemonId && context.db.get("SELECT b.recovery_id FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND g.run_id = ? AND g.generation = ? AND g.status = 'recovered' AND b.status = 'accepted' AND b.daemon_id = ? LIMIT 1", [projectId, runId, generation, identity.daemonId]);
+    if (current)
+        return;
+    const retired = identity.daemonId && (context.db.get(`SELECT ws.id FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id JOIN hook_events he ON he.project_id = w.project_id AND he.event_key = ws.hook_event_id WHERE w.project_id = ? AND w.run_id = ? AND he.daemon_id = ? LIMIT 1`, [projectId, runId, identity.daemonId]) || context.db.get("SELECT b.recovery_id FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND g.run_id = ? AND b.daemon_id = ? AND (g.generation <> ? OR b.status = 'abandoned') LIMIT 1", [projectId, runId, identity.daemonId, generation]));
+    if (!identity.daemonId || retired)
+        throw new AppError("recovery_daemon_stale", "Lifecycle receipt belongs to an unidentified or retired recovery daemon", 1, { run_id: runId, generation, daemon_id: identity.daemonId });
+}

package/dist/services/hook-session-observation.js

@@ -0,0 +1,24 @@
+export function recordFlowSessionObservation(context, input) {
+    const duplicate = context.db.get("SELECT id FROM flow_session_segments WHERE project_id = ? AND event_key = ?", [input.projectId, input.eventKey]);
+    if (duplicate)
+        return { changed: false, segment_id: duplicate.id };
+    const open = context.db.get(`SELECT id, run_id, protocol_id FROM flow_session_segments
+     WHERE project_id = ? AND session_id = ? AND ended_at IS NULL ORDER BY started_at DESC, id DESC LIMIT 1`, [input.projectId, input.sessionId]);
+    const now = context.now();
+    const runId = input.runId === undefined ? open?.run_id ?? null : input.runId;
+    const protocolId = input.protocolId === undefined ? open?.protocol_id ?? null : input.protocolId;
+    if (open && open.run_id === runId && open.protocol_id === protocolId) {
+        return { changed: false, segment_id: open.id };
+    }
+    if (open)
+        context.db.run("UPDATE flow_session_segments SET ended_at = ? WHERE id = ? AND ended_at IS NULL", [now, open.id]);
+    const result = context.db.run(`INSERT INTO flow_session_segments
+      (project_id, session_id, run_id, protocol_id, started_at, ended_at, cwd, tool_name, event_key)
+     VALUES (?, ?, ?, ?, ?, NULL, ?, ?, ?)`, [input.projectId, input.sessionId, runId, protocolId, now, input.cwd ?? null, input.toolName ?? null, input.eventKey]);
+    return { changed: true, segment_id: Number(result.lastInsertRowid) };
+}
+export function activeFlowSessionsForProject(context, projectId) {
+    return context.db.all(`SELECT * FROM sessions
+     WHERE project_id = ? AND status IN ('pending', 'active', 'waiting_user', 'blocked', 'stopping')
+     ORDER BY updated_at DESC`, [projectId]);
+}

package/dist/services/hooks.js

@@ -9,15 +9,15 @@ import { parseJsonObject } from "../shared/json.js";
 import { canonicalPath, ensureDir, resolveProjectRoot } from "../storage/paths.js";
 import { resolveWorkReference } from "../storage/work-references.js";
 import { appendAudit } from "./audit.js";
-import { memoryRepairAssignedHookCwd } from "./memory-repair-physical-binding.js";
-import { memoryNativeReviewAssignedHookCwd } from "./memory-native-review-copy.js";
+import { memoryRepairAssignedHookCwd, memoryNativeReviewAssignedHookCwd } from "./hook-memory-routing.js";
 import { prepareTextFile, prepareJsonText, prepareError } from "../cli/input-preparation.js";
+import { nativeHookNonParticipation } from "../cli/native-hook-preparation.js";
 import { nativeSessionIdentity, storageSessionId } from "./session-identity.js";
-import { assertRecoveryHookCurrent } from "./run-recovery.js";
+import { assertRecoveryHookCurrent } from "./hook-recovery-guard.js";
 import { observeLifecycleInvocation, observedLifecycleInvocation, managedNativeInvocationScope } from "./lifecycle-invocations.js";
 import { commandHasOption, commandOption, commandPosition, shellSuffixOffset, parseLifecycleCommand, lifecycleCommandFromPayload, continuationCommand } from "./lifecycle-command.js";
-import { registerProject, requireProjectByRoot } from "./projects.js";
-import { activeFlowSessionsForProject, recordFlowSessionObservation } from "./sessions.js";
+import { registerProject, requireProjectByRoot } from "./project-registry.js";
+import { activeFlowSessionsForProject, recordFlowSessionObservation } from "./hook-session-observation.js";
 const defaultProfileName = "default";
 const maxSanitizedSummaryLength = 1600;
 function lifecycleObservationResult(receipt) {
@@ -496,6 +496,9 @@ function codexNativeParentId(payload, childId) {
 /** Qualified ACP admission binds public commands to an exact issued assignment.
  * Its provenance is an observation, never a synchronous PreToolUse assertion. */
 export function handleZcodeEvent(context, input) {
+    const unrelated = nativeHookNonParticipation(["zcode", "event"], input.stdin);
+    if (unrelated)
+        return unrelated;
     const notification = parseJsonObject(input.stdin || "{}", "zcode ACP notification");
     const params = objectRecord(notification.params), update = objectRecord(params.update);
     if (notification.method !== "session/update" || update.sessionUpdate !== "tool_call")
@@ -523,6 +526,9 @@ export function handleZcodeEvent(context, input) {
  * admission; the native hook must not create a competing receipt for them.
  */
 export function handleZcodeHook(context, input) {
+    const unrelated = nativeHookNonParticipation(["zcode", "hook"], input.stdin);
+    if (unrelated)
+        return unrelated;
     return recordZcodeLifecycle(context, input, undefined, true);
 }
 function recordZcodeLifecycle(context, input, invocationId, nativePreTool = false) {
@@ -631,6 +637,9 @@ function recordZcodeLifecycle(context, input, invocationId, nativePreTool = fals
 }
 /** Convert a Grok Build PreToolUse hook into a trusted lifecycle receipt. */
 export function handleGrokEvent(context, input) {
+    const unrelated = nativeHookNonParticipation(["grok", "event"], input.stdin);
+    if (unrelated)
+        return unrelated;
     const hook = parseJsonObject(input.stdin || "{}", "Grok Build hook event");
     const eventName = stringValue(hook.hook_event_name) ?? stringValue(hook.hookEventName);
     if (eventName && eventName !== "PreToolUse" && eventName !== "pre_tool_use") {
@@ -703,6 +712,9 @@ export function handleGrokEvent(context, input) {
 }
 /** Convert a controlled OpenCode tool hook into the shared lifecycle receipt. */
 export function handleOpenCodeEvent(context, input) {
+    const unrelated = nativeHookNonParticipation(["opencode", "event"], input.stdin);
+    if (unrelated)
+        return unrelated;
     const event = parseJsonObject(input.stdin || "{}", "OpenCode tool event");
     if (event.schema_id !== "dd-flow/opencode-tool-event@1")
         throw new AppError("unsupported_opencode_event_schema", "Unsupported OpenCode event schema", 1);
@@ -710,6 +722,9 @@ export function handleOpenCodeEvent(context, input) {
 }
 /** Accept adapter-observed Factory identity, never a model-supplied Session ID. */
 export function handleDroidEvent(context, input) {
+    const unrelated = nativeHookNonParticipation(["droid", "event"], input.stdin);
+    if (unrelated)
+        return unrelated;
     const event = parseJsonObject(input.stdin || "{}", "Droid tool event");
     if (event.schema_id !== "dd-flow/droid-tool-event@1")
         throw new AppError("unsupported_droid_event_schema", "Unsupported Droid event schema", 1);
@@ -935,6 +950,9 @@ function handleControlledToolEvent(context, input, event, harness) {
 }
 /** Convert an Antigravity CLI tool hook into the shared lifecycle receipt. */
 export function handleAgyEvent(context, input) {
+    const unrelated = nativeHookNonParticipation(["agy", "event"], input.stdin);
+    if (unrelated)
+        return unrelated;
     const event = parseJsonObject(input.stdin || "{}", "Antigravity tool event");
     if (event.schema_id !== "dd-flow/agy-tool-event@1")
         throw new AppError("unsupported_agy_event_schema", "Unsupported Antigravity event schema", 1);
@@ -1493,9 +1511,10 @@ function hookEntry(matcher, command, statusMessage) {
 }
 function commandHook(command, statusMessage) {
     // Hook admission is synchronous (the CLI must see a committed receipt), but
-    // the old 5s budget was shorter than a cold CLI/store open under fan-out.
-    // Startup owns migrations; this budget only covers the bounded hot path.
-    return { type: "command", command, timeout: 30, statusMessage };
+    // Admission keeps its own shared 20s deadline. Leave separate headroom for
+    // the shell, cold CLI imports and bounded subprocess cleanup: the host must
+    // not kill the hook before it can report its typed admission failure.
+    return { type: "command", command, timeout: 60, statusMessage };
 }
 function hookCommand(event) {
     const args = `codex hook handle --event ${event} --json`;