@deksden-com/dd-flow-cli 0.9.0-beta.138 → 0.9.0-beta.139

package/dist/harness-runtime/lib/native-children.mjs

@@ -1,17 +1,35 @@
 export const NATIVE_CHILD_CONTRACT_VERSION = "native-children@1";
 import { errorRecord } from "./operation-errors.mjs";
+import { safeProviderError } from "./provider-overload-policy.mjs";
 
 function nativeFailure(code, message, exitCode, details) { return Object.assign(new Error(message), { code, exitCode, details }); }
 
+/** Project a positively settled native tree, never infer it from missing activity. */
+export function settledNativeTree(root, children, settled, rootSettled = false) {
+  if (settled !== true && rootSettled !== true || typeof root !== "string" || !root || !Array.isArray(children)) return {};
+  const ids = children.map(child => child.provider_session_id ?? child.session_id ?? child.childSessionId ?? child.sessionId);
+  if (ids.some(id => typeof id !== "string" || !id || id === root) || new Set(ids).size !== ids.length) return {};
+  const observations = [{ provider_session_id: root, status: "idle", settled: true }, ...children.map((child, index) => {
+    const status = String(child.status ?? child.state ?? "unknown").toLowerCase();
+    const terminal = settled === true || ["completed", "success", "succeeded", "failed", "cancelled", "canceled", "settled_by_root"].includes(status);
+    return { provider_session_id: ids[index], status: terminal ? "idle" : ["running", "active", "inprogress", "pending"].includes(status) ? "running" : "unknown", settled: terminal };
+  })];
+  return { tree_session_ids: [root, ...ids], unsettled_sessions: observations.filter(item => !item.settled).map(item => item.provider_session_id), tree_observations: observations };
+}
+
 /** Retain typed failure facts, never provider headers, request bodies or free-form messages. */
 export function safeNativeFailure(value, depth = 0) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
   const result = {};
-  for (const key of ["type", "code", "source", "reason", "errorPhase", "exceptionKind", "providerId", "modelId", "providerKind", "transport", "retryable", "willRetry", "statusCode", "resets_at", "retryAfter", "retry_after", "retryAfterMs", "resetAt"]) {
+  for (const key of ["type", "code", "source", "reason", "errorPhase", "exceptionKind", "providerId", "modelId", "providerKind", "transport", "retryable", "willRetry", "statusCode", "resets_at", "retryAfterMs", "resetAt"]) {
     const scalar = value[key];
     if (typeof scalar === "boolean" || typeof scalar === "number" && Number.isFinite(scalar)
       || typeof scalar === "string" && scalar.length <= 256 && /^[\w.:/ -]+$/.test(scalar)) result[key] = scalar;
   }
+  // Timing metadata is not an identifier: HTTP dates contain commas and an
+  // invalid value must reach the policy as invalid, not disappear into default backoff.
+  const timing = safeProviderError(value);
+  if (Object.hasOwn(timing, "retryAfter")) result.retryAfter = timing.retryAfter;
   if (typeof value.codexErrorInfo === "string" && /^[\w-]{1,128}$/.test(value.codexErrorInfo)) result.codexErrorInfo = value.codexErrorInfo;
   else if (value.codexErrorInfo && typeof value.codexErrorInfo.code === "string" && /^[\w-]{1,128}$/.test(value.codexErrorInfo.code)) result.codexErrorInfo = { code: value.codexErrorInfo.code };
   const attribution = depth === 0 && value.attribution && safeNativeFailure(value.attribution, 1);
@@ -55,6 +73,7 @@ export function normalizeNativeChildren(receipt, rootSessionId) {
       ...(text(value, ["terminal_turn_id"]) ? { terminal_turn_id: text(value, ["terminal_turn_id"]) } : {}),
       ...(text(value, ["terminal_observed_at"]) ? { terminal_observed_at: text(value, ["terminal_observed_at"]) } : {}),
       ...(value.provider_error !== undefined ? { provider_error: value.provider_error } : {}),
+      ...(["opencode.v2.session.execution", "agy.result", "acp.error_response", "droid.agent_turn_outcome", "grok.subagent.event"].includes(value.native_source) ? { native_source: value.native_source } : {}),
       ...(value.native_turn_items && typeof value.native_turn_items === "object" ? { native_turn_items: value.native_turn_items } : {}) });
   };
   for (const value of list(receipt.descendants)) add(value, "adapter.descendants");

package/dist/harness-runtime/lib/opencode-plugin.mjs

@@ -1,20 +1,25 @@
 import path from "node:path";
 import { managedFlowEnv } from './managed-flow-env.mjs';
 import * as Plugin from "../vendor/opencode-plugin.mjs";
-import { hookBudget, invokeNativeHook } from "./native-hook-command.mjs";
+import { hookBudget, invokeNativeHook, writeNativeHookFailure } from "./native-hook-command.mjs";
+import { callDaemon } from "./dd-opencode-daemon.mjs";
+import { errorRecord } from "./operation-errors.mjs";
 
 /** Launch-bound server plugin; never uses a process-global 'last Session'. */
-export function makeOpenCodePlugin(binding, invoke = invokeNativeHook) {
+export function makeOpenCodePlugin(binding, invoke = invokeNativeHook, resolve = callDaemon) {
   return Plugin.define({ id: binding.ddFlowBin ? "dd-flow" : "dd-flow-security", async setup(ctx) {
     const participating = new Map();
     const key = event => JSON.stringify([binding.daemonId, event.sessionID, event.messageID, event.id]);
     const envelope = async (phase, event, budget, outcome) => {
-      const info = await budget.run(() => ctx.session.get({ sessionID: event.sessionID }), "identity");
-      if (!info?.id || info.id !== event.sessionID || !info.location?.directory) throw new Error("OpenCode Session identity is unavailable");
       const input = event.input;
       if (!input || typeof input !== "object" || typeof input.command !== "string") throw new Error("OpenCode shell input is unavailable");
-      const cwd = path.resolve(info.location.directory, input.workdir ?? ".");
+      const identity = await budget.run(() => resolve(binding.stateDir, "hook.resolve", { sessionId: event.sessionID,
+        payload: { phase, message_id: event.messageID, tool_call_id: event.id, input } }, budget.remaining("identity")), "identity");
+      const info = identity?.nativeSession;
+      if (!identity?.nativeHookBinding || info?.id !== event.sessionID || !info.directory) throw Object.assign(new Error("OpenCode Session identity is unavailable"), { code: "native_hook_unproven" });
+      const cwd = path.resolve(info.directory, input.workdir ?? ".");
       return { schema_id: "dd-flow/opencode-tool-event@1", native_protocol: 2,
+        native_hook_binding: identity.nativeHookBinding,
         event_id: [binding.daemonId, event.sessionID, event.messageID, event.id].join(":"), phase,
         daemon_id: binding.daemonId, server_version: binding.version, plugin_sha256: process.env.DD_OPENCODE_PLUGIN_SHA256,
         session: { provider_session_id: info.id, parent_provider_session_id: info.parentID ?? null,
@@ -23,9 +28,26 @@ export function makeOpenCodePlugin(binding, invoke = invokeNativeHook) {
         profile: { provider: info.model?.providerID, model: info.model?.id, variant: info.model?.variant ?? "default", agent: event.agent },
         input: { ...input, workdir: cwd }, ...(outcome ? { outcome } : {}) };
     };
-    const deliver = (payload, budget) => invoke({ bin: binding.ddFlowBin, nodeBin: binding.nodeBin,
-      args: ["opencode", "event", "handle", "--project-root", binding.projectRoot, "--json"],
-      payload, home: binding.ddFlowHome, timeoutMs: budget.remaining("admission", 15000) });
+    const deliver = async (payload, budget) => {
+      const identity = { nativeHookBinding: payload.native_hook_binding };
+      try {
+        const result = await invoke({ bin: binding.ddFlowBin, nodeBin: binding.nodeBin,
+          args: ["opencode", "event", "handle", "--project-root", binding.projectRoot, "--json"],
+          payload: { ...payload, native_hook_binding: identity.nativeHookBinding }, home: binding.ddFlowHome, timeoutMs: budget.remaining("admission", 15000) });
+        await budget.run(() => resolve(binding.stateDir, "hook.verify", { binding: identity.nativeHookBinding }, budget.remaining("generation")), "generation");
+        if (result?.permissionDecision === "deny" || result?.hookSpecificOutput?.permissionDecision === "deny") throw Object.assign(new Error("dd-flow denied native shell admission"), { code: "native_hook_rejected" });
+        return result;
+      } catch (error) {
+        error.details = { ...error.details, native_hook_binding: identity.nativeHookBinding, ...(payload.phase === "after" ? { effect: "unknown", tool_outcome: payload.outcome } : {}) };
+        try { await writeNativeHookFailure(binding.stateDir, identity.nativeHookBinding, error, hookBudget(1_000, null)); await resolve(binding.stateDir, "hook.failed", {}, 1_000); }
+        catch (storage) {
+          error.details.receipt_error = { code: storage.code ?? "hook_receipt_write_failed", message: storage.message };
+          try { await resolve(binding.stateDir, "hook.failed", { binding: identity.nativeHookBinding, failure: errorRecord(error) }, 1_000); }
+          catch (notify) { error.details.receipt_error.notification_error = notify.code ?? "hook_notification_failed"; }
+        }
+        throw error;
+      }
+    };
     await ctx.shell.hook("create.before", event => {
       Object.assign(event.env, managedFlowEnv(binding));
       delete event.env.OPENCODE_PASSWORD; delete event.env.OPENCODE_SERVER_PASSWORD;
@@ -37,7 +59,6 @@ export function makeOpenCodePlugin(binding, invoke = invokeNativeHook) {
       const budget = hookBudget(), payload = await envelope("before", event, budget);
       event.input = { ...event.input, workdir: payload.session.directory };
       const result = await deliver({ ...payload, input: event.input }, budget);
-      if (result?.permissionDecision === "deny" || result?.hookSpecificOutput?.permissionDecision === "deny") throw new Error("dd-flow denied native shell admission");
       if (result?.observed) {
         participating.set(key(event), payload);
         await ctx.storage.set(key(event), JSON.parse(JSON.stringify(payload)));

package/dist/harness-runtime/lib/provider-overload-policy.d.mts

@@ -0,0 +1,13 @@
+export const CAPACITY_POLICY: "provider-overload-episode@1";
+export const MAX_OVERLOAD_RETRIES: 2;
+export const MAX_RETRY_AFTER_MS: 30000;
+export function classifyProviderError(native: unknown): string;
+export function safeProviderError(native: unknown): Record<string, unknown>;
+export type CapacityRefusal = { policy: string; ordinal: number; session_id: string; turn_id: string; first_observed_at: string; native_terminal_at?: string; native_terminal_basis?: string };
+export function parseCapacityOperation(id: string): { root: string; ordinal: number };
+export function normalizeProviderFailure(error: unknown, sessionId?: string, turnId?: string): null | { code: string; session_id: string; turn_id: string; native_error: Record<string, unknown>; observed_at: unknown; terminal_at: unknown; native_turn_items: unknown; primary_error: { details?: Record<string, unknown> } };
+export function terminalProviderOverload(error: unknown, sessionId?: string, turnId?: string): boolean;
+export function nativeItemsSettled(items: unknown): boolean;
+export function capacityBackoff(error: unknown, ordinal: number, now?: number, random?: () => number): number;
+export function refusalObservation(error: unknown, ordinal: number, firstObservedAt: string): CapacityRefusal;
+export function overloadExhausted(refusals: CapacityRefusal[], maxRetries?: number): null | { policy: string; reason: string; attempts: number; refusals: CapacityRefusal[] };

package/dist/harness-runtime/lib/provider-overload-policy.mjs

@@ -0,0 +1,138 @@
+/** Pure policy shared by the controller and pinned-engine EVAL consumers. */
+export const CAPACITY_POLICY = "provider-overload-episode@1";
+export const MAX_OVERLOAD_RETRIES = 2;
+export const MAX_RETRY_AFTER_MS = 30_000;
+
+function policyError(code, message, details = {}) { return Object.assign(new Error(message), { code, details }); }
+
+/** Only call on a native error envelope, never prompt or tool output. */
+export function classifyProviderError(native) {
+  if (!native || typeof native !== "object") return "provider_failed";
+  const code = [native.code, native.type, native.codexErrorInfo?.code ?? native.codexErrorInfo].filter(value => typeof value === "string").join(" ");
+  const message = String(native.message ?? "");
+  const text = `${code} ${message}`;
+  const status = Number(native.status ?? native.statusCode ?? native.status_code ?? native.http_status);
+  if (status === 402 || /quota|usageLimitExceeded|sessionBudgetExceeded|billing|payment.required|balance.exhausted|insufficient.credit|resource_exhausted.*limit/i.test(text)) return "provider_quota_exhausted";
+  if (status === 401 || status === 403 || /provider_auth_failed|invalid.api.key|authentication|unauthorized|eligib|forbidden|access.denied|rejected.this.account/i.test(text)) return "provider_auth_failed";
+  if (/provider_capacity_transient|serverOverloaded|model.?capacity|at capacity|server.overload|model.overload|server.?busy/i.test(text) || /(?:^|\s)overloaded_error(?:\s|$)/i.test(code) || status === 503 || status === 529) return "provider_capacity_transient";
+  if (/rateLimitExceeded|rate.limit/i.test(text) && (native.retryAfter !== undefined || native.retry_after !== undefined || Object.keys(native.headers ?? {}).some(key => key.toLowerCase() === "retry-after"))) return "provider_rate_limited";
+  return status === 429 || /provider_limit_unknown|\b429\b|rateLimitExceeded|rate.limit/i.test(text) ? "provider_limit_unknown" : "provider_failed";
+}
+
+/** Public retry evidence excludes response bodies, credentials and other headers. */
+export function safeProviderError(native) {
+  const result = { code: classifyProviderError(native) };
+  if (!native || typeof native !== "object") return result;
+  const status = native.status ?? native.statusCode ?? native.status_code ?? native.http_status;
+  if (Number.isInteger(Number(status))) result.status = Number(status);
+  const header = Object.entries(native.headers ?? {}).find(([key]) => key.toLowerCase() === "retry-after")?.[1];
+  const retry = header ?? native.retryAfter ?? native.retry_after;
+  if (retry !== undefined && retry !== null) result.retryAfter = typeof retry === "string" && retry.length <= 128 || typeof retry === "number" && Number.isFinite(retry) ? retry : "invalid-retry-after";
+  if (typeof native.willRetry === "boolean") result.willRetry = native.willRetry;
+  for (const key of ["reset_at", "resets_at", "resetAt", "resetsAt", "reset_time"]) {
+    const value = native[key];
+    if (typeof value === "string" && value.length <= 128 || typeof value === "number" && Number.isFinite(value)) result[key] = value;
+  }
+  return result;
+}
+
+export function parseCapacityOperation(id) {
+  if (typeof id !== "string" || !id) throw policyError("capacity_continuation_conflict", "Missing capacity operation identity");
+  const match = /^(.*):capacity:(\d+):session\.prompt$/.exec(id);
+  if (!match) return { root: id, ordinal: 0 };
+  const ordinal = Number(match[2]);
+  if (!Number.isSafeInteger(ordinal) || ordinal < 1 || String(ordinal) !== match[2]) throw policyError("capacity_continuation_conflict", "Capacity ordinal is not a canonical positive safe integer", { operation_id: id });
+  return { root: match[1], ordinal };
+}
+
+export function normalizeProviderFailure(error, expectedSessionId, expectedTurnId) {
+  let current = error;
+  for (let depth = 0; depth < 4 && current && typeof current === "object"; depth++) {
+    // The same continuation authority applies to a proven v2 execution
+    // refusal. Never classify transport loss or an active native retry here.
+    if (current.code === "provider_capacity_transient" || current.code === "provider_rate_limited") {
+      const details = current.details ?? {};
+      if (!["opencode.v2.session.execution", "agy.result", "acp.error_response", "droid.agent_turn_outcome", "grok.subagent.event"].includes(details.native_source) || details.terminal_status !== "failed"
+        || details.will_retry === true || details.native_retry_active === true || details.provider_error?.willRetry === true
+        || details.provider_error && !["provider_capacity_transient", "provider_rate_limited"].includes(classifyProviderError(details.provider_error))
+        || typeof details.provider_session_id !== "string" || !details.provider_session_id
+        || typeof details.turn_id !== "string" || !details.turn_id || details.native_turn_id !== details.turn_id
+        || expectedSessionId !== undefined && details.provider_session_id !== expectedSessionId
+        || expectedTurnId !== undefined && details.turn_id !== expectedTurnId) return null;
+      return { code: "serverOverloaded", session_id: details.provider_session_id, turn_id: details.turn_id,
+        native_error: details.provider_error ?? { type: details.native_error_type, status: details.http_status }, observed_at: details.observed_at ?? null,
+        terminal_at: null, terminal_basis: null, native_turn_items: details.native_turn_items ?? null, primary_error: current };
+    }
+    if (current.code === "turn_interrupted") {
+      const details = current.details ?? {}, native = details.provider_error;
+      const code = typeof native?.codexErrorInfo === "string" ? native.codexErrorInfo : native?.codexErrorInfo?.code;
+      if (native?.willRetry === true || details.terminal_status !== "failed" || typeof details.provider_session_id !== "string" || !details.provider_session_id
+        || expectedSessionId !== undefined && details.provider_session_id !== expectedSessionId
+        || typeof details.turn_id !== "string" || !details.turn_id || details.native_turn_id !== details.turn_id
+        || expectedTurnId !== undefined && details.turn_id !== expectedTurnId || typeof code !== "string") return null;
+      return { code, session_id: details.provider_session_id, turn_id: details.turn_id, native_error: native,
+        observed_at: details.observed_at ?? null, terminal_at: details.terminal_at ?? null, terminal_basis: details.terminal_basis ?? null,
+        native_turn_items: details.native_turn_items ?? null, primary_error: current };
+    }
+    // No arbitrary recursive cause search: an ownership/hook/lifecycle error wins.
+    if (current.code !== "harness_adapter_failed") return null;
+    current = current.details?.cause ?? current.cause;
+  }
+  return null;
+}
+
+export function terminalProviderOverload(error, expectedSessionId, expectedTurnId) {
+  const normalized = normalizeProviderFailure(error, expectedSessionId, expectedTurnId);
+  return normalized !== null && ["provider_capacity_transient", "provider_rate_limited"].includes(classifyProviderError(normalized.native_error));
+}
+
+export function nativeItemsSettled(items) {
+  return items?.observed === true && typeof items.possible_effects === "boolean" && items.pending !== true
+    && (items.possible_effects === false || items.pending === false);
+}
+
+export function capacityBackoff(error, ordinal, now = Date.now(), random = Math.random) {
+  if (!Number.isSafeInteger(ordinal) || ordinal < 1 || !Number.isFinite(now)) throw policyError("capacity_continuation_conflict", "Invalid capacity timing identity");
+  const native = normalizeProviderFailure(error)?.native_error ?? error?.details?.provider_error ?? error;
+  const header = Object.entries(native?.headers ?? {}).find(([key]) => key.toLowerCase() === "retry-after")?.[1];
+  const value = header ?? native?.retryAfter ?? native?.retry_after;
+  let retry = 0;
+  if (value !== undefined && value !== null) {
+    retry = typeof value === "number" || typeof value === "string" && /^\d+(\.\d+)?$/.test(value.trim()) ? Number(value) * 1000 : typeof value === "string" && /^\w{3}, \d{2} \w{3} \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(value.trim()) ? Math.max(0, Date.parse(value) - now) : NaN;
+    if (!Number.isFinite(retry) || retry < 0 || !Number.isFinite(now + retry) || now + retry > 8.64e15)
+      throw policyError("capacity_retry_metadata_invalid", "Retry-After cannot be represented safely", { retry_after: value });
+  }
+  const jitter = random();
+  if (!Number.isFinite(jitter) || jitter < 0 || jitter >= 1) throw policyError("capacity_retry_metadata_invalid", "Invalid retry jitter");
+  const wait = Math.max((ordinal === 1 ? 5_000 : 15_000) + Math.floor(jitter * 251), retry);
+  if (wait > MAX_RETRY_AFTER_MS) throw policyError("provider_unavailable", "Provider requested a delay beyond the retry budget", { policy: CAPACITY_POLICY, reason: "retry_after_exceeds_budget", retry_after_ms: retry, suggested_retry_at: new Date(now + retry).toISOString() });
+  return wait;
+}
+
+export function refusalObservation(error, ordinal, firstObservedAt) {
+  const failure = normalizeProviderFailure(error);
+  const observed = Date.parse(firstObservedAt);
+  if (!failure || !Number.isSafeInteger(ordinal) || ordinal < 0 || !Number.isFinite(observed))
+    throw policyError("capacity_continuation_conflict", "Refusal lacks an immutable native identity/time");
+  if (failure.observed_at !== null && (typeof failure.observed_at !== "string" || !Number.isFinite(Date.parse(failure.observed_at)) || Date.parse(failure.observed_at) !== observed))
+    throw policyError("capacity_continuation_conflict", "Native refusal observation time is invalid or changed");
+  const native = failure.terminal_at && Date.parse(failure.terminal_at);
+  return { policy: CAPACITY_POLICY, ordinal, session_id: failure.session_id, turn_id: failure.turn_id,
+    first_observed_at: firstObservedAt, ...(Number.isFinite(native) && typeof failure.terminal_basis === "string" && failure.terminal_basis ? { native_terminal_at: failure.terminal_at, native_terminal_basis: failure.terminal_basis } : {}) };
+}
+
+export function overloadExhausted(refusals, maxRetries = MAX_OVERLOAD_RETRIES) {
+  if (!Number.isSafeInteger(maxRetries) || maxRetries < 0 || maxRetries > MAX_OVERLOAD_RETRIES) throw policyError("capacity_continuation_conflict", "Invalid retry budget");
+  for (const [index, refusal] of refusals.entries()) {
+    const previous = refusals[index - 1];
+    if (typeof refusal.first_observed_at !== "string" || !Number.isFinite(Date.parse(refusal.first_observed_at))
+      || previous && Date.parse(refusal.first_observed_at) < Date.parse(previous.first_observed_at))
+      throw policyError("capacity_continuation_conflict", "Refusal observation clock reversed or is invalid");
+  }
+  for (const [index, refusal] of refusals.entries()) {
+    if (refusal.policy !== CAPACITY_POLICY) throw policyError("capacity_policy_mismatch", "Retained episode uses another retry policy");
+    const previous = refusals[index - 1];
+    if (refusal.ordinal !== index || previous && (refusal.session_id !== previous.session_id || refusals.slice(0, index).some(item => item.turn_id === refusal.turn_id))) throw policyError("capacity_continuation_conflict", "Refusal chain identity is inconsistent");
+  }
+  return refusals.length > maxRetries ? { policy: CAPACITY_POLICY, reason: "overload_retries_exhausted", attempts: refusals.length, refusals } : null;
+}

package/dist/schemas/flow-run.schema.json

@@ -23,6 +23,10 @@
         "publication_sha256": {"type": "string", "pattern": "^[a-f0-9]{64}$"}
       }
     },
+    "workspace_route": {
+      "type": "object", "additionalProperties": false, "required": ["revision", "sha256"],
+      "properties": {"revision": {"type": "integer", "minimum": 1}, "sha256": {"type": "string", "pattern": "^[a-f0-9]{64}$"}}
+    },
     "execution_bundle": {
       "type": "object", "additionalProperties": false,
       "required": ["schema_id", "manifest_sha256", "descriptor_sha256", "admission_sha256", "flow_id"],

package/dist/services/controller-child-capacity.js

@@ -0,0 +1,13 @@
+/** Only a proven new successful terminal Turn closes a child's retry episode. */
+export function closeSuccessfulChildCapacity(state, children, parentId) {
+    const closed = [];
+    for (const child of children) {
+        const retained = state.child_capacity?.[child.session_id];
+        if (!retained || child.parent_session_id !== parentId || child.provenance === "parent_mismatch"
+            || child.status !== "completed" || !child.terminal_turn_id || child.terminal_turn_id === retained.turn_id)
+            continue;
+        delete state.child_capacity[child.session_id];
+        closed.push(child.session_id);
+    }
+    return closed;
+}

package/dist/services/controller-child-observer.js

@@ -12,6 +12,12 @@ export function retainedChildObserver(input) {
         const provider_error = safeNativeFailure(child.provider_error);
         return { session_id: child.session_id, parent_session_id: child.parent_session_id, status: "failed", source: child.source, terminal_turn_id: child.terminal_turn_id,
             ...(typeof child.terminal_observed_at === "string" && Number.isFinite(Date.parse(child.terminal_observed_at)) ? { terminal_observed_at: child.terminal_observed_at } : {}),
+            ...(child.native_source ? { native_source: child.native_source } : {}),
+            ...(child.native_turn_items ? { native_turn_items: {
+                    ...(typeof child.native_turn_items.observed === "boolean" ? { observed: child.native_turn_items.observed } : {}),
+                    ...(typeof child.native_turn_items.possible_effects === "boolean" ? { possible_effects: child.native_turn_items.possible_effects } : {}),
+                    ...(typeof child.native_turn_items.pending === "boolean" ? { pending: child.native_turn_items.pending } : {})
+                } } : {}),
             ...(provider_error ? { provider_error } : {}) };
     };
     const accept = (children) => {
@@ -26,6 +32,8 @@ export function retainedChildObserver(input) {
             if (sameScope(observation.scope)) {
                 if (Array.isArray(observation.children))
                     accept(observation.children);
+                for (const key of observation.resolved ?? [])
+                    retained.delete(key);
                 if (Object.hasOwn(observation, "gap"))
                     gap = observation.gap ?? null;
             }
@@ -35,23 +43,31 @@ export function retainedChildObserver(input) {
             return;
         input.assertOwner();
         const failed = children.filter(child => child.parent_session_id === input.scope.root_session_id && child.status === "failed" && child.terminal_turn_id && !retained.has(`${child.session_id}:${child.terminal_turn_id}`)).map(normalized);
-        if (!failed.length && !gap)
+        // This is an authoritative current native snapshot. Older failed Turns
+        // remain in the journal/episode history, not in the current-outcome fence.
+        const resolved = [...retained].filter(([, old]) => children.some(child => child.parent_session_id === input.scope.root_session_id
+            && child.provenance !== "parent_mismatch" && child.session_id === old.session_id && ["completed", "failed"].includes(child.status)
+            && child.terminal_turn_id && child.terminal_turn_id !== old.terminal_turn_id)).map(([key]) => key);
+        if (!failed.length && !resolved.length && !gap)
             return;
         const fd = fs.openSync(input.file, "a", 0o600);
         try {
-            fs.writeSync(fd, `${JSON.stringify({ scope: input.scope, children: failed, gap: null })}\n`);
+            fs.writeSync(fd, `${JSON.stringify({ scope: input.scope, children: failed, ...(resolved.length ? { resolved } : {}), gap: null })}\n`);
             fs.fsyncSync(fd);
         }
         finally {
             fs.closeSync(fd);
         }
         accept(failed);
+        for (const key of resolved)
+            retained.delete(key);
         gap = null;
     };
     return {
         failed: () => [...retained.values()],
         gap: () => gap,
         drain: () => pending ?? Promise.resolve(),
+        observeSettledChildren: complete,
         completePostTurn(receipt) {
             const evidence = receipt.evidence;
             const tree = evidence?.subagents;

package/dist/services/controller-execution.js

@@ -27,13 +27,13 @@ export function genericControllerRouting(execution) {
     Object.freeze(policy);
     return {
         kind: "descriptor", policy, profiles, mergeMode: null,
-        transition(stage, fromStage) {
+        transition(stage, fromStage, _currentRun) {
             const selected = execution.stage(stage);
             if (fromStage)
                 execution.stage(fromStage);
             return { ...resolveExecutionPolicy({ ddFlowHome: "", policy, profiles, stage }), session_mode: selected.session_mode };
         },
-        cwd(stage) { execution.stage(stage); return path.resolve(snapshot.scope.workspace); }
+        cwd(stage, _mergeTargetWorkspace, _currentRun) { execution.stage(stage); return path.resolve(snapshot.scope.workspace); }
     };
 }
 /** Restore execution from RUN authority, never from a generic manifest copy.
@@ -77,12 +77,12 @@ export function selectControllerExecution(context, run, manifest) {
     return {
         kind: "sdlc", policy, profiles, bundle: bundle ?? undefined, binding: undefined, legacy,
         mergeMode: legacy.settings.merge_mode,
-        transition(stage, fromStage) {
+        transition(stage, fromStage, currentRun = run) {
             return resolveStageTransition({ ddFlowHome: context.ddFlowHome, policy, profiles, ...(fromStage ? { fromStage } : {}), stage,
-                projectRoot: run.project_root, workspaceRoot: run.workspace_root, stageSessionMode: legacy.settings.stage_session_mode, mergeMode: legacy.settings.merge_mode });
+                projectRoot: currentRun.project_root, workspaceRoot: currentRun.workspace_root, stageSessionMode: legacy.settings.stage_session_mode, mergeMode: legacy.settings.merge_mode });
         },
-        cwd(stage, mergeTargetWorkspace) {
-            return stageExecutionCwd({ stage, projectRoot: run.project_root, workspaceRoot: run.workspace_root, ...(mergeTargetWorkspace ? { mergeTargetWorkspace } : {}) });
+        cwd(stage, mergeTargetWorkspace, currentRun = run) {
+            return stageExecutionCwd({ stage, projectRoot: currentRun.project_root, workspaceRoot: currentRun.workspace_root, ...(mergeTargetWorkspace ? { mergeTargetWorkspace } : {}) });
         }
     };
 }

package/dist/services/external-work-launch.js

@@ -16,7 +16,7 @@ import { reviewExecutionCopyHash, reviewSourceFilter, reviewSourceHash, reviewSo
 import { workspaceGitFiles } from "./workspace-files.js";
 import { qualifyAgyHooks } from "../harness-runtime/lib/dd-agy-daemon.mjs";
 import { lifecycleRetryInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
-import { continueCodexCapacity } from "./codex-capacity.js";
+import { continueProviderCapacity } from "./provider-capacity.js";
 import { errorRecord } from "./run-controller-state.js";
 import { readFlowRunExecutionBundle } from "./runs.js";
 import { stageWorkIds } from "./stage-work-graph.js";
@@ -190,8 +190,6 @@ export async function launchExternalWork(context, input) {
             prompted = await call(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], null);
         }
         catch (error) {
-            if (!["codex-desktop", "opencode-server"].includes(runtimeHarness(resolved.worker)))
-                throw error;
             const retained = context.db.get("SELECT adapter_receipt_json FROM work_launches WHERE operation_id = ?", [operationId]);
             const capacityIntents = retained?.adapter_receipt_json ? JSON.parse(retained.adapter_receipt_json).capacity_intents ?? [] : [];
             const capacityFailures = retained?.adapter_receipt_json ? JSON.parse(retained.adapter_receipt_json).capacity_failures ?? [] : [];
@@ -200,7 +198,7 @@ export async function launchExternalWork(context, input) {
                 if (changed.changes !== 1)
                     throw new AppError("capacity_continuation_blocked", "External Work launch owner changed", 1);
             };
-            const resumed = await continueCodexCapacity({ error, sessionId, operationId: promptOperationId, allowSettledDescendants: true,
+            const resumed = await continueProviderCapacity({ error, sessionId, operationId: promptOperationId, allowSettledDescendants: true,
                 ...(input.signal ? { signal: input.signal } : {}),
                 continuationText: `Continue only Work ${work.work_id} in RUN ${work.run_id}, Stage ${stage ?? "current"}, in the same Session. Inspect its current durable state and the retained Work packet. Never repeat Work start or a completed tool, accepted answer, check or lifecycle command. Use only the current exact issued successor and finish at the original Work boundary.`,
                 retainedIntents: () => capacityIntents,

package/dist/services/frozen-engine.js

@@ -10,8 +10,14 @@ import { shellArgument } from "./runtime-command.js";
 import { hybridDigest } from "./hybrid-contracts.js";
 import { isMemoryInitResourceStorageFacts } from "./memory-init-resource-storage.js";
 import { memoryInitStartupInputSchemas } from "./memory-init-startup-custody.js";
-function storageProbeRefuse(reason) {
-    throw new AppError("frozen_engine_storage_incompatible", "Selected frozen engine cannot admit memory-init storage", 1, { reason, effect: "no_effect" });
+import { SETUP_STARTUP_MS } from "../harness-runtime/lib/setup-progress.mjs";
+function storageProbeRefuse(reason, probe) {
+    throw new AppError("frozen_engine_storage_incompatible", "Selected frozen engine cannot admit memory-init storage", 1, { reason, effect: "no_effect", ...(probe ? { probe } : {}) });
+}
+function probeFailure(result) {
+    const code = result.error?.code ?? null;
+    return { status: result.status, signal: result.signal, error_code: code, timed_out: code === "ETIMEDOUT",
+        timeout_ms: SETUP_STARTUP_MS, stdout_bytes: result.stdout?.length ?? null, stderr_bytes: result.stderr?.length ?? null };
 }
 const hash = (bytes) => crypto.createHash("sha256").update(bytes).digest("hex");
 function refuse(reason) {
@@ -113,8 +119,8 @@ export class AdmittedFrozenEngine {
     /** Qualify actual descriptor handlers in this immutable executable, not the
      * invoking CLI catalog. No storage or productive operation is admitted. */
     admitMemoryInitFlow(source, startupInputSchema) {
-        const fail = (reason) => {
-            throw new AppError("frozen_engine_flow_incompatible", "Selected frozen engine cannot admit memory-init handlers", 1, { reason, phase: "prepare", effect: "no_effect" });
+        const fail = (reason, probe) => {
+            throw new AppError("frozen_engine_flow_incompatible", "Selected frozen engine cannot admit memory-init handlers", 1, { reason, phase: "prepare", effect: "no_effect", ...(probe ? { probe } : {}) });
         };
         const revalidate = () => {
             try {
@@ -147,9 +153,11 @@ export class AdmittedFrozenEngine {
         revalidate();
         const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["NODE_OPTIONS", "NODE_PATH"].includes(key) && !key.startsWith("DD_FLOW_")));
         const result = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "flow", "admit", "--operation", "memory-init", "--json"], { input, cwd: this.#manifest.snapshot_root, env: { ...env, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
-            timeout: 15000, maxBuffer: 1024 * 1024, shell: false, windowsHide: true });
+            // This is cold startup of a selected CLI, not an already-loaded handler.
+            // Admission is bounded local validation; no provider operation is started.
+            timeout: SETUP_STARTUP_MS, maxBuffer: 1024 * 1024, shell: false, windowsHide: true });
         if (result.error || result.signal || result.status !== 0)
-            fail("selected_engine_probe_failed");
+            fail("selected_engine_probe_failed", probeFailure(result));
         revalidate();
         let response;
         try {
@@ -182,9 +190,9 @@ export class AdmittedFrozenEngine {
         revalidateEngine();
         const env = Object.fromEntries(Object.entries(process.env).filter(([key]) => !["NODE_OPTIONS", "NODE_PATH"].includes(key)));
         const result = spawnSync(this.nodeExecutable, [this.entrypoint, "runtime", "storage", "admit", "--operation", "memory-init", "--json"], { env: { ...env, DD_FLOW_HOME: home, DD_FLOW_RESOURCE_HOME: resourceHome, DD_FLOW_ENGINE_MODE: "1", DD_FLOW_ENGINE_HOME: this.#manifest.snapshot_root },
-            timeout: 15000, maxBuffer: 1024 * 1024, shell: false, windowsHide: true });
+            timeout: SETUP_STARTUP_MS, maxBuffer: 1024 * 1024, shell: false, windowsHide: true });
         if (result.error || result.signal || result.status !== 0)
-            storageProbeRefuse("selected_engine_probe_failed");
+            storageProbeRefuse("selected_engine_probe_failed", probeFailure(result));
         revalidateEngine();
         let response;
         try {

package/dist/services/managed-processes.js

@@ -5,6 +5,7 @@ import { spawnSync } from "node:child_process";
 import net from "node:net";
 import { getResourceDatabase } from "../storage/database.js";
 import { AppError, errorRecord } from "../shared/errors.js";
+import { maintenanceRetryable } from "../harness-runtime/lib/lease-renewal.mjs";
 export function managedProcessBinding(record, home) {
     return { resource_home: home, process_id: record.id, registration_sha256: crypto.createHash("sha256").update(JSON.stringify([home, record.id, record.kind, record.owner_id, record.lease_token, record.pid, record.pid_started_at, record.project_id, record.run_id, record.work_id, record.check_id, record.operation_id, record.metadata_json])).digest("hex") };
 }
@@ -203,17 +204,28 @@ export function heartbeatManagedProcess(context, input) {
 }
 export function renewManagedProcess(context, input) {
     prepareManagedProcessHeartbeat(context, input);
-    if (context.resourceDatabaseMode === "prepared_existing")
-        registry(context);
-    const reader = getResourceDatabase(resourceHome(context), "read_existing", context.databaseDeadlineAt);
+    let db;
     try {
-        if (!reader.get("SELECT 1 FROM managed_processes WHERE id=? AND lease_token=? AND state IN ('starting','running','stopping')", [input.id, input.leaseToken]))
-            return { owned: false, process_id: input.id };
+        if (context.resourceDatabaseMode === "prepared_existing")
+            registry(context);
+        const reader = getResourceDatabase(resourceHome(context), "read_existing", context.databaseDeadlineAt);
+        try {
+            if (!reader.get("SELECT 1 FROM managed_processes WHERE id=? AND lease_token=? AND state IN ('starting','running','stopping')", [input.id, input.leaseToken]))
+                return { owned: false, process_id: input.id };
+        }
+        finally {
+            reader.close?.();
+        }
+        db = registry(context);
     }
-    finally {
-        reader.close?.();
+    catch (error) {
+        // No lease mutation has started. The storage helper cannot know that
+        // operation boundary and deliberately defaults to an unknown effect.
+        if (error instanceof AppError && error.code === "process_heartbeat_timeout"
+            && maintenanceRetryable({ ...error, details: { ...error.details, effect: "no_effect" } }))
+            throw new AppError(error.code, error.message, error.exitCode, { ...error.details, effect: "no_effect", maintenance_phase: "renewal_prepare" });
+        throw error;
     }
-    const db = registry(context);
     return db.writeTransaction(() => {
         const now = context.now();
         if (!db.get("SELECT 1 FROM managed_processes WHERE id=? AND lease_token=? AND state IN ('starting','running','stopping')", [input.id, input.leaseToken]))
@@ -228,8 +240,9 @@ export function renewManagedProcess(context, input) {
 /** Read-only lease check for a caller already holding a RUN writer. Renewal
  * must happen before entering that writer, never from this assertion. */
 export function assertManagedProcessLease(context, input) {
-    const reader = getResourceDatabase(resourceHome(context), "read_isolated", context.databaseDeadlineAt);
+    let reader;
     try {
+        reader = getResourceDatabase(resourceHome(context), "read_isolated", context.databaseDeadlineAt);
         const current = reader.get("SELECT pid, lease_expires_at, state FROM managed_processes WHERE id = ? AND lease_token = ?", [input.id, input.leaseToken]);
         if (!current || current.pid !== input.pid || !["starting", "running"].includes(current.state)) {
             throw new AppError("controller_lease_lost", "Managed owner lease changed before productive dispatch", 1, { process_id: input.id });
@@ -237,8 +250,16 @@ export function assertManagedProcessLease(context, input) {
         if (!Number.isFinite(Date.parse(current.lease_expires_at)) || Date.parse(current.lease_expires_at) <= Date.now())
             throw new AppError("controller_lease_unconfirmed", "Managed owner requires renewal before productive dispatch", 1, { process_id: input.id, reason: "renewal_required" });
     }
+    catch (error) {
+        const failure = errorRecord(error);
+        // This assertion only reads. Unavailable observation is not evidence of
+        // owner loss; the caller must reconfirm outside its RUN writer.
+        if (maintenanceRetryable({ ...failure, details: { ...failure.details, effect: "no_effect" } }))
+            throw new AppError("controller_lease_unconfirmed", "Managed owner observation requires confirmation before productive dispatch", 1, { process_id: input.id, reason: "observation_unavailable", cause: failure });
+        throw error;
+    }
     finally {
-        reader.close?.();
+        reader?.close?.();
     }
 }
 export function prepareManagedProcessFinish(context, input) {