@deksden-com/dd-flow-cli 0.9.0-beta.151 → 0.9.0-beta.155

package/dist/harness-runtime/lib/dd-zcode-daemon.mjs

@@ -11,9 +11,9 @@ import net from "node:net";
 import { durableDaemonDispatch, completeDaemonShutdown, commitDaemonShutdown, assertDaemonDispatch, assertDaemonRestartable, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon } from "./daemon-operations.mjs";
 import path from "node:path";
 import { assertStartupChild, prepareRuntimeOwner, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, startManagedBridge, stopProcessGroup } from "./managed-daemon.mjs";
-import { acceptNativeHookRequest, hookBudget, readNativeHookFailures } from "./native-hook-command.mjs";
-import { parseLifecycleCommand, continuationCommand } from "./lifecycle-command.mjs";
-import { errorRecord, isProvenShellCorrection } from "./operation-errors.mjs";
+import { acceptNativeHookRequest, readNativeHookFailures, writeNativeHookFailure } from "./native-hook-command.mjs";
+import { parseLifecycleCommand, continuationCommand, commandOption } from "./lifecycle-command.mjs";
+import { errorRecord, isNativeHookObservationLoss, isProvenShellCorrection, reportedError } from "./operation-errors.mjs";
 
 import {
   AcpBridge,
@@ -225,7 +225,7 @@ export class DaemonRuntime {
     const adapter = params.adapterSessionId ?? known?.adapter_session_id ?? params.sessionId;
     const generation = this.activeGeneration ?? this.controlGeneration ?? 0;
     return {
-      ...this.state.config, ...params, operationId: this.state.active_request?.request_id, knownChildSessionIds: known?.known_child_session_ids ?? [], adapterSessionId: adapter,
+      ...this.state.config, ...params, operationId: this.state.active_request?.request_id, nativeHookOwner: this.nativeHookOperation ?? null, knownChildSessionIds: known?.known_child_session_ids ?? [], adapterSessionId: adapter,
       neverPromptedRootProof: this.neverPromptedRootProof(params.sessionId),
       daemonId: this.state.daemon_id, allowBackground: true, liveSession: this.liveAdapters.has(adapter),
       assertDispatch: () => { if (generation !== (this.controlGeneration ?? 0)) throw new DaemonError("operation_cancelled", "ZCode prompt was cancelled before native dispatch"); },
@@ -369,7 +369,8 @@ export class DaemonRuntime {
     if (this.activeProductive) throw new DaemonError("operation_busy", `${this.activeProductive} is already running`, true);
     this.activeProductive = name;
     this.activeGeneration = this.controlGeneration ?? 0;
-    const current = this.nativeHookOperation = { operationId: request?.operation_id, generation: this.activeGeneration, requests: new Map() };
+    const current = this.nativeHookOperation = { operationId: request?.operation_id, rootProviderSessionId: request?.session_id, generation: this.activeGeneration, requests: new Map() };
+    current.valid = () => current.generation === (this.controlGeneration ?? 0);
     let rejectHook;
     const hookFailed = new Promise((_, reject) => { rejectHook = reject; });
     void hookFailed.catch(() => {}); // A hook can fail while the dispatch receipt is still persisting.
@@ -379,6 +380,12 @@ export class DaemonRuntime {
       if (name === "session.prompt") this.state.last_native_failure = null;
       await this.persist({ active_tree: true, active_operation: name, ...(request ? { active_request: request } : {}) });
       const result = await Promise.race([task(), hookFailed]);
+      // The native tool cannot finish before its hook returns. Drain any
+      // already-written failure before discarding this operation's requests.
+      await this.observeHookFailures(current);
+      if (current.error) throw current.error;
+      const hookDiagnostics = (this.bridge.lifecycleDiagnostics ?? []).filter(item => item.operation_id === current.operationId && item.generation === current.generation);
+      if (hookDiagnostics.length) result.native_hook_diagnostics = [...new Map([...(result.native_hook_diagnostics ?? []), ...hookDiagnostics].map(item => [JSON.stringify(item), item])).values()];
       this.track(result);
       const running = this.treeRunning(result);
       await this.persist({ active_tree: running, active_operation: null, active_request: null });
@@ -393,12 +400,12 @@ export class DaemonRuntime {
       if (name === "session.prompt" && response?.method === "session/prompt" && error.details.provider_session_id)
         this.state.last_native_failure = { provider_session_id: error.details.provider_session_id, request_id: response.request_id };
       try {
-        await hookBudget(1_000, null).run(() => this.persist({
+        await this.persist({
           active_operation: null,
           active_request: active?.allocation
             ? { ...active, outcome: "unknown", error: errorPayload(error) }
             : null,
-        }), "failure_persistence");
+        });
       } catch (cleanupError) {
         // Preserve the operation's primary failure if durable cleanup itself
         // is unavailable. The caller will retain the outcome as unknown and
@@ -406,15 +413,50 @@ export class DaemonRuntime {
         if (error && typeof error === "object") error.cleanup_error = errorPayload(cleanupError);
       }
       throw error;
-    } finally { clearInterval(timer); current.requests.clear(); if (this.nativeHookOperation === current) this.nativeHookOperation = null; this.activeProductive = null; this.activeGeneration = null; }
+    } finally { clearInterval(timer); if (!current.retainNativeHooks) current.requests.clear(); if (this.nativeHookOperation === current) this.nativeHookOperation = null; this.activeProductive = null; this.activeGeneration = null; }
   }
 
   async observeHookFailures(current = this.nativeHookOperation) {
-    if (!current || this.nativeHookOperation !== current || current.reading) return;
-    current.reading = true;
-    try { await readNativeHookFailures(this.paths.dir, current.requests, current, error => {
-      if (!isProvenShellCorrection(error)) current.reject(error);
-    }); } finally { current.reading = false; }
+    if (!current || this.nativeHookOperation !== current) return;
+    while (current.reading) {
+      await current.reading;
+      if (this.nativeHookOperation !== current) return;
+    }
+    const reading = readNativeHookFailures(this.paths.dir, current.requests, current, error => this.acceptHookFailure(current, error));
+    current.reading = reading;
+    try { await reading; } finally { if (current.reading === reading) current.reading = null; }
+  }
+
+  acceptHookFailure(current, error) {
+    if (this.nativeHookOperation !== current) return;
+    const unconfirmed = error.details?.native_hook_binding?.native_creator === "unconfirmed";
+    if (!unconfirmed && isProvenShellCorrection(error)) return;
+    if (unconfirmed || isNativeHookObservationLoss(error)) {
+      const diagnostic = { ...errorRecord(error), session_id: this.state.active_request?.adapter_session_id ?? null,
+        operation_id: current.operationId, generation: current.generation, delivery_stage: "hook_observation", completeness: "incomplete" };
+      this.bridge.lifecycleDiagnostics ??= [];
+      this.bridge.lifecycleDiagnostics.push(diagnostic);
+      try { void Promise.resolve(this.bridge.journal?.write("native_hook_observation_failure", diagnostic)).catch(() => {}); } catch { /* diagnostic is optional */ }
+      return;
+    }
+    current.reject(error);
+  }
+
+  hookOwner(binding) {
+    if (!binding?.request_id) return null;
+    const turns = this.bridge.nativeHookOwnership?.turns?.values() ?? [];
+    const owners = new Set([this.nativeHookOperation, ...[...turns].filter(turn => !turn.invalid).map(turn => turn.owner)]);
+    for (const owner of owners) {
+      if (!owner || owner.operationId !== binding.operation_id || owner.generation !== binding.turn_generation || owner.generation !== (this.controlGeneration ?? 0)) continue;
+      const accepted = owner.requests.get(binding.request_id);
+      if (accepted?.current !== owner || JSON.stringify(accepted.binding) !== JSON.stringify(binding)) continue;
+      if (binding.source_harness === "zcode-acp") {
+        const proof = this.bridge.nativeHookOwnership?.fact(binding.provider_session_id, binding.tool_call_id, binding.native_command);
+        if (!proof || proof.owner !== owner || proof.parent !== binding.parent_provider_session_id) continue;
+      }
+      return owner;
+    }
+    return null;
   }
 
   async requireSettled(params) {
@@ -491,23 +533,67 @@ export class DaemonRuntime {
     };
     if (operation === "hook.resolve") {
       const sessionId = String(params.sessionId ?? "");
-      const session = this.sessions.get(sessionId);
+      const payload = params.payload, command = payload?.tool_input?.command ?? payload?.tool_input?.cmd;
+      const tool = payload?.tool_use_id ?? payload?.tool_call_id;
+      const source = this.bridge.nativeHookOwnership;
+      let proof = source?.fact(sessionId, tool, command);
+      const tracked = this.sessions.get(sessionId);
+      if (!proof && (!tracked || tracked.parent_provider_session_id) && source && tool && typeof command === "string") {
+        await source.wait(sessionId, tool, command, params.hookDeadlineAt);
+        proof = source.fact(sessionId, tool, command);
+      }
+      const session = proof ? { root_provider_session_id: proof.root, parent_provider_session_id: proof.parent } : tracked;
       if (!session?.root_provider_session_id) throw new DaemonError("hook_identity_unknown", "ZCode hook Session is not a tracked controlled Session", false, { session_id: sessionId });
       const identity = { daemonId: this.state.daemon_id, rootProviderSessionId: session.root_provider_session_id, parentProviderSessionId: session.parent_provider_session_id ?? null, observedProfile: this.bridge.modelProfiles?.get(sessionId) ?? {} };
-      const payload = params.payload, command = payload?.tool_input?.command ?? payload?.tool_input?.cmd;
       if (payload?.hook_event_name === "PreToolUse" && typeof command === "string" && (["lifecycle", "auxiliary"].includes(parseLifecycleCommand(command).participation) || continuationCommand(command))) {
-        const current = this.nativeHookOperation, active = this.state.active_request;
-        const tool = payload.tool_use_id ?? payload.tool_call_id;
+        // A retained child can only be attributed through the exact observed
+        // native turn and tool. Otherwise preserve the legacy handler without
+        // guessing that the currently active prompt created it.
+        if (sessionId !== session.root_provider_session_id && !proof) return identity;
+        const current = proof?.owner ?? this.nativeHookOperation, active = this.state.active_request;
         const pending = [...(this.bridge.pending?.values() ?? [])].some(request => request.method === "session/prompt" && request.sessionId === active?.adapter_session_id);
         const root = active?.session_id ?? active?.allocation?.provider_session_id;
-        if (!current || !active || !pending || current.generation !== (this.controlGeneration ?? 0) || session.root_provider_session_id !== root || !tool) throw new DaemonError("native_hook_unproven", "Native hook has no exact active Session operation");
-        const binding = await hookBudget(1_000, null).run(() => acceptNativeHookRequest(this.paths.dir, { daemon_id: this.state.daemon_id, operation_id: current.operationId, turn_generation: current.generation, provider_session_id: sessionId, root_provider_session_id: session.root_provider_session_id, tool_call_id: tool, event: "PreToolUse", command_sha256: createHash("sha256").update(command).digest("hex"), native_cwd: payload.cwd ?? null }, current), "hook_binding");
-        if (this.nativeHookOperation !== current) throw new DaemonError("native_hook_unproven", "Native hook operation changed during acceptance");
+        if (!current || current.generation !== (this.controlGeneration ?? 0) || !tool || !proof && (!active || !pending || session.root_provider_session_id !== root)) throw new DaemonError("native_hook_unproven", "Native hook has no exact owned Session operation");
+        assertDaemonDispatch(this.paths.dir);
+        const nativePayload = proof ? { ...proof.message, _meta: { ...(proof.message._meta ?? {}), ddZcode: { daemonId: this.state.daemon_id, rootProviderSessionId: proof.root, parentProviderSessionId: proof.parent } } } : null;
+        const binding = await acceptNativeHookRequest(this.paths.dir, { daemon_id: this.state.daemon_id, operation_id: current.operationId, turn_generation: current.generation, provider_session_id: sessionId, root_provider_session_id: session.root_provider_session_id, parent_provider_session_id: session.parent_provider_session_id ?? null, tool_call_id: tool, event: "PreToolUse", command_sha256: createHash("sha256").update(command).digest("hex"), native_cwd: payload.cwd ?? null, native_creator: proof ? "confirmed" : "unconfirmed", ...(proof ? { source_harness: "zcode-acp", native_command: command, native_payload: nativePayload } : {}) }, current);
+        if (current.generation !== (this.controlGeneration ?? 0) || proof && source.fact(sessionId, tool, command) !== proof || !proof && this.nativeHookOperation !== current) throw new DaemonError("native_hook_unproven", "Native hook operation changed during acceptance");
         current.requests.set(binding.request_id, { current, binding }); identity.nativeHookBinding = binding;
+        const parsed = parseLifecycleCommand(command);
+        if (proof && parsed.kind === "standalone" && parsed.invocation.operation === "work_start" && commandOption(parsed.invocation, "invocation-id")) identity.fastAck = true;
       }
       return identity;
     }
-    if (operation === "hook.failed") { await this.observeHookFailures(); return { observed: true }; }
+    if (operation === "hook.verify") {
+      if (params.daemonId !== this.state.daemon_id) throw new DaemonError("native_hook_unproven", "Native hook daemon identity differs");
+      const owner = this.hookOwner(params.binding);
+      if (!owner) throw new DaemonError("native_hook_unproven", "Native hook has no matching retained operation");
+      assertDaemonDispatch(this.paths.dir);
+      return { verified: true, nativeHookBinding: params.binding };
+    }
+    if (operation === "hook.failed") {
+      if (params.binding !== undefined || params.failure !== undefined) {
+        const binding = params.binding, failure = params.failure, current = this.hookOwner(binding);
+        // Join an in-flight file observation before checking the request. A
+        // direct fallback and its receipt must not be delivered twice.
+        while (current?.reading) await current.reading;
+        const accepted = current?.requests.get(binding?.request_id);
+        if (!current || this.hookOwner(binding) !== current || accepted?.current !== current
+          || JSON.stringify(accepted.binding) !== JSON.stringify(binding) || typeof failure?.code !== "string" || typeof failure?.message !== "string")
+          throw new DaemonError("native_hook_unproven", "Hook failure has no exact current owned delivery");
+        assertDaemonDispatch(this.paths.dir);
+        if (this.nativeHookOperation !== current) {
+          await writeNativeHookFailure(this.paths.dir, binding, reportedError(failure, "Native hook failed"));
+          return { observed: true, retained: true };
+        }
+        current.requests.delete(binding.request_id);
+        const error = reportedError(failure, "Native hook failed");
+        error.details = { ...error.details, native_hook_binding: binding };
+        this.acceptHookFailure(current, error);
+        return { observed: true };
+      }
+      await this.observeHookFailures(); return { observed: true };
+    }
     if (operation === "session.create") {
       const request = {
         operation_id: operationId,
@@ -668,6 +754,13 @@ export class DaemonRuntime {
     await this.persist({ native_stop_proof: { daemon_id: this.state.daemon_id, sessions: [...this.sessions.keys()], observed_at: new Date().toISOString() } });
     }
     commitDaemonShutdown(this.paths.dir);
+    if (!cancel) {
+      // The native tree has been observed idle. Publish that execution proof
+      // before attempting to close the independent bridge process. A close
+      // failure is cleanup debt and must not erase the already observed turn.
+      await this.persist({ active_tree: false, shutdown_state: "stopping", active_operation: null, active_request: null });
+      return { daemon_id: this.state.daemon_id, clean: true, settled: true, native_settled: true };
+    }
     // A cooperative close can make the native Session non-resident while its
     // original ACP prompt is still pending.  For an explicitly whole-RUN
     // cancellation this daemon owns the bridge process group, so retire that
@@ -698,7 +791,7 @@ export class DaemonRuntime {
 }
 
 export function zcodeBridgeEnv(config, daemonId) {
-  return { ...config.env, ...managedFlowEnv(config, daemonId) };
+  return { ...config.env, ...managedFlowEnv(config, daemonId), DD_ZCODE_STATE_DIR: !config.noFlow && daemonId ? config.runtime_owner?.state_dir : undefined };
 }
 
 export async function serveDaemon(stateDir) {

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -1,6 +1,7 @@
 import { ObservationClock, observedTimeout, validateObservationDuration } from "./observation-clock.mjs";
 import { ToolObservations, acpToolObservation, zcodePhysicalSession } from "./tool-observations.mjs";
-import { hookBudget, invokeNativeHook } from "./native-hook-command.mjs";
+import { ZcodeNativeHookOwnership } from "./zcode-native-hook-ownership.mjs";
+import { invokeNativeHook } from "./native-hook-command.mjs";
 import { parseLifecycleCommand, continuationCommand, commandOption } from "./lifecycle-command.mjs";
 import { spawn } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
@@ -136,6 +137,7 @@ export class AcpBridge {
     this.options = options;
     this.nextId = 1;
     this.pending = new Map();
+    this.nativeHookOwnership = new ZcodeNativeHookOwnership();
     this.allocationObservers = new Map();
     this.lateResponses = new Map();
     this.expiredRequests = new Map();
@@ -146,6 +148,7 @@ export class AcpBridge {
     this.connectionId = randomUUID();
     this.receivedSequence = 0;
     this.lifecycleNotifications = new Set();
+    this.lifecycleDiagnostics = [];
     this.notificationError = null;
     this.bridgeStderr = "";
     this.toolObservations = new ToolObservations();
@@ -230,7 +233,6 @@ export class AcpBridge {
       }
     }
     if (!isResponse || request) this.journal.writeInbound(message, request?.method);
-    if (typeof message.params?.sessionId === "string" && isProductiveSessionNotification(message)) this.observeActivity(message.params.sessionId, message.params.update);
     const update = message.params?.update;
     // ZCode emits this as `session/update`; Grok Build wraps the same ACP
     // payload in `_x.ai/session_notification`.  Preserve either provider's
@@ -256,32 +258,18 @@ export class AcpBridge {
         void this.notifications.catch(error => { this.notificationError ??= error; });
       }
     }
+    if (message.method === "zcode/session/native_turn_started") {
+      const pending = this.pending.get(message.params?.requestId);
+      for (const routed of this.nativeHookOwnership.bind(message.params, pending)) { this.observeAttributedActivity(routed.message); this.dispatchLifecycleNotification(routed.message, routed.observer, routed.owner); }
+    }
+    this.observeAttributedActivity(message);
     this.observeToolCall(message);
-    if (message.method === "session/update" && this.options.onLifecycleNotification) {
-      const observer = this.options.onLifecycleNotification;
-      const pending = Promise.resolve().then(() => observer(message)).catch(async error => {
-        // A validated no-effect rejection is returned through the invocation
-        // ledger. It is evidence, not a poisoned ACP Session.
-        const current = this.options.onLifecycleNotification === observer;
-        const correctable = current && correctableLifecycleErrors.has(error);
-        if (current && !correctable) {
-          this.lifecycleFailure ??= this.notificationError?.code === "profile_integrity_violation" ? this.notificationError : error;
-          this.notificationError = this.lifecycleFailure;
-        }
-        // A missing/foreign authority is not a recoverable CLI validation
-        // result. Stop admitting productive requests immediately; the managed
-        // controller still owns physical stop/drain and evidence capture.
-        if (current && !correctable) this.rejectAll(this.notificationError);
-        try {
-          await hookBudget(1_000, null).run(() => this.journal.write("notification_failure", { ...errorRecord(error),
-            session_id: message.params?.sessionId ?? null, tool_call_id: update?.toolCallId ?? null, event_time: now(), delivery_stage: "lifecycle_receipt", completeness: "incomplete" }), "failure_persistence");
-        } catch (persistenceError) {
-          if (current) this.notificationError ??= persistenceError;
-          process.stderr.write(`${JSON.stringify({ code: error.code, message: error.message, persistence_error: persistenceError.message })}\n`);
-        }
-      });
-      this.lifecycleNotifications.add(pending);
-      void pending.then(() => this.lifecycleNotifications.delete(pending), () => this.lifecycleNotifications.delete(pending));
+    const pendingPrompts = [...this.pending.values()].filter(item => item.method === "session/prompt" && item.sessionId === message.params?.sessionId);
+    const owned = this.nativeHookOwnership.observe(message, pendingPrompts.length > 0, this.nativeHookOwnership.isManaged(message.params?.sessionId, this.pending));
+    if (owned !== null) {
+      for (const routed of owned) this.dispatchLifecycleNotification(routed.message, routed.observer, routed.owner);
+    } else if (message.method === "session/update" && this.options.onLifecycleNotification) {
+      this.dispatchLifecycleNotification(message, this.options.onLifecycleNotification);
     }
     if (message.id !== undefined && message.method) { void this.answer(message).catch((error) => this.rejectAll(error)); return; }
     if (message.id !== undefined) {
@@ -293,6 +281,7 @@ export class AcpBridge {
         return;
       }
       clearTimeout(pending.timer); if (pending.idleTimer) clearInterval(pending.idleTimer); this.pending.delete(message.id);
+      if (pending.method === "session/prompt") this.discardUnboundIfIdle(pending.sessionId);
       if (pending.timedOut) this.journal.write("late_response", { ...responseSummary(message, pending.method), grace_ms: LATE_RESPONSE_GRACE_MS });
       if (message.error) {
         const data = message.error.data && typeof message.error.data === "object" && !Array.isArray(message.error.data) ? message.error.data : null;
@@ -332,6 +321,46 @@ export class AcpBridge {
       });
   }
 
+  observeAttributedActivity(message) {
+    if (typeof message.params?.sessionId === "string" && isProductiveSessionNotification(message) && this.nativeHookOwnership.isCurrent(message, this.pending)) this.observeActivity(message.params.sessionId, message.params.update);
+  }
+
+  discardUnboundIfIdle(sessionId) {
+    if (![...this.pending.values()].some(item => item.method === "session/prompt" && item.sessionId === sessionId)) this.nativeHookOwnership.discardUnbound(sessionId);
+  }
+
+  dispatchLifecycleNotification(message, observer, owner = null) {
+      const update = message.params?.update;
+      const pending = Promise.resolve().then(() => observer(message)).catch(async error => {
+        // A validated no-effect rejection is returned through the invocation
+        // ledger. It is evidence, not a poisoned ACP Session.
+        const current = this.options.onLifecycleNotification === observer && [...this.pending.values()].some(request => request.method === "session/prompt" && request.sessionId === message.params?.sessionId && (!owner || request.nativeHookOwner === owner));
+        const correctable = current && correctableLifecycleErrors.has(error);
+        // This callback observes an already-delivered native tool event. Its
+        // own timeout is not the result of the CLI command or the Turn.
+        const observationTimeout = current && error.code === "native_hook_timeout";
+        const diagnostic = { ...errorRecord(error), session_id: message.params?.sessionId ?? null,
+          tool_call_id: update?.toolCallId ?? null, event_time: now(), delivery_stage: "lifecycle_receipt", completeness: "incomplete" };
+        if (observationTimeout) this.lifecycleDiagnostics.push(diagnostic);
+        if (current && !correctable && !observationTimeout) {
+          this.lifecycleFailure ??= this.notificationError?.code === "profile_integrity_violation" ? this.notificationError : error;
+          this.notificationError = this.lifecycleFailure;
+        }
+        // A missing/foreign authority is not a recoverable CLI validation
+        // result. Stop admitting productive requests immediately; the managed
+        // controller still owns physical stop/drain and evidence capture.
+        if (current && !correctable && !observationTimeout) this.rejectAll(this.notificationError);
+        try {
+          await this.journal.write("notification_failure", diagnostic);
+        } catch (persistenceError) {
+          if (current && !observationTimeout) this.notificationError ??= persistenceError;
+          process.stderr.write(`${JSON.stringify({ code: error.code, message: error.message, persistence_error: persistenceError.message })}\n`);
+        }
+      });
+      this.lifecycleNotifications.add(pending);
+      void pending.then(() => this.lifecycleNotifications.delete(pending), () => this.lifecycleNotifications.delete(pending));
+  }
+
   observeToolCall(message) {
     const rootSessionId = this.modelSessions.get(message.params?.sessionId)?.sessionId;
     this.toolObservations.add(acpToolObservation(message, { harness: this.options.observationHarness ?? "zcode-acp", rootSessionId }));
@@ -364,7 +393,7 @@ export class AcpBridge {
         const rejectObservation = cause => {
           if (this.pending.get(pending.id) !== pending) return;
           clearTimeout(pending.timer); if (pending.idleTimer) clearInterval(pending.idleTimer);
-          this.pending.delete(pending.id); pending.reject(nativeObservationError(cause));
+          this.pending.delete(pending.id); this.discardUnboundIfIdle(pending.sessionId); pending.reject(nativeObservationError(cause));
         };
         void pending.publish("native_progress", { native_request_id: String(pending.id), session_id: adapterId, observed_at: new Date(observedAt).toISOString() }).catch(rejectObservation);
         this.sessionActivity.set(adapterId, observedAt);
@@ -430,7 +459,7 @@ export class AcpBridge {
     return new Promise((resolve, reject) => {
       const finish = (error) => {
         const pending = this.pending.get(id); if (!pending) return;
-        clearTimeout(pending.timer); if (pending.idleTimer) clearInterval(pending.idleTimer); this.pending.delete(id); reject(error);
+        clearTimeout(pending.timer); if (pending.idleTimer) clearInterval(pending.idleTimer); this.pending.delete(id); if (pending.method === "session/prompt") this.discardUnboundIfIdle(pending.sessionId); reject(error);
       };
       // Productive Turns use the sliding session-activity timeout below.  A
       // second wall-clock timeout would kill an active, long-running Turn.
@@ -484,7 +513,7 @@ export class AcpBridge {
           void this.journal.write("inactivity_observation_failure", { method, request_id: id, session_id: idleSessionId, error: { code: error?.code ?? "inactivity_observation_failed", message: error?.message ?? String(error) } }).catch(() => {});
         });
       }, Math.max(10, Math.min(1_000, Math.floor(validIdleTimeout / 4)))) : null;
-      this.pending.set(id, { id, resolve, reject, timer, idleTimer, method, sessionId: params.sessionId ?? null, operationId: this.dispatchOperationId ?? process.env.DD_EVAL_OPERATION_ID ?? null, generation: this.dispatchGeneration ?? null, dispatchedAt: Date.now(), publish: operationProgressReporter() });
+      this.pending.set(id, { id, resolve, reject, timer, idleTimer, method, sessionId: params.sessionId ?? null, operationId: this.dispatchOperationId ?? process.env.DD_EVAL_OPERATION_ID ?? null, generation: this.dispatchGeneration ?? null, nativeHookOwner: method === "session/prompt" ? this.dispatchNativeHookOwner ?? null : null, dispatchedAt: Date.now(), publish: operationProgressReporter() });
       if (method === "session/prompt") {
         void (async () => {
           const dispatch = { operation_id: this.pending.get(id)?.operationId, session_id: params.sessionId, native_request_id: id,
@@ -520,6 +549,7 @@ export class AcpBridge {
       clearTimeout(pending.timer); if (pending.idleTimer) clearInterval(pending.idleTimer); pending.reject(error);
     }
     this.pending.clear();
+    this.nativeHookOwnership.buffer.clear();
   }
   async flush() {
     await this.terminalOutcomes;
@@ -536,8 +566,7 @@ export class AcpBridge {
       await Promise.all([this.nativeDrain, this.diagnostics]);
       await this.terminalOutcomes;
       await Promise.allSettled([...this.lifecycleNotifications, this.notifications]);
-      if (this.notificationError) await hookBudget(1_000, null).run(() => this.journal.flush(), "failure_drain");
-      else await this.journal.flush();
+      await this.journal.flush();
     });
   }
 }
@@ -648,7 +677,6 @@ export async function readZcodeSubagents(bridge, sessionId, timeoutMs = 30_000,
     }
     if (typeof cursor !== "string" || cursors.has(cursor) || !Number.isSafeInteger(first.revision)) fail("ZCode child pagination has no advancing, versioned cursor", "native_topology_incomplete");
     cursors.add(cursor);
-    if (cursors.size > 1_024) fail("ZCode child pagination exceeds its bounded directory limit", "native_topology_incomplete");
     clock.sample(cursor);
   }
 }
@@ -714,7 +742,7 @@ export async function observeClosedZcodeTree(bridge, root, retainedChildren = []
   const clock = new ObservationClock({ timeoutMs: 30_000 });
   try {
     for (const sessionId of pending) {
-      if (pending.size > 1024 || clock.sample()) throw new Error("Closed tree observation limit exceeded");
+      if (clock.sample()) throw new Error("Closed tree observation timed out");
       const resident = await bridge.request("zcode/session/resident", { sessionId }, 5_000);
       if (resident?.sessionId !== sessionId || typeof resident.resident !== "boolean") throw new Error("Invalid residency identity or state");
       residents.push(resident);
@@ -1001,6 +1029,12 @@ export function zcodeLifecycleQualification(sha256, bridgeCommit, harnessContrac
     ["9c5ca6cc81c4eb5065e43f8b7ab6b7cc5ab7ae47", "dd-zcode-harness@2"],
     // CP253 installed artifact: exact same-child Read continuation and retained proof.
     ["b18dfdbedaa9330e765315bce0f1a609792d6c91", "dd-zcode-harness@2"],
+    // Plan108 native 0.17.0: exact input/turn binding and a late child shell
+    // event after the root reply. Clean rebuild retained identical code bytes.
+    ["ac3e1063934fd516b7e69e900dc196eaafd3e7a9", "dd-zcode-harness@2"],
+    // Reviewed late-progress repair: unchanged request/turn contract retains
+    // ac3e106 native evidence; changed delivery is covered by scoped regressions.
+    ["f9a3c5948ffbb0a31ec00bf8986610e17b8b9d77", "dd-zcode-harness@2"],
   ]);
   const qualified = qualifiedBridgeCommits.get(bridgeCommit) === harnessContract;
   return { status: qualified ? "qualified" : "unqualified", mechanism: "cli-invocation@1", sha256,
@@ -1087,7 +1121,9 @@ export async function promptSessionWithBridge(bridge, options) {
   bridge.configure({ ...options, onNotification: async (event) => { await forward?.(event); await options.onNotification?.(event); } });
   const identity = await controlledIdentity(bridge, { ...options, cwd }); forward = flowForwarder(options, identity.providerSessionId, bridge);
   await bridge.journal.flush();
-  bridge.configure({ onLifecycleNotification: await zcodeInvocationObserver({ ...options, adapterSessionId: identity.adapterSessionId }, identity.providerSessionId) });
+  const observer = await zcodeInvocationObserver({ ...options, adapterSessionId: identity.adapterSessionId }, identity.providerSessionId);
+  bridge.configure({ onLifecycleNotification: observer });
+  bridge.nativeHookOwnership?.register(options.nativeHookOwner?.operationId, observer, identity.adapterSessionId);
   const profile_receipt = await applyProfile(bridge, identity.adapterSessionId, requested, options.assertDispatch);
   options.assertDispatch?.();
   let initial_usage_error = null;
@@ -1097,8 +1133,10 @@ export async function promptSessionWithBridge(bridge, options) {
   // never turn a long native child request into a fabricated provider failure.
   const timeoutMs = null;
   const textCursor = bridge.assistantTextCursor(identity.adapterSessionId);
+  const diagnosticsCursor = bridge.lifecycleDiagnostics?.length ?? 0;
   options.assertDispatch?.();
   bridge.dispatchOperationId = options.operationId;
+  bridge.dispatchNativeHookOwner = options.nativeHookOwner ?? null;
   const managed = options.operationId ? { schema_id: "dd-flow/managed-provider-recovery@1", owner: "controller", operation_id: options.operationId, root_operation_id: options.operationId.replace(/:capacity:\d+:session\.prompt$/, "") } : null;
   const acknowledged = value => managed && value && Object.keys(managed).every(key => value[key] === managed[key]);
   if (managed && (bridge.recoveryCapability?.schema_id !== managed.schema_id || bridge.recoveryCapability?.owner !== "controller")) fail("ZCode bridge does not acknowledge controller-owned provider recovery", "provider_recovery_unavailable");
@@ -1155,7 +1193,8 @@ export async function promptSessionWithBridge(bridge, options) {
     await cancelTree(bridge, identity.adapterSessionId, evidence.subagents, identity.providerSessionId);
     fail("background ZCode subagents cannot outlive the one-shot dd-zcode connection; the live child tree was cancelled");
   }
-  return receipt(options, { harness: "zcode-acp", provider_session_id: identity.providerSessionId, adapter_session_id: identity.adapterSessionId, assistant_text: bridge.assistantTextSince(identity.adapterSessionId, textCursor), turn, profile: profile_receipt, evidence: publicEvidence(evidence) });
+  const native_hook_diagnostics = (bridge.lifecycleDiagnostics ?? []).slice(diagnosticsCursor).filter(item => item.session_id === identity.adapterSessionId);
+  return receipt(options, { harness: "zcode-acp", provider_session_id: identity.providerSessionId, adapter_session_id: identity.adapterSessionId, assistant_text: bridge.assistantTextSince(identity.adapterSessionId, textCursor), turn, profile: profile_receipt, evidence: publicEvidence(evidence), ...(native_hook_diagnostics.length ? { native_hook_diagnostics } : {}) });
 }
 
 export async function inspectSession(options) {

package/dist/harness-runtime/lib/delegation-instructions.d.mts

@@ -6,6 +6,7 @@ export function delegationContract(harness: string): string;
 export const lifecycleRetryInstruction: string;
 export const lifecycleCommandCompletionInstruction: string;
 export const stageLifecycleInstruction: string;
+export const acceptedResultInstruction: string;
 export function workerDelegationTask(input: { workId: string; startCommand: string; launchPolicy?: string }): string;
 export function renderDelegationInstructions(input: DelegationInput): string;
 export function renderCapacityInstructions(input: { harness: string; maximum: number }): string;

package/dist/harness-runtime/lib/delegation-instructions.mjs

@@ -71,12 +71,16 @@ export function delegationContract(harness) {
 
 export const lifecycleCommandCompletionInstruction = "Run runtime-issued lifecycle CLI calls in the foreground, never with a native background or detached-shell option. A shell tool may yield before the lifecycle process exits. Retain and poll its exact process/session handle to completion, including inside a tool wrapper; empty interim output is not a CLI result. If a wrapper returns 'Script running with cell ID …', use that wrapper's wait tool to finish the same cell before expecting an inner shell session handle; do not execute the command again. Read final stdout or response_file before deciding continuation, and never reissue the command while it is pending. When the result provides prompt_delivery, read its complete plain Markdown file at prompt_delivery.path before working; it contains the current instructions, unlike the historical prompt_path. If delivery publication is pending, stop for reconciliation without repeating the accepted command.";
 
-export const lifecycleRetryInstruction = `${lifecycleCommandCompletionInstruction} A failure is not permission to replay a lifecycle command. For proven effect=no_effect with recoverable=true and retry_command, correct the input and execute that exact issued successor. A check failure can retain receipts while leaving Work running: correct the evidenced cause first, then use the CLI's exact retry_command for an intentional fresh check attempt; never replay a check merely because Work is unsettled. If a successful CODE finish returns outcome=verification_required, inspect the retained receipts, update its verification file, and use only next.finish_command: the Stage is still running and the previous invocation ID is consumed. If continuation.kind=repair_required, or a successful result has outcome=repair_required and a repair Work ID, end this Turn for the registered repair child; use any retry_command only after that repair settles and verification is refreshed. Unknown effects require reconciliation, never replay. A committed effect without an explicit continuation is not retryable. A native shell launch refusal before the CLI starts permits correcting only that shell-form error and retrying the same exact command. Otherwise report the primary error and stop; never invent IDs, call hooks directly, or run status as a substitute.`;
+export const nonLifecycleInputCorrectionInstruction = "For a non-lifecycle command explicitly reporting phase=prepare, effect=no_effect and recoverable=true, correct only its rejected arguments/JSON or an already-authorized missing precondition, then retry that non-lifecycle operation. Read that exact command's --help when its options are unclear. This includes check/integration input rejected before dispatch: an unsupported option or invalid JSON is not a failed check or an unknown Git effect. For example, remove an unsupported --stage from interactive integrate, or retain the current authorized interactive scope before reading git-inputs. This does not permit changing accepted data under an old request ID, expanding scope, replaying lifecycle commands without their issued successor, repeating dispatched checks/integration with failed, partial, committed or unknown effects, or bypassing ownership, recovery, storage, trust or operator-control refusals. An error lacking any of the three explicit preparation fields does not grant this correction path.";
+
+export const lifecycleRetryInstruction = `${lifecycleCommandCompletionInstruction} A failure is not permission to replay a lifecycle command. For proven effect=no_effect with recoverable=true and retry_command, correct the input and execute that exact issued successor. A check failure can retain receipts while leaving Work running: correct the evidenced cause first, then use the CLI's exact retry_command for an intentional fresh check attempt; never replay a check merely because Work is unsettled. If a successful CODE finish returns outcome=verification_required, inspect the retained receipts, update its verification file, and use only next.finish_command: the Stage is still running and the previous invocation ID is consumed. If continuation.kind=repair_required, or a successful result has outcome=repair_required and a repair Work ID, end this Turn for the registered repair child; use any retry_command only after that repair settles and verification is refreshed. Unknown effects require reconciliation, never replay. A committed effect without an explicit continuation is not retryable. A native shell launch refusal before the CLI starts permits correcting only that shell-form error and retrying the same exact command. On any other lifecycle failure report the primary error and stop; never invent IDs, call hooks directly, or run status as a substitute. ${nonLifecycleInputCorrectionInstruction}`;
+export const acceptedResultInstruction = "dd-flow's accepted Work/Stage result is authoritative; a native completion message or a result file alone is not acceptance. After dd-flow accepts your Work result, stop writing files, running tools and creating tasks, and end this Turn. A late native error, idle child card or failed session shutdown does not revoke an accepted result: do not repeat the Work or send another model prompt just to close it. Report technical_notes and cleanup_pending separately; the controller owns resource retirement. If another assigned Work or the Stage gate is still incomplete, continue only that remaining assignment through the issued graph. A possible conflicting writer requires controller reconciliation before dependent work, not an invented completion or a duplicate worker.";
 
 export const stageLifecycleInstruction = [
   "The project root identifies this RUN; use the Stage packet's declared execution workspace and absolute artifact paths. Do not change a native Session's working directory to a workspace provisioned for a later Stage.",
   "In a controller-managed fanout, the coordinator ends the entry Turn after the Work graph is returned; the controller dispatches children. A completed child or Work is not Stage success: settle the declared graph and Stage gate before finishing.",
   "Execute each runtime-issued lifecycle operation and its arguments exactly. One literal lifecycle call may be composed with ordinary shell commands; preserve conditions, stdin and redirects, and never replay the surrounding shell chain after failure. Invocation IDs are internal authority; never add, copy or invent one.",
+  acceptedResultInstruction,
   lifecycleRetryInstruction
 ].join(" ");
 
@@ -97,6 +101,7 @@ export function workerDelegationTask({ workId, startCommand, launchPolicy }) {
     "Continue only if it succeeds and returns the authoritative Work packet.",
     lifecycleRetryInstruction,
     "After a successful start, complete the assigned Work, write its required result, invoke its exact work finish command, then stop.",
+    acceptedResultInstruction,
     "Do not start another Work, create a child, change dependencies, ask the user, or treat a quiet sibling as failed. You cannot ask the user or pause the parent Stage. Missing facts go through this Work's declared result/failure contract; only the coordinator handles Stage HITL."
   ].join("\n");
 }
@@ -120,10 +125,11 @@ export function renderDelegationInstructions({ harness, stage, capacity, works =
     adapter.launch,
     "Retain the frozen coordinator model and reasoning for native children; do not choose a different model, reasoning level or permission mode.",
     "You are the coordinator. The JSON assignments below contain child-only messages, not instructions for you to execute. Pass each message verbatim as the native tool's task/message/prompt argument. For context=fresh, select empty conversation context before launch; if unavailable, report the limitation and stop. Use only fields exposed by your actual native tool schema; if the native tool is absent, report that error without substituting a shell command.",
-    "Every child must be a direct child of this current Session. Wait for all launched children to settle before returning. One failed child is evidence for the coordinator, not a reason to cancel its siblings.",
+    "Every child must be a direct child of this current Session. Wait while assigned Work remains in progress; once dd-flow has accepted all assigned results, return without waiting merely for native session retirement. One failed child is evidence for the coordinator, not a reason to cancel its siblings.",
     adapter.partial ?? "If a spawn is refused, stop issuing new spawns and retain every successful child handle. Wait for all already-launched children, then release completed children using the adapter's exposed native close/release mechanism when supported. A failed batch does not undo successful spawns. Report completed/launched assignments, assignments not launched and the exact refusal; never claim no children launched when any spawn succeeded. Return after this partial wave; the controller will issue remaining Work when capacity is available. Do not replay an ambiguous spawn.",
     "Do not finish this Stage, repair it, or start a successor in this Turn. Do not invent provider or internal session IDs; lifecycle evidence comes from the adapter.",
     adapter.wait,
+    acceptedResultInstruction,
     "Child assignments (JSON data):",
     JSON.stringify(assignments, null, 2)
   ].join("\n\n");
@@ -148,13 +154,14 @@ export function renderWaitInstructions({ harness, stage }) {
   return [
     `Native child Work for ${stage} is still running.`,
     adapter.wait,
+    acceptedResultInstruction,
     "Do not create a Session, Work, or additional child agent. Do not cancel siblings merely because one child failed, and do not finish this Stage."
   ].join("\n");
 }
 
 export function renderAdapterPolicy({ harness }) {
   const adapter = requireAdapter(harness);
-  return [adapter.launch, adapter.wait, "Lifecycle identity and completion must come from adapter observations; never synthesize provider or internal Session IDs."].join(" ");
+  return [adapter.launch, adapter.wait, "Native launch identity comes from adapter observations; never synthesize provider or internal Session IDs.", acceptedResultInstruction].join(" ");
 }
 
 export function renderRecoveryProbeInstructions({ harness, command }) {

package/dist/harness-runtime/lib/delivery-command.mjs

@@ -0,0 +1,84 @@
+import fs from 'node:fs';
+import process from 'node:process';
+import { spawn } from 'node:child_process';
+
+// Internal transport, not operation authorization. The RUN owner registers and
+// confirms this wrapper's PID/group, then releases stdin after its final fence.
+// fd3 privately carries fixed argv and only permitted environment values; these
+// resolved values never enter policy or persisted configuration. fd4 carries raw stdout to the
+// owner in memory. Public stdout/stderr never contain provider output or env.
+const outputLimit = 1024 * 1024;
+const text = value => typeof value === 'string' && value.length > 0 && value.length <= 16384 && !value.includes('\0');
+const id = value => typeof value === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/.test(value);
+const emit = value => process.stdout.write(`${JSON.stringify(value)}\n`);
+process.stdout.on('error', () => {}); // Observer loss is not command completion.
+process.stderr.on('error', () => {});
+async function bounded(stream, limit) {
+  const chunks = []; let bytes = 0;
+  for await (const chunk of stream) {
+    bytes += chunk.length;
+    if (bytes > limit) throw new Error('bounded_input');
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+let config = null, admitted = false, started = false;
+const result = (exitCode, signal, error, outputAvailable = true, truncated = false) => {
+  emit({ schema_id: 'dd-flow/delivery-command-result@1', operation_id: config?.operation_id ?? null,
+    step_id: config?.step_id ?? null, admitted, started, exit_code: exitCode, signal, error,
+    output_available: outputAvailable, stdout_truncated: truncated });
+  process.exitCode = error ? 1 : 0;
+};
+try {
+  const bytes = await bounded(fs.createReadStream('', { fd: 3, autoClose: true }), 3 * outputLimit);
+  const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+  if (!value || typeof value !== 'object' || Array.isArray(value)
+    || Object.keys(value).sort().join() !== 'argv,environment,operation_id,permitted_environment_variables,schema_id,step_id'
+    || value.schema_id !== 'dd-flow/delivery-command@1' || !id(value.operation_id) || !id(value.step_id)
+    || !Array.isArray(value.argv) || !value.argv.length || value.argv.length > 128 || !value.argv.every(text)
+    || !Array.isArray(value.permitted_environment_variables) || value.permitted_environment_variables.length > 128
+    || !value.permitted_environment_variables.every(name => typeof name === 'string' && /^[A-Z_][A-Z0-9_]*$/.test(name))
+    || new Set(value.permitted_environment_variables).size !== value.permitted_environment_variables.length
+    || !value.environment || typeof value.environment !== 'object' || Array.isArray(value.environment)
+    || Object.entries(value.environment).some(([name, content]) => !value.permitted_environment_variables.includes(name)
+      || typeof content !== 'string' || content.includes('\0') || content.length > 16384)) throw new Error('invalid_configuration');
+  // Fail before readiness if the private output channel was not installed.
+  const channel = fs.fstatSync(4);
+  if (!channel.isFIFO() && !channel.isSocket()) throw new Error('private_pipe_required');
+  fs.writeSync(4, Buffer.alloc(0));
+  config = value;
+  emit({ schema_id: 'dd-flow/delivery-command-ready@1', operation_id: config.operation_id, step_id: config.step_id });
+  const admission = await bounded(process.stdin, 32);
+  if (!admission.equals(Buffer.from('admitted\n'))) result(null, null, 'admission_missing');
+  else {
+    admitted = true;
+    const environment = { ...config.environment };
+    environment.DD_FLOW_DELIVERY_OPERATION_ID = config.operation_id;
+    environment.DD_FLOW_DELIVERY_STEP_ID = config.step_id;
+    const output = fs.createWriteStream('', { fd: 4, autoClose: true });
+    let available = true, truncated = false, count = 0;
+    const flushed = new Promise(resolve => { output.once('finish', resolve); output.on('error', () => { available = false; resolve(); }); });
+    const child = spawn(config.argv[0], config.argv.slice(1), { env: environment, shell: false, windowsHide: true,
+      detached: false, stdio: ['ignore', 'pipe', 'pipe'] });
+    started = Boolean(child.pid);
+    let spawnFailed = false;
+    child.once('error', () => { spawnFailed = true; });
+    child.stdout.on('error', () => { available = false; });
+    child.stderr.on('error', () => { available = false; });
+    child.stderr.resume(); // Never persist or echo authenticated stderr.
+    child.stdout.on('data', bytes => {
+      const remaining = Math.max(0, outputLimit - count);
+      if (bytes.length > remaining) truncated = true;
+      if (remaining && available) output.write(bytes.subarray(0, remaining));
+      count += bytes.length;
+    });
+    const completed = await new Promise(resolve => child.once('close', (code, signal) => resolve({ code, signal })));
+    output.end(); await flushed;
+    result(completed.code, completed.signal, spawnFailed ? 'spawn_failed' : !available ? 'private_output_unavailable'
+      : truncated ? 'output_limit_exceeded' : completed.code !== 0 || completed.signal ? 'command_failed' : null, available, truncated);
+  }
+} catch {
+  // Input may contain secrets accidentally. Never print it or an exception
+  // whose message/stack could contain an authenticated argv or raw payload.
+  result(null, null, admitted ? 'transport_failed' : 'configuration_or_admission_invalid', false);
+}