owlrunkit 0.15.0 → 0.16.0

package/scripts/runkit-contract/install-codex-skill.mjs

@@ -8,7 +8,6 @@ import {
   mkdtemp,
   readFile,
   readdir,
-  realpath,
   rename,
   rm,
   writeFile,
@@ -18,10 +17,11 @@ import { pathToFileURL } from "node:url";
 
 import {
   initializeProjectRunKit,
-  inspectProjectUpgradeSafety,
   isDirectExecution,
   validateProjectConfigV2,
 } from "./core-contract.mjs";
+import { discoverFleet } from "./fleet-discovery.mjs";
+import { inspectProjectControlState } from "./project-control-state.mjs";
 
 const MANIFEST_FILE = ".owlcoda-install-manifest.json";
 
@@ -193,21 +193,39 @@ export async function inspectInstalledSkill({ targetRoot } = {}) {
   };
 }
 
-async function inspectFleetForSkillChange(workspaceRoots) {
-  if (!Array.isArray(workspaceRoots) || workspaceRoots.length === 0) {
-    throw new Error("skill_update_fleet_preflight_required");
-  }
-  const roots = [];
-  for (const workspaceRoot of workspaceRoots) {
-    if (typeof workspaceRoot !== "string" || workspaceRoot.length === 0) {
-      throw new Error("skill_update_fleet_workspace_invalid");
+export async function inspectFleetForSkillChange({
+  workspaceRoots = null,
+  fleetManifestPath = null,
+  fleetRoots = null,
+  fleetRegistryPath = null,
+} = {}) {
+  let discovery;
+  try {
+    discovery = await discoverFleet({
+      workspaceRoots,
+      fleetManifestPath,
+      fleetRoots,
+      fleetRegistryPath,
+    });
+  } catch (error) {
+    if (
+      workspaceRoots === null
+      && fleetManifestPath === null
+      && fleetRoots === null
+      && error?.message === "fleet_registry_missing"
+    ) {
+      throw new Error("skill_update_fleet_registry_missing");
     }
-    roots.push(await realpath(workspaceRoot));
+    throw error;
+  }
+  if (!discovery.complete) {
+    throw new Error(
+      `skill_update_fleet_discovery_incomplete:${discovery.unreachableRoots.join(",")}`,
+    );
   }
-  const fleet = [...new Set(roots)].sort();
   const projects = [];
-  for (const workspaceRoot of fleet) {
-    const safety = inspectProjectUpgradeSafety({ workspaceRoot });
+  for (const workspaceRoot of discovery.workspaceRoots) {
+    const safety = inspectProjectControlState({ workspaceRoot }).upgradeSafety;
     if (safety.status !== "safe") {
       const blockers = [
         ...safety.activeRunIds,
@@ -266,6 +284,9 @@ export async function installCodexSkill({
   archiveRoot,
   expectedUnmanagedManifestSha256 = null,
   workspaceRoots = null,
+  fleetManifestPath = null,
+  fleetRoots = null,
+  fleetRegistryPath = null,
 } = {}) {
   if (typeof repositoryRoot !== "string" || typeof targetRoot !== "string" || typeof archiveRoot !== "string") {
     throw new Error("repositoryRoot, targetRoot, and archiveRoot are required");
@@ -300,7 +321,12 @@ export async function installCodexSkill({
       }
       return { status: "unchanged", manifestSha256: desired.manifestSha256, previousInstallation: null };
     }
-    const projects = await inspectFleetForSkillChange(workspaceRoots);
+    const projects = await inspectFleetForSkillChange({
+      workspaceRoots,
+      fleetManifestPath,
+      fleetRoots,
+      fleetRegistryPath,
+    });
     await mkdir(archiveRoot, { recursive: true });
     const archivePath = await nextAvailablePath(
       archiveRoot,
@@ -438,7 +464,7 @@ export async function restoreCodexSkill({
     throw new Error("skill_rollback_prior_identity_mismatch");
   }
   const workspaceRoots = receipt.projects.map((project) => project.workspaceRoot);
-  const currentProjects = await inspectFleetForSkillChange(workspaceRoots);
+  const currentProjects = await inspectFleetForSkillChange({ workspaceRoots });
   const receiptProjectByRoot = new Map(
     receipt.projects.map((project) => [project.workspaceRoot, project]),
   );
@@ -516,17 +542,22 @@ export async function recoverCodexSkillForActiveFleet({
   targetRoot,
   archiveRoot,
   archivedInstallationPath,
-  workspaceRoots,
+  workspaceRoots = null,
+  fleetManifestPath = null,
+  fleetRoots = null,
 } = {}) {
   if (
     typeof targetRoot !== "string"
     || typeof archiveRoot !== "string"
     || typeof archivedInstallationPath !== "string"
-    || !Array.isArray(workspaceRoots)
-    || workspaceRoots.length === 0
+    || (
+      (!Array.isArray(workspaceRoots) || workspaceRoots.length === 0)
+      && (typeof fleetManifestPath !== "string" || fleetManifestPath.length === 0)
+      && (!Array.isArray(fleetRoots) || fleetRoots.length === 0)
+    )
   ) {
     throw new Error(
-      "targetRoot, archiveRoot, archivedInstallationPath, and workspaceRoots are required",
+      "targetRoot, archiveRoot, archivedInstallationPath, and a fleet source are required",
     );
   }
   const resolvedTarget = path.resolve(targetRoot);
@@ -553,14 +584,19 @@ export async function recoverCodexSkillForActiveFleet({
   if (!archivedCore || typeof archivedCore.coreManifestSha256 !== "string") {
     throw new Error("skill_recovery_archived_core_identity_missing");
   }
-  const fleetRoots = [];
-  for (const workspaceRoot of workspaceRoots) {
-    fleetRoots.push(await realpath(workspaceRoot));
+  const discovery = await discoverFleet({
+    workspaceRoots,
+    fleetManifestPath,
+    fleetRoots,
+  });
+  if (!discovery.complete) {
+    throw new Error(
+      `skill_recovery_fleet_discovery_incomplete:${discovery.unreachableRoots.join(",")}`,
+    );
   }
-  const fleet = [...new Set(fleetRoots)].sort();
   const projects = [];
   let activeRunCount = 0;
-  for (const workspaceRoot of fleet) {
+  for (const workspaceRoot of discovery.workspaceRoots) {
     const configPath = path.join(
       workspaceRoot,
       ".owlcoda/runkit/config.json",
@@ -572,7 +608,10 @@ export async function recoverCodexSkillForActiveFleet({
         `skill_recovery_config_core_mismatch:${workspaceRoot}`,
       );
     }
-    const safety = inspectProjectUpgradeSafety({ workspaceRoot });
+    const safety = inspectProjectControlState({
+      workspaceRoot,
+      currentCore: archivedCore,
+    }).upgradeSafety;
     if (safety.issues.length > 0) {
       throw new Error(
         `skill_recovery_control_state_invalid:${workspaceRoot}:${safety.issues.join(",")}`,
@@ -665,9 +704,9 @@ function parseOptions(values) {
     const value = values[index + 1];
     if (!flag?.startsWith("--") || value === undefined) throw new Error("Options must be --name value pairs");
     const name = flag.slice(2);
-    if (name === "workspace") {
-      options.workspace ??= [];
-      options.workspace.push(value);
+    if (name === "workspace" || name === "fleet-root") {
+      options[name] ??= [];
+      options[name].push(value);
     } else {
       options[name] = value;
     }
@@ -686,6 +725,8 @@ export async function runCli(argv = process.argv.slice(2)) {
         archiveRoot: options.archive,
         expectedUnmanagedManifestSha256: options["expected-unmanaged"] ?? null,
         workspaceRoots: options.workspace ?? null,
+        fleetManifestPath: options["fleet-manifest"] ?? null,
+        fleetRoots: options["fleet-root"] ?? null,
       });
       return { exitCode: 0, ...output };
     }
@@ -706,7 +747,9 @@ export async function runCli(argv = process.argv.slice(2)) {
         targetRoot: options.target,
         archiveRoot: options.archive,
         archivedInstallationPath: options["archived-installation"],
-        workspaceRoots: options.workspace,
+        workspaceRoots: options.workspace ?? null,
+        fleetManifestPath: options["fleet-manifest"] ?? null,
+        fleetRoots: options["fleet-root"] ?? null,
       });
       return { exitCode: 0, ...output };
     }

package/scripts/runkit-contract/lease-lifecycle.mjs

@@ -196,9 +196,15 @@ function acquireControlLock(workspaceRoot) {
 export function withControlTransaction(workspaceRoot, operation) {
   const release = acquireControlLock(workspaceRoot);
   try {
-    return operation();
-  } finally {
+    const result = operation();
+    if (result && typeof result.then === "function") {
+      return Promise.resolve(result).finally(release);
+    }
+    release();
+    return result;
+  } catch (error) {
     release();
+    throw error;
   }
 }
 

package/scripts/runkit-contract/lifecycle-orchestration.mjs

@@ -30,6 +30,7 @@ import {
   verifySnapshotSourceBinding,
 } from "./snapshot.mjs";
 import { verifyDeliveryPacket } from "./source-fingerprint.mjs";
+import { verifySourceCandidateV2 } from "./source-candidate.mjs";
 import { validateVerificationReceiptGate } from "./verification-receipt-gate.mjs";
 
 const LOCKFILES = [
@@ -53,6 +54,12 @@ function entryExists(filePath) {
   }
 }
 
+function sortedFileMap(value) {
+  return Object.fromEntries(
+    Object.entries(value).sort(([left], [right]) => left.localeCompare(right)),
+  );
+}
+
 function within(root, candidate) {
   const relative = path.relative(root, candidate);
   return relative === ""
@@ -479,11 +486,84 @@ export function activeAcceptedGate({ workspaceRoot, runId }) {
     }
   }
   const distinctMatchingPackets = collapseByteIdenticalDeliveryCandidates(matchingPackets);
-  if (distinctMatchingPackets.length !== 1
-    || distinctMatchingPackets[0].sourceGate.status !== "valid") {
-    throw new Error("Accepted finish requires one fresh delivery packet matching the active verification gate; source drift remains unresolved.");
+  let matchingCandidate = null;
+  if (distinctMatchingPackets.length === 0) {
+    const candidateRoot = path.join(executionRoot, "source-candidates");
+    projectTruthDirectory({
+      workspaceRoot,
+      executionRoot,
+      directoryPath: candidateRoot,
+      label: "Source candidate directory",
+    });
+    const candidates = [];
+    for (const entry of readdirSync(candidateRoot, { withFileTypes: true })) {
+      if (!entry.name.endsWith(".json")) continue;
+      if (entry.isSymbolicLink() || !entry.isFile()) {
+        throw new Error(`Source candidate must be a regular file: ${entry.name}`);
+      }
+      const candidatePath = path.join(candidateRoot, entry.name);
+      const candidate = readJson(regularFile(
+        candidatePath,
+        `Source candidate ${entry.name}`,
+      ));
+      if (
+        candidate.runId === runId
+        && candidate.sourceFingerprint?.sha256
+          === validated.active.receipt.sourceFingerprint
+      ) {
+        const sourceGate = verifySourceCandidateV2({
+          workspaceRoot,
+          candidatePath: relativeToWorkspace(workspaceRoot, candidatePath),
+        });
+        if (sourceGate.status === "valid") {
+          candidates.push({ candidatePath, candidate, sourceGate });
+        }
+      }
+    }
+    const manifestFingerprints = new Set(
+      candidates.map(({ candidate }) => candidate.sourceManifest.sha256),
+    );
+    if (manifestFingerprints.size === 1) {
+      [matchingCandidate] = candidates;
+    }
+  }
+  if (
+    matchingCandidate === null
+    && (
+      distinctMatchingPackets.length !== 1
+      || distinctMatchingPackets[0].sourceGate.status !== "valid"
+    )
+  ) {
+    throw new Error("Accepted finish requires one fresh source binding matching the active verification gate; source drift remains unresolved.");
   }
   const [matchingPacket] = distinctMatchingPackets;
+  const declaredSourceArtifact = validated.active.receipt.sourceArtifact;
+  if (declaredSourceArtifact !== undefined) {
+    const selectedPath = matchingCandidate === null
+      ? matchingPacket.packetPath
+      : matchingCandidate.candidatePath;
+    const expectedSourceArtifact = {
+      kind: matchingCandidate === null
+        ? "delivery_packet_v1"
+        : "source_candidate_v2",
+      runId,
+      path: relativeToWorkspace(workspaceRoot, selectedPath),
+      sha256: sha256(readFileSync(selectedPath)),
+      sourceFingerprint: validated.active.receipt.sourceFingerprint,
+    };
+    if (
+      declaredSourceArtifact.kind !== expectedSourceArtifact.kind
+      || declaredSourceArtifact.runId !== expectedSourceArtifact.runId
+      || declaredSourceArtifact.path !== expectedSourceArtifact.path
+      || declaredSourceArtifact.sha256 !== expectedSourceArtifact.sha256
+      || declaredSourceArtifact.sourceFingerprint
+        !== expectedSourceArtifact.sourceFingerprint
+    ) {
+      throw new Error(
+        "Accepted finish requires the active receipt sourceArtifact to match the selected source bytes.",
+      );
+    }
+  }
   const snapshotsRoot = path.join(executionRoot, "snapshots");
   const evidenceRoot = path.join(executionRoot, "snapshot-evidence");
   projectTruthDirectory({ workspaceRoot, executionRoot, directoryPath: snapshotsRoot, label: "Snapshot directory" });
@@ -492,14 +572,45 @@ export function activeAcceptedGate({ workspaceRoot, runId }) {
     const snapshotId = safeIdentifier(commandReceipt.id, "active snapshot id");
     const snapshotPath = path.join(snapshotsRoot, `${snapshotId}.json`);
     const snapshot = readJson(regularFile(snapshotPath, `Active snapshot ${snapshotId}`));
-    const sourceBinding = verifySnapshotSourceBinding({
-      snapshot,
-      expectedFiles: matchingPacket.packet.changedFiles?.files
-        ?? matchingPacket.packet.changedFiles?.wholeFileSha256,
-      expectedFingerprint: validated.active.receipt.sourceFingerprint,
-    });
-    if (!sourceBinding.valid) {
-      throw new Error(`Accepted finish requires snapshot source bound to the DeliveryPacket: ${snapshotId}; ${sourceBinding.issues.join("; ")}`);
+    if (matchingCandidate !== null) {
+      const expectedFiles = Object.fromEntries(
+        matchingCandidate.candidate.sourceManifest.entries
+          .filter((entry) => entry.operation !== "deleted")
+          .map((entry) => [entry.path, entry.sha256])
+          .sort(([left], [right]) => left.localeCompare(right)),
+      );
+      const beforeFiles = sortedFileMap(
+        snapshot.repositoryBefore?.selectedFiles ?? {},
+      );
+      const afterFiles = sortedFileMap(
+        snapshot.repositoryAfter?.selectedFiles ?? {},
+      );
+      const expectedInputs = Object.entries(expectedFiles)
+        .map(([id, hash]) => ({ id, sha256: hash }));
+      const actualInputs = [
+        ...(snapshot.command?.evidence?.materialInputs ?? []),
+      ].sort((left, right) => String(left?.id).localeCompare(String(right?.id)));
+      if (
+        snapshot.repositoryBefore?.head
+          !== matchingCandidate.candidate.baseline.head
+        || snapshot.repositoryAfter?.head
+          !== matchingCandidate.candidate.baseline.head
+        || JSON.stringify(beforeFiles) !== JSON.stringify(expectedFiles)
+        || JSON.stringify(afterFiles) !== JSON.stringify(expectedFiles)
+        || JSON.stringify(actualInputs) !== JSON.stringify(expectedInputs)
+      ) {
+        throw new Error(`Accepted finish requires snapshot source bound to SourceCandidate V2: ${snapshotId}`);
+      }
+    } else {
+      const sourceBinding = verifySnapshotSourceBinding({
+        snapshot,
+        expectedFiles: matchingPacket.packet.changedFiles?.files
+          ?? matchingPacket.packet.changedFiles?.wholeFileSha256,
+        expectedFingerprint: validated.active.receipt.sourceFingerprint,
+      });
+      if (!sourceBinding.valid) {
+        throw new Error(`Accepted finish requires snapshot source bound to the DeliveryPacket: ${snapshotId}; ${sourceBinding.issues.join("; ")}`);
+      }
     }
     const expectedStdoutPath = relativeToWorkspace(workspaceRoot, path.join(evidenceRoot, `${snapshotId}.stdout`));
     const expectedStderrPath = relativeToWorkspace(workspaceRoot, path.join(evidenceRoot, `${snapshotId}.stderr`));
@@ -523,7 +634,19 @@ export function activeAcceptedGate({ workspaceRoot, runId }) {
     status: "valid",
     gateInputPath,
     gateInputRelativePath: relativeToWorkspace(workspaceRoot, gateInputPath),
-    deliveryPacketPath: relativeToWorkspace(workspaceRoot, matchingPacket.packetPath),
+    ...(matchingCandidate === null
+      ? {
+        deliveryPacketPath: relativeToWorkspace(
+          workspaceRoot,
+          matchingPacket.packetPath,
+        ),
+      }
+      : {
+        sourceCandidatePath: relativeToWorkspace(
+          workspaceRoot,
+          matchingCandidate.candidatePath,
+        ),
+      }),
     activeReceiptSha256: gate.activeReceiptSha256,
     authorizationGranted: false,
   };

package/scripts/runkit-contract/onboarding-doctor.mjs

@@ -18,6 +18,8 @@ import {
   isCanonicalSha512Integrity,
   validateStoredRegistryAdoptionEvidence,
 } from "./registry-adoption-gate.mjs";
+import { resolveProjectCli } from "./project-cli-resolver.mjs";
+import { inspectProjectControlState } from "./project-control-state.mjs";
 
 const PACKAGE_NAME = "owlrunkit";
 const EXPECTED_VERSION = CORE_VERSION;
@@ -294,95 +296,25 @@ function strictDescendant(root, candidate) {
     && !path.isAbsolute(relative);
 }
 
-function assertPathWithoutSymlinks(root, target, { targetType }) {
-  const realRoot = realpathSync(root);
-  const relative = path.relative(realRoot, target);
-  if (!strictDescendant(realRoot, target)) {
-    throw new Error("installed_package_path_invalid");
-  }
-  let current = realRoot;
-  for (const segment of relative.split(path.sep)) {
-    current = path.join(current, segment);
-    const stat = lstatSync(current);
-    if (stat.isSymbolicLink()) throw new Error("installed_package_symlink_rejected");
-  }
-  const finalStat = lstatSync(target);
-  if (
-    (targetType === "file" && !finalStat.isFile())
-    || (targetType === "directory" && !finalStat.isDirectory())
-  ) {
-    throw new Error("installed_package_path_invalid");
-  }
-  const realTarget = realpathSync(target);
-  if (!strictDescendant(realRoot, realTarget)) {
-    throw new Error("installed_package_path_invalid");
-  }
-}
-
-function dependencyDeclarations(manifest) {
-  return ["dependencies", "devDependencies", "optionalDependencies"]
-    .filter((section) => Object.hasOwn(manifest[section] ?? {}, PACKAGE_NAME))
-    .map((section) => ({ section, spec: manifest[section][PACKAGE_NAME] }));
-}
-
 export function readLocalInstallBinding({ workspaceRoot } = {}) {
-  const root = resolveBoundedWorkspaceRoot(workspaceRoot);
-  const manifestPath = path.join(root, "package.json");
-  const lockPath = path.join(root, "package-lock.json");
-  const installedRoot = path.join(root, "node_modules", PACKAGE_NAME);
-  const installedManifestPath = path.join(installedRoot, "package.json");
-  try {
-    for (const [target, targetType] of [
-      [installedRoot, "directory"],
-    ]) {
-      assertPathWithoutSymlinks(root, target, { targetType });
-    }
-    const manifest = readWorkspaceJsonBounded(root, "package.json");
-    const lock = readWorkspaceJsonBounded(root, "package-lock.json");
-    const installedManifest = readWorkspaceJsonBounded(
-      root,
-      path.join("node_modules", PACKAGE_NAME, "package.json"),
-    );
-    const declarations = dependencyDeclarations(manifest);
-    if (declarations.length !== 1) {
-      return {
-        status: "mismatch",
-        issueCodes: ["registry_install_binding_ambiguous"],
-      };
-    }
-    const requestedSpec = declarations[0].spec;
-    const lockBinding = lock.packages?.[`node_modules/${PACKAGE_NAME}`];
-    if (
-      requestedSpec !== EXPECTED_VERSION
-      || lockBinding?.version !== EXPECTED_VERSION
-      || installedManifest.name !== PACKAGE_NAME
-      || installedManifest.version !== EXPECTED_VERSION
-      || typeof lockBinding.resolved !== "string"
-      || typeof lockBinding.integrity !== "string"
-    ) {
-      return {
-        status: "mismatch",
-        issueCodes: ["registry_install_binding_mismatch"],
-      };
-    }
-    return {
-      status: "bound",
-      requestedSpec: `${PACKAGE_NAME}@${requestedSpec}`,
-      packageName: PACKAGE_NAME,
-      version: EXPECTED_VERSION,
-      resolved: lockBinding.resolved,
-      integrity: lockBinding.integrity,
-    };
-  } catch (error) {
-    return {
-      status: "mismatch",
-      issueCodes: [
-        error instanceof Error && error.message.startsWith("installed_package_")
-          ? error.message
-          : "registry_install_binding_mismatch",
-      ],
-    };
-  }
+  const binding = resolveProjectCli({
+    workspaceRoot,
+    expectedVersion: EXPECTED_VERSION,
+    requireEntrypoint: false,
+  });
+  if (binding.status === "bound") return binding;
+  const issue = binding.issueCodes?.[0];
+  const issueCode = issue === "project_cli_dependency_ambiguous"
+    ? "registry_install_binding_ambiguous"
+    : issue === "project_cli_symlink_rejected"
+      ? "installed_package_symlink_rejected"
+      : issue === "project_cli_path_invalid"
+        ? "installed_package_path_invalid"
+        : "registry_install_binding_mismatch";
+  return {
+    status: "mismatch",
+    issueCodes: [issueCode],
+  };
 }
 
 export async function readRegistryExact({
@@ -694,6 +626,10 @@ export async function runDoctor({
 } = {}) {
   const root = resolveBoundedWorkspaceRoot(workspaceRoot);
   const core = currentCoreIdentity();
+  const lifecycle = inspectProjectControlState({
+    workspaceRoot: root,
+    currentCore: core,
+  });
   const installed = readLocalInstallBinding({ workspaceRoot: root });
   const registry = registryClient
     ? await registryClient.readExact({ packageName: PACKAGE_NAME, version: EXPECTED_VERSION })
@@ -720,7 +656,12 @@ export async function runDoctor({
     },
     config,
     installedPackage: installed.status === "bound"
-      ? { status: "ok", version: installed.version }
+      ? {
+          status: "ok",
+          version: installed.version,
+          cliStatus: installed.cliStatus,
+          ...(installed.cliPath ? { cliPath: installed.cliPath } : {}),
+        }
       : { status: "mismatch" },
     registry: registry.status === "registry_verified"
       ? { status: "ok", version: registry.version }
@@ -732,6 +673,12 @@ export async function runDoctor({
       detected: readProjectScripts(root),
     },
     runtimeIsolation,
+    lifecycle: {
+      status: lifecycle.status,
+      activeRunIds: lifecycle.activeRunIds,
+      activeLeaseIds: lifecycle.activeLeaseIds,
+      recovery: lifecycle.recovery,
+    },
   };
   const issueCodes = [...(registry.issueCodes ?? [])];
   if (!nodeOk) issueCodes.push("node_version_unsupported");
@@ -740,6 +687,7 @@ export async function runDoctor({
   if (config.status === "invalid") issueCodes.push("runkit_config_invalid");
   if (profiles.status === "missing") issueCodes.push("profiles_missing");
   if (profiles.status === "invalid") issueCodes.push("profiles_invalid");
+  if (lifecycle.status === "invalid") issueCodes.push("runkit_control_state_invalid");
   if (installed.status !== "bound") {
     issueCodes.push(...(installed.issueCodes ?? ["registry_install_binding_mismatch"]));
   }
@@ -761,7 +709,9 @@ export async function runDoctor({
     ...(profiles.launcherWarnings ?? []),
   ].sort();
   const nextAllowedAction = uniqueIssues.length === 0
-    ? (profiles.launcherWarnings ?? []).length > 0
+    ? lifecycle.recovery.nextAllowedAction !== "plan_new_execution"
+      ? lifecycle.recovery.nextAllowedAction
+      : (profiles.launcherWarnings ?? []).length > 0
       ? "review_profile_launchers"
       : adoption.status === "ok"
         ? "plan_new_execution"
@@ -774,6 +724,8 @@ export async function runDoctor({
           ? "run_init_or_repair_config"
           : uniqueIssues.some((code) => code.startsWith("profiles_"))
             ? "detect_or_repair_profiles"
+            : uniqueIssues.includes("runkit_control_state_invalid")
+              ? "repair_execution_artifacts"
             : "repair_registry_binding";
   return {
     schemaVersion: "OwlCodaRunKitDoctorReportV1",
@@ -795,6 +747,7 @@ export function formatDoctorHuman(report) {
     `Registry: ${report.checks.registry.status}`,
     `Profiles: ${report.checks.profiles.status}`,
     `Adoption: ${report.checks.adoption.status}`,
+    `Lifecycle: ${report.checks.lifecycle.status}`,
     ...(report.issueCodes.length > 0 ? [`Issues: ${report.issueCodes.join(", ")}`] : []),
     ...(report.warningCodes.length > 0 ? [`Warnings: ${report.warningCodes.join(", ")}`] : []),
     `Next: ${report.nextAllowedAction === "adopt_current_release"