@deksden-com/dd-flow-cli 0.9.0-beta.123 → 0.9.0-beta.127

package/dist/services/codex-capacity.js

@@ -1,16 +1,85 @@
 import { setTimeout as delay } from "node:timers/promises";
 import crypto from "node:crypto";
-import { terminalCodexOverload } from "../harness-runtime/lib/dd-codex.mjs";
+import { CAPACITY_POLICY, capacityBackoff, nativeItemsSettled, normalizeCodexFailure, overloadBurst, parseCapacityOperation, refusalObservation, terminalCodexOverload } from "../harness-runtime/lib/codex-capacity-policy.mjs";
 import { AppError } from "../shared/errors.js";
+import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
+export function eligibleCodexChildOverload(child, parentSessionId) {
+    return typeof child.session_id === "string" && child.session_id !== parentSessionId && child.parent_session_id === parentSessionId && child.provenance !== "parent_mismatch" && child.status === "failed" && typeof child.terminal_turn_id === "string" && nativeItemsSettled(child.native_turn_items)
+        && terminalCodexOverload({ code: "turn_interrupted", details: { provider_session_id: child.session_id, turn_id: child.terminal_turn_id, native_turn_id: child.terminal_turn_id, terminal_status: "failed", provider_error: child.provider_error } }, child.session_id, child.terminal_turn_id);
+}
+/** A terminal root is not a settled tree. Only the daemon's exact owned tree
+ * with a settled root and positively live descendants permits waiting. */
+export function capacityReadiness(seen, sessionId, operationId, turnId, items, allowDescendants = false) {
+    if (seen.provider_session_id !== sessionId || seen.terminal_turn_id !== undefined && seen.terminal_turn_id !== turnId || !nativeItemsSettled(items))
+        return "unproven";
+    const ids = Array.isArray(seen.tree_session_ids) ? seen.tree_session_ids : [];
+    if (!ids.length || ids[0] !== sessionId || ids.some(id => typeof id !== "string" || !id) || new Set(ids).size !== ids.length)
+        return "unproven";
+    const observations = Array.isArray(seen.tree_observations) ? seen.tree_observations : [];
+    const exactTree = observations.length === ids.length && ids.every(id => observations.filter(item => item.provider_session_id === id).length === 1);
+    const settlement = seen.settlement;
+    const budgetSettled = !settlement || settlement.state === "not_required" || settlement.state === "settled" && settlement.operation_ids?.includes(operationId) === true;
+    const treeSettled = allowDescendants ? exactTree && observations.every(item => item.settled === true) && Array.isArray(seen.unsettled_sessions) && seen.unsettled_sessions.length === 0 : ids.length === 1;
+    if (seen.settled === true && treeSettled && budgetSettled)
+        return "ready";
+    if (!allowDescendants || seen.settled !== false || !exactTree || ids.length < 2 || observations[0]?.provider_session_id !== sessionId || observations[0].settled !== true
+        || settlement && settlement.state !== "not_required" && !(settlement.state === "pending" && settlement.reason === "tree_unsettled"))
+        return "unproven";
+    const live = observations.filter(item => item.settled === false);
+    const unsettled = seen.unsettled_sessions;
+    const knownLive = live.length > 0 && live.every(item => item.provider_session_id !== sessionId && ["active", "running", "inProgress"].includes(String(typeof item.status === "object" && item.status ? item.status.type : item.status)));
+    return knownLive && observations.every(item => typeof item.settled === "boolean") && Array.isArray(unsettled) && unsettled.length === live.length && live.every(item => unsettled.includes(item.provider_session_id)) ? "owned_children_live" : "unproven";
+}
 /** Permit acquisition must still belong to the original task, not merely an
  * open RUN. Controls/inspection and ordinary successor prompts are unaffected. */
-export function assertCapacityOwnerAdmission(context, record, operationId) {
+export function assertCapacityOwnerAdmission(context, record, operationId, binding) {
     if (!operationId || !record.project_id || !record.run_id)
         return;
-    const root = operationId.replace(/:capacity:[12]:session\.prompt$/, "");
-    if (root === operationId && !/:child:[a-f0-9]+:followup:[12]$/.test(root))
+    const root = parseCapacityOperation(operationId).root;
+    const childOrdinal = /:child:[a-f0-9]+:followup:(\d+)$/.exec(root)?.[1];
+    if (childOrdinal && (!Number.isSafeInteger(Number(childOrdinal)) || Number(childOrdinal) < 1 || String(Number(childOrdinal)) !== childOrdinal))
+        throw new AppError("capacity_continuation_conflict", "Invalid native child continuation ordinal", 1);
+    if (root === operationId && !childOrdinal)
         return;
     const reject = () => { throw new AppError("capacity_owner_boundary_changed", "Queued continuation no longer belongs to an unfinished task; reconcile its durable state", 1, { operation_id: operationId, work_id: record.work_id, run_id: record.run_id }); };
+    const metadata = JSON.parse(record.metadata_json);
+    const hasTable = (name) => Boolean(context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?", [name]));
+    const parsed = parseCapacityOperation(operationId);
+    if (parsed.ordinal > 0 && !["judge", "probe"].includes(metadata.role ?? "")) {
+        if (!binding?.nativeSessionId || !binding.promptSha256)
+            reject();
+        let intent;
+        const predecessor = parsed.ordinal === 1 ? root : `${root}:capacity:${parsed.ordinal - 1}:session.prompt`;
+        if (hasTable("run_controller_operations")) {
+            const saved = context.db.get("SELECT receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'failed'", [predecessor, record.owner_id, metadata.run_generation ?? 0]);
+            if (saved)
+                intent = JSON.parse(saved.receipt_json).capacity_intent;
+        }
+        if (!intent && record.work_id)
+            for (const table of ["work_launches", "merge_requests"]) {
+                if (!hasTable(table))
+                    continue;
+                const rows = table === "work_launches"
+                    ? context.db.all("SELECT l.adapter_receipt_json FROM work_launches l JOIN works w ON w.work_id = l.work_id WHERE l.work_id = ? AND w.project_id = ? AND w.run_id = ?", [record.work_id, record.project_id, record.run_id])
+                    : context.db.all("SELECT adapter_receipt_json FROM merge_requests WHERE executor_work_id = ? AND project_id = ? AND run_id = ?", [record.work_id, record.project_id, record.run_id]);
+                for (const saved of rows) {
+                    const retained = JSON.parse(saved.adapter_receipt_json ?? "null");
+                    intent = retained?.capacity_intents?.find((item) => item.operation_id === operationId);
+                    if (intent)
+                        break;
+                }
+                if (intent)
+                    break;
+            }
+        if (!intent || intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== root || intent.ordinal !== parsed.ordinal
+            || intent.predecessor !== predecessor || intent.operation_id !== operationId || intent.refusal?.turn_id !== intent.turn_id
+            || intent.refusal?.ordinal !== parsed.ordinal - 1 || intent.refusal?.session_id !== intent.session_id
+            || !Number.isFinite(Date.parse(intent.not_before)) || Date.parse(intent.not_before) > Date.parse(context.now())
+            || intent.deadline !== null && (typeof intent.deadline !== "number" || intent.deadline <= Date.parse(context.now()))
+            || binding?.nativeSessionId !== undefined && intent.session_id !== binding.nativeSessionId
+            || binding?.promptSha256 !== undefined && intent.prompt_sha256 !== binding.promptSha256)
+            reject();
+    }
     if (context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'run_recovery_bindings'")) {
         if (context.db.get("SELECT 1 FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND g.run_id = ? AND g.status = 'recovered' AND b.status = 'accepted' AND json_extract(b.runtime_dispatch_json, '$.operation_id') = ?", [record.project_id, record.run_id, root]))
             reject();
@@ -22,7 +91,7 @@ export function assertCapacityOwnerAdmission(context, record, operationId) {
             reject();
         // MERGE owns the Stage/request boundary: finishing its Work does not
         // necessarily commit stage finish yet. External workers own only Work.
-        const mergeOwner = JSON.parse(record.metadata_json).role === "merge";
+        const mergeOwner = metadata.role === "merge";
         if (!work || !(merge && mergeOwner ? ["created", "running", "completed"] : ["created", "running"]).includes(work.status))
             reject();
     }
@@ -37,70 +106,140 @@ export function assertCapacityOwnerAdmission(context, record, operationId) {
     if (state.stage && (index.current_stage && index.current_stage !== state.stage || index.stage_runs?.some(stage => stage.stage === state.stage && ["done", "skipped"].includes(stage.status))))
         reject();
     const child = Object.entries(state.child_capacity ?? {}).find(([, intent]) => intent.operation_id === root)?.[0];
+    if (childOrdinal && !child)
+        reject();
     if (child && context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id JOIN sessions s ON s.session_id = ws.session_id WHERE w.project_id = ? AND w.run_id = ? AND s.provider_session_id = ? AND w.status <> 'running'", [record.project_id, record.run_id, child]))
         reject();
 }
 export function capacityDelay(error, ordinal, now = Date.now()) {
-    const native = error?.details?.provider_error;
-    const headers = native?.headers;
-    const header = headers && Object.entries(headers).find(([key]) => key.toLowerCase() === "retry-after")?.[1];
-    const value = header ?? native?.retryAfter ?? native?.retry_after;
-    const seconds = typeof value === "number" || typeof value === "string" && /^\d+(\.\d+)?$/.test(value.trim()) ? Number(value) * 1000 : typeof value === "string" ? Date.parse(value) - now : NaN;
-    return Math.max(ordinal === 1 ? 5_000 : 15_000, Number.isFinite(seconds) ? Math.max(0, seconds) : 0);
+    return capacityBackoff(error, ordinal, now);
 }
 /** Continue a confirmed terminal Turn, never replay its completed effects. */
 export async function continueCodexCapacity(input) {
     let { error, operationId } = input;
-    const history = input.retainedIntents?.() ?? [];
-    const rootId = input.operationId.replace(/:capacity:[12]:session\.prompt$/, "");
+    const history = [...(input.retainedIntents?.() ?? [])];
+    const parsed = parseCapacityOperation(input.operationId);
+    const rootId = parsed.root;
     const text = input.continuationText ?? "Continue the same assigned task in this Session. Check current durable RUN, Work and Stage state first. Never repeat an observed lifecycle command, accepted HITL answer, check or merge apply; use only an exact issued successor. Stop at the assigned boundary.";
     const promptSha = crypto.createHash("sha256").update(text).digest("hex");
-    let ordinal = Number(/:capacity:([12]):session\.prompt$/.exec(operationId)?.[1] ?? 0) + 1;
+    let ordinal = parsed.ordinal + 1;
+    const conflict = (message) => { throw new AppError("capacity_continuation_conflict", message, 1, { operation_id: operationId, root_operation_id: rootId, session_id: input.sessionId }); };
+    const blocked = (message) => new AppError("capacity_continuation_blocked", message, 1, { capacity_uncertainty: true, operation_id: operationId, root_operation_id: rootId, provider_session_id: input.sessionId, primary_error: error });
+    const observe = async (action, observedOperationId = operationId) => {
+        try {
+            return await action();
+        }
+        catch (cause) {
+            let primary = cause;
+            for (let depth = 0; depth < 4 && primary?.code === "harness_adapter_failed"; depth++)
+                primary = (primary.cause ?? primary.details?.cause);
+            if (isObservationLoss(primary))
+                throw new AppError("operation_observation_lost", "Capacity native observation was lost; do not cancel or resend", 1, { capacity_uncertainty: true, root_operation_id: rootId, operation_id: observedOperationId, provider_session_id: input.sessionId, predecessor_error: error, cause });
+            throw cause;
+        }
+    };
+    const refusals = [...(input.retainedFailures?.() ?? [])];
+    if (parsed.ordinal > history.length)
+        conflict("Continuation has no complete retained predecessor chain");
+    for (let index = 0; index < history.length; index++) {
+        const intent = history[index];
+        const expected = index + 1;
+        if (intent.ordinal !== expected || intent.operation_id !== `${rootId}:capacity:${expected}:session.prompt`
+            || intent.predecessor !== (expected === 1 ? rootId : `${rootId}:capacity:${expected - 1}:session.prompt`)
+            || intent.prompt_sha256 !== promptSha || intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== rootId || intent.session_id !== input.sessionId
+            || intent.deadline !== (input.deadline ?? null) || !intent.refusal || intent.refusal.ordinal !== expected - 1 || intent.refusal.turn_id !== intent.turn_id
+            || !Number.isFinite(Date.parse(intent.not_before)))
+            conflict("Retained capacity chain is incomplete or belongs to another policy/task");
+        const previous = refusals.find(item => item.ordinal === intent.refusal.ordinal);
+        if (previous && JSON.stringify(previous) !== JSON.stringify(intent.refusal))
+            conflict("Retained failure observation changed");
+        if (!previous)
+            refusals.push(intent.refusal);
+    }
+    refusals.sort((a, b) => a.ordinal - b.ordinal);
+    for (let index = 0; index < refusals.length; index++) {
+        const refusal = refusals[index];
+        if (refusal.ordinal !== index || refusal.policy !== CAPACITY_POLICY || refusal.session_id !== input.sessionId || !refusal.turn_id
+            || refusals.slice(0, index).some(item => item.turn_id === refusal.turn_id) || !Number.isFinite(Date.parse(refusal.first_observed_at)))
+            conflict("Retained refusal chain is invalid");
+    }
     // Reconcile a retained dispatch before preparing another. Native absence is
     // the only safe way to reuse a prepared intent; a lost reply is not absence.
     for (const intent of history) {
-        if (intent.predecessor !== operationId || intent.ordinal !== ordinal || intent.operation_id !== `${rootId}:capacity:${ordinal}:session.prompt`)
+        if (intent.ordinal < ordinal)
             continue;
+        if (intent.predecessor !== operationId || intent.ordinal !== ordinal || intent.operation_id !== `${rootId}:capacity:${ordinal}:session.prompt`)
+            conflict("Retained successor skips its predecessor");
         if (intent.prompt_sha256 !== promptSha || !intent.turn_id || !Number.isFinite(Date.parse(intent.not_before)))
             throw error;
         let observed;
         try {
-            observed = await input.inspectOperation(intent.operation_id);
+            observed = await observe(() => input.inspectOperation(intent.operation_id), intent.operation_id);
         }
         catch (cause) {
             let code = cause;
             for (let depth = 0; depth < 4 && code?.code === "harness_adapter_failed"; depth++)
                 code = code.details?.cause;
             if (code?.code !== "operation_not_found")
-                throw error;
+                throw cause;
             break;
         }
-        if (observed.operation_id !== intent.operation_id || observed.session_id !== input.sessionId || observed.operation !== "session.prompt" || observed.primary_error)
-            throw error;
+        if (observed.operation_id !== intent.operation_id || observed.session_id !== input.sessionId || observed.operation !== "session.prompt")
+            conflict("Retained native successor identity changed");
+        if (observed.primary_error)
+            throw observed.primary_error;
+        while (["prepared", "dispatching", "running", "awaiting_provider", "outcome_unknown"].includes(String(observed.state))) {
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            const boundary = await observe(async () => await input.decision?.() ?? "continue", intent.operation_id);
+            if (boundary === "completed" || boundary === "paused")
+                return { provider_session_id: input.sessionId, capacity_decision: boundary };
+            if (boundary === "reconciliation_blocked")
+                throw new AppError("capacity_continuation_blocked", "Retained native successor has an unresolved owner boundary", 1, { operation_id: intent.operation_id, primary_error: error });
+            if (input.deadline !== undefined && Date.now() >= input.deadline)
+                throw new AppError("capacity_owner_deadline_exceeded", "Retained successor exhausted its original deadline", 1);
+            await delay(250, undefined, { signal: input.signal });
+            observed = await observe(() => input.inspectOperation(intent.operation_id), intent.operation_id);
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            if (observed.operation_id !== intent.operation_id || observed.session_id !== input.sessionId || observed.operation !== "session.prompt")
+                conflict("Retained native successor identity changed");
+            if (observed.primary_error)
+                throw observed.primary_error;
+        }
         if (observed.state === "completed" && observed.result && typeof observed.result === "object") {
             input.signal?.throwIfAborted();
             input.assertCurrent();
-            return observed.result;
+            const boundary = await observe(async () => await input.decision?.() ?? "continue", intent.operation_id);
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            if (boundary === "reconciliation_blocked")
+                throw new AppError("capacity_continuation_blocked", "Retained completion cannot be reconciled with its owner boundary", 1);
+            return boundary === "paused" || boundary === "completed" ? { provider_session_id: input.sessionId, capacity_decision: boundary } : observed.result;
         }
+        if (observed.state === "failed" && observed.error && !terminalCodexOverload(observed.error, input.sessionId))
+            throw observed.error;
         if (observed.state !== "failed" || !terminalCodexOverload(observed.error, input.sessionId))
-            throw error;
+            throw new AppError("operation_observation_lost", "Retained successor outcome is not proven; do not resend", 1, { operation_id: intent.operation_id, primary_error: error, observed });
         operationId = intent.operation_id;
         error = observed.error;
         ordinal += 1;
     }
-    const decide = async () => {
+    const decide = async (observedOperationId = operationId) => {
         input.signal?.throwIfAborted();
         input.assertCurrent();
-        const decision = await input.decision?.() ?? "continue";
+        const decision = await observe(async () => await input.decision?.() ?? "continue", observedOperationId);
         input.signal?.throwIfAborted();
         input.assertCurrent();
         if (decision === "reconciliation_blocked")
-            throw error;
+            throw new AppError("capacity_continuation_blocked", "Native refusal cannot be reconciled with its durable owner boundary", 1, { primary_error: error, root_operation_id: rootId, provider_session_id: input.sessionId });
         if (decision === "continue" && input.deadline !== undefined && Date.now() >= input.deadline)
-            throw error;
+            throw new AppError("capacity_owner_deadline_exceeded", "Continuation exhausted its original owner deadline", 1, { primary_error: error, deadline: input.deadline, root_operation_id: rootId, provider_session_id: input.sessionId });
         return decision === "continue" ? null : { provider_session_id: input.sessionId, capacity_decision: decision };
     };
-    for (; ordinal <= 2; ordinal += 1) {
+    for (;; ordinal += 1) {
+        if (!Number.isSafeInteger(ordinal))
+            conflict("Continuation ordinal overflow");
         if (!terminalCodexOverload(error, input.sessionId)) {
             if (ordinal === 1)
                 return null;
@@ -109,82 +248,120 @@ export async function continueCodexCapacity(input) {
         const completed = await decide();
         if (completed)
             return completed;
-        let prior;
-        try {
-            prior = await input.inspectOperation(operationId);
-        }
-        catch {
-            if (ordinal === 1)
-                return null;
-            throw error;
-        }
+        const prior = await observe(() => input.inspectOperation(operationId));
         const failure = prior.error;
-        const turnId = failure?.details?.turn_id;
+        const confirmed = normalizeCodexFailure(failure, input.sessionId);
+        const turnId = confirmed?.turn_id;
+        input.signal?.throwIfAborted();
+        input.assertCurrent();
+        if (prior.primary_error)
+            throw prior.primary_error;
         if (prior.operation_id !== operationId || prior.operation !== "session.prompt" || prior.session_id !== input.sessionId
             || prior.state !== "failed" || prior.primary_error || !turnId || !terminalCodexOverload(failure, input.sessionId, turnId)) {
-            if (ordinal === 1)
-                return null;
-            throw error;
+            throw blocked("Retained predecessor does not prove the exact terminal overloaded Turn");
         }
-        const settled = async () => {
-            const seen = await input.inspectSession(turnId);
-            const items = seen.terminal_turn_id === turnId && seen.terminal_status === "failed" ? seen.native_turn_items : failure.details?.native_turn_items;
-            if (items?.observed !== true || typeof items.possible_effects !== "boolean" || items.pending === true || items.possible_effects === true && items.pending !== false)
-                return false;
-            const settlement = seen.settlement;
-            const ids = Array.isArray(seen.tree_session_ids) ? seen.tree_session_ids : [];
-            const observations = Array.isArray(seen.tree_observations) ? seen.tree_observations : [];
-            const treeProven = input.allowSettledDescendants
-                ? ids.length > 0 && ids[0] === input.sessionId && observations.length === ids.length
-                    && ids.every(id => observations.some(item => item.provider_session_id === id && item.settled === true))
-                    && Array.isArray(seen.unsettled_sessions) && seen.unsettled_sessions.length === 0
-                : ids.length === 1 && ids[0] === input.sessionId;
-            return seen.provider_session_id === input.sessionId && seen.settled === true && treeProven
-                && (!settlement || settlement.state === "not_required" || settlement.state === "settled" && settlement.operation_ids?.includes(operationId) === true);
+        const readiness = async () => {
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            const seen = await observe(() => input.inspectSession(turnId));
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            const items = (seen.terminal_turn_id === turnId && seen.terminal_status === "failed" ? seen.native_turn_items : confirmed?.native_turn_items);
+            return capacityReadiness(seen, input.sessionId, operationId, turnId, items, input.allowSettledDescendants);
         };
-        try {
-            if (!await settled()) {
-                if (ordinal === 1)
-                    return null;
-                throw error;
-            }
+        const ready = await readiness();
+        if (ready === "unproven")
+            throw blocked("Native predecessor readiness is unproven; do not cancel or replay to manufacture proof");
+        const native = normalizeCodexFailure(failure, input.sessionId, turnId);
+        let refusal = refusals.find(item => item.ordinal === ordinal - 1);
+        if (refusal && (refusal.turn_id !== turnId || refusal.session_id !== input.sessionId || refusal.policy !== CAPACITY_POLICY))
+            conflict("Failure ordinal identifies a different native Turn");
+        if (refusal) {
+            const expected = refusalObservation(failure, ordinal - 1, refusal.first_observed_at);
+            if (refusal.native_terminal_at !== expected.native_terminal_at || refusal.native_terminal_basis !== expected.native_terminal_basis)
+                conflict("Retained refusal time differs from its native receipt");
         }
-        catch {
-            if (ordinal === 1)
-                return null;
-            throw error;
+        if (!refusal) {
+            if (refusals.some(item => item.turn_id === turnId))
+                conflict("A cached native Turn cannot be a second refusal");
+            // A cached legacy failure cannot be assigned a new time during reattach.
+            if (ordinal > 1 && parsed.ordinal > 0 && !native.observed_at)
+                conflict("Retained continuation has no original failure time");
+            const observedAt = typeof native.observed_at === "string" && Number.isFinite(Date.parse(native.observed_at)) ? native.observed_at : new Date().toISOString();
+            refusal = refusalObservation(failure, ordinal - 1, observedAt);
+            if (!input.atomicIntent)
+                input.retainFailure?.(operationId, refusal);
+            refusals.push(refusal);
+        }
+        const burst = overloadBurst(refusals);
+        if (burst) {
+            if (input.atomicIntent)
+                input.retainFailure?.(operationId, refusal);
+            throw new AppError("provider_overload_burst", "Two consecutive continuation Turns were overloaded within two minutes", 1, { ...burst, root_operation_id: rootId, provider_session_id: input.sessionId, continuation_count: ordinal - 1, primary_error: failure });
         }
         const nextId = `${rootId}:capacity:${ordinal}:session.prompt`;
         const existing = history.find(item => item.operation_id === nextId);
         if (existing && (existing.predecessor !== operationId || existing.turn_id !== turnId || existing.prompt_sha256 !== promptSha || existing.ordinal !== ordinal))
             throw error;
         const wait = existing ? Math.max(0, Date.parse(existing.not_before) - Date.now()) : capacityDelay(failure, ordinal);
-        if (!Number.isFinite(wait) || wait > 30_000 || input.deadline !== undefined && Date.now() + wait >= input.deadline)
-            throw error;
-        if (!existing)
-            input.retainIntent({ predecessor: operationId, operation_id: nextId, turn_id: turnId, ordinal, prompt_sha256: promptSha, not_before: new Date(Date.now() + wait).toISOString() });
-        await delay(wait, undefined, { signal: input.signal });
+        if (!Number.isFinite(wait) || Date.now() + wait > 8.64e15 || input.deadline !== undefined && Date.now() + wait >= input.deadline) {
+            if (input.atomicIntent)
+                input.retainFailure?.(operationId, refusal);
+            throw new AppError("capacity_owner_deadline_exceeded", "Continuation wait exceeds its original owner deadline", 1, { primary_error: failure, deadline: input.deadline ?? null });
+        }
+        if (!existing) {
+            const intent = { predecessor: operationId, operation_id: nextId, turn_id: turnId, ordinal, prompt_sha256: promptSha, not_before: new Date(Date.now() + wait).toISOString(), policy: CAPACITY_POLICY, root_operation_id: rootId, session_id: input.sessionId, deadline: input.deadline ?? null, refusal };
+            input.retainIntent(intent);
+            history.push(intent);
+        }
+        // Intent/refusal are durable before the first wait; no permit or writer is
+        // held here, and live siblings are never cancelled as a settlement proof.
+        const waitForOwnedChildren = async (initial) => {
+            let current = initial;
+            while (current === "owned_children_live") {
+                await delay(250, undefined, { signal: input.signal });
+                const boundary = await decide();
+                if (boundary)
+                    return boundary;
+                current = await readiness();
+            }
+            if (current !== "ready")
+                throw blocked("Owned native child readiness became unproven");
+            return null;
+        };
+        const childBoundary = await waitForOwnedChildren(ready);
+        if (childBoundary)
+            return childBoundary;
+        // Node timers truncate large delays. Bounded slices preserve cancellation
+        // and owner checks; monotonic elapsed time does not renew a Retry-After.
+        const until = performance.now() + Math.max(0, Date.parse(history.find(item => item.operation_id === nextId).not_before) - Date.now());
+        while (performance.now() < until) {
+            await delay(Math.min(250, Math.max(0, until - performance.now())), undefined, { signal: input.signal });
+            const boundary = await decide();
+            if (boundary)
+                return boundary;
+        }
         const afterWait = await decide();
         if (afterWait)
             return afterWait;
-        if (!await settled().catch(() => false))
-            throw error;
+        const refreshedBoundary = await waitForOwnedChildren(await readiness());
+        if (refreshedBoundary)
+            return refreshedBoundary;
         const beforeDispatch = await decide();
         if (beforeDispatch)
             return beforeDispatch;
         try {
-            return await input.prompt(nextId, text, ordinal);
+            return await observe(() => input.prompt(nextId, text, ordinal), nextId);
         }
         catch (nextError) {
             // A task can complete/pause while the daemon queues for its permit.
             // Admission then refuses the stale prompt; accept that owner decision
             // before treating the transport's rejection as another provider failure.
-            const finished = await decide();
+            const finished = await decide(nextId);
             if (finished)
                 return finished;
             error = nextError;
             operationId = nextId;
         }
     }
-    throw error;
 }

package/dist/services/codex-hook-delivery.js

@@ -5,8 +5,8 @@ import { commandOption, lifecycleCommandFromPayload, parseLifecycleCommand, cont
 /** The hook asks the existing daemon about native evidence; it cannot mint it. */
 export async function verifyCodexHookDelivery(env, payload) {
     const command = lifecycleCommandFromPayload(payload);
-    const parsed = command ? parseLifecycleCommand(command) : { kind: "none" };
-    if (parsed.kind === "none" && !parsed.unresolved && !(command && continuationCommand(command)))
+    const parsed = command ? parseLifecycleCommand(command) : { kind: "none", participation: "none" };
+    if (parsed.kind === "none" && !["lifecycle", "auxiliary"].includes(parsed.participation) && !(command && continuationCommand(command)))
         return undefined;
     const managed = (parsed.kind !== "none" && commandOption(parsed.invocation, "invocation-id")) || env.DD_FLOW_DAEMON_ID;
     if (!managed)

package/dist/services/compatibility-preflight.js

@@ -11,7 +11,10 @@ export function preflightCliCompatibility(context, args, env = process.env, reso
     if (!projectRoot) {
         return { ok: true, classification, compatibility: null };
     }
-    const selection = selectEngine(context, { projectRoot, env }, { allowCurrentInProcess: true }, classification);
+    // Compatibility checks the executing build/manifest identity. Routing and
+    // binding validate snapshot bytes before dispatch; maintenance must not
+    // rehash the dependency closure or spawn health probes on every lease ACK.
+    const selection = selectEngine(context, { projectRoot, env }, { allowCurrentInProcess: true, verifyCurrentContent: false }, classification);
     const compatibility = compatibilityReport(selection, classification);
     if (classification.mode === "read_only_diagnostics" || classification.mode === "mb_upgrade") {
         return { ok: true, classification, compatibility };

package/dist/services/controller-fanout.js

@@ -1,4 +1,5 @@
-import { AppError } from "../shared/errors.js";
+import { AppError, errorRecord } from "../shared/errors.js";
+import { normalizeNativeChildren } from "../harness-runtime/lib/native-children.mjs";
 import { getVnextFanoutStatus, observeVnextNativeChildren, reconcileVnextFanout, subagentCapacityKey } from "./vnext-fanout.js";
 import { getFlowRunVariables } from "./runs.js";
 import { dispatchVnextPlanReview } from "./vnext-plan-review.js";
@@ -57,7 +58,7 @@ export async function nextControllerFanout(context, input) {
         throw new AppError("stage_graph_compatibility_required", "The retained graph cannot be dispatched by this controller; use the RUN's pinned engine", 1, { stage: input.stage, run_id: input.runId, graph: fanout });
     if (children.length) {
         const reconciled = await reconcileVnextFanout(context, { ...input, observations });
-        const issues = reconciled.issues.filter(issue => issue.code !== "child_check_in_progress");
+        const issues = reconciled.issues.filter(issue => !["child_check_in_progress", "child_capacity_pending"].includes(issue.code));
         if (issues.length)
             throw new AppError("fanout_reconciliation_required", "Native child outcome requires reconciliation, not replay", 1, { issues });
         if (children.some(child => child.status === "running" || child.status === "unknown"))
@@ -106,80 +107,13 @@ export async function nextControllerFanout(context, input) {
         throw new AppError("fanout_graph_stalled", "Created Work has no ready or running dependency path", 1);
     return prompt("semantic_completion", semanticCompletionPrompt(input.stage, fanout.works.completed));
 }
-/** Normalize provider-observed topology only; never parse assistant prose. */
+/** Shared pinned runtime normalization; preserve structured errors at the TS boundary. */
 export function controllerNativeChildren(receipt, rootSessionId) {
-    const candidates = [];
-    const object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
-    const list = (value) => Array.isArray(value) ? value : [];
-    const text = (value, keys) => { for (const key of keys)
-        if (typeof value[key] === "string" && value[key])
-            return value[key]; return null; };
-    const settledTree = new Set(list(receipt.tree_observations)
-        .filter(value => object(value).settled === true)
-        .map(value => text(object(value), ["provider_session_id", "session_id"]))
-        .filter((id) => id !== null));
-    const add = (raw, source, scopedParent = null, fallback = "unknown") => {
-        const value = object(raw);
-        const id = text(value, ["provider_session_id", "session_id", "sessionId", "childSessionId", "conversation_id", "conversationId", "id", "subagentId"]);
-        const parent = text(value, ["parent_provider_session_id", "parent_session_id", "parentSessionId", "parentID", "parentId"]) ?? scopedParent;
-        if (!id)
-            return;
-        const outcomeError = object(value.outcome_error);
-        if (typeof outcomeError.code === "string")
-            throw new AppError(outcomeError.code, String(outcomeError.message ?? "Native child outcome is unconfirmed"), 1, { ...object(outcomeError.details), session_id: id, source });
-        const state = String(value.status ?? value.state ?? fallback).toLowerCase();
-        if (state === "lost")
-            throw new AppError("native_child_outcome_lost", "Native child ended without a recoverable outcome", 1, { session_id: id, parent_session_id: parent, source, native_status: state });
-        // Provider idle means no current activity, not a Work result. Only an
-        // explicit terminal result or a separately proven root settlement may be
-        // terminal here; unknown states stay unknown for reconciliation.
-        const status = ["completed", "complete", "done", "success", "succeeded"].includes(state) ? "completed" : state === "settled_by_root" ? "settled_by_root" : ["failed", "error"].includes(state) ? "failed" : ["cancelled", "canceled", "interrupted"].includes(state) ? "cancelled" : ["running", "active", "pending"].includes(state) ? "running" : fallback;
-        const rootChild = parent === rootSessionId;
-        const settled = rootChild && status === "unknown" && settledTree.has(id) ? "settled_by_root" : status;
-        candidates.push({ session_id: id, parent_session_id: parent ?? "", status: settled, source, ...(rootChild ? {} : { provenance: "parent_mismatch" }),
-            ...(text(value, ["terminal_turn_id"]) ? { terminal_turn_id: text(value, ["terminal_turn_id"]) } : {}),
-            ...(value.provider_error !== undefined ? { provider_error: value.provider_error } : {}),
-            ...(value.native_turn_items && typeof value.native_turn_items === "object" ? { native_turn_items: value.native_turn_items } : {}) });
-    };
-    for (const value of list(receipt.descendants))
-        add(value, "adapter.descendants");
-    for (const value of list(receipt.children))
-        add(value, "opencode.session.children");
-    const subagents = object(object(receipt.evidence).subagents ?? receipt.subagents);
-    for (const value of list(subagents.running))
-        add(value, "zcode/session/subagents", rootSessionId, "running");
-    for (const value of list(subagents.completed))
-        add(value, "zcode/session/subagents", rootSessionId, "completed");
-    for (const value of list(object(subagents.ended).items)) {
-        const status = String(object(value).status ?? "unknown");
-        if (!["success", "failed", "cancelled", "lost"].includes(status))
-            throw new AppError("native_child_outcome_unavailable", "ZCode ended child has no recognized native outcome", 1, { child: value });
-        add(value, "zcode/session/subagents", rootSessionId);
+    try {
+        return normalizeNativeChildren(receipt, rootSessionId);
     }
-    const unique = new Map();
-    const rank = { unknown: 0, running: 1, settled_by_root: 2, completed: 3, failed: 3, cancelled: 3 };
-    for (const child of candidates) {
-        const previous = unique.get(child.session_id);
-        if (previous && previous.parent_session_id !== child.parent_session_id) {
-            // Keep the contradictory parent visible to the existing provenance gate,
-            // independently of input order or which source happened to say success.
-            const foreign = [previous, child].filter(item => item.parent_session_id !== rootSessionId).sort((a, b) => a.parent_session_id.localeCompare(b.parent_session_id))[0];
-            unique.set(child.session_id, { ...foreign, provenance: "parent_mismatch" });
-            continue;
-        }
-        if (previous && rank[previous.status] === 3 && rank[child.status] === 3 && previous.status !== child.status)
-            throw new AppError("native_child_outcome_conflict", "Native child has contradictory terminal outcomes", 1, { session_id: child.session_id, observations: [previous, child] });
-        if (previous && previous.status === child.status && previous.terminal_turn_id && child.terminal_turn_id && previous.terminal_turn_id !== child.terminal_turn_id)
-            throw new AppError("native_child_turn_conflict", "Native child has contradictory terminal Turn identities", 1, { session_id: child.session_id, observations: [previous, child] });
-        if (previous && previous.status === child.status) {
-            unique.set(child.session_id, { ...previous, ...child,
-                ...(child.terminal_turn_id ?? previous.terminal_turn_id ? { terminal_turn_id: child.terminal_turn_id ?? previous.terminal_turn_id } : {}),
-                ...(child.provider_error ?? previous.provider_error ? { provider_error: child.provider_error ?? previous.provider_error } : {}),
-                ...(child.native_turn_items ?? previous.native_turn_items ? { native_turn_items: child.native_turn_items ?? previous.native_turn_items } : {}) });
-            continue;
-        }
-        if (!previous || rank[child.status] > rank[previous.status])
-            unique.set(child.session_id, child);
+    catch (error) {
+        const record = errorRecord(error);
+        throw Object.assign(new AppError(record.code, record.message, record.exitCode, record.details), record);
     }
-    return [...unique.values()].sort((left, right) => left.session_id.localeCompare(right.session_id));
 }