fix(recovery_flow,verify,sweep): fail-closed spec recovery and migration ledger byte binding (DW-308 … DW-316)

CHANGELOG.md

@@ -468,6 +468,39 @@ breaking changes may land in a minor release.
 
 ### Fixed
 
+- Bind legacy migration dispatch and publication to the ledger bytes actually accepted
+  (DW-311, DW-316). Retire stale recovery authority when the ledger changes before
+  the true post-hook adapter-launch boundary, then publish a validated one-path,
+  clean-filter-normalized candidate through a prepared expected-old transaction on
+  the captured terminal direct branch. Resolve lost commit acknowledgements by
+  deterministic replay, and reconcile the target index against bounded stable checkout
+  observations while preserving unrelated stages. An absent committed target is accepted
+  only when the baseline commit proves the ledger was never tracked: a ledger a rival
+  commit deleted after the baseline was taken refuses publication instead of being
+  silently re-added on top of that commit, the committed twin of the staged deletion
+  the publisher already refuses; a ledger the transition itself published that a later
+  commit removed refuses its replay the same way. The candidate carries the live ledger's
+  own bytes, read once they are proven to decode to the accepted text, so the committed
+  blob is what `git add` of the validated file stages under any line-ending configuration
+  and a CRLF checkout is not left dirty beside an LF commit; every later validation
+  re-reads those bytes and holds the target's size, mtime and ctime with its inode, so a
+  rewrite in place — rival bytes, or the same text under other line endings — is refused
+  before the transaction commits rather than noticed after it. The baseline's identity
+  is the blob its commit holds, bound to the baseline text under the ledger readers'
+  universal-newline decoding, rather than the LF blob re-encoding that text names: a
+  tracked legacy ledger Git preserves with CRLF bytes (`core.autocrlf=false`, the
+  shape every Windows-written ledger takes) was refused as rival content and left the
+  migration in COMMITTING for good.
+
+- Refuse no-descriptor attempt-owned spec restoration before staging or lifecycle
+  normalization, preserving the existing target bytes for manual recovery (DW-310).
+
+- Fail closed after no-descriptor attempt-owned spec publication and pause for
+  manual adoption instead of trusting a path-based readback (DW-309).
+
+- Refuse attempt-owned spec recovery when final prepublication validation observes an
+  existing target was edited in place, preserving the competing bytes (DW-308).
+
 - Restore the accepted commit chain and index when the post-squash HEAD identity
   probe fails, retaining the probe fault if rollback also fails (DW-305).
 

src/bmad_loop/engine.py

@@ -6510,6 +6510,7 @@ def _run_session(
         label: str | None = None,
         spec_snapshot: SpecSnapshot | None = None,
         preserve_dispatched_spec_snapshot: bool = False,
+        prelaunch_validator: Callable[[], None] | None = None,
     ) -> SessionResult:
         # ``label`` names a non-standard session (a plugin-provided workflow) so
         # its task_id stays distinct from the role's own dev/review attempts.
@@ -6575,6 +6576,12 @@ def _run_session(
         if sctx is not None:
             veto = sctx.resolved_veto()
             if veto is not None:
+                # A veto prevents adapter launch but does not undo executable
+                # hook side effects. Callers whose durable launch authority is
+                # bound to mutable input must validate that input before the
+                # early return just as they do on the normal launch path.
+                if prelaunch_validator is not None:
+                    prelaunch_validator()
                 self.journal.append(
                     "plugin-veto",
                     stage=sctx.stage,
@@ -6658,6 +6665,13 @@ def _run_session(
                 / f"{self._dev_skill(role)}-result-{task_id}.md"
             )
             prompt += WORKFLOW_COMPLETION_CONTRACT.format(marker_path=marker_path)
+        # Optional transaction boundary for callers whose durable launch
+        # authority is tied to mutable workspace input.  It deliberately runs
+        # after every executable session hook and every prompt/snapshot repair,
+        # but before either the session-start record or adapter launch.  The
+        # default keeps all existing callers byte-for-byte inert.
+        if prelaunch_validator is not None:
+            prelaunch_validator()
         spec = SessionSpec(
             task_id=task_id,
             role=role,