@deksden-com/dd-flow-cli 0.9.0-beta.152 → 0.9.0-beta.155

package/dist/services/check-runner-evidence.js

@@ -273,6 +273,51 @@ export function readRunnerEvidenceDetailed(root, contract, binding) {
     });
 }
 export function readRunnerEvidence(root, contract, binding) { return readRunnerEvidenceDetailed(root, contract, binding).evidence; }
+/** Semantic attribution is diagnostic information, never permission to investigate a failed check. */
+export const checkDiagnosisPolicy = "settled-failure@1";
+export function checkDiagnosisDisposition(receipt) {
+    if (receipt.status === "running"
+        || receipt.execution_failures?.some(failure => ["cleanup_unconfirmed", "engine_outcome_unbound"].includes(failure.code)))
+        return "settlement_required";
+    if (!["passed", "failed", "aborted"].includes(receipt.status))
+        return "invalid_binding";
+    // Caller supplies the SQL-owned receipt, never a proposed runner report.
+    // Missing, malformed or foreign optional reports are diagnostic failures;
+    // they cannot change receipt ownership or grant a successful check.
+    if (receipt.status === "passed")
+        return "passed";
+    // New launchers record physical settlement even for spawn errors/signals.
+    // Historical aborted receipts with no such proof must first reconcile.
+    if (!receipt.execution_failures?.some(failure => failure.code === "check_execution_settled") && !Number.isSafeInteger(receipt.exit_code))
+        return "settlement_required";
+    return "diagnosis_required";
+}
+export function assertCheckDiagnosisEligible(receipts, _workspaceRoot) {
+    const dispositions = receipts.map(receipt => ({ check_receipt_id: receipt.id, disposition: checkDiagnosisDisposition(receipt) }));
+    if (!receipts.length || dispositions.some(item => item.disposition !== "diagnosis_required"))
+        throw new AppError("check_gate_blocked", "Check diagnosis requires owned, physically settled failed executions", 2, {
+            failures: receipts, dispositions, outcome: "blocked", recoverable: false,
+            instruction: "Reconcile any running or unknown check process before changing its workspace. Do not treat a foreign receipt or an agent report as proof of completion."
+        });
+}
+/** Human-readable retained facts; tool output remains data, never instructions. */
+export function checkDiagnosisSummary(receipt, workspaceRoot) {
+    const available = (file) => {
+        try {
+            fs.accessSync(file, fs.constants.R_OK);
+            return fs.statSync(file).isFile() ? file : `${file} (not a regular file)`;
+        }
+        catch {
+            return `${file} (unavailable; investigate the missing diagnostic, do not invent its content)`;
+        }
+    };
+    return [`Check: ${receipt.id}`, `Command: ${receipt.command}`, `cwd: ${workspaceRoot}`,
+        `Outcome: ${receipt.status}; exit: ${receipt.exit_code ?? "unavailable"}; epoch: ${receipt.verification_epoch}`,
+        `Receipt: ${available(receipt.receipt_path)}`, `stdout: ${available(receipt.stdout_path)}`, `stderr: ${available(receipt.stderr_path)}`,
+        `Execution facts: ${JSON.stringify(receipt.execution_failures ?? [])}`,
+        `Report: ${receipt.runner_evidence_required?.path ? path.join(path.dirname(receipt.receipt_path), "artifacts", receipt.runner_evidence_required.path) : "not declared"}`].join("\n");
+}
+/** Historical attribution reader only. New repair routing uses checkDiagnosisDisposition. */
 export function checkRepairDisposition(receipt) {
     if (receipt.fingerprint_scope != null && receipt.fingerprint_scope !== "check_inputs")
         return "tooling_blocker";
@@ -297,11 +342,3 @@ export function checkRepairDisposition(receipt) {
         return "unclassified";
     return "source_repair";
 }
-export function assertSourceRepairEligible(receipts, workspaceRoot) {
-    const dispositions = receipts.map(receipt => {
-        const drift = workspaceRoot !== undefined && !currentCandidateLibraryInputsValid(receipt, workspaceRoot);
-        return { check_receipt_id: receipt.id, disposition: drift ? "tooling_blocker" : checkRepairDisposition(receipt), ...(drift ? { reason: "candidate_library_inputs_changed" } : {}) };
-    });
-    if (!receipts.length || dispositions.some(item => item.disposition !== "source_repair"))
-        throw new AppError("check_gate_blocked", "Checks require tooling diagnosis or settlement before product repair; retained nonzero is not a candidate-source verdict", 2, { failures: receipts, dispositions, outcome: "blocked", recoverable: false, instruction: "Inspect retained runner evidence. Do not change product code to repair tooling, unknown observation or unclassified failure. Retry only after establishing and correcting the cause." });
-}

package/dist/services/cli-operation-classifier.js

@@ -89,6 +89,10 @@ function isReadOnlyDiagnostic(family, command, action) {
         return ["status", "ls", "show"].includes(command ?? "");
     if (family === "stage")
         return command === "fanout" && action === "status";
+    if (family === "interactive")
+        return command === "inputs" || command === "git-inputs";
+    if (family === "delivery")
+        return command === "inputs";
     if (family === "lane") {
         return (command === "status" ||
             command === "waiters" ||
@@ -108,7 +112,8 @@ function isReadOnlyDiagnostic(family, command, action) {
     if (family === "dashboard")
         return command === "data" || command === "open";
     if (family === "memory")
-        return command === "permissions" && action === "preflight";
+        return command === "permissions" && action === "preflight" || command === "distill" && action === "inputs"
+            || command === "fix" && ["context", "scope"].includes(action ?? "");
     if (family === "codex" && command === "hooks")
         return action === "print" || action === "status";
     if (family === "codex" && command === "home")

package/dist/services/code-checks.js

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
-import { candidateAbsencesValid, candidateFailureAbsences, candidateFailureFiles, candidateLibraryInputs, candidateLibraryInputsValid, currentCandidateLibraryInputsValid, checkRepairDisposition, readRunnerEvidence, readRunnerEvidenceDetailed, readRunnerProgress, runnerContractsValid, runnerEvidencePass, runnerObservationDurations, runnerProofArtifacts } from "./check-runner-evidence.js";
-export { assertSourceRepairEligible, checkRepairDisposition } from "./check-runner-evidence.js";
+import { candidateAbsencesValid, candidateFailureAbsences, candidateFailureFiles, candidateLibraryInputs, candidateLibraryInputsValid, currentCandidateLibraryInputsValid, checkDiagnosisDisposition, readRunnerEvidence, readRunnerEvidenceDetailed, readRunnerProgress, runnerContractsValid, runnerEvidencePass, runnerObservationDurations, runnerProofArtifacts } from "./check-runner-evidence.js";
+export { assertCheckDiagnosisEligible, checkDiagnosisDisposition, checkRepairDisposition } from "./check-runner-evidence.js";
 import { isGitlessWorkspace, ownedWorkspaceHookPath, projectServicePathFilter, workspaceGitFiles } from "./workspace-files.js";
 import { spawn, spawnSync } from "node:child_process";
 import { ObservationClock, validateObservationDuration } from "../harness-runtime/lib/observation-clock.mjs";
@@ -352,14 +352,16 @@ export class PreparedCheckEvidence {
                     candidates: receipts.filter(item => item.scope === input.scope && item.work_id === (input.workId ?? null))
                         .slice(-16).map(item => ({ id: item.id, input_hash: item.input_hash, profile_hash: item.profile_hash }))
                 });
-            if (!checkReceiptEvidenceValidForMode(bindReceipt(receipt, group), input.mode) || !currentCandidateLibraryInputsValid(receipt, input.workspaceRoot))
+            if (!checkReceiptEvidenceValidForMode(bindReceipt(receipt, group), input.mode) || input.mode !== "diagnostic" && !currentCandidateLibraryInputsValid(receipt, input.workspaceRoot))
                 fail();
             passed = passed && receipt.status === "passed";
-            for (const artifact of receipt.artifacts)
+            const availableArtifacts = input.mode === "diagnostic" ? availableDiagnosticArtifacts(receipt) : receipt.artifacts;
+            for (const artifact of availableArtifacts)
                 artifacts.push({ root: "run", path: path.relative(input.runHome, path.join(path.dirname(receipt.receipt_path), "artifacts", artifact.path)).split(path.sep).join("/"), sha256: artifact.sha256 });
             const bytes = fs.readFileSync(receipt.receipt_path);
-            completions.push({ root: "run", path: path.relative(input.runHome, receipt.completion_path).split(path.sep).join("/"), sha256: crypto.createHash("sha256").update(fs.readFileSync(receipt.completion_path)).digest("hex") });
-            if (receipt.input_manifest)
+            if (input.mode !== "diagnostic" || fs.existsSync(receipt.completion_path))
+                completions.push({ root: "run", path: path.relative(input.runHome, receipt.completion_path).split(path.sep).join("/"), sha256: crypto.createHash("sha256").update(readBoundedReleaseFile(receipt.completion_path, 1024 * 1024)).digest("hex") });
+            if (receipt.input_manifest && (input.mode !== "diagnostic" || fs.existsSync(path.join(path.dirname(receipt.receipt_path), receipt.input_manifest.path))))
                 completions.push({ root: "run", path: path.relative(input.runHome, path.join(path.dirname(receipt.receipt_path), receipt.input_manifest.path)).split(path.sep).join("/"), sha256: receipt.input_manifest.sha256 });
             return { id: receipt.id, path: receipt.receipt_path, sha256: crypto.createHash("sha256").update(bytes).digest("hex") };
         });
@@ -562,7 +564,7 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation, s
         const snapshot = workspaceState(input.workspaceRoot, [input.runHome]);
         const group = groups.find(candidate => candidate.declarations.some(check => check.run_at === predecessor.gate)
             && (checkInputHash(input.workspaceRoot, { ...candidate, gate: predecessor.gate }, profileHash, workspaceInputFingerprint(input.workspaceRoot, snapshot.files, candidate.inputs, [input.runHome]), input.evidenceContext, input.checkEnvironment) === predecessor.input_hash
-                || sourceRepairContractMatches(predecessor, candidate, profileHash)
+                || diagnosisRetryContractMatches(predecessor, candidate, profileHash, checkInputHash(input.workspaceRoot, { ...candidate, gate: predecessor.gate }, profileHash, "", input.evidenceContext, input.checkEnvironment, false), checkInputHash(input.workspaceRoot, { ...candidate, gate: predecessor.gate }, profileHash, "", input.evidenceContext, input.checkEnvironment))
                 || input.retryReason === "check_inputs_changed" && staleRetryContractMatches(predecessor, candidate, profileHash, input)));
         if (!group || retries.has(group))
             throw new AppError("retry_check_invalid", "Retry must match exactly one current execution contract", 2, { check_receipt_id: receiptId });
@@ -579,7 +581,9 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation, s
         const inputFingerprint = inputFilesFingerprint(inputFiles);
         const inputHash = checkInputHash(input.workspaceRoot, group, profileHash, inputFingerprint, input.evidenceContext, input.checkEnvironment);
         const epoch = crypto.createHash("sha256").update(`${group.gate}\0${inputFingerprint}`).digest("hex");
-        const executionContractHash = checkInputHash(input.workspaceRoot, group, profileHash, "", input.evidenceContext, input.checkEnvironment);
+        // Retry preserves the declared check/wave, not the failed conditions being
+        // corrected. Observed environment still participates in inputHash/PASS reuse.
+        const executionContractHash = checkInputHash(input.workspaceRoot, group, profileHash, "", input.evidenceContext, input.checkEnvironment, false);
         const reservationInput = { ...input, retryReceiptIds: retries.has(group) ? [retries.get(group)] : [], generation, group, before, inputFiles, inputFingerprint, executionContractHash, profileHash, inputHash, epoch, startedAt };
         delete reservationInput.retryReceiptId;
         const decision = reserveOrReuseReceipt(context, reservationInput);
@@ -592,6 +596,7 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation, s
         const { id, evidenceDir, stdoutPath, stderrPath, receiptPath, completionPath } = reserved;
         let resources = {};
         let result = { exitCode: null, error: "check did not start", aborted: true };
+        let dispatched = false, physicallySettled = false;
         try {
             fs.mkdirSync(evidenceDir, { recursive: true });
             retainInputManifest(context, reserved);
@@ -624,6 +629,7 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation, s
                 const runnerEnvironment = group.runnerEvidence ? { DD_FLOW_CHECK_RUNNER_EVIDENCE_PATH: path.join(evidenceDir, group.runnerEvidence.path), DD_FLOW_CHECK_RUNNER_PROGRESS_PATH: path.join(evidenceDir, "runner-progress.jsonl"), DD_FLOW_CHECK_INVOCATION_ID: id, DD_FLOW_CHECK_ID: id, DD_FLOW_CHECK_INPUT_HASH: inputHash, DD_FLOW_CHECK_VERIFICATION_EPOCH: epoch } : {};
                 if (group.runnerEvidence)
                     fs.mkdirSync(path.dirname(path.join(evidenceDir, group.runnerEvidence.path)), { recursive: true });
+                dispatched = true;
                 result = await runCheck(group.command, input.workspaceRoot, { ...codeExecutionEnvironment(input.workspaceRoot, input.checkEnvironment), ...browserCheckCapabilityEnvironment(context, input.runId, input.runHome), DD_FLOW_EVIDENCE_DIR: evidenceDir, DD_FLOW_CHECK_COMPLETION_FILE: completionPath, ...runnerEnvironment, ...portEnvironment(resources) }, stdout, stderr, (elapsed) => input.progress?.(`check ${index + 1}/${groups.length} still running (${elapsed}s): ${group.command}`), (pid) => {
                     confirmedExpiry = confirmManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, pid, processGroupId: process.platform === "win32" ? null : pid }).lease_expires_at;
                     assertRunMutationAllowed(context, input.projectId, input.runId, generation);
@@ -638,6 +644,7 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation, s
             const current = managedProcessStatus(context).find(item => item.id === managed.id);
             if (processTreeIsAlive(current))
                 throw new AppError("check_in_progress", "The check shell exited but its process tree is still live; retain this receipt and its resources until settlement", 2, { process_id: managed.id, check_receipt_id: id });
+            physicallySettled = !result.cleanupUnconfirmed;
             allocation.release();
             if (!result.cleanupUnconfirmed)
                 finishManagedProcess(context, { id: managed.id, leaseToken: managed.lease_token, state: result.aborted || result.exitCode !== 0 || Boolean(result.error) ? "failed" : "stopped", reason: result.error });
@@ -664,6 +671,9 @@ async function runCodeChecksOwned(context, input, workspaceGateId, generation, s
         const physicalFailures = executionFailures({ fingerprintScope: "check_inputs", exitCode: result.exitCode, launcherError: result.error ?? undefined, cleanupUnconfirmed: result.cleanupUnconfirmed, missing: artifacts.missing, mutations: mutationPaths, invalidRunner: Boolean(group.runnerEvidence && !runnerEvidence) });
         if (result.failure)
             physicalFailures.push(result.failure);
+        // This marker is SQL-owned execution metadata, not a semantic runner verdict.
+        if (result.aborted && (!dispatched || physicallySettled))
+            physicalFailures.push({ code: "check_execution_settled", message: "No owned check process remains; investigate the retained launch or execution failure" });
         const candidateFiles = candidateFailureFiles(runnerEvidence, input.workspaceRoot);
         const candidateAbsences = candidateFailureAbsences(runnerEvidence, input.workspaceRoot);
         const libraryInputs = candidateLibraryInputs(runnerEvidence, input.workspaceRoot);
@@ -826,14 +836,9 @@ function reserveOrReuseReceipt(context, input) {
     const successor = retryIds.size === 1 ? receipts.find((receipt) => receipt.retry_of_receipt_id === [...retryIds][0] && receipt.input_hash === input.inputHash && receipt.profile_hash === input.profileHash) : null;
     const reusableSuccessor = successor?.status === "passed" && checkReceiptEvidenceValid(successor);
     const retryPredecessor = receipts.find(receipt => retryIds.has(receipt.id));
-    const sourceCorrection = Boolean(retryPredecessor && (sourceRepairContractMatches(retryPredecessor, input.group, input.profileHash)
+    const sourceCorrection = Boolean(retryPredecessor && (diagnosisRetryContractMatches(retryPredecessor, input.group, input.profileHash, input.executionContractHash, checkInputHash(input.workspaceRoot, input.group, input.profileHash, "", input.evidenceContext, input.checkEnvironment))
         || input.retryReason === "check_inputs_changed" && staleRetryContractMatches(retryPredecessor, input.group, input.profileHash, input)));
     const latestContract = receipts.filter(receipt => receipt.command === input.group.command && receipt.profile_hash === input.profileHash && receipt.gate === input.group.gate && receipt.scope === input.scope && receipt.work_id === (input.workId ?? null)).at(-1);
-    // Hash files before SQLite's writer reservation. Captured identities remain
-    // valid historical evidence, but cannot authorize reuse in a changed install.
-    const priorLibrariesCurrent = !prior || currentCandidateLibraryInputsValid(prior, input.workspaceRoot);
-    const latestLibrariesCurrent = !latestContract || currentCandidateLibraryInputsValid(latestContract, input.workspaceRoot);
-    const libraryDrift = (receipt) => { throw new AppError("check_evidence_stale", "Captured library inputs differ from the current candidate installation; request an explicit restored-condition retry", 2, { reason: "candidate_library_inputs_changed", check_receipt_id: receipt.id, effect: "no_effect" }); };
     return context.db.writeTransaction(() => {
         assertRunMutationAllowed(context, input.projectId, input.runId, input.generation);
         if (JSON.stringify(context.db.all(snapshotSql, [input.projectId, input.runId])) !== snapshot)
@@ -869,16 +874,10 @@ function reserveOrReuseReceipt(context, input) {
         // An unchanged failed contract needs a concrete restored-condition retry,
         // not repeated coordinator finish until it happens to become green.
         if (!retryId && latestContract?.fingerprint_scope === "check_inputs" && latestContract.status === "failed"
-            && latestContract.execution_failures?.some(failure => failure.code === "check_inputs_changed") && latestContract.execution_contract_hash === input.executionContractHash) {
-            if (!latestLibrariesCurrent)
-                libraryDrift(latestContract);
+            && latestContract.execution_failures?.some(failure => failure.code === "check_inputs_changed") && latestContract.execution_contract_hash === input.executionContractHash)
             return { receipt: latestContract };
-        }
-        if (prior && ["failed", "aborted"].includes(prior.status) && !retryId) {
-            if (!priorLibrariesCurrent)
-                libraryDrift(prior);
+        if (prior && ["failed", "aborted"].includes(prior.status) && !retryId)
             return { receipt: prior };
-        }
         if (prior?.status === "passed" && !retryIds.has(prior.id) && input.group.reusable && reusablePrior)
             return { receipt: prior };
         let ordinal = (context.db.get("SELECT COALESCE(MAX(reservation_sequence), 0) + 1 AS sequence FROM check_receipts WHERE project_id = ? AND run_id = ?", [input.projectId, input.runId])?.sequence ?? 1);
@@ -895,9 +894,12 @@ function reserveOrReuseReceipt(context, input) {
         return { reserved };
     }, "checks.reserveOrReuseReceipt");
 }
-function sourceRepairContractMatches(receipt, group, profileHash) {
-    return checkRepairDisposition(receipt) === "source_repair" && group.command === receipt.command && profileHash === receipt.profile_hash && isDeepStrictEqual(group.inputs, receipt.inputs)
-        && isDeepStrictEqual(derivedReceiptArtifacts(group, receipt).sort(), [...receipt.required_artifacts].sort()) && isDeepStrictEqual([...group.ports].sort(), Object.keys(receipt.resources.ports).sort());
+function diagnosisRetryContractMatches(receipt, group, profileHash, executionContractHash, legacyExecutionContractHash) {
+    return checkDiagnosisDisposition(receipt) === "diagnosis_required" && group.command === receipt.command && profileHash === receipt.profile_hash && isDeepStrictEqual(group.inputs, receipt.inputs)
+        && [executionContractHash, legacyExecutionContractHash].includes(receipt.execution_contract_hash ?? "")
+        && group.requiredArtifacts.every(artifact => receipt.required_artifacts.includes(artifact))
+        && isDeepStrictEqual(group.runnerEvidence ?? null, receipt.runner_evidence_required ?? null)
+        && isDeepStrictEqual([...group.ports].sort(), Object.keys(receipt.resources.ports).sort());
 }
 function staleCheckRetryEligible(receipt) {
     if (receipt.fingerprint_scope !== "check_inputs" || receipt.status !== "failed" || receipt.exit_code !== 0 || receipt.retry_reason === "check_inputs_changed"
@@ -908,7 +910,8 @@ function staleCheckRetryEligible(receipt) {
 }
 function staleRetryContractMatches(receipt, group, profileHash, input) {
     return group.reusable && staleCheckRetryEligible(receipt) && isDeepStrictEqual(group.runnerEvidence ?? null, receipt.runner_evidence_required ?? null)
-        && receipt.execution_contract_hash === checkInputHash(input.workspaceRoot, group, profileHash, "", input.evidenceContext, input.checkEnvironment);
+        && [checkInputHash(input.workspaceRoot, group, profileHash, "", input.evidenceContext, input.checkEnvironment, false),
+            checkInputHash(input.workspaceRoot, group, profileHash, "", input.evidenceContext, input.checkEnvironment)].includes(receipt.execution_contract_hash ?? "");
 }
 function receiptFor(input) { return { id: input.id, local_id: input.localId, declaration_id: input.group.declarations[0].id, check_refs: input.group.declarations.map(checkRef), gate: input.group.gate, scope: input.scope, work_id: input.workId ?? null, command: input.group.command, input_hash: input.inputHash, verification_epoch: input.epoch, retry_of_receipt_id: input.retryOf ?? null, retry_reason: input.retryReason ?? null, status: input.status, ...(input.status === "aborted" ? { abort_reason: input.result.error } : {}), exit_code: input.status === "running" ? null : input.result.exitCode, stdout_path: input.stdoutPath, stderr_path: input.stderrPath, receipt_path: input.receiptPath, completion_path: input.completionPath, required_artifacts: input.group.requiredArtifacts, inputs: input.group.inputs, fingerprint_scope: "check_inputs", input_manifest: input.inputManifest ?? null, execution_contract_hash: input.executionContractHash, workspace_fingerprint: input.before.fingerprint, before_fingerprint: input.inputFingerprint, after_fingerprint: input.status === "running" ? input.inputFingerprint : input.after.fingerprint, profile_hash: input.profileHash, mutation_paths: input.mutationPaths, artifacts: input.artifacts, resources: { ports: input.resources }, started_at: input.startedAt, finished_at: input.status === "running" ? input.startedAt : new Date().toISOString() }; }
 function retainInputManifest(context, reserved) {
@@ -966,8 +969,6 @@ export function validateFailedCheckRetry(context, input) {
     const declared = new Set(input.declarations.flatMap((check) => [check.id, checkRef(check)]));
     if (!receipt.check_refs.some((ref) => declared.has(ref)))
         throw new AppError("retry_check_invalid", "--retry-check does not belong to this stage gate", 2, { check_receipt_id: input.receiptId, check_refs: receipt.check_refs });
-    if (receipt.fingerprint_scope === "check_inputs" && receipt.execution_failures?.some(failure => failure.code === "check_inputs_changed") && input.reason !== "check_inputs_changed")
-        throw new AppError("retry_check_invalid", "Scoped drift uses its bounded stale transition, not an environment/source retry", 2, { check_receipt_id: receipt.id });
     if (input.reason === "check_inputs_changed" && (!staleCheckRetryEligible(receipt) || receipt.retry_reason === "check_inputs_changed"))
         throw new AppError("retry_check_invalid", "Scoped input retry requires a bound, safely completed stale predecessor and one unconsumed episode", 2, { check_receipt_id: receipt.id });
     return receipt;
@@ -1326,12 +1327,28 @@ function explicitInputFiles(root, inputs, ignoredRoots, sourceFiles) {
         visit(path.resolve(root, input), input, new Set());
     return [...result.entries()];
 }
-function checkInputHash(workspaceRoot, group, profileHash, inputFingerprint, evidenceContext, checkEnvironment) { return crypto.createHash("sha256").update(JSON.stringify({ workspace_root: path.resolve(workspaceRoot), gate: group.reusable ? null : group.gate, command: group.command, required_artifacts: group.requiredArtifacts, ports: group.ports, inputs: group.inputs, ...(group.runnerEvidence ? { runner_evidence: group.runnerEvidence } : {}), profile_hash: profileHash, environment: environmentFingerprint(workspaceRoot, group.environmentInputs, checkEnvironment), input_fingerprint: inputFingerprint, ...(group.environmentInputs === undefined ? {} : { environment_inputs: group.environmentInputs }), ...(evidenceContext === undefined ? {} : { evidence_context: evidenceContext }) })).digest("hex"); }
+function checkInputHash(workspaceRoot, group, profileHash, inputFingerprint, evidenceContext, checkEnvironment, observedEnvironment = true) { return crypto.createHash("sha256").update(JSON.stringify({ workspace_root: path.resolve(workspaceRoot), gate: group.reusable ? null : group.gate, command: group.command, required_artifacts: group.requiredArtifacts, ports: group.ports, inputs: group.inputs, ...(group.runnerEvidence ? { runner_evidence: group.runnerEvidence } : {}), profile_hash: profileHash, environment: observedEnvironment ? environmentFingerprint(workspaceRoot, group.environmentInputs, checkEnvironment) : null, input_fingerprint: inputFingerprint, ...(group.environmentInputs === undefined ? {} : { environment_inputs: group.environmentInputs }), ...(evidenceContext === undefined ? {} : { evidence_context: evidenceContext }) })).digest("hex"); }
 function derivedReceiptArtifacts(group, receipt) { return [...new Set([...group.requiredArtifacts, ...runnerProofArtifacts(receipt.runner_evidence), ...(receipt.required_artifacts.includes("engine-outcome.json") ? ["engine-outcome.json"] : [])])]; }
 function bindReceipt(receipt, group) { return { ...receipt, gate: group.gate, declaration_id: group.declarations[0].id, check_refs: group.declarations.map(checkRef), required_artifacts: derivedReceiptArtifacts(group, receipt), inputs: group.inputs }; }
 export function checkReceiptEvidenceValid(receipt) { return checkReceiptEvidenceValidForMode(receipt); }
+function availableDiagnosticArtifacts(receipt) {
+    const root = path.join(path.dirname(receipt.receipt_path), "artifacts");
+    return receipt.artifacts.flatMap(artifact => {
+        const relative = path.isAbsolute(artifact.path) ? path.relative(root, artifact.path) : artifact.path;
+        const observed = collectCheckArtifacts(root, [relative]);
+        return observed.items.filter(item => item.sha256 === artifact.sha256);
+    });
+}
 function checkReceiptEvidenceValidForMode(receipt, mode) {
     try {
+        if (mode === "diagnostic" && receipt.status !== "passed") {
+            if (checkDiagnosisDisposition(receipt) !== "diagnosis_required")
+                return false;
+            // SQL selects this execution. Only its identity must survive in the
+            // diagnostic packet; missing reports/logs cannot erase a failed command.
+            const stored = JSON.parse(readBoundedReleaseFile(receipt.receipt_path, 1024 * 1024).toString("utf8"));
+            return ["id", "scope", "work_id", "command", "input_hash", "verification_epoch", "status", "exit_code", "started_at", "finished_at"].every(field => (stored[field] ?? null) === (receipt[field] ?? null));
+        }
         const staleDiagnostic = mode === "diagnostic" && receipt.fingerprint_scope === "check_inputs" && receipt.status === "failed" && Number.isInteger(receipt.exit_code)
             && receipt.before_fingerprint !== receipt.after_fingerprint && receipt.mutation_paths.length > 0 && receipt.execution_failures?.some(failure => failure.code === "check_inputs_changed");
         if (receipt.fingerprint_scope != null && receipt.fingerprint_scope !== "check_inputs")

package/dist/services/codex-hook-delivery.js

@@ -19,7 +19,10 @@ export async function verifyCodexHookDelivery(env, payload) {
         throw new AppError("native_hook_timeout", "Native hook deadline expired before delivery verification", 1, { phase: "verification", effect: "no_effect", recoverable: false });
     const proof = await callDaemon(env.DD_FLOW_CODEX_STATE_DIR, "hook.verify", {
         daemonId: env.DD_FLOW_DAEMON_ID, rootSessionId: payload.session_id,
-        sessionId: payload.agent_id ?? payload.session_id, toolCallId: payload.tool_use_id, turnId: payload.turn_id
+        sessionId: payload.agent_id ?? payload.session_id, toolCallId: payload.tool_use_id, turnId: payload.turn_id,
+        // The daemon verifies the native delivery before retaining it; the source
+        // command cannot itself grant admission to the CLI.
+        nativePayload: payload, nativeCommand: command
     }, Math.min(5000, remaining));
     if (typeof proof.projectRoot !== "string"
         || typeof proof.ddFlowHome !== "string" || !env.DD_FLOW_HOME || path.resolve(env.DD_FLOW_HOME) !== path.resolve(proof.ddFlowHome)
@@ -27,6 +30,12 @@ export async function verifyCodexHookDelivery(env, payload) {
         || typeof proof.toolCallId !== "string" || !(proof.parentSessionId === null || typeof proof.parentSessionId === "string")) {
         throw new AppError("native_hook_unproven", "Native hook proof differs from the requested project/runtime", 1, { effect: "no_effect" });
     }
+    const binding = proof.nativeHookBinding;
+    const retained = binding && typeof binding === "object" && !Array.isArray(binding) ? binding : null;
     return { daemonId: proof.daemonId, rootSessionId: proof.rootSessionId, sessionId: proof.sessionId,
-        parentSessionId: proof.parentSessionId, toolCallId: proof.toolCallId, projectRoot: proof.projectRoot, command: command };
+        parentSessionId: proof.parentSessionId, toolCallId: proof.toolCallId, projectRoot: proof.projectRoot, command: command,
+        ...(retained?.schema_id === "dd-flow/hook-request@1" && retained.source_harness === "codex-desktop"
+            && retained.daemon_id === proof.daemonId && retained.root_provider_session_id === proof.rootSessionId
+            && retained.provider_session_id === proof.sessionId && retained.tool_call_id === proof.toolCallId
+            && retained.native_command === command && typeof retained.request_id === "string" ? { nativeHookBinding: retained } : {}) };
 }

package/dist/services/controller-execution.js

@@ -5,6 +5,7 @@ import { resolveExecutionPolicy, resolveStageTransition, stageExecutionCwd } fro
 import { readFlowRunExecutionBundle } from "./runs.js";
 import { hybridDigest } from "./hybrid-contracts.js";
 import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isDeliveryFlow } from "../domain/delivery-flows.js";
 /** Adapt generic routing to shared fanout APIs, not to SDLC settings. No alias,
  * operator file, merge policy or project default participates in this selection.
  */
@@ -44,7 +45,9 @@ export function genericControllerRouting(execution, workspaceRoot) {
  * Legacy SDLC manifests retain their original settings and routing behavior.
  */
 export function selectControllerExecution(context, run, manifest) {
-    if (manifest?.schema_id === "dd-flow/run-controller-manifest@2" || ["mb-init", "mb-upgrade"].includes(run.flow_kind) || isDiagnosticFlow(run.flow_kind)) {
+    const boundDistill = run.flow_kind === "mb-distill" && JSON.parse(run.index_json).execution_bundle?.flow_id === "mb-distill";
+    const boundDelivery = isDeliveryFlow(run.flow_kind) && JSON.parse(run.index_json).execution_bundle?.flow_id === run.flow_kind;
+    if (manifest?.schema_id === "dd-flow/run-controller-manifest@2" || ["mb-init", "mb-upgrade", "mb-fix", "review-fix", "interactive"].includes(run.flow_kind) || isDiagnosticFlow(run.flow_kind) || boundDistill || boundDelivery) {
         const bundle = readFlowRunExecutionBundle(context, { projectRoot: run.project_root, runId: run.id });
         if (!bundle || bundle.descriptor.descriptor.id !== run.flow_kind || bundle.descriptor.descriptor.id === "sdlc")
             throw new AppError("controller_execution_invalid", "Generic controller requires its retained non-SDLC bundle", 1);

package/dist/services/controller-fanout.js

@@ -13,6 +13,7 @@ import { stageAttempt, stageWorkIds } from "./stage-work-graph.js";
 import { runtimeCommand } from "./runtime-command.js";
 import { promptDeliveryInstruction } from "./prompt-delivery.js";
 import { currentStageFinishCommand } from "./lifecycle-invocations.js";
+import { acceptedChildWork } from "./controller-result-authority.js";
 function semanticCompletionPrompt(stage, completed, command) {
     const task = stage === "plan-review"
         ? "Classify the reviewer findings, apply every accepted correction in the current PLAN-REVIEW Work, and write the authoritative review decision."
@@ -74,8 +75,11 @@ export async function nextControllerFanout(context, input) {
         const issues = reconciled.issues.filter(issue => !["child_check_in_progress", "child_capacity_pending"].includes(issue.code));
         if (issues.length)
             throw new AppError("fanout_reconciliation_required", "Native child outcome requires reconciliation, not replay", 1, { issues });
-        if (children.some(child => child.status === "running" || child.status === "unknown"))
-            return { kind: "wait", reason: "native_children_unsettled" };
+        const unsettled = children.filter(child => child.status === "running" || child.status === "unknown");
+        if (unsettled.length) {
+            const project = requireProjectByRoot(context, input.projectRoot);
+            return { kind: "wait", reason: unsettled.every(child => acceptedChildWork(context, { project_id: project.id, run_id: input.runId }, input.harness, input.sessionId, child.session_id)) ? "accepted_work_native_cleanup" : "native_children_unsettled" };
+        }
         fanout = getVnextFanoutStatus(context, input).orchestration;
     }
     if (input.dispatchFence && !fanout.works.failed)
@@ -155,7 +159,8 @@ export async function nextControllerFanout(context, input) {
             const work = choice.work;
             const row = context.db.get("SELECT payload_json,result_schema FROM works WHERE work_id=?", [work.work_id]);
             const payload = JSON.parse(row?.payload_json ?? "null");
-            if (payload?.kind === "memory-review" && row?.result_schema === "dd-flow/memory-review-work-result@1") {
+            if (payload?.kind === "memory-review" && row?.result_schema === "dd-flow/memory-review-work-result@1"
+                || payload?.kind === "interactive-review" && row?.result_schema === "dd-flow/interactive-work-result@1") {
                 const copy = prepareMemoryNativeReviewCopy(context, work.work_id, true);
                 return { ...work, start_command: `cd '${copy.root.replaceAll("'", "'\\''")}' && ${workStartCommand(context, assertWorkLaunchReady(context, work.work_id))}` };
             }
@@ -171,7 +176,7 @@ export async function nextControllerFanout(context, input) {
             if (!work.work_id || !work.start_command)
                 throw new AppError("fanout_contract_invalid", "Ready Work omits its trusted start command", 1);
         const totalWorks = fanout.works.created + fanout.works.running + fanout.works.completed + fanout.works.failed + fanout.works.cancelled;
-        return prompt("dispatch_work", renderDelegationInstructions({ harness: input.harness, stage: input.stage, capacity, works: wave, totalWorks, remainingWorks: fanout.works.created - wave.length }));
+        return { ...prompt("dispatch_work", renderDelegationInstructions({ harness: input.harness, stage: input.stage, capacity, works: wave, totalWorks, remainingWorks: fanout.works.created - wave.length })), work_ids: wave.map(work => work.work_id) };
     }
     if (fanout.works.running)
         return { kind: "wait", reason: "work_receipts_pending" };

package/dist/services/controller-memory-worker.js

@@ -6,7 +6,8 @@ import { launchExternalWork } from "./external-work-launch.js";
 import { requireProjectByRoot } from "./projects.js";
 import { assertControllerLeaseAllowed } from "./run-controller-process.js";
 import { assertManagedProcessLease } from "./managed-processes.js";
-import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
+import { isDeliveryFlow } from "../domain/delivery-flows.js";
 if (!parentPort)
     throw new AppError("controller_memory_task_invalid", "Memory worker requires its controller thread", 1);
 const port = parentPort, cancellation = new AbortController();
@@ -18,9 +19,10 @@ let reply;
 try {
     context = createContext(env, "prepared_existing");
     const project = requireProjectByRoot(context, task.input.projectRoot);
-    const run = context.db.get("SELECT flow_kind FROM runs WHERE project_id=? AND id=?", [project.id, task.input.runId]);
-    if (!run || !["mb-init", "mb-upgrade"].includes(run.flow_kind) && !isDiagnosticFlow(run.flow_kind))
-        throw new AppError("controller_memory_task_invalid", "Worker requires the selected memory or diagnostic RUN", 1, { effect: "no_effect" });
+    const run = context.db.get("SELECT flow_kind,index_json FROM runs WHERE project_id=? AND id=?", [project.id, task.input.runId]);
+    const delivery = run && isDeliveryFlow(run.flow_kind) && JSON.parse(run.index_json).execution_bundle?.flow_id === run.flow_kind;
+    if (!run || !["mb-init", "mb-upgrade", "mb-fix", "interactive"].includes(run.flow_kind) && !isSourceSnapshotFlow(run.flow_kind) && !delivery)
+        throw new AppError("controller_memory_task_invalid", "Worker requires the selected memory, interactive, source-snapshot or bound delivery RUN", 1, { effect: "no_effect" });
     if (task.operation === "external") {
         const work = context.db.get("SELECT project_id,run_id FROM works WHERE work_id=?", [task.input.workId]);
         if (!work || work.project_id !== project.id || work.run_id !== task.input.runId)

package/dist/services/controller-result-authority.js

@@ -0,0 +1,122 @@
+import { nextAttempt } from "./runs.js";
+import { stageAttempt, stageCycle, stageWorkIds } from "./stage-work-graph.js";
+import { storageSessionId } from "./session-identity.js";
+import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
+import { terminalProviderRecovery } from "../harness-runtime/lib/provider-overload-policy.mjs";
+import { getVnextFanoutStatus } from "./vnext-fanout.js";
+import { normalizeNativeChildren, nativeTreeReadiness } from "../harness-runtime/lib/native-children.mjs";
+/** Disappearance from a truncated child list is not retirement evidence. */
+export function acceptedChildrenRetired(expected, receipt, sessionId, operationId) {
+    const children = normalizeNativeChildren(receipt, sessionId);
+    const settledTree = nativeTreeReadiness(receipt, { sessionId, operationId }) === "ready"
+        && Array.isArray(receipt.tree_session_ids) ? receipt.tree_session_ids : [];
+    return expected.every(id => {
+        const child = children.find(item => item.session_id === id);
+        return Boolean(child && ["completed", "failed", "cancelled"].includes(child.status)) || settledTree.includes(id);
+    });
+}
+/** Typed transport/provider failures only; integrity/ownership errors never become notes. */
+export function lateNativeFailure(error, sessionId) {
+    const value = error;
+    return isObservationLoss(error) || isObservationLoss(value?.details?.cause)
+        || value?.code === "settlement_recovery_required" || terminalProviderRecovery(error, sessionId);
+}
+/** A technical pause is an engine-recorded boundary, never an operator label. */
+export function technicalDependencyControl(context, projectId, runId, controlId) {
+    if (!context.db.get("SELECT 1 FROM sqlite_schema WHERE name='run_controller_events'"))
+        return false;
+    return Boolean(context.db.get(`SELECT 1 FROM run_controller_events e JOIN run_controllers c ON c.controller_id=e.controller_id JOIN run_controls rc ON rc.project_id=c.project_id AND rc.run_id=c.run_id WHERE c.project_id=? AND c.run_id=? AND rc.control_id=? AND rc.action='pause' AND e.event_type='technical_dependency_paused' AND json_extract(e.data_json,'$.control_id')=rc.control_id AND json_extract(e.data_json,'$.schema_id')='dd-flow/controller-dependency@1'`, [projectId, runId, controlId]));
+}
+/** A technical pause may be resumed automatically only for its own accepted Work.
+ * This is a read-only predicate and is rechecked under the resume transaction. */
+export function acceptedTechnicalWorkControl(context, row, controlId) {
+    try {
+        const control = context.db.get("SELECT request_id,recovery_id,status,action FROM run_controls WHERE project_id=? AND run_id=? AND control_id=?", [row.project_id, row.run_id, controlId]);
+        if (!control || control.action !== "pause" || control.status !== "settled")
+            return false;
+        const guard = context.db.get("SELECT recovery_id,generation,status,capture_path FROM run_recovery_guards WHERE project_id=? AND run_id=? ORDER BY generation DESC LIMIT 1", [row.project_id, row.run_id]);
+        if (!guard || guard.recovery_id !== control.recovery_id || guard.status !== "sealed" || !guard.capture_path || guard.generation <= row.generation)
+            return false;
+        const events = context.db.all("SELECT data_json FROM run_controller_events WHERE controller_id=? AND event_type='technical_dependency_paused' AND json_extract(data_json,'$.control_id')=?", [row.controller_id, controlId]);
+        if (events.length !== 1)
+            return false;
+        const event = JSON.parse(events[0].data_json);
+        if (event.schema_id !== "dd-flow/controller-dependency@1" || event.request_id !== control.request_id || event.generation !== row.generation || typeof event.source_operation_id !== "string")
+            return false;
+        const state = JSON.parse(row.state_json), session = state.current_session === null ? null : state.sessions?.[state.current_session];
+        if (!session?.id || !session.owner?.owner_id || event.state_dir !== session.state_dir)
+            return false;
+        const op = context.db.get("SELECT generation,status,input_json FROM run_controller_operations WHERE controller_id=? AND operation_id=?", [row.controller_id, event.source_operation_id]);
+        if (!op || op.generation !== row.generation || !["outcome_unknown", "completed"].includes(op.status))
+            return false;
+        const input = JSON.parse(op.input_json), expected = input.obligation;
+        if (input.owner !== session.owner.owner_id || input.state_dir !== session.state_dir || !Array.isArray(input.args) || input.args[0] !== "session" || input.args[1] !== "prompt" || input.args.indexOf("--session-id") < 0 || input.args[input.args.indexOf("--session-id") + 1] !== session.id || !expected || expected.action !== "work" || expected.stage !== state.stage || expected.generation !== row.generation || !Array.isArray(expected.work_ids) || !expected.work_ids.length || !Array.isArray(expected.work_session_ids))
+            return false;
+        const run = context.db.get("SELECT status,index_json FROM runs WHERE project_id=? AND id=?", [row.project_id, row.run_id]);
+        const stage = run && JSON.parse(run.index_json).stage_runs.find(item => item.stage === expected.stage && (item.attempt ?? "try-001") === expected.attempt);
+        if (!run || !["running", "paused"].includes(run.status) || stage?.status !== "running" || !controllerObligationAccepted(context, row, expected))
+            return false;
+        const stageWorks = stageWorkIds(context, row.project_id, row.run_id, expected.stage);
+        return expected.work_ids.every(id => stageWorks.has(id) && Boolean(context.db.get("SELECT 1 FROM work_sessions WHERE work_id=? AND status='completed'", [id])))
+            && expected.work_session_ids.every(id => Boolean(context.db.get(`SELECT 1 FROM work_sessions WHERE id=? AND status='completed' AND work_id IN (${expected.work_ids.map(() => "?").join(",")})`, [id, ...expected.work_ids])));
+    }
+    catch {
+        return false;
+    }
+}
+/** Persist this snapshot with the exact dispatch, never infer success from one arbitrary Work. */
+export function controllerObligation(context, row, stage, action, assignedWorkIds) {
+    const ids = [...stageWorkIds(context, row.project_id, row.run_id, stage)];
+    const works = ids.length ? context.db.all("SELECT work_id,status,parent_work_id FROM works WHERE project_id=? AND run_id=?", [row.project_id, row.run_id]).filter(work => ids.includes(work.work_id)) : [];
+    const targets = action === "work" ? works.filter(work => work.parent_work_id && ["created", "running"].includes(work.status) && (!assignedWorkIds || assignedWorkIds.includes(work.work_id))).map(work => work.work_id) : [];
+    const sessions = targets.length ? context.db.all("SELECT ws.id,ws.work_id FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id WHERE w.project_id=? AND w.run_id=? AND ws.status='running'", [row.project_id, row.run_id]).filter(session => targets.includes(session.work_id)).map(session => session.id) : [];
+    const run = context.db.get("SELECT index_json,project_root FROM runs WHERE project_id=? AND id=?", [row.project_id, row.run_id]);
+    const previous = run ? JSON.parse(run.index_json).stage_runs.find(item => item.stage === stage) : undefined;
+    return { stage, attempt: action === "entry" ? nextAttempt(previous) : stageAttempt(context, row.project_id, row.run_id, stage), cycle: stageCycle(context, row.project_id, row.run_id, stage), action, work_ids: targets, work_session_ids: sessions, generation: row.generation, ...(action === "resume" && previous?.pause ? { pause_id: previous.pause.id } : {}), ...(action === "graph" ? { graph_before: ids.sort() } : {}) };
+}
+export function controllerObligationAccepted(context, row, expected) {
+    if (expected.generation !== row.generation)
+        return false;
+    const run = context.db.get("SELECT index_json,project_root FROM runs WHERE project_id=? AND id=?", [row.project_id, row.run_id]);
+    if (!run)
+        return false;
+    const stages = JSON.parse(run.index_json).stage_runs;
+    const stage = [...stages].reverse().find(item => item.stage === expected.stage && (item.attempt ?? "try-001") === expected.attempt);
+    if (!stage || stageCycle(context, row.project_id, row.run_id, expected.stage) !== expected.cycle)
+        return false;
+    if (["done", "skipped"].includes(stage.status))
+        return true;
+    if (expected.action === "resume")
+        return Boolean(expected.pause_id && context.db.get("SELECT 1 FROM audit_events WHERE project_id=? AND event_type='flow_run.stage_resumed' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.stage')=? AND json_extract(payload_json,'$.pause_id')=?", [row.project_id, row.run_id, expected.stage, expected.pause_id]));
+    if (expected.action === "entry") {
+        // Entry-only is a boundary for fanout stages. A non-fanout entry Turn
+        // also owes semantic work: merely starting SPECIFY is not its result.
+        if (stage.status === "paused" && stage.pause)
+            return Boolean(context.db.get("SELECT 1 FROM works WHERE project_id=? AND run_id=? AND work_id=? AND status='paused'", [row.project_id, row.run_id, stage.pause.work_id]));
+        if (stage.status !== "running")
+            return false;
+        try {
+            return Boolean(getVnextFanoutStatus(context, { projectRoot: run.project_root, runId: row.run_id, stage: expected.stage }).orchestration);
+        }
+        catch {
+            return false;
+        }
+    }
+    if (expected.action === "graph") {
+        const current = [...stageWorkIds(context, row.project_id, row.run_id, expected.stage)];
+        return Array.isArray(expected.graph_before) && current.length > expected.graph_before.length && expected.graph_before.every(id => current.includes(id));
+    }
+    if (expected.action !== "work" || !expected.work_ids.length)
+        return false;
+    return expected.work_ids.every(id => context.db.get("SELECT status FROM works WHERE project_id=? AND run_id=? AND work_id=?", [row.project_id, row.run_id, id])?.status === "completed")
+        && expected.work_session_ids.every(id => context.db.get("SELECT status FROM work_sessions WHERE id=?", [id])?.status === "completed");
+}
+/** A native failure cannot revoke an accepted result; unknown association is not success. */
+export function acceptedChildWork(context, row, harness, parent, child) {
+    const links = context.db.all(`SELECT ws.work_id,ws.status,w.status AS work_status FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN sessions s ON s.project_id=w.project_id AND s.session_id=ws.session_id WHERE w.project_id=? AND w.run_id=? AND ws.session_id=? AND s.parent_session_id=? ORDER BY ws.created_at DESC,ws.rowid DESC`, [row.project_id, row.run_id, storageSessionId({ harness_id: harness, session_id: child }), storageSessionId({ harness_id: harness, session_id: parent })]);
+    const current = new Map();
+    for (const link of links)
+        if (!current.has(link.work_id))
+            current.set(link.work_id, link);
+    return current.size > 0 && [...current.values()].every(link => link.status === "completed" && link.work_status === "completed");
+}

package/dist/services/dashboard.js

@@ -216,10 +216,11 @@ export function autoRefreshDashboards(context, input) {
     if (projectRecoveryGuarded(context, project.id))
         return { ok: true, skipped: true, reason: "run_recovery_guarded" };
     const configured = readProjectConfig(context, project.id);
-    // Automatic observation must not change a memory or diagnostic source baseline.
+    // Automatic observation must not change a memory/diagnostic baseline or
+    // invalidate accepted delivery checks by rewriting workspace projections.
     // Keep projections in Home; do not hide runtime-created paths in Git or
     // weaken source preservation by excluding user-owned .tasks directories.
-    const initializing = context.db.get("SELECT 1 FROM runs WHERE project_id=? AND flow_kind IN ('mb-init','mb-upgrade','mb-audit','project-review') AND (id=? OR status IN ('created','running','paused','waiting_for_user','blocked')) LIMIT 1", [project.id, input.runId ?? null]);
+    const initializing = context.db.get("SELECT 1 FROM runs WHERE project_id=? AND (flow_kind IN ('mb-init','mb-upgrade','mb-fix','mb-audit','project-review','review-fix','interactive') OR flow_kind='mb-distill' AND json_extract(index_json,'$.execution_bundle.flow_id')='mb-distill' OR flow_kind IN ('release','deploy','publish') AND json_extract(index_json,'$.execution_bundle.flow_id')=flow_kind) AND (id=? OR status IN ('created','running','paused','waiting_for_user','blocked')) LIMIT 1", [project.id, input.runId ?? null]);
     const config = initializing ? { ...configured, dashboard: { ...configured.dashboard,
             markdown_path: path.join(projectDashboardDir(context.ddFlowHome, project.id), "project-dashboard.md") } } : configured;
     if (!config.dashboard.auto_refresh) {
@@ -1307,6 +1308,7 @@ function normalizeFlowKind(flowKind) {
         "mb-upgrade",
         "mb-audit",
         "mb-fix",
+        "review-fix",
         "mb-distill",
         "mb-upgrade-review",
         "mb-sdlc-review",