@deksden-com/dd-flow-cli 0.9.0-beta.152 → 0.9.0-beta.155

package/dist/harness-runtime/lib/dd-agy-daemon.mjs

@@ -3,27 +3,29 @@ import { SETUP_STARTUP_MS, startupObserver, observationDetails } from './setup-p
 import { callDaemonObserved } from './daemon-observation.mjs';
 import { operationProgressReporter } from './operation-progress.mjs';
 import { prepareDaemonRequest } from "./native-request-proof.mjs";
-import { inspectAgyNative, stopAgyNativeTree, ownedAgyEndpoint, readAgyNativeQualification, AGY_NATIVE_INSPECTION_CONTRACT } from './agy-native-inspection.mjs';
+import { inspectAgyNative, inspectAgyNativeState, stopAgyNativeTree, ownedAgyEndpoint, readAgyNativeQualification, AGY_NATIVE_INSPECTION_CONTRACT } from './agy-native-inspection.mjs';
+import { agyNativeInventory } from './agy-native-inventory.mjs';
 import { processSnapshot } from './process-snapshot.mjs';
 import { streamRequestKey } from './provider-overload-policy.mjs';
 import { captureDispatchGuard, cancelPendingDispatch } from "./dispatch-fence.mjs";
-import { errorRecord, isProvenShellCorrection } from "./operation-errors.mjs";
-import { ToolObservations, agyToolObservation, agyTranscriptObservations } from "./tool-observations.mjs";
+import { errorRecord } from "./operation-errors.mjs";
+import { ToolObservations, agyToolObservation, createAgyTranscriptObserver } from "./tool-observations.mjs";
+import { readAgyTranscriptSnapshot } from "./agy-transcript-stream.mjs";
 import { constants } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createHash, randomUUID } from "node:crypto";
-import { appendFile, chmod, lstat, mkdir, open, readFile, realpath, rename, unlink, writeFile } from "node:fs/promises";
+import { appendFile, chmod, lstat, mkdir, open, readFile, readdir, realpath, rename, unlink, writeFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import net from "node:net";
 import { isDeepStrictEqual } from "node:util";
 import { ObservationClock, observedTimeout, validateObservationDuration } from "./observation-clock.mjs";
-import { hookBudget } from "./native-hook-command.mjs";
+import { hookBudget, retainNativeWorkStart, isStandaloneWorkStart } from "./native-hook-command.mjs";
+import { parseLifecycleCommand } from "./lifecycle-command.mjs";
 import { agyWorkspaceHooks } from "./agy-hooks.mjs";
 import { durableDaemonDispatch, completeDaemonShutdown, assertDaemonDispatch, assertDaemonRestartable, trackDaemonConnections, retireDaemonEndpoint, retireFailedDaemon } from "./daemon-operations.mjs";
 import path from "node:path";
 import { observeModel } from "./model-observations.mjs";
 import { AGY_VERSION_TIMEOUT_MS, AgyError, agyTerminalFailure, agyModelArgs, assertProfile, executable, observedProfile, runAgy, usageSnapshot, managedAgyEnv } from "./dd-agy.mjs";
-import { recoveredAgyErrorBoundary } from "./agy-error-boundary.mjs";
 import { agyTerminalEnvelope } from "./agy-terminal-envelope.mjs";
 import { settledNativeTree, nativeExecutionReceipt } from "./native-children.mjs";
 import { retainStartupFailure, prepareRuntimeOwner, cleanupFailedStart, cleanupFailedDaemonStart, confirmDaemonProcess, confirmDaemonStopped, finishDaemonProcess, scheduleDaemonProcessHeartbeat, registerDaemonProcess, stopProcessGroup } from "./managed-daemon.mjs";
@@ -35,20 +37,22 @@ class DaemonError extends AgyError {}
 // classify services. This transcript format has no tool-call IDs: parallel
 // calls therefore retain unknown resources, never FIFO-derived authority.
 export function agyTranscriptFacts(text, source, sessionId) {
-  const children = [], resources = new Map(), calls = [];
-  const result = () => ({ children, resources: [...resources.values()] });
-  if (!source?.locator || !source?.sha256 || !sessionId) return result();
-  const lines = text.split('\n');
+  const reducer = createAgyTranscriptFacts(source, sessionId), lines = text.split('\n');
   for (let index = 0; index < lines.length; index++) {
     const line = lines[index];
     if (!line && index === lines.length - 1) continue;
     let event;
-    try { event = JSON.parse(line); } catch {
-      // A writer may have appended only part of the last record. Retain the
-      // valid prefix; a malformed newline-terminated record is a real gap.
-      return index === lines.length - 1 ? result() : { ...result(), gap: 'agy_transcript_invalid_record' };
-    }
-    if (!event || typeof event !== 'object' || Array.isArray(event)) return { ...result(), gap: 'agy_transcript_invalid_record' };
+    try { event = JSON.parse(line); } catch { if (index < lines.length - 1) reducer.gap(); break; }
+    reducer.add(event);
+  }
+  return reducer.finish();
+}
+export function createAgyTranscriptFacts(source, sessionId) {
+  const children = [], resources = new Map(), calls = [];
+  let invalid = false;
+  function add(event) {
+    if (invalid || !source?.locator || !source?.sha256 || !sessionId) return;
+    if (!event || typeof event !== 'object' || Array.isArray(event) || event.conversation_id && event.conversation_id !== sessionId) { invalid = true; return; }
     const content = typeof event.content === 'string' ? event.content : '';
     const native_source = { ...source, step_index: event.step_index };
     if (event.source === 'SYSTEM' && event.type === 'SYSTEM_MESSAGE' && event.status === 'DONE') {
@@ -57,11 +61,11 @@ export function agyTranscriptFacts(text, source, sessionId) {
         const prior = resources.get(terminal.task_id);
         if (prior) resources.set(prior.resource_id, mergeAgyResource(prior, { ...prior, state: 'stopped', ...(terminal.command_outcome ? { native_outcome: terminal.command_outcome } : {}), terminal_source: native_source }));
       }
-      continue;
+      return;
     }
-    if (event.source !== 'MODEL') continue;
-    if (event.type === 'PLANNER_RESPONSE') { calls.length = 0; if (Array.isArray(event.tool_calls) && event.tool_calls.length === 1) calls.push(event.tool_calls[0]); continue; }
-    if (event.type !== 'GENERIC') continue;
+    if (event.source !== 'MODEL') return;
+    if (event.type === 'PLANNER_RESPONSE') { calls.length = 0; if (Array.isArray(event.tool_calls) && event.tool_calls.length === 1) calls.push(event.tool_calls[0]); return; }
+    if (event.type !== 'GENERIC') return;
     const call = calls.shift();
     if (call?.name === 'manage_task' && event.status === 'DONE') {
       const terminal = agyTerminalEnvelope(event, call), prior = resources.get(terminal?.task_id);
@@ -69,22 +73,22 @@ export function agyTranscriptFacts(text, source, sessionId) {
     }
     if (call?.name === 'invoke_subagent' && event.status === 'DONE') {
       const match = content.match(/^Created At: [^\n]+\nCompleted At: [^\n]+\nCreated the following subagent:\n(\{[\s\S]*?\})\nThe subagent will send you a message/);
-      if (!match) continue;
+      if (!match) return;
       try {
         const child = JSON.parse(match[1]);
         if (/^[\w-]+$/.test(child.conversationId) && typeof child.logAbsoluteUri === 'string') children.push({ provider_session_id: child.conversationId, parent_provider_session_id: sessionId, log_uri: child.logAbsoluteUri, workspace_uris: child.workspaceUris ?? [], status: 'unknown', native_source });
       } catch { /* No partial/guessed native edge. */ }
     }
-    if (event.status !== 'RUNNING') continue;
+    if (event.status !== 'RUNNING') return;
     const task = content.match(/^Created At: [^\n]+\nTool is running as a background task with task id: ([\w-]+\/task-\d+)\n/);
-    if (!task || !task[1].startsWith(`${sessionId}/`)) continue;
+    if (!task || !task[1].startsWith(`${sessionId}/`)) return;
     let daemon = call?.name === 'run_command' ? call.args?.IsDaemon : null;
     if (typeof daemon === 'string') { try { daemon = JSON.parse(daemon); } catch { daemon = null; } }
-    const resource = { resource_id: task[1], provider_session_id: sessionId, classification: daemon === true ? 'support_service' : daemon === false ? 'required_work' : 'unknown', state: 'unknown', native_source,
+    const resource = { resource_id: task[1], provider_session_id: sessionId, ...(call?.name === 'schedule' ? { kind: 'schedule' } : {}), classification: daemon === true ? 'support_service' : daemon === false ? 'required_work' : 'unknown', state: 'unknown', native_source,
       ...(typeof daemon === 'boolean' ? { native_classification: { tool: 'run_command', IsDaemon: daemon } } : {}) };
     resources.set(resource.resource_id, mergeAgyResource(resources.get(resource.resource_id), resource));
   }
-  return result();
+  return { add, gap: () => { invalid = true; }, finish: () => ({ children, resources: [...resources.values()], ...(invalid ? { gap: 'agy_transcript_invalid_record' } : {}) }) };
 }
 export function mergeAgyResource(prior, next) {
   if (!prior) return next;
@@ -104,7 +108,7 @@ export function mergeAgyResource(prior, next) {
   return { ...prior, ...next };
 }
 export const agyTranscriptResources = (text, source, sessionId) => agyTranscriptFacts(text, source, sessionId).resources;
-export async function captureAgyTranscript(runtimeRoot, child, rootSessionId, ownedSessionIds = [rootSessionId], inspect = null) {
+export async function captureAgyTranscript(runtimeRoot, child, rootSessionId, ownedSessionIds = [rootSessionId], inspect = null, onProgress = null) {
   const session = { harness_id: "antigravity-cli", session_id: child.provider_session_id };
   let handle;
   try {
@@ -117,15 +121,20 @@ export async function captureAgyTranscript(runtimeRoot, child, rootSessionId, ow
     handle = await open(expected, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
     const stat = await handle.stat();
     if (!before.isFile() || !stat.isFile() || stat.dev !== before.dev || stat.ino !== before.ino || await realpath(expected) !== canonical) throw new Error("native locator changed during open");
-    const maximum = 8 * 1024 * 1024, buffer = Buffer.alloc(Math.min(stat.size, maximum));
-    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
-    const bytes = buffer.subarray(0, bytesRead), prefix = bytes.subarray(0, bytes.lastIndexOf(10) + 1);
-    const source = { locator: child.log_uri, byte_start: 0, byte_end: prefix.length, sha256: createHash("sha256").update(prefix).digest("hex") };
-    if (prefix.length === bytesRead && stat.size <= maximum) inspect?.(prefix.toString("utf8"), source);
-    const events = agyTranscriptObservations(prefix.toString("utf8"), child.provider_session_id, child.parent_provider_session_id ?? rootSessionId, source);
-    if (prefix.length !== bytesRead || stat.size > maximum) events.push({ session, reason: stat.size > maximum ? "agy_transcript_size_limit" : "agy_transcript_partial_tail" });
+    let observer, inspector;
+    const snapshot = await readAgyTranscriptSnapshot(handle, { locator: child.log_uri, onProgress,
+      assertIdentity: async current => { const pathStat = await lstat(expected); if (!pathStat.isFile() || current.dev !== pathStat.dev || current.ino !== pathStat.ino || await realpath(expected) !== canonical) throw new Error('native locator changed during read'); },
+      onRecord: (record, { line, ...source }) => {
+        observer ??= createAgyTranscriptObserver(child.provider_session_id, child.parent_provider_session_id ?? rootSessionId, source);
+        inspector ??= inspect?.(source);
+        observer.add(record, line); inspector?.add(record);
+      } });
+    observer ??= createAgyTranscriptObserver(child.provider_session_id, child.parent_provider_session_id ?? rootSessionId, snapshot.source);
+    if (!snapshot.partial_tail) inspector?.finish();
+    const events = observer.finish();
+    if (snapshot.partial_tail) events.push({ session, reason: "agy_transcript_partial_tail" });
     return events;
-  } catch (error) { return [{ session, reason: error.code === "ENOENT" ? "agy_transcript_missing" : "agy_transcript_locator_rejected" }]; }
+  } catch (error) { return [{ session, reason: error.code === "ENOENT" ? "agy_transcript_missing" : error.message === 'agy_transcript_invalid_record' ? 'agy_transcript_invalid_record' : "agy_transcript_locator_rejected" }]; }
   finally { await handle?.close(); }
 }
 const absolute = (value, label) => { if (!value || !path.isAbsolute(value)) throw new DaemonError("invalid_path", `${label} must be an absolute path`); return path.resolve(value); };
@@ -141,6 +150,7 @@ async function readState(dir) { try { return JSON.parse(await readFile(locations
 async function removeSocket(paths) { try { if (!(await lstat(paths.socket)).isSocket()) throw new DaemonError("unsafe_socket", "refusing to replace a non-socket daemon path"); await unlink(paths.socket); } catch (error) { if (error.code !== "ENOENT") throw error; } }
 const shell = value => `'${String(value).replaceAll("'", `'"'"'`)}'`;
 export function sanitizedEnv(config) { const env = { ...process.env, TMPDIR: config.temporary, DD_AGY_HOOK_NODE: process.execPath, DD_AGY_HOOK_ENTRY: config.entryPath, DD_AGY_STATE_DIR: config.stateDir, DD_AGY_DAEMON_ID: config.daemonId }; for (const key of ["GEMINI_API_KEY","GOOGLE_API_KEY","ANTHROPIC_API_KEY","OPENAI_API_KEY"]) env[key] = undefined; return managedAgyEnv({ ...env, ...managedFlowEnv(config) }); }
+
 const errorPayload = errorRecord;
 async function forwardUsage(config, sessionId, result, tools, descendants) {
   if (!config.ddFlowBin || !config.projectRoot) return;
@@ -328,7 +338,7 @@ export class Runtime {
     if (!current) return;
     const key = createHash("sha256").update(JSON.stringify({ conversation_id: result.conversation_id ?? this.init?.conversation_id, status: result.status, num_turns: result.num_turns, error: result.error, response: result.response ?? result.text })).digest("hex");
     current.terminalProgress ??= new Set();
-    if (current.terminalProgress.has(key) || current.terminalProgress.size >= 1_024) return;
+    if (current.terminalProgress.has(key)) return;
     current.terminalProgress.add(key); this.markActivity();
   }
   observeProviderActivity(event) {
@@ -353,8 +363,7 @@ export class Runtime {
     const snapshots = prior?.index === index ? prior.seen : new Set();
     if (snapshots.has(fingerprint)) return;
     // Native step snapshots can alternate/replay; scope retained dedup to the
-    // current step. Too many unique snapshots becomes uncertain, never a grant.
-    if (snapshots.size >= 1_024) return;
+    // current step. Unique later updates remain useful activity at any size.
     snapshots.add(fingerprint); this.progressSteps.set(id, { index, seen: snapshots }); this.invalidateSettlement(id); this.markActivity();
   }
   async start(sessionId = null) {
@@ -463,7 +472,7 @@ export class Runtime {
     }
   }
   toolSnapshot() { const summary = this.toolObservations.summary(); const failures_by_name = {}; for (const event of this.toolObservations.calls.values()) if (event.status === "failed") failures_by_name[event.name] = (failures_by_name[event.name] ?? 0) + 1; return { ...summary, by_name: summary.by_tool, failures_by_name }; }
-  async captureChildTools() {
+  async captureChildTools(onProgress = null) {
     this.capturedToolFacts ??= new Map();
     this.nativeResources ??= new Map(this.state.native_resources_entries?.map(item => [item.resource_id, item]) ?? []);
     const root = this.init?.conversation_id ?? this.state.sessions?.[0]?.provider_session_id ?? this.lastResult?.conversation_id;
@@ -478,8 +487,10 @@ export class Runtime {
         ancestors.add(parent); parent = this.descendants.get(parent).parent_provider_session_id;
       }
       const events = parent === root && root
-        ? await captureAgyTranscript(this.paths.runtime, child, root, [root, ...ancestors], (text, source) => {
-          const facts = agyTranscriptFacts(text, source, child.provider_session_id);
+        ? await captureAgyTranscript(this.paths.runtime, child, root, [root, ...ancestors], source => {
+          const reducer = createAgyTranscriptFacts(source, child.provider_session_id);
+          return { add: reducer.add, finish: () => {
+          const facts = reducer.finish();
           for (const resource of facts.resources) this.nativeResources.set(resource.resource_id, mergeAgyResource(this.nativeResources.get(resource.resource_id), resource));
           if (facts.gap) { this.state.native_topology_error = facts.gap; this.invalidateSettlement(root); }
           for (const discovered of facts.children) {
@@ -497,7 +508,8 @@ export class Runtime {
             this.descendants.set(value.provider_session_id, value);
             queue.push(value);
           }
-        })
+          } };
+        }, onProgress && (cursor => onProgress(`${child.provider_session_id}:${cursor}`)))
         : [{ session: { harness_id: "antigravity-cli", session_id: child.provider_session_id }, reason: "agy_transcript_ancestry_unproven" }];
       for (const event of events) {
         this.toolObservations.add(event);
@@ -542,10 +554,7 @@ export class Runtime {
       return;
     }
     this.lastResult = result; this.markTerminalActivity(result);
-    const rootStop = this.sessionObservations.get(this.init?.conversation_id)?.stop;
-    const pendingTerminal = current && result.status === "SUCCESS";
     if (current) { current.terminalResult = result; current.terminalMetadata = terminalMetadata; current.terminalPersisted = false; }
-    if (pendingTerminal && rootStop?.source_bound === true && rootStop.fullyIdle === true) for (const [id, descendant] of this.descendants) if (descendant.status === "unknown") this.descendants.set(id, { ...descendant, status: "settled_by_root", settlement_evidence: "root_fully_idle_stop" });
     this.state.terminal_observation_pending = true;
     try {
       await this.persist({ active_tree: true, last_result: result, last_terminal_metadata: terminalMetadata });
@@ -571,14 +580,6 @@ export class Runtime {
       if (this.active !== current) return;
       this.active = null;
       const settled = this.receipt().settled;
-      if (result.status === "ERROR" && settled && rootStop?.fullyIdle === true && !this.state.last_hook_rejection && current.operationId && this.paths.runtime) {
-        const root = this.init.conversation_id, transcript = path.join(this.paths.runtime, "brain", root, ".system_generated", "logs", "transcript.jsonl");
-        await captureAgyTranscript(this.paths.runtime, { provider_session_id: root, parent_provider_session_id: root, log_uri: new URL(`file://${transcript}`).href }, root, [root], (text, source) => {
-          const boundary = recoveredAgyErrorBoundary(text, result.error, current.stepFloor, source, root);
-          const hook = current.nativeHookEvents?.get(boundary?.invocation_step ?? boundary?.boundary_step);
-          if (boundary && hook) terminalMetadata.recovered_error_boundary = { ...boundary, receipt: { ...boundary.receipt, native_hook_event_key: hook, daemon_instance: this.config.daemonId }, source };
-        });
-      }
       this.lastTerminalFailure = agyTerminalFailure(result, { ...terminalMetadata, native_turn_items: { observed: settled, possible_effects: true, pending: !settled }, provider_error_scope: "terminal_result", usage_ingest: this.usageIngest });
       try { await this.persist({ active_tree: !settled, last_terminal_failure: errorRecord(this.lastTerminalFailure) }); }
       catch (error) { return this.failTerminalObservation(current, result, terminalMetadata, error); }
@@ -602,6 +603,17 @@ export class Runtime {
     this.active = null;
     current.resolve(receipt);
   }
+  reconcilePendingHook(current) {
+    if (!current || this.active !== current) return Promise.resolve();
+    if (current.hookReconciliation) return current.hookReconciliation;
+    if (!current.pendingHookReconciliation) return Promise.resolve();
+    current.pendingHookReconciliation = false;
+    current.hookReconciliation = this.completePendingTurn().catch(error => {
+      current.observationError ??= error;
+      if (this.active === current) { this.drainingError ??= error; current.reject(error); }
+    }).finally(() => { current.hookReconciliation = null; });
+    return current.hookReconciliation;
+  }
   failTerminalObservation(current, result, metadata, cause) {
     this.state.terminal_observation_pending = true;
     const details = { ...metadata, native_outcome: result, settled: false, terminal_persisted: current?.terminalPersisted === true, observation_error: errorRecord(cause), native_turn_items: { observed: false, possible_effects: true, pending: true } };
@@ -712,7 +724,6 @@ export class Runtime {
     // proof (or verified prior clean retirement before new activity) closes it.
     const retained = this.state.retained_tree_settlement;
     const rootSettled = this.nativeProof?.turn_generation === this.turnGeneration && this.nativeProof.connection_id === this.connectionId && this.nativeProof.revision === (this.nativeRevision ?? 0)
-      || observation?.stop?.source_bound === true && observation.stop?.fullyIdle === true && observation.stop.generation === this.turnGeneration
       || retained?.evidence === "verified_clean_daemon_shutdown" && retained.session_id === root && retained.turn_generation === this.turnGeneration && !this.child;
     const terminalPending = this.active?.terminalResult === result;
     // A positively inspected owned scope before its first Turn has no model
@@ -724,7 +735,8 @@ export class Runtime {
     if (clock) clock.sample(this.progress);
     const exhausted = clock && (clock.observationLost || clock.elapsed >= clock.timeoutMs);
     const nativeSettlement = { confirmed: Boolean(settled), state: settled ? 'ready' : exhausted ? 'unproven' : this.nativeInspection?.state ?? 'unproven', reason: settled ? 'current_root_idle_proven' : exhausted ? 'observation_budget_exhausted' : this.nativeInspection?.reason ?? 'current_root_idle_proof_missing', capability: AGY_NATIVE_INSPECTION_CONTRACT, operation_id: terminalMetadata?.request_proof?.operation_id, request_key: streamRequestKey(terminalMetadata?.request_proof), provider_session_id: root, daemon_instance: this.config.daemonId, connection_epoch: this.connectionId, generation: this.turnGeneration, ...(this.nativeProof ? { source: this.nativeProof.source, method: this.nativeProof.method, proof_sha256: createHash('sha256').update(JSON.stringify(this.nativeProof)).digest('hex') } : {}), ...(clock ? { observation_clock: clock.state() } : {}) };
-    return nativeExecutionReceipt({ harness: "antigravity-cli", runtime_family: "antigravity", provider_session_id: root ?? null, adapter_session_id: root ?? null, cwd: this.config.cwd, profile: this.profile, result, ...(terminalMetadata ? { terminal_metadata: terminalMetadata, ...(terminalMetadata.turn_id ? { terminal_turn_id: terminalMetadata.turn_id } : {}) } : {}), ...(assistantText === null ? {} : { assistant_text: assistantText }), usage: usageSnapshot(result ?? {}, this.toolSnapshot()), usage_ingest: this.usageIngest, descendants: [...this.descendants.values()], ...settledNativeTree(root, [...this.descendants.values()], settled, !this.state.unclaimed_activity && (!this.active || terminalPending) && rootSettled && ["SUCCESS", "ERROR", "CANCELLED"].includes(result?.status)), native_turn_items: { observed: Boolean(terminalMetadata?.request_proof), possible_effects: true, pending: !settled, settled, ...(terminalMetadata?.request_proof ? { request_proof: terminalMetadata.request_proof } : {}) }, transcript_path: observation?.transcript_path ?? null, settled, native_settled: settled, physical_stopped: this.exited === true, native_settlement: nativeSettlement, }, { daemonId: this.config.daemonId, generation: this.turnGeneration, revision: this.nativeRevision ?? 0, resources: { coverage: "partial", entries: [...(this.nativeResources?.values() ?? this.state.native_resources_entries ?? [])] } });
+    const hookDiagnostics = (this.state.native_hook_diagnostics ?? []).filter(item => item.turn_generation === this.turnGeneration);
+    return nativeExecutionReceipt({ harness: "antigravity-cli", runtime_family: "antigravity", provider_session_id: root ?? null, adapter_session_id: root ?? null, cwd: this.config.cwd, profile: this.profile, result, ...(terminalMetadata ? { terminal_metadata: terminalMetadata, ...(terminalMetadata.turn_id ? { terminal_turn_id: terminalMetadata.turn_id } : {}) } : {}), ...(assistantText === null ? {} : { assistant_text: assistantText }), ...(hookDiagnostics.length ? { native_hook_diagnostics: hookDiagnostics } : {}), usage: usageSnapshot(result ?? {}, this.toolSnapshot()), usage_ingest: this.usageIngest, descendants: [...this.descendants.values()], ...settledNativeTree(root, [...this.descendants.values()], settled, !this.state.unclaimed_activity && (!this.active || terminalPending) && rootSettled && ["SUCCESS", "ERROR", "CANCELLED"].includes(result?.status)), native_turn_items: { observed: Boolean(terminalMetadata?.request_proof), possible_effects: true, pending: !settled, settled, ...(terminalMetadata?.request_proof ? { request_proof: terminalMetadata.request_proof } : {}) }, transcript_path: observation?.transcript_path ?? null, settled, native_settled: settled, physical_stopped: this.exited === true, native_settlement: nativeSettlement, }, { daemonId: this.config.daemonId, generation: this.turnGeneration, revision: this.nativeRevision ?? 0, resources: { coverage: "partial", entries: [...(this.nativeResources?.values() ?? this.state.native_resources_entries ?? [])], ...(this.state.native_retirement_notifications?.length ? { pending_notifications: this.state.native_retirement_notifications } : {}) } });
   }
   async zeroUsage() { await forwardUsage(this.config, this.init.conversation_id, { usage: {} }, this.toolSnapshot(), []); }
   async prompt(text, assertDispatch = captureDispatchGuard(this), operationId = null, livenessTimeoutMs = 1_800_000) {
@@ -735,14 +747,13 @@ export class Runtime {
     if (!this.nativeObserver && !this.nativeQualification?.qualified) throw new DaemonError('agy_native_inspection_unqualified', 'AGY whole-tree inspection requires a matching native qualification receipt before productive dispatch', false, { capability: AGY_NATIVE_INSPECTION_CONTRACT });
     await this.reconcileRetainedAdmission();
     if (this.active || this.promptObservation) throw new DaemonError("operation_in_progress", "an Antigravity turn or its mandatory dispatch observation is already running");
-    if (this.state.last_hook_rejection && !this.receipt().settled) throw new DaemonError("tree_not_settled", "Rejected hook does not prove that the prior Antigravity tree stopped", false, { primary_error: this.state.last_hook_rejection });
-    if (this.state.unclaimed_activity || (this.lastResult && !this.receipt().settled)) throw new DaemonError("tree_not_settled", "the prior Antigravity agent tree is not fully settled");
+    if (this.state.unclaimed_activity || ((this.state.active_tree || this.lastResult) && !this.receipt().settled)) throw new DaemonError("tree_not_settled", "the prior Antigravity agent tree is not fully settled");
     let resolveTurn, rejectTurn;
     const reply = new Promise((resolve, reject) => { resolveTurn = resolve; rejectTurn = reject; });
     // Cancellation can reject while admission persistence is still pending.
     void reply.catch(() => {});
     this.connectionId ??= randomUUID();
-    const current = { resolve: resolveTurn, reject: rejectTurn, generation: ++this.turnGeneration, operationId, connectionId: this.connectionId, dispatched: false };
+    const current = { resolve: resolveTurn, reject: rejectTurn, generation: ++this.turnGeneration, operationId, connectionId: this.connectionId, dispatched: false, guard: assertDispatch };
     this.nativeAbort?.abort(); this.nativeProof = null; this.nativeInspection = null;
     current.clock = new ObservationClock({ timeoutMs: livenessTimeoutMs, onGap: gap => { void this.journal('observation_gap', { gap, operation_id: operationId }).catch(() => {}); } });
     this.observationEpisode = current;
@@ -756,11 +767,15 @@ export class Runtime {
     // Reserve before persistence so different operation IDs cannot overlap.
     current.publishProgress = operationProgressReporter();
     this.active = current;
-    this.hookRequests = new Map();
+    this.lastNativeHookOperation = current;
+    // A callback's failure receipt may arrive after its Turn has returned.
+    // Keep its accepted request identity; it is an observation binding, not
+    // proof of which native Turn originally produced the callback.
+    this.hookRequests ??= new Map();
     const root = this.init?.conversation_id, prior = this.sessionObservations.get(root) ?? {};
     current.stepFloor = prior.last_step_index ?? -1;
     this.sessionObservations.set(root, { ...prior, step_floor: prior.last_step_index ?? null, stop: null, last_hook: null });
-    this.lastProviderEvent = null; this.progressSteps = new Map(); this.progressHooks = new Set(); this.progress = undefined;
+    this.lastProviderEvent = null; this.progressSteps = new Map(); this.progressHooks = new Map(); this.progress = undefined;
     try {
       await this.persist({ active_tree: true, last_hook_rejection: null });
       assertDispatch();
@@ -783,7 +798,15 @@ export class Runtime {
     const clock = current.clock;
     let checking = false;
     const timer = setInterval(() => {
+      if (this.active === current && [...(this.hookRequests?.values() ?? [])].some(binding => binding.current && binding.current !== current)) {
+        void this.observeHookFailures().catch(() => { /* Retry the same retained request on the next observation. */ });
+      }
       if (this.active === current && current.terminalResult && this.nativeInspection?.state === 'inspection_pending' && !this.nativeFlight) this.queueNativeInspection();
+      if (this.active === current && current.pendingHookReconciliation && !checking) {
+        checking = true;
+        void this.reconcilePendingHook(current).finally(() => { checking = false; });
+        return;
+      }
       if (this.active !== current || checking || !clock.sample(this.progress)) return;
       checking = true; const cursor = this.progress?.cursor;
       void this.completePendingTurn().then(() => {
@@ -856,56 +879,169 @@ export class Runtime {
       if (observation?.stop) this.sessionObservations.set(id, { ...observation, stop: null });
     }
   }
-  async childForHook(conversationId) {
+  qualifiedChildForHook(conversationId) {
+    // A fully source-bound in-memory ancestry is already the result of the
+    // observation loop. Avoid re-reading every transcript on each child hook.
+    const retained = this.descendants.get(conversationId), seenRetained = new Set();
+    let node = retained, expected = conversationId, qualified = Boolean(node && !this.state.native_topology_error);
+    while (qualified) {
+      const source = node?.native_source, parent = node?.parent_provider_session_id;
+      let sourceBound = source?.kind === 'agy.step_update.subagent_info'
+        && source.parent_provider_session_id === parent && Number.isSafeInteger(source.step_index) && source.step_index >= 0;
+      if (!sourceBound && typeof source?.locator === 'string' && /^[a-f0-9]{64}$/.test(source?.sha256 ?? '') && typeof parent === 'string') {
+        try {
+          const locator = fileURLToPath(source.locator);
+          sourceBound = locator.endsWith(path.sep + path.join('brain', parent, '.system_generated', 'logs', 'transcript.jsonl'));
+        } catch { /* An invalid locator never grants a fast-path identity. */ }
+      }
+      if (!node || node.provider_session_id !== expected || !sourceBound || !parent || seenRetained.has(expected)
+        || source.parent_provider_session_id && source.parent_provider_session_id !== parent) { qualified = false; break; }
+      seenRetained.add(node.provider_session_id);
+      if (parent === this.init?.conversation_id) break;
+      expected = parent;
+      node = this.descendants.get(parent);
+      if (!node) qualified = false;
+    }
+    return qualified ? retained : null;
+  }
+  async childForHook(conversationId, onProgress = null) {
     if (conversationId === this.init?.conversation_id) return null;
-    await this.captureChildTools();
+    const retained = this.qualifiedChildForHook(conversationId);
+    if (retained) return retained;
+    await this.captureChildTools(onProgress);
     const deadline = Date.now() + 1_000;
-    while (!this.descendants.has(conversationId) && Date.now() < deadline) { await new Promise(resolve => setTimeout(resolve, 25)); await this.captureChildTools(); }
+    while (!this.descendants.has(conversationId) && Date.now() < deadline) { await new Promise(resolve => setTimeout(resolve, 25)); await this.captureChildTools(onProgress); }
     const child = this.descendants.get(conversationId);
     if (!child) throw new DaemonError("agy_child_identity_unconfirmed", "Antigravity hook has no confirmed native parent", true, { conversation_id: conversationId });
     const seen = new Set([conversationId]); let current = child;
-    while (current.parent_provider_session_id !== this.init?.conversation_id) {
+    for (;;) {
+      if (this.state.native_topology_error || current.native_source?.parent_provider_session_id && current.native_source.parent_provider_session_id !== current.parent_provider_session_id)
+        throw new DaemonError("agy_child_parent_unqualified", "Antigravity native ancestry is contradictory");
+      if (current.parent_provider_session_id === this.init?.conversation_id) break;
       const parent = this.descendants.get(current.parent_provider_session_id);
-      if (this.state.native_topology_error || !current.native_source || !parent || seen.has(parent.provider_session_id)) throw new DaemonError("agy_child_parent_unqualified", "Antigravity worker has no source-bound ancestry to the controlled Session", false, { conversation_id: conversationId, parent_conversation_id: current.parent_provider_session_id });
+      if (!current.native_source || !parent || seen.has(parent.provider_session_id)) throw new DaemonError("agy_child_parent_unqualified", "Antigravity worker has no source-bound ancestry to the controlled Session", false, { conversation_id: conversationId, parent_conversation_id: current.parent_provider_session_id });
       seen.add(parent.provider_session_id); current = parent;
     }
     if (this.state.native_topology_error) throw new DaemonError("agy_child_parent_unqualified", "Antigravity native ancestry is contradictory");
     return child;
   }
-  async rejectHook(error, event, payload, current = this.active) {
-    if (current && this.active !== current) return;
-    const correctable = current && event === "PreToolUse" && isProvenShellCorrection(error);
-    if (correctable && current.hookCorrectionGeneration !== current.generation) {
-      // The request was correlated with this still-active Turn by
-      // observeHookFailures. Persist before allowing native same-Turn recovery.
-      const correction = { code: error.code, message: error.message, details: error.details, event, conversation_id: payload.conversationId ?? null,
-        daemon_id: this.config.daemonId, operation_id: current.operationId, turn_generation: current.generation };
-      try {
-        await hookBudget(1_000, null).run(async () => { await this.journal("hook_correction", { correction }); await this.persist({ last_hook_correction: correction }); }, "correction_persistence");
-        current.hookCorrectionGeneration = current.generation;
-        return;
-      } catch (storage) { error = Object.assign(new Error("Could not persist native hook correction"), { code: "native_hook_receipt_invalid", details: { effect: "unknown", primary_error: correction, receipt_error: storage.message } }); }
+  async registerWorkStart(event, payload, callbackRequestId = null) {
+    if (event !== "PreToolUse" || !this.config.runtime_owner || !this.config.ddFlowBin || !this.init?.conversation_id
+      || typeof payload.conversationId !== "string" || !payload.conversationId
+      || !Number.isSafeInteger(payload.stepIdx) || payload.stepIdx < 0
+      || payload.executionNum !== undefined && (!Number.isSafeInteger(payload.executionNum) || payload.executionNum < 0)
+      || !["run_command", "run_terminal_command", "RunTerminalCommand"].includes(payload.toolCall?.name)) return null;
+    const input = payload.toolCall?.args ?? {}, command = input.command ?? input.cmd ?? input.CommandLine;
+    if (!isStandaloneWorkStart(command)) return null;
+    assertDaemonDispatch(this.paths.dir);
+    const tool = createHash("sha256").update(JSON.stringify([this.config.daemonId, payload.conversationId, payload.stepIdx, payload.executionNum ?? null, event])).digest("hex");
+    this.retainedWorkStarts ??= new Map();
+    this.retainedWorkActivity ??= new Set();
+    if (!this.retainedWorkActivity.has(tool)) {
+      this.retainedWorkActivity.add(tool);
+      // A callback is activity even before its ancestry is published. It
+      // invalidates old idle, but cannot identify or finish a creator prompt.
+      this.childActivity(payload.conversationId);
     }
-    const rejection = this.state.last_hook_rejection && this.state.last_hook_rejection.turn_generation === current?.generation ? this.state.last_hook_rejection : { code: error.code ?? "agy_hook_rejected", message: error.message ?? String(error), details: error.details, event, conversation_id: payload.conversationId ?? null, tool: payload.toolCall?.name ?? null, daemon_id: this.config.daemonId, operation_id: current?.operationId ?? null, turn_generation: current?.generation ?? null };
-    this.state.last_hook_rejection = rejection;
-    if (current && this.active === current) { this.active = null; current.reject(new DaemonError(rejection.code, rejection.message, false, rejection)); }
-    try { await hookBudget(1_000, null).run(async () => { await this.journal("hook_rejected", { rejection }); await this.persist({ last_hook_rejection: rejection }); }, "failure_persistence"); }
-    catch (storageError) { rejection.receipt_error = { code: storageError.code, message: storageError.message }; }
+    return await retainNativeWorkStart(this.paths.dir, { daemon_id: this.config.daemonId, source_harness: "antigravity-cli",
+      root_provider_session_id: this.init.conversation_id, provider_session_id: payload.conversationId, parent_provider_session_id: null,
+      tool_call_id: tool, event, native_command: command, native_cwd: this.config.cwd,
+      ...(callbackRequestId ? { callback_request_id: callbackRequestId } : {}),
+      native_payload: { schema_id: "dd-flow/agy-tool-event@1", event_id: tool, phase: "before", daemon_id: this.config.daemonId,
+        launch_cwd: this.config.cwd, conversation_id: payload.conversationId, execution_num: payload.executionNum, step_index: payload.stepIdx,
+        tool: payload.toolCall.name, input, workspace_paths: payload.workspacePaths, transcript_path: payload.transcriptPath,
+        profile: payload.model ? observedProfile(payload) : {} } }, this.active ?? this.lastNativeHookOperation, this.retainedWorkStarts);
+  }
+  async verifyWorkStart(params) {
+    const retained = this.retainedWorkStarts?.get(params.requestId);
+    if (!retained || !isDeepStrictEqual(retained.binding, params.binding)) throw new DaemonError("native_hook_unproven", "Unknown native Work start callback");
+    retained.guard(); assertDaemonDispatch(this.paths.dir);
+    if (retained.binding.root_provider_session_id !== this.init?.conversation_id) throw new DaemonError("native_hook_unproven", "Native Work start root changed");
+    const publish = operationProgressReporter();
+    const child = await this.childForHook(retained.binding.provider_session_id,
+      cursor => publish('verification_progress', { native_request_id: cursor, session_id: retained.binding.provider_session_id }));
+    if (retained.binding.provider_session_id !== this.init.conversation_id && this.qualifiedChildForHook(retained.binding.provider_session_id) !== child)
+      throw new DaemonError("native_hook_unproven", "Native Work start child has no source-bound ancestry");
+    retained.guard();
+    const parent = child?.parent_provider_session_id ?? null;
+    const verified = { ...retained.binding, parent_provider_session_id: parent, native_ancestry: "confirmed",
+      native_payload: { ...retained.binding.native_payload, parent_conversation_id: parent } };
+    if (retained.binding.callback_request_id) this.hookRequests?.delete(retained.binding.callback_request_id);
+    return { verified: true, registeredHookBinding: retained.binding, nativeHookBinding: verified };
+  }
+  async recordUnconfirmedHookFailure(error, event, payload, observer, requestId = null) {
+    // The request was observed while this operation was active, but AGY does
+    // not expose the native creator Turn. Preserve the refusal without
+    // attributing it to (or aborting) this potentially unrelated prompt.
+    const key = typeof requestId === 'string' && /^[A-Za-z0-9-]{1,128}$/.test(requestId) ? requestId : null;
+    const scope = key && JSON.stringify([key, observer?.operationId ?? null, observer?.generation ?? null]);
+    this.unconfirmedHookFlights ??= new Map();
+    if (scope && this.unconfirmedHookFlights.has(scope)) return await this.unconfirmedHookFlights.get(scope);
+    const flight = (async () => {
+      let diagnostic = key && (this.state.native_hook_diagnostics ?? []).find(item => item.request_id === key
+        && item.operation_id === (observer?.operationId ?? null) && item.turn_generation === (observer?.generation ?? null));
+      try {
+        if (!diagnostic) {
+          diagnostic = { code: 'native_hook_failed', message: 'Native hook failed without a verified creator Turn',
+            ...(key ? { request_id: key } : {}), primary_error: errorRecord(error), event, conversation_id: payload.conversationId ?? null,
+            daemon_id: this.config.daemonId, operation_id: observer?.operationId ?? null,
+            turn_generation: observer?.generation ?? null, native_creator: 'unconfirmed' };
+          // Do not grow in-memory state when durable journal writing fails.
+          await this.journal('unconfirmed_hook_failure', diagnostic);
+          this.state.native_hook_diagnostics = [...(this.state.native_hook_diagnostics ?? []), diagnostic];
+        }
+        await this.persist(); return true;
+      } catch { return false; /* Optional diagnostic cannot erase a native operation. */ }
+    })();
+    if (scope) this.unconfirmedHookFlights.set(scope, flight);
+    try { return await flight; }
+    finally { if (scope && this.unconfirmedHookFlights.get(scope) === flight) this.unconfirmedHookFlights.delete(scope); }
   }
   async observeHookFailures() {
-    for (const [requestId, binding] of this.hookRequests ?? []) {
-      if (binding.current !== this.active || !this.active) continue;
-      let failure;
-      try { failure = JSON.parse(await readFile(path.join(this.paths.dir, "hook-failures", `${requestId}.json`), "utf8")); }
-      catch (error) { if (error.code === "ENOENT") continue; failure = { code: "native_hook_receipt_invalid", message: error.message }; }
-      if (failure.request_id !== undefined && failure.request_id !== requestId) continue;
-      this.hookRequests.delete(requestId);
-      await this.rejectHook(Object.assign(new Error(failure.message ?? "Native hook failed"), { code: failure.code, details: failure.details }), binding.event, binding.payload, binding.current);
-    }
+    if (!this.hookRequests?.size) return;
+    if (this.hookFailuresFlight) return await this.hookFailuresFlight;
+    const flight = (async () => {
+      let names;
+      try { names = new Set(await readdir(path.join(this.paths.dir, "hook-failures"))); }
+      catch (error) { if (error.code === "ENOENT") return; throw error; }
+      for (const [requestId, binding] of this.hookRequests ?? []) {
+        if (!binding.current || !names.has(`${requestId}.json`)) continue;
+        let failure;
+        try { failure = JSON.parse(await readFile(path.join(this.paths.dir, "hook-failures", `${requestId}.json`), "utf8")); }
+        catch (error) { if (error.code === "ENOENT") continue; failure = { code: "native_hook_receipt_invalid", message: error.message }; }
+        if (failure.request_id !== undefined && failure.request_id !== requestId) continue;
+        if (binding.current !== this.active) {
+          if (failure.request_id !== requestId) continue;
+          // The callback request was accepted while this observer operation was
+          // active. AGY has no native creator ID, so this is diagnostic only:
+          // never mutate either the old receipt or the current Turn.
+          await this.journal("late_hook_receipt", { request_id: requestId, daemon_id: this.config.daemonId,
+            observer_operation_id: binding.current.operationId ?? null, observer_turn_generation: binding.current.generation ?? null,
+            native_creator: "unconfirmed", event: binding.event, failure: errorRecord(failure) });
+          this.hookRequests.delete(requestId);
+          continue;
+        }
+        const saved = await this.recordUnconfirmedHookFailure(Object.assign(new Error(failure.message ?? "Native hook failed"), { code: failure.code, details: failure.details }), binding.event, binding.payload, binding.current, requestId);
+        if (saved) this.hookRequests.delete(requestId);
+      }
+    })();
+    this.hookFailuresFlight = flight;
+    try { await flight; } finally { if (this.hookFailuresFlight === flight) this.hookFailuresFlight = null; }
   }
   async observeHook(event, payload, budget = null) {
+    const hookOwner = this.active, hookGeneration = this.turnGeneration;
     const conversationId = payload.conversationId ?? this.init?.conversation_id;
-    const child = await this.childForHook(conversationId); budget?.remaining("identity");
+    const shell = ["run_command", "run_terminal_command", "RunTerminalCommand"].includes(payload.toolCall?.name);
+    const args = payload.toolCall?.args ?? {}, command = args.command ?? args.cmd ?? args.CommandLine;
+    const observationOnly = Boolean(this.config.runtime_owner && this.config.ddFlowBin && (event === "Stop" || !shell
+      || typeof command === "string" && parseLifecycleCommand(command).participation === "none"));
+    // Ordinary native facts cannot grant Work authority. Keep them cheap;
+    // independent observation verifies ancestry/idle after the callback ACK.
+    const child = observationOnly ? this.qualifiedChildForHook(conversationId) : await this.childForHook(conversationId); budget?.remaining("identity");
+    if (this.active !== hookOwner || this.turnGeneration !== hookGeneration) {
+      await this.journal("stale_hook", { hook_event: event, conversation_id: conversationId, reason: "owner_changed_during_identity" });
+      return { stale: true };
+    }
     const prior = this.sessionObservations.get(conversationId) ?? {};
     const execution = Number.isInteger(payload.executionNum) ? payload.executionNum : null;
     const step = Number.isInteger(payload.stepIdx) ? payload.stepIdx : null;
@@ -915,37 +1051,52 @@ export class Runtime {
     if (stale) { await this.journal("stale_hook", { hook_event: event, conversation_id: conversationId, step_index: step }); return { stale: true }; }
     const fingerprint = createHash("sha256").update(JSON.stringify({ event, payload })).digest("hex");
     if (event === "Stop" && prior.last_stop_hook === fingerprint && prior.last_stop_generation === this.turnGeneration) return { stale: true };
-    this.progressHooks ??= new Set();
+    this.progressHooks ??= new Map();
     const scoped = this.active && (!child || child.activity_generation === this.active.generation);
-    const sourceBound = Boolean(scoped && step !== null && step > (this.active.stepFloor ?? -1)
-      && this.progressSteps?.get(conversationId)?.index === step);
+    // Native hook payloads/step updates carry no creator prompt identity.
+    // A late old step above the new floor is indistinguishable from a new one:
+    // Stop remains a hint, never a whole-tree or child idle grant.
+    const sourceBound = false;
     const progressKey = JSON.stringify([conversationId, step, execution, event, payload.toolCall ?? null, payload.fullyIdle ?? null]);
-    if (scoped && step !== null && (["PreToolUse", "PostToolUse"].includes(event) || event === "Stop" && payload.fullyIdle === true) && !this.progressHooks.has(progressKey) && this.progressHooks.size < 1_024) { this.progressHooks.add(progressKey); this.markActivity(); }
+    if (scoped && step !== null && (["PreToolUse", "PostToolUse"].includes(event) || event === "Stop" && payload.fullyIdle === true)) {
+      let progress = this.progressHooks.get(conversationId);
+      if (!progress || progress.step !== step) { progress = { step, seen: new Set() }; this.progressHooks.set(conversationId, progress); }
+      if (!progress.seen.has(progressKey)) { progress.seen.add(progressKey); this.markActivity(); }
+    }
     if (conversationId) this.sessionObservations.set(conversationId, { ...prior,
       ...(step !== null ? { last_step_index: step, last_execution_num: execution ?? (step === prior.last_step_index ? prior.last_execution_num : null) } : {}),
       last_hook: fingerprint, ...(event === "PreToolUse" ? { last_pre_hook: fingerprint } : {}),
       ...(payload.transcriptPath ? { transcript_path: payload.transcriptPath } : {}),
       ...(event === "Stop" ? { last_stop_hook: fingerprint, last_stop_generation: this.turnGeneration, stop: { fullyIdle: payload.fullyIdle === true, source_bound: sourceBound, terminationReason: payload.terminationReason ?? null, executionNum: execution } } : {}) });
     if (event === "PreToolUse" && prior.last_pre_hook !== fingerprint) this.childActivity(conversationId);
-    if (child && event === "Stop" && sourceBound && payload.fullyIdle === true) this.descendants.set(conversationId, { ...this.descendants.get(conversationId), tree_settled: true, settlement_evidence: "child_fully_idle_stop" });
-    const terminalPending = this.active?.terminalResult === this.lastResult;
-    if (!child && event === "Stop" && sourceBound && payload.fullyIdle === true && (!this.active || terminalPending) && ["SUCCESS", "ERROR", "CANCELLED"].includes(this.lastResult?.status)) for (const [id, descendant] of this.descendants) if (descendant.status === "unknown") this.descendants.set(id, { ...descendant, status: "settled_by_root", settlement_evidence: "root_fully_idle_stop" });
     const parent = child?.parent_provider_session_id ?? null;
     if (event === "Stop" && !stale) {
       const observation = this.sessionObservations.get(conversationId);
       this.sessionObservations.set(conversationId, { ...observation, stop: { ...observation.stop, generation: this.turnGeneration } });
     }
     const observed = payload.model ? observedProfile(payload) : {};
-    await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: conversationId, parentSessionId: parent, requested: this.config, observed, source: { channel: "native.hook", scope: "configured", ...(!payload.model ? { non_asserting: true } : {}) }, evidence: payload.model ? "configured" : "unavailable", reason: payload.model ? null : "hook_omits_current_model" });
+    // An omitted model carries no profile evidence. The hook journal below
+    // retains that fact; do not read/lock/fsync the model history for every
+    // ordinary tool or Stop callback. Actual model observations stay intact.
+    if (payload.model && !observationOnly) await observeModel({ journal: this.config.journal, harness: "antigravity-cli", sessionId: conversationId, parentSessionId: parent, requested: this.config, observed, source: { channel: "native.hook", scope: "configured" }, evidence: "configured" });
+    if (this.active !== hookOwner || this.turnGeneration !== hookGeneration) {
+      await this.journal("stale_hook", { hook_event: event, conversation_id: conversationId, reason: "owner_changed_during_model_observation" });
+      return { stale: true };
+    }
     const eventId = createHash("sha256").update(JSON.stringify({ daemon: this.config.daemonId, event, conversationId, fully_idle: payload.fullyIdle ?? null, termination_reason: payload.terminationReason ?? null, execution: payload.executionNum ?? null, step: payload.stepIdx ?? null, tool: payload.toolCall?.name ?? null, args: payload.toolCall?.args ?? null })).digest("hex");
-    await this.persist(); await this.journal("hook", { stale, hook_event: event, event_id: eventId, conversation_id: conversationId, turn_generation: this.turnGeneration, execution_num: execution, step_index: step, termination_reason: payload.terminationReason ?? null, fully_idle: payload.fullyIdle ?? null, persistence_timing: this.persistTiming ?? null });
-    if (!stale && !child && event === "PreToolUse" && Number.isInteger(step) && this.active) { this.active.nativeHookEvents ??= new Map(); this.active.nativeHookEvents.set(step, `${eventId}:before`); }
+    await this.persist(); await this.journal("hook", { stale, hook_event: event, event_id: eventId, conversation_id: conversationId, turn_generation: hookGeneration, execution_num: execution, step_index: step, termination_reason: payload.terminationReason ?? null, fully_idle: payload.fullyIdle ?? null, ...(payload.model ? {} : { model_observation: "unavailable" }), persistence_timing: this.persistTiming ?? null });
+    if (this.active !== hookOwner || this.turnGeneration !== hookGeneration) return { stale: true };
     this.queueNativeInspection();
-    await this.completePendingTurn(); return { event_id: eventId, daemon_id: this.config.daemonId, launch_cwd: this.config.cwd, parent_conversation_id: parent, profile: observed, requested_profile: { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode }, project_root: this.config.projectRoot, dd_flow_bin: this.config.ddFlowBin, dd_flow_home: this.config.ddFlowHome };
+    // A provider may wait for this hook's ACK before emitting the very event
+    // needed to finish the turn. The fact above is persisted before ACK;
+    // completion reconciliation belongs to the daemon, not the callback.
+    if (hookOwner && this.active === hookOwner && this.turnGeneration === hookGeneration) hookOwner.pendingHookReconciliation = true;
+    return { observationOnly, event_id: eventId, source_bound: sourceBound, daemon_id: this.config.daemonId, launch_cwd: this.config.cwd, parent_conversation_id: parent, profile: observed, requested_profile: { provider: this.config.provider, model: this.config.model, reasoning: this.config.reasoning, mode: this.config.mode }, project_root: this.config.projectRoot, dd_flow_bin: this.config.ddFlowBin, dd_flow_home: this.config.ddFlowHome };
   }
   async finalizeProviderForControl() {
     const pending = this.providerFinalization;
     try {
+      while (this.active?.pendingHookReconciliation || this.active?.hookReconciliation) await this.reconcilePendingHook(this.active);
       try { await pending; }
       catch (error) {
         // Control retries only retained physical/resource cleanup, never a
@@ -958,6 +1109,7 @@ export class Runtime {
         }
       }
       await this.promptObservation?.dispatchJournal;
+      await this.observeHookFailures();
     } catch (error) {
       if (!this.drainingError) throw error;
       this.drainingError.cleanup_error = errorRecord(error);
@@ -975,29 +1127,109 @@ export class Runtime {
     // In particular, the previous Turn's SUCCESS cannot certify a cancelled
     // in-flight Turn that exited without its own result.
     const currentResult = !current || current.terminalResult === this.lastResult || this.lastResult !== priorResult;
-    if (currentResult && this.receipt().settled) await this.retireNativeServices();
     const clean = currentResult && this.receipt().settled;
     return { ...this.receipt(), clean, settled: Boolean(clean), native_settled: Boolean(clean), ...(clean ? {} : { native_settlement: { confirmed: false, reason: "native_terminal_unconfirmed" } }) };
   }
   async retireNativeServices() {
+    if (!this.nativeQualification?.qualified) return;
+    this.nativeResources ??= new Map((this.state.native_resources_entries ?? []).map(item => [item.resource_id, item]));
     const services = [...(this.nativeResources?.values() ?? [])].filter(item => item.classification === 'support_service' && item.state !== 'stopped');
-    // Unknown classification/unsupported binaries keep the existing cleanup
-    // blocker. A fixture PID printed to stdout is never a production mapping.
-    if (!services.length || !this.nativeQualification?.qualified) return;
+    const schedules = [...(this.nativeResources?.values() ?? [])].filter(item => item.state !== 'stopped' &&
+      (item.kind === 'schedule' || item.classification === 'unknown'));
+    // Unknown task semantics can be reconciled by exact native handle inventory,
+    // not by inventing a shell outcome or trusting a PID printed to stdout.
     const revision = this.nativeRevision ?? 0;
     const endpoint = this.nativeStopper ? null : await ownedAgyEndpoint(this.nativeLaunch);
     const input = { endpoint, sessionId: this.init.conversation_id, cwd: this.config.cwd,
       csrfToken: this.nativeCsrfToken, remainingMs: 10_000, rootRelation: this.nativeQualification.rootRelation };
-    const stopped = await (this.nativeStopper ?? stopAgyNativeTree)(input, [...this.descendants.keys()]);
-    const observed = await (this.nativeObserver ?? inspectAgyNative)(input);
+    const clock = new ObservationClock({ timeoutMs: input.remainingMs });
+    let progress = 0;
+    const requestInput = () => {
+      if (clock.sample()) throw new DaemonError('native_resources_unproven', 'AGY native retirement observation budget exhausted');
+      const remainingMs = Math.max(1, Math.ceil(clock.timeoutMs - clock.elapsed));
+      return { ...input, remainingMs };
+    };
+    const inventory = async () => {
+      if (this.state.native_topology_error) throw new DaemonError('native_resources_unproven', 'AGY native topology is incomplete');
+      const root = this.init.conversation_id, nodes = [{ provider_session_id: root, parent_provider_session_id: '' }, ...this.descendants.values()];
+      for (const node of nodes.slice(1)) {
+        const seen = new Set([node.provider_session_id]); let parent = node.parent_provider_session_id;
+        while (parent !== root) {
+          if (!parent || seen.has(parent)) throw new DaemonError('native_resources_unproven', 'AGY native resource ancestry is unbound');
+          seen.add(parent); parent = this.descendants.get(parent)?.parent_provider_session_id;
+        }
+      }
+      const result = [];
+      for (const node of nodes) {
+        const snapshot = await (this.nativeStateObserver ?? inspectAgyNativeState)({ ...requestInput(),
+          sessionId: node.provider_session_id, rootSessionId: root, parentSessionId: node.parent_provider_session_id });
+        result.push({ session_id: node.provider_session_id, snapshot, ...agyNativeInventory(snapshot, node.provider_session_id) });
+        clock.sample(++progress); // A completed node read, not observer polling.
+      }
+      return result;
+    };
+    // Historical transcript envelopes need not explain whether a timer fired
+    // or was cancelled. Fresh native absence proves retirement, not success.
+    // The transcript ledger is partial. It cannot decide whether a fresh native
+    // inventory is needed: even a missing ledger may hide an active daemon task.
+    let states = await inventory();
+    const required = states.find(state => !state.idle || state.tasks.some(task => task.isDaemon !== true));
+    if (required) {
+      this.childActivity(required.session_id);
+      throw new DaemonError('native_resources_unproven', 'AGY required execution became active before native resource retirement');
+    }
+    const notificationKey = (session, trajectory, message) => JSON.stringify([session, trajectory, message.id, message.sender, message.recipient]);
+    const notifications = new Map((this.state.native_retirement_notifications ?? []).filter(item => item.owner_daemon_id === this.config.daemonId)
+      .map(item => [notificationKey(item.session_id, item.trajectory_id, item), item]));
+    if (states.some(state => state.messages.some(message => !notifications.has(notificationKey(state.session_id, state.snapshot.trajectoryId, message)))))
+      throw new DaemonError('native_resources_unproven', 'AGY has pending delivery before native resource retirement');
+    const stopSenders = new Set(['system', ...states.map(state => state.session_id), ...states.flatMap(state => state.tasks.map(task => task.taskId))]);
+    const trajectories = new Map(states.map(state => [state.session_id, state.snapshot.trajectoryId]));
+    const activeTasks = states.some(state => state.snapshot.hasActiveChildren === true || state.tasks.length > 0);
+    const stopped = services.length || activeTasks
+      ? await (this.nativeStopper ?? stopAgyNativeTree)(requestInput(), [...this.descendants.keys()]) : null;
+    if (stopped) clock.sample(++progress);
+    const observed = await (this.nativeObserver ?? inspectAgyNative)(requestInput());
+    clock.sample(++progress);
     if (!this.nativeStopper && !isDeepStrictEqual(await ownedAgyEndpoint(this.nativeLaunch), endpoint)
       || !observed.idle || revision !== (this.nativeRevision ?? 0) || !this.receipt().settled)
       throw new DaemonError('native_resources_unproven', 'AGY native service retirement lost its owner/execution fence');
+    {
+      states = await inventory();
+      if (states.some(state => !state.idle || trajectories.get(state.session_id) !== state.snapshot.trajectoryId ||
+        state.tasks.length) ||
+        observed.trajectory_id && observed.trajectory_id !== trajectories.get(this.init.conversation_id) ||
+        revision !== (this.nativeRevision ?? 0) || !this.receipt().settled ||
+        !this.nativeStopper && !isDeepStrictEqual(await ownedAgyEndpoint(this.nativeLaunch), endpoint))
+        throw new DaemonError('native_resources_unproven', 'AGY schedule retirement lacks fresh idle inventory and required delivery');
+      for (const state of states) for (const message of state.messages) {
+        const key = notificationKey(state.session_id, state.snapshot.trajectoryId, message);
+        if (notifications.has(key)) continue;
+        if (!stopped || typeof message.id !== 'string' || !message.id || message.recipient !== state.session_id || !stopSenders.has(message.sender))
+          throw new DaemonError('native_resources_unproven', 'AGY post-stop delivery has no owned native control provenance');
+        // Native cancellation creates notices after required execution is
+        // already settled. They remain pending technical evidence until the
+        // fenced provider is closed; do not prompt a model or claim delivery.
+        notifications.set(key, { id: message.id, sender: message.sender, recipient: message.recipient, session_id: state.session_id,
+          trajectory_id: state.snapshot.trajectoryId, owner_daemon_id: this.config.daemonId, generation: this.turnGeneration, revision,
+          status: 'pending', disposition: 'after_owned_native_stop', method: stopped.method });
+      }
+      for (const schedule of schedules) {
+        const state = states.find(item => item.session_id === schedule.provider_session_id);
+        if (!state || state.tasks.some(task => task.taskId === schedule.resource_id))
+          throw new DaemonError('native_resources_unproven', 'AGY schedule owner or retirement is unproven');
+        this.nativeResources.set(schedule.resource_id, { ...schedule, state: 'stopped', native_retirement: {
+          method: state.snapshot.method, reason: 'native_task_inventory_absent', revision,
+          trajectory_id: state.snapshot.trajectoryId, observed_at: state.snapshot.observed_at } });
+      }
+    }
     // This is native handle retirement, not physical cleanup. Shared shutdown
     // still re-observes the retained local PID/birth inventory after close.
     for (const service of services) this.nativeResources.set(service.resource_id, { ...service, state: 'stopped',
       native_retirement: { method: stopped.method, stopped_session_ids: stopped.stopped_session_ids, revision } });
-    await this.persist({ native_resources_entries: [...this.nativeResources.values()] });
+    await this.persist({ native_resources_entries: [...this.nativeResources.values()], native_retirement_notifications: [...notifications.values()] });
+    if (revision !== (this.nativeRevision ?? 0) || !this.receipt().settled)
+      throw new DaemonError('native_resources_unproven', 'AGY resource retirement was fenced during publication');
   }
   async cancel() { if (!this.active && this.receipt().settled) return { ...this.receipt(), cancelled: true }; this.nativeAbort?.abort(); this.nativeProof = null; this.nativeRevision = (this.nativeRevision ?? 0) + 1; this.state.native_execution_revision = this.nativeRevision; cancelPendingDispatch(this); if (!this.child) return this.receipt(); if (!this.exited) { try { process.kill(-this.child.pid, "SIGINT"); } catch (error) { if (error.code !== "ESRCH") throw error; } const deadline = Date.now() + 5000; while (!this.exited && Date.now() < deadline) await new Promise(resolve => setTimeout(resolve, 100)); if (!this.exited) await stopProcessGroup(this.child, 5_000); } await this.finalizeProviderForControl(); await this.persist({ active_tree: false }); return { ...this.receipt(), cancelled: true };
   }
@@ -1059,30 +1291,55 @@ async function dispatch(runtime, request) {
   if (request.operation === "session.inspect") { runtime.requireSessionIdentity(params.sessionId); await runtime.captureChildTools(); void runtime.reconcileRetainedAdmission().catch(error => { runtime.nativeInspection = { state: 'unproven', reason: error.details?.reason ?? error.code ?? 'native_admission_unproven' }; }); runtime.queueNativeInspection(); await runtime.persist({ native_observation_episode: runtime.episodeSnapshot() }); return runtime.receipt(); }
   if (request.operation === "session.resume") { await runtime.start(params.sessionId ?? runtime.init?.conversation_id ?? null); runtime.requireSessionIdentity(params.sessionId); return runtime.receipt(); }
   if (request.operation === "session.cancel") { runtime.requireSessionIdentity(params.sessionId); return await runtime.cancel(); }
+  if (request.operation === "hook.verify") {
+    if (params.daemonId !== runtime.config.daemonId) throw new DaemonError("agy_hook_binding_invalid", "Antigravity hook binding does not name this daemon");
+    assertDaemonDispatch(runtime.paths.dir);
+    if (params.binding?.native_admission === "assigned_work_start") return await runtime.verifyWorkStart(params);
+    const retained = runtime.verifiedHookFacts?.get(params.requestId);
+    if (!retained || !isDeepStrictEqual(retained.binding, params.binding)) throw new DaemonError("native_hook_unproven", "Hook fact is not bound to a verified native delivery");
+    retained.guard();
+    return { verified: true, nativeHookBinding: retained.binding };
+  }
+  if (request.operation === "hook.complete") {
+    if (params.daemonId !== runtime.config.daemonId)
+      throw new DaemonError("agy_hook_binding_invalid", "Antigravity hook binding does not name this daemon");
+    if (typeof params.requestId !== 'string' || !/^[A-Za-z0-9-]{1,128}$/.test(params.requestId))
+      throw new DaemonError("agy_hook_binding_invalid", "Antigravity callback request ID is invalid");
+    // Administrative ACK only: the success of a callback is not proof that a
+    // Work mutation occurred or that a native agent Turn is complete.
+    return { retired: runtime.hookRequests?.delete(params.requestId) === true };
+  }
   if (request.operation === "hook.observe") {
     // Check the process binding before correlating a request with an active
     // turn. A stale/foreign daemon must not poison an unrelated operation.
     if (runtime.config.hookBinding === "environment-v1" && params.daemonId !== runtime.config.daemonId) throw new DaemonError("agy_hook_binding_invalid", "Antigravity hook binding does not name this daemon", false, { expected_daemon_id: runtime.config.daemonId, observed_daemon_id: params.daemonId ?? null });
     const current = runtime.active, budget = hookBudget(25_000, params.deadlineAt);
     runtime.hookRequests ??= new Map();
-    if (/^[A-Za-z0-9-]{1,128}$/.test(request.id)) runtime.hookRequests.set(request.id, { current, event: params.event, payload: { conversationId: params.payload?.conversationId, toolCall: { name: params.payload?.toolCall?.name } } });
+    if (/^[A-Za-z0-9-]{1,128}$/.test(request.id)) runtime.hookRequests.set(request.id, { current: current ?? runtime.lastNativeHookOperation, event: params.event, payload: { conversationId: params.payload?.conversationId, toolCall: { name: params.payload?.toolCall?.name } } });
     try {
+      const deferred = await budget.run(() => runtime.registerWorkStart(params.event, params.payload ?? {}, request.id), "registration");
+      if (deferred) return { fastAck: true, nativeHookBinding: deferred };
       const result = await budget.run(async () => {
         if (runtime.hookRequests.has(request.id) && current?.operationId) {
           const directory = path.join(runtime.paths.dir, "operations", createHash("sha256").update(current.operationId).digest("hex"), "hooks");
           await mkdir(directory, { recursive: true, mode: 0o700 });
-          await writeJson(path.join(directory, `${request.id}.json`), { schema_id: "dd-flow/hook-request@1", request_id: request.id, daemon_id: runtime.config.daemonId, operation_id: current.operationId, turn_generation: current.generation, event: params.event, conversation_id: params.payload?.conversationId ?? null, tool: params.payload?.toolCall?.name ?? null });
+          await writeJson(path.join(directory, `${request.id}.json`), { schema_id: "dd-flow/hook-request@1", request_id: request.id, daemon_id: runtime.config.daemonId, operation_id: current.operationId, turn_generation: current.generation, native_creator: "unconfirmed", event: params.event, conversation_id: params.payload?.conversationId ?? null, tool: params.payload?.toolCall?.name ?? null });
         }
         budget.remaining("observation");
         return await runtime.observeHook(params.event, params.payload ?? {}, budget);
       }, "observation");
+      // The AGY stream does not prove which native prompt produced a step.
+      // An unseen old step can exceed a newer prompt's observed floor. Do not
+      // mint an optional CLI admission from event order; legacy hook performs
+      // its existing scoped checks until a native creator binding exists.
       await runtime.observeHookFailures(); budget.remaining("observation");
-      if (current && runtime.state.last_hook_rejection?.turn_generation === current.generation) throw Object.assign(new Error(runtime.state.last_hook_rejection.message), runtime.state.last_hook_rejection);
+      if (result.stale) runtime.hookRequests.delete(request.id);
       return result;
     }
-    catch (error) { await runtime.rejectHook(error, params.event, params.payload ?? {}, current); throw error; }
+    catch (error) { await runtime.recordUnconfirmedHookFailure(error, params.event, params.payload ?? {}, current, request.id); throw error; }
   }
   if (request.operation === "daemon.stop") return await completeDaemonShutdown(runtime.paths.dir, runtime.state, patch => runtime.persist(patch), () => runtime.prepareStop(params.cancelTree === true), [["provider", () => runtime.close(false)], ["daemon_resource", () => runtime.finishResource()]], async () => {
+    await runtime.retireNativeServices();
     await runtime.captureChildTools();
     return runtime.receipt().native_resources;
   });