@deksden-com/dd-flow-cli 0.9.0-beta.145 → 0.9.0-beta.149

package/dist/harness-runtime/lib/dd-zcode-daemon.mjs

@@ -30,7 +30,7 @@ import {
 } from "./dd-zcode.mjs";
 
 const REQUEST_SCHEMA = "dd-zcode/daemon-request@1";
-import { settledNativeTree } from "./native-children.mjs";
+import { settledNativeTree, nativeExecutionReceipt } from "./native-children.mjs";
 const RESPONSE_SCHEMA = "dd-zcode/daemon-response@1";
 const STATE_SCHEMA = "dd-zcode/daemon-state@1";
 // ACP silence starts diagnostics; it is not a provider-failure deadline.
@@ -549,7 +549,7 @@ export class DaemonRuntime {
         for (const receipt of [previous, closed]) {
           if (receipt?.close?.closed === true && receipt.settled === true
             && receipt.topology?.complete === true && receipt.topology.root_session_id === params.sessionId
-            && Array.isArray(receipt.topology.child_session_ids)) return receipt;
+            && Array.isArray(receipt.topology.child_session_ids)) return nativeExecutionReceipt(receipt, { daemonId: this.state.daemon_id, generation: this.controlGeneration ?? 0 });
         }
         const known = [...new Set([...topology.child_session_ids, ...(previous?.topology?.child_session_ids ?? [])])];
         const emptyRoot = this.neverPromptedRootProof(params.sessionId);
@@ -559,7 +559,7 @@ export class DaemonRuntime {
         this.state.settlement_observations ??= {};
         this.state.settlement_observations[params.sessionId] = observation;
         await this.persist();
-        return observation;
+        return nativeExecutionReceipt(observation, { daemonId: this.state.daemon_id, generation: this.controlGeneration ?? 0 });
       }
       const adapter = params.adapterSessionId ?? params.sessionId;
       if (!this.liveAdapters.has(adapter) && this.activeProductive) {
@@ -584,8 +584,8 @@ export class DaemonRuntime {
       const childIds = [...new Set([...(this.sessions.get(result.provider_session_id)?.known_child_session_ids ?? []), ...zcodeChildSessionIds(nativeChildren)])];
       const childStates = new Map([...(nativeChildren?.ended?.items ?? nativeChildren?.completed ?? []), ...(nativeChildren?.running ?? []).map(child => ({ ...child, status: "running" }))].map(child => [child.childSessionId ?? child.sessionId, child.status]));
       const rootSettled = !this.activeProductive && failure?.provider_session_id === result.provider_session_id && (result.evidence ?? result).read?.projection?.status === "idle";
-      return { ...result, settled, ...settledNativeTree(result.provider_session_id, childIds.map(childSessionId => ({ childSessionId, status: childStates.get(childSessionId) ?? "unknown" })), settled, rootSettled),
-        ...(failure?.provider_session_id === result.provider_session_id ? { terminal_turn_id: String(failure.request_id) } : {}) };
+      return nativeExecutionReceipt({ ...result, settled, ...settledNativeTree(result.provider_session_id, childIds.map(childSessionId => ({ childSessionId, status: childStates.get(childSessionId) ?? "unknown" })), settled, rootSettled),
+        ...(failure?.provider_session_id === result.provider_session_id ? { terminal_turn_id: String(failure.request_id) } : {}) }, { daemonId: this.state.daemon_id, generation: this.controlGeneration ?? 0 });
     }
     if (operation === "session.cancel") {
       if (!this.sessions.has(params.sessionId)) throw new DaemonError("session_identity_mismatch", "cancellation Session is not owned by this daemon");
@@ -604,6 +604,7 @@ export class DaemonRuntime {
       return result;
     }
     if (operation === "daemon.stop") return await completeDaemonShutdown(this.paths.dir, this.state, patch => this.persist(patch), () => this.prepareStop(params.cancelTree === true), [
+      ["provider", () => this.bridge.close?.()],
       ["provider_resource", () => finishDaemonProcess(this.state.config, this.state.provider_process)],
       ["daemon_resource", () => finishDaemonProcess(this.state.config, this.state.resource_process)]
     ]);
@@ -691,7 +692,7 @@ export class DaemonRuntime {
     try { if (!bridgeClosed && typeof this.bridge.close === "function") await this.bridge.close(); }
     catch (error) { throw new DaemonError(error.code ?? "provider_process_stop_incomplete", error.message ?? String(error), false, error.details); }
     await this.persist({ active_tree: false, shutdown_state: "stopping", active_operation: null, active_request: null, physical_settlement: { confirmed_at: new Date().toISOString(), bridge_pid: this.bridge.child?.pid ?? null } });
-    return { daemon_id: this.state.daemon_id, stopped: true, clean: true, physical_settlement: this.state.physical_settlement, _shutdown: true };
+    return { daemon_id: this.state.daemon_id, stopped: true, clean: true, settled: true, native_settled: true, physical_settlement: this.state.physical_settlement, _shutdown: true };
   }
 
 }

package/dist/harness-runtime/lib/driver-recovery.mjs

@@ -6,22 +6,23 @@ import { writeJsonAtomic } from "./runner-events.mjs";
 import { reportedError } from "./operation-errors.mjs";
 import { ObservationClock } from "./observation-clock.mjs";
 import { runtimeProcess } from "./managed-daemon.mjs";
+import { nativeShutdownConfirmed } from "./native-children.mjs";
 
-function cleanShutdownConfirmed(state) {
+async function cleanShutdownConfirmed(root, state) {
   const proof = state.shutdown;
+  let fence;
+  try { fence = JSON.parse(await readFile(path.join(root, 'operation-fence.json'), 'utf8')); }
+  catch (error) { if (error.code !== 'ENOENT') throw error; }
   return state.shutdown_state === "clean" && state.active_tree === false
-    && proof?.schema_id === "dd-flow/daemon-shutdown@1" && proof.daemon_id === state.daemon_id
-    && proof.result?.clean === true && Array.isArray(proof.required_phases)
-    && proof.required_phases.length >= 3 && proof.required_phases.includes("tree")
-    && proof.required_phases.includes("daemon_resource")
-    && proof.required_phases.every(phase => typeof phase === "string" && proof.phases?.[phase] === true);
+    && typeof state.daemon_id === 'string' && fence?.daemon_id === state.daemon_id && Number.isSafeInteger(fence.generation) && fence.generation >= 0
+    && nativeShutdownConfirmed(proof, { daemonId: state.daemon_id, generation: fence.generation });
 }
 
 /** Explicit same-Session restart retains native stores and the old daemon
  * receipt; it does not turn a terminal directory into a new execution. */
 export async function authorizeRetainedDaemonResume(root, previous, sessionId, config) {
   const sessions = [...(previous.sessions ?? []), ...(previous.root_session_id ? [previous.root_session_id] : [])];
-  if (!cleanShutdownConfirmed(previous) || typeof sessionId !== "string" || !sessions.some(session => (typeof session === "string" ? session : session.provider_session_id) === sessionId)) throw Object.assign(new Error("terminal daemon restart requires a retained, settled Session identity and complete shutdown proof"), { code: "daemon_state_terminal" });
+  if (!await cleanShutdownConfirmed(root, previous) || typeof sessionId !== "string" || !sessions.some(session => (typeof session === "string" ? session : session.provider_session_id) === sessionId)) throw Object.assign(new Error("terminal daemon restart requires a retained, settled Session identity and complete shutdown proof"), { code: "daemon_state_terminal" });
   for (const key of ["cwd", "projectRoot", "ddFlowHome", "ddFlowBin", "provider", "model", "reasoning", "mode", "variant", "agent", "bin", "noFlow"]) {
     if ((previous.config?.[key] ?? null) !== (config[key] ?? null)) throw Object.assign(new Error(`retained daemon configuration changed: ${key}`), { code: "daemon_config_mismatch" });
   }
@@ -53,7 +54,7 @@ export async function recoverySettlement(driversRoot) {
       }
       else if (entry.name === "daemon.json") {
         const state = JSON.parse(await readFile(file, "utf8"));
-        if (!cleanShutdownConfirmed(state)) throw Object.assign(new Error("provider tree has no complete clean shutdown receipt"), { code: "recovery_settlement_unconfirmed" });
+        if (!await cleanShutdownConfirmed(directory, state)) throw Object.assign(new Error("provider tree has no complete clean shutdown receipt"), { code: "recovery_settlement_unconfirmed" });
         await assertDaemonReplaceable(directory);
         await reconcileDriverReplies(directory);
         if (state.config?.resourceHome && state.resource_process?.id) {

package/dist/harness-runtime/lib/managed-daemon.d.mts

@@ -10,7 +10,7 @@ export function heartbeatDaemonProcess(config: RuntimeConfig, record: ProcessBin
 export function finishDaemonProcess(config: RuntimeConfig, record: ProcessBinding | null | undefined, state?: string, reason?: string): Promise<void>;
 export function cleanupFailedDaemonStart(config: RuntimeConfig, record: ProcessBinding | null, child: ChildProcess | null, original: Error & { details?: Record<string, unknown> }, readState: () => Promise<Record<string, unknown>>, daemonId: string): Promise<void>;
 export function completeBudgetOperation(stateDir: string, request: { id: string; operation: string; params?: { sessionId?: string } }, result: unknown, observe?: () => Promise<Record<string, unknown>>): Promise<Record<string, unknown>>;
-export function stopProcessGroup(child: ChildProcess | null | undefined, graceMs?: number, options?: { detached?: boolean; settlementMs?: number }): Promise<void>;
+export function stopProcessGroup(child: ChildProcess | { pid: number; started: string } | null | undefined, graceMs?: number, options?: { detached?: boolean; settlementMs?: number; started?: string }): Promise<void>;
 export function assertStartupChild(child: Pick<ChildProcess, "pid" | "exitCode" | "signalCode">, expected: Record<string, unknown>, observed: Record<string, unknown> | null, log: string): void;
 export function retainStartupFailure(input: { state: Record<string, unknown>; publish: (state: Record<string, unknown>) => Promise<unknown>; log: string; error: Error & { code?: string; details?: Record<string, unknown> } }): Promise<void>;
 export function startManagedBridge(input: { config: RuntimeConfig; state: Record<string, unknown>; bridge: { child: ChildProcess | null; options: { onSpawn?: (child: ChildProcess) => Promise<void> }; start: () => Promise<unknown> }; kind: string; publish: (state: Record<string, unknown>) => Promise<unknown>; log?: string }): Promise<unknown>;

package/dist/harness-runtime/lib/managed-daemon.mjs

@@ -5,6 +5,7 @@ import { commandJson } from "./process-json.mjs";
 import { errorRecord, reportedError, diagnosticJson } from "./operation-errors.mjs";
 import { writeJsonAtomic } from "./runner-events.mjs";
 import { runBoundedCommand } from "./native-hook-command.mjs";
+import { processSnapshot } from "./process-snapshot.mjs";
 import { createRenewalState, maintenanceRetryable, renewalConfirmed, renewalDelay, renewalFailure, renewalRemaining, RENEWAL_POLICY } from "./lease-renewal.mjs";
 
 const leases = new Map();
@@ -598,14 +599,14 @@ export async function closeBridgeProcess(bridge, drain, stopOptions = {}) {
   finally { bridge.closePending = null; }
 }
 
-export async function stopProcessGroup(child, graceMs = 1_000, { detached = true, settlementMs = 10_000 } = {}) {
+export async function stopProcessGroup(child, graceMs = 1_000, { detached = true, settlementMs = 10_000, started = child?.started ?? null } = {}) {
   if (!child?.pid) return;
   if (processStops.has(child)) return await processStops.get(child);
-  const pending = stopOwnedChild(child, graceMs, detached, settlementMs);
+  const pending = stopOwnedChild(child, graceMs, detached, settlementMs, started);
   processStops.set(child, pending);
   try { return await pending; } finally { processStops.delete(child); }
 }
-async function stopOwnedChild(child, graceMs, detached, settlementMs) {
+async function stopOwnedChild(child, graceMs, detached, settlementMs, started) {
   const target = process.platform === "win32" || !detached ? child.pid : -child.pid;
   const details = signal => ({ pid: child.pid, pgid: target < 0 ? child.pid : null, signal, platform: process.platform, exit_code: child.exitCode ?? null, signal_code: child.signalCode ?? null, observed_at: new Date().toISOString() });
   const alive = () => { try { process.kill(target, 0); return true; } catch (error) { if (error.code === "ESRCH") return false; if (error.code === "EPERM") return true; throw error; } };
@@ -615,6 +616,13 @@ async function stopOwnedChild(child, graceMs, detached, settlementMs) {
     return !alive();
   };
   const signal = async name => {
+    // A retained raw PID is not a ChildProcess handle. Revalidate its birth at
+    // every signal, including escalation after the TERM grace period.
+    if (started !== null) {
+      if (typeof started !== 'string' || !started) throw Object.assign(new Error('process birth identity is invalid'), { code: 'process_identity_unproven' });
+      const observed = (await processSnapshot()).find(item => item.pid === child.pid);
+      if (!observed || observed.started !== started || observed.zombie) return false;
+    }
     try { process.kill(target, name); return true; }
     catch (error) {
       if (error.code === "ESRCH") return false;

package/dist/harness-runtime/lib/native-children.d.mts

@@ -1,4 +1,11 @@
-export const NATIVE_CHILD_CONTRACT_VERSION: "native-children@1";
+export const NATIVE_CHILD_CONTRACT_VERSION: "native-children@2";
+export const NATIVE_TREE_SETTLEMENT_CONTRACT: "native-tree-settlement@2";
+export const NATIVE_SHUTDOWN_CONTRACT: "dd-flow/daemon-shutdown@2";
+export const NATIVE_SHUTDOWN_PHASES: readonly string[];
+export function nativeShutdownConfirmed(receipt: unknown, binding?: { daemonId?: string; generation?: number }): boolean;
+export function nativeExecutionReceipt(receipt: Record<string, unknown>, options?: { daemonId?: string; generation?: number; revision?: number; resources?: Record<string, unknown> }): Record<string, unknown>;
+export type NativeTreeReadiness = "ready" | "owned_children_live" | "inspection_pending" | "unproven";
+export function nativeTreeReadiness(receipt: Record<string, unknown>, binding: { sessionId: string; operationId: string; turnId?: string; requestProof?: unknown; allowDescendants?: boolean }): NativeTreeReadiness;
 export function settledNativeTree(root: string, children: Record<string, unknown>[], settled: boolean, rootSettled?: boolean): Record<string, unknown>;
 export function safeNativeFailure(value: unknown): Record<string, unknown> | undefined;
 export interface NativeChild {

package/dist/harness-runtime/lib/native-children.mjs

@@ -1,9 +1,104 @@
-export const NATIVE_CHILD_CONTRACT_VERSION = "native-children@1";
+export const NATIVE_CHILD_CONTRACT_VERSION = "native-children@2";
+export const NATIVE_TREE_SETTLEMENT_CONTRACT = "native-tree-settlement@2";
+export const NATIVE_SHUTDOWN_CONTRACT = "dd-flow/daemon-shutdown@2";
+export const NATIVE_SHUTDOWN_PHASES = Object.freeze(["execution", "owned_resources", "provider", "daemon_resource"]);
 import { errorRecord } from "./operation-errors.mjs";
 import { safeProviderError } from "./provider-overload-policy.mjs";
+import { streamRequestKey } from "./provider-overload-policy.mjs";
+const liveStatus = value => ["active", "running", "inprogress", "pending", "streaming", "busy"].includes(String(typeof value === "object" && value ? value.type : value).toLowerCase());
+
+/** One current receipt only. Producers, not status ranks, establish freshness. */
+export function nativeTreeReadiness(receipt, { sessionId, operationId, turnId, requestProof, allowDescendants = true } = {}) {
+  if (receipt?.native_settlement?.contract !== NATIVE_TREE_SETTLEMENT_CONTRACT || receipt.native_settlement.scope !== "required_execution") return "unproven";
+  if (!receipt || typeof sessionId !== "string" || !sessionId || typeof operationId !== "string" || !operationId || receipt.provider_session_id !== sessionId
+    || turnId !== undefined && receipt.terminal_turn_id !== undefined && receipt.terminal_turn_id !== turnId) return "unproven";
+  const requestKey = requestProof?.kind === "stream_request" ? streamRequestKey(requestProof) : null;
+  if (requestProof?.kind === "stream_request" && (!requestKey || requestProof.operation_id !== operationId
+    || streamRequestKey(receipt.terminal_metadata?.request_proof) !== requestKey)) return "unproven";
+  const pending = receipt.native_settlement;
+  if (pending?.state === "inspection_pending") {
+    const clock = pending.observation_clock;
+    return receipt.settled === false && pending.confirmed === false && pending.operation_id === operationId
+      && pending.provider_session_id === sessionId && requestKey && pending.request_key === requestKey
+      && clock?.policy === "operation-progress@1" && Number.isFinite(clock.started_at)
+      && Number.isSafeInteger(clock.timeout_ms) && clock.timeout_ms > 0 && clock.timeout_ms <= 2147483647
+      && Number.isFinite(clock.elapsed_ms) && clock.elapsed_ms >= 0 && clock.elapsed_ms < clock.timeout_ms
+      && Number.isSafeInteger(clock.gaps) && clock.gaps >= 0
+      && typeof clock.uncertain === "boolean"
+      && Number.isFinite(clock.uncertainty_elapsed_ms) && clock.uncertainty_elapsed_ms >= 0
+      && (clock.observed_at === null || Number.isFinite(clock.observed_at))
+      && clock.observation_lost === false ? "inspection_pending" : "unproven";
+  }
+  if (receipt.native_turn_items?.pending === true) return "unproven";
+  const ids = receipt.tree_session_ids, observations = receipt.tree_observations, unsettled = receipt.unsettled_sessions;
+  if (!Array.isArray(ids) || !ids.length || ids[0] !== sessionId || ids.some(id => typeof id !== "string" || !id)
+    || new Set(ids).size !== ids.length || !allowDescendants && ids.length !== 1
+    || !Array.isArray(observations) || observations.length !== ids.length
+    || !ids.every(id => observations.filter(item => item?.provider_session_id === id).length === 1)
+    || observations.some(item => !item || typeof item !== "object" || Array.isArray(item) || typeof item.settled !== "boolean" || item.settled === true && liveStatus(item.status)) || !Array.isArray(unsettled)
+    || new Set(unsettled).size !== unsettled.length) return "unproven";
+  // A producer's tree list cannot silently omit another positively observed
+  // owned child. Normalize the same receipt, not a second historical ledger.
+  try {
+    const children = normalizeNativeChildren(receipt, sessionId);
+    if (children.some(child => !ids.includes(child.session_id) || !ids.includes(child.parent_session_id) || child.parent_session_id === child.session_id)) return "unproven";
+    for (const child of children) {
+      let parent = child.parent_session_id;
+      const visited = new Set([child.session_id]);
+      while (parent !== sessionId) {
+        if (visited.has(parent)) return "unproven";
+        visited.add(parent); parent = children.find(item => item.session_id === parent)?.parent_session_id;
+        if (!parent) return "unproven";
+      }
+    }
+  } catch { return "unproven"; }
+  const live = observations.filter(item => !item.settled);
+  if (unsettled.length !== live.length || !live.every(item => unsettled.includes(item.provider_session_id))) return "unproven";
+  const settlement = receipt.settlement;
+  const budgetSettled = !settlement || settlement.state === "not_required"
+    || settlement.state === "settled" && settlement.operation_ids?.includes(operationId) === true;
+  if (receipt.settled === true && receipt.native_settled !== false && pending?.confirmed !== false && !live.length && budgetSettled) return "ready";
+  const root = observations.find(item => item.provider_session_id === sessionId);
+  const knownLive = live.length > 0 && live.every(item => item.provider_session_id !== sessionId && liveStatus(item.status));
+  return allowDescendants && receipt.settled === false && root.settled === true && knownLive
+    && (!settlement || settlement.state === "not_required" || settlement.state === "pending" && settlement.reason === "tree_unsettled")
+    ? "owned_children_live" : "unproven";
+}
 
 function nativeFailure(code, message, exitCode, details) { return Object.assign(new Error(message), { code, exitCode, details }); }
 
+/** Control settlement is not native settlement; explicit uncertainty wins. */
+export function nativeShutdownConfirmed(receipt, { daemonId, generation } = {}) {
+  const proof = receipt?.schema_id === NATIVE_SHUTDOWN_CONTRACT ? receipt : receipt?.shutdown_proof;
+  const result = receipt?.schema_id === NATIVE_SHUTDOWN_CONTRACT ? receipt.result : receipt;
+  return Boolean(proof?.schema_id === NATIVE_SHUTDOWN_CONTRACT && typeof proof.daemon_id === "string" && proof.daemon_id
+    && (daemonId === undefined || proof.daemon_id === daemonId) && Number.isSafeInteger(proof.generation) && proof.generation >= 0
+    && (generation === undefined || proof.generation === generation)
+    && Array.isArray(proof.required_phases) && new Set(proof.required_phases).size === proof.required_phases.length
+    && NATIVE_SHUTDOWN_PHASES.every(phase => proof.required_phases.includes(phase))
+    && proof.required_phases.every(phase => typeof phase === "string" && proof.phases?.[phase] === true)
+    && result?.daemon_id === proof.daemon_id && result.shutdown_contract === NATIVE_SHUTDOWN_CONTRACT
+    && result.clean === true && result.stopped === true && result.physical_stopped === true
+    && result.native_settled === true && result.settled === true && result.native_settlement?.confirmed !== false
+    && result.resource_retirement?.confirmed !== false);
+}
+
+/** Scope metadata does not manufacture readiness or physical cleanup. */
+export function nativeExecutionReceipt(receipt, { daemonId, generation = 0, revision = 0, resources } = {}) {
+  if (receipt.native_settlement?.contract !== undefined && receipt.native_settlement.contract !== NATIVE_TREE_SETTLEMENT_CONTRACT
+    || receipt.native_settlement?.scope !== undefined && receipt.native_settlement.scope !== "required_execution")
+    throw Object.assign(new Error("historical native proof requires fresh execution observation"), { code: "native_contract_mismatch" });
+  if ((resources?.entries ?? []).some(item => item.owner_daemon_id !== undefined && item.owner_daemon_id !== daemonId
+    || item.generation !== undefined && item.generation !== generation)) throw Object.assign(new Error("native resource belongs to another owner"), { code: "native_resource_owner_mismatch" });
+  const owner = { owner_daemon_id: daemonId ?? null, generation, revision };
+  return { ...receipt,
+    native_settlement: { ...receipt.native_settlement, contract: NATIVE_TREE_SETTLEMENT_CONTRACT, scope: "required_execution", ...owner },
+    native_resources: { observed_at: new Date().toISOString(), coverage: "unsupported", ...resources,
+      schema_id: "native-resources@1", ...owner,
+      entries: (resources?.entries ?? []).map(item => ({ ...item, owner_daemon_id: owner.owner_daemon_id, generation: owner.generation })) }
+  };
+}
+
 /** Project a positively settled native tree, never infer it from missing activity. */
 export function settledNativeTree(root, children, settled, rootSettled = false) {
   if (settled !== true && rootSettled !== true || typeof root !== "string" || !root || !Array.isArray(children)) return {};
@@ -12,9 +107,9 @@ export function settledNativeTree(root, children, settled, rootSettled = false)
   const observations = [{ provider_session_id: root, status: "idle", settled: true }, ...children.map((child, index) => {
     const status = String(child.status ?? child.state ?? "unknown").toLowerCase();
     const terminal = settled === true || ["completed", "success", "succeeded", "failed", "cancelled", "canceled", "settled_by_root"].includes(status);
-    return { provider_session_id: ids[index], status: terminal ? "idle" : ["running", "active", "inprogress", "pending"].includes(status) ? "running" : "unknown", settled: terminal };
+    return { provider_session_id: ids[index], status: terminal ? "idle" : liveStatus(status) ? "running" : "unknown", settled: terminal };
   })];
-  return { tree_session_ids: [root, ...ids], unsettled_sessions: observations.filter(item => !item.settled).map(item => item.provider_session_id), tree_observations: observations };
+  return { native_settlement: { contract: NATIVE_TREE_SETTLEMENT_CONTRACT, scope: "required_execution" }, tree_session_ids: [root, ...ids], unsettled_sessions: observations.filter(item => !item.settled).map(item => item.provider_session_id), tree_observations: observations };
 }
 
 /** Retain typed failure facts, never provider headers, request bodies or free-form messages. */
@@ -51,6 +146,8 @@ export function normalizeNativeChildren(receipt, rootSessionId) {
       .map(value => text(object(value), ["provider_session_id", "session_id"]))
       .filter(id => id !== null)
   );
+  const unsettledTree = new Set(list(receipt.tree_observations).filter(value => object(value).settled === false)
+    .map(value => text(object(value), ["provider_session_id", "session_id"])).filter(Boolean));
   const add = (raw, source, scopedParent = null, fallback = "unknown") => {
     const value = object(raw);
     const id = text(value, ["provider_session_id", "session_id", "sessionId", "childSessionId", "conversation_id", "conversationId", "id", "subagentId"]);
@@ -66,9 +163,12 @@ export function normalizeNativeChildren(receipt, rootSessionId) {
     // Provider idle means no current activity, not a Work result. Only an
     // explicit terminal result or a separately proven root settlement may be
     // terminal here; unknown states stay unknown for reconciliation.
-    const status = ["completed", "complete", "done", "success", "succeeded"].includes(state) ? "completed" : state === "settled_by_root" ? "settled_by_root" : ["failed", "error"].includes(state) ? "failed" : ["cancelled", "canceled", "interrupted"].includes(state) ? "cancelled" : ["running", "active", "pending"].includes(state) ? "running" : fallback;
+    const status = ["completed", "complete", "done", "success", "succeeded"].includes(state) ? "completed" : state === "settled_by_root" ? "settled_by_root" : ["failed", "error"].includes(state) ? "failed" : ["cancelled", "canceled", "interrupted"].includes(state) ? "cancelled" : liveStatus(state) ? "running" : fallback;
     const rootChild = parent === rootSessionId;
     const settled = rootChild && status === "unknown" && settledTree.has(id) ? "settled_by_root" : status;
+    if ((unsettledTree.has(id) || value.native_turn_items?.pending === true) && ["completed", "failed", "cancelled", "settled_by_root"].includes(settled)
+      || settledTree.has(id) && (unsettledTree.has(id) || status === "running" || value.native_turn_items?.pending === true))
+      throw nativeFailure("native_child_observation_conflict", "Current child outcome contradicts tree observation", 1, { session_id: id, source });
     candidates.push({ session_id: id, parent_session_id: parent ?? "", status: settled, source, ...(rootChild ? {} : { provenance: "parent_mismatch" }),
       ...(text(value, ["terminal_turn_id"]) ? { terminal_turn_id: text(value, ["terminal_turn_id"]) } : {}),
       ...(text(value, ["terminal_observed_at"]) ? { terminal_observed_at: text(value, ["terminal_observed_at"]) } : {}),
@@ -87,9 +187,12 @@ export function normalizeNativeChildren(receipt, rootSessionId) {
     add(value, "zcode/session/subagents", rootSessionId);
   }
   const unique = new Map();
-  const rank = { unknown: 0, running: 1, settled_by_root: 2, completed: 3, failed: 3, cancelled: 3 };
+  const terminal = value => ["completed", "failed", "cancelled", "settled_by_root"].includes(value);
   for (const child of candidates) {
     const previous = unique.get(child.session_id);
+    if (previous && (terminal(previous.status) && child.native_turn_items?.pending === true
+      || terminal(child.status) && previous.native_turn_items?.pending === true))
+      throw nativeFailure("native_child_observation_conflict", "Current child outcome contradicts pending native items", 1, { session_id: child.session_id, observations: [previous, child] });
     if (previous && previous.parent_session_id !== child.parent_session_id) {
       // Keep the contradictory parent visible to the existing provenance gate,
       // independently of input order or which source happened to say success.
@@ -97,17 +200,20 @@ export function normalizeNativeChildren(receipt, rootSessionId) {
       unique.set(child.session_id, { ...foreign, provenance: "parent_mismatch" });
       continue;
     }
-    if (previous && rank[previous.status] === 3 && rank[child.status] === 3 && previous.status !== child.status) throw nativeFailure("native_child_outcome_conflict", "Native child has contradictory terminal outcomes", 1, { session_id: child.session_id, observations: [previous, child] });
+    if (previous && terminal(previous.status) && terminal(child.status) && previous.status !== child.status && ![previous.status, child.status].includes("settled_by_root")) throw nativeFailure("native_child_outcome_conflict", "Native child has contradictory terminal outcomes", 1, { session_id: child.session_id, observations: [previous, child] });
+    if (previous && (previous.status === "running" && terminal(child.status) || child.status === "running" && terminal(previous.status)))
+      throw nativeFailure("native_child_observation_conflict", "Current child has both active and terminal facts", 1, { session_id: child.session_id, observations: [previous, child] });
     if (previous && previous.status === child.status && previous.terminal_turn_id && child.terminal_turn_id && previous.terminal_turn_id !== child.terminal_turn_id)
       throw nativeFailure("native_child_turn_conflict", "Native child has contradictory terminal Turn identities", 1, { session_id: child.session_id, observations: [previous, child] });
     if (previous && previous.status === child.status) {
       unique.set(child.session_id, { ...previous, ...child,
         ...(child.terminal_turn_id ?? previous.terminal_turn_id ? { terminal_turn_id: child.terminal_turn_id ?? previous.terminal_turn_id } : {}),
         ...(child.provider_error ?? previous.provider_error ? { provider_error: child.provider_error ?? previous.provider_error } : {}),
-        ...(child.native_turn_items ?? previous.native_turn_items ? { native_turn_items: child.native_turn_items ?? previous.native_turn_items } : {}) });
+        ...(child.native_turn_items ?? previous.native_turn_items ? { native_turn_items: { ...previous.native_turn_items, ...child.native_turn_items,
+          ...([previous.native_turn_items, child.native_turn_items].some(items => items?.pending === true) ? { pending: true } : {}) } } : {}) });
       continue;
     }
-    if (!previous || rank[child.status] > rank[previous.status]) unique.set(child.session_id, child);
+    if (!previous || previous.status === "unknown" || previous.status === "settled_by_root" && terminal(child.status)) unique.set(child.session_id, child);
   }
   return [...unique.values()].sort((left, right) => left.session_id.localeCompare(right.session_id));
 }

package/dist/harness-runtime/lib/native-request-proof.mjs

@@ -13,7 +13,7 @@ const fail = reason => { throw Object.assign(new Error('Native request proof doe
  * the adapter, and recomputed by the adapter's shared request builder. */
 export function nativeCommandFingerprint({ executable, args, cwd, env, operationId }) {
   return hashJson({ executable, args, cwd, operation_id: operationId,
-    environment: Object.fromEntries(environmentKeys.map(key => [key, env[key] ?? null])) });
+    environment: Object.fromEntries([...environmentKeys, ...(env.PLAYWRIGHT_BROWSERS_PATH === undefined ? [] : ['PLAYWRIGHT_BROWSERS_PATH'])].map(key => [key, env[key] ?? null])) });
 }
 
 /** Called after the adapter's own argument preparation but before its RPC or

package/dist/harness-runtime/lib/observation-clock.d.mts

@@ -3,12 +3,12 @@ export function validateObservationDuration(value: number, label?: string): numb
 export interface ObservationState {
   policy: string; timeout_ms: number; started_at: number; cursor?: unknown;
   observed_at: number | null; elapsed_ms: number; uncertainty_elapsed_ms: number;
-  gaps: number; observation_lost: boolean;
+  gaps: number; uncertain?: boolean; observation_lost: boolean;
 }
 export class ObservationClock {
   constructor(options: { timeoutMs: number; gapMs?: number; uncertaintyMs?: number;
     wall?: () => number; monotonic?: () => number; onGap?: (value: Record<string, unknown>) => void;
-    saved?: ObservationState | null });
+    saved?: ObservationState | null; snapshotIsLive?: boolean });
   observationLost: boolean;
   sample(progress?: unknown, progressAt?: number): boolean;
   state(): ObservationState;

package/dist/harness-runtime/lib/observation-clock.mjs

@@ -9,7 +9,7 @@ export function validateObservationDuration(value, label = "observation duration
  * progress or proof of provider failure. Durable snapshots retain that episode. */
 export class ObservationClock {
   constructor({ timeoutMs, gapMs = 60_000, uncertaintyMs = 120_000, wall = Date.now,
-    monotonic = () => performance.now(), onGap = () => {}, saved = null }) {
+    monotonic = () => performance.now(), onGap = () => {}, saved = null, snapshotIsLive = false }) {
     validateObservationDuration(timeoutMs); validateObservationDuration(gapMs, "gap duration");
     validateObservationDuration(uncertaintyMs, "observation recovery duration");
     Object.assign(this, { timeoutMs, gapMs, uncertaintyMs, wall, monotonic, onGap });
@@ -21,13 +21,16 @@ export class ObservationClock {
         || !Number.isFinite(saved.started_at) || !Number.isSafeInteger(saved.gaps) || saved.gaps < 0
         || saved.observed_at !== null && !Number.isFinite(saved.observed_at)
         || typeof saved.observation_lost !== "boolean"
+        || saved.uncertain !== undefined && typeof saved.uncertain !== "boolean"
         || !Number.isFinite(saved.elapsed_ms) || saved.elapsed_ms < 0
         || !Number.isFinite(saved.uncertainty_elapsed_ms) || saved.uncertainty_elapsed_ms < 0)
         throw new RangeError("invalid retained observation clock");
       this.startedWall = saved.started_at; this.elapsed = saved.elapsed_ms;
       this.progress = saved.cursor; this.progressAt = saved.observed_at;
-      // A reconstructed observer cannot prove silence during its absence.
-      this.uncertain = true; this.gaps = saved.gaps + 1;
+      // Durable reconstruction has an observation gap. Transferring a freshly
+      // observed producer clock is not a second restart of that same producer.
+      this.uncertain = snapshotIsLive ? saved.uncertain ?? true : true;
+      this.gaps = saved.gaps + (snapshotIsLive ? 0 : 1);
       this.uncertaintyElapsed = saved.uncertainty_elapsed_ms;
       this.observationLost = saved.observation_lost || this.gaps > 1 || this.uncertaintyElapsed >= uncertaintyMs;
     }
@@ -77,7 +80,7 @@ export class ObservationClock {
     return { policy: OBSERVATION_CLOCK_CONTRACT_VERSION, timeout_ms: this.timeoutMs,
       started_at: this.startedWall, cursor: this.progress, observed_at: this.progressAt,
       elapsed_ms: this.elapsed, uncertainty_elapsed_ms: this.uncertaintyElapsed,
-      gaps: this.gaps, observation_lost: this.observationLost };
+      gaps: this.gaps, uncertain: this.uncertain, observation_lost: this.observationLost };
   }
 }
 

package/dist/harness-runtime/lib/provider-overload-policy.d.mts

@@ -1,5 +1,5 @@
 export const CAPACITY_POLICY: "provider-overload-episode@1";
-export const MAX_OVERLOAD_RETRIES: 2;
+export const MAX_OVERLOAD_RETRIES: 3;
 export const MAX_RETRY_AFTER_MS: 30000;
 export function classifyProviderError(native: unknown): string;
 export function safeProviderError(native: unknown): Record<string, unknown>;

package/dist/harness-runtime/lib/provider-overload-policy.mjs

@@ -1,6 +1,6 @@
 /** Pure policy shared by the controller and pinned-engine EVAL consumers. */
 export const CAPACITY_POLICY = "provider-overload-episode@1";
-export const MAX_OVERLOAD_RETRIES = 2;
+export const MAX_OVERLOAD_RETRIES = 3;
 export const MAX_RETRY_AFTER_MS = 30_000;
 
 function policyError(code, message, details = {}) { return Object.assign(new Error(message), { code, details }); }

package/dist/harness-runtime/lib/tool-observations.mjs

@@ -156,7 +156,7 @@ export function agyToolObservation(step, rootSessionId) {
   const sessionId = step.conversation_id ?? rootSessionId;
   return { session: identity("antigravity-cli", sessionId), parent_session: sessionId !== rootSessionId ? identity("antigravity-cli", rootSessionId) : null,
     call_id: step.step_id ?? step.stepId ?? step.id ?? step.tool_call_id ?? step.toolCallId ?? (Number.isInteger(step.step_index) ? String(step.step_index) : null),
-    name: step.tool_name ?? step.tool_info?.name, ...(step.tool_info?.error ? { status: "failed" } : nativeStatus(step.state)) };
+    name: step.tool_name ?? step.tool_info?.name, ...(step.tool_info?.error ? { status: "failed" } : nativeStatus(step.state === "ACTIVE" ? "running" : step.state)) };
 }
 
 /** Native AGY JSONL records have planner tool invocations, not matching live