fix(fn-20): address 3 adversarial review findings

1. Approval race condition (HIGH) — approve/reject now checks
   affected-row count from the conditional UPDATE. Concurrent
   resolutions that lose the race return InvalidTransition instead
   of reloading the row and falsely emitting a second
   ApprovalResolved event.
   (flowctl-service/src/approvals.rs)

2. CLI daemon discovery (MEDIUM) — flow_state_dir now walks up
   from cwd to find the nearest .flow/ directory instead of
   rooting at env::current_dir(). Running flowctl approval from
   a subdirectory no longer silently bypasses the daemon.
   (flowctl-cli/src/commands/approval.rs)

3. Outputs handoff ordering (MEDIUM) — Phase 5c (Outputs Dump)
   is now reordered BEFORE Phase 5 (Complete) in the canonical
   phase sequence, so the narrative handoff artifact exists
   before flowctl done unblocks dependents.
   (flowctl-cli/src/commands/workflow/phase.rs, agents/worker.md)

All flowctl-service approval tests pass (5/5); full suite 284+
tests pass; clippy clean.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: z23cc

agents/worker.md

@@ -435,6 +435,8 @@ Continue until SHIP verdict. Save final `REVIEW_ITERATIONS` count for Phase 5 ev
 <!-- section:core -->
 ## Phase 5: Complete
 
+**Prerequisite:** Phase 5c (Outputs Dump) must have run if `outputs.enabled=true`. The phase registry orders 5c before 5 so the narrative handoff file exists before dependents unblock.
+
 **Verify before completing:**
 ```bash
 <FLOWCTL> guard
@@ -519,9 +521,11 @@ Status MUST be `done`. If not:
 <!-- section:outputs -->
 ## Phase 5c: Outputs Dump (if outputs.enabled)
 
+**Runs BEFORE Phase 5 completion.** Phase 5c must produce the handoff artifact before `flowctl done` fires, otherwise a dependent task can start re-anchoring and race past the missing file. The phase registry in `flowctl-cli/src/commands/workflow/phase.rs` enforces this ordering (5c before 5).
+
 **Skip if `outputs.enabled` is false.** This is gated on its own config key — independent from `memory.enabled`. Outputs are a lightweight narrative handoff layer (plain markdown, no verification), separate from the verified memory system.
 
-After completing the task, write a ≤200-word narrative dump to `.flow/outputs/<TASK_ID>.md` for the next worker in this epic:
+Write a ≤200-word narrative dump to `.flow/outputs/<TASK_ID>.md` for the next worker in this epic:
 
 ```bash
 # Check if outputs is enabled (default: true)

flowctl/crates/flowctl-cli/src/commands/approval.rs

@@ -95,10 +95,28 @@ pub fn dispatch(cmd: &ApprovalCmd, json: bool) {
 // ── Transport resolution ────────────────────────────────────────────
 
 fn flow_state_dir() -> PathBuf {
-    env::current_dir()
-        .unwrap_or_else(|_| PathBuf::from("."))
-        .join(FLOW_DIR)
-        .join(STATE_DIR)
+    find_flow_dir().join(STATE_DIR)
+}
+
+/// Walk up from cwd to locate the nearest `.flow/` directory. Falls back to
+/// `./.flow` if none found (fresh repo). This matches how other tools resolve
+/// project roots (walk up until `.git`) and avoids the subdirectory pitfall
+/// where `flowctl approval ...` was bypassing the daemon when run from a
+/// crate folder.
+fn find_flow_dir() -> PathBuf {
+    let cwd = env::current_dir().unwrap_or_else(|_| PathBuf::from("."));
+    let mut cursor: &Path = &cwd;
+    loop {
+        let candidate = cursor.join(FLOW_DIR);
+        if candidate.is_dir() {
+            return candidate;
+        }
+        match cursor.parent() {
+            Some(parent) => cursor = parent,
+            None => break,
+        }
+    }
+    cwd.join(FLOW_DIR)
 }
 
 /// Where the daemon writes its PID + socket.

flowctl/crates/flowctl-cli/src/commands/workflow/phase.rs

@@ -67,10 +67,12 @@ const PHASE_DEFS: &[PhaseDef] = &[
 ];
 
 /// Canonical ordering of all phases — used to merge sequences.
-const CANONICAL_ORDER: &[&str] = &["0", "1", "2a", "2", "2.5", "3", "4", "5", "5c", "5b", "6"];
+/// Phase 5c (outputs dump) runs BEFORE 5 (completion) so the narrative
+/// handoff artifact exists before dependents unblock and begin re-anchor.
+const CANONICAL_ORDER: &[&str] = &["0", "1", "2a", "2", "2.5", "3", "4", "5c", "5", "5b", "6"];
 
 /// Default phase sequence (Worktree + Teams, always includes Phase 0).
-/// Phase 5c is appended when `outputs.enabled` is true (default).
+/// Phase 5c is inserted before 5 when `outputs.enabled` is true (default).
 const PHASE_SEQ_DEFAULT: &[&str] = &["0", "1", "2", "2.5", "3", "5", "5b", "6"];
 const PHASE_SEQ_TDD: &[&str]    = &["0", "1", "2a", "2", "2.5", "3", "5", "5b", "6"];
 const PHASE_SEQ_REVIEW: &[&str] = &["0", "1", "2", "2.5", "3", "4", "5", "5b", "6"];

flowctl/crates/flowctl-service/src/approvals.rs

@@ -181,6 +181,7 @@ impl ApprovalStore for LibSqlApprovalStore {
     }
 
     async fn approve(&self, id: &str, resolver: Option<String>) -> ServiceResult<Approval> {
+        // Pre-check for better error messages; authoritative guard is the UPDATE below.
         let existing = self.load_row(id).await?;
         if existing.status != ApprovalStatus::Pending {
             return Err(ServiceError::InvalidTransition(format!(
@@ -189,14 +190,21 @@ impl ApprovalStore for LibSqlApprovalStore {
             )));
         }
         let now = Utc::now().timestamp();
-        self.conn
+        let affected = self
+            .conn
             .execute(
                 "UPDATE approvals SET status = 'approved', resolved_at = ?1, resolver = ?2
                  WHERE id = ?3 AND status = 'pending'",
                 params![now, resolver.clone(), id.to_string()],
             )
             .await
             .map_err(|e| ServiceError::ValidationError(format!("update failed: {e}")))?;
+        if affected == 0 {
+            // Lost a race with another resolver — the row is no longer pending.
+            return Err(ServiceError::InvalidTransition(format!(
+                "approval {id} was resolved concurrently"
+            )));
+        }
         self.load_row(id).await
     }
 
@@ -206,6 +214,7 @@ impl ApprovalStore for LibSqlApprovalStore {
         resolver: Option<String>,
         reason: Option<String>,
     ) -> ServiceResult<Approval> {
+        // Pre-check for better error messages; authoritative guard is the UPDATE below.
         let existing = self.load_row(id).await?;
         if existing.status != ApprovalStatus::Pending {
             return Err(ServiceError::InvalidTransition(format!(
@@ -214,14 +223,21 @@ impl ApprovalStore for LibSqlApprovalStore {
             )));
         }
         let now = Utc::now().timestamp();
-        self.conn
+        let affected = self
+            .conn
             .execute(
                 "UPDATE approvals SET status = 'rejected', resolved_at = ?1, resolver = ?2, reason = ?3
                  WHERE id = ?4 AND status = 'pending'",
                 params![now, resolver.clone(), reason.clone(), id.to_string()],
             )
             .await
             .map_err(|e| ServiceError::ValidationError(format!("update failed: {e}")))?;
+        if affected == 0 {
+            // Lost a race with another resolver — the row is no longer pending.
+            return Err(ServiceError::InvalidTransition(format!(
+                "approval {id} was resolved concurrently"
+            )));
+        }
         self.load_row(id).await
     }
 }