@deksden-com/dd-flow-cli 0.9.0-beta.138 → 0.9.0-beta.139

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.139
+
+### Patch Changes
+
+- Route each Stage from current RUN workspace authority, preserve known native
+  terminal outcomes independently of diagnostic reads, and retain exact owned
+  OpenCode hook identity failures. Fence automatic cleanup from active owners,
+  persist retirement observation budgets and causal errors, validate resource
+  homes before writes, and preserve maintenance effect/cleanup boundaries.
+  Use progress-observed fixture transport without losing native CLI exit codes.
+- dafdb20: Use a shared bounded provider-overload episode: two same-Session continuations,
+  5/15-second backoff with jitter, and explicit provider-unavailable exhaustion.
+  Normalize native capacity failures across adapters, retain restart-safe retry
+  budgets, and close child episodes only after confirmed successful native Turns.
+
 ## 0.9.0-beta.138
 
 - Retain causal native check failures and permit fenced source repair in the same Session. Reject malformed repair proofs and preserve physical execution blockers during reconciliation.

package/dist/build-info.json

@@ -1,15 +1,15 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.138",
-  "cli_commit": "c1a9786d04e0944daac204e1c767414904d9ced2",
-  "built_at": "2026-10-15T05:27:46.626Z",
+  "cli_version": "0.9.0-beta.139",
+  "cli_commit": "bf550ff8ffdc8ce96dac783d0cfb0000a3b83e74",
+  "built_at": "2026-10-17T07:23:43.465Z",
   "built_with_canon": {
     "version": "4.1.2",
     "commit": "1ddedf9d3f086e046f8e7b194c739ec386e7c8b9",
     "flow_contract": "dd-flow-canonical-2026-08",
-    "repo_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-memorybank-084-release",
-    "memorybank_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-memorybank-084-release/.memory-bank",
-    "flow_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-memorybank-084-release/.memory-bank/dd-flow",
+    "repo_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-cp231-release",
+    "memorybank_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-cp231-release/.memory-bank",
+    "flow_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-cp231-release/.memory-bank/dd-flow",
     "layout": "dot_memory_bank"
   }
 }

package/dist/cli/runtime-process.js

@@ -91,7 +91,7 @@ export async function dispatchRuntimeProcess(context, action, parsed, prepared =
         return { ...receipt, ok: receipt.owned };
     }
     if (action === "admission") {
-        const [{ controllerHitlAdmission }, { assertCapacityOwnerAdmission }] = await Promise.all([import("../services/run-controller-adapter.js"), import("../services/codex-capacity.js")]);
+        const [{ controllerHitlAdmission }, { assertCapacityOwnerAdmission }] = await Promise.all([import("../services/run-controller-adapter.js"), import("../services/provider-capacity.js")]);
         const record = managedProcessStatus(context).find(process => process.id === requiredOption(parsed, "id"));
         if (!record || record.lease_token !== requiredOption(parsed, "lease-token") || record.owner_id !== requiredOption(parsed, "owner") || record.state !== "running" || !record.pid || !record.pid_started_at || !processIsAlive(record))
             throw new AppError("process_ownership_unknown", "Productive dispatch requires its current confirmed runtime owner", 1);

package/dist/cli.js

@@ -44,7 +44,9 @@ if (args[0] === "flow" && ["list", "show"].includes(args[1] ?? "")) {
     process.exit(runFlowCatalogCli(args));
 }
 if (args[0] === "init" || args[0] === "flow" && args[1] === "mb-init") {
+    publishSetup('ingress_entered');
     const { runMemoryInitCli } = await import("./cli/memory-init.js");
+    publishSetup('imports_ready');
     process.exit(await runMemoryInitCli(args, process.env));
 }
 if (args.slice(0, 3).join(" ") === "runtime storage admit") {

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -4,7 +4,7 @@ import { callDaemonObserved } from './daemon-observation.mjs';
 import { operationProgressReporter } from './operation-progress.mjs';
 import { prepareDaemonRequest } from "./native-request-proof.mjs";
 import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mjs";
-import { errorRecord } from "./operation-errors.mjs";
+import { errorRecord, isProvenShellCorrection } from "./operation-errors.mjs";
 import { ToolObservations, agyToolObservation, agyTranscriptObservations } from "./tool-observations.mjs";
 import { constants } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -20,6 +20,7 @@ import { durableDaemonDispatch, completeDaemonShutdown, assertDaemonDispatch, as
 import path from "node:path";
 import { observeModel } from "./model-observations.mjs";
 import { AGY_VERSION_TIMEOUT_MS, AgyError, agyTerminalFailure, assertProfile, executable, observedProfile, runAgy, usageSnapshot } from "./dd-agy.mjs";
+import { settledNativeTree } from "./native-children.mjs";
 import { prepareRuntimeOwner, cleanupFailedStart, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 import { readNativeLines, streamNativeDiagnostics, nativeObservationError, admitNativeRequestBuffer } from "./native-streams.mjs";
 
@@ -341,7 +342,9 @@ export class Runtime {
       if (!this.init) this.startupError ??= agyTerminalFailure(event.result, event.terminal_metadata);
       this.receivedTerminalMetadata = event.terminal_metadata;
     }
-    this.observeProviderActivity(event); await this.journal("provider_event", { event }); if (event.event === "init") { this.init = { conversation_id: event.conversation_id, ...(event.init ?? {}) }; if (!this.init.conversation_id) throw new DaemonError("agy_init_missing", "Antigravity init has no conversation ID"); const requested = { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode, permission_mode: "always-proceed" }; this.profile = assertProfile(requested, observedProfile(this.init, requested)); await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: this.init.conversation_id, requested, observed: this.profile.observed, source: "native.init" }); await this.persist({ shutdown_state: "running", active_tree: false }); readyResolve(this.init); } else if (event.event === "step_update") this.observeStep(event.step_update ?? {}); else if (event.event === "result") { if (this.startupError) throw this.startupError; await this.finishTurn(event.result ?? {}); } } }
+    this.observeProviderActivity(event);
+    if (event.event === "result" && this.init && !this.startupError) { await this.finishTurn(event.result ?? {}, event.terminal_metadata, event); continue; }
+    await this.journal("provider_event", { event }); if (event.event === "init") { this.init = { conversation_id: event.conversation_id, ...(event.init ?? {}) }; if (!this.init.conversation_id) throw new DaemonError("agy_init_missing", "Antigravity init has no conversation ID"); const requested = { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode, permission_mode: "always-proceed" }; this.profile = assertProfile(requested, observedProfile(this.init, requested)); await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: this.init.conversation_id, requested, observed: this.profile.observed, source: "native.init" }); await this.persist({ shutdown_state: "running", active_tree: false }); readyResolve(this.init); } else if (event.event === "step_update") this.observeStep(event.step_update ?? {}); else if (event.event === "result") { if (this.startupError) throw this.startupError; await this.finishTurn(event.result ?? {}); } } }
   observeStep(step) {
     const sessionId = step.conversation_id ?? this.init?.conversation_id, observation = this.sessionObservations.get(sessionId) ?? {};
     const fresh = Number.isInteger(step.step_index) && step.step_index > (observation.last_step_index ?? -1) && step.step_index > (observation.step_floor ?? -1);
@@ -378,7 +381,7 @@ export class Runtime {
       }
     }
   }
-  async finishTurn(result, retainedMetadata = null) {
+  async finishTurn(result, retainedMetadata = null, providerEvent = null) {
     if (result.status === "RUNNING") { await this.persist({ active_tree: true }); return; }
     if (!["SUCCESS", "ERROR", "CANCELLED"].includes(result.status)) throw new DaemonError("agy_terminal_result_invalid", "Antigravity result has no recognized terminal status", false, { provider_result: result });
     if (result.conversation_id && result.conversation_id !== this.init?.conversation_id) {
@@ -391,40 +394,51 @@ export class Runtime {
       return;
     }
     const current = this.active;
-    const terminalMetadata = retainedMetadata ?? this.receivedTerminalMetadata ?? (this.lastTerminalFailure && this.lastTerminalFailure.details?.provider_result?.error === result.error
+    const terminalMetadata = { received_at: new Date().toISOString(), ...(retainedMetadata ?? this.receivedTerminalMetadata ?? (this.lastTerminalFailure && this.lastTerminalFailure.details?.provider_result?.error === result.error
       && this.lastTerminalFailure.details.provider_session_id === (result.conversation_id || this.init?.conversation_id || null)
       && (current?.previousError === result.error || this.lastResult?.status === "ERROR" && this.lastResult.error === result.error) ? this.lastTerminalFailure.details
       : { observed_at: new Date().toISOString(), provider_session_id: result.conversation_id || this.init?.conversation_id || null, operation_id: current?.operationId ?? null,
-        turn_generation: current?.generation ?? null, journal_locator: this.paths.journal, native_source: "agy.result" });
+        turn_generation: current?.generation ?? null, journal_locator: this.paths.journal, native_source: "agy.result" })) };
     this.receivedTerminalMetadata = null;
     // The ordered stream returns one result per input. Model usage counters
     // are not request IDs: native command rejections can report zero turns.
     // prompt() drains earlier events before accepting another input.
     if (!current && this.lastResult) { await this.journal("stale_terminal_observed", { result }); return; }
-    await this.captureChildTools();
     this.lastResult = result; this.markTerminalActivity(result);
     const rootStop = this.sessionObservations.get(this.init?.conversation_id)?.stop;
     const pendingTerminal = current && result.status === "SUCCESS";
-    if (pendingTerminal) current.terminalResult = result;
+    if (current) { current.terminalResult = result; current.terminalMetadata = terminalMetadata; current.terminalPersisted = false; }
     if (pendingTerminal && rootStop?.fullyIdle === true) for (const [id, descendant] of this.descendants) if (descendant.status === "unknown") this.descendants.set(id, { ...descendant, status: "settled_by_root", settlement_evidence: "root_fully_idle_stop" });
-    const terminalReceipt = pendingTerminal ? this.receipt(result) : null;
-    await this.persist({ active_tree: pendingTerminal ? !terminalReceipt.settled : result.status === "RUNNING" || rootStop?.fullyIdle === false, last_result: result });
+    this.state.terminal_observation_pending = true;
+    try {
+      await this.persist({ active_tree: true, last_result: result, last_terminal_metadata: terminalMetadata });
+      if (current) current.terminalPersisted = true;
+      if (providerEvent) await this.journal("provider_event", { event: providerEvent });
+      await this.captureChildTools();
+    } catch (error) { return this.failTerminalObservation(current, result, terminalMetadata, error); }
     try { this.usageIngest = await forwardUsage(this.config, result.conversation_id ?? this.init.conversation_id, result, this.toolSnapshot(), [...this.descendants.values()]); }
-    catch (error) { this.usageIngest = { status: "failed", error: error.message ?? String(error) }; await this.journal("usage_ingest_failed", this.usageIngest); }
+    catch (error) { this.usageIngest = { status: "failed", error: error.message ?? String(error) }; try { await this.journal("usage_ingest_failed", this.usageIngest); } catch (storage) { return this.failTerminalObservation(current, result, terminalMetadata, storage); } }
+    try { await this.persist({ terminal_observation_pending: false }); }
+    catch (error) { this.state.terminal_observation_pending = true; return this.failTerminalObservation(current, result, terminalMetadata, error); }
+    this.state.terminal_observation_pending = false;
     if (!current) return;
     if (this.active !== current) return;
     if (result.status === "ERROR" || result.status === "CANCELLED") {
       this.active = null;
-      this.lastTerminalFailure = agyTerminalFailure(result, { ...terminalMetadata, provider_error_scope: current.previousError && current.previousError === result.error ? "repeated_conversation_error" : "terminal_result", usage_ingest: this.usageIngest });
-      await this.persist({ last_terminal_failure: errorRecord(this.lastTerminalFailure) });
+      const settled = this.receipt().settled;
+      this.lastTerminalFailure = agyTerminalFailure(result, { ...terminalMetadata, native_turn_items: { observed: settled, possible_effects: true, pending: !settled }, provider_error_scope: current.previousError && current.previousError === result.error ? "repeated_conversation_error" : "terminal_result", usage_ingest: this.usageIngest });
+      try { await this.persist({ active_tree: !settled, last_terminal_failure: errorRecord(this.lastTerminalFailure) }); }
+      catch (error) { return this.failTerminalObservation(current, result, terminalMetadata, error); }
       return current.reject(this.lastTerminalFailure);
     }
-    await this.completePendingTurn();
+    try { await this.completePendingTurn(); }
+    catch (error) { return this.failTerminalObservation(current, result, terminalMetadata, error); }
   }
   async completePendingTurn() {
     await this.observeHookFailures();
     const current = this.active;
-    if (!current?.terminalResult || current.terminalResult !== this.lastResult) return;
+    if (current?.observationError) throw current.observationError;
+    if (current?.terminalResult?.status !== "SUCCESS" || current.terminalResult !== this.lastResult) return;
     await this.persist({ active_tree: !this.receipt().settled });
     // Hooks can invalidate the tree while persistence is pending. Never
     // publish a proof captured before that asynchronous boundary.
@@ -434,9 +448,20 @@ export class Runtime {
     this.active = null;
     current.resolve(receipt);
   }
+  failTerminalObservation(current, result, metadata, cause) {
+    this.state.terminal_observation_pending = true;
+    const details = { ...metadata, native_outcome: result, settled: false, terminal_persisted: current?.terminalPersisted === true, observation_error: errorRecord(cause), native_turn_items: { observed: false, possible_effects: true, pending: true } };
+    const error = ["ERROR", "CANCELLED"].includes(result.status)
+      ? agyTerminalFailure(result, details)
+      : new DaemonError("native_outcome_observation_failed", "Antigravity terminal was received but mandatory observation failed", false, details);
+    error.cause = cause;
+    if (result.status !== "SUCCESS") this.lastTerminalFailure = error;
+    if (current) { current.observationError = error; current.reject(error); }
+    throw error;
+  }
   receipt(result = this.lastResult) {
     if (this.state.last_terminal_failure && !this.lastTerminalFailure) this.lastTerminalFailure = this.state.last_terminal_failure;
-    const terminalMetadata = this.lastTerminalFailure && this.lastTerminalFailure.details?.provider_result?.error === result?.error
+    const terminalMetadata = this.active?.terminalResult === result ? this.active.terminalMetadata : this.state.last_result === result ? this.state.last_terminal_metadata : this.lastTerminalFailure && this.lastTerminalFailure.details?.provider_result?.error === result?.error
       && this.lastTerminalFailure.details.provider_session_id === (result?.conversation_id || this.init?.conversation_id || null) ? this.lastTerminalFailure.details : null;
     const assistantText = typeof result?.response === "string" ? result.response : typeof result?.text === "string" ? result.text : null;
     const root = this.init?.conversation_id; const observation = this.sessionObservations.get(root);
@@ -446,7 +471,8 @@ export class Runtime {
     // non-idle Stop still wins, and every discovered child must be terminal.
     const rootSettled = observation?.stop?.fullyIdle !== false;
     const terminalPending = this.active?.terminalResult === result;
-    return { harness: "antigravity-cli", runtime_family: "antigravity", provider_session_id: root ?? null, adapter_session_id: root ?? null, cwd: this.config.cwd, profile: this.profile, result, ...(terminalMetadata ? { terminal_metadata: terminalMetadata } : {}), ...(assistantText === null ? {} : { assistant_text: assistantText }), usage: usageSnapshot(result ?? {}, this.toolSnapshot()), usage_ingest: this.usageIngest, descendants: [...this.descendants.values()], transcript_path: observation?.transcript_path ?? null, settled: Boolean(!this.state.unclaimed_activity && (!this.active || terminalPending) && result && ["SUCCESS", "ERROR", "CANCELLED"].includes(result.status) && treeSettled && rootSettled) };
+    const settled = Boolean(!this.state.terminal_observation_pending && !this.active?.observationError && !this.state.unclaimed_activity && (!this.active || terminalPending) && result && ["SUCCESS", "ERROR", "CANCELLED"].includes(result.status) && treeSettled && rootSettled);
+    return { harness: "antigravity-cli", runtime_family: "antigravity", provider_session_id: root ?? null, adapter_session_id: root ?? null, cwd: this.config.cwd, profile: this.profile, result, ...(terminalMetadata ? { terminal_metadata: terminalMetadata, ...(terminalMetadata.turn_id ? { terminal_turn_id: terminalMetadata.turn_id } : {}) } : {}), ...(assistantText === null ? {} : { assistant_text: assistantText }), usage: usageSnapshot(result ?? {}, this.toolSnapshot()), usage_ingest: this.usageIngest, descendants: [...this.descendants.values()], ...settledNativeTree(root, [...this.descendants.values()], settled, !this.state.unclaimed_activity && (!this.active || terminalPending) && rootSettled && ["SUCCESS", "ERROR", "CANCELLED"].includes(result?.status)), transcript_path: observation?.transcript_path ?? null, settled };
   }
   async zeroUsage() { await forwardUsage(this.config, this.init.conversation_id, { usage: {} }, this.toolSnapshot(), []); }
   async prompt(text, assertDispatch = captureDispatchGuard(this), operationId = null, livenessTimeoutMs = 1_800_000) {
@@ -500,9 +526,14 @@ export class Runtime {
       checking = true; const cursor = this.progress?.cursor;
       void this.completePendingTurn().then(() => {
         if (this.active !== current || this.progress?.cursor !== cursor || !clock.sample(this.progress)) return;
+        if (current.terminalResult) return this.failTerminalObservation(current, current.terminalResult, current.terminalMetadata, new Error("Native tree settlement was not confirmed within the productive silence window"));
         current.reject(new DaemonError("operation_observation_lost", "Antigravity native outcome is unknown after the productive silence window", true, { operation_id: operationId, turn_generation: current.generation, native_outcome: "unknown", last_activity_at: this.lastActivityAt ?? null }));
       }).catch(error => {
-        if (this.active === current && this.progress?.cursor === cursor) current.reject(new DaemonError("operation_observation_lost", "Antigravity quiet reconciliation could not confirm the native outcome", true, { operation_id: operationId, turn_generation: current.generation, native_outcome: "unknown", observation_error: errorRecord(error) }));
+        if (this.active === current && this.progress?.cursor === cursor) {
+          if (current.observationError) current.reject(current.observationError);
+          else if (current.terminalResult) { try { this.failTerminalObservation(current, current.terminalResult, current.terminalMetadata, error); } catch { /* reply owns the typed failure */ } }
+          else current.reject(new DaemonError("operation_observation_lost", "Antigravity quiet reconciliation could not confirm the native outcome", true, { operation_id: operationId, turn_generation: current.generation, native_outcome: "unknown", observation_error: errorRecord(error) }));
+        }
       }).finally(() => { checking = false; });
     }, Math.max(10, Math.min(1_000, livenessTimeoutMs / 4)));
     try {
@@ -538,9 +569,7 @@ export class Runtime {
   }
   async rejectHook(error, event, payload, current = this.active) {
     if (current && this.active !== current) return;
-    const correctable = current && event === "PreToolUse" && error.code === "lifecycle_shell_syntax_invalid"
-      && error.details?.effect === "no_effect" && error.details?.recoverable === true
-      && error.details?.disposition === "pre_cli_shell_refusal" && error.details?.native_pre_cli_refusal === true;
+    const correctable = current && event === "PreToolUse" && isProvenShellCorrection(error);
     if (correctable && current.hookCorrectionGeneration !== current.generation) {
       // The request was correlated with this still-active Turn by
       // observeHookFailures. Persist before allowing native same-Turn recovery.

package/dist/harness-runtime/lib/dd-agy.mjs

@@ -4,6 +4,7 @@ import path from "node:path";
 import { SETUP_STARTUP_MS } from './setup-progress.mjs';
 
 import { checkObservedProfile } from "./model-observations.mjs";
+import { classifyProviderError, safeProviderError } from "./provider-overload-policy.mjs";
 
 const DEFAULT_MODEL = "gemini-3.1-pro-high";
 export const AGY_VERSION_TIMEOUT_MS = 30_000;
@@ -13,11 +14,21 @@ export class AgyError extends Error {
 }
 
 export function agyTerminalFailure(result, metadata = {}) {
-  const message = String(result.error ?? "Antigravity returned ERROR"), normalized = message.toLowerCase();
-  const code = result.status === "CANCELLED" ? "agy_turn_cancelled" : /quota|insufficient.?credit|billing|usage limit/.test(normalized) ? "agy_provider_quota_exhausted"
-    : /rate.?limit|too many requests/.test(normalized) ? "agy_provider_rate_limited" : /\b429\b/.test(normalized) ? "agy_provider_limit_unknown"
-      : /auth|unauthori[sz]ed|forbidden|account|eligib/.test(normalized) ? "agy_provider_account" : "agy_provider_failed";
-  return new AgyError(code, message, code === "agy_provider_rate_limited", { provider_result: result, ...metadata });
+  const native = typeof result.error === "object" && result.error ? result.error : { message: result.error ?? "Antigravity returned ERROR" };
+  const category = classifyProviderError(native);
+  const legacy = { provider_quota_exhausted: "agy_provider_quota_exhausted", provider_limit_unknown: "agy_provider_limit_unknown", provider_auth_failed: "agy_provider_account", provider_failed: "agy_provider_failed" };
+  let code = result.status === "CANCELLED" ? "agy_turn_cancelled" : legacy[category] ?? category;
+  // A local generation/usage count is not a native request identity.
+  const identity = result.turn_id ?? result.request_id;
+  const turn = typeof identity === "string" && identity ? identity : null;
+  const proofMissing = result.status === "ERROR" && ["provider_capacity_transient", "provider_rate_limited"].includes(category) && !turn;
+  if (proofMissing) code = "provider_overload_evidence_unavailable";
+  return new AgyError(code, String(native.message ?? "Antigravity returned ERROR"), code === "provider_capacity_transient" || code === "provider_rate_limited", {
+    provider_result: result, ...metadata, provider_error: safeProviderError(native), native_source: "agy.result", terminal_status: result.status === "ERROR" ? "failed" : "cancelled",
+    ...(turn ? { turn_id: turn, native_turn_id: turn } : {}),
+    ...(proofMissing ? { provider_category: category, reason: "native_turn_identity_unavailable" } : {}),
+    will_retry: native.willRetry === true, native_retry_active: native.willRetry === true
+  });
 }
 
 export function executable(bin, args = []) {

package/dist/harness-runtime/lib/dd-codex-daemon.mjs

@@ -9,7 +9,7 @@ import { chmod, lstat, mkdir, open, readFile, rename, unlink, writeFile } from "
 import net from "node:net";
 import { durableDaemonDispatch, completeDaemonShutdown, assertDaemonDispatch, assertDaemonRestartable, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon } from "./daemon-operations.mjs";
 import { ObservationClock } from "./observation-clock.mjs";
-import { parseCapacityOperation } from "./codex-capacity-policy.mjs";
+import { parseCapacityOperation } from "./provider-overload-policy.mjs";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { waitForSettlement } from "./session-settlement.mjs";

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -281,7 +281,7 @@ export class CodexBridge {
     const correction = isProvenShellCorrection(error);
     error.details = { ...error.details, native_hook_binding: { provider_session_id: threadId, root_provider_session_id: root, turn_id: turnId,
         hook_run_id: run.id, source: "codex.hook/completed" }, provider_session_id: threadId, root_provider_session_id: root, turn_id: turnId,
-        hook_run_id: run.id, effect: correction ? "no_effect" : "unknown", duration_ms: run.durationMs };
+        hook_run_id: run.id, effect: error.details?.effect ?? "unknown", native_turn_items: { observed: false, possible_effects: true, pending: true }, duration_ms: run.durationMs };
     if (correction) {
       try { void Promise.resolve(this.journal.write("native_hook_correction", errorRecord(error))).catch(storage => { error.cleanup_error ??= errorRecord(storage); }); }
       catch (storage) { error.cleanup_error ??= errorRecord(storage); }
@@ -734,7 +734,7 @@ export function turnItemEvidence(turn, bridge, sessionId) {
     possible_effects: items.some(item => classifyCodexItem(item?.type) !== "non_tool") } : { observed: false };
 }
 
-export { terminalCodexOverload } from "./codex-capacity-policy.mjs";
+export { terminalProviderOverload as terminalCodexOverload } from "./provider-overload-policy.mjs";
 
 function isTerminalTurnStatus(status) { return ["completed", "failed", "interrupted", "cancelled"].includes(status); }
 function isAuthoritativeTerminal(bridge, turnId, status, threadStatus, failureNotBefore) {

package/dist/harness-runtime/lib/dd-droid.mjs

@@ -11,7 +11,7 @@ import path from "node:path";
 import { ObservationClock, observedTimeout, validateObservationDuration } from "./observation-clock.mjs";
 import { operationProgressReporter } from "./operation-progress.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
-import { errorRecord, reportedError, isObservationLoss } from "./operation-errors.mjs";
+import { errorRecord, reportedError, isObservationLoss, isProvenShellCorrection } from "./operation-errors.mjs";
 import { hookBudget, invokeNativeHook } from "./native-hook-command.mjs";
 import { checkObservedProfile, observeModel } from "./model-observations.mjs";
 import { readNativeLines, streamNativeDiagnostics, nativeObservationError } from "./native-streams.mjs";
@@ -21,6 +21,8 @@ const metadataReaders = new Map();
 function metadataReader(factory) { if (!metadataReaders.has(factory)) metadataReaders.set(factory, new DroidMetadataReader(factory)); return metadataReaders.get(factory); }
 import { confirmDaemonProcess, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 import { renderAdapterPolicy, lifecycleRetryInstruction } from "./delegation-instructions.mjs";
+import { classifyProviderError, safeProviderError } from "./provider-overload-policy.mjs";
+import { settledNativeTree } from "./native-children.mjs";
 
 export const DROID_CONTRACT = "dd-droid-harness@1";
 export const DROID_PROTOCOL = "1.201.0";
@@ -96,6 +98,19 @@ export async function readDroidSession(factory, id) {
 const terminal = value => ["completed", "cancelled", "failed", "process_exit", "error"].includes(value);
 const status = value => value === "completed" ? "completed" : ["cancelled", "process_exit"].includes(value) ? "cancelled" : ["failed", "error"].includes(value) ? "failed" : "unknown";
 
+export function droidTerminalFailure(outcome, sessionId, settled) {
+  if (!["failed", "error"].includes(outcome?.reason) || !outcome.error || typeof outcome.error !== "object") return null;
+  const code = classifyProviderError(outcome.error);
+  if (code === "provider_failed") return null;
+  const turnId = outcome.turnId;
+  return Object.assign(new DroidError(code, "Droid native provider request failed", {
+    provider_session_id: sessionId, session_id: sessionId, turn_id: turnId, native_turn_id: turnId,
+    terminal_status: "failed", native_source: "droid.agent_turn_outcome", observed_at: new Date().toISOString(),
+    provider_error: safeProviderError(outcome.error), will_retry: outcome.error.willRetry === true, native_retry_active: outcome.error.willRetry === true,
+    native_turn_items: { observed: settled === true, possible_effects: true, pending: settled !== true }
+  }), { retryable: code === "provider_capacity_transient" || code === "provider_rate_limited" });
+}
+
 
 function descendants(rows, rootPid) { const ids = new Set([rootPid]); for (;;) { const size = ids.size; for (const row of rows) if (ids.has(row.ppid)) ids.add(row.pid); if (size === ids.size) return rows.filter(row => ids.has(row.pid)); } }
 
@@ -361,15 +376,18 @@ export class DroidRuntime {
         });
       }
       const outcome = await completed; await this.draining;
+      let receipt;
       try {
-        const receipt = await this.inspect(id, { ignoreActive: true });
-        return { ...receipt, result: { ...outcome, status: status(outcome.reason) }, assistant_text: current.text, turn_id: turnId };
+        receipt = await this.inspect(id, { ignoreActive: true });
       } catch (error) {
         // A terminal native outcome is durable independently of a later
         // filesystem/topology observation.  Preserve it and let settlement
         // reconcile; do not convert it into a failed prompt.
         return { provider_session_id: id, adapter_session_id: id, result: { ...outcome, status: status(outcome.reason) }, assistant_text: current.text, turn_id: turnId, settled: false, settlement_observation_error: errorRecord(error) };
       }
+      const providerFailure = droidTerminalFailure(outcome, id, receipt.settled);
+      if (providerFailure) throw providerFailure;
+      return { ...receipt, result: { ...outcome, status: status(outcome.reason) }, assistant_text: current.text, turn_id: turnId };
     } catch (error) {
       if (current.outcome && isObservationLoss(error)) error = Object.assign(new Error("Droid completed natively but its dispatch acknowledgement was lost", { cause: error }), {
         code: "native_outcome_observation_failed", details: { native_outcome: { provider_session_id: id, turn_id: turnId, result: current.outcome }, settled: false, observation_error: errorRecord(error) }
@@ -400,6 +418,8 @@ export class DroidRuntime {
     catch (error) {
       receipt = { provider_session_id: binding.provider_session_id, adapter_session_id: binding.provider_session_id, settled: false, settlement_observation_error: errorRecord(error) };
     }
+    const failure = droidTerminalFailure(outcome, binding.provider_session_id, receipt.settled);
+    if (failure) throw failure;
     // Native outcome and tree settlement are independent. Retain the former
     // even while children are running; settled:false keeps capacity reserved.
     const current = this.active;
@@ -449,7 +469,9 @@ export class DroidRuntime {
       const ordered = tasks.toSorted((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0));
       const latest = ordered.at(-1); const running = tasks.some(task => !terminal(task.status));
       const closed = running && prior?.source === "adapter.tree_closed";
-      this.topology.set(id, { provider_session_id: id, parent_provider_session_id: this.rootId, tool_use_id: creationTool, latest_tool_use_id: latest.parentToolUseId, task_id: latest.taskInvocationId, task_invocation_ids: ordered.map(task => task.taskInvocationId), status: closed ? prior.status : running ? "running" : status(latest.status), source: closed ? prior.source : "droid.task_invocations", transcript_path: native.transcript_path });
+      const outcome = native.outcomes.at(-1), nativeTurn = outcome && terminal(outcome.reason) && typeof outcome.turnId === "string" ? outcome.turnId : null;
+      const evidence = !running && nativeTurn ? { terminal_turn_id: nativeTurn, native_source: "droid.agent_turn_outcome", native_turn_items: { observed: native.complete && native.tool_calls.completeness === "complete", possible_effects: native.tool_calls.total > 0, pending: native.tool_calls.pending > 0 }, ...(outcome.error && typeof outcome.error === "object" ? { provider_error: safeProviderError(outcome.error) } : {}) } : {};
+      this.topology.set(id, { provider_session_id: id, parent_provider_session_id: this.rootId, tool_use_id: creationTool, latest_tool_use_id: latest.parentToolUseId, task_id: latest.taskInvocationId, task_invocation_ids: ordered.map(task => task.taskInvocationId), status: closed ? prior.status : running ? "running" : status(latest.status), source: closed ? prior.source : "droid.task_invocations", transcript_path: native.transcript_path, ...evidence });
     }
     return [...this.topology.values()];
   }
@@ -470,7 +492,8 @@ export class DroidRuntime {
     this.requireIdentity(id); await this.captureProcesses(); const children = await this.refreshTopology(); const source = await readDroidSession(this.paths.factory, id);
     const usage = []; for (const sessionId of [id, ...children.map(child => child.provider_session_id)]) usage.push(await this.snapshotUsage(sessionId, { ingest: ingestUsage }));
     const settled = !this.topologyIncomplete && (!this.active || ignoreActive) && (this.closed || this.workingState === "idle") && children.every(child => terminal(child.status));
-    return { harness: "droid-cli", runtime_family: "droid", session: { harness_id: "droid-cli", session_id: id }, provider_session_id: id, adapter_session_id: id, cwd: this.config.cwd, observed_profile: source?.settings ? await this.observeSettings(id, source.settings, { path: source.transcript_path, sha256: source.source_sha256 }) : this.observedProfile, observed_runtime: { droid: this.config.version, factory_protocol: this.protocol ?? DROID_PROTOCOL, dd_harness_contract: DROID_CONTRACT }, status: settled ? "idle" : "running", settled, descendants: children, transcript_path: source?.transcript_path ?? null, usage, result: this.lastResult, provider_pid: this.closed ? null : this.child?.pid ?? null };
+    const rootSettled = (!this.active || ignoreActive) && (this.closed || this.workingState === "idle") && terminal((source?.outcomes?.at(-1) ?? this.lastResult)?.reason);
+    return { harness: "droid-cli", runtime_family: "droid", session: { harness_id: "droid-cli", session_id: id }, provider_session_id: id, adapter_session_id: id, cwd: this.config.cwd, observed_profile: source?.settings ? await this.observeSettings(id, source.settings, { path: source.transcript_path, sha256: source.source_sha256 }) : this.observedProfile, observed_runtime: { droid: this.config.version, factory_protocol: this.protocol ?? DROID_PROTOCOL, dd_harness_contract: DROID_CONTRACT }, status: settled ? "idle" : "running", settled, ...settledNativeTree(id, children, settled, rootSettled && !this.topologyIncomplete), terminal_turn_id: source?.outcomes?.at(-1)?.turnId ?? this.lastResult?.turnId, descendants: children, transcript_path: source?.transcript_path ?? null, usage, result: this.lastResult, provider_pid: this.closed ? null : this.child?.pid ?? null };
   }
   async observeHook(payload, eventId, deadlineAt = null) {
     try { return await this.observeHookChecked(payload, eventId, hookBudget(23_000, deadlineAt)); }
@@ -500,15 +523,14 @@ export class DroidRuntime {
     try {
       return await this.flow("event", "handle", { schema_id: "dd-flow/droid-tool-event@1", phase: event === "PreToolUse" ? "before" : "after", event_id: eventId, daemon_id: this.config.daemonId, session: { provider_session_id: id, parent_provider_session_id: parent, directory: this.config.cwd }, tool: payload.tool_name, input: payload.tool_input, profile, transcript_path: native.transcript_path, outcome: { status: payload.tool_response?.is_error ? "error" : "completed" } }, budget.remaining("admission", 15_000));
     } catch (error) {
-      const details = error.details;
-      if (event === "PreToolUse" && error.code === "lifecycle_shell_syntax_invalid" && details?.phase === "prepare" && details.effect === "no_effect" && details.recoverable === true && details.disposition === "pre_cli_shell_refusal" && (details.refusal_event_key || details.event_key)) {
+      if (event === "PreToolUse" && isProvenShellCorrection(error)) {
         const refusal = errorRecord(error);
         await this.journal("hook_rejected", { error: refusal, event_id: eventId, session_id: id });
         await this.save();
         return { continue: false, stopReason: error.message };
       }
       // Identity is proven above; only this owned admission can fail its turn.
-      this.fatalError ??= Object.assign(error, { details: { ...error.details, provider_session_id: id, event_id: eventId, effect: "unknown" } });
+      this.fatalError ??= Object.assign(error, { details: { ...error.details, provider_session_id: id, event_id: eventId, effect: error.details?.effect ?? "unknown", native_turn_items: { observed: false, possible_effects: true, pending: true } } });
       this.rejectPending(this.fatalError);
       try { await budget.run(async () => { await this.save({ fatal_error: errorRecord(this.fatalError) }); await this.journal("hook_rejected", { error: errorRecord(this.fatalError) }); }, "failure_persistence"); }
       catch (storage) { this.fatalError.details.receipt_error = errorRecord(storage); }

package/dist/harness-runtime/lib/dd-grok-daemon.mjs

@@ -20,6 +20,8 @@ import os from "node:os";
 import path from "node:path";
 
 import { AcpBridge } from "./dd-zcode.mjs";
+import { safeProviderError } from "./provider-overload-policy.mjs";
+import { settledNativeTree } from "./native-children.mjs";
 import { observeModel, readModelObservations } from "./model-observations.mjs";
 import { cancelSessionWithBridge, createSessionWithBridge, doctor, forkSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge } from "./dd-grok.mjs";
 import { prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
@@ -241,6 +243,10 @@ export class Runtime {
       parent_provider_session_id: parent,
       status,
       source,
+      ...(terminal(status) && typeof attempt === "string" && attempt ? { terminal_turn_id: attempt,
+        ...(typeof value.observed_at === "string" ? { terminal_observed_at: value.observed_at } : {}),
+        ...(value.provider_error && typeof value.provider_error === "object" ? { provider_error: safeProviderError(value.provider_error), native_source: "grok.subagent.event" } : {}),
+        ...(value.native_turn_items && typeof value.native_turn_items === "object" ? { native_turn_items: value.native_turn_items } : {}) } : {}),
       ...(attempt || descendant?.attempt_id ? { attempt_id: attempt ?? descendant.attempt_id } : {}),
       ...(newAttempt && descendant?.attempt_id ? { retired_attempt_ids: [...retired, descendant.attempt_id] } : retired.length ? { retired_attempt_ids: retired } : {}),
       ...(!newAttempt && !terminal(status) && descendant?.outcome_error ? { outcome_error: descendant.outcome_error } : {})
@@ -410,7 +416,7 @@ export class Runtime {
     if (operation === "session.create") return await this.productive(operation, async () => { const result = await createSessionWithBridge(this.bridge, { ...this.options(params), onSessionCreated: async (session) => { this.track(session); this.loadedSessionId = session.provider_session_id; await this.persist(); } }, this.initialized); this.loadedSessionId = result.provider_session_id; return result; }, null, operationId);
     if (operation === "session.prompt") { await this.requireSettled(); return await this.productive(operation, async () => { const result = await promptSessionWithBridge(this.bridge, { ...this.options(params), assertDispatch, operationId }); this.loadedSessionId = params.sessionId; return result; }, params.sessionId, operationId); }
     if (operation === "session.fork") { await this.requireSettled(); return await this.productive(operation, async () => { const result = await forkSessionWithBridge(this.bridge, this.options(params)); this.loadedSessionId = params.sessionId; return result; }); }
-    if (operation === "session.inspect" || operation === "session.resume") { const before = new Map(this.descendants); const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result, before); await this.persist(); return { ...result, settled: !this.active && !this.treeRunning(result), descendants: this.topology(result.provider_session_id) }; }
+    if (operation === "session.inspect" || operation === "session.resume") { const before = new Map(this.descendants); const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result, before); await this.persist(); const settled = !this.active && !this.treeRunning(result); const descendants = this.topology(result.provider_session_id); const terminal = this.sessions.get(result.provider_session_id)?.native_root_receipt; return { ...result, settled, descendants, ...settledNativeTree(result.provider_session_id, descendants, settled, !this.active && !this.rootRunning(result)), ...(terminal?.kind === "failed" && terminal.request_id !== undefined ? { terminal_turn_id: String(terminal.request_id) } : {}) }; }
     if (operation === "session.cancel") { if (!this.sessions.has(params.sessionId)) throw new DaemonError("session_identity_mismatch", "cancellation Session is not owned by this daemon"); cancelPendingDispatch(this); const result = await cancelSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); await this.persist({ active_tree: Boolean(this.active) || !result.settled }); return result; }
     if (operation === "session.archive") { await this.requireSettled(); return await this.productive(operation, async () => { let session = this.sessions.get(params.sessionId); if (!session?.cwd) { const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result); session = this.sessions.get(result.provider_session_id); } return await exportSessionArchive(this.paths, session.provider_session_id, absolute(session.cwd, "Grok Build session cwd"), params.archiveDir, this.state.versions); }); }
     if (operation === "daemon.stop") {