@deksden-com/dd-flow-cli 0.9.0-beta.145 → 0.9.0-beta.149

package/dist/harness-runtime/lib/dd-codex-daemon.mjs

@@ -7,12 +7,13 @@ import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mj
 import { createHash, randomUUID } from "node:crypto";
 import { chmod, lstat, mkdir, open, readFile, rename, unlink, writeFile } from "node:fs/promises";
 import net from "node:net";
-import { durableDaemonDispatch, completeDaemonShutdown, assertDaemonDispatch, assertDaemonRestartable, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon } from "./daemon-operations.mjs";
+import { durableDaemonDispatch, completeDaemonShutdown, commitDaemonShutdown, assertDaemonDispatch, assertDaemonRestartable, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon } from "./daemon-operations.mjs";
 import { ObservationClock } from "./observation-clock.mjs";
 import { parseCapacityOperation } from "./provider-overload-policy.mjs";
 import path from "node:path";
 import { spawn } from "node:child_process";
 import { waitForSettlement } from "./session-settlement.mjs";
+import { nativeExecutionReceipt } from "./native-children.mjs";
 import { errorRecord } from "./operation-errors.mjs";
 import { CODEX_REQUEST_TIMEOUT_MS, LATE_RESPONSE_GRACE_MS, CodexBridge, codexReadPhase, readCodexHistory, retainedCodexTurn, cancelSessionWithBridge, createSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge, startSessionWithBridge } from "./dd-codex.mjs";
 import { assertDaemonOwnership, assertStartupChild, prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
@@ -77,7 +78,7 @@ export async function inspectCodexTree(bridge, options, { remember = () => {}, a
   options = { ...options, readPhase: options.readPhase ?? codexReadPhase(bridge, options) };
   const sessions = new Set([options.sessionId]);
   const observed = await observeCodexSessions(bridge, options, sessions, active, remember);
-  return { ...observed.observations[0], settled: !observed.active && !observed.sessions.length, unsettled_sessions: observed.sessions, tree_session_ids: [...sessions], tree_observations: observed.observations.map(item => ({ provider_session_id: item.provider_session_id, status: item.status, settled: item.settled })) };
+  return nativeExecutionReceipt({ ...observed.observations[0], settled: !observed.active && !observed.sessions.length, unsettled_sessions: observed.sessions, tree_session_ids: [...sessions], tree_observations: observed.observations.map(item => ({ provider_session_id: item.provider_session_id, status: item.status, settled: item.settled })) }, { daemonId: options.daemonId });
 }
 
 export async function cancelCodexTree(bridge, options, { remember = () => {}, active = () => null, timeoutMs = 5_000 } = {}) {
@@ -120,32 +121,44 @@ export async function startDaemon(options) {
 }
 export async function stopDaemon(options) { const timeoutMs = options.timeoutMs ?? 30_000; return await confirmDaemonStopped(() => callDaemon(options.stateDir, "daemon.stop", { cancelTree: options.cancelTree === true }, timeoutMs), locations(options.stateDir).socket, timeoutMs, { readState: () => readState(locations(options.stateDir).state) }); }
 
+export async function prepareCodexStop({ bridge, state, sessions, active, save, stateDir, cancelTree }) {
+  if (cancelTree) cancelPendingDispatch(bridge);
+  if (active() && !cancelTree) throw Object.assign(new Error("productive operation is running"), { code: "tree_not_settled" });
+  let revision;
+  await waitForSettlement({
+    knownSessions: () => [...sessions],
+    observe: () => { revision = state.native_execution_revision; return observeCodexSessions(bridge, state.config, sessions, active); },
+    ...(cancelTree ? { cancel: async sessionId => { try { await cancelSessionWithBridge(bridge, { ...state.config, sessionId }); } catch (error) { if (error.code !== "turn_not_active") throw error; } } } : {})
+  });
+  if (active() || state.native_execution_revision !== revision) throw Object.assign(new Error("native activity changed during settlement observation"), { code: "tree_not_settled" });
+  commitDaemonShutdown(stateDir);
+  await save({ active_tree: false });
+  return { clean: true, settled: true, native_settled: true, native_settlement: { confirmed: true, revision } };
+}
+
 export async function serveDaemon(stateDir) {
   const paths = locations(stateDir); const state = await readState(paths.state); if (!state || state.schema_id !== stateSchema) throw Object.assign(new Error("daemon state missing"), { code: "daemon_state_missing" });
   const bridge = new CodexBridge({ ...state.config, env: { ...codexBridgeEnv(state.config, state.daemon_id), CODEX_HOME: process.env.CODEX_HOME, DD_FLOW_CODEX_STATE_DIR: paths.dir } }); await startManagedBridge({ config: state.config, state, bridge, kind: "codex-provider", publish: snapshot => writeState(paths.state, snapshot), log: paths.log }); const sessions = new Set(state.sessions ?? []); let active = null; let server; let persist = Promise.resolve();
   scheduleDaemonProcessHeartbeat(state.config, state.resource_process);
   const save = (patch = {}) => { Object.assign(state, patch, { pid: process.pid, updated_at: new Date().toISOString(), sessions: [...sessions] }); const snapshot = structuredClone(state); persist = persist.catch(() => {}).then(() => writeState(paths.state, snapshot)); return persist; };
+  bridge.options.onNativeActivity = () => {
+    state.native_execution_revision = (state.native_execution_revision ?? 0) + 1;
+    if (state.active_tree !== true) void save({ active_tree: true }).catch(error => { bridge.rejectAll(error); });
+  };
   const dispatch = async (operation, params, operationId) => {
     const assertDispatch = captureDispatchGuard(bridge);
     if (operation === "hook.verify") {
       if (params.daemonId !== state.daemon_id) throw Object.assign(new Error("Hook daemon identity differs"), { code: "native_hook_unproven" });
       return { ...bridge.verifyNativeHook(params), daemonId: state.daemon_id, ddFlowHome: state.config.ddFlowHome, projectRoot: state.config.projectRoot };
     }
-    if (operation === "daemon.status") return { daemon_id: state.daemon_id, pid: process.pid, cwd: state.cwd, journal: state.journal, config: state.config, sessions: [...sessions], active_operation: active, shutdown_state: state.shutdown_state };
+    if (operation === "daemon.status") return { daemon_id: state.daemon_id, pid: process.pid, cwd: state.cwd, journal: state.journal, config: state.config, sessions: [...sessions], active_operation: active, active_tree: state.active_tree ?? null, shutdown_state: state.shutdown_state };
     // The runner may need to retire an orphaned daemon after its caller was
     // interrupted. `daemon.stop` is the one control operation that remains
     // available while a request is marked active; callers must first prove the
     // provider Session itself is idle.
     if (operation === "daemon.stop") {
       return await completeDaemonShutdown(paths.dir, state, save, async () => {
-      if (params.cancelTree) cancelPendingDispatch(bridge);
-      if (active && !params.cancelTree) throw Object.assign(new Error("productive operation is running"), { code: "tree_not_settled" });
-      await waitForSettlement({
-        knownSessions: () => [...sessions],
-        observe: () => observeCodexSessions(bridge, state.config, sessions, () => active),
-        ...(params.cancelTree ? { cancel: async sessionId => { try { await cancelSessionWithBridge(bridge, { ...state.config, sessionId }); } catch (error) { if (error.code !== "turn_not_active") throw error; } } } : {})
-      });
-      return { clean: true };
+      return await prepareCodexStop({ bridge, state, sessions, active: () => active, save, stateDir: paths.dir, cancelTree: params.cancelTree });
       }, [
         ["provider", () => bridge.close()],
         ["provider_resource", () => finishDaemonProcess(state.config, state.provider_process)],
@@ -154,7 +167,7 @@ export async function serveDaemon(stateDir) {
     }
     if (["session.create", "session.prompt", "session.start", "session.fork", "session.resume"].includes(operation)) assertDaemonDispatch(paths.dir);
     if (active && !["session.inspect", "session.cancel"].includes(operation)) throw Object.assign(new Error(`${active} is in progress`), { code: "operation_busy", retryable: true });
-    if (operation === "session.create") { active = operation; try { await save({ active_operation: active }); const result = await createSessionWithBridge(bridge, { ...state.config, ...params }); sessions.add(result.provider_session_id); return result; } finally { active = null; await save({ active_operation: null }); } }
+    if (operation === "session.create") { active = operation; try { await save({ active_operation: active, active_tree: true }); const result = await createSessionWithBridge(bridge, { ...state.config, ...params }); sessions.add(result.provider_session_id); return result; } finally { active = null; await save({ active_operation: null }); } }
     if (operation === "session.prompt") {
       parseCapacityOperation(operationId);
       // Admission can wait for a permit. Observe again after it returns, not
@@ -163,6 +176,7 @@ export async function serveDaemon(stateDir) {
       // journal entries and must not both pass the idle check while inspecting.
       active = operation;
       try {
+        await save({ active_operation: active, active_tree: true });
         const tree = await inspectCodexTree(bridge, { ...state.config, ...params });
         assertDispatch();
         if (tree.settled !== true) throw Object.assign(new Error("native Session tree changed while waiting for admission"), { code: "tree_not_settled", details: { provider_session_id: params.sessionId, unsettled_sessions: tree.unsettled_sessions } });
@@ -173,7 +187,7 @@ export async function serveDaemon(stateDir) {
       }
       finally { active = null; await save({ active_operation: null }); }
     }
-    if (operation === "session.start") { sessions.add(params.sessionId); active = operation; try { await save({ active_operation: active }); return await startSessionWithBridge(bridge, { ...state.config, ...params, assertDispatch, operationId }); } finally { active = null; await save({ active_operation: null }); } }
+    if (operation === "session.start") { sessions.add(params.sessionId); active = operation; try { await save({ active_operation: active, active_tree: true }); return await startSessionWithBridge(bridge, { ...state.config, ...params, assertDispatch, operationId }); } finally { active = null; await save({ active_operation: null }); } }
     if (operation === "session.inspect" || operation === "session.resume") {
       const owned = new Set(sessions);
       for (const id of owned) for (const child of bridge.directChildren?.(id) ?? []) owned.add(child.provider_session_id);

package/dist/harness-runtime/lib/dd-codex.mjs

@@ -180,6 +180,10 @@ export class CodexBridge {
 
   receive(line) {
     let message; try { message = JSON.parse(line); } catch { this.journal.write("malformed", { line }); return; }
+    // Read-induced idle/status notifications are not new execution. Native
+    // turn/item events and newly active threads invalidate an idle proof.
+    if (/^(turn|item)\//.test(message.method ?? "")
+      || message.method === "thread/status/changed" && message.params?.status?.type === "active") this.options.onNativeActivity?.();
     this.observeItemPhase(message);
     try { this.observeTopology(message); }
     catch (error) { this.topologyError = error; this.rejectAll(error); return; }

package/dist/harness-runtime/lib/dd-droid-daemon.mjs

@@ -66,7 +66,7 @@ export async function serveDaemon(stateDir) {
       runtime.requireIdentity(params.sessionId); const cleanup = await runtime.closeTree(true); let inspected;
       try { inspected = await runtime.inspect(params.sessionId, { ignoreActive: true }); }
       catch (error) { inspected = { harness: "droid-cli", provider_session_id: params.sessionId, descendants: [...runtime.topology.values()], inspection_error: errorRecord(error) }; }
-      return { ...inspected, cancelled: true, settled: cleanup.settled, cleanup };
+      return { ...inspected, cancelled: true, settled: inspected.settled === true && cleanup.native_settled === true, native_settled: inspected.settled === true && cleanup.native_settled === true, physical_stopped: cleanup.physical_stopped, cleanup };
     }
     if (operation === "daemon.stop") {
       stopping = true;
@@ -78,9 +78,10 @@ export async function serveDaemon(stateDir) {
         if (runtime.rootId) try { await runtime.inspect(runtime.rootId, { ignoreActive: true }); } catch (error) { cleanup.inspection_error = errorRecord(error); }
         // Native evidence failures remain visible, but cannot strand copied
         // credentials or the daemon after the owned process tree is gone.
-        const clean = !cleanup.forced && !cleanup.topology_error && !cleanup.inspection_error;
-        return { clean, cleanup };
+        const clean = cleanup.native_settled === true && !cleanup.inspection_error;
+        return { clean, settled: cleanup.native_settled === true, native_settled: cleanup.native_settled === true, physical_stopped: cleanup.physical_stopped, cleanup };
         }, [
+          ["provider", async () => { if (!runtime.closed) throw new DroidError("provider_process_stop_incomplete", "Droid provider has not closed"); }],
           ["auth", () => removeDroidAuth(state.config)],
           ["daemon_resource", () => finishDaemonProcess(state.config, state.resource_process)]
         ]);

package/dist/harness-runtime/lib/dd-droid.mjs

@@ -22,7 +22,7 @@ function metadataReader(factory) { if (!metadataReaders.has(factory)) metadataRe
 import { confirmDaemonProcess, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
 import { renderAdapterPolicy, lifecycleRetryInstruction } from "./delegation-instructions.mjs";
 import { classifyProviderError, safeProviderError } from "./provider-overload-policy.mjs";
-import { settledNativeTree } from "./native-children.mjs";
+import { settledNativeTree, nativeExecutionReceipt } from "./native-children.mjs";
 
 export const DROID_CONTRACT = "dd-droid-harness@1";
 export const DROID_PROTOCOL = "1.201.0";
@@ -256,7 +256,7 @@ export class DroidRuntime {
   }
   async observeSettings(id, settings, source, extra = {}) {
     const observed = this.profile(settings);
-    const event = await observeModel({ journal: this.config.journal, harness: "droid-cli", sessionId: id, parentSessionId: id === this.rootId ? null : this.rootId,
+    const event = await observeModel({ journal: this.config.journal, harness: "droid-cli", sessionId: id, parentSessionId: id === this.rootId ? null : this.topology.get(id)?.parent_provider_session_id ?? this.rootId,
       requested: this.config, observed, source, ...extra });
     if (id === this.rootId) this.observedProfile = observed;
     this.modelEventIds ??= new Map();
@@ -267,8 +267,9 @@ export class DroidRuntime {
     return observed;
   }
   validateMetadata(id, native) {
-    if (!native || path.resolve(native.header.cwd) !== this.config.cwd || native.header.id !== id || (id !== this.rootId && native.header.callingSessionId !== this.rootId)) throw new DroidError("session_identity_mismatch", "Native model observation is outside the owned Session tree");
-    if (id !== this.rootId && !this.topology.has(id)) this.topology.set(id, { provider_session_id: id, parent_provider_session_id: this.rootId, tool_use_id: native.header.callingToolUseId, status: "unknown", source: "native.metadata" });
+    const parent = native?.header.callingSessionId;
+    if (!native || path.resolve(native.header.cwd) !== this.config.cwd || native.header.id !== id || (id !== this.rootId && (id === parent || parent !== this.rootId && !this.topology.has(parent) || this.topology.has(id) && this.topology.get(id).parent_provider_session_id !== parent))) throw new DroidError("session_identity_mismatch", "Native model observation is outside the owned Session tree");
+    if (id !== this.rootId && !this.topology.has(id)) this.topology.set(id, { provider_session_id: id, parent_provider_session_id: parent, tool_use_id: native.header.callingToolUseId, status: "unknown", source: "native.metadata" });
   }
   async observeModels() {
     if (!this.rootId || !this.loaded) return;
@@ -276,9 +277,12 @@ export class DroidRuntime {
     const info = await stat(catalog).catch(error => { if (error.code === "ENOENT") return null; throw error; });
     if (info && info.mtimeMs !== this.modelCatalogMtime) {
       const value = await readJson(catalog);
-      for (const task of value?.invocations ?? []) if (task.parentSessionId === this.rootId && task.childSessionId) {
-        const native = await this.metadata.read(task.childSessionId);
-        if (native) this.validateMetadata(task.childSessionId, native);
+      const tasks = Array.isArray(value?.invocations) ? value.invocations : [];
+      for (let size = -1; size !== this.topology.size;) { size = this.topology.size;
+        for (const task of tasks) if (task?.childSessionId && (task.parentSessionId === this.rootId || this.topology.has(task.parentSessionId))) {
+          const native = await this.metadata.read(task.childSessionId);
+          if (native) this.validateMetadata(task.childSessionId, native);
+        }
       }
       this.modelCatalogMtime = info.mtimeMs;
     }
@@ -286,7 +290,7 @@ export class DroidRuntime {
     const routing = await readDroidRoutingLog(log, this.state.model_log_cursor);
     for (const transition of routing.events) {
       const native = await this.metadata.read(transition.session_id);
-      if (!native || (transition.session_id !== this.rootId && native.header.callingSessionId !== this.rootId)) continue;
+      if (!native || (transition.session_id !== this.rootId && native.header.callingSessionId !== this.rootId && !this.topology.has(native.header.callingSessionId))) continue;
       this.validateMetadata(transition.session_id, native);
       await this.observeSettings(transition.session_id, { ...native.settings, modelId: transition.model, model: transition.model },
         { path: log, channel: "native_router", event_sha256: transition.event_sha256 }, { reason: transition.reason, nativeTimestamp: transition.native_timestamp, previousModel: transition.previous_model });
@@ -439,39 +443,72 @@ export class DroidRuntime {
     return { ...receipt, result: { ...outcome, status: status(outcome.reason) }, assistant_text: binding.assistant_text ?? "", turn_id: binding.turn_id, recovered_from: "native.agent_turn_outcome" };
   }
   async refreshTopology() {
-    let catalog;
-    try { catalog = await readJson(path.join(this.paths.factory, "task-invocations.json")); }
-    catch (error) { if (!(error instanceof SyntaxError)) throw error; this.topologyIncomplete = true; return [...this.topology.values()]; }
+    let catalog, missing = false;
+    try { catalog = JSON.parse(await readFile(path.join(this.paths.factory, "task-invocations.json"), "utf8")); }
+    catch (error) { if (error.code === "ENOENT") missing = true; else { if (!(error instanceof SyntaxError)) throw error; this.topologyIncomplete = true; return [...this.topology.values()]; } }
     this.topologyIncomplete = false;
-    const invocations = catalog?.invocations ?? [];
     const root = this.rootId ? await readDroidSession(this.paths.factory, this.rootId) : null;
-    const rootTools = new Map((root?.records ?? []).flatMap(record => record.message?.content ?? []).filter(block => block.type === "tool_use").map(block => [block.id, block]));
+    const taskTools = native => new Map((native?.records ?? []).flatMap(record => record.message?.content ?? []).filter(block => block.type === "tool_use" && block.name === "Task").map(block => [block.id, block]));
+    const validCatalog = catalog && !Array.isArray(catalog) && Array.isArray(catalog.invocations);
+    if (!validCatalog) {
+      const noChildren = !this.topology.size && !taskTools(root).size;
+      const noDispatch = !this.active && !this.lastResult && !this.state.active_tree && (!root || root.complete && root.records.every(record => record.type === "session_start"));
+      const completeNoTask = root?.complete && terminal(root.outcomes.at(-1)?.reason) && root.tool_calls.completeness === "complete";
+      this.topologyIncomplete = !(missing && noChildren && (noDispatch || completeNoTask));
+      return [...this.topology.values()];
+    }
+    const invocations = catalog.invocations, owned = new Set([this.rootId, ...this.topology.keys()]);
+    // Resolve ancestry before validating records so malformed foreign entries
+    // do not block this tree, while malformed reachable children do.
+    for (let size = -1; size !== owned.size;) { size = owned.size; for (const task of invocations) if (owned.has(task?.parentSessionId) && task?.childSessionId) owned.add(task.childSessionId); }
+    const parents = new Map([[this.rootId, root]]);
+    for (const id of owned) if (id !== this.rootId) parents.set(id, await readDroidSession(this.paths.factory, id));
+    for (const [parentId, native] of parents) {
+      if (!native?.complete) this.topologyIncomplete = true;
+      for (const toolId of taskTools(native).keys()) if (!invocations.some(task => task?.parentSessionId === parentId && task?.parentToolUseId === toolId)) this.topologyIncomplete = true;
+    }
     const groups = new Map();
     for (const task of invocations) {
-      if (task.parentSessionId !== this.rootId || !task.childSessionId || !task.parentToolUseId) continue;
+      if (!task || typeof task !== "object") { this.topologyIncomplete = true; continue; }
+      if (!owned.has(task.parentSessionId) && !owned.has(task.childSessionId) && ![...parents.values()].some(native => taskTools(native).has(task.parentToolUseId))) continue;
+      if (![task.parentSessionId, task.childSessionId, task.parentToolUseId, task.taskInvocationId, task.status].every(value => typeof value === "string" && value.length)) { this.topologyIncomplete = true; continue; }
       const tasks = groups.get(task.childSessionId) ?? []; tasks.push(task); groups.set(task.childSessionId, tasks);
     }
+    for (const id of this.topology.keys()) if (!groups.has(id)) this.topologyIncomplete = true;
     for (const [id, tasks] of groups) {
-      const native = await readDroidSession(this.paths.factory, id);
+      const native = parents.get(id), parentId = tasks[0].parentSessionId, rootTools = taskTools(parents.get(parentId));
       if (!native || !native.settings) { this.topologyIncomplete = true; continue; }
-      if (native.header.callingSessionId !== this.rootId) throw new DroidError("droid_child_identity_invalid", "Task invocation disagrees with physical child parent");
+      if (id === this.rootId || id === parentId || tasks.some(task => task.parentSessionId !== parentId) || native.header.callingSessionId !== parentId || path.resolve(native.header.cwd) !== this.config.cwd) throw new DroidError("droid_child_identity_invalid", "Task invocation disagrees with physical child parent/workspace");
+      if (new Set(tasks.map(task => task.taskInvocationId)).size !== tasks.length) this.topologyIncomplete = true;
       const creationTool = native.header.callingToolUseId;
       for (const task of tasks) {
+        if (!rootTools.has(task.parentToolUseId)) {
+          const block = (parents.get(parentId)?.records ?? []).flatMap(record => record.message?.content ?? []).find(block => block.type === "tool_use" && block.id === task.parentToolUseId);
+          if (block) throw new DroidError("droid_child_identity_invalid", "Task invocation is bound to a non-Task tool");
+          this.topologyIncomplete = true; continue;
+        }
         if (task.parentToolUseId === creationTool) continue;
         const tool = rootTools.get(task.parentToolUseId);
         if (tool?.name !== "Task" || tool.input?.resume !== id) throw new DroidError("droid_child_identity_invalid", "Repeated child invocation has no matching native Task resume evidence");
       }
       await this.observeSettings(id, native.settings, { path: native.transcript_path, sha256: native.source_sha256 });
-      const prior = this.topology.get(id);
       // Task resume adds a Turn to the same physical child, not another
       // Session. Its transcript retains the original creation edge. Work
       // reassignment is checked by dd-flow's physical Session binding.
-      const ordered = tasks.toSorted((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0));
-      const latest = ordered.at(-1); const running = tasks.some(task => !terminal(task.status));
-      const closed = running && prior?.source === "adapter.tree_closed";
+      const order = [...rootTools.keys()];
+      const ordered = tasks.toSorted((a, b) => order.indexOf(a.parentToolUseId) - order.indexOf(b.parentToolUseId));
+      const latest = ordered.at(-1); const running = !terminal(latest.status);
       const outcome = native.outcomes.at(-1), nativeTurn = outcome && terminal(outcome.reason) && typeof outcome.turnId === "string" ? outcome.turnId : null;
-      const evidence = !running && nativeTurn ? { terminal_turn_id: nativeTurn, native_source: "droid.agent_turn_outcome", native_turn_items: { observed: native.complete && native.tool_calls.completeness === "complete", possible_effects: native.tool_calls.total > 0, pending: native.tool_calls.pending > 0 }, ...(outcome.error && typeof outcome.error === "object" ? { provider_error: safeProviderError(outcome.error) } : {}) } : {};
-      this.topology.set(id, { provider_session_id: id, parent_provider_session_id: this.rootId, tool_use_id: creationTool, latest_tool_use_id: latest.parentToolUseId, task_id: latest.taskInvocationId, task_invocation_ids: ordered.map(task => task.taskInvocationId), status: closed ? prior.status : running ? "running" : status(latest.status), source: closed ? prior.source : "droid.task_invocations", transcript_path: native.transcript_path, ...evidence });
+      const parentResult = (parents.get(parentId)?.records ?? []).flatMap(record => record.message?.content ?? []).some(block => block.type === "tool_result" && block.tool_use_id === latest.parentToolUseId);
+      const exactTurn = nativeTurn && (tasks.length === 1 || latest.turnId === nativeTurn);
+      // A resumed Task's previous terminal Turn is not its current outcome.
+      // The matching native Task result proves completion without attributing
+      // a previous error/Turn ID to this invocation.
+      const evidence = !running && nativeTurn && (tasks.length === 1 || parentResult || exactTurn) ? {
+        ...(exactTurn ? { terminal_turn_id: nativeTurn } : {}), native_source: "droid.agent_turn_outcome",
+        native_turn_items: { observed: native.complete && native.tool_calls.completeness === "complete", possible_effects: native.tool_calls.total > 0, pending: native.tool_calls.pending > 0 },
+        ...(exactTurn && outcome.error && typeof outcome.error === "object" ? { provider_error: safeProviderError(outcome.error) } : {}) } : {};
+      this.topology.set(id, { provider_session_id: id, parent_provider_session_id: parentId, tool_use_id: creationTool, latest_tool_use_id: latest.parentToolUseId, task_id: latest.taskInvocationId, task_invocation_ids: ordered.map(task => task.taskInvocationId), status: running ? "running" : status(latest.status), source: "droid.task_invocations", transcript_path: native.transcript_path, ...evidence });
     }
     return [...this.topology.values()];
   }
@@ -491,9 +528,10 @@ export class DroidRuntime {
   async inspect(id, { ignoreActive = false, ingestUsage = true } = {}) {
     this.requireIdentity(id); await this.captureProcesses(); const children = await this.refreshTopology(); const source = await readDroidSession(this.paths.factory, id);
     const usage = []; for (const sessionId of [id, ...children.map(child => child.provider_session_id)]) usage.push(await this.snapshotUsage(sessionId, { ingest: ingestUsage }));
-    const settled = !this.topologyIncomplete && (!this.active || ignoreActive) && (this.closed || this.workingState === "idle") && children.every(child => terminal(child.status));
-    const rootSettled = (!this.active || ignoreActive) && (this.closed || this.workingState === "idle") && terminal((source?.outcomes?.at(-1) ?? this.lastResult)?.reason);
-    return { harness: "droid-cli", runtime_family: "droid", session: { harness_id: "droid-cli", session_id: id }, provider_session_id: id, adapter_session_id: id, cwd: this.config.cwd, observed_profile: source?.settings ? await this.observeSettings(id, source.settings, { path: source.transcript_path, sha256: source.source_sha256 }) : this.observedProfile, observed_runtime: { droid: this.config.version, factory_protocol: this.protocol ?? DROID_PROTOCOL, dd_harness_contract: DROID_CONTRACT }, status: settled ? "idle" : "running", settled, ...settledNativeTree(id, children, settled, rootSettled && !this.topologyIncomplete), terminal_turn_id: source?.outcomes?.at(-1)?.turnId ?? this.lastResult?.turnId, descendants: children, transcript_path: source?.transcript_path ?? null, usage, result: this.lastResult, provider_pid: this.closed ? null : this.child?.pid ?? null };
+    const settled = !this.topologyIncomplete && (!this.active || ignoreActive) && (this.closed || this.workingState === "idle") && source?.tool_calls.pending === 0 && children.every(child => terminal(child.status) && child.native_turn_items?.observed === true && child.native_turn_items.pending === false);
+    const rootSettled = source?.complete && source.tool_calls.completeness === "complete" && source.tool_calls.pending === 0 && (!this.active || ignoreActive) && (this.closed || this.workingState === "idle") && terminal((source?.outcomes?.at(-1) ?? this.lastResult)?.reason);
+    return nativeExecutionReceipt({ harness: "droid-cli", runtime_family: "droid", session: { harness_id: "droid-cli", session_id: id }, provider_session_id: id, adapter_session_id: id, cwd: this.config.cwd, observed_profile: source?.settings ? await this.observeSettings(id, source.settings, { path: source.transcript_path, sha256: source.source_sha256 }) : this.observedProfile, observed_runtime: { droid: this.config.version, factory_protocol: this.protocol ?? DROID_PROTOCOL, dd_harness_contract: DROID_CONTRACT }, status: settled ? "idle" : "running", settled, ...settledNativeTree(id, children, settled, rootSettled && !this.topologyIncomplete), terminal_turn_id: source?.outcomes?.at(-1)?.turnId ?? this.lastResult?.turnId, descendants: children, transcript_path: source?.transcript_path ?? null, usage, result: this.lastResult, provider_pid: this.closed ? null : this.child?.pid ?? null,
+      ...(this.topologyIncomplete ? { native_settlement: { confirmed: false, state: "unproven", reason: "native_task_inventory_incomplete" } } : {}) }, { daemonId: this.config.daemonId });
   }
   async observeHook(payload, eventId, deadlineAt = null) {
     try { return await this.observeHookChecked(payload, eventId, hookBudget(23_000, deadlineAt)); }
@@ -508,7 +546,8 @@ export class DroidRuntime {
     const foreign = message => new DroidError("droid_hook_identity_invalid", message, { scope: "foreign_hook", provider_session_id: id });
     if (!native || path.resolve(payload.cwd) !== this.config.cwd || await realpath(payload.transcript_path) !== await realpath(native.transcript_path)) throw foreign("Hook is outside its controlled native Session/workspace");
     const parent = native.header.callingSessionId ?? null;
-    if (parent && parent !== this.rootId) throw foreign("Hook child belongs to another root");
+    if (parent && parent !== this.rootId && !this.topology.has(parent)) throw foreign("Hook child belongs to another root");
+    if (parent && (id === parent || this.topology.has(id) && this.topology.get(id).parent_provider_session_id !== parent)) throw foreign("Hook child ancestry changed");
     if (!parent && this.rootId && id !== this.rootId) throw foreign("Hook came from an unrelated root");
     if (path.resolve(native.header.cwd) !== this.config.cwd) throw new DroidError("droid_hook_identity_invalid", "Owned native Session workspace changed");
     if (parent && !terminal(this.topology.get(id)?.status)) this.topology.set(id, { ...(this.topology.get(id) ?? {}), provider_session_id: id, parent_provider_session_id: parent, tool_use_id: native.header.callingToolUseId, status: "running", source: "droid.session_start" });
@@ -576,8 +615,11 @@ export class DroidRuntime {
     let topologyError = null;
     try { await this.refreshTopology(); }
     catch (error) { topologyError = errorRecord(error); await this.journal("closed_tree_topology_error", { error: topologyError }); }
-    for (const [id, child] of this.topology) if (!terminal(child.status)) this.topology.set(id, { ...child, status: "cancelled", source: "adapter.tree_closed", native_status: child.status });
-    const cleanup = { settled: true, forced, observed_processes: this.ownedProcesses.length, ...(topologyError ? { topology_error: topologyError } : {}) };
+    const root = this.rootId ? await readDroidSession(this.paths.factory, this.rootId) : null;
+    const nativeSettled = !forced && !topologyError && !this.topologyIncomplete
+      && (!this.rootId || root?.complete && (terminal(root.outcomes.at(-1)?.reason) || !this.active && !this.lastResult && root.records.every(record => record.type === "session_start")) && root.tool_calls.pending === 0)
+      && [...this.topology.values()].every(child => terminal(child.status) && child.native_turn_items?.observed === true && child.native_turn_items.pending === false);
+    const cleanup = { settled: true, physical_stopped: true, native_settled: nativeSettled, forced, observed_processes: this.ownedProcesses.length, ...(topologyError ? { topology_error: topologyError } : {}) };
     await this.save({ active_tree: false, cleanup });
     return cleanup;
   }

package/dist/harness-runtime/lib/dd-grok-daemon.mjs

@@ -21,7 +21,7 @@ import path from "node:path";
 
 import { AcpBridge } from "./dd-zcode.mjs";
 import { safeProviderError } from "./provider-overload-policy.mjs";
-import { settledNativeTree } from "./native-children.mjs";
+import { settledNativeTree, nativeExecutionReceipt } from "./native-children.mjs";
 import { observeModel, readModelObservations } from "./model-observations.mjs";
 import { cancelSessionWithBridge, createSessionWithBridge, doctor, forkSessionWithBridge, inspectSessionWithBridge, promptSessionWithBridge } from "./dd-grok.mjs";
 import { prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
@@ -465,7 +465,7 @@ export class Runtime {
     if (operation === "session.create") return await this.productive(operation, async () => { const result = await createSessionWithBridge(this.bridge, { ...this.options(params), onSessionCreated: async (session) => { this.track(session); this.loadedSessionId = session.provider_session_id; await this.persist(); } }, this.initialized); this.loadedSessionId = result.provider_session_id; return result; }, null, operationId);
     if (operation === "session.prompt") { await this.requireSettled(); return await this.productive(operation, async () => { const result = await promptSessionWithBridge(this.bridge, { ...this.options(params), assertDispatch, operationId }); this.loadedSessionId = params.sessionId; return result; }, params.sessionId, operationId); }
     if (operation === "session.fork") { await this.requireSettled(); return await this.productive(operation, async () => { const result = await forkSessionWithBridge(this.bridge, this.options(params)); this.loadedSessionId = params.sessionId; return result; }); }
-    if (operation === "session.inspect" || operation === "session.resume") { const before = new Map(this.descendants); const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result, before); await this.persist(); const settled = !this.active && !this.treeRunning(result); const descendants = this.topology(result.provider_session_id); const terminal = this.sessions.get(result.provider_session_id)?.native_root_receipt; return { ...result, settled, descendants, ...settledNativeTree(result.provider_session_id, descendants, settled, !this.active && !this.rootRunning(result)), ...(terminal?.kind === "failed" && terminal.request_id !== undefined ? { terminal_turn_id: String(terminal.request_id) } : {}) }; }
+    if (operation === "session.inspect" || operation === "session.resume") { const before = new Map(this.descendants); const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result, before); await this.persist(); const settled = !this.active && !this.treeRunning(result); const descendants = this.topology(result.provider_session_id); const terminal = this.sessions.get(result.provider_session_id)?.native_root_receipt; return nativeExecutionReceipt({ ...result, settled, descendants, ...settledNativeTree(result.provider_session_id, descendants, settled, !this.active && !this.rootRunning(result)), ...(terminal?.kind === "failed" && terminal.request_id !== undefined ? { terminal_turn_id: String(terminal.request_id) } : {}) }, { daemonId: this.state.daemon_id, generation: this.controlGeneration ?? 0 }); }
     if (operation === "session.cancel") { if (!this.sessions.has(params.sessionId)) throw new DaemonError("session_identity_mismatch", "cancellation Session is not owned by this daemon"); cancelPendingDispatch(this); const result = await cancelSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); await this.persist({ active_tree: Boolean(this.active) || !result.settled }); return result; }
     if (operation === "session.archive") { await this.requireSettled(); return await this.productive(operation, async () => { let session = this.sessions.get(params.sessionId); if (!session?.cwd) { const result = await inspectSessionWithBridge(this.bridge, this.options({ ...params, liveSession: true })); this.track(result); session = this.sessions.get(result.provider_session_id); } return await exportSessionArchive(this.paths, session.provider_session_id, absolute(session.cwd, "Grok Build session cwd"), params.archiveDir, this.state.versions); }); }
     if (operation === "daemon.stop") {
@@ -476,7 +476,7 @@ export class Runtime {
         observe: async () => ({ sessions: await this.refreshTree(), active: Boolean(this.active), active_operation: this.active }),
         ...(params.cancelTree ? { cancel: id => cancelSessionWithBridge(this.bridge, this.options({ sessionId: id, liveSession: true })) } : {})
       });
-      return { clean: true };
+      return { clean: true, settled: true, native_settled: true };
       }, [
         ["provider", () => this.bridge.close()],
         ["provider_resource", () => finishDaemonProcess(this.state.config, this.state.provider_process)],

package/dist/harness-runtime/lib/dd-opencode-daemon.mjs

@@ -10,8 +10,9 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { appendFile, chmod, lstat, mkdir, open, readFile, realpath, unlink, writeFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import net from "node:net";
-import { durableDaemonDispatch, completeDaemonShutdown, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon, assertDaemonDispatch, assertDaemonRestartable } from "./daemon-operations.mjs";
+import { durableDaemonDispatch, completeDaemonShutdown, commitDaemonShutdown, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon, assertDaemonDispatch, assertDaemonRestartable } from "./daemon-operations.mjs";
 import { waitForSettlement } from "./session-settlement.mjs";
+import { nativeExecutionReceipt } from "./native-children.mjs";
 import { errorRecord, isProvenShellCorrection, reportedError } from "./operation-errors.mjs";
 import { checkObservedProfile, observeModel } from "./model-observations.mjs";
 import os from "node:os";
@@ -201,15 +202,35 @@ export class Runtime {
   async journal(operation, result) { const line = `${JSON.stringify({ schema_id: "dd-opencode/daemon-event@1", event_id: randomUUID(), observed_at: new Date().toISOString(), operation, active_tree: this.state.active_tree, session_id: result?.provider_session_id ?? null })}\n`; for (const journal of new Set([this.paths.journal, this.state.config.journal].filter(Boolean))) { await mkdir(path.dirname(journal), { recursive: true, mode: 0o700 }); await appendFile(journal, line, { mode: 0o600 }); } }
   async childTree(id, seen = new Set()) {
     if (seen.has(id)) throw new DaemonError("session_identity_mismatch", "OpenCode native topology contains a cycle");
-    seen.add(id); const direct = await this.client.children(id) ?? [], nested = [];
+    seen.add(id); const direct = await this.ownedChildren(id), nested = [];
     for (const child of direct) {
       if (!child.id || child.parentID !== id) throw new DaemonError("session_identity_mismatch", "OpenCode child has a foreign native parent");
       nested.push(child, ...await this.childTree(child.id, seen));
     }
     return nested;
   }
-  async describe(id) {
-    const [info, messages, children, statuses] = await Promise.all([this.client.inspect(id), this.client.messages(id), this.childTree(id), this.client.statuses()]);
+  async ownedChildren(id) {
+    const direct = await this.client.children(id), children = new Map();
+    if (!Array.isArray(direct)) throw new DaemonError("native_child_observation_unavailable", "OpenCode child inventory is unavailable");
+    for (const child of direct) children.set(child.id, child);
+    for (const record of this.sessions.values()) if (record.parent_provider_session_id === id && !children.has(record.provider_session_id)) {
+      let child;
+      try { child = await this.client.inspect(record.provider_session_id); }
+      catch (cause) { throw new DaemonError("native_child_observation_unavailable", "Retained OpenCode child disappeared without completion proof", false, { provider_session_id: record.provider_session_id, cause: errorPayload(cause) }); }
+      if (child?.id !== record.provider_session_id) throw new DaemonError("session_identity_mismatch", "OpenCode retained child read returned another Session");
+      children.set(child.id, child);
+    }
+    for (const child of children.values()) if (!child.id || child.parentID !== id || child.fork) throw new DaemonError("session_identity_mismatch", "OpenCode child has a foreign native parent");
+    return [...children.values()];
+  }
+  async revision(id) {
+    if (!this.client.logs) return null;
+    const { watermark } = await this.client.logs(id);
+    return JSON.stringify([id, watermark]);
+  }
+  async describe(id, refreshes = 1) {
+    const before = new Map([[id, await this.revision(id)]]);
+    const [info, messages, children] = await Promise.all([this.client.inspect(id), this.client.messages(id), this.childTree(id)]);
     const parent = info.fork ? null : info.parentID ?? null, existing = this.sessions.get(id);
     if (info.id !== id || !existing && (!parent || !this.sessions.has(parent) || info.fork)
       || existing && (existing.parent_provider_session_id ?? null) !== parent) throw new DaemonError("foreign_session", "OpenCode Session is not in the retained owned tree");
@@ -219,17 +240,31 @@ export class Runtime {
       if (child.fork || retained && retained.parent_provider_session_id !== child.parentID) throw new DaemonError("session_identity_mismatch", "OpenCode child ancestry changed");
       this.retainSession(child, record.root_provider_session_id);
     }
-    const pending = new Map();
+    const pending = new Map(), histories = new Map([[id, messages]]);
+    for (const child of children) before.set(child.id, await this.revision(child.id));
+    const statuses = await this.client.statuses();
     for (const session of [id, ...children.map(child => child.id)]) {
+      if (session !== id) histories.set(session, await this.client.messages(session));
       const value = this.client.pending ? await this.client.pending(session) : { inbox: [], forms: [], permissions: [] };
       pending.set(session, { ...value, shells: this.client.shells ? (await this.client.shells(session)).filter(shell => shell.status === "running") : [] });
     }
-    const busy = session => Boolean(statuses[session] && statuses[session].type !== "idle") || Object.values(pending.get(session)).some(items => items.length > 0);
+    const changed = new Set(), unavailable = new Set();
+    for (const [session, seq] of before) {
+      const after = await this.revision(session);
+      if (seq === null || after === null) { unavailable.add(session); changed.add(session); }
+      else if (after !== seq) changed.add(session);
+    }
+    // Re-read one raced snapshot inside this request, without a new clock or
+    // quiet sleep. An absent fence has no reconciliation authority.
+    if (changed.size && !unavailable.size && refreshes > 0) return this.describe(id, refreshes - 1);
+    const currentMessages = session => { const history = histories.get(session); return history.slice(history.findLastIndex(message => message.info.role === "user") + 1); };
+    const busy = session => changed.has(session) || Boolean(statuses[session] && statuses[session].type !== "idle") || Object.values(pending.get(session)).some(items => items.length > 0)
+      || currentMessages(session).some(message => (message.parts ?? []).some(part => part.type === "tool" && ["pending", "running", "streaming"].includes(part.state?.status)));
     for (const child of children) {
-      const history = await this.client.messages(child.id);
+      const history = histories.get(child.id);
       const index = history.findLastIndex(message => message.info.role === "user" && message.info.sessionID === child.id);
       const terminal = index >= 0 && history.slice(index + 1).findLast(message => message.info.role === "idle" && message.info.sessionID === child.id);
-      if (!terminal || busy(child.id)) continue;
+      if (!terminal || busy(child.id)) { Object.assign(child, { status: changed.has(child.id) ? "unknown" : busy(child.id) ? "running" : "idle", native_turn_items: { observed: Boolean(terminal) && !changed.has(child.id), possible_effects: true, pending: busy(child.id) } }); continue; }
       const outcome = terminal.info.outcome;
       if (!["succeeded", "failed", "interrupted"].includes(outcome)) continue;
       Object.assign(child, { status: outcome === "succeeded" ? "completed" : outcome === "failed" ? "failed" : "cancelled",
@@ -237,7 +272,7 @@ export class Runtime {
         native_turn_items: { observed: true, possible_effects: true, pending: false },
         ...(terminal.info.error ? { provider_error: safeProviderError(terminal.info.error) } : {}) });
     }
-    const unsettledChildren = children.filter(child => busy(child.id)).map(child => child.id), status = busy(id) ? "busy" : "idle";
+    const unsettledChildren = children.filter(child => busy(child.id)).map(child => child.id), status = changed.has(id) ? "unknown" : busy(id) ? "busy" : "idle";
     const lastAssistant = messages.findLast(message => message.info?.role === "assistant");
     const inputIndex = messages.findLastIndex(message => message.info.role === "user");
     const idle = messages.slice(inputIndex + 1).findLast(message => message.info.role === "idle");
@@ -245,18 +280,20 @@ export class Runtime {
     await this.observeModels(id, messages, parent);
     this.journaledTools ??= new Map();
     if (this.state.config.journal) journalToolObservations(this.state.config.journal, messages.flatMap(message => (message.parts ?? []).map(part => openCodeToolObservation(part, id, message.info?.id))), this.journaledTools);
-    return { ...record, observed_profile: { provider: lastAssistant?.info?.providerID ?? info.model?.providerID ?? null, model: lastAssistant?.info?.modelID ?? info.model?.id ?? null, reasoning: lastAssistant?.info?.variant ?? info.model?.variant ?? "default", mode: info.agent ?? null },
+    const receipt = { ...record, observed_profile: { provider: lastAssistant?.info?.providerID ?? info.model?.providerID ?? null, model: lastAssistant?.info?.modelID ?? info.model?.id ?? null, reasoning: lastAssistant?.info?.variant ?? info.model?.variant ?? "default", mode: info.agent ?? null },
       assistant_text: (lastAssistant?.parts ?? []).filter(part => part.type === "text").map(part => part.text ?? "").join(""), info, status,
       route_conformance: { matches: [info, ...children].every(session => session.directory && path.resolve(session.directory) === path.resolve(this.state.config.cwd)), expected: this.state.config.cwd, actual: info.directory ?? null, actual_provenance: "native_session_readback" },
       route_violations: [info, ...children].filter(session => !session.directory || path.resolve(session.directory) !== path.resolve(this.state.config.cwd)).map(session => ({ provider_session_id: session.id, expected: this.state.config.cwd, actual: session.directory ?? null, actual_provenance: "native_session_readback" })),
       settled: status === "idle" && !unsettledChildren.length, unsettled_children: unsettledChildren,
       tree_session_ids: treeIds, unsettled_sessions: treeIds.filter(busy),
-      tree_observations: treeIds.map(session => ({ provider_session_id: session, status: busy(session) ? "running" : "idle", settled: !busy(session) })),
+      tree_observations: treeIds.map(session => ({ provider_session_id: session, status: changed.has(session) ? "unknown" : busy(session) ? "running" : "idle", settled: !busy(session) })),
+      ...(changed.size ? { native_settlement: { confirmed: false, state: "unproven", reason: "native_revision_fence_unavailable_or_changed" } } : {}),
       terminal_turn_id: idle && inputIndex >= 0 ? messages[inputIndex].info.id : null,
       terminal_status: idle?.info.outcome === "failed" ? "failed" : idle?.info.outcome === "succeeded" ? "completed" : idle?.info.outcome ?? null,
       native_turn_items: { observed: Boolean(idle), possible_effects: messages.slice(inputIndex + 1).some(message => message.parts.some(part => part.type === "tool")),
-        pending: busy(id) || messages.slice(inputIndex + 1).some(message => message.parts.some(part => part.type === "tool" && ["running", "streaming"].includes(part.state?.status))) },
+        pending: busy(id) },
       children, pending: pending.get(id), usage: usageSnapshot(messages, id), history_sha256: historyDigest(messages), message_count: messages.length };
+    return nativeExecutionReceipt(receipt, { daemonId: this.state.daemon_id, revision: before.get(id) ?? 0 });
   }
   async observeModels(id, messages, parent = null) {
     this.modelMessages ??= new Set();
@@ -301,18 +338,24 @@ export class Runtime {
   async cancelTree(id, seen = new Set()) {
     if (!this.sessions.has(id)) throw new DaemonError("foreign_session", "cannot cancel a Session without daemon ownership");
     if (seen.has(id)) return [];
-    const native = await this.client.inspect(id), retained = this.sessions.get(id);
-    if (native.id !== id || (retained.parent_provider_session_id ?? null) !== (native.fork ? null : native.parentID ?? null)) throw new DaemonError("session_identity_mismatch", "OpenCode cancellation Session ancestry changed");
-    this.retainSession(native, retained.root_provider_session_id ?? id);
+    const retained = this.sessions.get(id), errors = [];
+    let native;
+    try { native = await this.client.inspect(id); }
+    catch (error) { errors.push({ session_id: id, phase: "inspect", ...errorPayload(error) }); }
+    if (native) {
+      if (native.id !== id || (retained.parent_provider_session_id ?? null) !== (native.fork ? null : native.parentID ?? null)) throw new DaemonError("session_identity_mismatch", "OpenCode cancellation Session ancestry changed");
+      try { this.retainSession(native, retained.root_provider_session_id ?? id); }
+      catch (error) { errors.push({ session_id: id, phase: "retain", ...errorPayload(error) }); }
+    }
     seen.add(id);
-    const errors = []; let children = [];
-    try { children = await this.client.children(id); } catch (error) { errors.push({ session_id: id, phase: "children", ...errorPayload(error) }); }
+    let children = [];
+    try { children = await this.ownedChildren(id); } catch (error) { errors.push({ session_id: id, phase: "children", ...errorPayload(error) });
+      children = [...this.sessions.values()].filter(record => record.parent_provider_session_id === id).map(record => ({ id: record.provider_session_id, parentID: id, directory: record.cwd })); }
     for (const child of children) {
       if (child.parentID !== id || child.fork || this.sessions.has(child.id) && this.sessions.get(child.id).parent_provider_session_id !== id) {
         errors.push({ session_id: child.id, phase: "identity", code: "session_identity_mismatch" }); continue;
       }
-      this.retainSession(child, this.sessions.get(id)?.root_provider_session_id ?? id);
-      try { errors.push(...await this.cancelTree(child.id, seen)); }
+      try { this.retainSession(child, this.sessions.get(id)?.root_provider_session_id ?? id); errors.push(...await this.cancelTree(child.id, seen)); }
       catch (error) { errors.push({ session_id: child.id, phase: "cancel_child", ...errorPayload(error) }); }
     }
     try { await this.client.abort(id); } catch (error) { errors.push({ session_id: id, phase: "abort", ...errorPayload(error) }); }
@@ -467,7 +510,10 @@ export class Runtime {
         },
         ...(params.cancelTree ? { cancel: id => this.cancelTree(id) } : {})
       });
-      return { clean: true };
+      // Fresh native observation, not a prior productive result, owns the idle proof.
+      commitDaemonShutdown(this.paths.dir);
+      await this.persist({ active_tree: false });
+      return { clean: true, settled: true, native_settled: true };
       }, [
         ["provider", () => stopProcessGroup(this.child)],
         ["provider_resource", () => finishDaemonProcess(this.state.config, this.providerProcess)],

package/dist/harness-runtime/lib/dd-opencode.mjs

@@ -14,6 +14,33 @@ const lost = (message, details) => new OpenCodeError("operation_observation_lost
 export const requestDigest = value => createHash("sha256").update(JSON.stringify(value)).digest("hex");
 export const nativeModel = ({ provider, model, variant }) => ({ providerID: provider, id: model, ...(variant && variant !== "default" ? { variant } : {}) });
 
+/** Native finite session.log includes a control watermark, not a domain event. */
+export function decodeFiniteLog(items, sessionId, after = 0) {
+  const fail = (reason, field, unproven = false) => { throw new OpenCodeError(unproven ? "opencode_observation_unproven" : "opencode_observation_corrupt", "OpenCode finite log has no trustworthy revision", false,
+    { native_outcome: "unknown", session_id: sessionId, cursor: after, reason, field }); };
+  if (!Number.isSafeInteger(after) || after < 0) fail("invalid_cursor", "after");
+  if (!Array.isArray(items)) fail("invalid_batch", "items");
+  const events = []; let watermark, cursor = after;
+  for (const item of items) {
+    if (watermark !== undefined) fail("frame_after_sync", "type");
+    const sync = item?.type === "log.synced", metadata = sync ? item : item?.durable;
+    if (!metadata) fail("missing_metadata", "durable");
+    if (metadata.aggregateID !== sessionId) fail("foreign_aggregate", sync ? "aggregateID" : "durable.aggregateID");
+    if (!Number.isSafeInteger(metadata.seq) || metadata.seq < 0) fail("invalid_sequence", sync ? "seq" : "durable.seq", sync && metadata.seq === undefined);
+    if (sync) {
+      if (metadata.seq < cursor) fail("watermark_behind_cursor", "seq");
+      watermark = metadata.seq;
+    } else {
+      if (typeof item.type !== "string" || !item.type.startsWith("session.") || !item.data || typeof item.data !== "object") fail("invalid_domain_event", "type/data");
+      if (item.data.sessionID !== undefined && item.data.sessionID !== sessionId) fail("foreign_session", "data.sessionID");
+      if (metadata.seq <= cursor) fail("non_increasing_sequence", "durable.seq");
+      cursor = metadata.seq; events.push(item);
+    }
+  }
+  if (watermark === undefined) fail("missing_sync", "log.synced", true);
+  return { events, watermark };
+}
+
 /** info/parts is our normalized projection, not a second v1 native protocol. */
 export function normalizeMessage(message, sessionID) {
   if (!message?.id || !message.type) throw lost("OpenCode message has no native identity");
@@ -124,7 +151,7 @@ export class OpenCodeClient {
     try { for await (const event of api.session.log({ sessionID: id, after, follow: false }, { signal: controller.signal })) events.push(event); }
     catch (cause) { throw Object.assign(lost("OpenCode durable log observation failed", { session_id: id }), { cause }); }
     finally { clearInterval(timer); }
-    return events;
+    return decodeFiniteLog(events, id, after);
   }
   async abort(id) {
     // Queued input must not become fresh work during interruption cleanup.
@@ -221,15 +248,15 @@ export class OpenCodeClient {
       for (;;) {
         try {
           await checkHookFailures?.();
-          const events = await this.logs(id, state.cursor);
+          const { events, watermark } = await this.logs(id, state.cursor);
           let delivered = state.delivered === true, terminal = state.terminal;
           for (const event of events) {
-            if (!Number.isInteger(event.durable?.seq) || event.durable.seq <= state.cursor) continue;
             if (event.type === "session.inbox.delivered" && event.data.inboxID === messageId) { delivered = true; terminal = null; }
             if (delivered && event.type === "session.execution.started") terminal = null;
             if (delivered && ["session.execution.succeeded", "session.execution.failed", "session.execution.interrupted"].includes(event.type)) terminal = { type: event.type, error: event.data.error };
             state = { ...state, cursor: event.durable.seq, delivered, terminal }; await save?.(state);
           }
+          if (state.cursor !== watermark) { state = { ...state, cursor: watermark }; await save?.(state); }
           let runningTools = false;
           const observe = async (session, visited = new Set()) => {
             if (visited.has(session)) throw lost("OpenCode topology contains a cycle"); visited.add(session); known.add(session);