@deksden-com/dd-flow-cli 0.9.0-beta.38 → 0.9.0-beta.39

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @deksden-com/dd-flow-cli
 
+## 0.9.0-beta.39
+
+### Patch Changes
+
+- 803d2d0: Own managed Stage/Work execution, immutable boundary captures, mixed-profile handoffs and operator pause/stop/resume in the shared CLI runtime. Fence productive admission durably, reconcile exact native/process generations, preserve interrupted and unknown outcomes, and resume retained sessions without replaying completed work.
+
+  Control experiment-wide Subject, Judge and probe ownership through one retained resource registry, with detached control/recovery workers and explicit physical drain and release evidence. Require guarded shared-store migration and current runtime bindings; remove dependence on eval-owned productive adapters.
+
+  Discover native Codex children from spawn receipts and release terminal failed provider turns only after a fresh settled-tree observation.
+
 ## 0.9.0-beta.38
 
 ### Patch Changes
@@ -1037,7 +1047,6 @@ record` command with the bounded 15-probe contract.
 - 16f68a3: Add router-native engine snapshot commands and routed project-command dispatch.
 
   Also include the runtime/dashboard compatibility wave needed by the current Memory Bank canon:
-
   - target-based dashboard `open`/`refresh` commands and related-command help;
   - persisted FIFO lane waiters and merge wait-acquire specialization;
   - `migration plan/report/verify` evidence helpers for controlled `mb-upgrade` runtime migrations;

package/dist/build-info.json

@@ -1,11 +1,11 @@
 {
   "cli_package": "@deksden-com/dd-flow-cli",
-  "cli_version": "0.9.0-beta.38",
-  "cli_commit": "e1d723e620ee5aeec961c2bee1de1e72fcfb71a9",
-  "built_at": "2026-09-08T03:57:03.109Z",
+  "cli_version": "0.9.0-beta.39",
+  "cli_commit": "adabaee64d3de604908351aa1ee048208c1dd249",
+  "built_at": "2026-09-09T16:08:31.531Z",
   "built_with_canon": {
-    "version": "4.0.6",
-    "commit": "c6fc50cb3b5526ea0162ee4454d1ee36f17be2da",
+    "version": "4.1.0",
+    "commit": "ef349bf47cba1c987468e51d73a0dbadbd48dc1f",
     "flow_contract": "dd-flow-canonical-2026-08",
     "repo_root": "/Users/deksden/Documents/_Projects/dd-memorybank",
     "memorybank_root": "/Users/deksden/Documents/_Projects/dd-memorybank/.memory-bank",

package/dist/cli/help.js

@@ -1,4 +1,36 @@
 const helpPages = new Map([
+    ["runtime scope", `Usage:
+  dd-flow runtime scope fence --scope-id EVAL_ID --request-id ID --json
+  dd-flow runtime scope status --scope-id EVAL_ID --json
+  dd-flow runtime scope stop --scope-id EVAL_ID --request-id ID --json
+  dd-flow runtime scope control --scope-id EVAL_ID --request-id ID --mode pause|stop [--manifest-json JSON] --json
+  dd-flow runtime scope resume --scope-id EVAL_ID --request-id ID --generation N --capture-key SHA256 --json
+
+Use the EVAL manifest's retained DD_FLOW_RESOURCE_HOME. Commands select exactly
+one scope across its registered runtime homes; neighboring scopes are untouched.
+fence durably blocks new provider turns and owned baseline checks. It does not
+stop existing work. status reports retained ownership, not proof of settlement.
+stop fences first and requests owned daemon-tree and baseline-process cleanup.
+Inspect settled and each node's evidence: ok alone does not prove cleanup.
+Unproven ownership or cleanup remains pending; repeat stop to observe settlement.
+The fence/stop route is terminal cancellation and has no resume command.
+control records recoverable scope intent and starts a detached drain owner.
+The EVAL resolver supplies a runtime-scope-manifest@1 declaration with the source
+manifest path, SHA-256 and execution IDs, including queued executions. Declaration
+changes are rejected. resume accepts the exact captured generation and starts
+detached recovery preparation. It does not yet release scope admission: inspect
+dispatch_blocked and pending reasons; accepted preparation is not resumed work.
+RUN pause/stop/resume uses dd-flow run control.`],
+    ["storage", `Usage:
+  dd-flow storage migrate-writer --database ABSOLUTE_DB --backup NEW_ABSOLUTE_FILE --offline --json
+
+Drain all local and external runtime owners before using --offline. This command
+migrates one existing database, not a whole runtime or retained provider Session.
+It refuses unresolved ownership rows, preserves a verified WAL-safe backup, and
+fences unaware old writers. It does not initialize the default DD_FLOW_HOME.
+The backup path must be new; existing backups are never overwritten. An exact
+retry of a committed migration returns its receipt after verifying the backup.
+If no committed receipt exists, retain the failed backup and choose a new path.`],
     [
         "",
         `dd-flow - mechanical control layer for dd-flow workflows
@@ -33,6 +65,8 @@ Core commands:
   session register/status/stop  Register flow sessions and stop workers.
   dashboard data/render/open/refresh Render, refresh, open, and inspect project/global dashboards.
   schema validate             Validate canonical dd-flow JSON data contracts.
+  storage migrate-writer      Explicitly back up and fence a drained SQLite store.
+  runtime scope fence/status/stop Fence, inspect, or cancel one retained EVAL scope.
   memory permissions preflight Check Memory Bank write/read permissions.
   integration cmux status       Inspect optional cmux integration.
   codex home/hooks/hook         Manage Codex homes, hooks, and hook events.
@@ -153,8 +187,11 @@ Usage:
   dd-flow run start --project-root <root> [--workspace-root <checkout>] --flow-kind <kind> --subject-type <type> --subject-id <id> --slug <slug> [--preset compact|normal|full] [--task-profile-file <file>] [--protocol-override-file <file>] [--flag key=value] [--next-action <text>] --json
   dd-flow id next --type protocol|run --project-root <root> --slug <slug> --json
   dd-flow run status <RUN-ID|RUN-short-id> --project-root <root> --json
+  dd-flow run control status --run <RUN-ID> --project-root <root> --json
+  dd-flow run drive launch --run <RUN-ID> --project-root <root> --request-id <id> --context-file <file> --context-sha256 <sha256> [--stop-after <stage>] [--capture-root <directory>] --json
+  dd-flow run drive status --run <RUN-ID> --project-root <root> [--after <sequence>] --json
   dd-flow run list --project-root <root> --json
-  dd-flow run prepare-vnext-specify --project-root <root> --slug <slug> --json
+  dd-flow run prepare-vnext-specify --project-root <root> --slug <slug> [--execution-routing-file <file>] --json
   dd-flow run recovery inspect|begin|seal|capture|resume <RUN-ID|RUN-short-id> --project-root <root> --json
   dd-flow run snapshot create <RUN-ID|RUN-short-id> (--stage-entry <stage>|--candidate|--incomplete|--recovery-id <RCV-ID>) --project-root <root> --output <directory> --json
   dd-flow run snapshot restore --snapshot <directory> --project-root <prepared-root> [--recovery-id <RCV-ID>] --json
@@ -171,8 +208,12 @@ Usage:
 
 RUN-* is the execution envelope for one concrete flow launch. Semantic truth remains in protocol, experiment, DEF, scenario, evidence, and Memory Bank documents. New run artifacts are stored under DD_FLOW_HOME/projects/<PRJ-ID-slug>/runs/<RUN-ID-slug>/ with one run.json projection and an append-only timeline.jsonl. Timeline is the compact full run report: summary is always present, while --hide may suppress bulky sections. Use \`dd-flow stat usage --run …\` to reread registered local Codex transcript counters and tool-call facts and refresh the current usage projection; unavailable data is explicit rather than zero.
 
+run start and prepare-vnext-specify accept --execution-routing-file for vNext RUNs: dd-flow/execution-routing@1 with an execution object selects the complete routing policy from existing agent-profiles. RUN creation freezes the input and selected profiles without changing project settings.
+run snapshot restore also accepts --execution-routing-file for a new stage-entry experiment. Its fresh DD_FLOW_HOME may contain only agent-profiles and the empty database; selected profiles are read before import, previous RUN policy is archived, and existing Work overrides must resolve against the selected frozen profiles. Recovery imports reject this option.
 run prepare-vnext-specify allocates an otherwise unstarted vNext RUN for the canonical SPECIFY entry checkpoint. run recovery makes an interrupted RUN read-only, requires an explicit settled-tree receipt, captures immutable recovery evidence, then explicitly returns delegated Work to the ready graph. run snapshot is the eval-only checkpoint boundary: it snapshots one quiescent RUN, its dedicated DD_FLOW_HOME, and the exact project tree including its Git repository, then restores them into a fresh dedicated runtime. It is not a general runtime backup command and fails closed for a shared runtime.
 
+Managed drive is not yet native-provider qualified. With --capture-root, its detached controller fences RUN writers and captures each completed Stage before dispatching its successor. The capture root must be outside the runtime, project and workspace. Status events expose boundary_captured receipts; capturing means writers are still fenced, and capture_failed retains the fence for operator reconciliation. External snapshot creation is rejected while a managed controller owns a live RUN.
+
 Examples:
   dd-flow run start --project-root "$PWD" --flow-kind mb_sdlc --subject-type protocol --subject-id PRT-001-demo --slug demo --json
   dd-flow id next --type run --project-root "$PWD" --slug demo --json

package/dist/cli/run-cli.js

@@ -1,6 +1,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { createContext, createRouterContext } from "../runtime/context.js";
+import { migrateStoreWriter } from "../storage/writer-migration.js";
 import { helpForArgs } from "./help.js";
 import { AppError, isAppError } from "../shared/errors.js";
 import { writeJson } from "../shared/json.js";
@@ -50,9 +51,16 @@ import { finishStage, startStage } from "../services/stage-lifecycle.js";
 import { addWorkBatch, assertStageLifecycleOwner, assertWorkLifecycleOwner, cancelWork, deleteWork, failWork, finishWork, listWorks, mutateWorkDeps, retryWork, showWork, startWork } from "../services/work-registry.js";
 import { launchExternalWork } from "../services/external-work-launch.js";
 import { createEvalBootstrapSnapshot, createEvalRunSnapshot, prepareVnextSpecifyRun, restoreEvalBootstrapSnapshot, restoreEvalRunSnapshot } from "../services/eval-snapshots.js";
-import { acceptRunRecovery, beginRunRecovery, inspectRunRecovery, recordRecoveryCapture, resumeRunRecovery, sealRunRecovery } from "../services/run-recovery.js";
+import { acceptRunRecovery, assertRunMutationAllowed, beginRunRecovery, inspectRunRecovery, recordRecoveryCapture, recoveryGuard, resumeRunRecovery, sealRunRecovery } from "../services/run-recovery.js";
+import { recoveryRuntimeAdmission } from "../services/run-recovery-runtime.js";
 import { loadExternalStageContext } from "../services/stage-context.js";
-import { stopManagedProcess, confirmManagedProcess, finishManagedProcess, heartbeatManagedProcess, managedProcessStatus, reconcileExpiredManagedProcesses, registerManagedProcess } from "../services/managed-processes.js";
+import { stopManagedProcess, confirmManagedProcess, finishManagedProcess, heartbeatManagedProcess, managedProcessRuntimeHome, managedProcessStatus, processIsAlive, reconcileExpiredManagedProcesses, registerManagedProcess } from "../services/managed-processes.js";
+import { fenceRuntimeBudget, runtimeBudgetStatus, admitRuntimeCheck, parseRuntimeBudget, reserveProviderTurn, releaseProviderTurns } from "../services/runtime-budget.js";
+import { stopRuntimeScope } from "../services/runtime-scope-stop.js";
+import { launchRuntimeScopeControl, launchRuntimeScopeResume, serveRuntimeScopeControl } from "../services/runtime-scope-worker.js";
+import { launchRunController, resumeRunController, serveRunController, runControllerStatus, answerRunController, supplyRunControllerContext } from "../services/run-controller.js";
+import { controlLifecycleReply, runControlStatus } from "../services/run-control.js";
+import { requestRunControl, serveRunControl } from "../services/run-control-worker.js";
 import { startRuntimeService } from "../services/runtime-service.js";
 const defaultIo = {
     stdout: process.stdout,
@@ -159,6 +167,7 @@ function resolveProjectRootBeforeRouting(args, env) {
 function databaseModeForCommand(args, classification) {
     const [family, command] = args;
     if (family === "engine" ||
+        family === "storage" && command === "migrate-writer" ||
         family === "version" ||
         family === "schema" ||
         family === "canon" && command === "resolve" ||
@@ -510,6 +519,13 @@ function shortSha(value) {
 async function dispatch(args, context, io, scopeProjectRoot = null, classification = classifyCliOperation(args, context.env), output = parseOutputOptions(args)) {
     const [family, command, ...rest] = args;
     const parsed = parseArgs(rest);
+    if (family === "storage" && command === "migrate-writer") {
+        if (parsed.positional.length || [...parsed.options.keys()].some(key => !["database", "backup", "offline"].includes(key)) || [...parsed.options.values()].some(values => values.length !== 1))
+            throw new AppError("usage", "Usage: dd-flow storage migrate-writer --database ABSOLUTE_DB --backup NEW_ABSOLUTE_FILE --offline", 2);
+        if (parsed.options.get("offline")?.[0] !== flagValue)
+            throw new AppError("usage", "Writer migration requires --offline after draining all local and external runtime owners", 2);
+        return { ok: true, ...migrateStoreWriter(requiredOption(parsed, "database"), requiredOption(parsed, "backup")) };
+    }
     if (family === "engine") {
         return dispatchEngine(context, command, parsed, classification);
     }
@@ -898,6 +914,7 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
         const projectRoot = requiredOption(parsed, "project-root");
         const runId = requiredPosition(parsed, 0, "run-id");
         const stage = requiredOption(parsed, "stage");
+        const controlledReply = (result) => controlLifecycleReply(context, { projectRoot, runId }, result);
         const semanticFile = optionalOption(parsed, "semantic-file") ?? optionalOption(parsed, "data");
         const resultFile = optionalOption(parsed, "result-file") ?? semanticFile;
         const resultStdin = hasOption(parsed, "result-stdin");
@@ -925,56 +942,56 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
             if (!resultFile && !resultStdin) {
                 throw new AppError("usage", "vNext SPECIFY finish requires --result-file or --result-stdin", 2);
             }
-            return finishVnextSpecifyStage(context, {
+            return controlledReply(await finishVnextSpecifyStage(context, {
                 projectRoot,
                 runId,
                 ...(resultFile ? { resultFile } : { resultJson: await readStdin(io.stdin) }),
                 outcome: outcome
-            });
+            }));
         }
         if (stage === "protocolize" && isVnextProtocolizeRun(context, { projectRoot, runId })) {
             if (!resultFile || resultStdin || hasOption(parsed, "outcome")) {
                 throw new AppError("usage", "vNext PROTOCOLIZE requires exactly --result-file", 2);
             }
-            return finishVnextProtocolize(context, { projectRoot, runId, resultFile });
+            return controlledReply(await finishVnextProtocolize(context, { projectRoot, runId, resultFile }));
         }
         if (stage === "plan" && isVnextPlanRun(context, { projectRoot, runId })) {
             if (optionalOption(parsed, "code-work-batch-file"))
                 throw new AppError("usage", "vNext PLAN derives its CODE batch from accepted semantic plans; do not supply a batch file", 2);
-            return finishVnextPlan(context, { projectRoot, runId });
+            return controlledReply(await finishVnextPlan(context, { projectRoot, runId }));
         }
         if (stage === "plan-review" && isVnextPlanReviewRun(context, { projectRoot, runId })) {
             if (resultStdin || hasOption(parsed, "outcome"))
                 throw new AppError("usage", "vNext PLAN-REVIEW uses --decision-file", 2);
             const decisionFile = optionalOption(parsed, "decision-file");
-            return finishVnextPlanReview(context, { projectRoot, runId, ...(decisionFile ? { decisionFile } : {}) });
+            return controlledReply(await finishVnextPlanReview(context, { projectRoot, runId, ...(decisionFile ? { decisionFile } : {}) }));
         }
         if (stage === "code" && isVnextPlanRun(context, { projectRoot, runId })) {
             if (semanticFile || resultFile || resultStdin || hasOption(parsed, "outcome")) {
                 throw new AppError("usage", "vNext CODE finish accepts only --verification-file", 2);
             }
-            return await finishVnextCode(context, { projectRoot, runId, verificationFile: optionalOption(parsed, "verification-file") ?? path.join("<missing>", "code-verification.json"), ...(retryCheckId ? { retryCheckId, retryReason: retryReason } : {}), progress: commandProgress(io, output) });
+            return controlledReply(await finishVnextCode(context, { projectRoot, runId, verificationFile: optionalOption(parsed, "verification-file") ?? path.join("<missing>", "code-verification.json"), ...(retryCheckId ? { retryCheckId, retryReason: retryReason } : {}), progress: commandProgress(io, output) }));
         }
         if (stage === "code-review" && isVnextCodeReviewRun(context, { projectRoot, runId })) {
             if (resultStdin || semanticFile || resultFile || hasOption(parsed, "outcome"))
                 throw new AppError("usage", "vNext CODE-REVIEW uses --decision-file", 2);
-            return await finishVnextCodeReview(context, { projectRoot, runId, ...(optionalOption(parsed, "decision-file") ? { decisionFile: optionalOption(parsed, "decision-file") } : {}), ...(retryCheckId ? { retryCheckId, retryReason: retryReason } : {}), progress: commandProgress(io, output) });
+            return controlledReply(await finishVnextCodeReview(context, { projectRoot, runId, ...(optionalOption(parsed, "decision-file") ? { decisionFile: optionalOption(parsed, "decision-file") } : {}), ...(retryCheckId ? { retryCheckId, retryReason: retryReason } : {}), progress: commandProgress(io, output) }));
         }
         if (stage === "merge" && isVnextMergeRun(context, { projectRoot, runId })) {
             if (resultStdin || semanticFile || resultFile || hasOption(parsed, "outcome"))
                 throw new AppError("usage", "vNext MERGE uses the Work result path returned by stage start", 2);
-            return await finishVnextMerge(context, { projectRoot, runId, requestId: requiredOption(parsed, "request"), workId: requiredOption(parsed, "work"), ...(retryCheckId ? { retryCheckId, retryReason: retryReason } : {}), progress: commandProgress(io, output) });
+            return controlledReply(await finishVnextMerge(context, { projectRoot, runId, requestId: requiredOption(parsed, "request"), workId: requiredOption(parsed, "work"), ...(retryCheckId ? { retryCheckId, retryReason: retryReason } : {}), progress: commandProgress(io, output) }));
         }
         if (hasOption(parsed, "outcome") || hasOption(parsed, "result-file") || resultStdin) {
             throw new AppError("usage", "--outcome, --result-file and --result-stdin are only available for vNext SPECIFY", 2);
         }
-        return finishStage(context, {
+        return controlledReply(await finishStage(context, {
             projectRoot,
             runId,
             stage,
             ...(dir ? { dir } : {}),
             ...(semanticFile ? { semanticFile } : {})
-        });
+        }));
     }
     if (family === "stage" && command === "pause") {
         if (!hasOption(parsed, "question-stdin"))
@@ -1056,6 +1073,43 @@ async function dispatch(args, context, io, scopeProjectRoot = null, classificati
         return dispatchSession(context, command, parsed);
     }
     if (family === "run") {
+        if (command === "control") {
+            const action = requiredPosition(parsed, 0, "control action");
+            const scope = { projectRoot: requiredOption(parsed, "project-root"), runId: requiredOption(parsed, "run") };
+            if (action === "status")
+                return runControlStatus(context, scope);
+            if (action === "resume") {
+                if (["force", "grace-ms", "escalate"].some(option => hasOption(parsed, option)))
+                    throw new AppError("usage", "Resume does not accept stop or pause escalation options", 2);
+                return await resumeRunController(context, { ...scope, requestId: requiredOption(parsed, "request-id"), controlId: requiredOption(parsed, "from"), ...(hasOption(parsed, "wait-ms") ? { waitMs: Number(requiredOption(parsed, "wait-ms")) } : {}) });
+            }
+            if (action === "serve")
+                return await serveRunControl(context, { ...scope, controlId: requiredOption(parsed, "control-id") });
+            if (action === "pause" || action === "stop")
+                return await requestRunControl(context, {
+                    ...scope, action, requestId: requiredOption(parsed, "request-id"),
+                    ...(hasOption(parsed, "force") ? { force: true } : {}),
+                    ...(hasOption(parsed, "grace-ms") ? { graceMs: Number(requiredOption(parsed, "grace-ms")) } : {}),
+                    ...(hasOption(parsed, "escalate") ? { escalate: requiredOption(parsed, "escalate") } : {}),
+                    ...(hasOption(parsed, "wait-ms") ? { waitMs: Number(requiredOption(parsed, "wait-ms")) } : {})
+                });
+            throw new AppError("usage", "Use: dd-flow run control pause|stop|resume|status", 2);
+        }
+        if (command === "drive") {
+            const action = requiredPosition(parsed, 0, "drive action");
+            const scope = { projectRoot: requiredOption(parsed, "project-root"), runId: requiredOption(parsed, "run") };
+            if (action === "status")
+                return runControllerStatus(context, { ...scope, ...(optionalOption(parsed, "after") ? { after: Number(optionalOption(parsed, "after")) } : {}) });
+            if (action === "launch")
+                return await launchRunController(context, { ...scope, requestId: requiredOption(parsed, "request-id"), contextFile: requiredOption(parsed, "context-file"), contextSha256: requiredOption(parsed, "context-sha256"), ...(optionalOption(parsed, "stop-after") ? { stopAfter: optionalOption(parsed, "stop-after") } : {}), ...(optionalOption(parsed, "capture-root") ? { captureRoot: optionalOption(parsed, "capture-root") } : {}) });
+            if (action === "serve")
+                return await serveRunController(context, { ...scope, controllerId: requiredOption(parsed, "controller-id") });
+            if (action === "answer")
+                return answerRunController(context, { ...scope, requestId: requiredOption(parsed, "request-id"), pauseId: requiredOption(parsed, "pause-id"), answerFile: requiredOption(parsed, "answer-file") });
+            if (action === "context")
+                return supplyRunControllerContext(context, { ...scope, controllerId: requiredOption(parsed, "controller-id"), requestId: requiredOption(parsed, "request-id"), stage: requiredOption(parsed, "stage"), contextFile: requiredOption(parsed, "context-file"), contextSha256: requiredOption(parsed, "context-sha256") });
+            throw new AppError("usage", "Use: dd-flow run drive launch|status|answer|context", 2);
+        }
         return dispatchRun(context, command, parsed);
     }
     if (family === "stat") {
@@ -1528,13 +1582,14 @@ function dispatchRun(context, command, parsed) {
         if (action === "restore")
             return restoreEvalRunSnapshot(context, {
                 snapshot: requiredOption(parsed, "snapshot"),
+                executionRoutingFile: optionalOption(parsed, "execution-routing-file"),
                 ...(optionalOption(parsed, "recovery-id") ? { recoveryId: requiredOption(parsed, "recovery-id") } : {}),
                 projectRoot: requiredOption(parsed, "project-root")
             });
         throw new AppError("usage", "Use: dd-flow run snapshot bootstrap create|restore | dd-flow run snapshot create <RUN> (--stage-entry <stage>|--candidate) --project-root <path> --output <directory> | dd-flow run snapshot restore --snapshot <directory> --project-root <path>", 2);
     }
     if (command === "prepare-vnext-specify") {
-        return prepareVnextSpecifyRun(context, { projectRoot: requiredOption(parsed, "project-root"), slug: requiredOption(parsed, "slug") });
+        return prepareVnextSpecifyRun(context, { projectRoot: requiredOption(parsed, "project-root"), slug: requiredOption(parsed, "slug"), executionRoutingFile: optionalOption(parsed, "execution-routing-file") });
     }
     if (command === "start") {
         if (optionalOption(parsed, "flow-kind") === "mb-upgrade") {
@@ -1551,6 +1606,7 @@ function dispatchRun(context, command, parsed) {
             nextAction: optionalOption(parsed, "next-action"),
             preset: optionalOption(parsed, "preset"),
             taskProfile: readOptionalJsonFile(optionalOption(parsed, "task-profile-file")),
+            executionRoutingFile: optionalOption(parsed, "execution-routing-file"),
             ...(protocolOverrides ? { protocolOverrides } : {}),
             runOverrides: parseFlowFlagOverrides(allOptions(parsed, "flag"))
         });
@@ -1666,22 +1722,64 @@ function dispatchRun(context, command, parsed) {
     throw new AppError("usage", `Unknown run command: ${command ?? "<empty>"}`, 2);
 }
 async function dispatchRuntime(context, command, parsed, progress) {
+    if (command === "scope") {
+        if (parsed.positional.length === 1 && parsed.positional[0] === "resume") {
+            if ([...parsed.options.keys()].some(key => !["scope-id", "request-id", "generation", "capture-key"].includes(key)) || [...parsed.options.values()].some(values => values.length !== 1))
+                throw new AppError("usage", "Use runtime scope resume --scope-id ID --request-id ID --generation N --capture-key SHA256", 2);
+            return { ok: true, ...await launchRuntimeScopeResume(context, { scopeId: requiredOption(parsed, "scope-id"), requestId: requiredOption(parsed, "request-id"), generation: Number(requiredOption(parsed, "generation")), captureKey: requiredOption(parsed, "capture-key") }) };
+        }
+        if (parsed.positional.length === 1 && parsed.positional[0] === "control") {
+            if ([...parsed.options.keys()].some(key => !["scope-id", "request-id", "mode", "manifest-json"].includes(key)) || [...parsed.options.values()].some(values => values.length !== 1))
+                throw new AppError("usage", "Use runtime scope control --scope-id ID --request-id ID --mode pause|stop [--manifest-json JSON]", 2);
+            const mode = requiredOption(parsed, "mode");
+            if (mode !== "pause" && mode !== "stop")
+                throw new AppError("usage", "Scope control mode must be pause or stop", 2);
+            return { ok: true, ...await launchRuntimeScopeControl(context, requiredOption(parsed, "scope-id"), requiredOption(parsed, "request-id"), mode, hasOption(parsed, "manifest-json") ? JSON.parse(requiredOption(parsed, "manifest-json")) : undefined) };
+        }
+        if (parsed.positional.length === 1 && parsed.positional[0] === "serve") {
+            if ([...parsed.options.keys()].some(key => !["scope-id", "generation"].includes(key)) || [...parsed.options.values()].some(values => values.length !== 1))
+                throw new AppError("usage", "Invalid internal scope worker arguments", 2);
+            return { ok: true, ...await serveRuntimeScopeControl(context, requiredOption(parsed, "scope-id"), Number(requiredOption(parsed, "generation"))) };
+        }
+        if (parsed.positional.length === 1 && parsed.positional[0] === "stop") {
+            if ([...parsed.options.keys()].some(key => !["scope-id", "request-id"].includes(key)) || [...parsed.options.values()].some(values => values.length !== 1))
+                throw new AppError("usage", "Usage: dd-flow runtime scope stop --scope-id EVAL_ID --request-id ID", 2);
+            return { ok: true, ...await stopRuntimeScope(context, requiredOption(parsed, "scope-id"), requiredOption(parsed, "request-id")) };
+        }
+        if (parsed.positional.length === 1 && parsed.positional[0] === "status") {
+            if ([...parsed.options.keys()].some(key => key !== "scope-id") || [...parsed.options.values()].some(values => values.length !== 1))
+                throw new AppError("usage", "Usage: dd-flow runtime scope status --scope-id EVAL_ID", 2);
+            return { ok: true, ...runtimeBudgetStatus(context, requiredOption(parsed, "scope-id")) };
+        }
+        if (parsed.positional.length !== 1 || parsed.positional[0] !== "fence" || [...parsed.options.keys()].some(key => !["scope-id", "request-id"].includes(key)) || [...parsed.options.values()].some(values => values.length !== 1))
+            throw new AppError("usage", "Usage: dd-flow runtime scope fence --scope-id EVAL_ID --request-id ID", 2);
+        return { ok: true, ...fenceRuntimeBudget(context, requiredOption(parsed, "scope-id"), requiredOption(parsed, "request-id")) };
+    }
     if (command !== "process")
-        throw new AppError("usage", "Usage: dd-flow runtime process <start|stop|register|confirm|heartbeat|finish|status|reconcile>", 2);
+        throw new AppError("usage", "Usage: dd-flow runtime <scope|process>; see dd-flow runtime scope --help", 2);
     const action = requiredPosition(parsed, 0, "runtime process action");
+    if (action === "check-admission")
+        return { ok: true, ...admitRuntimeCheck(context, requiredOption(parsed, "id"), requiredOption(parsed, "lease-token")) };
     if (action === "start")
         return await startRuntimeService(context, { projectRoot: requiredOption(parsed, "project-root"), runId: requiredOption(parsed, "run"), command: requiredOption(parsed, "command"), ports: requiredOption(parsed, "ports").split(","), readyPort: requiredOption(parsed, "ready-port"), readyPath: optionalOption(parsed, "ready-path") ?? "/", timeoutMs: optionalPositiveNumber(parsed, "ready-timeout-ms", true) ?? 30_000, progress });
     if (action === "stop")
         return { ok: true, process: await stopManagedProcess(context, { id: requiredOption(parsed, "id"), leaseToken: requiredOption(parsed, "lease-token"), ...(optionalPositiveNumber(parsed, "grace-ms", true) ? { graceMs: optionalPositiveNumber(parsed, "grace-ms", true) } : {}) }) };
     if (action === "register") {
         const leaseMs = optionalPositiveNumber(parsed, "lease-ms", true);
+        const budget = parseRuntimeBudget(optionalOption(parsed, "budget-json"));
+        const projectId = optionalOption(parsed, "project-id") ?? null, runId = optionalOption(parsed, "run") ?? null;
+        const guard = projectId && runId ? recoveryGuard(context, projectId, runId) : null;
+        const run = projectId && runId ? context.db.get("SELECT id FROM runs WHERE project_id = ? AND id = ?", [projectId, runId]) : null;
         const process = registerManagedProcess(context, {
             kind: requiredOption(parsed, "kind"), ownerId: requiredOption(parsed, "owner"),
+            uniqueActiveOperation: requiredOption(parsed, "kind") === "eval-observer",
+            ...(requiredOption(parsed, "kind") === "eval-observer" ? { pid: optionalPositiveNumber(parsed, "pid", true) ?? 0, ...(optionalPositiveNumber(parsed, "process-group-id", true) ? { processGroupId: optionalPositiveNumber(parsed, "process-group-id", true) } : {}) } : {}),
             ownerPid: optionalPositiveNumber(parsed, "owner-pid", true),
-            projectId: optionalOption(parsed, "project-id") ?? null, runId: optionalOption(parsed, "run") ?? null,
+            projectId, runId,
             workId: optionalOption(parsed, "work") ?? null, checkId: optionalOption(parsed, "check") ?? null,
             operationId: optionalOption(parsed, "operation") ?? null, stdoutPath: optionalOption(parsed, "stdout") ?? null,
-            stderrPath: optionalOption(parsed, "stderr") ?? null, ...(leaseMs ? { leaseMs } : {})
+            stderrPath: optionalOption(parsed, "stderr") ?? null, ...(leaseMs ? { leaseMs } : {}),
+            metadata: { ...(budget ? { budget, harness: optionalOption(parsed, "harness") ?? null } : {}), ...(projectId && runId ? { run_generation: guard?.generation ?? 0, run_admitted: Boolean(run) && !["draining", "sealed", "resuming"].includes(guard?.status ?? "") } : {}), ...(optionalOption(parsed, "dispatch-barrier") ? { dispatch_barrier: optionalOption(parsed, "dispatch-barrier") } : {}), ...(optionalOption(parsed, "role") ? { role: optionalOption(parsed, "role") } : {}), ...(optionalOption(parsed, "state-dir") ? { state_dir: optionalOption(parsed, "state-dir") } : {}), ...(optionalOption(parsed, "adapter-executable") ? { adapter_executable: optionalOption(parsed, "adapter-executable") } : {}) }
         });
         return { ok: true, process };
     }
@@ -1694,6 +1792,36 @@ async function dispatchRuntime(context, command, parsed, progress) {
         const leaseMs = optionalPositiveNumber(parsed, "lease-ms", true);
         return { ok: heartbeatManagedProcess(context, { id: requiredOption(parsed, "id"), leaseToken: requiredOption(parsed, "lease-token"), ...(leaseMs ? { leaseMs } : {}) }) };
     }
+    if (action === "admission") {
+        const record = managedProcessStatus(context).find(process => process.id === requiredOption(parsed, "id"));
+        if (!record || record.lease_token !== requiredOption(parsed, "lease-token") || record.owner_id !== requiredOption(parsed, "owner") || record.state !== "running" || !record.pid || !record.pid_started_at || !processIsAlive(record))
+            throw new AppError("process_ownership_unknown", "Productive dispatch requires its current confirmed runtime owner", 1);
+        const metadata = JSON.parse(record.metadata_json);
+        if (metadata.state_dir !== requiredOption(parsed, "state-dir"))
+            throw new AppError("process_ownership_unknown", "Runtime admission belongs to another state directory", 1);
+        if (record.project_id && record.run_id) {
+            if (managedProcessRuntimeHome(record, context) !== context.ddFlowHome)
+                throw new AppError("process_runtime_scope_mismatch", "Runtime admission belongs to another or unproven flow home", 1);
+            const recovering = recoveryRuntimeAdmission(context, record, { stateDir: requiredOption(parsed, "state-dir"), daemonId: optionalOption(parsed, "daemon-id"), operationId: optionalOption(parsed, "operation-id"), operation: optionalOption(parsed, "operation"), nativeSessionId: optionalOption(parsed, "native-session-id"), promptSha256: optionalOption(parsed, "prompt-sha256") });
+            if (!recovering) {
+                if (metadata.run_admitted !== true || !Number.isSafeInteger(metadata.run_generation))
+                    throw new AppError("run_recovery_guarded", "Runtime was not admitted before the RUN fence; reconcile its launch", 1);
+                assertRunMutationAllowed(context, record.project_id, record.run_id, metadata.run_generation);
+            }
+            const run = context.db.get("SELECT status FROM runs WHERE project_id = ? AND id = ?", [record.project_id, record.run_id]);
+            const retainedHitlPrompt = recovering && ["paused", "waiting_for_user"].includes(run?.status ?? "") && ["session.prompt", "session.resume"].includes(optionalOption(parsed, "operation") ?? "") && context.db.get("SELECT 1 FROM run_recovery_bindings b JOIN run_recovery_guards g ON g.recovery_id = b.recovery_id WHERE g.project_id = ? AND g.run_id = ? AND g.generation = ? AND b.daemon_id = ? AND b.provider_session_id = ?", [record.project_id, record.run_id, metadata.run_generation, optionalOption(parsed, "daemon-id"), optionalOption(parsed, "native-session-id")]);
+            if (!run || run.status !== "running" && !retainedHitlPrompt && !["judge", "probe"].includes(metadata.role ?? ""))
+                throw new AppError("invalid_run_state", "Subject dispatch requires a running RUN or its retained recovery/HITL prompt", 1);
+        }
+        const budget = reserveProviderTurn(context, record, { operationId: optionalOption(parsed, "operation-id") ?? "", operation: optionalOption(parsed, "operation") ?? "", sessionId: optionalOption(parsed, "native-session-id"), daemonId: optionalOption(parsed, "daemon-id") });
+        return { ok: true, ...budget, process_id: record.id, generation: metadata.run_generation ?? null };
+    }
+    if (action === "release-turn") {
+        const record = managedProcessStatus(context).find(process => process.id === requiredOption(parsed, "id"));
+        if (!record || record.lease_token !== requiredOption(parsed, "lease-token") || record.owner_id !== requiredOption(parsed, "owner") || managedProcessRuntimeHome(record, context) !== context.ddFlowHome)
+            throw new AppError("process_ownership_unknown", "Budget release requires its retained physical owner", 1);
+        return releaseProviderTurns(context, record, { daemonId: requiredOption(parsed, "daemon-id"), operationId: optionalOption(parsed, "operation-id"), observationFile: optionalOption(parsed, "observation-file") });
+    }
     if (action === "finish") {
         const state = requiredOption(parsed, "state");
         if (state !== "stopped" && state !== "failed")
@@ -1704,7 +1832,7 @@ async function dispatchRuntime(context, command, parsed, progress) {
         return { ok: true, processes: managedProcessStatus(context) };
     if (action === "reconcile")
         return { ok: true, processes: await reconcileExpiredManagedProcesses(context, requiredOption(parsed, "owner"), optionalPositiveNumber(parsed, "grace-ms", true)) };
-    throw new AppError("usage", "Usage: dd-flow runtime process <start|stop|register|confirm|heartbeat|finish|status|reconcile>", 2);
+    throw new AppError("usage", "Usage: dd-flow runtime process <start|stop|register|confirm|heartbeat|admission|finish|status|reconcile>", 2);
 }
 function dispatchStat(context, command, parsed) {
     if (command === "usage") {

package/dist/harness-runtime/bin/dd-agy.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { durableDaemonStart, inspectDaemonOperation } from "../lib/daemon-operations.mjs";
 import { readFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
 import { doctor } from "../lib/dd-agy.mjs";
@@ -22,10 +23,10 @@ async function hook(options) {
 try {
   const { positional, options } = parse(process.argv.slice(2)), [family, command] = positional; const common = { journal: options.journal, stateDir: options["state-dir"], cwd: options.cwd, bin: options["agy-bin"], provider: options.provider, model: options.model, reasoning: options.reasoning, mode: options.mode, projectRoot: options["project-root"], ddFlowBin: options["dd-flow-bin"], ddFlowHome: options["dd-flow-home"], noFlow: options["no-flow"] === true, timeoutMs: options.timeout ? Number(options.timeout) * 1000 : undefined }; let result;
   if (family === "doctor") result = await doctor(common);
-  else if (family === "daemon" && command === "start") result = await startDaemon({ ...common, sessionId: options["session-id"], entryPath: process.argv[1] });
+  else if (family === "daemon" && command === "start") result = await durableDaemonStart({ ...common, sessionId: options["session-id"], entryPath: process.argv[1] }, startDaemon);
   else if (family === "daemon" && command === "serve") { await serveDaemon(common.stateDir); process.exit(0); }
   else if (family === "daemon" && command === "status") result = await callDaemon(common.stateDir, "daemon.status");
-  else if (family === "daemon" && command === "operation") result = await callDaemon(common.stateDir, "operation.inspect", { operationId: options["operation-id"] });
+  else if (family === "daemon" && command === "operation") result = await inspectDaemonOperation(common.stateDir, options["operation-id"]);
   else if (family === "daemon" && command === "stop") result = await stopDaemon({ stateDir: common.stateDir, cancelTree: options["cancel-tree"], timeoutMs: common.timeoutMs });
   else if (family === "hook" && command === "handle") { process.stdout.write(`${JSON.stringify(await hook(options))}\n`); process.exit(0); }
   else if (family === "session") { if (command === "fork") throw Object.assign(new Error("Antigravity native headless fork is unsupported; use deterministic_replay"), { code: "agy_headless_fork_unsupported" }); const operation = command === "status" ? "inspect" : command; result = await callDaemon(common.stateDir, `session.${operation}`, { sessionId: options["session-id"], ...(command === "create" || command === "prompt" ? { prompt: await prompt(options) } : {}), tree: options.tree === true }, common.timeoutMs ?? 1_800_000); }

package/dist/harness-runtime/bin/dd-codex.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { durableDaemonStart, inspectDaemonOperation } from "../lib/daemon-operations.mjs";
 import { cancelSession, createSession, doctor, inspectSession, promptFromFile, promptSession, startSession } from "../lib/dd-codex.mjs";
 import { callDaemon, serveDaemon, startDaemon, stopDaemon } from "../lib/dd-codex-daemon.mjs";
 
@@ -7,15 +8,15 @@ function common(options) { return { bin: options["codex-bin"], journal: options.
 try {
   const { positional, options } = parse(process.argv.slice(2)); const [family, command] = positional; const shared = common(options); let result;
   if (family === "doctor") result = await doctor(shared);
-  else if (family === "daemon" && command === "start") result = await startDaemon({ ...shared, entryPath: process.argv[1] });
+  else if (family === "daemon" && command === "start") result = await durableDaemonStart({ ...shared, entryPath: process.argv[1] }, startDaemon);
   else if (family === "daemon" && command === "serve") { await serveDaemon(shared.stateDir); process.exit(0); }
   else if (family === "daemon" && command === "status") result = await callDaemon(shared.stateDir, "daemon.status");
-  else if (family === "daemon" && command === "operation") result = await callDaemon(shared.stateDir, "operation.inspect", { operationId: options["operation-id"] });
+  else if (family === "daemon" && command === "operation") result = await inspectDaemonOperation(shared.stateDir, options["operation-id"]);
   else if (family === "daemon" && command === "stop") result = await stopDaemon({ ...shared, cancelTree: options["cancel-tree"] });
   else if (family === "session" && command === "create") result = shared.stateDir ? await callDaemon(shared.stateDir, "session.create", shared) : await createSession(shared);
   else if (family === "session" && command === "prompt") result = shared.stateDir ? await callDaemon(shared.stateDir, "session.prompt", { ...shared, prompt: options["prompt-file"] ? await promptFromFile(options["prompt-file"]) : options.prompt }, shared.timeoutMs ?? 1_800_000) : await promptSession({ ...shared, prompt: options["prompt-file"] ? await promptFromFile(options["prompt-file"]) : options.prompt });
   else if (family === "session" && command === "start") result = shared.stateDir ? await callDaemon(shared.stateDir, "session.start", { ...shared, prompt: options["prompt-file"] ? await promptFromFile(options["prompt-file"]) : options.prompt }, shared.timeoutMs ?? 30_000) : await startSession({ ...shared, prompt: options["prompt-file"] ? await promptFromFile(options["prompt-file"]) : options.prompt });
-  else if (family === "session" && ["inspect", "status", "resume"].includes(command)) result = shared.stateDir ? await callDaemon(shared.stateDir, "session.inspect", shared) : await inspectSession(shared);
+  else if (family === "session" && ["inspect", "status", "resume"].includes(command)) result = shared.stateDir ? await callDaemon(shared.stateDir, command === "resume" ? "session.resume" : "session.inspect", shared) : await inspectSession(shared);
   else if (family === "session" && command === "cancel") result = shared.stateDir ? await callDaemon(shared.stateDir, "session.cancel", shared) : await cancelSession(shared);
   else throw new Error("usage: dd-codex doctor | daemon start|status|stop | session create|start|prompt|inspect|status|resume|cancel [--json]");
   process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`);

package/dist/harness-runtime/bin/dd-droid.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { durableDaemonStart, inspectDaemonOperation } from "../lib/daemon-operations.mjs";
 import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import os from "node:os";
@@ -18,10 +19,10 @@ try {
     const runtime = new DroidRuntime({ ...config, stateDir: dir, home: path.join(dir, "home"), cwd: config.cwd ?? process.cwd(), journal: path.join(dir, "events.jsonl"), daemonId: randomUUID(), ddFlowHome: null, ddFlowBin: null }, {}, async () => {});
     try { await runtime.start(); result = { harness: "droid-cli", observed_runtime: { droid: await droidVersion(config.bin), factory_protocol: runtime.protocol, dd_harness_contract: DROID_CONTRACT }, models: runtime.models.map(model => model.id ?? model.modelId), capabilities: { native_children: true, tree_cancel: true, selective_child_cancel: false, native_fork: false }, protocol_expected: DROID_PROTOCOL }; }
     finally { await runtime.closeTree(true); await rm(dir, { recursive: true, force: true }); }
-  } else if (family === "daemon" && command === "start") result = await startDaemon(config);
+  } else if (family === "daemon" && command === "start") result = await durableDaemonStart(config, startDaemon);
   else if (family === "daemon" && command === "serve") { await serveDaemon(config.stateDir); process.exit(0); }
   else if (family === "daemon" && command === "status") result = await callDaemon(config.stateDir, "daemon.status");
-  else if (family === "daemon" && command === "operation") result = await callDaemon(config.stateDir, "operation.inspect", { operationId: options["operation-id"] });
+  else if (family === "daemon" && command === "operation") result = await inspectDaemonOperation(config.stateDir, options["operation-id"]);
   else if (family === "daemon" && command === "stop") result = await stopDaemon({ stateDir: config.stateDir, cancelTree: options["cancel-tree"] });
   else if (family === "hook" && command === "handle") { const payload = JSON.parse(await input()); const eventId = randomUUID(); result = await callDaemon(config.stateDir, "hook.observe", { payload, eventId }, 25_000, eventId); }
   else if (family === "session") { if (command === "fork") throw new Error("Droid fork is not qualified for this adapter"); const prompt = options["prompt-file"] ? await readFile(options["prompt-file"], "utf8") : options.prompt; result = await callDaemon(config.stateDir, `session.${command === "status" ? "inspect" : command}`, { sessionId: options["session-id"], ...(prompt ? { prompt } : {}) }); }

package/dist/harness-runtime/bin/dd-grok.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { durableDaemonStart, inspectDaemonOperation } from "../lib/daemon-operations.mjs";
 import { spawn } from "node:child_process";
 import { cancelSession, createSession, doctor, forkSession, inspectSession, promptFromFile, promptSession } from "../lib/dd-grok.mjs";
 import { callDaemon, serveDaemon, startDaemon, stopDaemon } from "../lib/dd-grok-daemon.mjs";
@@ -16,13 +17,13 @@ async function hook(options) {
 try {
   const { positional, options } = parse(process.argv.slice(2)); const [family, command] = positional; const shared = common(options); let result;
   if (family === "doctor") result = await doctor(shared);
-  else if (family === "daemon" && command === "start") result = await startDaemon({ ...shared, entryPath: process.argv[1] });
+  else if (family === "daemon" && command === "start") result = await durableDaemonStart({ ...shared, entryPath: process.argv[1] }, startDaemon);
   else if (family === "daemon" && command === "serve") { await serveDaemon(shared.stateDir); process.exit(0); }
   else if (family === "daemon" && command === "status") result = await callDaemon(shared.stateDir, "daemon.status");
-  else if (family === "daemon" && command === "operation") result = await callDaemon(shared.stateDir, "operation.inspect", { operationId: options["operation-id"] });
+  else if (family === "daemon" && command === "operation") result = await inspectDaemonOperation(shared.stateDir, options["operation-id"]);
   else if (family === "daemon" && command === "stop") result = await stopDaemon({ stateDir: shared.stateDir, cancelTree: options["cancel-tree"], timeoutMs: shared.timeoutMs });
   else if (family === "hook" && command === "handle") { process.stdout.write(`${JSON.stringify(await hook(options))}\n`); process.exit(0); }
-  else if (family === "session") { const params = { ...shared, ...(command === "create" || command === "prompt" ? { prompt: options["prompt-file"] ? await promptFromFile(options["prompt-file"]) : options.prompt } : {}), ...(command === "fork" ? { target: JSON.parse(options["target-json"] ?? "null") } : {}), ...(command === "archive" ? { archiveDir: options["archive-dir"] } : {}) }; if (shared.stateDir) result = await callDaemon(shared.stateDir, `session.${["status", "resume"].includes(command) ? "inspect" : command}`, params, shared.timeoutMs ?? 1_800_000); else if (command === "create") result = await createSession(params); else if (command === "prompt") result = await promptSession(params); else if (["inspect", "status", "resume"].includes(command)) result = await inspectSession(params); else if (command === "cancel") result = await cancelSession(params); else if (command === "fork") result = await forkSession(params); else throw new Error(`unknown session command: ${command}`); }
+  else if (family === "session") { const params = { ...shared, ...(command === "create" || command === "prompt" ? { prompt: options["prompt-file"] ? await promptFromFile(options["prompt-file"]) : options.prompt } : {}), ...(command === "fork" ? { target: JSON.parse(options["target-json"] ?? "null") } : {}), ...(command === "archive" ? { archiveDir: options["archive-dir"] } : {}) }; if (shared.stateDir) result = await callDaemon(shared.stateDir, `session.${command === "status" ? "inspect" : command}`, params, shared.timeoutMs ?? 1_800_000); else if (command === "create") result = await createSession(params); else if (command === "prompt") result = await promptSession(params); else if (["inspect", "status", "resume"].includes(command)) result = await inspectSession(params); else if (command === "cancel") result = await cancelSession(params); else if (command === "fork") result = await forkSession(params); else throw new Error(`unknown session command: ${command}`); }
   else throw new Error("usage: dd-grok doctor | daemon start|status|stop | session create|prompt|inspect|status|resume|cancel|fork|archive [options] --json");
   process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`);
 } catch (error) { if (process.argv[2] === "hook") { process.stdout.write(`${JSON.stringify({ decision: "deny", reason: error.message })}\n`); process.exit(2); } process.stderr.write(`${JSON.stringify({ ok: false, error: error.message, ...(error.code ? { code: error.code, retryable: error.retryable === true, details: error.details } : {}) })}\n`); process.exit(1); }

package/dist/harness-runtime/bin/dd-opencode.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { durableDaemonStart, inspectDaemonOperation } from "../lib/daemon-operations.mjs";
 import { readFile } from "node:fs/promises";
 import { callDaemon, serveDaemon, startDaemon, stopDaemon } from "../lib/dd-opencode-daemon.mjs";
 
@@ -6,13 +7,13 @@ function parse(argv) { const positional = [], options = {}; for (let i = 0; i <
 const prompt = async options => options["prompt-file"] ? await readFile(options["prompt-file"], "utf8") : options.prompt;
 try {
   const { positional, options } = parse(process.argv.slice(2)), [family, command] = positional; const common = { journal: options.journal, stateDir: options["state-dir"], sessionId: options["session-id"], cwd: options.cwd, bin: options["opencode-bin"], provider: options.provider, model: options.model, variant: options.variant, agent: options.agent, authPath: options["auth-path"], projectRoot: options["project-root"], ddFlowBin: options["dd-flow-bin"], ddFlowHome: options["dd-flow-home"], noFlow: options["no-flow"] === true, sessionArchive: options["session-archive"], timeoutMs: options.timeout ? Number(options.timeout) * 1000 : undefined }; let result;
-  if (family === "daemon" && command === "start") result = await startDaemon({ ...common, entryPath: process.argv[1] });
+  if (family === "daemon" && command === "start") result = await durableDaemonStart({ ...common, entryPath: process.argv[1] }, startDaemon);
   else if (family === "daemon" && command === "serve") { await serveDaemon(common.stateDir); process.exit(0); }
   else if (family === "daemon" && command === "status") result = await callDaemon(common.stateDir, "daemon.status");
-  else if (family === "daemon" && command === "operation") result = await callDaemon(common.stateDir, "operation.inspect", { operationId: options["operation-id"] });
+  else if (family === "daemon" && command === "operation") result = await inspectDaemonOperation(common.stateDir, options["operation-id"]);
   else if (family === "doctor") result = await callDaemon(common.stateDir, "daemon.doctor");
   else if (family === "daemon" && command === "stop") result = await stopDaemon({ stateDir: common.stateDir, cancelTree: options["cancel-tree"], timeoutMs: common.timeoutMs });
-  else if (family === "session") { const operation = ["status","resume"].includes(command) ? "inspect" : command; const params = { sessionId: options["session-id"], title: options.title, messageId: options["message-id"], archiveFile: options["archive-file"], ...(command === "prompt" ? { prompt: await prompt(options) } : {}) }; result = await callDaemon(common.stateDir, `session.${operation}`, params, common.timeoutMs ?? 1_800_000); }
+  else if (family === "session") { const operation = command === "status" ? "inspect" : command; const params = { sessionId: options["session-id"], title: options.title, messageId: options["message-id"], archiveFile: options["archive-file"], ...(command === "prompt" ? { prompt: await prompt(options) } : {}) }; result = await callDaemon(common.stateDir, `session.${operation}`, params, common.timeoutMs ?? 1_800_000); }
   else throw new Error("usage: dd-opencode daemon start|status|stop | session create|prompt|inspect|fork|cancel|archive [options] --json");
   process.stdout.write(`${JSON.stringify({ ok: true, ...result })}\n`);
 } catch (error) { process.stderr.write(`${JSON.stringify({ ok: false, error: error.message, ...(error.code ? { code: error.code, retryable: error.retryable === true, details: error.details } : {}) })}\n`); process.exit(1); }

package/dist/harness-runtime/bin/dd-zcode.mjs

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { durableDaemonStart, inspectDaemonOperation } from "../lib/daemon-operations.mjs";
 import { cancelChild, cancelSession, createSession, doctor, forkSession, inspectSession, promptFromFile, promptSession } from "../lib/dd-zcode.mjs";
 import { callDaemon, serveDaemon, startDaemon, stopDaemon } from "../lib/dd-zcode-daemon.mjs";
 
@@ -33,17 +34,17 @@ try {
   const answers = options["answers-file"] ? JSON.parse(await promptFromFile(options["answers-file"])) : undefined;
   const shared = common(options);
   if (family === "doctor") result = await doctor(shared);
-  else if (family === "daemon" && command === "start") result = await startDaemon({ ...shared, entryPath: process.argv[1] });
+  else if (family === "daemon" && command === "start") result = await durableDaemonStart({ ...shared, entryPath: process.argv[1] }, startDaemon);
   else if (family === "daemon" && command === "serve") { await serveDaemon(shared.stateDir); process.exit(0); }
   else if (family === "daemon" && command === "status") result = await callDaemon(shared.stateDir, "daemon.status");
-  else if (family === "daemon" && command === "operation") result = await callDaemon(shared.stateDir, "operation.inspect", { operationId: options["operation-id"] });
+  else if (family === "daemon" && command === "operation") result = await inspectDaemonOperation(shared.stateDir, options["operation-id"]);
   else if (family === "daemon" && command === "stop") result = await stopDaemon({ stateDir: shared.stateDir, cancelTree: options["cancel-tree"], timeoutMs: shared.timeoutMs });
   else if (family === "session") {
     const params = { ...shared, answers, ...(command === "create" || command === "prompt" ? { prompt: options["prompt-file"] ? await promptFromFile(options["prompt-file"]) : options.prompt } : {}), ...(command === "fork" ? { target: JSON.parse(options["target-json"] ?? "null") } : {}) };
     // promptSessionWithBridge owns the meaningful deadline: it fails when its
     // ACP Session has been idle for the configured liveness window.  A fixed
     // RPC deadline would wrongly terminate a long but active Turn.
-    const operation = `session.${["status", "resume"].includes(command) ? "inspect" : command}`;
+    const operation = `session.${command === "status" ? "inspect" : command}`;
     const rpcTimeout = command === "prompt" && shared.timeoutMs === undefined
       ? null
       : (shared.timeoutMs ?? 1_800_000);