@deksden-com/dd-flow-cli 0.9.0-beta.122 → 0.9.0-beta.124

package/dist/services/merge-server.js

@@ -106,10 +106,11 @@ async function dispatch(context, input) {
     const executable = resolveHarnessCommand(context.ddFlowHome, input.profile.harness, "adapter");
     const common = ["--dd-flow-bin", flowExecutable, "--state-dir", stateDir, "--journal", adapterJournal, "--cwd", input.request.target_workspace, "--provider", input.profile.provider, "--model", input.profile.model, "--reasoning", input.profile.reasoning, "--mode", input.profile.mode, "--permission", input.profile.permission, "--project-root", run.project_root, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, input.profile.harness), "--json"];
     const retained = { profile: input.profile, executable, owner: runtimeOwner, session_id: null, state_dir: stateDir, create_operation_id: `${input.request.merge_request_id}:${token}:session.create`, prompt_operation_id: `${input.request.merge_request_id}:${token}:session.prompt` };
-    const retain = () => { context.db.run("UPDATE merge_requests SET adapter_receipt_json = ?, updated_at = ? WHERE merge_request_id = ? AND dispatch_owner = ? AND dispatch_lease_token = ?", [JSON.stringify(retained), context.now(), input.request.merge_request_id, input.serverId, token]); };
+    const retain = () => { const changed = context.db.run("UPDATE merge_requests SET adapter_receipt_json = ?, updated_at = ? WHERE merge_request_id = ? AND dispatch_owner = ? AND dispatch_lease_token = ?", [JSON.stringify(retained), context.now(), input.request.merge_request_id, input.serverId, token]); if (changed.changes !== 1)
+        throw new AppError("capacity_continuation_blocked", "MERGE dispatch owner changed before durable receipt retention", 1); };
     retain();
     const leaseHeartbeat = setInterval(() => { if (guarded(context, input.request) || (recoveryGuard(context, input.request.project_id, input.request.run_id)?.generation ?? 0) !== generation)
-        return; const now = context.now(); context.db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status = 'dispatching' AND dispatch_owner = ? AND dispatch_lease_token = ?", [new Date(Date.now() + 120_000).toISOString(), now, input.request.merge_request_id, input.serverId, token]); }, 30_000);
+        return; const now = context.now(); context.db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status IN ('dispatching','active') AND dispatch_owner = ? AND dispatch_lease_token = ?", [new Date(Date.now() + 120_000).toISOString(), now, input.request.merge_request_id, input.serverId, token]); }, 30_000);
     leaseHeartbeat.unref();
     try {
         const adapterCall = (args, timeoutMs, progressMessage, id = `${input.request.merge_request_id}:${token}:${args[0]}.${args[1]}`) => { assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation); return runHarnessAdapter({ executable, args, env: runtimeContext.env, runtimeOwner, operationId: id, ...(timeoutMs ? { timeoutMs } : {}), ...(input.progress ? { progress: input.progress } : {}), ...(progressMessage ? { progressMessage } : {}), onEvidence: (value) => event(input.journal, { type: "adapter_call", ...value }) }); };
@@ -124,29 +125,51 @@ async function dispatch(context, input) {
         const stageCommand = managedLifecycleCommand(runtimeContext, `${flowCommand(runtimeContext)} stage start ${input.request.run_id} --stage merge --project-root ${JSON.stringify(run.project_root)} --json --progress-jsonl`);
         fs.writeFileSync(promptFile, `Start the assigned MERGE stage now. Your first tool call must be this exact standalone command:\n\n${stageCommand}\n\nTrust and follow the complete stage packet it returns. Continue through merge apply and stage finish. Stop only when the stage reaches a terminal result or explicitly requests user/operator action.\n\n${stageLifecycleInstruction}\n`);
         let prompted;
+        const promptDeadline = Date.now() + 45 * 60_000;
+        retained.prompt_deadline = promptDeadline;
+        retain();
         try {
             prompted = await adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} is still running`);
         }
         catch (error) {
             if (runtimeHarness(input.profile) !== "codex-desktop")
                 throw error;
-            const resumed = await continueCodexCapacity({ error, sessionId, operationId: String(retained.prompt_operation_id),
+            const capacityIntents = (retained.capacity_intents ?? []);
+            const capacityFailures = (retained.capacity_failures ?? []);
+            const resumed = await continueCodexCapacity({ error, sessionId, operationId: String(retained.prompt_operation_id), allowSettledDescendants: true,
+                deadline: promptDeadline,
+                continuationText: `Continue only MERGE ${input.request.merge_request_id}, Work ${input.request.executor_work_id}, RUN ${input.request.run_id} in this same Session and target ${input.request.target_workspace}. First inspect current durable Stage/Work/MERGE receipts. Never repeat Stage start, accepted answer, completed apply or checks. Follow only the current exact issued successor and stop at the original boundary.`,
+                retainedIntents: () => capacityIntents,
+                retainedFailures: () => capacityFailures,
+                retainFailure: (_id, refusal) => { capacityFailures.push(refusal); retained.capacity_failures = capacityFailures; retain(); },
                 inspectOperation: id => adapterCall(["daemon", "operation", "--state-dir", stateDir, "--operation-id", id, "--json"], 30_000, undefined, `${id}:capacity-observe`),
-                inspectSession: () => adapterCall(["session", "inspect", "--session-id", sessionId, ...common], 30_000, undefined, `${input.request.merge_request_id}:${token}:capacity-inspect`),
+                inspectSession: turnId => adapterCall(["session", "inspect", "--session-id", sessionId, ...(turnId ? ["--turn-id", turnId] : []), ...common], 30_000, undefined, `${input.request.merge_request_id}:${token}:capacity-inspect`),
                 assertCurrent: () => {
                     assertRunMutationAllowed(context, input.request.project_id, input.request.run_id, generation);
                     const current = context.db.get("SELECT status, dispatch_owner, dispatch_lease_token, dispatch_lease_expires_at, target_workspace FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id]);
-                    if (current?.status !== "dispatching" || current.dispatch_owner !== input.serverId || current.dispatch_lease_token !== token
+                    if (current?.status === "completed" || current?.status === "action_required")
+                        return;
+                    if (!current || !["dispatching", "active"].includes(current.status) || current.dispatch_owner !== input.serverId || current.dispatch_lease_token !== token
                         || current.dispatch_lease_expires_at <= context.now() || current.target_workspace !== input.request.target_workspace)
                         throw new AppError("capacity_continuation_blocked", "MERGE dispatch owner or target changed during capacity wait", 1, { request_id: input.request.merge_request_id });
-                    if (context.db.get("SELECT status FROM works WHERE work_id = ?", [input.request.executor_work_id])?.status !== "created")
-                        throw new AppError("capacity_continuation_blocked", "MERGE Work already changed state", 1);
+                    if (!["created", "running", "paused", "completed"].includes(context.db.get("SELECT status FROM works WHERE work_id = ?", [input.request.executor_work_id])?.status ?? ""))
+                        throw new AppError("capacity_continuation_blocked", "MERGE Work has failed or lost its binding", 1);
+                },
+                decision: () => {
+                    const status = context.db.get("SELECT status FROM merge_requests WHERE merge_request_id = ?", [input.request.merge_request_id])?.status;
+                    const workStatus = context.db.get("SELECT status FROM works WHERE work_id = ?", [input.request.executor_work_id])?.status;
+                    return status === "completed" ? "completed" : status === "action_required" || workStatus === "paused" ? "paused" : "continue";
                 },
-                retainIntent: intent => { retained.capacity_intent = intent; retain(); },
+                retainIntent: intent => { capacityIntents.push(intent); retained.capacity_intents = capacityIntents; retained.capacity_intent = intent; retain(); },
                 prompt: (id, text, ordinal) => {
                     const file = path.join(stateDir, `capacity-${ordinal}.md`);
-                    fs.writeFileSync(file, `${text}\n`, { flag: "wx", mode: 0o600 });
-                    return adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", file, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} capacity continuation ${ordinal}/2`, id);
+                    if (fs.existsSync(file)) {
+                        if (fs.readFileSync(file, "utf8") !== text)
+                            throw new AppError("capacity_continuation_conflict", "Retained MERGE continuation prompt differs", 1);
+                    }
+                    else
+                        fs.writeFileSync(file, text, { flag: "wx", mode: 0o600 });
+                    return adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", file, ...common], Math.max(1, promptDeadline - Date.now()), `MERGE ${input.request.merge_request_id} Session ${sessionId} capacity continuation ${ordinal}`, id);
                 } });
             if (!resumed)
                 throw error;
@@ -193,6 +216,6 @@ function processAlive(pid) { if (!pid)
     process.kill(pid, 0);
     return true;
 }
-catch {
-    return false;
+catch (error) {
+    return error.code !== "ESRCH";
 } }

package/dist/services/review-copy.js

@@ -5,6 +5,27 @@ import { spawnSync } from "node:child_process";
 import { AppError } from "../shared/errors.js";
 import { ignoredWorkspacePaths } from "./code-checks.js";
 import { localEnvironmentAllowed, ownedWorkspaceHookPath, projectServicePathFilter, workspaceGitFiles } from "./workspace-files.js";
+export function reviewerSourceInputs(root, aspectIds) {
+    const criteria = [...new Set(aspectIds)].sort().map(id => {
+        if (!/^[a-z][a-z0-9_-]*$/.test(id))
+            throw new AppError("review_criterion_invalid", "Assigned aspect has an invalid identity", 1, { aspect_id: id });
+        return `.memory-bank/dd-flow/mb-sdlc/plan-aspects/aspects/${id}.md`;
+    });
+    const orientation = [".memory-bank/index.md", ".memory-bank/spec/engineering/index.md", ".memory-bank/spec/engineering/coding-standards.md"].filter(relative => fs.existsSync(path.join(root, relative)));
+    return [...criteria, ...orientation].map(relative => {
+        const file = path.join(root, relative);
+        if (!fs.existsSync(file))
+            throw new AppError("review_criterion_missing", "Assigned reviewer criterion is missing", 1, { path: relative });
+        const inside = path.relative(fs.realpathSync(root), fs.realpathSync(file));
+        if (inside === ".." || inside.startsWith(`..${path.sep}`) || !fs.statSync(file).isFile())
+            throw new AppError("review_criterion_invalid", "Reviewer source must be a file in its workspace", 1, { path: relative });
+        return { path: relative, sha256: crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") };
+    });
+}
+export function reviewerSourceInstruction(root, aspectIds) {
+    const inputs = reviewerSourceInputs(root, aspectIds);
+    return ["Read the assigned canonical criterion files and the available project orientation below before independent review. Apply each criterion's scope; a small behavior change is not by itself a reason to omit testing or evidence. These starting inputs do not limit relevant project investigation. Do not edit them.", ...inputs.map(input => `- ${path.join(root, input.path)} (SHA256 ${input.sha256})`)].join("\n");
+}
 export function reviewEnvironmentAllowed(file) {
     return localEnvironmentAllowed(file);
 }

package/dist/services/review-deferral.js

@@ -0,0 +1,23 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { assertPortableArtifactRef } from "./portable-refs.js";
+/** A deferral names one project-local file, never an arbitrary path. */
+export function reviewDefEvidence(workspaceRoot, defId) {
+    try {
+        if (!defId || !/^DEF-[A-Za-z0-9][A-Za-z0-9_-]*$/.test(defId))
+            throw new Error("invalid DEF identifier");
+        const relative = `.memory-bank/defs/${defId}.md`;
+        const file = assertPortableArtifactRef(relative, { workspaceRoot, runHome: workspaceRoot, runId: "" });
+        const directory = fs.realpathSync(path.join(workspaceRoot, ".memory-bank", "defs"));
+        const root = fs.realpathSync(workspaceRoot);
+        const directoryRelative = path.relative(root, directory);
+        if (directoryRelative === ".." || directoryRelative.startsWith(`..${path.sep}`) || path.isAbsolute(directoryRelative) || path.dirname(file) !== directory || !fs.statSync(file).isFile())
+            throw new Error("DEF must be a regular file in the project defs directory");
+        return { def_id: defId, path: relative, sha256: crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") };
+    }
+    catch (error) {
+        throw new AppError("deferral_invalid", "A deferral requires a readable project-local named DEF", 2, { def_id: defId ?? null, cause: error instanceof Error ? error.message : String(error) });
+    }
+}

package/dist/services/run-controller-adapter.js

@@ -5,6 +5,7 @@ import { AppError } from "../shared/errors.js";
 import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { appendEvent, digest, digestBytes, errorRecord } from "./run-controller-state.js";
+import { CAPACITY_POLICY, parseCapacityOperation } from "../harness-runtime/lib/codex-capacity-policy.mjs";
 /** A paused RUN admits only its controller's exact accepted answer Turn. */
 export function controllerHitlAdmission(context, record, input) {
     if (input.operation !== "session.prompt" || !input.operationId || !input.promptSha256)
@@ -15,13 +16,13 @@ export function controllerHitlAdmission(context, record, input) {
     if (!row || row.generation !== JSON.parse(record.metadata_json).run_generation)
         return false;
     const suffix = `:prompt:${row.generation}`;
-    const successor = /^(.*):capacity:([12]):session\.prompt$/.exec(input.operationId);
-    const baseId = successor ? successor[1] : input.operationId;
+    const successor = parseCapacityOperation(input.operationId);
+    const baseId = successor.root;
     if (!baseId.endsWith(suffix))
         return false;
-    if (successor) {
-        const ordinal = Number(successor[2]);
-        const predecessorId = ordinal === 1 ? baseId : `${baseId}:capacity:1:session.prompt`;
+    if (successor.ordinal > 0) {
+        const ordinal = successor.ordinal;
+        const predecessorId = ordinal === 1 ? baseId : `${baseId}:capacity:${ordinal - 1}:session.prompt`;
         const predecessor = context.db.get("SELECT status, receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [predecessorId, row.controller_id, row.generation]);
         if (predecessor?.status !== "failed" || !predecessor.receipt_json)
             return false;
@@ -34,6 +35,10 @@ export function controllerHitlAdmission(context, record, input) {
         }
         if (retained.capacity_intent?.predecessor !== predecessorId || retained.capacity_intent.operation_id !== input.operationId || retained.capacity_intent.ordinal !== ordinal)
             return false;
+        if (retained.capacity_intent.policy !== CAPACITY_POLICY)
+            return false;
+        if (!retained.capacity_intent.not_before || !Number.isFinite(Date.parse(retained.capacity_intent.not_before)) || Date.parse(retained.capacity_intent.not_before) > Date.parse(context.now()) || retained.capacity_intent.prompt_sha256 !== input.promptSha256)
+            return false;
     }
     const state = JSON.parse(row.state_json);
     const session = state.current_session === null ? undefined : state.sessions[state.current_session];
@@ -208,8 +213,18 @@ export async function controllerAdapter(context, row, manifest, session, args, a
     const promptSha256 = promptFile >= 0 ? digestBytes(fs.readFileSync(args[promptFile + 1])) : inlinePrompt >= 0 ? digestBytes(args[inlinePrompt + 1] ?? "") : undefined;
     const input = { executable, args, owner: session.owner.owner_id, state_dir: session.state_dir, ...(args[0] === "session" && args[1] === "prompt" && promptSha256 ? { prompt_sha256: promptSha256 } : {}) };
     const now = context.now();
-    context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'dispatching', ?, ?)", [operationId, row.controller_id, row.generation, digest(input), JSON.stringify(input), now, now]);
-    appendEvent(context, row.controller_id, "operation_requested", { operation_id: operationId, operation: args.slice(0, 2), session_id: session.id || null });
+    const existing = context.db.get("SELECT input_hash,status,receipt_json,error_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [operationId, row.controller_id, row.generation]);
+    if (existing?.input_hash && existing.input_hash !== digest(input))
+        throw new AppError("controller_operation_conflict", "Retained operation has different dispatch parameters", 1, { operation_id: operationId });
+    if (existing?.status === "completed" && existing.receipt_json) {
+        const receipt = JSON.parse(existing.receipt_json);
+        validateReceipt(receipt, session, args);
+        return receipt;
+    }
+    if (!existing) {
+        context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'dispatching', ?, ?)", [operationId, row.controller_id, row.generation, digest(input), JSON.stringify(input), now, now]);
+        appendEvent(context, row.controller_id, "operation_requested", { operation_id: operationId, operation: args.slice(0, 2), session_id: session.id || null });
+    }
     try {
         assertOwner?.();
         let receipt;
@@ -217,7 +232,17 @@ export async function controllerAdapter(context, row, manifest, session, args, a
         try {
             const timeoutMs = args[0] === "session" && args[1] === "prompt" ? null
                 : args[0] === "session" && args[1] === "create" && runtimeHarness(session.profile) === "zcode-acp" ? 180_000 : 120_000;
-            receipt = await runHarnessAdapter({ executable, args, env: controllerEnvironment(context, manifest, session), operationId, runtimeOwner: session.owner, timeoutMs, ...(signal ? { signal } : {}) });
+            if (existing) {
+                const observed = await recoverCompletedOperation(context, manifest, session, executable, args, operationId, signal);
+                if (!observed) {
+                    const cause = existing.error_json ? JSON.parse(existing.error_json) : { code: "controller_operation_outcome_unknown", message: "Retained dispatch has no observed terminal result", details: { operation_id: operationId } };
+                    throw new AppError(cause.code, cause.message, 1, cause.details);
+                }
+                receipt = observed;
+                recoveredOperation = true;
+            }
+            else
+                receipt = await runHarnessAdapter({ executable, args, env: controllerEnvironment(context, manifest, session), operationId, runtimeOwner: session.owner, timeoutMs, ...(signal ? { signal } : {}) });
         }
         catch (error) {
             const retained = await recoverCompletedOperation(context, manifest, session, executable, args, operationId, signal);

package/dist/services/run-controller-recovery.js

@@ -213,15 +213,38 @@ export async function resumeControllerSession(context, row, manifest, state, ass
     catch (error) {
         if (runtimeHarness(session.profile) !== "codex-desktop")
             throw error;
-        const continuationText = `The preceding native recovery ACK Turn failed before any observed tool or file effect. This is the same retained Session and recovery generation. First inspect the current RUN recovery state; only if the exact ACK still awaits acceptance, execute the exact standalone acceptance command below once. Never deliver it again after acceptance. Then stop at the original Stage or Work-graph boundary.\n\n${dispatch.prompt}`;
+        const continuationText = `Continue the same retained Session and recovery generation. First inspect the current RUN recovery state; only if the exact ACK still awaits acceptance, execute the exact standalone acceptance command below once. Never deliver it again after acceptance. Then stop at the original Stage or Work-graph boundary.\n\n${dispatch.prompt}`;
         const inspect = (args, operationId) => runHarnessAdapter({ executable: manifest.adapters["codex-desktop"].executable,
             args, env: controllerEnvironment(executionContext, manifest, session), runtimeOwner: session.owner, operationId, timeoutMs: 30_000 });
         const resumed = await continueCodexCapacity({ error, sessionId: session.id, operationId: dispatch.operation_id, allowSettledDescendants: true, continuationText,
+            retainedIntents: () => {
+                const binding = context.db.get("SELECT runtime_dispatch_json FROM run_recovery_bindings WHERE recovery_id = ?", [recovery.recovery_id]);
+                return binding?.runtime_dispatch_json ? JSON.parse(binding.runtime_dispatch_json).capacity_intents ?? [] : [];
+            },
+            retainedFailures: () => {
+                const binding = context.db.get("SELECT runtime_dispatch_json FROM run_recovery_bindings WHERE recovery_id = ?", [recovery.recovery_id]);
+                return binding?.runtime_dispatch_json ? JSON.parse(binding.runtime_dispatch_json).capacity_failures ?? [] : [];
+            },
+            retainFailure: (_id, refusal) => {
+                assertRecoveryOwner();
+                context.db.writeTransaction(() => {
+                    const binding = context.db.get("SELECT runtime_dispatch_json FROM run_recovery_bindings WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared'", [recovery.recovery_id, daemonId]);
+                    if (!binding)
+                        throw new AppError("recovery_capacity_owner_changed", "Recovery binding changed before refusal retention", 1);
+                    const retained = JSON.parse(binding.runtime_dispatch_json);
+                    retained.capacity_failures = [...(retained.capacity_failures ?? []), refusal];
+                    const changed = context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared' AND runtime_dispatch_json = ?", [JSON.stringify(retained), recovery.recovery_id, daemonId, binding.runtime_dispatch_json]);
+                    if (changed.changes !== 1)
+                        throw new AppError("recovery_capacity_owner_changed", "Recovery binding changed during refusal retention", 1);
+                });
+            },
             inspectOperation: id => inspect(["daemon", "operation", "--state-dir", session.state_dir, "--operation-id", id, "--json"], `${id}:capacity-observe`),
-            inspectSession: () => inspect(["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], `${dispatch.operation_id}:capacity-inspect`),
+            inspectSession: turnId => inspect(["session", "inspect", "--session-id", session.id, ...(turnId ? ["--turn-id", turnId] : []), ...sessionArguments(context, manifest, session)], `${dispatch.operation_id}:capacity-inspect`),
             assertCurrent: () => {
                 assertRecoveryOwner();
                 const guard = recoveryGuard(context, row.project_id, row.run_id);
+                if (guard?.status === "recovered")
+                    return;
                 const binding = context.db.get("SELECT status, daemon_id FROM run_recovery_bindings WHERE recovery_id = ?", [recovery.recovery_id]);
                 const ack = context.db.get("SELECT status FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [recovery.operation_id, row.controller_id, row.generation]);
                 if (guard?.status !== "resuming" || binding?.status !== "prepared" || binding.daemon_id !== daemonId || ack?.status !== "accepted")
@@ -232,6 +255,7 @@ export async function resumeControllerSession(context, row, manifest, state, ass
                     || current.process.lease_expires_at <= context.now() || metadata.run_generation !== row.generation || !processIsAlive(current.process))
                     throw new AppError("recovery_capacity_owner_changed", "Replacement native owner changed during capacity wait", 1);
             },
+            decision: () => recoveryGuard(context, row.project_id, row.run_id)?.status === "recovered" ? "completed" : "continue",
             retainIntent: intent => retainRecoveryCapacityIntent(executionContext, { projectId: row.project_id, runId: row.run_id, recoveryId: recovery.recovery_id,
                 controllerId: row.controller_id, generation: row.generation, daemonId, intent, prompt: continuationText }),
             prompt: (operationId, prompt) => sendAck(operationId, prompt) });

package/dist/services/run-controller.js

@@ -30,12 +30,12 @@ import { requireRun, requireController, controllerReceipt, appendEvent, saveStat
 import { assertNoCorrelatedRejection } from "./continuation-outcome.js";
 import { spawnController, recordControllerLauncher, claimControllerProcess, markControllerDispatchReady } from "./run-controller-process.js";
 import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
-import { continueCodexCapacity } from "./codex-capacity.js";
+import { capacityDelay, continueCodexCapacity } from "./codex-capacity.js";
 import { resumeControllerSession, failControllerRecovery } from "./run-controller-recovery.js";
 import { captureControllerBoundary } from "./run-controller-capture.js";
 import { requestRunControl } from "./run-control-worker.js";
 import { storageSessionId } from "./session-identity.js";
-import { terminalCodexOverload } from "../harness-runtime/lib/dd-codex.mjs";
+import { CAPACITY_POLICY, nativeItemsSettled, overloadBurst, refusalObservation, terminalCodexOverload } from "../harness-runtime/lib/codex-capacity-policy.mjs";
 export { resumeRunController } from "./run-controller-recovery.js";
 export function prepareRunControllerLaunch(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(input.requestId) || !/^[a-f0-9]{64}$/.test(input.contextSha256))
@@ -534,8 +534,15 @@ async function executeController(context, row, manifest, state, assertOwnership,
         await reconcilePromptPredecessor(session);
         const firstOperationId = operationId ?? `${row.controller_id}:prompt:${crypto.randomUUID()}`;
         const send = (value, id) => {
+            const retained = context.db.get("SELECT input_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [id, row.controller_id, row.generation]);
+            if (retained) {
+                const dispatch = JSON.parse(retained.input_json);
+                if (![value, `${value}\n`].some(text => dispatch.prompt_sha256 === crypto.createHash("sha256").update(text).digest("hex")))
+                    throw new AppError("capacity_continuation_conflict", "Retained prompt differs from continuation", 1);
+                return controllerAdapter(executionContext, row, manifest, session, dispatch.args, assertOwner, id, cancellation.signal);
+            }
             const file = path.join(row.state_dir, `turn-${String(state.turns + 1).padStart(5, "0")}.md`);
-            fs.writeFileSync(file, `${value}\n`, { flag: "wx", mode: 0o600 });
+            fs.writeFileSync(file, value, { flag: "wx", mode: 0o600 });
             state.turns += 1;
             saveState(context, row, state);
             return controllerAdapter(executionContext, row, manifest, session, ["session", "prompt", "--session-id", session.id, "--prompt-file", file, ...sessionArguments(context, manifest, session)], assertOwner, id, cancellation.signal);
@@ -553,33 +560,61 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     throw error;
                 const inspect = (args, id) => runHarnessAdapter({ executable: manifest.adapters["codex-desktop"].executable,
                     args, env: controllerEnvironment(context, manifest, session), runtimeOwner: session.owner, operationId: id, timeoutMs: 30_000, signal: cancellation.signal });
-                const resumed = await continueCodexCapacity({ error, sessionId: session.id, operationId: firstOperationId,
+                const resumed = await continueCodexCapacity({ error, sessionId: session.id, operationId: firstOperationId, signal: cancellation.signal, allowSettledDescendants: true,
+                    retainedIntents: () => context.db.all("SELECT receipt_json FROM run_controller_operations WHERE controller_id = ? AND generation = ?", [row.controller_id, row.generation])
+                        .flatMap(item => { const retained = JSON.parse(item.receipt_json || "null"); return retained?.capacity_intent?.root_operation_id === firstOperationId ? [retained.capacity_intent] : []; }).sort((a, b) => a.ordinal - b.ordinal),
+                    retainedFailures: () => context.db.all("SELECT receipt_json FROM run_controller_operations WHERE controller_id = ? AND generation = ?", [row.controller_id, row.generation])
+                        .flatMap(item => { const retained = JSON.parse(item.receipt_json || "null"); return retained?.capacity_root === firstOperationId && retained.capacity_failure ? [retained.capacity_failure] : []; }),
+                    retainFailure: (id, refusal) => {
+                        const changed = context.db.run("UPDATE run_controller_operations SET receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_root: firstOperationId, capacity_failure: refusal }), context.now(), id, row.controller_id, row.generation]);
+                        if (changed.changes !== 1)
+                            throw new AppError("capacity_continuation_blocked", "Failed Turn owner changed before its refusal was retained", 1);
+                    },
                     inspectOperation: id => inspect(["daemon", "operation", "--state-dir", session.state_dir, "--operation-id", id, "--json"], `${id}:capacity-observe`),
-                    inspectSession: () => inspect(["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], `${firstOperationId}:capacity-inspect`),
+                    inspectSession: turnId => inspect(["session", "inspect", "--session-id", session.id, ...(turnId ? ["--turn-id", turnId] : []), ...sessionArguments(context, manifest, session)], `${firstOperationId}:capacity-inspect`),
                     assertCurrent: () => {
                         assertOwner();
+                    },
+                    decision: async () => {
+                        if (kind === "child") {
+                            const target = Object.entries(state.child_capacity ?? {}).find(([, retained]) => retained.operation_id === firstOperationId);
+                            if (!target)
+                                return "reconciliation_blocked";
+                            const seen = await inspect(["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], `${firstOperationId}:child-followup-observe`);
+                            const child = controllerNativeChildren(seen, session.id).find(item => item.session_id === target[0]);
+                            if (child?.parent_session_id === session.id && (child.status === "running" || child.terminal_turn_id && child.terminal_turn_id !== target[1].turn_id))
+                                return "completed";
+                        }
                         const view = getFlowRunStatus(executionContext, { projectRoot: manifest.request.project_root, runId: row.run_id });
                         const next = view.continuation;
+                        if (next.kind === "blocked")
+                            return "reconciliation_blocked";
+                        if (next.kind === "paused" && next.stage !== state.stage)
+                            return "paused";
+                        if (next.kind === "terminal" || next.stage !== state.stage)
+                            return "completed";
                         if (hitl) {
                             const answerId = firstOperationId.slice(0, -`:prompt:${row.generation}`.length);
                             const answer = context.db.get("SELECT input_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND status = 'accepted'", [answerId, row.controller_id]);
                             const accepted = answer && JSON.parse(answer.input_json);
                             const pause = view.index.stage_runs.find(item => item.stage === accepted?.stage)?.pause;
-                            if (next.kind !== "paused" || next.stage !== state.stage || !accepted || pause?.id !== accepted.pause_id || pause.work_id !== accepted.work_id || pause.answer_path)
-                                throw new AppError("capacity_continuation_blocked", "Accepted HITL pause changed during capacity wait", 1, { continuation: next });
-                        }
-                        else if (next.stage !== state.stage || ["terminal", "paused", "blocked", "wait"].includes(next.kind)) {
-                            throw new AppError("capacity_continuation_blocked", "RUN changed while native capacity was unavailable", 1, { continuation: next });
+                            if (next.kind !== "paused")
+                                return "continue";
+                            if (!accepted || pause?.id !== accepted.pause_id || pause.work_id !== accepted.work_id || pause.answer_path)
+                                return "paused";
                         }
+                        else if (next.kind === "paused")
+                            return "paused";
+                        return next.kind === "wait" ? "reconciliation_blocked" : "continue";
                     },
                     retainIntent: intent => context.db.writeTransaction(() => {
-                        const changed = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_intent: intent }), context.now(), intent.predecessor, row.controller_id, row.generation]);
+                        const changed = context.db.run("UPDATE run_controller_operations SET status = 'failed', receipt_json = ?, updated_at = ? WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'outcome_unknown'", [JSON.stringify({ capacity_root: firstOperationId, capacity_failure: intent.refusal, capacity_intent: intent }), context.now(), intent.predecessor, row.controller_id, row.generation]);
                         if (changed.changes !== 1)
                             throw new AppError("capacity_continuation_blocked", "Failed native operation changed before continuation", 1);
                         appendEvent(context, row.controller_id, "capacity_continuation", intent);
                     }),
                     prompt: (id, value) => send(value, id),
-                    ...(resumeCommand ? { continuationText: `The preceding Turn failed before any tool call. Continue the same accepted HITL answer in this Session. If the pause is still current, run this exact previously issued standalone command once without changing the answer:\n\n${resumeCommand}\n\nDo not accept or deliver the answer again if the pause has changed.` } : {}) });
+                    ...(resumeCommand ? { continuationText: `Continue the same accepted HITL task in this Session. First inspect current durable RUN and pause state. Only if the exact pause still awaits the accepted answer, run this previously issued command once:\n\n${resumeCommand}\n\nNever replay an already committed answer. Otherwise use only the current issued successor.` } : {}) });
                 if (!resumed)
                     throw error;
                 receipt = resumed;
@@ -740,6 +775,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 }
                 state.native_baseline = controllerNativeChildren(state.last_receipt ?? {}, session.id).map(child => child.session_id);
                 state.stage = next.stage;
+                state.child_capacity = {};
                 saveState(context, row, state);
                 setStatus("running");
                 if (next.stage === "code" || next.stage === "code-review") {
@@ -766,25 +802,49 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 saveState(context, row, state);
                 children = controllerNativeChildren(inspected, session.id).filter(child => !baseline.has(child.session_id));
                 const failed = children.filter(child => child.status === "failed");
-                const child = failed.length === 1 && children.every(item => item === failed[0] || item.status === "completed") ? failed[0] : undefined;
+                // Continue one existing child at a time; another failed child does not
+                // create a second fanout wave or share this child's refusal counter.
+                const child = children.every(item => item.status === "failed" || item.status === "completed") ? failed.find(item => item.parent_session_id === session.id && item.terminal_turn_id && nativeItemsSettled(item.native_turn_items) && terminalCodexOverload({ code: "turn_interrupted", details: { provider_session_id: item.session_id, turn_id: item.terminal_turn_id, native_turn_id: item.terminal_turn_id, terminal_status: "failed", provider_error: item.provider_error } }, item.session_id)) : undefined;
                 const turnId = child?.terminal_turn_id;
                 const native = child && turnId ? { code: "turn_interrupted", details: { provider_session_id: child.session_id, turn_id: turnId, native_turn_id: turnId,
-                        terminal_status: "failed", provider_error: child.provider_error } } : null;
+                        terminal_status: "failed", provider_error: child.provider_error, observed_at: child.terminal_observed_at } } : null;
                 const prior = child && state.child_capacity?.[child.session_id];
                 const links = child ? context.db.all("SELECT w.status FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.session_id = ?", [row.project_id, row.run_id, storageSessionId({ harness_id: "codex-desktop", session_id: child.session_id })]) : [];
                 if (child && turnId && native && terminalCodexOverload(native, child.session_id, turnId)
-                    && child.native_turn_items?.observed === true && child.native_turn_items.possible_effects === false
+                    && nativeItemsSettled(child.native_turn_items)
                     && inspected.settled === true && child.parent_session_id === session.id && links.length <= 1
-                    && (!links.length || links[0].status === "running") && (prior?.attempts ?? 0) < 2) {
-                    if (prior?.turn_id === turnId)
+                    && (!links.length || links[0].status === "running")) {
+                    const prepared = prior?.turn_id === turnId && prior.dispatched === false && prior.operation_id && prior.not_before ? prior : null;
+                    if (prior?.turn_id === turnId && !prepared)
                         throw new AppError("capacity_child_followup_unconfirmed", "Parent continuation did not start a new native child Turn", 1, { child_session_id: child.session_id, turn_id: turnId });
-                    const attempt = (prior?.attempts ?? 0) + 1;
+                    const attempt = prepared ? prepared.attempts : (prior?.attempts ?? 0) + 1;
+                    if (!Number.isSafeInteger(attempt) || prior && prior.policy !== CAPACITY_POLICY)
+                        throw new AppError("capacity_continuation_conflict", "Native child continuation policy or ordinal is incompatible", 1);
+                    const refusals = [...(prior?.refusals ?? [])];
+                    if (!refusals.some(item => item.turn_id === turnId)) {
+                        const refusal = refusalObservation(native, attempt - 1, child.terminal_observed_at ?? context.now());
+                        refusals.push(refusal);
+                        state.child_capacity ??= {};
+                        state.child_capacity[child.session_id] = { ...prior, turn_id: prior?.turn_id ?? turnId, attempts: prior?.attempts ?? 0, policy: CAPACITY_POLICY, refusals };
+                        saveState(context, row, state);
+                    }
+                    const burst = overloadBurst(refusals);
+                    if (burst)
+                        throw new AppError("provider_overload_burst", "Native child had two continuation refusals within two minutes", 1, { ...burst, child_session_id: child.session_id, primary_error: native });
+                    const wait = prepared ? Math.max(0, Date.parse(prepared.not_before) - Date.now()) : capacityDelay(native, attempt);
+                    if (!Number.isFinite(wait) || Date.now() + wait > 8.64e15)
+                        throw new AppError("capacity_retry_metadata_invalid", "Native child retry time is invalid", 1, { child_session_id: child.session_id, delay_ms: wait });
+                    const rootOperationId = prior?.root_operation_id ?? `${row.controller_id}:child:${digest([child.session_id, turnId]).slice(0, 16)}`;
+                    const operationId = prepared?.operation_id ?? `${rootOperationId}:followup:${attempt}`;
                     state.child_capacity ??= {};
-                    state.child_capacity[child.session_id] = { turn_id: turnId, attempts: attempt };
+                    state.child_capacity[child.session_id] = { turn_id: turnId, attempts: attempt, operation_id: operationId, root_operation_id: rootOperationId, policy: CAPACITY_POLICY, refusals, not_before: prepared?.not_before ?? new Date(Date.now() + wait).toISOString(), dispatched: false };
                     saveState(context, row, state);
-                    const operationId = `${row.controller_id}:child:${digest([child.session_id, turnId]).slice(0, 16)}:followup:${attempt}`;
                     appendEvent(context, row.controller_id, "capacity_child_followup", { child_session_id: child.session_id, turn_id: turnId, attempt, operation_id: operationId });
-                    await delay(attempt === 1 ? 5_000 : 15_000);
+                    const until = performance.now() + wait;
+                    while (performance.now() < until) {
+                        await delay(Math.min(250, Math.max(0, until - performance.now())), undefined, { signal: cancellation.signal });
+                        assertOwner();
+                    }
                     assertOwner();
                     const current = getFlowRunStatus(executionContext, { projectRoot: manifest.request.project_root, runId: row.run_id });
                     if (current.continuation.stage !== state.stage || ["terminal", "paused", "blocked", "wait"].includes(current.continuation.kind))
@@ -792,13 +852,20 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     const fresh = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
                     const still = controllerNativeChildren(fresh, session.id).find(item => item.session_id === child.session_id);
                     const currentLinks = context.db.all("SELECT w.status FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.session_id = ?", [row.project_id, row.run_id, storageSessionId({ harness_id: "codex-desktop", session_id: child.session_id })]);
+                    if (still?.status === "completed" && currentLinks.length <= 1 && currentLinks.every(link => link.status === "completed")) {
+                        state.last_receipt = fresh;
+                        saveState(context, row, state);
+                        continue;
+                    }
                     if (fresh.settled !== true || !still || still.parent_session_id !== session.id || still.status !== "failed" || still.terminal_turn_id !== turnId
-                        || still.native_turn_items?.observed !== true || still.native_turn_items.possible_effects !== false || currentLinks.length > 1
+                        || !nativeItemsSettled(still.native_turn_items) || currentLinks.length > 1
                         || currentLinks.some(link => link.status !== "running"))
                         throw new AppError("capacity_child_followup_blocked", "Native child or Work changed during capacity wait", 1, { child_session_id: child.session_id, turn_id: turnId });
                     assertOwner();
-                    const text = `The existing native child ${child.session_id} has a confirmed effect-free failed Turn. Use the native followup_task tool exactly once for that same child ID with this short message: "Continue your assigned Work from its current durable state. Do not repeat an observed lifecycle command. Finish only the original Work." Do not spawn another child, claim another Work, or perform the child's Work in this parent Turn. End this Turn after the followup_task response.`;
+                    const text = `The existing native child ${child.session_id} has a confirmed terminal overloaded Turn. Use the native followup_task tool exactly once for that same child ID with this short message: "Continue your assigned Work from its current durable state. Do not repeat an observed lifecycle command. Finish only the original Work." Do not spawn another child, claim another Work, or perform the child's Work in this parent Turn. End this Turn after the followup_task response.`;
                     await prompt(session, text, operationId, "child");
+                    state.child_capacity[child.session_id].dispatched = true;
+                    saveState(context, row, state);
                     const after = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
                     state.last_receipt = after;
                     saveState(context, row, state);
@@ -829,7 +896,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 const results = await Promise.allSettled(fanout.works.map(async (work) => {
                     try {
                         assertOwner();
-                        const receipt = await launchExternalWork(executionContext, { workId: work.work_id, stage: next.stage });
+                        const receipt = await launchExternalWork(executionContext, { workId: work.work_id, stage: next.stage, signal: cancellation.signal });
                         if (fatal)
                             throw fatal;
                         appendEvent(context, row.controller_id, "external_work_observed", { work_id: work.work_id, receipt });

package/dist/services/run-observations.js

@@ -90,7 +90,7 @@ export function runObservations(context, projectId, runId) {
             const actual = fs.realpathSync(file);
             if (!inside(home, actual))
                 throw new Error("journal escaped owned home");
-            fd = fs.openSync(actual, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW);
+            fd = fs.openSync(actual, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
             if (!fs.fstatSync(fd).isFile())
                 throw new Error("journal is not a regular file");
             replayToolJournal(file, { harness: source.session.harness_id, rootSessionId: sessionId, text: fs.readFileSync(fd, "utf8"), ...(source.session.harness_id === "codex-desktop" ? { expectedSessionIds: expectedCodexIds } : {}) }, reducer);
@@ -114,7 +114,9 @@ export function runObservations(context, projectId, runId) {
     // Select transcript fallback only after replay reveals an actual gap.
     for (const session of sessions) {
         const nativeId = session.provider_session_id ?? session.session_id;
-        if (!session.transcript_path || covered().has(JSON.stringify({ harness_id: session.harness, session_id: nativeId })))
+        const sessionSummary = reducer.summary(nativeId);
+        if (!session.transcript_path || covered().has(JSON.stringify({ harness_id: session.harness, session_id: nativeId }))
+            && sessionSummary.completeness === "complete" && sessionSummary.outcome_completeness === "complete")
             continue;
         const id = `transcript:${session.harness}:${nativeId}`;
         add(id, nativeId, session.transcript_path, home, "current", session.harness);
@@ -136,6 +138,9 @@ export function runObservations(context, projectId, runId) {
         if (!expectedIds.has(JSON.stringify(event.session))) {
             reducer.turns.delete(key);
         }
+    for (const [key, event] of reducer.sources)
+        if (!expectedIds.has(JSON.stringify(event.session)))
+            reducer.sources.delete(key);
     const summary = reducer.summary();
     const observed = new Set(summary.sessions.map(s => JSON.stringify(s.session)));
     const missing = expected.filter(s => !observed.has(JSON.stringify(s)));