@deksden-com/dd-flow-cli 0.9.0-beta.144 → 0.9.0-beta.149

package/dist/harness-runtime/lib/managed-daemon.mjs

@@ -5,6 +5,7 @@ import { commandJson } from "./process-json.mjs";
 import { errorRecord, reportedError, diagnosticJson } from "./operation-errors.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
 import { runBoundedCommand } from "./native-hook-command.mjs";
+import { processSnapshot } from "./process-snapshot.mjs";
 import { createRenewalState, maintenanceRetryable, renewalConfirmed, renewalDelay, renewalFailure, renewalRemaining, RENEWAL_POLICY } from "./lease-renewal.mjs";
 
 const leases = new Map();
@@ -409,21 +410,28 @@ export async function closeManagedBridge(config, state, bridge) {
   await finishDaemonProcess(config, state.provider_process, "stopped", "daemon_stopped");
 }
 
-export function scheduleDaemonProcessHeartbeat(config, record) {
+export function scheduleDaemonProcessHeartbeat(config, record, { signal } = {}) {
   if (!record?.id || !record.lease_token) return;
   const key = leaseKey(config, record);
-  if (leases.has(key)) return;
-  const lease = { pending: null, error: null, timer: null, lost: false, closing: false, expiresAt: Date.parse(record.lease_expires_at ?? ""), renewal: createRenewalState({ leaseExpiresAt: record.lease_expires_at }), stateDir: path.resolve(config.runtime_owner?.state_dir ?? config.stateDir ?? config.cwd), config, record };
+  if (leases.has(key)) {
+    if (signal && leases.get(key).signal !== signal) throw Object.assign(new Error("Heartbeat cancellation owner differs from the retained lease"), { code: "process_maintenance_signal_conflict" });
+    return;
+  }
+  const lease = { pending: null, error: null, timer: null, lost: false, closing: false, signal, expiresAt: Date.parse(record.lease_expires_at ?? ""), renewal: createRenewalState({ leaseExpiresAt: record.lease_expires_at }), stateDir: path.resolve(config.runtime_owner?.state_dir ?? config.stateDir ?? config.cwd), config, record };
   leases.set(key, lease);
   // Retry no-effect contention inside the same authority episode while native
   // work is active; scheduling ticks are not ownership evidence.
   lease.timer = setInterval(() => reconfirmLease(lease, () => {}).catch(() => {}), 60_000);
   lease.timer.unref();
+  if (signal) {
+    signal.addEventListener("abort", () => clearInterval(lease.timer), { once: true });
+    if (signal.aborted) clearInterval(lease.timer);
+  }
 }
 
-export async function heartbeatDaemonProcess(config, record) {
+export async function heartbeatDaemonProcess(config, record, { signal } = {}) {
   if (!record?.id || !record.lease_token) return;
-  scheduleDaemonProcessHeartbeat(config, record);
+  scheduleDaemonProcessHeartbeat(config, record, { signal });
   const lease = leases.get(leaseKey(config, record));
   if (lease.closing) throw Object.assign(new Error("Managed process is closing"), { code: "process_closing" });
   if (lease.lost) throw lease.error;
@@ -435,7 +443,7 @@ export async function heartbeatDaemonProcess(config, record) {
   lease.pending = (async () => {
     try {
       lease.renewal.uncertainSince ??= performance.now();
-      const result = await runtimeProcess(config, "heartbeat", { id: record.id, "lease-token": record.lease_token, "lease-ms": 300_000 }, { timeoutMs: renewalRemaining(lease.renewal) });
+      const result = await runtimeProcess(config, "heartbeat", { id: record.id, "lease-token": record.lease_token, "lease-ms": 300_000 }, { timeoutMs: renewalRemaining(lease.renewal), signal: lease.signal });
       if (result?.ok === false) {
         lease.lost = true; clearInterval(lease.timer);
         throw Object.assign(new Error("managed process lease is no longer owned; new productive operations are blocked"), { code: "process_lease_lost", details: { process_id: record.id } });
@@ -591,14 +599,14 @@ export async function closeBridgeProcess(bridge, drain, stopOptions = {}) {
   finally { bridge.closePending = null; }
 }
 
-export async function stopProcessGroup(child, graceMs = 1_000, { detached = true, settlementMs = 10_000 } = {}) {
+export async function stopProcessGroup(child, graceMs = 1_000, { detached = true, settlementMs = 10_000, started = child?.started ?? null } = {}) {
   if (!child?.pid) return;
   if (processStops.has(child)) return await processStops.get(child);
-  const pending = stopOwnedChild(child, graceMs, detached, settlementMs);
+  const pending = stopOwnedChild(child, graceMs, detached, settlementMs, started);
   processStops.set(child, pending);
   try { return await pending; } finally { processStops.delete(child); }
 }
-async function stopOwnedChild(child, graceMs, detached, settlementMs) {
+async function stopOwnedChild(child, graceMs, detached, settlementMs, started) {
   const target = process.platform === "win32" || !detached ? child.pid : -child.pid;
   const details = signal => ({ pid: child.pid, pgid: target < 0 ? child.pid : null, signal, platform: process.platform, exit_code: child.exitCode ?? null, signal_code: child.signalCode ?? null, observed_at: new Date().toISOString() });
   const alive = () => { try { process.kill(target, 0); return true; } catch (error) { if (error.code === "ESRCH") return false; if (error.code === "EPERM") return true; throw error; } };
@@ -608,6 +616,13 @@ async function stopOwnedChild(child, graceMs, detached, settlementMs) {
     return !alive();
   };
   const signal = async name => {
+    // A retained raw PID is not a ChildProcess handle. Revalidate its birth at
+    // every signal, including escalation after the TERM grace period.
+    if (started !== null) {
+      if (typeof started !== 'string' || !started) throw Object.assign(new Error('process birth identity is invalid'), { code: 'process_identity_unproven' });
+      const observed = (await processSnapshot()).find(item => item.pid === child.pid);
+      if (!observed || observed.started !== started || observed.zombie) return false;
+    }
     try { process.kill(target, name); return true; }
     catch (error) {
       if (error.code === "ESRCH") return false;

package/dist/harness-runtime/lib/native-children.d.mts

@@ -1,4 +1,11 @@
-export const NATIVE_CHILD_CONTRACT_VERSION: "native-children@1";
+export const NATIVE_CHILD_CONTRACT_VERSION: "native-children@2";
+export const NATIVE_TREE_SETTLEMENT_CONTRACT: "native-tree-settlement@2";
+export const NATIVE_SHUTDOWN_CONTRACT: "dd-flow/daemon-shutdown@2";
+export const NATIVE_SHUTDOWN_PHASES: readonly string[];
+export function nativeShutdownConfirmed(receipt: unknown, binding?: { daemonId?: string; generation?: number }): boolean;
+export function nativeExecutionReceipt(receipt: Record<string, unknown>, options?: { daemonId?: string; generation?: number; revision?: number; resources?: Record<string, unknown> }): Record<string, unknown>;
+export type NativeTreeReadiness = "ready" | "owned_children_live" | "inspection_pending" | "unproven";
+export function nativeTreeReadiness(receipt: Record<string, unknown>, binding: { sessionId: string; operationId: string; turnId?: string; requestProof?: unknown; allowDescendants?: boolean }): NativeTreeReadiness;
 export function settledNativeTree(root: string, children: Record<string, unknown>[], settled: boolean, rootSettled?: boolean): Record<string, unknown>;
 export function safeNativeFailure(value: unknown): Record<string, unknown> | undefined;
 export interface NativeChild {

package/dist/harness-runtime/lib/native-children.mjs

@@ -1,9 +1,104 @@
-export const NATIVE_CHILD_CONTRACT_VERSION = "native-children@1";
+export const NATIVE_CHILD_CONTRACT_VERSION = "native-children@2";
+export const NATIVE_TREE_SETTLEMENT_CONTRACT = "native-tree-settlement@2";
+export const NATIVE_SHUTDOWN_CONTRACT = "dd-flow/daemon-shutdown@2";
+export const NATIVE_SHUTDOWN_PHASES = Object.freeze(["execution", "owned_resources", "provider", "daemon_resource"]);
 import { errorRecord } from "./operation-errors.mjs";
 import { safeProviderError } from "./provider-overload-policy.mjs";
+import { streamRequestKey } from "./provider-overload-policy.mjs";
+const liveStatus = value => ["active", "running", "inprogress", "pending", "streaming", "busy"].includes(String(typeof value === "object" && value ? value.type : value).toLowerCase());
+
+/** One current receipt only. Producers, not status ranks, establish freshness. */
+export function nativeTreeReadiness(receipt, { sessionId, operationId, turnId, requestProof, allowDescendants = true } = {}) {
+  if (receipt?.native_settlement?.contract !== NATIVE_TREE_SETTLEMENT_CONTRACT || receipt.native_settlement.scope !== "required_execution") return "unproven";
+  if (!receipt || typeof sessionId !== "string" || !sessionId || typeof operationId !== "string" || !operationId || receipt.provider_session_id !== sessionId
+    || turnId !== undefined && receipt.terminal_turn_id !== undefined && receipt.terminal_turn_id !== turnId) return "unproven";
+  const requestKey = requestProof?.kind === "stream_request" ? streamRequestKey(requestProof) : null;
+  if (requestProof?.kind === "stream_request" && (!requestKey || requestProof.operation_id !== operationId
+    || streamRequestKey(receipt.terminal_metadata?.request_proof) !== requestKey)) return "unproven";
+  const pending = receipt.native_settlement;
+  if (pending?.state === "inspection_pending") {
+    const clock = pending.observation_clock;
+    return receipt.settled === false && pending.confirmed === false && pending.operation_id === operationId
+      && pending.provider_session_id === sessionId && requestKey && pending.request_key === requestKey
+      && clock?.policy === "operation-progress@1" && Number.isFinite(clock.started_at)
+      && Number.isSafeInteger(clock.timeout_ms) && clock.timeout_ms > 0 && clock.timeout_ms <= 2147483647
+      && Number.isFinite(clock.elapsed_ms) && clock.elapsed_ms >= 0 && clock.elapsed_ms < clock.timeout_ms
+      && Number.isSafeInteger(clock.gaps) && clock.gaps >= 0
+      && typeof clock.uncertain === "boolean"
+      && Number.isFinite(clock.uncertainty_elapsed_ms) && clock.uncertainty_elapsed_ms >= 0
+      && (clock.observed_at === null || Number.isFinite(clock.observed_at))
+      && clock.observation_lost === false ? "inspection_pending" : "unproven";
+  }
+  if (receipt.native_turn_items?.pending === true) return "unproven";
+  const ids = receipt.tree_session_ids, observations = receipt.tree_observations, unsettled = receipt.unsettled_sessions;
+  if (!Array.isArray(ids) || !ids.length || ids[0] !== sessionId || ids.some(id => typeof id !== "string" || !id)
+    || new Set(ids).size !== ids.length || !allowDescendants && ids.length !== 1
+    || !Array.isArray(observations) || observations.length !== ids.length
+    || !ids.every(id => observations.filter(item => item?.provider_session_id === id).length === 1)
+    || observations.some(item => !item || typeof item !== "object" || Array.isArray(item) || typeof item.settled !== "boolean" || item.settled === true && liveStatus(item.status)) || !Array.isArray(unsettled)
+    || new Set(unsettled).size !== unsettled.length) return "unproven";
+  // A producer's tree list cannot silently omit another positively observed
+  // owned child. Normalize the same receipt, not a second historical ledger.
+  try {
+    const children = normalizeNativeChildren(receipt, sessionId);
+    if (children.some(child => !ids.includes(child.session_id) || !ids.includes(child.parent_session_id) || child.parent_session_id === child.session_id)) return "unproven";
+    for (const child of children) {
+      let parent = child.parent_session_id;
+      const visited = new Set([child.session_id]);
+      while (parent !== sessionId) {
+        if (visited.has(parent)) return "unproven";
+        visited.add(parent); parent = children.find(item => item.session_id === parent)?.parent_session_id;
+        if (!parent) return "unproven";
+      }
+    }
+  } catch { return "unproven"; }
+  const live = observations.filter(item => !item.settled);
+  if (unsettled.length !== live.length || !live.every(item => unsettled.includes(item.provider_session_id))) return "unproven";
+  const settlement = receipt.settlement;
+  const budgetSettled = !settlement || settlement.state === "not_required"
+    || settlement.state === "settled" && settlement.operation_ids?.includes(operationId) === true;
+  if (receipt.settled === true && receipt.native_settled !== false && pending?.confirmed !== false && !live.length && budgetSettled) return "ready";
+  const root = observations.find(item => item.provider_session_id === sessionId);
+  const knownLive = live.length > 0 && live.every(item => item.provider_session_id !== sessionId && liveStatus(item.status));
+  return allowDescendants && receipt.settled === false && root.settled === true && knownLive
+    && (!settlement || settlement.state === "not_required" || settlement.state === "pending" && settlement.reason === "tree_unsettled")
+    ? "owned_children_live" : "unproven";
+}
 
 function nativeFailure(code, message, exitCode, details) { return Object.assign(new Error(message), { code, exitCode, details }); }
 
+/** Control settlement is not native settlement; explicit uncertainty wins. */
+export function nativeShutdownConfirmed(receipt, { daemonId, generation } = {}) {
+  const proof = receipt?.schema_id === NATIVE_SHUTDOWN_CONTRACT ? receipt : receipt?.shutdown_proof;
+  const result = receipt?.schema_id === NATIVE_SHUTDOWN_CONTRACT ? receipt.result : receipt;
+  return Boolean(proof?.schema_id === NATIVE_SHUTDOWN_CONTRACT && typeof proof.daemon_id === "string" && proof.daemon_id
+    && (daemonId === undefined || proof.daemon_id === daemonId) && Number.isSafeInteger(proof.generation) && proof.generation >= 0
+    && (generation === undefined || proof.generation === generation)
+    && Array.isArray(proof.required_phases) && new Set(proof.required_phases).size === proof.required_phases.length
+    && NATIVE_SHUTDOWN_PHASES.every(phase => proof.required_phases.includes(phase))
+    && proof.required_phases.every(phase => typeof phase === "string" && proof.phases?.[phase] === true)
+    && result?.daemon_id === proof.daemon_id && result.shutdown_contract === NATIVE_SHUTDOWN_CONTRACT
+    && result.clean === true && result.stopped === true && result.physical_stopped === true
+    && result.native_settled === true && result.settled === true && result.native_settlement?.confirmed !== false
+    && result.resource_retirement?.confirmed !== false);
+}
+
+/** Scope metadata does not manufacture readiness or physical cleanup. */
+export function nativeExecutionReceipt(receipt, { daemonId, generation = 0, revision = 0, resources } = {}) {
+  if (receipt.native_settlement?.contract !== undefined && receipt.native_settlement.contract !== NATIVE_TREE_SETTLEMENT_CONTRACT
+    || receipt.native_settlement?.scope !== undefined && receipt.native_settlement.scope !== "required_execution")
+    throw Object.assign(new Error("historical native proof requires fresh execution observation"), { code: "native_contract_mismatch" });
+  if ((resources?.entries ?? []).some(item => item.owner_daemon_id !== undefined && item.owner_daemon_id !== daemonId
+    || item.generation !== undefined && item.generation !== generation)) throw Object.assign(new Error("native resource belongs to another owner"), { code: "native_resource_owner_mismatch" });
+  const owner = { owner_daemon_id: daemonId ?? null, generation, revision };
+  return { ...receipt,
+    native_settlement: { ...receipt.native_settlement, contract: NATIVE_TREE_SETTLEMENT_CONTRACT, scope: "required_execution", ...owner },
+    native_resources: { observed_at: new Date().toISOString(), coverage: "unsupported", ...resources,
+      schema_id: "native-resources@1", ...owner,
+      entries: (resources?.entries ?? []).map(item => ({ ...item, owner_daemon_id: owner.owner_daemon_id, generation: owner.generation })) }
+  };
+}
+
 /** Project a positively settled native tree, never infer it from missing activity. */
 export function settledNativeTree(root, children, settled, rootSettled = false) {
   if (settled !== true && rootSettled !== true || typeof root !== "string" || !root || !Array.isArray(children)) return {};
@@ -12,9 +107,9 @@ export function settledNativeTree(root, children, settled, rootSettled = false)
   const observations = [{ provider_session_id: root, status: "idle", settled: true }, ...children.map((child, index) => {
     const status = String(child.status ?? child.state ?? "unknown").toLowerCase();
     const terminal = settled === true || ["completed", "success", "succeeded", "failed", "cancelled", "canceled", "settled_by_root"].includes(status);
-    return { provider_session_id: ids[index], status: terminal ? "idle" : ["running", "active", "inprogress", "pending"].includes(status) ? "running" : "unknown", settled: terminal };
+    return { provider_session_id: ids[index], status: terminal ? "idle" : liveStatus(status) ? "running" : "unknown", settled: terminal };
   })];
-  return { tree_session_ids: [root, ...ids], unsettled_sessions: observations.filter(item => !item.settled).map(item => item.provider_session_id), tree_observations: observations };
+  return { native_settlement: { contract: NATIVE_TREE_SETTLEMENT_CONTRACT, scope: "required_execution" }, tree_session_ids: [root, ...ids], unsettled_sessions: observations.filter(item => !item.settled).map(item => item.provider_session_id), tree_observations: observations };
 }
 
 /** Retain typed failure facts, never provider headers, request bodies or free-form messages. */
@@ -51,6 +146,8 @@ export function normalizeNativeChildren(receipt, rootSessionId) {
       .map(value => text(object(value), ["provider_session_id", "session_id"]))
       .filter(id => id !== null)
   );
+  const unsettledTree = new Set(list(receipt.tree_observations).filter(value => object(value).settled === false)
+    .map(value => text(object(value), ["provider_session_id", "session_id"])).filter(Boolean));
   const add = (raw, source, scopedParent = null, fallback = "unknown") => {
     const value = object(raw);
     const id = text(value, ["provider_session_id", "session_id", "sessionId", "childSessionId", "conversation_id", "conversationId", "id", "subagentId"]);
@@ -66,9 +163,12 @@ export function normalizeNativeChildren(receipt, rootSessionId) {
     // Provider idle means no current activity, not a Work result. Only an
     // explicit terminal result or a separately proven root settlement may be
     // terminal here; unknown states stay unknown for reconciliation.
-    const status = ["completed", "complete", "done", "success", "succeeded"].includes(state) ? "completed" : state === "settled_by_root" ? "settled_by_root" : ["failed", "error"].includes(state) ? "failed" : ["cancelled", "canceled", "interrupted"].includes(state) ? "cancelled" : ["running", "active", "pending"].includes(state) ? "running" : fallback;
+    const status = ["completed", "complete", "done", "success", "succeeded"].includes(state) ? "completed" : state === "settled_by_root" ? "settled_by_root" : ["failed", "error"].includes(state) ? "failed" : ["cancelled", "canceled", "interrupted"].includes(state) ? "cancelled" : liveStatus(state) ? "running" : fallback;
     const rootChild = parent === rootSessionId;
     const settled = rootChild && status === "unknown" && settledTree.has(id) ? "settled_by_root" : status;
+    if ((unsettledTree.has(id) || value.native_turn_items?.pending === true) && ["completed", "failed", "cancelled", "settled_by_root"].includes(settled)
+      || settledTree.has(id) && (unsettledTree.has(id) || status === "running" || value.native_turn_items?.pending === true))
+      throw nativeFailure("native_child_observation_conflict", "Current child outcome contradicts tree observation", 1, { session_id: id, source });
     candidates.push({ session_id: id, parent_session_id: parent ?? "", status: settled, source, ...(rootChild ? {} : { provenance: "parent_mismatch" }),
       ...(text(value, ["terminal_turn_id"]) ? { terminal_turn_id: text(value, ["terminal_turn_id"]) } : {}),
       ...(text(value, ["terminal_observed_at"]) ? { terminal_observed_at: text(value, ["terminal_observed_at"]) } : {}),
@@ -87,9 +187,12 @@ export function normalizeNativeChildren(receipt, rootSessionId) {
     add(value, "zcode/session/subagents", rootSessionId);
   }
   const unique = new Map();
-  const rank = { unknown: 0, running: 1, settled_by_root: 2, completed: 3, failed: 3, cancelled: 3 };
+  const terminal = value => ["completed", "failed", "cancelled", "settled_by_root"].includes(value);
   for (const child of candidates) {
     const previous = unique.get(child.session_id);
+    if (previous && (terminal(previous.status) && child.native_turn_items?.pending === true
+      || terminal(child.status) && previous.native_turn_items?.pending === true))
+      throw nativeFailure("native_child_observation_conflict", "Current child outcome contradicts pending native items", 1, { session_id: child.session_id, observations: [previous, child] });
     if (previous && previous.parent_session_id !== child.parent_session_id) {
       // Keep the contradictory parent visible to the existing provenance gate,
       // independently of input order or which source happened to say success.
@@ -97,17 +200,20 @@ export function normalizeNativeChildren(receipt, rootSessionId) {
       unique.set(child.session_id, { ...foreign, provenance: "parent_mismatch" });
       continue;
     }
-    if (previous && rank[previous.status] === 3 && rank[child.status] === 3 && previous.status !== child.status) throw nativeFailure("native_child_outcome_conflict", "Native child has contradictory terminal outcomes", 1, { session_id: child.session_id, observations: [previous, child] });
+    if (previous && terminal(previous.status) && terminal(child.status) && previous.status !== child.status && ![previous.status, child.status].includes("settled_by_root")) throw nativeFailure("native_child_outcome_conflict", "Native child has contradictory terminal outcomes", 1, { session_id: child.session_id, observations: [previous, child] });
+    if (previous && (previous.status === "running" && terminal(child.status) || child.status === "running" && terminal(previous.status)))
+      throw nativeFailure("native_child_observation_conflict", "Current child has both active and terminal facts", 1, { session_id: child.session_id, observations: [previous, child] });
     if (previous && previous.status === child.status && previous.terminal_turn_id && child.terminal_turn_id && previous.terminal_turn_id !== child.terminal_turn_id)
       throw nativeFailure("native_child_turn_conflict", "Native child has contradictory terminal Turn identities", 1, { session_id: child.session_id, observations: [previous, child] });
     if (previous && previous.status === child.status) {
       unique.set(child.session_id, { ...previous, ...child,
         ...(child.terminal_turn_id ?? previous.terminal_turn_id ? { terminal_turn_id: child.terminal_turn_id ?? previous.terminal_turn_id } : {}),
         ...(child.provider_error ?? previous.provider_error ? { provider_error: child.provider_error ?? previous.provider_error } : {}),
-        ...(child.native_turn_items ?? previous.native_turn_items ? { native_turn_items: child.native_turn_items ?? previous.native_turn_items } : {}) });
+        ...(child.native_turn_items ?? previous.native_turn_items ? { native_turn_items: { ...previous.native_turn_items, ...child.native_turn_items,
+          ...([previous.native_turn_items, child.native_turn_items].some(items => items?.pending === true) ? { pending: true } : {}) } } : {}) });
       continue;
     }
-    if (!previous || rank[child.status] > rank[previous.status]) unique.set(child.session_id, child);
+    if (!previous || previous.status === "unknown" || previous.status === "settled_by_root" && terminal(child.status)) unique.set(child.session_id, child);
   }
   return [...unique.values()].sort((left, right) => left.session_id.localeCompare(right.session_id));
 }

package/dist/harness-runtime/lib/native-hook-command.mjs

@@ -37,7 +37,7 @@ export async function writeNativeHookFailure(stateDir, binding, error, budget) {
   if (!binding?.request_id || !/^[A-Za-z0-9-]{1,128}$/.test(binding.request_id)) return;
   await budget.run(() => writeJsonAtomic(path.join(stateDir, "hook-failures", `${binding.request_id}.json`), {
     ...errorRecord(error), request_id: binding.request_id, observed_at: new Date().toISOString(), native_hook_binding: binding,
-  }), "failure_receipt");
+  }, () => budget.remaining("failure_receipt_commit")), "failure_receipt");
 }
 
 /** Read only requests accepted for this exact live operation, never scan a mailbox. */
@@ -74,7 +74,7 @@ export function hookBudget(timeoutMs = 25_000, deadlineAt = process.env.DD_FLOW_
   return { deadlineAt: Math.floor(Date.now() + duration), remaining, async run(action, phase) {
     const timeoutMs = remaining(phase);
     let timer;
-    try { return await Promise.race([Promise.resolve().then(action), new Promise((_, reject) => { timer = setTimeout(() => reject(Object.assign(new Error(`Native hook deadline exceeded during ${phase}`), { code: "native_hook_timeout", details: { phase, effect: "unknown" } })), timeoutMs); })]); }
+    try { return await Promise.race([Promise.resolve().then(() => { remaining(phase); return action(); }), new Promise((_, reject) => { timer = setTimeout(() => reject(Object.assign(new Error(`Native hook deadline exceeded during ${phase}`), { code: "native_hook_timeout", details: { phase, effect: "unknown" } })), timeoutMs); })]); }
     finally { clearTimeout(timer); }
   } };
 }
@@ -241,8 +241,8 @@ function hookDiagnostics(stderr) {
   }).slice(-16);
 }
 
-export async function invokeNativeHook({ bin, args, nodeBin, payload, home, cwd, env, timeoutMs = 15_000 }) {
-  const output = await runBoundedCommand({ bin, args, nodeBin, input: `${JSON.stringify(payload)}\n`, cwd, env: { ...env, DD_FLOW_HOME: home }, timeoutMs });
+export async function invokeNativeHook({ bin, args, nodeBin, payload, home, cwd, env, timeoutMs = 25_000 }) {
+  const output = await runBoundedCommand({ bin, args, nodeBin, input: `${JSON.stringify(payload)}\n`, cwd, env: { ...env, DD_FLOW_HOME: home }, timeoutMs, cleanupWithinBudget: true });
   let result;
   try { result = JSON.parse(output); } catch { throw Object.assign(new Error("Invalid native hook JSON response"), { code: "native_hook_response_invalid" }); }
   if (result?.ok === false && typeof result.error?.code === "string") throw Object.assign(new Error(result.error.message ?? "Native hook failed"), { code: result.error.code, details: result.error.details });

package/dist/harness-runtime/lib/native-request-proof.mjs

@@ -13,7 +13,7 @@ const fail = reason => { throw Object.assign(new Error('Native request proof doe
  * the adapter, and recomputed by the adapter's shared request builder. */
 export function nativeCommandFingerprint({ executable, args, cwd, env, operationId }) {
   return hashJson({ executable, args, cwd, operation_id: operationId,
-    environment: Object.fromEntries(environmentKeys.map(key => [key, env[key] ?? null])) });
+    environment: Object.fromEntries([...environmentKeys, ...(env.PLAYWRIGHT_BROWSERS_PATH === undefined ? [] : ['PLAYWRIGHT_BROWSERS_PATH'])].map(key => [key, env[key] ?? null])) });
 }
 
 /** Called after the adapter's own argument preparation but before its RPC or

package/dist/harness-runtime/lib/observation-clock.d.mts

@@ -3,12 +3,12 @@ export function validateObservationDuration(value: number, label?: string): numb
 export interface ObservationState {
   policy: string; timeout_ms: number; started_at: number; cursor?: unknown;
   observed_at: number | null; elapsed_ms: number; uncertainty_elapsed_ms: number;
-  gaps: number; observation_lost: boolean;
+  gaps: number; uncertain?: boolean; observation_lost: boolean;
 }
 export class ObservationClock {
   constructor(options: { timeoutMs: number; gapMs?: number; uncertaintyMs?: number;
     wall?: () => number; monotonic?: () => number; onGap?: (value: Record<string, unknown>) => void;
-    saved?: ObservationState | null });
+    saved?: ObservationState | null; snapshotIsLive?: boolean });
   observationLost: boolean;
   sample(progress?: unknown, progressAt?: number): boolean;
   state(): ObservationState;

package/dist/harness-runtime/lib/observation-clock.mjs

@@ -9,7 +9,7 @@ export function validateObservationDuration(value, label = "observation duration
  * progress or proof of provider failure. Durable snapshots retain that episode. */
 export class ObservationClock {
   constructor({ timeoutMs, gapMs = 60_000, uncertaintyMs = 120_000, wall = Date.now,
-    monotonic = () => performance.now(), onGap = () => {}, saved = null }) {
+    monotonic = () => performance.now(), onGap = () => {}, saved = null, snapshotIsLive = false }) {
     validateObservationDuration(timeoutMs); validateObservationDuration(gapMs, "gap duration");
     validateObservationDuration(uncertaintyMs, "observation recovery duration");
     Object.assign(this, { timeoutMs, gapMs, uncertaintyMs, wall, monotonic, onGap });
@@ -21,13 +21,16 @@ export class ObservationClock {
         || !Number.isFinite(saved.started_at) || !Number.isSafeInteger(saved.gaps) || saved.gaps < 0
         || saved.observed_at !== null && !Number.isFinite(saved.observed_at)
         || typeof saved.observation_lost !== "boolean"
+        || saved.uncertain !== undefined && typeof saved.uncertain !== "boolean"
         || !Number.isFinite(saved.elapsed_ms) || saved.elapsed_ms < 0
         || !Number.isFinite(saved.uncertainty_elapsed_ms) || saved.uncertainty_elapsed_ms < 0)
         throw new RangeError("invalid retained observation clock");
       this.startedWall = saved.started_at; this.elapsed = saved.elapsed_ms;
       this.progress = saved.cursor; this.progressAt = saved.observed_at;
-      // A reconstructed observer cannot prove silence during its absence.
-      this.uncertain = true; this.gaps = saved.gaps + 1;
+      // Durable reconstruction has an observation gap. Transferring a freshly
+      // observed producer clock is not a second restart of that same producer.
+      this.uncertain = snapshotIsLive ? saved.uncertain ?? true : true;
+      this.gaps = saved.gaps + (snapshotIsLive ? 0 : 1);
       this.uncertaintyElapsed = saved.uncertainty_elapsed_ms;
       this.observationLost = saved.observation_lost || this.gaps > 1 || this.uncertaintyElapsed >= uncertaintyMs;
     }
@@ -77,7 +80,7 @@ export class ObservationClock {
     return { policy: OBSERVATION_CLOCK_CONTRACT_VERSION, timeout_ms: this.timeoutMs,
       started_at: this.startedWall, cursor: this.progress, observed_at: this.progressAt,
       elapsed_ms: this.elapsed, uncertainty_elapsed_ms: this.uncertaintyElapsed,
-      gaps: this.gaps, observation_lost: this.observationLost };
+      gaps: this.gaps, uncertain: this.uncertain, observation_lost: this.observationLost };
   }
 }
 

package/dist/harness-runtime/lib/opencode-plugin.mjs

@@ -33,16 +33,16 @@ export function makeOpenCodePlugin(binding, invoke = invokeNativeHook, resolve =
       try {
         const result = await invoke({ bin: binding.ddFlowBin, nodeBin: binding.nodeBin,
           args: ["opencode", "event", "handle", "--project-root", binding.projectRoot, "--json"],
-          payload: { ...payload, native_hook_binding: identity.nativeHookBinding }, home: binding.ddFlowHome, timeoutMs: budget.remaining("admission", 15000) });
+          payload: { ...payload, native_hook_binding: identity.nativeHookBinding }, home: binding.ddFlowHome, timeoutMs: budget.remaining("admission") });
         await budget.run(() => resolve(binding.stateDir, "hook.verify", { binding: identity.nativeHookBinding }, budget.remaining("generation")), "generation");
         if (result?.permissionDecision === "deny" || result?.hookSpecificOutput?.permissionDecision === "deny") throw Object.assign(new Error("dd-flow denied native shell admission"), { code: "native_hook_rejected" });
         return result;
       } catch (error) {
         error.details = { ...error.details, native_hook_binding: identity.nativeHookBinding, ...(payload.phase === "after" ? { effect: "unknown", tool_outcome: payload.outcome } : {}) };
-        try { await writeNativeHookFailure(binding.stateDir, identity.nativeHookBinding, error, hookBudget(1_000, null)); await resolve(binding.stateDir, "hook.failed", {}, 1_000); }
+        try { await writeNativeHookFailure(binding.stateDir, identity.nativeHookBinding, error, budget); await resolve(binding.stateDir, "hook.failed", {}, budget.remaining("failure_notification")); }
         catch (storage) {
           error.details.receipt_error = { code: storage.code ?? "hook_receipt_write_failed", message: storage.message };
-          try { await resolve(binding.stateDir, "hook.failed", { binding: identity.nativeHookBinding, failure: errorRecord(error) }, 1_000); }
+          try { await resolve(binding.stateDir, "hook.failed", { binding: identity.nativeHookBinding, failure: errorRecord(error) }, budget.remaining("failure_notification")); }
           catch (notify) { error.details.receipt_error.notification_error = notify.code ?? "hook_notification_failed"; }
         }
         throw error;

package/dist/harness-runtime/lib/operation-errors.mjs

@@ -35,7 +35,7 @@ function boundedText(value, budget, limit = 16000) {
 // Lifecycle controls are not optional diagnostics. Reserve them before bulk
 // messages/details, including nested typed causes, without copying authority
 // that was truncated into a different command or continuation receipt.
-const operationalDetailKeys = ["phase", "effect", "recoverable", "retryable_no_effect", "handoff_required", "storage_retry", "repeated_without_progress", "cleanup_unconfirmed", "native_dispatch_started", "disposition", "cli_admission_barrier", "native_pre_cli_refusal", "issued_invocation_id", "invocation_id", "event_key", "refusal_event_key", "hook_event_id", "work_id", "hook_retry_signature", "rejection_signature", "retry_command", "repair_command", "continuation", "retry_instruction", "recovery_instruction", "authority_truncated"];
+const operationalDetailKeys = ["phase", "effect", "recoverable", "retryable_no_effect", "handoff_required", "storage_retry", "repeated_without_progress", "cleanup_unconfirmed", "native_dispatch_started", "disposition", "cli_admission_barrier", "native_pre_cli_refusal", "issued_invocation_id", "invocation_id", "event_key", "refusal_event_key", "hook_event_id", "work_id", "hook_retry_signature", "rejection_signature", "retry_command", "repair_command", "continuation", "retry_instruction", "correction_instruction", "recovery_instruction", "authority_truncated"];
 function operationalDetails(value, budget) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   const entries = [];

package/dist/harness-runtime/lib/provider-overload-policy.d.mts

@@ -1,11 +1,13 @@
 export const CAPACITY_POLICY: "provider-overload-episode@1";
-export const MAX_OVERLOAD_RETRIES: 2;
+export const MAX_OVERLOAD_RETRIES: 3;
 export const MAX_RETRY_AFTER_MS: 30000;
 export function classifyProviderError(native: unknown): string;
 export function safeProviderError(native: unknown): Record<string, unknown>;
-export type CapacityRefusal = { policy: string; ordinal: number; session_id: string; turn_id: string; first_observed_at: string; native_terminal_at?: string; native_terminal_basis?: string };
+export type RequestProof = { kind: "native_turn"; session_id: string; turn_id: string } | { kind: "stream_request"; daemon_instance: string; connection_id: string; operation_id: string; turn_generation: number; session_id: string; outbound_position: number; terminal_position: number };
+export function streamRequestKey(proof: unknown): string | null;
+export type CapacityRefusal = { policy: string; ordinal: number; session_id: string; turn_id: string; request_key?: string; request_proof?: RequestProof; first_observed_at: string; native_terminal_at?: string; native_terminal_basis?: string };
 export function parseCapacityOperation(id: string): { root: string; ordinal: number };
-export function normalizeProviderFailure(error: unknown, sessionId?: string, turnId?: string): null | { code: string; session_id: string; turn_id: string; native_error: Record<string, unknown>; observed_at: unknown; terminal_at: unknown; native_turn_items: unknown; primary_error: { details?: Record<string, unknown> } };
+export function normalizeProviderFailure(error: unknown, sessionId?: string, turnId?: string): null | { code: string; session_id: string; turn_id: string; request_key: string; request_proof: RequestProof; native_error: Record<string, unknown>; observed_at: unknown; terminal_at: unknown; native_turn_items: unknown; primary_error: { details?: Record<string, unknown> } };
 export function terminalProviderOverload(error: unknown, sessionId?: string, turnId?: string): boolean;
 export function nativeItemsSettled(items: unknown): boolean;
 export function capacityBackoff(error: unknown, ordinal: number, now?: number, random?: () => number): number;

package/dist/harness-runtime/lib/provider-overload-policy.mjs

@@ -1,6 +1,6 @@
 /** Pure policy shared by the controller and pinned-engine EVAL consumers. */
 export const CAPACITY_POLICY = "provider-overload-episode@1";
-export const MAX_OVERLOAD_RETRIES = 2;
+export const MAX_OVERLOAD_RETRIES = 3;
 export const MAX_RETRY_AFTER_MS = 30_000;
 
 function policyError(code, message, details = {}) { return Object.assign(new Error(message), { code, details }); }
@@ -11,10 +11,10 @@ export function classifyProviderError(native) {
   const code = [native.code, native.type, native.codexErrorInfo?.code ?? native.codexErrorInfo].filter(value => typeof value === "string").join(" ");
   const message = String(native.message ?? "");
   const text = `${code} ${message}`;
-  const status = Number(native.status ?? native.statusCode ?? native.status_code ?? native.http_status);
+  const status = Number(native.status ?? native.statusCode ?? native.status_code ?? native.http_status ?? /\(code (\d{3})\)/i.exec(message)?.[1]);
   if (status === 402 || /quota|usageLimitExceeded|sessionBudgetExceeded|billing|payment.required|balance.exhausted|insufficient.credit|resource_exhausted.*limit/i.test(text)) return "provider_quota_exhausted";
   if (status === 401 || status === 403 || /provider_auth_failed|invalid.api.key|authentication|unauthorized|eligib|forbidden|access.denied|rejected.this.account/i.test(text)) return "provider_auth_failed";
-  if (/provider_capacity_transient|serverOverloaded|model.?capacity|at capacity|server.overload|model.overload|server.?busy/i.test(text) || /(?:^|\s)overloaded_error(?:\s|$)/i.test(code) || status === 503 || status === 529) return "provider_capacity_transient";
+  if (/provider_capacity_transient|serverOverloaded|model.?capacity|at capacity|no capacity available for model|server.overload|model.overload|server.?busy/i.test(text) || /(?:^|\s)overloaded_error(?:\s|$)/i.test(code) || status === 503 || status === 529) return "provider_capacity_transient";
   if (/rateLimitExceeded|rate.limit/i.test(text) && (native.retryAfter !== undefined || native.retry_after !== undefined || Object.keys(native.headers ?? {}).some(key => key.toLowerCase() === "retry-after"))) return "provider_rate_limited";
   return status === 429 || /provider_limit_unknown|\b429\b|rateLimitExceeded|rate.limit/i.test(text) ? "provider_limit_unknown" : "provider_failed";
 }
@@ -45,6 +45,15 @@ export function parseCapacityOperation(id) {
   return { root: match[1], ordinal };
 }
 
+/** Local ordered-stream identity is not a native Turn ID. */
+export function streamRequestKey(proof) {
+  if (proof?.kind !== "stream_request" || ![proof.daemon_instance, proof.connection_id, proof.operation_id, proof.session_id].every(value => typeof value === "string" && value)
+    || !Number.isSafeInteger(proof.turn_generation) || proof.turn_generation < 1
+    || !Number.isSafeInteger(proof.outbound_position) || proof.outbound_position < 1
+    || !Number.isSafeInteger(proof.terminal_position) || proof.terminal_position <= proof.outbound_position) return null;
+  return JSON.stringify(["stream_request", proof.daemon_instance, proof.connection_id, proof.operation_id, proof.session_id, proof.turn_generation, proof.outbound_position, proof.terminal_position]);
+}
+
 export function normalizeProviderFailure(error, expectedSessionId, expectedTurnId) {
   let current = error;
   for (let depth = 0; depth < 4 && current && typeof current === "object"; depth++) {
@@ -52,14 +61,17 @@ export function normalizeProviderFailure(error, expectedSessionId, expectedTurnI
     // refusal. Never classify transport loss or an active native retry here.
     if (current.code === "provider_capacity_transient" || current.code === "provider_rate_limited") {
       const details = current.details ?? {};
+      const streamKey = details.native_source === "agy.result" && details.turn_id === undefined && details.native_turn_id === undefined ? streamRequestKey(details.request_proof) : null;
+      const turnKey = streamKey ?? details.turn_id;
       if (!["opencode.v2.session.execution", "agy.result", "acp.error_response", "droid.agent_turn_outcome", "grok.subagent.event"].includes(details.native_source) || details.terminal_status !== "failed"
         || details.will_retry === true || details.native_retry_active === true || details.provider_error?.willRetry === true
         || details.provider_error && !["provider_capacity_transient", "provider_rate_limited"].includes(classifyProviderError(details.provider_error))
         || typeof details.provider_session_id !== "string" || !details.provider_session_id
-        || typeof details.turn_id !== "string" || !details.turn_id || details.native_turn_id !== details.turn_id
+        || typeof turnKey !== "string" || !turnKey || (streamKey ? details.request_proof.session_id !== details.provider_session_id || details.native_turn_id !== undefined : details.native_turn_id !== details.turn_id)
         || expectedSessionId !== undefined && details.provider_session_id !== expectedSessionId
-        || expectedTurnId !== undefined && details.turn_id !== expectedTurnId) return null;
-      return { code: "serverOverloaded", session_id: details.provider_session_id, turn_id: details.turn_id,
+        || expectedTurnId !== undefined && turnKey !== expectedTurnId) return null;
+      return { code: "serverOverloaded", session_id: details.provider_session_id, turn_id: turnKey, request_key: turnKey,
+        request_proof: streamKey ? details.request_proof : { kind: "native_turn", session_id: details.provider_session_id, turn_id: details.turn_id },
         native_error: details.provider_error ?? { type: details.native_error_type, status: details.http_status }, observed_at: details.observed_at ?? null,
         terminal_at: null, terminal_basis: null, native_turn_items: details.native_turn_items ?? null, primary_error: current };
     }
@@ -70,7 +82,7 @@ export function normalizeProviderFailure(error, expectedSessionId, expectedTurnI
         || expectedSessionId !== undefined && details.provider_session_id !== expectedSessionId
         || typeof details.turn_id !== "string" || !details.turn_id || details.native_turn_id !== details.turn_id
         || expectedTurnId !== undefined && details.turn_id !== expectedTurnId || typeof code !== "string") return null;
-      return { code, session_id: details.provider_session_id, turn_id: details.turn_id, native_error: native,
+      return { code, session_id: details.provider_session_id, turn_id: details.turn_id, request_key: details.turn_id, request_proof: { kind: "native_turn", session_id: details.provider_session_id, turn_id: details.turn_id }, native_error: native,
         observed_at: details.observed_at ?? null, terminal_at: details.terminal_at ?? null, terminal_basis: details.terminal_basis ?? null,
         native_turn_items: details.native_turn_items ?? null, primary_error: current };
     }
@@ -118,6 +130,7 @@ export function refusalObservation(error, ordinal, firstObservedAt) {
     throw policyError("capacity_continuation_conflict", "Native refusal observation time is invalid or changed");
   const native = failure.terminal_at && Date.parse(failure.terminal_at);
   return { policy: CAPACITY_POLICY, ordinal, session_id: failure.session_id, turn_id: failure.turn_id,
+    request_key: failure.request_key, request_proof: failure.request_proof,
     first_observed_at: firstObservedAt, ...(Number.isFinite(native) && typeof failure.terminal_basis === "string" && failure.terminal_basis ? { native_terminal_at: failure.terminal_at, native_terminal_basis: failure.terminal_basis } : {}) };
 }
 

package/dist/harness-runtime/lib/runner-events.mjs

@@ -22,13 +22,15 @@ export function sha256(value) {
 
 export function hashJson(value) { return sha256(canonicalJson(value)); }
 
-export async function writeJsonAtomic(file, value) {
+export async function writeJsonAtomic(file, value, beforeCommit = () => {}) {
+  beforeCommit();
   await mkdir(path.dirname(file), { recursive: true });
   const temporary = `${file}.${process.pid}.${randomUUID()}.tmp`;
   try {
     const payload = await open(temporary, "wx", 0o600);
     try { await payload.writeFile(`${JSON.stringify(value, null, 2)}\n`); await payload.sync(); }
     finally { await payload.close(); }
+    beforeCommit();
     await rename(temporary, file);
     const directory = await open(path.dirname(file), "r");
     try { await directory.sync(); }

package/dist/harness-runtime/lib/setup-progress.mjs

@@ -1,19 +1,21 @@
 import { readFile } from 'node:fs/promises';
 import path from 'node:path';
+import { randomUUID } from 'node:crypto';
 export const SETUP_STARTUP_MS = 120_000;
 export const SETUP_QUIET_MS = 30_000;
 export const setupPhases = new Set(['ingress_entered', 'imports_ready', 'probe_started', 'probe_completed', 'dependency_check_completed', 'transfer_progress', 'identity_digest_progress', 'identity_digest_completed', 'native_initialized', 'ready']);
 export function setupReporter(operationId = process.env.DD_EVAL_OPERATION_ID) {
   if (!operationId) return () => {};
-  let sequence = 0;
+  let sequence = 0; const producerId = randomUUID();
   return (phase, step = null) => {
     if (!setupPhases.has(phase)) throw new Error('Invalid setup phase');
-    process.stderr.write(JSON.stringify({ kind: 'setup_phase', operation_id: operationId, phase, step, sequence: ++sequence, observed_at: new Date().toISOString() }) + '\n');
+    process.stderr.write(JSON.stringify({ kind: 'setup_phase', operation_id: operationId, producer_id: producerId, phase, step, sequence: ++sequence, observed_at: new Date().toISOString() }) + '\n');
   };
 }
 export const publishSetup = setupReporter();
 export function isSetupPhase(value) {
   return value?.kind === 'setup_phase' && typeof value.operation_id === 'string' && value.operation_id.length > 0 && setupPhases.has(value.phase)
+    && (!Object.hasOwn(value, 'producer_id') || typeof value.producer_id === 'string' && value.producer_id.length > 0 && value.producer_id.length <= 128)
     && Number.isSafeInteger(value.sequence) && value.sequence > 0 && value.sequence <= 1_000_000
     && (value.step === null || typeof value.step === 'string' && value.step.length <= 4096 || Number.isSafeInteger(value.step) && value.step >= 0)
     && typeof value.observed_at === 'string' && Number.isFinite(Date.parse(value.observed_at))
@@ -36,13 +38,13 @@ export function startupObserver(stateDir, daemonId) {
   };
 }
 export function setupObserver(operationId) {
-  const startedAt = Date.now(); let sequence = 0; const markers = new Set();
+  const startedAt = Date.now(); const sequences = new Map(), markers = new Set();
   return value => {
     if (typeof operationId !== 'string' || markers.size >= 4096 || !isSetupPhase(value) || value.operation_id !== operationId
-      || value.sequence <= sequence || Date.parse(value.observed_at) < startedAt || Date.parse(value.observed_at) > Date.now()) return false;
-    const marker = JSON.stringify([value.phase, value.step]);
+      || value.sequence <= (sequences.get(value.producer_id ?? null) ?? 0) || Date.parse(value.observed_at) < startedAt || Date.parse(value.observed_at) > Date.now()) return false;
+    const marker = JSON.stringify([value.producer_id ?? null, value.phase, value.step]);
     if (markers.has(marker)) return false;
-    markers.add(marker); sequence = value.sequence; return true;
+    markers.add(marker); sequences.set(value.producer_id ?? null, value.sequence); return true;
   };
 }
 export function observationDetails(clock, phase, pid) {

package/dist/harness-runtime/lib/tool-observations.mjs

@@ -156,7 +156,7 @@ export function agyToolObservation(step, rootSessionId) {
   const sessionId = step.conversation_id ?? rootSessionId;
   return { session: identity("antigravity-cli", sessionId), parent_session: sessionId !== rootSessionId ? identity("antigravity-cli", rootSessionId) : null,
     call_id: step.step_id ?? step.stepId ?? step.id ?? step.tool_call_id ?? step.toolCallId ?? (Number.isInteger(step.step_index) ? String(step.step_index) : null),
-    name: step.tool_name ?? step.tool_info?.name, ...(step.tool_info?.error ? { status: "failed" } : nativeStatus(step.state)) };
+    name: step.tool_name ?? step.tool_info?.name, ...(step.tool_info?.error ? { status: "failed" } : nativeStatus(step.state === "ACTIVE" ? "running" : step.state)) };
 }
 
 /** Native AGY JSONL records have planner tool invocations, not matching live