@deksden-com/dd-flow-cli 0.9.0-beta.18 → 0.9.0-beta.21

package/dist/services/hooks.js

@@ -8,6 +8,7 @@ import { parseJsonObject } from "../shared/json.js";
 import { ensureDir, resolveProjectRoot } from "../storage/paths.js";
 import { appendAudit } from "./audit.js";
 import { nativeSessionIdentity, storageSessionId } from "./session-identity.js";
+import { assertRecoveryHookCurrent } from "./run-recovery.js";
 import { commandHasOption, commandOption, commandPosition, parseLifecycleCommand, unwrapShellCommand } from "./lifecycle-command.js";
 import { registerProject, requireProjectByRoot } from "./projects.js";
 import { activeFlowSessionsForProject, bindObservedFlowSession, flowSessionPayloadFromRegisterCommand, recordFlowSessionObservation } from "./sessions.js";
@@ -285,7 +286,7 @@ export function handleCodexHook(context, input) {
         return { ok: true, observed: false, reason: "event_not_participating", event: eventName };
     // Resume legitimately receives an answer through stdin. It is matched by
     // immutable lifecycle arguments below; never reject or rewrite that pipe.
-    if (lifecycle.analysis.kind === "compound") {
+    if (lifecycle.analysis.kind === "compound" && !allowsStdinLifecycleCompound(lifecycle)) {
         return {
             ok: false,
             observed: false,
@@ -299,14 +300,25 @@ export function handleCodexHook(context, input) {
             }
         };
     }
-    const { flowPayload, stageStart, stageResume, workStart, bootstrapStageStart, commandProjectRoot } = lifecycle;
+    const { flowPayload, stageStart, stageFinish, stagePause, stageResume, workStart, workFinish, workFail, bootstrapStageStart, commandProjectRoot } = lifecycle;
     const matchKey = commandProjectRoot ? lifecycleMatchKey(lifecycle, commandProjectRoot) : null;
     // A bootstrap stage is the first stateful command for a new materialized project.
     // Its PreToolUse event arrives before stage start can register that project.
     if (bootstrapStageStart && commandProjectRoot) {
         registerProject(context, { root: commandProjectRoot });
     }
-    const project = projectForHook(context, input.projectRoot ?? commandProjectRoot, stringValue(payload.cwd));
+    let project;
+    try {
+        project = projectForHook(context, input.projectRoot ?? commandProjectRoot, stringValue(payload.cwd));
+    }
+    catch (error) {
+        // A terminal command outside a registered flow gets no trusted receipt;
+        // the CLI will fail closed if it is actually executed. This keeps hooks
+        // inert for unrelated shell-parser probes and stale project directories.
+        if (stageFinish || stagePause || workFinish || workFail)
+            return { ok: true, observed: false, reason: "project_not_registered" };
+        throw error;
+    }
     if (!project)
         return { ok: true, observed: false, reason: "unrelated_cwd" };
     // Codex retains the root session_id for a thread-spawned child, while the
@@ -333,6 +345,9 @@ export function handleCodexHook(context, input) {
         harness: "codex-desktop",
         providerSessionId: providerSessionId ?? null,
         parentSessionId,
+        // Pinned by the owning app-server process, never derived from current RUN
+        // state or an agent-supplied shell command/payload.
+        daemonId: stringValue(context.env.DD_FLOW_DAEMON_ID) ?? null,
         sessionId: effectiveSessionId,
         agentId: rawChildProviderSessionId ?? null,
         turnId: turnId ?? null,
@@ -364,7 +379,7 @@ export function handleCodexHook(context, input) {
         session: providerSessionId ? nativeSessionIdentity("codex-desktop", providerSessionId) : null,
         ...(parentProviderSessionId ? { parent_session: nativeSessionIdentity("codex-desktop", parentProviderSessionId) } : {}),
         protocol_id: protocolId,
-        ...(providerSessionId && (flowPayload || stageStart || stageResume || workStart)
+        ...(providerSessionId && (flowPayload || stageStart || stageFinish || stagePause || stageResume || workStart || workFinish || workFail || lifecycle.invocation.operation === "recovery_accept")
             ? {
                 hookSpecificOutput: {
                     hookEventName: "PreToolUse",
@@ -414,7 +429,7 @@ export function handleZcodeEvent(context, input) {
     const lifecycle = lifecycleFacts(command);
     if (!lifecycle)
         return { ok: true, observed: false, reason: "event_not_participating" };
-    if (lifecycle.analysis.kind === "compound") {
+    if (lifecycle.analysis.kind === "compound" && !allowsStdinLifecycleCompound(lifecycle)) {
         throw new AppError("compound_lifecycle_command", "dd-flow lifecycle commands must be a standalone ZCode Bash tool call", 1, {
             standalone_command: lifecycle.invocation.command
         });
@@ -521,12 +536,12 @@ export function handleGrokEvent(context, input) {
     const lifecycle = lifecycleFacts(command);
     if (!lifecycle)
         return { ok: true, observed: false, reason: "event_not_participating" };
-    if (lifecycle.analysis.kind === "compound") {
+    if (lifecycle.analysis.kind === "compound" && !allowsStdinLifecycleCompound(lifecycle)) {
         throw new AppError("compound_lifecycle_command", "dd-flow lifecycle commands must be a standalone Grok Build tool call", 1, {
             standalone_command: lifecycle.invocation.command
         });
     }
-    const { flowPayload, stageStart, stageResume, workStart, bootstrapStageStart, commandProjectRoot } = lifecycle;
+    const { flowPayload, stageStart, stageFinish, stagePause, stageResume, workStart, workFinish, workFail, bootstrapStageStart, commandProjectRoot } = lifecycle;
     const expectedRoot = resolveProjectRoot(input.projectRoot);
     if (commandProjectRoot && resolveProjectRoot(commandProjectRoot) !== expectedRoot) {
         throw new AppError("project_mismatch", "Grok Build lifecycle command project root does not match the controlled workspace", 1, {
@@ -570,7 +585,7 @@ export function handleGrokEvent(context, input) {
     });
     const result = { ok: true, observed: inserted, duplicate: !inserted, event_key: eventKey, session: nativeSessionIdentity("grok-acp", providerSessionId),
         ...(isChild ? { parent_session: nativeSessionIdentity("grok-acp", stringValue(ddGrok.parentProviderSessionId) ?? rootProviderSessionId) } : {}), daemon_id: daemonId ?? null };
-    return (flowPayload || stageStart || stageResume || workStart)
+    return (flowPayload || stageStart || stageFinish || stagePause || stageResume || workStart || workFinish || workFail || lifecycle.invocation.operation === "recovery_accept")
         ? { ...result, hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput: { ...(rawInput ?? {}), command: commandWithHookEvent(command, eventKey) } } }
         : result;
 }
@@ -635,7 +650,7 @@ function handleControlledToolEvent(context, input, event, harness) {
     const lifecycle = lifecycleFacts(command);
     if (!lifecycle)
         return { ok: true, observed: false, reason: "event_not_participating" };
-    if (lifecycle.analysis.kind === "compound") {
+    if (lifecycle.analysis.kind === "compound" && !allowsStdinLifecycleCompound(lifecycle)) {
         throw new AppError("compound_lifecycle_command", `dd-flow lifecycle commands must be a standalone ${label} shell tool call`, 1, { standalone_command: lifecycle.invocation.command });
     }
     const { flowPayload, bootstrapStageStart, commandProjectRoot } = lifecycle;
@@ -747,25 +762,43 @@ function lifecycleFacts(command) {
         return null;
     const invocation = analysis.invocation;
     const stageStart = invocation.operation === "stage_start";
+    const stageFinish = invocation.operation === "stage_finish";
+    const stagePause = invocation.operation === "stage_pause";
     const stageResume = invocation.operation === "stage_resume";
     const workStart = invocation.operation === "work_start";
+    const workFinish = invocation.operation === "work_finish";
+    const workFail = invocation.operation === "work_fail";
     return {
         analysis,
         invocation,
         flowPayload: flowSessionPayloadFromRegisterCommand(invocation),
         stageStart,
+        stageFinish,
+        stagePause,
         stageResume,
-        workStart,
+        workStart, workFinish, workFail,
         bootstrapStageStart: stageStart && commandHasOption(invocation, "bootstrap"),
         commandProjectRoot: commandOption(invocation, "project-root"),
-        stageName: stageStart || stageResume ? commandOption(invocation, "stage") : undefined,
-        runId: stageStart || stageResume ? commandPosition(invocation, 0) : undefined,
-        workId: stageResume ? commandOption(invocation, "work") : workStart ? commandPosition(invocation, 0) : undefined,
+        stageName: stageStart || stageFinish || stagePause || stageResume ? commandOption(invocation, "stage") : undefined,
+        runId: stageStart || stageFinish || stagePause || stageResume ? commandPosition(invocation, 0) : undefined,
+        workId: stagePause || stageResume ? commandOption(invocation, "work") : workStart || workFinish || workFail ? commandPosition(invocation, 0) : undefined,
         contextSha256: commandOption(invocation, "context-sha256")
     };
 }
+// Worker completion and the two HITL commands intentionally take their
+// payload from stdin. Their generated pipe/heredoc is one lifecycle command,
+// not a second authority. Everything else remains standalone-only.
+function allowsStdinLifecycleCompound(facts) {
+    const operation = facts.invocation.operation;
+    return (operation === "work_finish" && commandHasOption(facts.invocation, "result-stdin"))
+        || ((operation === "stage_pause" || operation === "stage_resume") && facts.invocation.heredoc);
+}
 function lifecycleMatchKey(facts, projectRoot) {
-    const { invocation, bootstrapStageStart, stageStart, stageResume, workStart, stageName, runId, workId, contextSha256 } = facts;
+    const { invocation, bootstrapStageStart, stageStart, stageFinish, stagePause, stageResume, workStart, workFinish, workFail, stageName, runId, workId, contextSha256 } = facts;
+    if (invocation.operation === "recovery_accept") {
+        const run = commandPosition(invocation, 0), recovery = commandOption(invocation, "recovery-id");
+        return run && recovery ? recoveryAcceptMatchKey(run, recovery, projectRoot) : null;
+    }
     if (bootstrapStageStart)
         return bootstrapMatchKey({
             projectRoot,
@@ -775,12 +808,61 @@ function lifecycleMatchKey(facts, projectRoot) {
         });
     if (stageStart && runId && stageName)
         return stageStartMatchKey(runId, stageName, projectRoot, contextSha256);
+    if (stageFinish && runId && stageName)
+        return stageLifecycleMatchKey("stage_finish", runId, stageName, projectRoot);
+    if (stagePause && runId && stageName && workId)
+        return stageLifecycleMatchKey("stage_pause", runId, stageName, projectRoot, workId);
     if (stageResume && runId && stageName && workId)
         return stageResumeMatchKey(runId, stageName, workId, projectRoot);
     if (workStart && workId)
-        return workStartMatchKey(workId, projectRoot);
+        return workStartMatchKey(workId, projectRoot, commandOption(invocation, "recovery-id"));
+    if (workFinish && workId)
+        return workLifecycleMatchKey("work_finish", workId, projectRoot);
+    if (workFail && workId)
+        return workLifecycleMatchKey("work_fail", workId, projectRoot);
     return null;
 }
+export function stageLifecycleMatchKey(operation, runId, stage, projectRoot, workId) {
+    return crypto.createHash("sha256").update(JSON.stringify({ operation, run_id: runId, stage, project_root: resolveProjectRoot(projectRoot), ...(workId ? { work_id: workId } : {}) })).digest("hex");
+}
+export function recoveryAcceptMatchKey(runId, recoveryId, projectRoot) {
+    return crypto.createHash("sha256").update(JSON.stringify({ operation: "recovery_accept", run_id: runId, recovery_id: recoveryId, project_root: resolveProjectRoot(projectRoot) })).digest("hex");
+}
+export function workLifecycleMatchKey(operation, workId, projectRoot) {
+    return crypto.createHash("sha256").update(JSON.stringify({ operation, work_id: workId, project_root: resolveProjectRoot(projectRoot) })).digest("hex");
+}
+/** Claims a Work terminal command only after its exact hook receipt has proved
+ * the physical Session that issued it. Work code performs the owner check. */
+export function claimWorkLifecycleHookEvent(context, input) {
+    const matchKey = workLifecycleMatchKey(input.operation, input.workId, input.projectRoot);
+    const eventKey = input.eventKey ?? findRecentMatchingHookEvent(context, {
+        projectId: input.projectId, matchKey, errorCode: "trusted_session_binding_required", operation: input.operation.replace("_", " ")
+    }).eventKey;
+    const event = context.db.get("SELECT id, session_id, match_key, status FROM hook_events WHERE project_id = ? AND event_key = ?", [input.projectId, eventKey]);
+    if (!event?.session_id || event.status !== "observed" || event.match_key !== matchKey) {
+        throw new AppError("trusted_session_binding_required", `${input.operation.replace("_", " ")} requires one fresh matching PreToolUse hook event`, 1, { work_id: input.workId, event_key: eventKey });
+    }
+    const claimed = context.db.run("UPDATE hook_events SET status = 'claimed', claimed_at = ? WHERE id = ? AND status = 'observed'", [context.now(), event.id]);
+    if (claimed.changes !== 1)
+        throw new AppError("trusted_session_binding_required", "matching Work lifecycle hook event was already claimed", 1, { work_id: input.workId });
+    return hookSessionIdentity(context, input.projectId, eventKey);
+}
+/** Claims a lifecycle command only after its exact hook receipt has proved the
+ * physical Session that issued it. Stage code performs the Work-owner check. */
+export function claimStageLifecycleHookEvent(context, input) {
+    const matchKey = stageLifecycleMatchKey(input.operation, input.runId, input.stage, input.projectRoot, input.workId);
+    const eventKey = input.eventKey ?? findRecentMatchingHookEvent(context, {
+        projectId: input.projectId, matchKey, errorCode: "trusted_session_binding_required", operation: input.operation.replace("_", " ")
+    }).eventKey;
+    const event = context.db.get("SELECT id, session_id, match_key, status FROM hook_events WHERE project_id = ? AND event_key = ?", [input.projectId, eventKey]);
+    if (!event?.session_id || event.status !== "observed" || event.match_key !== matchKey) {
+        throw new AppError("trusted_session_binding_required", `${input.operation.replace("_", " ")} requires one fresh matching PreToolUse hook event`, 1, { run_id: input.runId, stage: input.stage, event_key: eventKey });
+    }
+    const claimed = context.db.run("UPDATE hook_events SET status = 'claimed', claimed_at = ? WHERE id = ? AND status = 'observed'", [context.now(), event.id]);
+    if (claimed.changes !== 1)
+        throw new AppError("trusted_session_binding_required", "matching lifecycle hook event was already claimed", 1, { run_id: input.runId, stage: input.stage });
+    return hookSessionIdentity(context, input.projectId, eventKey);
+}
 /** Trusted session identity is created by PreToolUse, never supplied by an agent. */
 export function sessionIdForHookEvent(context, projectId, eventKey) {
     const event = context.db.get("SELECT session_id FROM hook_events WHERE project_id = ? AND event_key = ?", [projectId, eventKey]);
@@ -869,7 +951,7 @@ export function bootstrapMatchKey(input) {
     })).digest("hex");
 }
 export function claimWorkStartHookEvent(context, input) {
-    const expected = new Set([workStartMatchKey(input.workId, input.projectRoot), workStartMatchKey(shortWorkReference(input.workId), input.projectRoot)]);
+    const expected = new Set([workStartMatchKey(input.workId, input.projectRoot, input.recoveryId), workStartMatchKey(shortWorkReference(input.workId), input.projectRoot, input.recoveryId)]);
     const event = context.db.get("SELECT id, session_id, agent_id, turn_id, transcript_path, model, agent_type, match_key, status FROM hook_events WHERE project_id = ? AND event_key = ?", [input.projectId, input.eventKey]);
     if (!event?.session_id || event.status !== "observed" || !event.match_key || !expected.has(event.match_key)) {
         throw new AppError("trusted_work_launch_required", "work start requires one fresh matching PreToolUse event", 1, { work_id: input.workId, event_key: input.eventKey });
@@ -887,7 +969,9 @@ export function assertStageStartHookEvent(context, input) {
     if (!event?.session_id || event.status !== "observed" || event.match_key !== expected) {
         throw new AppError("trusted_stage_launch_required", "stage start requires one fresh matching PreToolUse event", 1, { run_id: input.runId, stage: input.stage, event_key: input.eventKey, expected_match_key: expected, observed_match_key: event?.match_key ?? null, observed_status: event?.status ?? null });
     }
-    return hookSessionIdentity(context, input.projectId, input.eventKey);
+    const identity = hookSessionIdentity(context, input.projectId, input.eventKey);
+    assertRecoveryHookCurrent(context, input.projectId, input.runId, identity);
+    return identity;
 }
 export function claimStageStartHookEvent(context, input) {
     assertStageStartHookEvent(context, input);
@@ -925,16 +1009,19 @@ export function claimStageResumeHookEvent(context, input) {
     if (!event?.event_key || !event.session_id || event.match_key !== matchKey || event.status !== "observed") {
         throw new AppError("trusted_stage_resume_required", "stage resume requires one fresh matching PreToolUse event", 1, { run_id: input.runId, stage: input.stage, work_id: input.workId });
     }
+    const identity = hookSessionIdentity(context, input.projectId, event.event_key);
+    assertRecoveryHookCurrent(context, input.projectId, input.runId, identity);
     const claimed = context.db.run("UPDATE hook_events SET status = 'claimed', claimed_at = ? WHERE id = ? AND status = 'observed'", [context.now(), event.id]);
     if (claimed.changes !== 1)
         throw new AppError("trusted_stage_resume_required", "matching stage-resume hook event was already claimed", 1, { run_id: input.runId, stage: input.stage });
-    return hookSessionIdentity(context, input.projectId, event.event_key);
+    return identity;
 }
-export function workStartMatchKey(workId, projectRoot) {
+export function workStartMatchKey(workId, projectRoot, recoveryId) {
     return crypto.createHash("sha256").update(JSON.stringify({
         operation: "work_start",
         work_id: workId,
-        project_root: resolveProjectRoot(projectRoot)
+        project_root: resolveProjectRoot(projectRoot),
+        ...(recoveryId ? { recovery_id: recoveryId } : {})
     })).digest("hex");
 }
 export function hookStatusForProject(context, projectId) {

package/dist/services/lifecycle-command.js

@@ -138,7 +138,7 @@ function invocationFromSegment(segment, heredoc, wrapped, inheritedEnv) {
         executable,
         argv,
         env,
-        args: parseCommandArgs(argv.slice(2)),
+        args: parseCommandArgs(argv.slice(operation === "recovery_accept" ? 3 : 2)),
         command: quote(segment.words),
         rewriteSafe: !heredoc && !wrapped && !segment.dynamic,
         wrapped,
@@ -170,15 +170,25 @@ function wrappedInvocationFromSegment(segment) {
     return parseLifecycleCommandInner(payload, true);
 }
 function lifecycleOperation(argv) {
+    if (argv[0] === "run" && argv[1] === "recovery" && argv[2] === "accept")
+        return "recovery_accept";
     const key = `${argv[0] ?? ""} ${argv[1] ?? ""}`;
     if (key === "session register")
         return "session_register";
     if (key === "stage start")
         return "stage_start";
+    if (key === "stage finish")
+        return "stage_finish";
+    if (key === "stage pause")
+        return "stage_pause";
     if (key === "stage resume")
         return "stage_resume";
     if (key === "work start")
         return "work_start";
+    if (key === "work finish")
+        return "work_finish";
+    if (key === "work fail")
+        return "work_fail";
     return null;
 }
 export function parseCommandArgs(argv) {

package/dist/services/merge-server.js

@@ -6,6 +6,7 @@ import { flowCommand } from "./stage-pause.js";
 import { validateSchema } from "./schema-validation.js";
 import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
 import { harnessRuntimeArguments, resolveHarnessCommand } from "./harness-config.js";
+import { assertRunMutationAllowed, recoveryGuard } from "./run-recovery.js";
 /** A deterministic dispatcher; only the launched harness Session performs agent work. */
 export async function serveMergeRequests(context, input) {
     const running = context.db.get("SELECT server_id, pid FROM merge_servers WHERE status IN ('running','stopping') ORDER BY started_at LIMIT 1");
@@ -59,12 +60,23 @@ export function mergeServerStatus(context) { return { ok: true, servers: context
 export function stopMergeServer(context, input) { const changed = context.db.run("UPDATE merge_servers SET status = 'stopping', heartbeat_at = ? WHERE server_id = ? AND status = 'running'", [context.now(), input.serverId]); if (changed.changes !== 1)
     throw new AppError("not_found", "Running merge-server was not found", 1, { server_id: input.serverId }); return { ok: true, server_id: input.serverId, status: "stopping" }; }
 async function dispatch(context, input) {
+    let generation;
+    context.db.exec("BEGIN IMMEDIATE");
     const token = crypto.randomUUID();
     const leaseUntil = new Date(Date.now() + 120_000).toISOString();
-    const claimed = context.db.run("UPDATE merge_requests SET status = 'dispatching', dispatch_owner = ?, dispatch_lease_token = ?, dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'queued' AND execution_route = 'server'", [input.serverId, token, leaseUntil, context.now(), input.request.merge_request_id]);
-    if (claimed.changes !== 1)
-        return;
-    const leaseHeartbeat = setInterval(() => { const now = context.now(); context.db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'dispatching' AND dispatch_owner = ? AND dispatch_lease_token = ?", [new Date(Date.now() + 120_000).toISOString(), now, input.request.merge_request_id, input.serverId, token]); }, 30_000);
+    try {
+        generation = assertRunMutationAllowed(context, input.request.project_id, input.request.run_id);
+        const claimed = context.db.run("UPDATE merge_requests SET status = 'dispatching', dispatch_owner = ?, dispatch_lease_token = ?, dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'queued' AND execution_route = 'server'", [input.serverId, token, leaseUntil, context.now(), input.request.merge_request_id]);
+        context.db.exec("COMMIT");
+        if (claimed.changes !== 1)
+            return;
+    }
+    catch (error) {
+        context.db.exec("ROLLBACK");
+        throw error;
+    }
+    const leaseHeartbeat = setInterval(() => { if (guarded(context, input.request) || (recoveryGuard(context, input.request.project_id, input.request.run_id)?.generation ?? 0) !== generation)
+        return; const now = context.now(); context.db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'dispatching' AND dispatch_owner = ? AND dispatch_lease_token = ?", [new Date(Date.now() + 120_000).toISOString(), now, input.request.merge_request_id, input.serverId, token]); }, 30_000);
     leaseHeartbeat.unref();
     const stateDir = path.join(input.root, input.request.merge_request_id);
     fs.mkdirSync(stateDir, { recursive: true });
@@ -77,13 +89,14 @@ async function dispatch(context, input) {
     const executable = resolveHarnessCommand(context.ddFlowHome, input.profile.harness, "adapter");
     const common = ["--state-dir", stateDir, "--journal", adapterJournal, "--cwd", input.request.target_workspace, "--provider", input.profile.provider, "--model", input.profile.model, "--reasoning", input.profile.reasoning, "--mode", input.profile.mode, "--permission", input.profile.permission, "--project-root", input.request.target_workspace, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, input.profile.harness), "--json"];
     try {
-        const adapterCall = (args, timeoutMs, progressMessage) => runHarnessAdapter({ executable, args, env: context.env, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), ...(progressMessage ? { progressMessage } : {}), onEvidence: (value) => event(input.journal, { type: "adapter_call", ...value }) });
+        const adapterCall = (args, timeoutMs, progressMessage) => { assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation); return runHarnessAdapter({ executable, args, env: context.env, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), ...(progressMessage ? { progressMessage } : {}), onEvidence: (value) => event(input.journal, { type: "adapter_call", ...value }) }); };
         await adapterCall(["daemon", "start", ...common]);
         const created = await adapterCall(["session", "create", ...common]);
         const sessionId = adapterSessionId(created);
         if (!sessionId)
             throw new AppError("merge_adapter_invalid", "Harness adapter did not return a Session id", 1, { harness: input.profile.harness, response: created });
         const prompted = await adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} is still running`);
+        assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation);
         const request = context.db.get("SELECT status FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id]);
         context.db.run("UPDATE merge_requests SET adapter_receipt_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ profile: input.profile, executable, session_id: sessionId, response: prompted }), context.now(), input.request.merge_request_id]);
         event(input.journal, { type: "adapter_settled", request_id: input.request.merge_request_id, session_id: sessionId, request_status: request?.status ?? null, at: context.now() });
@@ -91,6 +104,10 @@ async function dispatch(context, input) {
             context.db.run("UPDATE merge_requests SET status = 'queued', dispatch_owner = NULL, dispatch_lease_token = NULL, dispatch_lease_expires_at = NULL, last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_did_not_start_stage", response: prompted }), context.now(), input.request.merge_request_id]);
     }
     catch (error) {
+        if (error instanceof AppError && ["run_recovery_guarded", "run_recovery_generation_stale"].includes(error.code)) {
+            event(input.journal, { type: "recovery_dispatch_blocked", request_id: input.request.merge_request_id, code: error.code, at: context.now() });
+            throw error;
+        }
         const request = context.db.get("SELECT status FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id]);
         if (request?.status === "dispatching")
             context.db.run("UPDATE merge_requests SET status = 'queued', dispatch_owner = NULL, dispatch_lease_token = NULL, dispatch_lease_expires_at = NULL, last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_launch_failed", error: String(error) }), context.now(), input.request.merge_request_id]);
@@ -102,9 +119,11 @@ async function dispatch(context, input) {
         clearInterval(leaseHeartbeat);
     }
 }
-function nextServerRequests(context, limit) { const selected = new Set(); return context.db.all("SELECT merge_request_id, project_id, run_id, executor_work_id, target_workspace, execution_route, status, created_at FROM merge_requests WHERE status = 'queued' AND execution_route = 'server' ORDER BY created_at, merge_request_id").filter((request) => { if (selected.has(request.project_id) || context.db.get("SELECT 1 FROM merge_requests WHERE project_id = ? AND status NOT IN ('completed','failed','cancelled','superseded') AND (created_at < ? OR (created_at = ? AND merge_request_id < ?)) LIMIT 1", [request.project_id, request.created_at, request.created_at, request.merge_request_id]))
+function nextServerRequests(context, limit) { const selected = new Set(); return context.db.all("SELECT merge_request_id, project_id, run_id, executor_work_id, target_workspace, execution_route, status, created_at FROM merge_requests WHERE status = 'queued' AND execution_route = 'server' ORDER BY created_at, merge_request_id").filter((request) => { if (guarded(context, request) || selected.has(request.project_id) || context.db.get("SELECT 1 FROM merge_requests WHERE project_id = ? AND status NOT IN ('completed','failed','cancelled','superseded') AND (created_at < ? OR (created_at = ? AND merge_request_id < ?)) LIMIT 1", [request.project_id, request.created_at, request.created_at, request.merge_request_id]))
     return false; selected.add(request.project_id); return true; }).slice(0, limit); }
-function reconcileExpiredDispatches(context) { const expired = context.db.all("SELECT merge_request_id, executor_work_id FROM merge_requests WHERE status = 'dispatching' AND dispatch_lease_expires_at < ?", [context.now()]); for (const request of expired) {
+function reconcileExpiredDispatches(context) { const expired = context.db.all("SELECT merge_request_id, executor_work_id, project_id, run_id FROM merge_requests WHERE status = 'dispatching' AND dispatch_lease_expires_at < ?", [context.now()]); for (const request of expired) {
+    if (guarded(context, request))
+        continue;
     const work = context.db.get("SELECT status FROM works WHERE work_id = ?", [request.executor_work_id]);
     if (work?.status === "created")
         context.db.run("UPDATE merge_requests SET status = 'queued', dispatch_owner = NULL, dispatch_lease_token = NULL, dispatch_lease_expires_at = NULL, last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "expired_dispatch_requeued" }), context.now(), request.merge_request_id]);
@@ -119,6 +138,7 @@ catch (error) {
 } validateSchema({ schemaName: "agent-profile", file }); if (value.id !== id)
     throw new AppError("agent_profile_invalid", "Agent profile id does not match its requested filename", 2, { file, expected: id, actual: value.id ?? null }); return value; }
 function event(file, value) { fs.appendFileSync(file, `${JSON.stringify(value)}\n`); }
+function guarded(context, request) { const guard = recoveryGuard(context, request.project_id, request.run_id); return Boolean(guard && ["draining", "sealed", "resuming"].includes(guard.status)); }
 function delay(ms) { return new Promise((resolve) => setTimeout(resolve, ms)); }
 function processAlive(pid) { if (!pid)
     return false; try {