@deksden-com/dd-flow-cli 0.9.0-beta.158 → 0.9.0-beta.159

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.159
+
+### Patch Changes
+
+- Follow committed lifecycle successors consistently in native and CLI admission, including changed-fingerprint repair retries. Keep native-call bindings immutable after expiry and restrict actionable repairs to the current stage attempt/cycle.
+- Recognize semantic completion progress independently of the Work graph; pause genuine nonprogress with current diagnostics instead of replaying historical failures (plan 113).
+- Resolve emitted JavaScript import specifiers to their TypeScript fixture sources when selecting affected verification consumers, without selecting an unrelated full suite.
+
 ## 0.9.0-beta.158
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.158",
-  "cli_commit": "d0da77c661fa63daf690214f177105c0c0892262",
-  "built_at": "2026-10-29T05:58:19.667Z",
+  "cli_version": "0.9.0-beta.159",
+  "cli_commit": "138ff716eb8e3f8e4b5c32a7556284c30e50804b",
+  "built_at": "2026-10-29T12:37:35.400Z",
   "built_with_canon": {
     "version": "4.1.4",
     "commit": "7cc415b3ef3ce37c9624c7cee51023e66f67cd57",

package/dist/services/continuation-outcome.js

@@ -1,20 +1,25 @@
 import { AppError } from "../shared/errors.js";
-import { isRegisteredRepair } from "./repair-intents.js";
+import { applicableLifecycleRejection } from "./lifecycle-invocations.js";
 import { stageAttempt } from "./stage-work-graph.js";
 /** Only the settled coordinator turn can explain a repeated continuation.
  * A stale error from another stage/turn or an error followed by success is not
  * authority. Never inspect the assistant's prose for this decision. */
 export function assertNoCorrelatedRejection(context, scope) {
-    const rows = context.db.all(`SELECT outcome_json FROM hook_events
+    const rows = context.db.all(`SELECT event_key, outcome_json FROM hook_events
     WHERE project_id = ? AND json_extract(outcome_json, '$.run_id') = ?
     AND json_extract(outcome_json, '$.generation') = ? AND json_extract(outcome_json, '$.stage') = ?
     AND json_extract(outcome_json, '$.controller_turn') = ? AND json_extract(outcome_json, '$.attempt') = ? ORDER BY id`, [scope.projectId, scope.runId, scope.generation, scope.stage, scope.turn, stageAttempt(context, scope.projectId, scope.runId, scope.stage)]);
     const latest = new Map();
     for (const row of rows) {
-        const value = JSON.parse(row.outcome_json);
-        latest.set(JSON.stringify([value.operation, value.session_id ?? null, value.correlation_key ?? value.fingerprint ?? value.work_id ?? null, value.attempt ?? null]), value);
+        const value = { ...JSON.parse(row.outcome_json), event_key: row.event_key };
+        const invocationId = context.db.get("SELECT 1 FROM sqlite_master WHERE name='lifecycle_invocations'")
+            ? context.db.get("SELECT id FROM lifecycle_invocations WHERE event_key=?", [row.event_key])?.id : undefined;
+        latest.set(invocationId ?? JSON.stringify([value.operation, value.session_id ?? null, value.correlation_key ?? value.fingerprint ?? value.work_id ?? null, value.attempt ?? null]), value);
     }
     for (const value of latest.values())
-        if (value.error && !isRegisteredRepair(context, value.error.details.continuation, scope))
-            throw new AppError(value.error.code, value.error.message, 1, { ...value.error.details, operation: value.operation, hook_event_id: value.hook_event_id, continuation_scope: scope });
+        if (value.error) {
+            const failure = applicableLifecycleRejection(context, value.error, scope, { eventKey: value.event_key });
+            if (failure)
+                throw new AppError(failure.code, failure.message, 1, { ...failure.details, operation: value.operation, hook_event_id: value.hook_event_id, continuation_scope: scope });
+        }
 }

package/dist/services/controller-fanout.js

@@ -12,9 +12,42 @@ import { requireProjectByRoot } from "./projects.js";
 import { stageAttempt, stageWorkIds } from "./stage-work-graph.js";
 import { runtimeCommand } from "./runtime-command.js";
 import { promptDeliveryInstruction } from "./prompt-delivery.js";
-import { currentStageFinishAuthority } from "./lifecycle-invocations.js";
+import { committedSuccessor, currentStageFinishAuthority } from "./lifecycle-invocations.js";
 import { acceptedChildWork } from "./controller-result-authority.js";
 import { explicitWorkFailure } from "./controller-work-failure.js";
+import { commandOption, parseLifecycleCommand } from "./lifecycle-command.js";
+/** A new transport ID is not progress. Read only the current assignment's
+ * committed transition and its check inputs; never inspect mutable files here. */
+export function controllerSemanticCheckpoint(context, input) {
+    const scopeJson = context.env.DD_FLOW_INVOCATION_SCOPE;
+    const scope = scopeJson ? JSON.parse(scopeJson) : null;
+    const project = scope && context.db.get("SELECT id FROM projects WHERE root=?", [scope.projectRoot]);
+    const attempt = project && scope ? stageAttempt(context, project.id, scope.runId, input.stage) : null;
+    const receipt = (id) => typeof id === "string" && project && scope
+        ? context.db.get("SELECT declaration_id,input_hash,status FROM check_receipts WHERE id=? AND project_id=? AND run_id=?", [id, project.id, scope.runId]) ?? null : null;
+    const stableSet = (values) => [...new Set(values.map(value => JSON.stringify(value)))].sort().map(value => JSON.parse(value));
+    const parsed = input.command ? parseLifecycleCommand(input.command) : null;
+    const operation = parsed && parsed.kind !== "none" ? {
+        operation: parsed.invocation.operation, positional: parsed.invocation.args.positional,
+        options: [...parsed.invocation.args.options].filter(([key]) => !["invocation-id", "hook-event-id", "json", "progress-jsonl", "response-file", "reason"].includes(key))
+            .sort(([a], [b]) => a.localeCompare(b)).map(([key, values]) => [key, key === "retry-check" ? values.map(receipt) : values])
+    } : null;
+    const transitions = scopeJson && input.invocationId ? stableSet(context.db.all("SELECT * FROM lifecycle_invocations WHERE scope_json=? AND status='settled' AND json_extract(outcome_json,'$.successor_invocation_id')=?", [scopeJson, input.invocationId]).flatMap(row => {
+        const prior = parseLifecycleCommand(row.command);
+        if (prior.kind === "none" || commandOption(prior.invocation, "stage") !== input.stage)
+            return [];
+        const outcome = JSON.parse(row.outcome_json ?? "null");
+        if (committedSuccessor(context, row, outcome)?.id !== input.invocationId)
+            return [];
+        const result = outcome.result, error = outcome.error;
+        const references = result?.receipts ?? error?.details?.failures ?? [];
+        return [{ outcome: result?.outcome ?? null, verification: result?.verification?.verdict ?? null,
+                error: error ? { code: error.code, rejection_signature: error.details?.rejection_signature ?? null, input_key: error.details?.input_key ?? null } : null,
+                receipts: stableSet((Array.isArray(references) ? references : []).map(value => receipt(value?.id))) }];
+    })) : [];
+    const memoryChecks = project && scope && input.reviewInputSha256 ? stableSet(context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='memory.correction_checks' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.wave')=? AND json_extract(payload_json,'$.review_input_sha256')=?", [project.id, scope.runId, input.wave ?? 0, input.reviewInputSha256]).map(row => { const value = JSON.parse(row.payload_json); return { corrected_input: value.corrected_input_sha256, completed_correction: value.completed_correction_sha256, receipts: stableSet((value.checks ?? []).map((check) => receipt(check.id))) }; })) : [];
+    return { phase: input.phase, ...(input.wave === undefined ? {} : { wave: input.wave }), attempt, generation: scope?.generation ?? null, operation, transitions, ...(input.reviewInputSha256 ? { memory_checks: memoryChecks } : {}) };
+}
 function semanticCompletionPrompt(stage, completed, command) {
     const task = stage === "plan-review"
         ? "Classify the reviewer findings, apply every accepted correction in the current PLAN-REVIEW Work, and write the authoritative review decision."
@@ -94,7 +127,7 @@ export async function nextControllerFanout(context, input) {
         if (fanout.state === "dispatch_required" || fanout.state === "capacity_required")
             return { kind: "wait", reason: "qualified_capacity_required" };
     }
-    const prompt = (action, text) => ({ kind: "prompt", action, prompt: action === "dispatch_work" ? text : `${text}\n\n${lifecycleCommandCompletionInstruction}`, fingerprint: JSON.stringify({ stage: input.stage, parent: fanout.parent_work_id, state: fanout.state, graph: fanout.graph_revision }) });
+    const prompt = (action, text, checkpoint) => ({ kind: "prompt", action, prompt: action === "dispatch_work" ? text : `${text}\n\n${lifecycleCommandCompletionInstruction}`, ...(checkpoint ? { checkpoint } : {}), fingerprint: JSON.stringify({ stage: input.stage, action, parent: fanout.parent_work_id, state: fanout.state, graph: fanout.graph_revision, ...(checkpoint ? { semantic: checkpoint } : {}) }) });
     if (fanout.state === "coordinator_required")
         return prompt("materialize_graph", `Continue the current ${input.stage} Stage using its authoritative packet. Materialize only its required Work graph, declaring real dependencies at registration. If the packet's CLI command registers the graph, use its returned Work graph unchanged: do not add or alter dependencies after registration. Accepted predecessor Stages already fence their completed producers; do not add cross-stage edges merely to restate input provenance. Do not launch children, finish the Stage, or start a successor. Return after registering the graph; the runtime will dispatch its ready Work.`);
     if (fanout.works.failed || fanout.works.cancelled) {
@@ -198,7 +231,7 @@ export async function nextControllerFanout(context, input) {
         const run = context.db.get("SELECT flow_kind,run_root,run_dir FROM runs WHERE project_id=? AND id=?", [projectId, input.runId]);
         if (run?.flow_kind === "mb-init" || run?.flow_kind === "mb-upgrade") {
             const attempt = stageAttempt(context, projectId, input.runId, "review");
-            const repair = context.db.get(`SELECT CASE event_type WHEN 'memory.second_repair_registration' THEN 2 ELSE 1 END AS wave
+            const repair = context.db.get(`SELECT CASE event_type WHEN 'memory.second_repair_registration' THEN 2 ELSE 1 END AS wave,json_extract(payload_json,'$.scope.input_sha256') AS input_sha256
         FROM audit_events WHERE project_id=? AND event_type IN ('memory.repair_registration','memory.second_repair_registration')
         AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.scope.attempt')=?
         AND json_extract(payload_json,'$.scope.parent_work_id')=? ORDER BY wave DESC LIMIT 1`, [projectId, input.runId, attempt, fanout.parent_work_id]);
@@ -206,7 +239,7 @@ export async function nextControllerFanout(context, input) {
         AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.scope.attempt')=?
         AND json_extract(payload_json,'$.scope.parent_work_id')=? AND json_extract(payload_json,'$.wave')=?`, [projectId, input.runId, attempt, fanout.parent_work_id, repair.wave])) {
                 const args = ["--run", input.runId, "--project-root", input.projectRoot, "--wave", String(repair.wave), "--json"];
-                return prompt("semantic_completion", `Correction wave ${repair.wave} Work has settled. Before Stage finish, run ${runtimeCommand(context, ["memory", "corrections", "checks", ...args])}, then ${runtimeCommand(context, ["memory", "review", "selective-register", ...args])}. Read both complete responses, then end this Turn so the controller can dispatch the independent selective reviewers. Do not finish the Stage or treat repair Work completion as independent acceptance.`);
+                return prompt("semantic_completion", `Correction wave ${repair.wave} Work has settled. Before Stage finish, run ${runtimeCommand(context, ["memory", "corrections", "checks", ...args])}, then ${runtimeCommand(context, ["memory", "review", "selective-register", ...args])}. Read both complete responses, then end this Turn so the controller can dispatch the independent selective reviewers. Do not finish the Stage or treat repair Work completion as independent acceptance.`, controllerSemanticCheckpoint(context, { stage: input.stage, phase: "memory_correction_checks_register", wave: repair.wave, reviewInputSha256: repair.input_sha256 }));
             }
             const wave = repair?.wave ?? 0;
             const runHome = run.run_root ?? run.run_dir;
@@ -222,7 +255,7 @@ export async function nextControllerFanout(context, input) {
                     ? `If the outcome is needs_repair, use the returned canonical findings and correction_plan_binding to author substantive repair tasks with exact owned write_paths. Register that plan with the packet's issued memory corrections register command for wave ${wave + 1}, then end this Turn so the controller can dispatch it. Do not invoke Stage finish before corrections, checks and independent selective review complete.`
                     : "If the outcome is needs_repair or blocked, the two correction waves are exhausted. Use the issued pause command for the concrete unresolved blocker; do not mark it accepted.",
                 "For blocked collection, use the issued pause command. Do not calculate finding hashes, merge or drop findings, edit project files in the coordinator, create speculative Work or start a successor Stage."
-            ].join("\n\n"));
+            ].join("\n\n"), controllerSemanticCheckpoint(context, { stage: input.stage, phase: "memory_collection", wave, command: collect }));
         }
     }
     const finish = currentStageFinishAuthority(context, input.stage);
@@ -230,7 +263,7 @@ export async function nextControllerFanout(context, input) {
         throw new AppError("controller_finish_authority_missing", "Settled child Work has no current Stage finish authority", 1, { stage: input.stage, reconciliation_required: true });
     if (finish.status !== "issued" || !finish.command)
         throw new AppError("controller_finish_authority_pending", "Observe the original Stage finish before another productive dispatch", 1, { stage: input.stage, invocation_id: finish.id, status: finish.status, reconciliation_required: true });
-    return prompt("semantic_completion", semanticCompletionPrompt(input.stage, fanout.works.completed, finish.command));
+    return { ...prompt("semantic_completion", semanticCompletionPrompt(input.stage, fanout.works.completed, finish.command), controllerSemanticCheckpoint(context, { stage: input.stage, phase: "stage_finish", command: finish.command, invocationId: finish.id })), authority: { id: finish.id, status: finish.status } };
 }
 /** Shared pinned runtime normalization; preserve structured errors at the TS boundary. */
 export function controllerNativeChildren(receipt, rootSessionId) {

package/dist/services/lifecycle-invocations.js

@@ -17,7 +17,7 @@ import { observeCommandHook } from "./hooks.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { normalizedPathAlias, resolveContextualPaths } from "./command-context.js";
 import { isRegisteredRepair } from "./repair-receipt.js";
-import { stageAttempt } from "./stage-work-graph.js";
+import { stageAttempt, stageWorkIds } from "./stage-work-graph.js";
 import { contextualPathOptionsForLifecycle } from "../cli/command-inputs.js";
 import { canonicalPath } from "../storage/paths.js";
 import { runtimeCommand, shellArgument } from "./runtime-command.js";
@@ -378,12 +378,15 @@ export function assertLifecycleOutcomes(context, scope) {
     }
     const columns = context.db.all("PRAGMA table_info(hook_events)");
     if (columns.some(column => column.name === "outcome_json")) {
-        for (const row of context.db.all("SELECT outcome_json FROM hook_events WHERE project_id = ? AND json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ? ORDER BY id", [project.id, scope.runId, scope.generation])) {
+        for (const row of context.db.all("SELECT event_key, outcome_json FROM hook_events WHERE project_id = ? AND json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ? ORDER BY id", [project.id, scope.runId, scope.generation])) {
             const outcome = JSON.parse(row.outcome_json);
             if (outcome.disposition === "retrying" && outcome.deadline <= Date.now())
                 throw new AppError("lifecycle_outcome_unknown", "Storage retry has no terminal receipt; reconcile its committed evidence", 1, { lifecycle_outcome: outcome, effect: "unknown" });
-            if (outcome.disposition === "fatal" && !isRegisteredRepair(context, outcome.error?.details?.continuation, { projectId: project.id, runId: scope.runId }))
-                throw new AppError(outcome.error?.code ?? "lifecycle_outcome_unknown", outcome.error?.message || "Mandatory lifecycle failed (historical receipt has no message)", 1, { ...outcome.error?.details, lifecycle_outcome: outcome });
+            if (outcome.disposition === "fatal") {
+                const failure = applicableLifecycleRejection(context, { code: outcome.error?.code ?? "lifecycle_outcome_unknown", message: outcome.error?.message || "Mandatory lifecycle failed (historical receipt has no message)", details: outcome.error?.details }, { ...scope, projectId: project.id, stage: outcome.stage }, { eventKey: row.event_key });
+                if (failure)
+                    throw new AppError(failure.code, failure.message, 1, { ...failure.details, lifecycle_outcome: outcome });
+            }
         }
     }
     if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'"))
@@ -391,13 +394,15 @@ export function assertLifecycleOutcomes(context, scope) {
     const rows = context.db.all(`SELECT a.* FROM lifecycle_invocations a
     WHERE json_extract(a.scope_json, '$.projectRoot') = ? AND json_extract(a.scope_json, '$.runId') = ?
       AND json_extract(a.scope_json, '$.generation') = ? AND a.status = 'settled'
-      AND NOT EXISTS (SELECT 1 FROM lifecycle_invocations newer WHERE newer.scope_json = a.scope_json AND newer.fingerprint = a.fingerprint AND newer.rowid > a.rowid)
     ORDER BY a.rowid`, [scope.projectRoot, scope.runId, scope.generation]);
     for (const row of rows) {
         const outcome = row.outcome_json ? JSON.parse(row.outcome_json) : null;
         const error = outcome?.error;
-        if (typeof error?.code === "string" && !committedSuccessor(context, row, outcome) && !isCorrectableLifecycleRejection(error.code, error.details) && !isRegisteredRepair(context, error.details?.continuation, { projectId: project.id, runId: scope.runId }))
-            throw new AppError(error.code, typeof error.message === "string" ? error.message : "Mandatory lifecycle failed", 1, { ...(error.details ?? {}), invocation_id: row.id });
+        if (typeof error?.code === "string" && !isCorrectableLifecycleRejection(error.code, error.details)) {
+            const failure = applicableLifecycleRejection(context, { code: error.code, message: typeof error.message === "string" ? error.message : "Mandatory lifecycle failed", details: error.details }, { ...scope, projectId: project.id }, { invocationId: row.id });
+            if (failure)
+                throw new AppError(failure.code, failure.message, 1, { ...failure.details, invocation_id: failure.details.invocation_id ?? row.id });
+        }
     }
 }
 /** Hooks already own native identity. Retain command outcomes there, with an
@@ -760,7 +765,7 @@ function currentIssuedCommand(context, scope, command, excludeId) {
 function scopedCommandFingerprint(context, scope, command) {
     return fingerprint(invocation(canonicalManagedCommand(context, command, JSON.parse(scope))));
 }
-function committedSuccessor(context, prior, outcome) {
+export function committedSuccessor(context, prior, outcome) {
     if (typeof outcome?.successor_invocation_id !== "string" || outcome.successor_invocation_id === prior.id)
         return null;
     const command = outcome.error?.details?.retry_command ?? outcome.result?.next?.finish_command;
@@ -1608,33 +1613,35 @@ export function observeLifecycleInvocation(context, input) {
 function observeLifecycleInvocationReceipt(context, input) {
     storage(context);
     const delivered = parseLifecycleCommand(input.command);
-    if (delivered.kind === "standalone") {
-        const id = commandOption(delivered.invocation, "invocation-id");
-        const direct = context.db.all("SELECT * FROM lifecycle_invocations WHERE admission_json IS NOT NULL AND status IN ('executing','settled')")
-            .filter(row => {
-            const scope = JSON.parse(row.scope_json);
-            if (id && row.id !== id || scope.daemonId !== input.identity.daemonId || scope.rootSessionId !== input.identity.rootSessionId)
-                return false;
-            // A fresh native call must bind the explicitly committed successor,
-            // not short-circuit to its predecessor's successful repair response.
-            // Exact delivery/explicit-ID replay remains historical read-only.
-            const successor = row.status === "settled" && row.outcome_json ? committedSuccessor(context, row, JSON.parse(row.outcome_json)) : null;
-            if (!id && row.identity_json && successor && ["issued", "observed"].includes(successor.status)
-                && !sameNativeCall(row.identity_json, JSON.stringify([input.identity.daemonId, input.identity.rootSessionId, input.identity.sessionId, input.identity.parentSessionId, input.identity.toolCallId])))
-                return false;
-            try {
-                return fingerprint(invocation(canonicalManagedCommand(context, delivered.invocation.command, scope))) === row.fingerprint;
-            }
-            catch {
-                return false;
-            }
-        });
-        if (direct.length === 1)
-            return { eventKey: direct[0].event_key, duplicate: true,
-                disposition: direct[0].status === "settled" ? "settled_read" : "in_flight", invocationId: direct[0].id };
-    }
     const projectRoot = input.projectId ? context.db.get("SELECT root FROM projects WHERE id = ?", [input.projectId])?.root : undefined;
+    // Selection is SQL-only and shared with CLI lookup. A historical result may
+    // return early, but never before considering its committed successor chain.
+    const correlation = { identity: input.identity, ...(input.id ? { id: input.id } : {}), ...(input.executionCwd === undefined ? {} : { executionCwd: input.executionCwd }), native: true };
+    let selected = null;
+    let deferredAmbiguity;
+    if (delivered.kind !== "none" && delivered.supported !== false) {
+        try {
+            selected = observedLifecycleInvocation(context, input.command, { daemonId: input.identity.daemonId, rootSessionId: input.identity.rootSessionId, ...(projectRoot ? { projectRoot } : {}) }, correlation);
+        }
+        catch (error) {
+            if (!(error instanceof AppError) || error.code !== "invocation_ambiguous")
+                throw error;
+            // A native root can retain assignments from different generations.
+            // Only the existing trusted owner discovery may narrow that scope.
+            deferredAmbiguity = error;
+        }
+    }
+    let selectedRow = selected ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [selected.id]) : undefined;
+    if (selectedRow?.admission_json && ["executing", "settled"].includes(selectedRow.status))
+        return { eventKey: selectedRow.event_key, duplicate: true,
+            disposition: selectedRow.status === "settled" ? "settled_read" : "in_flight", invocationId: selectedRow.id };
     const provenScope = projectRoot && input.harness ? managedNativeInvocationScope(context, projectRoot, input.identity, input.harness) : null;
+    if (deferredAmbiguity) {
+        if (!provenScope)
+            throw deferredAmbiguity;
+        selected = observedLifecycleInvocation(context, input.command, provenScope, correlation);
+        selectedRow = selected ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [selected.id]) : undefined;
+    }
     const owner = provenScope && input.harness && input.projectId ? managedNativeOwner(context, input.identity, input.harness, input.projectId) : null;
     const ownerSnapshot = () => {
         if (!provenScope?.runId || !input.projectId)
@@ -1656,7 +1663,8 @@ function observeLifecycleInvocationReceipt(context, input) {
         return JSON.stringify(rows);
     };
     const retainedOwner = ownerSnapshot();
-    const supplied = input.id ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [input.id]) : undefined;
+    const suppliedId = input.id ?? (delivered.kind !== "none" ? commandOption(delivered.invocation, "invocation-id") : undefined);
+    const supplied = suppliedId ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [suppliedId]) : undefined;
     const analysis = parseLifecycleCommand(input.command);
     if (analysis.kind === "none" || analysis.supported === false) {
         let issuedBarrier;
@@ -1735,11 +1743,11 @@ function observeLifecycleInvocationReceipt(context, input) {
             return false;
         return true;
     });
-    const candidates = lifecycleCandidates(matching, deliveredIdentity);
+    const candidates = lifecycleCandidates(context, matching, deliveredIdentity);
     // A known explicit ID remains a compatibility path. A missing or mistyped
     // public ID is corrected only by an exact operation/target match inside the
     // trusted native root. Never fuzzy-match UUID text or select a global latest.
-    const initial = supplied ?? (candidates.length === 1 ? candidates[0] : undefined);
+    const initial = supplied ?? selectedRow ?? (candidates.length === 1 ? candidates[0] : undefined);
     // A live observation arriving after direct admission is optional correlation,
     // never a second authority or an executing -> observed transition.
     if (initial?.admission_json && ["executing", "settled"].includes(initial.status))
@@ -1782,6 +1790,9 @@ function observeLifecycleInvocationReceipt(context, input) {
         const row = context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [initial.id]);
         if (retainedOwner !== ownerSnapshot())
             throw new AppError("invocation_scope_unproven", "Native owner changed before admission receipt", 1, { effect: "no_effect" });
+        const current = observedLifecycleInvocation(context, input.command, scope, { ...(input.id ? { id: input.id } : {}), identity, ...(input.executionCwd === undefined ? {} : { executionCwd: input.executionCwd }), native: true });
+        if (!current || current.id !== initial.id)
+            throw new AppError("invocation_assignment_unproven", "Lifecycle continuation changed before native receipt; inspect its committed successor", 1, { effect: "no_effect", reconciliation_required: true, invocation_id: initial.id, successor_invocation_id: current?.id });
         if (row.scope_json !== initial.scope_json)
             throw new AppError("invocation_scope_mismatch", "Lifecycle scope changed before native receipt", 1, { effect: "no_effect" });
         if (row.status === "settled")
@@ -1811,10 +1822,11 @@ function observeLifecycleInvocationReceipt(context, input) {
         // its workdir is invalid), after which repeating the same issued command
         // is safe. Keep the newest receipt until the CLI claims the attempt. The
         // observed -> executing compare-and-swap remains the exactly-once boundary.
-        const updated = context.db.run("UPDATE lifecycle_invocations SET identity_json = ?, event_key = ?, status = 'observed', updated_at = ? WHERE id = ? AND status IN ('issued', 'observed')", [identityJson, eventKey, context.now(), initial.id]);
+        const updated = context.db.run("UPDATE lifecycle_invocations SET identity_json = ?, event_key = ?, status = 'observed', updated_at = ? WHERE id = ? AND scope_json = ? AND command = ? AND status IN ('issued', 'observed')", [identityJson, eventKey, context.now(), initial.id, initial.scope_json, initial.command]);
         // Once execution has been claimed, later PreToolUse observations are
         // retained as hook evidence but cannot replace the executor's receipt.
-        return { eventKey: updated.changes === 1 ? eventKey : row.event_key, duplicate: updated.changes !== 1, disposition: updated.changes === 1 ? "admitted" : "in_flight", ...resolved };
+        const retained = updated.changes === 1 ? row : context.db.get("SELECT * FROM lifecycle_invocations WHERE id = ?", [initial.id]);
+        return { eventKey: updated.changes === 1 ? eventKey : retained.event_key, duplicate: updated.changes !== 1, disposition: updated.changes === 1 ? "admitted" : "in_flight", ...resolved };
     });
 }
 /** Correlate exact native argv for diagnostics, independently of assignment
@@ -1888,19 +1900,38 @@ export function observedLifecycleInvocation(context, command, scopeConstraint, c
     if (analysis.kind === "none" || analysis.supported === false)
         return null;
     const leafCommand = analysis.invocation.command;
-    const suppliedId = commandOption(analysis.invocation, "invocation-id");
+    const inlineId = commandOption(analysis.invocation, "invocation-id");
+    if (inlineId && correlation?.id && inlineId !== correlation.id)
+        throw new AppError("invocation_identity_mismatch", "Explicit lifecycle identifiers disagree", 1, { effect: "no_effect" });
+    const suppliedId = correlation?.id ?? inlineId;
     const retainedId = suppliedId && context.db.get("SELECT id FROM lifecycle_invocations WHERE id = ?", [suppliedId]) ? suppliedId : undefined;
     // `issued` is a rendezvous, not authority: the CLI still blocks in
     // awaitLifecycleInvocation until the native observer commits the receipt.
-    const history = context.db.all("SELECT * FROM lifecycle_invocations WHERE status IN ('issued','observed','executing','settled') ORDER BY rowid DESC");
+    const retainedHistory = context.db.all("SELECT * FROM lifecycle_invocations ORDER BY rowid DESC");
+    const history = retainedHistory.filter(row => ["issued", "observed", "executing", "settled"].includes(row.status));
+    const inlineEvent = commandOption(analysis.invocation, "hook-event-id");
+    if (inlineEvent && correlation?.eventKey && inlineEvent !== correlation.eventKey)
+        throw new AppError("invocation_identity_mismatch", "Lifecycle event identifiers disagree", 1, { effect: "no_effect" });
+    const eventKey = inlineEvent ?? correlation?.eventKey;
+    if (correlation?.executionCwd !== undefined && !path.isAbsolute(correlation.executionCwd))
+        throw new AppError("invocation_directory_mismatch", "Bound lifecycle execution cwd must be absolute", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+    const identity = correlation?.identity;
+    const identityJson = identity ? JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId,
+        ...(correlation.executionCwd === undefined ? [] : [{ executionCwd: canonicalPath(correlation.executionCwd) }])]) : undefined;
+    const nativeRows = identityJson ? retainedHistory.filter(row => row.identity_json && sameNativeCall(row.identity_json, identityJson)) : [];
+    if (correlation?.native && nativeRows.some(row => row.identity_json !== identityJson))
+        throw new AppError("invocation_identity_mismatch", "The same native tool call changed its bound execution route", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+    const bindings = [retainedId, ...retainedHistory.filter(row => eventKey && row.event_key === eventKey).map(row => row.id), ...nativeRows.map(row => row.id)].filter((id) => Boolean(id));
+    if (new Set(bindings).size > 1)
+        throw new AppError("invocation_identity_mismatch", "Lifecycle identifiers refer to different retained attempts", 1, { phase: "prepare", effect: "no_effect", recoverable: false });
+    const nativeBindingId = nativeRows[0]?.id;
     const matching = history
         .filter(row => {
         try {
-            const explicitId = retainedId;
-            const eventKey = commandOption(analysis.invocation, "hook-event-id") ?? correlation?.eventKey;
+            const explicitId = retainedId ?? nativeBindingId;
             if (explicitId && row.id !== explicitId || eventKey && row.event_key !== eventKey)
                 return false;
-            if (row.status === "settled" && (!row.outcome_json || JSON.parse(row.outcome_json).error) && !explicitId && !eventKey && !correlation?.identity)
+            if (row.status === "settled" && (!row.outcome_json || JSON.parse(row.outcome_json).error && !JSON.parse(row.outcome_json).successor_invocation_id) && !explicitId && !eventKey && !correlation?.identity)
                 return false;
             const scope = JSON.parse(row.scope_json);
             const constraint = typeof scopeConstraint === "string" ? { daemonId: scopeConstraint } : scopeConstraint;
@@ -1912,8 +1943,9 @@ export function observedLifecycleInvocation(context, command, scopeConstraint, c
             return false;
         }
     });
-    const identity = correlation?.identity;
-    const matches = lifecycleCandidates(matching, identity ? JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId]) : undefined, true, history);
+    if (nativeBindingId && !matching.length)
+        throw new AppError("invocation_identity_mismatch", "The same native tool call changed its bound lifecycle command or scope", 1, { phase: "prepare", effect: "no_effect", recoverable: false, invocation_id: nativeBindingId });
+    const matches = retainedId || eventKey ? matching : lifecycleCandidates(context, matching, identityJson, true);
     if (!matches.length)
         return null;
     if (matches.length !== 1)
@@ -1924,7 +1956,7 @@ export function observedLifecycleInvocation(context, command, scopeConstraint, c
  * Exact native delivery replays its immutable assignment. CLI lookup without
  * native correlation may use a uniquely bound committed successor, not an
  * arbitrary newest/active row. Unrelated history remains ambiguous. */
-function lifecycleCandidates(rows, identity, lookup = false, history = rows) {
+function lifecycleCandidates(context, rows, identity, lookup = false) {
     if (identity) {
         const replay = rows.filter(row => {
             if (!row.identity_json)
@@ -1934,8 +1966,8 @@ function lifecycleCandidates(rows, identity, lookup = false, history = rows) {
             if (!lookup)
                 return false;
             try {
-                const retained = JSON.parse(row.identity_json);
-                return Array.isArray(retained) && JSON.stringify(retained.slice(0, 5)) === identity;
+                const retained = JSON.parse(row.identity_json), delivered = JSON.parse(identity);
+                return Array.isArray(retained) && delivered.length === 5 && JSON.stringify(retained.slice(0, 5)) === identity;
             }
             catch {
                 return false;
@@ -1945,17 +1977,20 @@ function lifecycleCandidates(rows, identity, lookup = false, history = rows) {
             return replay;
     }
     const active = rows.filter(row => row.status !== "settled");
-    if (lookup && !identity && active.length === 1 && (active[0].status === "issued" || active[0].identity_json && active[0].event_key)) {
-        const current = active[0];
+    const terminal = rows.filter(row => row.status === "settled" && !JSON.parse(row.outcome_json ?? "null")?.successor_invocation_id);
+    const current = active.length === 1 ? active[0] : !active.length && terminal.length === 1 ? terminal[0] : undefined;
+    if (lookup && !current && !active.length && rows.some(row => JSON.parse(row.outcome_json ?? "null")?.successor_invocation_id)) {
+        throw new AppError("invocation_assignment_unproven", "Retained lifecycle chain has no current successor", 1, { effect: "no_effect", reconciliation_required: true });
+    }
+    if (lookup && current && (current.status === "issued" || current.status === "settled" || current.identity_json && current.event_key)) {
         const leadsToCurrent = (row, seen = new Set()) => {
             if (row.id === current.id)
-                return true;
+                return row.status !== "issued" || row.deadline === null || row.deadline > Date.now();
             if (row.status !== "settled" || seen.has(row.id))
                 return false;
             seen.add(row.id);
             try {
-                const next = JSON.parse(row.outcome_json ?? "null")?.successor_invocation_id;
-                const successor = history.find(candidate => candidate.id === next && candidate.scope_json === current.scope_json);
+                const successor = committedSuccessor(context, row, JSON.parse(row.outcome_json ?? "null"));
                 return Boolean(successor && leadsToCurrent(successor, seen));
             }
             catch {
@@ -1963,7 +1998,11 @@ function lifecycleCandidates(rows, identity, lookup = false, history = rows) {
             }
         };
         if (rows.every(row => leadsToCurrent(row)))
-            return active;
+            return [current];
+        // A declared but broken link cannot be repaired by picking an unrelated
+        // active row. Existing unlinked history remains a native rendezvous only.
+        if (rows.some(row => row.status === "settled" && JSON.parse(row.outcome_json ?? "null")?.successor_invocation_id))
+            return rows;
     }
     return (!lookup || identity) && active.length ? active : rows;
 }
@@ -2125,9 +2164,101 @@ function preparationInputKey(parsed, details) {
         return undefined;
     return crypto.createHash("sha256").update(JSON.stringify([parsed.operation, publicParsed.args.positional, options, consumed ?? null])).digest("hex");
 }
+/** Historical registration is evidence, not an eternally actionable repair.
+ * Follow only committed links; matching command text or an issued UUID alone
+ * cannot retire a rejection. This reader never grants execution authority. */
+function lifecycleFailureAttemptCurrent(context, row, scope) {
+    if (!scope.projectId)
+        return true;
+    const parsed = invocation(row.command), stage = commandOption(parsed, "stage");
+    if (scope.stage && stage && stage !== scope.stage)
+        return false;
+    const currentStage = scope.stage ?? stage;
+    if (!currentStage)
+        return true;
+    const hook = row.event_key ? context.db.get("SELECT outcome_json FROM hook_events WHERE event_key=? AND project_id=?", [row.event_key, scope.projectId]) : undefined;
+    const outcome = hook?.outcome_json ? JSON.parse(hook.outcome_json) : null;
+    const packet = context.db.get(`SELECT a.payload_json FROM audit_events a JOIN lifecycle_packet_assignments pa
+    ON pa.packet_sha256=json_extract(a.payload_json,'$.packet_sha256') WHERE a.project_id=? AND a.event_type='lifecycle.coordinator_packet'
+    AND pa.invocation_id=? ORDER BY a.id DESC LIMIT 1`, [scope.projectId, row.id]);
+    const retainedAttempt = outcome?.attempt ?? (packet ? JSON.parse(packet.payload_json).stage_scope?.attempt : undefined);
+    return !retainedAttempt || retainedAttempt === stageAttempt(context, scope.projectId, scope.runId, currentStage);
+}
+export function applicableLifecycleRejection(context, error, scope, correlation = {}) {
+    let current = { ...error, details: error.details ?? {} };
+    const hasInvocations = context.db.get("SELECT 1 FROM sqlite_master WHERE name='lifecycle_invocations'");
+    const detailsId = typeof current.details.invocation_id === "string" ? current.details.invocation_id : undefined;
+    const explicit = hasInvocations && correlation.invocationId ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id=?", [correlation.invocationId]) : undefined;
+    const event = hasInvocations && correlation.eventKey ? context.db.get("SELECT * FROM lifecycle_invocations WHERE event_key=?", [correlation.eventKey]) : undefined;
+    if (explicit && event && explicit.id !== event.id)
+        return current;
+    let row = explicit ?? event;
+    const detailsRow = hasInvocations && detailsId ? context.db.get("SELECT * FROM lifecycle_invocations WHERE id=?", [detailsId]) : undefined;
+    if (row && detailsRow && row.id !== detailsRow.id)
+        return { ...current, details: { ...current.details, invocation_id: row.id, reported_invocation_id: detailsRow.id } };
+    // Error payloads are retained diagnostics, not authority over a newer hook.
+    if (!correlation.invocationId && !correlation.eventKey)
+        row = detailsRow;
+    const root = scope.projectRoot ?? (scope.projectId ? context.db.get("SELECT root FROM projects WHERE id=?", [scope.projectId])?.root : undefined);
+    if (row) {
+        const retained = JSON.parse(row.scope_json);
+        if (retained.runId !== scope.runId || retained.generation !== scope.generation || root && retained.projectRoot !== root)
+            row = undefined;
+        else if (!lifecycleFailureAttemptCurrent(context, row, scope))
+            return null;
+    }
+    let pending = null;
+    const seen = new Set();
+    while (row && !seen.has(row.id)) {
+        seen.add(row.id);
+        const outcome = row.outcome_json ? JSON.parse(row.outcome_json) : null;
+        const next = committedSuccessor(context, row, outcome);
+        if (!next || seen.has(next.id))
+            break;
+        if (!lifecycleFailureAttemptCurrent(context, next, scope))
+            break;
+        pending = next;
+        if (["observed", "executing"].includes(next.status))
+            return null;
+        if (next.status !== "settled")
+            break;
+        const successorOutcome = next.outcome_json ? JSON.parse(next.outcome_json) : null;
+        if (successorOutcome?.error?.code)
+            current = { code: successorOutcome.error.code, message: successorOutcome.error.message ?? "Lifecycle command failed", details: { ...(successorOutcome.error.details ?? {}), invocation_id: next.id } };
+        else if (successorOutcome?.result) {
+            const result = successorOutcome.result;
+            const operation = invocation(next.command).operation;
+            const accepted = ["accepted", "completed", "done", "resumed"].includes(result.outcome) || ["done", "completed"].includes(result.status) || result.stage_status === "done"
+                || operation === "work_start" && result.ok === true && typeof result.work_session_id === "string"
+                || operation === "stage_start" && result.ok === true && typeof result.next?.finish_command === "string"
+                || operation === "stage_resume" && result.resumed === true;
+            if (accepted && !["blocked", "repair_required"].includes(result.outcome)
+                || result.outcome === "verification_required" && Array.isArray(result.receipts) && result.receipts.length && result.receipts.every((receipt) => receipt.status === "passed"))
+                return null;
+        }
+        row = next;
+    }
+    const continuation = current.details.continuation;
+    if (!isRegisteredRepair(context, continuation, scope.projectId ? { projectId: scope.projectId, runId: scope.runId } : undefined))
+        return current;
+    const repair = continuation;
+    if (repair.run_id !== scope.runId || scope.stage && repair.stage !== scope.stage)
+        return current;
+    if (!stageWorkIds(context, repair.project_id, repair.run_id, repair.stage).has(repair.work_id))
+        return current;
+    const work = context.db.get("SELECT status FROM works WHERE project_id=? AND run_id=? AND work_id=?", [repair.project_id, repair.run_id, repair.work_id]);
+    if (work && ["created", "ready", "running"].includes(work.status))
+        return null;
+    if (work?.status !== "completed")
+        return current;
+    if (pending?.status === "issued")
+        return null;
+    return { code: "invocation_continuation_unavailable", message: "Accepted repair has no proven current lifecycle continuation", details: { phase: "productive_continuation", effect: "no_effect", reconciliation_required: true,
+            work_id: repair.work_id, stage: repair.stage, attempt: repair.attempt, ...(row ? { refusal_invocation_id: row.id } : {}), primary: { code: current.code, message: current.message } } };
+}
 export function currentLifecycleFailure(context, input) {
     if (input.turn !== undefined) {
-        const hooks = context.db.all(`SELECT id, outcome_json FROM hook_events
+        const hooks = context.db.all(`SELECT id, event_key, outcome_json FROM hook_events
       WHERE json_extract(outcome_json, '$.run_id') = ? AND json_extract(outcome_json, '$.generation') = ?
         AND json_extract(outcome_json, '$.stage') = ? AND json_extract(outcome_json, '$.controller_turn') = ?
         ${input.projectId ? "AND project_id = ?" : ""}
@@ -2144,41 +2275,33 @@ export function currentLifecycleFailure(context, input) {
             }
             if (activeAttempt && outcome.attempt && outcome.attempt !== activeAttempt)
                 continue;
-            const key = JSON.stringify([outcome.operation ?? "", outcome.session_id ?? null, outcome.correlation_key ?? outcome.fingerprint ?? hook.id]);
+            const invocationId = context.db.get("SELECT 1 FROM sqlite_master WHERE name='lifecycle_invocations'")
+                ? context.db.get("SELECT id FROM lifecycle_invocations WHERE event_key=?", [hook.event_key])?.id : undefined;
+            const key = invocationId ?? JSON.stringify([outcome.operation ?? "", outcome.session_id ?? null, outcome.correlation_key ?? outcome.fingerprint ?? hook.id]);
             if (outcome.disposition === "completed") {
                 completed.add(key);
                 continue;
             }
             if (completed.has(key) || !outcome.error?.code)
                 continue;
-            const continuation = outcome.error.details?.continuation;
-            if (continuation && typeof continuation === "object"
-                && continuation.run_id === input.runId
-                && continuation.stage === input.stage
-                && isRegisteredRepair(context, continuation, input.projectId ? { projectId: input.projectId, runId: input.runId } : undefined))
-                continue;
-            return { code: outcome.error.code, message: outcome.error.message ?? "Lifecycle command failed", details: outcome.error.details ?? {}, hook_event_id: hook.id };
+            const failure = applicableLifecycleRejection(context, { code: outcome.error.code, message: outcome.error.message ?? "Lifecycle command failed", details: outcome.error.details ?? {} }, input, { eventKey: hook.event_key });
+            if (failure)
+                return { ...failure, hook_event_id: hook.id };
         }
     }
     const attempts = context.db.all("SELECT * FROM lifecycle_invocations ORDER BY updated_at DESC, rowid DESC");
+    const projectRoot = input.projectRoot ?? (input.projectId ? context.db.get("SELECT root FROM projects WHERE id=?", [input.projectId])?.root : undefined);
     const scoped = attempts.filter(row => {
         try {
             const scope = JSON.parse(row.scope_json);
-            return scope.runId === input.runId && scope.generation === input.generation && (!input.projectRoot || scope.projectRoot === input.projectRoot);
+            return scope.runId === input.runId && scope.generation === input.generation && (!projectRoot || scope.projectRoot === projectRoot);
         }
         catch {
             return false;
         }
     });
-    const fingerprints = [...new Set(scoped.map(row => row.fingerprint))];
-    for (const fingerprint of fingerprints) {
-        const rows = scoped.filter(row => row.fingerprint === fingerprint);
-        // An issued successor has not performed the correction. Once the Turn
-        // ended it cannot erase the predecessor's actual rejection.
-        if (rows.some(row => ["observed", "executing"].includes(row.status)))
-            continue;
-        const row = rows.find(candidate => candidate.status === "settled");
-        if (!row)
+    for (const row of scoped) {
+        if (row.status !== "settled")
             continue;
         let outcome;
         try {
@@ -2207,13 +2330,9 @@ export function currentLifecycleFailure(context, input) {
         }
         if (stage !== input.stage)
             continue;
-        const continuation = outcome.error.details?.continuation;
-        if (continuation && typeof continuation === "object"
-            && continuation.run_id === input.runId
-            && continuation.stage === input.stage
-            && isRegisteredRepair(context, continuation, input.projectId ? { projectId: input.projectId, runId: input.runId } : undefined))
-            continue;
-        return { code: outcome.error.code, message: outcome.error.message, details: outcome.error.details ?? {}, invocation_id: row.id };
+        const failure = applicableLifecycleRejection(context, { code: outcome.error.code, message: outcome.error.message, details: outcome.error.details ?? {} }, input, { invocationId: row.id });
+        if (failure)
+            return { ...failure, invocation_id: typeof failure.details.invocation_id === "string" ? failure.details.invocation_id : row.id };
     }
     return null;
 }

package/dist/services/run-controller-state.js

@@ -85,6 +85,14 @@ export function retainControllerContinuation(state, fingerprint, error) {
         throw new AppError(error.code, error.message, 1, error.details);
     state.last_continuation = fingerprint;
 }
+/** Keep a bounded diagnostic projection, not the whole failing prompt/receipt. */
+export function controllerDependencyDiagnostic(recorded, protectedAction) {
+    const details = recorded.details && typeof recorded.details === "object" ? recorded.details : {};
+    return { primary: { code: String(recorded.code), message: String(recorded.message) }, protected_action: protectedAction,
+        ...Object.fromEntries(["reason", "work_id", "operation_id", "refusal_invocation_id", "successor_invocation_id", "stage", "attempt", "action", "invocation_id"].filter(key => typeof details[key] === "string").map(key => [key, details[key]])),
+        ...(details.checkpoint && typeof details.checkpoint === "object" ? { checkpoint: details.checkpoint } : {}),
+        ...(details.authority && typeof details.authority === "object" ? { authority: details.authority } : {}) };
+}
 export function digest(value) { return digestBytes(JSON.stringify(value)); }
 export function digestBytes(value) { return crypto.createHash("sha256").update(value).digest("hex"); }
 export function errorRecord(error) {

package/dist/services/run-controller.js

@@ -1,4 +1,5 @@
-import { assertLifecycleOutcomes, currentLifecycleFailure, managedInvocationContext, managedLifecycleCommand, awaitLifecycleInvocation, assertLifecycleInvocationCurrent, bindControllerStageAssignment } from "./lifecycle-invocations.js";
+import { assertLifecycleOutcomes, currentLifecycleFailure, currentStageFinishAuthority, managedInvocationContext, managedLifecycleCommand, awaitLifecycleInvocation, assertLifecycleInvocationCurrent, bindControllerStageAssignment } from "./lifecycle-invocations.js";
+import { stageAttempt } from "./stage-work-graph.js";
 import { isSourceSnapshotFlow } from "../domain/source-snapshot-flows.js";
 import { isDeliveryFlow } from "../domain/delivery-flows.js";
 export function recoveryPacketMatchesStage(packet, scope) {
@@ -36,12 +37,12 @@ import { readNativeDaemonState, requireManagedDaemonBinding, managedDaemonExecut
 import { initCodexHome } from "./hooks.js";
 import { launchExternalWork } from "./external-work-launch.js";
 import { runControllerMemoryTask } from "./controller-memory-task.js";
-import { controllerNativeChildren, controllerStageEntryPrompt, controllerStageResumePrompt, nextControllerFanout } from "./controller-fanout.js";
+import { controllerNativeChildren, controllerSemanticCheckpoint, controllerStageEntryPrompt, controllerStageResumePrompt, nextControllerFanout } from "./controller-fanout.js";
 import { publishPromptDelivery } from "./prompt-delivery.js";
 import { publishStagePacket } from "./stage-report-renderer.js";
 import { claimQueuedMergeRequest } from "./merge-server.js";
 import { prepareVnextCodeWorkspace } from "./vnext-code.js";
-import { requireRun, requireController, controllerReceipt, appendEvent, saveState, retainControllerContinuation, retainControllerCapacityIntent, digest, digestBytes, errorRecord } from "./run-controller-state.js";
+import { requireRun, requireController, controllerReceipt, controllerDependencyDiagnostic, appendEvent, saveState, retainControllerContinuation, retainControllerCapacityIntent, digest, digestBytes, errorRecord } from "./run-controller-state.js";
 import { assertNoCorrelatedRejection } from "./continuation-outcome.js";
 import { spawnController, recordControllerLauncher, claimControllerProcess, markControllerDispatchReady, assertControllerLeaseAllowed } from "./run-controller-process.js";
 import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
@@ -684,11 +685,9 @@ async function executeController(context, row, manifest, state, assertOwnership,
         // require that same failure to disappear before the owner can pause it.
         assertPhysicalOwner();
         const recorded = cause ? errorRecord(cause) : { code: "native_writer_dependency_blocked", message: "Conflicting native execution has not settled" };
-        const primary = { code: String(recorded.code), message: String(recorded.message) };
+        const dependency = controllerDependencyDiagnostic(recorded, protectedAction);
+        const primary = dependency.primary;
         const details = cause instanceof AppError ? cause.details : {};
-        const dependency = { primary, protected_action: protectedAction,
-            ...(typeof details.reason === "string" ? { reason: details.reason } : {}),
-            ...Object.fromEntries(["work_id", "operation_id", "refusal_invocation_id", "successor_invocation_id"].filter(key => typeof details[key] === "string").map(key => [key, details[key]])) };
         recordTechnicalNote(context, row.project_id, row.run_id, { code: primary.code, message: primary.message,
             phase: protectedAction, generation: row.generation, ...(state.stage ? { stage: state.stage } : {}),
             ...(typeof details.work_id === "string" ? { work_id: details.work_id } : {}),
@@ -1641,8 +1640,33 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 saveState(context, row, state);
                 continue;
             }
-            if (state.last_continuation === fanout.fingerprint)
-                assertNoCorrelatedRejection(context, { projectId: row.project_id, runId: row.run_id, generation: row.generation, stage: next.stage, turn: state.turns });
+            if (state.last_continuation === fanout.fingerprint) {
+                // Re-read committed evidence before pausing; a settlement can race the
+                // graph observation. No new prompt or invocation is issued to reconcile.
+                const latest = executionContext.db.get("SELECT status,index_json FROM runs WHERE project_id=? AND id=?", [row.project_id, row.run_id]);
+                const latestStage = latest && [...(JSON.parse(latest.index_json).stage_runs ?? [])].reverse().find((stage) => stage.stage === next.stage);
+                if (latest?.status === "done" || latestStage?.status === "done")
+                    continue;
+                if (fanout.authority) {
+                    const current = currentStageFinishAuthority(executionContext, next.stage);
+                    if (current?.status === "issued" && current.command) {
+                        const checkpoint = controllerSemanticCheckpoint(executionContext, { stage: next.stage, phase: "stage_finish", command: current.command, invocationId: current.id });
+                        if (JSON.stringify(checkpoint) !== JSON.stringify(fanout.checkpoint))
+                            continue;
+                    }
+                }
+                let rejected;
+                try {
+                    assertNoCorrelatedRejection(context, { projectId: row.project_id, runId: row.run_id, generation: row.generation, stage: next.stage, turn: state.turns });
+                }
+                catch (error) {
+                    if (!(error instanceof AppError))
+                        throw error;
+                    rejected = error;
+                }
+                await pauseDependency(session, undefined, new AppError(rejected?.code ?? "fanout_stage_nonprogressing", rejected?.message ?? "The coordinator repeated an unchanged continuation", 1, { ...rejected?.details, stage: next.stage, attempt: stageAttempt(executionContext, row.project_id, row.run_id, next.stage), action: fanout.action,
+                    checkpoint: JSON.parse(fanout.fingerprint), ...(fanout.authority ? { authority: fanout.authority } : {}), reconciliation_required: true }), "productive_continuation");
+            }
             retainControllerContinuation(state, fanout.fingerprint, { code: "fanout_stage_nonprogressing", message: "The coordinator repeated an unchanged Work-graph continuation", details: { stage: next.stage, action: fanout.action, before: state.last_continuation, after: fanout.fingerprint, controller_turn: state.turns } });
             saveState(context, row, state);
             await prompt(session, fanout.prompt, undefined, undefined, fanout.action === "materialize_graph" ? "graph" : fanout.action === "dispatch_work" ? "work" : "finish", fanout.work_ids);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.158",
+  "version": "0.9.0-beta.159",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "packageManager": "pnpm@10.23.0",