@deksden-com/dd-flow-cli 0.9.0-beta.155 → 0.9.0-beta.156

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.156
+
+### Patch Changes
+
+- b59c32b: Preserve current lifecycle successors, restore OpenCode retained child admission, and separate Work correction from technical pause and native resource cleanup. Continue an eligible completed child once per Work without replaying unknown effects or treating descriptive deviations as unfinished obligations.
+
+  Observe a concurrent controller-launch winner instead of rejecting an already accepted duplicate resume; retain physical ownership and launch CAS fences.
+
 ## 0.9.0-beta.155
 
 Versions beta.153 and beta.154 were used by unpublished preparation candidates; this release uses a new immutable identity. Older pending Changesets below reconcile release accounting rather than claim their functionality is new.

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.155",
-  "cli_commit": "2bfe677b16b348906e3015dc8db4ca5253824886",
-  "built_at": "2026-10-27T22:16:56.390Z",
+  "cli_version": "0.9.0-beta.156",
+  "cli_commit": "1a2bd0ea6d022b22e94f552f1cde1fb8e8b6689e",
+  "built_at": "2026-10-28T07:26:47.345Z",
   "built_with_canon": {
     "version": "4.1.3",
     "commit": "052ffdf0fff642a46485d2decc79bf78b1970d5e",

package/dist/cli/run-cli.js

@@ -408,7 +408,8 @@ async function runCliRequest(args, io, env) {
                             return;
                         nextNativeObservation = Date.now() + 250;
                         const { reconcileRetainedNativeHook } = await import("../services/retained-native-hook.js");
-                        await reconcileRetainedNativeHook(dispatchContext, { scope, invocationId, onProgress });
+                        await reconcileRetainedNativeHook(dispatchContext, { scope, invocationId, onProgress,
+                            onDiagnostic: value => io.stderr.write(`${JSON.stringify({ kind: "native_hook_diagnostic", ...value })}\n`) });
                     } } : {}) });
             if (admission.replay) {
                 retainedOutcome = admission.outcome;

package/dist/harness-runtime/lib/dd-opencode-daemon.mjs

@@ -69,9 +69,9 @@ async function forwardUsage(config, sessionId, snapshot) {
 async function freePort() { return await new Promise((resolve, reject) => { const server = net.createServer(); server.once("error", reject); server.listen(0, "127.0.0.1", () => { const port = server.address().port; server.close(() => resolve(port)); }); }); }
 const errorPayload = errorRecord;
 
-async function writePlugin(paths, config) {
+export async function writePlugin(paths, config) {
   const directory = path.join(paths.config, "opencode", "plugins"); await mkdir(directory, { recursive: true, mode: 0o700 });
-  const source = `import { makeOpenCodePlugin } from ${JSON.stringify(new URL("./opencode-plugin.mjs", import.meta.url).href)};\nexport default makeOpenCodePlugin(${JSON.stringify({ stateDir: paths.dir, daemonId: config.daemonId, version: config.version, ddFlowBin: config.ddFlowBin, nodeBin: process.execPath, ddFlowHome: config.ddFlowHome, projectRoot: config.projectRoot, resourceHome: config.resourceHome, nativeWorkStartAdmission: true })});\n`;
+  const source = `import { makeOpenCodePlugin } from ${JSON.stringify(new URL("./opencode-plugin.mjs", import.meta.url).href)};\nexport default makeOpenCodePlugin(${JSON.stringify({ stateDir: paths.dir, daemonId: config.daemonId, version: config.version, ddFlowBin: config.ddFlowBin, nodeBin: process.execPath, ddFlowHome: config.ddFlowHome, projectRoot: config.projectRoot, resourceHome: config.resourceHome, runtime_owner: config.runtime_owner, noFlow: config.noFlow, nativeWorkStartAdmission: true })});\n`;
   const checksum = createHash("sha256").update(source).digest("hex"); await writeFile(path.join(directory, "dd-flow.js"), source, { mode: 0o600 }); return checksum;
 }
 async function prepare(paths, config, authSource) {

package/dist/harness-runtime/lib/delegation-instructions.d.mts

@@ -1,7 +1,7 @@
 export type DelegationWork = { work_id: string; start_command: string; launch_policy?: string };
 export type DelegationInput = { harness: string; stage: string; capacity: number; works?: DelegationWork[]; totalWorks?: number; remainingWorks?: number };
 export function delegationAdapter(harness: string): string | null;
-export function renderNativeChildFollowupInstruction(harness: string, childId: string | { session_id?: unknown; parent_session_id?: unknown; terminal_turn_id?: unknown; continuation_ref?: unknown }): string | null;
+export function renderNativeChildFollowupInstruction(harness: string, childId: string | { session_id?: unknown; parent_session_id?: unknown; terminal_turn_id?: unknown; continuation_ref?: unknown }, options?: { purpose: "work_repair"; context?: string }): string | null;
 export function delegationContract(harness: string): string;
 export const lifecycleRetryInstruction: string;
 export const lifecycleCommandCompletionInstruction: string;

package/dist/harness-runtime/lib/delegation-instructions.mjs

@@ -38,12 +38,15 @@ export function delegationAdapter(harness) {
 }
 
 /** Only documented same-child APIs may continue an existing native worker. */
-export function renderNativeChildFollowupInstruction(harness, childId) {
+export function renderNativeChildFollowupInstruction(harness, childId, options = {}) {
   const child = childId && typeof childId === "object" ? childId : null;
   childId = child?.session_id ?? childId;
   if (typeof childId !== "string" || !childId) return null;
   const adapter = delegationAdapter(harness), target = JSON.stringify(childId);
-  const message = JSON.stringify("Continue the same assigned Work after the transient provider failure; do not restart it or repeat committed lifecycle commands.");
+  if (options.purpose === "work_repair" && ["zcode", "antigravity"].includes(adapter)) return null;
+  const message = JSON.stringify(options.purpose === "work_repair"
+    ? `Continue the same assigned Work using this retained correction, not provider recovery. Inspect the original check/result diagnostic, correct the evidenced defect, and use only its issued successor. Do not restart the Work, spawn another child, or repeat committed/pending lifecycle commands.\n${options.context ?? ""}`
+    : "Continue the same assigned Work after the transient provider failure; do not restart it or repeat committed lifecycle commands.");
   if (adapter === "zcode") {
     const ref = child?.continuation_ref;
     if (ref?.schema_id !== "zcode/child-continuation@1" || ref.capability !== "dd-flow/managed-provider-recovery@1" || ref.child_session_id !== childId

package/dist/services/controller-child-repair.js

@@ -0,0 +1,95 @@
+import { AppError } from "../shared/errors.js";
+import { renderNativeChildFollowupInstruction, renderWaitInstructions } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { nativeItemsSettled } from "../harness-runtime/lib/provider-overload-policy.mjs";
+import { parseLifecycleCommand } from "./lifecycle-command.js";
+import { storageSessionId } from "./session-identity.js";
+import { stageWorkIds } from "./stage-work-graph.js";
+import { appendEvent, digest } from "./run-controller-state.js";
+const blocked = (workId, reason, diagnostic = {}) => new AppError("child_work_repair_blocked", "Completed child has no safe automatic Work correction", 1, { work_id: workId, reason, reconciliation_required: true, effect: "no_effect", ...diagnostic });
+/** One durable same-child correction per Work, not a provider retry or a new worker. */
+export function completedChildRepair(context, row, input) {
+    const members = stageWorkIds(context, row.project_id, row.run_id, input.stage);
+    for (const child of input.children) {
+        if (child.status !== "completed")
+            continue;
+        const links = context.db.all(`SELECT w.work_id,w.status FROM work_sessions ws
+      JOIN works w ON w.work_id=ws.work_id JOIN sessions s ON s.session_id=ws.session_id AND s.project_id=w.project_id
+      WHERE w.project_id=? AND w.run_id=? AND ws.session_id=? AND s.parent_session_id=?`, [row.project_id, row.run_id, storageSessionId({ harness_id: input.harness, session_id: child.session_id }), storageSessionId({ harness_id: input.harness, session_id: input.parentId })])
+            .filter(link => members.has(link.work_id));
+        if (!links.some(link => link.status === "running"))
+            continue;
+        if (links.length !== 1 || child.parent_session_id !== input.parentId || child.provenance === "parent_mismatch"
+            || !child.terminal_turn_id || !nativeItemsSettled(child.native_turn_items))
+            throw blocked(links[0].work_id, "native_identity_unconfirmed");
+        const workId = links[0].work_id;
+        if (context.db.get("SELECT 1 FROM check_receipts WHERE project_id=? AND run_id=? AND work_id=? AND status='running' LIMIT 1", [row.project_id, row.run_id, workId]))
+            continue;
+        if (context.db.get("SELECT 1 FROM works WHERE parent_work_id=? AND status IN ('created','running','paused') LIMIT 1", [workId]))
+            throw blocked(workId, "descendants_unsettled");
+        const previous = context.db.get(`SELECT e.controller_id,e.data_json FROM run_controller_events e
+      JOIN run_controllers c ON c.controller_id=e.controller_id WHERE c.project_id=? AND c.run_id=?
+      AND e.event_type='work_repair_reserved' AND json_extract(e.data_json,'$.work_id')=? ORDER BY e.sequence LIMIT 1`, [row.project_id, row.run_id, workId]);
+        if (previous) {
+            const retained = JSON.parse(previous.data_json);
+            const operation = context.db.get("SELECT status,input_json FROM run_controller_operations WHERE operation_id=?", [retained.operation_id]);
+            const diagnostic = { operation_id: retained.operation_id, refusal_invocation_id: retained.refusal_invocation_id };
+            if (previous.controller_id !== row.controller_id || retained.generation !== row.generation || retained.terminal_turn_id !== child.terminal_turn_id
+                || retained.child_session_id !== child.session_id)
+                throw blocked(workId, "automatic_episode_exhausted", diagnostic);
+            if (operation?.status === "completed" || operation?.status === "failed")
+                throw blocked(workId, "followup_admission_unconfirmed", diagnostic);
+            // Same operation ID lets the adapter observe an uncertain dispatch. It
+            // may dispatch only if its own durable phase proves it never crossed out.
+            return retained;
+        }
+        const refusals = context.db.all("SELECT id,command,scope_json,identity_json,outcome_json FROM lifecycle_invocations WHERE status='settled' AND json_extract(outcome_json,'$.error.details.work_id')=? ORDER BY rowid DESC", [workId]);
+        const refusal = refusals.find(attempt => {
+            try {
+                const scope = JSON.parse(attempt.scope_json), identity = JSON.parse(attempt.identity_json ?? "null");
+                const parsed = parseLifecycleCommand(attempt.command);
+                return attempt.scope_json === context.env.DD_FLOW_INVOCATION_SCOPE && parsed.kind === "standalone" && parsed.invocation.operation === "work_finish" && scope.runId === row.run_id
+                    && scope.generation === row.generation && scope.rootSessionId === input.parentId
+                    && Array.isArray(identity) && identity[2] === child.session_id && identity[3] === input.parentId;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!refusal)
+            throw blocked(workId, "repair_refusal_missing");
+        const outcome = JSON.parse(refusal.outcome_json), error = outcome.error, details = error?.details;
+        const diagnostic = { refusal_invocation_id: refusal.id, primary_error: { code: error?.code, message: error?.message } };
+        if (details?.effect !== "no_effect" || details.recoverable !== true || typeof details.retry_command !== "string"
+            || typeof outcome.successor_invocation_id !== "string")
+            throw blocked(workId, "repair_successor_unproven", diagnostic);
+        const successor = context.db.get("SELECT scope_json,status FROM lifecycle_invocations WHERE id=?", [outcome.successor_invocation_id]);
+        if (successor?.status !== "issued" || successor.scope_json !== refusal.scope_json)
+            throw blocked(workId, "repair_successor_not_issued", diagnostic);
+        const instruction = renderNativeChildFollowupInstruction(input.harness, child, { purpose: "work_repair", context: JSON.stringify({ work_id: workId, code: error.code, message: error.message, retry_command: details.retry_command }) });
+        if (!instruction)
+            throw blocked(workId, "same_child_repair_unsupported", diagnostic);
+        return { work_id: workId, generation: row.generation, child_session_id: child.session_id, terminal_turn_id: child.terminal_turn_id, refusal_invocation_id: refusal.id,
+            successor_invocation_id: outcome.successor_invocation_id, operation_id: `${row.controller_id}:work-repair:${digest([row.run_id, workId])}`,
+            prompt: `Continue only the existing child for this unfinished Work. This is one bounded correction, not a new fanout wave.\n${instruction}\n\nA follow-up submission acknowledgement or the child's previous completed Turn is not completion of this correction. Wait for this same child's follow-up; never resend the message to poll it.\n${renderWaitInstructions({ harness: input.harness, stage: input.stage })}` };
+    }
+    return null;
+}
+export function reserveChildRepair(context, row, repair, assertOwner) {
+    context.db.writeTransaction(() => {
+        assertOwner();
+        if (repair.generation !== row.generation)
+            throw blocked(repair.work_id, "generation_changed_before_followup");
+        const work = context.db.get("SELECT status FROM works WHERE project_id=? AND run_id=? AND work_id=?", [row.project_id, row.run_id, repair.work_id]);
+        if (work?.status !== "running")
+            throw blocked(repair.work_id, "work_changed_before_followup");
+        const successor = context.db.get("SELECT status FROM lifecycle_invocations WHERE id=?", [repair.successor_invocation_id]);
+        if (successor?.status !== "issued")
+            throw blocked(repair.work_id, "successor_changed_before_followup");
+        const reserved = context.db.get(`SELECT e.controller_id,e.data_json FROM run_controller_events e JOIN run_controllers c ON c.controller_id=e.controller_id
+      WHERE c.project_id=? AND c.run_id=? AND e.event_type='work_repair_reserved' AND json_extract(e.data_json,'$.work_id')=?`, [row.project_id, row.run_id, repair.work_id]);
+        if (reserved && (reserved.controller_id !== row.controller_id || reserved.data_json !== JSON.stringify(repair)))
+            throw blocked(repair.work_id, "episode_reserved_by_another_dispatch");
+        if (!reserved)
+            appendEvent(context, row.controller_id, "work_repair_reserved", repair);
+    });
+}

package/dist/services/controller-fanout.js

@@ -12,7 +12,7 @@ import { requireProjectByRoot } from "./projects.js";
 import { stageAttempt, stageWorkIds } from "./stage-work-graph.js";
 import { runtimeCommand } from "./runtime-command.js";
 import { promptDeliveryInstruction } from "./prompt-delivery.js";
-import { currentStageFinishCommand } from "./lifecycle-invocations.js";
+import { currentStageFinishAuthority } from "./lifecycle-invocations.js";
 import { acceptedChildWork } from "./controller-result-authority.js";
 function semanticCompletionPrompt(stage, completed, command) {
     const task = stage === "plan-review"
@@ -72,7 +72,10 @@ export async function nextControllerFanout(context, input) {
         throw new AppError("stage_graph_compatibility_required", "The retained graph cannot be dispatched by this controller; use the RUN's pinned engine", 1, { stage: input.stage, run_id: input.runId, graph: fanout });
     if (children.length) {
         const reconciled = await reconcileVnextFanout(context, { ...input, observations });
-        const issues = reconciled.issues.filter(issue => !["child_check_in_progress", "child_capacity_pending"].includes(issue.code));
+        // A known settled child's Work blocker does not consume an independent
+        // ready branch. It remains running, so this cannot manufacture Stage success.
+        const issues = reconciled.issues.filter(issue => !["child_check_in_progress", "child_capacity_pending"].includes(issue.code)
+            && !(issue.code === "execution_ended_without_work_result" && issue.work_id && input.repairBlockedWorks?.includes(issue.work_id)));
         if (issues.length)
             throw new AppError("fanout_reconciliation_required", "Native child outcome requires reconciliation, not replay", 1, { issues });
         const unsettled = children.filter(child => child.status === "running" || child.status === "unknown");
@@ -214,10 +217,12 @@ export async function nextControllerFanout(context, input) {
             ].join("\n\n"));
         }
     }
-    const finish = currentStageFinishCommand(context, input.stage);
+    const finish = currentStageFinishAuthority(context, input.stage);
     if (!finish)
-        throw new AppError("controller_finish_authority_missing", "Settled child Work has no current issued Stage finish; reconcile lifecycle authority", 1, { stage: input.stage });
-    return prompt("semantic_completion", semanticCompletionPrompt(input.stage, fanout.works.completed, finish));
+        throw new AppError("controller_finish_authority_missing", "Settled child Work has no current Stage finish authority", 1, { stage: input.stage, reconciliation_required: true });
+    if (finish.status !== "issued" || !finish.command)
+        throw new AppError("controller_finish_authority_pending", "Observe the original Stage finish before another productive dispatch", 1, { stage: input.stage, invocation_id: finish.id, status: finish.status, reconciliation_required: true });
+    return prompt("semantic_completion", semanticCompletionPrompt(input.stage, fanout.works.completed, finish.command));
 }
 /** Shared pinned runtime normalization; preserve structured errors at the TS boundary. */
 export function controllerNativeChildren(receipt, rootSessionId) {

package/dist/services/lifecycle-invocations.js

@@ -108,7 +108,7 @@ export function isRetryableLifecycleRejection(code, details = {}) {
         return details.recoverable !== false;
     if (["work_checks_failed", "code_gate_failed", "code_review_gate_failed", "merge_gate_failed"].includes(code))
         return Array.isArray(details.failures) && details.failures.length > 0 && details.failures.every(receipt => checkDiagnosisDisposition(receipt) === "diagnosis_required");
-    return details.recoverable === true || ["review_repair_incomplete", "plan_review_incomplete", "semantic_result_invalid",
+    return details.recoverable === true || ["work_contract_incomplete", "review_repair_incomplete", "plan_review_incomplete", "semantic_result_invalid",
         "review_evidence_invalid", "evidence_obligation_unknown", "invalid_evidence_ref",
         "evidence_ref_missing", "evidence_line_out_of_range", "document_update_missing",
         "document_update_not_materialized", "review_repair_no_change"].includes(code)
@@ -765,18 +765,23 @@ function invocationRecoverySnapshot(context, scope) {
 }
 /** Resolve authority, never reconstruct it from an old prompt or issue on read. */
 export function currentStageFinishCommand(context, stage) {
+    return currentStageFinishAuthority(context, stage)?.command ?? null;
+}
+/** Observation of an existing attempt is not permission to dispatch it again. */
+export function currentStageFinishAuthority(context, stage) {
     const scope = context.env.DD_FLOW_INVOCATION_SCOPE;
     if (!scope || !context.db.get("SELECT 1 FROM sqlite_master WHERE name='lifecycle_invocations'"))
         return null;
-    const rows = context.db.all("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND status = 'issued'", [scope])
+    const rows = context.db.all("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND status IN ('issued','observed','executing')", [scope])
         .filter(row => {
         const parsed = invocation(row.command);
-        return parsed.operation === "stage_finish" && commandOption(parsed, "stage") === stage
-            && (row.deadline === null || row.deadline > Date.now());
+        return parsed.operation === "stage_finish" && commandOption(parsed, "stage") === stage;
     });
     if (rows.length > 1)
         throw new AppError("invocation_ambiguous", "Stage has multiple current finish authorities", 1, { stage });
-    return rows[0] ? publicInvocationCommand(context, rows[0], rows[0].command) : null;
+    const row = rows[0];
+    return row ? { id: row.id, status: row.status, command: row.status === "issued" && (row.deadline === null || row.deadline > Date.now())
+            ? publicInvocationCommand(context, row, row.command) : null } : null;
 }
 export function managedInvocationContext(context, input) {
     const env = { ...context.env, DD_FLOW_CURRENT_INVOCATION: undefined, DD_FLOW_INVOCATION_SCOPE: undefined };
@@ -1876,7 +1881,8 @@ export function observedLifecycleInvocation(context, command, scopeConstraint, c
     const retainedId = suppliedId && context.db.get("SELECT id FROM lifecycle_invocations WHERE id = ?", [suppliedId]) ? suppliedId : undefined;
     // `issued` is a rendezvous, not authority: the CLI still blocks in
     // awaitLifecycleInvocation until the native observer commits the receipt.
-    const matching = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing','settled') ORDER BY rowid DESC")
+    const history = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing','settled') ORDER BY rowid DESC");
+    const matching = history
         .filter(row => {
         try {
             const explicitId = retainedId;
@@ -1896,7 +1902,7 @@ export function observedLifecycleInvocation(context, command, scopeConstraint, c
         }
     });
     const identity = correlation?.identity;
-    const matches = lifecycleCandidates(matching, identity ? JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId]) : undefined, true);
+    const matches = lifecycleCandidates(matching, identity ? JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId]) : undefined, true, history);
     if (!matches.length)
         return null;
     if (matches.length !== 1)
@@ -1905,8 +1911,9 @@ export function observedLifecycleInvocation(context, command, scopeConstraint, c
 }
 /** A new native call may consume a successor, but never a historical result.
  * Exact native delivery replays its immutable assignment. CLI lookup without
- * native correlation remains ambiguous when history and a successor coexist. */
-function lifecycleCandidates(rows, identity, lookup = false) {
+ * native correlation may use a uniquely bound committed successor, not an
+ * arbitrary newest/active row. Unrelated history remains ambiguous. */
+function lifecycleCandidates(rows, identity, lookup = false, history = rows) {
     if (identity) {
         const replay = rows.filter(row => {
             if (!row.identity_json)
@@ -1927,6 +1934,26 @@ function lifecycleCandidates(rows, identity, lookup = false) {
             return replay;
     }
     const active = rows.filter(row => row.status !== "settled");
+    if (lookup && !identity && active.length === 1 && (active[0].status === "issued" || active[0].identity_json && active[0].event_key)) {
+        const current = active[0];
+        const leadsToCurrent = (row, seen = new Set()) => {
+            if (row.id === current.id)
+                return true;
+            if (row.status !== "settled" || seen.has(row.id))
+                return false;
+            seen.add(row.id);
+            try {
+                const next = JSON.parse(row.outcome_json ?? "null")?.successor_invocation_id;
+                const successor = history.find(candidate => candidate.id === next && candidate.scope_json === current.scope_json);
+                return Boolean(successor && leadsToCurrent(successor, seen));
+            }
+            catch {
+                return false;
+            }
+        };
+        if (rows.every(row => leadsToCurrent(row)))
+            return active;
+    }
     return (!lookup || identity) && active.length ? active : rows;
 }
 /** Restore private assignment arguments without discarding the provider's

package/dist/services/retained-native-hook.js

@@ -12,6 +12,7 @@ import { handleAgyEvent, handleCodexHook, handleDroidEvent, handleOpenCodeEvent,
 import { withDaemonProgressObserver } from "../harness-runtime/lib/daemon-observation.mjs";
 const object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
 const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const diagnostics = new WeakMap();
 async function regularJson(file) {
     try {
         const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
@@ -65,6 +66,23 @@ function payloadCommand(binding) {
  * binding from its verified native-delivery map before it becomes a receipt. */
 export async function reconcileRetainedNativeHook(context, input) {
     const { scope, invocationId } = input;
+    const diagnostic = (phase, error, binding) => {
+        if (!input.onDiagnostic)
+            return;
+        const supplied = error instanceof Error || object(error) ? error.code : undefined;
+        const code = typeof supplied === "string" && /^[A-Za-z][A-Za-z0-9_]{0,95}$/.test(supplied) ? supplied : "native_hook_verification_unavailable";
+        // Diagnostics never become execution authority or activity. Keep identifiers
+        // and a typed cause, not native messages/configs that can contain credentials.
+        const value = { phase, code, invocation_id: invocationId,
+            ...(typeof binding?.request_id === "string" ? { request_id: binding.request_id } : {}),
+            ...(typeof binding?.operation_id === "string" ? { operation_id: binding.operation_id } : {}) };
+        const seen = diagnostics.get(context) ?? new Set(), key = JSON.stringify(value);
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        diagnostics.set(context, seen);
+        input.onDiagnostic(value);
+    };
     if (!scope.runId || context.env.DD_FLOW_DAEMON_ID !== scope.daemonId)
         return false;
     let owner = null;
@@ -84,17 +102,22 @@ export async function reconcileRetainedNativeHook(context, input) {
     let metadata;
     try {
         const state = readNativeDaemonState(stateDir);
-        if ((state.daemon_id ?? state.config?.daemonId) !== scope.daemonId)
+        if ((state.daemon_id ?? state.config?.daemonId) !== scope.daemonId) {
+            diagnostic("owner", { code: "daemon_owner_mismatch" });
             return false;
+        }
         const project = requireProjectByRoot(context, scope.projectRoot);
         owned = requireManagedDaemonBinding(context, { stateDir, projectId: project.id, runId: scope.runId });
         metadata = JSON.parse(owned.process.metadata_json);
     }
-    catch {
+    catch (error) {
+        diagnostic("owner", error);
         return false;
     }
-    if (metadata.run_generation !== scope.generation)
+    if (metadata.run_generation !== scope.generation) {
+        diagnostic("owner", { code: "run_generation_mismatch" });
         return false;
+    }
     const operations = path.join(stateDir, "operations");
     if (!await realDirectory(operations))
         return false;
@@ -151,14 +174,20 @@ export async function reconcileRetainedNativeHook(context, input) {
                     || !(resolved.parent_provider_session_id === null || typeof resolved.parent_provider_session_id === "string")
                     || ["request_id", "operation_id", "daemon_id", "turn_generation", "source_harness", "root_provider_session_id", "provider_session_id",
                         "tool_call_id", "event", "native_command", "command_sha256", "native_creator", "native_admission"].some(key => resolved[key] !== binding[key])
-                    || payloadCommand(resolved) !== binding.native_command)
+                    || payloadCommand(resolved) !== binding.native_command) {
+                    diagnostic("verify", { code: "native_hook_unproven" }, binding);
                     continue;
+                }
                 verified.push(resolved);
             }
             else if (proof.verified === true && JSON.stringify(proof.nativeHookBinding) === JSON.stringify(binding))
                 verified.push(binding);
+            else
+                diagnostic("verify", { code: "native_hook_unproven" }, binding);
+        }
+        catch (error) {
+            diagnostic("verify", error, binding);
         }
-        catch { /* Legacy/retired daemons cannot attest a retained fact. */ }
     }
     // Exact old tool delivery belongs to its immutable prior attempt. A public
     // command may be identical in a fresh no-effect successor; do not repeatedly

package/dist/services/run-controller-process.js

@@ -79,12 +79,25 @@ async function prepareSpawn(context, row) {
     const launch = launchRecord(context, row);
     if (!launch || launch.value.dispatch_ready || !["starting", "running", "recovery_required"].includes(row.status))
         return null;
-    const launcher = await physicalStartup(context.databaseDeadlineAt).birth(() => {
-        const current = requireController(context, row.controller_id);
-        if (current.owner_token !== row.owner_token || current.generation !== row.generation)
-            throw new AppError("controller_owner_mismatch", "Controller launch owner changed during physical observation", 1);
-        assertLaunchAllowed(context, current);
-    });
+    const superseded = new AppError("controller_owner_mismatch", "Controller launch owner changed during physical observation", 1);
+    let launcher;
+    try {
+        launcher = await physicalStartup(context.databaseDeadlineAt).birth(() => {
+            const current = requireController(context, row.controller_id);
+            if (current.generation !== row.generation)
+                throw new AppError("controller_owner_mismatch", "Controller launch generation changed during physical observation", 1);
+            if (current.owner_token !== row.owner_token)
+                throw superseded;
+            assertLaunchAllowed(context, current);
+        });
+    }
+    catch (error) {
+        // Like a lost launch CAS below, a concurrent winner is observed, not
+        // retried or replaced. Other ownership/admission errors remain refusals.
+        if (error === superseded)
+            return null;
+        throw error;
+    }
     const resourceContext = { ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: JSON.parse(row.manifest_json).resource_home } };
     const ours = launch.value.pid === launcher.pid && launch.value.pid_started_at === launcher.pid_started_at;
     let token = row.owner_token;

package/dist/services/run-controller.js

@@ -55,6 +55,8 @@ import { storageSessionId } from "./session-identity.js";
 import { RECOVERY_POLICY as CAPACITY_POLICY, nativeItemsSettled, recoveryExhausted as overloadExhausted, recoveryRefusal as refusalObservation, terminalProviderRecovery as terminalProviderOverload, normalizeRecoveryFailure } from "../harness-runtime/lib/provider-overload-policy.mjs";
 import { renderNativeChildFollowupInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
 import { childCapacityDispatchAllowed, childCapacityRecoveryDecision, closeSuccessfulChildCapacity, reconcileChildCapacity } from "./controller-child-capacity.js";
+import { completedChildRepair, reserveChildRepair } from "./controller-child-repair.js";
+import { getVnextFanoutStatus } from "./vnext-fanout.js";
 import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
 import { recordTechnicalNote } from "./technical-notes.js";
 import { acceptedChildWork, acceptedChildrenRetired, controllerObligation, controllerObligationAccepted, lateNativeFailure } from "./controller-result-authority.js";
@@ -673,7 +675,9 @@ async function executeController(context, row, manifest, state, assertOwnership,
         return false;
     });
     const pauseDependency = async (session, sourceOperationId) => {
-        assertOwner();
+        // The control intent contains the retained productive failure; it must not
+        // require that same failure to disappear before the owner can pause it.
+        assertPhysicalOwner();
         note(session, "native_writer_dependency_blocked", "stage_transition", "dependency_blocked");
         const requestId = `technical:${row.controller_id}:${row.generation}:${digest([state.stage, session.state_dir]).slice(0, 20)}`;
         const input = { projectRoot: manifest.request.project_root, runId: row.run_id, requestId, action: "pause" };
@@ -1394,8 +1398,51 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     continue;
                 }
             }
+            const repairBlockedWorks = [];
+            if (!retainedFailures.length && children.some(child => child.status === "completed" && !acceptedChildWork(context, row, childHarness, session.id, child.session_id))) {
+                const inspected = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                state.last_receipt = inspected;
+                saveState(context, row, state);
+                children = controllerNativeChildren(inspected, session.id).filter(child => !baseline.has(child.session_id));
+                // Do not compete with an active parent/healthy sibling or turn a known
+                // repair into a replacement fanout wave.
+                if (inspected.settled !== true || children.some(child => ["running", "unknown"].includes(child.status))) {
+                    setStatus("waiting_for_children");
+                    await delay(1000, undefined, { signal: cancellation.signal });
+                    continue;
+                }
+                let repair = null;
+                const blockers = [];
+                for (const child of children) {
+                    try {
+                        repair ??= completedChildRepair(executionContext, row, { stage: next.stage, harness: childHarness, parentId: session.id, children: [child] });
+                    }
+                    catch (error) {
+                        if (!(error instanceof AppError) || error.code !== "child_work_repair_blocked")
+                            throw error;
+                        blockers.push(error);
+                    }
+                }
+                if (repair) {
+                    reserveChildRepair(executionContext, row, repair, assertOwner);
+                    await prompt(session, repair.prompt, repair.operation_id, undefined, "work", [repair.work_id]);
+                    continue;
+                }
+                if (blockers.length) {
+                    const graph = getVnextFanoutStatus(executionContext, { projectRoot: run.project_root, runId: run.id, stage: next.stage }).orchestration;
+                    if (!graph?.works.ready.length)
+                        throw blockers[0];
+                    for (const blocker of blockers) {
+                        const workId = String(blocker.details.work_id);
+                        repairBlockedWorks.push(workId);
+                        recordTechnicalNote(context, row.project_id, row.run_id, { code: "child_work_repair_blocked", message: blocker.message,
+                            phase: "work_repair", generation: row.generation, stage: next.stage, work_id: workId, harness: childHarness,
+                            resource_identity: workId, consequence: "dependency_blocked", diagnostic_reference: String(blocker.details.reason) });
+                    }
+                }
+            }
             const memoryFlow = ["mb-init", "mb-upgrade", "mb-fix", "interactive"].includes(run.flow_kind) || isSourceSnapshotFlow(run.flow_kind) || routing.kind === "descriptor" && isDeliveryFlow(run.flow_kind);
-            const fanoutInput = { projectRoot: run.project_root, runId: run.id, stage: next.stage, harness: runtimeHarness(session.profile), sessionId: session.id, children, policy, profiles, dispatchFence: retainedFailures.length > 0 };
+            const fanoutInput = { projectRoot: run.project_root, runId: run.id, stage: next.stage, harness: runtimeHarness(session.profile), sessionId: session.id, children, policy, profiles, dispatchFence: retainedFailures.length > 0, repairBlockedWorks };
             const fanout = memoryFlow ? await runControllerMemoryTask(executionContext, { operation: "fanout", input: fanoutInput }, cancellation.signal)
                 : await nextControllerFanout(executionContext, fanoutInput);
             if (memoryFlow)

package/dist/services/work-registry.js

@@ -1943,8 +1943,8 @@ export function validateCodeWorkResult(work, value, projectRoot, runHome, runId)
     const ignored = ignoredWorkspacePaths(projectRoot, changedPaths);
     if (ignored.length)
         throw new AppError("environment_repair_not_product_change", "CODE Work must record ignored environment repair separately, not as a product changed_path", 2, { work_id: work.work_id, paths: ignored });
-    if ((result.deviations?.length ?? 0) > 0 || (result.blockers?.length ?? 0) > 0)
-        throw new AppError("work_contract_incomplete", "CODE Work cannot complete with unresolved deviations or blockers; fail the Work and report the contract mismatch", 2, { work_id: work.work_id, deviations: result.deviations ?? [], blockers: result.blockers ?? [] });
+    if ((result.blockers?.length ?? 0) > 0)
+        throw new AppError("work_contract_incomplete", "CODE Work cannot complete with unresolved blockers; correct the result or fail this Work with the evidenced blocker", 2, { work_id: work.work_id, blockers: result.blockers ?? [], phase: "prepare", effect: "no_effect", recoverable: true });
     const packet = codePacket(work);
     if (!packet)
         return;
@@ -2124,7 +2124,7 @@ function renderWorkerPromptBody(context, work, run, dependencies, commands) {
                 : ["Read the failed receipt and its stdout/stderr. Fix project-owned source, migration, test, formatting, or configuration errors in this same Work, then use the returned retry_command with your result. Internal invocation IDs are runtime-owned; do not copy or invent them. Do not invent a cause that does not appear in the retained output."];
     const codeContext = packet ? ["<semantic_spine>", JSON.stringify(packet.semantic_spine, null, 2), "</semantic_spine>", "", ...(packet.repair ? ["<repair_context>", JSON.stringify(packet.repair, null, 2), "Read the failed receipt and its linked stdout/stderr before editing. Preserve the accepted origin context and fix only the evidenced failure.", "</repair_context>", ""] : []), "<accepted_requirements>", JSON.stringify(packet.requirements, null, 2), "</accepted_requirements>", "", "<write_boundary_invariant>", "For a mutation guarded by membership, ownership, authorization or parent lifecycle state, preserve that predicate in the write statement or make guard and write one explicit transaction with the needed lock. A prior read may diagnose an error but never proves a later write remains allowed. Apply this to create, update, delete and parent-state mutations.", "</write_boundary_invariant>", "", "<acceptance_context>", "The criteria below are end-to-end context. Complete this Work's semantic contribution and declared checks; another ordered Work may own a different acceptance surface.", JSON.stringify(packet.acceptance, null, 2), "</acceptance_context>", "", "<required_read>", "These are mandatory starting sources, not a read allowlist. Read any additional project files needed to implement the Work correctly.", ...packet.required_read.map((item) => `- ${resolveRunReferences(item, work.run_id, requireRunHome(run))}`), "</required_read>", "", "<discovery_boundary>", "These are likely discovery areas, not a hard boundary. Expand project-local investigation when required and report material additions.", ...packet.discovery_boundary.map((item) => `- ${item}`), "</discovery_boundary>", "", "<planned_write_areas>", "SOFT COORDINATION HINT ONLY. These paths help the coordinator avoid concurrent collisions. They do not grant or deny write permission and do not limit the files needed for this Work. You may create or change any project file under workspace_root that is necessary and in semantic scope; report every actual changed path.", ...(packet.planned_write_areas.length ? packet.planned_write_areas.map((item) => `- ${item}`) : ["- none predicted; derive the necessary files from the task"]), "</planned_write_areas>", "", ...(packet.provides_checks.length ? ["<provided_checks>", ...packet.provides_checks.map((item) => `- ${item.id}: materialize ${item.command}${item.definition ? ` as ${item.definition}` : ""}; it is not usable until this Work finishes.`), "Update the declared project command or alias before Work finish. The CLI verifies materialization at Work finish. Execution occurs at its declared run_at gate, not necessarily in this Work.", "</provided_checks>", ""] : []), "<verification>", ...packet.checks.map((item) => `- ${item.id} at ${item.run_at}: ${item.command} — ${item.purpose}`), "The CLI executes work-scoped checks and retains their receipts. Report semantic evidence only; do not rerun declared checks manually.", "</verification>", "", "<stop_conditions>", ...packet.stop_conditions.map((item) => `- ${item}`), "</stop_conditions>", ""] : [];
     if (packet)
-        codeContext.push("<document_updates>", JSON.stringify(packet.document_updates, null, 2), "Materialize every listed update. dd-flow verifies the resulting file against its PLAN-time baseline.", "</document_updates>", "", "<completion_contract>", "Successful completion requires empty deviations and blockers and every assigned document update in changed_paths. A necessary path outside planned_write_areas is normal coordination drift, not a blocker; include it in changed_paths and continue.", "</completion_contract>", "");
+        codeContext.push("<document_updates>", JSON.stringify(packet.document_updates, null, 2), "Materialize every listed update. dd-flow verifies the resulting file against its PLAN-time baseline.", "</document_updates>", "", "<completion_contract>", "Successful completion requires no unresolved blockers and closure of every assigned obligation/document update. Record descriptive deviations as notes for review; their presence alone does not reject the Work. A necessary path outside planned_write_areas is normal coordination drift, not a blocker; include it in changed_paths and continue.", "</completion_contract>", "");
     if (packet)
         codeContext.push("<temporary_services>", "Prefer the declared check launcher: it already owns check resources. If the planned scenario genuinely requires an interactive HTTP service, use the managed supervisor below. This is a template: replace the project service command, port names and readiness path from the plan/project instructions; do not invent a fixed port.", `${command} runtime process start --run ${run.id} --project-root ${JSON.stringify(run.project_root)} --command '<project-service-command>' --ports api --ready-port api --ready-path /health --json --progress-jsonl`, "The service receives DD_FLOW_PORT_API (and equivalent variables for all declared names). The command stays running as its supervisor. Retain its tool handle; wait for the service ready event and read its service.json receipt. Pass those exact ports and the same project environment to reset/seed, API and browser operations.", "A ready receipt proves service readiness only. Record the scenario outcome and real evidence separately. After the scenario, execute the exact stop_command from that receipt, then wait for the supervisor to exit. Never use pkill/killall or stop a sibling's process. If cleanup fails, retain the process id and report the failure; do not claim the resource is free.", "</temporary_services>", "");
     return ["<work>", `- work_id: ${work.work_id}`, `- run_id: ${work.run_id}`, `- project_root: ${run.project_root}`, `- workspace_root: ${run.workspace_root}`, `- run_home: ${requireRunHome(run)}`, "</work>", "", "<cli_context>", `- Work commands use the short ID ${shortWorkId(work.work_id)}; dd-flow binds it to this RUN.`, `- @project = ${run.project_root}`, `- @workspace = ${run.workspace_root}`, `- @run = ${requireRunHome(run)}`, "- @ aliases are accepted only by declared dd-flow path parameters. Copy the quoted alias literally; do not add backslashes. Shell tools such as cat and rg require ordinary paths relative to cwd or absolute paths.", "- Lifecycle invocation IDs are internal runtime authority and are intentionally omitted from commands.", "</cli_context>", "", "<hard_write_boundary>", ...writeBoundary, "</hard_write_boundary>", "", ...codeContext, "<dependency_results>", JSON.stringify(dependencies.filter(Boolean), null, 2), "</dependency_results>", "", "<task>", resolveRunReferences(work.task, work.run_id, requireRunHome(run)), "</task>", "", ...(work.result_schema ? ["<result_contract>", `Return JSON matching \`${work.result_schema}\`.`, ...resultSchemaGuidance(work, run.id), `Write the completed JSON to ${resultInputPath}. This is an attempt input, not the canonical result.json receipt. dd-flow validates the file and atomically stores the canonical receipt.`, "</result_contract>", ""] : []), "<completion>", repairPacket ? "Repair Finish validates and publishes the exact private delta before Work settlement. Independent re-review, correction checks and Stage/RUN acceptance remain separate obligations." : packet?.repair?.verification_check_refs?.length ? "Work finish runs its normal work-scoped checks plus the listed causal repair checks. Their original run_at remains an aggregate obligation; this is the additional proof required before accepting this repair." : "Work finish runs only declared run_at=work checks. Stage finish owns readiness/code/merge gates; successful Work completion does not mean those gates have passed.", "A failed receipt means only that the check failed; it is not proof of an engine, harness, dependency, or environment blocker.", ...completionRepair, ...(repairPacket ? [] : [lifecycleRetryInstruction]), repairPacket ? "Use Fail for an evidenced external blocker or assignment conflict, including any required edit outside the exact write_paths allowlist. Never expand that allowlist or edit the shared checkout." : "Use Fail only for a concrete external blocker after deterministic bootstrap or a contradiction with an accepted requirement/non-goal. Never fail merely because a necessary project path was absent from planned_write_areas.", "Finish may run for several minutes. Preserve the shell tool's process/session handle and poll that same invocation until it exits; progress arrives as JSONL on stderr. Never reissue Finish merely because final stdout has not arrived.", `First write only the result JSON to ${resultInputPath}. Then run this standalone command:\n${finishWorkCommand}`, `Fail only for an evidenced external or semantic-contract blocker: ${failWorkCommand}`, "</completion>", ""].join("\n");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.155",
+  "version": "0.9.0-beta.156",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",