@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.161

package/dist/services/memory-repair-writer-copy.js

@@ -0,0 +1,736 @@
+import fs from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { AppError } from "../shared/errors.js";
+import { appendAudit } from "./audit.js";
+import { hybridDigest } from "./hybrid-contracts.js";
+import { PreparedMemoryRepairWorkBaseline } from "./memory-repair-work-baseline.js";
+import { PreparedSecondMemoryRepairBaseline } from "./memory-second-repair-baseline.js";
+import { PreparedMemoryRepairWorkspace } from "./memory-repair-workspace.js";
+import { runtimeHarness } from "./execution-policy.js";
+import { hookSessionIdentity } from "./hooks.js";
+import { isCompletedMemoryRepairClaim } from "./memory-repair-work-results.js";
+import { RetainedMemoryRepairPublicationPlan } from "./memory-repair-publication-plan.js";
+import { PreparedMemoryRepairPublicationSource } from "./memory-repair-publication-source.js";
+import { retainedMemoryRepairPublicationPlans } from "./memory-repair-publication-intent.js";
+import { recordMemoryRepairNativeBinding, memoryRepairExecutionIdentity } from "./memory-repair-physical-binding.js";
+const event = "memory.repair_writer_copy_intent";
+const preparationToken = Symbol("memory-repair-writer-copy-preparation");
+function sqlHookIdentity(context, projectId, eventKey, execution) {
+    if (execution)
+        return memoryRepairExecutionIdentity(context, { projectId, eventKey, ...execution }).identity;
+    const reader = { ...context };
+    // Lifecycle observation may read daemon files; custody rechecks are SQL-only.
+    delete reader.observeLifecycleHook;
+    return hookSessionIdentity(reader, projectId, eventKey);
+}
+function refuse(reason) {
+    throw new AppError("memory_repair_writer_copy_invalid", "Writer workspace lacks independently registered copy custody", 1, { reason, effect: "no_effect" });
+}
+function selected(context, expected, eventType = event) {
+    const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? LIMIT 2", [expected.project_id, eventType, expected.run_id, expected.work_id, expected.generation]);
+    if (!rows.length)
+        return null;
+    try {
+        const bound = eventType === event ? 1024 * 1024 : 12 * 1024 * 1024;
+        if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > bound)
+            refuse("ambiguous_or_unbounded_copy_intent");
+        const value = JSON.parse(rows[0].payload_json);
+        if (hybridDigest(value) !== hybridDigest(expected))
+            refuse("foreign_or_changed_copy_intent");
+        return value;
+    }
+    catch (error) {
+        if (error instanceof AppError && error.code === "memory_repair_writer_copy_invalid")
+            throw error;
+        return refuse("invalid_copy_intent");
+    }
+}
+function safeDestination(intent) {
+    try {
+        if (!path.isAbsolute(intent.run_root) || fs.realpathSync(intent.run_root) !== path.resolve(intent.run_root)
+            || !fs.lstatSync(intent.run_root).isDirectory())
+            refuse("noncanonical_run_root");
+        let current = intent.run_root;
+        for (const part of intent.copy_relative.split("/")) {
+            current = path.join(current, part);
+            const stat = fs.lstatSync(current, { throwIfNoEntry: false });
+            if (stat && !stat.isDirectory())
+                refuse("linked_or_non_directory_copy_path");
+            if (!stat)
+                break;
+        }
+    }
+    catch (error) {
+        if (error instanceof AppError && error.code === "memory_repair_writer_copy_invalid")
+            throw error;
+        return refuse("copy_destination_unavailable");
+    }
+}
+function intentFor(context, baseline) {
+    const receipt = baseline.receipt();
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/.test(receipt.work_id)
+        || !Number.isSafeInteger(receipt.generation) || receipt.generation < 0)
+        refuse("unsafe_copy_scope");
+    const run = context.db.get("SELECT run_root,run_dir FROM runs WHERE project_id=? AND id=?", [receipt.project_id, receipt.run_id]);
+    if (!run)
+        refuse("owned_run_required");
+    const intent = { schema_id: "dd-flow/memory-repair-writer-copy-intent@1",
+        project_id: receipt.project_id, run_id: receipt.run_id, work_id: receipt.work_id, generation: receipt.generation,
+        baseline_registration_sha256: baseline.sha256, protected_baseline_sha256: receipt.baseline_sha256,
+        exported_baseline_sha256: receipt.exported_baseline_sha256, run_root: run.run_root ?? run.run_dir,
+        source_root: receipt.workspace_root, copy_relative: `works/${receipt.work_id}/writer-workspaces/generation-${receipt.generation}`,
+        input: baseline.copyInput() };
+    if (Buffer.byteLength(JSON.stringify(intent)) > 1024 * 1024)
+        refuse("unbounded_copy_intent");
+    return intent;
+}
+/** Reserve a CLI-owned destination before filesystem/provider effects. An
+ * intent never proves a complete copy, actual CWD, physical Session or repair.
+ * Existing files without this receipt cannot be adopted after receipt loss.
+ */
+export class PreparedMemoryRepairWriterCopy {
+    sha256;
+    #baseline;
+    #intent;
+    constructor(token, baseline, intent) {
+        if (token !== preparationToken)
+            refuse("prepared_copy_token_required");
+        this.#baseline = baseline;
+        this.#intent = structuredClone(intent);
+        this.sha256 = hybridDigest(intent);
+        Object.freeze(this);
+    }
+    static prepare(context, baseline) {
+        if (!PreparedMemoryRepairWorkBaseline.isPrepared(baseline) && !PreparedSecondMemoryRepairBaseline.isPrepared(baseline))
+            refuse("registered_work_baseline_required");
+        baseline.assertPrelaunchCustody(context);
+        baseline.revalidate(context);
+        baseline.assertRegisteredCustody(context);
+        const intent = intentFor(context, baseline);
+        const prepared = new PreparedMemoryRepairWriterCopy(preparationToken, baseline, intent);
+        prepared.revalidate(context);
+        return prepared;
+    }
+    intent() { return structuredClone(this.#intent); }
+    root() { return path.join(this.#intent.run_root, this.#intent.copy_relative); }
+    assertCustody(context) {
+        this.#baseline.assertRegisteredCustody(context);
+        const run = context.db.get("SELECT run_root,run_dir FROM runs WHERE project_id=? AND id=?", [this.#intent.project_id, this.#intent.run_id]);
+        if (!run || (run.run_root ?? run.run_dir) !== this.#intent.run_root)
+            refuse("run_root_changed");
+        selected(context, this.#intent);
+    }
+    revalidate(context) {
+        this.#baseline.revalidate(context);
+        this.assertCustody(context);
+        safeDestination(this.#intent);
+        if (!selected(context, this.#intent) && fs.existsSync(this.root()))
+            refuse("unowned_copy_root");
+    }
+    reserve(context) {
+        this.revalidate(context);
+        return context.db.writeTransaction(() => {
+            this.assertCustody(context);
+            const prior = selected(context, this.#intent);
+            if (!prior)
+                appendAudit(context, { projectId: this.#intent.project_id, eventType: event, payload: this.#intent });
+            if (hybridDigest(selected(context, this.#intent)) !== this.sha256)
+                refuse("copy_intent_readback_failed");
+            return { work_id: this.#intent.work_id, copy_root: this.root(), copy_intent_sha256: this.sha256, status: "reserved", replayed: Boolean(prior) };
+        });
+    }
+    /** Prepare actual frozen second-wave launch inputs from a completed owned
+     * copy, without dispatching or manufacturing a provider Session/start. */
+    secondWaveLaunchPacket(context) {
+        if (!PreparedSecondMemoryRepairBaseline.isPrepared(this.#baseline))
+            refuse("second_prelaunch_baseline_required");
+        return this.launchPacket(context);
+    }
+    /** Both waves use the same independently registered ready copy boundary.
+     * A packet is preparation data, never authority to claim or dispatch. */
+    launchPacket(context) {
+        const baseline = this.#baseline;
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("preparation_outside_writer_required");
+        this.revalidate(context);
+        if (!selected(context, this.#intent))
+            refuse("registered_copy_intent_required");
+        const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='memory.repair_writer_copy_ready' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? LIMIT 2", [this.#intent.project_id, this.#intent.run_id, this.#intent.work_id, this.#intent.generation]);
+        if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 12 * 1024 * 1024)
+            refuse("ready_copy_receipt_required");
+        let ready;
+        try {
+            ready = JSON.parse(rows[0].payload_json);
+        }
+        catch {
+            return refuse("invalid_ready_receipt");
+        }
+        if (!ready || typeof ready.workspace_manifest_base64 !== "string")
+            refuse("ready_manifest_required");
+        const bytes = Buffer.from(ready.workspace_manifest_base64, "base64");
+        if (bytes.toString("base64") !== ready.workspace_manifest_base64)
+            refuse("changed_ready_manifest");
+        const workspace = PreparedMemoryRepairWorkspace.restore(bytes, ready.workspace_manifest_sha256, baseline.exportedBaseline());
+        const build = { ...this.#intent, workspace_manifest_sha256: workspace.sha256, workspace_manifest_base64: bytes.toString("base64") };
+        if (!selected(context, build, "memory.repair_writer_copy_build") || !selected(context, build, "memory.repair_writer_copy_ready"))
+            refuse("registered_ready_build_required");
+        workspace.verify(this.root());
+        const route = baseline.workerRoute();
+        const frozen = { coordinator: route.coordinator, worker: route.worker,
+            delegation: { mode: route.delegation.mode, max_parallel: route.delegation.mode === "external" ? route.delegation.max_parallel : null } };
+        const metadata = { root: build.copy_relative, copy_intent_sha256: this.sha256, workspace_manifest_sha256: workspace.sha256,
+            baseline_registration_sha256: baseline.sha256 };
+        this.revalidate(context);
+        return { work_id: this.#intent.work_id, copy_root: this.root(), profile: { ...frozen,
+                profile_hash: createHash("sha256").update(JSON.stringify(frozen)).digest("hex"), memory_repair_copy: metadata } };
+    }
+    /** Exact completed copies can reconcile a missing completion projection.
+     * Exact partial builds may fill missing files, never overwrite known bytes.
+     * Provider launch/start still requires separate physical Session custody.
+     */
+    materialize(context) {
+        this.revalidate(context);
+        if (!selected(context, this.#intent))
+            refuse("registered_copy_intent_required");
+        const workspace = PreparedMemoryRepairWorkspace.capture(this.#intent.source_root, this.#intent.input, this.#baseline.exportedBaseline());
+        const build = { ...this.#intent, workspace_manifest_sha256: workspace.sha256, workspace_manifest_base64: workspace.bytes().toString("base64") };
+        const buildEvent = "memory.repair_writer_copy_build", readyEvent = "memory.repair_writer_copy_ready";
+        const prior = selected(context, build, buildEvent);
+        if (!prior && fs.lstatSync(this.root(), { throwIfNoEntry: false }))
+            refuse("copy_without_build_receipt");
+        context.db.writeTransaction(() => {
+            this.assertCustody(context);
+            if (!selected(context, this.#intent))
+                refuse("registered_copy_intent_required");
+            if (!selected(context, build, buildEvent))
+                appendAudit(context, { projectId: build.project_id, eventType: buildEvent, payload: build });
+            if (!selected(context, build, buildEvent))
+                refuse("build_receipt_readback_failed");
+        });
+        try {
+            this.revalidate(context);
+            workspace.revalidateSource();
+            const ready = selected(context, build, readyEvent);
+            if (ready)
+                workspace.verify(this.root());
+            else if (fs.lstatSync(this.root(), { throwIfNoEntry: false }))
+                workspace.resume(this.root());
+            else {
+                fs.mkdirSync(path.dirname(this.root()), { recursive: true, mode: 0o700 });
+                safeDestination(this.#intent);
+                workspace.create(this.root());
+            }
+            this.revalidate(context);
+            workspace.verify(this.root());
+            return context.db.writeTransaction(() => {
+                this.assertCustody(context);
+                if (!selected(context, this.#intent) || !selected(context, build, buildEvent))
+                    refuse("copy_build_custody_lost");
+                const replay = selected(context, build, readyEvent);
+                if (!replay)
+                    appendAudit(context, { projectId: build.project_id, eventType: readyEvent, payload: build });
+                if (!selected(context, build, readyEvent))
+                    refuse("ready_receipt_readback_failed");
+                return { work_id: build.work_id, copy_root: this.root(), copy_intent_sha256: this.sha256,
+                    workspace_manifest_sha256: workspace.sha256, status: "materialized", replayed: Boolean(replay),
+                    memory_repair_copy: { root: build.copy_relative, copy_intent_sha256: this.sha256,
+                        workspace_manifest_sha256: workspace.sha256, baseline_registration_sha256: this.#baseline.sha256 } };
+            });
+        }
+        catch (error) {
+            throw new AppError("memory_repair_writer_copy_publication_pending", "Copy build is registered but not admitted; reconcile its owned workspace before dispatch", 1, { effect: "publication_pending", work_id: build.work_id, copy_root: this.root(), cause: error instanceof Error ? error.message : String(error) });
+        }
+    }
+}
+function intentForValue(build) {
+    const value = structuredClone(build);
+    delete value.workspace_manifest_sha256;
+    delete value.workspace_manifest_base64;
+    return value;
+}
+/** Prepared physical-start boundary, not permission to dispatch or settle a
+ * repair. The actual Hook claimant must match the independently retained
+ * physical provider Session; ready files alone cannot manufacture that proof.
+ */
+export class PreparedBoundMemoryRepairCopy {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #build in value;
+    }
+    #baseline;
+    #build;
+    #workspace;
+    #providerSessionId;
+    #claimWriterToken = null;
+    #startReceipt = null;
+    #restoredStart = false;
+    #claimIdentity = null;
+    constructor(token, baseline, build, workspace, providerSessionId) {
+        if (token !== preparationToken)
+            refuse("prepared_copy_token_required");
+        this.#baseline = baseline;
+        this.#build = structuredClone(build);
+        this.#workspace = workspace;
+        this.#providerSessionId = providerSessionId;
+        Object.freeze(this);
+    }
+    static prepare(context, baseline, requestedRoot) {
+        return this.#prepare(context, baseline, requestedRoot, null);
+    }
+    static restoreForStartedWork(context, baseline, requestedRoot, workSessionId) {
+        if (typeof workSessionId !== "string" || !workSessionId || workSessionId.length > 256)
+            refuse("registered_start_session_required");
+        return this.#prepare(context, baseline, requestedRoot, workSessionId);
+    }
+    static restoreForPublication(context, baseline, requestedRoot, workSessionId) {
+        if (!PreparedMemoryRepairWorkBaseline.isPrepared(baseline))
+            refuse("registered_work_baseline_required");
+        baseline.registeredPublicationIntent(context, workSessionId);
+        return this.#prepare(context, baseline, requestedRoot, workSessionId, true);
+    }
+    /** Retained start/private-input restoration, not shared publication admission. */
+    static restoreForOutput(context, baseline, requestedRoot, workSessionId) {
+        if (typeof workSessionId !== "string" || !workSessionId || workSessionId.length > 256)
+            refuse("registered_start_session_required");
+        return this.#prepare(context, baseline, requestedRoot, workSessionId, false, true);
+    }
+    static #prepare(context, baseline, requestedRoot, workSessionId, publicationOnly = false, outputOnly = false) {
+        if (!PreparedMemoryRepairWorkBaseline.isPrepared(baseline))
+            refuse("registered_work_baseline_required");
+        baseline.assertRegisteredCustody(context);
+        const launch = baseline.launch();
+        if (!launch?.provider_session_id)
+            refuse("registered_physical_launch_required");
+        const intent = intentFor(context, baseline);
+        if (!selected(context, intent))
+            refuse("registered_copy_intent_required");
+        const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='memory.repair_writer_copy_ready' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? LIMIT 2", [intent.project_id, intent.run_id, intent.work_id, intent.generation]);
+        try {
+            if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 12 * 1024 * 1024)
+                refuse("ready_copy_receipt_required");
+            const ready = JSON.parse(rows[0].payload_json);
+            if (typeof ready.workspace_manifest_base64 !== "string")
+                refuse("ready_manifest_required");
+            const bytes = Buffer.from(ready.workspace_manifest_base64, "base64");
+            if (bytes.toString("base64") !== ready.workspace_manifest_base64)
+                refuse("changed_ready_manifest");
+            const build = { ...intent, workspace_manifest_sha256: ready.workspace_manifest_sha256, workspace_manifest_base64: ready.workspace_manifest_base64 };
+            if (!selected(context, build, "memory.repair_writer_copy_build") || !selected(context, build, "memory.repair_writer_copy_ready"))
+                refuse("registered_ready_build_required");
+            const workspace = PreparedMemoryRepairWorkspace.restore(bytes, build.workspace_manifest_sha256, baseline.exportedBaseline());
+            const metadata = JSON.parse(launch.profile_json).memory_repair_copy;
+            const expected = { root: intent.copy_relative, copy_intent_sha256: hybridDigest(intent), workspace_manifest_sha256: workspace.sha256,
+                baseline_registration_sha256: baseline.sha256 };
+            if (hybridDigest(metadata) !== hybridDigest(expected) || typeof requestedRoot !== "string"
+                || !path.isAbsolute(requestedRoot) || requestedRoot !== path.resolve(requestedRoot)
+                || requestedRoot !== path.join(intent.run_root, intent.copy_relative))
+                refuse("launch_copy_or_cwd_mismatch");
+            const prepared = new PreparedBoundMemoryRepairCopy(preparationToken, baseline, build, workspace, launch.provider_session_id);
+            if (workSessionId)
+                prepared.#restoreStart(context, workSessionId, publicationOnly, outputOnly);
+            else
+                prepared.revalidate(context);
+            return prepared;
+        }
+        catch (error) {
+            if (error instanceof AppError && error.code === "memory_repair_writer_copy_invalid")
+                throw error;
+            return refuse("invalid_bound_copy_receipt");
+        }
+    }
+    root() { return path.join(this.#build.run_root, this.#build.copy_relative); }
+    /** Observe a result against the retained start, never agent-supplied baseline
+     * authority. This preparation does not publish or settle the Work.
+     */
+    prepareOutput(context, bytes, workSessionId) {
+        if (!(bytes instanceof Uint8Array) || !bytes.byteLength || bytes.byteLength > 1024 * 1024)
+            refuse("bounded_result_bytes_required");
+        if (!this.#restoredStart || !this.#startReceipt || this.#startReceipt.work_session_id !== workSessionId)
+            refuse("restored_registered_start_required");
+        this.revalidateCommittedStart(context, workSessionId);
+        const retained = Buffer.from(bytes);
+        const result = this.#baseline.validateResult(context, retained);
+        const exported = this.#baseline.exportedBaseline();
+        const delta = exported.observeResult(this.root(), result);
+        const transition = this.#baseline.baseline().publicationTransition(exported, delta);
+        this.revalidateCommittedStart(context, workSessionId);
+        delta.revalidate();
+        return new PreparedMemoryRepairPrivateOutput(preparationToken, this, workSessionId, retained, result, delta, transition);
+    }
+    /** The frozen private input remains unchanged. Only an independently
+     * registered running-Work source owner can admit a different shared view. */
+    prepareOutputAgainstSource(context, bytes, workSessionId, source) {
+        if (!PreparedMemoryRepairPublicationSource.isPrepared(source) || !source.matches(this.#baseline, this, workSessionId))
+            refuse("registered_publication_source_required");
+        if (!(bytes instanceof Uint8Array) || !bytes.byteLength || bytes.byteLength > 1024 * 1024)
+            refuse("bounded_result_bytes_required");
+        if (!this.#restoredStart || !this.#startReceipt || this.#startReceipt.work_session_id !== workSessionId)
+            refuse("restored_registered_start_required");
+        source.assertRegisteredCustody(context);
+        source.revalidate(context);
+        const retained = Buffer.from(bytes), result = this.#baseline.validateResult(context, retained);
+        const exported = this.#baseline.exportedBaseline(), start = this.#baseline.baseline();
+        const delta = exported.observeResult(this.root(), result);
+        const privateTransition = start.publicationTransition(exported, delta);
+        const transition = source.before().publicationTransition(exported, delta, start);
+        source.revalidate(context);
+        delta.revalidate();
+        return new PreparedMemoryRepairPrivateOutput(preparationToken, this, workSessionId, retained, result, delta, transition, source, privateTransition);
+    }
+    input() {
+        const receipt = this.#baseline.receipt(), launch = this.#baseline.launch();
+        const current = this.#baseline.currentInput();
+        return { schema_id: current ? "dd-flow/memory-repair-work-input@2" : "dd-flow/memory-repair-work-input@1", work_id: this.#build.work_id, generation: this.#build.generation,
+            packet_sha256: receipt.packet_sha256, baseline_registration_sha256: this.#baseline.sha256,
+            protected_baseline_sha256: this.#build.protected_baseline_sha256, exported_baseline_sha256: this.#build.exported_baseline_sha256,
+            copy_intent_sha256: hybridDigest(intentForValue(this.#build)), copy_build_sha256: hybridDigest(this.#build),
+            workspace_manifest_sha256: this.#build.workspace_manifest_sha256, workspace_root: this.root(),
+            launch_operation_id: launch.operation_id, provider_session_id: this.#providerSessionId, ...(current ?? {}) };
+    }
+    startedReceipt() {
+        if (!this.#startReceipt)
+            refuse("registered_start_receipt_required");
+        return structuredClone(this.#startReceipt);
+    }
+    sourceRoot() { return this.#build.source_root; }
+    assertClaimIdentity(context, identity) {
+        if (this.#restoredStart)
+            refuse("restored_start_cannot_claim");
+        const token = context.db.ownedWriteTransactionToken?.();
+        if (!token || context.db.isOwnedWriteTransaction?.() !== true)
+            refuse("owned_work_claim_writer_required");
+        this.assertProviderSession(context, identity.providerSessionId);
+        this.#assertPhysicalIdentity(context, identity);
+        this.#claimWriterToken = token;
+        this.#claimIdentity = { hookEventId: identity.hookEventId, providerSessionId: identity.providerSessionId,
+            sessionId: identity.sessionId, harness: identity.harness, cwd: identity.cwd };
+    }
+    #assertPhysicalIdentity(context, identity) {
+        const profile = JSON.parse(this.#baseline.launch().profile_json);
+        if (identity.providerSessionId !== this.#providerSessionId || identity.harness !== runtimeHarness(profile.worker)
+            || identity.cwd !== this.root())
+            refuse("repair_session_or_cwd_mismatch");
+        if (context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id=ws.work_id JOIN sessions s ON s.project_id=w.project_id AND s.session_id=ws.session_id WHERE w.project_id=? AND w.run_id=? AND w.work_id<>? AND s.harness=? AND s.provider_session_id=? LIMIT 1", [this.#build.project_id, this.#build.run_id, this.#build.work_id, identity.harness, identity.providerSessionId]))
+            refuse("repair_session_not_fresh");
+    }
+    /** Called inside the generic Work claim writer, after its WorkSession row
+     * exists. The independent start receipt commits atomically with that claim.
+     */
+    recordStart(context, workSessionId) {
+        if (context.db.isOwnedWriteTransaction?.() !== true)
+            refuse("owned_work_claim_writer_required");
+        if (!this.#claimIdentity || !this.#claimWriterToken || context.db.ownedWriteTransactionToken?.() !== this.#claimWriterToken)
+            refuse("same_work_claim_writer_required");
+        recordMemoryRepairNativeBinding(context, this.#build.work_id, this.#baseline.workerRoute(), this.#baseline.launch(), workSessionId);
+        const physical = this.#baseline.assertRegisteredStartCustody(context, workSessionId);
+        const identity = sqlHookIdentity(context, this.#build.project_id, physical.hook_event_id, { runId: this.#build.run_id, workId: this.#build.work_id, root: this.root() });
+        if (hybridDigest({ hookEventId: identity.hookEventId, providerSessionId: identity.providerSessionId, sessionId: identity.sessionId,
+            harness: identity.harness, cwd: identity.cwd }) !== hybridDigest(this.#claimIdentity))
+            refuse("repair_claim_identity_changed");
+        this.#assertPhysicalIdentity(context, identity);
+        if (identity.sessionId !== physical.session_id || physical.cwd !== this.root()
+            || !context.db.get("SELECT 1 FROM hook_events WHERE project_id=? AND event_key=? AND status='claimed' AND event_name='PreToolUse' AND session_id=? AND provider_session_id=? AND harness=?", [this.#build.project_id, physical.hook_event_id, physical.session_id, this.#providerSessionId, identity.harness]))
+            refuse("registered_start_hook_required");
+        const intent = intentFor(context, this.#baseline);
+        if (hybridDigest(intent) !== hybridDigest(intentForValue(this.#build)) || !selected(context, intent)
+            || !selected(context, this.#build, "memory.repair_writer_copy_build") || !selected(context, this.#build, "memory.repair_writer_copy_ready"))
+            refuse("bound_copy_custody_changed");
+        try {
+            if (typeof physical.start_receipt_json !== "string" || Buffer.byteLength(physical.start_receipt_json) > 16 * 1024 * 1024)
+                refuse("invalid_repair_start_receipt");
+            const start = JSON.parse(physical.start_receipt_json), hash = (value) => createHash("sha256").update(value).digest("hex");
+            if (start.version !== 2 || start.generation !== this.#build.generation || typeof start.context !== "string"
+                || start.context_sha256 !== hash(start.context) || typeof start.prompt !== "string" || start.prompt_sha256 !== hash(start.prompt)
+                || start.response?.work_session_id !== workSessionId || start.response?.worker_prompt_markdown !== start.prompt
+                || start.response_sha256 !== hash(JSON.stringify(start.response)))
+                refuse("repair_start_receipt_changed");
+            const input = JSON.parse(start.context);
+            if (input.work_id !== this.#build.work_id || input.run_id !== this.#build.run_id || input.workspace_root !== this.root()
+                || input.read_only !== false || input.result_schema !== "dd-flow/memory-repair-work-result@1"
+                || hybridDigest(input.memory_repair_input) !== hybridDigest(this.input()))
+                refuse("repair_start_input_changed");
+            const value = { schema_id: "dd-flow/memory-repair-start@1", project_id: this.#build.project_id, run_id: this.#build.run_id,
+                work_id: this.#build.work_id, generation: this.#build.generation, work_session_id: workSessionId,
+                session_id: physical.session_id, hook_event_id: physical.hook_event_id, harness: identity.harness,
+                provider_session_id: this.#providerSessionId, context_sha256: start.context_sha256, prompt_sha256: start.prompt_sha256,
+                input_sha256: hybridDigest(this.input()) };
+            const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='memory.repair_work_start' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? LIMIT 2", [value.project_id, value.run_id, value.work_id, value.generation]);
+            if (rows.length > 1 || rows.length && (Buffer.byteLength(rows[0].payload_json) > 1024 * 1024 || hybridDigest(JSON.parse(rows[0].payload_json)) !== hybridDigest(value)))
+                refuse("repair_start_registration_changed");
+            if (!rows.length)
+                appendAudit(context, { projectId: value.project_id, eventType: "memory.repair_work_start", payload: value });
+            const retained = context.db.get("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='memory.repair_work_start' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=?", [value.project_id, value.run_id, value.work_id, value.generation]);
+            if (!retained || hybridDigest(JSON.parse(retained.payload_json)) !== hybridDigest(value))
+                refuse("repair_start_readback_failed");
+            this.#startReceipt = structuredClone(value);
+            return value;
+        }
+        catch (error) {
+            if (error instanceof AppError && error.code === "memory_repair_writer_copy_invalid")
+                throw error;
+            return refuse("invalid_repair_start_receipt");
+        }
+    }
+    assertProviderSession(context, providerSessionId) {
+        this.assertCustody(context);
+        if (providerSessionId !== this.#providerSessionId)
+            refuse("foreign_physical_session");
+    }
+    /** Before projecting the committed prompt, prove that SQL still owns the
+     * same start and neither original inputs nor the private copy have drifted.
+     * Filesystem observation deliberately happens after the claim writer.
+     */
+    revalidateCommittedStart(context, workSessionId) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("start_verification_outside_writer_required");
+        this.assertCommittedStartCustody(context, workSessionId);
+        this.#baseline.revalidateSource(context);
+        safeDestination(this.#build);
+        if (this.#restoredStart)
+            this.#workspace.verifyUnchangedInputs(this.root());
+        else
+            this.#workspace.verify(this.root());
+    }
+    /** SQL-only fence usable inside a publication reservation writer. */
+    assertCommittedStartCustody(context, workSessionId) {
+        if (!this.#startReceipt)
+            refuse("registered_start_receipt_required");
+        const physical = this.#baseline.assertRegisteredStartCustody(context, workSessionId);
+        if (physical.session_id !== this.#startReceipt.session_id || physical.hook_event_id !== this.#startReceipt.hook_event_id
+            || physical.harness !== this.#startReceipt.harness || physical.provider_session_id !== this.#providerSessionId
+            || physical.cwd !== this.root())
+            refuse("repair_start_identity_changed");
+        const identity = sqlHookIdentity(context, this.#build.project_id, physical.hook_event_id, { runId: this.#build.run_id, workId: this.#build.work_id, root: this.root() });
+        this.#assertPhysicalIdentity(context, identity);
+        if (identity.sessionId !== physical.session_id
+            || !context.db.get("SELECT 1 FROM hook_events WHERE project_id=? AND event_key=? AND status='claimed' AND event_name='PreToolUse' AND session_id=? AND provider_session_id=? AND harness=?", [this.#build.project_id, physical.hook_event_id, physical.session_id, this.#providerSessionId, identity.harness]))
+            refuse("registered_start_hook_required");
+        const intent = intentFor(context, this.#baseline);
+        if (hybridDigest(intent) !== hybridDigest(intentForValue(this.#build)) || !selected(context, intent)
+            || !selected(context, this.#build, "memory.repair_writer_copy_build")
+            || !selected(context, this.#build, "memory.repair_writer_copy_ready"))
+            refuse("bound_copy_custody_changed");
+        const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type='memory.repair_work_start' AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? LIMIT 2", [this.#build.project_id, this.#build.run_id, this.#build.work_id, this.#build.generation]);
+        try {
+            if (Buffer.byteLength(physical.start_receipt_json) > 16 * 1024 * 1024)
+                refuse("invalid_repair_start_receipt");
+            const start = JSON.parse(physical.start_receipt_json), hash = (value) => createHash("sha256").update(value).digest("hex");
+            if (start.version !== 2 || start.generation !== this.#build.generation
+                || typeof start.context !== "string" || start.context_sha256 !== this.#startReceipt.context_sha256
+                || hash(start.context) !== start.context_sha256 || typeof start.prompt !== "string"
+                || start.prompt_sha256 !== this.#startReceipt.prompt_sha256 || hash(start.prompt) !== start.prompt_sha256
+                || start.response?.work_session_id !== workSessionId || start.response?.worker_prompt_markdown !== start.prompt
+                || hash(JSON.stringify(start.response)) !== start.response_sha256)
+                refuse("repair_start_receipt_changed");
+            if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 1024 * 1024
+                || hybridDigest(JSON.parse(rows[0].payload_json)) !== hybridDigest(this.#startReceipt))
+                refuse("repair_start_registration_changed");
+        }
+        catch (error) {
+            if (error instanceof AppError && error.code === "memory_repair_writer_copy_invalid")
+                throw error;
+            refuse("invalid_repair_start_receipt");
+        }
+    }
+    #restoreStart(context, workSessionId, publicationOnly = false, outputOnly = false) {
+        const physical = this.#baseline.assertRegisteredStartCustody(context, workSessionId);
+        const identity = sqlHookIdentity(context, this.#build.project_id, physical.hook_event_id, { runId: this.#build.run_id, workId: this.#build.work_id, root: this.root() });
+        this.#assertPhysicalIdentity(context, identity);
+        if (identity.sessionId !== physical.session_id
+            || !context.db.get("SELECT 1 FROM hook_events WHERE project_id=? AND event_key=? AND status='claimed' AND event_name='PreToolUse' AND session_id=? AND provider_session_id=? AND harness=?", [this.#build.project_id, physical.hook_event_id, physical.session_id, this.#providerSessionId, identity.harness]))
+            refuse("registered_start_hook_required");
+        try {
+            if (Buffer.byteLength(physical.start_receipt_json) > 16 * 1024 * 1024)
+                refuse("invalid_repair_start_receipt");
+            const start = JSON.parse(physical.start_receipt_json), input = JSON.parse(start.context);
+            if (input.work_id !== this.#build.work_id || input.run_id !== this.#build.run_id || input.workspace_root !== this.root()
+                || input.read_only !== false || input.result_schema !== "dd-flow/memory-repair-work-result@1"
+                || hybridDigest(input.memory_repair_input) !== hybridDigest(this.input()))
+                refuse("repair_start_input_changed");
+            this.#startReceipt = { schema_id: "dd-flow/memory-repair-start@1", project_id: this.#build.project_id, run_id: this.#build.run_id,
+                work_id: this.#build.work_id, generation: this.#build.generation, work_session_id: workSessionId,
+                session_id: physical.session_id, hook_event_id: physical.hook_event_id, harness: identity.harness,
+                provider_session_id: this.#providerSessionId, context_sha256: start.context_sha256, prompt_sha256: start.prompt_sha256,
+                input_sha256: hybridDigest(this.input()) };
+            this.#restoredStart = true;
+            if (publicationOnly) {
+                this.assertCommittedStartCustody(context, workSessionId);
+                if (this.#baseline.registeredPublicationIntent(context, workSessionId).start_receipt_sha256 !== hybridDigest(this.#startReceipt))
+                    refuse("publication_start_changed");
+            }
+            else if (outputOnly)
+                this.verifyPrivateInputs(context, workSessionId);
+            else
+                this.revalidateCommittedStart(context, workSessionId);
+        }
+        catch (error) {
+            if (error instanceof AppError && error.code === "memory_repair_writer_copy_invalid")
+                throw error;
+            refuse("invalid_repair_start_receipt");
+        }
+    }
+    /** Immutable retained manifest and independent start digest are metadata,
+     * not permission to recapture shared inputs or publish a private result. */
+    workspaceManifest() { return this.#workspace; }
+    startReceiptSha256(context, workSessionId) {
+        this.assertCommittedStartCustody(context, workSessionId);
+        return hybridDigest(this.#startReceipt);
+    }
+    verifyPrivateInputs(context, workSessionId) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("publication_verification_outside_writer_required");
+        this.assertCommittedStartCustody(context, workSessionId);
+        safeDestination(this.#build);
+        this.#workspace.verifyUnchangedInputs(this.root());
+        this.assertCommittedStartCustody(context, workSessionId);
+    }
+    /** Private inputs and reserved output must still match; shared source is
+     * deliberately not recaptured or compared to its original pre-apply view.
+     */
+    verifyPublicationPrivateView(context, workSessionId, expected) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("publication_verification_outside_writer_required");
+        this.assertCommittedStartCustody(context, workSessionId);
+        safeDestination(this.#build);
+        this.#workspace.verifyUnchangedInputs(this.root());
+        expected.revalidate(this.root());
+    }
+    /** Shared MB changes require the separately admitted exact prefix; every
+     * selected input outside MB must still equal the immutable start manifest.
+     * This is read-only verification, not current-view or publication admission.
+     */
+    verifyPublicationSourceInputs(context, workSessionId, expected) {
+        if (context.db.isOwnedWriteTransaction?.())
+            refuse("publication_verification_outside_writer_required");
+        this.assertCommittedStartCustody(context, workSessionId);
+        this.#workspace.verifySelectedSourceInputs(this.sourceRoot(), this.#build.input, expected);
+        this.assertCommittedStartCustody(context, workSessionId);
+    }
+    assertCustody(context) {
+        this.#baseline.assertRegisteredCustody(context);
+        const intent = intentFor(context, this.#baseline);
+        if (hybridDigest({ ...intent, workspace_manifest_sha256: this.#build.workspace_manifest_sha256, workspace_manifest_base64: this.#build.workspace_manifest_base64 }) !== hybridDigest(this.#build)
+            || !selected(context, intent) || !selected(context, this.#build, "memory.repair_writer_copy_build")
+            || !selected(context, this.#build, "memory.repair_writer_copy_ready"))
+            refuse("bound_copy_custody_changed");
+    }
+    revalidate(context) {
+        this.#baseline.revalidate(context);
+        this.assertCustody(context);
+        safeDestination(this.#build);
+        this.#workspace.verify(this.root());
+    }
+}
+/** Immutable private-output observation. Accepted is the worker's claim, not
+ * publication, independent re-review, finding closure or Work settlement.
+ */
+export class PreparedMemoryRepairPrivateOutput {
+    static isPrepared(value) {
+        return typeof value === "object" && value !== null && #copy in value;
+    }
+    sha256;
+    #copy;
+    #workSessionId;
+    #bytes;
+    #result;
+    #delta;
+    #transition;
+    #source;
+    #privatePlan;
+    constructor(token, copy, workSessionId, bytes, result, delta, transition, source = null, privateTransition = null) {
+        if (token !== preparationToken)
+            refuse("private_output_preparation_required");
+        this.#copy = copy;
+        this.#workSessionId = workSessionId;
+        this.#bytes = Buffer.from(bytes);
+        this.#result = structuredClone(result);
+        this.#delta = delta;
+        this.#transition = transition;
+        this.#source = source;
+        this.#privatePlan = null;
+        if (source) {
+            if (!privateTransition)
+                refuse("private_transition_required");
+            const retained = { before_sha256: privateTransition.state(0).sha256, before_base64: privateTransition.state(0).bytes().toString("base64"),
+                after_sha256: privateTransition.after().sha256, after_base64: privateTransition.after().bytes().toString("base64"),
+                actions: privateTransition.actions().map(action => ({ ...action, bytes_base64: action.after?.kind === "file" ? privateTransition.bytes(action.path).toString("base64") : null })) };
+            this.#privatePlan = RetainedMemoryRepairPublicationPlan.restore(Buffer.from(JSON.stringify(retained)), hybridDigest(retained));
+        }
+        this.sha256 = hybridDigest({ input: copy.input(), start_receipt_sha256: hybridDigest(copy.startedReceipt()), work_session_id: workSessionId,
+            result_sha256: createHash("sha256").update(bytes).digest("hex"), delta_sha256: delta.sha256, transition_sha256: transition.sha256,
+            ...(source ? { source_view_sha256: source.sha256, source_receipt_sha256: hybridDigest(source.receipt()), private_plan_sha256: this.#privatePlan.sha256 } : {}) });
+        Object.freeze(this);
+    }
+    result() { return structuredClone(this.#result); }
+    bytes() { return Buffer.from(this.#bytes); }
+    delta() { return this.#delta; }
+    transition() { return this.#transition; }
+    /** Retain exact output bytes and expected views before any shared effect.
+     * Reservation alone grants no permission to apply files or settle Work.
+     */
+    reservePublication(context) {
+        if (!isCompletedMemoryRepairClaim(this.#result))
+            refuse("accepted_private_output_required");
+        this.revalidate(context);
+        const start = this.#copy.startedReceipt(), actions = this.#transition.actions();
+        const retained = { schema_id: this.#source ? "dd-flow/memory-repair-publication-intent@2" : "dd-flow/memory-repair-publication-intent@1", project_id: start.project_id,
+            run_id: start.run_id, work_id: this.#result.work_id, generation: start.generation, work_session_id: this.#workSessionId,
+            source_root: this.#copy.sourceRoot(), private_root: this.#copy.root(), output_sha256: this.sha256,
+            start_receipt_sha256: hybridDigest(start), result_sha256: createHash("sha256").update(this.#bytes).digest("hex"),
+            result_base64: this.#bytes.toString("base64"), delta_sha256: this.#delta.sha256, transition_sha256: this.#transition.sha256,
+            before_sha256: this.#transition.state(0).sha256, before_base64: this.#transition.state(0).bytes().toString("base64"),
+            after_sha256: this.#transition.after().sha256, after_base64: this.#transition.after().bytes().toString("base64"),
+            actions: actions.map(action => ({ ...action, bytes_base64: action.after?.kind === "file" ? this.#transition.bytes(action.path).toString("base64") : null })),
+            ...(this.#source ? { source_view_sha256: this.#source.sha256, source_receipt_sha256: hybridDigest(this.#source.receipt()),
+                private_plan_sha256: this.#privatePlan.sha256, private_plan: JSON.parse(this.#privatePlan.bytes().toString("utf8")) } : {}) };
+        if (Buffer.byteLength(JSON.stringify(retained)) > 160 * 1024 * 1024)
+            refuse("unbounded_publication_intent");
+        retainedMemoryRepairPublicationPlans(retained);
+        const expected = hybridDigest(retained), eventType = "memory.repair_publication_intent";
+        const select = () => {
+            const rows = context.db.all("SELECT payload_json FROM audit_events WHERE project_id=? AND event_type=? AND json_extract(payload_json,'$.run_id')=? AND json_extract(payload_json,'$.work_id')=? AND json_extract(payload_json,'$.generation')=? LIMIT 2", [retained.project_id, eventType, retained.run_id, retained.work_id, retained.generation]);
+            if (!rows.length)
+                return null;
+            try {
+                if (rows.length !== 1 || Buffer.byteLength(rows[0].payload_json) > 160 * 1024 * 1024
+                    || hybridDigest(JSON.parse(rows[0].payload_json)) !== expected)
+                    refuse("publication_intent_changed");
+                return expected;
+            }
+            catch (error) {
+                if (error instanceof AppError && error.code === "memory_repair_writer_copy_invalid")
+                    throw error;
+                return refuse("invalid_publication_intent");
+            }
+        };
+        const result = context.db.writeTransaction(() => {
+            if (context.db.isOwnedWriteTransaction?.() !== true)
+                refuse("owned_publication_writer_required");
+            this.#copy.assertCommittedStartCustody(context, this.#workSessionId);
+            this.#source?.assertRegisteredCustody(context);
+            const prior = select();
+            if (!prior)
+                appendAudit(context, { projectId: retained.project_id, eventType, payload: retained });
+            if (select() !== expected)
+                refuse("publication_intent_readback_failed");
+            return { work_id: retained.work_id, work_session_id: this.#workSessionId, publication_intent_sha256: expected,
+                status: "reserved", replayed: Boolean(prior) };
+        });
+        try {
+            this.revalidate(context);
+        }
+        catch (error) {
+            throw new AppError("memory_repair_publication_pending", "Publication intent committed but output/input custody changed before apply", 1, { effect: "committed", publication_intent_sha256: expected, cause: error instanceof Error ? error.message : String(error) });
+        }
+        return result;
+    }
+    revalidate(context) {
+        if (this.#source) {
+            this.#source.assertRegisteredCustody(context);
+            this.#source.revalidate(context);
+        }
+        else
+            this.#copy.revalidateCommittedStart(context, this.#workSessionId);
+        this.#delta.revalidate();
+    }
+}