@deksden-com/dd-flow-cli 0.9.0-beta.119 → 0.9.0-beta.120

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.120
+
+### Patch Changes
+
+- Continue only confirmed, effect-free Codex `serverOverloaded` Turns in the same Session with bounded backoff and retained owner, budget, HITL, Work, MERGE, and recovery admission. Preserve exact native child Turn evidence and fail closed when effects are unknown.
+- Distinguish hard provider quota from short rate limiting and ambiguous 429 responses across AGY, ZCode, and OpenCode.
+
 ## 0.9.0-beta.119
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.119",
-  "cli_commit": "9bf32901c2f926dd5819e3695dbab4fae1869724",
-  "built_at": "2026-09-28T13:03:08.769Z",
+  "cli_version": "0.9.0-beta.120",
+  "cli_commit": "a9385404a7a9fced5e4cfdcdb656e534c06d1401",
+  "built_at": "2026-09-28T22:25:15.635Z",
   "built_with_canon": {
     "version": "4.1.1",
     "commit": "678daa038287c948ada5b2d785a6dcc925c7b891",

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -327,10 +327,11 @@ export class Runtime {
       this.active = null;
       const message = String(result.error ?? "Antigravity returned ERROR"); const normalized = message.toLowerCase();
       const code = result.status === "CANCELLED" ? "agy_turn_cancelled" : /quota|insufficient.?credit|billing|usage limit/.test(normalized) ? "agy_provider_quota_exhausted"
-        : /rate.?limit|too many requests|\b429\b/.test(normalized) ? "agy_provider_rate_limited"
+        : /rate.?limit|too many requests/.test(normalized) ? "agy_provider_rate_limited"
+          : /\b429\b/.test(normalized) ? "agy_provider_limit_unknown"
           : /auth|unauthori[sz]ed|forbidden|account/.test(normalized) ? "agy_provider_account"
             : "agy_provider_failed";
-      return current.reject(new DaemonError(code, message, ["agy_provider_quota_exhausted", "agy_provider_rate_limited"].includes(code), { provider_result: result, provider_error_scope: current.previousError && current.previousError === result.error ? "repeated_conversation_error" : "terminal_result", usage_ingest: this.usageIngest }));
+      return current.reject(new DaemonError(code, message, code === "agy_provider_rate_limited", { provider_result: result, provider_error_scope: current.previousError && current.previousError === result.error ? "repeated_conversation_error" : "terminal_result", usage_ingest: this.usageIngest }));
     }
     await this.completePendingTurn();
   }

package/dist/harness-runtime/lib/dd-codex.d.mts

@@ -0,0 +1 @@
+export function terminalCodexOverload(error: unknown, expectedSessionId: string, expectedTurnId?: string): boolean;

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -52,7 +52,7 @@ class Journal {
 }
 
 export class CodexBridge {
-  constructor(options = {}) { this.options = options; this.nextId = 1; this.pending = new Map(); this.lateResponses = new Map(); this.turns = new Map(); this.finalMessages = new Map(); this.descendants = new Map(); this.journal = new Journal(options.journal); this.stderr = ""; this.requestedProfiles = new Map(); this.modelObservations = Promise.resolve(); }
+  constructor(options = {}) { this.options = options; this.nextId = 1; this.pending = new Map(); this.lateResponses = new Map(); this.turns = new Map(); this.nativeErrors = new Map(); this.finalMessages = new Map(); this.descendants = new Map(); this.journal = new Journal(options.journal); this.stderr = ""; this.requestedProfiles = new Map(); this.modelObservations = Promise.resolve(); }
 
   async start() {
     const bin = this.options.bin ?? process.env.DD_CODEX_BIN ?? "codex";
@@ -120,11 +120,16 @@ export class CodexBridge {
       message.error ? pending.reject(Object.assign(new Error(message.error.message ?? JSON.stringify(message.error)), { code: "rpc_error", details: message.error })) : pending.resolve(message.result ?? {});
       return;
     }
-    if (message.method === "turn/completed") this.turns.set(message.params?.turn?.id ?? message.params?.threadId, { status: "completed", value: message.params });
-    if (message.method === "turn/started") this.turns.set(message.params?.turn?.id ?? message.params?.threadId, { status: "running", value: message.params });
+    if (message.method === "error" && message.params?.threadId && message.params?.turnId) {
+      const key = `${message.params.threadId}:${message.params.turnId}`;
+      this.nativeErrors.set(key, { error: message.params.error, willRetry: message.params.willRetry });
+      while (this.nativeErrors.size > 128) this.nativeErrors.delete(this.nativeErrors.keys().next().value);
+    }
+    if (message.method === "turn/completed") this.turns.set(message.params?.turn?.id ?? message.params?.threadId, { status: "completed", value: message.params, threadId: message.params?.threadId });
+    if (message.method === "turn/started" && this.turns.get(message.params?.turn?.id)?.status !== "completed") this.turns.set(message.params?.turn?.id ?? message.params?.threadId, { status: "running", value: message.params, threadId: message.params?.threadId });
     const threadId = message.params?.threadId;
     if (threadId && message.method === "item/started") this.finalMessages.delete(threadId);
-    if (threadId && message.method === "item/completed" && message.params?.item?.type === "agentMessage") this.finalMessages.set(threadId, { item: message.params.item, completedAt: Date.now() });
+    if (threadId && message.method === "item/completed" && message.params?.item?.type === "agentMessage") this.finalMessages.set(threadId, { item: message.params.item, turnId: message.params?.turnId ?? null, completedAt: Date.now() });
   }
 
   isManagedHook(run) {
@@ -217,13 +222,27 @@ export class CodexBridge {
   observeTopology(value, depth = 0) {
     if (!value || typeof value !== "object" || depth > 8) return;
     if (Array.isArray(value)) { for (const item of value) this.observeTopology(item, depth + 1); return; }
+    if (depth === 0 && ["turn/started", "turn/completed"].includes(value.method)) {
+      const { threadId, turn } = value.params ?? {};
+      const previous = this.descendants.get(threadId);
+      if (previous && typeof turn?.id === "string" && turn.id) {
+        if (value.method === "turn/started" && previous.active_turn_id !== turn.id && this.turns.get(turn.id)?.status !== "completed") {
+          this.descendants.set(threadId, { ...previous, status: "running", active_turn_id: turn.id, terminal_turn_id: null, provider_error: null });
+        } else if (value.method === "turn/completed" && (!previous.active_turn_id || previous.active_turn_id === turn.id)) {
+          this.descendants.set(threadId, { ...previous, status: turn.status === "completed" ? "completed" : turn.status ?? "unknown",
+            active_turn_id: turn.id, terminal_turn_id: turn.id, terminal_observed_at: now(), provider_error: nativeTurnError(this, threadId, turn), native_turn_items: turnItemEvidence(turn) });
+        }
+      }
+    }
     const activity = value.params?.item;
     const activityParent = value.params?.threadId;
     if (activity?.type === "subAgentActivity" && typeof activity.agentThreadId === "string" && activity.agentThreadId &&
         typeof activityParent === "string" && activityParent && activity.agentThreadId !== activityParent) {
       const previous = this.descendants.get(activity.agentThreadId);
       const observed = activity.kind === "completed" ? "completed" : activity.kind === "interrupted" ? "interrupted" : "running";
-      const status = previous?.status === "completed" ? "completed" : observed;
+      // Parent activity has no child Turn identity on some app-server builds.
+      // It can discover a child, but cannot reopen or close a later known Turn.
+      const status = previous?.active_turn_id || previous?.status === "completed" ? previous.status : observed;
       this.descendants.set(activity.agentThreadId, { ...previous, provider_session_id: activity.agentThreadId,
         parent_provider_session_id: activityParent, status, agent_path: activity.agentPath ?? previous?.agent_path ?? null,
         source: "codex.app_server.subAgentActivity" });
@@ -234,7 +253,7 @@ export class CodexBridge {
         if (typeof child !== "string" || !child || child === value.senderThreadId) continue;
         const previous = this.descendants.get(child);
         this.descendants.set(child, { ...previous, provider_session_id: child, parent_provider_session_id: value.senderThreadId,
-          status: previous?.status === "completed" ? "completed" : value.agentsStates?.[child]?.status ?? "unknown", source: "codex.app_server" });
+          status: previous?.status === "completed" || previous?.active_turn_id ? previous.status : value.agentsStates?.[child]?.status ?? previous?.status ?? "unknown", source: "codex.app_server" });
       }
     }
     const id = value.threadId ?? value.id ?? null;
@@ -242,7 +261,7 @@ export class CodexBridge {
     if (typeof id === "string" && id && typeof parent === "string" && parent) {
       const previous = this.descendants.get(id);
       this.descendants.set(id, { ...previous, provider_session_id: id, parent_provider_session_id: parent,
-        status: previous?.status === "completed" ? "completed" : value.status?.type ?? value.status ?? "unknown", source: "codex.app_server" });
+        status: previous?.status === "completed" || previous?.active_turn_id ? previous.status : value.status?.type ?? value.status ?? previous?.status ?? "unknown", source: "codex.app_server" });
     }
     for (const child of Object.values(value)) this.observeTopology(child, depth + 1);
   }
@@ -306,6 +325,18 @@ async function withBridge(options, action) { const bridge = new CodexBridge(opti
 function profile(options) { return { harness: "codex-desktop", model: options.model ?? null, reasoning: options.reasoning ?? null }; }
 function threadId(result) { const id = result?.thread?.id ?? result?.threadId; return required(id, "Codex thread id"); }
 function directChildren(bridge, sessionId) { return typeof bridge?.directChildren === "function" ? bridge.directChildren(sessionId) : []; }
+async function observedChildren(bridge, sessionId) {
+  const children = directChildren(bridge, sessionId);
+  let reads = 0;
+  return await Promise.all(children.map(async child => {
+    if (child.status !== "failed" || !child.terminal_turn_id || reads++ >= 16) return child;
+    const observed = await readTurn(bridge, child.provider_session_id, child.terminal_turn_id, true);
+    const turn = observed?.turn;
+    if (turn?.id !== child.terminal_turn_id || turn.status !== child.status) return child;
+    return { ...child, provider_error: nativeTurnError(bridge, child.provider_session_id, turn) ?? child.provider_error,
+      native_turn_items: turnItemEvidence(turn) };
+  }));
+}
 function codexSessionConfig() { return { ...CODEX_SESSION_CONFIG }; }
 
 async function requestConfiguredThread(bridge, method, params, timeoutMs) {
@@ -399,11 +430,24 @@ export async function promptSessionWithBridge(bridge, options) {
   bridge.assertHookHealthy?.(sessionId);
   const started = await bridge.request("turn/start", { threadId: sessionId, input: [{ type: "text", text: prompt }], cwd, model: options.model ?? null, effort: options.reasoning ?? null, approvalPolicy: "never", sandboxPolicy: { type: "dangerFullAccess" } }, options.timeoutMs ?? 1_800_000);
   const turn = started?.turn ?? started; const turnId = turn?.id ?? null;
-  const completed = await waitForTurn(bridge, sessionId, turnId, options.timeoutMs ?? 1_800_000, options, cwd);
+  let completed;
+  try { completed = await waitForTurn(bridge, sessionId, turnId, options.timeoutMs ?? 1_800_000, options, cwd); }
+  catch (error) {
+    if (error?.code === "turn_interrupted") {
+      try {
+        const observed = await readTurn(bridge, sessionId, turnId, true);
+        if (observed?.turn?.id === turnId && observed.turn.status === error.details?.terminal_status) {
+          error.details.native_turn_items = turnItemEvidence(observed.turn);
+          error.details.provider_error ??= observed.turn.error ?? null;
+        }
+      } catch { /* The primary native terminal failure remains authoritative. */ }
+    }
+    throw error;
+  }
   const thread = await readCompletedThread(bridge, sessionId);
   bridge.assertHookHealthy?.(sessionId);
-  const assistantText = latestAssistantText(thread) ?? latestAssistantText(completed);
-  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, turn_id: turnId, status: "completed", turn: completed, ...(thread ? { thread: threadReceipt(thread) } : {}), descendants: directChildren(bridge, sessionId), ...(assistantText ? { assistant_text: assistantText } : {}), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread?.model ?? null, reasoning: thread?.reasoningEffort ?? null, provider: thread?.modelProvider ?? null }, "thread/read.after_turn") };
+  const assistantText = latestAssistantText(thread?.turns?.find(item => item?.id === turnId)) ?? latestAssistantText(completed);
+  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, turn_id: turnId, status: "completed", turn: completed, ...(thread ? { thread: threadReceipt(thread) } : {}), descendants: await observedChildren(bridge, sessionId), ...(assistantText ? { assistant_text: assistantText } : {}), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread?.model ?? null, reasoning: thread?.reasoningEffort ?? null, provider: thread?.modelProvider ?? null }, "thread/read.after_turn") };
 }
 
 async function ensureThreadLoaded(bridge, sessionId, options, cwd) {
@@ -428,23 +472,23 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd) {
   let nextStoredReadAt = Date.now();
   while (!clock.sample(bridge.activity?.get(sessionId))) {
     bridge.assertHookHealthy?.(sessionId);
-    const known = bridge.turns.get(turnId) ?? bridge.turns.get(sessionId); if (known?.status === "completed") return terminalTurn(known.value, turnId, bridge);
+    const known = bridge.turns.get(turnId) ?? bridge.turns.get(sessionId); if (known?.status === "completed" && (!known.threadId || known.threadId === sessionId)) return terminalTurn(known.value, sessionId, turnId, bridge);
     if (Date.now() >= nextStoredReadAt) {
       const stored = await readTurn(bridge, sessionId, turnId, false);
-      if (stored?.turn && isAuthoritativeTerminal(bridge, turnId, stored.turn.status, stored.threadStatus, failureNotBefore)) return terminalTurn({ turn: stored.turn }, turnId, bridge);
+      if (stored?.turn && isAuthoritativeTerminal(bridge, turnId, stored.turn.status, stored.threadStatus, failureNotBefore)) return terminalTurn({ turn: stored.turn }, sessionId, turnId, bridge);
       // A loaded app-server can retain a stale `active` Thread state after a
       // provider-side interruption. The persisted turn page is independent of
       // that live subscription and is the compact authority for its terminal
       // status; unlike `includeTurns`, it never hydrates the whole history.
       const persisted = await readPersistedTurn(bridge, sessionId, turnId);
-      if (persisted && isAuthoritativeTerminal(bridge, turnId, persisted.status, stored?.threadStatus, failureNotBefore)) return terminalTurn({ turn: persisted }, turnId, bridge);
+      if (persisted && isAuthoritativeTerminal(bridge, turnId, persisted.status, stored?.threadStatus, failureNotBefore)) return terminalTurn({ turn: persisted }, sessionId, turnId, bridge);
       // Desktop may unload an idle Thread immediately after an interrupted
       // Turn. Reload it once before polling again: otherwise the compact
       // status remains `notLoaded` forever and hides the terminal Turn.
       if (stored?.threadStatus === "notLoaded") {
         await ensureThreadLoaded(bridge, sessionId, options, cwd);
         const hydrated = await readTurn(bridge, sessionId, turnId, true);
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, turnId, bridge);
+        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
       }
       // Some app-server versions correctly omit turns for a compact read.
       // Once the thread is idle, hydrate exactly once to recover the terminal
@@ -455,7 +499,7 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd) {
         // an inProgress Turn after emitting the final agent message; treating
         // that stale Turn as terminal incorrectly aborts an otherwise usable
         // worker session.
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, turnId, bridge);
+        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
       }
       // Some app-server builds emit a final agent message but omit both the
       // terminal event and the compact turn record. Wait briefly, hydrate once,
@@ -464,10 +508,10 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd) {
       // Agent messages are streamed as completed items while a Turn is still
       // reasoning and calling tools.  They are terminal evidence only after
       // app-server reports the Thread idle.
-      if (final && stored?.threadStatus === "idle" && Date.now() - final.completedAt >= 1_000) {
+      if (final?.turnId === turnId && stored?.threadStatus === "idle" && Date.now() - final.completedAt >= 1_000) {
         const hydrated = await readTurn(bridge, sessionId, turnId, true);
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, turnId, bridge);
-        return terminalTurn({ turn: { id: turnId, status: "completed", synthetic: true, final_message: final.item } }, turnId, bridge);
+        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
+        return terminalTurn({ turn: { id: turnId, status: "completed", synthetic: true, final_message: final.item } }, sessionId, turnId, bridge);
       }
       nextStoredReadAt = Date.now() < failureNotBefore ? failureNotBefore : Date.now() + 15_000;
     }
@@ -476,15 +520,48 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd) {
   fail("Codex turn timed out", "turn_timeout");
 }
 
-function terminalTurn(value, turnId, bridge) {
+function terminalTurn(value, sessionId, turnId, bridge) {
   // A terminal event may arrive while an older snapshot RPC is in flight.
   const observed = bridge.turns.get(turnId);
-  if (observed?.status === "completed") value = observed.value;
+  if (observed?.status === "completed" && (!observed.threadId || observed.threadId === sessionId)) value = observed.value;
   const turn = value?.turn ?? value;
-  if (turn?.status && turn.status !== "completed") fail(`Codex turn ${turnId ?? "unknown"} ended as ${turn.status}`, "turn_interrupted", { turn_id: turn.id ?? turnId ?? null, terminal_status: turn.status, provider_error: turn.error ?? turn.codexErrorInfo ?? null });
+  if (turn?.id && turn.id !== turnId || value?.threadId && value.threadId !== sessionId) fail("Codex terminal Turn identity does not match the requested Session/Turn", "turn_identity_mismatch", { provider_session_id: sessionId, turn_id: turnId, native_thread_id: value?.threadId ?? null, native_turn_id: turn?.id ?? null });
+  const providerError = nativeTurnError(bridge, sessionId, turn);
+  if (turn?.status && turn.status !== "completed") fail(`Codex turn ${turnId ?? "unknown"} ended as ${turn.status}`, "turn_interrupted", { provider_session_id: sessionId, turn_id: turnId, native_turn_id: turn.id ?? null, terminal_status: turn.status, observed_at: now(),
+    provider_error: providerError, native_turn_items: turnItemEvidence(turn) });
   return value;
 }
 
+function nativeTurnError(bridge, sessionId, turn) {
+  const native = bridge.nativeErrors?.get(`${sessionId}:${turn?.id}`);
+  const error = turn?.error && typeof turn.error === "object" && native?.error && typeof native.error === "object"
+    ? { ...native.error, ...turn.error } : turn?.error ?? native?.error ?? (turn?.codexErrorInfo ? { codexErrorInfo: turn.codexErrorInfo } : null);
+  return error && native?.willRetry !== undefined && typeof error === "object" ? { ...error, willRetry: native.willRetry } : error;
+}
+
+function turnItemEvidence(turn) {
+  const items = turn?.items;
+  return Array.isArray(items) && turn?.itemsView !== "notLoaded" ? { observed: true, count: items.length, types: items.map(item => item?.type ?? "unknown"),
+    possible_effects: items.some(item => !["agentMessage", "reasoning", "userMessage"].includes(item?.type)) } : { observed: false };
+}
+
+export function terminalCodexOverload(error, expectedSessionId, expectedTurnId) {
+  let current = error;
+  for (let depth = 0; depth < 4 && current && typeof current === "object"; depth += 1) {
+    if (current.code === "turn_interrupted") {
+      const details = current.details ?? {}, native = details.provider_error;
+      const code = native?.codexErrorInfo;
+      return details.terminal_status === "failed" && typeof details.provider_session_id === "string" && details.provider_session_id === expectedSessionId
+        && typeof details.turn_id === "string" && Boolean(details.turn_id) && details.native_turn_id === details.turn_id
+        && (expectedTurnId === undefined || details.turn_id === expectedTurnId)
+        && (code === "serverOverloaded" || code?.code === "serverOverloaded");
+    }
+    if (current.code !== "harness_adapter_failed") return false;
+    current = current.details?.cause ?? current.cause;
+  }
+  return false;
+}
+
 function isTerminalTurnStatus(status) { return ["completed", "failed", "interrupted", "cancelled"].includes(status); }
 function isAuthoritativeTerminal(bridge, turnId, status, threadStatus, failureNotBefore) {
   if (!isTerminalTurnStatus(status)) return false;
@@ -518,7 +595,7 @@ async function readCompletedThread(bridge, sessionId) {
 }
 
 function latestAssistantText(value) {
-  const messages = value?.messages ?? value?.items ?? value?.turn?.items ?? [];
+  const messages = value?.messages ?? value?.items ?? value?.turn?.items ?? (value?.turn?.final_message ? [value.turn.final_message] : []);
   if (!Array.isArray(messages)) return null;
   for (const message of [...messages].reverse()) {
     if (message?.role !== "assistant" && message?.type !== "agentMessage") continue;
@@ -538,7 +615,7 @@ export async function inspectSession(options) {
 
 export async function inspectSessionWithBridge(bridge, options) {
   const sessionId = required(options.sessionId, "--session-id"); const value = await bridge.request("thread/read", { threadId: sessionId, includeTurns: false }); const thread = value?.thread ?? value;
-  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, status: thread.status ?? null, thread: threadReceipt(thread), descendants: directChildren(bridge, sessionId), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread.model ?? null, reasoning: thread.reasoningEffort ?? null, provider: thread.modelProvider ?? null }, "thread/read") };
+  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, status: thread.status ?? null, thread: threadReceipt(thread), descendants: await observedChildren(bridge, sessionId), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread.model ?? null, reasoning: thread.reasoningEffort ?? null, provider: thread.modelProvider ?? null }, "thread/read") };
 }
 
 export async function cancelSession(options) {

package/dist/harness-runtime/lib/dd-opencode.mjs

@@ -68,8 +68,8 @@ export class OpenCodeClient {
         const native = reply.info.error;
         const message = native.data?.message ?? native.message ?? native.name ?? "OpenCode provider failed";
         const status = native.data?.statusCode;
-        const code = status === 429 || /rate limit/i.test(message) ? "provider_rate_limited" : status === 402 || /payment required|quota|usage balance exhausted/i.test(message) ? "provider_quota_exhausted" : "opencode_provider_failed";
-        throw new OpenCodeError(code, message, native.data?.isRetryable === true || code === "provider_rate_limited", { session_id: id, message_id: reply.info.id, provider_error: native });
+        const code = status === 402 || /payment required|quota|usage balance exhausted|insufficient.?credit|billing/i.test(message) ? "provider_quota_exhausted" : /rate.?limit|too many requests/i.test(message) ? "provider_rate_limited" : status === 429 ? "provider_limit_unknown" : "opencode_provider_failed";
+        throw new OpenCodeError(code, message, code === "provider_rate_limited", { session_id: id, message_id: reply.info.id, provider_error: native });
       }
       return reply;
     }

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -268,8 +268,8 @@ export class AcpBridge {
         const error = new Error(messageText);
         const nativeCode = typeof data?.code === "string" ? data.code : typeof data?.native_code === "string" ? data.native_code : null;
         const unknown = ["native_timeout", "native_backend_dead", "native_backend_pipe_broken", "native_outcome_unknown"].includes(nativeCode);
-        error.code = unknown ? nativeCode : /rate limit/i.test(messageText) ? "provider_rate_limited" : /payment required|usage balance exhausted/i.test(messageText) ? "provider_quota_exhausted" : "acp_request_failed";
-        error.retryable = !unknown && /rate limit/i.test(messageText);
+        error.code = unknown ? nativeCode : /payment required|quota|usage balance exhausted|insufficient.?credit|billing/i.test(messageText) ? "provider_quota_exhausted" : /rate.?limit|too many requests/i.test(messageText) ? "provider_rate_limited" : /\b429\b/.test(messageText) ? "provider_limit_unknown" : "acp_request_failed";
+        error.retryable = error.code === "provider_rate_limited";
         error.details = { acp_code: message.error.code ?? null, ...(data ? { native: data } : {}), ...(details ? { provider_details: details } : {}), ...(providerDetails ? { provider_update: provider } : {}) };
         pending.reject(error);
       }

package/dist/services/codex-capacity.js

@@ -0,0 +1,71 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { terminalCodexOverload } from "../harness-runtime/lib/dd-codex.mjs";
+/** Only a terminal, effect-free native Turn may get another productive Turn. */
+export async function continueCodexCapacity(input) {
+    let { error, operationId } = input;
+    for (let ordinal = 1; ordinal <= 2; ordinal += 1) {
+        if (!terminalCodexOverload(error, input.sessionId)) {
+            if (ordinal === 1)
+                return null;
+            throw error;
+        }
+        let prior;
+        try {
+            prior = await input.inspectOperation(operationId);
+        }
+        catch {
+            if (ordinal === 1)
+                return null;
+            throw error;
+        }
+        const failure = prior.error;
+        const turnId = failure?.details?.turn_id;
+        if (prior.operation_id !== operationId || prior.operation !== "session.prompt" || prior.session_id !== input.sessionId
+            || prior.state !== "failed" || prior.primary_error || !turnId || !terminalCodexOverload(failure, input.sessionId, turnId)
+            || failure.details?.native_turn_items?.observed !== true || failure.details.native_turn_items.possible_effects !== false) {
+            if (ordinal === 1)
+                return null;
+            throw error;
+        }
+        const settled = async () => {
+            const seen = await input.inspectSession();
+            const settlement = seen.settlement;
+            const ids = Array.isArray(seen.tree_session_ids) ? seen.tree_session_ids : [];
+            const observations = Array.isArray(seen.tree_observations) ? seen.tree_observations : [];
+            const treeProven = input.allowSettledDescendants
+                ? ids.length > 0 && ids[0] === input.sessionId && observations.length === ids.length
+                    && ids.every(id => observations.some(item => item.provider_session_id === id && item.settled === true))
+                    && Array.isArray(seen.unsettled_sessions) && seen.unsettled_sessions.length === 0
+                : ids.length === 1 && ids[0] === input.sessionId;
+            return seen.provider_session_id === input.sessionId && seen.settled === true && treeProven
+                && (!settlement || ["settled", "not_required"].includes(settlement.state ?? ""));
+        };
+        input.assertCurrent();
+        try {
+            if (!await settled()) {
+                if (ordinal === 1)
+                    return null;
+                throw error;
+            }
+        }
+        catch {
+            if (ordinal === 1)
+                return null;
+            throw error;
+        }
+        const nextId = `${input.operationId}:capacity:${ordinal}:session.prompt`;
+        input.retainIntent({ predecessor: operationId, operation_id: nextId, turn_id: turnId, ordinal, not_before: new Date(Date.now() + (ordinal === 1 ? 5_000 : 15_000)).toISOString() });
+        await delay(ordinal === 1 ? 5_000 : 15_000);
+        input.assertCurrent();
+        if (!await settled().catch(() => false))
+            throw error;
+        try {
+            return await input.prompt(nextId, input.continuationText ?? "Continue the same assigned task in this Session. Check current durable RUN, Work and Stage state first. Never repeat an observed lifecycle command, accepted HITL answer, check or merge apply; use only an exact issued successor. Stop at the assigned boundary.", ordinal);
+        }
+        catch (nextError) {
+            error = nextError;
+            operationId = nextId;
+        }
+    }
+    throw error;
+}

package/dist/services/controller-fanout.js

@@ -136,7 +136,10 @@ export function controllerNativeChildren(receipt, rootSessionId) {
         const status = ["completed", "complete", "done", "success", "succeeded"].includes(state) ? "completed" : state === "settled_by_root" ? "settled_by_root" : ["failed", "error"].includes(state) ? "failed" : ["cancelled", "canceled", "interrupted"].includes(state) ? "cancelled" : ["running", "active", "pending"].includes(state) ? "running" : fallback;
         const rootChild = parent === rootSessionId;
         const settled = rootChild && status === "unknown" && settledTree.has(id) ? "settled_by_root" : status;
-        candidates.push({ session_id: id, parent_session_id: parent ?? "", status: settled, source, ...(rootChild ? {} : { provenance: "parent_mismatch" }) });
+        candidates.push({ session_id: id, parent_session_id: parent ?? "", status: settled, source, ...(rootChild ? {} : { provenance: "parent_mismatch" }),
+            ...(text(value, ["terminal_turn_id"]) ? { terminal_turn_id: text(value, ["terminal_turn_id"]) } : {}),
+            ...(value.provider_error !== undefined ? { provider_error: value.provider_error } : {}),
+            ...(value.native_turn_items && typeof value.native_turn_items === "object" ? { native_turn_items: value.native_turn_items } : {}) });
     };
     for (const value of list(receipt.descendants))
         add(value, "adapter.descendants");
@@ -166,6 +169,15 @@ export function controllerNativeChildren(receipt, rootSessionId) {
         }
         if (previous && rank[previous.status] === 3 && rank[child.status] === 3 && previous.status !== child.status)
             throw new AppError("native_child_outcome_conflict", "Native child has contradictory terminal outcomes", 1, { session_id: child.session_id, observations: [previous, child] });
+        if (previous && previous.status === child.status && previous.terminal_turn_id && child.terminal_turn_id && previous.terminal_turn_id !== child.terminal_turn_id)
+            throw new AppError("native_child_turn_conflict", "Native child has contradictory terminal Turn identities", 1, { session_id: child.session_id, observations: [previous, child] });
+        if (previous && previous.status === child.status) {
+            unique.set(child.session_id, { ...previous, ...child,
+                ...(child.terminal_turn_id ?? previous.terminal_turn_id ? { terminal_turn_id: child.terminal_turn_id ?? previous.terminal_turn_id } : {}),
+                ...(child.provider_error ?? previous.provider_error ? { provider_error: child.provider_error ?? previous.provider_error } : {}),
+                ...(child.native_turn_items ?? previous.native_turn_items ? { native_turn_items: child.native_turn_items ?? previous.native_turn_items } : {}) });
+            continue;
+        }
         if (!previous || rank[child.status] > rank[previous.status])
             unique.set(child.session_id, child);
     }

package/dist/services/external-work-launch.js

@@ -16,6 +16,8 @@ import { reviewExecutionCopyHash, reviewSourceFilter, reviewSourceHash, reviewSo
 import { workspaceGitFiles } from "./workspace-files.js";
 import { qualifyAgyHooks } from "../harness-runtime/lib/dd-agy-daemon.mjs";
 import { lifecycleRetryInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { continueCodexCapacity } from "./codex-capacity.js";
+import { errorRecord } from "./run-controller-state.js";
 /**
  * Creates an external provider root for one already-created Work.  The launch
  * is not a Work claim: only the worker's trusted `work start` hook binds it.
@@ -91,7 +93,7 @@ export async function launchExternalWork(context, input) {
     const common = ["--dd-flow-bin", flowExecutable, "--state-dir", root, "--journal", journal, "--cwd", isolatedWorkspace ?? run.workspace_root, "--provider", resolved.worker.provider, "--model", resolved.worker.model, "--reasoning", resolved.worker.reasoning, "--mode", resolved.worker.mode, "--permission", resolved.worker.permission, "--project-root", run.project_root, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, runtimeHarness(resolved.worker)), "--json"];
     const evidence = (value) => fs.appendFileSync(journal, `${JSON.stringify({ type: "adapter_call", at: context.now(), ...value })}\n`);
     try {
-        const call = (args, timeoutMs) => runHarnessAdapter({ executable, args, env: runtimeContext.env, operationId: `${operationId}:${args[0]}.${args[1]}`, runtimeOwner, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), onEvidence: evidence });
+        const call = (args, timeoutMs, id = `${operationId}:${args[0]}.${args[1]}`) => runHarnessAdapter({ executable, args, env: runtimeContext.env, operationId: id, runtimeOwner, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), onEvidence: evidence });
         await call(["daemon", "start", ...common]);
         assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
         const created = await call(["session", "create", ...common], runtimeHarness(resolved.worker) === "zcode-acp" ? 180_000 : undefined);
@@ -108,13 +110,45 @@ export async function launchExternalWork(context, input) {
             throw new AppError("read_only_input_changed", "Authoritative review workspace changed after the execution copy was made", 2, { work_id: work.work_id });
         const promptFile = path.join(root, "launch.md");
         fs.writeFileSync(promptFile, `Start the assigned Work now. Your first tool call must be this exact standalone command:\n\n${workStartCommand(runtimeContext, work)}\n\nUse the packet returned by that command. Do not claim another Work or run this command more than once.\n\n${lifecycleRetryInstruction}${isolatedWorkspace ? `\n\nThe review copy has no .git. Read the captured status/diff or gitless note in ${path.join(isolatedWorkspace, ".dd-flow", "review-evidence")}; do not run Git inside the copy.\n` : "\n"}`);
-        const prompted = await call(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60_000);
+        const promptOperationId = `${operationId}:session.prompt`;
+        let prompted;
+        try {
+            prompted = await call(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60_000);
+        }
+        catch (error) {
+            if (runtimeHarness(resolved.worker) !== "codex-desktop")
+                throw error;
+            const resumed = await continueCodexCapacity({ error, sessionId, operationId: promptOperationId,
+                inspectOperation: id => call(["daemon", "operation", "--state-dir", root, "--operation-id", id, "--json"], 30_000, `${id}:capacity-observe`),
+                inspectSession: () => call(["session", "inspect", "--session-id", sessionId, ...common], 30_000, `${operationId}:capacity-inspect`),
+                assertCurrent: () => {
+                    assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
+                    const current = context.db.get("SELECT w.status, l.status AS launch_status FROM works w JOIN work_launches l ON l.work_id = w.work_id WHERE w.work_id = ? AND l.operation_id = ?", [work.work_id, operationId]);
+                    if (current?.status !== "created" || current.launch_status !== "launching")
+                        throw new AppError("capacity_continuation_blocked", "External Work changed before its native continuation", 1, { work_id: work.work_id, state: current });
+                    if (reviewCopy && reviewSourceHash(run.workspace_root, reviewInputs, reviewBase) !== reviewCopy.source_sha256)
+                        throw new AppError("read_only_input_changed", "Authoritative review workspace changed during capacity wait", 2);
+                },
+                retainIntent: intent => {
+                    const changed = context.db.run("UPDATE work_launches SET adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ? AND status = 'launching'", [JSON.stringify({ create: created, capacity_intent: intent }), context.now(), operationId]);
+                    if (changed.changes !== 1)
+                        throw new AppError("capacity_continuation_blocked", "External Work launch owner changed", 1);
+                },
+                prompt: (id, text, ordinal) => {
+                    const file = path.join(root, `capacity-${ordinal}.md`);
+                    fs.writeFileSync(file, `${text}\n`, { flag: "wx", mode: 0o600 });
+                    return call(["session", "prompt", "--session-id", sessionId, "--prompt-file", file, ...common], 45 * 60_000, id);
+                } });
+            if (!resumed)
+                throw error;
+            prompted = resumed;
+        }
         assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
         context.db.run("UPDATE work_launches SET status = 'start_requested', provider_session_id = ?, adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ?", [sessionId, JSON.stringify({ create: created, prompt: prompted }), context.now(), operationId]);
         return { ok: true, work_id: work.work_id, operation_id: operationId, status: "start_requested", session: { harness_id: runtimeHarness(resolved.worker), session_id: sessionId }, profile_hash: resolved.profile_hash, journal_path: journal };
     }
     catch (error) {
-        context.db.run("UPDATE work_launches SET status = 'failed', adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify({ error: String(error) }), context.now(), operationId]);
+        context.db.run("UPDATE work_launches SET status = 'failed', adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify({ error: errorRecord(error) }), context.now(), operationId]);
         throw error;
     }
 }

package/dist/services/merge-server.js

@@ -1,5 +1,7 @@
 import { managedInvocationContext, managedLifecycleCommand } from "./lifecycle-invocations.js";
 import { stageLifecycleInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { continueCodexCapacity } from "./codex-capacity.js";
+import { errorRecord } from "./run-controller-state.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -110,7 +112,7 @@ async function dispatch(context, input) {
         return; const now = context.now(); context.db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'dispatching' AND dispatch_owner = ? AND dispatch_lease_token = ?", [new Date(Date.now() + 120_000).toISOString(), now, input.request.merge_request_id, input.serverId, token]); }, 30_000);
     leaseHeartbeat.unref();
     try {
-        const adapterCall = (args, timeoutMs, progressMessage) => { assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation); return runHarnessAdapter({ executable, args, env: runtimeContext.env, runtimeOwner, operationId: `${input.request.merge_request_id}:${token}:${args[0]}.${args[1]}`, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), ...(progressMessage ? { progressMessage } : {}), onEvidence: (value) => event(input.journal, { type: "adapter_call", ...value }) }); };
+        const adapterCall = (args, timeoutMs, progressMessage, id = `${input.request.merge_request_id}:${token}:${args[0]}.${args[1]}`) => { assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation); return runHarnessAdapter({ executable, args, env: runtimeContext.env, runtimeOwner, operationId: id, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), ...(progressMessage ? { progressMessage } : {}), onEvidence: (value) => event(input.journal, { type: "adapter_call", ...value }) }); };
         await adapterCall(["daemon", "start", ...common]);
         const created = await adapterCall(["session", "create", ...common], runtimeHarness(input.profile) === "zcode-acp" ? 180_000 : undefined);
         const sessionId = adapterSessionId(created);
@@ -121,7 +123,35 @@ async function dispatch(context, input) {
         runtimeContext = managedInvocationContext(runtimeContext, { harness: runtimeHarness(input.profile), stateDir, sessionId, projectRoot: run.project_root, runId: input.request.run_id, generation });
         const stageCommand = managedLifecycleCommand(runtimeContext, `${flowCommand(runtimeContext)} stage start ${input.request.run_id} --stage merge --project-root ${JSON.stringify(run.project_root)} --json --progress-jsonl`);
         fs.writeFileSync(promptFile, `Start the assigned MERGE stage now. Your first tool call must be this exact standalone command:\n\n${stageCommand}\n\nTrust and follow the complete stage packet it returns. Continue through merge apply and stage finish. Stop only when the stage reaches a terminal result or explicitly requests user/operator action.\n\n${stageLifecycleInstruction}\n`);
-        const prompted = await adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} is still running`);
+        let prompted;
+        try {
+            prompted = await adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} is still running`);
+        }
+        catch (error) {
+            if (runtimeHarness(input.profile) !== "codex-desktop")
+                throw error;
+            const resumed = await continueCodexCapacity({ error, sessionId, operationId: String(retained.prompt_operation_id),
+                inspectOperation: id => adapterCall(["daemon", "operation", "--state-dir", stateDir, "--operation-id", id, "--json"], 30_000, undefined, `${id}:capacity-observe`),
+                inspectSession: () => adapterCall(["session", "inspect", "--session-id", sessionId, ...common], 30_000, undefined, `${input.request.merge_request_id}:${token}:capacity-inspect`),
+                assertCurrent: () => {
+                    assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation);
+                    const current = context.db.get("SELECT status, dispatch_owner, dispatch_lease_token, dispatch_lease_expires_at, target_workspace FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id]);
+                    if (current?.status !== "dispatching" || current.dispatch_owner !== input.serverId || current.dispatch_lease_token !== token
+                        || current.dispatch_lease_expires_at <= context.now() || current.target_workspace !== input.request.target_workspace)
+                        throw new AppError("capacity_continuation_blocked", "MERGE dispatch owner or target changed during capacity wait", 1, { request_id: input.request.merge_request_id });
+                    if (context.db.get("SELECT status FROM works WHERE work_id = ?", [input.request.executor_work_id])?.status !== "created")
+                        throw new AppError("capacity_continuation_blocked", "MERGE Work already changed state", 1);
+                },
+                retainIntent: intent => { retained.capacity_intent = intent; retain(); },
+                prompt: (id, text, ordinal) => {
+                    const file = path.join(stateDir, `capacity-${ordinal}.md`);
+                    fs.writeFileSync(file, `${text}\n`, { flag: "wx", mode: 0o600 });
+                    return adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", file, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} capacity continuation ${ordinal}/2`, id);
+                } });
+            if (!resumed)
+                throw error;
+            prompted = resumed;
+        }
         Object.assign(retained, { response: prompted });
         retain();
         assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation);
@@ -137,9 +167,9 @@ async function dispatch(context, input) {
         }
         const request = context.db.get("SELECT status FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id]);
         if (request?.status === "dispatching")
-            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_launch_failed", error: String(error) }), context.now(), input.request.merge_request_id]);
+            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_launch_failed", error: errorRecord(error) }), context.now(), input.request.merge_request_id]);
         else if (request?.status === "active")
-            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_lost_after_stage_start", error: String(error) }), context.now(), input.request.merge_request_id]);
+            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_lost_after_stage_start", error: errorRecord(error) }), context.now(), input.request.merge_request_id]);
         throw error;
     }
     finally {

package/dist/services/run-controller-adapter.js

@@ -15,14 +15,32 @@ export function controllerHitlAdmission(context, record, input) {
     if (!row || row.generation !== JSON.parse(record.metadata_json).run_generation)
         return false;
     const suffix = `:prompt:${row.generation}`;
-    if (!input.operationId.endsWith(suffix))
+    const successor = /^(.*):capacity:([12]):session\.prompt$/.exec(input.operationId);
+    const baseId = successor ? successor[1] : input.operationId;
+    if (!baseId.endsWith(suffix))
         return false;
+    if (successor) {
+        const ordinal = Number(successor[2]);
+        const predecessorId = ordinal === 1 ? baseId : `${baseId}:capacity:1:session.prompt`;
+        const predecessor = context.db.get("SELECT status, receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [predecessorId, row.controller_id, row.generation]);
+        if (predecessor?.status !== "failed" || !predecessor.receipt_json)
+            return false;
+        let retained;
+        try {
+            retained = JSON.parse(predecessor.receipt_json);
+        }
+        catch {
+            return false;
+        }
+        if (retained.capacity_intent?.predecessor !== predecessorId || retained.capacity_intent.operation_id !== input.operationId || retained.capacity_intent.ordinal !== ordinal)
+            return false;
+    }
     const state = JSON.parse(row.state_json);
     const session = state.current_session === null ? undefined : state.sessions[state.current_session];
     if (!session || session.stopped || session.id !== input.nativeSessionId || session.state_dir !== input.stateDir || session.owner.owner_id !== record.owner_id)
         return false;
     const operation = (id) => context.db.get("SELECT input_json, input_hash FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'dispatching'", [id, row.controller_id, row.generation]);
-    const answer = context.db.get("SELECT input_json, input_hash FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation <= ? AND status = 'accepted'", [input.operationId.slice(0, -suffix.length), row.controller_id, row.generation]);
+    const answer = context.db.get("SELECT input_json, input_hash FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation <= ? AND status = 'accepted'", [baseId.slice(0, -suffix.length), row.controller_id, row.generation]);
     const prompt = operation(input.operationId);
     if (!answer || !prompt)
         return false;

package/dist/services/run-controller-recovery.js

@@ -8,11 +8,13 @@ import { requireProjectByRoot } from "./projects.js";
 import { loadExternalStageContext } from "./stage-context.js";
 import { verifyRecoverySnapshot } from "./eval-snapshots.js";
 import { recoveryGuard, resumeRunRecovery } from "./run-recovery.js";
-import { prepareRunRecoveryDispatch } from "./run-recovery-runtime.js";
+import { prepareRunRecoveryDispatch, retainRecoveryCapacityIntent } from "./run-recovery-runtime.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, processStartedAt } from "./managed-processes.js";
 import { requireRun, requireController, controllerReceipt, appendEvent, saveState, digest, errorRecord } from "./run-controller-state.js";
-import { controllerAdapter, sessionArguments } from "./run-controller-adapter.js";
+import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
+import { runHarnessAdapter } from "./harness-adapter.js";
+import { continueCodexCapacity } from "./codex-capacity.js";
 import { spawnController, recordControllerLauncher } from "./run-controller-process.js";
 import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 import { managedInvocationContext } from "./lifecycle-invocations.js";
@@ -194,7 +196,49 @@ export async function resumeControllerSession(context, row, manifest, state, ass
     fs.writeFileSync(file, dispatch.prompt, { flag: "wx", mode: 0o600 });
     state.turns += 1;
     saveState(context, row, state);
-    const receipt = await call(["session", "prompt", "--session-id", session.id, "--prompt-file", file, ...sessionArguments(context, manifest, session)], dispatch.operation_id);
+    const sendAck = (operationId, prompt) => {
+        let promptFile = file;
+        if (operationId !== dispatch.operation_id) {
+            promptFile = path.join(row.state_dir, `turn-${String(state.turns + 1).padStart(5, "0")}.md`);
+            fs.writeFileSync(promptFile, prompt, { flag: "wx", mode: 0o600 });
+            state.turns += 1;
+            saveState(context, row, state);
+        }
+        return call(["session", "prompt", "--session-id", session.id, "--prompt-file", promptFile, ...sessionArguments(context, manifest, session)], operationId);
+    };
+    let receipt;
+    try {
+        receipt = await sendAck(dispatch.operation_id, dispatch.prompt);
+    }
+    catch (error) {
+        if (runtimeHarness(session.profile) !== "codex-desktop")
+            throw error;
+        const continuationText = `The preceding native recovery ACK Turn failed before any observed tool or file effect. This is the same retained Session and recovery generation. First inspect the current RUN recovery state; only if the exact ACK still awaits acceptance, execute the exact standalone acceptance command below once. Never deliver it again after acceptance. Then stop at the original Stage or Work-graph boundary.\n\n${dispatch.prompt}`;
+        const inspect = (args, operationId) => runHarnessAdapter({ executable: manifest.adapters["codex-desktop"].executable,
+            args, env: controllerEnvironment(executionContext, manifest, session), runtimeOwner: session.owner, operationId, timeoutMs: 30_000 });
+        const resumed = await continueCodexCapacity({ error, sessionId: session.id, operationId: dispatch.operation_id, allowSettledDescendants: true, continuationText,
+            inspectOperation: id => inspect(["daemon", "operation", "--state-dir", session.state_dir, "--operation-id", id, "--json"], `${id}:capacity-observe`),
+            inspectSession: () => inspect(["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], `${dispatch.operation_id}:capacity-inspect`),
+            assertCurrent: () => {
+                assertRecoveryOwner();
+                const guard = recoveryGuard(context, row.project_id, row.run_id);
+                const binding = context.db.get("SELECT status, daemon_id FROM run_recovery_bindings WHERE recovery_id = ?", [recovery.recovery_id]);
+                const ack = context.db.get("SELECT status FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [recovery.operation_id, row.controller_id, row.generation]);
+                if (guard?.status !== "resuming" || binding?.status !== "prepared" || binding.daemon_id !== daemonId || ack?.status !== "accepted")
+                    throw new AppError("recovery_capacity_owner_changed", "Recovery ACK was accepted or superseded during capacity wait", 1);
+                const current = requireManagedDaemonBinding(executionContext, { stateDir: session.state_dir, projectId: row.project_id, runId: row.run_id, ownerId: session.owner.owner_id });
+                const metadata = JSON.parse(current.process.metadata_json);
+                if (current.process.id !== dispatch.process_id || current.state.daemon_id !== daemonId || current.process.state !== "running"
+                    || current.process.lease_expires_at <= context.now() || metadata.run_generation !== row.generation || !processIsAlive(current.process))
+                    throw new AppError("recovery_capacity_owner_changed", "Replacement native owner changed during capacity wait", 1);
+            },
+            retainIntent: intent => retainRecoveryCapacityIntent(executionContext, { projectId: row.project_id, runId: row.run_id, recoveryId: recovery.recovery_id,
+                controllerId: row.controller_id, generation: row.generation, daemonId, intent, prompt: continuationText }),
+            prompt: (operationId, prompt) => sendAck(operationId, prompt) });
+        if (!resumed)
+            throw error;
+        receipt = resumed;
+    }
     assertRecoveryOwner();
     if (recoveryGuard(context, row.project_id, row.run_id)?.status !== "recovered")
         throw new AppError("trusted_recovery_acceptance_required", "Recovery Turn ended without its native acknowledgement", 1);

package/dist/services/run-controller.js

@@ -30,9 +30,12 @@ import { requireRun, requireController, controllerReceipt, appendEvent, saveStat
 import { assertNoCorrelatedRejection } from "./continuation-outcome.js";
 import { spawnController, recordControllerLauncher, claimControllerProcess, markControllerDispatchReady } from "./run-controller-process.js";
 import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
+import { continueCodexCapacity } from "./codex-capacity.js";
 import { resumeControllerSession, failControllerRecovery } from "./run-controller-recovery.js";
 import { captureControllerBoundary } from "./run-controller-capture.js";
 import { requestRunControl } from "./run-control-worker.js";
+import { storageSessionId } from "./session-identity.js";
+import { terminalCodexOverload } from "../harness-runtime/lib/dd-codex.mjs";
 export { resumeRunController } from "./run-controller-recovery.js";
 export function prepareRunControllerLaunch(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.requestId) || !/^[a-f0-9]{64}$/.test(input.contextSha256))
@@ -526,16 +529,61 @@ async function executeController(context, row, manifest, state, assertOwnership,
             throw new AppError("settlement_reconciliation_required", "The managed Session still has an unsettled productive predecessor", 1, { session_id: session.id, settlement: current });
         }
     };
-    const prompt = async (session, text, operationId) => {
+    const prompt = async (session, text, operationId, kind) => {
+        const hitl = kind === "hitl";
         await reconcilePromptPredecessor(session);
-        const file = path.join(row.state_dir, `turn-${String(state.turns + 1).padStart(5, "0")}.md`);
-        fs.writeFileSync(file, `${text}\n`, { flag: "wx", mode: 0o600 });
-        state.turns += 1;
-        saveState(context, row, state);
+        const firstOperationId = operationId ?? `${row.controller_id}:prompt:${crypto.randomUUID()}`;
+        const send = (value, id) => {
+            const file = path.join(row.state_dir, `turn-${String(state.turns + 1).padStart(5, "0")}.md`);
+            fs.writeFileSync(file, `${value}\n`, { flag: "wx", mode: 0o600 });
+            state.turns += 1;
+            saveState(context, row, state);
+            return controllerAdapter(executionContext, row, manifest, session, ["session", "prompt", "--session-id", session.id, "--prompt-file", file, ...sessionArguments(context, manifest, session)], assertOwner, id, cancellation.signal);
+        };
         let receipt;
-        const adapter = controllerAdapter(executionContext, row, manifest, session, ["session", "prompt", "--session-id", session.id, "--prompt-file", file, ...sessionArguments(context, manifest, session)], assertOwner, operationId, cancellation.signal);
         try {
-            receipt = await adapter;
+            try {
+                receipt = await send(text, firstOperationId);
+            }
+            catch (error) {
+                if (runtimeHarness(session.profile) !== "codex-desktop")
+                    throw error;
+                const resumeCommand = hitl ? text.split("\n\n")[1] : undefined;
+                if (hitl && !resumeCommand?.includes(" stage resume "))
+                    throw error;
+                const inspect = (args, id) => runHarnessAdapter({ executable: manifest.adapters["codex-desktop"].executable,
+                    args, env: controllerEnvironment(context, manifest, session), runtimeOwner: session.owner, operationId: id, timeoutMs: 30_000, signal: cancellation.signal });
+                const resumed = await continueCodexCapacity({ error, sessionId: session.id, operationId: firstOperationId,
+                    inspectOperation: id => inspect(["daemon", "operation", "--state-dir", session.state_dir, "--operation-id", id, "--json"], `${id}:capacity-observe`),
+                    inspectSession: () => inspect(["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], `${firstOperationId}:capacity-inspect`),
+                    assertCurrent: () => {
+                        assertOwner();
+                        const view = getFlowRunStatus(executionContext, { projectRoot: manifest.request.project_root, runId: row.run_id });
+                        const next = view.continuation;
+                        if (hitl) {
+                            const answerId = firstOperationId.slice(0, -`:prompt:${row.generation}`.length);
+                            const answer = context.db.get("SELECT input_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND status = 'accepted'", [answerId, row.controller_id]);
+                            const accepted = answer && JSON.parse(answer.input_json);
+                            const pause = view.index.stage_runs.find(item => item.stage === accepted?.stage)?.pause;
+                            if (next.kind !== "paused" || next.stage !== state.stage || !accepted || pause?.id !== accepted.pause_id || pause.work_id !== accepted.work_id || pause.answer_path)
+                                throw new AppError("capacity_continuation_blocked", "Accepted HITL pause changed during capacity wait", 1, { continuation: next });
+                        }
+                        else if (next.stage !== state.stage || ["terminal", "paused", "blocked", "wait"].includes(next.kind)) {
+                            throw new AppError("capacity_continuation_blocked", "RUN changed while native capacity was unavailable", 1, { continuation: next });
+                        }
+                    },
+                    retainIntent: intent => context.db.writeTransaction(() => {
+                        const changed = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_intent: intent }), context.now(), intent.predecessor, row.controller_id, row.generation]);
+                        if (changed.changes !== 1)
+                            throw new AppError("capacity_continuation_blocked", "Failed native operation changed before continuation", 1);
+                        appendEvent(context, row.controller_id, "capacity_continuation", intent);
+                    }),
+                    prompt: (id, value) => send(value, id),
+                    ...(resumeCommand ? { continuationText: `The preceding Turn failed before any tool call. Continue the same accepted HITL answer in this Session. If the pause is still current, run this exact previously issued standalone command once without changing the answer:\n\n${resumeCommand}\n\nDo not accept or deliver the answer again if the pause has changed.` } : {}) });
+                if (!resumed)
+                    throw error;
+                receipt = resumed;
+            }
             checkOutcomes();
             if (fatal)
                 throw fatal;
@@ -545,7 +593,6 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 throw error;
             await stopAfterFailure(error);
             cancellation.abort();
-            await adapter.catch(() => { });
             throw fatal ?? error;
         }
         state.last_receipt = receipt;
@@ -613,7 +660,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 // The accepted answer is logical intent; only its generation-bound
                 // adapter operation represents a physical dispatch that stop must drain.
                 const command = managedLifecycleCommand(executionContext, `${flowCommand(executionContext)} stage resume ${run.id} --stage ${next.stage} --work ${input.work_id} --project-root ${quote([run.project_root])} --answer-file ${quote([input.file])} --json`, { replaceUnobservedAnswer: true });
-                const receipt = await prompt(state.sessions[state.current_session], controllerStageResumePrompt(pause.id, command), `${answer.operation_id}:prompt:${row.generation}`);
+                const receipt = await prompt(state.sessions[state.current_session], controllerStageResumePrompt(pause.id, command), `${answer.operation_id}:prompt:${row.generation}`, "hitl");
                 const afterAnswer = getFlowRunStatus(executionContext, { projectRoot: run.project_root, runId: run.id });
                 if (afterAnswer.index.stage_runs.some(stage => stage.status === "paused" && stage.pause?.id === pause.id)) {
                     throw new AppError("controller_answer_not_applied", "The answer Turn completed without resuming the assigned HITL pause", 1, { pause_id: pause.id, operation_id: answer.operation_id, stage: next.stage, effect: "no_progress" });
@@ -712,7 +759,55 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 throw new AppError("controller_attach_required", "An unfinished Stage has no managed coordinator", 1);
             const session = state.sessions[state.current_session];
             const baseline = new Set(state.native_baseline ?? []);
-            const children = controllerNativeChildren(state.last_receipt ?? {}, session.id).filter(child => !baseline.has(child.session_id));
+            let children = controllerNativeChildren(state.last_receipt ?? {}, session.id).filter(child => !baseline.has(child.session_id));
+            if (runtimeHarness(session.profile) === "codex-desktop" && children.some(child => child.status === "failed")) {
+                const inspected = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                state.last_receipt = inspected;
+                saveState(context, row, state);
+                children = controllerNativeChildren(inspected, session.id).filter(child => !baseline.has(child.session_id));
+                const failed = children.filter(child => child.status === "failed");
+                const child = failed.length === 1 && children.every(item => item === failed[0] || item.status === "completed") ? failed[0] : undefined;
+                const turnId = child?.terminal_turn_id;
+                const native = child && turnId ? { code: "turn_interrupted", details: { provider_session_id: child.session_id, turn_id: turnId, native_turn_id: turnId,
+                        terminal_status: "failed", provider_error: child.provider_error } } : null;
+                const prior = child && state.child_capacity?.[child.session_id];
+                const links = child ? context.db.all("SELECT w.status FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.session_id = ?", [row.project_id, row.run_id, storageSessionId({ harness_id: "codex-desktop", session_id: child.session_id })]) : [];
+                if (child && turnId && native && terminalCodexOverload(native, child.session_id, turnId)
+                    && child.native_turn_items?.observed === true && child.native_turn_items.possible_effects === false
+                    && inspected.settled === true && child.parent_session_id === session.id && links.length <= 1
+                    && (!links.length || links[0].status === "running") && (prior?.attempts ?? 0) < 2) {
+                    if (prior?.turn_id === turnId)
+                        throw new AppError("capacity_child_followup_unconfirmed", "Parent continuation did not start a new native child Turn", 1, { child_session_id: child.session_id, turn_id: turnId });
+                    const attempt = (prior?.attempts ?? 0) + 1;
+                    state.child_capacity ??= {};
+                    state.child_capacity[child.session_id] = { turn_id: turnId, attempts: attempt };
+                    saveState(context, row, state);
+                    const operationId = `${row.controller_id}:child:${digest([child.session_id, turnId]).slice(0, 16)}:followup:${attempt}`;
+                    appendEvent(context, row.controller_id, "capacity_child_followup", { child_session_id: child.session_id, turn_id: turnId, attempt, operation_id: operationId });
+                    await delay(attempt === 1 ? 5_000 : 15_000);
+                    assertOwner();
+                    const current = getFlowRunStatus(executionContext, { projectRoot: manifest.request.project_root, runId: row.run_id });
+                    if (current.continuation.stage !== state.stage || ["terminal", "paused", "blocked", "wait"].includes(current.continuation.kind))
+                        throw new AppError("capacity_child_followup_blocked", "RUN changed during native child capacity wait", 1, { child_session_id: child.session_id });
+                    const fresh = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                    const still = controllerNativeChildren(fresh, session.id).find(item => item.session_id === child.session_id);
+                    const currentLinks = context.db.all("SELECT w.status FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.session_id = ?", [row.project_id, row.run_id, storageSessionId({ harness_id: "codex-desktop", session_id: child.session_id })]);
+                    if (fresh.settled !== true || !still || still.parent_session_id !== session.id || still.status !== "failed" || still.terminal_turn_id !== turnId
+                        || still.native_turn_items?.observed !== true || still.native_turn_items.possible_effects !== false || currentLinks.length > 1
+                        || currentLinks.some(link => link.status !== "running"))
+                        throw new AppError("capacity_child_followup_blocked", "Native child or Work changed during capacity wait", 1, { child_session_id: child.session_id, turn_id: turnId });
+                    assertOwner();
+                    const text = `The existing native child ${child.session_id} has a confirmed effect-free failed Turn. Use the native followup_task tool exactly once for that same child ID with this short message: "Continue your assigned Work from its current durable state. Do not repeat an observed lifecycle command. Finish only the original Work." Do not spawn another child, claim another Work, or perform the child's Work in this parent Turn. End this Turn after the followup_task response.`;
+                    await prompt(session, text, operationId, "child");
+                    const after = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                    state.last_receipt = after;
+                    saveState(context, row, state);
+                    const observed = controllerNativeChildren(after, session.id).find(item => item.session_id === child.session_id);
+                    if (!observed || observed.status === "failed" && observed.terminal_turn_id === turnId)
+                        throw new AppError("capacity_child_followup_unconfirmed", "Native child did not advance to a new Turn after parent followup", 1, { child_session_id: child.session_id, turn_id: turnId });
+                    continue;
+                }
+            }
             const fanout = await nextControllerFanout(executionContext, { projectRoot: run.project_root, runId: run.id, stage: next.stage, harness: runtimeHarness(session.profile), sessionId: session.id, children, policy, profiles });
             assertOwner();
             if (fanout.kind === "none") {

package/dist/services/run-recovery-runtime.js

@@ -56,6 +56,42 @@ export function prepareRunRecoveryDispatch(context, input) {
         return dispatch;
     });
 }
+/** Publish only an exact successor to a failed, effect-free recovery ACK Turn. */
+export function retainRecoveryCapacityIntent(context, input) {
+    const { intent } = input;
+    if (![1, 2].includes(intent.ordinal) || !intent.turn_id || !intent.not_before)
+        throw new AppError("recovery_capacity_intent_invalid", "Recovery capacity successor is invalid", 1);
+    context.db.writeTransaction(() => {
+        const guard = recoveryGuard(context, input.projectId, input.runId);
+        const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared'", [input.recoveryId, input.daemonId]);
+        if (!guard || guard.recovery_id !== input.recoveryId || guard.generation !== input.generation || guard.status !== "resuming" || !binding?.runtime_dispatch_json)
+            throw new AppError("recovery_capacity_owner_changed", "Recovery ACK no longer owns the current generation", 1);
+        const controller = context.db.get("SELECT generation, status FROM run_controllers WHERE controller_id = ? AND project_id = ? AND run_id = ?", [input.controllerId, input.projectId, input.runId]);
+        const control = context.db.get("SELECT status FROM run_controls WHERE recovery_id = ?", [input.recoveryId]);
+        if (controller?.generation !== input.generation || ["completed", "cancelled", "superseded"].includes(controller.status) || control?.status !== "resuming")
+            throw new AppError("recovery_capacity_owner_changed", "Recovery controller or control changed before successor publication", 1);
+        const dispatch = JSON.parse(binding.runtime_dispatch_json);
+        const currentProcess = getResourceDatabase(resourceHome(context)).get("SELECT * FROM managed_processes WHERE id = ?", [dispatch.process_id]);
+        if (!currentProcess || currentProcess.state !== "running" || currentProcess.lease_expires_at <= context.now() || currentProcess.owner_id !== dispatch.owner_id
+            || currentProcess.project_id !== input.projectId || currentProcess.run_id !== input.runId)
+            throw new AppError("recovery_capacity_owner_changed", "Replacement daemon lease changed before successor publication", 1);
+        const prior = dispatch.capacity_intents ?? [];
+        const predecessor = intent.ordinal === 1 ? dispatch.operation_id : prior[0]?.operation_id;
+        if (prior.length !== intent.ordinal - 1 || predecessor !== intent.predecessor || intent.operation_id !== `${dispatch.operation_id}:capacity:${intent.ordinal}:session.prompt`)
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery capacity successor does not extend the pinned ACK", 1);
+        const failed = context.db.get("SELECT status FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [intent.predecessor, input.controllerId, input.generation]);
+        if (failed?.status !== "outcome_unknown")
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery predecessor is not the failed native operation", 1);
+        const next = { ...intent, prompt_sha256: crypto.createHash("sha256").update(input.prompt).digest("hex") };
+        const updated = { ...dispatch, capacity_intents: [...prior, next] };
+        const changed = context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared' AND runtime_dispatch_json = ?", [JSON.stringify(updated), input.recoveryId, input.daemonId, binding.runtime_dispatch_json]);
+        if (changed.changes !== 1)
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery dispatch changed before successor publication", 1);
+        const marked = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_intent: next }), context.now(), intent.predecessor, input.controllerId, input.generation]);
+        if (marked.changes !== 1)
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery predecessor changed before successor publication", 1);
+    });
+}
 /** The caller has already checked PID/start/lease and runtime-home identity. */
 export function recoveryRuntimeAdmission(context, record, input) {
     if (!record.project_id || !record.run_id || !input.daemonId)
@@ -73,8 +109,13 @@ export function recoveryRuntimeAdmission(context, record, input) {
     if (metadata.run_generation !== guard.generation)
         return false;
     if (guard.status === "recovered" && binding.status === "accepted")
-        return true;
+        return !input.operationId?.startsWith(`${dispatch.operation_id}:capacity:`);
     if (guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.resume")
         return typeof dispatch.resume_operation_id === "string" && input.operationId === dispatch.resume_operation_id && input.nativeSessionId === binding.provider_session_id;
-    return guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.prompt" && input.operationId === dispatch.operation_id && input.nativeSessionId === binding.provider_session_id && input.promptSha256 === dispatch.prompt_sha256;
+    const active = dispatch.capacity_intents?.at(-1);
+    if (active && active.not_before > context.now())
+        return false;
+    return guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.prompt"
+        && input.operationId === (active?.operation_id ?? dispatch.operation_id) && input.nativeSessionId === binding.provider_session_id
+        && input.promptSha256 === (active?.prompt_sha256 ?? dispatch.prompt_sha256);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deksden-com/dd-flow-cli",
-  "version": "0.9.0-beta.119",
+  "version": "0.9.0-beta.120",
   "description": "Mechanical runtime CLI for dd-flow workflows.",
   "type": "module",
   "bin": {