@deksden-com/dd-flow-cli 0.9.0-beta.121 → 0.9.0-beta.123

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.123
+
+### Patch Changes
+
+- Continue confirmed Codex overloads in the retained Session with bounded backoff, exact owner admission and no concurrent productive Turns.
+- Retain content-addressed verification evidence and reviewer input baselines across publication, relocation and review waves.
+- Preserve canonical native model/tool observations and AGY child transcript evidence without rewriting historical results.
+
+## 0.9.0-beta.122
+
+### Patch Changes
+
+- Generate a deterministic RUN-local verification matrix from accepted requirements, PLAN and exact check receipts; publish retained input/output packets and show their paths in shared Stage/Work instructions.
+- Recognize one unambiguous lifecycle command through the shared Bash grammar instead of rejecting all shell composition; retain scoped authority, execution-directory and foreground checks.
+- Share native hook deadlines through subprocess and SQLite admission, retain bounded phase diagnostics and the first ZCode failure, and prepare Stage archive/Git work outside the writer.
+- Admit the tested ZCode ACP 0.52 bridge and retain explicitly configured native storage routes across daemon lifecycle calls.
+
 ## 0.9.0-beta.120
 
 ### Patch Changes

package/dist/build-info.json

@@ -1,11 +1,11 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.121",
-  "cli_commit": "2e7bef9a7813bd003855d94b394e63d8aa5f6419",
-  "built_at": "2026-09-29T16:13:36.621Z",
+  "cli_version": "0.9.0-beta.123",
+  "cli_commit": "0d75e9e7e18868fbe9eee8d51e4c4d06ab03a8cd",
+  "built_at": "2026-09-30T12:08:03.924Z",
   "built_with_canon": {
-    "version": "4.1.1",
-    "commit": "678daa038287c948ada5b2d785a6dcc925c7b891",
+    "version": "4.1.2",
+    "commit": "bbb3845083d7c1984bb61d813dd6700fe695180a",
     "flow_contract": "dd-flow-canonical-2026-08",
     "repo_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank",
     "memorybank_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank/.memory-bank",

package/dist/cli/hook-ingress.js

@@ -21,11 +21,12 @@ export async function runHookIngress(args) {
             throw new AppError("usage", "--project-root requires a value", 2);
         if (parsed.options.has("json") && parsed.options.get("json")?.[0] !== "__dd_flow_flag__")
             throw new AppError("usage", "--json does not take a value", 2);
-        const budget = hookBudget(ingressBudgetMs);
+        const budget = hookBudget(ingressBudgetMs, process.env.DD_FLOW_HOOK_DEADLINE_AT ? Number(process.env.DD_FLOW_HOOK_DEADLINE_AT) : null);
         const stdin = await readNativeHookInput(process.stdin, budget);
         const payload = parseJsonObject(stdin || "{}", "native hook stdin");
         const command = lifecycleCommandFromPayload(payload);
-        if (event !== "PreToolUse" || !command || (parseLifecycleCommand(command).kind === "none" && !continuationCommand(command))) {
+        const analysis = command ? parseLifecycleCommand(command) : { kind: "none", unresolved: false };
+        if (event !== "PreToolUse" || !command || (analysis.kind === "none" && !analysis.unresolved && !continuationCommand(command))) {
             process.stdout.write("{}\n");
             return 0;
         }
@@ -46,7 +47,7 @@ export async function runHookIngress(args) {
 // A bounded CLI subprocess, not a detached writer: its successful reply follows COMMIT.
 if (process.argv[1] === workerFile) {
     try {
-        const stdin = await readNativeHookInput(process.stdin, hookBudget(ingressBudgetMs));
+        const stdin = await readNativeHookInput(process.stdin, hookBudget(ingressBudgetMs, process.env.DD_FLOW_HOOK_DEADLINE_AT ? Number(process.env.DD_FLOW_HOOK_DEADLINE_AT) : null));
         const payload = parseJsonObject(stdin, "native hook stdin");
         const started = performance.now();
         const { verifyCodexHookDelivery } = await import("../services/codex-hook-delivery.js");

package/dist/cli/native-hook-ingress.js

@@ -1,11 +1,22 @@
 import { AppError, errorRecord } from "../shared/errors.js";
 import { parseCommandArgs } from "../services/lifecycle-command.js";
+import { channel } from "node:diagnostics_channel";
 /** These ingress commands consume a prepared store; they never prepare it. */
 export function isNativeHookIngress(args) {
     return args[2] === "handle" && ((args[1] === "event" && ["agy", "grok", "droid", "opencode", "zcode"].includes(args[0] ?? ""))
         || args[0] === "zcode" && args[1] === "hook");
 }
 export async function dispatchNativeHook(args, stdin, env) {
+    const started = performance.now();
+    const deadline = env.DD_FLOW_HOOK_DEADLINE_AT === undefined ? undefined : Number(env.DD_FLOW_HOOK_DEADLINE_AT);
+    if (deadline !== undefined && !Number.isSafeInteger(deadline))
+        throw new AppError("hook_deadline_invalid", "Native hook deadline must be an absolute millisecond timestamp", 1, { effect: "unknown" });
+    const phase = (name) => {
+        if (deadline !== undefined && deadline <= Date.now())
+            throw new AppError("native_hook_timeout", "Native hook deadline expired", 1, { phase: name, effect: "unknown" });
+        process.stderr.write(`${JSON.stringify({ kind: "native_hook_phase", phase: name, elapsed_ms: Math.round(performance.now() - started), ...(deadline !== undefined ? { remaining_ms: Math.max(0, deadline - Date.now()) } : {}) })}\n`);
+    };
+    phase("import");
     const parsed = parseCommandArgs(args.slice(3));
     const projectRoot = parsed.options.get("project-root")?.[0];
     if (!isNativeHookIngress(args) || parsed.positional.length || !projectRoot || projectRoot === "__dd_flow_flag__")
@@ -16,27 +27,48 @@ export async function dispatchNativeHook(args, stdin, env) {
     const [hooks, { createContext }, { resolveDdFlowHome }] = await Promise.all([
         import("../services/hooks.js"), import("../runtime/context.js"), import("../storage/paths.js")
     ]);
+    phase("imported");
     let opened;
     // Reuse the actual envelope validators and shell parser. They return for
     // unrelated tools before their first DB access, without duplicating policy.
     const context = {
         env, ddFlowHome: resolveDdFlowHome(env), now: () => new Date().toISOString(),
-        get db() { return (opened ??= createContext(env, "hook")).db; }
+        get db() {
+            if (!opened) {
+                phase("store_open");
+                opened = createContext(env, "hook");
+                phase("store_opened");
+            }
+            return opened.db;
+        }
     };
     const handler = args[0] === "agy" ? hooks.handleAgyEvent : args[0] === "grok" ? hooks.handleGrokEvent
         : args[0] === "droid" ? hooks.handleDroidEvent : args[0] === "opencode" ? hooks.handleOpenCodeEvent
             : args[1] === "hook" ? hooks.handleZcodeHook : hooks.handleZcodeEvent;
+    const timing = channel("dd-flow.sqlite.ingress");
+    // This command owns one synchronous store; there is no concurrent handler here.
+    let previousPhase;
+    const log = (value) => {
+        const record = value;
+        if (record.phase === previousPhase)
+            return;
+        previousPhase = record.phase;
+        process.stderr.write(`${JSON.stringify({ kind: "native_hook_phase", phase: record.phase, elapsed_ms: Math.round(performance.now() - started), ...(record.remaining_ms !== undefined ? { remaining_ms: record.remaining_ms } : {}) })}\n`);
+    };
+    timing.subscribe(log);
     try {
+        phase("receipt");
         return await handler(context, { projectRoot, stdin });
     }
     finally {
+        timing.unsubscribe(log);
         opened?.db.close?.();
     }
 }
 export async function runNativeHookIngress(args) {
     try {
         const { readNativeHookInput, hookBudget } = await import("../harness-runtime/lib/native-hook-command.mjs");
-        const stdin = await readNativeHookInput(process.stdin, hookBudget());
+        const stdin = await readNativeHookInput(process.stdin, hookBudget(25_000, process.env.DD_FLOW_HOOK_DEADLINE_AT ? Number(process.env.DD_FLOW_HOOK_DEADLINE_AT) : null));
         process.stdout.write(`${JSON.stringify(await dispatchNativeHook(args, stdin, process.env))}\n`);
         return 0;
     }

package/dist/cli/run-cli.js

@@ -75,6 +75,7 @@ import { launchRuntimeScopeControl, launchRuntimeScopeResume, prepareRuntimeScop
 import { prepareRuntimeScopeResumeRequest } from "../services/runtime-scope-resume.js";
 import { launchRunController, prepareRunControllerLaunch, resumeRunController, serveRunController, runControllerStatus, answerRunController, prepareRunControllerAnswer, supplyRunControllerContext, prepareRunControllerContext } from "../services/run-controller.js";
 import { controllerHitlAdmission } from "../services/run-controller-adapter.js";
+import { assertCapacityOwnerAdmission } from "../services/codex-capacity.js";
 import { controlLifecycleReply, runControlStatus } from "../services/run-control.js";
 import { reconcileRunControl, requestRunControl, serveRunControl } from "../services/run-control-worker.js";
 import { startRuntimeService, prepareRuntimeService } from "../services/runtime-service.js";
@@ -2656,6 +2657,8 @@ async function dispatchRuntime(context, command, parsed, progress, prepared = {}
             const acceptedHitlPrompt = ["paused", "waiting_for_user"].includes(run?.status ?? "") && controllerHitlAdmission(context, record, { stateDir: requiredOption(parsed, "state-dir"), operationId: optionalOption(parsed, "operation-id"), operation: optionalOption(parsed, "operation"), nativeSessionId: optionalOption(parsed, "native-session-id"), promptSha256: optionalOption(parsed, "prompt-sha256") });
             if (!run || run.status !== "running" && !retainedHitlPrompt && !acceptedHitlPrompt && !["judge", "probe"].includes(metadata.role ?? ""))
                 throw new AppError("invalid_run_state", "Subject dispatch requires a running RUN or its retained recovery/HITL prompt", 1);
+            if (!recovering)
+                assertCapacityOwnerAdmission(context, record, optionalOption(parsed, "operation-id"));
         }
         const budget = reserveProviderTurn(context, record, { operationId: optionalOption(parsed, "operation-id") ?? "", operation: optionalOption(parsed, "operation") ?? "", sessionId: optionalOption(parsed, "native-session-id"), daemonId: optionalOption(parsed, "daemon-id") });
         return { ok: true, ...budget, process_id: record.id, generation: metadata.run_generation ?? null };

package/dist/harness-runtime/bin/dd-agy.mjs

@@ -15,7 +15,7 @@ async function hook(options) {
   const payload = JSON.parse(await readNativeHookInput(process.stdin, budget) || "{}"), event = options.event;
   try {
   const observationMs = budget.remaining("observation");
-  const identity = await callDaemon(options["state-dir"], "hook.observe", { event, payload, daemonId: options["daemon-id"], deadlineAt: Date.now() + observationMs }, observationMs, requestId);
+  const identity = await callDaemon(options["state-dir"], "hook.observe", { event, payload, daemonId: options["daemon-id"], deadlineAt: budget.deadlineAt }, observationMs, requestId);
   if (identity.stale) return event === "PreToolUse" ? { decision: "deny", reason: "agy_stale_hook" } : {};
   if (event === "PreToolUse" || event === "PostToolUse") {
     const phase = event === "PreToolUse" ? "before" : "after", args = payload.toolCall?.args ?? {};
@@ -28,7 +28,10 @@ async function hook(options) {
   } catch (error) {
     // A failed socket cannot be used to report its own failure. The daemon
     // reads only receipts matching request IDs it actually accepted this turn.
-    try { await writeJsonAtomic(path.join(options["state-dir"], "hook-failures", `${requestId}.json`), { request_id: requestId, observed_at: new Date().toISOString(), code: error.code ?? "agy_hook_rejected", message: error.message, details: { ...error.details, effect: "unknown" } }); }
+    const correctable = event === "PreToolUse" && error.code === "lifecycle_shell_syntax_invalid" && error.details?.effect === "no_effect"
+      && error.details?.recoverable === true && error.details?.disposition === "pre_cli_shell_refusal";
+    try { await writeJsonAtomic(path.join(options["state-dir"], "hook-failures", `${requestId}.json`), { request_id: requestId, observed_at: new Date().toISOString(), code: error.code ?? "agy_hook_rejected", message: error.message,
+      details: { ...error.details, effect: correctable ? "no_effect" : "unknown", ...(correctable ? { native_pre_cli_refusal: true } : {}) } }); }
     catch (storage) { process.stderr.write(`${JSON.stringify({ code: error.code, receipt_error: storage.message })}\n`); }
     throw error;
   }
@@ -49,4 +52,4 @@ try {
   else if (family === "session") { if (command === "fork") throw Object.assign(new Error("Antigravity native headless fork is unsupported; use deterministic_replay"), { code: "agy_headless_fork_unsupported" }); const operation = command === "status" ? "inspect" : command; result = await callDaemon(common.stateDir, `session.${operation}`, { sessionId: options["session-id"], ...(command === "create" || command === "prompt" ? { prompt: await prompt(options) } : {}), tree: options.tree === true }, common.timeoutMs ?? 1_800_000); }
   else throw new Error("usage: dd-agy doctor | hooks install|check | daemon start|status|stop | session create|prompt|inspect|resume|cancel|fork [options] --json");
   process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`);
-} catch (error) { if (process.argv.includes("hook") && process.argv.includes("handle")) { process.stdout.write(`${JSON.stringify({ decision: "deny", reason: error.code ?? "agy_hook_rejected" })}\n`); process.exit(0); } process.stderr.write(`${JSON.stringify({ ok: false, error: error.message, ...(error.code ? { code: error.code, retryable: error.retryable === true, details: error.details } : {}) })}\n`); process.exit(1); }
+} catch (error) { if (process.argv.includes("hook") && process.argv.includes("handle")) { process.stdout.write(`${JSON.stringify({ decision: "deny", reason: `${error.code ?? "agy_hook_rejected"}: ${error.message ?? "Native hook refused this tool call"}` })}\n`); process.exit(0); } process.stderr.write(`${JSON.stringify({ ok: false, error: error.message, ...(error.code ? { code: error.code, retryable: error.retryable === true, details: error.details } : {}) })}\n`); process.exit(1); }

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -1,5 +1,7 @@
 import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mjs";
-import { ToolObservations, agyToolObservation } from "./tool-observations.mjs";
+import { ToolObservations, agyToolObservation, agyTranscriptObservations } from "./tool-observations.mjs";
+import { constants } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { createHash, randomUUID } from "node:crypto";
 import { appendFile, chmod, lstat, mkdir, open, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
@@ -16,6 +18,29 @@ import { prepareRuntimeOwner, cleanupFailedStart, cleanupFailedDaemonStart, conf
 
 const REQUEST_SCHEMA = "dd-agy/daemon-request@1", RESPONSE_SCHEMA = "dd-agy/daemon-response@1", STATE_SCHEMA = "dd-agy/daemon-state@1";
 class DaemonError extends AgyError {}
+export async function captureAgyTranscript(runtimeRoot, child, rootSessionId, ownedSessionIds = [rootSessionId]) {
+  const session = { harness_id: "antigravity-cli", session_id: child.provider_session_id };
+  let handle;
+  try {
+    if (!rootSessionId || !child.provider_session_id || !ownedSessionIds.includes(child.parent_provider_session_id) || !child.log_uri || !/^[\w-]+$/.test(child.provider_session_id)) throw new Error("unbound native locator");
+    const expected = path.join(runtimeRoot, "brain", child.provider_session_id, ".system_generated", "logs", "transcript.jsonl");
+    const canonical = path.join(await realpath(runtimeRoot), "brain", child.provider_session_id, ".system_generated", "logs", "transcript.jsonl");
+    if (![expected, canonical].includes(fileURLToPath(child.log_uri)) || await realpath(expected) !== canonical) throw new Error("foreign or symlink native locator");
+    const before = await lstat(expected);
+    if (!before.isFile()) throw new Error("native locator is not a regular file");
+    handle = await open(expected, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    const stat = await handle.stat();
+    if (!before.isFile() || !stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino || await realpath(expected) !== canonical) throw new Error("native locator changed during open");
+    const maximum = 8 * 1024 * 1024, buffer = Buffer.alloc(Math.min(stat.size, maximum));
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+    const bytes = buffer.subarray(0, bytesRead), prefix = bytes.subarray(0, bytes.lastIndexOf(10) + 1);
+    const source = { locator: child.log_uri, byte_start: 0, byte_end: prefix.length, sha256: createHash("sha256").update(prefix).digest("hex") };
+    const events = agyTranscriptObservations(prefix.toString("utf8"), child.provider_session_id, child.parent_provider_session_id ?? rootSessionId, source);
+    if (prefix.length !== bytesRead || stat.size > maximum) events.push({ session, reason: stat.size > maximum ? "agy_transcript_size_limit" : "agy_transcript_partial_tail" });
+    return events;
+  } catch (error) { return [{ session, reason: error.code === "ENOENT" ? "agy_transcript_missing" : "agy_transcript_locator_rejected" }]; }
+  finally { await handle?.close(); }
+}
 const absolute = (value, label) => { if (!value || !path.isAbsolute(value)) throw new DaemonError("invalid_path", `${label} must be an absolute path`); return path.resolve(value); };
 function locations(stateDir) {
   const dir = absolute(stateDir, "--state-dir"), digest = createHash("sha256").update(dir).digest("hex").slice(0, 22), local = path.join(dir, "daemon.sock");
@@ -192,7 +217,7 @@ export async function startDaemon(options) {
   const version = (await runAgy(config.bin, ["--version"], { cwd: config.cwd, env: sanitizedEnv(config), timeoutMs: AGY_VERSION_TIMEOUT_MS })).stdout.trim();
   const resourceProcess = await registerDaemonProcess(config, { kind: "agy-daemon", owner: `agy:${path.basename(paths.dir)}`, operation: `agy-daemon:${path.basename(paths.dir)}`, stdout: paths.log, stderr: paths.log });
   const retained = retainedAgyState(previous, config.resumeSessionId);
-  await writeJson(paths.state, { schema_id: STATE_SCHEMA, daemon_id: config.daemonId, shutdown_state: "starting", active_tree: false, unclaimed_activity: retained.unclaimed_activity ?? false, retained_tree_settlement: retained.retained_tree_settlement ?? null, versions: { agy: version }, config, sessions: [], session_observations: retained.session_observations ?? [], descendants: retained.descendants ?? [], tool_calls: retained.tool_calls ?? [], completed_tool_steps: retained.completed_tool_steps ?? [], tool_identity_complete: retained.tool_identity_complete !== false, turn_generation: retained.turn_generation ?? 0, last_result: retained.last_result ?? null, resource_process: resourceProcess });
+  await writeJson(paths.state, { schema_id: STATE_SCHEMA, daemon_id: config.daemonId, shutdown_state: "starting", active_tree: false, unclaimed_activity: retained.unclaimed_activity ?? false, retained_tree_settlement: retained.retained_tree_settlement ?? null, versions: { agy: version }, config, sessions: [], session_observations: retained.session_observations ?? [], descendants: retained.descendants ?? [], ...(Array.isArray(retained.tool_observations) ? { tool_observations: retained.tool_observations } : {}), tool_observation_gaps: retained.tool_observation_gaps ?? [], tool_calls: retained.tool_calls ?? [], completed_tool_steps: retained.completed_tool_steps ?? [], tool_identity_complete: retained.tool_identity_complete !== false, turn_generation: retained.turn_generation ?? 0, last_result: retained.last_result ?? null, resource_process: resourceProcess });
   const log = await open(paths.log, "a", 0o600), child = spawn(process.execPath, [config.entryPath, "daemon", "serve", "--state-dir", paths.dir], { cwd: config.cwd, env: sanitizedEnv(config), detached: true, stdio: ["ignore", log.fd, log.fd] }); child.unref(); await log.close();
   try {
     await confirmDaemonProcess(config, resourceProcess, child);
@@ -214,7 +239,7 @@ export const stopDaemon = async options => { const timeoutMs = options.timeoutMs
 
 export class Runtime {
   constructor(paths, state) { this.paths = paths; this.state = state; this.config = state.config; this.child = null; this.providerProcess = state.provider_process ?? null; this.providerFinalization = Promise.resolve(); this.buffer = ""; this.init = null; this.readyPromise = null; this.active = null; this.exited = false; this.toolObservations = new ToolObservations(); for (const reason of state.tool_observation_gaps ?? []) this.toolObservations.gaps.add(reason); for (const event of state.tool_observations ?? []) this.toolObservations.add(event); if (state.tool_calls?.length && !state.tool_observations) this.toolObservations.gaps.add("legacy_tools_not_attributed"); this.turnGeneration = state.turn_generation ?? 0; this.descendants = new Map((state.descendants ?? []).map(child => [child.provider_session_id, child])); this.lastResult = state.last_result ?? null; this.sessionObservations = new Map(state.session_observations ?? []); this.startupError = null; this.persisting = Promise.resolve(); this.draining = Promise.resolve(); this.lastActivityAt = state.last_activity_at ?? null; this.usageIngest = null; this.lastProviderEvent = null; }
-  persist(patch = {}) { Object.assign(this.state, patch, { pid: process.pid, updated_at: new Date().toISOString(), last_activity_at: this.lastActivityAt, session_observations: [...this.sessionObservations], tool_observations: [...this.toolObservations.calls.values()], tool_observation_gaps: [...this.toolObservations.gaps], turn_generation: this.turnGeneration, descendants: [...this.descendants.values()], sessions: this.init ? [{ provider_session_id: this.init.conversation_id, root_provider_session_id: this.init.conversation_id, cwd: this.config.cwd }] : [] }); const snapshot = structuredClone(this.state); const queued = performance.now(); this.persisting = this.persisting.then(async () => { const started = performance.now(); await writeJson(this.paths.state, snapshot); this.persistTiming = { queue_ms: Math.round(started - queued), write_ms: Math.round(performance.now() - started) }; }); return this.persisting; }
+  persist(patch = {}) { Object.assign(this.state, patch, { pid: process.pid, updated_at: new Date().toISOString(), last_activity_at: this.lastActivityAt, session_observations: [...this.sessionObservations], tool_observations: [...this.toolObservations.calls.values(), ...this.toolObservations.sources.values()], tool_observation_gaps: [...this.toolObservations.gaps], turn_generation: this.turnGeneration, descendants: [...this.descendants.values()], sessions: this.init ? [{ provider_session_id: this.init.conversation_id, root_provider_session_id: this.init.conversation_id, cwd: this.config.cwd }] : [] }); const snapshot = structuredClone(this.state); const queued = performance.now(); this.persisting = this.persisting.then(async () => { const started = performance.now(); await writeJson(this.paths.state, snapshot); this.persistTiming = { queue_ms: Math.round(started - queued), write_ms: Math.round(performance.now() - started) }; }); return this.persisting; }
   async journal(kind, payload = {}) { const line = `${JSON.stringify({ schema_id: "dd-agy/daemon-event@1", event_id: randomUUID(), observed_at: new Date().toISOString(), kind, ...payload })}\n`; for (const journal of new Set([this.paths.journal, this.config.journal].filter(Boolean))) { await mkdir(path.dirname(journal), { recursive: true, mode: 0o700 }); await appendFile(journal, line, { mode: 0o600 }); } }
   args(sessionId) { return ["--input-format", "stream-json", "--output-format", "stream-json", "--model", this.config.model, "--effort", this.config.reasoning, "--mode", this.config.mode, "--dangerously-skip-permissions", "--print-timeout", "6h", `--gemini_dir=${this.paths.gemini}`, "--app_data_dir=runtime", ...(sessionId ? ["--conversation", sessionId] : ["--new-project"])]; }
   requireSessionIdentity(requestedId) {
@@ -295,6 +320,26 @@ export class Runtime {
     this.observeProviderActivity(event); await this.journal("provider_event", { event }); if (event.event === "init") { this.init = { conversation_id: event.conversation_id, ...(event.init ?? {}) }; if (!this.init.conversation_id) throw new DaemonError("agy_init_missing", "Antigravity init has no conversation ID"); const requested = { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode, permission_mode: "always-proceed" }; this.profile = assertProfile(requested, observedProfile(this.init, requested)); await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: this.init.conversation_id, requested, observed: this.profile.observed, source: "native.init" }); await this.persist({ shutdown_state: "running", active_tree: false }); readyResolve(this.init); } else if (event.event === "step_update") this.observeStep(event.step_update ?? {}); else if (event.event === "result") { if (this.startupError) throw this.startupError; await this.finishTurn(event.result ?? {}); } } }
   observeStep(step) { const sessionId = step.conversation_id ?? this.init?.conversation_id; const observation = this.sessionObservations.get(sessionId) ?? {}; if (Number.isInteger(step.step_index) && step.step_index > (observation.last_step_index ?? -1)) this.childActivity(sessionId); if (Number.isInteger(step.step_index)) this.sessionObservations.set(sessionId, { ...observation, last_step_index: Math.max(observation.last_step_index ?? -1, step.step_index) }); this.toolObservations.add(agyToolObservation(step, this.init?.conversation_id)); for (const child of step.subagent_info?.subagents ?? []) if (child.conversation_id) { const prior = this.descendants.get(child.conversation_id); this.descendants.set(child.conversation_id, { ...prior, provider_session_id: child.conversation_id, parent_provider_session_id: sessionId ?? null, role: child.role ?? null, subagent_type: child.type_name ?? null, log_uri: child.log_uri ?? null, workspace_uris: child.workspace_uris ?? [], status: prior?.status ?? "unknown" }); } }
   toolSnapshot() { const summary = this.toolObservations.summary(); const failures_by_name = {}; for (const event of this.toolObservations.calls.values()) if (event.status === "failed") failures_by_name[event.name] = (failures_by_name[event.name] ?? 0) + 1; return { ...summary, by_name: summary.by_tool, failures_by_name }; }
+  async captureChildTools() {
+    this.capturedToolFacts ??= new Map();
+    const root = this.init?.conversation_id ?? this.state.sessions?.[0]?.provider_session_id ?? this.lastResult?.conversation_id;
+    for (const child of this.descendants.values()) {
+      const ancestors = new Set(); let parent = child.parent_provider_session_id;
+      while (parent && parent !== root && this.descendants.has(parent) && !ancestors.has(parent)) {
+        ancestors.add(parent); parent = this.descendants.get(parent).parent_provider_session_id;
+      }
+      const events = parent === root && root
+        ? await captureAgyTranscript(this.paths.runtime, child, root, [root, ...ancestors])
+        : [{ session: { harness_id: "antigravity-cli", session_id: child.provider_session_id }, reason: "agy_transcript_ancestry_unproven" }];
+      for (const event of events) {
+        this.toolObservations.add(event);
+        const key = JSON.stringify([event.session, event.call_id, event.reason]), encoded = JSON.stringify(event);
+        if (this.capturedToolFacts.get(key) === encoded) continue;
+        await this.journal("tool_observation", { schema_id: "dd-flow/tool-observation@1", event });
+        this.capturedToolFacts.set(key, encoded);
+      }
+    }
+  }
   async finishTurn(result) {
     if (result.status === "RUNNING") { await this.persist({ active_tree: true }); return; }
     if (!["SUCCESS", "ERROR", "CANCELLED"].includes(result.status)) throw new DaemonError("agy_terminal_result_invalid", "Antigravity result has no recognized terminal status", false, { provider_result: result });
@@ -312,6 +357,7 @@ export class Runtime {
     // are not request IDs: native command rejections can report zero turns.
     // prompt() drains earlier events before accepting another input.
     if (!current && this.lastResult) { await this.journal("stale_terminal_observed", { result }); return; }
+    await this.captureChildTools();
     this.lastResult = result; this.markActivity();
     const rootStop = this.sessionObservations.get(this.init?.conversation_id)?.stop;
     const pendingTerminal = current && result.status === "SUCCESS";
@@ -404,6 +450,21 @@ export class Runtime {
   }
   async rejectHook(error, event, payload, current = this.active) {
     if (current && this.active !== current) return;
+    const correctable = current && event === "PreToolUse" && error.code === "lifecycle_shell_syntax_invalid"
+      && error.details?.effect === "no_effect" && error.details?.recoverable === true
+      && error.details?.disposition === "pre_cli_shell_refusal" && error.details?.native_pre_cli_refusal === true;
+    if (correctable && current.hookCorrectionGeneration !== current.generation) {
+      // The request was correlated with this still-active Turn by
+      // observeHookFailures. Persist before allowing native same-Turn recovery.
+      const correction = { code: error.code, message: error.message, details: error.details, event, conversation_id: payload.conversationId ?? null,
+        daemon_id: this.config.daemonId, operation_id: current.operationId, turn_generation: current.generation };
+      try {
+        await this.journal("hook_correction", { correction });
+        await this.persist({ last_hook_correction: correction });
+        current.hookCorrectionGeneration = current.generation;
+        return;
+      } catch (storage) { error = Object.assign(new Error("Could not persist native hook correction"), { code: "native_hook_receipt_invalid", details: { effect: "unknown", primary_error: correction, receipt_error: storage.message } }); }
+    }
     const rejection = this.state.last_hook_rejection && this.state.last_hook_rejection.turn_generation === current?.generation ? this.state.last_hook_rejection : { code: error.code ?? "agy_hook_rejected", message: error.message ?? String(error), details: error.details, event, conversation_id: payload.conversationId ?? null, tool: payload.toolCall?.name ?? null, daemon_id: this.config.daemonId, operation_id: current?.operationId ?? null, turn_generation: current?.generation ?? null };
     this.state.last_hook_rejection = rejection;
     if (current && this.active === current) { this.active = null; current.reject(new DaemonError(rejection.code, rejection.message, false, rejection)); }
@@ -417,12 +478,13 @@ export class Runtime {
       try { failure = JSON.parse(await readFile(path.join(this.paths.dir, "hook-failures", `${requestId}.json`), "utf8")); }
       catch (error) { if (error.code === "ENOENT") continue; failure = { code: "native_hook_receipt_invalid", message: error.message }; }
       if (failure.request_id !== undefined && failure.request_id !== requestId) continue;
+      this.hookRequests.delete(requestId);
       await this.rejectHook(Object.assign(new Error(failure.message ?? "Native hook failed"), { code: failure.code, details: failure.details }), binding.event, binding.payload, binding.current);
     }
   }
   async observeHook(event, payload, budget = null) { const conversationId = payload.conversationId ?? this.init?.conversation_id; const child = await this.childForHook(conversationId); budget?.remaining("identity"); const prior = this.sessionObservations.get(conversationId) ?? {}; const execution = Number.isInteger(payload.executionNum) ? payload.executionNum : null; const step = Number.isInteger(payload.stepIdx) ? payload.stepIdx : null; const floor = prior.step_floor; const stale = step !== null && ((Number.isInteger(floor) && step <= floor) || (child && Number.isInteger(prior.last_step_index) && step < prior.last_step_index)); if (stale) { await this.journal("stale_hook", { hook_event: event, conversation_id: conversationId, step_index: step }); return { stale: true }; } const fingerprint = createHash("sha256").update(JSON.stringify({ event, payload })).digest("hex"); if (!stale && prior.last_hook !== fingerprint) this.markActivity(); if (conversationId && !stale) this.sessionObservations.set(conversationId, { ...prior, ...(step !== null ? { last_step_index: Math.max(prior.last_step_index ?? -1, step) } : {}), last_hook: fingerprint, ...(event === "PreToolUse" ? { last_pre_hook: fingerprint } : {}), ...(payload.transcriptPath ? { transcript_path: payload.transcriptPath } : {}), ...(event === "Stop" ? { stop: { fullyIdle: payload.fullyIdle === true, terminationReason: payload.terminationReason ?? null, executionNum: payload.executionNum ?? null } } : {}) }); if (!stale && event === "PreToolUse" && prior.last_pre_hook !== fingerprint) this.childActivity(conversationId); if (child && !stale && event === "Stop" && payload.fullyIdle === true) this.descendants.set(conversationId, { ...this.descendants.get(conversationId), tree_settled: true, settlement_evidence: "child_fully_idle_stop" }); const terminalPending = this.active?.terminalResult === this.lastResult; if (!child && !stale && event === "Stop" && payload.fullyIdle === true && (!this.active || terminalPending) && ["SUCCESS", "ERROR", "CANCELLED"].includes(this.lastResult?.status)) for (const [id, descendant] of this.descendants) if (descendant.status === "unknown") this.descendants.set(id, { ...descendant, status: "settled_by_root", settlement_evidence: "root_fully_idle_stop" }); const parent = child?.parent_provider_session_id ?? null;
     const observed = payload.model ? observedProfile(payload) : {};
-    await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: conversationId, parentSessionId: parent, requested: this.config, observed, source: "native.hook", evidence: payload.model ? "configured" : "unavailable", reason: payload.model ? null : "hook_omits_current_model" });
+    await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: conversationId, parentSessionId: parent, requested: this.config, observed, source: { channel: "native.hook", scope: "configured", ...(!payload.model ? { non_asserting: true } : {}) }, evidence: payload.model ? "configured" : "unavailable", reason: payload.model ? null : "hook_omits_current_model" });
     const eventId = createHash("sha256").update(JSON.stringify({ daemon: this.config.daemonId, event, conversationId, fully_idle: payload.fullyIdle ?? null, termination_reason: payload.terminationReason ?? null, execution: payload.executionNum ?? null, step: payload.stepIdx ?? null, tool: payload.toolCall?.name ?? null, args: payload.toolCall?.args ?? null })).digest("hex"); await this.persist(); await this.journal("hook", { stale, hook_event: event, event_id: eventId, conversation_id: conversationId, turn_generation: this.turnGeneration, execution_num: execution, step_index: step, termination_reason: payload.terminationReason ?? null, fully_idle: payload.fullyIdle ?? null, persistence_timing: this.persistTiming ?? null }); await this.completePendingTurn(); return { event_id: eventId, daemon_id: this.config.daemonId, launch_cwd: this.config.cwd, parent_conversation_id: parent, profile: observed, requested_profile: { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode }, project_root: this.config.projectRoot, dd_flow_bin: this.config.ddFlowBin, dd_flow_home: this.config.ddFlowHome };
   }
   async finalizeProviderForControl() {
@@ -446,7 +508,7 @@ export class Runtime {
     await this.finalizeProviderForControl();
     await finishDaemonProcess(this.config, providerProcess, "failed", reason);
   }
-  async finishResource(state = "stopped", reason = "daemon_stopped") { await finishDaemonProcess(this.config, this.state.resource_process, state, reason); }
+  async finishResource(state = "stopped", reason = "daemon_stopped") { await this.captureChildTools(); await finishDaemonProcess(this.config, this.state.resource_process, state, reason); }
 }
 
 export async function serveDaemon(stateDir) {
@@ -469,7 +531,7 @@ async function dispatch(runtime, request) {
   if (request.operation === "daemon.status") { await runtime.observeHookFailures(); return { daemon_id: runtime.config.daemonId, shutdown_state: runtime.state.shutdown_state, active_tree: runtime.state.active_tree, active_operation: runtime.active?.operationId ?? null, last_hook_rejection: runtime.state.last_hook_rejection ?? null, last_activity_at: runtime.lastActivityAt, provider_ready: Boolean(runtime.init && !runtime.exited), pid: process.pid, provider_pid: runtime.child?.pid ?? null, versions: runtime.state.versions, config: runtime.config, sessions: runtime.state.sessions ?? [], receipt: runtime.receipt() }; }
   if (request.operation === "session.create") { if (params.sessionId) throw new DaemonError("invalid_create", "create does not accept a Session ID"); if (params.prompt) throw new DaemonError("invalid_create", "create does not execute a prompt; use session.prompt"); await runtime.start(); await runtime.zeroUsage(); return runtime.receipt(); }
   if (request.operation === "session.prompt") { const assertDispatch = captureDispatchGuard(runtime); await runtime.start(params.sessionId ?? null); runtime.requireSessionIdentity(params.sessionId); return await runtime.prompt(params.prompt, assertDispatch, request.id); }
-  if (request.operation === "session.inspect") { runtime.requireSessionIdentity(params.sessionId); return runtime.receipt(); }
+  if (request.operation === "session.inspect") { runtime.requireSessionIdentity(params.sessionId); await runtime.captureChildTools(); return runtime.receipt(); }
   if (request.operation === "session.resume") { await runtime.start(params.sessionId ?? runtime.init?.conversation_id ?? null); runtime.requireSessionIdentity(params.sessionId); return runtime.receipt(); }
   if (request.operation === "session.cancel") { runtime.requireSessionIdentity(params.sessionId); return await runtime.cancel(); }
   if (request.operation === "hook.observe") {

package/dist/harness-runtime/lib/dd-codex-daemon.mjs

@@ -9,7 +9,7 @@ import { spawn } from "node:child_process";
 import { waitForSettlement } from "./session-settlement.mjs";
 import { errorRecord } from "./operation-errors.mjs";
 import { CodexBridge, cancelSessionWithBridge, createSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge, startSessionWithBridge } from "./dd-codex.mjs";
-import { prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
+import { assertDaemonOwnership, prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
 
 const requestSchema = "dd-codex/daemon-request@1";
 const responseSchema = "dd-codex/daemon-response@1";
@@ -38,7 +38,7 @@ async function observeCodexSessions(bridge, options, sessions, active, remember
   }
   const unsettled = [], observations = [];
   for (const sessionId of sessions) {
-    const observed = await inspectSessionWithBridge(bridge, { ...options, sessionId });
+    const observed = await inspectSessionWithBridge(bridge, { ...options, sessionId, turnId: sessionId === options.sessionId ? options.turnId : undefined });
     for (const child of observed.descendants ?? []) { sessions.add(child.provider_session_id); remember(child.provider_session_id); }
     const status = observed.status?.type ?? observed.status;
     const stored = ["notLoaded", "systemError"].includes(status) ? await bridge.request("thread/turns/list", { threadId: sessionId, limit: 1, sortDirection: "desc", itemsView: "summary" }, 5_000) : null;
@@ -101,7 +101,7 @@ export async function serveDaemon(stateDir) {
   bridge.close = async () => { await closeBridge(); await finishDaemonProcess(state.config, state.provider_process, "stopped", "daemon_stopped"); };
   scheduleDaemonProcessHeartbeat(state.config, state.resource_process);
   const save = (patch = {}) => { Object.assign(state, patch, { pid: process.pid, updated_at: new Date().toISOString(), sessions: [...sessions] }); const snapshot = structuredClone(state); persist = persist.then(() => writeState(paths.state, snapshot)); return persist; };
-  const dispatch = async (operation, params) => {
+  const dispatch = async (operation, params, operationId) => {
     const assertDispatch = captureDispatchGuard(bridge);
     if (operation === "hook.verify") {
       if (params.daemonId !== state.daemon_id) throw Object.assign(new Error("Hook daemon identity differs"), { code: "native_hook_unproven" });
@@ -125,7 +125,23 @@ export async function serveDaemon(stateDir) {
     }
     if (active && !["session.inspect", "session.cancel"].includes(operation)) throw Object.assign(new Error(`${active} is in progress`), { code: "operation_busy", retryable: true });
     if (operation === "session.create") { active = operation; try { await save({ active_operation: active }); const result = await createSessionWithBridge(bridge, { ...state.config, ...params }); sessions.add(result.provider_session_id); return result; } finally { active = null; await save({ active_operation: null }); } }
-    if (operation === "session.prompt") { sessions.add(params.sessionId); active = operation; try { await save({ active_operation: active }); return await promptSessionWithBridge(bridge, { ...state.config, ...params, assertDispatch }); } finally { active = null; await save({ active_operation: null }); } }
+    if (operation === "session.prompt") {
+      // Admission can wait for a permit. Observe again after it returns, not
+      // just before the caller's backoff, so no child Turn races this dispatch.
+      // Reserve before the first await: distinct operation IDs are independent
+      // journal entries and must not both pass the idle check while inspecting.
+      active = operation;
+      try {
+        const tree = await inspectCodexTree(bridge, { ...state.config, ...params });
+        assertDispatch();
+        if (tree.settled !== true) throw Object.assign(new Error("native Session tree changed while waiting for admission"), { code: "tree_not_settled", details: { provider_session_id: params.sessionId, unsettled_sessions: tree.unsettled_sessions } });
+        if (/:capacity:[12]:session\.prompt$|:child:[a-f0-9]+:followup:[12]$/.test(operationId ?? ""))
+          await assertDaemonOwnership(paths.dir, { "operation-id": operationId, operation, "native-session-id": params.sessionId, "prompt-sha256": createHash("sha256").update(params.prompt ?? "").digest("hex") }, assertDispatch);
+        sessions.add(params.sessionId);
+        await save({ active_operation: active }); return await promptSessionWithBridge(bridge, { ...state.config, ...params, assertDispatch });
+      }
+      finally { active = null; await save({ active_operation: null }); }
+    }
     if (operation === "session.start") { sessions.add(params.sessionId); active = operation; try { await save({ active_operation: active }); return await startSessionWithBridge(bridge, { ...state.config, ...params, assertDispatch }); } finally { active = null; await save({ active_operation: null }); } }
     if (operation === "session.inspect" || operation === "session.resume") {
       const owned = new Set(sessions);
@@ -143,7 +159,7 @@ export async function serveDaemon(stateDir) {
     }
     throw Object.assign(new Error(`unknown operation: ${operation}`), { code: "unknown_operation" });
   };
-await removeSocket(paths.socket); server = net.createServer((connection) => { connection.setEncoding("utf8"); let buffer = ""; connection.on("data", (chunk) => { buffer += chunk; const at = buffer.indexOf("\n"); if (at < 0) return; const line = buffer.slice(0, at); buffer = buffer.slice(at + 1); void (async () => { let request; try { request = JSON.parse(line); if (request.schema_id !== requestSchema || !request.id || !request.operation) throw Object.assign(new Error("invalid daemon request"), { code: "daemon_protocol" }); const result = await durableDaemonDispatch(paths.dir, request, () => dispatch(request.operation, request.params ?? {}), () => dispatch("session.inspect", request.params ?? {})); connection.end(`${JSON.stringify({ schema_id: responseSchema, id: request.id, ok: true, result: { ...result, _shutdown: undefined } })}\n`); if (result._shutdown) { await bridge.close(); await save({ shutdown_state: "clean", stopped_at: new Date().toISOString() }); await finishDaemonProcess(state.config, state.resource_process); server.close(() => process.exit(0)); await removeSocket(paths.socket); } } catch (error) { if (connection.writableEnded) { await save({ shutdown_state: "cleanup_failed", cleanup_error: errorPayload(error) }); return; } connection.end(`${JSON.stringify({ schema_id: responseSchema, id: request?.id ?? null, ok: false, error: errorPayload(error) })}\n`); } })(); }); });
+await removeSocket(paths.socket); server = net.createServer((connection) => { connection.setEncoding("utf8"); let buffer = ""; connection.on("data", (chunk) => { buffer += chunk; const at = buffer.indexOf("\n"); if (at < 0) return; const line = buffer.slice(0, at); buffer = buffer.slice(at + 1); void (async () => { let request; try { request = JSON.parse(line); if (request.schema_id !== requestSchema || !request.id || !request.operation) throw Object.assign(new Error("invalid daemon request"), { code: "daemon_protocol" }); const result = await durableDaemonDispatch(paths.dir, request, () => dispatch(request.operation, request.params ?? {}, request.id), () => dispatch("session.inspect", request.params ?? {})); connection.end(`${JSON.stringify({ schema_id: responseSchema, id: request.id, ok: true, result: { ...result, _shutdown: undefined } })}\n`); if (result._shutdown) { await bridge.close(); await save({ shutdown_state: "clean", stopped_at: new Date().toISOString() }); await finishDaemonProcess(state.config, state.resource_process); server.close(() => process.exit(0)); await removeSocket(paths.socket); } } catch (error) { if (connection.writableEnded) { await save({ shutdown_state: "cleanup_failed", cleanup_error: errorPayload(error) }); return; } connection.end(`${JSON.stringify({ schema_id: responseSchema, id: request?.id ?? null, ok: false, error: errorPayload(error) })}\n`); } })(); }); });
   await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600); await save({ shutdown_state: "running", active_operation: null }); return await new Promise(() => {});
 }
 import { authorizeRetainedDaemonResume } from "./driver-recovery.mjs";

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -542,6 +542,8 @@ function nativeTurnError(bridge, sessionId, turn) {
 function turnItemEvidence(turn) {
   const items = turn?.items;
   return Array.isArray(items) && turn?.itemsView !== "notLoaded" ? { observed: true, count: items.length, types: items.map(item => item?.type ?? "unknown"),
+    items: items.map(item => ({ id: item?.id ?? null, type: item?.type ?? "unknown", status: item?.status ?? null })),
+    pending: items.some(item => !["agentMessage", "reasoning", "userMessage"].includes(item?.type) && !["completed", "failed", "declined"].includes(item?.status)),
     possible_effects: items.some(item => !["agentMessage", "reasoning", "userMessage"].includes(item?.type)) } : { observed: false };
 }
 
@@ -615,7 +617,9 @@ export async function inspectSession(options) {
 
 export async function inspectSessionWithBridge(bridge, options) {
   const sessionId = required(options.sessionId, "--session-id"); const value = await bridge.request("thread/read", { threadId: sessionId, includeTurns: false }); const thread = value?.thread ?? value;
-  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, status: thread.status ?? null, thread: threadReceipt(thread), descendants: await observedChildren(bridge, sessionId), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread.model ?? null, reasoning: thread.reasoningEffort ?? null, provider: thread.modelProvider ?? null }, "thread/read") };
+  const terminal = options.turnId ? (await readTurn(bridge, sessionId, options.turnId, true))?.turn : null;
+  const exact = terminal?.id === options.turnId && terminal?.status === "failed" ? { terminal_turn_id: terminal.id, terminal_status: terminal.status, provider_error: nativeTurnError(bridge, sessionId, terminal), native_turn_items: turnItemEvidence(terminal) } : {};
+  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, status: thread.status ?? null, thread: threadReceipt(thread), ...exact, descendants: await observedChildren(bridge, sessionId), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread.model ?? null, reasoning: thread.reasoningEffort ?? null, provider: thread.modelProvider ?? null }, "thread/read") };
 }
 
 export async function cancelSession(options) {

package/dist/harness-runtime/lib/dd-zcode-daemon.mjs

@@ -124,8 +124,19 @@ export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 3
   });
 }
 
+const ZCODE_ROUTING_ENV = ["ZCODE_HOME", "ZCODE_STORAGE_DIR", "ZCODE_SESSION_DB_PATH"];
+
+function nativeRoutingEnv() {
+  return Object.fromEntries(ZCODE_ROUTING_ENV.filter(key => process.env[key] !== undefined)
+    .map(key => [key, absolute(process.env[key], key)]));
+}
+
+function sameNativeRouting(previous, config) {
+  return ZCODE_ROUTING_ENV.every(key => (previous?.env?.[key] ?? null) === (config.env?.[key] ?? null));
+}
+
 function sameConfig(state, config) {
-  return ["cwd", "journal", "bin", "zcodePath", "ddFlowBin", "ddFlowHome", "projectRoot", "resourceHome", "livenessTimeoutMs", "requestTimeoutMs"].every((key) => (state.config?.[key] ?? null) === (config[key] ?? null));
+  return sameNativeRouting(state.config, config) && ["cwd", "journal", "bin", "zcodePath", "ddFlowBin", "ddFlowHome", "projectRoot", "resourceHome", "livenessTimeoutMs", "requestTimeoutMs"].every((key) => (state.config?.[key] ?? null) === (config[key] ?? null));
 }
 
 export async function startDaemon(options) {
@@ -145,7 +156,7 @@ export async function startDaemon(options) {
     ddFlowHome: options.ddFlowHome ? absolute(options.ddFlowHome, "--dd-flow-home") : null,
     projectRoot: options.projectRoot ? absolute(options.projectRoot, "--project-root") : null,
     resourceHome: process.env.DD_FLOW_RESOURCE_HOME ? absolute(process.env.DD_FLOW_RESOURCE_HOME, "DD_FLOW_RESOURCE_HOME") : null,
-    env: options.ddFlowHome ? { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home"), ...(options.ddFlowBin ? { DD_FLOW_BIN: absolute(options.ddFlowBin, "--dd-flow-bin") } : {}) } : {},
+    env: { ...nativeRoutingEnv(), ...(options.ddFlowHome ? { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home"), ...(options.ddFlowBin ? { DD_FLOW_BIN: absolute(options.ddFlowBin, "--dd-flow-bin") } : {}) } : {}) },
     livenessTimeoutMs: positiveDuration(options.livenessTimeoutMs, "livenessTimeoutMs", DEFAULT_LIVENESS_TIMEOUT_MS),
     requestTimeoutMs: optionalDuration(options.requestTimeoutMs, "requestTimeoutMs", DEFAULT_REQUEST_TIMEOUT_MS),
   };
@@ -159,7 +170,10 @@ export async function startDaemon(options) {
   } catch (error) { if (error.code !== "daemon_not_running" && error.code !== "daemon_timeout") throw error; }
 
   const previous = await readState(paths.dir);
-  if (previous?.shutdown_state === "clean") await authorizeRetainedDaemonResume(paths.dir, previous, options.sessionId, config);
+  if (previous?.shutdown_state === "clean") {
+    if (!sameNativeRouting(previous.config, config)) throw new DaemonError("daemon_config_mismatch", "retained ZCode native storage routing changed");
+    await authorizeRetainedDaemonResume(paths.dir, previous, options.sessionId, config);
+  }
   if (previous?.shutdown_state === "running" && previous.active_tree) {
     throw new DaemonError("invalid_harness_crash", "the previous daemon died with an active or unproven Session tree", false, { daemon_id: previous.daemon_id });
   }
@@ -237,6 +251,7 @@ export class DaemonRuntime {
     const generation = this.activeGeneration ?? this.controlGeneration ?? 0;
     return {
       ...this.state.config, ...params, knownChildSessionIds: known?.known_child_session_ids ?? [], adapterSessionId: adapter,
+      neverPromptedRootProof: this.neverPromptedRootProof(params.sessionId),
       daemonId: this.state.daemon_id, allowBackground: true, liveSession: this.liveAdapters.has(adapter),
       assertDispatch: () => { if (generation !== (this.controlGeneration ?? 0)) throw new DaemonError("operation_cancelled", "ZCode prompt was cancelled before native dispatch"); },
       // The bridge owns the quiet timer; the daemon owns the durable status.
@@ -304,6 +319,12 @@ export class DaemonRuntime {
         // A late identity is evidence, not permission to resurrect a completed
         // request or overwrite another operation's ownership.
         this.track(identity);
+        const allocated = this.sessions.get(identity.provider_session_id);
+        if (allocated && this.activeProductive === "session.create" && current?.allocation?.adapter_session_id === identity.adapter_session_id
+          && allocated.prompt_dispatched === undefined) {
+          allocated.prompt_dispatched = false;
+          allocated.created_by_daemon_id = this.state.daemon_id;
+        }
         if (!current || current.allocation?.adapter_session_id !== identity.adapter_session_id) {
           await this.persist({});
           return;
@@ -344,6 +365,8 @@ export class DaemonRuntime {
       topology: topology ?? existing?.topology ?? null,
       known_child_session_ids: [...new Set([...(existing?.known_child_session_ids ?? zcodeChildSessionIds(existing?.topology)), ...zcodeChildSessionIds(topology)])],
       completed_turns: existing?.completed_turns ?? 0,
+      prompt_dispatched: existing?.prompt_dispatched,
+      created_by_daemon_id: existing?.created_by_daemon_id,
       close_receipt: result.close?.closed === true ? result : existing?.close_receipt ?? null,
     }); }
     if (result?.adapter_session_id) this.liveAdapters.add(result.adapter_session_id);
@@ -397,10 +420,9 @@ export class DaemonRuntime {
 
   async requireSettled(params) {
     if (this.sessions.get(params.sessionId)?.close_receipt) throw new DaemonError("session_closed", "Closed Session requires explicit recovery");
-    const known = this.sessions.get(params.sessionId);
     // A freshly created ZCode Session has no prior Turn and is not yet exposed
     // by the provider's subagent index. Its first prompt is therefore safe.
-    if (known && (known.completed_turns ?? 0) === 0) return null;
+    if (this.neverPromptedRootProof(params.sessionId)) return null;
     const observed = await inspectSessionWithBridge(this.bridge, this.options(params));
     const runningChildren = observed.subagents?.running ?? [];
     if (this.treeRunning(observed)) {
@@ -410,6 +432,21 @@ export class DaemonRuntime {
     return observed;
   }
 
+  neverPromptedRootProof(sessionId) {
+    const known = this.sessions.get(sessionId);
+    return known?.prompt_dispatched === false && known.created_by_daemon_id === this.state.daemon_id
+      && known.parent_provider_session_id === null && known.root_provider_session_id === sessionId
+      && Array.isArray(known.known_child_session_ids) && known.known_child_session_ids.length === 0
+      ? { source: "owned_daemon_create_without_prompt", daemon_id: this.state.daemon_id, provider_session_id: sessionId }
+      : null;
+  }
+
+  async markPromptDispatched(sessionId) {
+    const known = this.sessions.get(sessionId);
+    if (known) known.prompt_dispatched = true;
+    await this.persist();
+  }
+
   async dispatch(operation, params) {
     if (operation === "daemon.status") return {
       daemon_id: this.state.daemon_id, pid: process.pid, socket: this.paths.socket,
@@ -447,11 +484,11 @@ export class DaemonRuntime {
         dispatched_at: new Date().toISOString(),
         request_timeout_ms: this.state.config.requestTimeoutMs,
       };
-      const result = await this.productive(operation, async () => { await this.requireSettled(params); return await promptSessionWithBridge(this.bridge, { ...this.options(params), timeoutMs: request.request_timeout_ms }); }, request);
+      const result = await this.productive(operation, async () => { await this.requireSettled(params); await this.markPromptDispatched(params.sessionId); return await promptSessionWithBridge(this.bridge, { ...this.options(params), timeoutMs: request.request_timeout_ms }); }, request);
       const session = this.sessions.get(result.provider_session_id); if (session) session.completed_turns = (session.completed_turns ?? 0) + 1;
       await this.persist(); return result;
     }
-    if (operation === "session.fork") return await this.productive(operation, async () => { await this.requireSettled(params); return await forkSessionWithBridge(this.bridge, this.options(params)); });
+    if (operation === "session.fork") return await this.productive(operation, async () => { await this.requireSettled(params); await this.markPromptDispatched(params.sessionId); return await forkSessionWithBridge(this.bridge, this.options(params)); });
     if (operation === "session.inspect" || operation === "session.resume") {
       const closed = this.sessions.get(params.sessionId)?.close_receipt;
       if (closed) {
@@ -467,7 +504,8 @@ export class DaemonRuntime {
             && Array.isArray(receipt.topology.child_session_ids)) return receipt;
         }
         const known = [...new Set([...topology.child_session_ids, ...(previous?.topology?.child_session_ids ?? [])])];
-        const observation = { ...closed, ...await observeClosedZcodeTree(this.bridge, params.sessionId, known), observed_at: new Date().toISOString() };
+        const emptyRoot = this.neverPromptedRootProof(params.sessionId);
+        const observation = { ...closed, ...await observeClosedZcodeTree(this.bridge, params.sessionId, known, emptyRoot && closed.close?.closed === true ? {...emptyRoot,close_confirmed:true} : null), observed_at: new Date().toISOString() };
         // Observations are not ownership inventory: their timestamps must not
         // invalidate a drain fence on every read.
         this.state.settlement_observations ??= {};
@@ -525,6 +563,20 @@ export class DaemonRuntime {
       }
       const options = this.options({ sessionId: session.provider_session_id, adapterSessionId: session.adapter_session_id });
       let observed;
+      // A daemon-owned allocation with no productive dispatch cannot have
+      // children, and native ZCode has no durable read index for it yet. Close
+      // that resident directly; do not send cancellation for default stop.
+      const emptyRoot = !cancel && !this.activeProductive ? this.neverPromptedRootProof(session.provider_session_id) : null;
+      if (emptyRoot) {
+        const close = await this.bridge.request("zcode/session/close", { sessionId: session.adapter_session_id });
+        const observation = close?.closed === true
+          ? await observeClosedZcodeTree(this.bridge, session.provider_session_id, [], { ...emptyRoot, close_confirmed: true })
+          : { settled: false, topology: { root_session_id: session.provider_session_id, child_session_ids: [], complete: false } };
+        this.track({ provider_session_id: session.provider_session_id, adapter_session_id: session.adapter_session_id, cancellation_requested: false, close_requested: true, close, ...observation });
+        await this.persist({ active_tree: observation.settled !== true });
+        if (observation.settled !== true) unsettled.push(session.provider_session_id);
+        continue;
+      }
       if (!cancel) observed = await inspectSessionWithBridge(this.bridge, options);
       if (cancel || !observed || this.treeRunning(observed)) {
         if (!cancel) unsettled.push(session.provider_session_id);