@deksden-com/dd-flow-cli 0.9.0-beta.138 → 0.9.0-beta.139

package/dist/services/memory-init-native-capacity.js

@@ -12,6 +12,8 @@ import { readBoundedReleaseFile } from "./release-source.js";
 import { acquireInstallationLock } from "./installation-lock.js";
 import { inspectDaemonOperation } from "../harness-runtime/lib/daemon-operations.mjs";
 import { nativeCommandFingerprint } from "../harness-runtime/lib/native-request-proof.mjs";
+import { continueProviderCapacity } from "./provider-capacity.js";
+import { CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, refusalObservation, terminalProviderOverload } from "../harness-runtime/lib/provider-overload-policy.mjs";
 const sha = (bytes) => createHash("sha256").update(bytes).digest("hex");
 function refuse(reason, effect = "no_effect") {
     throw new AppError("memory_init_native_capacity_required", "Native startup requires its exact qualified probe", 1, { reason, effect, next_action: "reconcile_exact_native_probe" });
@@ -71,17 +73,40 @@ export async function produceMemoryInitNativeCapacity(input) {
             const rootSessionId = adapterSessionId(read(path.join(root, "session-create.json")));
             const inspected = read(path.join(root, "session-inspect.json"));
             const children = rootSessionId && inspected ? normalizeNativeChildren(inspected, rootSessionId) : [];
-            for (const phase of ["daemon-start", "session-create", "session-prompt", "daemon-stop"]) {
-                const operationId = `memory-native:${hybridDigest(identity)}:${phase}`;
+            const promptRoot = `memory-native:${hybridDigest(identity)}:session-prompt`;
+            const intents = fs.readdirSync(root).filter(name => /^capacity-intent-\d+\.json$/.test(name)).map(name => read(path.join(root, name))).sort((a, b) => a.ordinal - b.ordinal);
+            if (intents.length > MAX_OVERLOAD_RETRIES)
+                refuse("probe_capacity_budget_changed", "unknown");
+            const promptPhases = ["session-prompt", ...intents.map(intent => `session-prompt-capacity-${intent.ordinal}`)];
+            for (let index = 0; index < intents.length; index++) {
+                const intent = intents[index];
+                if (intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== promptRoot || intent.session_id !== rootSessionId
+                    || intent.ordinal !== index + 1 || intent.operation_id !== `${promptRoot}:capacity:${index + 1}:session.prompt`
+                    || intent.predecessor !== (index ? intents[index - 1].operation_id : promptRoot))
+                    refuse("probe_capacity_chain_changed", "unknown");
+            }
+            for (const phase of ["daemon-start", "session-create", ...promptPhases, "daemon-stop"]) {
+                const continuation = /^session-prompt-capacity-(\d+)$/.exec(phase);
+                const operationId = continuation ? `${promptRoot}:capacity:${continuation[1]}:session.prompt` : `memory-native:${hybridDigest(identity)}:${phase}`;
                 const observed = await inspectDaemonOperation(path.join(root, "daemon"), operationId).catch(() => null);
                 const fingerprint = read(path.join(root, `${phase}.request-proof.json`));
                 const intent = read(path.join(root, `${phase}.intent.json`));
                 const expected = read(path.join(root, `${phase}.json`));
                 if (!observed || !fingerprint || fingerprint.command_sha256 !== intent?.command_sha256
                     || observed.invocation_sha256 !== fingerprint.command_sha256 || observed.params_sha256 !== fingerprint.params_sha256
-                    || observed.operation_id !== operationId || observed.state !== "completed"
-                    || phase !== "daemon-start" && observed.daemon_id !== start?.daemon_id
-                    || hybridDigest(publicReply(observed.result)) !== hybridDigest(expected))
+                    || observed.operation_id !== operationId
+                    || phase !== "daemon-start" && observed.daemon_id !== start?.daemon_id)
+                    refuse("probe_provider_custody_changed", "unknown");
+                const promptIndex = promptPhases.indexOf(phase);
+                if (promptIndex >= 0 && promptIndex < promptPhases.length - 1) {
+                    const intent = intents[promptIndex];
+                    if (observed.state !== "failed" || !terminalProviderOverload(observed.error, rootSessionId ?? undefined, intent.turn_id)
+                        || intent.refusal?.turn_id !== intent.turn_id || intent.refusal?.session_id !== rootSessionId)
+                        refuse("probe_capacity_predecessor_changed", "unknown");
+                    if (hybridDigest(intent.refusal) !== hybridDigest(refusalObservation(observed.error, promptIndex, intent.refusal.first_observed_at)))
+                        refuse("probe_capacity_refusal_changed", "unknown");
+                }
+                else if (observed.state !== "completed" || hybridDigest(publicReply(observed.result)) !== hybridDigest(expected))
                     refuse("probe_provider_custody_changed", "unknown");
             }
             if (hybridDigest(proof.input) !== hybridDigest(identity) || proof.failure || !rootSessionId
@@ -112,9 +137,8 @@ export async function produceMemoryInitNativeCapacity(input) {
         delete env.DD_FLOW_HOME;
         delete env.DD_FLOW_BIN;
         delete env.DD_FLOW_ENGINE_HOME;
-        const call = async (phase, args, timeoutMs = 120_000) => {
+        const call = async (phase, args, timeoutMs = 120_000, operationId = `memory-native:${hybridDigest(identity)}:${phase}`) => {
             lease.assertOwnership();
-            const operationId = `memory-native:${hybridDigest(identity)}:${phase}`;
             const command = nativeCommandFingerprint({ executable, args: [...args, ...common], cwd: workspace, env, operationId });
             const received = read(path.join(root, `${phase}.json`));
             const intent = read(path.join(root, `${phase}.intent.json`));
@@ -132,6 +156,12 @@ export async function produceMemoryInitNativeCapacity(input) {
                     refuse(`unresolved_${phase}`, "unknown");
                 const observed = await inspectDaemonOperation(stateDir, operationId).catch(() => null);
                 const start = read(path.join(root, "daemon-start.json"));
+                if (args[0] === "session" && args[1] === "prompt" && witness.operation_id === operationId
+                    && observed?.operation_id === operationId && observed.operation === "session.prompt"
+                    && witness.command_sha256 === command && observed.invocation_sha256 === command
+                    && observed.params_sha256 === witness.params_sha256 && observed.daemon_id === start?.daemon_id
+                    && observed.state === "failed" && observed.error)
+                    throw observed.error;
                 if (observed?.operation_id !== operationId || observed.operation !== args.slice(0, 2).join(".")
                     || witness.command_sha256 !== command || observed.invocation_sha256 !== command
                     || observed.params_sha256 !== witness.params_sha256 || !/^[a-f0-9]{64}$/.test(String(observed.params_sha256))
@@ -194,8 +224,33 @@ export async function produceMemoryInitNativeCapacity(input) {
             rootSessionId = adapterSessionId(created);
             if (!rootSessionId)
                 refuse("root_session_identity_missing", "unknown");
-            await call("session-prompt", ["session", "prompt", "--session-id", rootSessionId, "--model", input.profile.model,
-                "--reasoning", input.profile.reasoning, "--prompt", renderCapacityInstructions({ harness: input.profile.harness, maximum: input.maximum })], 180_000);
+            const promptArgs = (text) => ["session", "prompt", "--session-id", rootSessionId, "--model", input.profile.model, "--reasoning", input.profile.reasoning, "--prompt", text];
+            try {
+                await call("session-prompt", promptArgs(renderCapacityInstructions({ harness: input.profile.harness, maximum: input.maximum })), 180_000);
+            }
+            catch (error) {
+                const rootId = `memory-native:${hybridDigest(identity)}:session-prompt`;
+                const retainedIntents = () => fs.readdirSync(root).filter(name => /^capacity-intent-\d+\.json$/.test(name)).map(name => read(path.join(root, name))).sort((a, b) => a.ordinal - b.ordinal);
+                const retainedFailures = () => fs.readdirSync(root).filter(name => /^capacity-failure-\d+\.json$/.test(name)).map(name => read(path.join(root, name))).sort((a, b) => a.ordinal - b.ordinal);
+                const resumed = await continueProviderCapacity({ error, sessionId: rootSessionId, operationId: rootId,
+                    continuationText: "Continue the same technical capacity probe in this Session. Inspect existing direct children first; do not launch replacements or a second child wave. Complete only the originally requested capacity markers.",
+                    allowSettledDescendants: true, assertCurrent: () => lease.assertOwnership(),
+                    inspectOperation: async (id) => await inspectDaemonOperation(stateDir, id),
+                    inspectSession: async () => runHarnessAdapter({ executable, args: ["session", "inspect", "--session-id", rootSessionId, ...common], env, harness: input.profile.harness, cwd: workspace, operationId: `${rootId}:capacity-inspect`, timeoutMs: 30_000 }),
+                    retainedIntents, retainedFailures,
+                    retainIntent: intent => retain(path.join(root, `capacity-intent-${intent.ordinal}.json`), intent),
+                    retainFailure: (_id, refusal) => {
+                        const file = path.join(root, `capacity-failure-${refusal.ordinal}.json`);
+                        const prior = read(file);
+                        if (prior && hybridDigest(prior) !== hybridDigest(refusal))
+                            refuse("probe_capacity_failure_changed", "unknown");
+                        if (!prior)
+                            retain(file, refusal);
+                    },
+                    prompt: (id, text, ordinal) => call(`session-prompt-capacity-${ordinal}`, promptArgs(text), 180_000, id) });
+                if (!resumed)
+                    throw error;
+            }
             inspected = await call("session-inspect", ["session", "inspect", "--session-id", rootSessionId]);
         }
         catch (error) {
@@ -230,7 +285,7 @@ export async function produceMemoryInitNativeCapacity(input) {
             inspected, cleanup, children, capacity: children.length, qualified, ...(failure ? { failure } : {}) };
         if (failure) {
             fs.appendFileSync(path.join(root, "observations.jsonl"), `${JSON.stringify(proof)}\n`, { mode: 0o600 });
-            refuse("probe_operation_unresolved", "unknown");
+            throw new AppError("memory_init_native_capacity_required", "Native startup probe failed or could not be reconciled", 1, { reason: "probe_operation_unresolved", effect: "unknown", next_action: "reconcile_exact_native_probe", primary_error: failure });
         }
         retain(path.join(root, "capacity.json"), proof);
         return await publish(proof);

package/dist/services/memory-init-preflight.js

@@ -243,6 +243,24 @@ function inspect(input, env, ownedPublication = false, qualifyTools = true, obse
         ...(generatedLint ? { generated_lint_config_sha256: generatedLint } : {}),
         ...(toolProbes ? { tool_probes: toolProbes } : {}) };
 }
+/** Check the prepared executable identities, not another version invocation. */
+function reinspect(facts, input, env, ownedPublication, lintReservation) {
+    const tools = { git: executable("git", env), wt: executable("wt", env), "mb-lint": executable("mb-lint", env) };
+    if (facts.tool_probes)
+        for (const name of ["git", "wt", "mb-lint"]) {
+            let checksum;
+            try {
+                checksum = createHash("sha256").update(readBoundedReleaseFile(tools[name], 64 * 1024 * 1024)).digest("hex");
+            }
+            catch {
+                return refuse("target_changed_after_preparation");
+            }
+            if (tools[name] !== facts.tools[name] || checksum !== facts.tool_probes[name]?.executable_sha256)
+                refuse("target_changed_after_preparation");
+        }
+    const current = inspect(input, env, ownedPublication, false, undefined, lintReservation, tools);
+    return facts.tool_probes ? { ...current, tool_probes: facts.tool_probes } : current;
+}
 /** Read-only inventory of the independently selected bootstrap baseline. The
  * publisher/bootstrap must establish owned-publication custody first. This
  * changes no legacy target fact/checksum and never follows a source symlink.
@@ -289,7 +307,7 @@ export class PreparedMemoryInitTarget {
     }
     facts() { return structuredClone(this.#facts); }
     revalidate() {
-        if (hybridDigest(inspect(this.#input, this.#env, false, this.#facts.tool_probes !== undefined, undefined, this.#facts.generated_lint_config_sha256 ? true : undefined)) !== this.sha256)
+        if (hybridDigest(reinspect(this.#facts, this.#input, this.#env, false, this.#facts.generated_lint_config_sha256 ? true : undefined)) !== this.sha256)
             refuse("target_changed_after_preparation");
     }
     /** Only the publisher may use this after independently verifying its CLI-home owner journal.
@@ -297,8 +315,8 @@ export class PreparedMemoryInitTarget {
      * lint policy/owned temporary. User sources, scope, HEAD and tools stay pinned.
      */
     static revalidateOwnedPublication(facts, expectedSha256, env) {
-        if (hybridDigest(facts) !== expectedSha256 || hybridDigest(inspect({ projectRoot: facts.project_root,
-            workspaceRoot: facts.workspace_root, requestId: facts.request_id }, env, true, facts.tool_probes !== undefined, undefined, facts.generated_lint_config_sha256)) !== expectedSha256)
+        if (hybridDigest(facts) !== expectedSha256 || hybridDigest(reinspect(facts, { projectRoot: facts.project_root,
+            workspaceRoot: facts.workspace_root, requestId: facts.request_id }, env, true, facts.generated_lint_config_sha256)) !== expectedSha256)
             refuse("target_changed_after_preparation");
     }
     /** Restore only after the publication service checks its independent journal and root owner.

package/dist/services/memory-init-project-bootstrap.js

@@ -2,7 +2,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { createHash } from "node:crypto";
 import semver from "semver";
-import { AppError } from "../shared/errors.js";
+import { AppError, errorRecord } from "../shared/errors.js";
 import { hybridDigest } from "./hybrid-contracts.js";
 import { FrozenGenericExecution } from "./generic-execution.js";
 import { PreparedMemoryInitTarget } from "./memory-init-preflight.js";
@@ -509,7 +509,7 @@ export class PreparedMemoryInitProjectBootstrap {
         }
         catch (error) {
             throw new AppError("memory_init_engine_bootstrap_failed", "Engine-bound bootstrap retained an incomplete request outcome", 1, { reason: error instanceof AppError ? error.details.reason ?? error.code : "engine_bootstrap_operation_failed",
-                effect: "partial", next_action: "reconcile_exact_request" });
+                effect: "partial", next_action: "reconcile_exact_request", cause: errorRecord(error) });
         }
     }
     apply(context, onCheckpoint) {
@@ -593,7 +593,7 @@ export class PreparedMemoryInitProjectBootstrap {
         }
         catch (error) {
             throw new AppError("memory_init_project_bootstrap_failed", "Project bootstrap retained an incomplete request outcome", 1, { reason: error instanceof AppError ? error.details?.reason ?? error.code : "bootstrap_operation_failed",
-                effect: retained ? "partial" : "no_effect", next_action: "reconcile_exact_request" });
+                effect: retained ? "partial" : "no_effect", next_action: "reconcile_exact_request", cause: errorRecord(error) });
         }
     }
 }

package/dist/services/memory-init-start.js

@@ -22,6 +22,7 @@ import { openMemoryInitStores } from "./memory-init-stores.js";
 import { prepareMemoryInitRequestCandidate } from "./memory-init-request-candidate.js";
 import { prepareMemoryInitHarnessCommands } from "./memory-init-project-bootstrap.js";
 import { readMemoryInitRequestInput } from "./memory-init-request-input.js";
+import { publishSetup } from "../harness-runtime/lib/setup-progress.mjs";
 function refuse(reason) {
     throw new AppError("memory_init_start_invalid", "Memory init requires its exact startup request", 1, { reason, effect: "no_effect", next_action: "reconcile_exact_request" });
 }
@@ -99,10 +100,13 @@ export function prepareMemoryInitFreshRequest(env, scope, input, rawIntake = Buf
     const candidate = prepareMemoryInitRequestCandidate(resolveDdFlowHome(env), scope, materialBytes, rawIntake);
     if (candidate.objective !== raw.objective)
         refuse("raw_intake_objective_mismatch");
+    publishSetup("probe_completed", "memory-init:request-candidate");
     const selection = prepareMemoryInitSelection({ ddFlowHome: resolveDdFlowHome(env), env, now: () => new Date().toISOString() }, scope, raw);
+    publishSetup("probe_completed", "memory-init:selection");
     // A known incompatible delivered reader refuses before candidate/store
     // effects. Historical SDK requests still use their original @1/@2 contract.
     selection.engine.admitMemoryInitFlow(selection.source, "dd-flow/memory-init-startup-input@3");
+    publishSetup("probe_completed", "memory-init:flow-admission");
     const retained = candidate.retain();
     let stores;
     try {
@@ -113,10 +117,12 @@ export function prepareMemoryInitFreshRequest(env, scope, input, rawIntake = Buf
             throw error;
         throw new AppError("memory_init_fresh_preparation_incomplete", "Request candidate remains retained; store admission did not complete", 1, { effect: "partial", request_id: scope.requestId, cause: errorRecord(error), next_action: "reconcile_exact_request" });
     }
+    publishSetup("probe_completed", "memory-init:stores");
     let admitted = false;
     return withStoreCleanup(() => {
         try {
             const prepared = PreparedMemoryInitStartupInput.prepare(stores.context, selection, candidate);
+            publishSetup("probe_completed", "memory-init:startup-input");
             admitted = true;
             return { ...stores, prepared };
         }

package/dist/services/memory-init-worktrunk-capability.js

@@ -8,8 +8,8 @@ import { hybridDigest } from "./hybrid-contracts.js";
 import { PreparedMemoryInitTarget } from "./memory-init-preflight.js";
 import { readBoundedReleaseFile } from "./release-source.js";
 const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
-function refuse(reason) {
-    throw new AppError("memory_init_worktrunk_capability_failed", "Selected Worktrunk cannot create the required workspace", 1, { reason, effect: "no_effect", next_action: "repair_prerequisite_then_retry" });
+function refuse(reason, diagnostics) {
+    throw new AppError("memory_init_worktrunk_capability_failed", "Selected Worktrunk cannot create the required workspace", 1, { reason, effect: "no_effect", next_action: "repair_prerequisite_then_retry", ...(diagnostics ? { tool_probe: diagnostics } : {}) });
 }
 /** Historical custody shape only; it does not run or qualify an executable. */
 export function isMemoryInitWorktrunkCapabilityFacts(value) {
@@ -83,9 +83,15 @@ export class PreparedMemoryInitWorktrunkCapability {
             const run = (file, args) => {
                 ownRoot();
                 unchanged();
+                const started = performance.now();
                 const result = spawnSync(file, args, { cwd: repo, env: probeEnv, shell: false, windowsHide: true, timeout: 5000, maxBuffer: 256 * 1024 });
                 if (result.error || result.signal || result.status !== 0)
-                    refuse("worktrunk_probe_execution_failed");
+                    refuse("worktrunk_probe_execution_failed", {
+                        name: path.basename(file), phase: "workspace_probe", timeout_ms: 5000, elapsed_ms: Math.round(performance.now() - started),
+                        status: result.status, signal: result.signal, error_code: result.error?.code ?? null,
+                        timed_out: result.error?.code === "ETIMEDOUT",
+                        stdout_bytes: result.stdout?.length ?? null, stderr_bytes: result.stderr?.length ?? null
+                    });
                 ownRoot();
                 unchanged();
                 return new TextDecoder("utf-8", { fatal: true }).decode(result.stdout);

package/dist/services/merge-server.js

@@ -1,6 +1,6 @@
 import { managedInvocationContext, managedLifecycleCommand } from "./lifecycle-invocations.js";
 import { stageLifecycleInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
-import { continueCodexCapacity } from "./codex-capacity.js";
+import { continueProviderCapacity } from "./provider-capacity.js";
 import { errorRecord } from "./run-controller-state.js";
 import crypto from "node:crypto";
 import fs from "node:fs";
@@ -164,11 +164,9 @@ async function dispatch(context, input) {
             prompted = await adapterCall(["session", "prompt", "--session-id", sessionId, "--prompt-file", promptFile, ...common], null, `MERGE ${input.request.merge_request_id} Session ${sessionId} is still running`);
         }
         catch (error) {
-            if (!["codex-desktop", "opencode-server"].includes(runtimeHarness(input.profile)))
-                throw error;
             const capacityIntents = (retained.capacity_intents ?? []);
             const capacityFailures = (retained.capacity_failures ?? []);
-            const resumed = await continueCodexCapacity({ error, sessionId, operationId: String(retained.prompt_operation_id), allowSettledDescendants: true,
+            const resumed = await continueProviderCapacity({ error, sessionId, operationId: String(retained.prompt_operation_id), allowSettledDescendants: true,
                 signal: ownership.signal,
                 continuationText: `Continue only MERGE ${input.request.merge_request_id}, Work ${input.request.executor_work_id}, RUN ${input.request.run_id} in this same Session and target ${input.request.target_workspace}. First inspect current durable Stage/Work/MERGE receipts. Never repeat Stage start, accepted answer, completed apply or checks. Follow only the current exact issued successor and stop at the original boundary.`,
                 retainedIntents: () => capacityIntents,

package/dist/services/{codex-capacity.js → provider-capacity.js}

@@ -1,11 +1,14 @@
 import { setTimeout as delay } from "node:timers/promises";
 import crypto from "node:crypto";
-import { CAPACITY_POLICY, capacityBackoff, nativeItemsSettled, normalizeCodexFailure, overloadBurst, parseCapacityOperation, refusalObservation, terminalCodexOverload } from "../harness-runtime/lib/codex-capacity-policy.mjs";
+import { CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, capacityBackoff, nativeItemsSettled, normalizeProviderFailure, overloadExhausted, parseCapacityOperation, refusalObservation, terminalProviderOverload } from "../harness-runtime/lib/provider-overload-policy.mjs";
 import { AppError } from "../shared/errors.js";
 import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
-export function eligibleCodexChildOverload(child, parentSessionId) {
+export function providerChildFailure(child) {
+    return child.provider_failure ?? { code: child.native_source ? "provider_capacity_transient" : "turn_interrupted", details: { native_source: child.native_source, provider_session_id: child.session_id, turn_id: child.terminal_turn_id, native_turn_id: child.terminal_turn_id, terminal_status: child.status, observed_at: child.terminal_observed_at ?? null, provider_error: child.provider_error, native_turn_items: child.native_turn_items } };
+}
+export function eligibleProviderChildOverload(child, parentSessionId) {
     return typeof child.session_id === "string" && child.session_id !== parentSessionId && child.parent_session_id === parentSessionId && child.provenance !== "parent_mismatch" && child.status === "failed" && typeof child.terminal_turn_id === "string" && nativeItemsSettled(child.native_turn_items)
-        && terminalCodexOverload({ code: "turn_interrupted", details: { provider_session_id: child.session_id, turn_id: child.terminal_turn_id, native_turn_id: child.terminal_turn_id, terminal_status: "failed", provider_error: child.provider_error } }, child.session_id, child.terminal_turn_id);
+        && terminalProviderOverload(providerChildFailure(child), child.session_id, child.terminal_turn_id);
 }
 /** A terminal root is not a settled tree. Only the daemon's exact owned tree
  * with a settled root and positively live descendants permits waiting. */
@@ -37,7 +40,7 @@ export function assertCapacityOwnerAdmission(context, record, operationId, bindi
         return;
     const root = parseCapacityOperation(operationId).root;
     const childOrdinal = /:child:[a-f0-9]+:followup:(\d+)$/.exec(root)?.[1];
-    if (childOrdinal && (!Number.isSafeInteger(Number(childOrdinal)) || Number(childOrdinal) < 1 || String(Number(childOrdinal)) !== childOrdinal))
+    if (childOrdinal && (!Number.isSafeInteger(Number(childOrdinal)) || Number(childOrdinal) < 1 || Number(childOrdinal) > MAX_OVERLOAD_RETRIES || String(Number(childOrdinal)) !== childOrdinal))
         throw new AppError("capacity_continuation_conflict", "Invalid native child continuation ordinal", 1);
     if (root === operationId && !childOrdinal)
         return;
@@ -71,7 +74,9 @@ export function assertCapacityOwnerAdmission(context, record, operationId, bindi
                 if (intent)
                     break;
             }
-        if (!intent || intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== root || intent.ordinal !== parsed.ordinal
+        if (intent?.policy && intent.policy !== CAPACITY_POLICY)
+            throw new AppError("capacity_policy_mismatch", "Continuation is pinned to another retry policy", 1);
+        if (!intent || parsed.ordinal > MAX_OVERLOAD_RETRIES || intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== root || intent.ordinal !== parsed.ordinal
             || intent.predecessor !== predecessor || intent.operation_id !== operationId || intent.refusal?.turn_id !== intent.turn_id
             || intent.refusal?.ordinal !== parsed.ordinal - 1 || intent.refusal?.session_id !== intent.session_id
             || !Number.isFinite(Date.parse(intent.not_before)) || Date.parse(intent.not_before) > Date.parse(context.now())
@@ -115,9 +120,13 @@ export function capacityDelay(error, ordinal, now = Date.now()) {
     return capacityBackoff(error, ordinal, now);
 }
 /** Continue a confirmed terminal Turn, never replay its completed effects. */
-export async function continueCodexCapacity(input) {
+export async function continueProviderCapacity(input) {
     let { error, operationId } = input;
     const history = [...(input.retainedIntents?.() ?? [])];
+    if (history.some(intent => intent.policy !== CAPACITY_POLICY) || input.retainedFailures?.().some(refusal => refusal.policy !== CAPACITY_POLICY))
+        throw new AppError("capacity_policy_mismatch", "Retained continuation uses another retry policy", 1);
+    if (history.length > MAX_OVERLOAD_RETRIES)
+        throw new AppError("capacity_continuation_conflict", "Retained episode exceeds its retry budget", 1);
     const parsed = parseCapacityOperation(input.operationId);
     const rootId = parsed.root;
     const text = input.continuationText ?? "Continue the same assigned task in this Session. Check current durable RUN, Work and Stage state first. Never repeat an observed lifecycle command, accepted HITL answer, check or merge apply; use only an exact issued successor. Stop at the assigned boundary.";
@@ -217,9 +226,9 @@ export async function continueCodexCapacity(input) {
                 throw new AppError("capacity_continuation_blocked", "Retained completion cannot be reconciled with its owner boundary", 1);
             return boundary === "paused" || boundary === "completed" ? { provider_session_id: input.sessionId, capacity_decision: boundary } : observed.result;
         }
-        if (observed.state === "failed" && observed.error && !terminalCodexOverload(observed.error, input.sessionId))
+        if (observed.state === "failed" && observed.error && !terminalProviderOverload(observed.error, input.sessionId))
             throw observed.error;
-        if (observed.state !== "failed" || !terminalCodexOverload(observed.error, input.sessionId))
+        if (observed.state !== "failed" || !terminalProviderOverload(observed.error, input.sessionId))
             throw new AppError("operation_observation_lost", "Retained successor outcome is not proven; do not resend", 1, { operation_id: intent.operation_id, primary_error: error, observed });
         operationId = intent.operation_id;
         error = observed.error;
@@ -240,7 +249,7 @@ export async function continueCodexCapacity(input) {
     for (;; ordinal += 1) {
         if (!Number.isSafeInteger(ordinal))
             conflict("Continuation ordinal overflow");
-        if (!terminalCodexOverload(error, input.sessionId)) {
+        if (!terminalProviderOverload(error, input.sessionId)) {
             if (ordinal === 1)
                 return null;
             throw error;
@@ -250,14 +259,14 @@ export async function continueCodexCapacity(input) {
             return completed;
         const prior = await observe(() => input.inspectOperation(operationId));
         const failure = prior.error;
-        const confirmed = normalizeCodexFailure(failure, input.sessionId);
+        const confirmed = normalizeProviderFailure(failure, input.sessionId);
         const turnId = confirmed?.turn_id;
         input.signal?.throwIfAborted();
         input.assertCurrent();
         if (prior.primary_error)
             throw prior.primary_error;
         if (prior.operation_id !== operationId || prior.operation !== "session.prompt" || prior.session_id !== input.sessionId
-            || prior.state !== "failed" || prior.primary_error || !turnId || !terminalCodexOverload(failure, input.sessionId, turnId)) {
+            || prior.state !== "failed" || prior.primary_error || !turnId || !terminalProviderOverload(failure, input.sessionId, turnId)) {
             throw blocked("Retained predecessor does not prove the exact terminal overloaded Turn");
         }
         const readiness = async () => {
@@ -272,7 +281,7 @@ export async function continueCodexCapacity(input) {
         const ready = await readiness();
         if (ready === "unproven")
             throw blocked("Native predecessor readiness is unproven; do not cancel or replay to manufacture proof");
-        const native = normalizeCodexFailure(failure, input.sessionId, turnId);
+        const native = normalizeProviderFailure(failure, input.sessionId, turnId);
         let refusal = refusals.find(item => item.ordinal === ordinal - 1);
         if (refusal && (refusal.turn_id !== turnId || refusal.session_id !== input.sessionId || refusal.policy !== CAPACITY_POLICY))
             conflict("Failure ordinal identifies a different native Turn");
@@ -293,17 +302,26 @@ export async function continueCodexCapacity(input) {
                 input.retainFailure?.(operationId, refusal);
             refusals.push(refusal);
         }
-        const burst = overloadBurst(refusals);
-        if (burst) {
+        const exhausted = overloadExhausted(refusals);
+        if (exhausted) {
             if (input.atomicIntent)
                 input.retainFailure?.(operationId, refusal);
-            throw new AppError("provider_overload_burst", "Two consecutive continuation Turns were overloaded within two minutes", 1, { ...burst, root_operation_id: rootId, provider_session_id: input.sessionId, continuation_count: ordinal - 1, primary_error: failure });
+            throw new AppError("provider_unavailable", "Provider overload retry episode exhausted", 1, { ...exhausted, root_operation_id: rootId, provider_session_id: input.sessionId, continuation_count: ordinal - 1, primary_error: refusals.length ? input.error : failure, last_error: failure });
         }
         const nextId = `${rootId}:capacity:${ordinal}:session.prompt`;
         const existing = history.find(item => item.operation_id === nextId);
         if (existing && (existing.predecessor !== operationId || existing.turn_id !== turnId || existing.prompt_sha256 !== promptSha || existing.ordinal !== ordinal))
             throw error;
-        const wait = existing ? Math.max(0, Date.parse(existing.not_before) - Date.now()) : capacityDelay(failure, ordinal);
+        let wait;
+        try {
+            wait = existing ? Math.max(0, Date.parse(existing.not_before) - Date.now()) : capacityDelay(failure, ordinal);
+        }
+        catch (cause) {
+            if (input.atomicIntent)
+                input.retainFailure?.(operationId, refusal);
+            const metadata = cause;
+            throw new AppError(metadata.code ?? "capacity_retry_metadata_invalid", metadata.message ?? "Invalid provider retry metadata", 1, { ...metadata.details, policy: CAPACITY_POLICY, attempts: refusals.length, root_operation_id: rootId, primary_error: input.error, last_error: failure });
+        }
         if (!Number.isFinite(wait) || Date.now() + wait > 8.64e15 || input.deadline !== undefined && Date.now() + wait >= input.deadline) {
             if (input.atomicIntent)
                 input.retainFailure?.(operationId, refusal);

package/dist/services/recovery-snapshot-database.js

@@ -64,7 +64,7 @@ export function captureRecoveryDatabase(source, output, projectId, runId, protoc
             rules[table] = `${ownProject} AND protocol_id IN (${protocols})`;
         // Relocation proofs are RUN-owned provenance needed to map unchanged context
         // bytes through subsequent recovery generations, not portable live authority.
-        rules.audit_events = `${ownProject} AND (protocol_id IN (${protocols}) OR (event_type = 'flow_run.publication_relocation' AND json_extract(payload_json, '$.run_id') IN (SELECT run_id FROM capture_scope)))`;
+        rules.audit_events = `${ownProject} AND (protocol_id IN (${protocols}) OR (event_type IN ('flow_run.publication_relocation', 'flow_run.workspace_rebound') AND json_extract(payload_json, '$.run_id') IN (SELECT run_id FROM capture_scope)))`;
         // Bootstrap precedes RUN/project allocation: some owning receipts have
         // NULL project_id. Select only the captured MB bundle's independently
         // anchored request/roots, never all bootstrap receipts for this project.

package/dist/services/run-controller-adapter.js

@@ -6,7 +6,7 @@ import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { appendEvent, digest, digestBytes, errorRecord, requireRun } from "./run-controller-state.js";
 import { managedProcessStatus } from "./managed-processes.js";
-import { CAPACITY_POLICY, parseCapacityOperation } from "../harness-runtime/lib/codex-capacity-policy.mjs";
+import { CAPACITY_POLICY, parseCapacityOperation } from "../harness-runtime/lib/provider-overload-policy.mjs";
 import { recoveryObservationBudget } from "./recovery-observation-budget.js";
 import { canonicalNativeOperation } from "../harness-runtime/lib/adapter-timeouts.mjs";
 import { retainedDaemonReply } from "../harness-runtime/lib/daemon-observation.mjs";

package/dist/services/run-controller-recovery.js

@@ -15,7 +15,7 @@ import { managedProcessBinding, managedProcessRuntimeHome, managedProcessStatus,
 import { requireRun, requireController, controllerReceipt, appendEvent, saveState, digest, errorRecord } from "./run-controller-state.js";
 import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
 import { runHarnessAdapter } from "./harness-adapter.js";
-import { continueCodexCapacity } from "./codex-capacity.js";
+import { continueProviderCapacity } from "./provider-capacity.js";
 import { spawnController, recordControllerLauncher } from "./run-controller-process.js";
 import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 import { managedInvocationContext } from "./lifecycle-invocations.js";
@@ -213,12 +213,10 @@ export async function resumeControllerSession(context, row, manifest, state, ass
         receipt = await sendAck(dispatch.operation_id, dispatch.prompt);
     }
     catch (error) {
-        if (!["codex-desktop", "opencode-server"].includes(runtimeHarness(session.profile)))
-            throw error;
         const continuationText = `Continue the same retained Session and recovery generation. First inspect the current RUN recovery state; only if the exact ACK still awaits acceptance, execute the exact standalone acceptance command below once. Never deliver it again after acceptance. Then stop at the original Stage or Work-graph boundary.\n\n${dispatch.prompt}`;
         const inspect = (args, operationId) => runHarnessAdapter({ executable: manifest.adapters[runtimeHarness(session.profile)].executable,
             args, env: controllerEnvironment(executionContext, manifest, session), runtimeOwner: session.owner, operationId, timeoutMs: 30_000 });
-        const resumed = await continueCodexCapacity({ error, sessionId: session.id, operationId: dispatch.operation_id, allowSettledDescendants: true, continuationText,
+        const resumed = await continueProviderCapacity({ error, sessionId: session.id, operationId: dispatch.operation_id, allowSettledDescendants: true, continuationText,
             retainedIntents: () => {
                 const binding = context.db.get("SELECT runtime_dispatch_json FROM run_recovery_bindings WHERE recovery_id = ?", [recovery.recovery_id]);
                 return binding?.runtime_dispatch_json ? JSON.parse(binding.runtime_dispatch_json).capacity_intents ?? [] : [];