@deksden-com/dd-flow-cli 0.9.0-beta.155 → 0.9.0-beta.158

package/dist/services/retained-native-hook.js

@@ -12,6 +12,7 @@ import { handleAgyEvent, handleCodexHook, handleDroidEvent, handleOpenCodeEvent,
 import { withDaemonProgressObserver } from "../harness-runtime/lib/daemon-observation.mjs";
 const object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
 const sha256 = (value) => crypto.createHash("sha256").update(value).digest("hex");
+const diagnostics = new WeakMap();
 async function regularJson(file) {
     try {
         const handle = await open(file, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
@@ -65,6 +66,23 @@ function payloadCommand(binding) {
  * binding from its verified native-delivery map before it becomes a receipt. */
 export async function reconcileRetainedNativeHook(context, input) {
     const { scope, invocationId } = input;
+    const diagnostic = (phase, error, binding) => {
+        if (!input.onDiagnostic)
+            return;
+        const supplied = error instanceof Error || object(error) ? error.code : undefined;
+        const code = typeof supplied === "string" && /^[A-Za-z][A-Za-z0-9_]{0,95}$/.test(supplied) ? supplied : "native_hook_verification_unavailable";
+        // Diagnostics never become execution authority or activity. Keep identifiers
+        // and a typed cause, not native messages/configs that can contain credentials.
+        const value = { phase, code, invocation_id: invocationId,
+            ...(typeof binding?.request_id === "string" ? { request_id: binding.request_id } : {}),
+            ...(typeof binding?.operation_id === "string" ? { operation_id: binding.operation_id } : {}) };
+        const seen = diagnostics.get(context) ?? new Set(), key = JSON.stringify(value);
+        if (seen.has(key))
+            return;
+        seen.add(key);
+        diagnostics.set(context, seen);
+        input.onDiagnostic(value);
+    };
     if (!scope.runId || context.env.DD_FLOW_DAEMON_ID !== scope.daemonId)
         return false;
     let owner = null;
@@ -84,17 +102,22 @@ export async function reconcileRetainedNativeHook(context, input) {
     let metadata;
     try {
         const state = readNativeDaemonState(stateDir);
-        if ((state.daemon_id ?? state.config?.daemonId) !== scope.daemonId)
+        if ((state.daemon_id ?? state.config?.daemonId) !== scope.daemonId) {
+            diagnostic("owner", { code: "daemon_owner_mismatch" });
             return false;
+        }
         const project = requireProjectByRoot(context, scope.projectRoot);
         owned = requireManagedDaemonBinding(context, { stateDir, projectId: project.id, runId: scope.runId });
         metadata = JSON.parse(owned.process.metadata_json);
     }
-    catch {
+    catch (error) {
+        diagnostic("owner", error);
         return false;
     }
-    if (metadata.run_generation !== scope.generation)
+    if (metadata.run_generation !== scope.generation) {
+        diagnostic("owner", { code: "run_generation_mismatch" });
         return false;
+    }
     const operations = path.join(stateDir, "operations");
     if (!await realDirectory(operations))
         return false;
@@ -151,14 +174,20 @@ export async function reconcileRetainedNativeHook(context, input) {
                     || !(resolved.parent_provider_session_id === null || typeof resolved.parent_provider_session_id === "string")
                     || ["request_id", "operation_id", "daemon_id", "turn_generation", "source_harness", "root_provider_session_id", "provider_session_id",
                         "tool_call_id", "event", "native_command", "command_sha256", "native_creator", "native_admission"].some(key => resolved[key] !== binding[key])
-                    || payloadCommand(resolved) !== binding.native_command)
+                    || payloadCommand(resolved) !== binding.native_command) {
+                    diagnostic("verify", { code: "native_hook_unproven" }, binding);
                     continue;
+                }
                 verified.push(resolved);
             }
             else if (proof.verified === true && JSON.stringify(proof.nativeHookBinding) === JSON.stringify(binding))
                 verified.push(binding);
+            else
+                diagnostic("verify", { code: "native_hook_unproven" }, binding);
+        }
+        catch (error) {
+            diagnostic("verify", error, binding);
         }
-        catch { /* Legacy/retired daemons cannot attest a retained fact. */ }
     }
     // Exact old tool delivery belongs to its immutable prior attempt. A public
     // command may be identical in a fresh no-effect successor; do not repeatedly

package/dist/services/run-control.js

@@ -302,16 +302,19 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
         // third-party session/card never acknowledged completion.
         const physicalContext = { ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: registeredProcesses.find(item => records.includes(item.record))?.home ?? resourceHome(context) } };
         let executionAbsent = false;
-        if ((boundary || technicalPause) && !interrupt && !conflicts.has(directory) && !unsafeDaemons.has(canonicalPath(directory, false))) {
+        let absenceVersion;
+        if ((boundary || technicalPause || control?.action === "stop") && !interrupt && !conflicts.has(directory) && !unsafeDaemons.has(canonicalPath(directory, false))) {
             try {
-                executionAbsent = managedDaemonExecutionAbsent(physicalContext, { stateDir: directory, projectId: project.id, runId: input.runId });
+                absenceVersion = nativeInventoryVersion(directory);
+                executionAbsent = managedDaemonExecutionAbsent(physicalContext, { stateDir: directory, projectId: project.id, runId: input.runId })
+                    && absenceVersion === nativeInventoryVersion(directory);
             }
             catch { /* Unknown physical ownership remains on strict reconciliation. */ }
         }
         if (executionAbsent) {
             const leader = records.find(record => record.kind.endsWith("-daemon") && record.id === state.resource_process?.id && record.pid === state.pid && record.lease_token === state.resource_process.lease_token);
             if (leader && (state.daemon_id ?? state.config?.daemonId)) {
-                nativeVersions.set(directory, nativeInventoryVersion(directory));
+                nativeVersions.set(directory, absenceVersion);
                 closedDaemons.set(directory, { source: "owned_execution_absent", daemon_id: state.daemon_id ?? state.config?.daemonId,
                     session_ids: state.sessions.map(item => typeof item === "string" ? item : adapterSessionId(item)), execution_settled: true,
                     native_cleanup_confirmed: state.shutdown_state === "clean", processes: records.map(record => managedProcessBinding(record, registeredProcesses.find(item => item.record === record).home)) });
@@ -320,34 +323,6 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
                 continue;
             }
         }
-        // Explicit stop can reconcile a retired owner whose last bookkeeping ACK
-        // failed. This is physical retirement, not a fabricated clean shutdown.
-        if (control?.action === "stop" && state.shutdown_state === "cleanup_failed")
-            try {
-                const daemonId = state.daemon_id ?? state.config?.daemonId;
-                const daemon = records.filter(record => record.kind.endsWith("-daemon"));
-                const provider = records.filter(record => record.kind.endsWith("-provider"));
-                const operations = retainedDaemonOperations(directory);
-                const owner = state.config?.runtime_owner;
-                if (daemonId && !conflicts.has(directory) && !unsafeDaemons.has(canonicalPath(directory, false))
-                    && state.active_tree === false && !state.active_operation && state.shutdown?.daemon_id === daemonId
-                    && state.shutdown.phases?.tree === true && state.shutdown.phases.provider === true
-                    && daemon.length === 1 && provider.length === 1 && records.length === 2
-                    && daemon[0].id === state.resource_process?.id && daemon[0].lease_token === state.resource_process.lease_token && daemon[0].pid === state.pid
-                    && provider[0].id === state.provider_process?.id && provider[0].lease_token === state.provider_process.lease_token && provider[0].pid === state.provider_pid
-                    && JSON.parse(daemon[0].metadata_json).dispatch_barrier === "run-generation@1"
-                    && records.every(record => record.pid && record.pid_started_at && ["stopped", "failed"].includes(record.state) && record.finished_at && !processTreeIsAlive(record))
-                    && operations.length > 0 && operations.every(operation => ["completed", "failed", "interrupted"].includes(String(operation.state))
-                    && (operation.operation === "daemon.start" ? operation.daemon_id === null && operation.launch?.runtime_owner === JSON.stringify(owner)
-                        : operation.daemon_id === daemonId && ["daemon.stop", "daemon.status", "session.create", "session.prompt", "session.start", "session.fork", "session.resume", "session.cancel", "session.inspect"].includes(String(operation.operation))
-                            && (operation.session_id == null || state.sessions.some(item => (typeof item === "string" ? item : adapterSessionId(item)) === operation.session_id))))) {
-                    nativeVersions.set(directory, nativeInventoryVersion(directory, operations));
-                    closedDaemons.set(directory, { source: "observed_owned_retirement", daemon_id: daemonId, stopped: true, settled: true,
-                        session_ids: state.sessions.map(item => typeof item === "string" ? item : adapterSessionId(item)),
-                        processes: records.map(record => ({ process_id: record.id, pid: record.pid, pid_started_at: record.pid_started_at })) });
-                }
-            }
-            catch { /* Invalid or unfinished evidence remains on the existing recovery path. */ }
         if (!interrupt) {
             try {
                 const nativeOperations = retainedDaemonOperations(directory);
@@ -477,10 +452,17 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             if (!Array.isArray(args) || args.some(value => typeof value !== "string") || !saved.state_dir || !saved.executable || saved.owner !== operation.controller_id || conflicts.has(saved.state_dir) || directoryAdapters.get(saved.state_dir) !== saved.executable)
                 throw new AppError("controller_operation_binding_unknown", "Unfinished controller operation has no matching frozen runtime binding", 1);
             const method = `${args[0]}.${args[1] === "status" ? "inspect" : args[1]}`;
-            if ((boundary || technicalPause) && closedDaemons.get(saved.state_dir)?.source === "owned_execution_absent"
-                && (["daemon.stop", "session.cancel", "session.inspect"].includes(method)
+            if (control?.action === "stop" && closedDaemons.get(saved.state_dir)?.source === "owned_execution_absent"
+                && (!["session.create", "session.prompt", "session.start", "session.fork", "session.cancel", "session.resume", "session.inspect", "daemon.start", "daemon.stop"].includes(method)
+                    || !args.includes("--state-dir") || args[args.indexOf("--state-dir") + 1] !== saved.state_dir
+                    || args.includes("--session-id") && !targets.has(JSON.stringify([saved.state_dir, args[args.indexOf("--session-id") + 1]]))))
+                throw new AppError("controller_operation_binding_unknown", "Fenced operation differs from its retained runtime scope", 1);
+            if ((boundary || technicalPause || control?.action === "stop") && closedDaemons.get(saved.state_dir)?.source === "owned_execution_absent"
+                && (control?.action === "stop" || ["daemon.stop", "session.cancel", "session.inspect"].includes(method)
                     || saved.obligation && controllerObligationAccepted(context, requireController(context, operation.controller_id), saved.obligation))) {
-                return { operation_id: operation.operation_id, status: "completed", receipt: { source: "accepted_boundary_execution_absent", native_outcome: "unavailable", cleanup_pending: true } };
+                // This completes the settlement observation, not the original unknown
+                // operation. Its retained row/effect remains unknown and is not replayed.
+                return { operation_id: operation.operation_id, status: "completed", receipt: { source: control?.action === "stop" ? "fenced_stop_execution_absent" : "accepted_boundary_execution_absent", native_outcome: "unavailable", original_operation_status: operation.status, semantic_outcome_accepted: false, cleanup_pending: true } };
             }
             if (!["session.create", "session.prompt", "session.start", "session.fork", "session.cancel", "session.resume", "session.inspect", "daemon.start", "daemon.stop"].includes(method))
                 throw new AppError("controller_operation_receipt_required", "Unfinished controller operation needs its original receipt", 1);
@@ -733,7 +715,7 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
         // remaining idempotent resource finish. Unknown outcomes keep their ID.
         if (sessionsSettled) {
             const remainingFinish = state.shutdown_state === "cleanup_failed" && state.active_tree === false
-                && state.shutdown?.daemon_id === daemonId && state.shutdown.phases?.tree === true
+                && state.shutdown?.daemon_id === daemonId && state.shutdown.phases?.execution === true
                 && state.shutdown.required_phases?.includes("daemon_resource")
                 && state.shutdown.phases.daemon_resource !== true
                 && state.shutdown.required_phases.every(phase => phase === "daemon_resource" || state.shutdown.phases[phase] === true);
@@ -922,7 +904,7 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
 }
 export function nativeInventoryVersion(directory, operations = retainedDaemonOperations(directory)) {
     const state = JSON.parse(fs.readFileSync(path.join(directory, "daemon.json"), "utf8"));
-    const keys = ["schema_id", "daemon_id", "config", "pid", "provider_pid", "shutdown_state", "shutdown", "active_operation", "active_tree", "sessions", "descendants", "root_session_id", "resource_process", "provider_process", "owned_processes"];
+    const keys = ["schema_id", "daemon_id", "config", "pid", "provider_pid", "shutdown_state", "shutdown", "active_operation", "active_tree", "sessions", "descendants", "root_session_id", "resource_process", "provider_process", "owned_processes", "native_execution_revision", "unclaimed_activity", "native_resources_entries", "native_topology_error", "native_retirement_notifications", "terminal_observation_pending", "tool_observation_gaps"];
     // Only these native verbs are read-only. Unknown verbs remain guarded.
     const productive = operations.filter(operation => !isObservationOperation(operation.operation));
     const knownSchema = ["dd-opencode/daemon-state@2", "dd-codex/daemon-state@1", "dd-grok/daemon-state@1", "dd-zcode/daemon-state@1", "dd-agy/daemon-state@1", "dd-droid/daemon-state@1"].includes(String(state.schema_id));

package/dist/services/run-controller-process.js

@@ -79,12 +79,25 @@ async function prepareSpawn(context, row) {
     const launch = launchRecord(context, row);
     if (!launch || launch.value.dispatch_ready || !["starting", "running", "recovery_required"].includes(row.status))
         return null;
-    const launcher = await physicalStartup(context.databaseDeadlineAt).birth(() => {
-        const current = requireController(context, row.controller_id);
-        if (current.owner_token !== row.owner_token || current.generation !== row.generation)
-            throw new AppError("controller_owner_mismatch", "Controller launch owner changed during physical observation", 1);
-        assertLaunchAllowed(context, current);
-    });
+    const superseded = new AppError("controller_owner_mismatch", "Controller launch owner changed during physical observation", 1);
+    let launcher;
+    try {
+        launcher = await physicalStartup(context.databaseDeadlineAt).birth(() => {
+            const current = requireController(context, row.controller_id);
+            if (current.generation !== row.generation)
+                throw new AppError("controller_owner_mismatch", "Controller launch generation changed during physical observation", 1);
+            if (current.owner_token !== row.owner_token)
+                throw superseded;
+            assertLaunchAllowed(context, current);
+        });
+    }
+    catch (error) {
+        // Like a lost launch CAS below, a concurrent winner is observed, not
+        // retried or replaced. Other ownership/admission errors remain refusals.
+        if (error === superseded)
+            return null;
+        throw error;
+    }
     const resourceContext = { ...context, env: { ...context.env, DD_FLOW_RESOURCE_HOME: JSON.parse(row.manifest_json).resource_home } };
     const ours = launch.value.pid === launcher.pid && launch.value.pid_started_at === launcher.pid_started_at;
     let token = row.owner_token;

package/dist/services/run-controller.js

@@ -55,6 +55,9 @@ import { storageSessionId } from "./session-identity.js";
 import { RECOVERY_POLICY as CAPACITY_POLICY, nativeItemsSettled, recoveryExhausted as overloadExhausted, recoveryRefusal as refusalObservation, terminalProviderRecovery as terminalProviderOverload, normalizeRecoveryFailure } from "../harness-runtime/lib/provider-overload-policy.mjs";
 import { renderNativeChildFollowupInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
 import { childCapacityDispatchAllowed, childCapacityRecoveryDecision, closeSuccessfulChildCapacity, reconcileChildCapacity } from "./controller-child-capacity.js";
+import { completedChildRepair, reserveChildRepair } from "./controller-child-repair.js";
+import { prepareWorkFailureResolution, readFailureDecision, failureDecisionReady, acceptFailureDecision, applyWorkFailureDecision, reconcilePendingWorkFailure, workFailureResolutionPrompt, workFailureDiagnostic, workFailureBlockActive } from "./controller-work-failure.js";
+import { getVnextFanoutStatus } from "./vnext-fanout.js";
 import { isObservationLoss } from "../harness-runtime/lib/operation-errors.mjs";
 import { recordTechnicalNote } from "./technical-notes.js";
 import { acceptedChildWork, acceptedChildrenRetired, controllerObligation, controllerObligationAccepted, lateNativeFailure } from "./controller-result-authority.js";
@@ -608,14 +611,18 @@ async function executeController(context, row, manifest, state, assertOwnership,
     };
     const capacityUncertain = (error) => error instanceof AppError && ["capacity_continuation_blocked", "operation_observation_lost"].includes(error.code) && error.details.capacity_uncertainty === true || Boolean(state.pending_capacity) && (String(error?.code) === "capacity_continuation_blocked" || isObservationLoss(error));
     const stopAfterFailure = (error) => {
+        // The published pause already fences this owner. A later observer failure
+        // must not supersede that same control with a second pause or fatal stop.
+        if (technicalPauseRequested)
+            return Promise.resolve();
         // A retained successor may already be running. Fencing/recovery records
         // uncertainty; cancellation is not evidence of its missing outcome.
         if (capacityUncertain(error))
             return Promise.resolve();
         if (retainControllerLeaseUncertainty(context, row, error))
             return Promise.resolve();
-        if (error instanceof AppError && (error.details.reconciliation_required === true || ["invocation_assignment_unproven", "invocation_outcome_pending", "invocation_receipt_timeout"].includes(error.code)) && state.current_session !== null)
-            return pauseDependency(state.sessions[state.current_session]).catch(cause => {
+        if (error instanceof AppError && error.code !== "child_work_repair_blocked" && (error.details.reconciliation_required === true || ["invocation_assignment_unproven", "invocation_outcome_pending", "invocation_receipt_timeout"].includes(error.code)) && state.current_session !== null)
+            return pauseDependency(state.sessions[state.current_session], undefined, error, "productive_continuation").catch(cause => {
                 if (!(cause instanceof AppError && cause.code === "controller_technical_dependency_paused"))
                     return stopAfterFailure(new AppError("controller_dependency_control_unavailable", "The dependency pause could not be published safely", 1, { primary: errorRecord(error), control_error: errorRecord(cause) }));
             });
@@ -672,9 +679,24 @@ async function executeController(context, row, manifest, state, assertOwnership,
         note(session, "accepted_work_native_child_failed", "native_completion", "cleanup_pending", child.terminal_turn_id);
         return false;
     });
-    const pauseDependency = async (session, sourceOperationId) => {
-        assertOwner();
-        note(session, "native_writer_dependency_blocked", "stage_transition", "dependency_blocked");
+    const pauseDependency = async (session, sourceOperationId, cause, protectedAction = "stage_transition") => {
+        // The control intent contains the retained productive failure; it must not
+        // require that same failure to disappear before the owner can pause it.
+        assertPhysicalOwner();
+        const recorded = cause ? errorRecord(cause) : { code: "native_writer_dependency_blocked", message: "Conflicting native execution has not settled" };
+        const primary = { code: String(recorded.code), message: String(recorded.message) };
+        const details = cause instanceof AppError ? cause.details : {};
+        const dependency = { primary, protected_action: protectedAction,
+            ...(typeof details.reason === "string" ? { reason: details.reason } : {}),
+            ...Object.fromEntries(["work_id", "operation_id", "refusal_invocation_id", "successor_invocation_id"].filter(key => typeof details[key] === "string").map(key => [key, details[key]])) };
+        recordTechnicalNote(context, row.project_id, row.run_id, { code: primary.code, message: primary.message,
+            phase: protectedAction, generation: row.generation, ...(state.stage ? { stage: state.stage } : {}),
+            ...(typeof details.work_id === "string" ? { work_id: details.work_id } : {}),
+            harness: runtimeHarness(session.profile), resource_identity: session.state_dir,
+            consequence: "dependency_blocked", ...(sourceOperationId ? { source_operation_id: sourceOperationId } : {}),
+            diagnostic_reference: JSON.stringify(dependency) });
+        // Diagnostic observations can race (adapter read vs lifecycle monitor), but
+        // they own one pause of this execution, not one control per error message.
         const requestId = `technical:${row.controller_id}:${row.generation}:${digest([state.stage, session.state_dir]).slice(0, 20)}`;
         const input = { projectRoot: manifest.request.project_root, runId: row.run_id, requestId, action: "pause" };
         // Publish source binding in the same SQL transaction as the control
@@ -688,13 +710,13 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 return;
             const prior = context.db.get("SELECT 1 FROM run_controller_events WHERE controller_id=? AND event_type='technical_dependency_paused' AND json_extract(data_json,'$.control_id')=? AND COALESCE(json_extract(data_json,'$.source_operation_id'),'')=?", [row.controller_id, controlId, sourceOperationId ?? ""]);
             if (!prior)
-                appendEvent(context, row.controller_id, "technical_dependency_paused", { schema_id: "dd-flow/controller-dependency@1", request_id: requestId, control_id: controlId, generation: row.generation, control: receipt, state_dir: session.state_dir, ...(sourceOperationId ? { source_operation_id: sourceOperationId } : {}) });
+                appendEvent(context, row.controller_id, "technical_dependency_paused", { schema_id: "dd-flow/controller-dependency@1", request_id: requestId, control_id: controlId, generation: row.generation, control: receipt, state_dir: session.state_dir, ...dependency, ...(sourceOperationId ? { source_operation_id: sourceOperationId } : {}) });
         });
         if (typeof intent.control_id !== "string")
             throw new AppError("controller_dependency_control_unavailable", "Technical control was not created", 1, { intent });
         technicalPauseRequested = true;
         const control = await requestRunControl(executionContext, { ...input, waitMs: 0 });
-        throw new AppError("controller_technical_dependency_paused", "Conflicting native execution requires control reconciliation before continuation", 1, { control, effect: "no_effect" });
+        throw new AppError("controller_technical_dependency_paused", "A retained dependency requires control reconciliation before continuation", 1, { control, ...dependency, effect: "no_effect" });
     };
     const confirmStopped = async (stateDir, receipt) => {
         const fail = () => new AppError("controller_native_shutdown_unproven", "The managed daemon is not proven clean and closed", 1, { state_dir: stateDir, receipt });
@@ -761,7 +783,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
             // A missing report is not a failed Stage. A real unstable source still
             // fences its dependent successor until the existing control can seal it.
             if (nextStage && ["recovery_observation_budget_exhausted", "controller_boundary_changed", "snapshot_source_changed", "owned_inventory_changed"].includes(code) && state.current_session !== null)
-                await pauseDependency(state.sessions[state.current_session]);
+                await pauseDependency(state.sessions[state.current_session], undefined, error, "boundary_capture");
         }
     };
     const reconcilePromptPredecessor = async (session) => {
@@ -771,7 +793,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
             return;
         const receipt = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false).catch(async (error) => {
             if (accepted && controllerObligationAccepted(context, row, accepted) && lateNativeFailure(error, session.id))
-                await pauseDependency(session);
+                await pauseDependency(session, undefined, error, "predecessor_settlement");
             throw error;
         });
         state.last_receipt = receipt;
@@ -782,12 +804,12 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 note(session, "accepted_boundary_settlement_pending", "native_observation", "cleanup_pending");
                 if (receipt.native_settled === true && receipt.settled === true)
                     return;
-                await pauseDependency(session);
+                await pauseDependency(session, undefined, new AppError("accepted_boundary_settlement_pending", "Accepted boundary still has an unsettled native predecessor", 1), "predecessor_settlement");
             }
             throw new AppError("settlement_reconciliation_required", "The managed Session still has an unsettled productive predecessor", 1, { session_id: session.id, settlement: current });
         }
     };
-    const prompt = async (session, text, operationId, kind, boundary = "finish", assignedWorkIds) => {
+    const prompt = async (session, text, operationId, kind, boundary = "finish", assignedWorkIds, failureResolution) => {
         const hitl = kind === "hitl";
         const pending = state.pending_capacity;
         if (pending && (pending.session_id !== session.id || pending.generation !== row.generation || pending.kind !== (kind ?? "stage") || operationId && operationId !== pending.root_operation_id))
@@ -796,6 +818,8 @@ async function executeController(context, row, manifest, state, assertOwnership,
             await reconcilePromptPredecessor(session);
         const firstOperationId = pending?.root_operation_id ?? operationId ?? `${row.controller_id}:prompt:${crypto.randomUUID()}`;
         const expectedBoundary = state.stage ? controllerObligation(context, row, state.stage, hitl ? "resume" : boundary, assignedWorkIds) : undefined;
+        if (expectedBoundary && failureResolution)
+            expectedBoundary.failure_resolution = failureResolution;
         const hitlText = async () => {
             const answerId = firstOperationId.slice(0, -`:prompt:${row.generation}`.length);
             const answer = context.db.get("SELECT input_json,receipt_json FROM run_controller_operations WHERE operation_id = ? AND controller_id = ? AND status IN ('accepted','completed')", [answerId, row.controller_id]);
@@ -955,8 +979,11 @@ async function executeController(context, row, manifest, state, assertOwnership,
         catch (error) {
             if (!fatal && error instanceof AppError && ["run_recovery_guarded", "run_recovery_generation_stale", "controller_owner_mismatch"].includes(error.code))
                 throw error;
-            if (!fatal && lateNativeFailure(error, session.id))
-                await pauseDependency(session, firstOperationId);
+            if (!fatal && lateNativeFailure(error, session.id)) {
+                if (failureResolution && failureDecisionReady(failureResolution))
+                    acceptFailureDecision(executionContext, row, failureResolution, assertOwner);
+                await pauseDependency(session, firstOperationId, error, "productive_continuation");
+            }
             await stopAfterFailure(error);
             if (!capacityUncertain(error) && !(error instanceof AppError && error.code === "controller_lease_unconfirmed"))
                 cancellation.abort();
@@ -968,7 +995,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
         return receipt;
     };
     const monitor = setInterval(() => {
-        if (fatal)
+        if (fatal || technicalPauseRequested)
             return;
         try {
             checkOutcomes();
@@ -980,6 +1007,12 @@ async function executeController(context, row, manifest, state, assertOwnership,
         }
     }, 1000);
     monitor.unref();
+    const resolutionWriterSettled = async (session) => {
+        const inspected = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+        state.last_receipt = inspected;
+        saveState(context, row, state);
+        return inspected.settled === true && !controllerNativeChildren(inspected, session.id).some(child => ["running", "unknown"].includes(child.status));
+    };
     try {
         for (;;) {
             if (technicalPauseRequested)
@@ -1003,7 +1036,17 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 const file = args?.includes("--prompt-file") ? args[args.indexOf("--prompt-file") + 1] : undefined;
                 if (!session || pending.generation !== row.generation || !file || digestBytes(fs.readFileSync(file)) !== dispatch?.prompt_sha256)
                     throw new AppError("capacity_continuation_conflict", "Retained capacity resume reference has no exact owned prompt", 1);
-                await prompt(session, fs.readFileSync(file, "utf8"), pending.root_operation_id, pending.kind === "stage" ? undefined : pending.kind);
+                await prompt(session, fs.readFileSync(file, "utf8"), pending.root_operation_id, pending.kind === "stage" ? undefined : pending.kind, dispatch?.obligation?.action ?? "finish", dispatch?.obligation?.work_ids, dispatch?.obligation?.failure_resolution);
+                continue;
+            }
+            const failureRecovery = await reconcilePendingWorkFailure(executionContext, row, state, next.kind, run.project_root, assertOwner, resolutionWriterSettled);
+            if (failureRecovery === "waiting") {
+                setStatus("waiting_for_children");
+                await delay(1000);
+                continue;
+            }
+            if (failureRecovery === "applied") {
+                saveState(context, row, state);
                 continue;
             }
             if (next.kind !== "paused" && state.current_session !== null) {
@@ -1051,6 +1094,11 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 appendEvent(context, row.controller_id, "terminal", { reason: next.reason });
                 return;
             }
+            if ((next.kind === "paused" || next.kind === "blocked") && workFailureBlockActive(executionContext, row, view.index)) {
+                setStatus("waiting_for_dependency");
+                await delay(1000, undefined, { signal: cancellation.signal });
+                continue;
+            }
             if (next.kind === "paused") {
                 setStatus("waiting_for_user");
                 const pause = view.index.stage_runs.find(stage => stage.stage === next.stage)?.pause;
@@ -1152,7 +1200,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 }
                 if (!session || transition.session_mode === "new_session" || !sameSessionProfile(session.profile, transition.coordinator) || path.resolve(session.cwd) !== stageCwd) {
                     if (session && !await retireSession(session))
-                        await pauseDependency(session);
+                        await pauseDependency(session, undefined, new AppError("native_session_cleanup_pending", "Retired Session still prevents conflicting workspace reuse", 1), "stage_transition");
                     await renewLease();
                     assertOwner();
                     const directory = path.join(row.state_dir, `session-${state.sessions.length + 1}`);
@@ -1394,8 +1442,55 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     continue;
                 }
             }
+            const repairBlockedWorks = [];
+            if (!retainedFailures.length && children.some(child => child.status === "completed" && !acceptedChildWork(context, row, childHarness, session.id, child.session_id))) {
+                const inspected = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false);
+                state.last_receipt = inspected;
+                saveState(context, row, state);
+                children = controllerNativeChildren(inspected, session.id).filter(child => !baseline.has(child.session_id));
+                // Do not compete with an active parent/healthy sibling or turn a known
+                // repair into a replacement fanout wave.
+                if (inspected.settled !== true || children.some(child => ["running", "unknown"].includes(child.status))) {
+                    setStatus("waiting_for_children");
+                    await delay(1000, undefined, { signal: cancellation.signal });
+                    continue;
+                }
+                let repair = null;
+                const blockers = [];
+                for (const child of children) {
+                    try {
+                        repair ??= completedChildRepair(executionContext, row, { stage: next.stage, harness: childHarness, parentId: session.id, children: [child] });
+                    }
+                    catch (error) {
+                        if (!(error instanceof AppError) || error.code !== "child_work_repair_blocked")
+                            throw error;
+                        blockers.push(error);
+                    }
+                }
+                if (repair) {
+                    reserveChildRepair(executionContext, row, repair, assertOwner);
+                    await prompt(session, repair.prompt, repair.operation_id, undefined, "work", [repair.work_id]);
+                    continue;
+                }
+                if (blockers.length) {
+                    const graph = getVnextFanoutStatus(executionContext, { projectRoot: run.project_root, runId: run.id, stage: next.stage }).orchestration;
+                    if (!graph?.works.ready.length)
+                        throw blockers[0];
+                    for (const blocker of blockers) {
+                        const workId = String(blocker.details.work_id);
+                        repairBlockedWorks.push(workId);
+                        recordTechnicalNote(context, row.project_id, row.run_id, { code: "child_work_repair_blocked", message: blocker.message,
+                            phase: "work_repair", generation: row.generation, stage: next.stage, work_id: workId, harness: childHarness,
+                            resource_identity: workId, consequence: "dependency_blocked", diagnostic_reference: JSON.stringify({
+                                protected_action: "work_finish", reason: blocker.details.reason, primary: blocker.details.primary_error,
+                                refusal_invocation_id: blocker.details.refusal_invocation_id, successor_invocation_id: blocker.details.successor_invocation_id,
+                                operation_id: blocker.details.operation_id
+                            }) });
+                    }
+                }
+            }
             const memoryFlow = ["mb-init", "mb-upgrade", "mb-fix", "interactive"].includes(run.flow_kind) || isSourceSnapshotFlow(run.flow_kind) || routing.kind === "descriptor" && isDeliveryFlow(run.flow_kind);
-            const fanoutInput = { projectRoot: run.project_root, runId: run.id, stage: next.stage, harness: runtimeHarness(session.profile), sessionId: session.id, children, policy, profiles, dispatchFence: retainedFailures.length > 0 };
+            const fanoutInput = { projectRoot: run.project_root, runId: run.id, stage: next.stage, harness: runtimeHarness(session.profile), sessionId: session.id, children, policy, profiles, dispatchFence: retainedFailures.length > 0, repairBlockedWorks, ...(state.work_failure?.deferred ? { deferredFailure: state.work_failure.work_id } : {}) };
             const fanout = memoryFlow ? await runControllerMemoryTask(executionContext, { operation: "fanout", input: fanoutInput }, cancellation.signal)
                 : await nextControllerFanout(executionContext, fanoutInput);
             if (memoryFlow)
@@ -1427,6 +1522,43 @@ async function executeController(context, row, manifest, state, assertOwnership,
                     throw new AppError(cause.code, cause.message, 1, { ...cause.details, ...(cause.invocation_id ? { invocation_id: cause.invocation_id } : {}), ...(cause.hook_event_id ? { hook_event_id: cause.hook_event_id } : {}), controller_wrapper: "incomplete_subject_turn", stage: next.stage });
                 throw new AppError("incomplete_subject_turn", "Managed Turn ended without a completed Stage or declared continuation", 1, { stage: next.stage });
             }
+            if (fanout.kind === "failure") {
+                const resolution = state.work_failure ?? prepareWorkFailureResolution(executionContext, row, next.stage, fanout.failure);
+                if (resolution.work_id !== fanout.failure.work_id || resolution.work_session_id !== fanout.failure.work_session_id)
+                    throw new AppError("work_failure_scope_changed", "Pending resolution belongs to another failed attempt", 1);
+                state.work_failure = resolution;
+                saveState(context, row, state);
+                while (!failureDecisionReady(resolution)) {
+                    const attempt = state.work_failure.submission_attempt ?? 0;
+                    if (attempt >= 2)
+                        await pauseDependency(session, undefined, new AppError("work_failure_decision_invalid", "Coordinator did not submit a valid bound failure decision", 1, workFailureDiagnostic(resolution)), "work_failure_resolution");
+                    await prompt(session, workFailureResolutionPrompt(resolution, state.work_failure.submission_diagnostic), `${row.controller_id}:failure-resolution:${digest([resolution.accepted_file, attempt, row.generation])}`, undefined, "failure_resolution", undefined, resolution);
+                    try {
+                        readFailureDecision(resolution);
+                    }
+                    catch (error) {
+                        state.work_failure.submission_diagnostic = error instanceof Error ? error.message : String(error);
+                    }
+                    state.work_failure.submission_attempt = attempt + 1;
+                    saveState(context, row, state);
+                }
+                const decision = acceptFailureDecision(executionContext, row, resolution, assertOwner);
+                if (decision.action === "block" && fanout.ready) {
+                    state.work_failure.deferred = true;
+                    saveState(context, row, state);
+                    continue;
+                }
+                if (!await resolutionWriterSettled(session)) {
+                    setStatus("waiting_for_children");
+                    await delay(1000);
+                    continue;
+                }
+                applyWorkFailureDecision(executionContext, row, resolution, decision, run.project_root, assertOwner);
+                delete state.work_failure;
+                state.last_continuation = null;
+                saveState(context, row, state);
+                continue;
+            }
             if (fanout.kind === "wait") {
                 if (fanout.reason === "accepted_work_native_cleanup") {
                     const pending = children.filter(child => ["running", "unknown"].includes(child.status) && acceptedChildWork(context, row, childHarness, session.id, child.session_id));
@@ -1435,20 +1567,20 @@ async function executeController(context, row, manifest, state, assertOwnership,
                         try {
                             await call(session, ["session", "cancel", "--session-id", child.session_id, ...sessionArguments(context, manifest, session)], false);
                         }
-                        catch {
-                            await pauseDependency(session);
+                        catch (error) {
+                            await pauseDependency(session, undefined, error, "accepted_child_retirement");
                         }
                     }
                     const operationId = `${row.controller_id}:child-retirement:${crypto.randomUUID()}`;
                     const observed = await call(session, ["session", "inspect", "--session-id", session.id, ...sessionArguments(context, manifest, session)], false, operationId).catch(async (error) => {
                         if (lateNativeFailure(error, session.id))
-                            await pauseDependency(session);
+                            await pauseDependency(session, operationId, error, "accepted_child_retirement");
                         throw error;
                     });
                     state.last_receipt = observed;
                     saveState(context, row, state);
                     if (!acceptedChildrenRetired(pending.map(child => child.session_id), observed, session.id, operationId))
-                        await pauseDependency(session);
+                        await pauseDependency(session, operationId, new AppError("accepted_child_retirement_unconfirmed", "Accepted child results are retained but native retirement remains unconfirmed", 1), "accepted_child_retirement");
                     continue;
                 }
                 setStatus(fanout.reason === "qualified_capacity_required" ? "waiting_for_capacity" : "waiting_for_children");
@@ -1504,7 +1636,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 if (rejected)
                     throw fatal ?? rejected.reason;
                 if (cleanupConflict)
-                    await pauseDependency(session);
+                    await pauseDependency(session, undefined, new AppError("external_work_cleanup_pending", "Accepted external Work still has an unretired workspace writer", 1), "workspace_reuse");
                 state.last_continuation = null;
                 saveState(context, row, state);
                 continue;

package/dist/services/vnext-code.js

@@ -1,5 +1,5 @@
 import { managedLifecycleCommand } from "./lifecycle-invocations.js";
-import { stageLifecycleInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { stageLifecycleInstruction, workStopConditionInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
 import { ensureAggregateRepair, ensureRepairIntent } from "./repair-intents.js";
 import { runWorkspaceBootstrap } from "./workspace-bootstrap.js";
 import crypto from "node:crypto";
@@ -546,6 +546,8 @@ export function coordinatorPrompt(context, input) {
         "</code_graph>",
         "",
         "<execution_commands>",
+        workStopConditionInstruction,
+        "An explicit child work fail ends that attempt, not automatically the Stage. The controller supplies a bound failure-resolution packet; submit its requested decision without inventing a retry, mutating runtime state or replaying accepted predecessors.",
         "Do not choose a provider delegation tool from this stage prompt. At each work_fanout boundary, stop at the Work-graph boundary; the shared controller supplies the selected adapter's native tool, exact parameters, child task, and wait contract. It launches only entries listed in graph.ready and uses at most the qualified capacity. Every registered CODE Work runs in a fresh child Session, including a serial dependency chain. The coordinator launches those children only through the controller-supplied native delegation instruction; it must never invoke a Work start_command itself. Each child receives its complete packet from dd-flow and runs its own exact start_command. After a Work finishes, the controller uses the graph returned by work finish to launch newly ready Work. To refresh the parent graph yourself use the exact command: " + runtimeCommand(context, ["work", "ls", "--run", input.run.id, "--ready", "--project-root", input.projectRoot, "--json"]),
         "A quiet child is still running until the harness reports its turn completed, failed, cancelled or explicitly needs attention. An elapsed nominal wait, silence, or no new artifact is not an unresponsive-worker failure. Never interrupt, replace, relaunch, or stage-block a still-running child for that reason, even if an external controller asks. Long work finish and stage finish commands emit check progress on stderr. After you issue the exact CODE stage finish command, wait for that same command to return once: a completed command with a non-zero exit and structured `code_gate_failed` output is its terminal result, not a reason to keep waiting. A repair_required continuation already registered the repair: end this Turn. Do not invoke that Work's start_command from the coordinator Session, inspect its PID, start a second finish command, or infer failure from quiet output. Close a disposable child only after its Work is accepted or explicitly failed/cancelled and the harness reports the turn settled.",
         `A repairable engine, harness, or environment failure is not a user question. Write the evidence summary to ${path.join(requireHome(input.run), "works", input.rootWork.work_id, "block-summary.md")}, then record it with a separate command: ${runtimeCommand(context, ["stage", "block", input.run.id, "--stage", "code", "--work", input.rootWork.work_id, "--kind", "<engine|harness|environment>", "--code", "<stable-code>", "--summary-file", `@run/works/${input.rootWork.work_id}/block-summary.md`, "--retryable", "--project-root", input.projectRoot, "--json"])}. Choose kind and stable-code from evidence; this example is not an executable continuation. Repair it externally, then run the exact unblock_command returned by dd-flow and continue this same stage.`,

package/dist/services/vnext-plan-review.js

@@ -21,7 +21,7 @@ import { currentStagePrompt, applyExternalStageContext, prepareExternalStageCont
 import { prepareJsonSchema, prepareOutputFile } from "../cli/input-preparation.js";
 import { getStageFanoutCapacity, readFanoutDescriptor, subagentCapacityKey, writeFanoutDescriptor } from "./vnext-fanout.js";
 import { stageGraphScope } from "./stage-work-graph.js";
-import { stageLifecycleInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
+import { stageLifecycleInstruction, workStopConditionInstruction } from "../harness-runtime/lib/delegation-instructions.mjs";
 import { prepareRunVerificationMatrix, acceptVerificationMatrix, commitVerificationMatrixStart, resumeVerificationMatrix, verificationMatrixInstruction, latestRunVerificationMatrix } from "./verification-matrix.js";
 import { reviewerSourceInputs, reviewerSourceInstruction } from "./review-copy.js";
 import { reviewDefEvidence } from "./review-deferral.js";
@@ -366,7 +366,7 @@ function orchestratorPrompt(context, input) {
     const decision = path.join(input.root, "decision.json");
     const workspaceContract = ["<workspace_contract>", `- route: ${input.workspaceRoute.route}`, `- feature branch: ${input.workspaceRoute.feature_branch ?? "not applicable"}`, `- base commit: ${input.workspaceRoute.base_ref ?? "not applicable"}`, `- read/write workspace: ${input.run.workspace_root}`, "The CLI verified this frozen route. All plan and correction writes belong in the named workspace; project root remains only the stable lifecycle identity. Do not create, switch, merge or delete branches/worktrees.", "</workspace_contract>"].join("\n");
     const acceptanceOwnership = "For every deferred acceptance or document update, identify the named CODE Work owner, its causal checks, and when it can truthfully close the obligation. Aggregate checks run only after implementation Work completes: assign a CODE owner to pending documents and use CODE needs_checks → verification_required → repair after those receipts. A promise that MERGE or an unnamed readiness owner will finish acceptance is a material PLAN finding; bootstrap workspace readiness is not proof of the new feature.";
-    const template = [acceptanceOwnership, planCheckInstruction,
+    const template = [acceptanceOwnership, planCheckInstruction, workStopConditionInstruction, "Review stop_conditions semantically: reject conditions that veto the requested change merely because the baseline differs, turn planned paths into ownership, or expand one unsupported evidence operation into a prohibition on all implementation. Preserve real safety, accepted-decision and required-evidence boundaries.",
         `The accepted check profile is ${path.join(input.run.workspace_root, ".memory-bank", "spec", "engineering", "code-check-profile.json")}. A new check required by a correction is planned, not available: name its provider Work and order consumers after that Work.`,
         input.template].join("\n\n");
     const reviewerLaunch = capacity.source === "external_policy"