agentxchain 2.129.0 → 2.130.1

package/src/commands/reject-turn.js

@@ -153,8 +153,21 @@ function buildRejectionValidation(root, state, config, opts) {
       [resolution.turn.turn_id]: resolution.turn,
     },
   };
+  const stagingPath = resolveStagingPath(root, resolution.turn.turn_id);
+  // BUG-22: If resolveStagingPath returns null, a stale result from another turn
+  // was detected. Reject with a clear diagnostic instead of consuming it.
+  if (stagingPath === null) {
+    return {
+      ok: true,
+      turn: resolution.turn,
+      validationResult: {
+        errors: [`Stale staging data: .agentxchain/staging/turn-result.json belongs to a different turn. Clean up with: rm .agentxchain/staging/turn-result.json`],
+        failed_stage: 'stale_staging',
+      },
+    };
+  }
   const validation = validateStagedTurnResult(root, projectedState, config, {
-    stagingPath: resolveStagingPath(root, resolution.turn.turn_id),
+    stagingPath,
   });
   if (!validation.ok) {
     return {
@@ -213,8 +226,29 @@ function resolveTargetTurn(state, turnId) {
 }
 
 function resolveStagingPath(root, turnId) {
+  // BUG-22: Prefer turn-scoped staging path. Only fall back to legacy global
+  // staging if the global result's turn_id matches the active turn.
   const turnScopedPath = getTurnStagingResultPath(turnId);
-  return existsSync(join(root, turnScopedPath)) ? turnScopedPath : '.agentxchain/staging/turn-result.json';
+  if (existsSync(join(root, turnScopedPath))) {
+    return turnScopedPath;
+  }
+
+  const legacyPath = '.agentxchain/staging/turn-result.json';
+  const legacyAbs = join(root, legacyPath);
+  if (existsSync(legacyAbs)) {
+    try {
+      const raw = JSON.parse(require('fs').readFileSync(legacyAbs, 'utf8'));
+      if (raw.turn_id && raw.turn_id !== turnId) {
+        // Stale result from a different turn — do not consume
+        return null;
+      }
+    } catch {
+      // Parse error — let the validator handle it
+    }
+    return legacyPath;
+  }
+
+  return legacyPath; // File doesn't exist — validator will report "not found"
 }
 
 function printDispatchBundleWarnings(bundleResult) {

package/src/commands/restart.js

@@ -19,10 +19,15 @@ import {
   getActiveTurns,
   getActiveTurnCount,
   reactivateGovernedRun,
+  detectStateBundleDesync,
   STATE_PATH,
   HISTORY_PATH,
   LEDGER_PATH,
 } from '../lib/governed-state.js';
+import { writeDispatchBundle } from '../lib/dispatch-bundle.js';
+import { getDispatchTurnDir } from '../lib/turn-paths.js';
+import { consumeNextApprovedIntent } from '../lib/intake.js';
+import { loadProjectState } from '../lib/config.js';
 import { deriveRecoveryDescriptor } from '../lib/blocked-state.js';
 import { deriveRecommendedContinuityAction } from '../lib/continuity-status.js';
 import { readSessionCheckpoint, writeSessionCheckpoint, captureBaselineRef, SESSION_PATH } from '../lib/session-checkpoint.js';
@@ -213,6 +218,25 @@ export async function restartCommand(opts) {
     process.exit(1);
   }
 
+  // ── BUG-18: State/bundle integrity check ─────────────────────────────────
+  const desync = detectStateBundleDesync(root, state);
+  if (!desync.ok) {
+    console.log(chalk.red('State/bundle integrity failure detected:'));
+    for (const entry of desync.desynced) {
+      console.log(chalk.red(`  Active turn ${entry.turn_id} (${entry.role}) has no dispatch bundle at ${entry.expected_path}`));
+    }
+    console.log('');
+    console.log(chalk.dim('This is a ghost turn — state references an active turn but the dispatch files are missing.'));
+    console.log(chalk.dim('Recovery options:'));
+    for (const entry of desync.desynced) {
+      console.log(`  ${chalk.cyan(`agentxchain reissue-turn --turn ${entry.turn_id} --reason "missing dispatch bundle"`)}`);
+    }
+    console.log(`  ${chalk.cyan('agentxchain reject-turn --reason "ghost turn — missing dispatch bundle"')}`);
+    console.log('');
+    console.log(chalk.dim('Run `agentxchain doctor` for a full diagnostic.'));
+    process.exit(1);
+  }
+
   // ── Repo-drift detection ────────────────────────────────────────────────
   const driftWarnings = [];
   if (checkpoint?.baseline_ref) {
@@ -316,21 +340,61 @@ export async function restartCommand(opts) {
 
   // Assign next turn if no active turn exists
   if (activeTurnCount === 0) {
-    const assignment = assignGovernedTurn(root, config, roleId);
-    if (!assignment.ok) {
-      console.log(chalk.red(`Failed to assign turn: ${assignment.error}`));
-      process.exit(1);
+    // BUG-21 fix: consume approved intents (same as resume path) so intent_id
+    // propagates into turn metadata and all lifecycle events.
+    const consumed = consumeNextApprovedIntent(root, { role: roleId });
+    let assignedState;
+    let turnId;
+    let assignedRole = roleId;
+
+    if (consumed.ok) {
+      // Intake path handled the turn assignment with intakeContext
+      assignedState = loadProjectState(root, config);
+      if (!assignedState) {
+        console.log(chalk.red('Failed to reload governed state after intake binding.'));
+        process.exit(1);
+      }
+      turnId = consumed.turn_id;
+      assignedRole = consumed.role || roleId;
+      console.log(chalk.green(`Bound approved intent to next turn: ${consumed.intentId}`));
+    } else {
+      // No approved intents — plain assignment
+      const assignment = assignGovernedTurn(root, config, roleId);
+      if (!assignment.ok) {
+        console.log(chalk.red(`Failed to assign turn: ${assignment.error}`));
+        process.exit(1);
+      }
+      for (const warning of assignment.warnings || []) {
+        console.log(chalk.yellow(`Warning: ${warning}`));
+      }
+      assignedState = assignment.state;
+      turnId = assignment.turn?.turn_id || assignment.turn?.id;
+      assignedRole = assignment.turn?.assigned_role || roleId;
     }
-    for (const warning of assignment.warnings || []) {
-      console.log(chalk.yellow(`Warning: ${warning}`));
+
+    // BUG-17 fix: write dispatch bundle AFTER state assignment succeeds.
+    // The bundle must exist on disk before we report success, otherwise the
+    // operator sees a "ghost turn" in state with no dispatch directory.
+    if (turnId) {
+      const bundleResult = writeDispatchBundle(root, assignedState, config, { turnId });
+      if (!bundleResult.ok) {
+        console.log(chalk.red(`Turn assigned but dispatch bundle write failed: ${bundleResult.error}`));
+        console.log(chalk.dim('The turn is assigned in state but has no dispatch context.'));
+        console.log(chalk.dim('Run `agentxchain reissue-turn` to reissue with a fresh bundle.'));
+        process.exit(1);
+      }
+      for (const bw of bundleResult.warnings || []) {
+        console.log(chalk.yellow(`Dispatch bundle warning: ${bw}`));
+      }
     }
 
     // assignGovernedTurn already writes a checkpoint at turn_assigned
 
     console.log(chalk.green(`✓ Restarted run ${state.run_id}`));
     console.log(chalk.dim(`  Phase: ${phase}`));
-    console.log(chalk.dim(`  Turn: ${assignment.turn?.id || 'assigned'}`));
-    console.log(chalk.dim(`  Role: ${assignment.turn?.role || roleId || 'routing default'}`));
+    console.log(chalk.dim(`  Turn: ${turnId || 'assigned'}`));
+    console.log(chalk.dim(`  Role: ${assignedRole || 'routing default'}`));
+    console.log(chalk.dim(`  Dispatch: ${getDispatchTurnDir(turnId || 'unknown')}/`));
     if (checkpoint) {
       console.log(chalk.dim(`  Last checkpoint: ${checkpoint.checkpoint_reason} at ${checkpoint.last_checkpoint_at}`));
     }

package/src/commands/run.js

@@ -48,6 +48,7 @@ import { resolveChainOptions, executeChainedRun } from '../lib/run-chain.js';
 import { resolveContinuousOptions, executeContinuousRun } from '../lib/continuous-run.js';
 import { createDispatchProgressTracker } from '../lib/dispatch-progress.js';
 import { emitRunEvent } from '../lib/run-events.js';
+import { checkpointAcceptedTurn } from '../lib/turn-checkpoint.js';
 
 export async function runCommand(opts) {
   const context = loadProjectContext();
@@ -148,6 +149,7 @@ export async function executeGovernedRun(context, opts = {}) {
 
   const maxTurns = opts.maxTurns || 50;
   const autoApprove = !!opts.autoApprove;
+  const autoCheckpoint = opts.autoCheckpoint === true;
   const verbose = !!opts.verbose;
   const overrideResolution = opts.role
     ? resolveGovernedRole({ override: opts.role, state: null, config })
@@ -499,6 +501,17 @@ export async function executeGovernedRun(context, opts = {}) {
       return approved;
     },
 
+    async afterAccept({ turn }) {
+      if (!autoCheckpoint) {
+        return { ok: true };
+      }
+      const checkpoint = checkpointAcceptedTurn(root, { turnId: turn.turn_id });
+      if (!checkpoint.ok) {
+        return { ok: false, error: checkpoint.error || `checkpoint failed for ${turn.turn_id}` };
+      }
+      return { ok: true };
+    },
+
     onEvent(event) {
       switch (event.type) {
         case 'turn_assigned':

package/src/commands/status.js

@@ -8,7 +8,7 @@ import {
   deriveRecoveryDescriptor,
   deriveRuntimeBlockedGuidance,
 } from '../lib/blocked-state.js';
-import { getActiveTurn, getActiveTurnCount, getActiveTurns, detectActiveTurnBindingDrift } from '../lib/governed-state.js';
+import { getActiveTurn, getActiveTurnCount, getActiveTurns, detectActiveTurnBindingDrift, detectStateBundleDesync } from '../lib/governed-state.js';
 import { getContinuityStatus } from '../lib/continuity-status.js';
 import { getConnectorHealth } from '../lib/connector-health.js';
 import { readRepoDecisions, summarizeRepoDecisions } from '../lib/repo-decisions.js';
@@ -182,6 +182,7 @@ function renderGovernedStatus(context, opts) {
       workflow_kit_artifacts: workflowKitArtifacts,
       dashboard_session: dashboardSessionObj,
       binding_drift: detectActiveTurnBindingDrift(state, config),
+      bundle_integrity: detectStateBundleDesync(root, state),
     }, null, 2));
     return;
   }
@@ -284,6 +285,17 @@ function renderGovernedStatus(context, opts) {
   renderConnectorHealthStatus(connectorHealth);
   renderRecentEventSummary(recentEventSummary);
 
+  // BUG-18: State/bundle integrity check
+  const desync = detectStateBundleDesync(root, state);
+  if (!desync.ok) {
+    console.log(chalk.red.bold('  ⚠ Ghost turn(s) detected — dispatch bundle missing'));
+    for (const entry of desync.desynced) {
+      console.log(chalk.red(`    ${entry.turn_id} (${entry.role}): ${entry.expected_path} not found`));
+    }
+    console.log(chalk.dim('  Run `agentxchain reissue-turn` to recover, or `agentxchain doctor` for diagnostics.'));
+    console.log('');
+  }
+
   const activeTurnCount = getActiveTurnCount(state);
   const singleActiveTurn = getActiveTurn(state);
   const approvalPending = Boolean(state?.pending_phase_transition || state?.pending_run_completion);

package/src/lib/connector-probe.js

@@ -1,10 +1,9 @@
-import { execFileSync } from 'node:child_process';
-
 import {
   buildProviderHeaders,
   buildProviderRequest,
   PROVIDER_ENDPOINTS,
 } from './adapters/api-proxy-adapter.js';
+import { probeRuntimeSpawnContext } from './runtime-spawn-context.js';
 
 const PROBEABLE_RUNTIME_TYPES = new Set(['local_cli', 'api_proxy', 'mcp', 'remote_agent']);
 const DEFAULT_TIMEOUT_MS = 8_000;
@@ -35,8 +34,8 @@ const KNOWN_CLI_AUTHORITY_FLAGS = [
  * Maps binary name to expected transport.
  */
 const KNOWN_CLI_TRANSPORTS = {
-  claude: 'stdin',
-  codex: 'argv',
+  claude: ['stdin'],
+  codex: ['argv', 'stdin'],
 };
 
 function formatCommand(command, args = []) {
@@ -78,11 +77,6 @@ function commandHead(runtime) {
   return null;
 }
 
-function resolveBinary(command) {
-  const resolver = process.platform === 'win32' ? 'where' : 'which';
-  execFileSync(resolver, [command], { stdio: 'ignore' });
-}
-
 function resolveProviderEndpoint(runtime) {
   if (typeof runtime?.base_url === 'string' && runtime.base_url.trim()) {
     return runtime.base_url.trim();
@@ -153,7 +147,7 @@ async function probeHttp({ url, method = 'GET', headers = {}, body, timeoutMs })
   }
 }
 
-async function probeLocalCommand(runtimeId, runtime, probeKindLabel) {
+async function probeLocalCommand(runtimeId, runtime, probeKindLabel, options = {}) {
   const head = commandHead(runtime);
   const base = {
     runtime_id: runtimeId,
@@ -170,22 +164,22 @@ async function probeLocalCommand(runtimeId, runtime, probeKindLabel) {
     };
   }
 
-  try {
-    resolveBinary(head);
+  const spawnProbe = probeRuntimeSpawnContext(options.root || process.cwd(), runtime, { runtimeId });
+  if (spawnProbe.ok) {
     return {
       ...base,
       level: 'pass',
-      command: head,
-      detail: `${head} is available on PATH`,
-    };
-  } catch {
-    return {
-      ...base,
-      level: 'fail',
-      command: head,
-      detail: `${head} was not found on PATH`,
+      command: spawnProbe.command || head,
+      detail: spawnProbe.detail,
     };
   }
+
+  return {
+    ...base,
+    level: 'fail',
+    command: spawnProbe.command || head,
+    detail: spawnProbe.detail,
+  };
 }
 
 async function probeApiProxy(runtimeId, runtime, timeoutMs) {
@@ -331,6 +325,27 @@ function analyzeLocalCliAuthorityIntent(runtimeId, runtime, roles) {
   if (boundRoles.length === 0) return { warnings };
 
   const authoritativeRoles = boundRoles.filter((r) => r.write_authority === 'authoritative');
+  const isCodex = binaryName === 'codex' || binaryName.endsWith('/codex');
+
+  if (isCodex) {
+    if (commandTokens[1] !== 'exec') {
+      warnings.push({
+        probe_kind: 'command_intent',
+        level: 'warn',
+        detail: 'OpenAI Codex CLI governed local runs should use the non-interactive "exec" subcommand. Top-level "codex" is the interactive entrypoint.',
+        fix: 'Use ["codex", "exec", "--dangerously-bypass-approvals-and-sandbox", "{prompt}"]',
+      });
+    }
+
+    if (commandTokens.includes('--quiet')) {
+      warnings.push({
+        probe_kind: 'command_intent',
+        level: 'warn',
+        detail: 'OpenAI Codex CLI rejects "--quiet" in governed local_cli commands on the current CLI. The command exits before the turn starts.',
+        fix: 'Remove "--quiet" and use ["codex", "exec", "--dangerously-bypass-approvals-and-sandbox", "{prompt}"]',
+      });
+    }
+  }
 
   // Check known CLI authority flags
   const knownCli = KNOWN_CLI_AUTHORITY_FLAGS.find((entry) => binaryName === entry.binary || binaryName.endsWith(`/${entry.binary}`));
@@ -359,7 +374,7 @@ function analyzeLocalCliAuthorityIntent(runtimeId, runtime, roles) {
 
   // Prompt transport validation
   const transport = runtime.prompt_transport || 'dispatch_bundle_only';
-  const knownTransport = KNOWN_CLI_TRANSPORTS[binaryName];
+  const knownTransports = KNOWN_CLI_TRANSPORTS[binaryName];
 
   if (transport === 'argv' && !commandTokens.some((token) => token.includes('{prompt}'))) {
     warnings.push({
@@ -370,13 +385,13 @@ function analyzeLocalCliAuthorityIntent(runtimeId, runtime, roles) {
     });
   }
 
-  if (knownTransport && transport !== knownTransport && transport !== 'dispatch_bundle_only') {
+  if (knownTransports && !knownTransports.includes(transport) && transport !== 'dispatch_bundle_only') {
     const transportLabel = knownCli ? knownCli.label : binaryName;
     warnings.push({
       probe_kind: 'transport_intent',
       level: 'warn',
-      detail: `${transportLabel} typically uses "${knownTransport}" transport, but this runtime is configured with "${transport}"`,
-      fix: `Set prompt_transport to "${knownTransport}" or "dispatch_bundle_only"`,
+      detail: `${transportLabel} typically uses ${knownTransports.map((value) => `"${value}"`).join(' or ')} transport, but this runtime is configured with "${transport}"`,
+      fix: `Set prompt_transport to ${knownTransports.map((value) => `"${value}"`).join(' or ')} or "dispatch_bundle_only"`,
     });
   }
 
@@ -414,7 +429,7 @@ export async function probeConnectorRuntime(runtimeId, runtime, options = {}) {
   }
 
   if (runtime.type === 'local_cli') {
-    const result = await probeLocalCommand(runtimeId, runtime, 'command_presence');
+    const result = await probeLocalCommand(runtimeId, runtime, 'command_presence', options);
     // Add authority-intent and transport analysis when roles are available
     if (roles) {
       const { warnings } = analyzeLocalCliAuthorityIntent(runtimeId, runtime, roles);
@@ -437,7 +452,7 @@ export async function probeConnectorRuntime(runtimeId, runtime, options = {}) {
     if (runtime.transport === 'streamable_http') {
       return probeHttpRuntime(runtimeId, runtime, timeoutMs);
     }
-    return probeLocalCommand(runtimeId, runtime, 'command_presence');
+    return probeLocalCommand(runtimeId, runtime, 'command_presence', options);
   }
 
   return probeHttpRuntime(runtimeId, runtime, timeoutMs);

package/src/lib/connector-validate.js

@@ -22,6 +22,7 @@ import { dispatchMcp } from './adapters/mcp-adapter.js';
 import { dispatchRemoteAgent } from './adapters/remote-agent-adapter.js';
 import { getDispatchPromptPath, getTurnStagingResultPath } from './turn-paths.js';
 import { validateStagedTurnResult } from './turn-result-validator.js';
+import { probeRuntimeSpawnContext } from './runtime-spawn-context.js';
 
 const VALIDATABLE_RUNTIME_TYPES = new Set(['local_cli', 'api_proxy', 'mcp', 'remote_agent']);
 const DEFAULT_VALIDATE_TIMEOUT_MS = 120_000;
@@ -130,6 +131,26 @@ export async function validateConfiguredConnector(sourceRoot, options = {}) {
       };
     }
 
+    if (runtime.type === 'local_cli' || (runtime.type === 'mcp' && (runtime.transport || 'stdio') !== 'streamable_http')) {
+      const spawnProbe = probeRuntimeSpawnContext(scratchRoot, scratchContext.config.runtimes[runtimeId], { runtimeId });
+      if (!spawnProbe.ok) {
+        return {
+          ok: false,
+          exitCode: 1,
+          overall: 'fail',
+          runtime_id: runtimeId,
+          runtime_type: runtime.type,
+          role_id: roleSelection.roleId,
+          timeout_ms: timeoutMs,
+          warnings,
+          dispatch: null,
+          validation: null,
+          error: spawnProbe.detail,
+          scratch_root: scratchRoot,
+        };
+      }
+    }
+
     const initResult = initializeGovernedRun(scratchRoot, scratchContext.config, {
       provenance: {
         trigger: 'connector_validate',

package/src/lib/continuous-run.js

@@ -239,6 +239,7 @@ export function resolveContinuousOptions(opts, config) {
     triageApproval: opts.triageApproval ?? configCont.triage_approval ?? 'auto',
     cooldownSeconds: opts.cooldownSeconds ?? configCont.cooldown_seconds ?? 5,
     perSessionMaxUsd: opts.sessionBudget ?? configCont.per_session_max_usd ?? null,
+    autoCheckpoint: opts.autoCheckpoint ?? configCont.auto_checkpoint ?? true,
   };
 }
 
@@ -307,7 +308,12 @@ export async function advanceContinuousRunOnce(context, session, contOpts, execu
 
     let execution;
     try {
-      execution = await executeGovernedRun(context, { autoApprove: true, report: true, log });
+      execution = await executeGovernedRun(context, {
+        autoApprove: true,
+        autoCheckpoint: contOpts.autoCheckpoint,
+        report: true,
+        log,
+      });
     } catch (err) {
       session.status = 'failed';
       writeContinuousSession(root, session);
@@ -413,6 +419,7 @@ export async function advanceContinuousRunOnce(context, session, contOpts, execu
   try {
     execution = await executeGovernedRun(context, {
       autoApprove: true,
+      autoCheckpoint: contOpts.autoCheckpoint,
       report: true,
       log,
     });

package/src/lib/coordinator-dispatch.js

@@ -213,6 +213,31 @@ export function selectNextAssignment(workspacePath, state, config) {
   return firstFailure || { ok: false, reason: 'no_assignable_workstream', detail: 'No workstream is assignable in the current phase' };
 }
 
+export function selectAssignmentForWorkstream(workspacePath, state, config, workstreamId) {
+  const workstream = config.workstreams?.[workstreamId];
+  if (!workstream) {
+    return {
+      ok: false,
+      reason: 'workstream_missing',
+      detail: `Unknown workstream "${workstreamId}"`,
+      workstream_id: workstreamId,
+    };
+  }
+
+  if (workstream.phase !== state.phase) {
+    return {
+      ok: false,
+      reason: 'phase_mismatch',
+      detail: `Workstream "${workstreamId}" is in phase "${workstream.phase}", but coordinator is currently in phase "${state.phase}"`,
+      workstream_id: workstreamId,
+    };
+  }
+
+  const history = readCoordinatorHistory(workspacePath);
+  const barriers = readBarriers(workspacePath);
+  return evaluateWorkstream(workspacePath, state, config, workstreamId, history, barriers);
+}
+
 export function dispatchCoordinatorTurn(workspacePath, state, config, assignment) {
   if (!assignment?.ok) {
     return { ok: false, error: 'Assignment is required before dispatch' };

package/src/lib/governed-state.js

@@ -62,6 +62,7 @@ import {
   summarizeVerificationReplay,
 } from './verification-replay.js';
 import { executeGateActions } from './gate-actions.js';
+import { detectPendingCheckpoint } from './turn-checkpoint.js';
 
 // ── Constants ────────────────────────────────────────────────────────────────
 
@@ -405,6 +406,32 @@ export function getActiveTurn(state) {
   return turns.length === 1 ? turns[0] : null;
 }
 
+/**
+ * BUG-18: Detect state/bundle desync — every active turn referenced in
+ * state.json must have a corresponding dispatch bundle directory on disk.
+ *
+ * @param {string} root - project root
+ * @param {object} state - governed state
+ * @returns {{ ok: boolean, desynced: Array<{ turn_id: string, role: string, expected_path: string }> }}
+ */
+export function detectStateBundleDesync(root, state) {
+  const activeTurns = getActiveTurns(state);
+  const desynced = [];
+
+  for (const [turnId, turn] of Object.entries(activeTurns)) {
+    const bundleDir = join(root, '.agentxchain', 'dispatch', 'turns', turnId);
+    if (!existsSync(bundleDir)) {
+      desynced.push({
+        turn_id: turnId,
+        role: turn.assigned_role || 'unknown',
+        expected_path: `.agentxchain/dispatch/turns/${turnId}`,
+      });
+    }
+  }
+
+  return { ok: desynced.length === 0, desynced };
+}
+
 function resolveRecoveryTurnId(state, preferredTurnId = null) {
   const activeTurns = getActiveTurns(state);
   if (preferredTurnId && activeTurns[preferredTurnId]) {
@@ -2163,6 +2190,10 @@ export function assignGovernedTurn(root, config, roleId, options = {}) {
   const writeAuthority = role.write_authority || 'review_only';
   const cleanCheck = checkCleanBaseline(root, writeAuthority);
   if (!cleanCheck.clean) {
+    const pendingCheckpoint = detectPendingCheckpoint(root, cleanCheck.dirty_files || []);
+    if (pendingCheckpoint.required) {
+      return { ok: false, error: pendingCheckpoint.message, error_code: 'checkpoint_required' };
+    }
     return { ok: false, error: cleanCheck.reason };
   }
 
@@ -2457,7 +2488,8 @@ export function reissueTurn(root, config, opts = {}) {
   const oldRuntimeId = oldTurn.runtime_id;
 
   // Resolve current runtime binding (may have changed in config)
-  const currentRuntimeId = role.runtime;
+  // BUG-25 fix: normalized config uses runtime_id, raw config uses runtime
+  const currentRuntimeId = role.runtime_id || role.runtime;
   const currentRuntime = config.runtimes?.[currentRuntimeId];
   if (!currentRuntime) {
     return { ok: false, error: `Runtime "${currentRuntimeId}" not found in config for role "${roleId}"` };
@@ -2754,7 +2786,25 @@ function _acceptGovernedTurnLocked(root, config, opts) {
   }
 
   const turnStagingPath = getTurnStagingResultPath(currentTurn.turn_id);
-  const resolvedStagingPath = existsSync(join(root, turnStagingPath)) ? turnStagingPath : STAGING_PATH;
+  let resolvedStagingPath = existsSync(join(root, turnStagingPath)) ? turnStagingPath : STAGING_PATH;
+  // BUG-22: verify legacy staging file belongs to the active turn before consuming
+  if (resolvedStagingPath === STAGING_PATH) {
+    try {
+      const legacyAbs = join(root, STAGING_PATH);
+      if (existsSync(legacyAbs)) {
+        const raw = JSON.parse(readFileSync(legacyAbs, 'utf8'));
+        if (raw.turn_id && raw.turn_id !== currentTurn.turn_id) {
+          return {
+            ok: false,
+            error: `Stale staging data: ${STAGING_PATH} contains turn_id "${raw.turn_id}" but active turn is "${currentTurn.turn_id}". Remove the stale file or use the turn-scoped staging path.`,
+            error_code: 'stale_staging',
+          };
+        }
+      }
+    } catch {
+      // Parse error handled by downstream validation
+    }
+  }
   const stagedTurn = loadHookStagedTurn(root, resolvedStagingPath);
   const validationState = attachLegacyCurrentTurnAlias({
     ...state,
@@ -3838,6 +3888,106 @@ function _acceptGovernedTurnLocked(root, config, opts) {
     }
   }
 
+  // ── BUG-19: Post-acceptance gate reconciliation ────────────────────────
+  // If a previous gate failure is cached in last_gate_failure, re-evaluate
+  // whether the conditions are now satisfied after this turn's artifacts.
+  // This prevents stale gate failures from surviving after a turn fixes them.
+  // Only clear if ALL failure conditions are now resolved.
+  if (updatedState.last_gate_failure && updatedState.status !== 'completed' && updatedState.status !== 'blocked') {
+    const staleGate = updatedState.last_gate_failure;
+    let allConditionsResolved = true;
+
+    // Check if missing_files are now present
+    if (Array.isArray(staleGate.missing_files) && staleGate.missing_files.length > 0) {
+      const stillMissing = staleGate.missing_files.filter(f => !existsSync(join(root, f)));
+      if (stillMissing.length > 0) {
+        allConditionsResolved = false;
+      }
+    }
+
+    // Check if missing_verification is still an issue
+    // Verification failures can only be resolved by the specific gate re-evaluation
+    // during a phase_transition_request, not by post-acceptance reconciliation,
+    // because verification is turn-specific — the prior turn's verification status
+    // is what the gate evaluated, and a different turn's pass doesn't retroactively
+    // fix the prior turn's failure.
+    if (staleGate.missing_verification) {
+      allConditionsResolved = false;
+    }
+
+    // Only clear if there were resolvable conditions and they are all resolved
+    const hadResolvableConditions = Array.isArray(staleGate.missing_files) && staleGate.missing_files.length > 0;
+    if (allConditionsResolved && hadResolvableConditions) {
+      updatedState.last_gate_failure = null;
+      if (staleGate.gate_id) {
+        updatedState.phase_gate_status = {
+          ...(updatedState.phase_gate_status || {}),
+          [staleGate.gate_id]: 'cleared_by_reconciliation',
+        };
+      }
+      ledgerEntries.push({
+        type: 'gate_reconciliation',
+        gate_id: staleGate.gate_id,
+        gate_type: staleGate.gate_type,
+        phase: updatedState.phase,
+        reason: 'post_acceptance_reconciliation',
+        previously_missing_files: staleGate.missing_files || [],
+        reconciled_at: now,
+        reconciled_by_turn: currentTurn.turn_id,
+      });
+    }
+  }
+
+  // ── BUG-20: Post-acceptance intent satisfaction ─────────────────────────
+  // When a turn bound to an injected intent is accepted successfully, transition
+  // the intent to 'completed' so it disappears from the pending queue.
+  if (currentTurn.intake_context?.intent_id) {
+    const intentId = currentTurn.intake_context.intent_id;
+    try {
+      const intentPath = join(root, '.agentxchain', 'intake', 'intents', `${intentId}.json`);
+      if (existsSync(intentPath)) {
+        const intent = JSON.parse(readFileSync(intentPath, 'utf8'));
+        if (intent.status === 'executing') {
+          intent.status = 'completed';
+          intent.completed_at = now;
+          intent.run_completed_at = updatedState.completed_at || now;
+          intent.run_final_turn = currentTurn.turn_id;
+          intent.updated_at = now;
+          intent.satisfying_turn = currentTurn.turn_id;
+          if (!Array.isArray(intent.history)) intent.history = [];
+          intent.history.push({
+            from: 'executing',
+            to: 'completed',
+            at: now,
+            turn_id: currentTurn.turn_id,
+            role: currentTurn.assigned_role,
+            run_id: updatedState.run_id,
+            reason: 'turn accepted — acceptance contract satisfied',
+          });
+          writeFileSync(intentPath, JSON.stringify(intent, null, 2));
+
+          // Create observation scaffold (same as resolve path)
+          const obsDir = join(root, '.agentxchain', 'intake', 'observations', intentId);
+          mkdirSync(obsDir, { recursive: true });
+
+          // Emit intent_satisfied event
+          emitRunEvent(root, 'intent_satisfied', {
+            run_id: updatedState.run_id,
+            phase: updatedState.phase,
+            status: updatedState.status,
+            turn: { turn_id: currentTurn.turn_id, role_id: currentTurn.assigned_role },
+            intent_id: intentId,
+            payload: {
+              satisfying_turn: currentTurn.turn_id,
+            },
+          });
+        }
+      }
+    } catch {
+      // Non-fatal — intent satisfaction is advisory
+    }
+  }
+
   // ── Transaction journal: prepare before committing writes ──────────────
   const transactionId = generateId('txn');
   const journal = {