# CLI 0.0.4-microsoft-preview.17

Microsoft migration engine preview. Stable `latest` remains 0.0.3.

## Discovery phase guidance and safe correction

- Fixed a conflicting host instruction: reading a flow graph during discovery no longer tells the model to store flow groups again. Non-group phases receive read-only evidence for their existing selected flow, including when `groupId` is omitted.
- Discovery explicitly selects the upstream analyser's Task B, not its grouping Task A. Complete pinned Microsoft instructions and required skills remain unchanged.
- Persistent discovery guidance identifies the next missing output from the saved partial files: metadata, architecture, components, message flow, gaps, patterns, dependencies, then verified finalization. Existing files are not treated as proof of correctness.
- Known imported tools excluded by the current phase can receive at most two correction opportunities. The third wrong-stage request stops the stage, even with valid reads between attempts. The existing consecutive invalid-input budget can stop earlier.
- Rejected operations are never invoked, renamed, or applied. The model must supply a fresh authorized request. Exact rejected responses are audited. Unknown tools, shell requests and storage/audit failures remain immediately fatal.
- Repeated stage violations report `WRONG_STAGE_TOOL` with the affected phase/tool and a specific remedy. Other unauthorized requests report `UNAUTHORIZED_STAGE_TOOL`. Neither is mislabeled as a missing binding.

These are host orchestration changes, not replacements for Microsoft stage logic. Source selection, dependency requirements, workflow coverage, authorization and finalization checks remain enforced.

## Update in PowerShell

```powershell
Invoke-WebRequest 'https://tools.lambogenius.com/lambogenius-integration-migration/0.0.4-microsoft-preview.17/install-cli.ps1' -OutFile install-cli-preview17.ps1
# Review the downloaded script before execution.
& .\install-cli-preview17.ps1 -SkipDependencies
li.cmd --version
```

Expected version: `0.0.4-microsoft-preview.17`. Omit `-SkipDependencies` if prerequisites need installation.

Keep the supported context settings from preview.16 (`contextWindowTokens: 262144`, `maxOutputTokens: 8192`); this bug does not require another context increase. Sufficient model/server memory is still necessary. The engine fingerprint changes: preserve previous outputs and use a fresh generated workspace. Do not edit checkpoint fingerprints to force resume. Installation does not reset license counters.

## Verification and limitations

- 84 Microsoft-core tests, 221 CLI tests and 24 installer/release tests passed; compilation and lint passed.
- FINACCONT-BT regression replay used the exact saved rejected model response and the actual selected source/parser results: 98 artifacts, five orchestrations, three scripted calls, zero model calls, maximum prompt 76,085 UTF-8 bytes.
- The rejected group write executed nothing; a subsequent authorized discovery metadata write succeeded in an isolated fixture. Saved groups, source files and original audit bytes were unchanged.
- The fixture deliberately remained incomplete and did not finalize discovery. This validates phase correction, not semantic discovery or an end-to-end migration. No customer generated output or cloud resources were changed.

This release does not tune Ollama inference performance or promise shorter model responses.