@rig-c/create 1.0.4 → 1.2.0

package/src/job-host-state.ts

@@ -0,0 +1,154 @@
+/** Retire only a replaced project's demonstrably stopped managed host. Never edit Review's store. */
+import { Database, constants as sqlite } from 'bun:sqlite';
+import { randomUUID } from 'node:crypto';
+import { lstatSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, rmdirSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { connect } from 'node:net';
+import { jobHash, jobHostStateRoot, pendingPublications, privateJson } from './job-outbox.ts';
+import { Refusal, refuse } from './refusal.ts';
+
+interface StoredRoot { path: string; dev: number; ino: number }
+interface ActiveJob { jobId: string; rootKey: string; root: StoredRoot; fingerprint: string }
+interface Host { jobId: string; fingerprint: string; pid: number; origin: string }
+const UUID = /^[a-f0-9]{8}-[a-f0-9]{4}-4[a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/;
+
+export function replacedRootRefusal(root: string, recorded?: { pid: number; origin: string }): never {
+  refuse('JOB_ROOT_REPLACED', `project.json: the retained Review host belongs to a replaced project directory at ${root}; stop the original job open host in its terminal${recorded ? ` (recorded PID ${recorded.pid}, ${recorded.origin})` : ''}, then retry rig-create job open or job reconcile. Recovery requires its recorded PID to be absent, its recorded port to refuse connections, no startup claim and no pending publication; restore missing or unsafe host metadata before retrying`);
+}
+
+function absent(path: string): boolean {
+  try { lstatSync(path); return false; }
+  catch (error) { if ((error as NodeJS.ErrnoException).code === 'ENOENT') return true; throw error; }
+}
+
+function owned(path: string, directory: boolean): void {
+  const info = lstatSync(path);
+  if (info.isSymbolicLink() || !(directory ? info.isDirectory() : info.isFile())
+    || (info.mode & 0o077) || !directory && info.nlink !== 1
+    || process.getuid && info.uid !== process.getuid() || realpathSync(path) !== path) throw Error();
+}
+
+function dead(pid: number): boolean {
+  try { process.kill(pid, 0); return false; }
+  catch (error) { return (error as NodeJS.ErrnoException).code === 'ESRCH'; }
+}
+
+/** A timeout, reset or any other network error is uncertainty, never proof of a stopped listener. */
+export function hostPortRefuses(port: number): Promise<boolean> {
+  return new Promise(resolve => {
+    const socket = connect({ host: '127.0.0.1', port });
+    const finish = (refused: boolean) => { socket.destroy(); resolve(refused); };
+    socket.setTimeout(500, () => finish(false));
+    socket.once('connect', () => finish(false));
+    socket.once('error', error => finish((error as NodeJS.ErrnoException).code === 'ECONNREFUSED'));
+  });
+}
+
+/** Caller holds acquireJobLock(root) through inspection, rename and host startup. */
+export async function recoverReplacedJobHostState(
+  root: string,
+  now?: number,
+  probe: (port: number) => Promise<boolean> = hostPortRefuses,
+): Promise<string | undefined> {
+  const state = jobHostStateRoot(root), host = join(state, 'host'), file = join(host, 'jobs.sqlite');
+  if (absent(file)) return;
+  let claim: string | undefined, archived: string | undefined;
+  let claimIdentity: { dev: number; ino: number } | undefined;
+  let recorded: Host | undefined;
+  const nonce = randomUUID();
+  try {
+    // The only private store fields consumed are the active job's identity and root identity.
+    owned(state, true); owned(host, true); owned(file, false);
+    if (['-journal', '-wal', '-shm'].some(suffix => !absent(file + suffix))) throw Error();
+    const current = lstatSync(root);
+    const rootIdentity = { path: realpathSync(root), dev: current.dev, ino: current.ino };
+    const db = new Database(file, sqlite.SQLITE_OPEN_READONLY | sqlite.SQLITE_OPEN_NOFOLLOW);
+    let jobs: ActiveJob[];
+    try {
+      jobs = db.query<{ job_id: string; root_key: string; document: string }, []>(
+        'SELECT job_id, root_key, document FROM jobs WHERE active=1',
+      ).all().map(row => {
+        const data = JSON.parse(row.document) as { root: StoredRoot; fingerprint: string };
+        return { jobId: row.job_id, rootKey: row.root_key, root: data.root, fingerprint: data.fingerprint };
+      });
+    } finally { db.close(); }
+    if (!jobs.length) return;
+    for (const job of jobs) {
+      if (!job.root || job.root.path !== rootIdentity.path || !Number.isSafeInteger(job.root.dev)
+        || job.root.dev < 0 || !Number.isSafeInteger(job.root.ino) || job.root.ino < 0) throw Error();
+    }
+    if (jobs.every(job => job.root.dev === current.dev && job.root.ino === current.ino)) return;
+    // Renaming the whole managed directory must not strand a different active incarnation.
+    if (jobs.length !== 1 || pendingPublications(root).length) throw Error();
+    const job = jobs[0]!;
+    if (!UUID.test(job.jobId) || job.fingerprint !== 'rig-create/live-review/1'
+      || job.rootKey !== jobHash(JSON.stringify([rootIdentity.path, job.fingerprint]))) throw Error();
+    const control = join(host, 'job-ui'); owned(control, true);
+    const claimNames = () => readdirSync(control).filter(name => name.endsWith('.claim') || name.endsWith('.claiming'));
+    if (claimNames().length) throw Error();
+    // Use Review's existing startup-claim protocol, so an overlapping listener cannot adopt the old job.
+    const candidate = join(control, `job-${job.jobId}.${nonce}.claiming`);
+    mkdirSync(candidate, { mode: 0o700 }); claim = candidate;
+    const installed = lstatSync(candidate); claimIdentity = { dev: installed.dev, ino: installed.ino };
+    writeFileSync(join(candidate, `owner.${nonce}.json`), JSON.stringify({ pid: process.pid, nonce }), { mode: 0o600, flag: 'wx' });
+    const target = join(control, `job-${job.jobId}.claim`);
+    if (!absent(target)) throw Error();
+    renameSync(candidate, target); claim = target;
+    const snapshot = (): { seal: string; hosts: Host[] } => {
+      owned(state, true); owned(host, true); owned(file, false); owned(control, true);
+      const currentRoot = lstatSync(root);
+      if (currentRoot.dev !== rootIdentity.dev || currentRoot.ino !== rootIdentity.ino || realpathSync(root) !== root) throw Error();
+      if (['-journal', '-wal', '-shm'].some(suffix => !absent(file + suffix))) throw Error();
+      const claims = claimNames();
+      if (claims.length !== 1 || join(control, claims[0]!) !== claim) throw Error();
+      const names = readdirSync(control).filter(name => name.endsWith('.json')).sort();
+      if (!names.includes(`${job.jobId}.json`)) throw Error();
+      const records = names.map(name => {
+        const path = join(control, name); owned(path, false);
+        const value = privateJson(path) as Host & { schema: string };
+        if (value.schema !== 'rig-review-job-host/1' || !UUID.test(value.jobId) || name !== `${value.jobId}.json`
+          || value.fingerprint !== job.fingerprint || !Number.isSafeInteger(value.pid) || value.pid <= 0
+          || !/^http:\/\/127\.0\.0\.1:([1-9][0-9]{0,4})$/.test(value.origin)
+          || Number(new URL(value.origin).port || 80) > 65535) throw Error();
+        return { path, value };
+      });
+      owned(claim!, true); owned(join(claim!, `owner.${nonce}.json`), false);
+      const paths = [root, state, host, control, file, claim!, join(claim!, `owner.${nonce}.json`), ...records.map(record => record.path)];
+      const seal = jobHash(JSON.stringify(paths.map(path => {
+        const info = lstatSync(path);
+        return [path, info.dev, info.ino, info.isFile() ? jobHash(readFileSync(path)) : null];
+      })));
+      return { seal, hosts: records.map(record => record.value) };
+    };
+    const before = snapshot();
+    recorded = before.hosts.find(record => record.jobId === job.jobId);
+    for (const record of before.hosts) {
+      if (!dead(record.pid) || !await probe(Number(new URL(record.origin).port || 80))) throw Error();
+    }
+    // No await between final identity/claim/PID recheck and rename. Keep all original state bytes.
+    if (snapshot().seal !== before.seal || before.hosts.some(record => !dead(record.pid))) throw Error();
+    const destination = `${state}.replaced-${new Date(now ?? current.mtimeMs).toISOString().replace(/[:.]/g, '-')}-${nonce}`;
+    if (!absent(destination)) throw Error();
+    renameSync(state, destination); archived = destination;
+    return destination;
+  } catch (error) {
+    if (error instanceof Refusal && error.code !== 'JOB_ROOT_REPLACED') throw error;
+    replacedRootRefusal(root, recorded);
+  } finally {
+    if (claim) {
+      const actual = archived ? join(archived, 'host', 'job-ui', claim.slice(claim.lastIndexOf('/') + 1)) : claim;
+      // This marker was created here; never remove a pre-existing Review claim or state directory.
+      try {
+        const info = lstatSync(actual);
+        if (!claimIdentity || !info.isDirectory() || info.isSymbolicLink() || info.dev !== claimIdentity.dev || info.ino !== claimIdentity.ino) throw Error();
+        const owner = join(actual, `owner.${nonce}.json`);
+        if (!absent(owner)) {
+          if (readFileSync(owner, 'utf8') !== JSON.stringify({ pid: process.pid, nonce })) throw Error();
+          rmSync(owner);
+        }
+        // rmdir refuses a competing owner's nonempty replacement.
+        rmdirSync(actual);
+      } catch { replacedRootRefusal(root, recorded); }
+    }
+  }
+}

package/src/job-host.ts

@@ -2,17 +2,19 @@ import { randomUUID } from 'node:crypto';
 import { readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
-import { startJobHost, type JobHostAttachFailure, type JobHostOptions, type JobHostReuseBinding, type JobOwnerHost, type JobReviewerBinding, type JobSelector, type JobSubject, type JobEventV3, type ActV3 } from '@rig-c/review/job-host';
+import { startJobHost, type JobHostAttachFailure, type JobHostOptions, type JobHostReuseBinding, type JobOwnerHost, type JobReviewerBinding, type JobSelector, type JobEventV3, type ActV3 } from '@rig-c/review/job-host';
 import { asArray, checkProject, collectItems, loadCollection, isObject, type Finding } from './check.ts';
 import { baselineOf, newFindings } from './refusal-baseline.ts';
 import { Refusal, refuse } from './refusal.ts';
 import { liveManifestPath, draftPublicationContext, currentJobIdentity, partsEnumerator, prepareDraftManifest, prepareLiveManifest, publicationFile, publicationSelector, readPublished, readRecordPublished } from './job-publication.ts';
-import { acknowledgePublication, acquireJobLock, assertJobIdentity, enqueuePublication, ensureJobPrivateIgnores, failPublication, JOB_BINDING_FILE, jobHash, jobHostStateRoot, pendingPublications, privateDirectory, publicationVersionHash, readAcknowledgedPublication, readWriterBinding, reconcilePublication, writePrivateJson, isRecordResult, type PublicationResult, type JobIdentity, type PendingPublication, type WriterBinding } from './job-outbox.ts';
+import { acknowledgePublication, acquireJobLock, assertJobIdentity, enqueuePublication, ensureJobPrivateIgnores, failPublication, JOB_BINDING_FILE, jobHash, jobHostStateRoot, pendingPublications, privateDirectory, publicationVersionHash, readAcknowledgedPublication, readWriterBinding, reconcilePublication, writePrivateJson, isRecordResult, type PublicationResult, type JobIdentity, type PendingPublication, type WriterBinding, type PublicationSubject } from './job-outbox.ts';
 import { draftPublicationResult } from './job-writer.ts';
 import { attachCreateJobForClose } from './job-close.ts';
 import { pendingJobActs, type PendingJobAct } from './job-acts.ts';
 import { checkReviewPackages } from './review-package.ts';
+import { reviewVerdictSignable } from './signable.ts';
 import type { JsonObject } from './templates.ts';
+import { recoverReplacedJobHostState, replacedRootRefusal } from './job-host-state.ts';
 
 function installBinding(root: string, binding: WriterBinding): void {
   ensureJobPrivateIgnores(root);
@@ -79,10 +81,23 @@ export async function openCreateJob(
     if (existing) assertJobIdentity(existing.identity, identity);
     privateDirectory(identity.stateDir);
     let writerGrant: WriterGrant | undefined;
-    const host = await startHost({
+    const start = () => startHost({
       ...options(identity, true, undefined, grant => { writerGrant = grant; }),
       ...(existing ? { port: Number(new URL(existing.origin).port) } : {}),
     });
+    let host: JobOwnerHost;
+    try {
+      host = await start();
+    } catch (error) {
+      if (typeof error !== 'object' || error === null || (error as { code?: unknown }).code !== 'JOB_ROOT_REPLACED') throw error;
+      if (identity.stateDir !== join(jobHostStateRoot(root), 'host') || !await recoverReplacedJobHostState(root, now)) replacedRootRefusal(root);
+      privateDirectory(identity.stateDir);
+      try { host = await start(); }
+      catch (retryError) {
+        if (typeof retryError === 'object' && retryError !== null && (retryError as { code?: unknown }).code === 'JOB_ROOT_REPLACED') replacedRootRefusal(root);
+        throw retryError;
+      }
+    }
     const file = join(root, 'project.json');
     const temporary = join(root, '.rig-create-job-record.tmp');
     try {
@@ -174,7 +189,7 @@ export async function publishPending(
     const currentHash = jobHash(bytes);
     if (currentHash !== entry.recordHash) { entry.recordHash = currentHash; delete entry.generation; }
     const project = JSON.parse(bytes.toString('utf8'));
-    let subjects: readonly JobSubject[];
+    let subjects: readonly PublicationSubject[];
     if (isRecordResult(entry.result)) {
       subjects = readRecordPublished({ root: entry.root, record: { path: 'project.json', sha256: entry.recordHash }, result: entry.result, phase: 'inventory' }).subjects;
     } else {
@@ -216,7 +231,7 @@ export async function publishPending(
 }
 
 /** One declared subject after the ask step: asked now, asked before on this publication, or refused by Review. */
-export type AskOutcome = { readonly subject: JobSubject; readonly status: 'asked' | 'already' } | { readonly subject: JobSubject; readonly status: 'refused'; readonly code: string };
+export type AskOutcome = { readonly subject: PublicationSubject; readonly status: 'asked' | 'already' } | { readonly subject: PublicationSubject; readonly status: 'refused'; readonly code: string };
 
 type AgentReply = { ok?: boolean; error?: { code?: string }; value?: { events?: unknown; status?: unknown; cursor?: unknown } };
 
@@ -251,10 +266,10 @@ async function* jobEvents(host: JobOwnerHost, strict = false): AsyncGenerator<Jo
 }
 
 /** The subjects already asked on this publication, from the same event reader as job acts. */
-async function askedSubjects(host: JobOwnerHost, publicationId: string): Promise<JobSubject[]> {
-  const asked: JobSubject[] = [];
+async function askedSubjects(host: JobOwnerHost, publicationId: string): Promise<PublicationSubject[]> {
+  const asked: PublicationSubject[] = [];
   for await (const event of jobEvents(host)) {
-    if (event.type === 'pending' && event.ask.publicationId === publicationId) asked.push(event.ask.subject as JobSubject);
+    if (event.type === 'pending' && event.ask.publicationId === publicationId) asked.push(event.ask.subject as PublicationSubject);
   }
   return asked;
 }
@@ -282,7 +297,7 @@ export async function listCreateJobActs(
  * publication, pending or answered, is not asked again, so a re-open never shows a second
  * control. Asks stay limited to the declared list (`REVIEW_ACT_SUBJECT_UNDECLARED`).
  */
-export async function askDeclaredSubjects(host: JobOwnerHost, publicationId: string, subjects: readonly JobSubject[]): Promise<AskOutcome[]> {
+export async function askDeclaredSubjects(host: JobOwnerHost, publicationId: string, subjects: readonly PublicationSubject[]): Promise<AskOutcome[]> {
   const before = await askedSubjects(host, publicationId);
   const outcomes: AskOutcome[] = [];
   for (const subject of subjects) {
@@ -298,7 +313,7 @@ export async function askDeclaredSubjects(host: JobOwnerHost, publicationId: str
   return outcomes;
 }
 
-export function subjectLabel(subject: JobSubject): string {
+export function subjectLabel(subject: PublicationSubject): string {
   switch (subject.kind) {
     case 'parts-verdict': return `parts-verdict ${subject.draftId}`;
     case 'checkpoint': return `checkpoint ${subject.checkpointId}`;
@@ -325,11 +340,16 @@ export function refuseAskOutcomes(outcomes: readonly AskOutcome[]): void {
   refuse('JOB_ASK_REFUSED', `project.json: the publication is acknowledged but review refused the ask for ${named}; restore the published record bytes and run rig-create job open to ask again`);
 }
 
-export async function reconcileCreateJob(root: string, publish: (entry: PendingPublication) => Promise<unknown> = publishPending): Promise<number> {
+export async function reconcileCreateJob(root: string, publish: (entry: PendingPublication) => Promise<unknown> = publishPending, now?: number): Promise<number> {
+  root = realpathSync(root);
   const release = acquireJobLock(root)!;
   let outcomes: AskOutcome[];
   let count: number;
-  try { ({ count, outcomes } = await reconcileLocked(root, publish)); }
+  try {
+    const binding = readWriterBinding(root);
+    if (!binding || binding.identity.stateDir === join(jobHostStateRoot(root), 'host')) await recoverReplacedJobHostState(root, now);
+    ({ count, outcomes } = await reconcileLocked(root, publish));
+  }
   finally { release(); }
   refuseAskOutcomes(outcomes);
   return count;
@@ -482,13 +502,16 @@ export async function openDraftPublication(root: string, host: JobOwnerHost, now
       ? headSelector
       : undefined);
   const warnings: Finding[] = [];
+  const project = JSON.parse(bytes.toString('utf8')) as JsonObject;
   const draftContext = targetSelector?.kind === 'draft'
-    ? draftPublicationContext(root, JSON.parse(bytes.toString('utf8')), targetSelector.id, warnings)
+    ? draftPublicationContext(root, project, targetSelector.id, warnings)
     : undefined;
   // Re-publish an older post head that still declares a sign-off or checkpoint:
   // either pending ask would prevent the legacy direction panel from rendering.
   const currentSubjects = draftContext?.subjects ?? (targetSelector?.kind === 'post'
-    ? [{ kind: 'review-verdict' as const, stage: 'direction-review' as const }]
+    ? (reviewVerdictSignable(project, targetSelector.version, 'direction-review')
+      ? [{ kind: 'review-verdict' as const, stage: 'direction-review' as const }]
+      : [])
     : undefined);
   const reuseHead = Boolean(head && headSelector && source?.projectHash === jobHash(bytes) && (
     targetSelector === undefined || isDeepStrictEqual(headSelector, targetSelector)

package/src/job-outbox.ts

@@ -4,7 +4,9 @@ import { existsSync, JOB_PRIVATE_DIRECTORY, lstatSync, readFileSync, readdirSync
 import { basename, dirname, join, resolve } from 'node:path';
 import { tmpdir } from 'node:os';
 import { isDeepStrictEqual } from 'node:util';
-import type { JobPublishRequest, JobReviewerBinding, JobSubject, RecordResult } from '@rig-c/review/job-host';
+import type { JobPublishRequest, JobReviewerBinding, JobSubject, RecordSubject, RecordResult } from '@rig-c/review/job-host';
+
+export type PublicationSubject = JobSubject | RecordSubject;
 import { refuse } from './refusal.ts';
 
 export const JOB_BINDING_FILE = '.rig-create-review-binding.json';
@@ -342,7 +344,7 @@ export interface AcknowledgedPublication {
   result: PendingPublication['result'];
   versionHash: string;
   /** The subjects the published context declared. Receipts written before they were retained omit it. */
-  subjects?: readonly JobSubject[];
+  subjects?: readonly PublicationSubject[];
 }
 
 function acknowledgedPath(root: string, jobId: string, publicationId: string): string {
@@ -350,7 +352,7 @@ function acknowledgedPath(root: string, jobId: string, publicationId: string): s
 }
 
 /** Persist the version identity before the pending publication is removed. */
-export function acknowledgePublication(entry: PendingPublication, publicationId: string, generation: number, requestId: string, subjects?: readonly JobSubject[]): void {
+export function acknowledgePublication(entry: PendingPublication, publicationId: string, generation: number, requestId: string, subjects?: readonly PublicationSubject[]): void {
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(publicationId) || !Number.isSafeInteger(generation) || generation < 0 || !entry.versionHash) {
     refuse('JOB_OUTBOX_INVALID', 'project.json: publication acknowledgment lacks its identity; reconcile the original pending publication');
   }

package/src/job-publication.ts

@@ -1,13 +1,13 @@
 import { checkInputs } from './inputs.ts';
 import { pngDimensions } from './scene.ts';
-import { checkpointRequired } from './plan-history.ts';
+import { hasPartsReceipt } from './fix-ledger.ts';
 import { renameSync, rmSync, writeFileSync } from 'node:fs';
 import { existsSync, lstatSync, readFileSync, realpathSync } from './check-reads.ts';
 import { dirname, join, relative, resolve } from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import { partsFileReferences } from '@rig-c/parts/src/parts.ts';
 import partsPackage from '@rig-c/parts/package.json';
-import { JOB_ACT_SCHEMA, JOB_API_SCHEMA, type JobPublicationReader, type JobPublishedContext, type JobSelector, type JobRecordSignoffStage } from '@rig-c/review/job-host';
+import { JOB_ACT_SCHEMA, JOB_API_SCHEMA, type JobPublicationReader, type JobPublishedContext, type JobSelector, type JobRecordSignoffStage, type RecordPlanSubject } from '@rig-c/review/job-host';
 import { stepHash } from './step-hash.ts';
 import { checkpointEvidenceContext, type CheckpointEvidence } from './checkpoint-evidence.ts';
 import { locateParts, PARTS_PACKAGE } from './parts-sections.ts';
@@ -24,10 +24,10 @@ import {
 import { optionContextFiles, optionFile, validateContext } from './choices.ts';
 import { hasStageOrder, interviewStageOfGuide, stageOfStep, stepCoveredByApproval } from './stages.ts';
 import { selectAnswerHashes } from './signoff-answers.ts';
-import { assertInterviewRecordSignable, packageSignSubjects, stageSignable } from './signable.ts';
-import { collectReopens, liveSignoff } from './reopen.ts';
+import { assertInterviewRecordSignable, checkpointSignable, packageSignSubjects, reviewVerdictSignable, stageSignable } from './signable.ts';
+import { collectReopens, directionReviewClosed, liveSignoff } from './reopen.ts';
 import { acceptedReviewVerdict } from './review.ts';
-import { requireRecordDirectionTarget } from './record-direction-target.ts';
+import { recordDirectionTarget, requireRecordDirectionTarget } from './record-direction-target.ts';
 import { latestPartsApproval, riggingContext } from './structure.ts';
 import { jobHash, pendingPublications, isRecordResult, type JobIdentity } from './job-outbox.ts';
 import { Refusal, refuse } from './refusal.ts';
@@ -57,8 +57,6 @@ type RecordContextBase = {
   readonly files: JobPublishedContext['files'];
 };
 type RecordSignoffStage = JobRecordSignoffStage;
-type RecordPlanSubject = { readonly kind: 'checkpoint'; readonly checkpointId: string }
-  | { readonly kind: 'signoff'; readonly stage: RecordSignoffStage };
 export type RecordOptionContext = RecordContextBase & {
   readonly plan: null;
   readonly subjects: readonly [{ readonly kind: 'interview-picks'; readonly questionId: string; readonly setId: string }];
@@ -285,7 +283,9 @@ export function readRecordPublished({ root, record, result, phase, parts: sealed
       label = `option-set ${result.questionId} / ${result.setId}`;
     } else if (result.kind === 'plan') {
       if (!plan) throw Error('the requested plan is absent');
-      if (stage === 'direction-review') {
+      const reopenDirection = stage === 'direction-review' && directionReviewClosed(project)
+        && recordDirectionTarget(project, now) === null;
+      if (stage === 'direction-review' && !reopenDirection) {
         const reopens = collectReopens(project, []);
         const post = asArray(project.versions).filter(isObject).filter(version => version.kind === 'post'
           && liveSignoff(reopens, 'post', Date.parse(String(version.at)))).at(-1);
@@ -297,7 +297,7 @@ export function readRecordPublished({ root, record, result, phase, parts: sealed
         requireRecordDirectionTarget(project, now);
       }
       const covered = steps.filter(step => stepCoveredByApproval(project, step, stage));
-      const signable = stage !== null && ['interview', 'plan-approved', 'rigging-interview', 'post-interview', 'direction-review'].includes(stage)
+      const signable = !reopenDirection && stage !== null && ['interview', 'plan-approved', 'rigging-interview', 'post-interview', 'direction-review'].includes(stage)
         && (stage !== 'interview' || interviewSignoff) && stageSignable(project, stage);
       if (signable && stage === 'direction-review' && steps.length === 0) throw Error('direction-review record sign-off needs displayed plan steps');
       const emptyPost = stage === 'post-interview' && !steps.some(step => step.phase === 'post') && postNotPassed({ items });
@@ -311,9 +311,10 @@ export function readRecordPublished({ root, record, result, phase, parts: sealed
       }
       subjects = steps.filter(step => {
         if (step.status !== 'at-checkpoint' || (step.phase !== 'rig' && step.phase !== 'post') || stageOfStep(step.phase, String(step.id)) !== stage) return false;
-        return checkpointRequired(project, step, now);
+        return checkpointSignable(project, stage, String(step.id), now);
       }).map(step => ({ kind: 'checkpoint' as const, checkpointId: String(step.id) }));
       if (signable) subjects = [...subjects, { kind: 'signoff', stage: stage as RecordSignoffStage }];
+      if (reopenDirection) subjects = [{ kind: 'reopen', stage: 'direction-review' }];
       label = `plan / ${stage}`;
     } else throw Error('unknown record result');
     // Detect record changes during closure reads as well as changes before entry.
@@ -513,9 +514,12 @@ export const readPublished: JobPublicationReader = async ({ root, record, result
   }
   const plan = project.plan as JsonObject | undefined;
   const steps = Array.isArray(plan?.steps) ? plan.steps as JsonObject[] : [];
-  const subjects: JobPublishedContext['subjects'] = [{ kind: 'review-verdict', stage: selector.kind === 'post' ? 'direction-review' : 'rig-review' },
+  const reviewStage = selector.kind === 'post' ? 'direction-review' as const : 'rig-review' as const;
+  const subjects: JobPublishedContext['subjects'] = [
+    ...(reviewVerdictSignable(project, selector.version, reviewStage) ? [{ kind: 'review-verdict' as const, stage: reviewStage }] : []),
     // The legacy direction panel accepts only the verdict on a post publication.
-    ...(selector.kind === 'post' ? [] : packageSignSubjects(project, effectiveStage(root, project), selector, steps.length))];
+    ...(selector.kind === 'post' ? [] : packageSignSubjects(project, effectiveStage(root, project), selector, steps.length)),
+  ];
   return {
     selector, plan: { steps: steps.map(step => ({ id: String(step.id), hash: stepHash(step) })) },
     parts: { enumeratorVersion: partsEnumerator.version, manifest: { path: manifestPath, sha256: jobHash(manifest) }, images },
@@ -576,7 +580,7 @@ export function draftPublishedContext(root: string, project: JsonObject, id: str
   const plan = project.plan as JsonObject | undefined;
   return { selector: { kind: 'draft', id }, plan: plan ? { steps: (plan.steps as JsonObject[] ?? []).map(step => ({ id: String(step.id), hash: stepHash(step) })) } : null,
     parts: { enumeratorVersion: partsEnumerator.version, manifest: { path: manifestPath, sha256: jobHash(manifest) }, images },
-    subjects: [{ kind: 'parts-verdict', draftId: id }],
+    subjects: hasPartsReceipt(project, id) ? [] : [{ kind: 'parts-verdict', draftId: id }],
     partIds: (JSON.parse(manifest.toString('utf8')).parts as { name: string }[]).map(part => part.name), files };
 }
 

package/src/job-runtime.ts

@@ -5,6 +5,16 @@ import { askOutcomeLines, assertRequestedDraft, assertRequestedRig, closeCreateJ
 import { failPublication, pendingPublications, reconcilePublication } from './job-outbox.ts';
 import { jobActsText } from './job-acts.ts';
 import { Refusal, refuse } from './refusal.ts';
+import { replacedRootRefusal } from './job-host-state.ts';
+
+/** Preserve this known producer refusal without printing an uncontrolled producer message. */
+export function publicationFailure(error: unknown, root: string): Refusal | undefined {
+  if (error instanceof Refusal) return error;
+  if (typeof error === 'object' && error !== null && (error as { code?: unknown }).code === 'JOB_ROOT_REPLACED') {
+    try { replacedRootRefusal(root); } catch (failure) { return failure as Refusal; }
+  }
+  return undefined;
+}
 
 async function run(): Promise<void> {
   const input = JSON.parse(readFileSync(0, 'utf8')) as { root: string; id?: string; reviewer?: string; role?: 'owner' | 'delegate'; draft?: string; rig?: string; question?: string; plan?: boolean; now: number; json?: boolean };
@@ -16,7 +26,8 @@ async function run(): Promise<void> {
       let outcomes: AskOutcome[] = [];
       try { await reconcilePublication(root, entry, async item => { outcomes = await publishPending(item); }); }
       catch (error) {
-        const failure = error instanceof Refusal ? { code: error.code, message: error.message }
+        const named = publicationFailure(error, root);
+        const failure = named ? { code: named.code, message: named.message }
           : { code: 'JOB_PUBLISH_PENDING', message: 'project.json: host publication failed; restore the bound host before rig-create job reconcile' };
         failPublication(root, entry, failure);
         throw new Refusal('JOB_PUBLISH_PENDING', 'project.json: committed publication is pending; run rig-create job reconcile');
@@ -31,7 +42,7 @@ async function run(): Promise<void> {
       console.log(input.json ? JSON.stringify(result) : jobActsText(result));
       break;
     }
-    case 'reconcile': console.log(`job: reconciled ${await reconcileCreateJob(root)} publication(s)`); break;
+    case 'reconcile': console.log(`job: reconciled ${await reconcileCreateJob(root, undefined, input.now)} publication(s)`); break;
     case 'close': await closeCreateJob(root); console.log('job: closed'); break;
     case 'open': {
       if (!input.reviewer || !input.role) refuse('JOB_BINDING_INVALID', 'project.json: job open needs --reviewer and --role owner|delegate');
@@ -64,7 +75,8 @@ async function run(): Promise<void> {
           host.stop();
           throw error;
         }
-        console.error(error instanceof Refusal ? `${error.code}: ${error.message}` : 'JOB_PUBLISH_PENDING: project.json: draft publication failed; run rig-create job reconcile');
+        const named = publicationFailure(error, root);
+        console.error(named ? `${named.code}: ${named.message}` : 'JOB_PUBLISH_PENDING: project.json: draft publication failed; run rig-create job reconcile');
         process.exitCode = 1;
       }
       if (host.reused || stopping) {
@@ -93,7 +105,8 @@ if (import.meta.main) {
   try { await run(); }
   catch (error) {
     // Unexpected errors may embed producer input. Only controlled refusals leave this process.
-    console.error(error instanceof Refusal ? `${error.code}: ${error.message}` : 'JOB_PUBLISH_PENDING: project.json: publication operation failed; run rig-create job reconcile');
+    const named = publicationFailure(error, 'the requested project directory');
+    console.error(named ? `${named.code}: ${named.message}` : 'JOB_PUBLISH_PENDING: project.json: publication operation failed; run rig-create job reconcile');
     process.exitCode = 1;
   }
 }

package/src/next.ts

@@ -32,7 +32,7 @@ import { pausedFrom } from './pause.ts';
 import { carriedRefusals, findingKey, newFindings } from './refusal-baseline.ts';
 import { refuse, USAGE_EXIT } from './refusal.ts';
 import { reopenLapseWarnings } from './reopen-lapses.ts';
-import { collectReopens, liveSignoff } from './reopen.ts';
+import { collectReopens, directionReviewClosed, liveSignoff } from './reopen.ts';
 import { acceptedReviewVerdict } from './review.ts';
 import {
   advanceOrder,
@@ -54,6 +54,7 @@ import {
 } from './stages.ts';
 import type { Json, JsonObject } from './templates.ts';
 import { sceneCurrentAt, sceneRig, SceneError } from './scene.ts';
+import { depthPlanMoves } from './rig-version.ts';
 import { resolveAgentCitationSpec } from './scene-authority.ts';
 
 export const NEXT_SCHEMA = 'rig-create/next@1';
@@ -72,7 +73,7 @@ export interface NextRefusal {
 }
 
 export interface NextReviewAct {
-  kind: 'parts-verdict' | 'interview-picks' | 'review-verdict' | 'signoff' | 'signoff-checkpoint';
+  kind: 'parts-verdict' | 'interview-picks' | 'review-verdict' | 'signoff' | 'signoff-checkpoint' | 'reopen';
   stage: string;
   draft_id?: string;
   question_id?: string;
@@ -209,7 +210,10 @@ function reviewCommands(dir: string, project: JsonObject, move: NextMove): NextM
   if (move.role !== 'human' || move.unanswered_by_record || move.field === 'pauses' || !act) return [move];
   let selector: string;
   let writer: string;
-  if (act.kind === 'interview-picks' && act.question_id) {
+  if (act.kind === 'reopen') {
+    selector = '--plan';
+    writer = `reopen ${act.stage}`;
+  } else if (act.kind === 'interview-picks' && act.question_id) {
     selector = `--question ${shellWord(act.question_id)}`;
     writer = `interview-answer ${shellWord(act.question_id)}`;
   } else if (act.kind === 'signoff' && ['interview', 'plan-approved', 'rigging-interview', 'post-interview', 'direction-review'].includes(act.stage)) {
@@ -691,18 +695,12 @@ export function nextProject(projectDirArg: string, now: number = Date.now()): Ne
       if (kind === 'post') {
         // Match the direction writer's authoring gate, including earlier
         // accepted verdicts that a later bounce does not itself reopen.
-        const reopens = collectReopens(project, []);
-        const closed = collectSignoffs(project, []).some(s => s.stage === 'direction-review'
-          && s.checkpoint === null && liveSignoff(reopens, s.stage, s.at))
-          || versions.some(v => v.kind === 'post' && asArray(v.verdicts).filter(isObject).some(d =>
-            d.review === 'direction-review' && d.verdict === 'accepted'
-            && liveSignoff(reopens, 'direction-review', Date.parse(String(d.at)))));
-        if (closed) {
+        if (directionReviewClosed(project)) {
           const target = 'reopens[stage=direction-review]';
           addAwait(target);
           moves.push({ role: 'human', field: 'reopens', awaits: target,
-            command: `rig-create reopen direction-review ${shellWord(dir)} --by '<human>' --verbatim-file '<absolute-human-words-file>' --source '<reopen-act-id>'`,
-            act: 'Until create#493, an agent may type this human reopen only from Review host raw export act@4: save its unchanged nonempty value.words byte-for-byte to an absolute verbatim-file path and name actId with --source. Empty/missing words: STOP; the agent never supplies words. Do not use job fetch-act (it rejects act@4). Create cannot ingest Review reopen acts yet.' });
+            command: null, review_act: { kind: 'reopen', stage: 'direction-review' },
+            act: 'reopen direction-review in Review, then ingest the exported reopen act before writing the replacement post' });
           continue;
         }
       }
@@ -716,7 +714,7 @@ export function nextProject(projectDirArg: string, now: number = Date.now()): Ne
         command: `rig-create ${writer} ${shellWord(dir)} ${inputs.replace(/<[^>]+>/g, shellWord)} ${refs.map(r => `--answers ${r.version}:${r.verdict}`).join(' ')}`,
         act: `build the next ${kind} version with ${writer}, recording answers_feedback ${JSON.stringify(refs)}` });
     }
-    if (moves.length > 0) return { schema: NEXT_SCHEMA, project_id: String(project.name ?? ''), stage, effective_stage: effectiveStage, accepted: false, refusals, ...warningFields, awaits: awaitsList, moves };
+    if (moves.length > 0) return { schema: NEXT_SCHEMA, project_id: String(project.name ?? ''), stage, effective_stage: effectiveStage, accepted: false, refusals, ...warningFields, awaits: awaitsList, moves: moves.flatMap(move => reviewCommands(dir, project, move)) };
   }
   const recordedLapseTargets = new Set<string>();
   const steps = asArray(isObject(project.plan) ? project.plan.steps : undefined).filter(isObject);
@@ -873,6 +871,12 @@ export function nextProject(projectDirArg: string, now: number = Date.now()): Ne
   const splitOrder = hasStageOrder(project);
   const drafts = asArray(project.drafts).filter(isObject);
   const versions = asArray(project.versions).filter(isObject);
+  if (effectiveStage === 'rigging-interview' && depthPlanMoves(project, collection).length > 0
+    && !steps.some(s => s.id === 'turn' && s.phase === 'rig')) {
+    addAwait('plan.steps[turn]');
+    moves.push({ role: 'agent', field: 'plan.steps[turn]', awaits: 'plan.steps[turn]', command: null,
+      act: 'Draft plan add turn --phase rig --rests-on turn before the rig steps, record the chosen depth route and reason in its text, with a bar that reads the producer depth reports; approve it at rigging-interview.' });
+  }
 
   if (stage === PAUSED_STAGE) {
     const resumeTarget = pausedFrom(project);
@@ -1235,6 +1239,10 @@ export function nextProject(projectDirArg: string, now: number = Date.now()): Ne
       }
     }
   } else if (effectiveStage === 'rigging' || effectiveStage === 'rig-review') {
+    if (effectiveStage === 'rigging') for (const move of depthPlanMoves(project, collection)) {
+      addAwait(move.awaits);
+      moves.push(move);
+    }
     const rigSteps = steps.filter(
       s => (s.phase === 'rig' || s.phase === 'post') && stageOfStep(s.phase, String(s.id)) === 'rigging',
     );

package/src/parts-review.ts

@@ -3,12 +3,11 @@ import { assertPartsCliArgs, assertPartsReadDraft, decodePartsRead, partsReadFin
 import { randomUUID } from 'node:crypto';
 import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { readProject } from './feedback.ts';
 import { readPartsReview, ReviewReadError, storeReviewRead, type ReviewReadRunner } from './review-read.ts';
-import { acquireBoundJobWrite, jobRuntimeExecArgv } from './job-writer.ts';
+import { acquireBoundJobWrite } from './job-writer.ts';
 import { acquireJobLock, jobHash, readAcknowledgedPublication, readWriterBinding } from './job-outbox.ts';
-import { decodeReviewAct, reviewActFindings, reviewActTransport, reviewActVerbatim } from './review-act.ts';
+import { decodeReviewAct, fetchReviewActBytes, reviewActFindings, reviewActTransport, reviewActVerbatim } from './review-act.ts';
 import { assertPartsActSource, partsActDraftHash, partsActFindings, partsActReceipt } from './parts-act.ts';
 import { newRefusals } from './refusal-baseline.ts';
 import { refuse, USAGE_EXIT } from './refusal.ts';
@@ -58,14 +57,8 @@ export function partsReviewCommand(args: string[], now: number, hooks: PartsRevi
   let committed = false;
   const temporary = join(root, `.parts-review-${randomUUID()}.tmp`);
   try {
-    const transport = { ...reviewActTransport(root, actId!), kind: 'parts-verdict' };
-    const child = Bun.spawnSync([process.execPath, ...jobRuntimeExecArgv(), fileURLToPath(new URL('./review-act-runtime.ts', import.meta.url))], {
-      stdin: Buffer.from(JSON.stringify(transport)), stdout: 'pipe', stderr: 'pipe',
-    });
-    let response: { ok: boolean; bytes: string; code: string; message: string };
-    try { response = JSON.parse(child.stdout.toString()); }
-    catch { return refuse('REVIEW_ACT_FETCH_REFUSED', 'project.json.review_acts: fetch adapter failed; restore the live Review job'); }
-    if (!response.ok || child.exitCode) refuse(response.code, response.message);
+    const transport = { ...reviewActTransport(root, actId!), kind: 'parts-verdict' as const };
+    const response = { bytes: fetchReviewActBytes(transport) };
     const act = decodeReviewAct(response.bytes, 'parts-verdict');
     if (Date.parse(act.at) > now) refuse('REVIEW_ACT_INVALID', 'project.json.review_acts: act is dated in the future; restore the clock before recording');
     const { file } = readProject(root);