@deksden-com/dd-flow-cli 0.9.0-beta.122 → 0.9.0-beta.124

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.124
+
+### Patch Changes
+
+- Stop only two confirmed continuation overload refusals within the inclusive two-minute window, preserving native refusal times and exact owner admission across recovery.
+
+  Retain final PLAN check obligations, completion markers and native output bytes in verification evidence; require canonical fixes for duplicated CODE P0/P1 findings.
+
+  Join native daemon cleanup before durable stop acknowledgement and reconcile already-closed provider bridges without replay.
+
+## 0.9.0-beta.123
+
+### Patch Changes
+
+- Continue confirmed Codex overloads in the retained Session with bounded backoff, exact owner admission and no concurrent productive Turns.
+- Retain content-addressed verification evidence and reviewer input baselines across publication, relocation and review waves.
+- Preserve canonical native model/tool observations and AGY child transcript evidence without rewriting historical results.
+
 ## 0.9.0-beta.122
 
 ### Patch Changes

package/README.md

@@ -3,6 +3,29 @@
 See [dd-zcode integration](src/harness-runtime/DD-ZCODE.md) for native transport,
 adapter ownership and the versioned bridge contract.
 
+## Native daemon shutdown
+
+`daemon.stop` fences productive dispatch before awaiting settlement. A successful
+durable stop receipt follows native tree settlement, physical provider exit,
+journal drain and required resource/auth finalization. The endpoint then retires
+before ACK; clients also verify the retained daemon PID has exited. A missing
+socket alone is not physical shutdown proof.
+
+Partial cleanup preserves the same incarnation's completed phases in
+`daemon.json` (`dd-flow/daemon-shutdown@1`). A fresh control operation can finish
+remaining cleanup without replaying agent work or inspecting a closed pipe.
+Failed operation IDs remain immutable. Unknown ownership and persistent EPERM
+remain failures; never remove sockets or repair runtime databases manually to
+make an outcome look clean.
+
+Shutdown proof records `required_phases`; every recorded phase must be complete,
+including native tree and daemon resource settlement. A `clean` label without
+this proof cannot authorize retained restart. `stopping`, `cleanup_failed` and
+`unclean` cannot start a replacement native bridge. Forced AGY termination
+without a current native terminal receipt is unclean, even after a previous
+successful Turn. Mandatory stream-journal failures remain failures after
+physical cleanup. Listener retirement must not unlink a replacement endpoint.
+
 ## Managed temporary HTTP services
 
 For an interactive scenario, `runtime process start --run <RUN-ID>

package/dist/build-info.json

@@ -1,11 +1,11 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.122",
-  "cli_commit": "b03c699ac77fa596e684408c8e46e8710edbe9f6",
-  "built_at": "2026-09-30T01:56:09.576Z",
+  "cli_version": "0.9.0-beta.124",
+  "cli_commit": "7bc8e8d17471c2cd33a93ca25e55770a4cb6e336",
+  "built_at": "2026-10-01T12:53:56.722Z",
   "built_with_canon": {
     "version": "4.1.2",
-    "commit": "0cf38231406614cfeb0a96001ba0201de2316e47",
+    "commit": "2e57b987ec91b7c3b0fa97f6169047802a1233fb",
     "flow_contract": "dd-flow-canonical-2026-08",
     "repo_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank",
     "memorybank_root": "/home/runner/work/dd-flow-cli/dd-flow-cli/dd-memorybank/.memory-bank",

package/dist/cli/run-cli.js

@@ -75,6 +75,7 @@ import { launchRuntimeScopeControl, launchRuntimeScopeResume, prepareRuntimeScop
 import { prepareRuntimeScopeResumeRequest } from "../services/runtime-scope-resume.js";
 import { launchRunController, prepareRunControllerLaunch, resumeRunController, serveRunController, runControllerStatus, answerRunController, prepareRunControllerAnswer, supplyRunControllerContext, prepareRunControllerContext } from "../services/run-controller.js";
 import { controllerHitlAdmission } from "../services/run-controller-adapter.js";
+import { assertCapacityOwnerAdmission } from "../services/codex-capacity.js";
 import { controlLifecycleReply, runControlStatus } from "../services/run-control.js";
 import { reconcileRunControl, requestRunControl, serveRunControl } from "../services/run-control-worker.js";
 import { startRuntimeService, prepareRuntimeService } from "../services/runtime-service.js";
@@ -2656,6 +2657,8 @@ async function dispatchRuntime(context, command, parsed, progress, prepared = {}
             const acceptedHitlPrompt = ["paused", "waiting_for_user"].includes(run?.status ?? "") && controllerHitlAdmission(context, record, { stateDir: requiredOption(parsed, "state-dir"), operationId: optionalOption(parsed, "operation-id"), operation: optionalOption(parsed, "operation"), nativeSessionId: optionalOption(parsed, "native-session-id"), promptSha256: optionalOption(parsed, "prompt-sha256") });
             if (!run || run.status !== "running" && !retainedHitlPrompt && !acceptedHitlPrompt && !["judge", "probe"].includes(metadata.role ?? ""))
                 throw new AppError("invalid_run_state", "Subject dispatch requires a running RUN or its retained recovery/HITL prompt", 1);
+            if (!recovering)
+                assertCapacityOwnerAdmission(context, record, optionalOption(parsed, "operation-id"), { nativeSessionId: optionalOption(parsed, "native-session-id"), promptSha256: optionalOption(parsed, "prompt-sha256") });
         }
         const budget = reserveProviderTurn(context, record, { operationId: optionalOption(parsed, "operation-id") ?? "", operation: optionalOption(parsed, "operation") ?? "", sessionId: optionalOption(parsed, "native-session-id"), daemonId: optionalOption(parsed, "daemon-id") });
         return { ok: true, ...budget, process_id: record.id, generation: metadata.run_generation ?? null };

package/dist/domain/stage-catalog.js

@@ -3,7 +3,7 @@ export const vnextStages = [
     { id: "specify", directory: "01-specify", result: "specify.json", schema: "dd-flow/vnext-specify-result@4", next: ["protocolize"] },
     { id: "protocolize", directory: "02-protocolize", result: "protocolize-result.json", schema: "dd-flow/vnext-protocolize-result@3", next: ["plan"] },
     { id: "plan", directory: "03-plan", result: "stage-report.json", schema: "dd-flow/stage-report@2", next: ["plan-review", "code"] },
-    { id: "plan-review", directory: "04-plan-review", result: "decision.json", schema: "dd-flow/plan-review-decision@3", next: ["code"] },
+    { id: "plan-review", directory: "04-plan-review", result: "decision.json", schema: "dd-flow/plan-review-decision@4", next: ["code"] },
     { id: "code", directory: "05-code", result: "code-verification.json", schema: "dd-flow/code-verification@2", next: ["code-review", "merge"] },
     { id: "code-review", directory: "06-code-review", result: "decision.json", schema: "dd-flow/code-review-decision@3", next: ["merge"] },
     { id: "merge", directory: "07-merge", result: "stage-report.json", schema: "dd-flow/stage-report@2", next: [] }

package/dist/harness-runtime/lib/codex-capacity-policy.d.mts

@@ -0,0 +1,10 @@
+export const CAPACITY_POLICY: "codex-overload-burst@1";
+export const OVERLOAD_WINDOW_MS: number;
+export type CapacityRefusal = { policy: string; ordinal: number; session_id: string; turn_id: string; first_observed_at: string; native_terminal_at?: string; native_terminal_basis?: string };
+export function parseCapacityOperation(id: string): { root: string; ordinal: number };
+export function normalizeCodexFailure(error: unknown, sessionId?: string, turnId?: string): null | { code: string; session_id: string; turn_id: string; native_error: Record<string, unknown>; observed_at: unknown; terminal_at: unknown; native_turn_items: unknown; primary_error: { details?: Record<string, unknown> } };
+export function terminalCodexOverload(error: unknown, sessionId?: string, turnId?: string): boolean;
+export function nativeItemsSettled(items: unknown): boolean;
+export function capacityBackoff(error: unknown, ordinal: number, now?: number): number;
+export function refusalObservation(error: unknown, ordinal: number, firstObservedAt: string): CapacityRefusal;
+export function overloadBurst(refusals: CapacityRefusal[]): null | { policy: string; basis: string; elapsed_ms: number; refusals: CapacityRefusal[] };

package/dist/harness-runtime/lib/codex-capacity-policy.mjs

@@ -0,0 +1,89 @@
+/** Pure policy shared by the controller and pinned-engine EVAL consumers. */
+export const CAPACITY_POLICY = "codex-overload-burst@1";
+export const OVERLOAD_WINDOW_MS = 120_000;
+
+function policyError(code, message, details = {}) { return Object.assign(new Error(message), { code, details }); }
+
+export function parseCapacityOperation(id) {
+  if (typeof id !== "string" || !id) throw policyError("capacity_continuation_conflict", "Missing capacity operation identity");
+  const match = /^(.*):capacity:(\d+):session\.prompt$/.exec(id);
+  if (!match) return { root: id, ordinal: 0 };
+  const ordinal = Number(match[2]);
+  if (!Number.isSafeInteger(ordinal) || ordinal < 1 || String(ordinal) !== match[2]) throw policyError("capacity_continuation_conflict", "Capacity ordinal is not a canonical positive safe integer", { operation_id: id });
+  return { root: match[1], ordinal };
+}
+
+export function normalizeCodexFailure(error, expectedSessionId, expectedTurnId) {
+  let current = error;
+  for (let depth = 0; depth < 4 && current && typeof current === "object"; depth++) {
+    if (current.code === "turn_interrupted") {
+      const details = current.details ?? {}, native = details.provider_error;
+      const code = typeof native?.codexErrorInfo === "string" ? native.codexErrorInfo : native?.codexErrorInfo?.code;
+      if (details.terminal_status !== "failed" || typeof details.provider_session_id !== "string" || !details.provider_session_id
+        || expectedSessionId !== undefined && details.provider_session_id !== expectedSessionId
+        || typeof details.turn_id !== "string" || !details.turn_id || details.native_turn_id !== details.turn_id
+        || expectedTurnId !== undefined && details.turn_id !== expectedTurnId || typeof code !== "string") return null;
+      return { code, session_id: details.provider_session_id, turn_id: details.turn_id, native_error: native,
+        observed_at: details.observed_at ?? null, terminal_at: details.terminal_at ?? null, terminal_basis: details.terminal_basis ?? null,
+        native_turn_items: details.native_turn_items ?? null, primary_error: current };
+    }
+    // No arbitrary recursive cause search: an ownership/hook/lifecycle error wins.
+    if (current.code !== "harness_adapter_failed") return null;
+    current = current.details?.cause ?? current.cause;
+  }
+  return null;
+}
+
+export function terminalCodexOverload(error, expectedSessionId, expectedTurnId) {
+  return normalizeCodexFailure(error, expectedSessionId, expectedTurnId)?.code === "serverOverloaded";
+}
+
+export function nativeItemsSettled(items) {
+  return items?.observed === true && typeof items.possible_effects === "boolean" && items.pending !== true
+    && (items.possible_effects === false || items.pending === false);
+}
+
+export function capacityBackoff(error, ordinal, now = Date.now()) {
+  if (!Number.isSafeInteger(ordinal) || ordinal < 1 || !Number.isFinite(now)) throw policyError("capacity_continuation_conflict", "Invalid capacity timing identity");
+  const native = normalizeCodexFailure(error)?.native_error ?? error?.details?.provider_error ?? error;
+  const header = Object.entries(native?.headers ?? {}).find(([key]) => key.toLowerCase() === "retry-after")?.[1];
+  const value = header ?? native?.retryAfter ?? native?.retry_after;
+  let retry = 0;
+  if (value !== undefined && value !== null) {
+    retry = typeof value === "number" || typeof value === "string" && /^\d+(\.\d+)?$/.test(value.trim()) ? Number(value) * 1000 : typeof value === "string" ? Math.max(0, Date.parse(value) - now) : NaN;
+    if (!Number.isFinite(retry) || retry < 0 || !Number.isFinite(now + retry) || now + retry > 8.64e15)
+      throw policyError("capacity_retry_metadata_invalid", "Retry-After cannot be represented safely", { retry_after: value });
+  }
+  return Math.max(ordinal === 1 ? 5_000 : 15_000, retry);
+}
+
+export function refusalObservation(error, ordinal, firstObservedAt) {
+  const failure = normalizeCodexFailure(error);
+  const observed = Date.parse(firstObservedAt);
+  if (!failure || !Number.isSafeInteger(ordinal) || ordinal < 0 || !Number.isFinite(observed))
+    throw policyError("capacity_continuation_conflict", "Refusal lacks an immutable native identity/time");
+  if (failure.observed_at !== null && (typeof failure.observed_at !== "string" || !Number.isFinite(Date.parse(failure.observed_at)) || Date.parse(failure.observed_at) !== observed))
+    throw policyError("capacity_continuation_conflict", "Native refusal observation time is invalid or changed");
+  const native = failure.terminal_at && Date.parse(failure.terminal_at);
+  return { policy: CAPACITY_POLICY, ordinal, session_id: failure.session_id, turn_id: failure.turn_id,
+    first_observed_at: firstObservedAt, ...(Number.isFinite(native) && typeof failure.terminal_basis === "string" && failure.terminal_basis ? { native_terminal_at: failure.terminal_at, native_terminal_basis: failure.terminal_basis } : {}) };
+}
+
+export function overloadBurst(refusals) {
+  for (const [index, refusal] of refusals.entries()) {
+    const previous = refusals[index - 1];
+    if (typeof refusal.first_observed_at !== "string" || !Number.isFinite(Date.parse(refusal.first_observed_at))
+      || previous && Date.parse(refusal.first_observed_at) < Date.parse(previous.first_observed_at))
+      throw policyError("capacity_continuation_conflict", "Refusal observation clock reversed or is invalid");
+  }
+  const continuations = refusals.filter(item => item.ordinal > 0);
+  const pair = continuations.slice(-2);
+  if (pair.length !== 2) return null;
+  const [previous, current] = pair;
+  if (previous.session_id !== current.session_id || previous.turn_id === current.turn_id || current.ordinal !== previous.ordinal + 1)
+    throw policyError("capacity_continuation_conflict", "Refusal chain identity is inconsistent");
+  const basis = previous.native_terminal_at && current.native_terminal_at && previous.native_terminal_basis && previous.native_terminal_basis === current.native_terminal_basis ? "native_terminal_at" : "first_observed_at";
+  const elapsed = Date.parse(current[basis]) - Date.parse(previous[basis]);
+  if (!Number.isFinite(elapsed) || elapsed < 0) throw policyError("capacity_continuation_conflict", "Refusal clock reversed or is invalid");
+  return elapsed <= OVERLOAD_WINDOW_MS ? { policy: CAPACITY_POLICY, basis, elapsed_ms: elapsed, refusals: pair } : null;
+}

package/dist/harness-runtime/lib/daemon-operations.mjs

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { lstatSync } from "node:fs";
 import { mkdir, readFile, readdir, link, unlink, open } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import path from "node:path";
@@ -10,6 +11,99 @@ import { readModelObservations, modelAttribution } from "./model-observations.mj
 const productive = new Set(["session.create", "session.prompt", "session.start", "session.fork", "session.resume"]);
 const controls = new Map();
 const dispatchGenerations = new Map();
+const shutdowns = new Map();
+
+export function assertDaemonDispatch(root) {
+  const stop = shutdowns.get(root);
+  if (stop?.pending || stop?.committed) throw Object.assign(new Error("daemon shutdown fences productive dispatch"), { code: "daemon_stopping" });
+}
+export function assertDaemonRestartable(state) {
+  if (["unclean", "cleanup_failed", "stopping"].includes(state?.shutdown_state)) throw Object.assign(new Error("previous daemon shutdown is unresolved; do not restart a native bridge for cleanup"), { code: "daemon_state_terminal", details: { daemon_id: state.daemon_id ?? state.config?.daemonId, shutdown_state: state.shutdown_state } });
+}
+export function commitDaemonShutdown(root) {
+  if (typeof root !== 'string') return; // In-memory adapter diagnostics own no daemon endpoint.
+  const fence = shutdowns.get(root) ?? { pending: 0 };
+  fence.committed = true; shutdowns.set(root, fence);
+}
+
+/** The same incarnation may retry remaining cleanup, never a native Turn. */
+export async function completeDaemonShutdown(root, state, persist, prepare, phases) {
+  const daemonId = state.daemon_id ?? state.config?.daemonId;
+  let shutdown = state.shutdown;
+  if (!shutdown || shutdown.daemon_id !== daemonId) shutdown = { schema_id: "dd-flow/daemon-shutdown@1", daemon_id: daemonId, generation: dispatchGenerations.get(root) ?? 0, phases: {} };
+  shutdown = { ...shutdown, required_phases: ["tree", ...phases.map(([phase]) => phase)] };
+  try {
+    if (!shutdown.phases.tree) {
+      const result = await prepare();
+      shutdown = { ...shutdown, phases: { tree: true }, tree_observed_at: new Date().toISOString(), result: result ?? { clean: true } };
+      commitDaemonShutdown(root);
+      await persist({ shutdown, shutdown_state: "stopping", active_tree: false });
+    }
+    commitDaemonShutdown(root);
+    for (const [phase, action] of phases) {
+      if (shutdown.phases[phase]) continue;
+      await action();
+      shutdown = { ...shutdown, phases: { ...shutdown.phases, [phase]: true } };
+      await persist({ shutdown });
+    }
+    const result = { ...shutdown.result, daemon_id: daemonId, stopped: true, settled: true, shutdown_contract: "dd-flow/daemon-shutdown@1", _shutdown: true };
+    await persist({ shutdown, shutdown_state: result.clean === true ? "clean" : "unclean", active_tree: false, stopped_at: new Date().toISOString(), cleanup_error: null });
+    return result;
+  } catch (error) {
+    if (error.code === "tree_not_settled" && !shutdowns.get(root)?.committed) throw error;
+    try { await persist({ shutdown_state: "cleanup_failed", cleanup_error: errorRecord(error) }); }
+    catch (storage) { error.details = { ...error.details, persistence_error: errorRecord(storage) }; }
+    throw error;
+  }
+}
+
+const daemonConnections = new WeakMap();
+export function trackDaemonConnections(server) {
+  const sockets = new Set(); daemonConnections.set(server, sockets);
+  server.once("listening", () => {
+    const endpoint = server.address();
+    if (typeof endpoint !== "string") return;
+    try { const info = lstatSync(endpoint); daemonEndpoints.set(server, { endpoint, dev: info.dev, ino: info.ino }); }
+    catch (error) { daemonEndpoints.set(server, { endpoint, error }); }
+  });
+  server.on("connection", socket => { sockets.add(socket); socket.on("error", () => {}); socket.once("close", () => sockets.delete(socket)); });
+}
+const daemonEndpoints = new WeakMap();
+
+/** Retire the listener after durable publication, before ACK; no provider IO. */
+export function retireDaemonEndpoint(server, exitCode = 0) {
+  if (!server.listening) return;
+  const retained = daemonEndpoints.get(server);
+  let endpointError = retained?.error;
+  if (retained && !endpointError) {
+    try {
+      const current = lstatSync(retained.endpoint);
+      if (current.dev !== retained.dev || current.ino !== retained.ino || !current.isSocket()) endpointError = Object.assign(new Error("daemon endpoint was replaced; refusing to unlink another listener"), { code: "daemon_endpoint_identity_mismatch", details: { socket: retained.endpoint, phase: "retire_listener" } });
+    } catch (error) { if (error.code !== "ENOENT") endpointError = error; }
+  }
+  if (endpointError) {
+    // libuv's close unlinks by pathname, not inode. Exit without closing its
+    // listener handle when the name belongs to a different incarnation.
+    const timer = setTimeout(() => { for (const socket of daemonConnections.get(server) ?? []) socket.destroy(); process.exit(1); }, 1_000);
+    timer.unref();
+    throw endpointError;
+  }
+  const timer = setTimeout(() => { for (const socket of daemonConnections.get(server) ?? []) socket.destroy(); }, 1_000);
+  timer.unref();
+  server.close(() => { clearTimeout(timer); process.exit(exitCode); });
+}
+
+export async function retireFailedDaemon(server, state, error, persist) {
+  // An already-finished registry lease cannot own a listening productive daemon.
+  if (state.shutdown?.phases?.daemon_resource) {
+    // Durable result publication and listener retirement occur after the
+    // cleanup helper returns. Their failures still invalidate overall clean.
+    if (persist) try { await persist({ shutdown_state: "cleanup_failed", cleanup_error: errorRecord(error) }); }
+    catch (storage) { error.details = { ...error.details, persistence_error: errorRecord(storage) }; }
+    process.stderr.write(`${JSON.stringify({ shutdown_failure: errorRecord(error) })}\n`);
+    try { retireDaemonEndpoint(server, 1); } catch { /* Retirement already scheduled a nonzero exit without unlinking a foreign endpoint. */ }
+  }
+}
 
 async function controlDispatch(root, request, action) {
   const key = request.operation === "daemon.stop" ? `stop:${request.params?.cancelTree === true}` : `cancel:${request.params?.sessionId ?? ""}`;
@@ -122,13 +216,16 @@ export async function durableDaemonDispatch(root, request, action, observe) {
   if (!productive.has(request.operation) && !control) return await action();
   const generation = dispatchGenerations.get(root) ?? 0;
   if (control) dispatchGenerations.set(root, generation + 1);
-  const assertCurrent = () => { if (generation !== (dispatchGenerations.get(root) ?? 0)) throw Object.assign(new Error("control cancelled a queued productive dispatch"), { code: "operation_cancelled" }); };
-  const result = await journalDispatch(root, request, async () => {
+  const assertCurrent = () => { assertDaemonDispatch(root); if (generation !== (dispatchGenerations.get(root) ?? 0)) throw Object.assign(new Error("control cancelled a queued productive dispatch"), { code: "operation_cancelled" }); };
+  const stop = request.operation === "daemon.stop" ? (shutdowns.get(root) ?? { pending: 0, committed: false }) : null;
+  if (stop) { stop.pending++; shutdowns.set(root, stop); }
+  let result;
+  try { result = await journalDispatch(root, request, async () => {
     // Persist before admission so a racing fence can observe the writer.
     if (!control) await assertDaemonOwnership(root, { "operation-id": request.id, operation: request.operation, "native-session-id": request.params?.sessionId, "prompt-sha256": typeof request.params?.prompt === "string" ? createHash("sha256").update(request.params.prompt).digest("hex") : undefined }, assertCurrent);
     if (!control) assertCurrent();
     return control ? await controlDispatch(root, request, action) : await action();
-  });
+  }); } finally { if (stop) { stop.pending--; if (!stop.pending && !stop.committed) shutdowns.delete(root); } }
   if (control) return result;
   let settlement;
   try {