@deksden-com/dd-flow-cli 0.9.0-beta.142 → 0.9.0-beta.143

package/CHANGELOG.md

@@ -1,11 +1,21 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.143
+
+### Patch Changes
+
+- 60daf29: Keep an early AGY provider rejection as the readiness failure rather than a stream-drain cleanup failure. Preserve strict journal and physical cleanup errors.
+- d86445c: Observe accepted Codex Turns while persisted history is unavailable, preserving exact native outcomes, cancellation identity and conservative tree settlement. Keep RPC errors intact in compact journals.
+
+  Treat successful metadata-only history responses as incomplete in cancellation and final result admission; require exact current Turn item evidence before bypassing retained-output/profile safeguards. Reject incomplete cancellation records and terminal settlement without a valid Turn identity. Prefer native completed output over stale snapshots of the same Turn.
+
 ## 0.9.0-beta.142
 
 ### Patch Changes
 
 - Wait for the owned OpenCode v2 listener through typed SDK transport startup failures and expose bounded read-only scope inventory batches for validated retirement-proof reuse.
 - Retry no-effect physical confirmation on the same held check, bootstrap or service process before dispatch, without replaying commands or extending exhausted authority.
+- Backfilled from published artifact commit `19ca01d6`: Keep native Session observation stable, use bounded shared Codex read phases, scope check evidence to declared inputs, retain accepted intake/HITL review sources, and reject stale review coverage without productive replay. These changes were already shipped; beta.143 does not count them as new work.
 
 ## 0.9.0-beta.141
 

package/dist/build-info.json

@@ -1,15 +1,15 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.142",
-  "cli_commit": "a5b068e5cc52809ac0ea0687e40a49f9379bb198",
-  "built_at": "2026-10-18T10:20:25.955Z",
+  "cli_version": "0.9.0-beta.143",
+  "cli_commit": "2294710b9c9b678193798301d5a81048506d672d",
+  "built_at": "2026-10-20T02:52:47.825Z",
   "built_with_canon": {
     "version": "4.1.2",
-    "commit": "1ddedf9d3f086e046f8e7b194c739ec386e7c8b9",
+    "commit": "a1cfe8b06329c691c314064b6ea6a3da6628cceb",
     "flow_contract": "dd-flow-canonical-2026-08",
-    "repo_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-cp231-release",
-    "memorybank_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-cp231-release/.memory-bank",
-    "flow_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-cp231-release/.memory-bank/dd-flow",
+    "repo_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-plan092",
+    "memorybank_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-plan092/.memory-bank",
+    "flow_root": "/Users/deksden/Documents/_Projects/_worktrees/dd-canon-plan092/.memory-bank/dd-flow",
     "layout": "dot_memory_bank"
   }
 }

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -294,7 +294,7 @@ export class Runtime {
     let allowProviderFinalization;
     const providerRegistered = new Promise(resolve => { allowProviderFinalization = resolve; });
     const observationFailure = error => { this.drainingError ??= error; readyReject(error); this.active?.reject(error); };
-    this.nativeDrain = readNativeLines(this.child.stdout, line => { this.buffer = `${line}\n`; return this.draining = this.drain(readyResolve); }, observationFailure);
+    this.nativeDrain = readNativeLines(this.child.stdout, line => { this.buffer = `${line}\n`; return this.draining = this.drain(readyResolve, readyReject); }, observationFailure);
     this.diagnostics = streamNativeDiagnostics(this.child.stderr, chunk => this.journal("stderr", { text: chunk }), observationFailure);
     this.child.on("error", error => { readyReject(error); if (this.active) { this.active.reject(error); this.active = null; } });
     // A dead leader is not yet a finalized tree: stop must also join the
@@ -329,7 +329,7 @@ export class Runtime {
     try { return await Promise.race([this.readyPromise, new Promise((_, reject) => { readyTimer = observedTimeout(() => reject(new DaemonError("agy_init_timeout", "Antigravity init timed out", true)), SETUP_STARTUP_MS, { progress: () => this.lastActivityAt }); })]); }
     finally { clearTimeout(readyTimer); }
   }
-  async drain(readyResolve) { let index; while ((index = this.buffer.indexOf("\n")) >= 0) { const line = this.buffer.slice(0, index).trim(); this.buffer = this.buffer.slice(index + 1); if (!line) continue; let event; try { event = JSON.parse(line); } catch { await this.journal("invalid_json", { line: line.slice(0, 1000) }); continue; }
+  async drain(readyResolve, readyReject) { let index; while ((index = this.buffer.indexOf("\n")) >= 0) { const line = this.buffer.slice(0, index).trim(); this.buffer = this.buffer.slice(index + 1); if (!line) continue; let event; try { event = JSON.parse(line); } catch { await this.journal("invalid_json", { line: line.slice(0, 1000) }); continue; }
     // Record an early provider rejection before journalling: a short-lived
     // child can close while the asynchronous write is still pending.
     if (event.event === "result" && ["ERROR", "CANCELLED"].includes(event.result?.status)) {
@@ -344,7 +344,12 @@ export class Runtime {
     }
     this.observeProviderActivity(event);
     if (event.event === "result" && this.init && !this.startupError) { await this.finishTurn(event.result ?? {}, event.terminal_metadata, event); continue; }
-    await this.journal("provider_event", { event }); if (event.event === "init") { this.init = { conversation_id: event.conversation_id, ...(event.init ?? {}) }; if (!this.init.conversation_id) throw new DaemonError("agy_init_missing", "Antigravity init has no conversation ID"); const requested = { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode, permission_mode: "always-proceed" }; this.profile = assertProfile(requested, observedProfile(this.init, requested)); await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: this.init.conversation_id, requested, observed: this.profile.observed, source: "native.init" }); await this.persist({ shutdown_state: "running", active_tree: false }); readyResolve(this.init); } else if (event.event === "step_update") this.observeStep(event.step_update ?? {}); else if (event.event === "result") { if (this.startupError) throw this.startupError; await this.finishTurn(event.result ?? {}); } } }
+    await this.journal("provider_event", { event }); if (event.event === "init") { this.init = { conversation_id: event.conversation_id, ...(event.init ?? {}) }; if (!this.init.conversation_id) throw new DaemonError("agy_init_missing", "Antigravity init has no conversation ID"); const requested = { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode, permission_mode: "always-proceed" }; this.profile = assertProfile(requested, observedProfile(this.init, requested)); await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: this.init.conversation_id, requested, observed: this.profile.observed, source: "native.init" }); await this.persist({ shutdown_state: "running", active_tree: false }); readyResolve(this.init); } else if (event.event === "step_update") this.observeStep(event.step_update ?? {}); else if (event.event === "result") {
+      // A successfully read/journalled provider refusal rejects readiness, not
+      // the stream drain that physical cleanup must still join.
+      if (this.startupError) { readyReject(this.startupError); continue; }
+      await this.finishTurn(event.result ?? {});
+    } } }
   observeStep(step) {
     const sessionId = step.conversation_id ?? this.init?.conversation_id, observation = this.sessionObservations.get(sessionId) ?? {};
     const fresh = Number.isInteger(step.step_index) && step.step_index > (observation.last_step_index ?? -1) && step.step_index > (observation.step_floor ?? -1);

package/dist/harness-runtime/lib/dd-codex-daemon.mjs

@@ -14,7 +14,7 @@ import path from "node:path";
 import { spawn } from "node:child_process";
 import { waitForSettlement } from "./session-settlement.mjs";
 import { errorRecord } from "./operation-errors.mjs";
-import { CODEX_REQUEST_TIMEOUT_MS, LATE_RESPONSE_GRACE_MS, CodexBridge, cancelSessionWithBridge, createSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge, startSessionWithBridge } from "./dd-codex.mjs";
+import { CODEX_REQUEST_TIMEOUT_MS, LATE_RESPONSE_GRACE_MS, CodexBridge, codexReadPhase, readCodexHistory, retainedCodexTurn, cancelSessionWithBridge, createSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge, startSessionWithBridge } from "./dd-codex.mjs";
 import { assertDaemonOwnership, assertStartupChild, prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
 
 export function codexBridgeEnv(config, daemonId) { return { ...config.env, ...managedFlowEnv(config, daemonId) }; }
@@ -28,10 +28,11 @@ async function readState(file) { try { return JSON.parse(await readFile(file, "u
 async function writeState(file, value) { const temp = `${file}.${process.pid}.tmp`; await writeFile(temp, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 }); await rename(temp, file); }
 async function removeSocket(socket) { try { const info = await lstat(socket); if (!info.isSocket()) throw Object.assign(new Error("refusing to remove non-socket daemon path"), { code: "unsafe_socket" }); await unlink(socket); } catch (error) { if (error.code !== "ENOENT") throw error; } }
 const errorPayload = errorRecord;
-const terminalTurn = turn => ["completed", "interrupted", "failed", "cancelled"].includes(turn?.status);
-export function settledCodexSession(status, latestTurn, active) {
+const terminalTurn = turn => typeof turn?.id === "string" && turn.id.trim().length > 0 && ["completed", "interrupted", "failed", "cancelled"].includes(turn.status);
+export function settledCodexSession(status, latestTurn, active, historyAvailable = true) {
+  if (latestTurn && !terminalTurn(latestTurn)) return false;
   if (status === "idle") return true;
-  if (status === "notLoaded") return !latestTurn || terminalTurn(latestTurn);
+  if (status === "notLoaded") return terminalTurn(latestTurn) || historyAvailable && !latestTurn;
   // `systemError` alone is not evidence that the provider stopped. A current
   // terminal Turn plus no daemon operation is the narrow settled case.
   return status === "systemError" && !active && terminalTurn(latestTurn);
@@ -49,26 +50,46 @@ async function observeCodexSessions(bridge, options, sessions, active, remember
     const observed = await inspectSessionWithBridge(bridge, { ...options, sessionId, turnId: sessionId === options.sessionId ? options.turnId : undefined });
     for (const child of observed.descendants ?? []) { sessions.add(child.provider_session_id); remember(child.provider_session_id); }
     const status = observed.status?.type ?? observed.status;
-    const stored = ["notLoaded", "systemError"].includes(status) ? await bridge.request("thread/turns/list", { threadId: sessionId, limit: 1, sortDirection: "desc", itemsView: "summary" }, 5_000) : null;
-    const settled = settledCodexSession(status, stored?.data?.[0] ?? null, active());
+    const currentId = bridge.currentTurns?.get(sessionId) ?? (sessionId === options.sessionId ? options.turnId : undefined);
+    const retained = retainedCodexTurn(bridge, sessionId, currentId);
+    const compactTurn = observed.thread?.turns?.findLast(turn => !currentId || turn?.id === currentId);
+    const stored = ["notLoaded", "systemError"].includes(status) || currentId && !terminalTurn(retained)
+      ? await readCodexHistory(bridge, "thread/turns/list", { threadId: sessionId, limit: 20, sortDirection: "desc", itemsView: "summary" }, options.readPhase) : null;
+    const hydrated = stored && !stored.available
+      ? await readCodexHistory(bridge, "thread/read", { threadId: sessionId, includeTurns: true }, options.readPhase) : null;
+    const hydratedAvailable = hydrated?.available && Array.isArray(hydrated.result.thread.turns);
+    const hydratedTurn = hydratedAvailable ? hydrated.result.thread.turns.findLast(turn => !currentId || turn?.id === currentId) : null;
+    const malformedHistory = [stored?.result?.data, hydrated?.result?.thread.turns, observed.thread?.turns].some(turns =>
+      turns?.some(turn => typeof turn?.id !== "string" || !turn.id.trim() || !["inProgress", "completed", "interrupted", "failed", "cancelled"].includes(turn.status)));
+    const latest = retained && terminalTurn(retained) ? retained
+      : malformedHistory ? { status: "unknown" }
+      : stored?.result?.data.find(turn => !currentId || turn?.id === currentId) ?? hydratedTurn ?? compactTurn ?? retained
+        ?? (currentId ? { id: currentId, status: "unknown" } : null);
+    const observedStatus = hydrated?.result?.thread.status ?? observed.status;
+    const settled = settledCodexSession(observedStatus?.type ?? observedStatus, latest, active(), (stored?.available ?? true) || hydratedAvailable);
     if (!settled) unsettled.push(sessionId);
-    observations.push({ ...observed, settled });
+    observations.push({ ...observed, status: observedStatus, settled });
   }
   return { sessions: unsettled.reverse(), active: Boolean(active()), observations };
 }
 
 export async function inspectCodexTree(bridge, options, { remember = () => {}, active = () => null } = {}) {
+  options = { ...options, readPhase: options.readPhase ?? codexReadPhase(bridge, options) };
   const sessions = new Set([options.sessionId]);
   const observed = await observeCodexSessions(bridge, options, sessions, active, remember);
   return { ...observed.observations[0], settled: !observed.active && !observed.sessions.length, unsettled_sessions: observed.sessions, tree_session_ids: [...sessions], tree_observations: observed.observations.map(item => ({ provider_session_id: item.provider_session_id, status: item.status, settled: item.settled })) };
 }
 
 export async function cancelCodexTree(bridge, options, { remember = () => {}, active = () => null, timeoutMs = 5_000 } = {}) {
+  // Zero requests one best-effort cancellation/observation pass, not an
+  // invalid zero-length RPC window or permission to skip owned children.
+  const readBudget = timeoutMs === 0 ? CODEX_REQUEST_TIMEOUT_MS : timeoutMs;
+  options = { ...options, readPhase: options.readPhase ?? codexReadPhase(bridge, { ...options, timeoutMs: readBudget, livenessTimeoutMs: readBudget }) };
   const sessions = new Set([options.sessionId]);
   const settlement = await waitForSettlement({
     timeoutMs, knownSessions: () => [...sessions],
     cancel: async sessionId => {
-      try { await cancelSessionWithBridge(bridge, { ...options, sessionId, turnId: null }); }
+      try { await cancelSessionWithBridge(bridge, { ...options, sessionId, turnId: sessionId === options.sessionId ? options.turnId : undefined }); }
       catch (error) { if (error.code !== "turn_not_active") throw error; }
     },
     observe: () => observeCodexSessions(bridge, options, sessions, active, remember)

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -4,7 +4,7 @@ import { appendFile, mkdir, readFile } from "node:fs/promises";
 import path from "node:path";
 import readline from "node:readline";
 import { closeBridgeProcess } from "./managed-daemon.mjs";
-import { errorRecord, isProvenShellCorrection } from "./operation-errors.mjs";
+import { errorRecord, isObservationLoss, isProvenShellCorrection } from "./operation-errors.mjs";
 import { reportedFailure, commandText } from "./process-json.mjs";
 import { ObservationClock, observedTimeout, validateObservationDuration } from "./observation-clock.mjs";
 import { observeModel } from "./model-observations.mjs";
@@ -12,9 +12,105 @@ import { classifyCodexItem } from "./tool-observations.mjs";
 import { readNativeLines, streamNativeDiagnostics, nativeObservationError } from "./native-streams.mjs";
 import { operationProgressReporter } from "./operation-progress.mjs";
 import { publishSetup } from './setup-progress.mjs';
+import { capacityBackoff } from './provider-overload-policy.mjs';
 
 export const CODEX_REQUEST_TIMEOUT_MS = 120_000;
 export const LATE_RESPONSE_GRACE_MS = 5_000;
+export function codexReadPhase(bridge, options = {}) {
+  const timeoutMs = Math.min(CODEX_REQUEST_TIMEOUT_MS, options.livenessTimeoutMs ?? options.timeoutMs ?? CODEX_REQUEST_TIMEOUT_MS);
+  return { clock: new ObservationClock({ timeoutMs, ...options.observationClock,
+    onGap: gap => bridge.journal?.write("observation_gap", { ...gap, phase: "metadata_read" }) }),
+    random: options.readRandom ?? Math.random,
+    sleep: options.readSleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms))) };
+}
+
+function dispatchBudget(phase, method, limitMs) {
+  const clock = phase.outerClock ?? phase.clock;
+  if (clock.sample(phase.progress?.())) throw Object.assign(new Error("Codex owner observation window expired before dispatch"), {
+    code: clock.observationLost ? "operation_observation_lost" : "rpc_timeout",
+    details: { method, phase: "before_dispatch", effect: "no_effect", observation: clock.state() }
+  });
+  const remaining = Math.max(1, Math.ceil(clock.timeoutMs - clock.elapsed));
+  const timeoutMs = Math.min(limitMs, remaining);
+  return [timeoutMs, { graceMs: Math.min(LATE_RESPONSE_GRACE_MS, remaining - timeoutMs) }];
+}
+
+export async function readCodexRpc(bridge, method, params, phase = codexReadPhase(bridge)) {
+  if (!["thread/read", "thread/turns/list"].includes(method)) throw new Error("Codex read policy only accepts read-only RPC");
+  const sample = () => phase.clock.sample(phase.progress?.());
+  let primary;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    if (sample()) throw primary ?? Object.assign(new Error("Codex metadata observation window expired"), { code: phase.clock.observationLost ? "operation_observation_lost" : "rpc_timeout", details: { method, phase: "metadata_read", observation: phase.clock.state() } });
+    const remaining = Math.min(CODEX_REQUEST_TIMEOUT_MS, Math.max(1, Math.ceil(phase.clock.timeoutMs - phase.clock.elapsed)));
+    try {
+      const result = await bridge.request(method, params, remaining, { graceMs: 0, observe: () => { sample(); phase.outerClock?.sample(); } });
+      if (!result || typeof result !== "object" || Array.isArray(result)
+        || method === "thread/read" && (!result.thread || typeof result.thread !== "object" || Array.isArray(result.thread) || typeof result.thread.id !== "string" || !result.thread.id)
+        || method === "thread/turns/list" && !Array.isArray(result.data))
+        throw Object.assign(new Error("Codex read returned invalid data"), { code: "rpc_schema_invalid", details: { method } });
+      if (method === "thread/read" && result.thread.id !== params.threadId)
+        throw Object.assign(new Error("Codex read returned a foreign Thread"), { code: "thread_identity_mismatch" });
+      return result;
+    }
+    catch (error) {
+      primary ??= error; bridge.assertHookHealthy?.(params.threadId);
+      // A broken process cannot be replaced under the guise of a read retry.
+      const current = bridge.currentTurns?.get(params.threadId);
+      const materializing = method === "thread/read" && current && !bridge.turns?.has(current)
+        && bridge.nativeHookTurns?.get(params.threadId) !== current && error?.code === "rpc_error" && error.details?.code === -32603;
+      const emptyMetadata = materializing && error.details.message?.match(/^failed to read thread: thread-store internal error: failed to read session metadata (.+): rollout at (.+) is empty$/);
+      const transient = error?.code === "rpc_timeout" || error?.code === "EAGAIN" || error?.code === "EINTR"
+        || Boolean(emptyMetadata && emptyMetadata[1] === emptyMetadata[2] && emptyMetadata[1].endsWith(`-${params.threadId}.jsonl`));
+      if (!transient) { if (error !== primary) error.previous_read_error = errorRecord(primary); throw error; }
+      if (attempt === 2 || sample()) { if (error !== primary) primary.secondary_error = errorRecord(error); throw primary; }
+      const delay = Math.min(capacityBackoff(error, attempt + 1, phase.clock.wall(), phase.random), Math.max(0, phase.clock.timeoutMs - phase.clock.elapsed));
+      bridge.journal?.write("thread_read_retry", { method, session_id: params.threadId, attempt: attempt + 1, delay_ms: delay, error: errorRecord(error) });
+      await phase.sleep(delay);
+    }
+  }
+}
+
+// Availability belongs to this read of this Thread, not to the whole binary.
+export async function readCodexHistory(bridge, method, params, phase = codexReadPhase(bridge)) {
+  if (method !== "thread/turns/list" && !(method === "thread/read" && params.includeTurns === true))
+    throw new Error("Codex history policy only accepts history reads");
+  let result, error;
+  try {
+    result = await readCodexRpc(bridge, method, params, phase);
+    if (method === "thread/read" && result.thread.turns !== undefined && !Array.isArray(result.thread.turns))
+      fail("Codex history read returned invalid turns", "rpc_schema_invalid", { method });
+  }
+  catch (cause) {
+    bridge.assertHookHealthy?.(params.threadId);
+    const native = cause?.details;
+    const operation = method === "thread/read" ? "includeTurns" : "thread/turns/list";
+    const unsupported = native?.code === -32601 && native.message === "list_turns is not supported yet";
+    const unmaterialized = native?.code === -32600 && native.message ===
+      `thread ${params.threadId} is not materialized yet; ${operation} is unavailable before first user message`;
+    if (cause?.code !== "rpc_error" || !unsupported && !unmaterialized) throw cause;
+    error = errorRecord(cause);
+  }
+  const available = !error;
+  phase.history ??= new Map();
+  const key = `${params.threadId}:${method}`;
+  if (phase.history.get(key)?.available !== available) bridge.journal?.write("history_availability", {
+    method, session_id: params.threadId, available, ...(error ? { error } : {})
+  });
+  phase.history.set(key, { available, error });
+  return { available, result, error };
+}
+
+export function retainedCodexTurn(bridge, sessionId, turnId = bridge.currentTurns?.get(sessionId)) {
+  if (!turnId) return null;
+  const retained = bridge.turns?.get(turnId);
+  if (!retained) return null;
+  if (retained.threadId && retained.threadId !== sessionId || retained.value?.threadId && retained.value.threadId !== sessionId)
+    fail("Codex retained Thread identity differs", "turn_identity_mismatch");
+  if (!retained.threadId && !retained.value?.threadId) return null;
+  const turn = retained.value?.turn;
+  if (turn?.id !== turnId) fail("Codex retained Turn identity differs", "turn_identity_mismatch");
+  return turn;
+}
 const CODEX_SESSION_CONFIG = Object.freeze({
   bypass_hook_trust: true,
   "features.plugins": false,
@@ -158,7 +254,7 @@ export class CodexBridge {
     // retain a compact read receipt instead of writing the same transcript on
     // every status poll.
     const request = message.id !== undefined ? this.pending.get(message.id) : null;
-    if (request?.method === "thread/read") {
+    if (request?.method === "thread/read" && !message.error) {
       const thread = message.result?.thread ?? message.result ?? {};
       this.journal.write("inbound", { jsonrpc: message.jsonrpc, id: message.id, result: { thread: {
         id: thread.id ?? null, status: thread.status ?? null, model: thread.model ?? null, modelProvider: thread.modelProvider ?? null, reasoningEffort: thread.reasoningEffort ?? null, updatedAt: thread.updatedAt ?? null,
@@ -410,7 +506,7 @@ export class CodexBridge {
     this.send({ jsonrpc: "2.0", id: message.id, error });
   }
 
-  request(method, params = {}, timeoutMs = this.options.timeoutMs ?? CODEX_REQUEST_TIMEOUT_MS) {
+  request(method, params = {}, timeoutMs = this.options.timeoutMs ?? CODEX_REQUEST_TIMEOUT_MS, policy = {}) {
     const turnFloor = method === "turn/start" ? new Set([this.currentTurns?.get(params.threadId), ...[...this.turns].filter(([, value]) => value.threadId === params.threadId).map(([id]) => id)].filter(Boolean)) : null;
     if (method === "turn/start" && params.threadId) {
       // Only one productive root Turn is admitted by the daemon fence. Drop
@@ -422,16 +518,18 @@ export class CodexBridge {
     }
     const id = this.nextId++;
     return new Promise((resolve, reject) => {
-      const timer = observedTimeout(() => {
+      const timer = observedTimeout(clock => {
         const pending = this.pending.get(id); if (!pending || pending.timedOut) return;
         pending.timedOut = true;
-        const timeoutError = Object.assign(new Error(`${method} timed out`), { code: "rpc_timeout", details: { method, request_id: id, timeout_ms: timeoutMs, grace_ms: LATE_RESPONSE_GRACE_MS } });
+        const graceMs = policy.graceMs ?? LATE_RESPONSE_GRACE_MS;
+        const timeoutError = Object.assign(new Error(`${method} timed out`), { code: clock.observationLost ? "operation_observation_lost" : "rpc_timeout", details: { method, request_id: id, timeout_ms: timeoutMs, grace_ms: graceMs, observation: clock.state() } });
         this.journal.write("request_deadline", timeoutError.details);
+        if (!graceMs) { this.pending.delete(id); reject(timeoutError); return; }
         pending.timer = observedTimeout(() => {
           if (this.pending.get(id) !== pending) return;
           this.pending.delete(id); reject(timeoutError);
-        }, LATE_RESPONSE_GRACE_MS, { progress: () => pending.progress });
-      }, timeoutMs, { progress: () => this.pending.get(id)?.progress, onGap: gap => this.journal.write("observation_gap", { ...gap, method, request_id: id }) });
+        }, graceMs, { progress: () => pending.progress });
+      }, timeoutMs, { progress: () => { policy.observe?.(); return this.pending.get(id)?.progress; }, onGap: gap => this.journal.write("observation_gap", { ...gap, method, request_id: id }) });
       const publish = operationProgressReporter();
       this.pending.set(id, { id, resolve, reject, timer, method, threadId: params.threadId, turnFloor });
       if (method === "turn/start" && params.threadId) {
@@ -467,12 +565,12 @@ async function withBridge(options, action) {
 function profile(options) { return { harness: "codex-desktop", model: options.model ?? null, reasoning: options.reasoning ?? null }; }
 function threadId(result) { const id = result?.thread?.id ?? result?.threadId; return required(id, "Codex thread id"); }
 function directChildren(bridge, sessionId) { return typeof bridge?.directChildren === "function" ? bridge.directChildren(sessionId) : []; }
-async function observedChildren(bridge, sessionId) {
+async function observedChildren(bridge, sessionId, phase) {
   const children = directChildren(bridge, sessionId);
   let reads = 0;
   return await Promise.all(children.map(async child => {
     if (child.status !== "failed" || !child.terminal_turn_id || reads++ >= 16) return child;
-    const observed = await readTurn(bridge, child.provider_session_id, child.terminal_turn_id, true);
+    const observed = await readTurn(bridge, child.provider_session_id, child.terminal_turn_id, true, phase);
     const turn = observed?.turn;
     if (turn?.id !== child.terminal_turn_id || turn.status !== child.status) return child;
     return { ...child, provider_error: nativeTurnError(bridge, child.provider_session_id, turn) ?? child.provider_error,
@@ -481,8 +579,8 @@ async function observedChildren(bridge, sessionId) {
 }
 function codexSessionConfig() { return { ...CODEX_SESSION_CONFIG }; }
 
-async function requestConfiguredThread(bridge, method, params, timeoutMs) {
-  try { return await bridge.request(method, { ...params, config: codexSessionConfig() }, timeoutMs); }
+async function requestConfiguredThread(bridge, method, params, timeoutMs, policy) {
+  try { return await bridge.request(method, { ...params, config: codexSessionConfig() }, timeoutMs, policy); }
   catch (error) {
     const data = error?.details?.data;
     const key = data?.configKey ?? data?.config_key ?? null;
@@ -506,7 +604,7 @@ function threadReceipt(thread) {
 
 export async function doctor(options = {}) {
   const codex_cli = parseCodexCliVersion(await commandText(options.bin ?? process.env.DD_CODEX_BIN ?? "codex", ["--version"], { phase: 'native-version' }));
-  return await withBridge(options, async () => ({ harness: "codex-desktop", app_server: "available", observed_runtime: { codex_cli, dd_harness_contract: "dd-codex-harness@1" }, requested_profile: profile(options), observed_at: now() }));
+  return await withBridge(options, async () => ({ harness: "codex-desktop", app_server: "available", observation_scope: "version_and_initialize", observed_runtime: { codex_cli, dd_harness_contract: "dd-codex-harness@1" }, requested_profile: profile(options), observed_at: now() }));
 }
 
 async function observeCodexProfile(bridge, options, id, observed, source) {
@@ -548,6 +646,9 @@ export async function startSession(options) {
 }
 
 export async function startSessionWithBridge(bridge, options) {
+  options = { ...options, readPhase: codexReadPhase(bridge, options) };
+  options.readPhase.outerClock = new ObservationClock({ timeoutMs: options.livenessTimeoutMs ?? options.timeoutMs ?? CODEX_REQUEST_TIMEOUT_MS,
+    ...options.observationClock, onGap: gap => bridge.journal?.write("observation_gap", { ...gap, phase: "start", session_id: options.sessionId }) });
   const sessionId = required(options.sessionId, "--session-id"); const cwd = absolute(options.cwd, "--cwd"); const prompt = required(options.prompt, "--prompt");
   await ensureThreadLoaded(bridge, sessionId, options, cwd);
   bridge.requestedProfiles?.set(sessionId, profile(options));
@@ -555,13 +656,16 @@ export async function startSessionWithBridge(bridge, options) {
   options.assertDispatch?.();
   bridge.assertHookHealthy?.(sessionId);
   bridge.dispatchOperationId = options.operationId;
-  const started = await bridge.request("turn/start", { threadId: sessionId, input: [{ type: "text", text: prompt }], cwd, model: options.model ?? null, effort: options.reasoning ?? null, approvalPolicy: "never", sandboxPolicy: { type: "dangerFullAccess" } }, options.timeoutMs ?? 30_000);
+  const started = await bridge.request("turn/start", { threadId: sessionId, input: [{ type: "text", text: prompt }], cwd, model: options.model ?? null, effort: options.reasoning ?? null, approvalPolicy: "never", sandboxPolicy: { type: "dangerFullAccess" } }, ...dispatchBudget(options.readPhase, "turn/start", options.timeoutMs ?? 30_000));
   const turn = started?.turn ?? started; const turnId = turn?.id ?? null;
   if (typeof turnId !== "string" || !turnId) throw new Error("Codex did not return a Turn id");
   return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, turn_id: turnId, status: "started", requested_profile: profile(options), observed_profile: { model: null, reasoning: null } };
 }
 
 export async function promptSessionWithBridge(bridge, options) {
+  options = { ...options, readPhase: codexReadPhase(bridge, options) };
+  const clock = new ObservationClock({ timeoutMs: options.livenessTimeoutMs ?? options.timeoutMs ?? 1_800_000, ...options.observationClock, onGap: gap => bridge.journal?.write("observation_gap", { ...gap, phase: "prompt", session_id: options.sessionId }) });
+  options.readPhase.outerClock = clock;
   const sessionId = required(options.sessionId, "--session-id"); const cwd = absolute(options.cwd, "--cwd"); const prompt = required(options.prompt, "--prompt");
   validateObservationDuration(options.livenessTimeoutMs ?? options.timeoutMs ?? 1_800_000);
   await ensureThreadLoaded(bridge, sessionId, options, cwd);
@@ -573,8 +677,7 @@ export async function promptSessionWithBridge(bridge, options) {
   options.assertDispatch?.();
   bridge.assertHookHealthy?.(sessionId);
   bridge.dispatchOperationId = options.operationId;
-  const clock = new ObservationClock({ timeoutMs: options.livenessTimeoutMs ?? options.timeoutMs ?? 1_800_000, onGap: gap => bridge.journal?.write("observation_gap", { ...gap, session_id: sessionId }) });
-  const started = await bridge.request("turn/start", { threadId: sessionId, input: [{ type: "text", text: prompt }], cwd, model: options.model ?? null, effort: options.reasoning ?? null, approvalPolicy: "never", sandboxPolicy: { type: "dangerFullAccess" } }, 30_000);
+  const started = await bridge.request("turn/start", { threadId: sessionId, input: [{ type: "text", text: prompt }], cwd, model: options.model ?? null, effort: options.reasoning ?? null, approvalPolicy: "never", sandboxPolicy: { type: "dangerFullAccess" } }, ...dispatchBudget(options.readPhase, "turn/start", 30_000));
   const turn = started?.turn ?? started; const turnId = turn?.id ?? null;
   let completed;
   try { completed = isTerminalTurnStatus(turn?.status) ? terminalTurn({ turn }, sessionId, turnId, bridge)
@@ -599,14 +702,34 @@ export async function promptSessionWithBridge(bridge, options) {
           details: { native_outcome: { provider_session_id: sessionId, turn_id: turnId, status: "failed", provider_error: error.details?.provider_error }, settled: false, observation_error: errorRecord(observationError) }, cause: error });
       }
     }
+    if (isObservationLoss(error)) throw Object.assign(new Error("Codex accepted Turn outcome could not be observed", { cause: error }), {
+      code: "operation_observation_lost", retryable: false, details: { provider_session_id: sessionId, turn_id: turnId,
+        operation_id: options.operationId ?? null, phase: "turn_observation", native_dispatch_started: true,
+        native_outcome: "unknown", observation_error: errorRecord(error), history_reads: Object.fromEntries(options.readPhase.history ?? []) }
+    });
     throw error;
   }
   const nativeOutcome = { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, turn_id: turnId, status: "completed", turn: completed };
   try {
-    const thread = await readCompletedThread(bridge, sessionId);
+    const phase = codexReadPhase(bridge, options);
+    const history = await readCodexHistory(bridge, "thread/read", { threadId: sessionId, includeTurns: true }, phase);
+    const thread = history.available ? history.result.thread
+      : (await readCodexRpc(bridge, "thread/read", { threadId: sessionId, includeTurns: false }, phase)).thread;
     bridge.assertHookHealthy?.(sessionId);
-    const assistantText = latestAssistantText(thread?.turns?.find(item => item?.id === turnId)) ?? latestAssistantText(completed);
-    return { ...nativeOutcome, ...(thread ? { thread: threadReceipt(thread) } : {}), descendants: await observedChildren(bridge, sessionId), ...(assistantText ? { assistant_text: assistantText } : {}), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread?.model ?? null, reasoning: thread?.reasoningEffort ?? null, provider: thread?.modelProvider ?? null }, "thread/read.after_turn") };
+    const final = bridge.finalMessages?.get(sessionId);
+    const historyTurn = thread?.turns?.find(item => item?.id === turnId);
+    const completeHistory = history.available && (turnItemEvidence(historyTurn, bridge, sessionId).observed
+      // Preserve the existing idle + readable-history final-message receipt.
+      || completed?.turn?.synthetic === true && Array.isArray(thread.turns) && final?.turnId === turnId && thread.status?.type === "idle");
+    const assistantText = latestAssistantText(completed) ?? latestAssistantText(historyTurn)
+      ?? (final?.turnId === turnId ? latestAssistantText({ items: [final.item] }) : null);
+    if (!completeHistory && (!assistantText || !turnItemEvidence(completed?.turn ?? completed, bridge, sessionId).observed))
+      fail("Codex completed but its current output/items remain unavailable", "operation_observation_lost", { history_error: history.error, provider_session_id: sessionId, turn_id: turnId });
+    if (!completeHistory && (options.model && !thread.model || options.reasoning && !thread.reasoningEffort))
+      fail("Codex completed but its applied profile remains unavailable", "operation_observation_lost", { history_error: history.error, provider_session_id: sessionId, turn_id: turnId });
+    const result = { ...nativeOutcome, ...(thread ? { thread: threadReceipt(thread) } : {}), descendants: await observedChildren(bridge, sessionId, phase), ...(assistantText ? { assistant_text: assistantText } : {}), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread?.model ?? null, reasoning: thread?.reasoningEffort ?? null, provider: thread?.modelProvider ?? null }, "thread/read.after_turn") };
+    await bridge.journal?.flush?.();
+    return result;
   } catch (error) {
     throw Object.assign(new Error("Codex completed natively but mandatory observation failed"), { code: "native_outcome_observation_failed", retryable: false,
       details: { native_outcome: nativeOutcome, settled: false, observation_error: errorRecord(error) }, cause: error });
@@ -614,7 +737,7 @@ export async function promptSessionWithBridge(bridge, options) {
 }
 
 async function ensureThreadLoaded(bridge, sessionId, options, cwd) {
-  const value = await bridge.request("thread/read", { threadId: sessionId, includeTurns: false }, 10_000);
+  const value = await readCodexRpc(bridge, "thread/read", { threadId: sessionId, includeTurns: false }, options.readPhase);
   const thread = value?.thread ?? value;
   if (thread?.status?.type !== "notLoaded") return;
   await requestConfiguredThread(bridge, "thread/resume", {
@@ -623,10 +746,14 @@ async function ensureThreadLoaded(bridge, sessionId, options, cwd) {
     model: options.model ?? null,
     approvalPolicy: "never",
     sandbox: "danger-full-access"
-  }, 30_000);
+  }, ...dispatchBudget(options.readPhase, "thread/resume", 30_000));
 }
 
 async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, clock = new ObservationClock({ timeoutMs, onGap: gap => bridge.journal?.write("observation_gap", { ...gap, session_id: sessionId, turn_id: turnId }) }), startStatus) {
+  const readPhase = codexReadPhase(bridge, options);
+  readPhase.clock = clock;
+  readPhase.progress = () => bridge.activityObservations?.get(sessionId) ?? bridge.activity?.get(sessionId);
+  options = { ...options, readPhase };
   // app-server can briefly expose the new Turn as `interrupted` between the
   // turn/start response and its turn/started notification. Give that snapshot
   // one event-loop grace window before treating failure as authoritative.
@@ -636,7 +763,7 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, c
     if (status === "completed" || startStatus !== "inProgress" || bridge.turns.get(turnId)?.status === "completed") return true;
     // A provisional failure can contradict the accepted start before its
     // delayed notification arrives. Recheck this Turn, never start another.
-    const current = await readTurn(bridge, sessionId, turnId, true);
+    const current = await readTurn(bridge, sessionId, turnId, true, readPhase);
     return bridge.turns.get(turnId)?.status === "completed" || current?.turn?.status === status
       && isAuthoritativeTerminal(bridge, turnId, status, current.threadStatus, failureNotBefore);
   };
@@ -646,27 +773,29 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, c
     const known = bridge.turns.get(turnId) ?? bridge.turns.get(sessionId); if (known?.status === "completed" && (!known.threadId || known.threadId === sessionId)) return terminalTurn(known.value, sessionId, turnId, bridge);
     const expired = clock.sample(bridge.activityObservations?.get(sessionId) ?? bridge.activity?.get(sessionId));
     if (expired || Date.now() >= nextStoredReadAt) {
-      const stored = await readTurn(bridge, sessionId, turnId, false);
+      const stored = await readTurn(bridge, sessionId, turnId, false, readPhase);
       if (stored?.turn && await reconcileSnapshot(stored.turn.status, stored.threadStatus)) return terminalTurn({ turn: stored.turn }, sessionId, turnId, bridge);
       // A loaded app-server can retain a stale `active` Thread state after a
       // provider-side interruption. The persisted turn page is independent of
       // that live subscription and is the compact authority for its terminal
-      // status; unlike `includeTurns`, it never hydrates the whole history.
-      const persisted = await readPersistedTurn(bridge, sessionId, turnId);
-      if (persisted && await reconcileSnapshot(persisted.status, stored?.threadStatus)) return terminalTurn({ turn: persisted }, sessionId, turnId, bridge);
+      // status. Hydrate only when that read surface is unavailable.
+      const persisted = await readPersistedTurn(bridge, sessionId, turnId, readPhase);
+      if (persisted.turn && await reconcileSnapshot(persisted.turn.status, persisted.threadStatus ?? stored?.threadStatus)) return terminalTurn({ turn: persisted.turn }, sessionId, turnId, bridge);
+      const native = bridge.turns.get(turnId);
+      if (native?.status === "completed" && (!native.threadId || native.threadId === sessionId)) return terminalTurn(native.value, sessionId, turnId, bridge);
       // Desktop may unload an idle Thread immediately after an interrupted
       // Turn. Reload it once before polling again: otherwise the compact
       // status remains `notLoaded` forever and hides the terminal Turn.
       if (stored?.threadStatus === "notLoaded") {
         await ensureThreadLoaded(bridge, sessionId, options, cwd);
-        const hydrated = await readTurn(bridge, sessionId, turnId, true);
+        const hydrated = await readTurn(bridge, sessionId, turnId, true, readPhase);
         if (hydrated?.turn && await reconcileSnapshot(hydrated.turn.status, hydrated.threadStatus)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
       }
       // Some app-server versions correctly omit turns for a compact read.
       // Once the thread is idle, hydrate exactly once to recover the terminal
       // turn instead of waiting for the global timeout.
       if (stored?.threadStatus === "idle") {
-        const hydrated = await readTurn(bridge, sessionId, turnId, true);
+        const hydrated = persisted.hydrated ? persisted : await readTurn(bridge, sessionId, turnId, true, readPhase);
         // "idle" only describes the Thread.  Some app-server builds retain
         // an inProgress Turn after emitting the final agent message; treating
         // that stale Turn as terminal incorrectly aborts an otherwise usable
@@ -681,7 +810,7 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, c
       // reasoning and calling tools.  They are terminal evidence only after
       // app-server reports the Thread idle.
       if (final?.turnId === turnId && stored?.threadStatus === "idle" && Date.now() - final.completedAt >= 1_000) {
-        const hydrated = await readTurn(bridge, sessionId, turnId, true);
+        const hydrated = await readTurn(bridge, sessionId, turnId, true, readPhase);
         if (hydrated?.turn && await reconcileSnapshot(hydrated.turn.status, hydrated.threadStatus)) return terminalTurn({ turn: hydrated.turn }, sessionId, turnId, bridge);
         if (hydrated?.threadStatus === "idle" && !isTerminalTurnStatus(hydrated.turn?.status))
           return terminalTurn({ turn: { id: turnId, status: "completed", synthetic: true, final_message: final.item } }, sessionId, turnId, bridge);
@@ -689,7 +818,7 @@ async function waitForTurn(bridge, sessionId, turnId, timeoutMs, options, cwd, c
       nextStoredReadAt = Date.now() < failureNotBefore ? failureNotBefore : Date.now() + 15_000;
     }
     const terminal = bridge.turns.get(turnId); if (terminal?.status === "completed" && (!terminal.threadId || terminal.threadId === sessionId)) return terminalTurn(terminal.value, sessionId, turnId, bridge);
-    if (expired && clock.sample(bridge.activityObservations?.get(sessionId) ?? bridge.activity?.get(sessionId))) fail("Codex native outcome remains unknown after its silence window", "operation_observation_lost", { provider_session_id: sessionId, turn_id: turnId, native_outcome: "unknown" });
+    if (expired && clock.sample(bridge.activityObservations?.get(sessionId) ?? bridge.activity?.get(sessionId))) fail("Codex native outcome remains unknown after its silence window", "operation_observation_lost", { provider_session_id: sessionId, turn_id: turnId, operation_id: options.operationId ?? null, native_dispatch_started: true, phase: "turn_observation", native_outcome: "unknown", history_reads: Object.fromEntries(readPhase.history ?? []) });
     await new Promise((resolve) => setTimeout(resolve, 250));
   }
 }
@@ -744,29 +873,23 @@ function isAuthoritativeTerminal(bridge, turnId, status, threadStatus, failureNo
   return !(bridge.turns.get(turnId)?.status === "running" && threadStatus === "active");
 }
 
-async function readTurn(bridge, sessionId, turnId, includeTurns) {
+async function readTurn(bridge, sessionId, turnId, includeTurns, phase) {
   if (!turnId) return null;
   try {
-    const result = await bridge.request("thread/read", { threadId: sessionId, includeTurns }, 10_000);
+    const history = includeTurns ? await readCodexHistory(bridge, "thread/read", { threadId: sessionId, includeTurns }, phase) : null;
+    if (history && !history.available) return { turn: null, threadStatus: null, historyAvailable: false };
+    const result = history?.result ?? await readCodexRpc(bridge, "thread/read", { threadId: sessionId, includeTurns }, phase);
     const thread = result?.thread ?? result;
     return { turn: Array.isArray(thread?.turns) ? thread.turns.find((turn) => turn?.id === turnId) ?? null : null, threadStatus: thread?.status?.type ?? null };
-  } catch { bridge.assertHookHealthy?.(sessionId); return null; }
+  } catch (error) { bridge.assertHookHealthy?.(sessionId); throw error; }
 }
 
-async function readPersistedTurn(bridge, sessionId, turnId) {
+async function readPersistedTurn(bridge, sessionId, turnId, phase) {
   try {
-    const result = await bridge.request("thread/turns/list", { threadId: sessionId, limit: 20, sortDirection: "desc", itemsView: "summary" }, 10_000);
-    return Array.isArray(result?.data) ? result.data.find((turn) => turn?.id === turnId) ?? null : null;
-  } catch { bridge.assertHookHealthy?.(sessionId); return null; }
-}
-
-async function readCompletedThread(bridge, sessionId) {
-  let lastError;
-  for (let attempt = 0; attempt < 8; attempt += 1) {
-    try { const result = await bridge.request("thread/read", { threadId: sessionId, includeTurns: true }, 10_000); return result?.thread ?? result; }
-    catch (error) { lastError = error; bridge.assertHookHealthy?.(sessionId); bridge.journal.write("thread_read_retry", { session_id: sessionId, attempt, error: errorRecord(error) }); await new Promise((resolve) => setTimeout(resolve, 150)); }
-  }
-  throw lastError;
+    const history = await readCodexHistory(bridge, "thread/turns/list", { threadId: sessionId, limit: 20, sortDirection: "desc", itemsView: "summary" }, phase);
+    if (!history.available) return { ...await readTurn(bridge, sessionId, turnId, true, phase), hydrated: true };
+    return { available: history.available, turn: history.result?.data.find((turn) => turn?.id === turnId) ?? null };
+  } catch (error) { bridge.assertHookHealthy?.(sessionId); throw error; }
 }
 
 function latestAssistantText(value) {
@@ -789,10 +912,11 @@ export async function inspectSession(options) {
 }
 
 export async function inspectSessionWithBridge(bridge, options) {
-  const sessionId = required(options.sessionId, "--session-id"); const value = await bridge.request("thread/read", { threadId: sessionId, includeTurns: false }); const thread = value?.thread ?? value;
-  const terminal = options.turnId ? (await readTurn(bridge, sessionId, options.turnId, true))?.turn : null;
+  const phase = options.readPhase ?? codexReadPhase(bridge, options);
+  const sessionId = required(options.sessionId, "--session-id"); const value = await readCodexRpc(bridge, "thread/read", { threadId: sessionId, includeTurns: false }, phase); const thread = value?.thread ?? value;
+  const terminal = options.turnId ? retainedCodexTurn(bridge, sessionId, options.turnId) ?? (await readTurn(bridge, sessionId, options.turnId, true, phase))?.turn : null;
   const exact = terminal?.id === options.turnId && terminal?.status === "failed" ? { terminal_turn_id: terminal.id, terminal_status: terminal.status, provider_error: nativeTurnError(bridge, sessionId, terminal), native_turn_items: turnItemEvidence(terminal, bridge, sessionId) } : {};
-  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, status: thread.status ?? null, thread: threadReceipt(thread), ...exact, descendants: await observedChildren(bridge, sessionId), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread.model ?? null, reasoning: thread.reasoningEffort ?? null, provider: thread.modelProvider ?? null }, "thread/read") };
+  return { harness: "codex-desktop", provider_session_id: sessionId, adapter_session_id: sessionId, status: thread.status ?? null, thread: threadReceipt(thread), ...exact, descendants: await observedChildren(bridge, sessionId, phase), requested_profile: profile(options), observed_profile: await observeCodexProfile(bridge, options, sessionId, { model: thread.model ?? null, reasoning: thread.reasoningEffort ?? null, provider: thread.modelProvider ?? null }, "thread/read") };
 }
 
 export async function cancelSession(options) {
@@ -800,12 +924,21 @@ export async function cancelSession(options) {
 }
 
 export async function cancelSessionWithBridge(bridge, options) {
+  const phase = options.readPhase ?? codexReadPhase(bridge, options);
   const sessionId = required(options.sessionId, "--session-id");
   let turnId = options.turnId ?? null;
   if (!turnId) {
-    const result = await bridge.request("thread/read", { threadId: sessionId, includeTurns: true }, 10_000);
-    const thread = result?.thread ?? result;
-    turnId = [...(thread?.turns ?? [])].reverse().find((turn) => turn?.status === "inProgress")?.id ?? null;
+    const currentId = bridge.currentTurns?.get(sessionId);
+    const retained = retainedCodexTurn(bridge, sessionId, currentId);
+    turnId = currentId && !isTerminalTurnStatus(retained?.status) ? currentId : null;
+    if (!turnId) {
+      const history = await readCodexHistory(bridge, "thread/read", { threadId: sessionId, includeTurns: true }, phase);
+      if (!history.available || !Array.isArray(history.result.thread.turns)
+        || history.result.thread.turns.some(turn => typeof turn?.id !== "string" || !turn.id.trim()
+          || turn.status !== "inProgress" && !isTerminalTurnStatus(turn.status)))
+        fail("Codex active Turn cannot be established from incomplete history", "operation_observation_lost", { provider_session_id: sessionId, native_outcome: "unknown", history_error: history.error });
+      turnId = [...history.result.thread.turns].reverse().find((turn) => turn.status === "inProgress")?.id ?? null;
+    }
   }
   if (!turnId) fail("Codex Session has no active Turn to interrupt", "turn_not_active");
   await bridge.request("turn/interrupt", { threadId: sessionId, turnId });