@deksden-com/dd-flow-cli 0.9.0-beta.156 → 0.9.0-beta.159

package/dist/services/lifecycle-invocations.js

@@ -17,7 +17,7 @@ import { observeCommandHook } from "./hooks.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { normalizedPathAlias, resolveContextualPaths } from "./command-context.js";
 import { isRegisteredRepair } from "./repair-receipt.js";
-import { stageAttempt } from "./stage-work-graph.js";
+import { stageAttempt, stageWorkIds } from "./stage-work-graph.js";
 import { contextualPathOptionsForLifecycle } from "../cli/command-inputs.js";
 import { canonicalPath } from "../storage/paths.js";
 import { runtimeCommand, shellArgument } from "./runtime-command.js";
@@ -378,12 +378,15 @@ export function assertLifecycleOutcomes(context, scope) {
     }
     const columns = context.db.all("PRAGMA table_info(hook_events)");
     if (columns.some(column => column.name === "outcome_json")) {
-        for (const row of context.db.all("SELECT outcome_json FROM hook_events WHERE project_id = ? AND json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ? ORDER BY id", [project.id, scope.runId, scope.generation])) {
+        for (const row of context.db.all("SELECT event_key, outcome_json FROM hook_events WHERE project_id = ? AND json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ? ORDER BY id", [project.id, scope.runId, scope.generation])) {
             const outcome = JSON.parse(row.outcome_json);
             if (outcome.disposition === "retrying" && outcome.deadline <= Date.now())
                 throw new AppError("lifecycle_outcome_unknown", "Storage retry has no terminal receipt; reconcile its committed evidence", 1, { lifecycle_outcome: outcome, effect: "unknown" });
-            if (outcome.disposition === "fatal" && !isRegisteredRepair(context, outcome.error?.details?.continuation, { projectId: project.id, runId: scope.runId }))
-                throw new AppError(outcome.error?.code ?? "lifecycle_outcome_unknown", outcome.error?.message || "Mandatory lifecycle failed (historical receipt has no message)", 1, { ...outcome.error?.details, lifecycle_outcome: outcome });
+            if (outcome.disposition === "fatal") {
+                const failure = applicableLifecycleRejection(context, { code: outcome.error?.code ?? "lifecycle_outcome_unknown", message: outcome.error?.message || "Mandatory lifecycle failed (historical receipt has no message)", details: outcome.error?.details }, { ...scope, projectId: project.id, stage: outcome.stage }, { eventKey: row.event_key });
+                if (failure)
+                    throw new AppError(failure.code, failure.message, 1, { ...failure.details, lifecycle_outcome: outcome });
+            }
         }
     }
     if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'"))
@@ -391,13 +394,15 @@ export function assertLifecycleOutcomes(context, scope) {
     const rows = context.db.all(`SELECT a.* FROM lifecycle_invocations a
     WHERE json_extract(a.scope_json, '$.projectRoot') = ? AND json_extract(a.scope_json, '$.runId') = ?
       AND json_extract(a.scope_json, '$.generation') = ? AND a.status = 'settled'
-      AND NOT EXISTS (SELECT 1 FROM lifecycle_invocations newer WHERE newer.scope_json = a.scope_json AND newer.fingerprint = a.fingerprint AND newer.rowid > a.rowid)
     ORDER BY a.rowid`, [scope.projectRoot, scope.runId, scope.generation]);
     for (const row of rows) {
         const outcome = row.outcome_json ? JSON.parse(row.outcome_json) : null;
         const error = outcome?.error;
-        if (typeof error?.code === "string" && !committedSuccessor(context, row, outcome) && !isCorrectableLifecycleRejection(error.code, error.details) && !isRegisteredRepair(context, error.details?.continuation, { projectId: project.id, runId: scope.runId }))
-            throw new AppError(error.code, typeof error.message === "string" ? error.message : "Mandatory lifecycle failed", 1, { ...(error.details ?? {}), invocation_id: row.id });
+        if (typeof error?.code === "string" && !isCorrectableLifecycleRejection(error.code, error.details)) {
+            const failure = applicableLifecycleRejection(context, { code: error.code, message: typeof error.message === "string" ? error.message : "Mandatory lifecycle failed", details: error.details }, { ...scope, projectId: project.id }, { invocationId: row.id });
+            if (failure)
+                throw new AppError(failure.code, failure.message, 1, { ...failure.details, invocation_id: failure.details.invocation_id ?? row.id });
+        }
     }
 }
 /** Hooks already own native identity. Retain command outcomes there, with an
@@ -600,6 +605,9 @@ export function observeLifecycleCommand(context, command, nativeEvent) {
                 }
                 if (error && parsed.kind === "standalone" && hookOnlyCorrection && error.details.recoverable !== false) {
                     const signature = preparationRejectionSignature(new AppError(error.code, error.message, 1, error.details));
+                    const inputKey = preparationInputKey(parsed.invocation, error.details);
+                    if (inputKey)
+                        error.details.input_key = inputKey;
                     error.details.hook_retry_signature = signature;
                     const repeated = context.db.get(`SELECT 1 FROM hook_events WHERE project_id = ? AND id <> ?
           AND json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ?
@@ -607,8 +615,9 @@ export function observeLifecycleCommand(context, command, nativeEvent) {
           AND json_extract(outcome_json, '$.harness') = ? AND json_extract(outcome_json, '$.session_id') = ?
           AND json_type(outcome_json, '$.stage') IS NOT NULL AND json_type(outcome_json, '$.attempt') IS NOT NULL
           AND json_extract(outcome_json, '$.stage') IS ? AND json_extract(outcome_json, '$.attempt') IS ?
-          AND json_extract(outcome_json, '$.error.details.hook_retry_signature') = ? LIMIT 1`, [anchor.project_id, anchor.hook_event_id, anchor.run_id, anchor.generation, anchor.operation, correlationKey,
-                        anchor.harness, anchor.session_id, anchor.stage ?? null, anchor.attempt ?? null, signature]);
+          AND json_extract(outcome_json, '$.error.details.hook_retry_signature') = ?
+          AND (? IS NULL OR json_extract(outcome_json, '$.error.details.input_key') = ?) LIMIT 1`, [anchor.project_id, anchor.hook_event_id, anchor.run_id, anchor.generation, anchor.operation, correlationKey,
+                        anchor.harness, anchor.session_id, anchor.stage ?? null, anchor.attempt ?? null, signature, inputKey ?? null, inputKey ?? null]);
                     if (!repeated) {
                         const argv = parsed.invocation.argv.filter((value, index, all) => !/^--(?:hook-event-id|invocation-id)(?:=|$)/.test(value)
                             && !/^--(?:hook-event-id|invocation-id)$/.test(all[index - 1] ?? ""));
@@ -619,8 +628,15 @@ export function observeLifecycleCommand(context, command, nativeEvent) {
                     }
                     else {
                         error.details.recoverable = false;
-                        error.details.repeated_without_progress = true;
-                        record.disposition = "fatal";
+                        delete error.details.retry_command;
+                        delete error.details.retry_instruction;
+                        if (inputKey)
+                            error.details.repeated_without_progress = true;
+                        else
+                            error.details.input_binding_unavailable = true;
+                        // An unread file is not evidence of unchanged contents. Withhold
+                        // automatic correction locally; do not turn that ignorance into fatal.
+                        record.disposition = inputKey ? "fatal" : "pending_continuation";
                     }
                 }
                 if (error && !auxiliary && record.disposition === "fatal") {
@@ -749,7 +765,7 @@ function currentIssuedCommand(context, scope, command, excludeId) {
 function scopedCommandFingerprint(context, scope, command) {
     return fingerprint(invocation(canonicalManagedCommand(context, command, JSON.parse(scope))));
 }
-function committedSuccessor(context, prior, outcome) {
+export function committedSuccessor(context, prior, outcome) {
     if (typeof outcome?.successor_invocation_id !== "string" || outcome.successor_invocation_id === prior.id)
         return null;
     const command = outcome.error?.details?.retry_command ?? outcome.result?.next?.finish_command;
@@ -1597,33 +1613,35 @@ export function observeLifecycleInvocation(context, input) {
 function observeLifecycleInvocationReceipt(context, input) {
     storage(context);
     const delivered = parseLifecycleCommand(input.command);
-    if (delivered.kind === "standalone") {
-        const id = commandOption(delivered.invocation, "invocation-id");
-        const direct = context.db.all("SELECT * FROM lifecycle_invocations WHERE admission_json IS NOT NULL AND status IN ('executing','settled')")
-            .filter(row => {
-            const scope = JSON.parse(row.scope_json);
-            if (id && row.id !== id || scope.daemonId !== input.identity.daemonId || scope.rootSessionId !== input.identity.rootSessionId)
-                return false;
-            // A fresh native call must bind the explicitly committed successor,
-            // not short-circuit to its predecessor's successful repair response.
-            // Exact delivery/explicit-ID replay remains historical read-only.
-            const successor = row.status === "settled" && row.outcome_json ? committedSuccessor(context, row, JSON.parse(row.outcome_json)) : null;
-            if (!id && row.identity_json && successor && ["issued", "observed"].includes(successor.status)
-                && !sameNativeCall(row.identity_json, JSON.stringify([input.identity.daemonId, input.identity.rootSessionId, input.identity.sessionId, input.identity.parentSessionId, input.identity.toolCallId])))
-                return false;
-            try {
-                return fingerprint(invocation(canonicalManagedCommand(context, delivered.invocation.command, scope))) === row.fingerprint;
-            }
-            catch {
-                return false;
-            }
-        });
-        if (direct.length === 1)
-            return { eventKey: direct[0].event_key, duplicate: true,
-                disposition: direct[0].status === "settled" ? "settled_read" : "in_flight", invocationId: direct[0].id };
-    }
     const projectRoot = input.projectId ? context.db.get("SELECT root FROM projects WHERE id = ?", [input.projectId])?.root : undefined;
+    // Selection is SQL-only and shared with CLI lookup. A historical result may
+    // return early, but never before considering its committed successor chain.
+    const correlation = { identity: input.identity, ...(input.id ? { id: input.id } : {}), ...(input.executionCwd === undefined ? {} : { executionCwd: input.executionCwd }), native: true };
+    let selected = null;
+    let deferredAmbiguity;
+    if (delivered.kind !== "none" && delivered.supported !== false) {
+        try {
+            selected = observedLifecycleInvocation(context, input.command, { daemonId: input.identity.daemonId, rootSessionId: input.identity.rootSessionId, ...(projectRoot ? { projectRoot } : {}) }, correlation);
+        }
+        catch (error) {
+            if (!(error instanceof AppError) || error.code !== "invocation_ambiguous")
+                throw error;
+            // A native root can retain assignments from different generations.
+            // Only the existing trusted owner discovery may narrow that scope.
+            deferredAmbiguity = error;
+        }
+    }
+    let selectedRow = selected ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [selected.id]) : undefined;
+    if (selectedRow?.admission_json && ["executing", "settled"].includes(selectedRow.status))
+        return { eventKey: selectedRow.event_key, duplicate: true,
+            disposition: selectedRow.status === "settled" ? "settled_read" : "in_flight", invocationId: selectedRow.id };
     const provenScope = projectRoot && input.harness ? managedNativeInvocationScope(context, projectRoot, input.identity, input.harness) : null;
+    if (deferredAmbiguity) {
+        if (!provenScope)
+            throw deferredAmbiguity;
+        selected = observedLifecycleInvocation(context, input.command, provenScope, correlation);
+        selectedRow = selected ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [selected.id]) : undefined;
+    }
     const owner = provenScope && input.harness && input.projectId ? managedNativeOwner(context, input.identity, input.harness, input.projectId) : null;
     const ownerSnapshot = () => {
         if (!provenScope?.runId || !input.projectId)
@@ -1645,7 +1663,8 @@ function observeLifecycleInvocationReceipt(context, input) {
         return JSON.stringify(rows);
     };
     const retainedOwner = ownerSnapshot();
-    const supplied = input.id ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [input.id]) : undefined;
+    const suppliedId = input.id ?? (delivered.kind !== "none" ? commandOption(delivered.invocation, "invocation-id") : undefined);
+    const supplied = suppliedId ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [suppliedId]) : undefined;
     const analysis = parseLifecycleCommand(input.command);
     if (analysis.kind === "none" || analysis.supported === false) {
         let issuedBarrier;
@@ -1724,11 +1743,11 @@ function observeLifecycleInvocationReceipt(context, input) {
             return false;
         return true;
     });
-    const candidates = lifecycleCandidates(matching, deliveredIdentity);
+    const candidates = lifecycleCandidates(context, matching, deliveredIdentity);
     // A known explicit ID remains a compatibility path. A missing or mistyped
     // public ID is corrected only by an exact operation/target match inside the
     // trusted native root. Never fuzzy-match UUID text or select a global latest.
-    const initial = supplied ?? (candidates.length === 1 ? candidates[0] : undefined);
+    const initial = supplied ?? selectedRow ?? (candidates.length === 1 ? candidates[0] : undefined);
     // A live observation arriving after direct admission is optional correlation,
     // never a second authority or an executing -> observed transition.
     if (initial?.admission_json && ["executing", "settled"].includes(initial.status))
@@ -1771,6 +1790,9 @@ function observeLifecycleInvocationReceipt(context, input) {
         const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [initial.id]);
         if (retainedOwner !== ownerSnapshot())
             throw new AppError("invocation_scope_unproven", "Native owner changed before admission receipt", 1, { effect: "no_effect" });
+        const current = observedLifecycleInvocation(context, input.command, scope, { ...(input.id ? { id: input.id } : {}), identity, ...(input.executionCwd === undefined ? {} : { executionCwd: input.executionCwd }), native: true });
+        if (!current || current.id !== initial.id)
+            throw new AppError("invocation_assignment_unproven", "Lifecycle continuation changed before native receipt; inspect its committed successor", 1, { effect: "no_effect", reconciliation_required: true, invocation_id: initial.id, successor_invocation_id: current?.id });
         if (row.scope_json !== initial.scope_json)
             throw new AppError("invocation_scope_mismatch", "Lifecycle scope changed before native receipt", 1, { effect: "no_effect" });
         if (row.status === "settled")
@@ -1800,10 +1822,11 @@ function observeLifecycleInvocationReceipt(context, input) {
         // its workdir is invalid), after which repeating the same issued command
         // is safe. Keep the newest receipt until the CLI claims the attempt. The
         // observed -> executing compare-and-swap remains the exactly-once boundary.
-        const updated = context.db.run("UPDATE lifecycle_invocations SET identity_json = ?, event_key = ?, status = 'observed', updated_at = ? WHERE id = ? AND status IN ('issued', 'observed')", [identityJson, eventKey, context.now(), initial.id]);
+        const updated = context.db.run("UPDATE lifecycle_invocations SET identity_json = ?, event_key = ?, status = 'observed', updated_at = ? WHERE id = ? AND scope_json = ? AND command = ? AND status IN ('issued', 'observed')", [identityJson, eventKey, context.now(), initial.id, initial.scope_json, initial.command]);
         // Once execution has been claimed, later PreToolUse observations are
         // retained as hook evidence but cannot replace the executor's receipt.
-        return { eventKey: updated.changes === 1 ? eventKey : row.event_key, duplicate: updated.changes !== 1, disposition: updated.changes === 1 ? "admitted" : "in_flight", ...resolved };
+        const retained = updated.changes === 1 ? row : context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [initial.id]);
+        return { eventKey: updated.changes === 1 ? eventKey : retained.event_key, duplicate: updated.changes !== 1, disposition: updated.changes === 1 ? "admitted" : "in_flight", ...resolved };
     });
 }
 /** Correlate exact native argv for diagnostics, independently of assignment
@@ -1877,19 +1900,38 @@ export function observedLifecycleInvocation(context, command, scopeConstraint, c
     if (analysis.kind === "none" || analysis.supported === false)
         return null;
     const leafCommand = analysis.invocation.command;
-    const suppliedId = commandOption(analysis.invocation, "invocation-id");
+    const inlineId = commandOption(analysis.invocation, "invocation-id");
+    if (inlineId && correlation?.id && inlineId !== correlation.id)
+        throw new AppError("invocation_identity_mismatch", "Explicit lifecycle identifiers disagree", 1, { effect: "no_effect" });
+    const suppliedId = correlation?.id ?? inlineId;
     const retainedId = suppliedId && context.db.get("SELECT id FROM lifecycle_invocations WHERE id = ?", [suppliedId]) ? suppliedId : undefined;
     // `issued` is a rendezvous, not authority: the CLI still blocks in
     // awaitLifecycleInvocation until the native observer commits the receipt.
-    const history = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing','settled') ORDER BY rowid DESC");
+    const retainedHistory = context.db.all("SELECT * FROM lifecycle_invocations ORDER BY rowid DESC");
+    const history = retainedHistory.filter(row => ["issued", "observed", "executing", "settled"].includes(row.status));
+    const inlineEvent = commandOption(analysis.invocation, "hook-event-id");
+    if (inlineEvent && correlation?.eventKey && inlineEvent !== correlation.eventKey)
+        throw new AppError("invocation_identity_mismatch", "Lifecycle event identifiers disagree", 1, { effect: "no_effect" });
+    const eventKey = inlineEvent ?? correlation?.eventKey;
+    if (correlation?.executionCwd !== undefined && !path.isAbsolute(correlation.executionCwd))
+        throw new AppError("invocation_directory_mismatch", "Bound lifecycle execution cwd must be absolute", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+    const identity = correlation?.identity;
+    const identityJson = identity ? JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId,
+        ...(correlation.executionCwd === undefined ? [] : [{ executionCwd: canonicalPath(correlation.executionCwd) }])]) : undefined;
+    const nativeRows = identityJson ? retainedHistory.filter(row => row.identity_json && sameNativeCall(row.identity_json, identityJson)) : [];
+    if (correlation?.native && nativeRows.some(row => row.identity_json !== identityJson))
+        throw new AppError("invocation_identity_mismatch", "The same native tool call changed its bound execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+    const bindings = [retainedId, ...retainedHistory.filter(row => eventKey && row.event_key === eventKey).map(row => row.id), ...nativeRows.map(row => row.id)].filter((id) => Boolean(id));
+    if (new Set(bindings).size > 1)
+        throw new AppError("invocation_identity_mismatch", "Lifecycle identifiers refer to different retained attempts", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+    const nativeBindingId = nativeRows[0]?.id;
     const matching = history
         .filter(row => {
         try {
-            const explicitId = retainedId;
-            const eventKey = commandOption(analysis.invocation, "hook-event-id") ?? correlation?.eventKey;
+            const explicitId = retainedId ?? nativeBindingId;
             if (explicitId && row.id !== explicitId || eventKey && row.event_key !== eventKey)
                 return false;
-            if (row.status === "settled" && (!row.outcome_json || JSON.parse(row.outcome_json).error) && !explicitId && !eventKey && !correlation?.identity)
+            if (row.status === "settled" && (!row.outcome_json || JSON.parse(row.outcome_json).error && !JSON.parse(row.outcome_json).successor_invocation_id) && !explicitId && !eventKey && !correlation?.identity)
                 return false;
             const scope = JSON.parse(row.scope_json);
             const constraint = typeof scopeConstraint === "string" ? { daemonId: scopeConstraint } : scopeConstraint;
@@ -1901,8 +1943,9 @@ export function observedLifecycleInvocation(context, command, scopeConstraint, c
             return false;
         }
     });
-    const identity = correlation?.identity;
-    const matches = lifecycleCandidates(matching, identity ? JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId]) : undefined, true, history);
+    if (nativeBindingId && !matching.length)
+        throw new AppError("invocation_identity_mismatch", "The same native tool call changed its bound lifecycle command or scope", 1, { phase: "prepare", effect: "no_effect", recoverable: false, invocation_id: nativeBindingId });
+    const matches = retainedId || eventKey ? matching : lifecycleCandidates(context, matching, identityJson, true);
     if (!matches.length)
         return null;
     if (matches.length !== 1)
@@ -1913,7 +1956,7 @@ export function observedLifecycleInvocation(context, command, scopeConstraint, c
  * Exact native delivery replays its immutable assignment. CLI lookup without
  * native correlation may use a uniquely bound committed successor, not an
  * arbitrary newest/active row. Unrelated history remains ambiguous. */
-function lifecycleCandidates(rows, identity, lookup = false, history = rows) {
+function lifecycleCandidates(context, rows, identity, lookup = false) {
     if (identity) {
         const replay = rows.filter(row => {
             if (!row.identity_json)
@@ -1923,8 +1966,8 @@ function lifecycleCandidates(rows, identity, lookup = false, history = rows) {
             if (!lookup)
                 return false;
             try {
-                const retained = JSON.parse(row.identity_json);
-                return Array.isArray(retained) && JSON.stringify(retained.slice(0, 5)) === identity;
+                const retained = JSON.parse(row.identity_json), delivered = JSON.parse(identity);
+                return Array.isArray(retained) && delivered.length === 5 && JSON.stringify(retained.slice(0, 5)) === identity;
             }
             catch {
                 return false;
@@ -1934,17 +1977,20 @@ function lifecycleCandidates(rows, identity, lookup = false, history = rows) {
             return replay;
     }
     const active = rows.filter(row => row.status !== "settled");
-    if (lookup && !identity && active.length === 1 && (active[0].status === "issued" || active[0].identity_json && active[0].event_key)) {
-        const current = active[0];
+    const terminal = rows.filter(row => row.status === "settled" && !JSON.parse(row.outcome_json ?? "null")?.successor_invocation_id);
+    const current = active.length === 1 ? active[0] : !active.length && terminal.length === 1 ? terminal[0] : undefined;
+    if (lookup && !current && !active.length && rows.some(row => JSON.parse(row.outcome_json ?? "null")?.successor_invocation_id)) {
+        throw new AppError("invocation_assignment_unproven", "Retained lifecycle chain has no current successor", 1, { effect: "no_effect", reconciliation_required: true });
+    }
+    if (lookup && current && (current.status === "issued" || current.status === "settled" || current.identity_json && current.event_key)) {
         const leadsToCurrent = (row, seen = new Set()) => {
             if (row.id === current.id)
-                return true;
+                return row.status !== "issued" || row.deadline === null || row.deadline > Date.now();
             if (row.status !== "settled" || seen.has(row.id))
                 return false;
             seen.add(row.id);
             try {
-                const next = JSON.parse(row.outcome_json ?? "null")?.successor_invocation_id;
-                const successor = history.find(candidate => candidate.id === next && candidate.scope_json === current.scope_json);
+                const successor = committedSuccessor(context, row, JSON.parse(row.outcome_json ?? "null"));
                 return Boolean(successor && leadsToCurrent(successor, seen));
             }
             catch {
@@ -1952,7 +1998,11 @@ function lifecycleCandidates(rows, identity, lookup = false, history = rows) {
             }
         };
         if (rows.every(row => leadsToCurrent(row)))
-            return active;
+            return [current];
+        // A declared but broken link cannot be repaired by picking an unrelated
+        // active row. Existing unlinked history remains a native rendezvous only.
+        if (rows.some(row => row.status === "settled" && JSON.parse(row.outcome_json ?? "null")?.successor_invocation_id))
+            return rows;
     }
     return (!lookup || identity) && active.length ? active : rows;
 }
@@ -1988,6 +2038,8 @@ export function resolveObservedLifecycleArgs(context, id, actualArgs) {
             const inline = argv.findIndex(value => value.startsWith(`--${publicKey}=`));
             if (inline >= 0)
                 argv[inline] = `--${publicKey}=${commandOption(actual, publicKey)}`;
+            else
+                argv.push(`--${publicKey}`, commandOption(actual, publicKey));
         }
     }
     return argv;
@@ -1998,24 +2050,47 @@ export function retainObservedLifecycleSemantics(context, id, argv) {
     const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [id]);
     if (!row || row.status !== "executing")
         throw new AppError("invocation_settlement_conflict", "Lifecycle attempt is not executing", 1, { invocation_id: id });
+    const command = commandWithObservedWorkSemantics(row, argv);
+    if (command === row.command)
+        return;
+    if (context.db.run("UPDATE lifecycle_invocations SET command = ?, updated_at = ? WHERE id = ? AND status = 'executing'", [command, context.now(), id]).changes !== 1) {
+        throw new AppError("invocation_settlement_conflict", "Lifecycle attempt changed before its public input was retained", 1, { invocation_id: id });
+    }
+}
+function commandWithObservedWorkSemantics(row, argv) {
     const parsed = invocation(row.command);
     if (!["work_fail", "work_finish"].includes(parsed.operation))
-        return;
+        return row.command;
     const prefix = Object.entries(parsed.env).map(([key, value]) => `${key}=${quote([value])}`).join(" ");
     const executable = launchExpression(parsed);
     const suffix = row.command.slice(shellSuffixOffset(row.command)).trimStart();
-    const command = `${prefix ? `${prefix} ` : ""}${executable} ${quote(argv)}${suffix ? ` ${suffix}` : ""}`;
+    // CLI dispatch removes presentation options. Update only the public semantic
+    // value, retaining the issued transport, response destination and shell suffix.
+    const actual = invocation(`${executable} ${quote(argv)}`);
+    const semanticKey = parsed.operation === "work_fail" ? "reason" : "result-file";
+    const retainedArgs = [...parsed.argv];
+    const value = commandOption(actual, semanticKey);
+    if (value !== undefined) {
+        const index = retainedArgs.findIndex(arg => arg === `--${semanticKey}` || arg.startsWith(`--${semanticKey}=`));
+        if (index >= 0) {
+            if (retainedArgs[index] === `--${semanticKey}`)
+                retainedArgs[index + 1] = value;
+            else
+                retainedArgs[index] = `--${semanticKey}=${value}`;
+        }
+        else
+            retainedArgs.push(`--${semanticKey}`, value);
+    }
+    const command = `${prefix ? `${prefix} ` : ""}${executable} ${quote(retainedArgs)}${suffix ? ` ${suffix}` : ""}`;
     checkCommand(row, command);
-    if (context.db.run("UPDATE lifecycle_invocations SET command = ?, updated_at = ? WHERE id = ? AND status = 'executing'", [command, context.now(), id]).changes !== 1) {
-        throw new AppError("invocation_settlement_conflict", "Lifecycle attempt changed before its public input was retained", 1, { invocation_id: id });
-    }
+    return command;
 }
-export function settleLifecyclePreparationRejection(context, id, error) {
+export function settleLifecyclePreparationRejection(context, id, error, preparedCommand) {
     delete error.details.retry_command;
     delete error.details.retry_instruction;
     try {
         return context.db.writeTransaction(() => {
-            const row = load(context, id);
+            let row = load(context, id);
             if (row.status === "settled") {
                 const details = row.outcome_json ? JSON.parse(row.outcome_json)?.error?.details : undefined;
                 return details?.effect === "no_effect" && details.retry_command ? details : { effect: "unknown", recoverable: false };
@@ -2025,22 +2100,41 @@ export function settleLifecyclePreparationRejection(context, id, error) {
             const scope = JSON.parse(row.scope_json);
             if (scope.runId)
                 assertLifecycleInvocationCurrent(context, scope, row.command);
+            if (preparedCommand) {
+                // Only a command already validated before preparation may retain public
+                // Work inputs. This records a no-effect refusal, not admission to execute.
+                checkCommand(row, preparedCommand);
+                const command = commandWithObservedWorkSemantics(row, invocation(preparedCommand).argv);
+                if (command !== row.command)
+                    context.db.run("UPDATE lifecycle_invocations SET command = ?, updated_at = ? WHERE id = ?", [command, context.now(), row.id]);
+                row = { ...row, command };
+            }
+            const parsed = invocation(row.command);
+            if (parsed.operation === "work_finish" && !error.details.work_id) {
+                try {
+                    error.details.work_id = resolveWorkReference(context, commandPosition(parsed, 0) ?? "", { ...(scope.runId ? { runId: scope.runId } : {}) }).work_id;
+                }
+                catch { /* An unresolved target remains its original local preparation error. */ }
+            }
             const signature = preparationRejectionSignature(error);
+            const inputKey = preparationInputKey(parsed, error.details);
             const repeated = context.db.all("SELECT outcome_json FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? AND id <> ? AND status = 'settled'", [row.scope_json, row.fingerprint, row.id])
                 .some(prior => { try {
-                return JSON.parse(prior.outcome_json ?? "null")?.error?.details?.rejection_signature === signature;
+                const details = JSON.parse(prior.outcome_json ?? "null")?.error?.details;
+                return details?.rejection_signature === signature && (!inputKey || details.input_key === inputKey);
             }
             catch {
                 return false;
             } });
             const retryable = !repeated && isRetryableLifecycleRejection(error.code, error.details);
-            const details = { ...error.details, effect: "no_effect", recoverable: retryable, rejection_signature: signature,
+            const details = { ...error.details, effect: "no_effect", recoverable: retryable, rejection_signature: signature, ...(inputKey ? { input_key: inputKey } : {}),
                 ...(repeated ? { repeated_without_progress: true } : {}),
                 ...(retryable ? {
                     retry_command: successorLifecycleInvocationCommand(context, row),
                     retry_instruction: "Correct the reported input, then execute retry_command verbatim in this same Session. The rejected call changed no lifecycle state."
                 } : {}) };
-            context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ?", [JSON.stringify({ error: { ...errorRecord(error), details } }), context.now(), row.id]);
+            const successor = typeof details.retry_command === "string" ? currentIssuedCommand(context, row.scope_json, details.retry_command, row.id) : null;
+            context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ?", [JSON.stringify({ error: { ...errorRecord(error), details }, ...(successor ? { successor_invocation_id: successor.id } : {}) }), context.now(), row.id]);
             return details;
         });
     }
@@ -2050,7 +2144,7 @@ export function settleLifecyclePreparationRejection(context, id, error) {
     }
 }
 function preparationRejectionSignature(error) {
-    const omitted = new Set(["retry_command", "retry_instruction", "invocation_id", "hook_event_id", "rejection_signature", "hook_retry_signature", "event_key", "tool_call_id", "controller_turn", "timestamp", "created_at", "updated_at", "repeated_without_progress", "recoverable"]);
+    const omitted = new Set(["retry_command", "retry_instruction", "invocation_id", "hook_event_id", "rejection_signature", "hook_retry_signature", "event_key", "tool_call_id", "controller_turn", "timestamp", "created_at", "updated_at", "repeated_without_progress", "recoverable", "input_key", "input_sha256", "consumed_input_sha256"]);
     const normalize = (value) => {
         if (Array.isArray(value))
             return value.map(normalize);
@@ -2060,9 +2154,111 @@ function preparationRejectionSignature(error) {
     };
     return crypto.createHash("sha256").update(JSON.stringify([error.code, normalize(error.details)])).digest("hex");
 }
+function preparationInputKey(parsed, details) {
+    const publicParsed = invocation(`${launchExpression(parsed)} ${quoteModelFacingArgs(publicInvocationArgs(parsed))}`);
+    const options = [...publicParsed.args.options].filter(([key]) => !["invocation-id", "hook-event-id", "json", "progress-jsonl", "response-file"].includes(key)).sort(([a], [b]) => a.localeCompare(b));
+    const digest = details.consumed_input_sha256 ?? details.input_sha256;
+    const consumed = typeof digest === "string" && /^[a-f0-9]{64}$/.test(digest) ? digest : undefined;
+    // No file read in this layer: an unread body cannot prove unchanged input.
+    if (!consumed && options.some(([key]) => /(?:-file|-stdin)$/.test(key) || key === "data"))
+        return undefined;
+    return crypto.createHash("sha256").update(JSON.stringify([parsed.operation, publicParsed.args.positional, options, consumed ?? null])).digest("hex");
+}
+/** Historical registration is evidence, not an eternally actionable repair.
+ * Follow only committed links; matching command text or an issued UUID alone
+ * cannot retire a rejection. This reader never grants execution authority. */
+function lifecycleFailureAttemptCurrent(context, row, scope) {
+    if (!scope.projectId)
+        return true;
+    const parsed = invocation(row.command), stage = commandOption(parsed, "stage");
+    if (scope.stage && stage && stage !== scope.stage)
+        return false;
+    const currentStage = scope.stage ?? stage;
+    if (!currentStage)
+        return true;
+    const hook = row.event_key ? context.db.get("SELECT outcome_json FROM hook_events WHERE event_key=? AND project_id=?", [row.event_key, scope.projectId]) : undefined;
+    const outcome = hook?.outcome_json ? JSON.parse(hook.outcome_json) : null;
+    const packet = context.db.get(`SELECT a.payload_json FROM audit_events a JOIN lifecycle_packet_assignments pa
+    ON pa.packet_sha256=json_extract(a.payload_json,'$.packet_sha256') WHERE a.project_id=? AND a.event_type='lifecycle.coordinator_packet'
+    AND pa.invocation_id=? ORDER BY a.id DESC LIMIT 1`, [scope.projectId, row.id]);
+    const retainedAttempt = outcome?.attempt ?? (packet ? JSON.parse(packet.payload_json).stage_scope?.attempt : undefined);
+    return !retainedAttempt || retainedAttempt === stageAttempt(context, scope.projectId, scope.runId, currentStage);
+}
+export function applicableLifecycleRejection(context, error, scope, correlation = {}) {
+    let current = { ...error, details: error.details ?? {} };
+    const hasInvocations = context.db.get("SELECT 1 FROM sqlite_master WHERE name='lifecycle_invocations'");
+    const detailsId = typeof current.details.invocation_id === "string" ? current.details.invocation_id : undefined;
+    const explicit = hasInvocations && correlation.invocationId ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id=?", [correlation.invocationId]) : undefined;
+    const event = hasInvocations && correlation.eventKey ? context.db.get("SELECT * FROM lifecycle_invocations WHERE event_key=?", [correlation.eventKey]) : undefined;
+    if (explicit && event && explicit.id !== event.id)
+        return current;
+    let row = explicit ?? event;
+    const detailsRow = hasInvocations && detailsId ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id=?", [detailsId]) : undefined;
+    if (row && detailsRow && row.id !== detailsRow.id)
+        return { ...current, details: { ...current.details, invocation_id: row.id, reported_invocation_id: detailsRow.id } };
+    // Error payloads are retained diagnostics, not authority over a newer hook.
+    if (!correlation.invocationId && !correlation.eventKey)
+        row = detailsRow;
+    const root = scope.projectRoot ?? (scope.projectId ? context.db.get("SELECT root FROM projects WHERE id=?", [scope.projectId])?.root : undefined);
+    if (row) {
+        const retained = JSON.parse(row.scope_json);
+        if (retained.runId !== scope.runId || retained.generation !== scope.generation || root && retained.projectRoot !== root)
+            row = undefined;
+        else if (!lifecycleFailureAttemptCurrent(context, row, scope))
+            return null;
+    }
+    let pending = null;
+    const seen = new Set();
+    while (row && !seen.has(row.id)) {
+        seen.add(row.id);
+        const outcome = row.outcome_json ? JSON.parse(row.outcome_json) : null;
+        const next = committedSuccessor(context, row, outcome);
+        if (!next || seen.has(next.id))
+            break;
+        if (!lifecycleFailureAttemptCurrent(context, next, scope))
+            break;
+        pending = next;
+        if (["observed", "executing"].includes(next.status))
+            return null;
+        if (next.status !== "settled")
+            break;
+        const successorOutcome = next.outcome_json ? JSON.parse(next.outcome_json) : null;
+        if (successorOutcome?.error?.code)
+            current = { code: successorOutcome.error.code, message: successorOutcome.error.message ?? "Lifecycle command failed", details: { ...(successorOutcome.error.details ?? {}), invocation_id: next.id } };
+        else if (successorOutcome?.result) {
+            const result = successorOutcome.result;
+            const operation = invocation(next.command).operation;
+            const accepted = ["accepted", "completed", "done", "resumed"].includes(result.outcome) || ["done", "completed"].includes(result.status) || result.stage_status === "done"
+                || operation === "work_start" && result.ok === true && typeof result.work_session_id === "string"
+                || operation === "stage_start" && result.ok === true && typeof result.next?.finish_command === "string"
+                || operation === "stage_resume" && result.resumed === true;
+            if (accepted && !["blocked", "repair_required"].includes(result.outcome)
+                || result.outcome === "verification_required" && Array.isArray(result.receipts) && result.receipts.length && result.receipts.every((receipt) => receipt.status === "passed"))
+                return null;
+        }
+        row = next;
+    }
+    const continuation = current.details.continuation;
+    if (!isRegisteredRepair(context, continuation, scope.projectId ? { projectId: scope.projectId, runId: scope.runId } : undefined))
+        return current;
+    const repair = continuation;
+    if (repair.run_id !== scope.runId || scope.stage && repair.stage !== scope.stage)
+        return current;
+    if (!stageWorkIds(context, repair.project_id, repair.run_id, repair.stage).has(repair.work_id))
+        return current;
+    const work = context.db.get("SELECT status FROM works WHERE project_id=? AND run_id=? AND work_id=?", [repair.project_id, repair.run_id, repair.work_id]);
+    if (work && ["created", "ready", "running"].includes(work.status))
+        return null;
+    if (work?.status !== "completed")
+        return current;
+    if (pending?.status === "issued")
+        return null;
+    return { code: "invocation_continuation_unavailable", message: "Accepted repair has no proven current lifecycle continuation", details: { phase: "productive_continuation", effect: "no_effect", reconciliation_required: true,
+            work_id: repair.work_id, stage: repair.stage, attempt: repair.attempt, ...(row ? { refusal_invocation_id: row.id } : {}), primary: { code: current.code, message: current.message } } };
+}
 export function currentLifecycleFailure(context, input) {
     if (input.turn !== undefined) {
-        const hooks = context.db.all(`SELECT id, outcome_json FROM hook_events
+        const hooks = context.db.all(`SELECT id, event_key, outcome_json FROM hook_events
       WHERE json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ?
         AND json_extract(outcome_json, '$.stage') = ? AND json_extract(outcome_json, '$.controller_turn') = ?
         ${input.projectId ? "AND project_id = ?" : ""}
@@ -2079,41 +2275,33 @@ export function currentLifecycleFailure(context, input) {
             }
             if (activeAttempt && outcome.attempt && outcome.attempt !== activeAttempt)
                 continue;
-            const key = JSON.stringify([outcome.operation ?? "", outcome.session_id ?? null, outcome.correlation_key ?? outcome.fingerprint ?? hook.id]);
+            const invocationId = context.db.get("SELECT 1 FROM sqlite_master WHERE name='lifecycle_invocations'")
+                ? context.db.get("SELECT id FROM lifecycle_invocations WHERE event_key=?", [hook.event_key])?.id : undefined;
+            const key = invocationId ?? JSON.stringify([outcome.operation ?? "", outcome.session_id ?? null, outcome.correlation_key ?? outcome.fingerprint ?? hook.id]);
             if (outcome.disposition === "completed") {
                 completed.add(key);
                 continue;
             }
             if (completed.has(key) || !outcome.error?.code)
                 continue;
-            const continuation = outcome.error.details?.continuation;
-            if (continuation && typeof continuation === "object"
-                && continuation.run_id === input.runId
-                && continuation.stage === input.stage
-                && isRegisteredRepair(context, continuation, input.projectId ? { projectId: input.projectId, runId: input.runId } : undefined))
-                continue;
-            return { code: outcome.error.code, message: outcome.error.message ?? "Lifecycle command failed", details: outcome.error.details ?? {}, hook_event_id: hook.id };
+            const failure = applicableLifecycleRejection(context, { code: outcome.error.code, message: outcome.error.message ?? "Lifecycle command failed", details: outcome.error.details ?? {} }, input, { eventKey: hook.event_key });
+            if (failure)
+                return { ...failure, hook_event_id: hook.id };
         }
     }
     const attempts = context.db.all("SELECT * FROM lifecycle_invocations ORDER BY updated_at DESC, rowid DESC");
+    const projectRoot = input.projectRoot ?? (input.projectId ? context.db.get("SELECT root FROM projects WHERE id=?", [input.projectId])?.root : undefined);
     const scoped = attempts.filter(row => {
         try {
             const scope = JSON.parse(row.scope_json);
-            return scope.runId === input.runId && scope.generation === input.generation && (!input.projectRoot || scope.projectRoot === input.projectRoot);
+            return scope.runId === input.runId && scope.generation === input.generation && (!projectRoot || scope.projectRoot === projectRoot);
         }
         catch {
             return false;
         }
     });
-    const fingerprints = [...new Set(scoped.map(row => row.fingerprint))];
-    for (const fingerprint of fingerprints) {
-        const rows = scoped.filter(row => row.fingerprint === fingerprint);
-        // An issued successor has not performed the correction. Once the Turn
-        // ended it cannot erase the predecessor's actual rejection.
-        if (rows.some(row => ["observed", "executing"].includes(row.status)))
-            continue;
-        const row = rows.find(candidate => candidate.status === "settled");
-        if (!row)
+    for (const row of scoped) {
+        if (row.status !== "settled")
             continue;
         let outcome;
         try {
@@ -2142,13 +2330,9 @@ export function currentLifecycleFailure(context, input) {
         }
         if (stage !== input.stage)
             continue;
-        const continuation = outcome.error.details?.continuation;
-        if (continuation && typeof continuation === "object"
-            && continuation.run_id === input.runId
-            && continuation.stage === input.stage
-            && isRegisteredRepair(context, continuation, input.projectId ? { projectId: input.projectId, runId: input.runId } : undefined))
-            continue;
-        return { code: outcome.error.code, message: outcome.error.message, details: outcome.error.details ?? {}, invocation_id: row.id };
+        const failure = applicableLifecycleRejection(context, { code: outcome.error.code, message: outcome.error.message, details: outcome.error.details ?? {} }, input, { invocationId: row.id });
+        if (failure)
+            return { ...failure, invocation_id: typeof failure.details.invocation_id === "string" ? failure.details.invocation_id : row.id };
     }
     return null;
 }
@@ -2184,7 +2368,7 @@ export async function awaitLifecycleInvocation(context, input) {
                 ? error.details.recoverable !== false
                 : isRetryableLifecycleRejection(error.code, details);
             Object.assign(error.details, { phase: "prepare", effect: "no_effect", recoverable });
-            Object.assign(error.details, settleLifecyclePreparationRejection(context, input.id, error));
+            Object.assign(error.details, settleLifecyclePreparationRejection(context, input.id, error, input.command));
             throw error;
         }
     }