@deksden-com/dd-flow-cli 0.9.0-beta.140 → 0.9.0-beta.142

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.142
+
+### Patch Changes
+
+- Wait for the owned OpenCode v2 listener through typed SDK transport startup failures and expose bounded read-only scope inventory batches for validated retirement-proof reuse.
+- Retry no-effect physical confirmation on the same held check, bootstrap or service process before dispatch, without replaying commands or extending exhausted authority.
+
+## 0.9.0-beta.141
+
+### Patch Changes
+
+- 49dbfa3: Retain precise check and startup failures, validate bound browser inactivity proof,
+  and observe test progress without losing diagnostics or rollback guarantees.
+
 ## 0.9.0-beta.140
 
 - Compare observable birth after EPERM so a foreign reused PID is not mistaken for the retained owner; unknown identity remains conservative.

package/dist/build-info.json

@@ -1,8 +1,8 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.140",
-  "cli_commit": "995243962934773092d9d2a127b0e1224baa622d",
-  "built_at": "2026-10-17T10:10:08.823Z",
+  "cli_version": "0.9.0-beta.142",
+  "cli_commit": "a5b068e5cc52809ac0ea0687e40a49f9379bb198",
+  "built_at": "2026-10-18T10:20:25.955Z",
   "built_with_canon": {
     "version": "4.1.2",
     "commit": "1ddedf9d3f086e046f8e7b194c739ec386e7c8b9",

package/dist/cli/command-inputs.js

@@ -156,7 +156,7 @@ export const commandInputs = {
     "run control pause": route(0, `${control} request-id`, "grace-ms wait-ms escalate", "force"),
     "run control stop": route(0, `${control} request-id`, "grace-ms wait-ms escalate", "force"),
     "runtime scope fence": route(0, "scope-id request-id"),
-    "runtime scope status": route(0, "scope-id"),
+    "runtime scope status": route(0, "", "scope-id scope-ids-json"),
     "runtime scope stop": route(0, "scope-id request-id"),
     "runtime scope control": route(0, "scope-id request-id mode", "manifest-json", "", "", { mode: ["pause", "stop"] }),
     "runtime scope serve": route(0, "scope-id generation"),

package/dist/cli/command-option-descriptions.js

@@ -143,6 +143,7 @@ export const runtimeOptionDescriptions = {
     schema: "Registered JSON schema name against which the supplied file is validated.",
     "schema-dir": "Explicit schema directory for validation; not a workflow handler registry or permission to execute code.",
     "scope-id": "Exact retained runtime/EVAL scope identity; operations must not affect neighboring scopes.",
+    "scope-ids-json": "Read-only JSON array of 1..16 unique retained scope IDs; returns ordered fresh inventories without fencing or stopping them.",
     "semantic-file": "Stage semantic result artifact; applicable schema and finish checks are selected independently.",
     session: "Physical Session selector for source-backed usage aggregation.",
     "session-id": "Exact retained physical Session identity for registration, status, stop or usage synchronization.",

package/dist/cli/help.js

@@ -169,6 +169,7 @@ never registers a project, selects a model automatically or creates a runtime DB
     ["runtime scope", `Usage:
   dd-flow runtime scope fence --scope-id EVAL_ID --request-id ID --json
   dd-flow runtime scope status --scope-id EVAL_ID --json
+  dd-flow runtime scope status --scope-ids-json '["EVAL_ID","QUAL_ID"]' --json
   dd-flow runtime scope stop --scope-id EVAL_ID --request-id ID --json
   dd-flow runtime scope control --scope-id EVAL_ID --request-id ID --mode pause|stop [--manifest-json JSON] --json
   dd-flow runtime scope resume --scope-id EVAL_ID --request-id ID --generation N --capture-key SHA256 --json

package/dist/cli/run-cli.js

@@ -92,7 +92,7 @@ import { prepareCommandRoute } from "./command-inputs.js";
 import { parseLifecycleCommand } from "../services/lifecycle-command.js";
 import { dispatchRuntimeProcess, prepareRuntimeProcess } from "./runtime-process.js";
 import { reconcileFlowRunHealth } from "../services/run-health.js";
-import { fenceRuntimeBudget, runtimeBudgetStatus, prepareRuntimeScopeControl, prepareRuntimeScopeFence } from "../services/runtime-budget.js";
+import { fenceRuntimeBudget, runtimeBudgetStatus, prepareRuntimeScopeStatus, prepareRuntimeScopeControl, prepareRuntimeScopeFence } from "../services/runtime-budget.js";
 import { stopRuntimeScope } from "../services/runtime-scope-stop.js";
 import { launchRuntimeScopeControl, launchRuntimeScopeResume, prepareRuntimeScopeReconciliation, prepareRuntimeScopeServing, reconcileRuntimeScopeControl, serveRuntimeScopeControl } from "../services/runtime-scope-worker.js";
 import { prepareRuntimeScopeResumeRequest } from "../services/runtime-scope-resume.js";
@@ -1017,6 +1017,8 @@ async function prepareCliInputValue(args, context, io, scopeProjectRoot, respons
             return prepareError(error, { parameter: "from/output" });
         }
     }
+    if (route.key === "runtime scope status")
+        prepareRuntimeScopeStatus(optionalOption(parsed, "scope-id"), optionalOption(parsed, "scope-ids-json"));
     if (["runtime scope fence", "runtime scope stop"].includes(route.key))
         prepareRuntimeScopeFence(requiredOption(parsed, "scope-id"), requiredOption(parsed, "request-id"));
     if (route.key === "runtime scope resume")
@@ -2778,8 +2780,12 @@ async function dispatchRuntime(context, command, parsed, progress, prepared = {}
             return { ok: true, ...await stopRuntimeScope(context, requiredOption(parsed, "scope-id"), requiredOption(parsed, "request-id")) };
         }
         if (parsed.positional.length === 1 && parsed.positional[0] === "status") {
-            if ([...parsed.options.keys()].some(key => key !== "scope-id") || [...parsed.options.values()].some(values => values.length !== 1))
-                throw new AppError("usage", "Usage: dd-flow runtime scope status --scope-id EVAL_ID", 2);
+            if ([...parsed.options.keys()].some(key => !["scope-id", "scope-ids-json"].includes(key)) || parsed.options.size !== 1 || [...parsed.options.values()].some(values => values.length !== 1))
+                throw new AppError("usage", "Use exactly one of --scope-id or --scope-ids-json", 2);
+            const ids = prepareRuntimeScopeStatus(optionalOption(parsed, "scope-id"), optionalOption(parsed, "scope-ids-json"));
+            if (parsed.options.has("scope-ids-json")) {
+                return { ok: true, scopes: ids.map(id => runtimeBudgetStatus(context, id)) };
+            }
             return { ok: true, ...runtimeBudgetStatus(context, requiredOption(parsed, "scope-id")) };
         }
         if (parsed.positional.length !== 1 || parsed.positional[0] !== "fence" || [...parsed.options.keys()].some(key => !["scope-id", "request-id"].includes(key)) || [...parsed.options.values()].some(values => values.length !== 1))

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -21,7 +21,7 @@ import path from "node:path";
 import { observeModel } from "./model-observations.mjs";
 import { AGY_VERSION_TIMEOUT_MS, AgyError, agyTerminalFailure, assertProfile, executable, observedProfile, runAgy, usageSnapshot } from "./dd-agy.mjs";
 import { settledNativeTree } from "./native-children.mjs";
-import { prepareRuntimeOwner, cleanupFailedStart, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
+import { retainStartupFailure, prepareRuntimeOwner, cleanupFailedStart, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 import { readNativeLines, streamNativeDiagnostics, nativeObservationError, admitNativeRequestBuffer } from "./native-streams.mjs";
 
 const REQUEST_SCHEMA = "dd-agy/daemon-request@1", RESPONSE_SCHEMA = "dd-agy/daemon-response@1", STATE_SCHEMA = "dd-agy/daemon-state@1";
@@ -677,8 +677,12 @@ export async function serveDaemon(stateDir) {
   await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600);
   try { await runtime.start(state.config.resumeSessionId); runtime.requireSessionIdentity(state.config.resumeSessionId); }
   catch (error) {
-    await runtime.abortProvider("daemon_start_failed");
-    await runtime.persist({ shutdown_state: "failed", startup_error: errorPayload(error), active_tree: false }); await runtime.finishResource("failed", "daemon_start_failed");
+    try { await runtime.abortProvider("daemon_start_failed"); }
+    catch (cleanup) { error.details = { ...error.details, cleanup_failed: errorRecord(cleanup) }; }
+    try { if (!error.details?.cleanup_failed) await runtime.finishResource("failed", "daemon_start_failed"); }
+    catch (cleanup) { error.details = { ...error.details, resource_cleanup_failed: errorRecord(cleanup) }; }
+    Object.assign(state, { shutdown_state: error.details?.cleanup_failed || error.details?.resource_cleanup_failed ? "cleanup_failed" : "failed", active_tree: Boolean(error.details?.cleanup_failed) });
+    await retainStartupFailure({ state, publish: snapshot => runtime.persist(snapshot), log: paths.log, error });
     await new Promise(resolve => server.close(resolve));
     throw error;
   }

package/dist/harness-runtime/lib/dd-codex-daemon.mjs

@@ -15,7 +15,7 @@ import { spawn } from "node:child_process";
 import { waitForSettlement } from "./session-settlement.mjs";
 import { errorRecord } from "./operation-errors.mjs";
 import { CODEX_REQUEST_TIMEOUT_MS, LATE_RESPONSE_GRACE_MS, CodexBridge, cancelSessionWithBridge, createSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge, startSessionWithBridge } from "./dd-codex.mjs";
-import { assertDaemonOwnership, prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
+import { assertDaemonOwnership, assertStartupChild, prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
 
 export function codexBridgeEnv(config, daemonId) { return { ...config.env, ...managedFlowEnv(config, daemonId) }; }
 
@@ -94,14 +94,14 @@ export async function startDaemon(options) {
   if (previous?.shutdown_state === "clean") await authorizeRetainedDaemonResume(paths.dir, previous, options.sessionId, config);
   await removeSocket(paths.socket); const resourceProcess = await registerDaemonProcess(config, { kind: "codex-daemon", owner: `codex:${path.basename(paths.dir)}`, operation: `codex-daemon:${path.basename(paths.dir)}`, stdout: paths.log, stderr: paths.log }); const state = { schema_id: stateSchema, daemon_id: randomUUID(), pid: null, cwd: config.cwd, journal: config.journal, config, socket: paths.socket, started_at: new Date().toISOString(), shutdown_state: "starting", sessions: previous?.sessions ?? [], resource_process: resourceProcess }; await writeState(paths.state, state);
   const log = await open(paths.log, "a", 0o600); const child = spawn(process.execPath, [options.entryPath, "daemon", "serve", "--state-dir", paths.dir], { cwd: config.cwd, detached: true, stdio: ["ignore", log.fd, log.fd] }); child.unref(); await log.close();
-  try { await confirmDaemonProcess(config, resourceProcess, child); const startupClock = new ObservationClock({ timeoutMs: SETUP_STARTUP_MS }); const startupProgress = startupObserver(paths.dir, state.daemon_id); while (!startupClock.sample(await startupProgress())) { await new Promise((resolve) => setTimeout(resolve, 100)); try { return await callDaemon(paths.dir, "daemon.status", {}, 5_000); } catch (error) { if (!["daemon_not_running", "daemon_timeout"].includes(error.code)) throw error; } } throw Object.assign(new Error("daemon did not become ready"), { code: "daemon_start_failed", details: observationDetails(startupClock, "daemon-start", child.pid) }); }
+  try { await confirmDaemonProcess(config, resourceProcess, child); const startupClock = new ObservationClock({ timeoutMs: SETUP_STARTUP_MS }); const startupProgress = startupObserver(paths.dir, state.daemon_id); while (!startupClock.sample(await startupProgress())) { assertStartupChild(child, state, await readState(paths.state), paths.log); await new Promise((resolve) => setTimeout(resolve, 100)); try { return await callDaemon(paths.dir, "daemon.status", {}, 5_000); } catch (error) { if (!["daemon_not_running", "daemon_timeout"].includes(error.code)) throw error; } } throw Object.assign(new Error("daemon did not become ready"), { code: "daemon_start_failed", details: observationDetails(startupClock, "daemon-start", child.pid) }); }
   catch (error) { await cleanupFailedDaemonStart(config, resourceProcess, child, error, () => readState(paths.state), state.daemon_id); throw error; }
 }
 export async function stopDaemon(options) { const timeoutMs = options.timeoutMs ?? 30_000; return await confirmDaemonStopped(() => callDaemon(options.stateDir, "daemon.stop", { cancelTree: options.cancelTree === true }, timeoutMs), locations(options.stateDir).socket, timeoutMs, { readState: () => readState(locations(options.stateDir).state) }); }
 
 export async function serveDaemon(stateDir) {
   const paths = locations(stateDir); const state = await readState(paths.state); if (!state || state.schema_id !== stateSchema) throw Object.assign(new Error("daemon state missing"), { code: "daemon_state_missing" });
-  const bridge = new CodexBridge({ ...state.config, env: { ...codexBridgeEnv(state.config, state.daemon_id), CODEX_HOME: process.env.CODEX_HOME, DD_FLOW_CODEX_STATE_DIR: paths.dir } }); await startManagedBridge({ config: state.config, state, bridge, kind: "codex-provider", publish: snapshot => writeState(paths.state, snapshot) }); const sessions = new Set(state.sessions ?? []); let active = null; let server; let persist = Promise.resolve();
+  const bridge = new CodexBridge({ ...state.config, env: { ...codexBridgeEnv(state.config, state.daemon_id), CODEX_HOME: process.env.CODEX_HOME, DD_FLOW_CODEX_STATE_DIR: paths.dir } }); await startManagedBridge({ config: state.config, state, bridge, kind: "codex-provider", publish: snapshot => writeState(paths.state, snapshot), log: paths.log }); const sessions = new Set(state.sessions ?? []); let active = null; let server; let persist = Promise.resolve();
   scheduleDaemonProcessHeartbeat(state.config, state.resource_process);
   const save = (patch = {}) => { Object.assign(state, patch, { pid: process.pid, updated_at: new Date().toISOString(), sessions: [...sessions] }); const snapshot = structuredClone(state); persist = persist.catch(() => {}).then(() => writeState(paths.state, snapshot)); return persist; };
   const dispatch = async (operation, params, operationId) => {

package/dist/harness-runtime/lib/dd-droid-daemon.mjs

@@ -12,7 +12,7 @@ import { durableDaemonDispatch, inspectDaemonOperation, settleDaemonOperation, c
 import { ObservationClock, validateObservationDuration } from "./observation-clock.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
 import { errorRecord } from "./operation-errors.mjs";
-import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess } from "./managed-daemon.mjs";
+import { retainStartupFailure, prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess } from "./managed-daemon.mjs";
 
 const REQUEST = "dd-droid/daemon-request@1", RESPONSE = "dd-droid/daemon-response@1";
 async function removeSocket(file) { try { if (!(await lstat(file)).isSocket()) throw new DroidError("unsafe_socket", "Refusing to replace non-socket daemon path"); await unlink(file); } catch (error) { if (error.code !== "ENOENT") throw error; } }
@@ -123,7 +123,18 @@ export async function serveDaemon(stateDir) {
   }); });
   trackDaemonConnections(server);
   try { await runtime.start(); scheduleDaemonProcessHeartbeat(state.config, state.resource_process); await save({ shutdown_state: "running" }); await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600); }
-  catch (error) { let cleanup; try { cleanup = await runtime.closeTree(true); await removeDroidAuth(state.config); } catch (failure) { await save({ shutdown_state: "cleanup_failed", startup_error: errorRecord(error), cleanup_error: errorRecord(failure) }); throw error; } await save({ shutdown_state: "failed", startup_error: errorRecord(error), cleanup }); await finishDaemonProcess(state.config, state.resource_process, "failed", "startup_failed"); throw error; }
+  catch (error) {
+    let cleanup, cleanupError;
+    try { cleanup = await runtime.closeTree(true); }
+    catch (failure) { cleanupError = errorRecord(failure); error.details = { ...error.details, cleanup_failed: cleanupError }; }
+    try { await removeDroidAuth(state.config); }
+    catch (failure) { error.details = { ...error.details, auth_cleanup_failed: errorRecord(failure) }; }
+    if (!cleanupError) try { await finishDaemonProcess(state.config, state.resource_process, "failed", "startup_failed"); }
+    catch (failure) { error.details = { ...error.details, resource_cleanup_failed: errorRecord(failure) }; }
+    Object.assign(state, { shutdown_state: cleanupError || error.details?.resource_cleanup_failed || error.details?.auth_cleanup_failed ? "cleanup_failed" : "failed", ...(cleanupError ? { cleanup_error: cleanupError } : { cleanup }) });
+    await retainStartupFailure({ state, publish: save, log: paths.log, error });
+    throw error;
+  }
   await new Promise(resolve => server.once("close", resolve));
 }
 import { authorizeRetainedDaemonResume } from "./driver-recovery.mjs";

package/dist/harness-runtime/lib/dd-grok-daemon.mjs

@@ -161,7 +161,7 @@ export async function callDaemon(stateDir, operation, params = {}, timeoutMs = 3
 
 function sameConfig(state, config) { return ["cwd", "journal", "bin", "authSource", "model", "reasoning", "mode", "ddFlowBin", "ddFlowHome", "projectRoot", "sessionArchive", "resourceHome", "noFlow"].every((key) => (state.config?.[key] ?? null) === (config[key] ?? null)); }
 export function grokStartupFailure(state) {
-  if (state?.shutdown_state !== "failed" || !state.startup_error) return null;
+  if (!["failed", "cleanup_failed"].includes(state?.shutdown_state) || !state.startup_error) return null;
   const failure = state.startup_error;
   return new DaemonError(failure.code ?? "daemon_start_failed", failure.message ?? "Grok daemon failed before becoming ready", failure.retryable === true, failure.details);
 }
@@ -462,7 +462,7 @@ export async function serveDaemon(stateDir) {
     const session = runtime.sessions.get(sessionId);
     const rootProviderSessionId = session?.root_provider_session_id ?? sessionId;
     await observeAcpToolCall(state.config, { daemonId: state.daemon_id, rootProviderSessionId, parentProviderSessionId: session?.parent_provider_session_id ?? null, observedProfile: bridge.modelProfiles?.get(sessionId) ?? {} }, message);
-  } }); let initialized; try { initialized = await startManagedBridge({ config: state.config, state, bridge, kind: "grok-provider", publish: snapshot => writeState(paths.state, snapshot) }); } catch (error) { await writeState(paths.state, { ...state, shutdown_state: "failed", startup_error: errorPayload(error) }); throw error; } runtime = new Runtime(paths, state, bridge, initialized);
+  } }); const initialized = await startManagedBridge({ config: state.config, state, bridge, kind: "grok-provider", publish: snapshot => writeState(paths.state, snapshot), log: paths.log }); runtime = new Runtime(paths, state, bridge, initialized);
   for (const fact of await readModelObservations(state.config.journal)) {
     if (fact.harness === "grok-acp" && fact.source?.channel === "x.ai/subagent_spawned" && runtime.sessions.has(fact.session_id)
       && (runtime.descendants.get(fact.session_id)?.attempt_id ?? null) === (fact.source.attempt_id ?? null) && fact.observed?.model) {

package/dist/harness-runtime/lib/dd-opencode-daemon.mjs

@@ -21,7 +21,7 @@ import { writeJsonAtomic } from "./runner-events.mjs";
 import { OpenCodeClient, OpenCodeError, historyDigest, usageSnapshot, nativeModel } from "./dd-opencode.mjs";
 import { safeProviderError } from "./provider-overload-policy.mjs";
 import { acceptNativeHookRequest, hookBudget, readNativeHookFailures } from "./native-hook-command.mjs";
-import { prepareRuntimeOwner, cleanupFailedStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
+import { assertStartupChild, retainStartupFailure, prepareRuntimeOwner, cleanupFailedStart, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 
 const REQUEST_SCHEMA = "dd-opencode/daemon-request@1", RESPONSE_SCHEMA = "dd-opencode/daemon-response@1", STATE_SCHEMA = "dd-opencode/daemon-state@2", ARCHIVE_SCHEMA = "dd-opencode/session-archive@2";
 class DaemonError extends Error { constructor(code, message, retryable = false, details) { super(message); this.code = code; this.retryable = retryable; this.details = details; } }
@@ -114,7 +114,7 @@ async function bootstrapCredentials(config, client) {
   if ((entry || legacy) && !selected) throw new DaemonError("opencode_credentials_unproven", "Selected portable credential is not active in the private server");
   return selected ? "active_private" : "absent";
 }
-async function importArchive(config, client) {
+async function importArchive(config, client, onProgress = async () => {}) {
   if (!config.sessionArchive) return null;
   const manifest = JSON.parse(await readFile(config.sessionArchive, "utf8"));
   if (manifest.schema_id !== ARCHIVE_SCHEMA || !manifest.payload || !/^2\./.test(manifest.opencode_version)) throw new DaemonError("invalid_session_archive", "Use the archived v1 engine for legacy OpenCode archives");
@@ -133,6 +133,7 @@ async function importArchive(config, client) {
     if (info?.id !== transfer.info.id || info.location?.directory !== config.cwd || (info.parentID ?? null) !== (transfer.info.parentID ?? null))
       throw new DaemonError("session_import_unproven", "OpenCode import did not preserve native identity/location");
     records.push({ provider_session_id: info.id, parent_provider_session_id: info.id === root ? null : info.parentID, root_provider_session_id: root, cwd: config.cwd });
+    await onProgress(info.id);
   }
   return records;
 }
@@ -169,10 +170,10 @@ export async function startDaemon(options) {
   const state = { schema_id: STATE_SCHEMA, native_protocol: 2, daemon_id: daemonId, shutdown_state: "starting", active_tree: false, auth_status: config.authStatus, versions: { opencode: config.version }, config, sessions: previous?.sessions ?? [], operations: previous?.operations ?? {}, resource_process: resourceProcess }; await writeJson(paths.state, state);
   const log = await open(paths.log, "a", 0o600), entry = absolute(options.entryPath, "dd-opencode entry"); const child = spawn(process.execPath, [entry, "daemon", "serve", "--state-dir", paths.dir], { cwd: config.cwd, env: isolatedEnv(config), detached: true, stdio: ["ignore", log.fd, log.fd] }); child.unref(); await log.close();
   try { await confirmDaemonProcess(config, resourceProcess, child); const startupClock = new ObservationClock({ timeoutMs: SETUP_STARTUP_MS }); const startupProgress = startupObserver(paths.dir, state.daemon_id); while (!startupClock.sample(await startupProgress())) {
-    if (child.exitCode !== null || child.signalCode !== null) { const failed = await readState(paths.dir); throw Object.assign(new DaemonError("daemon_start_failed", "OpenCode daemon exited before readiness"), { cause: failed?.startup_error }); }
+    assertStartupChild(child, state, await readState(paths.dir), paths.log);
     await new Promise(resolve => setTimeout(resolve, 100)); try { return await callDaemon(paths.dir, "daemon.status", {}, 1000); } catch (error) { if (!["daemon_not_running","daemon_timeout"].includes(error.code)) throw error; }
   } throw Object.assign(new DaemonError("daemon_start_failed", "daemon did not become ready", true), { details: observationDetails(startupClock, 'daemon-start', child.pid) }); }
-  catch (error) { await cleanupFailedStart(config, resourceProcess, child, error); throw error; }
+  catch (error) { await cleanupFailedDaemonStart(config, resourceProcess, child, error, () => readState(paths.dir), daemonId); throw error; }
 }
 export const stopDaemon = async options => { const timeoutMs = options.timeoutMs ?? 30_000; return await confirmDaemonStopped(() => callDaemon(options.stateDir, "daemon.stop", { cancelTree: options.cancelTree === true }, timeoutMs), locations(options.stateDir).socket, timeoutMs, { readState: () => readState(options.stateDir) }); };
 
@@ -358,9 +359,9 @@ export class Runtime {
     }
     if (operation === "daemon.doctor") {
       const info = await this.client.health();
+      if (info.pid !== this.child?.pid || info.version !== this.state.versions.opencode) throw new DaemonError("foreign_server", "OpenCode endpoint is not the owned process");
       await this.client.call("model.list", { location: { directory: this.state.config.cwd } });
       const plugins = await this.client.call("plugin.list", { location: { directory: this.state.config.cwd } });
-      if (info.pid !== this.child?.pid || info.version !== this.state.versions.opencode) throw new DaemonError("foreign_server", "OpenCode endpoint is not the owned process");
       const pluginID = this.state.config.noFlow ? "dd-flow-security" : "dd-flow";
       if (!plugins.data.some(plugin => plugin.id === pluginID && plugin.state?.status === "active")) throw new DaemonError("opencode_plugin_missing", "Owned v2 plugin is not active");
       return { compatible: true, native_protocol: 2, observed_runtime: this.state.versions, productive_hooks: !this.state.config.noFlow, versions: this.state.versions, plugin_sha256: this.state.config.pluginSha256, auth_status: this.state.auth_status };
@@ -459,6 +460,56 @@ export class Runtime {
     throw new DaemonError("unknown_operation", `unknown daemon operation: ${operation}`);
   }
 }
+
+/** Read-only readiness probes share the startup quiet window. A repeated
+ * ServiceUnavailable response is not activation progress. */
+export async function awaitOpenCodeStartup(client, state, child, { timeoutMs = SETUP_STARTUP_MS, publish = async () => {} } = {}) {
+  const clock = new ObservationClock({ timeoutMs });
+  let phase = "server", attempt = 0; const observedPhases = new Set();
+  const mark = async value => {
+    if (state.startup_phase === value) return;
+    state.startup_phase = value; await publish(state);
+    if (!observedPhases.has(value)) { observedPhases.add(value); clock.sample(value); }
+  };
+  const remaining = () => {
+    if (clock.sample()) throw new DaemonError("daemon_start_failed", "OpenCode startup made no further progress", false, observationDetails(clock, "native-readiness", child?.pid));
+    if (child && (child.exitCode !== null || child.signalCode !== null)) throw new DaemonError("opencode_unavailable", "Owned OpenCode process exited during startup", false, { exit_code: child.exitCode, signal: child.signalCode });
+    return Math.max(1, Math.ceil(clock.timeoutMs - clock.elapsed));
+  };
+  client.readObservation = () => ({ timeoutMs: remaining() });
+  try {
+    while (true) {
+      remaining();
+      try {
+        if (phase === "server") {
+          const identity = await client.health({ timeoutMs: remaining() });
+          if (identity.pid !== child?.pid || identity.version !== state.versions.opencode) throw new DaemonError("foreign_server", "OpenCode startup returned another server");
+          await mark("owned_server_ready"); phase = "location";
+        }
+        if (phase === "location") {
+          await client.call("model.list", { location: { directory: state.config.cwd } });
+          await mark("location_models_ready"); phase = "plugin";
+        }
+        const plugins = await client.call("plugin.list", { location: { directory: state.config.cwd } });
+        if (!Array.isArray(plugins?.data)) throw new DaemonError("opencode_configuration_invalid", "OpenCode returned invalid plugin readiness");
+        const id = state.config.noFlow ? "dd-flow-security" : "dd-flow", plugin = plugins.data.find(value => value.id === id);
+        if (["failed", "error", "missing", "disabled"].includes(plugin?.state?.status)) throw new DaemonError("opencode_plugin_failed", "Required owned plugin failed activation", false, { plugin_id: id, status: plugin.state.status });
+        if (plugin?.state?.status === "active") { await mark("required_plugin_active"); return { remaining, clock }; }
+        // A status transition of this required plugin is real new evidence.
+        if (["loading", "activating", "registered"].includes(plugin?.state?.status)) await mark(`required_plugin_${plugin.state.status}`);
+      } catch (error) {
+        const transient = error.code === "opencode_unavailable" && error.retryable === true
+          // Safe pre-identity reads use the normalized observation category,
+          // not a version-specific SDK error wrapper. No productive RPC here.
+          && (phase === "server" || error.details?.native_type === "ServiceUnavailableError");
+        if (!transient) throw error;
+      }
+      const pause = Math.min([250, 500, 1000, 2000][Math.min(attempt++, 3)], remaining());
+      await new Promise(resolve => setTimeout(resolve, pause));
+    }
+  } catch (error) { delete client.readObservation; throw error; }
+}
+
 export async function serveDaemon(stateDir) {
   const paths = locations(stateDir), state = await readState(paths.dir); if (state?.schema_id !== STATE_SCHEMA) throw new DaemonError("daemon_state_missing", "daemon state is missing");
   let child, providerProcess;
@@ -470,13 +521,14 @@ export async function serveDaemon(stateDir) {
     scheduleDaemonProcessHeartbeat(state.config, state.resource_process);
     scheduleDaemonProcessHeartbeat(state.config, providerProcess);
     state.provider_process = providerProcess; state.provider_pid = child.pid; await writeJson(paths.state, state);
-    const client = new OpenCodeClient({ baseUrl: `http://127.0.0.1:${port}`, password: state.config.password, directory: state.config.cwd }); const startupProgress = startupObserver(paths.dir, state.daemon_id); const startupClock = new ObservationClock({ timeoutMs: SETUP_STARTUP_MS }); while (!startupClock.sample(await startupProgress())) { try { await client.health(); break; } catch { await new Promise(resolve => setTimeout(resolve, 100)); } }
-    const identity = await client.health();
-    if (identity.pid !== child.pid || identity.version !== state.versions.opencode) throw new DaemonError("foreign_server", "OpenCode startup returned another server");
+    const client = new OpenCodeClient({ baseUrl: `http://127.0.0.1:${port}`, password: state.config.password, directory: state.config.cwd });
+    const startup = await awaitOpenCodeStartup(client, state, child, { publish: snapshot => writeJson(paths.state, snapshot) });
     state.auth_status = await bootstrapCredentials(state.config, client);
-    const imported = await importArchive(state.config, client); if (imported) state.sessions.push(...imported);
+    state.startup_phase = "credentials_ready"; await writeJson(paths.state, state); startup.clock.sample(state.startup_phase);
+    const imported = await importArchive(state.config, client, async id => { state.startup_phase = `session_imported:${id}`; await writeJson(paths.state, state); startup.clock.sample(state.startup_phase); }); if (imported) state.sessions.push(...imported);
+    startup.remaining(); delete client.readObservation;
     await chmod(state.config.database, 0o600);
-    const runtime = new Runtime(paths, state, client, child, providerProcess); await runtime.dispatch("daemon.doctor", {}); await removeSocket(paths);
+    const runtime = new Runtime(paths, state, client, child, providerProcess); await removeSocket(paths);
     const server = net.createServer(connection => {
       connection.setEncoding("utf8"); let buffer = "", consumed = false;
       connection.on("data", chunk => {
@@ -499,8 +551,8 @@ export async function serveDaemon(stateDir) {
     trackDaemonConnections(server); runtime.server = server;
     await new Promise((resolve, reject) => { server.once("error", reject); server.listen(paths.socket, resolve); }); await chmod(paths.socket, 0o600); await runtime.persist({ shutdown_state: "running", active_tree: false, server_port: port }); return await new Promise(() => {});
   } catch (error) {
-    await writeJson(paths.state, { ...state, startup_error: errorPayload(error) });
-    await cleanupFailedStart(state.config, providerProcess, child, error); throw error;
+    await cleanupFailedStart(state.config, providerProcess, child, error);
+    await retainStartupFailure({ state, publish: snapshot => writeJson(paths.state, snapshot), log: paths.log, error }); throw error;
   }
 }
 import { authorizeRetainedDaemonResume } from "./driver-recovery.mjs";

package/dist/harness-runtime/lib/dd-opencode.mjs

@@ -51,7 +51,7 @@ export class OpenCodeClient {
   async call(method, input, { timeoutMs, progress, onDispatched, productive = false, signal } = {}) {
     const observation = this.readObservation?.();
     timeoutMs ??= observation?.timeoutMs ?? this.timeoutMs; progress ??= observation?.progress;
-    const api = await this.ready, controller = new AbortController();
+    const controller = new AbortController();
     let timer;
     const abort = () => { controller.abort(); clearInterval(timer); };
     signal?.addEventListener("abort", abort, { once: true });
@@ -59,6 +59,13 @@ export class OpenCodeClient {
     timer = observedTimeout(() => controller.abort(), timeoutMs, { progress });
     if (signal?.aborted) clearInterval(timer);
     try {
+      // Cover initialization as well as RPC. Abort still reaches the owned
+      // request; an unresolved module import cannot start a late RPC.
+      let rejectAbort;
+      const aborted = new Promise((_, reject) => { rejectAbort = () => reject(Object.assign(new Error("OpenCode probe aborted"), { name: "AbortError" })); controller.signal.addEventListener("abort", rejectAbort, { once: true }); });
+      let api;
+      try { if (controller.signal.aborted) rejectAbort(); api = await Promise.race([this.ready, aborted]); }
+      finally { controller.signal.removeEventListener("abort", rejectAbort); }
       const keys = method.split("."), name = keys.pop(), domain = keys.reduce((value, key) => value?.[key], api);
       if (typeof domain?.[name] !== "function") throw new OpenCodeError("opencode_capability_missing", `OpenCode v2 does not expose ${method}`);
       const options = { signal: controller.signal };
@@ -70,13 +77,15 @@ export class OpenCodeClient {
       if (cause._tag === "SessionNotFoundError" || cause._tag === "NotFoundError") throw new OpenCodeError("session_not_found", "OpenCode native Session is unavailable");
       if (productive && ["InvalidRequestError", "ConflictError", "UnauthorizedError", "ForbiddenError"].includes(cause._tag))
         throw new OpenCodeError("opencode_admission_rejected", "OpenCode rejected native admission", false, { effect: "no_effect", native_type: cause._tag });
+      if (!productive && ["UnauthorizedError", "ForbiddenError"].includes(cause._tag)) throw new OpenCodeError("opencode_auth_rejected", "OpenCode rejected authentication", false, { method, native_type: cause._tag });
+      if (!productive && ["InvalidRequestError", "ConflictError"].includes(cause._tag)) throw new OpenCodeError("opencode_configuration_invalid", "OpenCode rejected the diagnostic request", false, { method, native_type: cause._tag });
       if (productive || controller.signal.aborted) throw Object.assign(lost(`OpenCode observer lost during ${method}`, { method }), { cause });
       throw Object.assign(new OpenCodeError("opencode_unavailable", `OpenCode ${method} observation failed`, true,
         { method, native_type: cause._tag ?? cause.name ?? null, native_reason: cause.reason ?? null }), { cause });
     } finally { clearInterval(timer); signal?.removeEventListener("abort", abort); }
   }
-  async health() {
-    const info = await this.call("server.info", undefined, { timeoutMs: 5_000 });
+  async health(options = {}) {
+    const info = await this.call("server.info", undefined, { timeoutMs: 5_000, ...options });
     if (!/^2\./.test(info?.version) || !Number.isInteger(info.pid)) throw new OpenCodeError("unsupported_version", "OpenCode v2 server identity is unavailable");
     return info;
   }

package/dist/harness-runtime/lib/dd-zcode-daemon.mjs

@@ -10,7 +10,7 @@ import { chmod, lstat, mkdir, open, readFile, rename, unlink, writeFile } from "
 import net from "node:net";
 import { durableDaemonDispatch, completeDaemonShutdown, commitDaemonShutdown, assertDaemonDispatch, assertDaemonRestartable, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon } from "./daemon-operations.mjs";
 import path from "node:path";
-import { prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
+import { assertStartupChild, prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
 import { acceptNativeHookRequest, hookBudget, readNativeHookFailures } from "./native-hook-command.mjs";
 import { parseLifecycleCommand, continuationCommand } from "./lifecycle-command.mjs";
 import { errorRecord, isProvenShellCorrection } from "./operation-errors.mjs";
@@ -186,6 +186,7 @@ export async function startDaemon(options) {
     await confirmDaemonProcess(config, resourceProcess, child);
     const startupClock = new ObservationClock({ timeoutMs: SETUP_STARTUP_MS }); const startupProgress = startupObserver(paths.dir, state.daemon_id);
     while (!startupClock.sample(await startupProgress())) {
+      assertStartupChild(child, state, await readState(paths.dir), paths.log);
       await new Promise((resolve) => setTimeout(resolve, 100));
       try { return await callDaemon(paths.dir, "daemon.status", {}, 1000); }
       catch (error) { if (error.code !== "daemon_not_running" && error.code !== "daemon_timeout") throw error; }
@@ -704,7 +705,7 @@ export async function serveDaemon(stateDir) {
   const state = await readState(paths.dir);
   if (!state || state.schema_id !== STATE_SCHEMA) throw new DaemonError("daemon_state_missing", "daemon state is missing or incompatible");
   const bridge = new AcpBridge({ ...state.config, env: zcodeBridgeEnv(state.config, state.daemon_id) });
-  const initialized = await startManagedBridge({ config: state.config, state, bridge, kind: "zcode-provider", publish: snapshot => writeState(paths.state, snapshot) });
+  const initialized = await startManagedBridge({ config: state.config, state, bridge, kind: "zcode-provider", publish: snapshot => writeState(paths.state, snapshot), log: paths.log });
   const runtime = new DaemonRuntime(paths, state, bridge, initialized);
   scheduleDaemonProcessHeartbeat(state.config, state.resource_process);
   await removeSocket(paths.socket, paths.dir);

package/dist/harness-runtime/lib/managed-daemon.d.mts

@@ -11,3 +11,6 @@ export function finishDaemonProcess(config: RuntimeConfig, record: ProcessBindin
 export function cleanupFailedDaemonStart(config: RuntimeConfig, record: ProcessBinding | null, child: ChildProcess | null, original: Error & { details?: Record<string, unknown> }, readState: () => Promise<Record<string, unknown>>, daemonId: string): Promise<void>;
 export function completeBudgetOperation(stateDir: string, request: { id: string; operation: string; params?: { sessionId?: string } }, result: unknown, observe?: () => Promise<Record<string, unknown>>): Promise<Record<string, unknown>>;
 export function stopProcessGroup(child: ChildProcess | null | undefined, graceMs?: number, options?: { detached?: boolean; settlementMs?: number }): Promise<void>;
+export function assertStartupChild(child: Pick<ChildProcess, "pid" | "exitCode" | "signalCode">, expected: Record<string, unknown>, observed: Record<string, unknown> | null, log: string): void;
+export function retainStartupFailure(input: { state: Record<string, unknown>; publish: (state: Record<string, unknown>) => Promise<unknown>; log: string; error: Error & { code?: string; details?: Record<string, unknown> } }): Promise<void>;
+export function startManagedBridge(input: { config: RuntimeConfig; state: Record<string, unknown>; bridge: { child: ChildProcess | null; options: { onSpawn?: (child: ChildProcess) => Promise<void> }; start: () => Promise<unknown> }; kind: string; publish: (state: Record<string, unknown>) => Promise<unknown>; log?: string }): Promise<unknown>;

package/dist/harness-runtime/lib/managed-daemon.mjs

@@ -1,8 +1,8 @@
-import { lstat, readFile, readdir, mkdir } from "node:fs/promises";
+import { lstat, readFile, readdir, mkdir, appendFile } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import path from "node:path";
 import { commandJson } from "./process-json.mjs";
-import { errorRecord } from "./operation-errors.mjs";
+import { errorRecord, reportedError, diagnosticJson } from "./operation-errors.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
 import { runBoundedCommand } from "./native-hook-command.mjs";
 import { createRenewalState, maintenanceRetryable, renewalConfirmed, renewalDelay, renewalFailure, renewalRemaining, RENEWAL_POLICY } from "./lease-renewal.mjs";
@@ -352,11 +352,12 @@ export async function confirmDaemonProcess(config, record, child) {
 
 /** Provider bridges use a different process group from their daemon. Publish
  * the exact binding before initialize can start productive provider traffic. */
-export async function startManagedBridge({ config, state, bridge, kind, publish }) {
-  state.pid = process.pid;
-  await publish(state);
-  const provider = config.runtime_owner ? await registerDaemonProcess(config, { kind, owner: config.runtime_owner.owner_id, operation: kind }) : null;
+export async function startManagedBridge({ config, state, bridge, kind, publish, log }) {
+  let provider;
   try {
+    state.pid = process.pid;
+    await publish(state);
+    provider = config.runtime_owner ? await registerDaemonProcess(config, { kind, owner: config.runtime_owner.owner_id, operation: kind }) : null;
     state.provider_process = provider;
     state.startup_phase = "owner_registered";
     await publish(state);
@@ -372,7 +373,35 @@ export async function startManagedBridge({ config, state, bridge, kind, publish
     await publish(state);
     return initialized;
   }
-  catch (error) { await cleanupFailedStart(config, provider, bridge.child, error); throw error; }
+  catch (error) {
+    await cleanupFailedStart(config, provider, bridge.child, error);
+    state.shutdown_state = error.details?.cleanup_failed ? "cleanup_failed" : "failed";
+    await retainStartupFailure({ state, publish, log, error });
+    throw error;
+  }
+}
+
+/** A retained cause belongs to this startup generation, never a previous PID. */
+export function assertStartupChild(child, expected, observed, log) {
+  const sameGeneration = observed?.daemon_id === expected.daemon_id && (observed?.generation ?? null) === (expected.generation ?? null)
+    && (observed?.config?.runtime_owner?.owner_id ?? null) === (expected.config?.runtime_owner?.owner_id ?? null)
+    && (observed?.config?.runtime_owner?.operation_id ?? null) === (expected.config?.runtime_owner?.operation_id ?? null);
+  if (sameGeneration && observed?.startup_error) throw reportedError(observed.startup_error, "Native startup failed");
+  if (child.exitCode !== null || child.signalCode !== null) throw Object.assign(new Error("Native daemon exited before readiness"), {
+    code: "daemon_start_failed", retryable: false, details: { daemon_id: expected.daemon_id,
+      pid: child.pid ?? null, exit_code: child.exitCode, signal: child.signalCode, daemon_log: log }
+  });
+}
+
+export async function retainStartupFailure({ state, publish, log, error }) {
+  state.startup_error = JSON.parse(diagnosticJson(errorRecord(error)));
+  try { await publish(state); }
+  catch (publication) {
+    error.details = { ...error.details, startup_publication_error: errorRecord(publication), daemon_log: log };
+    // No credentials/config/argv: the log is only a bounded error record fallback.
+    try { if (log) await appendFile(log, `${diagnosticJson({ daemon_id: state.daemon_id, startup_error: errorRecord(error) })}\n`, { mode: 0o600 }); }
+    catch (logging) { error.details.startup_log_error = errorRecord(logging); }
+  }
 }
 
 export async function closeManagedBridge(config, state, bridge) {

package/dist/harness-runtime/lib/operation-errors.d.mts

@@ -9,6 +9,8 @@ export interface ErrorRecord {
   cleanup_error?: ErrorRecord;
 }
 export function errorRecord(error: unknown, depth?: number): ErrorRecord;
+export function redactDiagnostic(value: string): string;
+export function diagnosticJson(value: unknown): string;
 export function isObservationLoss(error: unknown): boolean;
 export function isProvenShellCorrection(error: unknown): boolean;
 export function reportedError(value: Record<string, unknown>, fallback: string): Error & ErrorRecord;

package/dist/harness-runtime/lib/operation-errors.mjs

@@ -1,5 +1,16 @@
 // An observer losing its response does not establish that a provider Turn failed.
 export const OPERATION_ERROR_CONTRACT_VERSION = "operation-errors@2";
+export function redactDiagnostic(value) {
+  return value.replace(/\b(Bearer|Basic)\s+[^\s"']+/gi, "$1 <redacted>")
+    .replace(/(^|[^\w-])([\w-]+)(["']?\s*[=:]\s*["']?)([^\s"',;&}]+)/g,
+      (whole, prefix, key, separator) => /token|secret|password|api[_-]?key|authorization/i.test(key)
+        ? `${prefix}${key}${separator}<redacted>` : whole)
+    .replace(/(\b[A-Za-z][A-Za-z0-9+.-]{0,31}:\/\/)[^\s/:@]+:[^\s/@]+@/g, "$1<redacted>@");
+}
+export function diagnosticJson(value) {
+  return JSON.stringify(value, (key, item) => /token|secret|password|api[_-]?key|authorization/i.test(key)
+    ? "<redacted>" : typeof item === "string" ? redactDiagnostic(item) : item, 2);
+}
 // Only use after the native delivery/operation owner has been verified.
 export function isProvenShellCorrection(error) {
   const details = error?.details;