@deksden-com/dd-flow-cli 0.9.0-beta.119 → 0.9.0-beta.121

package/dist/services/managed-processes.js

@@ -61,7 +61,12 @@ export function prepareManagedProcessRegistration(context, input) {
         throw new AppError("validation", "Unique managed operation requires operationId", 2);
     let metadataJson;
     try {
-        metadataJson = JSON.stringify({ ...input.metadata, dd_flow_home: context.ddFlowHome, ...(input.ownerPid ? { owner_pid: input.ownerPid, owner_pid_started_at: processStartedAt(input.ownerPid) } : {}) });
+        const metadata = { ...input.metadata, dd_flow_home: context.ddFlowHome, ...(input.ownerPid ? { owner_pid: input.ownerPid, owner_pid_started_at: processStartedAt(input.ownerPid) } : {}) };
+        delete metadata.process_birth;
+        delete metadata.owner_birth;
+        if (input.ownerPid)
+            metadata.owner_birth = stableProcessBirth(input.ownerPid);
+        metadataJson = JSON.stringify(metadata);
     }
     catch {
         throw new AppError("validation", "metadata must be JSON-serializable", 2);
@@ -86,7 +91,8 @@ export function registerManagedProcess(context, rawInput) {
     if (!input.uniqueActiveOperation)
         return insertManagedProcess(context, input, metadataJson);
     const db = registry(context);
-    if (observer && !processIsAlive({ pid: input.pid, pid_started_at: observerBirth }))
+    const observerProcessBirth = observer ? stableProcessBirth(input.pid) : null;
+    if (observer && !processIsAlive({ pid: input.pid, pid_started_at: observerBirth, metadata_json: JSON.stringify({ process_birth: observerProcessBirth }) }))
         throw new AppError("process_ownership_unknown", "EVAL observer changed before registration", 1);
     return db.writeTransaction(() => {
         const existing = db.get("SELECT * FROM managed_processes WHERE operation_id = ? AND state IN ('starting','running','stopping','orphaned')", [input.operationId]);
@@ -97,6 +103,7 @@ export function registerManagedProcess(context, rawInput) {
             const metadata = JSON.parse(metadataJson);
             if (input.processGroupId)
                 metadata.process_group_id = input.processGroupId;
+            metadata.process_birth = observerProcessBirth;
             const now = context.now();
             db.run("UPDATE managed_processes SET pid = ?, pid_started_at = ?, state = 'running', lease_expires_at = ?, updated_at = ?, metadata_json = ? WHERE id = ? AND lease_token = ? AND state = 'starting'", [input.pid, observerBirth, leaseExpiry(now, input.leaseMs), now, JSON.stringify(metadata), result.id, result.lease_token]);
             result = requireProcess(db, result.id);
@@ -137,9 +144,11 @@ export function confirmManagedProcess(context, input) {
     const metadata = parseMetadata(current.metadata_json);
     if (input.processGroupId)
         metadata.process_group_id = input.processGroupId;
+    metadata.process_birth = stableProcessBirth(input.pid);
     if (input.ownerPid) {
         metadata.owner_pid = input.ownerPid;
         metadata.owner_pid_started_at = processStartedAt(input.ownerPid);
+        metadata.owner_birth = stableProcessBirth(input.ownerPid);
     }
     const result = db.run(`UPDATE managed_processes
      SET pid = ?, pid_started_at = ?, state = 'running', lease_expires_at = ?, updated_at = ?, metadata_json = ?
@@ -216,6 +225,11 @@ export function processIsAlive(record) {
     catch (error) {
         return error.code !== "ESRCH";
     }
+    const metadata = record.metadata_json ? parseMetadata(record.metadata_json) : {};
+    if (Object.hasOwn(metadata, "process_birth")) {
+        const birth = parseBirth(metadata.process_birth), observed = stableProcessBirth(record.pid);
+        return !birth || !observed || observed === birth;
+    }
     const started = processStartedAt(record.pid);
     return !record.pid_started_at || !started || record.pid_started_at === started;
 }
@@ -223,6 +237,17 @@ export function processTreeIsAlive(record) {
     if (processIsAlive(record))
         return true;
     const group = parseMetadata(record.metadata_json).process_group_id;
+    const birth = parseBirth(parseMetadata(record.metadata_json).process_birth);
+    // POSIX cannot reuse a leader PID while its old process group survives.
+    if (process.platform !== "win32" && group === record.pid && record.pid && birth) {
+        try {
+            process.kill(record.pid, 0);
+        }
+        catch { /* A missing leader can still have living children. */ }
+        const observed = stableProcessBirth(record.pid);
+        if (observed && observed !== birth)
+            return false;
+    }
     if (process.platform !== "win32" && typeof group === "number") {
         try {
             process.kill(-group, 0);
@@ -238,7 +263,7 @@ export function managedOwnerIsAlive(record) {
     const metadata = parseMetadata(record.metadata_json);
     if (typeof metadata.owner_pid !== "number")
         return null;
-    return processIsAlive({ pid: metadata.owner_pid, pid_started_at: typeof metadata.owner_pid_started_at === "string" ? metadata.owner_pid_started_at : null });
+    return processIsAlive({ pid: metadata.owner_pid, pid_started_at: typeof metadata.owner_pid_started_at === "string" ? metadata.owner_pid_started_at : null, metadata_json: JSON.stringify({ process_birth: metadata.owner_birth }) });
 }
 /**
  * Expiry proves that observation stopped, not that the owner died.  A live PID
@@ -413,16 +438,27 @@ function leaseExpiry(now, leaseMs = defaultLeaseMs) {
     return new Date(Date.parse(now) + leaseMs).toISOString();
 }
 export function processStartedAt(pid) { const result = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8", timeout: 1_000 }); const value = result.status === 0 ? result.stdout.trim() : ""; return value || null; }
+function stableProcessBirth(pid) {
+    const result = spawnSync("ps", ["-o", "lstart=", "-p", String(pid)], { encoding: "utf8", timeout: 1_000, env: { ...process.env, TZ: "UTC", LC_ALL: "C" } });
+    const value = result.status === 0 ? result.stdout.trim() : "";
+    return value ? `ps-lstart-utc-c@1:${value}` : null;
+}
+function parseBirth(value) { return typeof value === "string" && value.startsWith("ps-lstart-utc-c@1:") && value.length > "ps-lstart-utc-c@1:".length ? value : null; }
 function releasePortClaims(db, claims) { for (const claim of claims)
     db.run("DELETE FROM managed_resources WHERE resource_kind = 'port' AND resource_key = ? AND lease_token = ?", [claim.key, claim.token]); }
 function terminateOwnedProcess(record, signal) {
     // Never signal a group merely because its former leader PID was once ours.
     // PID reuse or a departed leader makes group ownership unprovable.
-    if (!record.pid || !record.pid_started_at || processStartedAt(record.pid) !== record.pid_started_at)
+    if (!record.pid || !record.pid_started_at)
         return;
-    const group = parseMetadata(record.metadata_json).process_group_id;
+    const metadata = parseMetadata(record.metadata_json);
+    const birth = parseBirth(metadata.process_birth);
+    if (Object.hasOwn(metadata, "process_birth") ? !birth || stableProcessBirth(record.pid) !== birth : processStartedAt(record.pid) !== record.pid_started_at)
+        return;
+    const group = metadata.process_group_id;
+    // A non-leader PID does not establish ownership of its whole process group.
     try {
-        process.kill(process.platform === "win32" || typeof group !== "number" ? record.pid : -group, signal);
+        process.kill(process.platform === "win32" || group !== record.pid ? record.pid : -group, signal);
     }
     catch { /* inspect again below */ }
 }

package/dist/services/merge-server.js

@@ -1,5 +1,7 @@
 import { managedInvocationContext, managedLifecycleCommand } from "./lifecycle-invocations.js";
 import { stageLifecycleInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { continueCodexCapacity } from "./codex-capacity.js";
+import { errorRecord } from "./run-controller-state.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
@@ -110,7 +112,7 @@ async function dispatch(context, input) {
         return; const now = context.now(); context.db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'dispatching' AND dispatch_owner = ? AND dispatch_lease_token = ?", [new Date(Date.now() + 120_000).toISOString(), now, input.request.merge_request_id, input.serverId, token]); }, 30_000);
     leaseHeartbeat.unref();
     try {
-        const adapterCall = (args, timeoutMs, progressMessage) => { assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation); return runHarnessAdapter({ executable, args, env: runtimeContext.env, runtimeOwner, operationId: `${input.request.merge_request_id}:${token}:${args[0]}.${args[1]}`, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), ...(progressMessage ? { progressMessage } : {}), onEvidence: (value) => event(input.journal, { type: "adapter_call", ...value }) }); };
+        const adapterCall = (args, timeoutMs, progressMessage, id = `${input.request.merge_request_id}:${token}:${args[0]}.${args[1]}`) => { assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation); return runHarnessAdapter({ executable, args, env: runtimeContext.env, runtimeOwner, operationId: id, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), ...(progressMessage ? { progressMessage } : {}), onEvidence: (value) => event(input.journal, { type: "adapter_call", ...value }) }); };
         await adapterCall(["daemon", "start", ...common]);
         const created = await adapterCall(["session", "create", ...common], runtimeHarness(input.profile) === "zcode-acp" ? 180_000 : undefined);
         const sessionId = adapterSessionId(created);
@@ -121,7 +123,35 @@ async function dispatch(context, input) {
         runtimeContext = managedInvocationContext(runtimeContext, { harness: runtimeHarness(input.profile), stateDir, sessionId, projectRoot: run.project_root, runId: input.request.run_id, generation });
         const stageCommand = managedLifecycleCommand(runtimeContext, `${flowCommand(runtimeContext)} stage start ${input.request.run_id} --stage merge --project-root ${JSON.stringify(run.project_root)} --json --progress-jsonl`);
         fs.writeFileSync(promptFile, `Start the assigned MERGE stage now. Your first tool call must be this exact standalone command:\n\n${stageCommand}\n\nTrust and follow the complete stage packet it returns. Continue through merge apply and stage finish. Stop only when the stage reaches a terminal result or explicitly requests user/operator action.\n\n${stageLifecycleInstruction}\n`);
-        const prompted = await adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} is still running`);
+        let prompted;
+        try {
+            prompted = await adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} is still running`);
+        }
+        catch (error) {
+            if (runtimeHarness(input.profile) !== "codex-desktop")
+                throw error;
+            const resumed = await continueCodexCapacity({ error, sessionId, operationId: String(retained.prompt_operation_id),
+                inspectOperation: id => adapterCall(["daemon", "operation", "--state-dir", stateDir, "--operation-id", id, "--json"], 30_000, undefined, `${id}:capacity-observe`),
+                inspectSession: () => adapterCall(["session", "inspect", "--session-id", sessionId, ...common], 30_000, undefined, `${input.request.merge_request_id}:${token}:capacity-inspect`),
+                assertCurrent: () => {
+                    assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation);
+                    const current = context.db.get("SELECT status, dispatch_owner, dispatch_lease_token, dispatch_lease_expires_at, target_workspace FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id]);
+                    if (current?.status !== "dispatching" || current.dispatch_owner !== input.serverId || current.dispatch_lease_token !== token
+                        || current.dispatch_lease_expires_at <= context.now() || current.target_workspace !== input.request.target_workspace)
+                        throw new AppError("capacity_continuation_blocked", "MERGE dispatch owner or target changed during capacity wait", 1, { request_id: input.request.merge_request_id });
+                    if (context.db.get("SELECT status FROM works WHERE work_id = ?", [input.request.executor_work_id])?.status !== "created")
+                        throw new AppError("capacity_continuation_blocked", "MERGE Work already changed state", 1);
+                },
+                retainIntent: intent => { retained.capacity_intent = intent; retain(); },
+                prompt: (id, text, ordinal) => {
+                    const file = path.join(stateDir, `capacity-${ordinal}.md`);
+                    fs.writeFileSync(file, `${text}\n`, { flag: "wx", mode: 0o600 });
+                    return adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", file, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} capacity continuation ${ordinal}/2`, id);
+                } });
+            if (!resumed)
+                throw error;
+            prompted = resumed;
+        }
         Object.assign(retained, { response: prompted });
         retain();
         assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation);
@@ -137,9 +167,9 @@ async function dispatch(context, input) {
         }
         const request = context.db.get("SELECT status FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id]);
         if (request?.status === "dispatching")
-            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_launch_failed", error: String(error) }), context.now(), input.request.merge_request_id]);
+            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_launch_failed", error: errorRecord(error) }), context.now(), input.request.merge_request_id]);
         else if (request?.status === "active")
-            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_lost_after_stage_start", error: String(error) }), context.now(), input.request.merge_request_id]);
+            context.db.run("UPDATE merge_requests SET status = 'recovery_required', last_error_json = ?, updated_at = ? WHERE merge_request_id = ?", [JSON.stringify({ code: "adapter_lost_after_stage_start", error: errorRecord(error) }), context.now(), input.request.merge_request_id]);
         throw error;
     }
     finally {

package/dist/services/run-control.js

@@ -11,7 +11,7 @@ import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { harnessKey } from "./harness-config.js";
 import { finishManagedProcess, managedLeaseReleased, managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, stopManagedProcess } from "./managed-processes.js";
-import { reconcileUnfinishedChecks } from "./code-checks.js";
+import { reconcileUnfinishedChecks, terminalCheckSettled } from "./code-checks.js";
 import { controlStatusReceipt } from "./run-control-receipt.js";
 import { assertNativeCancellationReceipt, cancelControlledNativeSession, inspectControlledNativeSession } from "./native-session-control.js";
 /** Durable projection only: status never probes a provider or acquires an owner. */
@@ -545,6 +545,12 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             return { process_id: record.id, kind: record.kind, status: "pending", reason: "managed_lease_unsettled" };
         if (!record.pid || !record.pid_started_at)
             return { process_id: record.id, kind: record.kind, status: "pending", reason: "managed_process_identity_unknown" };
+        // Code checks mark their process terminal only after proving its tree is
+        // empty, then publish the exact check receipt. A later PGID reuse cannot
+        // turn that already-settled check back into an owned live process.
+        const check = record.kind === "check" && record.project_id === project.id && record.run_id === input.runId ? terminalCheckSettled(context, record) : null;
+        if (check)
+            return { process_id: record.id, kind: record.kind, status: "completed", receipt: { source: "terminal_check_tree_settled", ...managedProcessBinding(record, home), check_id: record.check_id, finished_at: check.finished_at } };
         if (!interrupt && processTreeIsAlive(record))
             return { process_id: record.id, kind: record.kind, status: "pending", reason: "managed_process_running" };
         if (boundary)

package/dist/services/run-controller-adapter.js

@@ -15,14 +15,32 @@ export function controllerHitlAdmission(context, record, input) {
     if (!row || row.generation !== JSON.parse(record.metadata_json).run_generation)
         return false;
     const suffix = `:prompt:${row.generation}`;
-    if (!input.operationId.endsWith(suffix))
+    const successor = /^(.*):capacity:([12]):session\.prompt$/.exec(input.operationId);
+    const baseId = successor ? successor[1] : input.operationId;
+    if (!baseId.endsWith(suffix))
         return false;
+    if (successor) {
+        const ordinal = Number(successor[2]);
+        const predecessorId = ordinal === 1 ? baseId : `${baseId}:capacity:1:session.prompt`;
+        const predecessor = context.db.get("SELECT status, receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [predecessorId, row.controller_id, row.generation]);
+        if (predecessor?.status !== "failed" || !predecessor.receipt_json)
+            return false;
+        let retained;
+        try {
+            retained = JSON.parse(predecessor.receipt_json);
+        }
+        catch {
+            return false;
+        }
+        if (retained.capacity_intent?.predecessor !== predecessorId || retained.capacity_intent.operation_id !== input.operationId || retained.capacity_intent.ordinal !== ordinal)
+            return false;
+    }
     const state = JSON.parse(row.state_json);
     const session = state.current_session === null ? undefined : state.sessions[state.current_session];
     if (!session || session.stopped || session.id !== input.nativeSessionId || session.state_dir !== input.stateDir || session.owner.owner_id !== record.owner_id)
         return false;
     const operation = (id) => context.db.get("SELECT input_json, input_hash FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'dispatching'", [id, row.controller_id, row.generation]);
-    const answer = context.db.get("SELECT input_json, input_hash FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation <= ? AND status = 'accepted'", [input.operationId.slice(0, -suffix.length), row.controller_id, row.generation]);
+    const answer = context.db.get("SELECT input_json, input_hash FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation <= ? AND status = 'accepted'", [baseId.slice(0, -suffix.length), row.controller_id, row.generation]);
     const prompt = operation(input.operationId);
     if (!answer || !prompt)
         return false;

package/dist/services/run-controller-recovery.js

@@ -8,11 +8,13 @@ import { requireProjectByRoot } from "./projects.js";
 import { loadExternalStageContext } from "./stage-context.js";
 import { verifyRecoverySnapshot } from "./eval-snapshots.js";
 import { recoveryGuard, resumeRunRecovery } from "./run-recovery.js";
-import { prepareRunRecoveryDispatch } from "./run-recovery-runtime.js";
+import { prepareRunRecoveryDispatch, retainRecoveryCapacityIntent } from "./run-recovery-runtime.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, processStartedAt } from "./managed-processes.js";
 import { requireRun, requireController, controllerReceipt, appendEvent, saveState, digest, errorRecord } from "./run-controller-state.js";
-import { controllerAdapter, sessionArguments } from "./run-controller-adapter.js";
+import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
+import { runHarnessAdapter } from "./harness-adapter.js";
+import { continueCodexCapacity } from "./codex-capacity.js";
 import { spawnController, recordControllerLauncher } from "./run-controller-process.js";
 import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 import { managedInvocationContext } from "./lifecycle-invocations.js";
@@ -194,7 +196,49 @@ export async function resumeControllerSession(context, row, manifest, state, ass
     fs.writeFileSync(file, dispatch.prompt, { flag: "wx", mode: 0o600 });
     state.turns += 1;
     saveState(context, row, state);
-    const receipt = await call(["session", "prompt", "--session-id", session.id, "--prompt-file", file, ...sessionArguments(context, manifest, session)], dispatch.operation_id);
+    const sendAck = (operationId, prompt) => {
+        let promptFile = file;
+        if (operationId !== dispatch.operation_id) {
+            promptFile = path.join(row.state_dir, `turn-${String(state.turns + 1).padStart(5, "0")}.md`);
+            fs.writeFileSync(promptFile, prompt, { flag: "wx", mode: 0o600 });
+            state.turns += 1;
+            saveState(context, row, state);
+        }
+        return call(["session", "prompt", "--session-id", session.id, "--prompt-file", promptFile, ...sessionArguments(context, manifest, session)], operationId);
+    };
+    let receipt;
+    try {
+        receipt = await sendAck(dispatch.operation_id, dispatch.prompt);
+    }
+    catch (error) {
+        if (runtimeHarness(session.profile) !== "codex-desktop")
+            throw error;
+        const continuationText = `The preceding native recovery ACK Turn failed before any observed tool or file effect. This is the same retained Session and recovery generation. First inspect the current RUN recovery state; only if the exact ACK still awaits acceptance, execute the exact standalone acceptance command below once. Never deliver it again after acceptance. Then stop at the original Stage or Work-graph boundary.\n\n${dispatch.prompt}`;
+        const inspect = (args, operationId) => runHarnessAdapter({ executable: manifest.adapters["codex-desktop"].executable,
+            args, env: controllerEnvironment(executionContext, manifest, session), runtimeOwner: session.owner, operationId, timeoutMs: 30_000 });
+        const resumed = await continueCodexCapacity({ error, sessionId: session.id, operationId: dispatch.operation_id, allowSettledDescendants: true, continuationText,
+            inspectOperation: id => inspect(["daemon", "operation", "--state-dir", session.state_dir, "--operation-id", id, "--json"], `${id}:capacity-observe`),
+            inspectSession: () => inspect(["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], `${dispatch.operation_id}:capacity-inspect`),
+            assertCurrent: () => {
+                assertRecoveryOwner();
+                const guard = recoveryGuard(context, row.project_id, row.run_id);
+                const binding = context.db.get("SELECT status, daemon_id FROM run_recovery_bindings WHERE recovery_id = ?", [recovery.recovery_id]);
+                const ack = context.db.get("SELECT status FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [recovery.operation_id, row.controller_id, row.generation]);
+                if (guard?.status !== "resuming" || binding?.status !== "prepared" || binding.daemon_id !== daemonId || ack?.status !== "accepted")
+                    throw new AppError("recovery_capacity_owner_changed", "Recovery ACK was accepted or superseded during capacity wait", 1);
+                const current = requireManagedDaemonBinding(executionContext, { stateDir: session.state_dir, projectId: row.project_id, runId: row.run_id, ownerId: session.owner.owner_id });
+                const metadata = JSON.parse(current.process.metadata_json);
+                if (current.process.id !== dispatch.process_id || current.state.daemon_id !== daemonId || current.process.state !== "running"
+                    || current.process.lease_expires_at <= context.now() || metadata.run_generation !== row.generation || !processIsAlive(current.process))
+                    throw new AppError("recovery_capacity_owner_changed", "Replacement native owner changed during capacity wait", 1);
+            },
+            retainIntent: intent => retainRecoveryCapacityIntent(executionContext, { projectId: row.project_id, runId: row.run_id, recoveryId: recovery.recovery_id,
+                controllerId: row.controller_id, generation: row.generation, daemonId, intent, prompt: continuationText }),
+            prompt: (operationId, prompt) => sendAck(operationId, prompt) });
+        if (!resumed)
+            throw error;
+        receipt = resumed;
+    }
     assertRecoveryOwner();
     if (recoveryGuard(context, row.project_id, row.run_id)?.status !== "recovered")
         throw new AppError("trusted_recovery_acceptance_required", "Recovery Turn ended without its native acknowledgement", 1);

package/dist/services/run-controller.js

@@ -30,9 +30,12 @@ import { requireRun, requireController, controllerReceipt, appendEvent, saveStat
 import { assertNoCorrelatedRejection } from "./continuation-outcome.js";
 import { spawnController, recordControllerLauncher, claimControllerProcess, markControllerDispatchReady } from "./run-controller-process.js";
 import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
+import { continueCodexCapacity } from "./codex-capacity.js";
 import { resumeControllerSession, failControllerRecovery } from "./run-controller-recovery.js";
 import { captureControllerBoundary } from "./run-controller-capture.js";
 import { requestRunControl } from "./run-control-worker.js";
+import { storageSessionId } from "./session-identity.js";
+import { terminalCodexOverload } from "../harness-runtime/lib/dd-codex.mjs";
 export { resumeRunController } from "./run-controller-recovery.js";
 export function prepareRunControllerLaunch(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.requestId) || !/^[a-f0-9]{64}$/.test(input.contextSha256))
@@ -526,16 +529,61 @@ async function executeController(context, row, manifest, state, assertOwnership,
             throw new AppError("settlement_reconciliation_required", "The managed Session still has an unsettled productive predecessor", 1, { session_id: session.id, settlement: current });
         }
     };
-    const prompt = async (session, text, operationId) => {
+    const prompt = async (session, text, operationId, kind) => {
+        const hitl = kind === "hitl";
         await reconcilePromptPredecessor(session);
-        const file = path.join(row.state_dir, `turn-${String(state.turns + 1).padStart(5, "0")}.md`);
-        fs.writeFileSync(file, `${text}\n`, { flag: "wx", mode: 0o600 });
-        state.turns += 1;
-        saveState(context, row, state);
+        const firstOperationId = operationId ?? `${row.controller_id}:prompt:${crypto.randomUUID()}`;
+        const send = (value, id) => {
+            const file = path.join(row.state_dir, `turn-${String(state.turns + 1).padStart(5, "0")}.md`);
+            fs.writeFileSync(file, `${value}\n`, { flag: "wx", mode: 0o600 });
+            state.turns += 1;
+            saveState(context, row, state);
+            return controllerAdapter(executionContext, row, manifest, session, ["session", "prompt", "--session-id", session.id, "--prompt-file", file, ...sessionArguments(context, manifest, session)], assertOwner, id, cancellation.signal);
+        };
         let receipt;
-        const adapter = controllerAdapter(executionContext, row, manifest, session, ["session", "prompt", "--session-id", session.id, "--prompt-file", file, ...sessionArguments(context, manifest, session)], assertOwner, operationId, cancellation.signal);
         try {
-            receipt = await adapter;
+            try {
+                receipt = await send(text, firstOperationId);
+            }
+            catch (error) {
+                if (runtimeHarness(session.profile) !== "codex-desktop")
+                    throw error;
+                const resumeCommand = hitl ? text.split("\n\n")[1] : undefined;
+                if (hitl && !resumeCommand?.includes(" stage resume "))
+                    throw error;
+                const inspect = (args, id) => runHarnessAdapter({ executable: manifest.adapters["codex-desktop"].executable,
+                    args, env: controllerEnvironment(context, manifest, session), runtimeOwner: session.owner, operationId: id, timeoutMs: 30_000, signal: cancellation.signal });
+                const resumed = await continueCodexCapacity({ error, sessionId: session.id, operationId: firstOperationId,
+                    inspectOperation: id => inspect(["daemon", "operation", "--state-dir", session.state_dir, "--operation-id", id, "--json"], `${id}:capacity-observe`),
+                    inspectSession: () => inspect(["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], `${firstOperationId}:capacity-inspect`),
+                    assertCurrent: () => {
+                        assertOwner();
+                        const view = getFlowRunStatus(executionContext, { projectRoot: manifest.request.project_root, runId: row.run_id });
+                        const next = view.continuation;
+                        if (hitl) {
+                            const answerId = firstOperationId.slice(0, -`:prompt:${row.generation}`.length);
+                            const answer = context.db.get("SELECT input_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND status = 'accepted'", [answerId, row.controller_id]);
+                            const accepted = answer && JSON.parse(answer.input_json);
+                            const pause = view.index.stage_runs.find(item => item.stage === accepted?.stage)?.pause;
+                            if (next.kind !== "paused" || next.stage !== state.stage || !accepted || pause?.id !== accepted.pause_id || pause.work_id !== accepted.work_id || pause.answer_path)
+                                throw new AppError("capacity_continuation_blocked", "Accepted HITL pause changed during capacity wait", 1, { continuation: next });
+                        }
+                        else if (next.stage !== state.stage || ["terminal", "paused", "blocked", "wait"].includes(next.kind)) {
+                            throw new AppError("capacity_continuation_blocked", "RUN changed while native capacity was unavailable", 1, { continuation: next });
+                        }
+                    },
+                    retainIntent: intent => context.db.writeTransaction(() => {
+                        const changed = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_intent: intent }), context.now(), intent.predecessor, row.controller_id, row.generation]);
+                        if (changed.changes !== 1)
+                            throw new AppError("capacity_continuation_blocked", "Failed native operation changed before continuation", 1);
+                        appendEvent(context, row.controller_id, "capacity_continuation", intent);
+                    }),
+                    prompt: (id, value) => send(value, id),
+                    ...(resumeCommand ? { continuationText: `The preceding Turn failed before any tool call. Continue the same accepted HITL answer in this Session. If the pause is still current, run this exact previously issued standalone command once without changing the answer:\n\n${resumeCommand}\n\nDo not accept or deliver the answer again if the pause has changed.` } : {}) });
+                if (!resumed)
+                    throw error;
+                receipt = resumed;
+            }
             checkOutcomes();
             if (fatal)
                 throw fatal;
@@ -545,7 +593,6 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 throw error;
             await stopAfterFailure(error);
             cancellation.abort();
-            await adapter.catch(() => { });
             throw fatal ?? error;
         }
         state.last_receipt = receipt;
@@ -613,7 +660,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 // The accepted answer is logical intent; only its generation-bound
                 // adapter operation represents a physical dispatch that stop must drain.
                 const command = managedLifecycleCommand(executionContext, `${flowCommand(executionContext)} stage resume ${run.id} --stage ${next.stage} --work ${input.work_id} --project-root ${quote([run.project_root])} --answer-file ${quote([input.file])} --json`, { replaceUnobservedAnswer: true });
-                const receipt = await prompt(state.sessions[state.current_session], controllerStageResumePrompt(pause.id, command), `${answer.operation_id}:prompt:${row.generation}`);
+                const receipt = await prompt(state.sessions[state.current_session], controllerStageResumePrompt(pause.id, command), `${answer.operation_id}:prompt:${row.generation}`, "hitl");
                 const afterAnswer = getFlowRunStatus(executionContext, { projectRoot: run.project_root, runId: run.id });
                 if (afterAnswer.index.stage_runs.some(stage => stage.status === "paused" && stage.pause?.id === pause.id)) {
                     throw new AppError("controller_answer_not_applied", "The answer Turn completed without resuming the assigned HITL pause", 1, { pause_id: pause.id, operation_id: answer.operation_id, stage: next.stage, effect: "no_progress" });
@@ -712,7 +759,55 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 throw new AppError("controller_attach_required", "An unfinished Stage has no managed coordinator", 1);
             const session = state.sessions[state.current_session];
             const baseline = new Set(state.native_baseline ?? []);
-            const children = controllerNativeChildren(state.last_receipt ?? {}, session.id).filter(child => !baseline.has(child.session_id));
+            let children = controllerNativeChildren(state.last_receipt ?? {}, session.id).filter(child => !baseline.has(child.session_id));
+            if (runtimeHarness(session.profile) === "codex-desktop" && children.some(child => child.status === "failed")) {
+                const inspected = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                state.last_receipt = inspected;
+                saveState(context, row, state);
+                children = controllerNativeChildren(inspected, session.id).filter(child => !baseline.has(child.session_id));
+                const failed = children.filter(child => child.status === "failed");
+                const child = failed.length === 1 && children.every(item => item === failed[0] || item.status === "completed") ? failed[0] : undefined;
+                const turnId = child?.terminal_turn_id;
+                const native = child && turnId ? { code: "turn_interrupted", details: { provider_session_id: child.session_id, turn_id: turnId, native_turn_id: turnId,
+                        terminal_status: "failed", provider_error: child.provider_error } } : null;
+                const prior = child && state.child_capacity?.[child.session_id];
+                const links = child ? context.db.all("SELECT w.status FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.session_id = ?", [row.project_id, row.run_id, storageSessionId({ harness_id: "codex-desktop", session_id: child.session_id })]) : [];
+                if (child && turnId && native && terminalCodexOverload(native, child.session_id, turnId)
+                    && child.native_turn_items?.observed === true && child.native_turn_items.possible_effects === false
+                    && inspected.settled === true && child.parent_session_id === session.id && links.length <= 1
+                    && (!links.length || links[0].status === "running") && (prior?.attempts ?? 0) < 2) {
+                    if (prior?.turn_id === turnId)
+                        throw new AppError("capacity_child_followup_unconfirmed", "Parent continuation did not start a new native child Turn", 1, { child_session_id: child.session_id, turn_id: turnId });
+                    const attempt = (prior?.attempts ?? 0) + 1;
+                    state.child_capacity ??= {};
+                    state.child_capacity[child.session_id] = { turn_id: turnId, attempts: attempt };
+                    saveState(context, row, state);
+                    const operationId = `${row.controller_id}:child:${digest([child.session_id, turnId]).slice(0, 16)}:followup:${attempt}`;
+                    appendEvent(context, row.controller_id, "capacity_child_followup", { child_session_id: child.session_id, turn_id: turnId, attempt, operation_id: operationId });
+                    await delay(attempt === 1 ? 5_000 : 15_000);
+                    assertOwner();
+                    const current = getFlowRunStatus(executionContext, { projectRoot: manifest.request.project_root, runId: row.run_id });
+                    if (current.continuation.stage !== state.stage || ["terminal", "paused", "blocked", "wait"].includes(current.continuation.kind))
+                        throw new AppError("capacity_child_followup_blocked", "RUN changed during native child capacity wait", 1, { child_session_id: child.session_id });
+                    const fresh = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                    const still = controllerNativeChildren(fresh, session.id).find(item => item.session_id === child.session_id);
+                    const currentLinks = context.db.all("SELECT w.status FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.session_id = ?", [row.project_id, row.run_id, storageSessionId({ harness_id: "codex-desktop", session_id: child.session_id })]);
+                    if (fresh.settled !== true || !still || still.parent_session_id !== session.id || still.status !== "failed" || still.terminal_turn_id !== turnId
+                        || still.native_turn_items?.observed !== true || still.native_turn_items.possible_effects !== false || currentLinks.length > 1
+                        || currentLinks.some(link => link.status !== "running"))
+                        throw new AppError("capacity_child_followup_blocked", "Native child or Work changed during capacity wait", 1, { child_session_id: child.session_id, turn_id: turnId });
+                    assertOwner();
+                    const text = `The existing native child ${child.session_id} has a confirmed effect-free failed Turn. Use the native followup_task tool exactly once for that same child ID with this short message: "Continue your assigned Work from its current durable state. Do not repeat an observed lifecycle command. Finish only the original Work." Do not spawn another child, claim another Work, or perform the child's Work in this parent Turn. End this Turn after the followup_task response.`;
+                    await prompt(session, text, operationId, "child");
+                    const after = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                    state.last_receipt = after;
+                    saveState(context, row, state);
+                    const observed = controllerNativeChildren(after, session.id).find(item => item.session_id === child.session_id);
+                    if (!observed || observed.status === "failed" && observed.terminal_turn_id === turnId)
+                        throw new AppError("capacity_child_followup_unconfirmed", "Native child did not advance to a new Turn after parent followup", 1, { child_session_id: child.session_id, turn_id: turnId });
+                    continue;
+                }
+            }
             const fanout = await nextControllerFanout(executionContext, { projectRoot: run.project_root, runId: run.id, stage: next.stage, harness: runtimeHarness(session.profile), sessionId: session.id, children, policy, profiles });
             assertOwner();
             if (fanout.kind === "none") {

package/dist/services/run-recovery-runtime.js

@@ -56,6 +56,42 @@ export function prepareRunRecoveryDispatch(context, input) {
         return dispatch;
     });
 }
+/** Publish only an exact successor to a failed, effect-free recovery ACK Turn. */
+export function retainRecoveryCapacityIntent(context, input) {
+    const { intent } = input;
+    if (![1, 2].includes(intent.ordinal) || !intent.turn_id || !intent.not_before)
+        throw new AppError("recovery_capacity_intent_invalid", "Recovery capacity successor is invalid", 1);
+    context.db.writeTransaction(() => {
+        const guard = recoveryGuard(context, input.projectId, input.runId);
+        const binding = context.db.get("SELECT * FROM run_recovery_bindings WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared'", [input.recoveryId, input.daemonId]);
+        if (!guard || guard.recovery_id !== input.recoveryId || guard.generation !== input.generation || guard.status !== "resuming" || !binding?.runtime_dispatch_json)
+            throw new AppError("recovery_capacity_owner_changed", "Recovery ACK no longer owns the current generation", 1);
+        const controller = context.db.get("SELECT generation, status FROM run_controllers WHERE controller_id = ? AND project_id = ? AND run_id = ?", [input.controllerId, input.projectId, input.runId]);
+        const control = context.db.get("SELECT status FROM run_controls WHERE recovery_id = ?", [input.recoveryId]);
+        if (controller?.generation !== input.generation || ["completed", "cancelled", "superseded"].includes(controller.status) || control?.status !== "resuming")
+            throw new AppError("recovery_capacity_owner_changed", "Recovery controller or control changed before successor publication", 1);
+        const dispatch = JSON.parse(binding.runtime_dispatch_json);
+        const currentProcess = getResourceDatabase(resourceHome(context)).get("SELECT * FROM managed_processes WHERE id = ?", [dispatch.process_id]);
+        if (!currentProcess || currentProcess.state !== "running" || currentProcess.lease_expires_at <= context.now() || currentProcess.owner_id !== dispatch.owner_id
+            || currentProcess.project_id !== input.projectId || currentProcess.run_id !== input.runId)
+            throw new AppError("recovery_capacity_owner_changed", "Replacement daemon lease changed before successor publication", 1);
+        const prior = dispatch.capacity_intents ?? [];
+        const predecessor = intent.ordinal === 1 ? dispatch.operation_id : prior[0]?.operation_id;
+        if (prior.length !== intent.ordinal - 1 || predecessor !== intent.predecessor || intent.operation_id !== `${dispatch.operation_id}:capacity:${intent.ordinal}:session.prompt`)
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery capacity successor does not extend the pinned ACK", 1);
+        const failed = context.db.get("SELECT status FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [intent.predecessor, input.controllerId, input.generation]);
+        if (failed?.status !== "outcome_unknown")
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery predecessor is not the failed native operation", 1);
+        const next = { ...intent, prompt_sha256: crypto.createHash("sha256").update(input.prompt).digest("hex") };
+        const updated = { ...dispatch, capacity_intents: [...prior, next] };
+        const changed = context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared' AND runtime_dispatch_json = ?", [JSON.stringify(updated), input.recoveryId, input.daemonId, binding.runtime_dispatch_json]);
+        if (changed.changes !== 1)
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery dispatch changed before successor publication", 1);
+        const marked = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_intent: next }), context.now(), intent.predecessor, input.controllerId, input.generation]);
+        if (marked.changes !== 1)
+            throw new AppError("recovery_capacity_intent_conflict", "Recovery predecessor changed before successor publication", 1);
+    });
+}
 /** The caller has already checked PID/start/lease and runtime-home identity. */
 export function recoveryRuntimeAdmission(context, record, input) {
     if (!record.project_id || !record.run_id || !input.daemonId)
@@ -73,8 +109,13 @@ export function recoveryRuntimeAdmission(context, record, input) {
     if (metadata.run_generation !== guard.generation)
         return false;
     if (guard.status === "recovered" && binding.status === "accepted")
-        return true;
+        return !input.operationId?.startsWith(`${dispatch.operation_id}:capacity:`);
     if (guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.resume")
         return typeof dispatch.resume_operation_id === "string" && input.operationId === dispatch.resume_operation_id && input.nativeSessionId === binding.provider_session_id;
-    return guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.prompt" && input.operationId === dispatch.operation_id && input.nativeSessionId === binding.provider_session_id && input.promptSha256 === dispatch.prompt_sha256;
+    const active = dispatch.capacity_intents?.at(-1);
+    if (active && active.not_before > context.now())
+        return false;
+    return guard.status === "resuming" && binding.status === "prepared" && input.operation === "session.prompt"
+        && input.operationId === (active?.operation_id ?? dispatch.operation_id) && input.nativeSessionId === binding.provider_session_id
+        && input.promptSha256 === (active?.prompt_sha256 ?? dispatch.prompt_sha256);
 }

package/dist/services/runtime-scope-stop.js

@@ -1,9 +1,11 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
+import { createContext } from "../runtime/context.js";
 import { AppError } from "../shared/errors.js";
 import { runHarnessAdapter } from "./harness-adapter.js";
-import { managedLeaseReleased, managedProcessBinding, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, stopManagedProcess } from "./managed-processes.js";
+import { managedLeaseReleased, managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, processTreeIsAlive, resourceHome, stopManagedProcess } from "./managed-processes.js";
+import { terminalCheckSettled } from "./code-checks.js";
 import { fenceRuntimeBudget, runtimeBudgetStatus, scopeLocalProcessRole } from "./runtime-budget.js";
 import { retainedDaemonOperations } from "./run-control.js";
 import { historicalDaemonSettlement } from "./native-daemon-history.js";
@@ -80,10 +82,29 @@ export async function stopRuntimeScope(context, scopeId, requestId) {
         const metadata = JSON.parse(record.metadata_json);
         // RUN control owns active controllers/checks. Adopt only its already-finished
         // physical registrations here; death alone is not a completed RUN operation.
+        const terminalCheck = record.kind === "check" && metadata.role === "check" && record.check_id && record.project_id && record.run_id
+            ? (() => {
+                const home = managedProcessRuntimeHome(record, context);
+                if (!home)
+                    return null;
+                let reader;
+                try {
+                    reader = createContext({ ...context.env, DD_FLOW_HOME: home }, "read_existing");
+                }
+                catch {
+                    return null;
+                }
+                try {
+                    return terminalCheckSettled(reader, record);
+                }
+                finally {
+                    reader.db.close?.();
+                }
+            })() : null;
         if ((record.kind === "run-controller" && metadata.role === "controller" && record.operation_id
             || record.kind === "check" && metadata.role === "check" && record.check_id)
             && record.project_id && record.run_id && ["stopped", "failed"].includes(record.state)
-            && record.pid && record.pid_started_at && !processTreeIsAlive(record)) {
+            && record.pid && record.pid_started_at && (terminalCheck || !processTreeIsAlive(record))) {
             const operationId = record.operation_id ?? record.check_id;
             nodes.push({ process_id: record.id, state_dir: metadata.state_dir ?? "", settled: true, operation_id: operationId, owner_operation_id: operationId });
             continue;

package/dist/services/vnext-code.js

@@ -582,7 +582,13 @@ export function verificationProjection(works, receipts, options = {}) {
             if (item.obligation_ref)
                 rawEvidence.set(item.obligation_ref, unique([...(rawEvidence.get(item.obligation_ref) ?? []), ...(item.refs ?? [])]));
     }
-    const acceptance = uniqueBy(packets.flatMap((value) => value.acceptance), (value) => value.criterion_id);
+    const byCriterionGate = new Map();
+    for (const entry of packets.flatMap((value) => value.acceptance)) {
+        const key = JSON.stringify([entry.criterion_id, entry.gate]);
+        const previous = byCriterionGate.get(key);
+        byCriterionGate.set(key, { criterion_id: entry.criterion_id, gate: entry.gate, check_refs: unique([...(previous?.check_refs ?? []), ...entry.check_refs]) });
+    }
+    const acceptance = [...byCriterionGate.values()];
     const historicalReceiptRefs = new Set((options.historicalReceipts ?? receipts).flatMap((receipt) => receiptReferences(receipt, options)));
     const acceptanceEvidence = new Map(acceptance.map((item) => {
         const reported = rawEvidence.get(item.criterion_id) ?? [];