@deksden-com/dd-flow-cli 0.9.0-beta.152 → 0.9.0-beta.156

package/dist/services/diagnostic-report.js

@@ -55,6 +55,36 @@ export function prepareDiagnosticReport(result, analysis, critics) {
         dashboard_links: critics.map(work => ({ work_id: work.workId, result: `run://${result.run_id}/works/${work.workId}/result.json` }))
     };
 }
+/** Pure repair-intake selection, not acceptance or mutation authority. The
+ * caller must obtain report bytes from the completed RUN's committed custody,
+ * then separately bind the user's approved write scope. Never infer selection
+ * from severity, recommendations or a non-empty findings register. */
+export function selectDiagnosticFindings(report, findingIds) {
+    const invalid = (reason) => {
+        throw new AppError("repair_selection_invalid", "Select exact reviewed finding IDs before preparing repair scope", 2, { reason, effect: "no_effect" });
+    };
+    if (!Array.isArray(findingIds) || !findingIds.length || findingIds.length > 4096
+        || findingIds.some(id => typeof id !== "string" || !id.trim()) || new Set(findingIds).size !== findingIds.length)
+        invalid("explicit_unique_selection_required");
+    const register = new Map(report.findings_register.map(finding => [finding.id, finding]));
+    if (register.size !== report.findings_register.length)
+        invalid("ambiguous_finding_register");
+    const selected = findingIds.map(id => {
+        const finding = register.get(id);
+        if (!finding)
+            return invalid("unknown_finding");
+        if (!["accepted", "downgraded", "def_candidate", "review_fix_candidate"].includes(finding.resolution.disposition))
+            invalid("finding_not_accepted");
+        return structuredClone(finding);
+    });
+    return {
+        source: { ...structuredClone(report.run), report_sha256: hybridDigest(report) },
+        selected_findings: selected,
+        unselected_ids: report.findings_register.filter(finding => !findingIds.includes(finding.id)).map(finding => finding.id),
+        limitations: [...report.limitations],
+        authorization: "not_granted"
+    };
+}
 /** HTML embeds exactly the authoritative JSON value; untrusted prose is text,
  * never HTML or executable script. Markdown remains a compact companion. */
 export function renderDiagnosticReport(report) {

package/dist/services/diagnostic-run-bundle.js

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { AppError } from "../shared/errors.js";
-import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
+import { isDeliveryFlow } from "../domain/delivery-flows.js";
 import { PreparedInstalledFlowSource } from "./installed-flow-source.js";
 import { FrozenGenericExecution } from "./generic-execution.js";
 import { AdmittedFrozenEngine } from "./frozen-engine.js";
@@ -10,34 +11,65 @@ import { requireProjectByRoot } from "./projects.js";
 import { nextDescriptorRunId } from "./descriptor-run-start.js";
 import { bundledHandlerContext } from "./stage-handlers.js";
 import { hybridDigest } from "./hybrid-contracts.js";
+import { readDiagnosticRequest } from "./diagnostic-start.js";
 const bytes = (value) => Buffer.from(JSON.stringify(value));
 const hash = (value) => createHash("sha256").update(value).digest("hex");
 function refuse(reason) { throw new AppError("diagnostic_run_bundle_invalid", "Diagnostic bundle requires its frozen source, execution and snapshot", 2, { reason, effect: "no_effect" }); }
 /** Initial construction only. Retry after allocation restores the retained RUN
  * bundle, never current operator settings/canon. boundAt belongs to the request. */
 export function prepareDiagnosticRunBundle(context, input) {
+    return prepareRequestRunBundle(context, input, "source_snapshot");
+}
+/** Delivery shares immutable request/engine/profile retention, not diagnosis's
+ * read-only cloned workspace or its permission model. No effect is admitted. */
+export function prepareDeliveryRunBundle(context, input) {
+    return prepareRequestRunBundle(context, input, "delivery");
+}
+function prepareRequestRunBundle(context, input, mode) {
     if (!(input.source instanceof PreparedInstalledFlowSource) || !(input.execution instanceof FrozenGenericExecution)
         || !(input.engine instanceof AdmittedFrozenEngine) || !Number.isFinite(Date.parse(input.boundAt)))
         refuse("unprepared_selection");
     const frozen = input.execution.snapshot(), flowId = frozen.settings.flow_id;
-    if (!isDiagnosticFlow(flowId))
-        refuse("diagnostic_flow_required");
+    if (mode === "delivery" ? !isDeliveryFlow(flowId) : !isSourceSnapshotFlow(flowId))
+        refuse("registered_request_flow_required");
+    if (mode === "delivery" && frozen.settings.stage_session_mode === "same_session")
+        refuse("independent_delivery_verifier_session_required");
+    if (flowId === "review-fix" && frozen.settings.stage_session_mode === "same_session")
+        refuse("independent_scope_review_session_required");
+    if ((mode === "delivery" || flowId === "mb-distill" || flowId === "review-fix") && (typeof input.requestText !== "string" || !input.requestText.trim()
+        || Buffer.byteLength(input.requestText) > 64 * 1024))
+        refuse(mode === "delivery" ? "original_delivery_request_required" : flowId === "mb-distill" ? "original_distill_request_required" : "original_review_fix_request_required");
+    const request = flowId === "review-fix" ? readDiagnosticRequest(context, { projectRoot: frozen.scope.projectRoot,
+        requestId: frozen.scope.requestId, flowId }) : null;
+    if (flowId === "review-fix" && (!request?.repair_source || request.created_at !== input.boundAt
+        || request.objective !== input.requestText || request.source_sha256 !== input.source.sha256
+        || request.execution_sha256 !== input.execution.sha256))
+        refuse("original_repair_request_required");
     const project = requireProjectByRoot(context, frozen.scope.projectRoot);
-    const snapshot = readDiagnosticSnapshot(context, { projectId: project.id, projectRoot: frozen.scope.projectRoot,
-        sourceRoot: frozen.scope.projectRoot, requestId: frozen.scope.requestId, flowId });
-    if (!snapshot || snapshot.root !== frozen.scope.workspace)
+    const snapshot = isSourceSnapshotFlow(flowId) ? readDiagnosticSnapshot(context, { projectId: project.id, projectRoot: frozen.scope.projectRoot,
+        sourceRoot: frozen.scope.projectRoot, requestId: frozen.scope.requestId, flowId }) : null;
+    if (mode === "source_snapshot" && (!snapshot || snapshot.root !== frozen.scope.workspace))
         refuse("snapshot_selection_changed");
     input.source.revalidate();
     const flow = input.source.resolveRegisteredFlow();
     if (flow.descriptor.id !== flowId || flow.sha256 !== frozen.settings.descriptor_sha256)
         refuse("flow_selection_changed");
-    input.engine.admitDiagnosticFlow(input.source, flowId);
+    if (isDeliveryFlow(flowId))
+        input.engine.admitDeliveryFlow(input.source, flowId);
+    else if (flowId === "review-fix")
+        input.engine.admitReviewFixFlow(input.source);
+    else if (flowId === "mb-distill")
+        input.engine.admitDistillFlow(input.source);
+    else if (flowId === "mb-audit" || flowId === "project-review")
+        input.engine.admitDiagnosticFlow(input.source, flowId);
+    else
+        refuse("registered_request_flow_required");
     const manifest = input.engine.manifest(), checksum = manifest.integrity.checksum;
     if (typeof checksum !== "string")
         refuse("engine_identity_missing");
     const runId = nextDescriptorRunId(context, { projectRoot: frozen.scope.projectRoot, requestId: frozen.scope.requestId, slug: flowId });
     const binding = { schema_id: "dd-flow/run-engine-binding@1", run_id: runId,
-        project_root: frozen.scope.projectRoot, bound_at: input.boundAt, source: "run_creation", reason: "Request-bound read-only diagnostic",
+        project_root: frozen.scope.projectRoot, bound_at: input.boundAt, source: "run_creation", reason: isDeliveryFlow(flowId) ? "Request-bound delivery; startup grants no productive mutation approval" : flowId === "review-fix" ? "Request-bound selected finding scope and explicit formalization handoff" : flowId === "mb-distill" ? "Request-bound practice distillation with separate destination authority" : "Request-bound read-only diagnostic",
         engine: { package_name: manifest.package_name, package_version: manifest.package_version, engine_version: manifest.engine_version,
             integrity_checksum: checksum, snapshot_root: manifest.snapshot_root }, probe: { status: "not_required", command: null } };
     const blobs = input.source.blobs();
@@ -47,6 +79,12 @@ export function prepareDiagnosticRunBundle(context, input) {
         blobs.set(logical, content);
         return { path: logical, sha256: hash(content) };
     };
+    // Use the retained request verbatim, not the coordinator's interpretation or
+    // a later mutable intake file. It is task data, never implicit write scope.
+    if (mode === "delivery" || flowId === "mb-distill" || flowId === "review-fix")
+        put("runtime/source-request.md", Buffer.from(input.requestText));
+    if (request?.repair_source)
+        put(request.repair_source.path, Buffer.from(request.repair_source.base64, "base64"));
     for (const ref of [frozen.settings.attached_session_receipt, frozen.settings.delegation.native_capacity_receipt]) {
         if (!ref)
             continue;
@@ -60,7 +98,8 @@ export function prepareDiagnosticRunBundle(context, input) {
     const execution = put("runtime/execution.json", bytes(frozen.settings));
     const engineBinding = put("runtime/engine-binding.json", bytes(binding));
     const engineManifest = put("runtime/engine-manifest.json", input.engine.manifestBytes());
-    put("runtime/diagnostic-snapshot.json", bytes(snapshot));
+    if (snapshot)
+        put("runtime/diagnostic-snapshot.json", bytes(snapshot));
     const provenance = { canon: input.source.canonProvenance(), project_pack: null };
     const bundle = { schema_id: "dd-flow/execution-bundle@1", run_id: runId, flow_id: flowId,
         descriptor: input.source.descriptorReference(), execution_settings: execution, profile_settings: profile,

package/dist/services/diagnostic-snapshot.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { execFileSync } from "node:child_process";
 import { AppError } from "../shared/errors.js";
-import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
 import { hybridDigest } from "./hybrid-contracts.js";
 import { appendAudit } from "./audit.js";
 import { reviewSourceHash, reviewSourceFilter, reviewExecutionCopyHash } from "./review-copy.js";
@@ -32,7 +32,7 @@ export function diagnosticSnapshotPaths(context, value, runId) {
 }
 function validate(context, input, runId) {
     const physical = physicalSnapshot(context, input, runId);
-    if (!isDiagnosticFlow(input.flowId) || !input.requestId?.trim() || input.requestId.length > 200
+    if (!isSourceSnapshotFlow(input.flowId) || !input.requestId?.trim() || input.requestId.length > 200
         || !path.isAbsolute(physical.projectRoot) || physical.projectRoot !== physical.sourceRoot
         || fs.realpathSync(physical.sourceRoot) !== physical.sourceRoot)
         refuse("invalid_selection");

package/dist/services/diagnostic-stage-handlers.js

@@ -8,7 +8,7 @@ import { PreparedDescriptorStageStart } from "./descriptor-stage-start.js";
 import { PreparedDescriptorStageCoordinator, readDescriptorStageInput } from "./descriptor-stage-coordinator.js";
 import { PreparedDescriptorStageSettlement } from "./descriptor-stage-settlement.js";
 import { PreparedDescriptorRunSettlement } from "./descriptor-run-settlement.js";
-import { assertDiagnosticCriticResolution, assertDiagnosticReportData, assertDiagnosticStageScope, sealDiagnosticStageLimitations, validateDiagnosticStageResult } from "./diagnostic-stage-results.js";
+import { assertDiagnosticCriticResolution, assertDiagnosticReportData, assertDiagnosticStageScope, materializeDiagnosticRetainedFields, sealDiagnosticStageLimitations, validateDiagnosticStageResult } from "./diagnostic-stage-results.js";
 import { readAcceptedStageData } from "./stage-report-renderer.js";
 import { registerDiagnosticStageGraph } from "./diagnostic-work-registration.js";
 import { PreparedDiagnosticWorkCollection } from "./diagnostic-work-collection.js";
@@ -53,7 +53,8 @@ export function finishDiagnosticStage(context, input) {
     const previous = previousStage ? readAcceptedStageData(context, { ...scope, stage: previousStage }) : null;
     const prior = previous ? JSON.parse(previous.bytes.toString("utf8")) : null;
     const collection = ["audit", "analyze", "review"].includes(input.stage) ? PreparedDiagnosticWorkCollection.prepare(context, input) : null;
-    const candidates = ["audit", "analyze"].includes(input.stage) ? sealDiagnosticCandidateIds(input.bytes, collection.results()) : input.bytes;
+    const proposal = materializeDiagnosticRetainedFields(input.bytes, prior, input.stage);
+    const candidates = ["audit", "analyze"].includes(input.stage) ? sealDiagnosticCandidateIds(proposal, collection.results()) : proposal;
     const bytes = sealDiagnosticStageLimitations(candidates, [
         ...(prior?.details.limitations ?? []), ...(collection?.results() ?? []).flatMap(work => work.result.limitations)
     ], prior?.details.missing_expected_sources ?? []);

package/dist/services/diagnostic-stage-results.js

@@ -7,6 +7,32 @@ import { verifyDiagnosticCoverage, verifyDiagnosticSources } from "./diagnostic-
 const refuse = (reason) => {
     throw new AppError("diagnostic_stage_result_invalid", "Diagnostic result does not match its frozen stage", 2, { reason, effect: "no_effect", ...(reason === "result_schema_invalid" ? { phase: "prepare", recoverable: true } : {}) });
 };
+/** Retained fields are CLI data, not a transcription task for the coordinator. */
+export function materializeDiagnosticRetainedFields(bytes, prior, stage) {
+    if (!prior || !bytes.length || bytes.length > 1024 * 1024)
+        return bytes;
+    let value;
+    try {
+        value = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        return bytes;
+    }
+    if (!value || typeof value !== "object" || !value.details || typeof value.details !== "object" || Array.isArray(value.details))
+        return bytes;
+    const retained = stage === "report" ? Object.entries(prior.details).filter(([key]) => key !== "limitations")
+        : ["focus", "coverage"].map(key => [key, prior.details[key]]);
+    for (const [key, expected] of retained) {
+        if (Object.hasOwn(value.details, key) && hybridDigest(value.details[key]) !== hybridDigest(expected))
+            throw new AppError("diagnostic_stage_invalid", "A proposal cannot replace CLI-retained predecessor data", 2, { reason: `accepted_${key}_changed`, effect: "no_effect", phase: "prepare", recoverable: true });
+        value.details[key] = structuredClone(expected);
+    }
+    if (!Object.hasOwn(value.details, "limitations"))
+        value.details.limitations = [];
+    if (!Object.hasOwn(value.details, "missing_expected_sources"))
+        value.details.missing_expected_sources = structuredClone(prior.details.missing_expected_sources);
+    return Buffer.from(JSON.stringify(value));
+}
 /** Accepted limitations and missing-source observations belong to predecessor/Work custody, not a coordinator's
  * transcription. Keep its annotations too; validate the complete sealed result
  * with the frozen schema afterwards, without truncating overflowing data. */

package/dist/services/diagnostic-start.js

@@ -1,5 +1,6 @@
+import { createHash } from "node:crypto";
 import { AppError } from "../shared/errors.js";
-import { isDiagnosticFlow } from "../domain/diagnostic-flows.js";
+import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
 import { PreparedInstalledFlowSource } from "./installed-flow-source.js";
 import { FrozenGenericExecution } from "./generic-execution.js";
 import { AdmittedFrozenEngine } from "./frozen-engine.js";
@@ -11,6 +12,7 @@ import { requireProjectByRoot } from "./projects.js";
 import { resolveProjectRoot } from "../storage/paths.js";
 import { hybridDigest } from "./hybrid-contracts.js";
 import { appendAudit } from "./audit.js";
+import { prepareReviewFixSourceIntake } from "./review-fix-intake-custody.js";
 const event = "diagnostic.request";
 function refuse(reason) { throw new AppError("diagnostic_request_invalid", "Diagnostic request requires its original frozen selection", 2, { reason, effect: "no_effect" }); }
 export function readDiagnosticRequest(context, scope) {
@@ -22,18 +24,47 @@ export function readDiagnosticRequest(context, scope) {
         refuse("ambiguous_request");
     const value = JSON.parse(rows[0].payload_json);
     if (value.schema_id !== "dd-flow/diagnostic-request@1" || value.project_id !== project.id
-        || hybridDigest(value.scope) !== hybridDigest(scope) || !isDiagnosticFlow(value.scope.flowId))
+        || hybridDigest(value.scope) !== hybridDigest(scope) || !isSourceSnapshotFlow(value.scope.flowId))
         refuse("request_scope_changed");
+    if (scope.flowId === "review-fix") {
+        try {
+            const source = value.repair_source;
+            if (!source || source.path !== "runtime/repair-intake.json" || typeof source.base64 !== "string"
+                || !/^[a-f0-9]{64}$/.test(source.sha256) || !Array.isArray(source.selection?.findingIds)
+                || !source.selection.findingIds.length || source.selection.findingIds.length > 4096)
+                refuse("repair_source_missing");
+            const bytes = Buffer.from(source.base64, "base64");
+            if (!bytes.length || bytes.length > 4 * 1024 * 1024 || bytes.toString("base64") !== source.base64
+                || createHash("sha256").update(bytes).digest("hex") !== source.sha256)
+                refuse("repair_source_changed");
+            const capsule = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+            if (capsule.schema_id !== "dd-flow/review-fix-source-intake@1" || capsule.intake.authorization !== "not_granted"
+                || capsule.intake.source.id !== source.selection.sourceRunId
+                || hybridDigest(capsule.intake.selected_findings.map((finding) => finding.id)) !== hybridDigest(source.selection.findingIds))
+                refuse("repair_selection_changed");
+        }
+        catch (error) {
+            if (error instanceof AppError)
+                throw error;
+            return refuse("repair_source_invalid");
+        }
+    }
+    else if (value.repair_source !== undefined)
+        refuse("foreign_repair_source");
     return value;
 }
 /** Freeze all ambient choices before copying source or allocating a RUN. */
 export function retainDiagnosticRequest(context, input) {
     const { scope, source, execution, engine } = input;
     if (!(source instanceof PreparedInstalledFlowSource) || !(execution instanceof FrozenGenericExecution)
-        || !(engine instanceof AdmittedFrozenEngine) || !isDiagnosticFlow(scope.flowId) || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(scope.requestId)
+        || !(engine instanceof AdmittedFrozenEngine) || !isSourceSnapshotFlow(scope.flowId) || !/^[A-Za-z0-9][A-Za-z0-9_.-]{0,95}$/.test(scope.requestId)
         || !input.objective.trim() || Buffer.byteLength(input.objective) > 64 * 1024)
         refuse("invalid_selection");
+    if ((scope.flowId === "review-fix") !== (input.repairSelection !== undefined))
+        refuse("repair_selection_required_only_for_review_fix");
     const project = requireProjectByRoot(context, scope.projectRoot), frozen = execution.snapshot();
+    if (scope.flowId === "review-fix" && frozen.settings.stage_session_mode === "same_session")
+        refuse("independent_scope_review_session_required");
     const workspace = diagnosticSnapshotRoot(context, { projectId: project.id, projectRoot: scope.projectRoot, sourceRoot: scope.projectRoot,
         requestId: scope.requestId, flowId: scope.flowId });
     if (frozen.scope.projectRoot !== scope.projectRoot || frozen.scope.requestId !== scope.requestId || frozen.scope.workspace !== workspace
@@ -41,15 +72,34 @@ export function retainDiagnosticRequest(context, input) {
         || frozen.settings.attached_session_receipt || frozen.settings.delegation.native_capacity_receipt)
         refuse("execution_selection_changed");
     source.revalidate();
-    engine.admitDiagnosticFlow(source, scope.flowId);
+    if (scope.flowId === "review-fix")
+        engine.admitReviewFixFlow(source);
+    else if (scope.flowId === "mb-distill")
+        engine.admitDistillFlow(source);
+    else
+        engine.admitDiagnosticFlow(source, scope.flowId);
     const manifest = engine.manifest();
     if (typeof manifest.integrity.checksum !== "string")
         refuse("engine_identity_missing");
+    let repairSource;
+    if (scope.flowId === "review-fix") {
+        const prior = readDiagnosticRequest(context, scope);
+        if (prior) {
+            if (hybridDigest(prior.repair_source.selection) !== hybridDigest(input.repairSelection))
+                refuse("repair_selection_changed");
+            repairSource = prior.repair_source;
+        }
+        else {
+            const prepared = prepareReviewFixSourceIntake(context, { projectRoot: scope.projectRoot, ...input.repairSelection });
+            repairSource = { selection: structuredClone(input.repairSelection), path: prepared.path, sha256: prepared.sha256, base64: prepared.bytes.toString("base64") };
+        }
+    }
     const value = { schema_id: "dd-flow/diagnostic-request@1", project_id: project.id, scope: structuredClone(scope),
         created_at: context.now(), objective: input.objective, selection: structuredClone(input.selection),
         source: source.snapshot(), source_sha256: source.sha256, execution: frozen, execution_sha256: execution.sha256,
         engine: { identity: { package_name: manifest.package_name, package_version: manifest.package_version, engine_version: manifest.engine_version,
-                integrity_checksum: manifest.integrity.checksum, snapshot_root: manifest.snapshot_root }, manifest_sha256: engine.manifestSha256 } };
+                integrity_checksum: manifest.integrity.checksum, snapshot_root: manifest.snapshot_root }, manifest_sha256: engine.manifestSha256 },
+        ...(repairSource ? { repair_source: repairSource } : {}) };
     if (Buffer.byteLength(JSON.stringify(value)) > 48 * 1024 * 1024)
         refuse("request_exceeds_bound");
     return context.db.writeTransaction(() => {
@@ -79,6 +129,6 @@ export function startDiagnosticRun(context, scope) {
         requestId: scope.requestId, projectRoot: scope.projectRoot, workspace: snapshot.root
     });
     const engine = AdmittedFrozenEngine.admitSelection(retained.engine.identity, retained.engine.manifest_sha256);
-    const bundle = prepareDiagnosticRunBundle(context, { source, execution, engine, boundAt: retained.created_at });
+    const bundle = prepareDiagnosticRunBundle(context, { source, execution, engine, boundAt: retained.created_at, requestText: retained.objective });
     return PreparedDescriptorRunStart.prepare(context, { bundle }).apply(context);
 }

package/dist/services/diagnostic-work-collection.js

@@ -17,7 +17,7 @@ export function assertDiagnosticSessionIndependence(workers, excluded) {
         || new Set(keys).size !== keys.length || keys.some(key => excludedKeys.has(key)))
         refuse("physical_session_reused");
 }
-function completedWork(context, scope, workId) {
+export function readCompletedResearchWork(context, scope, workId) {
     const work = context.db.get("SELECT status,result FROM works WHERE project_id=? AND run_id=? AND work_id=?", [scope.projectId, scope.runId, workId]);
     if (work?.status !== "completed" || !work.result || Buffer.byteLength(work.result) > 1024 * 1024)
         refuse("work_not_completed");
@@ -36,12 +36,12 @@ function collectSql(context, scope, rootId) {
     if (!graph || graph.parent_work_id !== rootId)
         refuse("registration_required");
     const batch = diagnosticWorkBatch(graph.input);
-    const works = batch.works.map(item => completedWork(context, scope, graph.work_ids[item.key]));
+    const works = batch.works.map(item => readCompletedResearchWork(context, scope, graph.work_ids[item.key]));
     const coordinators = context.db.all("SELECT s.harness,s.provider_session_id FROM work_sessions ws JOIN sessions s ON s.project_id=? AND s.run_id=? AND s.session_id=ws.session_id WHERE ws.work_id=?", [scope.projectId, scope.runId, rootId]);
     const authorGraph = scope.stage === "review" ? readRegisteredDiagnosticGraph(context, { ...scope, stage: graph.input.flow_id === "mb-audit" ? "audit" : "analyze" }) : null;
     if (scope.stage === "review" && !authorGraph)
         refuse("author_graph_missing");
-    const authors = authorGraph ? Object.values(authorGraph.work_ids).map(id => completedWork(context, scope, id)) : [];
+    const authors = authorGraph ? Object.values(authorGraph.work_ids).map(id => readCompletedResearchWork(context, scope, id)) : [];
     assertDiagnosticSessionIndependence(works.map(value => value.session), [...coordinators, ...authors.map(value => value.session)]);
     return { graph, works, authors, coordinators };
 }

package/dist/services/distill-document-publication.js

@@ -0,0 +1,280 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { MemoryRepairDocumentBaseline, orderMemoryDocumentEntries } from "./memory-repair-document-delta.js";
+import { RetainedMemoryRepairPublicationPlan } from "./memory-repair-publication-plan.js";
+import { stageRetainedMemoryRepairFile, verifyRetainedMemoryRepairFile } from "./memory-repair-publication-files.js";
+import { acquireInstallationLock } from "./installation-lock.js";
+import { publishImmutableInput } from "../storage/immutable-input.js";
+import { ObservedMemorySources } from "./memory-source-observations.js";
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+function refuse(reason) {
+    throw new AppError("distill_publication_invalid", "Distillation publication requires its exact retained document plan", 2, { reason, effect: "no_effect" });
+}
+function beforeFiles(plan) {
+    const encoded = JSON.parse(plan.bytes().toString("utf8"));
+    const before = JSON.parse(Buffer.from(encoded.before_base64, "base64").toString("utf8"));
+    return before.entries.filter((entry) => entry.kind === "file" && before.write_paths.includes(entry.path))
+        .map((entry) => ({ path: entry.path, sha256: entry.sha256 }));
+}
+/** Selected original text only. Protected neighboring/private document bytes
+ * must never be exported as verifier context. No destination write occurs. */
+export function captureDistillBeforeDocuments(root, plan) {
+    const selected = beforeFiles(plan), observed = ObservedMemorySources.capture({ workspace: root }, selected.map(entry => ({ root: "workspace", path: entry.path })));
+    return validateDistillBeforeDocuments(plan, selected.map(entry => ({ ...entry, base64: observed.bytes({ root: "workspace", path: entry.path }).toString("base64") })));
+}
+/** SQL decoding is filesystem-free. The original before-view, not a fresh file,
+ * determines exact membership and hashes, including originally empty files. */
+export function validateDistillBeforeDocuments(plan, value) {
+    const expected = beforeFiles(plan);
+    if (!Array.isArray(value) || value.length !== expected.length || value.length > 4096)
+        refuse("original_documents_required");
+    let total = 0;
+    const seen = new Set();
+    for (const document of value) {
+        if (!document || typeof document !== "object" || Object.keys(document).sort().join() !== "base64,path,sha256"
+            || typeof document.base64 !== "string" || document.base64.length > 24 * 1024 * 1024 || seen.has(document.path)
+            || !expected.some(entry => entry.path === document.path && entry.sha256 === document.sha256))
+            refuse("original_document_changed");
+        const bytes = Buffer.from(document.base64, "base64");
+        total += bytes.length;
+        if (bytes.length > 16 * 1024 * 1024 || total > 64 * 1024 * 1024 || bytes.toString("base64") !== document.base64 || hash(bytes) !== document.sha256)
+            refuse("original_document_changed");
+        seen.add(document.path);
+    }
+    const byPath = new Map(value.map(document => [document.path, document]));
+    return expected.map(entry => ({ ...entry, base64: byPath.get(entry.path).base64 }));
+}
+export function distillBeforeDocumentReferences(plan) {
+    return beforeDocumentReferences(plan, "distill");
+}
+export function memoryFixBeforeDocumentReferences(plan) {
+    return beforeDocumentReferences(plan, "memory-fix");
+}
+function beforeDocumentReferences(plan, namespace) {
+    return beforeFiles(plan).map(entry => ({ destination_path: entry.path,
+        source: { root: "run", path: `artifacts/${namespace}/before/${entry.sha256}.md`, sha256: entry.sha256 } }));
+}
+/** Restore original verifier inputs from retained SQL bytes before target
+ * effects, including after a lost projection. Never read the changed target. */
+export function publishDistillBeforeDocuments(runRoot, plan, documents) {
+    return publishBeforeDocuments(runRoot, plan, documents, "distill");
+}
+export function publishMemoryFixBeforeDocuments(runRoot, plan, documents) {
+    return publishBeforeDocuments(runRoot, plan, documents, "memory-fix");
+}
+function publishBeforeDocuments(runRoot, plan, documents, family) {
+    const retained = validateDistillBeforeDocuments(plan, documents);
+    if (!retained.length)
+        return;
+    if (!path.isAbsolute(runRoot) || fs.realpathSync(runRoot) !== runRoot || !fs.lstatSync(runRoot).isDirectory())
+        refuse("unsafe_baseline_home");
+    const artifacts = privateDirectory(runRoot, "artifacts"), namespace = privateDirectory(artifacts, family), directory = privateDirectory(namespace, "before");
+    for (const document of retained)
+        publishImmutableInput(path.join(directory, `${document.sha256}.md`), Buffer.from(document.base64, "base64"), "distill_before_document_conflict");
+}
+/** Physical plan only, not scope approval or RUN/Work authority. The caller
+ * independently selects canonical exceptions and retains this plan in SQL
+ * before any apply. Capture protects the entire destination Memory Bank,
+ * including unrelated files and opaque private/link entries. */
+export function prepareDistillDocumentPlan(destinationRoot, outputs, canonicalPaths = new Set()) {
+    return prepareDocumentPlan(destinationRoot, outputs, canonicalPaths, "distill");
+}
+/** Physical bounded repair plan only. A null output explicitly requests removal
+ * of that selected existing document. Intake/Work/user authority belongs to the
+ * caller; this helper never expands selection or admits canonical exceptions. */
+export function prepareMemoryFixDocumentPlan(destinationRoot, outputs) {
+    return prepareDocumentPlan(destinationRoot, outputs, new Set(), "memory_fix");
+}
+function prepareDocumentPlan(destinationRoot, outputs, canonicalPaths, family) {
+    const refuse = (reason) => { throw new AppError(`${family}_publication_invalid`, "Publication requires its exact retained document plan", 2, { reason, effect: "no_effect" }); };
+    if (!outputs.length || outputs.length > 4096 || new Set(outputs.map(output => output.path)).size !== outputs.length)
+        refuse("invalid_output_selection");
+    let total = 0;
+    for (const output of outputs) {
+        if (output.bytes === null && family === "memory_fix")
+            continue;
+        if (!(output.bytes instanceof Uint8Array) || output.bytes.length > 16 * 1024 * 1024 || (total += output.bytes.length) > 64 * 1024 * 1024)
+            refuse("unbounded_output");
+        try {
+            new TextDecoder("utf-8", { fatal: true }).decode(output.bytes);
+        }
+        catch {
+            refuse("non_text_document");
+        }
+    }
+    const selected = [...outputs].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    const before = MemoryRepairDocumentBaseline.capture(destinationRoot, selected.map(output => output.path), canonicalPaths);
+    const entries = new Map(before.entries().map(entry => [entry.path, entry]));
+    const actions = [];
+    for (const output of selected) {
+        if (output.bytes === null) {
+            const prior = entries.get(output.path);
+            if (!prior || prior.kind !== "file")
+                return refuse("delete_requires_existing_document");
+            entries.delete(output.path);
+            actions.push({ path: output.path, before: prior, after: null, bytes_base64: null });
+            continue;
+        }
+        const parts = output.path.split("/");
+        for (let length = 1; length < parts.length; length++) {
+            const logical = parts.slice(0, length).join("/");
+            if (!entries.has(logical)) {
+                const after = { path: logical, kind: "directory", mode: 0o755, sha256: null };
+                entries.set(logical, after);
+                actions.push({ path: logical, before: null, after, bytes_base64: null });
+            }
+        }
+        const prior = entries.get(output.path) ?? null;
+        const after = { path: output.path, kind: "file", mode: prior?.mode ?? 0o644, sha256: hash(output.bytes) };
+        if (hybridDigest(prior) === hybridDigest(after))
+            continue;
+        entries.set(output.path, after);
+        actions.push({ path: output.path, before: prior, after, bytes_base64: Buffer.from(output.bytes).toString("base64") });
+    }
+    const beforeData = JSON.parse(before.bytes().toString("utf8"));
+    const afterMaterial = { ...beforeData, entries: orderMemoryDocumentEntries(entries.values()) };
+    const after = MemoryRepairDocumentBaseline.restore(Buffer.from(JSON.stringify(afterMaterial)), hybridDigest({ ...afterMaterial, schema_id: undefined }));
+    const receipt = { before_sha256: before.sha256, before_base64: before.bytes().toString("base64"),
+        after_sha256: after.sha256, after_base64: after.bytes().toString("base64"), actions };
+    before.revalidate(destinationRoot);
+    return RetainedMemoryRepairPublicationPlan.restore(Buffer.from(JSON.stringify(receipt)), hybridDigest(receipt));
+}
+function privateDirectory(parent, name) {
+    const directory = path.join(parent, name);
+    if (!fs.lstatSync(directory, { throwIfNoEntry: false }))
+        fs.mkdirSync(directory, { mode: 0o700 });
+    const stat = fs.lstatSync(directory);
+    if (!stat.isDirectory() || fs.realpathSync(directory) !== directory)
+        refuse("unsafe_staging_directory");
+    return directory;
+}
+function syncDirectory(directory) {
+    const fd = fs.openSync(directory, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    try {
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+/** One recoverable physical step of an independently retained plan. This
+ * grants no publication authority: its owner must fence SQL/source/scope
+ * custody on every call, then retain the actual completion separately.
+ * A changed prefix is never recaptured or overwritten on retry. */
+export function applyDistillDocumentStep(destinationRoot, plan, assertAuthority) {
+    return applyDocumentStep(destinationRoot, plan, assertAuthority, "distill");
+}
+/** Same prefix/recovery mechanics as distill, with selected removals moved into
+ * private staging rather than erased. No Stage or publication authority here. */
+export function applyMemoryFixDocumentStep(destinationRoot, plan, assertAuthority) {
+    return applyDocumentStep(destinationRoot, plan, assertAuthority, "memory_fix");
+}
+function applyDocumentStep(destinationRoot, plan, assertAuthority, family) {
+    const refuse = (reason) => { throw new AppError(`${family}_publication_invalid`, "Publication requires its exact retained document plan", 2, { reason, effect: "no_effect" }); };
+    if (!(plan instanceof RetainedMemoryRepairPublicationPlan) || typeof assertAuthority !== "function")
+        refuse("retained_plan_and_authority_required");
+    const actions = plan.actions();
+    if (family === "distill" && actions.some(action => !action.after))
+        refuse("distillation_does_not_delete_documents");
+    assertAuthority();
+    const initial = plan.classify(destinationRoot);
+    const removedDirectory = path.join(destinationRoot, ".dd-flow/memory-fix-publications", plan.sha256);
+    for (const [index, action] of actions.slice(0, initial.completed).entries())
+        if (!action.after) {
+            if (fs.realpathSync(removedDirectory) !== removedDirectory || (fs.lstatSync(removedDirectory).mode & 0o7777) !== 0o700)
+                refuse("removed_document_custody_changed");
+            const logical = `removed-${index}.md`, location = { root: "workspace", path: logical };
+            const original = ObservedMemorySources.capture({ workspace: removedDirectory }, [location]);
+            const stat = fs.lstatSync(path.join(removedDirectory, logical));
+            if (hash(original.bytes(location)) !== action.before.sha256 || !stat.isFile() || stat.nlink !== 1
+                || (stat.mode & 0o7777) !== action.before.mode)
+                refuse("removed_document_custody_changed");
+            syncDirectory(removedDirectory);
+        }
+    for (const action of actions.slice(0, initial.completed))
+        syncDirectory(path.dirname(path.join(destinationRoot, action.path)));
+    if (initial.completed === initial.total) {
+        assertAuthority();
+        return { ...initial, status: "applied", replayed: true };
+    }
+    const service = privateDirectory(destinationRoot, ".dd-flow"), namespace = privateDirectory(service, family === "distill" ? "distill-publications" : "memory-fix-publications");
+    const directory = privateDirectory(namespace, plan.sha256);
+    if ((fs.lstatSync(directory).mode & 0o7777) !== 0o700)
+        refuse("nonprivate_staging_directory");
+    publishImmutableInput(path.join(directory, "owner.json"), Buffer.from(JSON.stringify({ schema_id: family === "distill" ? "dd-flow/distill-document-staging@1" : "dd-flow/memory-fix-document-staging@1", destination_root: destinationRoot, plan_sha256: plan.sha256 })), `${family}_staging_conflict`);
+    const lock = acquireInstallationLock(path.join(namespace, "destination.lock"), plan.sha256);
+    let effected = false, released = false;
+    const release = () => { lock.release(); released = true; };
+    try {
+        lock.assertOwnership();
+        assertAuthority();
+        const current = plan.classify(destinationRoot);
+        if (current.completed !== initial.completed)
+            refuse("publication_cursor_changed");
+        const action = actions[current.completed], destination = path.join(destinationRoot, action.path);
+        if (!action.after) {
+            const removed = path.join(directory, `removed-${current.completed}.md`);
+            if (fs.lstatSync(removed, { throwIfNoEntry: false }))
+                refuse("foreign_removed_document");
+            assertAuthority();
+            lock.assertOwnership();
+            if (plan.classify(destinationRoot).completed !== current.completed)
+                refuse("publication_cursor_changed");
+            effected = true;
+            fs.renameSync(destination, removed);
+            syncDirectory(directory);
+        }
+        else if (action.after.kind === "file") {
+            const staged = stageRetainedMemoryRepairFile(directory, `action-${current.completed}.tmp`, plan.output(action.path), action.after.mode);
+            verifyRetainedMemoryRepairFile(staged.path, plan.output(action.path), action.after.mode);
+            assertAuthority();
+            lock.assertOwnership();
+            if (plan.classify(destinationRoot).completed !== current.completed)
+                refuse("publication_cursor_changed");
+            effected = true;
+            fs.renameSync(staged.path, destination);
+            syncDirectory(directory);
+        }
+        else {
+            const staged = path.join(directory, `directory-${current.completed}.tmp`);
+            if (!fs.lstatSync(staged, { throwIfNoEntry: false }))
+                fs.mkdirSync(staged, { mode: 0o700 });
+            const stat = fs.lstatSync(staged);
+            if (!stat.isDirectory() || fs.realpathSync(staged) !== staged || fs.readdirSync(staged).length
+                || ![0o700, action.after.mode].includes(stat.mode & 0o7777))
+                refuse("foreign_staged_directory");
+            fs.chmodSync(staged, action.after.mode);
+            syncDirectory(staged);
+            assertAuthority();
+            lock.assertOwnership();
+            if (plan.classify(destinationRoot).completed !== current.completed)
+                refuse("publication_cursor_changed");
+            effected = true;
+            fs.renameSync(staged, destination);
+            syncDirectory(directory);
+        }
+        syncDirectory(path.dirname(destination));
+        const observed = plan.classify(destinationRoot);
+        if (observed.completed !== current.completed + 1)
+            refuse("unexpected_publication_effect");
+        release();
+        return { ...observed, status: observed.completed === observed.total ? "applied" : "partial", replayed: false };
+    }
+    catch (error) {
+        let releaseFailure;
+        if (!released)
+            try {
+                release();
+            }
+            catch (failure) {
+                releaseFailure = failure instanceof Error ? failure.message : String(failure);
+            }
+        if (!effected && !releaseFailure)
+            throw error;
+        throw new AppError(`${family}_publication_pending`, "Reconcile the same retained publication; do not prepare a new baseline", 1, { effect: effected ? "publication_pending" : "no_effect", plan_sha256: plan.sha256, cause: error instanceof Error ? error.message : String(error),
+            ...(releaseFailure ? { release_failure: releaseFailure } : {}) });
+    }
+}