@deksden-com/dd-flow-cli 0.9.0-beta.55 → 0.9.0-beta.62

package/CHANGELOG.md

@@ -1,5 +1,48 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.62
+
+### Patch Changes
+
+- Verify a controlled native Session with a fresh inspection after cancellation before treating its tree as settled.
+
+## 0.9.0-beta.61
+
+### Patch Changes
+
+- Keep the scope reconciliation contract test type-safe.
+
+## 0.9.0-beta.60
+
+### Patch Changes
+
+- Document and verify explicit reconciliation of a drained runtime scope without automatic observer respawn.
+
+## 0.9.0-beta.59
+
+### Patch Changes
+
+- Keep bundled ZCode close-contract fixtures aligned with retained native topology checks.
+
+## 0.9.0-beta.58
+
+### Patch Changes
+
+- Keep local task artifacts outside the release lint scope.
+
+## 0.9.0-beta.57
+
+### Patch Changes
+
+- Bound recovery observation, expose safe external reconciliation, and require
+  complete non-resident ZCode session-tree evidence before a stopped run settles.
+
+## 0.9.0-beta.56
+
+### Patch Changes
+
+- Keep RUN database and runtime status aligned with pause, stop, controller failures and trusted recovery. Preserve real Stage pauses and terminal results, reject late revival under a recovery fence, roll back status changes after persistence failures, and provide an explicit backed-up legacy status repair tool.
+
 ## 0.9.0-beta.55
 
 ### Patch Changes

package/README.md

@@ -452,3 +452,25 @@ pnpm build
 ```
 
 Manual smoke checks should use a temporary `DD_FLOW_HOME` when they do not intentionally inspect the operator's real local state.
+
+### RUN status during recovery
+
+A controller failure pauses the logical RUN without rewriting its Stage/Work
+outcomes. Accepted pause/stop or recovery intent immediately persists `paused` in the RUN row,
+`index_json`, and `run.json`. A trusted recovery acknowledgement restores the
+operational status; an existing Stage/Work pause remains paused. Terminal RUNs
+are never reopened. Physical tree settlement remains a separate control receipt.
+
+Legacy stores with a fenced recovery may still contain `running`. After building,
+inspect one exact RUN with:
+
+```sh
+node tools/repair-paused-run-status.mjs --home /path/to/dd-flow-home --project PRJ-001-project --run RUN-001-eval-subject
+```
+
+Add `--apply` to repair it. This requires the latest recovery to be draining, sealed or resuming, saves the original row and runtime JSON
+beside `run.json`, and changes no schema, engine binding or recovery capture.
+It does not claim physical settlement or alter its receipts. `--cancel-abandoned`
+explicitly cancels an abandoned fixture only when the project directory is absent
+and it has no Work, Session, controller or recovery history. Historical experiment
+engine snapshots remain pinned; rebuild/release the engine for future executions.

package/dist/build-info.json

@@ -1,15 +1,15 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.55",
-  "cli_commit": "84e76cfa798732b3121534551515b02f4a238425",
-  "built_at": "2026-09-13T19:08:39.320Z",
+  "cli_version": "0.9.0-beta.62",
+  "cli_commit": "a496c8a3b9781cd1808bd4a49fe314f0ef17c52c",
+  "built_at": "2026-09-14T08:57:06.311Z",
   "built_with_canon": {
     "version": "4.1.1",
     "commit": "97f811d33c212ae3497020178b1ed825c7c3ebac",
     "flow_contract": "dd-flow-canonical-2026-08",
-    "repo_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank",
-    "memorybank_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank/.memory-bank",
-    "flow_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank/.memory-bank/dd-flow",
+    "repo_root": "/Users/deksden/Documents/_Projects/dd-memorybank",
+    "memorybank_root": "/Users/deksden/Documents/_Projects/dd-memorybank/.memory-bank",
+    "flow_root": "/Users/deksden/Documents/_Projects/dd-memorybank/.memory-bank/dd-flow",
     "layout": "dot_memory_bank"
   }
 }

package/dist/cli/help.js

@@ -5,6 +5,7 @@ const helpPages = new Map([
   dd-flow runtime scope stop --scope-id EVAL_ID --request-id ID --json
   dd-flow runtime scope control --scope-id EVAL_ID --request-id ID --mode pause|stop [--manifest-json JSON] --json
   dd-flow runtime scope resume --scope-id EVAL_ID --request-id ID --generation N --capture-key SHA256 --json
+  dd-flow runtime scope reconcile --scope-id EVAL_ID --generation N --request-id ID --json
 
 Use the EVAL manifest's retained DD_FLOW_RESOURCE_HOME. Commands select exactly
 one scope across its registered runtime homes; neighboring scopes are untouched.
@@ -188,6 +189,7 @@ Usage:
   dd-flow id next --type protocol|run --project-root <root> --slug <slug> --json
   dd-flow run status <RUN-ID|RUN-short-id> --project-root <root> --json
   dd-flow run control status --run <RUN-ID> --project-root <root> --json
+  dd-flow run control reconcile --run <RUN-ID> --project-root <root> --control-id <ID> --request-id <ID> --json
   dd-flow run drive launch --run <RUN-ID> --project-root <root> --request-id <id> --context-file <file> --context-sha256 <sha256> [--stop-after <stage>] [--capture-root <directory>] --json
   dd-flow run drive status --run <RUN-ID> --project-root <root> [--after <sequence>] --json
   dd-flow run list --project-root <root> --json

package/dist/cli/run-cli.js

@@ -59,11 +59,11 @@ import { loadExternalStageContext } from "../services/stage-context.js";
 import { stopManagedProcess, confirmManagedProcess, finishManagedProcess, heartbeatManagedProcess, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, reconcileExpiredManagedProcesses, registerManagedProcess } from "../services/managed-processes.js";
 import { fenceRuntimeBudget, runtimeBudgetStatus, admitRuntimeCheck, parseRuntimeBudget, reserveProviderTurn, releaseProviderTurns } from "../services/runtime-budget.js";
 import { stopRuntimeScope } from "../services/runtime-scope-stop.js";
-import { launchRuntimeScopeControl, launchRuntimeScopeResume, serveRuntimeScopeControl } from "../services/runtime-scope-worker.js";
+import { launchRuntimeScopeControl, launchRuntimeScopeResume, reconcileRuntimeScopeControl, serveRuntimeScopeControl } from "../services/runtime-scope-worker.js";
 import { launchRunController, resumeRunController, serveRunController, runControllerStatus, answerRunController, supplyRunControllerContext } from "../services/run-controller.js";
 import { controllerHitlAdmission } from "../services/run-controller-adapter.js";
 import { controlLifecycleReply, runControlStatus } from "../services/run-control.js";
-import { requestRunControl, serveRunControl } from "../services/run-control-worker.js";
+import { reconcileRunControl, requestRunControl, serveRunControl } from "../services/run-control-worker.js";
 import { startRuntimeService } from "../services/runtime-service.js";
 const defaultIo = {
     stdout: process.stdout,
@@ -1142,6 +1142,11 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
             const scope = { projectRoot: requiredOption(parsed, "project-root"), runId: requiredOption(parsed, "run") };
             if (action === "status")
                 return runControlStatus(context, scope);
+            if (action === "reconcile") {
+                if ([...parsed.options.keys()].some(key => !["run", "project-root", "control-id", "request-id"].includes(key)) || [...parsed.options.values()].some(values => values.length !== 1))
+                    throw new AppError("usage", "Use run control reconcile --run ID --project-root PATH --control-id ID --request-id ID", 2);
+                return await reconcileRunControl(context, { ...scope, controlId: requiredOption(parsed, "control-id"), requestId: requiredOption(parsed, "request-id") });
+            }
             if (action === "resume") {
                 if (["force", "grace-ms", "escalate"].some(option => hasOption(parsed, option)))
                     throw new AppError("usage", "Resume does not accept stop or pause escalation options", 2);
@@ -1157,7 +1162,7 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
                     ...(hasOption(parsed, "escalate") ? { escalate: requiredOption(parsed, "escalate") } : {}),
                     ...(hasOption(parsed, "wait-ms") ? { waitMs: Number(requiredOption(parsed, "wait-ms")) } : {})
                 });
-            throw new AppError("usage", "Use: dd-flow run control pause|stop|resume|status", 2);
+            throw new AppError("usage", "Use: dd-flow run control pause|stop|resume|reconcile|status", 2);
         }
         if (command === "drive") {
             const action = requiredPosition(parsed, 0, "drive action");
@@ -1790,6 +1795,11 @@ function dispatchRun(context, command, parsed) {
 }
 async function dispatchRuntime(context, command, parsed, progress) {
     if (command === "scope") {
+        if (parsed.positional.length === 1 && parsed.positional[0] === "reconcile") {
+            if ([...parsed.options.keys()].some(key => !["scope-id", "request-id", "generation"].includes(key)) || [...parsed.options.values()].some(values => values.length !== 1))
+                throw new AppError("usage", "Use runtime scope reconcile --scope-id ID --generation N --request-id ID", 2);
+            return { ok: true, ...await reconcileRuntimeScopeControl(context, requiredOption(parsed, "scope-id"), Number(requiredOption(parsed, "generation")), requiredOption(parsed, "request-id")) };
+        }
         if (parsed.positional.length === 1 && parsed.positional[0] === "resume") {
             if ([...parsed.options.keys()].some(key => !["scope-id", "request-id", "generation", "capture-key"].includes(key)) || [...parsed.options.values()].some(values => values.length !== 1))
                 throw new AppError("usage", "Use runtime scope resume --scope-id ID --request-id ID --generation N --capture-key SHA256", 2);

package/dist/harness-runtime/lib/dd-zcode-daemon.mjs

@@ -16,6 +16,8 @@ import {
   forkSessionWithBridge,
   inspectSessionWithBridge,
   promptSessionWithBridge,
+  zcodeChildSessionIds,
+  observeClosedZcodeTree,
 } from "./dd-zcode.mjs";
 
 const REQUEST_SCHEMA = "dd-zcode/daemon-request@1";
@@ -228,7 +230,7 @@ export class DaemonRuntime {
     const known = this.sessions.get(params.sessionId);
     const adapter = params.adapterSessionId ?? known?.adapter_session_id ?? params.sessionId;
     const generation = this.activeGeneration ?? this.controlGeneration ?? 0;
-    return { ...this.state.config, ...params, adapterSessionId: adapter, daemonId: this.state.daemon_id, allowBackground: true, liveSession: this.liveAdapters.has(adapter), assertDispatch: () => { if (generation !== (this.controlGeneration ?? 0)) throw new DaemonError("operation_cancelled", "ZCode prompt was cancelled before native dispatch"); } };
+    return { ...this.state.config, ...params, knownChildSessionIds: known?.known_child_session_ids ?? [], adapterSessionId: adapter, daemonId: this.state.daemon_id, allowBackground: true, liveSession: this.liveAdapters.has(adapter), assertDispatch: () => { if (generation !== (this.controlGeneration ?? 0)) throw new DaemonError("operation_cancelled", "ZCode prompt was cancelled before native dispatch"); } };
   }
 
   track(result, topology = result?.evidence?.subagents) {
@@ -244,6 +246,7 @@ export class DaemonRuntime {
       parent_provider_session_id: parent,
       root_provider_session_id: existing?.root_provider_session_id ?? (parent ? parentRoot : result.provider_session_id),
       topology: topology ?? existing?.topology ?? null,
+      known_child_session_ids: [...new Set([...(existing?.known_child_session_ids ?? zcodeChildSessionIds(existing?.topology)), ...zcodeChildSessionIds(topology)])],
       completed_turns: existing?.completed_turns ?? 0,
       close_receipt: result.close?.closed === true ? result : existing?.close_receipt ?? null,
     }); }
@@ -321,7 +324,17 @@ export class DaemonRuntime {
       const closed = this.sessions.get(params.sessionId)?.close_receipt;
       if (closed) {
         if (operation === "session.resume") throw new DaemonError("session_closed", "Closed Session requires explicit recovery");
-        return { ...closed, read: { projection: { status: "stopped" } }, subagents: closed.after, settled: closed.settled === true };
+        const topology = closed.topology;
+        if (topology?.root_session_id !== params.sessionId || !Array.isArray(topology.child_session_ids) || topology.child_session_ids.some(id => typeof id !== "string" || !id)) return { ...closed, settled: false, observation_error: { code: "topology_incomplete", message: "closed Session has no native topology identity" } };
+        const previous = this.state.settlement_observations?.[params.sessionId];
+        const known = [...new Set([...topology.child_session_ids, ...(previous?.topology?.child_session_ids ?? [])])];
+        const observation = { ...closed, ...await observeClosedZcodeTree(this.bridge, params.sessionId, known), observed_at: new Date().toISOString() };
+        // Observations are not ownership inventory: their timestamps must not
+        // invalidate a drain fence on every read.
+        this.state.settlement_observations ??= {};
+        this.state.settlement_observations[params.sessionId] = observation;
+        await this.persist();
+        return observation;
       }
       const adapter = params.adapterSessionId ?? params.sessionId;
       if (!this.liveAdapters.has(adapter) && this.activeProductive) {
@@ -367,7 +380,8 @@ export class DaemonRuntime {
     const unsettled = [];
     for (const session of this.sessions.values()) {
       if (session.close_receipt) {
-        if (!session.close_receipt.settled) unsettled.push(session.provider_session_id);
+        const observed = await this.dispatch("session.inspect", { sessionId: session.provider_session_id });
+        if (observed.settled !== true) unsettled.push(session.provider_session_id);
         continue;
       }
       const options = this.options({ sessionId: session.provider_session_id, adapterSessionId: session.adapter_session_id });

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -199,11 +199,14 @@ export class AcpBridge {
     if (message.method === "session/update" && this.options.onLifecycleNotification) {
       const observer = this.options.onLifecycleNotification;
       const pending = Promise.resolve().then(() => observer(message)).catch(async error => {
-        if (!this.notificationError || (fatalLifecycleError(error) && !fatalLifecycleError(this.notificationError))) this.notificationError = error;
+        // A validated no-effect rejection is returned through the invocation
+        // ledger. It is evidence, not a poisoned ACP Session.
+        const fatal = fatalLifecycleError(error);
+        if (!this.notificationError || fatal) this.notificationError = error;
         // A missing/foreign authority is not a recoverable CLI validation
         // result. Stop admitting productive requests immediately; the managed
         // controller still owns physical stop/drain and evidence capture.
-        if (fatalLifecycleError(error)) this.rejectAll(error);
+        if (fatal) this.rejectAll(error);
         try {
           await this.journal.write("notification_failure", { code: error.code ?? "invocation_observation_failed", message: error.message,
             session_id: message.params?.sessionId ?? null, tool_call_id: update?.toolCallId ?? null, event_time: now(), delivery_stage: "lifecycle_receipt", completeness: "incomplete" });
@@ -429,7 +432,50 @@ export function latestAssistantText(read) {
   return null;
 }
 
-async function cancelTree(bridge, sessionId, before, providerSessionId) {
+export function zcodeChildSessionIds(snapshot) {
+  return [...new Set([
+    ...(Array.isArray(snapshot?.childSessionIds) ? snapshot.childSessionIds : []),
+    ...(Array.isArray(snapshot?.running) ? snapshot.running : []).map(child => child?.childSessionId),
+    ...(Array.isArray(snapshot?.ended?.items) ? snapshot.ended.items : []).map(child => child?.childSessionId),
+  ].filter(id => typeof id === "string" && id))];
+}
+
+// Read residency BEFORE each durable topology snapshot. An inactive node cannot
+// add descendants; a resident node never proves settlement, even when idle.
+// No resolve/read/subagents extension here: those may implicitly resume.
+export async function observeClosedZcodeTree(bridge, root, retainedChildren = []) {
+  const pending = new Set([root, ...retainedChildren]), residents = [], snapshots = [];
+  const deadline = performance.now() + 30_000;
+  try {
+    for (const sessionId of pending) {
+      if (pending.size > 1024 || performance.now() >= deadline) throw new Error("Closed tree observation limit exceeded");
+      const timeout = () => Math.max(1, Math.min(5000, deadline - performance.now()));
+      const resident = await bridge.request("zcode/session/resident", { sessionId }, timeout());
+      if (resident?.sessionId !== sessionId || typeof resident.resident !== "boolean") throw new Error("Invalid residency identity or state");
+      residents.push(resident);
+      const retained = await bridge.request("zcode/session/retainedSubagents", { sessionId }, timeout());
+      const tree = retained?.topology;
+      if (retained?.sessionId !== sessionId || !Array.isArray(tree?.childSessionIds)
+        || tree.childSessionIds.some(id => typeof id !== "string" || !id || id === sessionId)
+        || !Array.isArray(tree?.running) || !Array.isArray(tree?.ended?.items)
+        || !Number.isSafeInteger(tree.ended.total) || tree.ended.total < 0
+        || tree.ended.total > tree.childSessionIds.length
+        || [...tree.running, ...tree.ended.items].some(child => !tree.childSessionIds.includes(child?.childSessionId))) throw new Error("Incomplete retained native topology");
+      snapshots.push({ sessionId, ...tree });
+      for (const child of tree.childSessionIds) pending.add(child);
+    }
+    return { topology: { root_session_id: root, child_session_ids: [...pending].filter(id => id !== root), complete: true }, residents, snapshots, settled: residents.every(item => item.resident === false) };
+  } catch (error) {
+    return { topology: { root_session_id: root, child_session_ids: [...pending].filter(id => id !== root), complete: false }, residents, snapshots, settled: false, observation_error: { code: error.code ?? "topology_observation_failed", message: error.message } };
+  }
+}
+
+async function cancelTree(bridge, sessionId, before, providerSessionId, retainedChildren = []) {
+  const knownChildren = new Set(retainedChildren);
+  const remember = snapshot => {
+    for (const id of zcodeChildSessionIds(snapshot)) knownChildren.add(id);
+  };
+  remember(before);
   const cancellations = [];
   for (const child of before.running ?? []) {
     const taskId = child.taskId ?? child.agentId;
@@ -452,27 +498,20 @@ async function cancelTree(bridge, sessionId, before, providerSessionId) {
       bridge.request("zcode/session/read", { sessionId }, timeout).catch(error => ({ observation_error: { code: error.code, message: error.message } })),
     ]);
     root_status = read?.projection?.status ?? read?.session?.status ?? null;
+    remember(after);
     if (after.observation_error || read?.observation_error) break;
     if (Array.isArray(after.running) && !after.running.length && !(read?.projection?.activeToolCalls ?? []).length && ["idle", "completed", "cancelled", "failed", "stopped"].includes(root_status)) {
-      return { cancellations, before, after, root_status, cancellation_requested: false, settled: true, close_requested: false };
+      // Idle is only a turn-level observation. Close the owned resident before
+      // proving the transitive tree cannot create another child.
+      break;
     }
   }
   let close = null;
   try { close = await bridge.request("zcode/session/close", { sessionId }); }
   catch (error) { close = { closed: false, error: { code: error.code ?? "close_failed", message: error.message } }; }
-  const knownChildren = [...new Set([...(before.running ?? []), ...(after.running ?? [])].map(child => child.childSessionId).filter(Boolean))];
-  const residents = close?.closed === true ? await Promise.all([providerSessionId, ...knownChildren].map(async id => {
-    try {
-      const observed = await bridge.request("zcode/session/resident", { sessionId: id }, 5000);
-      if (observed.sessionId !== id) throw Object.assign(new Error("Residency evidence belongs to another Session"), { code: "session_identity_mismatch" });
-      return observed;
-    }
-    catch (error) { return { sessionId: id, observation_error: { code: error.code, message: error.message } }; }
-  })) : [];
-  const completeTopology = !before.observation_error && Array.isArray(before.running) && !after.observation_error && Array.isArray(after.running)
-    && [...(before.running ?? []), ...after.running].every(child => typeof child.childSessionId === "string");
-  return { cancellations, before, after, root_status, cancellation_requested: true, close_requested: true, close, residents,
-    settled: close?.closed === true && completeTopology && residents.length > 0 && residents.every(item => item.resident === false) };
+  const observation = close?.closed === true ? await observeClosedZcodeTree(bridge, providerSessionId, [...knownChildren])
+    : { topology: { root_session_id: providerSessionId, child_session_ids: [...knownChildren], complete: false }, settled: false };
+  return { cancellations, before, after, root_status, cancellation_requested: true, close_requested: true, close, ...observation };
 }
 
 // Cancel one known child without cancelling its parent turn.  The parent keeps
@@ -749,7 +788,7 @@ export async function cancelSessionWithBridge(bridge, options) {
   requireJournal(options);
   const identity = await controlledIdentity(bridge, options);
   const before = await bridge.request("zcode/session/subagents", { sessionId: identity.adapterSessionId }).catch(error => ({ observation_error: { code: error.code, message: error.message } }));
-  return receipt(options, { harness: "zcode-acp", provider_session_id: identity.providerSessionId, adapter_session_id: identity.adapterSessionId, ...await cancelTree(bridge, identity.adapterSessionId, before, identity.providerSessionId) });
+  return receipt(options, { harness: "zcode-acp", provider_session_id: identity.providerSessionId, adapter_session_id: identity.adapterSessionId, ...await cancelTree(bridge, identity.adapterSessionId, before, identity.providerSessionId, options.knownChildSessionIds) });
 }
 
 export async function forkSession(options) {

package/dist/services/harness-adapter.js

@@ -3,6 +3,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { AppError } from "../shared/errors.js";
+import { recoveryRpcTimeout } from "./recovery-observation-budget.js";
 const maxAdapterOutputBytes = 1_000_000;
 /** Native hooks need a real executable, not a PATH-dependent shell expression. */
 export function prepareHarnessFlowExecutable(context, stateDir) {
@@ -37,7 +38,7 @@ export function prepareHarnessFlowExecutable(context, stateDir) {
 }
 /** Runs one harness command with the lifecycle guarantees shared by agent services. */
 export function runHarnessAdapter(input) {
-    const timeoutMs = input.timeoutMs ?? 120_000;
+    const timeoutMs = recoveryRpcTimeout(input.timeoutMs ?? 120_000);
     if (!input.operationId.trim())
         throw new AppError("operation_id_required", "Harness calls require a scoped operation id", 2);
     // The current adapter transport uses this name; its identity is runtime-owned,

package/dist/services/hooks.js

@@ -9,7 +9,7 @@ import { ensureDir, resolveProjectRoot } from "../storage/paths.js";
 import { appendAudit } from "./audit.js";
 import { nativeSessionIdentity, storageSessionId } from "./session-identity.js";
 import { assertRecoveryHookCurrent } from "./run-recovery.js";
-import { observeLifecycleInvocation } from "./lifecycle-invocations.js";
+import { observeLifecycleInvocation, settleLifecycleNoEffectRejection } from "./lifecycle-invocations.js";
 import { commandHasOption, commandOption, commandPosition, shellSuffixOffset, parseLifecycleCommand, unwrapShellCommand } from "./lifecycle-command.js";
 import { registerProject, requireProjectByRoot } from "./projects.js";
 import { activeFlowSessionsForProject, bindObservedFlowSession, flowSessionPayloadFromRegisterCommand, recordFlowSessionObservation } from "./sessions.js";
@@ -433,9 +433,9 @@ export function handleZcodeEvent(context, input) {
         }) }, commandOption(parsed.invocation, "invocation-id"));
 }
 /**
- * Accept the synchronous native ZCode PreToolUse callback.  ACP notifications
- * are retained as evidence, but cannot be an admission signal: they arrive
- * after the tool call and may be serialized behind unrelated work.
+ * Accept the synchronous native ZCode PreToolUse callback. Invocation-ID
+ * commands instead rendezvous with their ACP event while the CLI awaits
+ * admission; the native hook must not create a competing receipt for them.
  */
 export function handleZcodeHook(context, input) {
     return recordZcodeLifecycle(context, input);
@@ -455,9 +455,6 @@ function recordZcodeLifecycle(context, input, invocationId) {
         return { ok: true, observed: false, reason: "event_not_participating" };
     if (!invocationId && commandOption(lifecycle.invocation, "invocation-id"))
         return { ok: true, observed: false, reason: "cli_invocation_owns_admission" };
-    if (lifecycle.analysis.kind === "compound") {
-        throw new AppError("compound_lifecycle_command", "dd-flow lifecycle commands must be a standalone ZCode Bash tool call", 1, { standalone_command: lifecycle.invocation.command });
-    }
     const expectedRoot = resolveProjectRoot(input.projectRoot);
     if (lifecycle.commandProjectRoot && resolveProjectRoot(lifecycle.commandProjectRoot) !== expectedRoot) {
         throw new AppError("project_mismatch", "ZCode lifecycle command project root does not match the controlled workspace", 1, { expected: expectedRoot, actual: lifecycle.commandProjectRoot });
@@ -477,6 +474,17 @@ function recordZcodeLifecycle(context, input, invocationId) {
     const toolUseId = stringValue(hook.tool_use_id) ?? stringValue(hook.toolUseId) ?? stringValue(hook.event_id) ?? stringValue(hook.eventId);
     if (!toolUseId)
         throw new AppError("zcode_hook_event_missing", "ZCode native hook has no tool-use ID", 1);
+    if (lifecycle.analysis.kind === "compound") {
+        if (lifecycle.analysis.reason !== "shell_composition")
+            throw new AppError("compound_lifecycle_command", "Ambiguous shell cannot authorize a lifecycle replacement", 1, { reason: lifecycle.analysis.reason });
+        if (invocationId) {
+            const error = { code: "compound_lifecycle_command", message: "dd-flow lifecycle commands must be a standalone ZCode Bash tool call", exitCode: 1,
+                details: { standalone_command: lifecycle.invocation.command } };
+            settleLifecycleNoEffectRejection(context, invocationId, lifecycle.invocation.command, error, { daemonId, rootSessionId: rootProviderSessionId, sessionId: providerSessionId, parentSessionId: parentProviderSessionId ?? null, toolCallId: toolUseId });
+            return { ok: true, observed: false, invocation_id: invocationId, no_effect: true, error };
+        }
+        throw new AppError("compound_lifecycle_command", "dd-flow lifecycle commands must be a standalone ZCode Bash tool call", 1, { standalone_command: lifecycle.invocation.command });
+    }
     const eventKey = crypto.createHash("sha256").update(JSON.stringify(["zcode-acp", daemonId, providerSessionId, toolUseId])).digest("hex");
     const rewritten = invocationId ? command : commandWithHookEvent(command, eventKey);
     if (!invocationId && rewritten === command && commandOption(lifecycle.invocation, "hook-event-id") !== eventKey)

package/dist/services/lifecycle-invocations.js

@@ -69,7 +69,7 @@ export function lifecycleRetryCommands(context, stage) {
                 return [];
             const successor = load(context, commandOption(invocation(retry), "invocation-id") ?? "");
             const latest = context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [row.scope_json, row.fingerprint]);
-            return successor.id === latest?.id && successor.status === "issued" ? [retry] : [];
+            return successor.id === latest?.id && successor.status === "issued" && (successor.deadline === null || successor.deadline > Date.now()) ? [retry] : [];
         }
         catch {
             return [];
@@ -109,6 +109,7 @@ export function managedLifecycleCommand(context, command) {
             throw new AppError("invocation_scope_mismatch", "Lifecycle attempt belongs to another managed scope", 1, { invocation_id: suppliedId });
         }
         checkCommand(retained, command);
+        assertRenderableInvocation(retained);
         return command;
     }
     if (!context.db.writable || context.env.DD_FLOW_INVOCATION_READONLY === "1") {
@@ -143,21 +144,67 @@ export function retryLifecycleInvocationCommand(context, id) {
     const prior = load(context, id);
     if (prior.status !== "executing")
         throw new AppError("invocation_retry_not_authorized", "Only the executing lifecycle operation can publish its next attempt", 1);
+    return successorLifecycleInvocationCommand(context, prior);
+}
+/** A predecessor may publish exactly one successor only while the caller has
+ * proved that no lifecycle effect was admitted.  This is shared by ordinary
+ * command validation and the native pre-execution rejection path. */
+function successorLifecycleInvocationCommand(context, prior) {
     const parsed = invocation(prior.command);
     const argv = [...parsed.argv];
     const at = argv.indexOf("--invocation-id");
-    if (at < 0 || argv[at + 1] !== id)
+    if (at < 0 || argv[at + 1] !== prior.id)
         throw new AppError("invocation_command_invalid", "Retained issued command lost its invocation marker", 1);
     // The parser proves the marker belongs to argv. Remove that one rendered
     // token from the retained text so response-file/stdin/heredoc presentation
     // remains byte-for-byte stable across a retry.
-    const marker = ` --invocation-id ${id}`;
+    const marker = ` --invocation-id ${prior.id}`;
     const markerAt = prior.command.indexOf(marker);
     if (markerAt < 0 || prior.command.indexOf(marker, markerAt + marker.length) >= 0)
         throw new AppError("invocation_command_invalid", "Retained issued command has an ambiguous invocation marker", 1);
     const command = `${prior.command.slice(0, markerAt)}${prior.command.slice(markerAt + marker.length)}`;
-    return managedLifecycleCommand({ ...context, env: { ...context.env, DD_FLOW_INVOCATION_SCOPE: prior.scope_json, DD_FLOW_CURRENT_INVOCATION: id } }, command);
+    return managedLifecycleCommand({ ...context, env: { ...context.env, DD_FLOW_INVOCATION_SCOPE: prior.scope_json, DD_FLOW_CURRENT_INVOCATION: prior.id } }, command);
+}
+/** A native observer can reject a malformed tool call before the CLI claims
+ * execution.  Persist that fact and its sole replacement atomically: waiting
+ * callers must never time out merely because the observer rejected syntax. */
+export function settleLifecycleNoEffectRejection(context, id, command, error, identity) {
+    storage(context);
+    context.db.exec("BEGIN IMMEDIATE");
+    try {
+        const prior = load(context, id);
+        checkCommand(prior, command);
+        const scope = JSON.parse(prior.scope_json);
+        checkNativeIdentity(scope, identity, id);
+        if (prior.status === "settled") {
+            context.db.exec("COMMIT");
+            return;
+        }
+        if (scope.runId)
+            assertLifecycleInvocationCurrent(context, scope, command);
+        if (prior.status !== "issued")
+            throw new AppError("invocation_rejection_conflict", "A lifecycle rejection arrived after execution admission", 1, { invocation_id: id });
+        settleUnadmittedInvocation(context, prior, error);
+        context.db.exec("COMMIT");
+    }
+    catch (error) {
+        context.db.exec("ROLLBACK");
+        throw error;
+    }
 }
+// Caller holds the write transaction and has checked authority. Issued (or
+// legacy expired) attempts have never admitted an effect; observed/executing
+// attempts must never receive an automatic replacement.
+function settleUnadmittedInvocation(context, prior, error) {
+    if (!["issued", "expired"].includes(prior.status))
+        throw new AppError("invocation_rejection_conflict", "Attempt already admitted native execution", 1);
+    const details = { ...error.details, retry_command: successorLifecycleInvocationCommand(context, prior),
+        retry_instruction: "Use retry_command as one standalone lifecycle command. The rejected command did not change lifecycle state." };
+    if (context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ? AND status = ?", [JSON.stringify({ error: { ...error, details } }), context.now(), prior.id, prior.status]).changes !== 1) {
+        throw new AppError("invocation_settlement_conflict", "Lifecycle rejection could not be committed", 1, { invocation_id: prior.id });
+    }
+}
+const receiptTimeout = (id) => ({ code: "invocation_receipt_timeout", message: "No native confirmation before the receipt deadline; lifecycle state was not changed", exitCode: 1, details: { invocation_id: id } });
 /** Settle a conclusive rejection and publish its only legal successor atomically.
  * A crash must leave either the old attempt executing, or both the settled
  * outcome and its successor; never a usable successor beside an unknown effect. */
@@ -291,7 +338,13 @@ function commandWithInvocationId(command, id) {
 /** The attempt owns authority; the caller owns presentation-only shell input.
  * Preserve current stdin/heredoc/response-file text while validating that it
  * still names the exact persisted operation and project. */
+function assertRenderableInvocation(row) {
+    if (row.status === "expired" || row.status === "issued" && row.deadline !== null && row.deadline <= Date.now()) {
+        throw new AppError("invocation_expired", "Retained lifecycle attempt has expired; inspection cannot grant a new attempt", 1, { invocation_id: row.id, status: row.status, outcome: row.outcome_json ? JSON.parse(row.outcome_json) : null });
+    }
+}
 function renderInvocationCommand(row, command) {
+    assertRenderableInvocation(row);
     const parsed = invocation(command);
     if (commandOption(parsed, "invocation-id"))
         throw new AppError("invocation_command_invalid", "Rendered lifecycle command already has an invocation id", 1);
@@ -301,6 +354,13 @@ function renderInvocationCommand(row, command) {
 }
 /** Native observer and receipt writer commit together. Never await I/O inside
  * this transaction; the callback must write to this same SQLite connection. */
+function checkNativeIdentity(scope, identity, id) {
+    if (identity.daemonId !== scope.daemonId || identity.rootSessionId !== scope.rootSessionId
+        || !identity.sessionId || !identity.toolCallId
+        || (identity.sessionId === scope.rootSessionId ? identity.parentSessionId !== null : !identity.parentSessionId)) {
+        throw new AppError("invocation_identity_mismatch", "Native identity does not belong to the issued managed scope", 1, { invocation_id: id });
+    }
+}
 export function observeLifecycleInvocation(context, input) {
     const initial = load(context, input.id);
     checkCommand(initial, input.command);
@@ -311,11 +371,7 @@ export function observeLifecycleInvocation(context, input) {
         return { eventKey: initial.event_key, duplicate: true };
     const scope = JSON.parse(initial.scope_json);
     const identity = input.identity;
-    if (identity.daemonId !== scope.daemonId || identity.rootSessionId !== scope.rootSessionId
-        || !identity.sessionId || !identity.toolCallId
-        || (identity.sessionId === scope.rootSessionId ? identity.parentSessionId !== null : !identity.parentSessionId)) {
-        throw new AppError("invocation_identity_mismatch", "Native identity does not belong to the issued managed scope", 1, { invocation_id: input.id });
-    }
+    checkNativeIdentity(scope, identity, input.id);
     const identityJson = JSON.stringify([identity.daemonId, identity.rootSessionId, identity.sessionId, identity.parentSessionId, identity.toolCallId]);
     context.db.exec("BEGIN IMMEDIATE");
     try {
@@ -325,7 +381,11 @@ export function observeLifecycleInvocation(context, input) {
             return { eventKey: row.event_key, duplicate: true };
         }
         if (row.status === "expired" || (row.deadline !== null && row.deadline <= Date.now() && !row.event_key)) {
-            throw new AppError("invocation_expired", "Late observation cannot revive an expired lifecycle attempt", 1, { invocation_id: input.id });
+            if (scope.runId)
+                assertLifecycleInvocationCurrent(context, scope, input.command);
+            settleUnadmittedInvocation(context, row, receiptTimeout(input.id));
+            context.db.exec("COMMIT");
+            return { eventKey: row.event_key, duplicate: true };
         }
         if (row.identity_json) {
             if (row.identity_json !== identityJson)
@@ -370,10 +430,20 @@ export async function awaitLifecycleInvocation(context, input) {
             continue;
         }
         if (row.status === "expired" || (row.deadline !== null && row.deadline <= Date.now())) {
-            const expired = context.db.run("UPDATE lifecycle_invocations SET status = 'expired', updated_at = ? WHERE id = ? AND status = 'issued'", [context.now(), input.id]);
-            if (!expired.changes && row.status !== "expired")
-                continue;
-            throw new AppError("invocation_receipt_timeout", "No native confirmation before the receipt deadline; lifecycle state was not changed", 1, { invocation_id: input.id });
+            context.db.exec("BEGIN IMMEDIATE");
+            try {
+                const current = load(context, input.id);
+                if (["issued", "expired"].includes(current.status)) {
+                    input.assertCurrent(JSON.parse(current.scope_json));
+                    settleUnadmittedInvocation(context, current, receiptTimeout(input.id));
+                }
+                context.db.exec("COMMIT");
+            }
+            catch (error) {
+                context.db.exec("ROLLBACK");
+                throw error;
+            }
+            continue;
         }
         await delay(Math.min(25, Math.max(1, (row.deadline ?? Date.now() + 25) - Date.now())));
     }

package/dist/services/native-session-control.js

@@ -8,15 +8,17 @@ export async function cancelControlledNativeSession(input) {
     if (input.observe && (reply.operation_id !== input.operationId || reply.operation !== "session.cancel" || reply.session_id !== input.sessionId))
         throw new AppError("controller_operation_mismatch", "Cancellation observation belongs to another operation or Session", 1);
     const result = input.observe ? reply.state === "completed" ? reply.result : null : reply;
+    // A completed cancel command is an immutable ACK, not proof that the
+    // provider tree has stopped. Callers must use a separate fresh inspection.
     if (!input.observe || reply.state === "completed")
-        assertNativeCancellationReceipt(result, input.sessionId, input.requireSettled);
+        assertNativeCancellationReceipt(result, input.sessionId);
     input.assertCurrent();
     return { status: result ? "completed" : "outcome_unknown", receipt: (result ?? reply) };
 }
-export function assertNativeCancellationReceipt(value, sessionId, requireSettled = false) {
+export function assertNativeCancellationReceipt(value, sessionId) {
     const identity = adapterSessionId(value);
-    if (!value || typeof value !== "object" || Array.isArray(value) || identity && identity !== sessionId || (requireSettled && value.settled !== true))
-        throw new AppError("controller_operation_mismatch", requireSettled ? "Cancellation receipt has no terminal settlement for its target Session" : "Cancellation receipt has no valid result for its target Session", 1);
+    if (!value || typeof value !== "object" || Array.isArray(value) || identity && identity !== sessionId)
+        throw new AppError("controller_operation_mismatch", "Cancellation receipt has no valid result for its target Session", 1);
 }
 /** Native observation is shared by RUN and non-Work EVAL owners. */
 export async function inspectControlledNativeSession(input) {