@deksden-com/dd-flow-cli 0.9.0-beta.64 → 0.9.0-beta.74

package/dist/harness-runtime/lib/dd-zcode.mjs

@@ -1,4 +1,5 @@
 import { observedTimeout } from "./observation-clock.mjs";
+import { ToolObservations, acpToolObservation, zcodePhysicalSession } from "./tool-observations.mjs";
 import { invokeNativeHook } from "./native-hook-command.mjs";
 import { spawn } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -9,6 +10,10 @@ import { stopProcessGroup } from "./managed-daemon.mjs";
 import { checkObservedProfile, observeModel, observedFields } from "./model-observations.mjs";
 
 const ZCODE_HARNESS_CONTRACT = "dd-zcode-harness@1";
+// A deadline is an observation boundary, not permission to replay an ACP
+// request.  Keep the original correlation slot briefly so a slow native
+// response (especially cold-start/session creation) can still settle it.
+const LATE_RESPONSE_GRACE_MS = 5_000;
 
 function fail(message, code) { const error = new Error(message); if (code) error.code = code; throw error; }
 function fatalLifecycleError(error) {
@@ -17,6 +22,11 @@ function fatalLifecycleError(error) {
 function absolute(value, label) { if (!value || !path.isAbsolute(value)) fail(`${label} must be an absolute path`); return path.resolve(value); }
 function text(value, label) { if (typeof value !== "string" || !value.trim()) fail(`${label} is required`); return value.trim(); }
 function now() { return new Date().toISOString(); }
+function responseSummary(message, method = null) {
+  const result = message?.result;
+  return { request_id: message?.id ?? null, method, has_result: result !== undefined,
+    result_keys: result && typeof result === "object" && !Array.isArray(result) ? Object.keys(result).slice(0, 32) : [], error: message?.error ?? null };
+}
 
 function executable(command, args = []) {
   const resolved = command ?? process.env.DD_ZCODE_ACP_BIN ?? "zcode-acp";
@@ -129,13 +139,15 @@ export class AcpBridge {
     this.options = options;
     this.nextId = 1;
     this.pending = new Map();
+    this.allocationObservers = new Map();
+    this.lateResponses = new Map();
+    this.expiredRequests = new Map();
     this.sessionActivity = new Map();
     this.notifications = Promise.resolve();
     this.lifecycleNotifications = new Set();
     this.notificationError = null;
     this.bridgeStderr = "";
-    this.toolCalls = new Map();
-    this.failedToolCalls = new Set();
+    this.toolObservations = new ToolObservations();
     this.assistantText = new Map();
     this.journal = new Journal(options.journal);
     this.modelSessions = new Map(); this.modelProfiles = new Map();
@@ -166,6 +178,11 @@ export class AcpBridge {
     const cwd = this.options.cwd ? absolute(this.options.cwd, "--cwd") : process.cwd();
     this.child = spawn(target.command, target.args, { cwd, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"], env: { ...process.env, ...(this.options.env ?? {}) } });
     this.child.stderr.setEncoding("utf8").on("data", (chunk) => { this.bridgeStderr += String(chunk); this.journal.write("bridge_stderr", { text: String(chunk) }); });
+    this.child.stdin?.on("error", (error) => {
+      error.details = { system_code: error.code ?? null };
+      error.code = "bridge_pipe_broken";
+      this.rejectAll(error);
+    });
     this.child.on("error", (error) => { error.code ??= "bridge_exited"; this.rejectAll(error); });
     this.child.on("exit", (code) => { const error = new Error(`zcode-acp exited ${code}${this.bridgeStderr.trim() ? `: ${this.bridgeStderr.trim()}` : ""}`); error.code = "bridge_exited"; this.rejectAll(error); });
     readline.createInterface({ input: this.child.stdout }).on("line", (line) => this.receive(line));
@@ -180,7 +197,9 @@ export class AcpBridge {
     let message;
     try { message = JSON.parse(line); } catch { this.journal.write("malformed", { line }); return; }
     const request = message.id !== undefined ? this.pending.get(message.id) : null;
-    this.journal.writeInbound(message, request?.method);
+    const expired = message.id !== undefined ? this.expiredRequests.get(message.id) : null;
+    const isResponse = message.id !== undefined && !message.method;
+    if (!isResponse || request) this.journal.writeInbound(message, request?.method);
     if (typeof message.params?.sessionId === "string" && isProductiveSessionNotification(message)) this.sessionActivity.set(message.params.sessionId, Date.now());
     const update = message.params?.update;
     // ZCode emits this as `session/update`; Grok Build wraps the same ACP
@@ -195,6 +214,15 @@ export class AcpBridge {
       const sessionId = message.params.sessionId;
       this.assistantText.set(sessionId, `${this.assistantText.get(sessionId) ?? ""}${message.params.update.content.text ?? ""}`);
     }
+    if (message.method === "zcode/session/allocated") {
+      const identity = message.params;
+      const observer = this.allocationObservers.get(identity?.adapter_session_id);
+      if (observer && typeof identity?.provider_session_id === "string" && identity.provider_session_id.length > 0) {
+        this.allocationObservers.delete(identity.adapter_session_id);
+        this.notifications = this.notifications.then(() => observer(identity));
+        void this.notifications.catch(error => { this.notificationError ??= error; });
+      }
+    }
     this.observeToolCall(message);
     if (message.method === "session/update" && this.options.onLifecycleNotification) {
       const observer = this.options.onLifecycleNotification;
@@ -220,17 +248,26 @@ export class AcpBridge {
     if (message.id !== undefined && message.method) { void this.answer(message).catch((error) => this.rejectAll(error)); return; }
     if (message.id !== undefined) {
       const pending = request ?? this.pending.get(message.id);
-      if (!pending) return;
+      if (!pending) {
+        this.lateResponses.set(message.id, message);
+        while (this.lateResponses.size > 128) this.lateResponses.delete(this.lateResponses.keys().next().value);
+        this.journal.write("late_response", responseSummary(message, expired?.method ?? null));
+        return;
+      }
       clearTimeout(pending.timer); if (pending.idleTimer) clearInterval(pending.idleTimer); this.pending.delete(message.id);
+      if (pending.timedOut) this.journal.write("late_response", { ...responseSummary(message, pending.method), grace_ms: LATE_RESPONSE_GRACE_MS });
       if (message.error) {
-        const details = message.error.data?.details ?? message.error.data?.message ?? null;
+        const data = message.error.data && typeof message.error.data === "object" && !Array.isArray(message.error.data) ? message.error.data : null;
+        const details = data?.details ?? data?.message ?? data ?? null;
         const provider = pending.providerError;
         const providerDetails = provider?.message ?? null;
-        const messageText = [message.error.message, details, providerDetails].filter(Boolean).join(": ") || JSON.stringify(message.error);
+        const messageText = [message.error.message, details, providerDetails].filter(Boolean).map(value => typeof value === "string" ? value : JSON.stringify(value)).join(": ") || JSON.stringify(message.error);
         const error = new Error(messageText);
-        error.code = /rate limit/i.test(messageText) ? "provider_rate_limited" : /payment required|usage balance exhausted/i.test(messageText) ? "provider_quota_exhausted" : "acp_request_failed";
-        error.retryable = /rate limit/i.test(messageText);
-        error.details = { acp_code: message.error.code ?? null, ...(details ? { provider_details: details } : {}), ...(providerDetails ? { provider_update: provider } : {}) };
+        const nativeCode = typeof data?.code === "string" ? data.code : null;
+        const unknown = ["native_timeout", "native_backend_dead", "native_backend_pipe_broken", "native_outcome_unknown"].includes(nativeCode);
+        error.code = unknown ? nativeCode : /rate limit/i.test(messageText) ? "provider_rate_limited" : /payment required|usage balance exhausted/i.test(messageText) ? "provider_quota_exhausted" : "acp_request_failed";
+        error.retryable = !unknown && /rate limit/i.test(messageText);
+        error.details = { acp_code: message.error.code ?? null, ...(data ? { native: data } : {}), ...(details ? { provider_details: details } : {}), ...(providerDetails ? { provider_update: provider } : {}) };
         pending.reject(error);
       }
       else { pending.resolve(message.result ?? {}); }
@@ -249,35 +286,18 @@ export class AcpBridge {
   }
 
   observeToolCall(message) {
-    if (message.method !== "session/update") return;
-    const update = message.params?.update;
-    if (!update?.toolCallId) return;
-    const id = JSON.stringify([message.params?.sessionId ?? null, update.toolCallId]);
-    if (update.sessionUpdate === "tool_call") this.toolCalls.set(id, update?._meta?.claudeCode?.toolName ?? update.title?.split(":", 1)[0] ?? "unknown");
-    if (update.sessionUpdate === "tool_call_update" && ["failed", "error"].includes(update.status)) this.failedToolCalls.add(id);
+    const rootSessionId = this.modelSessions.get(message.params?.sessionId)?.sessionId;
+    this.toolObservations.add(acpToolObservation(message, { harness: this.options.observationHarness ?? "zcode-acp", rootSessionId }));
   }
 
   toolSummary(sessionId) {
-    const by_tool = {};
-    let total = 0; let failures = 0;
-    for (const [id, name] of this.toolCalls) {
-      if (sessionId !== undefined && JSON.parse(id)[0] !== sessionId) continue;
-      total += 1; by_tool[name] = (by_tool[name] ?? 0) + 1;
-      if (this.failedToolCalls.has(id)) failures += 1;
-    }
-    return { total, failures, by_tool };
+    return this.toolObservations.summary(this.modelSessions.get(sessionId)?.sessionId ?? sessionId);
   }
-  toolCursor() { return new Set(this.toolCalls.keys()); }
+  toolCursor() { return this.toolObservations.cursor(); }
   assistantTextCursor(sessionId) { return (this.assistantText.get(sessionId) ?? "").length; }
   assistantTextSince(sessionId, cursor) { return (this.assistantText.get(sessionId) ?? "").slice(cursor); }
-  toolSummarySince(cursor) {
-    const by_tool = {}; let total = 0; let failures = 0;
-    for (const [id, name] of this.toolCalls) {
-      if (cursor.has(id)) continue;
-      total += 1; by_tool[name] = (by_tool[name] ?? 0) + 1;
-      if (this.failedToolCalls.has(id)) failures += 1;
-    }
-    return { total, failures, by_tool };
+  toolSummarySince(cursor, sessionId) {
+    return this.toolObservations.summary(this.modelSessions.get(sessionId)?.sessionId ?? sessionId, cursor);
   }
 
   async answer(message) {
@@ -299,8 +319,9 @@ export class AcpBridge {
     this.send({ jsonrpc: "2.0", id: message.id, result });
   }
 
-  request(method, params = {}, timeoutMs = 30_000, { idleSessionId = null, idleTimeoutMs = null } = {}) {
+  request(method, params = {}, timeoutMs = 30_000, { idleSessionId = null, idleTimeoutMs = null, inactivityMode = "reject" } = {}) {
     if ((this.notificationError?.code === "profile_integrity_violation" || fatalLifecycleError(this.notificationError)) && ["session/new", "session/prompt", "session/fork"].includes(method)) return Promise.reject(this.notificationError);
+    if (this.inactivityError && ["session/new", "session/prompt", "session/fork"].includes(method)) return Promise.reject(this.inactivityError);
     const id = this.nextId++;
     return new Promise((resolve, reject) => {
       const finish = (error) => {
@@ -310,12 +331,27 @@ export class AcpBridge {
       // Productive Turns use the sliding session-activity timeout below.  A
       // second wall-clock timeout would kill an active, long-running Turn.
       const timer = Number.isFinite(timeoutMs) && timeoutMs > 0
-        ? observedTimeout(() => finish(Object.assign(new Error(`${method} timed out`), { code: "rpc_timeout", details: { method, session_id: params.sessionId ?? null } })), timeoutMs)
+        ? observedTimeout(() => {
+          const pending = this.pending.get(id);
+          if (!pending || pending.timedOut) return;
+          pending.timedOut = true;
+          const timeoutError = Object.assign(new Error(`${method} timed out`), {
+            code: "rpc_timeout",
+            details: { method, request_id: id, session_id: params.sessionId ?? null, timeout_ms: timeoutMs, grace_ms: LATE_RESPONSE_GRACE_MS },
+          });
+          this.journal.write("request_deadline", timeoutError.details);
+          pending.timer = observedTimeout(() => {
+            this.expiredRequests.set(id, { method, sessionId: params.sessionId ?? null });
+            while (this.expiredRequests.size > 128) this.expiredRequests.delete(this.expiredRequests.keys().next().value);
+            finish(timeoutError);
+          }, LATE_RESPONSE_GRACE_MS);
+        }, timeoutMs)
         : null;
       const validIdleTimeout = Number.isFinite(idleTimeoutMs) && idleTimeoutMs > 0 ? idleTimeoutMs : null;
       if (idleSessionId) this.sessionActivity.set(idleSessionId, Date.now());
       let lastTimerAt = Date.now();
       let resumedAt = null;
+      let inactivityRecorded = false;
       const checkIdle = async () => {
         if (!this.pending.has(id)) return;
         const observedAt = Date.now();
@@ -331,45 +367,73 @@ export class AcpBridge {
           return;
         }
         const lastActivity = this.sessionActivity.get(idleSessionId) ?? Date.now();
-        if (observedAt - Math.max(lastActivity, resumedAt ?? lastActivity) < validIdleTimeout) return;
-        const error = new Error(`${method} received no session update for ${validIdleTimeout}ms`);
-        error.code = "subject_liveness_timeout";
-        error.details = { session_id: idleSessionId, last_activity_at: new Date(lastActivity).toISOString(), idle_timeout_ms: validIdleTimeout };
-        finish(error);
+        if (observedAt - Math.max(lastActivity, resumedAt ?? lastActivity) < validIdleTimeout || inactivityRecorded) return;
+        // ACP silence is diagnostic only. A native child can be computing while
+        // its Session is non-resident and therefore unsubscribable.
+        inactivityRecorded = true;
+        this.journal.write("inactivity_detected", { method, request_id: id, session_id: idleSessionId, last_activity_at: new Date(lastActivity).toISOString(), idle_timeout_ms: validIdleTimeout, observed_at: new Date(observedAt).toISOString() });
+        if (inactivityMode !== "diagnostic") {
+          finish(Object.assign(new Error(`${method} received no session update for ${validIdleTimeout}ms`), { code: "subject_liveness_timeout", details: { session_id: idleSessionId, last_activity_at: new Date(lastActivity).toISOString(), idle_timeout_ms: validIdleTimeout } }));
+          return;
+        }
+        await this.options.onInactivity?.({ method, requestId: id, sessionId: idleSessionId, lastActivityAt: lastActivity, idleTimeoutMs: validIdleTimeout });
       };
-      const idleTimer = validIdleTimeout ? setInterval(() => { void checkIdle(); }, Math.max(10, Math.min(1_000, Math.floor(validIdleTimeout / 4)))) : null;
+      const idleTimer = validIdleTimeout ? setInterval(() => {
+        void checkIdle().catch((error) => {
+          // A timer callback is outside the request promise. Preserve the
+          // failure for the owning daemon/flush path instead of creating an
+          // unhandled rejection that loses the primary request evidence.
+          this.inactivityError ??= error;
+          void this.journal.write("inactivity_observation_failure", { method, request_id: id, session_id: idleSessionId, error: { code: error?.code ?? "inactivity_observation_failed", message: error?.message ?? String(error) } }).catch(() => {});
+        });
+      }, Math.max(10, Math.min(1_000, Math.floor(validIdleTimeout / 4)))) : null;
       this.pending.set(id, { resolve, reject, timer, idleTimer, method, sessionId: params.sessionId ?? null });
       this.send({ jsonrpc: "2.0", id, method, params });
     });
   }
 
   notify(method, params = {}) { this.send({ jsonrpc: "2.0", method, params }); }
-  send(message) { this.journal.write("outbound", message); this.child.stdin.write(`${JSON.stringify(message)}\n`); }
+  send(message) {
+    this.journal.write("outbound", message);
+    const stdin = this.child?.stdin;
+    if (!stdin || stdin.destroyed) {
+      const error = Object.assign(new Error("zcode-acp stdin is closed"), { code: "bridge_pipe_broken" });
+      this.rejectAll(error);
+      throw error;
+    }
+    try { stdin.write(`${JSON.stringify(message)}\n`); }
+    catch (error) { error.details = { system_code: error.code ?? null }; error.code = "bridge_pipe_broken"; this.rejectAll(error); throw error; }
+  }
   rejectAll(error) { for (const pending of this.pending.values()) { clearTimeout(pending.timer); if (pending.idleTimer) clearInterval(pending.idleTimer); pending.reject(error); } this.pending.clear(); }
   async flush() {
     try { await Promise.all([...this.lifecycleNotifications]); await this.notifications; await this.journal.flush(); }
     catch (error) { throw this.notificationError ?? error; }
     if (this.notificationError) throw this.notificationError;
+    if (this.inactivityError) throw this.inactivityError;
   }
   async close() {
-    let flushError = null;
-    try { await this.flush(); } catch (error) { flushError = error; }
+    // Productive notification failures belong to flush()/the original Turn.
+    // Draining them must not relabel a successful physical shutdown as failed.
+    await Promise.allSettled([...this.lifecycleNotifications, this.notifications]);
     if (this.child) {
       this.child.stdin.end();
       await Promise.race([new Promise((resolve) => this.child.once("exit", resolve)), new Promise((resolve) => setTimeout(resolve, 2000))]);
       await stopProcessGroup(this.child, 2_000);
     }
     await this.journal.flush();
-    if (flushError) throw flushError;
   }
 }
 
 function isProductiveSessionNotification(message) {
   if (!["session/update", "_x.ai/session_notification"].includes(message.method)) return false;
   const update = message.params?.update;
-  // Transport heartbeat is not evidence of model work. Every other documented
-  // session update proves that the native session is still responsive.
-  return update?.sessionUpdate !== "heartbeat" && update?.type !== "heartbeat";
+  // Transport state and the bridge's cosmetic thinking hint are not native
+  // progress. The latter is identifiable without leaking a ZCode-specific
+  // synthetic flag through the ACP wire contract.
+  if (update?.sessionUpdate === "heartbeat" || update?.type === "heartbeat") return false;
+  if (update?.sessionUpdate === "agent_thought_chunk" && typeof update?.messageId === "string" && update.messageId.startsWith("thinking_")) return false;
+  if ((update?.sessionUpdate === "status" || update?.type === "status") && update?.status === "running") return false;
+  return true;
 }
 
 export function observedProfile(read) {
@@ -390,14 +454,16 @@ async function resume(bridge, sessionId, cwd) {
 }
 
 async function inspect(bridge, sessionId) {
-  const [read, subagents, usage] = await Promise.all([
+  const [read, subagents] = await Promise.all([
     bridge.request("zcode/session/read", { sessionId }),
     bridge.request("zcode/session/subagents", { sessionId }),
-    bridge.request("zcode/session/usage", { sessionId }),
   ]);
+  let usage = null, usage_observation_error = null;
+  try { usage = await bridge.request("zcode/session/usage", { sessionId }); }
+  catch (error) { usage_observation_error = { code: error.code ?? "usage_observation_failed", message: error.message ?? String(error) }; }
   const observed = observedProfile(read);
   await bridge.recordModel?.(sessionId, observed, "zcode/session/read");
-  return { read, subagents, usage, observed_profile: observed };
+  return { read, subagents, usage, ...(usage_observation_error ? { usage_observation_error } : {}), observed_profile: observed };
 }
 
 // The journal is the immutable transcript.  CLI receipts only need the
@@ -590,7 +656,7 @@ function receipt(options, value) { return options.daemonId ? { daemon_id: option
 
 async function withBridge(options, operation) {
   const bridge = new AcpBridge(options);
-  try { const initialized = await bridge.start(); return await operation(bridge, initialized); }
+  try { const initialized = await bridge.start(); const result = await operation(bridge, initialized); await bridge.flush(); return result; }
   finally { await bridge.close(); }
 }
 
@@ -619,8 +685,8 @@ export async function zcodeInvocationObserver(options, rootProviderSessionId, se
     if (message.method !== "session/update" || update?.sessionUpdate !== "tool_call") return null;
     if (options.adapterSessionId && message.params?.sessionId !== options.adapterSessionId) return null;
     const native = update._meta?.zcodeRuntime ?? {};
-    if (native.source === "subagent" && !native.childSessionId) throw Object.assign(new Error("Native subagent event has no physical child identity"), { code: "zcode_child_identity_missing" });
-    const session = native.childSessionId ?? rootProviderSessionId;
+    const session = zcodePhysicalSession(update, rootProviderSessionId);
+    if (!session) throw Object.assign(new Error("Native subagent event has no physical child identity"), { code: "zcode_child_identity_missing" });
     const key = update.toolCallId;
     if (!key || typeof session !== "string") return null;
     if (owners.has(key) && owners.get(key) !== session) throw Object.assign(new Error("Native tool id has conflicting Session ownership"), { code: "zcode_tool_identity_conflict" });
@@ -678,6 +744,11 @@ async function forwardUsage(options, providerSessionId, usage, toolCalls) {
   await runWithStdin(options.ddFlowBin, ["zcode", "usage", "ingest", "--project-root", projectRoot, "--json"], `${JSON.stringify(payload)}\n`, options.ddFlowHome ? { DD_FLOW_HOME: absolute(options.ddFlowHome, "--dd-flow-home") } : {});
 }
 
+async function forwardUsageBestEffort(options, providerSessionId, usage, toolCalls) {
+  try { await forwardUsage(options, providerSessionId, usage, toolCalls); return null; }
+  catch (error) { return { code: error.code ?? "usage_ingest_failed", message: error.message ?? String(error) }; }
+}
+
 export function zcodeLifecycleQualification(sha256, bridgeCommit, harnessContract) {
   // Behavioural evidence: dd-eval production-invocations probe, 2026-09-13.
   // Pin both providers of native event identity, not a string in the bundle.
@@ -712,19 +783,36 @@ export async function createSessionWithBridge(bridge, options, initialized) {
   let forward;
   bridge.configure({ ...options, onNotification: async (event) => { await forward?.(event); await options.onNotification?.(event); } });
   const created = await bridge.request("session/new", { cwd, mcpServers: [] });
+  // The ACP alias is the first durable identity available. Persist it before
+  // resolving the native Session so a later resolve timeout cannot erase the
+  // fact that allocation was already admitted.
+  await options.onSessionAliasAllocated?.({ adapter_session_id: created.sessionId, cwd });
+  bridge.allocationObservers?.set(created.sessionId, async identity => {
+    if (identity.cwd !== cwd) fail("ZCode allocation workspace mismatch", "session_identity_mismatch");
+    await options.onSessionAllocated?.(identity);
+  });
   const resolved = await bridge.request("zcode/session/resolve", { sessionId: created.sessionId });
   const providerSessionId = resolved.providerSessionId;
+  // Expose both identities before profile/usage bookkeeping. The owning
+  // daemon can persist this allocation even when a later step fails.
+  await options.onSessionAllocated?.({
+    adapter_session_id: created.sessionId,
+    provider_session_id: providerSessionId,
+    cwd,
+  });
   bridge.registerModelSession?.(created.sessionId, providerSessionId, requested, null, false);
   const profile_receipt = await applyProfile(bridge, created.sessionId, requested);
   forward = flowForwarder(options, providerSessionId, bridge);
-  const usage = await bridge.request("zcode/session/usage", { sessionId: created.sessionId });
-  await forwardUsage(options, providerSessionId, usage, bridge.toolSummary(created.sessionId));
+  let usage = null, usage_observation_error = null;
+  try { usage = await bridge.request("zcode/session/usage", { sessionId: created.sessionId }); }
+  catch (error) { usage_observation_error = { code: error.code ?? "usage_observation_failed", message: error.message ?? String(error) }; }
+  const usage_ingest_error = await forwardUsageBestEffort(options, providerSessionId, usage, bridge.toolSummary(created.sessionId));
   await bridge.flush();
   // ZCode materializes `subagents` only after its first prompt.  Session
   // creation is intentionally nonproductive, so querying that topology here
   // would both fail on real ZCode and turn the common create contract into an
   // implicit first turn.  The first prompt/inspect records full evidence.
-  const evidence = { read: null, subagents: { running: [], completed: [] }, usage, observed_profile: profile_receipt.observed, tool_calls: bridge.toolSummary(created.sessionId) };
+  const evidence = { read: null, subagents: { running: [], completed: [] }, usage, ...(usage_observation_error ? { usage_observation_error } : {}), ...(usage_ingest_error ? { usage_ingest_error } : {}), observed_profile: profile_receipt.observed, tool_calls: bridge.toolSummary(created.sessionId) };
   return receipt(options, { harness: "zcode-acp", runtime_family: "zcode", adapter_session_id: created.sessionId, provider_session_id: providerSessionId, cwd, initialized, profile: profile_receipt, evidence: publicEvidence(evidence) });
 }
 
@@ -743,25 +831,36 @@ export async function promptSessionWithBridge(bridge, options) {
   bridge.configure({ onLifecycleNotification: await zcodeInvocationObserver({ ...options, adapterSessionId: identity.adapterSessionId }, identity.providerSessionId) });
   const profile_receipt = await applyProfile(bridge, identity.adapterSessionId, requested, options.assertDispatch);
   options.assertDispatch?.();
-  await forwardUsage(options, identity.providerSessionId, await bridge.request("zcode/session/usage", { sessionId: identity.adapterSessionId }), bridge.toolSummary(identity.adapterSessionId));
-  const timeoutMs = options.timeoutMs ?? (options.livenessTimeoutMs ? null : 1_800_000);
+  let initial_usage_error = null;
+  try { initial_usage_error = await forwardUsageBestEffort(options, identity.providerSessionId, await bridge.request("zcode/session/usage", { sessionId: identity.adapterSessionId }), bridge.toolSummary(identity.adapterSessionId)); }
+  catch (error) { initial_usage_error = { code: error.code ?? "usage_observation_failed", message: error.message ?? String(error) }; }
+  // This is the request budget. ACP silence is observed separately and must
+  // never turn a long native child request into a fabricated provider failure.
+  const timeoutMs = options.timeoutMs === undefined ? 1_800_000 : options.timeoutMs;
   const textCursor = bridge.assistantTextCursor(identity.adapterSessionId);
   options.assertDispatch?.();
   const turn = await bridge.request("session/prompt", { sessionId: identity.adapterSessionId, prompt: [{ type: "text", text: prompt }] }, timeoutMs, {
     idleSessionId: identity.adapterSessionId,
     idleTimeoutMs: options.livenessTimeoutMs ?? null,
+    inactivityMode: "diagnostic",
   });
-  await bridge.flush();
-  const evidence = await inspect(bridge, identity.adapterSessionId);
-  evidence.tool_calls = bridge.toolSummary(identity.adapterSessionId);
-  await forwardUsage(options, identity.providerSessionId, evidence.usage, evidence.tool_calls);
   const stopReason = typeof turn?.stopReason === "string" ? turn.stopReason : null;
   if (stopReason && stopReason !== "end_turn") {
+    // A close can settle the pending prompt before its terminal event. Do not
+    // collect live evidence first: ordinary inspection is allowed to recover
+    // an evicted Session, which would undo the just-confirmed close.
+    await bridge.flush();
     const error = new Error(`ZCode ended the provider request with ${stopReason}, not end_turn`);
     error.code = stopReason === "cancelled" ? "zcode_turn_cancelled" : "zcode_turn_not_completed";
-    error.details = { stop_reason: stopReason, provider_session_id: identity.providerSessionId, adapter_session_id: identity.adapterSessionId, evidence: publicEvidence(evidence) };
+    error.details = { stop_reason: stopReason, provider_session_id: identity.providerSessionId, adapter_session_id: identity.adapterSessionId };
     throw error;
   }
+  await bridge.flush();
+  const evidence = await inspect(bridge, identity.adapterSessionId);
+  evidence.tool_calls = bridge.toolSummary(identity.adapterSessionId);
+  const usage_ingest_error = await forwardUsageBestEffort(options, identity.providerSessionId, evidence.usage, evidence.tool_calls);
+  if (initial_usage_error) evidence.initial_usage_error = initial_usage_error;
+  if (usage_ingest_error) evidence.usage_ingest_error = usage_ingest_error;
   if (!options.allowBackground && (evidence.subagents.running ?? []).length) {
     await cancelTree(bridge, identity.adapterSessionId, evidence.subagents, identity.providerSessionId);
     fail("background ZCode subagents cannot outlive the one-shot dd-zcode connection; the live child tree was cancelled");

package/dist/harness-runtime/lib/driver-recovery.mjs

@@ -117,11 +117,11 @@ export async function reconcileDriverReplies(root) {
   try { entries = await readdir(directory); } catch (error) { if (error.code === "ENOENT") return; throw error; }
   for (const entry of entries.filter(name => name.endsWith(".json"))) {
     const file = path.join(directory, entry), record = JSON.parse(await readFile(file, "utf8"));
-    if (["completed", "failed"].includes(record.state)) continue;
+    if (["completed", "failed", "interrupted"].includes(record.state)) continue;
     let receipt;
     try { receipt = await inspectDaemonOperation(root, record.operation_id); }
     catch (error) { if (error.code !== "operation_not_found") throw error; }
-    if (!["completed", "failed"].includes(receipt?.state)) throw Object.assign(new Error("a previous driver request has an unknown outcome; no new productive request was sent"), {
+    if (!["completed", "failed", "interrupted"].includes(receipt?.state)) throw Object.assign(new Error("a previous driver request has an unknown outcome; no new productive request was sent"), {
       code: "operation_observation_lost", details: { operation_id: record.operation_id, state_dir: root }
     });
     await writeJsonAtomic(file, { ...record, state: receipt.state, result: receipt.result, error: receipt.error, reconciled_at: new Date().toISOString() });

package/dist/harness-runtime/lib/managed-daemon.mjs

@@ -81,7 +81,7 @@ export async function budgetObservationScope(stateDir, sessionId) {
     try {
       const requested = JSON.parse(await readFile(path.join(directory, "requested.json"), "utf8"));
       const result = JSON.parse(await readFile(path.join(directory, "result.json"), "utf8"));
-      if (requested.daemon_id === daemonId && requested.session_id === sessionId && ["completed", "failed"].includes(result.state) && ["session.prompt", "session.start", "session.resume"].includes(requested.operation)) operationIds.push(requested.operation_id);
+      if (requested.daemon_id === daemonId && requested.session_id === sessionId && ["completed", "failed", "interrupted"].includes(result.state) && ["session.prompt", "session.start", "session.resume"].includes(requested.operation)) operationIds.push(requested.operation_id);
     } catch (error) { if (error.code !== "ENOENT") throw error; }
   }
   return { stateDir, state, daemonId, sessionId, operationIds };
@@ -100,12 +100,34 @@ export async function releaseBudgetObservation(scope, observation) {
 
 export async function completeBudgetOperation(stateDir, request, result, observe) {
   const state = await budgetState(stateDir);
-  if (!state?.config?.runtime_owner?.budget) return;
-  if (["session.create", "session.fork"].includes(request.operation)) return await releaseBudget(state, { "operation-id": request.id });
+  if (!state?.config?.runtime_owner?.budget) return { state: "not_required" };
+  if (["session.create", "session.fork"].includes(request.operation)) {
+    await releaseBudget(state, { "operation-id": request.id });
+    return { state: "settled", operation_ids: [request.id], source: "creation_receipt" };
+  }
+  const sessionId = request.params?.sessionId;
+  // A productive daemon receipt is bound to this exact dispatch. Reuse its
+  // complete tree proof instead of immediately asking the provider again.
+  if (["session.prompt", "session.start", "session.resume"].includes(request.operation)
+    && result?.settled === true
+    && typeof sessionId === "string"
+    && (result.provider_session_id ?? result.session_id ?? result.adapter_session_id) === sessionId) {
+    const scope = { stateDir, state, daemonId: state.daemon_id ?? state.config?.daemonId, sessionId, operationIds: [request.id] };
+    await releaseBudgetObservation(scope, result);
+    return { state: "settled", operation_ids: [request.id], source: "operation_receipt" };
+  }
+  // A known live tree is not a reason to poll it again. Preserve capacity and
+  // let the next explicit reconciliation obtain fresh proof.
+  if (result?.settled === false) return { state: "pending", reason: "tree_unsettled" };
   const scope = await budgetObservationScope(stateDir, request.params?.sessionId);
-  if (!scope?.operationIds.length) return;
-  const observation = observe ? await observe() : result;
+  if (!scope?.operationIds.length) return { state: "not_required" };
+  // Reconciliation requires a fresh, explicit proof.  Treating an arbitrary
+  // productive reply as proof would silently release a live turn.
+  if (!observe) return { state: "pending", reason: "settlement_evidence_required" };
+  const observation = await observe();
+  if (observation?.settled !== true) return { state: "pending", reason: "tree_unsettled" };
   await releaseBudgetObservation(scope, observation);
+  return { state: "settled", operation_ids: scope.operationIds, source: "reconciliation_observation" };
 }
 
 async function budgetState(stateDir) {

package/dist/harness-runtime/lib/operation-errors.mjs

@@ -1,6 +1,6 @@
 // An observer losing its response does not establish that a provider Turn failed.
 export function isObservationLoss(error) {
-  return ["rpc_timeout", "daemon_timeout", "turn_timeout", "operation_observation_lost", "daemon_connection_closed"].includes(error?.code);
+  return ["rpc_timeout", "native_timeout", "native_outcome_unknown", "native_backend_dead", "native_backend_pipe_broken", "bridge_exited", "bridge_pipe_broken", "daemon_timeout", "turn_timeout", "operation_observation_lost", "daemon_connection_closed"].includes(error?.code);
 }
 
 export function errorRecord(error, depth = 0) {

package/dist/harness-runtime/lib/tool-observations.d.mts

@@ -0,0 +1,17 @@
+export interface ToolEvent {
+  session?: { harness_id: string; session_id: string };
+  call_id?: string;
+  status?: string;
+  name?: string;
+  reason?: string;
+  [key: string]: unknown;
+}
+export class ToolObservations {
+  calls: Map<string, ToolEvent>;
+  gaps: Set<string>;
+  add(event: ToolEvent | null): void;
+  summary(sessionId?: string, cursor?: Set<string>): { total: number; failures: number; pending: number; by_tool: Record<string, number>; completeness: string; sessions: Array<{ session: { harness_id: string; session_id: string }; total: number; failures: number; pending: number; by_tool: Record<string, number> }>; reasons: string[] };
+  cursor(): Set<string>;
+}
+export function codexToolObservation(record: Record<string, unknown>, sessionId: string): ToolEvent | null;
+export function replayToolJournal(file: string, options: { harness: string; rootSessionId: string; adapterSessionId?: string }, reducer?: ToolObservations): ToolObservations;