@deksden-com/dd-flow-cli 0.9.0-beta.155 → 0.9.0-beta.158

package/dist/schemas/vnext-protocol-plan.schema.json

@@ -28,7 +28,7 @@
     "decision": {"type": "object", "additionalProperties": false, "required": ["id", "decision", "rationale", "affected_surfaces"], "properties": {"id": {"type": "string", "minLength": 1}, "decision": {"type": "string", "minLength": 1}, "rationale": {"type": "string", "minLength": 1}, "affected_surfaces": {"$ref": "#/$defs/strings"}, "durable_ref": {"type": "string", "minLength": 1}}},
     "documentUpdate": {"type": "object", "additionalProperties": false, "required": ["path", "action", "owner", "reason"], "properties": {"path": {"type": "string", "minLength": 1}, "action": {"enum": ["create", "update"]}, "owner": {"type": "string", "minLength": 1}, "reason": {"type": "string", "minLength": 1}}},
     "spine": {"type": "object", "additionalProperties": false, "required": ["user_outcome", "component_responsibility", "must_preserve", "non_goals", "acceptance_contribution"], "properties": {"user_outcome": {"type": "string", "minLength": 1}, "component_responsibility": {"type": "string", "minLength": 1}, "must_preserve": {"$ref": "#/$defs/strings"}, "non_goals": {"type": "array", "items": {"type": "string", "minLength": 1}}, "acceptance_contribution": {"type": "string", "minLength": 1}}},
-    "execution": {"type": "object", "additionalProperties": false, "required": ["required_read", "discovery_boundary", "planned_write_areas", "stop_conditions"], "properties": {"required_read": {"$ref": "#/$defs/strings", "description": "Mandatory starting sources. This is not a read allowlist."}, "discovery_boundary": {"$ref": "#/$defs/strings", "description": "Likely discovery areas. A worker may inspect other project-local sources when necessary."}, "planned_write_areas": {"type": "array", "items": {"type": "string", "minLength": 1}, "description": "Optional file or directory hints used only to coordinate concurrent Works. They never grant or deny write permission."}, "stop_conditions": {"$ref": "#/$defs/strings", "description": "Semantic contradictions or external blockers that require the worker to stop."}}},
+    "execution": {"type": "object", "additionalProperties": false, "required": ["required_read", "discovery_boundary", "planned_write_areas", "stop_conditions"], "properties": {"required_read": {"$ref": "#/$defs/strings", "description": "Mandatory starting sources. This is not a read allowlist."}, "discovery_boundary": {"$ref": "#/$defs/strings", "description": "Likely discovery areas. A worker may inspect other project-local sources when necessary."}, "planned_write_areas": {"type": "array", "items": {"type": "string", "minLength": 1}, "description": "Optional file or directory hints used only to coordinate concurrent Works. They never grant or deny write permission."}, "stop_conditions": {"type": "array", "items": {"type": "string", "minLength": 1}, "description": "Optional action-specific accepted-decision, safety or evidence boundaries. An empty list is valid; a mismatch with current implementation or planned paths alone is not a stop condition."}}},
     "check": {"type": "object", "additionalProperties": false, "required": ["id", "command", "purpose", "run_at", "availability"], "properties": {"id": {"type": "string", "pattern": "^CHK-[A-Za-z0-9-]+$"}, "command": {"type": "string", "minLength": 1}, "purpose": {"type": "string", "minLength": 1}, "run_at": {"enum": ["work", "code", "readiness", "merge", "release"]}, "availability": {"enum": ["available", "planned"]}, "provided_by": {"type": "string", "pattern": "^P[0-9]+$"}, "definition": {"type": "string", "minLength": 1}, "required_artifacts": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "ports": {"type": "array", "uniqueItems": true, "items": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_]*$"}}, "inputs": {"type": "array", "uniqueItems": true, "items": {"type": "string", "minLength": 1}}, "reuse": {"const": "deterministic"}}, "allOf": [{"if": {"properties": {"availability": {"const": "planned"}}, "required": ["availability"]}, "then": {"required": ["provided_by", "definition"], "properties": {"command": {"pattern": "^@check/"}}}}, {"if": {"properties": {"command": {"pattern": "^@check/"}}}, "then": {"required": ["definition"]}}]},
     "verification": {"type": "object", "additionalProperties": false, "required": ["check_refs"], "properties": {"check_refs": {"type": "array", "minItems": 1, "uniqueItems": true, "items": {"type": "string", "pattern": "^CHK-[A-Za-z0-9-]+$"}}}},
     "item": {"type": "object", "additionalProperties": false, "required": ["id", "title", "summary", "details", "depends_on", "requirement_refs", "semantic_spine", "execution_context", "verification"], "properties": {"id": {"type": "string", "pattern": "^P[0-9]+$"}, "title": {"type": "string", "minLength": 1}, "summary": {"type": "string", "minLength": 1}, "details": {"type": "string", "minLength": 1}, "depends_on": {"type": "array", "uniqueItems": true, "items": {"type": "string", "pattern": "^P[0-9]+$"}}, "requirement_refs": {"$ref": "#/$defs/strings"}, "semantic_spine": {"$ref": "#/$defs/spine"}, "execution_context": {"$ref": "#/$defs/execution"}, "verification": {"$ref": "#/$defs/verification"}}},

package/dist/services/codex-capacity.js

@@ -0,0 +1,367 @@
+import { setTimeout as delay } from "node:timers/promises";
+import crypto from "node:crypto";
+import { CAPACITY_POLICY, capacityBackoff, nativeItemsSettled, normalizeCodexFailure, overloadBurst, parseCapacityOperation, refusalObservation, terminalCodexOverload } from "../harness-runtime/lib/codex-capacity-policy.mjs";
+import { AppError } from "../shared/errors.js";
+import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
+export function eligibleCodexChildOverload(child, parentSessionId) {
+    return typeof child.session_id === "string" && child.session_id !== parentSessionId && child.parent_session_id === parentSessionId && child.provenance !== "parent_mismatch" && child.status === "failed" && typeof child.terminal_turn_id === "string" && nativeItemsSettled(child.native_turn_items)
+        && terminalCodexOverload({ code: "turn_interrupted", details: { provider_session_id: child.session_id, turn_id: child.terminal_turn_id, native_turn_id: child.terminal_turn_id, terminal_status: "failed", provider_error: child.provider_error } }, child.session_id, child.terminal_turn_id);
+}
+/** A terminal root is not a settled tree. Only the daemon's exact owned tree
+ * with a settled root and positively live descendants permits waiting. */
+export function capacityReadiness(seen, sessionId, operationId, turnId, items, allowDescendants = false) {
+    if (seen.provider_session_id !== sessionId || seen.terminal_turn_id !== undefined && seen.terminal_turn_id !== turnId || !nativeItemsSettled(items))
+        return "unproven";
+    const ids = Array.isArray(seen.tree_session_ids) ? seen.tree_session_ids : [];
+    if (!ids.length || ids[0] !== sessionId || ids.some(id => typeof id !== "string" || !id) || new Set(ids).size !== ids.length)
+        return "unproven";
+    const observations = Array.isArray(seen.tree_observations) ? seen.tree_observations : [];
+    const exactTree = observations.length === ids.length && ids.every(id => observations.filter(item => item.provider_session_id === id).length === 1);
+    const settlement = seen.settlement;
+    const budgetSettled = !settlement || settlement.state === "not_required" || settlement.state === "settled" && settlement.operation_ids?.includes(operationId) === true;
+    const treeSettled = allowDescendants ? exactTree && observations.every(item => item.settled === true) && Array.isArray(seen.unsettled_sessions) && seen.unsettled_sessions.length === 0 : ids.length === 1;
+    if (seen.settled === true && treeSettled && budgetSettled)
+        return "ready";
+    if (!allowDescendants || seen.settled !== false || !exactTree || ids.length < 2 || observations[0]?.provider_session_id !== sessionId || observations[0].settled !== true
+        || settlement && settlement.state !== "not_required" && !(settlement.state === "pending" && settlement.reason === "tree_unsettled"))
+        return "unproven";
+    const live = observations.filter(item => item.settled === false);
+    const unsettled = seen.unsettled_sessions;
+    const knownLive = live.length > 0 && live.every(item => item.provider_session_id !== sessionId && ["active", "running", "inProgress"].includes(String(typeof item.status === "object" && item.status ? item.status.type : item.status)));
+    return knownLive && observations.every(item => typeof item.settled === "boolean") && Array.isArray(unsettled) && unsettled.length === live.length && live.every(item => unsettled.includes(item.provider_session_id)) ? "owned_children_live" : "unproven";
+}
+/** Permit acquisition must still belong to the original task, not merely an
+ * open RUN. Controls/inspection and ordinary successor prompts are unaffected. */
+export function assertCapacityOwnerAdmission(context, record, operationId, binding) {
+    if (!operationId || !record.project_id || !record.run_id)
+        return;
+    const root = parseCapacityOperation(operationId).root;
+    const childOrdinal = /:child:[a-f0-9]+:followup:(\d+)$/.exec(root)?.[1];
+    if (childOrdinal && (!Number.isSafeInteger(Number(childOrdinal)) || Number(childOrdinal) < 1 || String(Number(childOrdinal)) !== childOrdinal))
+        throw new AppError("capacity_continuation_conflict", "Invalid native child continuation ordinal", 1);
+    if (root === operationId && !childOrdinal)
+        return;
+    const reject = () => { throw new AppError("capacity_owner_boundary_changed", "Queued continuation no longer belongs to an unfinished task; reconcile its durable state", 1, { operation_id: operationId, work_id: record.work_id, run_id: record.run_id }); };
+    const metadata = JSON.parse(record.metadata_json);
+    const hasTable = (name) => Boolean(context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?", [name]));
+    const parsed = parseCapacityOperation(operationId);
+    if (parsed.ordinal > 0 && !["judge", "probe"].includes(metadata.role ?? "")) {
+        if (!binding?.nativeSessionId || !binding.promptSha256)
+            reject();
+        let intent;
+        const predecessor = parsed.ordinal === 1 ? root : `${root}:capacity:${parsed.ordinal - 1}:session.prompt`;
+        if (hasTable("run_controller_operations")) {
+            const saved = context.db.get("SELECT receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND generation = ? AND status = 'failed'", [predecessor, record.owner_id, metadata.run_generation ?? 0]);
+            if (saved)
+                intent = JSON.parse(saved.receipt_json).capacity_intent;
+        }
+        if (!intent && record.work_id)
+            for (const table of ["work_launches", "merge_requests"]) {
+                if (!hasTable(table))
+                    continue;
+                const rows = table === "work_launches"
+                    ? context.db.all("SELECT l.adapter_receipt_json FROM work_launches l JOIN works w ON w.work_id = l.work_id WHERE l.work_id = ? AND w.project_id = ? AND w.run_id = ?", [record.work_id, record.project_id, record.run_id])
+                    : context.db.all("SELECT adapter_receipt_json FROM merge_requests WHERE executor_work_id = ? AND project_id = ? AND run_id = ?", [record.work_id, record.project_id, record.run_id]);
+                for (const saved of rows) {
+                    const retained = JSON.parse(saved.adapter_receipt_json ?? "null");
+                    intent = retained?.capacity_intents?.find((item) => item.operation_id === operationId);
+                    if (intent)
+                        break;
+                }
+                if (intent)
+                    break;
+            }
+        if (!intent || intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== root || intent.ordinal !== parsed.ordinal
+            || intent.predecessor !== predecessor || intent.operation_id !== operationId || intent.refusal?.turn_id !== intent.turn_id
+            || intent.refusal?.ordinal !== parsed.ordinal - 1 || intent.refusal?.session_id !== intent.session_id
+            || !Number.isFinite(Date.parse(intent.not_before)) || Date.parse(intent.not_before) > Date.parse(context.now())
+            || intent.deadline !== null && (typeof intent.deadline !== "number" || intent.deadline <= Date.parse(context.now()))
+            || binding?.nativeSessionId !== undefined && intent.session_id !== binding.nativeSessionId
+            || binding?.promptSha256 !== undefined && intent.prompt_sha256 !== binding.promptSha256)
+            reject();
+    }
+    if (context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'run_recovery_bindings'")) {
+        if (context.db.get("SELECT 1 FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND g.run_id = ? AND g.status = 'recovered' AND b.status = 'accepted' AND json_extract(b.runtime_dispatch_json, '$.operation_id') = ?", [record.project_id, record.run_id, root]))
+            reject();
+    }
+    if (record.work_id) {
+        const work = context.db.get("SELECT status FROM works WHERE work_id = ? AND project_id = ? AND run_id = ?", [record.work_id, record.project_id, record.run_id]);
+        const merge = context.db.get("SELECT status FROM merge_requests WHERE executor_work_id = ? AND project_id = ? AND run_id = ?", [record.work_id, record.project_id, record.run_id]);
+        if (merge && !["dispatching", "active"].includes(merge.status))
+            reject();
+        // MERGE owns the Stage/request boundary: finishing its Work does not
+        // necessarily commit stage finish yet. External workers own only Work.
+        const mergeOwner = metadata.role === "merge";
+        if (!work || !(merge && mergeOwner ? ["created", "running", "completed"] : ["created", "running"]).includes(work.status))
+            reject();
+    }
+    if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'run_controllers'"))
+        return;
+    const controller = context.db.get("SELECT state_json FROM run_controllers WHERE controller_id = ? AND project_id = ? AND run_id = ?", [record.owner_id, record.project_id, record.run_id]);
+    if (!controller)
+        return;
+    const state = JSON.parse(controller.state_json);
+    const run = context.db.get("SELECT index_json FROM runs WHERE project_id = ? AND id = ?", [record.project_id, record.run_id]);
+    const index = JSON.parse(run?.index_json ?? "{}");
+    if (state.stage && (index.current_stage && index.current_stage !== state.stage || index.stage_runs?.some(stage => stage.stage === state.stage && ["done", "skipped"].includes(stage.status))))
+        reject();
+    const child = Object.entries(state.child_capacity ?? {}).find(([, intent]) => intent.operation_id === root)?.[0];
+    if (childOrdinal && !child)
+        reject();
+    if (child && context.db.get("SELECT 1 FROM work_sessions ws JOIN works w ON w.work_id = ws.work_id JOIN sessions s ON s.session_id = ws.session_id WHERE w.project_id = ? AND w.run_id = ? AND s.provider_session_id = ? AND w.status <> 'running'", [record.project_id, record.run_id, child]))
+        reject();
+}
+export function capacityDelay(error, ordinal, now = Date.now()) {
+    return capacityBackoff(error, ordinal, now);
+}
+/** Continue a confirmed terminal Turn, never replay its completed effects. */
+export async function continueCodexCapacity(input) {
+    let { error, operationId } = input;
+    const history = [...(input.retainedIntents?.() ?? [])];
+    const parsed = parseCapacityOperation(input.operationId);
+    const rootId = parsed.root;
+    const text = input.continuationText ?? "Continue the same assigned task in this Session. Check current durable RUN, Work and Stage state first. Never repeat an observed lifecycle command, accepted HITL answer, check or merge apply; use only an exact issued successor. Stop at the assigned boundary.";
+    const promptSha = crypto.createHash("sha256").update(text).digest("hex");
+    let ordinal = parsed.ordinal + 1;
+    const conflict = (message) => { throw new AppError("capacity_continuation_conflict", message, 1, { operation_id: operationId, root_operation_id: rootId, session_id: input.sessionId }); };
+    const blocked = (message) => new AppError("capacity_continuation_blocked", message, 1, { capacity_uncertainty: true, operation_id: operationId, root_operation_id: rootId, provider_session_id: input.sessionId, primary_error: error });
+    const observe = async (action, observedOperationId = operationId) => {
+        try {
+            return await action();
+        }
+        catch (cause) {
+            let primary = cause;
+            for (let depth = 0; depth < 4 && primary?.code === "harness_adapter_failed"; depth++)
+                primary = (primary.cause ?? primary.details?.cause);
+            if (isObservationLoss(primary))
+                throw new AppError("operation_observation_lost", "Capacity native observation was lost; do not cancel or resend", 1, { capacity_uncertainty: true, root_operation_id: rootId, operation_id: observedOperationId, provider_session_id: input.sessionId, predecessor_error: error, cause });
+            throw cause;
+        }
+    };
+    const refusals = [...(input.retainedFailures?.() ?? [])];
+    if (parsed.ordinal > history.length)
+        conflict("Continuation has no complete retained predecessor chain");
+    for (let index = 0; index < history.length; index++) {
+        const intent = history[index];
+        const expected = index + 1;
+        if (intent.ordinal !== expected || intent.operation_id !== `${rootId}:capacity:${expected}:session.prompt`
+            || intent.predecessor !== (expected === 1 ? rootId : `${rootId}:capacity:${expected - 1}:session.prompt`)
+            || intent.prompt_sha256 !== promptSha || intent.policy !== CAPACITY_POLICY || intent.root_operation_id !== rootId || intent.session_id !== input.sessionId
+            || intent.deadline !== (input.deadline ?? null) || !intent.refusal || intent.refusal.ordinal !== expected - 1 || intent.refusal.turn_id !== intent.turn_id
+            || !Number.isFinite(Date.parse(intent.not_before)))
+            conflict("Retained capacity chain is incomplete or belongs to another policy/task");
+        const previous = refusals.find(item => item.ordinal === intent.refusal.ordinal);
+        if (previous && JSON.stringify(previous) !== JSON.stringify(intent.refusal))
+            conflict("Retained failure observation changed");
+        if (!previous)
+            refusals.push(intent.refusal);
+    }
+    refusals.sort((a, b) => a.ordinal - b.ordinal);
+    for (let index = 0; index < refusals.length; index++) {
+        const refusal = refusals[index];
+        if (refusal.ordinal !== index || refusal.policy !== CAPACITY_POLICY || refusal.session_id !== input.sessionId || !refusal.turn_id
+            || refusals.slice(0, index).some(item => item.turn_id === refusal.turn_id) || !Number.isFinite(Date.parse(refusal.first_observed_at)))
+            conflict("Retained refusal chain is invalid");
+    }
+    // Reconcile a retained dispatch before preparing another. Native absence is
+    // the only safe way to reuse a prepared intent; a lost reply is not absence.
+    for (const intent of history) {
+        if (intent.ordinal < ordinal)
+            continue;
+        if (intent.predecessor !== operationId || intent.ordinal !== ordinal || intent.operation_id !== `${rootId}:capacity:${ordinal}:session.prompt`)
+            conflict("Retained successor skips its predecessor");
+        if (intent.prompt_sha256 !== promptSha || !intent.turn_id || !Number.isFinite(Date.parse(intent.not_before)))
+            throw error;
+        let observed;
+        try {
+            observed = await observe(() => input.inspectOperation(intent.operation_id), intent.operation_id);
+        }
+        catch (cause) {
+            let code = cause;
+            for (let depth = 0; depth < 4 && code?.code === "harness_adapter_failed"; depth++)
+                code = code.details?.cause;
+            if (code?.code !== "operation_not_found")
+                throw cause;
+            break;
+        }
+        if (observed.operation_id !== intent.operation_id || observed.session_id !== input.sessionId || observed.operation !== "session.prompt")
+            conflict("Retained native successor identity changed");
+        if (observed.primary_error)
+            throw observed.primary_error;
+        while (["prepared", "dispatching", "running", "awaiting_provider", "outcome_unknown"].includes(String(observed.state))) {
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            const boundary = await observe(async () => await input.decision?.() ?? "continue", intent.operation_id);
+            if (boundary === "completed" || boundary === "paused")
+                return { provider_session_id: input.sessionId, capacity_decision: boundary };
+            if (boundary === "reconciliation_blocked")
+                throw new AppError("capacity_continuation_blocked", "Retained native successor has an unresolved owner boundary", 1, { operation_id: intent.operation_id, primary_error: error });
+            if (input.deadline !== undefined && Date.now() >= input.deadline)
+                throw new AppError("capacity_owner_deadline_exceeded", "Retained successor exhausted its original deadline", 1);
+            await delay(250, undefined, { signal: input.signal });
+            observed = await observe(() => input.inspectOperation(intent.operation_id), intent.operation_id);
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            if (observed.operation_id !== intent.operation_id || observed.session_id !== input.sessionId || observed.operation !== "session.prompt")
+                conflict("Retained native successor identity changed");
+            if (observed.primary_error)
+                throw observed.primary_error;
+        }
+        if (observed.state === "completed" && observed.result && typeof observed.result === "object") {
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            const boundary = await observe(async () => await input.decision?.() ?? "continue", intent.operation_id);
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            if (boundary === "reconciliation_blocked")
+                throw new AppError("capacity_continuation_blocked", "Retained completion cannot be reconciled with its owner boundary", 1);
+            return boundary === "paused" || boundary === "completed" ? { provider_session_id: input.sessionId, capacity_decision: boundary } : observed.result;
+        }
+        if (observed.state === "failed" && observed.error && !terminalCodexOverload(observed.error, input.sessionId))
+            throw observed.error;
+        if (observed.state !== "failed" || !terminalCodexOverload(observed.error, input.sessionId))
+            throw new AppError("operation_observation_lost", "Retained successor outcome is not proven; do not resend", 1, { operation_id: intent.operation_id, primary_error: error, observed });
+        operationId = intent.operation_id;
+        error = observed.error;
+        ordinal += 1;
+    }
+    const decide = async (observedOperationId = operationId) => {
+        input.signal?.throwIfAborted();
+        input.assertCurrent();
+        const decision = await observe(async () => await input.decision?.() ?? "continue", observedOperationId);
+        input.signal?.throwIfAborted();
+        input.assertCurrent();
+        if (decision === "reconciliation_blocked")
+            throw new AppError("capacity_continuation_blocked", "Native refusal cannot be reconciled with its durable owner boundary", 1, { primary_error: error, root_operation_id: rootId, provider_session_id: input.sessionId });
+        if (decision === "continue" && input.deadline !== undefined && Date.now() >= input.deadline)
+            throw new AppError("capacity_owner_deadline_exceeded", "Continuation exhausted its original owner deadline", 1, { primary_error: error, deadline: input.deadline, root_operation_id: rootId, provider_session_id: input.sessionId });
+        return decision === "continue" ? null : { provider_session_id: input.sessionId, capacity_decision: decision };
+    };
+    for (;; ordinal += 1) {
+        if (!Number.isSafeInteger(ordinal))
+            conflict("Continuation ordinal overflow");
+        if (!terminalCodexOverload(error, input.sessionId)) {
+            if (ordinal === 1)
+                return null;
+            throw error;
+        }
+        const completed = await decide();
+        if (completed)
+            return completed;
+        const prior = await observe(() => input.inspectOperation(operationId));
+        const failure = prior.error;
+        const confirmed = normalizeCodexFailure(failure, input.sessionId);
+        const turnId = confirmed?.turn_id;
+        input.signal?.throwIfAborted();
+        input.assertCurrent();
+        if (prior.primary_error)
+            throw prior.primary_error;
+        if (prior.operation_id !== operationId || prior.operation !== "session.prompt" || prior.session_id !== input.sessionId
+            || prior.state !== "failed" || prior.primary_error || !turnId || !terminalCodexOverload(failure, input.sessionId, turnId)) {
+            throw blocked("Retained predecessor does not prove the exact terminal overloaded Turn");
+        }
+        const readiness = async () => {
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            const seen = await observe(() => input.inspectSession(turnId));
+            input.signal?.throwIfAborted();
+            input.assertCurrent();
+            const items = (seen.terminal_turn_id === turnId && seen.terminal_status === "failed" ? seen.native_turn_items : confirmed?.native_turn_items);
+            return capacityReadiness(seen, input.sessionId, operationId, turnId, items, input.allowSettledDescendants);
+        };
+        const ready = await readiness();
+        if (ready === "unproven")
+            throw blocked("Native predecessor readiness is unproven; do not cancel or replay to manufacture proof");
+        const native = normalizeCodexFailure(failure, input.sessionId, turnId);
+        let refusal = refusals.find(item => item.ordinal === ordinal - 1);
+        if (refusal && (refusal.turn_id !== turnId || refusal.session_id !== input.sessionId || refusal.policy !== CAPACITY_POLICY))
+            conflict("Failure ordinal identifies a different native Turn");
+        if (refusal) {
+            const expected = refusalObservation(failure, ordinal - 1, refusal.first_observed_at);
+            if (refusal.native_terminal_at !== expected.native_terminal_at || refusal.native_terminal_basis !== expected.native_terminal_basis)
+                conflict("Retained refusal time differs from its native receipt");
+        }
+        if (!refusal) {
+            if (refusals.some(item => item.turn_id === turnId))
+                conflict("A cached native Turn cannot be a second refusal");
+            // A cached legacy failure cannot be assigned a new time during reattach.
+            if (ordinal > 1 && parsed.ordinal > 0 && !native.observed_at)
+                conflict("Retained continuation has no original failure time");
+            const observedAt = typeof native.observed_at === "string" && Number.isFinite(Date.parse(native.observed_at)) ? native.observed_at : new Date().toISOString();
+            refusal = refusalObservation(failure, ordinal - 1, observedAt);
+            if (!input.atomicIntent)
+                input.retainFailure?.(operationId, refusal);
+            refusals.push(refusal);
+        }
+        const burst = overloadBurst(refusals);
+        if (burst) {
+            if (input.atomicIntent)
+                input.retainFailure?.(operationId, refusal);
+            throw new AppError("provider_overload_burst", "Two consecutive continuation Turns were overloaded within two minutes", 1, { ...burst, root_operation_id: rootId, provider_session_id: input.sessionId, continuation_count: ordinal - 1, primary_error: failure });
+        }
+        const nextId = `${rootId}:capacity:${ordinal}:session.prompt`;
+        const existing = history.find(item => item.operation_id === nextId);
+        if (existing && (existing.predecessor !== operationId || existing.turn_id !== turnId || existing.prompt_sha256 !== promptSha || existing.ordinal !== ordinal))
+            throw error;
+        const wait = existing ? Math.max(0, Date.parse(existing.not_before) - Date.now()) : capacityDelay(failure, ordinal);
+        if (!Number.isFinite(wait) || Date.now() + wait > 8.64e15 || input.deadline !== undefined && Date.now() + wait >= input.deadline) {
+            if (input.atomicIntent)
+                input.retainFailure?.(operationId, refusal);
+            throw new AppError("capacity_owner_deadline_exceeded", "Continuation wait exceeds its original owner deadline", 1, { primary_error: failure, deadline: input.deadline ?? null });
+        }
+        if (!existing) {
+            const intent = { predecessor: operationId, operation_id: nextId, turn_id: turnId, ordinal, prompt_sha256: promptSha, not_before: new Date(Date.now() + wait).toISOString(), policy: CAPACITY_POLICY, root_operation_id: rootId, session_id: input.sessionId, deadline: input.deadline ?? null, refusal };
+            input.retainIntent(intent);
+            history.push(intent);
+        }
+        // Intent/refusal are durable before the first wait; no permit or writer is
+        // held here, and live siblings are never cancelled as a settlement proof.
+        const waitForOwnedChildren = async (initial) => {
+            let current = initial;
+            while (current === "owned_children_live") {
+                await delay(250, undefined, { signal: input.signal });
+                const boundary = await decide();
+                if (boundary)
+                    return boundary;
+                current = await readiness();
+            }
+            if (current !== "ready")
+                throw blocked("Owned native child readiness became unproven");
+            return null;
+        };
+        const childBoundary = await waitForOwnedChildren(ready);
+        if (childBoundary)
+            return childBoundary;
+        // Node timers truncate large delays. Bounded slices preserve cancellation
+        // and owner checks; monotonic elapsed time does not renew a Retry-After.
+        const until = performance.now() + Math.max(0, Date.parse(history.find(item => item.operation_id === nextId).not_before) - Date.now());
+        while (performance.now() < until) {
+            await delay(Math.min(250, Math.max(0, until - performance.now())), undefined, { signal: input.signal });
+            const boundary = await decide();
+            if (boundary)
+                return boundary;
+        }
+        const afterWait = await decide();
+        if (afterWait)
+            return afterWait;
+        const refreshedBoundary = await waitForOwnedChildren(await readiness());
+        if (refreshedBoundary)
+            return refreshedBoundary;
+        const beforeDispatch = await decide();
+        if (beforeDispatch)
+            return beforeDispatch;
+        try {
+            return await observe(() => input.prompt(nextId, text, ordinal), nextId);
+        }
+        catch (nextError) {
+            // A task can complete/pause while the daemon queues for its permit.
+            // Admission then refuses the stale prompt; accept that owner decision
+            // before treating the transport's rejection as another provider failure.
+            const finished = await decide(nextId);
+            if (finished)
+                return finished;
+            error = nextError;
+            operationId = nextId;
+        }
+    }
+}

package/dist/services/controller-child-repair.js

@@ -0,0 +1,117 @@
+import { AppError } from "../shared/errors.js";
+import { renderNativeChildFollowupInstruction, renderWaitInstructions } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { nativeItemsSettled } from "../harness-runtime/lib/provider-overload-policy.mjs";
+import { parseLifecycleCommand } from "./lifecycle-command.js";
+import { storageSessionId } from "./session-identity.js";
+import { stageWorkIds } from "./stage-work-graph.js";
+import { appendEvent, digest } from "./run-controller-state.js";
+const blocked = (workId, reason, diagnostic = {}) => new AppError("child_work_repair_blocked", "Completed child has no safe automatic Work correction", 1, { work_id: workId, reason, reconciliation_required: true, effect: "no_effect", ...diagnostic });
+function progressKey(error) {
+    const failures = error.details.failures;
+    if (Array.isArray(failures) && failures.length) {
+        const inputs = failures.map((receipt) => typeof receipt.declaration_id === "string" && typeof receipt.command === "string" && typeof receipt.input_hash === "string"
+            ? [receipt.declaration_id, receipt.command, receipt.input_hash] : null);
+        return inputs.every(Boolean) ? digest([error.code, inputs.sort((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)))]) : null;
+    }
+    return typeof error.details.input_key === "string" && typeof error.details.rejection_signature === "string"
+        ? digest([error.details.input_key, error.details.rejection_signature]) : null;
+}
+/** One durable correction per refusal/successor, not a provider retry or a new worker. */
+export function completedChildRepair(context, row, input) {
+    const members = stageWorkIds(context, row.project_id, row.run_id, input.stage);
+    for (const child of input.children) {
+        if (child.status !== "completed")
+            continue;
+        const links = context.db.all(`SELECT w.work_id,w.status FROM work_sessions ws
+      JOIN works w ON w.work_id=ws.work_id JOIN sessions s ON s.session_id=ws.session_id AND s.project_id=w.project_id
+      WHERE w.project_id=? AND w.run_id=? AND ws.session_id=? AND s.parent_session_id=?`, [row.project_id, row.run_id, storageSessionId({ harness_id: input.harness, session_id: child.session_id }), storageSessionId({ harness_id: input.harness, session_id: input.parentId })])
+            .filter(link => members.has(link.work_id));
+        if (!links.some(link => link.status === "running"))
+            continue;
+        if (links.length !== 1 || child.parent_session_id !== input.parentId || child.provenance === "parent_mismatch"
+            || !child.terminal_turn_id || !nativeItemsSettled(child.native_turn_items))
+            throw blocked(links[0].work_id, "native_identity_unconfirmed");
+        const workId = links[0].work_id;
+        if (context.db.get("SELECT 1 FROM check_receipts WHERE project_id=? AND run_id=? AND work_id=? AND status='running' LIMIT 1", [row.project_id, row.run_id, workId]))
+            continue;
+        if (context.db.get("SELECT 1 FROM works WHERE parent_work_id=? AND status IN ('created','running','paused') LIMIT 1", [workId]))
+            throw blocked(workId, "descendants_unsettled");
+        const reservations = context.db.all(`SELECT e.controller_id,e.data_json FROM run_controller_events e
+      JOIN run_controllers c ON c.controller_id=e.controller_id WHERE c.project_id=? AND c.run_id=?
+      AND e.event_type='work_repair_reserved' AND json_extract(e.data_json,'$.work_id')=? ORDER BY e.sequence DESC`, [row.project_id, row.run_id, workId]);
+        const refusals = context.db.all("SELECT id,command,scope_json,identity_json,outcome_json FROM lifecycle_invocations WHERE status='settled' AND json_extract(outcome_json,'$.error.details.work_id')=? ORDER BY rowid DESC", [workId]);
+        const refusal = refusals.find(attempt => {
+            try {
+                const scope = JSON.parse(attempt.scope_json), identity = JSON.parse(attempt.identity_json ?? "null");
+                const parsed = parseLifecycleCommand(attempt.command);
+                return attempt.scope_json === context.env.DD_FLOW_INVOCATION_SCOPE && parsed.kind === "standalone" && parsed.invocation.operation === "work_finish" && scope.runId === row.run_id
+                    && scope.generation === row.generation && scope.rootSessionId === input.parentId
+                    && Array.isArray(identity) && identity[2] === child.session_id && identity[3] === input.parentId;
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!refusal)
+            throw blocked(workId, "repair_refusal_missing");
+        const outcome = JSON.parse(refusal.outcome_json), error = outcome.error, details = error?.details;
+        const diagnostic = { refusal_invocation_id: refusal.id, successor_invocation_id: outcome.successor_invocation_id, primary_error: { code: error?.code, message: error?.message } };
+        // Reattach the exact durable episode before admitting a new one. A new
+        // terminal Turn/UUID alone never authorizes a second delivery.
+        for (const previous of reservations) {
+            const retained = JSON.parse(previous.data_json);
+            const operation = context.db.get("SELECT status FROM run_controller_operations WHERE operation_id=?", [retained.operation_id]);
+            const sameEpisode = retained.refusal_invocation_id === refusal.id && retained.successor_invocation_id === outcome.successor_invocation_id;
+            if (operation?.status !== "completed" && operation?.status !== "failed") {
+                if (previous.controller_id !== row.controller_id || retained.generation !== row.generation || retained.child_session_id !== child.session_id)
+                    throw blocked(workId, "followup_owner_unconfirmed", { ...diagnostic, operation_id: retained.operation_id });
+                return retained;
+            }
+            if (sameEpisode)
+                throw blocked(workId, "followup_admission_unconfirmed", { ...diagnostic, operation_id: retained.operation_id });
+        }
+        if (details?.effect !== "no_effect" || details.recoverable !== true || typeof details.retry_command !== "string"
+            || typeof outcome.successor_invocation_id !== "string")
+            throw blocked(workId, "repair_successor_unproven", diagnostic);
+        const successor = context.db.get("SELECT scope_json,status FROM lifecycle_invocations WHERE id=?", [outcome.successor_invocation_id]);
+        if (successor?.status !== "issued" || successor.scope_json !== refusal.scope_json)
+            throw blocked(workId, "repair_successor_not_issued", diagnostic);
+        const progress = progressKey(error);
+        if (!progress)
+            throw blocked(workId, "repair_progress_unproven", diagnostic);
+        if (reservations.some(previous => {
+            const retained = JSON.parse(previous.data_json);
+            // Legacy episodes without a binding cannot prove a new correction.
+            return !retained.progress_key || retained.progress_key === progress;
+        }))
+            throw blocked(workId, "repeated_without_progress", diagnostic);
+        const instruction = renderNativeChildFollowupInstruction(input.harness, child, { purpose: "work_repair", context: JSON.stringify({ work_id: workId, code: error.code, message: error.message, retry_command: details.retry_command }) });
+        if (!instruction)
+            throw blocked(workId, "same_child_repair_unsupported", diagnostic);
+        return { work_id: workId, generation: row.generation, child_session_id: child.session_id, terminal_turn_id: child.terminal_turn_id, refusal_invocation_id: refusal.id,
+            successor_invocation_id: outcome.successor_invocation_id, progress_key: progress,
+            operation_id: `${row.controller_id}:work-repair:${digest([row.run_id, workId, row.generation, refusal.id, outcome.successor_invocation_id])}`,
+            prompt: `Continue only the existing child for this unfinished Work. This is one bound correction, not a new fanout wave.\n${instruction}\n\nA follow-up submission acknowledgement or the child's previous completed Turn is not completion of this correction. Wait for this same child's follow-up; never resend the message to poll it.\n${renderWaitInstructions({ harness: input.harness, stage: input.stage })}` };
+    }
+    return null;
+}
+export function reserveChildRepair(context, row, repair, assertOwner) {
+    context.db.writeTransaction(() => {
+        assertOwner();
+        if (repair.generation !== row.generation)
+            throw blocked(repair.work_id, "generation_changed_before_followup");
+        const work = context.db.get("SELECT status FROM works WHERE project_id=? AND run_id=? AND work_id=?", [row.project_id, row.run_id, repair.work_id]);
+        if (work?.status !== "running")
+            throw blocked(repair.work_id, "work_changed_before_followup");
+        const reserved = context.db.get(`SELECT e.controller_id,e.data_json FROM run_controller_events e JOIN run_controllers c ON c.controller_id=e.controller_id
+      WHERE c.project_id=? AND c.run_id=? AND e.event_type='work_repair_reserved' AND json_extract(e.data_json,'$.successor_invocation_id')=?`, [row.project_id, row.run_id, repair.successor_invocation_id]);
+        if (reserved && (reserved.controller_id !== row.controller_id || reserved.data_json !== JSON.stringify(repair)))
+            throw blocked(repair.work_id, "episode_reserved_by_another_dispatch");
+        if (!reserved) {
+            const successor = context.db.get("SELECT status FROM lifecycle_invocations WHERE id=?", [repair.successor_invocation_id]);
+            if (successor?.status !== "issued")
+                throw blocked(repair.work_id, "successor_changed_before_followup");
+            appendEvent(context, row.controller_id, "work_repair_reserved", repair);
+        }
+    });
+}

package/dist/services/controller-fanout.js

@@ -12,8 +12,9 @@ import { requireProjectByRoot } from "./projects.js";
 import { stageAttempt, stageWorkIds } from "./stage-work-graph.js";
 import { runtimeCommand } from "./runtime-command.js";
 import { promptDeliveryInstruction } from "./prompt-delivery.js";
-import { currentStageFinishCommand } from "./lifecycle-invocations.js";
+import { currentStageFinishAuthority } from "./lifecycle-invocations.js";
 import { acceptedChildWork } from "./controller-result-authority.js";
+import { explicitWorkFailure } from "./controller-work-failure.js";
 function semanticCompletionPrompt(stage, completed, command) {
     const task = stage === "plan-review"
         ? "Classify the reviewer findings, apply every accepted correction in the current PLAN-REVIEW Work, and write the authoritative review decision."
@@ -72,7 +73,10 @@ export async function nextControllerFanout(context, input) {
         throw new AppError("stage_graph_compatibility_required", "The retained graph cannot be dispatched by this controller; use the RUN's pinned engine", 1, { stage: input.stage, run_id: input.runId, graph: fanout });
     if (children.length) {
         const reconciled = await reconcileVnextFanout(context, { ...input, observations });
-        const issues = reconciled.issues.filter(issue => !["child_check_in_progress", "child_capacity_pending"].includes(issue.code));
+        // A known settled child's Work blocker does not consume an independent
+        // ready branch. It remains running, so this cannot manufacture Stage success.
+        const issues = reconciled.issues.filter(issue => !["child_check_in_progress", "child_capacity_pending"].includes(issue.code)
+            && !(issue.code === "execution_ended_without_work_result" && issue.work_id && input.repairBlockedWorks?.includes(issue.work_id)));
         if (issues.length)
             throw new AppError("fanout_reconciliation_required", "Native child outcome requires reconciliation, not replay", 1, { issues });
         const unsettled = children.filter(child => child.status === "running" || child.status === "unknown");
@@ -96,21 +100,28 @@ export async function nextControllerFanout(context, input) {
     if (fanout.works.failed || fanout.works.cancelled) {
         const projectId = requireProjectByRoot(context, input.projectRoot).id;
         const members = stageWorkIds(context, projectId, input.runId, input.stage);
-        const failures = context.db.all("SELECT work_id,status,result FROM works WHERE project_id = ? AND run_id = ? AND parent_work_id = ? AND status IN ('failed','cancelled')", [projectId, input.runId, fanout.parent_work_id]).filter(work => members.has(work.work_id)).map(work => {
-            let receipt = {};
-            try {
-                const value = work.result ? JSON.parse(work.result) : null;
-                if (value && typeof value === "object" && !Array.isArray(value))
-                    receipt = value;
-            }
-            catch { /* Missing legacy metadata is unknown. */ }
-            const providerError = safeNativeFailure(receipt.provider_error);
-            const nativeBinding = verifiedNativeWorkFailure(context, { projectRoot: input.projectRoot, runId: input.runId, stage: input.stage, parentSessionId: input.sessionId, parentWorkId: fanout.parent_work_id, workId: work.work_id, receipt });
-            return { work_id: work.work_id, status: work.status, ...(providerError ? { provider_error: providerError } : {}),
-                ...(nativeBinding ? { native_binding: nativeBinding } : {}),
-                ...Object.fromEntries(["terminal_turn_id", "terminal_observed_at"].filter(key => typeof receipt[key] === "string" && receipt[key].length <= 256).map(key => [key, receipt[key]])) };
-        });
-        throw new AppError("fanout_child_failed", "A child Work failed or was cancelled; no retry authority has been issued", 1, { stage: input.stage, run_id: input.runId, parent_work_id: fanout.parent_work_id, failed: fanout.works.failed, cancelled: fanout.works.cancelled, failures, effect: "unknown" });
+        const failedIds = context.db.all("SELECT work_id FROM works WHERE project_id=? AND run_id=? AND parent_work_id=? AND status='failed' ORDER BY work_id", [projectId, input.runId, fanout.parent_work_id]).filter(work => members.has(work.work_id));
+        const explicit = !input.dispatchFence && !fanout.works.cancelled ? failedIds.map(work => explicitWorkFailure(context, projectId, input.runId, work.work_id)) : [];
+        const failure = explicit.length === failedIds.length && explicit.length ? explicit[0] : null;
+        if (failure && !(input.deferredFailure === failure.work_id && fanout.works.ready.length))
+            return { kind: "failure", failure, ready: fanout.works.ready.length > 0 };
+        if (!failure) {
+            const failures = context.db.all("SELECT work_id,status,result FROM works WHERE project_id = ? AND run_id = ? AND parent_work_id = ? AND status IN ('failed','cancelled')", [projectId, input.runId, fanout.parent_work_id]).filter(work => members.has(work.work_id)).map(work => {
+                let receipt = {};
+                try {
+                    const value = work.result ? JSON.parse(work.result) : null;
+                    if (value && typeof value === "object" && !Array.isArray(value))
+                        receipt = value;
+                }
+                catch { /* Missing legacy metadata is unknown. */ }
+                const providerError = safeNativeFailure(receipt.provider_error);
+                const nativeBinding = verifiedNativeWorkFailure(context, { projectRoot: input.projectRoot, runId: input.runId, stage: input.stage, parentSessionId: input.sessionId, parentWorkId: fanout.parent_work_id, workId: work.work_id, receipt });
+                return { work_id: work.work_id, status: work.status, ...(providerError ? { provider_error: providerError } : {}),
+                    ...(nativeBinding ? { native_binding: nativeBinding } : {}),
+                    ...Object.fromEntries(["terminal_turn_id", "terminal_observed_at"].filter(key => typeof receipt[key] === "string" && receipt[key].length <= 256).map(key => [key, receipt[key]])) };
+            });
+            throw new AppError("fanout_child_failed", "A child Work failed or was cancelled; no retry authority has been issued", 1, { stage: input.stage, run_id: input.runId, parent_work_id: fanout.parent_work_id, failed: fanout.works.failed, cancelled: fanout.works.cancelled, failures, effect: "unknown" });
+        }
     }
     if (fanout.works.ready.length) {
         const choices = fanout.works.ready.map(work => {
@@ -214,10 +225,12 @@ export async function nextControllerFanout(context, input) {
             ].join("\n\n"));
         }
     }
-    const finish = currentStageFinishCommand(context, input.stage);
+    const finish = currentStageFinishAuthority(context, input.stage);
     if (!finish)
-        throw new AppError("controller_finish_authority_missing", "Settled child Work has no current issued Stage finish; reconcile lifecycle authority", 1, { stage: input.stage });
-    return prompt("semantic_completion", semanticCompletionPrompt(input.stage, fanout.works.completed, finish));
+        throw new AppError("controller_finish_authority_missing", "Settled child Work has no current Stage finish authority", 1, { stage: input.stage, reconciliation_required: true });
+    if (finish.status !== "issued" || !finish.command)
+        throw new AppError("controller_finish_authority_pending", "Observe the original Stage finish before another productive dispatch", 1, { stage: input.stage, invocation_id: finish.id, status: finish.status, reconciliation_required: true });
+    return prompt("semantic_completion", semanticCompletionPrompt(input.stage, fanout.works.completed, finish.command));
 }
 /** Shared pinned runtime normalization; preserve structured errors at the TS boundary. */
 export function controllerNativeChildren(receipt, rootSessionId) {