@deksden-com/dd-flow-cli 0.9.0-beta.119 → 0.9.0-beta.121

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.120
+
+### Patch Changes
+
+- Continue only confirmed, effect-free Codex `serverOverloaded` Turns in the same Session with bounded backoff and retained owner, budget, HITL, Work, MERGE, and recovery admission. Preserve exact native child Turn evidence and fail closed when effects are unknown.
+- Distinguish hard provider quota from short rate limiting and ambiguous 429 responses across AGY, ZCode, and OpenCode.
+
 ## 0.9.0-beta.119
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.119",
-  "cli_commit": "9bf32901c2f926dd5819e3695dbab4fae1869724",
-  "built_at": "2026-09-28T13:03:08.769Z",
+  "cli_version": "0.9.0-beta.121",
+  "cli_commit": "2e7bef9a7813bd003855d94b394e63d8aa5f6419",
+  "built_at": "2026-09-29T16:13:36.621Z",
   "built_with_canon": {
     "version": "4.1.1",
     "commit": "678daa038287c948ada5b2d785a6dcc925c7b891",

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -327,10 +327,11 @@ export class Runtime {
       this.active = null;
       const message = String(result.error ?? "Antigravity returned ERROR"); const normalized = message.toLowerCase();
       const code = result.status === "CANCELLED" ? "agy_turn_cancelled" : /quota|insufficient.?credit|billing|usage limit/.test(normalized) ? "agy_provider_quota_exhausted"
-        : /rate.?limit|too many requests|\b429\b/.test(normalized) ? "agy_provider_rate_limited"
+        : /rate.?limit|too many requests/.test(normalized) ? "agy_provider_rate_limited"
+          : /\b429\b/.test(normalized) ? "agy_provider_limit_unknown"
           : /auth|unauthori[sz]ed|forbidden|account/.test(normalized) ? "agy_provider_account"
             : "agy_provider_failed";
-      return current.reject(new DaemonError(code, message, ["agy_provider_quota_exhausted", "agy_provider_rate_limited"].includes(code), { provider_result: result, provider_error_scope: current.previousError && current.previousError === result.error ? "repeated_conversation_error" : "terminal_result", usage_ingest: this.usageIngest }));
+      return current.reject(new DaemonError(code, message, code === "agy_provider_rate_limited", { provider_result: result, provider_error_scope: current.previousError && current.previousError === result.error ? "repeated_conversation_error" : "terminal_result", usage_ingest: this.usageIngest }));
     }
     await this.completePendingTurn();
   }

package/dist/harness-runtime/lib/dd-codex.d.mts

@@ -0,0 +1 @@
+export function terminalCodexOverload(error: unknown, expectedSessionId: string, expectedTurnId?: string): boolean;

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -52,7 +52,7 @@ class Journal {
 }
 
 export class CodexBridge {
-  constructor(options = {}) { this.options = options; this.nextId = 1; this.pending = new Map(); this.lateResponses = new Map(); this.turns = new Map(); this.finalMessages = new Map(); this.descendants = new Map(); this.journal = new Journal(options.journal); this.stderr = ""; this.requestedProfiles = new Map(); this.modelObservations = Promise.resolve(); }
+  constructor(options = {}) { this.options = options; this.nextId = 1; this.pending = new Map(); this.lateResponses = new Map(); this.turns = new Map(); this.nativeErrors = new Map(); this.finalMessages = new Map(); this.descendants = new Map(); this.journal = new Journal(options.journal); this.stderr = ""; this.requestedProfiles = new Map(); this.modelObservations = Promise.resolve(); }
 
   async start() {
     const bin = this.options.bin ?? process.env.DD_CODEX_BIN ?? "codex";
@@ -120,11 +120,16 @@ export class CodexBridge {
       message.error ? pending.reject(Object.assign(new Error(message.error.message ?? JSON.stringify(message.error)), { code: "rpc_error", details: message.error })) : pending.resolve(message.result ?? {});
       return;
     }
-    if (message.method === "turn/completed") this.turns.set(message.params?.turn?.id ?? message.params?.threadId, { status: "completed", value: message.params });
-    if (message.method === "turn/started") this.turns.set(message.params?.turn?.id ?? message.params?.threadId, { status: "running", value: message.params });
+    if (message.method === "error" && message.params?.threadId && message.params?.turnId) {
+      const key = `${message.params.threadId}:${message.params.turnId}`;
+      this.nativeErrors.set(key, { error: message.params.error, willRetry: message.params.willRetry });
+      while (this.nativeErrors.size > 128) this.nativeErrors.delete(this.nativeErrors.keys().next().value);
+    }
+    if (message.method === "turn/completed") this.turns.set(message.params?.turn?.id ?? message.params?.threadId, { status: "completed", value: message.params, threadId: message.params?.threadId });
+    if (message.method === "turn/started" && this.turns.get(message.params?.turn?.id)?.status !== "completed") this.turns.set(message.params?.turn?.id ?? message.params?.threadId, { status: "running", value: message.params, threadId: message.params?.threadId });
     const threadId = message.params?.threadId;
     if (threadId && message.method === "item/started") this.finalMessages.delete(threadId);
-    if (threadId && message.method === "item/completed" && message.params?.item?.type === "agentMessage") this.finalMessages.set(threadId, { item: message.params.item, completedAt: Date.now() });
+    if (threadId && message.method === "item/completed" && message.params?.item?.type === "agentMessage") this.finalMessages.set(threadId, { item: message.params.item, turnId: message.params?.turnId ?? null, completedAt: Date.now() });
   }
 
   isManagedHook(run) {
@@ -217,13 +222,27 @@ export class CodexBridge {
   observeTopology(value, depth = 0) {
     if (!value || typeof value !== "object" || depth > 8) return;
     if (Array.isArray(value)) { for (const item of value) this.observeTopology(item, depth + 1); return; }
+    if (depth === 0 && ["turn/started", "turn/completed"].includes(value.method)) {
+      const { threadId, turn } = value.params ?? {};
+      const previous = this.descendants.get(threadId);
+      if (previous && typeof turn?.id === "string" && turn.id) {
+        if (value.method === "turn/started" && previous.active_turn_id !== turn.id && this.turns.get(turn.id)?.status !== "completed") {
+          this.descendants.set(threadId, { ...previous, status: "running", active_turn_id: turn.id, terminal_turn_id: null, provider_error: null });
+        } else if (value.method === "turn/completed" && (!previous.active_turn_id || previous.active_turn_id === turn.id)) {
+          this.descendants.set(threadId, { ...previous, status: turn.status === "completed" ? "completed" : turn.status ?? "unknown",
+            active_turn_id: turn.id, terminal_turn_id: turn.id, terminal_observed_at: now(), provider_error: nativeTurnError(this, threadId, turn), native_turn_items: turnItemEvidence(turn) });
+        }
+      }
+    }
     const activity = value.params?.item;
     const activityParent = value.params?.threadId;
     if (activity?.type === "subAgentActivity" && typeof activity.agentThreadId === "string" && activity.agentThreadId &&
         typeof activityParent === "string" && activityParent && activity.agentThreadId !== activityParent) {
       const previous = this.descendants.get(activity.agentThreadId);
       const observed = activity.kind === "completed" ? "completed" : activity.kind === "interrupted" ? "interrupted" : "running";
-      const status = previous?.status === "completed" ? "completed" : observed;
+      // Parent activity has no child Turn identity on some app-server builds.
+      // It can discover a child, but cannot reopen or close a later known Turn.
+      const status = previous?.active_turn_id || previous?.status === "completed" ? previous.status : observed;
       this.descendants.set(activity.agentThreadId, { ...previous, provider_session_id: activity.agentThreadId,
         parent_provider_session_id: activityParent, status, agent_path: activity.agentPath ?? previous?.agent_path ?? null,
         source: "codex.app_server.subAgentActivity" });
@@ -234,7 +253,7 @@ export class CodexBridge {
         if (typeof child !== "string" || !child || child === value.senderThreadId) continue;
         const previous = this.descendants.get(child);
         this.descendants.set(child, { ...previous, provider_session_id: child, parent_provider_session_id: value.senderThreadId,
-          status: previous?.status === "completed" ? "completed" : value.agentsStates?.[child]?.status ?? "unknown", source: "codex.app_server" });
+          status: previous?.status === "completed" || previous?.active_turn_id ? previous.status : value.agentsStates?.[child]?.status ?? previous?.status ?? "unknown", source: "codex.app_server" });
       }
     }
     const id = value.threadId ?? value.id ?? null;
@@ -242,7 +261,7 @@ export class CodexBridge {
     if (typeof id === "string" && id && typeof parent === "string" && parent) {
       const previous = this.descendants.get(id);
       this.descendants.set(id, { ...previous, provider_session_id: id, parent_provider_session_id: parent,
-        status: previous?.status === "completed" ? "completed" : value.status?.type ?? value.status ?? "unknown", source: "codex.app_server" });
+        status: previous?.status === "completed" || previous?.active_turn_id ? previous.status : value.status?.type ?? value.status ?? previous?.status ?? "unknown", source: "codex.app_server" });
     }
     for (const child of Object.values(value)) this.observeTopology(child, depth + 1);
   }
@@ -306,6 +325,18 @@ async function withBridge(options, action) { const bridge = new CodexBridge(opti
 function profile(options) { return { harness: "codex-desktop", model: options.model ?? null, reasoning: options.reasoning ?? null }; }
 function threadId(result) { const id = result?.thread?.id ?? result?.threadId; return required(id, "Codex thread id"); }
 function directChildren(bridge, sessionId) { return typeof bridge?.directChildren === "function" ? bridge.directChildren(sessionId) : []; }
+async function observedChildren(bridge, sessionId) {
+  const children = directChildren(bridge, sessionId);
+  let reads = 0;
+  return await Promise.all(children.map(async child => {
+    if (child.status !== "failed" || !child.terminal_turn_id || reads++ >= 16) return child;
+    const observed = await readTurn(bridge, child.provider_session_id, child.terminal_turn_id, true);
+    const turn = observed?.turn;
+    if (turn?.id !== child.terminal_turn_id || turn.status !== child.status) return child;
+    return { ...child, provider_error: nativeTurnError(bridge, child.provider_session_id, turn) ?? child.provider_error,
+      native_turn_items: turnItemEvidence(turn) };
+  }));
+}
 function codexSessionConfig() { return { ...CODEX_SESSION_CONFIG }; }
 
 async function requestConfiguredThread(bridge, method, params, timeoutMs) {
@@ -399,11 +430,24 @@ export async function promptSessionWithBridge(bridge, options) {
   bridge.assertHookHealthy?.(sessionId);
   const started = await bridge.request("turn/start", { threadId: sessionId, input: [{ type: "text", text: prompt }], cwd, model: options.model ?? null, effort: options.reasoning ?? null, approvalPolicy: "never", sandboxPolicy: { type: "dangerFullAccess" } }, options.timeoutMs ?? 1_800_000);
   const turn = started?.turn ?? started; const turnId = turn?.id ?? null;
-  const completed = await waitForTurn(bridge, sessionId, turnId, options.timeoutMs ?? 1_800_000, options, cwd);
+  let completed;
+  try { completed = await waitForTurn(bridge, sessionId, turnId, options.timeoutMs ?? 1_800_000, options, cwd); }
+  catch (error) {
+    if (error?.code === "turn_interrupted") {
+      try {
+        const observed = await readTurn(bridge, sessionId, turnId, true);
+        if (observed?.turn?.id === turnId && observed.turn.status === error.details?.terminal_status) {
+          error.details.native_turn_items = turnItemEvidence(observed.turn);
+          error.details.provider_error ??= observed.turn.error ?? null;
+        }
+      } catch { /* The primary native terminal failure remains authoritative. */ }
+    }
+    throw error;
+  }
   const thread = await readCompletedThread(bridge, sessionId);
   bridge.assertHookHealthy?.(sessionId);
-  const assistantText = latestAssistantText(thread) ?? latestAssistantText(completed);
-  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, turn_id: turnId, status: "completed", turn: completed, ...(thread ? { thread: threadReceipt(thread) } : {}), descendants: directChildren(bridge, sessionId), ...(assistantText ? { assistant_text: assistantText } : {}), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread?.model ?? null, reasoning: thread?.reasoningEffort ?? null, provider: thread?.modelProvider ?? null }, "thread/read.after_turn") };
+  const assistantText = latestAssistantText(thread?.turns?.find(item => item?.id === turnId)) ?? latestAssistantText(completed);
+  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, turn_id: turnId, status: "completed", turn: completed, ...(thread ? { thread: threadReceipt(thread) } : {}), descendants: await observedChildren(bridge, sessionId), ...(assistantText ? { assistant_text: assistantText } : {}), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread?.model ?? null, reasoning: thread?.reasoningEffort ?? null, provider: thread?.modelProvider ?? null }, "thread/read.after_turn") };
 }
 
 async function ensureThreadLoaded(bridge, sessionId, options, cwd) {
@@ -428,23 +472,23 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd) {
   let nextStoredReadAt = Date.now();
   while (!clock.sample(bridge.activity?.get(sessionId))) {
     bridge.assertHookHealthy?.(sessionId);
-    const known = bridge.turns.get(turnId) ?? bridge.turns.get(sessionId); if (known?.status === "completed") return terminalTurn(known.value, turnId, bridge);
+    const known = bridge.turns.get(turnId) ?? bridge.turns.get(sessionId); if (known?.status === "completed" && (!known.threadId || known.threadId === sessionId)) return terminalTurn(known.value, sessionId, turnId, bridge);
     if (Date.now() >= nextStoredReadAt) {
       const stored = await readTurn(bridge, sessionId, turnId, false);
-      if (stored?.turn && isAuthoritativeTerminal(bridge, turnId, stored.turn.status, stored.threadStatus, failureNotBefore)) return terminalTurn({ turn: stored.turn }, turnId, bridge);
+      if (stored?.turn && isAuthoritativeTerminal(bridge, turnId, stored.turn.status, stored.threadStatus, failureNotBefore)) return terminalTurn({ turn: stored.turn }, sessionId, turnId, bridge);
       // A loaded app-server can retain a stale `active` Thread state after a
       // provider-side interruption. The persisted turn page is independent of
       // that live subscription and is the compact authority for its terminal
       // status; unlike `includeTurns`, it never hydrates the whole history.
       const persisted = await readPersistedTurn(bridge, sessionId, turnId);
-      if (persisted && isAuthoritativeTerminal(bridge, turnId, persisted.status, stored?.threadStatus, failureNotBefore)) return terminalTurn({ turn: persisted }, turnId, bridge);
+      if (persisted && isAuthoritativeTerminal(bridge, turnId, persisted.status, stored?.threadStatus, failureNotBefore)) return terminalTurn({ turn: persisted }, sessionId, turnId, bridge);
       // Desktop may unload an idle Thread immediately after an interrupted
       // Turn. Reload it once before polling again: otherwise the compact
       // status remains `notLoaded` forever and hides the terminal Turn.
       if (stored?.threadStatus === "notLoaded") {
         await ensureThreadLoaded(bridge, sessionId, options, cwd);
         const hydrated = await readTurn(bridge, sessionId, turnId, true);
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, turnId, bridge);
+        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
       }
       // Some app-server versions correctly omit turns for a compact read.
       // Once the thread is idle, hydrate exactly once to recover the terminal
@@ -455,7 +499,7 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd) {
         // an inProgress Turn after emitting the final agent message; treating
         // that stale Turn as terminal incorrectly aborts an otherwise usable
         // worker session.
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, turnId, bridge);
+        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
       }
       // Some app-server builds emit a final agent message but omit both the
       // terminal event and the compact turn record. Wait briefly, hydrate once,
@@ -464,10 +508,10 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd) {
       // Agent messages are streamed as completed items while a Turn is still
       // reasoning and calling tools.  They are terminal evidence only after
       // app-server reports the Thread idle.
-      if (final && stored?.threadStatus === "idle" && Date.now() - final.completedAt >= 1_000) {
+      if (final?.turnId === turnId && stored?.threadStatus === "idle" && Date.now() - final.completedAt >= 1_000) {
         const hydrated = await readTurn(bridge, sessionId, turnId, true);
-        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, turnId, bridge);
-        return terminalTurn({ turn: { id: turnId, status: "completed", synthetic: true, final_message: final.item } }, turnId, bridge);
+        if (hydrated?.turn && isAuthoritativeTerminal(bridge, turnId, hydrated.turn.status, hydrated.threadStatus, failureNotBefore)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
+        return terminalTurn({ turn: { id: turnId, status: "completed", synthetic: true, final_message: final.item } }, sessionId, turnId, bridge);
       }
       nextStoredReadAt = Date.now() < failureNotBefore ? failureNotBefore : Date.now() + 15_000;
     }
@@ -476,15 +520,48 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd) {
   fail("Codex turn timed out", "turn_timeout");
 }
 
-function terminalTurn(value, turnId, bridge) {
+function terminalTurn(value, sessionId, turnId, bridge) {
   // A terminal event may arrive while an older snapshot RPC is in flight.
   const observed = bridge.turns.get(turnId);
-  if (observed?.status === "completed") value = observed.value;
+  if (observed?.status === "completed" && (!observed.threadId || observed.threadId === sessionId)) value = observed.value;
   const turn = value?.turn ?? value;
-  if (turn?.status && turn.status !== "completed") fail(`Codex turn ${turnId ?? "unknown"} ended as ${turn.status}`, "turn_interrupted", { turn_id: turn.id ?? turnId ?? null, terminal_status: turn.status, provider_error: turn.error ?? turn.codexErrorInfo ?? null });
+  if (turn?.id && turn.id !== turnId || value?.threadId && value.threadId !== sessionId) fail("Codex terminal Turn identity does not match the requested Session/Turn", "turn_identity_mismatch", { provider_session_id: sessionId, turn_id: turnId, native_thread_id: value?.threadId ?? null, native_turn_id: turn?.id ?? null });
+  const providerError = nativeTurnError(bridge, sessionId, turn);
+  if (turn?.status && turn.status !== "completed") fail(`Codex turn ${turnId ?? "unknown"} ended as ${turn.status}`, "turn_interrupted", { provider_session_id: sessionId, turn_id: turnId, native_turn_id: turn.id ?? null, terminal_status: turn.status, observed_at: now(),
+    provider_error: providerError, native_turn_items: turnItemEvidence(turn) });
   return value;
 }
 
+function nativeTurnError(bridge, sessionId, turn) {
+  const native = bridge.nativeErrors?.get(`${sessionId}:${turn?.id}`);
+  const error = turn?.error && typeof turn.error === "object" && native?.error && typeof native.error === "object"
+    ? { ...native.error, ...turn.error } : turn?.error ?? native?.error ?? (turn?.codexErrorInfo ? { codexErrorInfo: turn.codexErrorInfo } : null);
+  return error && native?.willRetry !== undefined && typeof error === "object" ? { ...error, willRetry: native.willRetry } : error;
+}
+
+function turnItemEvidence(turn) {
+  const items = turn?.items;
+  return Array.isArray(items) && turn?.itemsView !== "notLoaded" ? { observed: true, count: items.length, types: items.map(item => item?.type ?? "unknown"),
+    possible_effects: items.some(item => !["agentMessage", "reasoning", "userMessage"].includes(item?.type)) } : { observed: false };
+}
+
+export function terminalCodexOverload(error, expectedSessionId, expectedTurnId) {
+  let current = error;
+  for (let depth = 0; depth < 4 && current && typeof current === "object"; depth += 1) {
+    if (current.code === "turn_interrupted") {
+      const details = current.details ?? {}, native = details.provider_error;
+      const code = native?.codexErrorInfo;
+      return details.terminal_status === "failed" && typeof details.provider_session_id === "string" && details.provider_session_id === expectedSessionId
+        && typeof details.turn_id === "string" && Boolean(details.turn_id) && details.native_turn_id === details.turn_id
+        && (expectedTurnId === undefined || details.turn_id === expectedTurnId)
+        && (code === "serverOverloaded" || code?.code === "serverOverloaded");
+    }
+    if (current.code !== "harness_adapter_failed") return false;
+    current = current.details?.cause ?? current.cause;
+  }
+  return false;
+}
+
 function isTerminalTurnStatus(status) { return ["completed", "failed", "interrupted", "cancelled"].includes(status); }
 function isAuthoritativeTerminal(bridge, turnId, status, threadStatus, failureNotBefore) {
   if (!isTerminalTurnStatus(status)) return false;
@@ -518,7 +595,7 @@ async function readCompletedThread(bridge, sessionId) {
 }
 
 function latestAssistantText(value) {
-  const messages = value?.messages ?? value?.items ?? value?.turn?.items ?? [];
+  const messages = value?.messages ?? value?.items ?? value?.turn?.items ?? (value?.turn?.final_message ? [value.turn.final_message] : []);
   if (!Array.isArray(messages)) return null;
   for (const message of [...messages].reverse()) {
     if (message?.role !== "assistant" && message?.type !== "agentMessage") continue;
@@ -538,7 +615,7 @@ export async function inspectSession(options) {
 
 export async function inspectSessionWithBridge(bridge, options) {
   const sessionId = required(options.sessionId, "--session-id"); const value = await bridge.request("thread/read", { threadId: sessionId, includeTurns: false }); const thread = value?.thread ?? value;
-  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, status: thread.status ?? null, thread: threadReceipt(thread), descendants: directChildren(bridge, sessionId), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread.model ?? null, reasoning: thread.reasoningEffort ?? null, provider: thread.modelProvider ?? null }, "thread/read") };
+  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, status: thread.status ?? null, thread: threadReceipt(thread), descendants: await observedChildren(bridge, sessionId), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread.model ?? null, reasoning: thread.reasoningEffort ?? null, provider: thread.modelProvider ?? null }, "thread/read") };
 }
 
 export async function cancelSession(options) {

package/dist/harness-runtime/lib/dd-grok-daemon.mjs

@@ -315,7 +315,7 @@ export class Runtime {
     // creation/end_turn receipt can then establish an idle root. Dispatch
     // clears that receipt before sending any subsequent productive request.
     const receipt = this.sessions.get(result?.provider_session_id)?.native_root_receipt;
-    if (status === "unknown" && ["created", "end_turn", "cancelled"].includes(receipt?.kind)) return false;
+    if (status === "unknown" && ["created", "end_turn", "cancelled", "failed"].includes(receipt?.kind)) return false;
     return !["completed", "failed", "cancelled", "stopped", "idle"].includes(status);
   }
   async refreshTree(cancel = false) {
@@ -356,7 +356,17 @@ export class Runtime {
       const running = name === "session.archive" ? false : this.treeRunning(result);
       await this.persist({ active_tree: running, active_operation: null });
       return { ...result, descendants: this.topology(result.provider_session_id), settled: !running };
-    } catch (error) { await this.persist({ active_tree: true, active_operation: null }); throw error; }
+    } catch (error) {
+      // A matched JSON-RPC error completes this native prompt request. It is
+      // root-turn proof, not proof that any descendants have stopped. A lost
+      // response, bridge error, or failure before dispatch earns no receipt.
+      const response = error?.details?.terminal_response;
+      if (name === "session.prompt" && response?.method === "session/prompt" && response.session_id === sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (session) session.native_root_receipt = { kind: "failed", daemon_id: this.state.daemon_id, request_id: response.request_id };
+      }
+      await this.persist({ active_tree: true, active_operation: null }); throw error;
+    }
     finally { this.active = null; }
   }
   async dispatch(operation, params) {

package/dist/harness-runtime/lib/dd-opencode.mjs

@@ -68,8 +68,8 @@ export class OpenCodeClient {
         const native = reply.info.error;
         const message = native.data?.message ?? native.message ?? native.name ?? "OpenCode provider failed";
         const status = native.data?.statusCode;
-        const code = status === 429 || /rate limit/i.test(message) ? "provider_rate_limited" : status === 402 || /payment required|quota|usage balance exhausted/i.test(message) ? "provider_quota_exhausted" : "opencode_provider_failed";
-        throw new OpenCodeError(code, message, native.data?.isRetryable === true || code === "provider_rate_limited", { session_id: id, message_id: reply.info.id, provider_error: native });
+        const code = status === 402 || /payment required|quota|usage balance exhausted|insufficient.?credit|billing/i.test(message) ? "provider_quota_exhausted" : /rate.?limit|too many requests/i.test(message) ? "provider_rate_limited" : status === 429 ? "provider_limit_unknown" : "opencode_provider_failed";
+        throw new OpenCodeError(code, message, code === "provider_rate_limited", { session_id: id, message_id: reply.info.id, provider_error: native });
       }
       return reply;
     }

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -268,9 +268,11 @@ export class AcpBridge {
         const error = new Error(messageText);
         const nativeCode = typeof data?.code === "string" ? data.code : typeof data?.native_code === "string" ? data.native_code : null;
         const unknown = ["native_timeout", "native_backend_dead", "native_backend_pipe_broken", "native_outcome_unknown"].includes(nativeCode);
-        error.code = unknown ? nativeCode : /rate limit/i.test(messageText) ? "provider_rate_limited" : /payment required|usage balance exhausted/i.test(messageText) ? "provider_quota_exhausted" : "acp_request_failed";
-        error.retryable = !unknown && /rate limit/i.test(messageText);
-        error.details = { acp_code: message.error.code ?? null, ...(data ? { native: data } : {}), ...(details ? { provider_details: details } : {}), ...(providerDetails ? { provider_update: provider } : {}) };
+        error.code = unknown ? nativeCode : /payment required|quota|usage balance exhausted|insufficient.?credit|billing/i.test(messageText) ? "provider_quota_exhausted" : /rate.?limit|too many requests/i.test(messageText) ? "provider_rate_limited" : /\b429\b/.test(messageText) ? "provider_limit_unknown" : "acp_request_failed";
+        error.retryable = error.code === "provider_rate_limited";
+        error.details = { acp_code: message.error.code ?? null,
+          terminal_response: { method: pending.method, session_id: pending.sessionId, request_id: message.id },
+          ...(data ? { native: data } : {}), ...(details ? { provider_details: details } : {}), ...(providerDetails ? { provider_update: provider } : {}) };
         pending.reject(error);
       }
       else { pending.resolve(message.result ?? {}); }

package/dist/services/code-checks.js

@@ -9,11 +9,51 @@ import { assertRunMutationAllowed } from "./run-recovery.js";
 import { AppError } from "../shared/errors.js";
 import { confirmManagedProcess, finishManagedProcess, heartbeatManagedProcess, managedProcessStatus, managedProcessRuntimeHome, managedOwnerIsAlive, processTreeIsAlive, registerManagedProcess, reservePorts } from "./managed-processes.js";
 import { admitRuntimeCheck, runtimeBudgetForRun } from "./runtime-budget.js";
+import { getResourceDatabase } from "../storage/database.js";
 const profileRelativePath = path.join(".memory-bank", "spec", "engineering", "code-check-profile.json");
 // Receipt reservation precedes child spawn so an interrupted CLI leaves an
 // auditable attempt. A second caller must not mistake that small handoff window
 // for a dead check and overwrite its outcome.
 const receiptStartingGraceMs = 30_000;
+/** The check writer proves an empty tree before marking its registration terminal. */
+export function terminalCheckSettled(context, record) {
+    if (record.kind !== "check" || !record.check_id || record.owner_id !== `check:${record.check_id}` || !record.project_id || !record.run_id
+        || !record.pid || !record.pid_started_at || !["stopped", "failed"].includes(record.state) || !record.finished_at)
+        return null;
+    let metadata;
+    try {
+        metadata = JSON.parse(record.metadata_json);
+    }
+    catch {
+        return null;
+    }
+    if (metadata.role !== "check" || managedProcessRuntimeHome(record, context) !== context.ddFlowHome)
+        return null;
+    let resource;
+    try {
+        resource = getResourceDatabase(context.env.DD_FLOW_RESOURCE_HOME ?? context.ddFlowHome, "read_existing");
+    }
+    catch {
+        return null;
+    }
+    try {
+        const current = resource.get("SELECT * FROM managed_processes WHERE id = ?", [record.id]);
+        if (!current || current.lease_token !== record.lease_token || current.owner_id !== record.owner_id || current.pid !== record.pid
+            || current.pid_started_at !== record.pid_started_at || current.metadata_json !== record.metadata_json || current.state !== record.state
+            || current.project_id !== record.project_id || current.run_id !== record.run_id || current.work_id !== record.work_id
+            || current.check_id !== record.check_id || current.finished_at !== record.finished_at)
+            return null;
+        const receipt = context.db.get("SELECT status, finished_at, work_id FROM check_receipts WHERE id = ? AND project_id = ? AND run_id = ?", [record.check_id, record.project_id, record.run_id]);
+        return receipt && receipt.work_id === record.work_id && ["passed", "failed", "aborted"].includes(receipt.status) && receipt.finished_at
+            ? { status: receipt.status, finished_at: receipt.finished_at } : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        resource.close?.();
+    }
+}
 export function codeExecutionEnvironment(workspaceRoot) {
     const suffix = crypto.createHash("sha256").update(path.resolve(workspaceRoot)).digest("hex").slice(0, 12);
     // The managed CLI's Node must win over a provider app's PATH: a Rosetta

package/dist/services/codex-capacity.js

@@ -0,0 +1,71 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { terminalCodexOverload } from "../harness-runtime/lib/dd-codex.mjs";
+/** Only a terminal, effect-free native Turn may get another productive Turn. */
+export async function continueCodexCapacity(input) {
+    let { error, operationId } = input;
+    for (let ordinal = 1; ordinal <= 2; ordinal += 1) {
+        if (!terminalCodexOverload(error, input.sessionId)) {
+            if (ordinal === 1)
+                return null;
+            throw error;
+        }
+        let prior;
+        try {
+            prior = await input.inspectOperation(operationId);
+        }
+        catch {
+            if (ordinal === 1)
+                return null;
+            throw error;
+        }
+        const failure = prior.error;
+        const turnId = failure?.details?.turn_id;
+        if (prior.operation_id !== operationId || prior.operation !== "session.prompt" || prior.session_id !== input.sessionId
+            || prior.state !== "failed" || prior.primary_error || !turnId || !terminalCodexOverload(failure, input.sessionId, turnId)
+            || failure.details?.native_turn_items?.observed !== true || failure.details.native_turn_items.possible_effects !== false) {
+            if (ordinal === 1)
+                return null;
+            throw error;
+        }
+        const settled = async () => {
+            const seen = await input.inspectSession();
+            const settlement = seen.settlement;
+            const ids = Array.isArray(seen.tree_session_ids) ? seen.tree_session_ids : [];
+            const observations = Array.isArray(seen.tree_observations) ? seen.tree_observations : [];
+            const treeProven = input.allowSettledDescendants
+                ? ids.length > 0 && ids[0] === input.sessionId && observations.length === ids.length
+                    && ids.every(id => observations.some(item => item.provider_session_id === id && item.settled === true))
+                    && Array.isArray(seen.unsettled_sessions) && seen.unsettled_sessions.length === 0
+                : ids.length === 1 && ids[0] === input.sessionId;
+            return seen.provider_session_id === input.sessionId && seen.settled === true && treeProven
+                && (!settlement || ["settled", "not_required"].includes(settlement.state ?? ""));
+        };
+        input.assertCurrent();
+        try {
+            if (!await settled()) {
+                if (ordinal === 1)
+                    return null;
+                throw error;
+            }
+        }
+        catch {
+            if (ordinal === 1)
+                return null;
+            throw error;
+        }
+        const nextId = `${input.operationId}:capacity:${ordinal}:session.prompt`;
+        input.retainIntent({ predecessor: operationId, operation_id: nextId, turn_id: turnId, ordinal, not_before: new Date(Date.now() + (ordinal === 1 ? 5_000 : 15_000)).toISOString() });
+        await delay(ordinal === 1 ? 5_000 : 15_000);
+        input.assertCurrent();
+        if (!await settled().catch(() => false))
+            throw error;
+        try {
+            return await input.prompt(nextId, input.continuationText ?? "Continue the same assigned task in this Session. Check current durable RUN, Work and Stage state first. Never repeat an observed lifecycle command, accepted HITL answer, check or merge apply; use only an exact issued successor. Stop at the assigned boundary.", ordinal);
+        }
+        catch (nextError) {
+            error = nextError;
+            operationId = nextId;
+        }
+    }
+    throw error;
+}

package/dist/services/controller-fanout.js

@@ -136,7 +136,10 @@ export function controllerNativeChildren(receipt, rootSessionId) {
         const status = ["completed", "complete", "done", "success", "succeeded"].includes(state) ? "completed" : state === "settled_by_root" ? "settled_by_root" : ["failed", "error"].includes(state) ? "failed" : ["cancelled", "canceled", "interrupted"].includes(state) ? "cancelled" : ["running", "active", "pending"].includes(state) ? "running" : fallback;
         const rootChild = parent === rootSessionId;
         const settled = rootChild && status === "unknown" && settledTree.has(id) ? "settled_by_root" : status;
-        candidates.push({ session_id: id, parent_session_id: parent ?? "", status: settled, source, ...(rootChild ? {} : { provenance: "parent_mismatch" }) });
+        candidates.push({ session_id: id, parent_session_id: parent ?? "", status: settled, source, ...(rootChild ? {} : { provenance: "parent_mismatch" }),
+            ...(text(value, ["terminal_turn_id"]) ? { terminal_turn_id: text(value, ["terminal_turn_id"]) } : {}),
+            ...(value.provider_error !== undefined ? { provider_error: value.provider_error } : {}),
+            ...(value.native_turn_items && typeof value.native_turn_items === "object" ? { native_turn_items: value.native_turn_items } : {}) });
     };
     for (const value of list(receipt.descendants))
         add(value, "adapter.descendants");
@@ -166,6 +169,15 @@ export function controllerNativeChildren(receipt, rootSessionId) {
         }
         if (previous && rank[previous.status] === 3 && rank[child.status] === 3 && previous.status !== child.status)
             throw new AppError("native_child_outcome_conflict", "Native child has contradictory terminal outcomes", 1, { session_id: child.session_id, observations: [previous, child] });
+        if (previous && previous.status === child.status && previous.terminal_turn_id && child.terminal_turn_id && previous.terminal_turn_id !== child.terminal_turn_id)
+            throw new AppError("native_child_turn_conflict", "Native child has contradictory terminal Turn identities", 1, { session_id: child.session_id, observations: [previous, child] });
+        if (previous && previous.status === child.status) {
+            unique.set(child.session_id, { ...previous, ...child,
+                ...(child.terminal_turn_id ?? previous.terminal_turn_id ? { terminal_turn_id: child.terminal_turn_id ?? previous.terminal_turn_id } : {}),
+                ...(child.provider_error ?? previous.provider_error ? { provider_error: child.provider_error ?? previous.provider_error } : {}),
+                ...(child.native_turn_items ?? previous.native_turn_items ? { native_turn_items: child.native_turn_items ?? previous.native_turn_items } : {}) });
+            continue;
+        }
         if (!previous || rank[child.status] > rank[previous.status])
             unique.set(child.session_id, child);
     }

package/dist/services/external-work-launch.js

@@ -16,6 +16,8 @@ import { reviewExecutionCopyHash, reviewSourceFilter, reviewSourceHash, reviewSo
 import { workspaceGitFiles } from "./workspace-files.js";
 import { qualifyAgyHooks } from "../harness-runtime/lib/dd-agy-daemon.mjs";
 import { lifecycleRetryInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { continueCodexCapacity } from "./codex-capacity.js";
+import { errorRecord } from "./run-controller-state.js";
 /**
  * Creates an external provider root for one already-created Work.  The launch
  * is not a Work claim: only the worker's trusted `work start` hook binds it.
@@ -91,7 +93,7 @@ export async function launchExternalWork(context, input) {
     const common = ["--dd-flow-bin", flowExecutable, "--state-dir", root, "--journal", journal, "--cwd", isolatedWorkspace ?? run.workspace_root, "--provider", resolved.worker.provider, "--model", resolved.worker.model, "--reasoning", resolved.worker.reasoning, "--mode", resolved.worker.mode, "--permission", resolved.worker.permission, "--project-root", run.project_root, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, runtimeHarness(resolved.worker)), "--json"];
     const evidence = (value) => fs.appendFileSync(journal, `${JSON.stringify({ type: "adapter_call", at: context.now(), ...value })}\n`);
     try {
-        const call = (args, timeoutMs) => runHarnessAdapter({ executable, args, env: runtimeContext.env, operationId: `${operationId}:${args[0]}.${args[1]}`, runtimeOwner, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), onEvidence: evidence });
+        const call = (args, timeoutMs, id = `${operationId}:${args[0]}.${args[1]}`) => runHarnessAdapter({ executable, args, env: runtimeContext.env, operationId: id, runtimeOwner, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), onEvidence: evidence });
         await call(["daemon", "start", ...common]);
         assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
         const created = await call(["session", "create", ...common], runtimeHarness(resolved.worker) === "zcode-acp" ? 180_000 : undefined);
@@ -108,13 +110,45 @@ export async function launchExternalWork(context, input) {
             throw new AppError("read_only_input_changed", "Authoritative review workspace changed after the execution copy was made", 2, { work_id: work.work_id });
         const promptFile = path.join(root, "launch.md");
         fs.writeFileSync(promptFile, `Start the assigned Work now. Your first tool call must be this exact standalone command:\n\n${workStartCommand(runtimeContext, work)}\n\nUse the packet returned by that command. Do not claim another Work or run this command more than once.\n\n${lifecycleRetryInstruction}${isolatedWorkspace ? `\n\nThe review copy has no .git. Read the captured status/diff or gitless note in ${path.join(isolatedWorkspace, ".dd-flow", "review-evidence")}; do not run Git inside the copy.\n` : "\n"}`);
-        const prompted = await call(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60_000);
+        const promptOperationId = `${operationId}:session.prompt`;
+        let prompted;
+        try {
+            prompted = await call(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60_000);
+        }
+        catch (error) {
+            if (runtimeHarness(resolved.worker) !== "codex-desktop")
+                throw error;
+            const resumed = await continueCodexCapacity({ error, sessionId, operationId: promptOperationId,
+                inspectOperation: id => call(["daemon", "operation", "--state-dir", root, "--operation-id", id, "--json"], 30_000, `${id}:capacity-observe`),
+                inspectSession: () => call(["session", "inspect", "--session-id", sessionId, ...common], 30_000, `${operationId}:capacity-inspect`),
+                assertCurrent: () => {
+                    assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
+                    const current = context.db.get("SELECT w.status, l.status AS launch_status FROM works w JOIN work_launches l ON l.work_id = w.work_id WHERE w.work_id = ? AND l.operation_id = ?", [work.work_id, operationId]);
+                    if (current?.status !== "created" || current.launch_status !== "launching")
+                        throw new AppError("capacity_continuation_blocked", "External Work changed before its native continuation", 1, { work_id: work.work_id, state: current });
+                    if (reviewCopy && reviewSourceHash(run.workspace_root, reviewInputs, reviewBase) !== reviewCopy.source_sha256)
+                        throw new AppError("read_only_input_changed", "Authoritative review workspace changed during capacity wait", 2);
+                },
+                retainIntent: intent => {
+                    const changed = context.db.run("UPDATE work_launches SET adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ? AND status = 'launching'", [JSON.stringify({ create: created, capacity_intent: intent }), context.now(), operationId]);
+                    if (changed.changes !== 1)
+                        throw new AppError("capacity_continuation_blocked", "External Work launch owner changed", 1);
+                },
+                prompt: (id, text, ordinal) => {
+                    const file = path.join(root, `capacity-${ordinal}.md`);
+                    fs.writeFileSync(file, `${text}\n`, { flag: "wx", mode: 0o600 });
+                    return call(["session", "prompt", "--session-id", sessionId, "--prompt-file", file, ...common], 45 * 60_000, id);
+                } });
+            if (!resumed)
+                throw error;
+            prompted = resumed;
+        }
         assertRunMutationAllowed(context, work.project_id, work.run_id, generation);
         context.db.run("UPDATE work_launches SET status = 'start_requested', provider_session_id = ?, adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ?", [sessionId, JSON.stringify({ create: created, prompt: prompted }), context.now(), operationId]);
         return { ok: true, work_id: work.work_id, operation_id: operationId, status: "start_requested", session: { harness_id: runtimeHarness(resolved.worker), session_id: sessionId }, profile_hash: resolved.profile_hash, journal_path: journal };
     }
     catch (error) {
-        context.db.run("UPDATE work_launches SET status = 'failed', adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify({ error: String(error) }), context.now(), operationId]);
+        context.db.run("UPDATE work_launches SET status = 'failed', adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify({ error: errorRecord(error) }), context.now(), operationId]);
         throw error;
     }
 }