chore: integrate remaining repairs and prepare v1.0.42

.github/actions/record-verification/action.yml

@@ -0,0 +1,40 @@
+name: Record successful verification
+description: Save evidence after every verification step in the caller has succeeded
+inputs:
+  key:
+    description: Exact evidence key from verified-content
+    required: true
+  path:
+    description: Evidence path from verified-content
+    required: true
+  job-name:
+    description: Exact GitHub job name used to locate the authoritative result
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Record tested product content
+      shell: bash
+      env:
+        EVIDENCE: ${{ inputs.path }}
+      run: node script/ci-evidence.mjs proof
+    - name: Upload immutable verification proof
+      id: proof
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      with:
+        name: ci-verification-${{ github.job }}-${{ runner.os }}-${{ runner.arch }}-${{ github.run_attempt }}
+        path: ${{ inputs.path }}.artifact/verification.json
+        retention-days: 2
+        if-no-files-found: error
+    - name: Record verification source
+      shell: bash
+      env:
+        EVIDENCE: ${{ inputs.path }}
+        CHECK_JOB: ${{ inputs.job-name }}
+        ARTIFACT_ID: ${{ steps.proof.outputs.artifact-id }}
+      run: node script/ci-evidence.mjs record
+    - name: Save successful verification
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ inputs.path }}
+        key: ${{ inputs.key }}

.github/actions/verified-content/action.yml

@@ -0,0 +1,57 @@
+name: Previously verified content
+description: Restore exact successful verification evidence, excluding only the SpecGit delivery record
+inputs:
+  check:
+    description: Stable job identifier, separate for every verification suite
+    required: true
+  job-name:
+    description: Exact GitHub job name whose successful conclusion must be confirmed
+    required: true
+  runner-label:
+    description: Runner label which must appear in the source job's platform evidence
+    required: true
+outputs:
+  reused:
+    value: ${{ steps.verify.outputs.reused }}
+    description: Whether this exact content has already passed this suite today
+  key:
+    value: ${{ steps.key.outputs.value }}
+    description: Exact evidence key
+  path:
+    value: ${{ steps.key.outputs.path }}
+    description: Evidence file path
+runs:
+  using: composite
+  steps:
+    - name: Fingerprint verification inputs
+      id: content
+      shell: bash
+      run: node script/ci-fingerprint.mjs
+    - name: Identify verification evidence
+      id: key
+      shell: bash
+      env:
+        CHECK: ${{ inputs.check }}
+        FINGERPRINT: ${{ steps.content.outputs.fingerprint }}
+        DAY: ${{ steps.content.outputs.day }}
+      run: |
+        echo "value=verified-v4-${RUNNER_OS}-${RUNNER_ARCH}-${DAY}-${CHECK}-${FINGERPRINT}" >> "$GITHUB_OUTPUT"
+        echo "path=${RUNNER_TEMP}/verified-${CHECK}.txt" >> "$GITHUB_OUTPUT"
+    - name: Restore successful verification
+      id: restore
+      if: github.event_name != 'workflow_dispatch'
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      with:
+        path: ${{ steps.key.outputs.path }}
+        key: ${{ steps.key.outputs.value }}
+    - name: Verify the source job and product content
+      id: verify
+      if: steps.restore.outputs.cache-hit == 'true'
+      shell: bash
+      env:
+        EVIDENCE: ${{ steps.key.outputs.path }}
+        CHECK_JOB: ${{ inputs.job-name }}
+        CHECK_RUNNER: ${{ inputs.runner-label }}
+        PRODUCT_FINGERPRINT: ${{ steps.content.outputs.fingerprint }}
+        GH_TOKEN: ${{ github.token }}
+      run: node script/ci-evidence.mjs verify

.github/releases/v1.0.40.md

@@ -30,9 +30,9 @@
 ### 🧪 Test Summary
 
 ```
-Integration CI baseline (dev 8060765fcc):
+Release integration CI (PR #539, 00695dab86):
 core: 1225 pass, 6 skip, 0 fail
-opencode: 4426 pass, 23 skip, 1 todo, 0 fail
+opencode: 4429 pass, 23 skip, 1 todo, 0 fail
 HttpAPI coverage / auth / effect: 230 pass each, no failures or missing routes
 Generated client and SDK freshness: passed
 Typecheck, DAG core gate, Linux and Windows E2E: passed
@@ -46,7 +46,7 @@ Merged opencode package typecheck: passed
 
 ### 🔍 Verification
 
-The slow-tool regression was observed failing before the fix and passing afterward through the real session processor and a local HTTP model endpoint. Additional cases cover parallel local tools and explicit cancellation. Independent Standards and Spec reviews found no code blockers. The integration statistics above come from [dev CI](https://github.com/LeXwDeX/OpenCode-GraphAgent/actions/runs/33868550950); they identify the tested baseline and do not substitute for the final release PR's Typecheck, Linux unit, Linux/Windows E2E and SpecGit acceptance gates. Reported model usage in the regression is deterministic test input; no live model context limit is inferred from it.
+The slow-tool regression was observed failing before the fix and passing afterward through the real session processor and a local HTTP model endpoint. Additional cases cover parallel local tools and explicit cancellation. Independent Standards, Spec and merge reviews found no code blockers. The integration statistics above come from the accepted [PR #539 CI](https://github.com/LeXwDeX/OpenCode-GraphAgent/actions/runs/33894718562), including generated client/SDK freshness and all three HttpAPI modes. [Typecheck, lint and DAG core](https://github.com/LeXwDeX/OpenCode-GraphAgent/actions/runs/33894718548), both E2E platforms and SpecGit 1.10.1 acceptance also passed before merge to dev. The release branch preserves that accepted runtime tree; [release PR #544](https://github.com/LeXwDeX/OpenCode-GraphAgent/pull/544) carries its own binding and main-targeted gates. Reported model usage in the regression is deterministic test input; no live model context limit is inferred from it.
 
 ---
 

.github/releases/v1.0.41.md

@@ -0,0 +1,51 @@
+## opencode {VERSION}
+
+{Prerelease/Stable} release from `{branch}` branch. DAG replanning, recovery, input mapping, and single-step execution now preserve durable workflow semantics across races and restarts.
+
+---
+
+### 🐛 Bug Fixes
+
+- **Stale execution isolation, [#545](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/545)**: bind admission and settlement to the durable execution identity so delayed workers, deadlines, and recovery observations cannot terminalize a replacement attempt.
+- **Running definition consistency, [#546](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/546)**: reject execution-semantic changes to an admitted node unless a supported explicit restart applies the new definition, while retaining valid timeout updates.
+- **Atomic replans, [#547](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/547)**: commit node mutations, workflow configuration, and graph revision together so a failed replan cannot expose a partial graph or dispatch missing configuration. Forward committed notifications in order even when earlier legacy listeners yield.
+- **Durable checkpoint veto recovery, [#548](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/548)**: reconstruct unresolved reporting-checkpoint decisions after restart before dispatch or workflow completion.
+- **Input mapping validation, [#549](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/549)**: reject unknown, self, and unordered mapping sources before execution and report missing required runtime values without dropping valid nulls.
+- **Plain-text recovery parity, [#550](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/550)**: classify missing, empty, and whitespace-only recovered output the same way as live provider output while preserving valid text exactly.
+- **Single-step convergence, [#551](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/551)**: propagate skipped dependency chains to a terminal state without dispatching more than one child for each user step.
+
+---
+
+### ⚙️ CI / Engineering
+
+- **SpecGit 1.13.1 delivery compatibility, [#552](https://github.com/LeXwDeX/OpenCode-GraphAgent/issues/552)**: refresh the generated acceptance harness and local entry points, preserve the required long-running CI budget, and update the repository bootstrap wrapper for current body-file flags and init assets.
+- **Integrated delivery, [PR #553](https://github.com/LeXwDeX/OpenCode-GraphAgent/pull/553)**: track the seven DAG fixes and harness maintenance as independently verifiable issues on the shared dev delivery.
+
+---
+
+### 🧪 Test Summary
+
+```
+core DAG:             92 pass
+OpenCode DAG:        665 pass
+output schema:         3 pass
+TUI:                  60 pass
+local gate total:    820 tests, 0 failures
+typecheck:         29/29 packages green
+lint:               4845 warnings, budget 4850
+SpecGit wrapper:     283 assertions, 0 failures
+atomicity repeat:  20/20 passes
+macOS install:       6 assertions, 0 failures
+```
+
+---
+
+### 🔍 Verification
+
+PR #553 was accepted at `e742eec4cef4339e54c6c72aedd5dbe7a7594fdd` and merged to dev as `345e5c13e7bdce2c739bace6327a896ebed88075`. [Typecheck and DAG coverage](https://github.com/LeXwDeX/OpenCode-GraphAgent/actions/runs/33931615264) and [unit tests, HttpAPI contracts, and Linux/Windows E2E](https://github.com/LeXwDeX/OpenCode-GraphAgent/actions/runs/33931615315) passed; SpecGit accepted the final head before merge. Independent GPT-5.6-Sol Standards and Spec reviews resolved every mandatory finding.
+
+Regressions exercised real DAG commands, projections, durable stores, delayed execution boundaries, injected transaction rollback, restart recovery, checkpoint vetoes, mapping validation, plain-text settlement, and guarded single-step dispatch. Existing coverage floors and generated SDK freshness checks passed. A native candidate included the Web UI, 16 validated templates, and ripgrep; its real archive passed installer signature, tamper-rejection, and executable checks. The compiled server returned a healthy `1.0.41` response and HTTP 200 for its embedded homepage. The official release workflow validates reference templates and produces the platform archives with SHA256SUMS.
+
+---
+
+**Full changelog:** [`{previous_tag}`...`{current_tag}`](https://github.com/LeXwDeX/OpenCode-GraphAgent/compare/{previous_tag}...{current_tag})