@deksden-com/dd-flow-cli 0.9.0-beta.123 → 0.9.0-beta.124

package/dist/services/codex-capacity.js

@@ -1,16 +1,57 @@
 import { setTimeout as delay } from "node:timers/promises";
 import crypto from "node:crypto";
-import { terminalCodexOverload } from "../harness-runtime/lib/dd-codex.mjs";
+import { CAPACITY_POLICY, capacityBackoff, nativeItemsSettled, normalizeCodexFailure, overloadBurst, parseCapacityOperation, refusalObservation, terminalCodexOverload } from "../harness-runtime/lib/codex-capacity-policy.mjs";
 import { AppError } from "../shared/errors.js";
 /** Permit acquisition must still belong to the original task, not merely an
  * open RUN. Controls/inspection and ordinary successor prompts are unaffected. */
-export function assertCapacityOwnerAdmission(context, record, operationId) {
+export function assertCapacityOwnerAdmission(context, record, operationId, binding) {
     if (!operationId || !record.project_id || !record.run_id)
         return;
-    const root = operationId.replace(/:capacity:[12]:session\.prompt$/, "");
-    if (root === operationId && !/:child:[a-f0-9]+:followup:[12]$/.test(root))
+    const root = parseCapacityOperation(operationId).root;
+    const childOrdinal = /:child:[a-f0-9]+:followup:(\d+)$/.exec(root)?.[1];
+    if (childOrdinal && (!Number.isSafeInteger(Number(childOrdinal)) || Number(childOrdinal) < 1 || String(Number(childOrdinal)) !== childOrdinal))
+        throw new AppError("capacity_continuation_conflict", "Invalid native child continuation ordinal", 1);
+    if (root === operationId && !childOrdinal)
         return;
     const reject = () => { throw new AppError("capacity_owner_boundary_changed", "Queued continuation no longer belongs to an unfinished task; reconcile its durable state", 1, { operation_id: operationId, work_id: record.work_id, run_id: record.run_id }); };
+    const metadata = JSON.parse(record.metadata_json);
+    const hasTable = (name) => Boolean(context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?", [name]));
+    const parsed = parseCapacityOperation(operationId);
+    if (parsed.ordinal > 0 && !["judge", "probe"].includes(metadata.role ?? "")) {
+        if (!binding?.nativeSessionId || !binding.promptSha256)
+            reject();
+        let intent;
+        const predecessor = parsed.ordinal === 1 ? root : `${root}:capacity:${parsed.ordinal - 1}:session.prompt`;
+        if (hasTable("run_controller_operations")) {
+            const saved = context.db.get("SELECT receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'failed'", [predecessor, record.owner_id, metadata.run_generation ?? 0]);
+            if (saved)
+                intent = JSON.parse(saved.receipt_json).capacity_intent;
+        }
+        if (!intent && record.work_id)
+            for (const table of ["work_launches", "merge_requests"]) {
+                if (!hasTable(table))
+                    continue;
+                const rows = table === "work_launches"
+                    ? context.db.all("SELECT l.adapter_receipt_json FROM work_launches l JOIN works w ON w.work_id = l.work_id WHERE l.work_id = ? AND w.project_id = ? AND w.run_id = ?", [record.work_id, record.project_id, record.run_id])
+                    : context.db.all("SELECT adapter_receipt_json FROM merge_requests WHERE executor_work_id = ? AND project_id = ? AND run_id = ?", [record.work_id, record.project_id, record.run_id]);
+                for (const saved of rows) {
+                    const retained = JSON.parse(saved.adapter_receipt_json ?? "null");
+                    intent = retained?.capacity_intents?.find((item) => item.operation_id === operationId);
+                    if (intent)
+                        break;
+                }
+                if (intent)
+                    break;
+            }
+        if (!intent || intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== root || intent.ordinal !== parsed.ordinal
+            || intent.predecessor !== predecessor || intent.operation_id !== operationId || intent.refusal?.turn_id !== intent.turn_id
+            || intent.refusal?.ordinal !== parsed.ordinal - 1 || intent.refusal?.session_id !== intent.session_id
+            || !Number.isFinite(Date.parse(intent.not_before)) || Date.parse(intent.not_before) > Date.parse(context.now())
+            || intent.deadline !== null && (typeof intent.deadline !== "number" || intent.deadline <= Date.parse(context.now()))
+            || binding?.nativeSessionId !== undefined && intent.session_id !== binding.nativeSessionId
+            || binding?.promptSha256 !== undefined && intent.prompt_sha256 !== binding.promptSha256)
+            reject();
+    }
     if (context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'run_recovery_bindings'")) {
         if (context.db.get("SELECT 1 FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND g.run_id = ? AND g.status = 'recovered' AND b.status = 'accepted' AND json_extract(b.runtime_dispatch_json, '$.operation_id') = ?", [record.project_id, record.run_id, root]))
             reject();
@@ -22,7 +63,7 @@ export function assertCapacityOwnerAdmission(context, record, operationId) {
             reject();
         // MERGE owns the Stage/request boundary: finishing its Work does not
         // necessarily commit stage finish yet. External workers own only Work.
-        const mergeOwner = JSON.parse(record.metadata_json).role === "merge";
+        const mergeOwner = metadata.role === "merge";
         if (!work || !(merge && mergeOwner ? ["created", "running", "completed"] : ["created", "running"]).includes(work.status))
             reject();
     }
@@ -37,30 +78,56 @@ export function assertCapacityOwnerAdmission(context, record, operationId) {
     if (state.stage && (index.current_stage && index.current_stage !== state.stage || index.stage_runs?.some(stage => stage.stage === state.stage && ["done", "skipped"].includes(stage.status))))
         reject();
     const child = Object.entries(state.child_capacity ?? {}).find(([, intent]) => intent.operation_id === root)?.[0];
+    if (childOrdinal && !child)
+        reject();
     if (child && context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id JOIN sessions s ON s.session_id = ws.session_id WHERE w.project_id = ? AND w.run_id = ? AND s.provider_session_id = ? AND w.status <> 'running'", [record.project_id, record.run_id, child]))
         reject();
 }
 export function capacityDelay(error, ordinal, now = Date.now()) {
-    const native = error?.details?.provider_error;
-    const headers = native?.headers;
-    const header = headers && Object.entries(headers).find(([key]) => key.toLowerCase() === "retry-after")?.[1];
-    const value = header ?? native?.retryAfter ?? native?.retry_after;
-    const seconds = typeof value === "number" || typeof value === "string" && /^\d+(\.\d+)?$/.test(value.trim()) ? Number(value) * 1000 : typeof value === "string" ? Date.parse(value) - now : NaN;
-    return Math.max(ordinal === 1 ? 5_000 : 15_000, Number.isFinite(seconds) ? Math.max(0, seconds) : 0);
+    return capacityBackoff(error, ordinal, now);
 }
 /** Continue a confirmed terminal Turn, never replay its completed effects. */
 export async function continueCodexCapacity(input) {
     let { error, operationId } = input;
-    const history = input.retainedIntents?.() ?? [];
-    const rootId = input.operationId.replace(/:capacity:[12]:session\.prompt$/, "");
+    const history = [...(input.retainedIntents?.() ?? [])];
+    const parsed = parseCapacityOperation(input.operationId);
+    const rootId = parsed.root;
     const text = input.continuationText ?? "Continue the same assigned task in this Session. Check current durable RUN, Work and Stage state first. Never repeat an observed lifecycle command, accepted HITL answer, check or merge apply; use only an exact issued successor. Stop at the assigned boundary.";
     const promptSha = crypto.createHash("sha256").update(text).digest("hex");
-    let ordinal = Number(/:capacity:([12]):session\.prompt$/.exec(operationId)?.[1] ?? 0) + 1;
+    let ordinal = parsed.ordinal + 1;
+    const conflict = (message) => { throw new AppError("capacity_continuation_conflict", message, 1, { operation_id: operationId, root_operation_id: rootId, session_id: input.sessionId }); };
+    const refusals = [...(input.retainedFailures?.() ?? [])];
+    if (parsed.ordinal > history.length)
+        conflict("Continuation has no complete retained predecessor chain");
+    for (let index = 0; index < history.length; index++) {
+        const intent = history[index];
+        const expected = index + 1;
+        if (intent.ordinal !== expected || intent.operation_id !== `${rootId}:capacity:${expected}:session.prompt`
+            || intent.predecessor !== (expected === 1 ? rootId : `${rootId}:capacity:${expected - 1}:session.prompt`)
+            || intent.prompt_sha256 !== promptSha || intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== rootId || intent.session_id !== input.sessionId
+            || intent.deadline !== (input.deadline ?? null) || !intent.refusal || intent.refusal.ordinal !== expected - 1 || intent.refusal.turn_id !== intent.turn_id
+            || !Number.isFinite(Date.parse(intent.not_before)))
+            conflict("Retained capacity chain is incomplete or belongs to another policy/task");
+        const previous = refusals.find(item => item.ordinal === intent.refusal.ordinal);
+        if (previous && JSON.stringify(previous) !== JSON.stringify(intent.refusal))
+            conflict("Retained failure observation changed");
+        if (!previous)
+            refusals.push(intent.refusal);
+    }
+    refusals.sort((a, b) => a.ordinal - b.ordinal);
+    for (let index = 0; index < refusals.length; index++) {
+        const refusal = refusals[index];
+        if (refusal.ordinal !== index || refusal.policy !== CAPACITY_POLICY || refusal.session_id !== input.sessionId || !refusal.turn_id
+            || refusals.slice(0, index).some(item => item.turn_id === refusal.turn_id) || !Number.isFinite(Date.parse(refusal.first_observed_at)))
+            conflict("Retained refusal chain is invalid");
+    }
     // Reconcile a retained dispatch before preparing another. Native absence is
     // the only safe way to reuse a prepared intent; a lost reply is not absence.
     for (const intent of history) {
-        if (intent.predecessor !== operationId || intent.ordinal !== ordinal || intent.operation_id !== `${rootId}:capacity:${ordinal}:session.prompt`)
+        if (intent.ordinal < ordinal)
             continue;
+        if (intent.predecessor !== operationId || intent.ordinal !== ordinal || intent.operation_id !== `${rootId}:capacity:${ordinal}:session.prompt`)
+            conflict("Retained successor skips its predecessor");
         if (intent.prompt_sha256 !== promptSha || !intent.turn_id || !Number.isFinite(Date.parse(intent.not_before)))
             throw error;
         let observed;
@@ -72,7 +139,7 @@ export async function continueCodexCapacity(input) {
             for (let depth = 0; depth < 4 && code?.code === "harness_adapter_failed"; depth++)
                 code = code.details?.cause;
             if (code?.code !== "operation_not_found")
-                throw error;
+                throw cause;
             break;
         }
         if (observed.operation_id !== intent.operation_id || observed.session_id !== input.sessionId || observed.operation !== "session.prompt" || observed.primary_error)
@@ -80,7 +147,12 @@ export async function continueCodexCapacity(input) {
         if (observed.state === "completed" && observed.result && typeof observed.result === "object") {
             input.signal?.throwIfAborted();
             input.assertCurrent();
-            return observed.result;
+            const boundary = await input.decision?.() ?? "continue";
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            if (boundary === "reconciliation_blocked")
+                throw new AppError("capacity_continuation_blocked", "Retained completion cannot be reconciled with its owner boundary", 1);
+            return boundary === "paused" || boundary === "completed" ? { provider_session_id: input.sessionId, capacity_decision: boundary } : observed.result;
         }
         if (observed.state !== "failed" || !terminalCodexOverload(observed.error, input.sessionId))
             throw error;
@@ -95,12 +167,14 @@ export async function continueCodexCapacity(input) {
         input.signal?.throwIfAborted();
         input.assertCurrent();
         if (decision === "reconciliation_blocked")
-            throw error;
+            throw new AppError("capacity_continuation_blocked", "Native refusal cannot be reconciled with its durable owner boundary", 1, { primary_error: error, root_operation_id: rootId, provider_session_id: input.sessionId });
         if (decision === "continue" && input.deadline !== undefined && Date.now() >= input.deadline)
-            throw error;
+            throw new AppError("capacity_owner_deadline_exceeded", "Continuation exhausted its original owner deadline", 1, { primary_error: error, deadline: input.deadline, root_operation_id: rootId, provider_session_id: input.sessionId });
         return decision === "continue" ? null : { provider_session_id: input.sessionId, capacity_decision: decision };
     };
-    for (; ordinal <= 2; ordinal += 1) {
+    for (;; ordinal += 1) {
+        if (!Number.isSafeInteger(ordinal))
+            conflict("Continuation ordinal overflow");
         if (!terminalCodexOverload(error, input.sessionId)) {
             if (ordinal === 1)
                 return null;
@@ -109,17 +183,12 @@ export async function continueCodexCapacity(input) {
         const completed = await decide();
         if (completed)
             return completed;
-        let prior;
-        try {
-            prior = await input.inspectOperation(operationId);
-        }
-        catch {
-            if (ordinal === 1)
-                return null;
-            throw error;
-        }
+        const prior = await input.inspectOperation(operationId);
         const failure = prior.error;
-        const turnId = failure?.details?.turn_id;
+        const confirmed = normalizeCodexFailure(failure, input.sessionId);
+        const turnId = confirmed?.turn_id;
+        input.signal?.throwIfAborted();
+        input.assertCurrent();
         if (prior.operation_id !== operationId || prior.operation !== "session.prompt" || prior.session_id !== input.sessionId
             || prior.state !== "failed" || prior.primary_error || !turnId || !terminalCodexOverload(failure, input.sessionId, turnId)) {
             if (ordinal === 1)
@@ -127,9 +196,15 @@ export async function continueCodexCapacity(input) {
             throw error;
         }
         const settled = async () => {
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
             const seen = await input.inspectSession(turnId);
-            const items = seen.terminal_turn_id === turnId && seen.terminal_status === "failed" ? seen.native_turn_items : failure.details?.native_turn_items;
-            if (items?.observed !== true || typeof items.possible_effects !== "boolean" || items.pending === true || items.possible_effects === true && items.pending !== false)
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            if (seen.terminal_turn_id !== undefined && seen.terminal_turn_id !== turnId)
+                return false;
+            const items = seen.terminal_turn_id === turnId && seen.terminal_status === "failed" ? seen.native_turn_items : confirmed?.native_turn_items;
+            if (!nativeItemsSettled(items))
                 return false;
             const settlement = seen.settlement;
             const ids = Array.isArray(seen.tree_session_ids) ? seen.tree_session_ids : [];
@@ -142,33 +217,60 @@ export async function continueCodexCapacity(input) {
             return seen.provider_session_id === input.sessionId && seen.settled === true && treeProven
                 && (!settlement || settlement.state === "not_required" || settlement.state === "settled" && settlement.operation_ids?.includes(operationId) === true);
         };
-        try {
-            if (!await settled()) {
-                if (ordinal === 1)
-                    return null;
-                throw error;
-            }
-        }
-        catch {
+        if (!await settled()) {
             if (ordinal === 1)
                 return null;
             throw error;
         }
+        const native = normalizeCodexFailure(failure, input.sessionId, turnId);
+        let refusal = refusals.find(item => item.ordinal === ordinal - 1);
+        if (refusal && (refusal.turn_id !== turnId || refusal.session_id !== input.sessionId || refusal.policy !== CAPACITY_POLICY))
+            conflict("Failure ordinal identifies a different native Turn");
+        if (refusal) {
+            const expected = refusalObservation(failure, ordinal - 1, refusal.first_observed_at);
+            if (refusal.native_terminal_at !== expected.native_terminal_at || refusal.native_terminal_basis !== expected.native_terminal_basis)
+                conflict("Retained refusal time differs from its native receipt");
+        }
+        if (!refusal) {
+            if (refusals.some(item => item.turn_id === turnId))
+                conflict("A cached native Turn cannot be a second refusal");
+            // A cached legacy failure cannot be assigned a new time during reattach.
+            if (ordinal > 1 && parsed.ordinal > 0 && !native.observed_at)
+                conflict("Retained continuation has no original failure time");
+            const observedAt = typeof native.observed_at === "string" && Number.isFinite(Date.parse(native.observed_at)) ? native.observed_at : new Date().toISOString();
+            refusal = refusalObservation(failure, ordinal - 1, observedAt);
+            input.retainFailure?.(operationId, refusal);
+            refusals.push(refusal);
+        }
+        const burst = overloadBurst(refusals);
+        if (burst)
+            throw new AppError("provider_overload_burst", "Two consecutive continuation Turns were overloaded within two minutes", 1, { ...burst, root_operation_id: rootId, provider_session_id: input.sessionId, continuation_count: ordinal - 1, primary_error: failure });
         const nextId = `${rootId}:capacity:${ordinal}:session.prompt`;
         const existing = history.find(item => item.operation_id === nextId);
         if (existing && (existing.predecessor !== operationId || existing.turn_id !== turnId || existing.prompt_sha256 !== promptSha || existing.ordinal !== ordinal))
             throw error;
         const wait = existing ? Math.max(0, Date.parse(existing.not_before) - Date.now()) : capacityDelay(failure, ordinal);
-        if (!Number.isFinite(wait) || wait > 30_000 || input.deadline !== undefined && Date.now() + wait >= input.deadline)
-            throw error;
-        if (!existing)
-            input.retainIntent({ predecessor: operationId, operation_id: nextId, turn_id: turnId, ordinal, prompt_sha256: promptSha, not_before: new Date(Date.now() + wait).toISOString() });
-        await delay(wait, undefined, { signal: input.signal });
+        if (!Number.isFinite(wait) || Date.now() + wait > 8.64e15 || input.deadline !== undefined && Date.now() + wait >= input.deadline)
+            throw new AppError("capacity_owner_deadline_exceeded", "Continuation wait exceeds its original owner deadline", 1, { primary_error: failure, deadline: input.deadline ?? null });
+        if (!existing) {
+            const intent = { predecessor: operationId, operation_id: nextId, turn_id: turnId, ordinal, prompt_sha256: promptSha, not_before: new Date(Date.now() + wait).toISOString(), policy: CAPACITY_POLICY, root_operation_id: rootId, session_id: input.sessionId, deadline: input.deadline ?? null, refusal };
+            input.retainIntent(intent);
+            history.push(intent);
+        }
+        // Node timers truncate large delays. Bounded slices preserve cancellation
+        // and owner checks; monotonic elapsed time does not renew a Retry-After.
+        const until = performance.now() + wait;
+        while (performance.now() < until) {
+            await delay(Math.min(250, Math.max(0, until - performance.now())), undefined, { signal: input.signal });
+            const boundary = await decide();
+            if (boundary)
+                return boundary;
+        }
         const afterWait = await decide();
         if (afterWait)
             return afterWait;
-        if (!await settled().catch(() => false))
-            throw error;
+        if (!await settled())
+            throw new AppError("capacity_continuation_blocked", "Native predecessor settlement changed during capacity wait", 1, { primary_error: failure });
         const beforeDispatch = await decide();
         if (beforeDispatch)
             return beforeDispatch;
@@ -186,5 +288,4 @@ export async function continueCodexCapacity(input) {
             operationId = nextId;
         }
     }
-    throw error;
 }

package/dist/services/controller-fanout.js

@@ -138,6 +138,7 @@ export function controllerNativeChildren(receipt, rootSessionId) {
         const settled = rootChild && status === "unknown" && settledTree.has(id) ? "settled_by_root" : status;
         candidates.push({ session_id: id, parent_session_id: parent ?? "", status: settled, source, ...(rootChild ? {} : { provenance: "parent_mismatch" }),
             ...(text(value, ["terminal_turn_id"]) ? { terminal_turn_id: text(value, ["terminal_turn_id"]) } : {}),
+            ...(text(value, ["terminal_observed_at"]) ? { terminal_observed_at: text(value, ["terminal_observed_at"]) } : {}),
             ...(value.provider_error !== undefined ? { provider_error: value.provider_error } : {}),
             ...(value.native_turn_items && typeof value.native_turn_items === "object" ? { native_turn_items: value.native_turn_items } : {}) });
     };

package/dist/services/external-work-launch.js

@@ -112,6 +112,7 @@ export async function launchExternalWork(context, input) {
         fs.writeFileSync(promptFile, `Start the assigned Work now. Your first tool call must be this exact standalone command:\n\n${workStartCommand(runtimeContext, work)}\n\nUse the packet returned by that command. Do not claim another Work or run this command more than once.\n\n${lifecycleRetryInstruction}${isolatedWorkspace ? `\n\nThe review copy has no .git. Read the captured status/diff or gitless note in ${path.join(isolatedWorkspace, ".dd-flow", "review-evidence")}; do not run Git inside the copy.\n` : "\n"}`);
         const promptOperationId = `${operationId}:session.prompt`;
         const promptDeadline = Date.now() + 45 * 60_000;
+        context.db.run("UPDATE work_launches SET adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ? AND status = 'launching'", [JSON.stringify({ create: created, prompt_deadline: promptDeadline }), context.now(), operationId]);
         let prompted;
         try {
             prompted = await call(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60_000);
@@ -121,10 +122,18 @@ export async function launchExternalWork(context, input) {
                 throw error;
             const retained = context.db.get("SELECT adapter_receipt_json FROM work_launches WHERE operation_id = ?", [operationId]);
             const capacityIntents = retained?.adapter_receipt_json ? JSON.parse(retained.adapter_receipt_json).capacity_intents ?? [] : [];
+            const capacityFailures = retained?.adapter_receipt_json ? JSON.parse(retained.adapter_receipt_json).capacity_failures ?? [] : [];
+            const retainCapacity = () => {
+                const changed = context.db.run("UPDATE work_launches SET adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ? AND status = 'launching'", [JSON.stringify({ create: created, prompt_deadline: promptDeadline, capacity_intents: capacityIntents, capacity_failures: capacityFailures }), context.now(), operationId]);
+                if (changed.changes !== 1)
+                    throw new AppError("capacity_continuation_blocked", "External Work launch owner changed", 1);
+            };
             const resumed = await continueCodexCapacity({ error, sessionId, operationId: promptOperationId, allowSettledDescendants: true,
                 ...(input.signal ? { signal: input.signal } : {}), deadline: promptDeadline,
                 continuationText: `Continue only Work ${work.work_id} in RUN ${work.run_id}, Stage ${stage ?? "current"}, in the same Session. Inspect its current durable state and the retained Work packet. Never repeat Work start or a completed tool, accepted answer, check or lifecycle command. Use only the current exact issued successor and finish at the original Work boundary.`,
                 retainedIntents: () => capacityIntents,
+                retainedFailures: () => capacityFailures,
+                retainFailure: (_id, refusal) => { capacityFailures.push(refusal); retainCapacity(); },
                 inspectOperation: id => call(["daemon", "operation", "--state-dir", root, "--operation-id", id, "--json"], 30_000, `${id}:capacity-observe`),
                 inspectSession: turnId => call(["session", "inspect", "--session-id", sessionId, ...(turnId ? ["--turn-id", turnId] : []), ...common], 30_000, `${operationId}:capacity-inspect`),
                 assertCurrent: () => {
@@ -141,9 +150,7 @@ export async function launchExternalWork(context, input) {
                 },
                 retainIntent: intent => {
                     capacityIntents.push(intent);
-                    const changed = context.db.run("UPDATE work_launches SET adapter_receipt_json = ?, updated_at = ? WHERE operation_id = ? AND status = 'launching'", [JSON.stringify({ create: created, capacity_intent: intent, capacity_intents: capacityIntents }), context.now(), operationId]);
-                    if (changed.changes !== 1)
-                        throw new AppError("capacity_continuation_blocked", "External Work launch owner changed", 1);
+                    retainCapacity();
                 },
                 prompt: (id, text, ordinal) => {
                     const file = path.join(root, `capacity-${ordinal}.md`);

package/dist/services/harness-adapter.js

@@ -2,7 +2,8 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { AppError } from "../shared/errors.js";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { stopProcessGroup } from "../harness-runtime/lib/managed-daemon.mjs";
 import { recoveryRpcTimeout } from "./recovery-observation-budget.js";
 const maxAdapterOutputBytes = 1_000_000;
 /** Native hooks need a real executable, not a PATH-dependent shell expression. */
@@ -64,18 +65,26 @@ export function runHarnessAdapter(input) {
         let outputTooLarge = false;
         let timedOut = false;
         let aborted = false;
-        let killTimer;
+        let cleanup;
         let settled = false;
         let callbackError;
         let spawnError;
-        const terminate = (signal) => { try {
-            if (detached && child.pid)
-                process.kill(-child.pid, signal);
-            else
-                child.kill(signal);
-        }
-        catch { /* The process already settled. */ } };
-        const stopTransport = () => { terminate("SIGTERM"); killTimer ??= setTimeout(() => terminate("SIGKILL"), 5_000); };
+        const stopTransport = () => {
+            cleanup ??= stopProcessGroup(child, 5_000, { detached }).catch(error => {
+                if (timer)
+                    clearTimeout(timer);
+                if (heartbeat)
+                    clearInterval(heartbeat);
+                input.signal?.removeEventListener("abort", abort);
+                const details = { cleanup_error: errorRecord(error) };
+                if (callbackError instanceof Error) {
+                    Object.assign(callbackError, { cleanup_error: details.cleanup_error, details: { ...callbackError.details, ...details } });
+                    reject(callbackError);
+                }
+                else
+                    reject(new AppError(outputTooLarge ? "harness_adapter_output_limit" : timedOut ? "harness_adapter_timeout" : aborted ? "harness_adapter_aborted" : "harness_adapter_cleanup_unconfirmed", "Adapter transport cleanup could not be confirmed", 1, details));
+            });
+        };
         const deliver = (callback) => {
             try {
                 const result = callback();
@@ -109,7 +118,7 @@ export function runHarnessAdapter(input) {
         child.stdout.setEncoding("utf8").on("data", (chunk) => { stdout = append(stdout, chunk); });
         child.stderr.setEncoding("utf8").on("data", (chunk) => { stderr = append(stderr, chunk); });
         child.once("error", (error) => { spawnError = error; });
-        child.once("close", (status, signal) => {
+        child.once("close", async (status, signal) => {
             if (settled)
                 return;
             settled = true;
@@ -118,10 +127,7 @@ export function runHarnessAdapter(input) {
             input.signal?.removeEventListener("abort", abort);
             if (heartbeat)
                 clearInterval(heartbeat);
-            if (killTimer) {
-                clearTimeout(killTimer);
-                terminate("SIGKILL");
-            }
+            await cleanup;
             const progressFailure = callbackError;
             deliver(() => evidence({ status, signal, timed_out: timedOut, aborted, stdout, stderr, ...(spawnError ? { error: spawnError.message } : {}) }));
             if (spawnError)

package/dist/services/managed-processes.js

@@ -4,7 +4,7 @@ import path from "node:path";
 import { spawnSync } from "node:child_process";
 import net from "node:net";
 import { getResourceDatabase } from "../storage/database.js";
-import { AppError } from "../shared/errors.js";
+import { AppError, errorRecord } from "../shared/errors.js";
 export function managedProcessBinding(record, home) {
     return { resource_home: home, process_id: record.id, registration_sha256: crypto.createHash("sha256").update(JSON.stringify([home, record.id, record.kind, record.owner_id, record.lease_token, record.pid, record.pid_started_at, record.project_id, record.run_id, record.work_id, record.check_id, record.operation_id, record.metadata_json])).digest("hex") };
 }
@@ -339,14 +339,19 @@ export async function stopManagedProcess(context, input) {
         return record;
     db.run("UPDATE managed_processes SET state = 'stopping', updated_at = ? WHERE id = ? AND lease_token = ? AND state IN ('starting','running','orphaned')", [context.now(), record.id, record.lease_token]);
     if (processTreeIsAlive(record)) {
-        terminateOwnedProcess(record, "SIGTERM");
+        const signalErrors = [];
+        const termError = terminateOwnedProcess(record, "SIGTERM");
+        if (termError)
+            signalErrors.push(errorRecord(termError));
         await delay(graceMs);
-        if (input.force !== false && processTreeIsAlive(record)) {
-            terminateOwnedProcess(record, "SIGKILL");
+        if (!termError && input.force !== false && processTreeIsAlive(record)) {
+            const killError = terminateOwnedProcess(record, "SIGKILL");
+            if (killError)
+                signalErrors.push(errorRecord(killError));
             await delay(250);
         }
         if (processTreeIsAlive(record))
-            throw Object.assign(new Error("Owned process tree could not be safely stopped; resources retained"), { code: "process_tree_not_settled", details: { process_id: record.id } });
+            throw Object.assign(new Error("Owned process tree could not be safely stopped; resources retained"), { code: "process_tree_not_settled", details: { process_id: record.id, signal_errors: signalErrors } });
     }
     if (!finishManagedProcess(context, { id: record.id, leaseToken: record.lease_token, state: "stopped", reason: input.reason ?? "requested_stop" }))
         throw Object.assign(new Error("Managed process ownership changed before settlement"), { code: "process_lease_lost" });
@@ -460,7 +465,10 @@ function terminateOwnedProcess(record, signal) {
     try {
         process.kill(process.platform === "win32" || group !== record.pid ? record.pid : -group, signal);
     }
-    catch { /* inspect again below */ }
+    catch (error) {
+        if (error.code !== "ESRCH")
+            return Object.assign(error, { details: { process_id: record.id, pid: record.pid, pgid: group ?? null, signal, phase: "owned_process_stop" } });
+    }
 }
 function parseMetadata(value) { try {
     const parsed = JSON.parse(value);

package/dist/services/merge-server.js

@@ -106,7 +106,8 @@ async function dispatch(context, input) {
     const executable = resolveHarnessCommand(context.ddFlowHome, input.profile.harness, "adapter");
     const common = ["--dd-flow-bin", flowExecutable, "--state-dir", stateDir, "--journal", adapterJournal, "--cwd", input.request.target_workspace, "--provider", input.profile.provider, "--model", input.profile.model, "--reasoning", input.profile.reasoning, "--mode", input.profile.mode, "--permission", input.profile.permission, "--project-root", run.project_root, "--dd-flow-home", context.ddFlowHome, ...harnessRuntimeArguments(context.ddFlowHome, input.profile.harness), "--json"];
     const retained = { profile: input.profile, executable, owner: runtimeOwner, session_id: null, state_dir: stateDir, create_operation_id: `${input.request.merge_request_id}:${token}:session.create`, prompt_operation_id: `${input.request.merge_request_id}:${token}:session.prompt` };
-    const retain = () => { context.db.run("UPDATE merge_requests SET adapter_receipt_json = ?, updated_at = ? WHERE merge_request_id = ? AND dispatch_owner = ? AND dispatch_lease_token = ?", [JSON.stringify(retained), context.now(), input.request.merge_request_id, input.serverId, token]); };
+    const retain = () => { const changed = context.db.run("UPDATE merge_requests SET adapter_receipt_json = ?, updated_at = ? WHERE merge_request_id = ? AND dispatch_owner = ? AND dispatch_lease_token = ?", [JSON.stringify(retained), context.now(), input.request.merge_request_id, input.serverId, token]); if (changed.changes !== 1)
+        throw new AppError("capacity_continuation_blocked", "MERGE dispatch owner changed before durable receipt retention", 1); };
     retain();
     const leaseHeartbeat = setInterval(() => { if (guarded(context, input.request) || (recoveryGuard(context, input.request.project_id, input.request.run_id)?.generation ?? 0) !== generation)
         return; const now = context.now(); context.db.run("UPDATE merge_requests SET dispatch_lease_expires_at = ?, updated_at = ? WHERE merge_request_id = ? AND status IN ('dispatching','active') AND dispatch_owner = ? AND dispatch_lease_token = ?", [new Date(Date.now() + 120_000).toISOString(), now, input.request.merge_request_id, input.serverId, token]); }, 30_000);
@@ -125,6 +126,8 @@ async function dispatch(context, input) {
         fs.writeFileSync(promptFile, `Start the assigned MERGE stage now. Your first tool call must be this exact standalone command:\n\n${stageCommand}\n\nTrust and follow the complete stage packet it returns. Continue through merge apply and stage finish. Stop only when the stage reaches a terminal result or explicitly requests user/operator action.\n\n${stageLifecycleInstruction}\n`);
         let prompted;
         const promptDeadline = Date.now() + 45 * 60_000;
+        retained.prompt_deadline = promptDeadline;
+        retain();
         try {
             prompted = await adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], 45 * 60 * 1000, `MERGE ${input.request.merge_request_id} Session ${sessionId} is still running`);
         }
@@ -132,10 +135,13 @@ async function dispatch(context, input) {
             if (runtimeHarness(input.profile) !== "codex-desktop")
                 throw error;
             const capacityIntents = (retained.capacity_intents ?? []);
+            const capacityFailures = (retained.capacity_failures ?? []);
             const resumed = await continueCodexCapacity({ error, sessionId, operationId: String(retained.prompt_operation_id), allowSettledDescendants: true,
                 deadline: promptDeadline,
                 continuationText: `Continue only MERGE ${input.request.merge_request_id}, Work ${input.request.executor_work_id}, RUN ${input.request.run_id} in this same Session and target ${input.request.target_workspace}. First inspect current durable Stage/Work/MERGE receipts. Never repeat Stage start, accepted answer, completed apply or checks. Follow only the current exact issued successor and stop at the original boundary.`,
                 retainedIntents: () => capacityIntents,
+                retainedFailures: () => capacityFailures,
+                retainFailure: (_id, refusal) => { capacityFailures.push(refusal); retained.capacity_failures = capacityFailures; retain(); },
                 inspectOperation: id => adapterCall(["daemon", "operation", "--state-dir", stateDir, "--operation-id", id, "--json"], 30_000, undefined, `${id}:capacity-observe`),
                 inspectSession: turnId => adapterCall(["session", "inspect", "--session-id", sessionId, ...(turnId ? ["--turn-id", turnId] : []), ...common], 30_000, undefined, `${input.request.merge_request_id}:${token}:capacity-inspect`),
                 assertCurrent: () => {
@@ -163,7 +169,7 @@ async function dispatch(context, input) {
                     }
                     else
                         fs.writeFileSync(file, text, { flag: "wx", mode: 0o600 });
-                    return adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", file, ...common], Math.max(1, promptDeadline - Date.now()), `MERGE ${input.request.merge_request_id} Session ${sessionId} capacity continuation ${ordinal}/2`, id);
+                    return adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", file, ...common], Math.max(1, promptDeadline - Date.now()), `MERGE ${input.request.merge_request_id} Session ${sessionId} capacity continuation ${ordinal}`, id);
                 } });
             if (!resumed)
                 throw error;
@@ -210,6 +216,6 @@ function processAlive(pid) { if (!pid)
     process.kill(pid, 0);
     return true;
 }
-catch {
-    return false;
+catch (error) {
+    return error.code !== "ESRCH";
 } }

package/dist/services/review-deferral.js

@@ -0,0 +1,23 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { AppError } from "../shared/errors.js";
+import { assertPortableArtifactRef } from "./portable-refs.js";
+/** A deferral names one project-local file, never an arbitrary path. */
+export function reviewDefEvidence(workspaceRoot, defId) {
+    try {
+        if (!defId || !/^DEF-[A-Za-z0-9][A-Za-z0-9_-]*$/.test(defId))
+            throw new Error("invalid DEF identifier");
+        const relative = `.memory-bank/defs/${defId}.md`;
+        const file = assertPortableArtifactRef(relative, { workspaceRoot, runHome: workspaceRoot, runId: "" });
+        const directory = fs.realpathSync(path.join(workspaceRoot, ".memory-bank", "defs"));
+        const root = fs.realpathSync(workspaceRoot);
+        const directoryRelative = path.relative(root, directory);
+        if (directoryRelative === ".." || directoryRelative.startsWith(`..${path.sep}`) || path.isAbsolute(directoryRelative) || path.dirname(file) !== directory || !fs.statSync(file).isFile())
+            throw new Error("DEF must be a regular file in the project defs directory");
+        return { def_id: defId, path: relative, sha256: crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex") };
+    }
+    catch (error) {
+        throw new AppError("deferral_invalid", "A deferral requires a readable project-local named DEF", 2, { def_id: defId ?? null, cause: error instanceof Error ? error.message : String(error) });
+    }
+}

package/dist/services/run-controller-adapter.js

@@ -5,6 +5,7 @@ import { AppError } from "../shared/errors.js";
 import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { appendEvent, digest, digestBytes, errorRecord } from "./run-controller-state.js";
+import { CAPACITY_POLICY, parseCapacityOperation } from "../harness-runtime/lib/codex-capacity-policy.mjs";
 /** A paused RUN admits only its controller's exact accepted answer Turn. */
 export function controllerHitlAdmission(context, record, input) {
     if (input.operation !== "session.prompt" || !input.operationId || !input.promptSha256)
@@ -15,13 +16,13 @@ export function controllerHitlAdmission(context, record, input) {
     if (!row || row.generation !== JSON.parse(record.metadata_json).run_generation)
         return false;
     const suffix = `:prompt:${row.generation}`;
-    const successor = /^(.*):capacity:([12]):session\.prompt$/.exec(input.operationId);
-    const baseId = successor ? successor[1] : input.operationId;
+    const successor = parseCapacityOperation(input.operationId);
+    const baseId = successor.root;
     if (!baseId.endsWith(suffix))
         return false;
-    if (successor) {
-        const ordinal = Number(successor[2]);
-        const predecessorId = ordinal === 1 ? baseId : `${baseId}:capacity:1:session.prompt`;
+    if (successor.ordinal > 0) {
+        const ordinal = successor.ordinal;
+        const predecessorId = ordinal === 1 ? baseId : `${baseId}:capacity:${ordinal - 1}:session.prompt`;
         const predecessor = context.db.get("SELECT status, receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [predecessorId, row.controller_id, row.generation]);
         if (predecessor?.status !== "failed" || !predecessor.receipt_json)
             return false;
@@ -34,6 +35,8 @@ export function controllerHitlAdmission(context, record, input) {
         }
         if (retained.capacity_intent?.predecessor !== predecessorId || retained.capacity_intent.operation_id !== input.operationId || retained.capacity_intent.ordinal !== ordinal)
             return false;
+        if (retained.capacity_intent.policy !== CAPACITY_POLICY)
+            return false;
         if (!retained.capacity_intent.not_before || !Number.isFinite(Date.parse(retained.capacity_intent.not_before)) || Date.parse(retained.capacity_intent.not_before) > Date.parse(context.now()) || retained.capacity_intent.prompt_sha256 !== input.promptSha256)
             return false;
     }

package/dist/services/run-controller-recovery.js

@@ -221,6 +221,23 @@ export async function resumeControllerSession(context, row, manifest, state, ass
                 const binding = context.db.get("SELECT runtime_dispatch_json FROM run_recovery_bindings WHERE recovery_id = ?", [recovery.recovery_id]);
                 return binding?.runtime_dispatch_json ? JSON.parse(binding.runtime_dispatch_json).capacity_intents ?? [] : [];
             },
+            retainedFailures: () => {
+                const binding = context.db.get("SELECT runtime_dispatch_json FROM run_recovery_bindings WHERE recovery_id = ?", [recovery.recovery_id]);
+                return binding?.runtime_dispatch_json ? JSON.parse(binding.runtime_dispatch_json).capacity_failures ?? [] : [];
+            },
+            retainFailure: (_id, refusal) => {
+                assertRecoveryOwner();
+                context.db.writeTransaction(() => {
+                    const binding = context.db.get("SELECT runtime_dispatch_json FROM run_recovery_bindings WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared'", [recovery.recovery_id, daemonId]);
+                    if (!binding)
+                        throw new AppError("recovery_capacity_owner_changed", "Recovery binding changed before refusal retention", 1);
+                    const retained = JSON.parse(binding.runtime_dispatch_json);
+                    retained.capacity_failures = [...(retained.capacity_failures ?? []), refusal];
+                    const changed = context.db.run("UPDATE run_recovery_bindings SET runtime_dispatch_json = ? WHERE recovery_id = ? AND daemon_id = ? AND status = 'prepared' AND runtime_dispatch_json = ?", [JSON.stringify(retained), recovery.recovery_id, daemonId, binding.runtime_dispatch_json]);
+                    if (changed.changes !== 1)
+                        throw new AppError("recovery_capacity_owner_changed", "Recovery binding changed during refusal retention", 1);
+                });
+            },
             inspectOperation: id => inspect(["daemon", "operation", "--state-dir", session.state_dir, "--operation-id", id, "--json"], `${id}:capacity-observe`),
             inspectSession: turnId => inspect(["session", "inspect", "--session-id", session.id, ...(turnId ? ["--turn-id", turnId] : []), ...sessionArguments(context, manifest, session)], `${dispatch.operation_id}:capacity-inspect`),
             assertCurrent: () => {