@deksden-com/dd-flow-cli 0.9.0-beta.150 → 0.9.0-beta.152

package/dist/services/controller-child-capacity.js

@@ -1,3 +1,58 @@
+import { nativeContinuationSuccessor, nativeContinuationAdmitted } from "../harness-runtime/lib/native-children.mjs";
+/** The failure fence forbids fanout, not the exact retained child's recovery. */
+export function childCapacityDispatchAllowed(state, failures, parentId, operationId, promptSha256) {
+    return Object.entries(state.child_capacity ?? {}).some(([sessionId, intent]) => intent.operation_id === operationId
+        && intent.dispatched === true && intent.phase === "dispatched" && intent.prompt_sha256 === promptSha256
+        && failures.some(child => child.session_id === sessionId && child.parent_session_id === parentId
+            && child.status === "failed" && child.provenance !== "parent_mismatch" && child.terminal_turn_id === intent.turn_id));
+}
+/** An overloaded parent may have sent the message, but activity is not admission. */
+export function childCapacityRecoveryDecision(state, children, parentId, operationId, parentTurnId) {
+    const target = Object.entries(state.child_capacity ?? {}).find(([, intent]) => intent.operation_id === operationId);
+    if (!target)
+        return "reconciliation_blocked";
+    const child = children.find(item => item.session_id === target[0]);
+    if (child && (child.parent_session_id !== parentId || child.provenance === "parent_mismatch"))
+        return "reconciliation_blocked";
+    if (!child)
+        return "continue";
+    if (parentTurnId && child.continuation_admission?.parent_turn_id === parentTurnId && target[1].phase === "dispatched")
+        target[1].parent_turn_id = parentTurnId;
+    reconcileChildCapacity(state, [child], parentId);
+    if (["native_message_accepted", "successor_observed"].includes(target[1].phase ?? ""))
+        return "completed";
+    return child.status === "running" || child.terminal_turn_id && child.terminal_turn_id !== target[1].turn_id ? "reconciliation_blocked" : "continue";
+}
+/** Bind native admission to a durable managed parent Turn, never to child prose. */
+export function reconcileChildCapacity(state, children, parentId, observedAt = new Date().toISOString()) {
+    let changed = false;
+    for (const child of children) {
+        const intent = state.child_capacity?.[child.session_id], admission = child.continuation_admission;
+        if (!intent?.dispatched || !intent.operation_id || !intent.parent_turn_id || !intent.continuation_ref || !admission
+            || child.parent_session_id !== parentId || child.provenance === "parent_mismatch" || admission.parent_session_id !== parentId
+            || admission.parent_turn_id !== intent.parent_turn_id || admission.agent_id !== intent.continuation_ref.agent_id)
+            continue;
+        const bound = { ...admission, operation_id: intent.operation_id, predecessor_turn_id: intent.turn_id };
+        child.continuation_admission = bound;
+        const successor = nativeContinuationSuccessor(child, intent.turn_id, intent.continuation_ref.ended_at);
+        if (admission.proof_kind === "parent_tool_successor" && !successor)
+            continue;
+        if (admission.proof_kind === "parent_tool_admission" && !nativeContinuationAdmitted(child, intent.turn_id, intent.continuation_ref.ended_at))
+            continue;
+        const phase = successor ? "successor_observed" : "native_message_accepted";
+        if (intent.phase === "successor_observed" && !successor)
+            continue;
+        if (intent.phase !== phase || JSON.stringify(intent.admission) !== JSON.stringify(bound)) {
+            // A refreshed proof digest/status poll is not a new model signal.
+            if (intent.phase !== phase || !intent.last_signal_at)
+                intent.last_signal_at = observedAt;
+            intent.phase = phase;
+            intent.admission = bound;
+            changed = true;
+        }
+    }
+    return changed;
+}
 /** Only a proven new successful terminal Turn closes a child's retry episode. */
 export function closeSuccessfulChildCapacity(state, children, parentId) {
     const closed = [];
@@ -6,6 +61,9 @@ export function closeSuccessfulChildCapacity(state, children, parentId) {
         if (!retained || child.parent_session_id !== parentId || child.provenance === "parent_mismatch"
             || child.status !== "completed" || !child.terminal_turn_id || child.terminal_turn_id === retained.turn_id)
             continue;
+        if (retained.continuation_ref && retained.phase !== "successor_observed")
+            continue;
+        retained.phase = "settled";
         delete state.child_capacity[child.session_id];
         closed.push(child.session_id);
     }

package/dist/services/controller-child-observer.js

@@ -1,5 +1,5 @@
 import fs from "node:fs";
-import { normalizeNativeChildren, safeNativeFailure } from "../harness-runtime/lib/native-children.mjs";
+import { normalizeNativeChildren, safeNativeFailure, nativeContinuationSuccessor } from "../harness-runtime/lib/native-children.mjs";
 /** A durable observation is a dispatch fence, not authority to complete Work. */
 export function retainedChildObserver(input) {
     let active = true, pending;
@@ -13,6 +13,11 @@ export function retainedChildObserver(input) {
         return { session_id: child.session_id, parent_session_id: child.parent_session_id, status: "failed", source: child.source, terminal_turn_id: child.terminal_turn_id,
             ...(typeof child.terminal_observed_at === "string" && Number.isFinite(Date.parse(child.terminal_observed_at)) ? { terminal_observed_at: child.terminal_observed_at } : {}),
             ...(child.native_source ? { native_source: child.native_source } : {}),
+            ...(child.continuation_ref ? { continuation_ref: child.continuation_ref } : {}),
+            ...(child.recovery_unavailable_reason ? { recovery_unavailable_reason: child.recovery_unavailable_reason } : {}),
+            ...(child.continuation_admission ? { continuation_admission: child.continuation_admission } : {}),
+            ...(child.resumed_from_message_id ? { resumed_from_message_id: child.resumed_from_message_id } : {}),
+            ...(child.current_turn_id ? { current_turn_id: child.current_turn_id } : {}),
             ...(child.native_turn_items ? { native_turn_items: {
                     ...(typeof child.native_turn_items.observed === "boolean" ? { observed: child.native_turn_items.observed } : {}),
                     ...(typeof child.native_turn_items.possible_effects === "boolean" ? { possible_effects: child.native_turn_items.possible_effects } : {}),
@@ -46,8 +51,9 @@ export function retainedChildObserver(input) {
         // This is an authoritative current native snapshot. Older failed Turns
         // remain in the journal/episode history, not in the current-outcome fence.
         const resolved = [...retained].filter(([, old]) => children.some(child => child.parent_session_id === input.scope.root_session_id
-            && child.provenance !== "parent_mismatch" && child.session_id === old.session_id && ["completed", "failed"].includes(child.status)
-            && child.terminal_turn_id && child.terminal_turn_id !== old.terminal_turn_id)).map(([key]) => key);
+            && child.provenance !== "parent_mismatch" && child.session_id === old.session_id
+            && (!old.continuation_ref && ["completed", "failed"].includes(child.status) && child.terminal_turn_id && child.terminal_turn_id !== old.terminal_turn_id
+                || nativeContinuationSuccessor(child, old.terminal_turn_id, old.continuation_ref?.ended_at)))).map(([key]) => key);
         if (!failed.length && !resolved.length && !gap)
             return;
         const fd = fs.openSync(input.file, "a", 0o600);

package/dist/services/memory-init-native-capacity.js

@@ -14,7 +14,7 @@ import { inspectDaemonOperation } from "../harness-runtime/lib/daemon-operations
 import { nativeCommandFingerprint } from "../harness-runtime/lib/native-request-proof.mjs";
 import { validateMemoryInitStartupScope } from "./memory-init-startup-custody.js";
 import { continueProviderCapacity } from "./provider-capacity.js";
-import { CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, refusalObservation, terminalProviderOverload } from "../harness-runtime/lib/provider-overload-policy.mjs";
+import { RECOVERY_POLICY as CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, recoveryRefusal as refusalObservation, terminalProviderRecovery as terminalProviderOverload } from "../harness-runtime/lib/provider-overload-policy.mjs";
 const sha = (bytes) => createHash("sha256").update(bytes).digest("hex");
 function refuse(reason, effect = "no_effect") {
     throw new AppError("memory_init_native_capacity_required", "Native startup requires its exact qualified probe", 1, { reason, effect, next_action: "reconcile_exact_native_probe" });

package/dist/services/provider-capacity.js

@@ -1,6 +1,6 @@
 import { setTimeout as delay } from "node:timers/promises";
 import crypto from "node:crypto";
-import { CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, capacityBackoff, nativeItemsSettled, normalizeProviderFailure, overloadExhausted, parseCapacityOperation, refusalObservation, terminalProviderOverload, streamRequestKey } from "../harness-runtime/lib/provider-overload-policy.mjs";
+import { RECOVERY_POLICY as CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, classifyRecoveryError, recoveryBackoff as capacityBackoff, nativeItemsSettled, normalizeRecoveryFailure as normalizeProviderFailure, recoveryExhausted as overloadExhausted, parseCapacityOperation, recoveryRefusal as refusalObservation, terminalProviderRecovery as terminalProviderOverload, streamRequestKey } from "../harness-runtime/lib/provider-overload-policy.mjs";
 import { AppError } from "../shared/errors.js";
 import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
 import { parseLifecycleCommand, commandOption } from "./lifecycle-command.js";
@@ -48,12 +48,20 @@ export function ownedProviderBoundary(context, input, boundary) {
     return boundary.outcome === "completed" && (input.scope === "work" ? rows[0].status === "completed" : stage.status === "done");
 }
 export function providerChildFailure(child) {
-    return child.provider_failure ?? { code: child.native_source ? "provider_capacity_transient" : "turn_interrupted", details: { native_source: child.native_source, provider_session_id: child.session_id, turn_id: child.terminal_turn_id, native_turn_id: child.terminal_turn_id, terminal_status: child.status, observed_at: child.terminal_observed_at ?? null, provider_error: child.provider_error, native_turn_items: child.native_turn_items } };
+    return child.provider_failure ?? { code: child.native_source ? classifyRecoveryError(child.provider_error) : "turn_interrupted", details: { native_source: child.native_source, provider_session_id: child.session_id, turn_id: child.terminal_turn_id, native_turn_id: child.terminal_turn_id, terminal_status: child.status, observed_at: child.terminal_observed_at ?? null, provider_error: child.provider_error, native_turn_items: child.native_turn_items } };
 }
 export function eligibleProviderChildOverload(child, parentSessionId) {
     return typeof child.session_id === "string" && child.session_id !== parentSessionId && child.parent_session_id === parentSessionId && child.provenance !== "parent_mismatch" && child.status === "failed" && typeof child.terminal_turn_id === "string" && nativeItemsSettled(child.native_turn_items)
         && terminalProviderOverload(providerChildFailure(child), child.session_id, child.terminal_turn_id);
 }
+export function unavailableProviderChildRecovery(child, parentSessionId) {
+    if (typeof child.session_id !== "string" || child.parent_session_id !== parentSessionId || child.provenance === "parent_mismatch" || child.status !== "failed"
+        || typeof child.terminal_turn_id !== "string" || typeof child.recovery_unavailable_reason !== "string" || !/^[a-z][a-z0-9_]{0,127}$/.test(child.recovery_unavailable_reason))
+        return null;
+    const primary = providerChildFailure(child);
+    return terminalProviderOverload(primary, child.session_id, child.terminal_turn_id)
+        ? new AppError("provider_recovery_unavailable", "Native provider refusal is retained, but same-child continuation is not safely supported", 1, { reason: child.recovery_unavailable_reason, child_session_id: child.session_id, terminal_turn_id: child.terminal_turn_id, primary_error: primary }) : null;
+}
 /** A terminal root is not a settled tree. Only the daemon's exact owned tree
  * with a settled root and positively live descendants permits waiting. */
 export function capacityReadiness(seen, sessionId, operationId, turnId, items, allowDescendants = false, requestProof) {
@@ -227,7 +235,7 @@ export async function continueProviderCapacity(input) {
         while (["prepared", "dispatching", "running", "awaiting_provider", "outcome_unknown"].includes(String(observed.state))) {
             input.signal?.throwIfAborted();
             input.assertCurrent();
-            const boundary = await observe(async () => await input.decision?.() ?? "continue", intent.operation_id);
+            const boundary = await observe(async () => await input.decision?.(undefined, error) ?? "continue", intent.operation_id);
             if (boundary === "completed" || boundary === "paused")
                 return { provider_session_id: input.sessionId, capacity_decision: boundary };
             if (boundary === "reconciliation_blocked")
@@ -246,7 +254,7 @@ export async function continueProviderCapacity(input) {
         if (observed.state === "completed" && observed.result && typeof observed.result === "object") {
             input.signal?.throwIfAborted();
             input.assertCurrent();
-            const boundary = await observe(async () => await input.decision?.() ?? "continue", intent.operation_id);
+            const boundary = await observe(async () => await input.decision?.(undefined, error) ?? "continue", intent.operation_id);
             input.signal?.throwIfAborted();
             input.assertCurrent();
             if (boundary === "reconciliation_blocked")
@@ -266,7 +274,7 @@ export async function continueProviderCapacity(input) {
         input.assertCurrent();
         const normalized = normalizeProviderFailure(error, input.sessionId);
         const candidate = normalized?.request_proof.kind === "stream_request" ? normalized.primary_error.details?.recovered_error_boundary : undefined;
-        const decision = await observe(async () => await input.decision?.(candidate?.receipt) ?? "continue", observedOperationId);
+        const decision = await observe(async () => await input.decision?.(candidate?.receipt, error) ?? "continue", observedOperationId);
         input.signal?.throwIfAborted();
         input.assertCurrent();
         if (normalized?.request_proof.kind === "stream_request" && ["completed", "paused"].includes(decision) && !candidate?.receipt)
@@ -445,11 +453,11 @@ export async function continueProviderCapacity(input) {
             // A task can complete/pause while the daemon queues for its permit.
             // Admission then refuses the stale prompt; accept that owner decision
             // before treating the transport's rejection as another provider failure.
+            error = nextError;
+            operationId = nextId;
             const finished = await decide(nextId);
             if (finished)
                 return finished;
-            error = nextError;
-            operationId = nextId;
         }
     }
 }

package/dist/services/repair-intents.js

@@ -7,7 +7,10 @@ import { assertSourceRepairEligible } from "./code-checks.js";
 export function ensureAggregateRepair(context, input, create) {
     if (!input.failures.length)
         throw new AppError("repair_intent_invalid", "Repair requires candidate-source-backed failed receipts", 1);
-    assertSourceRepairEligible(input.failures);
+    const workspace = context.db.get("SELECT workspace_root FROM runs WHERE project_id=? AND id=?", [input.projectId, input.runId]);
+    if (!workspace?.workspace_root && input.failures.some(receipt => receipt.candidate_library_inputs?.length))
+        throw new AppError("repair_intent_invalid", "Library-backed repair requires the current RUN workspace", 1);
+    assertSourceRepairEligible(input.failures, workspace?.workspace_root);
     const causes = input.failures.map(receipt => ({ id: receipt.id, epoch: receipt.verification_epoch, fingerprint: receipt.fingerprint_scope === "check_inputs" ? receipt.before_fingerprint : receipt.workspace_fingerprint })).sort((a, b) => a.id.localeCompare(b.id));
     return ensureRepairIntent(context, { ...input, causes: { receipts: causes, origins: [...(input.origins ?? [])].sort() } }, create);
 }

package/dist/services/run-controller-adapter.js

@@ -6,7 +6,7 @@ import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
 import { runtimeHarness } from "./execution-policy.js";
 import { appendEvent, digest, digestBytes, errorRecord, requireRun } from "./run-controller-state.js";
 import { managedProcessStatus } from "./managed-processes.js";
-import { CAPACITY_POLICY, parseCapacityOperation } from "../harness-runtime/lib/provider-overload-policy.mjs";
+import { RECOVERY_POLICY as CAPACITY_POLICY, parseCapacityOperation } from "../harness-runtime/lib/provider-overload-policy.mjs";
 import { recoveryObservationBudget } from "./recovery-observation-budget.js";
 import { canonicalNativeOperation } from "../harness-runtime/lib/adapter-timeouts.mjs";
 import { retainedDaemonReply } from "../harness-runtime/lib/daemon-observation.mjs";

package/dist/services/run-controller.js

@@ -45,14 +45,14 @@ import { assertNoCorrelatedRejection } from "./continuation-outcome.js";
 import { spawnController, recordControllerLauncher, claimControllerProcess, markControllerDispatchReady, assertControllerLeaseAllowed } from "./run-controller-process.js";
 import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
 import { retainedChildObserver } from "./controller-child-observer.js";
-import { capacityDelay, continueProviderCapacity, eligibleProviderChildOverload, providerChildFailure, ownedProviderBoundary } from "./provider-capacity.js";
+import { capacityDelay, continueProviderCapacity, eligibleProviderChildOverload, providerChildFailure, ownedProviderBoundary, unavailableProviderChildRecovery } from "./provider-capacity.js";
 import { resumeControllerSession, failControllerRecovery } from "./run-controller-recovery.js";
 import { captureControllerBoundary } from "./run-controller-capture.js";
 import { requestRunControl } from "./run-control-worker.js";
 import { storageSessionId } from "./session-identity.js";
-import { CAPACITY_POLICY, nativeItemsSettled, overloadExhausted, refusalObservation, terminalProviderOverload } from "../harness-runtime/lib/provider-overload-policy.mjs";
+import { RECOVERY_POLICY as CAPACITY_POLICY, nativeItemsSettled, recoveryExhausted as overloadExhausted, recoveryRefusal as refusalObservation, terminalProviderRecovery as terminalProviderOverload, normalizeRecoveryFailure } from "../harness-runtime/lib/provider-overload-policy.mjs";
 import { renderNativeChildFollowupInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
-import { closeSuccessfulChildCapacity } from "./controller-child-capacity.js";
+import { childCapacityDispatchAllowed, childCapacityRecoveryDecision, closeSuccessfulChildCapacity, reconcileChildCapacity } from "./controller-child-capacity.js";
 import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
 export { resumeRunController } from "./run-controller-recovery.js";
 const preparedLaunchInputs = new WeakMap();
@@ -754,7 +754,8 @@ async function executeController(context, row, manifest, state, assertOwnership,
                         throw new AppError("capacity_continuation_conflict", "Retained capacity root has no failure receipt", 1);
                     throw JSON.parse(root.error_json);
                 }
-                if (childObserver(session)?.failed().length)
+                const failedChildren = childObserver(session)?.failed() ?? [];
+                if (failedChildren.length && !(kind === "child" && childCapacityDispatchAllowed(state, failedChildren, session.id, firstOperationId, digestBytes(text))))
                     throw new AppError("fanout_dispatch_fenced", "A retained child failure forbids another coordinator dispatch", 1);
                 promptPending = true;
                 observedPromptOperation = firstOperationId;
@@ -785,15 +786,15 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     assertCurrent: () => {
                         assertOwner();
                     },
-                    decision: async (boundary) => {
+                    decision: async (boundary, currentFailure) => {
                         if (kind === "child") {
-                            const target = Object.entries(state.child_capacity ?? {}).find(([, retained]) => retained.operation_id === firstOperationId);
-                            if (!target)
-                                return "reconciliation_blocked";
                             const seen = await inspect(["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], `${firstOperationId}:child-followup-observe`);
-                            const child = controllerNativeChildren(seen, session.id).find(item => item.session_id === target[0]);
-                            if (child?.parent_session_id === session.id && (child.status === "running" || child.terminal_turn_id && child.terminal_turn_id !== target[1].turn_id))
-                                return "completed";
+                            const parent = normalizeRecoveryFailure(currentFailure, session.id);
+                            const decision = childCapacityRecoveryDecision(state, controllerNativeChildren(seen, session.id), session.id, firstOperationId, parent?.request_proof.kind === "native_turn" ? parent.turn_id : undefined);
+                            if (decision !== "continue") {
+                                saveState(context, row, state);
+                                return decision;
+                            }
                         }
                         const view = getFlowRunStatus(executionContext, { projectRoot: manifest.request.project_root, runId: row.run_id });
                         const next = view.continuation;
@@ -1081,7 +1082,32 @@ async function executeController(context, row, manifest, state, assertOwnership,
             const session = state.sessions[state.current_session];
             const childHarness = runtimeHarness(session.profile);
             const baseline = new Set(state.native_baseline ?? []);
+            for (const intent of Object.values(state.child_capacity ?? {})) {
+                if (!intent.dispatched || !intent.operation_id || intent.parent_turn_id || !intent.prompt_sha256)
+                    continue;
+                let saved = context.db.get("SELECT input_json,receipt_json,status FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [intent.operation_id, row.controller_id, row.generation]);
+                if (!saved)
+                    continue;
+                const dispatch = JSON.parse(saved.input_json);
+                if (!saved.receipt_json && saved.status === "outcome_unknown" && dispatch.dispatch_phase !== "prepared" && dispatch.prompt_sha256 === intent.prompt_sha256 && Array.isArray(dispatch.args)) {
+                    // Existing adapter recovery reads its durable operation; it cannot
+                    // redispatch a productive operation past external_dispatch_possible.
+                    await controllerAdapter(executionContext, row, manifest, session, dispatch.args, assertOwner, intent.operation_id, cancellation.signal, renewLease);
+                    saved = context.db.get("SELECT input_json,receipt_json,status FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ?", [intent.operation_id, row.controller_id, row.generation]);
+                }
+                if (!saved?.receipt_json)
+                    continue;
+                const receipt = JSON.parse(saved.receipt_json);
+                if ((saved.status === "completed" || dispatch.dispatch_phase === "receipt_observed") && dispatch.prompt_sha256 === intent.prompt_sha256
+                    && receipt.provider_session_id === session.id && receipt.turn?._meta?.zcode?.ddFlowRecovery?.operation_id === intent.operation_id
+                    && typeof receipt.turn._meta.zcodeNativeTurnId === "string" && receipt.turn._meta.zcodeNativeTurnId) {
+                    intent.parent_turn_id = receipt.turn._meta.zcodeNativeTurnId;
+                    saveState(context, row, state);
+                }
+            }
             let children = controllerNativeChildren(state.last_receipt ?? {}, session.id).filter(child => !baseline.has(child.session_id));
+            if (reconcileChildCapacity(state, children, session.id))
+                saveState(context, row, state);
             childObserver(session)?.observeSettledChildren(children);
             const retainedFailures = childObserver(session)?.failed() ?? [];
             children = controllerNativeChildren({ descendants: [...children, ...retainedFailures] }, session.id);
@@ -1091,7 +1117,35 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     saveState(context, row, state);
                     appendEvent(context, row.controller_id, "capacity_child_episodes_completed", { child_session_ids: closedChildEpisodes });
                 });
-            if (children.some(child => child.status === "failed" && renderNativeChildFollowupInstruction(childHarness, child.session_id))) {
+            const queuedChild = children.find(child => state.child_capacity?.[child.session_id]?.phase === "native_message_accepted"
+                && (child.status === "failed" && state.child_capacity[child.session_id].turn_id === child.terminal_turn_id
+                    || child.status === "running" && child.continuation_admission?.proof_kind === "parent_tool_admission"));
+            if (queuedChild) {
+                const observedAt = Date.parse(state.child_capacity[queuedChild.session_id].last_signal_at ?? "");
+                if (!Number.isFinite(observedAt) || Date.now() - observedAt >= 600_000)
+                    throw new AppError("operation_observation_lost", "Accepted native child continuation has no new observed signal", 1, { child_session_id: queuedChild.session_id });
+                setStatus("waiting_for_children");
+                await delay(1000, undefined, { signal: cancellation.signal });
+                state.last_receipt = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                saveState(context, row, state);
+                continue;
+            }
+            const recoveryUnavailable = children.map(child => {
+                const links = context.db.all("SELECT w.status FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id WHERE w.project_id = ? AND w.run_id = ? AND ws.session_id = ?", [row.project_id, row.run_id, storageSessionId({ harness_id: childHarness, session_id: child.session_id })]);
+                return links.length > 1 || links.some(link => link.status !== "running") ? null : unavailableProviderChildRecovery(child, session.id);
+            }).find(Boolean);
+            if (recoveryUnavailable) {
+                if (children.every(child => ["completed", "failed", "cancelled", "settled_by_root"].includes(child.status)))
+                    throw recoveryUnavailable;
+                // A blocked child does not cancel healthy siblings. Observe their own
+                // native completion before reporting the unavailable continuation.
+                setStatus("waiting_for_children");
+                await delay(1000, undefined, { signal: cancellation.signal });
+                state.last_receipt = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                saveState(context, row, state);
+                continue;
+            }
+            if (children.some(child => child.status === "failed" && renderNativeChildFollowupInstruction(childHarness, child))) {
                 const inspected = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
                 state.last_receipt = inspected;
                 saveState(context, row, state);
@@ -1104,6 +1158,8 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     if (linked.length > 1 || linked.some(link => link.status !== "running"))
                         continue;
                     const retained = state.child_capacity?.[failedChild.session_id];
+                    if (retained?.policy && retained.policy !== CAPACITY_POLICY)
+                        throw new AppError("capacity_policy_mismatch", "Retained child episode requires its original pinned recovery policy", 1);
                     const refusals = [...(retained?.refusals ?? [])];
                     if (refusals.some(item => item.turn_id === failedChild.terminal_turn_id))
                         continue;
@@ -1114,11 +1170,11 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     await prepareMutation(() => { saveState(context, row, state); appendEvent(context, row.controller_id, "capacity_child_refusal", { child_session_id: failedChild.session_id, refusal: refusals.at(-1) }); });
                     const exhausted = overloadExhausted(refusals);
                     if (exhausted)
-                        throw new AppError("provider_unavailable", "Native child exhausted its overload continuation attempts", 1, { ...exhausted, reason: "overload_retries_exhausted", child_session_id: failedChild.session_id, primary_error: nativeFailure });
+                        throw new AppError("provider_unavailable", "Native child exhausted its provider continuation attempts", 1, { ...exhausted, child_session_id: failedChild.session_id, primary_error: nativeFailure });
                 }
                 // Continue one existing child at a time; another failed child does not
                 // create a second fanout wave or share this child's refusal counter.
-                const child = children.every(item => item.status === "failed" || item.status === "completed") ? failed.find(item => renderNativeChildFollowupInstruction(childHarness, item.session_id) && eligibleProviderChildOverload(item, session.id)) : undefined;
+                const child = children.every(item => item.status === "failed" || item.status === "completed") ? failed.find(item => renderNativeChildFollowupInstruction(childHarness, item) && eligibleProviderChildOverload(item, session.id)) : undefined;
                 const turnId = child?.terminal_turn_id;
                 const native = child && turnId ? providerChildFailure(child) : null;
                 const prior = child && state.child_capacity?.[child.session_id];
@@ -1143,7 +1199,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     }
                     const exhausted = overloadExhausted(refusals);
                     if (exhausted)
-                        throw new AppError("provider_unavailable", "Native child exhausted its overload continuation attempts", 1, { ...exhausted, reason: "overload_retries_exhausted", child_session_id: child.session_id, primary_error: native });
+                        throw new AppError("provider_unavailable", "Native child exhausted its provider continuation attempts", 1, { ...exhausted, child_session_id: child.session_id, primary_error: native });
                     let wait;
                     try {
                         wait = prepared ? Math.max(0, Date.parse(prepared.not_before) - Date.now()) : capacityDelay(native, attempt);
@@ -1157,7 +1213,8 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     const rootOperationId = prior?.root_operation_id ?? `${row.controller_id}:child:${digest([child.session_id, turnId]).slice(0, 16)}`;
                     const operationId = prepared?.operation_id ?? `${rootOperationId}:followup:${attempt}`;
                     state.child_capacity ??= {};
-                    state.child_capacity[child.session_id] = { turn_id: turnId, attempts: attempt, operation_id: operationId, root_operation_id: rootOperationId, policy: CAPACITY_POLICY, refusals, not_before: prepared?.not_before ?? new Date(Date.now() + wait).toISOString(), dispatched: false };
+                    const followupText = renderNativeChildFollowupInstruction(childHarness, child);
+                    state.child_capacity[child.session_id] = { turn_id: turnId, attempts: attempt, operation_id: operationId, root_operation_id: rootOperationId, policy: CAPACITY_POLICY, refusals, not_before: prepared?.not_before ?? new Date(Date.now() + wait).toISOString(), dispatched: false, phase: "prepare", prompt_sha256: digestBytes(followupText), ...(child.continuation_ref ? { continuation_ref: child.continuation_ref } : {}) };
                     await prepareMutation(() => { saveState(context, row, state); appendEvent(context, row.controller_id, "capacity_child_followup", { child_session_id: child.session_id, turn_id: turnId, attempt, operation_id: operationId }); });
                     const until = performance.now() + wait;
                     while (performance.now() < until) {
@@ -1186,15 +1243,27 @@ async function executeController(context, row, manifest, state, assertOwnership,
                         throw new AppError("capacity_child_followup_blocked", "Native child or Work changed during capacity wait", 1, { child_session_id: child.session_id, turn_id: turnId });
                     await renewLease();
                     assertOwner();
-                    const text = renderNativeChildFollowupInstruction(childHarness, child.session_id);
+                    const text = renderNativeChildFollowupInstruction(childHarness, child);
+                    // Fence dispatch before awaiting the parent: a lost ack must never
+                    // resend SendMessage into a child which may already be running.
+                    state.child_capacity[child.session_id].dispatched = true;
+                    state.child_capacity[child.session_id].phase = "dispatched";
+                    saveState(context, row, state);
                     await prompt(session, text, operationId, "child");
+                    const parentTurnId = state.last_receipt?.turn?._meta?.zcodeNativeTurnId;
+                    if (typeof parentTurnId === "string" && parentTurnId)
+                        state.child_capacity[child.session_id].parent_turn_id = parentTurnId;
                     state.child_capacity[child.session_id].dispatched = true;
                     saveState(context, row, state);
                     const after = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                    const afterChildren = controllerNativeChildren(after, session.id);
+                    reconcileChildCapacity(state, afterChildren, session.id);
+                    if (after.descendants)
+                        after.descendants = afterChildren;
                     state.last_receipt = after;
                     saveState(context, row, state);
                     const observed = controllerNativeChildren(after, session.id).find(item => item.session_id === child.session_id);
-                    if (!observed || observed.status === "failed" && observed.terminal_turn_id === turnId)
+                    if (!observed || observed.status === "failed" && observed.terminal_turn_id === turnId && state.child_capacity[child.session_id].phase !== "native_message_accepted")
                         throw new AppError("capacity_child_followup_unconfirmed", "Native child did not advance to a new Turn after parent followup", 1, { child_session_id: child.session_id, turn_id: turnId });
                     continue;
                 }

package/dist/services/run-recovery-guard.js

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 import { AppError } from "../shared/errors.js";
-import { CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, overloadExhausted } from "../harness-runtime/lib/provider-overload-policy.mjs";
+import { RECOVERY_POLICY as CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, recoveryExhausted as overloadExhausted } from "../harness-runtime/lib/provider-overload-policy.mjs";
 import { assertRunStartupSettled } from "./run-start-custody.js";
 export function recoveryPacketReceipt(binding) {
     if (!binding.packet_json || !binding.packet_sha256 || crypto.createHash("sha256").update(binding.packet_json).digest("hex") !== binding.packet_sha256)

package/dist/services/run-recovery-runtime.js

@@ -8,7 +8,7 @@ import { managedProcessBinding, processIsAlive, resourceHome } from "./managed-p
 import { getResourceDatabase } from "../storage/database.js";
 import { requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 import { lifecycleRetryInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
-import { CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, overloadExhausted } from "../harness-runtime/lib/provider-overload-policy.mjs";
+import { RECOVERY_POLICY as CAPACITY_POLICY, MAX_OVERLOAD_RETRIES, recoveryExhausted as overloadExhausted } from "../harness-runtime/lib/provider-overload-policy.mjs";
 /** Pin retained Session loading and its first acknowledgement Turn, never a general fence bypass. */
 export function prepareRunRecoveryDispatch(context, input) {
     if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(input.operationId) || !path.isAbsolute(input.stateDir))

package/dist/services/stage-context.js

@@ -16,6 +16,16 @@ function assertContextRelocation(receipt) {
         || !Array.isArray(receipt.path_mapping) || receipt.path_mapping.some(item => !item || typeof item.from !== "string" || typeof item.to !== "string" || !path.isAbsolute(item.from) || !path.isAbsolute(item.to)))
         throw new AppError("context_relocation_invalid", "Stage context relocation lacks a verified import binding", 2);
 }
+function relocateDeclaredPath(source, receipts) {
+    let mapped = source;
+    for (const receipt of receipts) {
+        assertContextRelocation(receipt);
+        const selected = [...receipt.path_mapping].sort((a, b) => b.from.length - a.from.length).find(item => mapped === item.from || mapped.startsWith(`${item.from}${path.sep}`));
+        if (selected)
+            mapped = path.join(selected.to, path.relative(selected.from, mapped));
+    }
+    return mapped;
+}
 /** Physical packet locators may move; accepted decision/provenance blocks may not. */
 export function projectPacketLocators(text, receipts) {
     receipts.forEach(assertContextRelocation);
@@ -89,13 +99,7 @@ export function renderRetainedStageContext(input) {
         || !/^[a-f0-9]{64}$/.test(input.workspaceView.source_sha256) || !/^[a-f0-9]{64}$/.test(input.workspaceView.copy_sha256)))
         throw new AppError("context_workspace_view_invalid", "Stage context workspace view lacks its bound review-copy proof", 2);
     const mapPath = (source, workspaceSource = true) => {
-        let mapped = source;
-        for (const receipt of input.receipts) {
-            assertContextRelocation(receipt);
-            const selected = [...receipt.path_mapping].sort((a, b) => b.from.length - a.from.length).find(item => mapped === item.from || mapped.startsWith(`${item.from}${path.sep}`));
-            if (selected)
-                mapped = path.join(selected.to, path.relative(selected.from, mapped));
-        }
+        let mapped = relocateDeclaredPath(source, input.receipts);
         const view = input.workspaceView;
         if (view && workspaceSource && (mapped === view.from || mapped.startsWith(`${view.from}${path.sep}`)))
             mapped = path.join(view.to, path.relative(view.from, mapped));
@@ -149,6 +153,7 @@ export function loadExternalStageContextBytes(input) {
     return { value, sourcePath, materializedSha256, bytes };
 }
 export function prepareExternalStageContext(input) {
+    verifyImmutableContextSources(input.loaded.value);
     const destination = externalStageContextDestination(input);
     if (!fs.existsSync(destination))
         prepareOutputFile(destination);
@@ -206,6 +211,7 @@ export function applyExternalStageContext(input) {
     return installed;
 }
 export function renderExternalStageContext(input) {
+    verifyImmutableContextSources(input.loaded.value);
     const value = input.loaded.value;
     const sources = value.sources ?? [];
     const taskInput = value.task_input ?? [];
@@ -251,7 +257,7 @@ function validateContext(value, expectedStage) {
         for (const item of value[key]) {
             const valid = key === "accepted_decisions" ? text(item) || object(item) && (text(item.id) || text(item.statement)) && [item.id, item.statement].every(field => field === undefined || text(field))
                 : object(item) && text(item.role) && (key === "dynamic_roles" ? item.reason === undefined || text(item.reason)
-                    : text(item.path) && (key === "sources" ? text(item.reason) && (item.required === undefined || typeof item.required === "boolean") && (item.root === undefined || typeof item.root === "string" && ["project", "workspace", "run"].includes(item.root)) : item.sha256 === undefined || text(item.sha256)));
+                    : text(item.path) && (key === "sources" ? text(item.reason) && (item.sha256 === undefined || typeof item.sha256 === "string" && /^[a-f0-9]{64}$/.test(item.sha256)) && (item.required === undefined || typeof item.required === "boolean") && (item.root === undefined || typeof item.root === "string" && ["project", "workspace", "run"].includes(item.root)) : item.sha256 === undefined || text(item.sha256)));
             if (!valid)
                 throw new AppError("validation", `Invalid stage context ${key} item`, 2, { parameter: key });
         }
@@ -261,4 +267,46 @@ function validateContext(value, expectedStage) {
             throw new AppError("validation", `Stage context ${key} must be a nonempty string`, 2);
     }
 }
+function verifyImmutableContextSources(value) {
+    for (const source of value.sources ?? []) {
+        if (!source.sha256)
+            continue; // Ordinary mutable project documents are not frozen.
+        try {
+            const info = fs.lstatSync(source.path);
+            if (!info.isFile() || info.isSymbolicLink() || info.size > 2 * 1024 * 1024 || sha256(fs.readFileSync(source.path)) !== source.sha256)
+                throw new Error("changed");
+        }
+        catch {
+            throw new AppError("context_source_checksum_mismatch", "Immutable stage source is unavailable or changed", 2, { role: source.role });
+        }
+    }
+}
+/** Only an accepted CODE context may bind a diagnostic capability to checks. */
+export function browserCheckCapabilityEnvironment(context, runId, runHome) {
+    const row = context.db.get("SELECT project_id, index_json FROM runs WHERE id = ?", [runId]);
+    const ref = row ? JSON.parse(row.index_json).execution_profile?.stage_context_inputs?.code : null;
+    if (!ref)
+        return {};
+    const file = path.resolve(runHome, ref.path), relative = path.relative(runHome, file);
+    if (relative.startsWith('..') || path.isAbsolute(relative))
+        throw new AppError('context_source_checksum_mismatch', 'Stage context escaped RUN', 2);
+    const loaded = loadExternalStageContext({ file, expectedSha256: ref.sha256, stage: 'code' });
+    const sources = loaded.value.sources?.filter(item => item.role === 'browser_environment_capabilities' && item.root === 'run') ?? [];
+    if (!sources.length)
+        return {};
+    if (sources.length !== 1)
+        throw new AppError('context_source_checksum_mismatch', 'Browser capability source is ambiguous', 2);
+    const source = { ...sources[0], path: relocateDeclaredPath(sources[0].path, runContextRelocations(context, row.project_id, runId)) };
+    const filename = path.basename(source.path), namedHash = filename.match(/^browser-capabilities(?:-([a-f0-9]{64}))?\.json$/);
+    const expected = path.join(runHome, 'environment', filename);
+    let owned = false;
+    try {
+        owned = fs.realpathSync(source.path) === path.join(fs.realpathSync(runHome), 'environment', filename);
+    }
+    catch { /* Missing proof is not a foreign host lookup. */ }
+    if (!source.sha256 || !namedHash || namedHash[1] && namedHash[1] !== source.sha256 || path.resolve(source.path) !== expected || !owned)
+        throw new AppError('context_source_checksum_mismatch', 'Browser capability lacks its RUN binding', 2);
+    verifyImmutableContextSources({ ...loaded.value, sources: [source] });
+    return { DD_FLOW_BROWSER_CAPABILITY_PATH: source.path, DD_FLOW_BROWSER_CAPABILITY_SHA256: source.sha256 };
+}
 function sha256(value) { return crypto.createHash("sha256").update(value).digest("hex"); }

package/dist/services/vnext-code-review.js

@@ -253,7 +253,7 @@ export async function finishVnextCodeReview(context, input) {
     const matrix = prepareRunVerificationMatrix(context, { projectId: project.id, runId: run.id, stage, role: "output", receipts, semanticFile: decisionFile });
     const failed = receipts.filter((receipt) => receipt.status !== "passed");
     if (failed.length) {
-        assertSourceRepairEligible(failed);
+        assertSourceRepairEligible(failed, run.workspace_root);
         context.db.writeTransaction(() => acceptVerificationMatrix(context, matrix));
         publishVerificationMatrix(context, matrix);
         throw new AppError("code_review_gate_failed", "CODE-REVIEW repair changed the project but the aggregate gate failed", 2, {

package/dist/services/vnext-code.js

@@ -225,7 +225,7 @@ export async function finishVnextCode(context, input) {
     const matrix = prepareRunVerificationMatrix(context, { projectId: project.id, runId: run.id, stage, role: "output", receipts, semanticFile: input.verificationFile });
     const matrixInstruction = matrix ? verificationMatrixInstruction(matrix.metadata, home, "semantic verification in code-verification.json") : "";
     if (failed.length) {
-        assertSourceRepairEligible(failed);
+        assertSourceRepairEligible(failed, run.workspace_root);
         context.db.writeTransaction(() => acceptVerificationMatrix(context, matrix));
         publishVerificationMatrix(context, matrix);
         const continuation = registerAggregateCodeRepair(context, { projectRoot, runId: run.id, stage, failures: failed, checks, generation });
@@ -408,8 +408,9 @@ export function prepareVnextCodeRepair(context, input) {
             check_receipt_id: input.checkReceiptId
         });
     }
+    // Aggregate registration validated current inputs before its SQL transaction.
     if (input.checkReceiptId)
-        assertSourceRepairEligible(checkReceipts(context, { projectId: project.id, runId: run.id }).filter(item => item.id === input.checkReceiptId));
+        assertSourceRepairEligible(checkReceipts(context, { projectId: project.id, runId: run.id }).filter(item => item.id === input.checkReceiptId), input.registrationOwned ? undefined : run.workspace_root);
     const origins = [...new Set(input.originWorkIds)].map((id) => requireCodeWork(context, project.id, run.id, id));
     const packets = origins.map((work) => packet(work));
     const invariantPackets = receipt || input.semanticUnresolved?.length

package/dist/services/vnext-fanout.js

@@ -305,7 +305,7 @@ export async function reconcileVnextFanout(context, input) {
             continue;
         }
         const link = active[0];
-        if (renderNativeChildFollowupInstruction(String(value.harness_id), String(child.session_id)) && eligibleProviderChildOverload(child, value.parent_session_id)) {
+        if (renderNativeChildFollowupInstruction(String(value.harness_id), child) && eligibleProviderChildOverload(child, value.parent_session_id)) {
             issues.push({ code: "child_capacity_pending", work_id: link.work_id, session_id: child.session_id });
             continue;
         }

package/dist/services/vnext-merge.js

@@ -479,7 +479,7 @@ export async function repairVnextMerge(context, input) {
     if (request.project_id !== project.id || request.status !== "action_required" || errorCode(request) !== "merge_gate_failed") {
         throw new AppError("invalid_merge_repair_state", "MERGE source repair requires an action-required failed integration gate", 2, { merge_request_id: input.requestId, status: request.status, code: errorCode(request) });
     }
-    assertSourceRepairEligible(checkReceipts(context, { projectId: project.id, runId: request.run_id }).filter(receipt => failedReceiptIds(request).includes(receipt.id)));
+    assertSourceRepairEligible(checkReceipts(context, { projectId: project.id, runId: request.run_id }).filter(receipt => failedReceiptIds(request).includes(receipt.id)), request.target_workspace);
     abortIntegration(request);
     const originWorkIds = sourceCodeWorkIds(context, request.project_id, request.run_id);
     if (!originWorkIds.length)

package/dist/services/work-registry.js

@@ -1564,7 +1564,7 @@ async function settle(context, id, status, result, progress, retry, memoryResult
             receipts = await runCodeChecks(context, { projectId: work.project_id, runId: work.run_id, runHome: requireRunHome(run), workspaceRoot: run.workspace_root, workId: work.work_id, artifactDir, scope: "work", checks: requiredChecks, ...(retry ? { retryReceiptId: retry.receiptId, retryReason: retry.reason } : {}), ...(progress ? { progress } : {}) });
             const failed = receipts.filter((receipt) => receipt.status !== "passed");
             if (failed.length)
-                assertSourceRepairEligible(failed);
+                assertSourceRepairEligible(failed, run.workspace_root);
             if (failed.length)
                 throw new AppError("work_checks_failed", "Work remains running because required checks failed", 2, { work_id: id, failures: failed, all_receipts: receipts });
         }