@deksden-com/dd-flow-cli 0.9.0-beta.144 → 0.9.0-beta.149

package/dist/harness-runtime/lib/dd-grok.mjs

@@ -102,7 +102,7 @@ async function identity(bridge, options) {
   return sessionId;
 }
 
-async function cancelTree(bridge, sessionId) {
+async function cancelTree(bridge, sessionId, options = {}) {
   const before = await subagents(bridge, sessionId).catch(error => ({ observation_error: { code: error.code, message: error.message } })); const cancellations = [];
   for (const child of before.subagents ?? []) {
     const childId = child.sessionId ?? child.subagentId;
@@ -119,7 +119,10 @@ async function cancelTree(bridge, sessionId) {
     if (!(after.subagents ?? []).length) {
       const root = await sessionInfo(bridge, sessionId).catch(error => ({ observation_error: { code: error.code, message: error.message } }));
       const status = root?.status ?? root?.state ?? root?.data?.status ?? null;
-      return { before, after, cancellations, root_status: status, settled: ["completed", "failed", "cancelled", "stopped", "idle"].includes(String(status).toLowerCase()) };
+      await bridge.terminalOutcomes;
+      const retained = options.rootSettled?.(sessionId) === true;
+      if (status === null && !retained) continue;
+      return { before, after, cancellations, root_status: status, settled: options.rootSettled ? retained : ["completed", "failed", "cancelled", "stopped", "idle"].includes(String(status).toLowerCase()) };
     }
   }
   const root = await sessionInfo(bridge, sessionId).catch(() => null);
@@ -163,7 +166,7 @@ export async function promptSessionWithBridge(bridge, options) {
 export async function inspectSession(options) { requireJournal(options); return await withBridge(options, async (bridge, initialized) => await inspectSessionWithBridge(bridge, { ...options, initialized })); }
 export async function inspectSessionWithBridge(bridge, options) { requireJournal(options); const sessionId = await identity(bridge, options); const evidence = await inspect(bridge, sessionId, options); evidence.tool_calls = sessionToolCalls(options, bridge, sessionId); const usage_ingest_error = await forwardUsageBestEffort(options, sessionId, evidence.usage, evidence.tool_calls); if (usage_ingest_error) evidence.usage_ingest_error = usage_ingest_error; return receipt(options, { harness: "grok-acp", provider_session_id: sessionId, adapter_session_id: sessionId, ...evidence }); }
 export async function cancelSession(options) { requireJournal(options); return await withBridge(options, async (bridge) => await cancelSessionWithBridge(bridge, options)); }
-export async function cancelSessionWithBridge(bridge, options) { requireJournal(options); const sessionId = await identity(bridge, options); return receipt(options, { harness: "grok-acp", provider_session_id: sessionId, adapter_session_id: sessionId, ...await cancelTree(bridge, sessionId) }); }
+export async function cancelSessionWithBridge(bridge, options) { requireJournal(options); const sessionId = await identity(bridge, options); return receipt(options, { harness: "grok-acp", provider_session_id: sessionId, adapter_session_id: sessionId, ...await cancelTree(bridge, sessionId, options) }); }
 export async function forkSession(options) { requireJournal(options); return await withBridge(options, async (bridge) => await forkSessionWithBridge(bridge, options)); }
 export async function forkSessionWithBridge(bridge, options) {
   requireJournal(options); const sessionId = await identity(bridge, options); const target = options.target;

package/dist/harness-runtime/lib/dd-opencode-daemon.mjs

@@ -10,8 +10,9 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { appendFile, chmod, lstat, mkdir, open, readFile, realpath, unlink, writeFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import net from "node:net";
-import { durableDaemonDispatch, completeDaemonShutdown, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon, assertDaemonDispatch, assertDaemonRestartable } from "./daemon-operations.mjs";
+import { durableDaemonDispatch, completeDaemonShutdown, commitDaemonShutdown, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon, assertDaemonDispatch, assertDaemonRestartable } from "./daemon-operations.mjs";
 import { waitForSettlement } from "./session-settlement.mjs";
+import { nativeExecutionReceipt } from "./native-children.mjs";
 import { errorRecord, isProvenShellCorrection, reportedError } from "./operation-errors.mjs";
 import { checkObservedProfile, observeModel } from "./model-observations.mjs";
 import os from "node:os";
@@ -201,15 +202,35 @@ export class Runtime {
   async journal(operation, result) { const line = `${JSON.stringify({ schema_id: "dd-opencode/daemon-event@1", event_id: randomUUID(), observed_at: new Date().toISOString(), operation, active_tree: this.state.active_tree, session_id: result?.provider_session_id ?? null })}\n`; for (const journal of new Set([this.paths.journal, this.state.config.journal].filter(Boolean))) { await mkdir(path.dirname(journal), { recursive: true, mode: 0o700 }); await appendFile(journal, line, { mode: 0o600 }); } }
   async childTree(id, seen = new Set()) {
     if (seen.has(id)) throw new DaemonError("session_identity_mismatch", "OpenCode native topology contains a cycle");
-    seen.add(id); const direct = await this.client.children(id) ?? [], nested = [];
+    seen.add(id); const direct = await this.ownedChildren(id), nested = [];
     for (const child of direct) {
       if (!child.id || child.parentID !== id) throw new DaemonError("session_identity_mismatch", "OpenCode child has a foreign native parent");
       nested.push(child, ...await this.childTree(child.id, seen));
     }
     return nested;
   }
-  async describe(id) {
-    const [info, messages, children, statuses] = await Promise.all([this.client.inspect(id), this.client.messages(id), this.childTree(id), this.client.statuses()]);
+  async ownedChildren(id) {
+    const direct = await this.client.children(id), children = new Map();
+    if (!Array.isArray(direct)) throw new DaemonError("native_child_observation_unavailable", "OpenCode child inventory is unavailable");
+    for (const child of direct) children.set(child.id, child);
+    for (const record of this.sessions.values()) if (record.parent_provider_session_id === id && !children.has(record.provider_session_id)) {
+      let child;
+      try { child = await this.client.inspect(record.provider_session_id); }
+      catch (cause) { throw new DaemonError("native_child_observation_unavailable", "Retained OpenCode child disappeared without completion proof", false, { provider_session_id: record.provider_session_id, cause: errorPayload(cause) }); }
+      if (child?.id !== record.provider_session_id) throw new DaemonError("session_identity_mismatch", "OpenCode retained child read returned another Session");
+      children.set(child.id, child);
+    }
+    for (const child of children.values()) if (!child.id || child.parentID !== id || child.fork) throw new DaemonError("session_identity_mismatch", "OpenCode child has a foreign native parent");
+    return [...children.values()];
+  }
+  async revision(id) {
+    if (!this.client.logs) return null;
+    const { watermark } = await this.client.logs(id);
+    return JSON.stringify([id, watermark]);
+  }
+  async describe(id, refreshes = 1) {
+    const before = new Map([[id, await this.revision(id)]]);
+    const [info, messages, children] = await Promise.all([this.client.inspect(id), this.client.messages(id), this.childTree(id)]);
     const parent = info.fork ? null : info.parentID ?? null, existing = this.sessions.get(id);
     if (info.id !== id || !existing && (!parent || !this.sessions.has(parent) || info.fork)
       || existing && (existing.parent_provider_session_id ?? null) !== parent) throw new DaemonError("foreign_session", "OpenCode Session is not in the retained owned tree");
@@ -219,17 +240,31 @@ export class Runtime {
       if (child.fork || retained && retained.parent_provider_session_id !== child.parentID) throw new DaemonError("session_identity_mismatch", "OpenCode child ancestry changed");
       this.retainSession(child, record.root_provider_session_id);
     }
-    const pending = new Map();
+    const pending = new Map(), histories = new Map([[id, messages]]);
+    for (const child of children) before.set(child.id, await this.revision(child.id));
+    const statuses = await this.client.statuses();
     for (const session of [id, ...children.map(child => child.id)]) {
+      if (session !== id) histories.set(session, await this.client.messages(session));
       const value = this.client.pending ? await this.client.pending(session) : { inbox: [], forms: [], permissions: [] };
       pending.set(session, { ...value, shells: this.client.shells ? (await this.client.shells(session)).filter(shell => shell.status === "running") : [] });
     }
-    const busy = session => Boolean(statuses[session] && statuses[session].type !== "idle") || Object.values(pending.get(session)).some(items => items.length > 0);
+    const changed = new Set(), unavailable = new Set();
+    for (const [session, seq] of before) {
+      const after = await this.revision(session);
+      if (seq === null || after === null) { unavailable.add(session); changed.add(session); }
+      else if (after !== seq) changed.add(session);
+    }
+    // Re-read one raced snapshot inside this request, without a new clock or
+    // quiet sleep. An absent fence has no reconciliation authority.
+    if (changed.size && !unavailable.size && refreshes > 0) return this.describe(id, refreshes - 1);
+    const currentMessages = session => { const history = histories.get(session); return history.slice(history.findLastIndex(message => message.info.role === "user") + 1); };
+    const busy = session => changed.has(session) || Boolean(statuses[session] && statuses[session].type !== "idle") || Object.values(pending.get(session)).some(items => items.length > 0)
+      || currentMessages(session).some(message => (message.parts ?? []).some(part => part.type === "tool" && ["pending", "running", "streaming"].includes(part.state?.status)));
     for (const child of children) {
-      const history = await this.client.messages(child.id);
+      const history = histories.get(child.id);
       const index = history.findLastIndex(message => message.info.role === "user" && message.info.sessionID === child.id);
       const terminal = index >= 0 && history.slice(index + 1).findLast(message => message.info.role === "idle" && message.info.sessionID === child.id);
-      if (!terminal || busy(child.id)) continue;
+      if (!terminal || busy(child.id)) { Object.assign(child, { status: changed.has(child.id) ? "unknown" : busy(child.id) ? "running" : "idle", native_turn_items: { observed: Boolean(terminal) && !changed.has(child.id), possible_effects: true, pending: busy(child.id) } }); continue; }
       const outcome = terminal.info.outcome;
       if (!["succeeded", "failed", "interrupted"].includes(outcome)) continue;
       Object.assign(child, { status: outcome === "succeeded" ? "completed" : outcome === "failed" ? "failed" : "cancelled",
@@ -237,7 +272,7 @@ export class Runtime {
         native_turn_items: { observed: true, possible_effects: true, pending: false },
         ...(terminal.info.error ? { provider_error: safeProviderError(terminal.info.error) } : {}) });
     }
-    const unsettledChildren = children.filter(child => busy(child.id)).map(child => child.id), status = busy(id) ? "busy" : "idle";
+    const unsettledChildren = children.filter(child => busy(child.id)).map(child => child.id), status = changed.has(id) ? "unknown" : busy(id) ? "busy" : "idle";
     const lastAssistant = messages.findLast(message => message.info?.role === "assistant");
     const inputIndex = messages.findLastIndex(message => message.info.role === "user");
     const idle = messages.slice(inputIndex + 1).findLast(message => message.info.role === "idle");
@@ -245,18 +280,20 @@ export class Runtime {
     await this.observeModels(id, messages, parent);
     this.journaledTools ??= new Map();
     if (this.state.config.journal) journalToolObservations(this.state.config.journal, messages.flatMap(message => (message.parts ?? []).map(part => openCodeToolObservation(part, id, message.info?.id))), this.journaledTools);
-    return { ...record, observed_profile: { provider: lastAssistant?.info?.providerID ?? info.model?.providerID ?? null, model: lastAssistant?.info?.modelID ?? info.model?.id ?? null, reasoning: lastAssistant?.info?.variant ?? info.model?.variant ?? "default", mode: info.agent ?? null },
+    const receipt = { ...record, observed_profile: { provider: lastAssistant?.info?.providerID ?? info.model?.providerID ?? null, model: lastAssistant?.info?.modelID ?? info.model?.id ?? null, reasoning: lastAssistant?.info?.variant ?? info.model?.variant ?? "default", mode: info.agent ?? null },
       assistant_text: (lastAssistant?.parts ?? []).filter(part => part.type === "text").map(part => part.text ?? "").join(""), info, status,
       route_conformance: { matches: [info, ...children].every(session => session.directory && path.resolve(session.directory) === path.resolve(this.state.config.cwd)), expected: this.state.config.cwd, actual: info.directory ?? null, actual_provenance: "native_session_readback" },
       route_violations: [info, ...children].filter(session => !session.directory || path.resolve(session.directory) !== path.resolve(this.state.config.cwd)).map(session => ({ provider_session_id: session.id, expected: this.state.config.cwd, actual: session.directory ?? null, actual_provenance: "native_session_readback" })),
       settled: status === "idle" && !unsettledChildren.length, unsettled_children: unsettledChildren,
       tree_session_ids: treeIds, unsettled_sessions: treeIds.filter(busy),
-      tree_observations: treeIds.map(session => ({ provider_session_id: session, status: busy(session) ? "running" : "idle", settled: !busy(session) })),
+      tree_observations: treeIds.map(session => ({ provider_session_id: session, status: changed.has(session) ? "unknown" : busy(session) ? "running" : "idle", settled: !busy(session) })),
+      ...(changed.size ? { native_settlement: { confirmed: false, state: "unproven", reason: "native_revision_fence_unavailable_or_changed" } } : {}),
       terminal_turn_id: idle && inputIndex >= 0 ? messages[inputIndex].info.id : null,
       terminal_status: idle?.info.outcome === "failed" ? "failed" : idle?.info.outcome === "succeeded" ? "completed" : idle?.info.outcome ?? null,
       native_turn_items: { observed: Boolean(idle), possible_effects: messages.slice(inputIndex + 1).some(message => message.parts.some(part => part.type === "tool")),
-        pending: busy(id) || messages.slice(inputIndex + 1).some(message => message.parts.some(part => part.type === "tool" && ["running", "streaming"].includes(part.state?.status))) },
+        pending: busy(id) },
       children, pending: pending.get(id), usage: usageSnapshot(messages, id), history_sha256: historyDigest(messages), message_count: messages.length };
+    return nativeExecutionReceipt(receipt, { daemonId: this.state.daemon_id, revision: before.get(id) ?? 0 });
   }
   async observeModels(id, messages, parent = null) {
     this.modelMessages ??= new Set();
@@ -301,18 +338,24 @@ export class Runtime {
   async cancelTree(id, seen = new Set()) {
     if (!this.sessions.has(id)) throw new DaemonError("foreign_session", "cannot cancel a Session without daemon ownership");
     if (seen.has(id)) return [];
-    const native = await this.client.inspect(id), retained = this.sessions.get(id);
-    if (native.id !== id || (retained.parent_provider_session_id ?? null) !== (native.fork ? null : native.parentID ?? null)) throw new DaemonError("session_identity_mismatch", "OpenCode cancellation Session ancestry changed");
-    this.retainSession(native, retained.root_provider_session_id ?? id);
+    const retained = this.sessions.get(id), errors = [];
+    let native;
+    try { native = await this.client.inspect(id); }
+    catch (error) { errors.push({ session_id: id, phase: "inspect", ...errorPayload(error) }); }
+    if (native) {
+      if (native.id !== id || (retained.parent_provider_session_id ?? null) !== (native.fork ? null : native.parentID ?? null)) throw new DaemonError("session_identity_mismatch", "OpenCode cancellation Session ancestry changed");
+      try { this.retainSession(native, retained.root_provider_session_id ?? id); }
+      catch (error) { errors.push({ session_id: id, phase: "retain", ...errorPayload(error) }); }
+    }
     seen.add(id);
-    const errors = []; let children = [];
-    try { children = await this.client.children(id); } catch (error) { errors.push({ session_id: id, phase: "children", ...errorPayload(error) }); }
+    let children = [];
+    try { children = await this.ownedChildren(id); } catch (error) { errors.push({ session_id: id, phase: "children", ...errorPayload(error) });
+      children = [...this.sessions.values()].filter(record => record.parent_provider_session_id === id).map(record => ({ id: record.provider_session_id, parentID: id, directory: record.cwd })); }
     for (const child of children) {
       if (child.parentID !== id || child.fork || this.sessions.has(child.id) && this.sessions.get(child.id).parent_provider_session_id !== id) {
         errors.push({ session_id: child.id, phase: "identity", code: "session_identity_mismatch" }); continue;
       }
-      this.retainSession(child, this.sessions.get(id)?.root_provider_session_id ?? id);
-      try { errors.push(...await this.cancelTree(child.id, seen)); }
+      try { this.retainSession(child, this.sessions.get(id)?.root_provider_session_id ?? id); errors.push(...await this.cancelTree(child.id, seen)); }
       catch (error) { errors.push({ session_id: child.id, phase: "cancel_child", ...errorPayload(error) }); }
     }
     try { await this.client.abort(id); } catch (error) { errors.push({ session_id: id, phase: "abort", ...errorPayload(error) }); }
@@ -467,7 +510,10 @@ export class Runtime {
         },
         ...(params.cancelTree ? { cancel: id => this.cancelTree(id) } : {})
       });
-      return { clean: true };
+      // Fresh native observation, not a prior productive result, owns the idle proof.
+      commitDaemonShutdown(this.paths.dir);
+      await this.persist({ active_tree: false });
+      return { clean: true, settled: true, native_settled: true };
       }, [
         ["provider", () => stopProcessGroup(this.child)],
         ["provider_resource", () => finishDaemonProcess(this.state.config, this.providerProcess)],

package/dist/harness-runtime/lib/dd-opencode.mjs

@@ -14,6 +14,33 @@ const lost = (message, details) => new OpenCodeError("operation_observation_lost
 export const requestDigest = value => createHash("sha256").update(JSON.stringify(value)).digest("hex");
 export const nativeModel = ({ provider, model, variant }) => ({ providerID: provider, id: model, ...(variant && variant !== "default" ? { variant } : {}) });
 
+/** Native finite session.log includes a control watermark, not a domain event. */
+export function decodeFiniteLog(items, sessionId, after = 0) {
+  const fail = (reason, field, unproven = false) => { throw new OpenCodeError(unproven ? "opencode_observation_unproven" : "opencode_observation_corrupt", "OpenCode finite log has no trustworthy revision", false,
+    { native_outcome: "unknown", session_id: sessionId, cursor: after, reason, field }); };
+  if (!Number.isSafeInteger(after) || after < 0) fail("invalid_cursor", "after");
+  if (!Array.isArray(items)) fail("invalid_batch", "items");
+  const events = []; let watermark, cursor = after;
+  for (const item of items) {
+    if (watermark !== undefined) fail("frame_after_sync", "type");
+    const sync = item?.type === "log.synced", metadata = sync ? item : item?.durable;
+    if (!metadata) fail("missing_metadata", "durable");
+    if (metadata.aggregateID !== sessionId) fail("foreign_aggregate", sync ? "aggregateID" : "durable.aggregateID");
+    if (!Number.isSafeInteger(metadata.seq) || metadata.seq < 0) fail("invalid_sequence", sync ? "seq" : "durable.seq", sync && metadata.seq === undefined);
+    if (sync) {
+      if (metadata.seq < cursor) fail("watermark_behind_cursor", "seq");
+      watermark = metadata.seq;
+    } else {
+      if (typeof item.type !== "string" || !item.type.startsWith("session.") || !item.data || typeof item.data !== "object") fail("invalid_domain_event", "type/data");
+      if (item.data.sessionID !== undefined && item.data.sessionID !== sessionId) fail("foreign_session", "data.sessionID");
+      if (metadata.seq <= cursor) fail("non_increasing_sequence", "durable.seq");
+      cursor = metadata.seq; events.push(item);
+    }
+  }
+  if (watermark === undefined) fail("missing_sync", "log.synced", true);
+  return { events, watermark };
+}
+
 /** info/parts is our normalized projection, not a second v1 native protocol. */
 export function normalizeMessage(message, sessionID) {
   if (!message?.id || !message.type) throw lost("OpenCode message has no native identity");
@@ -124,7 +151,7 @@ export class OpenCodeClient {
     try { for await (const event of api.session.log({ sessionID: id, after, follow: false }, { signal: controller.signal })) events.push(event); }
     catch (cause) { throw Object.assign(lost("OpenCode durable log observation failed", { session_id: id }), { cause }); }
     finally { clearInterval(timer); }
-    return events;
+    return decodeFiniteLog(events, id, after);
   }
   async abort(id) {
     // Queued input must not become fresh work during interruption cleanup.
@@ -221,15 +248,15 @@ export class OpenCodeClient {
       for (;;) {
         try {
           await checkHookFailures?.();
-          const events = await this.logs(id, state.cursor);
+          const { events, watermark } = await this.logs(id, state.cursor);
           let delivered = state.delivered === true, terminal = state.terminal;
           for (const event of events) {
-            if (!Number.isInteger(event.durable?.seq) || event.durable.seq <= state.cursor) continue;
             if (event.type === "session.inbox.delivered" && event.data.inboxID === messageId) { delivered = true; terminal = null; }
             if (delivered && event.type === "session.execution.started") terminal = null;
             if (delivered && ["session.execution.succeeded", "session.execution.failed", "session.execution.interrupted"].includes(event.type)) terminal = { type: event.type, error: event.data.error };
             state = { ...state, cursor: event.durable.seq, delivered, terminal }; await save?.(state);
           }
+          if (state.cursor !== watermark) { state = { ...state, cursor: watermark }; await save?.(state); }
           let runningTools = false;
           const observe = async (session, visited = new Set()) => {
             if (visited.has(session)) throw lost("OpenCode topology contains a cycle"); visited.add(session); known.add(session);

package/dist/harness-runtime/lib/dd-zcode-daemon.mjs

@@ -30,7 +30,7 @@ import {
 } from "./dd-zcode.mjs";
 
 const REQUEST_SCHEMA = "dd-zcode/daemon-request@1";
-import { settledNativeTree } from "./native-children.mjs";
+import { settledNativeTree, nativeExecutionReceipt } from "./native-children.mjs";
 const RESPONSE_SCHEMA = "dd-zcode/daemon-response@1";
 const STATE_SCHEMA = "dd-zcode/daemon-state@1";
 // ACP silence starts diagnostics; it is not a provider-failure deadline.
@@ -549,7 +549,7 @@ export class DaemonRuntime {
         for (const receipt of [previous, closed]) {
           if (receipt?.close?.closed === true && receipt.settled === true
             && receipt.topology?.complete === true && receipt.topology.root_session_id === params.sessionId
-            && Array.isArray(receipt.topology.child_session_ids)) return receipt;
+            && Array.isArray(receipt.topology.child_session_ids)) return nativeExecutionReceipt(receipt, { daemonId: this.state.daemon_id, generation: this.controlGeneration ?? 0 });
         }
         const known = [...new Set([...topology.child_session_ids, ...(previous?.topology?.child_session_ids ?? [])])];
         const emptyRoot = this.neverPromptedRootProof(params.sessionId);
@@ -559,7 +559,7 @@ export class DaemonRuntime {
         this.state.settlement_observations ??= {};
         this.state.settlement_observations[params.sessionId] = observation;
         await this.persist();
-        return observation;
+        return nativeExecutionReceipt(observation, { daemonId: this.state.daemon_id, generation: this.controlGeneration ?? 0 });
       }
       const adapter = params.adapterSessionId ?? params.sessionId;
       if (!this.liveAdapters.has(adapter) && this.activeProductive) {
@@ -584,8 +584,8 @@ export class DaemonRuntime {
       const childIds = [...new Set([...(this.sessions.get(result.provider_session_id)?.known_child_session_ids ?? []), ...zcodeChildSessionIds(nativeChildren)])];
       const childStates = new Map([...(nativeChildren?.ended?.items ?? nativeChildren?.completed ?? []), ...(nativeChildren?.running ?? []).map(child => ({ ...child, status: "running" }))].map(child => [child.childSessionId ?? child.sessionId, child.status]));
       const rootSettled = !this.activeProductive && failure?.provider_session_id === result.provider_session_id && (result.evidence ?? result).read?.projection?.status === "idle";
-      return { ...result, settled, ...settledNativeTree(result.provider_session_id, childIds.map(childSessionId => ({ childSessionId, status: childStates.get(childSessionId) ?? "unknown" })), settled, rootSettled),
-        ...(failure?.provider_session_id === result.provider_session_id ? { terminal_turn_id: String(failure.request_id) } : {}) };
+      return nativeExecutionReceipt({ ...result, settled, ...settledNativeTree(result.provider_session_id, childIds.map(childSessionId => ({ childSessionId, status: childStates.get(childSessionId) ?? "unknown" })), settled, rootSettled),
+        ...(failure?.provider_session_id === result.provider_session_id ? { terminal_turn_id: String(failure.request_id) } : {}) }, { daemonId: this.state.daemon_id, generation: this.controlGeneration ?? 0 });
     }
     if (operation === "session.cancel") {
       if (!this.sessions.has(params.sessionId)) throw new DaemonError("session_identity_mismatch", "cancellation Session is not owned by this daemon");
@@ -604,6 +604,7 @@ export class DaemonRuntime {
       return result;
     }
     if (operation === "daemon.stop") return await completeDaemonShutdown(this.paths.dir, this.state, patch => this.persist(patch), () => this.prepareStop(params.cancelTree === true), [
+      ["provider", () => this.bridge.close?.()],
       ["provider_resource", () => finishDaemonProcess(this.state.config, this.state.provider_process)],
       ["daemon_resource", () => finishDaemonProcess(this.state.config, this.state.resource_process)]
     ]);
@@ -691,7 +692,7 @@ export class DaemonRuntime {
     try { if (!bridgeClosed && typeof this.bridge.close === "function") await this.bridge.close(); }
     catch (error) { throw new DaemonError(error.code ?? "provider_process_stop_incomplete", error.message ?? String(error), false, error.details); }
     await this.persist({ active_tree: false, shutdown_state: "stopping", active_operation: null, active_request: null, physical_settlement: { confirmed_at: new Date().toISOString(), bridge_pid: this.bridge.child?.pid ?? null } });
-    return { daemon_id: this.state.daemon_id, stopped: true, clean: true, physical_settlement: this.state.physical_settlement, _shutdown: true };
+    return { daemon_id: this.state.daemon_id, stopped: true, clean: true, settled: true, native_settled: true, physical_settlement: this.state.physical_settlement, _shutdown: true };
   }
 
 }

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -3,7 +3,7 @@ import { ToolObservations, acpToolObservation, zcodePhysicalSession } from "./to
 import { hookBudget, invokeNativeHook } from "./native-hook-command.mjs";
 import { parseLifecycleCommand, continuationCommand, commandOption } from "./lifecycle-command.mjs";
 import { spawn } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { createReadStream } from 'node:fs';
 import { publishSetup, SETUP_STARTUP_MS } from './setup-progress.mjs';
 import { appendFile, mkdir, readFile, writeFile } from "node:fs/promises";
@@ -141,6 +141,10 @@ export class AcpBridge {
     this.expiredRequests = new Map();
     this.sessionActivity = new Map();
     this.notifications = Promise.resolve();
+    this.terminalOutcomes = Promise.resolve();
+    this.terminalRequests = new Map();
+    this.connectionId = randomUUID();
+    this.receivedSequence = 0;
     this.lifecycleNotifications = new Set();
     this.notificationError = null;
     this.bridgeStderr = "";
@@ -202,16 +206,27 @@ export class AcpBridge {
   receive(line) {
     let message;
     try { message = JSON.parse(line); } catch { this.journal.write("malformed", { line }); return; }
+    const observation = { connection_id: this.connectionId, sequence: ++this.receivedSequence, productive: isProductiveSessionNotification(message) };
     const request = message.id !== undefined ? this.pending.get(message.id) : null;
     const expired = message.id !== undefined ? this.expiredRequests.get(message.id) : null;
     const isResponse = message.id !== undefined && !message.method;
     const rejected = isResponse && this.rejectedHookRequests?.get(message.id);
-    if (rejected) {
-      this.rejectedHookRequests.delete(message.id);
-      const terminal = { request_id: message.id, method: rejected.method, session_id: rejected.sessionId, terminal_response: message };
+    if (rejected || isResponse && (request?.method === "session/prompt" || this.terminalRequests.has(message.id))) {
+      const owner = rejected ?? request ?? this.terminalRequests.get(message.id);
+      const terminal = { request_id: message.id, method: owner.method, session_id: owner.sessionId, terminal_response: message,
+        connection_id: this.connectionId, operation_id: owner.operationId ?? null, generation: owner.generation ?? null, native_sequence: observation.sequence };
+      this.terminalOutcomes = this.terminalOutcomes.then(async () => {
+        await this.journal.write(rejected ? "native_terminal_after_hook_failure" : "native_terminal_outcome", terminal);
+        await this.journal.flush();
+        await this.options.onTerminalOutcome?.(terminal);
+        this.terminalRequests.set(message.id, owner);
+        while (this.terminalRequests.size > 128) this.terminalRequests.delete(this.terminalRequests.keys().next().value);
+        if (rejected) this.rejectedHookRequests.delete(message.id);
+      });
+      void this.terminalOutcomes.catch(storage => { this.terminalProjectionError ??= storage; if (rejected) rejected.error.cleanup_error ??= errorRecord(storage); });
+      if (rejected) {
       rejected.error.details = { ...rejected.error.details, native_terminal_after_hook_failure: terminal };
-      try { void Promise.resolve(this.journal.write("native_terminal_after_hook_failure", terminal)).catch(storage => { rejected.error.cleanup_error ??= errorRecord(storage); }); }
-      catch (storage) { rejected.error.cleanup_error ??= errorRecord(storage); }
+      }
     }
     if (!isResponse || request) this.journal.writeInbound(message, request?.method);
     if (typeof message.params?.sessionId === "string" && isProductiveSessionNotification(message)) this.observeActivity(message.params.sessionId, message.params.update);
@@ -305,7 +320,7 @@ export class AcpBridge {
       return;
     }
     if (message.method) this.notifications = this.notifications
-      .then(async () => { await this.observeModelUpdate(message); await this.options.onNotification?.(message); })
+      .then(async () => { await this.observeModelUpdate(message); await this.options.onNotification?.(message, observation); })
       .catch(async (error) => {
         const failure = { code: error.code ?? "notification_observation_failed", message: error.message, ...(error.details ? { details: error.details } : {}), session_id: message.params?.sessionId ?? null, tool_call_id: message.params?.update?.toolCallId ?? null, event_time: now(), delivery_stage: "acp_evidence", completeness: "incomplete" };
         try { await this.journal.write("notification_failure", failure); }
@@ -405,6 +420,7 @@ export class AcpBridge {
   }
 
   request(method, params = {}, timeoutMs = 30_000, { idleSessionId = null, idleTimeoutMs = null, inactivityMode = "reject" } = {}) {
+    if (method === "session/prompt" && (this.rejectedHookRequests?.size ?? 0) + [...this.pending.values()].filter(request => request.method === "session/prompt").length >= 32) return Promise.reject(Object.assign(new Error("Unreconciled native terminal evidence limit reached"), { code: "native_terminal_evidence_pending" }));
     if (timeoutMs !== null) validateObservationDuration(timeoutMs);
     if (idleTimeoutMs !== null) validateObservationDuration(idleTimeoutMs);
     if ((this.lifecycleFailure || this.notificationError?.code === "profile_integrity_violation") && ["session/new", "session/prompt", "session/fork"].includes(method)) return Promise.reject(this.lifecycleFailure ?? this.notificationError);
@@ -467,9 +483,19 @@ export class AcpBridge {
           void this.journal.write("inactivity_observation_failure", { method, request_id: id, session_id: idleSessionId, error: { code: error?.code ?? "inactivity_observation_failed", message: error?.message ?? String(error) } }).catch(() => {});
         });
       }, Math.max(10, Math.min(1_000, Math.floor(validIdleTimeout / 4)))) : null;
-      this.pending.set(id, { id, resolve, reject, timer, idleTimer, method, sessionId: params.sessionId ?? null, dispatchedAt: Date.now(), publish: operationProgressReporter() });
-      this.send({ jsonrpc: "2.0", id, method, params });
-      if (method === "session/prompt") this.journal.write("native_dispatch", { operation_id: this.dispatchOperationId ?? process.env.DD_EVAL_OPERATION_ID ?? null, session_id: params.sessionId, native_request_id: id });
+      this.pending.set(id, { id, resolve, reject, timer, idleTimer, method, sessionId: params.sessionId ?? null, operationId: this.dispatchOperationId ?? process.env.DD_EVAL_OPERATION_ID ?? null, generation: this.dispatchGeneration ?? null, dispatchedAt: Date.now(), publish: operationProgressReporter() });
+      if (method === "session/prompt") {
+        void (async () => {
+          const dispatch = { operation_id: this.pending.get(id)?.operationId, session_id: params.sessionId, native_request_id: id,
+            connection_id: this.connectionId, generation: this.pending.get(id)?.generation };
+          await this.journal.write("native_dispatch_prepared", dispatch);
+          await this.journal.flush();
+          await this.options.onPromptDispatch?.(dispatch);
+          if (!this.pending.has(id) || this.pending.get(id).timedOut || this.lifecycleFailure) return;
+          this.send({ jsonrpc: "2.0", id, method, params });
+          await this.journal.write("native_dispatch", dispatch);
+        })().catch(finish);
+      } else this.send({ jsonrpc: "2.0", id, method, params });
     });
   }
 
@@ -488,14 +514,14 @@ export class AcpBridge {
   rejectAll(error) {
     for (const [id, pending] of this.pending) {
       if (this.notificationError === error && pending.method === "session/prompt") {
-        this.rejectedHookRequests ??= new Map(); this.rejectedHookRequests.set(id, { method: pending.method, sessionId: pending.sessionId, error });
-        if (this.rejectedHookRequests.size > 32) this.rejectedHookRequests.delete(this.rejectedHookRequests.keys().next().value);
+        this.rejectedHookRequests ??= new Map(); this.rejectedHookRequests.set(id, { method: pending.method, sessionId: pending.sessionId, operationId: pending.operationId, generation: pending.generation, error });
       }
       clearTimeout(pending.timer); if (pending.idleTimer) clearInterval(pending.idleTimer); pending.reject(error);
     }
     this.pending.clear();
   }
   async flush() {
+    await this.terminalOutcomes;
     if (this.notificationError) throw this.notificationError;
     try { await Promise.all([...this.lifecycleNotifications]); await this.notifications; await this.journal.flush(); }
     catch (error) { throw this.notificationError ?? error; }
@@ -507,6 +533,7 @@ export class AcpBridge {
     // Draining them must not relabel a successful physical shutdown as failed.
     return await closeBridgeProcess(this, async () => {
       await Promise.all([this.nativeDrain, this.diagnostics]);
+      await this.terminalOutcomes;
       await Promise.allSettled([...this.lifecycleNotifications, this.notifications]);
       if (this.notificationError) await hookBudget(1_000, null).run(() => this.journal.flush(), "failure_drain");
       else await this.journal.flush();
@@ -964,6 +991,7 @@ export function zcodeLifecycleQualification(sha256, bridgeCommit, harnessContrac
     native_nested_children: false, reason: qualified ? null : "native_event_contract_unqualified" };
 }
 
+let doctorDigestScanOrdinal = 0;
 export async function doctor(options = {}) {
   const zcodeAcp = await commandOutput(options.bin, ["--version"]);
   const zcodeAcpCommit = await commandOutput(options.bin, ["--dd-harness-commit"]);
@@ -971,11 +999,13 @@ export async function doctor(options = {}) {
   const zcodePath = options.zcodePath ?? process.env.ZCODE_BIN ?? process.env.ZCODE_PATH ?? "/Applications/ZCode.app/Contents/Resources/glm/zcode.cjs";
   const zcode = await commandOutput(zcodePath, ["--version"]);
   const hash = createHash('sha256'); let bytes = 0;
+  const scan = `zcode-digest:${zcodePath}:scan-${++doctorDigestScanOrdinal}`;
+  publishSetup('probe_started', scan);
   for await (const chunk of createReadStream(zcodePath)) {
     hash.update(chunk); bytes += chunk.length;
-    if (bytes % (4 * 1024 * 1024) < chunk.length) publishSetup('identity_digest_progress', bytes);
+    if (bytes % (4 * 1024 * 1024) < chunk.length) publishSetup('identity_digest_progress', `${scan}:${bytes}`);
   }
-  const sha256 = hash.digest('hex'); publishSetup('identity_digest_completed');
+  const sha256 = hash.digest('hex'); publishSetup('identity_digest_completed', scan);
   const qualification = zcodeLifecycleQualification(sha256, zcodeAcpCommit, ddHarness);
   return { compatible: qualification.status === "qualified", contract_supported: supportedZcodeHarnessContract(ddHarness), lifecycle_qualification: qualification, observed_runtime: { zcode, zcode_acp: zcodeAcp, zcode_acp_commit: zcodeAcpCommit, dd_harness_contract: ddHarness } };
 }

package/dist/harness-runtime/lib/delegation-instructions.mjs

@@ -60,7 +60,7 @@ export function delegationContract(harness) {
   return `dd-flow/delegation/${key}@${["codex", "opencode"].includes(key) ? 2 : 1}`;
 }
 
-export const lifecycleCommandCompletionInstruction = "Run runtime-issued lifecycle CLI calls in the foreground, never with a native background or detached-shell option. A shell tool may yield before the lifecycle process exits. Retain and poll its exact process/session handle to completion, including inside a tool wrapper; empty interim output is not a CLI result. If a wrapper returns 'Script running with cell ID …', use that wrapper's wait tool to finish the same cell before expecting an inner shell session handle; do not execute the command again. Read final stdout or response_file before deciding continuation, and never reissue the command while it is pending.";
+export const lifecycleCommandCompletionInstruction = "Run runtime-issued lifecycle CLI calls in the foreground, never with a native background or detached-shell option. A shell tool may yield before the lifecycle process exits. Retain and poll its exact process/session handle to completion, including inside a tool wrapper; empty interim output is not a CLI result. If a wrapper returns 'Script running with cell ID …', use that wrapper's wait tool to finish the same cell before expecting an inner shell session handle; do not execute the command again. Read final stdout or response_file before deciding continuation, and never reissue the command while it is pending. When the result provides prompt_delivery, read its complete plain Markdown file at prompt_delivery.path before working; it contains the current instructions, unlike the historical prompt_path. If delivery publication is pending, stop for reconciliation without repeating the accepted command.";
 
 export const lifecycleRetryInstruction = `${lifecycleCommandCompletionInstruction} A failure is not permission to replay a lifecycle command. For proven effect=no_effect with recoverable=true and retry_command, correct the input and execute that exact issued successor. A check failure can retain receipts while leaving Work running: correct the evidenced cause first, then use the CLI's exact retry_command for an intentional fresh check attempt; never replay a check merely because Work is unsettled. If a successful CODE finish returns outcome=verification_required, inspect the retained receipts, update its verification file, and use only next.finish_command: the Stage is still running and the previous invocation ID is consumed. If continuation.kind=repair_required, or a successful result has outcome=repair_required and a repair Work ID, end this Turn for the registered repair child; use any retry_command only after that repair settles and verification is refreshed. Unknown effects require reconciliation, never replay. A committed effect without an explicit continuation is not retryable. A native shell launch refusal before the CLI starts permits correcting only that shell-form error and retrying the same exact command. Otherwise report the primary error and stop; never invent IDs, call hooks directly, or run status as a substitute.`;
 

package/dist/harness-runtime/lib/driver-recovery.mjs

@@ -6,22 +6,23 @@ import { writeJsonAtomic } from "./runner-events.mjs";
 import { reportedError } from "./operation-errors.mjs";
 import { ObservationClock } from "./observation-clock.mjs";
 import { runtimeProcess } from "./managed-daemon.mjs";
+import { nativeShutdownConfirmed } from "./native-children.mjs";
 
-function cleanShutdownConfirmed(state) {
+async function cleanShutdownConfirmed(root, state) {
   const proof = state.shutdown;
+  let fence;
+  try { fence = JSON.parse(await readFile(path.join(root, 'operation-fence.json'), 'utf8')); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
   return state.shutdown_state === "clean" && state.active_tree === false
-    && proof?.schema_id === "dd-flow/daemon-shutdown@1" && proof.daemon_id === state.daemon_id
-    && proof.result?.clean === true && Array.isArray(proof.required_phases)
-    && proof.required_phases.length >= 3 && proof.required_phases.includes("tree")
-    && proof.required_phases.includes("daemon_resource")
-    && proof.required_phases.every(phase => typeof phase === "string" && proof.phases?.[phase] === true);
+    && typeof state.daemon_id === 'string' && fence?.daemon_id === state.daemon_id && Number.isSafeInteger(fence.generation) && fence.generation >= 0
+    && nativeShutdownConfirmed(proof, { daemonId: state.daemon_id, generation: fence.generation });
 }
 
 /** Explicit same-Session restart retains native stores and the old daemon
  * receipt; it does not turn a terminal directory into a new execution. */
 export async function authorizeRetainedDaemonResume(root, previous, sessionId, config) {
   const sessions = [...(previous.sessions ?? []), ...(previous.root_session_id ? [previous.root_session_id] : [])];
-  if (!cleanShutdownConfirmed(previous) || typeof sessionId !== "string" || !sessions.some(session => (typeof session === "string" ? session : session.provider_session_id) === sessionId)) throw Object.assign(new Error("terminal daemon restart requires a retained, settled Session identity and complete shutdown proof"), { code: "daemon_state_terminal" });
+  if (!await cleanShutdownConfirmed(root, previous) || typeof sessionId !== "string" || !sessions.some(session => (typeof session === "string" ? session : session.provider_session_id) === sessionId)) throw Object.assign(new Error("terminal daemon restart requires a retained, settled Session identity and complete shutdown proof"), { code: "daemon_state_terminal" });
   for (const key of ["cwd", "projectRoot", "ddFlowHome", "ddFlowBin", "provider", "model", "reasoning", "mode", "variant", "agent", "bin", "noFlow"]) {
     if ((previous.config?.[key] ?? null) !== (config[key] ?? null)) throw Object.assign(new Error(`retained daemon configuration changed: ${key}`), { code: "daemon_config_mismatch" });
   }
@@ -53,7 +54,7 @@ export async function recoverySettlement(driversRoot) {
       }
       else if (entry.name === "daemon.json") {
         const state = JSON.parse(await readFile(file, "utf8"));
-        if (!cleanShutdownConfirmed(state)) throw Object.assign(new Error("provider tree has no complete clean shutdown receipt"), { code: "recovery_settlement_unconfirmed" });
+        if (!await cleanShutdownConfirmed(directory, state)) throw Object.assign(new Error("provider tree has no complete clean shutdown receipt"), { code: "recovery_settlement_unconfirmed" });
         await assertDaemonReplaceable(directory);
         await reconcileDriverReplies(directory);
         if (state.config?.resourceHome && state.resource_process?.id) {

package/dist/harness-runtime/lib/entity-references.d.mts

@@ -0,0 +1,2 @@
+export function shortEntityReference(id: string): string;
+export function entityReferenceVariants(id: string): string[];

package/dist/harness-runtime/lib/entity-references.mjs

@@ -0,0 +1,9 @@
+/** Stable model-facing reference for persisted project, RUN and Work IDs. */
+export function shortEntityReference(id) {
+  return /^(?:PRJ|RUN|WRK)-\d{3,}(?:-|$)/.exec(id)?.[0]?.replace(/-$/, "") ?? id;
+}
+
+/** Accepted spellings of one already-resolved entity. Wrong full slugs stay distinct. */
+export function entityReferenceVariants(id) {
+  return [...new Set([id, shortEntityReference(id)])];
+}

package/dist/harness-runtime/lib/managed-daemon.d.mts

@@ -10,7 +10,7 @@ export function heartbeatDaemonProcess(config: RuntimeConfig, record: ProcessBin
 export function finishDaemonProcess(config: RuntimeConfig, record: ProcessBinding | null | undefined, state?: string, reason?: string): Promise<void>;
 export function cleanupFailedDaemonStart(config: RuntimeConfig, record: ProcessBinding | null, child: ChildProcess | null, original: Error & { details?: Record<string, unknown> }, readState: () => Promise<Record<string, unknown>>, daemonId: string): Promise<void>;
 export function completeBudgetOperation(stateDir: string, request: { id: string; operation: string; params?: { sessionId?: string } }, result: unknown, observe?: () => Promise<Record<string, unknown>>): Promise<Record<string, unknown>>;
-export function stopProcessGroup(child: ChildProcess | null | undefined, graceMs?: number, options?: { detached?: boolean; settlementMs?: number }): Promise<void>;
+export function stopProcessGroup(child: ChildProcess | { pid: number; started: string } | null | undefined, graceMs?: number, options?: { detached?: boolean; settlementMs?: number; started?: string }): Promise<void>;
 export function assertStartupChild(child: Pick<ChildProcess, "pid" | "exitCode" | "signalCode">, expected: Record<string, unknown>, observed: Record<string, unknown> | null, log: string): void;
 export function retainStartupFailure(input: { state: Record<string, unknown>; publish: (state: Record<string, unknown>) => Promise<unknown>; log: string; error: Error & { code?: string; details?: Record<string, unknown> } }): Promise<void>;
 export function startManagedBridge(input: { config: RuntimeConfig; state: Record<string, unknown>; bridge: { child: ChildProcess | null; options: { onSpawn?: (child: ChildProcess) => Promise<void> }; start: () => Promise<unknown> }; kind: string; publish: (state: Record<string, unknown>) => Promise<unknown>; log?: string }): Promise<unknown>;