@deksden-com/dd-flow-cli 0.9.0-beta.64 → 0.9.0-beta.74

package/dist/services/harness-adapter.js

@@ -38,7 +38,9 @@ export function prepareHarnessFlowExecutable(context, stateDir) {
 }
 /** Runs one harness command with the lifecycle guarantees shared by agent services. */
 export function runHarnessAdapter(input) {
-    const timeoutMs = recoveryRpcTimeout(input.timeoutMs ?? 120_000);
+    // `null` is deliberate: a productive Turn has no adapter-wall-clock limit.
+    // Preserve it instead of treating it like an omitted short control request.
+    const timeoutMs = recoveryRpcTimeout(input.timeoutMs === undefined ? 120_000 : input.timeoutMs);
     if (!input.operationId.trim())
         throw new AppError("operation_id_required", "Harness calls require a scoped operation id", 2);
     // The current adapter transport uses this name; its identity is runtime-owned,
@@ -89,7 +91,7 @@ export function runHarnessAdapter(input) {
             }
         };
         const heartbeat = input.progress && input.progressMessage ? setInterval(() => deliver(() => input.progress?.(`${input.progressMessage}; waiting for adapter completion`)), 15_000) : undefined;
-        const timer = setTimeout(() => { timedOut = true; stopTransport(); }, timeoutMs);
+        const timer = timeoutMs === null ? undefined : setTimeout(() => { timedOut = true; stopTransport(); }, timeoutMs);
         const abort = () => { aborted = true; stopTransport(); };
         if (input.signal?.aborted)
             abort();
@@ -111,7 +113,8 @@ export function runHarnessAdapter(input) {
             if (settled)
                 return;
             settled = true;
-            clearTimeout(timer);
+            if (timer)
+                clearTimeout(timer);
             input.signal?.removeEventListener("abort", abort);
             if (heartbeat)
                 clearInterval(heartbeat);
@@ -138,7 +141,7 @@ export function runHarnessAdapter(input) {
                 if (!reply || typeof reply !== "object" || Array.isArray(reply))
                     throw new Error("not object");
                 const value = reply;
-                if (value.ok === false && typeof value.error?.code === "string")
+                if (value.ok === false)
                     return reject(new AppError("harness_adapter_failed", "Harness adapter reported a runtime failure", 1, { cause: adapterCause(stdout) }));
                 resolve(reply);
             }
@@ -153,8 +156,11 @@ function adapterCause(...outputs) {
         for (const line of [output.trim(), ...output.trim().split("\n").reverse()]) {
             try {
                 const value = JSON.parse(line);
-                if (typeof value.error?.code === "string")
-                    return { ...value.error, message: typeof value.error.message === "string" ? value.error.message : value.error.code };
+                const nested = value.error && typeof value.error === "object" && !Array.isArray(value.error) ? value.error : null;
+                const code = typeof nested?.code === "string" ? nested.code : typeof value.code === "string" ? value.code : null;
+                const message = typeof nested?.message === "string" ? nested.message : typeof value.error === "string" ? value.error : code;
+                if (code)
+                    return { code, message, ...(nested?.details ?? value.details ? { details: nested?.details ?? value.details } : {}), ...((nested?.retryable ?? value.retryable) === true ? { retryable: true } : {}) };
             }
             catch { /* Adapter diagnostics need not be JSON. */ }
         }

package/dist/services/lifecycle-invocations.js

@@ -3,7 +3,7 @@ import path from "node:path";
 import fs from "node:fs";
 import { quote } from "shell-quote";
 import { setTimeout as delay } from "node:timers/promises";
-import { AppError } from "../shared/errors.js";
+import { AppError, errorRecord } from "../shared/errors.js";
 import { commandOption, parseLifecycleCommand, shellSuffixOffset } from "./lifecycle-command.js";
 import { requireProjectByRoot } from "./projects.js";
 import { assertRunMutationAllowed, assertStageSettlementAllowed, assertWorkSettlementAllowed, recoveryGuard } from "./run-recovery.js";
@@ -16,7 +16,9 @@ import { runtimeHarness } from "./execution-policy.js";
 // Conclusive result/check rejections, never transport, ownership, registry or
 // unknown-effect failures. These validators reject before accepting the result.
 export function isRetryableLifecycleRejection(code, details = {}) {
-    return ["validation", "schema_validation", "work_checks_failed", "code_review_gate_failed",
+    if (details.recoverable === false || details.effect === "unknown" || details.effect === "committed")
+        return false;
+    return details.recoverable === true || ["validation", "schema_validation", "work_checks_failed", "code_gate_failed", "code_review_gate_failed", "merge_gate_failed",
         "review_repair_incomplete", "plan_review_incomplete", "semantic_result_invalid",
         "review_evidence_invalid", "evidence_obligation_unknown", "invalid_evidence_ref",
         "evidence_ref_missing", "evidence_line_out_of_range", "document_update_missing",
@@ -82,7 +84,7 @@ export function assertLifecycleOutcomes(context, scope) {
             if (outcome.disposition === "retrying" && outcome.deadline <= Date.now())
                 throw new AppError("lifecycle_outcome_unknown", "Storage retry has no terminal receipt; reconcile its committed evidence", 1, { lifecycle_outcome: outcome, effect: "unknown" });
             if (outcome.disposition === "fatal")
-                throw new AppError(outcome.error.code, outcome.error.message, 1, { ...outcome.error.details, lifecycle_outcome: outcome });
+                throw new AppError(outcome.error?.code ?? "lifecycle_outcome_unknown", outcome.error?.message || "Mandatory lifecycle failed (historical receipt has no message)", 1, { ...outcome.error?.details, lifecycle_outcome: outcome });
         }
     }
     if (!context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'"))
@@ -94,7 +96,7 @@ export function assertLifecycleOutcomes(context, scope) {
     ORDER BY a.rowid`, [scope.projectRoot, scope.runId, scope.generation]);
     for (const row of rows) {
         const error = (row.outcome_json ? JSON.parse(row.outcome_json) : null)?.error;
-        if (typeof error?.code === "string" && typeof error.details?.retry_command !== "string")
+        if (typeof error?.code === "string" && !isRetryableLifecycleRejection(error.code, error.details))
             throw new AppError(error.code, typeof error.message === "string" ? error.message : "Mandatory lifecycle failed", 1, { ...(error.details ?? {}), invocation_id: row.id });
     }
 }
@@ -174,8 +176,9 @@ export function observeLifecycleCommand(context, command) {
         delete context.observeLifecycleHook;
         if (!anchor)
             return;
-        const retryable = outcome.error && (isRetryableLifecycleRejection(outcome.error.code, outcome.error.details) || typeof outcome.error.details.retry_command === "string");
-        const record = { ...anchor, ...outcome, effect: outcome.error ? outcome.error.details.effect ?? (retryable ? "no_effect" : "unknown") : "committed", disposition: outcome.error ? retryable ? "correctable" : "fatal" : "completed" };
+        const error = outcome.error ? errorRecord(outcome.error) : undefined;
+        const retryable = error && isRetryableLifecycleRejection(error.code, error.details);
+        const record = { ...anchor, ...(error ? { error } : outcome), effect: error ? error.details.effect ?? (retryable ? "no_effect" : "unknown") : "committed", disposition: error ? retryable ? "correctable" : "fatal" : "completed" };
         try {
             context.db.writeTransaction(() => {
                 const retained = context.db.get("SELECT outcome_json FROM hook_events WHERE id = ?", [anchor.hook_event_id]);
@@ -280,7 +283,7 @@ export function managedLifecycleCommand(context, command) {
         const retained = context.db.get("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'lifecycle_invocations'")
             ? context.db.get("SELECT * FROM lifecycle_invocations WHERE scope_json = ? AND fingerprint = ? ORDER BY rowid DESC LIMIT 1", [JSON.stringify(scope), fingerprint(parsed)]) : undefined;
         if (!retained)
-            throw new AppError("invocation_command_unprepared", "Read-only inspection has no retained lifecycle command", 1);
+            throw new AppError("invocation_command_unprepared", "The controller has not issued this lifecycle command yet. End this Turn and await its next assignment with the exact command; do not generate or reuse an invocation ID.", 1);
         return renderInvocationCommand(retained, command);
     }
     storage(context);
@@ -352,7 +355,7 @@ export function settleLifecycleNoEffectRejection(context, id, command, error, id
 function settleUnadmittedInvocation(context, prior, error) {
     if (!["issued", "expired"].includes(prior.status))
         throw new AppError("invocation_rejection_conflict", "Attempt already admitted native execution", 1);
-    const details = { ...error.details, retry_command: successorLifecycleInvocationCommand(context, prior),
+    const details = { ...error.details, effect: "no_effect", recoverable: true, retry_command: successorLifecycleInvocationCommand(context, prior),
         retry_instruction: "Use retry_command as one standalone lifecycle command. The rejected command did not change lifecycle state." };
     if (context.db.run("UPDATE lifecycle_invocations SET status = 'settled', outcome_json = ?, updated_at = ? WHERE id = ? AND status = ?", [JSON.stringify({ error: { ...error, details } }), context.now(), prior.id, prior.status]).changes !== 1) {
         throw new AppError("invocation_settlement_conflict", "Lifecycle rejection could not be committed", 1, { invocation_id: prior.id });
@@ -375,6 +378,7 @@ export function settleLifecycleRejection(context, id, error) {
         if (isRetryableLifecycleRejection(error.code, error.details) || storageRetry) {
             const retry = retryLifecycleInvocationCommand(context, id);
             details.retry_command = retry;
+            details.recoverable = true;
             if (storageRetry)
                 details.storage_retry = 1;
             details.retry_instruction = "Correct only the evidenced defect, then use retry_command with the required result input. Reissuing the old command only reads its retained outcome.";

package/dist/services/native-session-control.js

@@ -7,6 +7,12 @@ export async function cancelControlledNativeSession(input) {
         env: input.env, operationId: input.observe ? `${input.operationId}:observe` : input.operationId, timeoutMs: 30_000 });
     if (input.observe && (reply.operation_id !== input.operationId || reply.operation !== "session.cancel" || reply.session_id !== input.sessionId))
         throw new AppError("controller_operation_mismatch", "Cancellation observation belongs to another operation or Session", 1);
+    if (input.observe && reply.state === "failed") {
+        if (!reply.error || typeof reply.error !== "object" || Array.isArray(reply.error))
+            throw new AppError("controller_operation_mismatch", "Cancellation failure has no terminal error", 1);
+        input.assertCurrent();
+        return { status: "failed", receipt: reply };
+    }
     const result = input.observe ? reply.state === "completed" ? reply.result : null : reply;
     // A completed cancel command is an immutable ACK, not proof that the
     // provider tree has stopped. Callers must use a separate fresh inspection.

package/dist/services/projects.js

@@ -232,9 +232,13 @@ export function findProjectByRoot(context, root) {
     return context.db.get("SELECT * FROM projects WHERE root = ?", [root]);
 }
 export function requireProjectByRoot(context, root) {
-    const project = findProjectByRoot(context, root);
+    // Callers may receive a path through a native adapter or shell.  Resolve
+    // aliases such as macOS `/var` -> `/private/var` before comparing with the
+    // canonical root persisted in the project registry.
+    const canonical = normalizeStoredRoot(root);
+    const project = findProjectByRoot(context, canonical);
     if (!project) {
-        throw new AppError("not_found", `Project is not registered: ${root}`, 1);
+        throw new AppError("not_found", `Project is not registered: ${canonical}`, 1);
     }
     return project;
 }

package/dist/services/recovery-observation-budget.js

@@ -3,7 +3,15 @@ import { AppError } from "../shared/errors.js";
 export const recoveryObservationBudgetMs = 120_000;
 const activeObservation = new AsyncLocalStorage();
 export const withRecoveryObservation = (budget, action) => activeObservation.run(budget, action);
-export const recoveryRpcTimeout = (maximum) => activeObservation.getStore()?.timeout(maximum) ?? maximum;
+export const recoveryRpcTimeout = (maximum) => {
+    const observation = activeObservation.getStore();
+    // An unbounded productive transport wait is still bounded while recovery is
+    // actively reconciling. Outside recovery, its owner policy decides when to
+    // stop rather than a hidden adapter timer.
+    if (maximum === null)
+        return observation ? observation.timeout() : null;
+    return observation?.timeout(maximum ?? 30_000) ?? maximum ?? 30_000;
+};
 /** Call only while holding the existing owner-claim transaction. A replay of
  * an explicit request never replenishes time, even after another request. */
 export function renewRecoveryObservation(snapshot, requestId) {

package/dist/services/run-control-worker.js

@@ -92,12 +92,31 @@ async function launchControlWorker(context, input) {
         finally {
             fs.closeSync(output);
         }
+        // The detached worker is the durable owner of the stop.  Do not let the
+        // caller tear down its RUN/home before that owner has either registered
+        // its managed-process lease or recorded a startup failure.
+        await waitForControlWorkerAdmission(context, input.controlId, token);
     }
     catch (error) {
         context.db.run("UPDATE run_control_workers SET status = 'failed', error_json = ?, updated_at = ? WHERE control_id = ? AND owner_token = ? AND status = 'starting' AND owner_pid IS NULL", [JSON.stringify(failure(error)), context.now(), input.controlId, token]);
         // The durable intent remains accepted even if its worker could not start.
     }
 }
+async function waitForControlWorkerAdmission(context, controlId, ownerToken, timeoutMs = 5_000) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const worker = context.db.get("SELECT status, process_id, owner_token FROM run_control_workers WHERE control_id = ?", [controlId]);
+        if (!worker || worker.owner_token !== ownerToken)
+            return;
+        // A running worker without a resource lease is still in the vulnerable
+        // registration gap; keep the parent alive until that gap closes.
+        if (worker.process_id || ["failed", "completed", "superseded"].includes(worker.status))
+            return;
+        if (Date.now() >= deadline)
+            throw new AppError("run_control_worker_start_timeout", "Control worker did not publish its managed-process lease", 1, { control_id: controlId, timeout_ms: timeoutMs });
+        await delay(25);
+    }
+}
 const launchOperationId = (controlId, token) => `${controlId}:worker-launch:${crypto.createHash("sha256").update(token).digest("hex")}`;
 function recordControlLauncher(context, controlId, token) {
     const now = context.now();

package/dist/services/run-control.js

@@ -298,7 +298,7 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
                 const nativeOperations = retainedDaemonOperations(directory);
                 nativeVersions.set(directory, nativeInventoryVersion(directory, nativeOperations));
                 for (const operation of nativeOperations)
-                    if (!["completed", "failed"].includes(String(operation.state)))
+                    if (!["completed", "failed", "interrupted"].includes(String(operation.state)))
                         unresolved.push({ state_dir: directory, operation_id: operation.operation_id, status: "pending", reason: "native_operation_unsettled" });
                 if (state.shutdown_state !== "clean" && !records.some(record => record.kind.endsWith("-daemon") && record.id === state.resource_process?.id && record.pid === state.pid && record.pid_started_at && record.lease_token === state.resource_process.lease_token && JSON.parse(record.metadata_json).dispatch_barrier === "run-generation@1"))
                     unresolved.push({ state_dir: directory, status: "pending", reason: "native_dispatch_barrier_unverified" });
@@ -321,8 +321,13 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             if (records.some(record => !record.pid || !record.pid_started_at || processTreeIsAlive(record)))
                 throw new AppError("shutdown_process_unsettled", "Closed daemon still has an unconfirmed or live owned process", 1);
             const receipts = retainedDaemonOperations(directory);
-            if (receipts.some(receipt => !["completed", "failed"].includes(String(receipt.state))))
-                throw new AppError("shutdown_operation_unsettled", "Closed daemon retains an unfinished native operation", 1);
+            // A whole-RUN stop is also the recovery fence for a create whose reply
+            // was lost after native allocation. Keep that one outstanding operation
+            // observable until terminalization below; unrelated unfinished work is
+            // still a shutdown proof failure.
+            const unfinished = receipts.filter(receipt => !["completed", "failed", "interrupted"].includes(String(receipt.state)));
+            if (unfinished.some(receipt => receipt.daemon_id !== daemonId || String(receipt.operation) !== "session.create" || receipt.session_id !== null))
+                throw new AppError("shutdown_operation_unsettled", "Closed daemon retains an unfinished non-create operation", 1);
             const stopped = receipts.find(receipt => receipt.daemon_id === daemonId && receipt.operation === "daemon.stop" && receipt.state === "completed" && receipt.result?.stopped === true && receipt.result?.clean === true);
             if (!stopped)
                 throw new AppError("shutdown_receipt_required", "Closed daemon has no clean native shutdown receipt for its current identity", 1);
@@ -366,6 +371,12 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             const retained = JSON.parse(controllers.find(row => row.controller_id === operation.controller_id).state_json).sessions.find(session => session.state_dir === saved.state_dir && (!target || session.id === target));
             if (!retained)
                 throw new AppError("controller_operation_binding_unknown", "Unfinished operation has no retained controller Session", 1);
+            // A create without a native daemon state file has no provider-side
+            // receipt to inspect. Do not invoke the adapter again merely to discover
+            // that fact; retain the original outcome-unknown operation for the
+            // explicit controller fence/recovery path.
+            if (method === "session.create" && !fs.existsSync(path.join(saved.state_dir, "daemon.json")))
+                return { operation_id: operation.operation_id, status: "pending", reason: "create_observation_unavailable" };
             const harness = runtimeHarness(retained.profile);
             const env = { ...context.env, DD_FLOW_HOME: context.ddFlowHome };
             delete env.DD_FLOW_CONTROLLER_TOKEN;
@@ -374,7 +385,7 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             const receipt = await runHarnessAdapter({ executable: saved.executable, args: ["daemon", "operation", "--operation-id", operation.operation_id, "--state-dir", saved.state_dir, "--json"], env, operationId: `${observationId}:observe:${operation.operation_id}`, timeoutMs: 30_000 });
             if (receipt.operation_id !== operation.operation_id || receipt.operation !== method || target && receipt.session_id !== target)
                 throw new AppError("controller_operation_mismatch", "Operation observation belongs to another retained dispatch", 1);
-            if (!["completed", "failed"].includes(String(receipt.state)))
+            if (!["completed", "failed", "interrupted"].includes(String(receipt.state)))
                 return { operation_id: operation.operation_id, status: "pending", reason: "controller_operation_unsettled", receipt };
             if (receipt.state === "completed" && (!receipt.result || typeof receipt.result !== "object" || Array.isArray(receipt.result) || target && method !== "daemon.start" && adapterSessionId(receipt.result) !== target || method === "session.create" && !adapterSessionId(receipt.result)))
                 throw new AppError("controller_operation_mismatch", "Terminal operation has no valid result for its retained Session", 1);
@@ -453,7 +464,7 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
         if (!session.id)
             return closed && !session.create_operation_id && Array.isArray(closed.session_ids) && closed.session_ids.length === 0
                 ? { state_dir: session.state_dir, status: "completed", receipt: closed }
-                : { state_dir: session.state_dir, status: "pending", reason: "provider_identity_unknown" };
+                : { state_dir: session.state_dir, create_operation_id: session.create_operation_id ?? null, status: "pending", reason: "provider_identity_unknown" };
         bindings = readBindings();
         if (bindings.some(binding => foreign(binding) && underRoot(binding, session.id, harness)))
             return { session_id: session.id, state_dir: session.state_dir, status: "pending", reason: "session_scope_conflict" };
@@ -486,8 +497,11 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             }
             else {
                 const { status, receipt } = await cancelControlledNativeSession({ executable, sessionId: session.id, stateDir: session.state_dir, env, operationId, observe: !inserted.changes, assertCurrent });
-                context.db.run("UPDATE run_control_operations SET status = ?, receipt_json = ?, error_json = NULL, updated_at = ? WHERE operation_id = ?", [status, JSON.stringify(receipt), context.now(), operationId]);
+                const terminalFailure = status === "failed" ? receipt.error && typeof receipt.error === "object" && !Array.isArray(receipt.error) ? receipt.error : { code: "native_cancel_failed" } : null;
+                context.db.run("UPDATE run_control_operations SET status = ?, receipt_json = ?, error_json = ?, updated_at = ? WHERE operation_id = ?", [status, JSON.stringify(receipt), terminalFailure ? JSON.stringify(terminalFailure) : null, context.now(), operationId]);
                 cancellation = receipt;
+                if (terminalFailure)
+                    cancellationError = { code: typeof terminalFailure.code === "string" ? terminalFailure.code : "native_cancel_failed", receipt };
             }
         }
         catch (error) {
@@ -551,9 +565,14 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
         }
     }));
     const [nodes, processNodes, operations] = await Promise.all([sessionNodes, processResults, operationNodes]);
-    const closeNodes = interrupt && control?.action === "stop" && request?.force === true ? await Promise.all([...daemonInventories].map(async ([directory, { state, records }]) => {
-        if (closedDaemons.has(directory))
-            return { state_dir: directory, status: "completed", receipt: closedDaemons.get(directory) };
+    // Every whole-RUN stop retires its owned daemon boundary once cancellation
+    // has been admitted. `force` controls escalation inside that lifecycle; it
+    // must not decide whether the lifecycle exists at all.
+    const closeNodes = interrupt && control?.action === "stop" ? await Promise.all([...daemonInventories].map(async ([directory, { state, records }]) => {
+        if (closedDaemons.has(directory)) {
+            const receipt = closedDaemons.get(directory);
+            return { state_dir: directory, status: "completed", operation_id: receipt.operation_id, receipt };
+        }
         bindings = readBindings();
         const ids = state.sessions.map(item => typeof item === "string" ? item : adapterSessionId(item));
         const harness = directoryHarnesses.get(directory) ?? null;
@@ -598,6 +617,11 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             const receipt = await runHarnessAdapter({ executable, args: inserted.changes ? ["daemon", "stop", "--cancel-tree", "--state-dir", directory, "--json"] : ["daemon", "operation", "--operation-id", operationId, "--state-dir", directory, "--json"], env, operationId: inserted.changes ? operationId : `${operationId}:observe`, timeoutMs: 30_000 });
             if (!inserted.changes && (receipt.operation_id !== operationId || receipt.operation !== "daemon.stop" || receipt.daemon_id !== daemonId))
                 throw new AppError("controller_operation_mismatch", "Daemon close observation belongs to another operation or incarnation", 1);
+            if (receipt.state === "failed") {
+                const failure = receipt.error && typeof receipt.error === "object" && !Array.isArray(receipt.error) ? receipt.error : { code: "daemon_close_failed" };
+                context.db.run("UPDATE run_control_operations SET status = 'failed', receipt_json = ?, error_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(receipt), JSON.stringify(failure), context.now(), operationId]);
+                return { operation_id: operationId, state_dir: directory, status: "pending", reason: typeof failure.code === "string" ? failure.code : "daemon_close_failed", receipt };
+            }
             const observed = inserted.changes ? receipt : receipt.state === "completed" ? receipt.result : null;
             if (observed)
                 assertDaemonCloseReceipt(observed);
@@ -611,6 +635,47 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
             return { operation_id: operationId, state_dir: directory, status: "pending", reason: failure.code };
         }
     })) : [];
+    // Once the same control owns a clean whole-tree stop, an older productive
+    // request cannot gain a provider reply through this daemon. Seal that fact in
+    // the shared native journal before the next observation pass. This prevents a
+    // closed daemon from becoming a permanent prerequisite for its own recovery.
+    const terminalizedOperations = [];
+    if (interrupt && control?.action === "stop")
+        for (const node of closeNodes) {
+            if (node.status !== "completed")
+                continue;
+            const directory = node.state_dir;
+            const inventory = daemonInventories.get(directory);
+            const daemonId = inventory?.state.daemon_id ?? inventory?.state.config?.daemonId;
+            const executable = directoryAdapters.get(directory);
+            if (!inventory)
+                continue;
+            if (!daemonId || !executable || !node.operation_id) {
+                terminalizedOperations.push({ state_dir: directory, status: "pending", reason: "operation_terminalization_binding_unknown" });
+                continue;
+            }
+            const pending = retainedDaemonOperations(directory).filter(operation => operation.daemon_id === daemonId && ["running", "awaiting_provider"].includes(String(operation.state)) && ["session.create", "session.prompt", "session.start", "session.fork", "session.resume"].includes(String(operation.operation)) && typeof operation.operation_id === "string");
+            terminalizedOperations.push(...await Promise.all(pending.map(async (operation) => {
+                try {
+                    const operationId = operation.operation_id, sessionId = typeof operation.session_id === "string" ? operation.session_id : null;
+                    assertCurrent();
+                    const env = { ...context.env, DD_FLOW_HOME: context.ddFlowHome };
+                    delete env.DD_FLOW_CONTROL_TOKEN;
+                    delete env.DD_FLOW_CONTROLLER_TOKEN;
+                    const interruptArgs = ["daemon", "operation", "interrupt", "--operation-id", operationId, "--control-id", control.control_id, "--stop-operation-id", String(node.operation_id), "--daemon-id", String(daemonId)];
+                    if (sessionId)
+                        interruptArgs.push("--session-id", sessionId);
+                    interruptArgs.push("--state-dir", directory, "--json");
+                    const receipt = await runHarnessAdapter({ executable, args: interruptArgs, env, operationId: `${observationId}:interrupt-operation:${operationId}`, timeoutMs: 30_000 });
+                    if (receipt.operation_id !== operationId || receipt.state !== "interrupted" || receipt.daemon_id !== daemonId || receipt.session_id !== sessionId)
+                        throw new AppError("controller_operation_mismatch", "Interrupted operation receipt belongs to another native request", 1);
+                    return { operation_id: operationId, state_dir: directory, status: "completed", receipt };
+                }
+                catch (error) {
+                    return { operation_id: operation.operation_id, state_dir: directory, status: "pending", reason: error instanceof AppError ? error.code : "operation_terminalization_failed" };
+                }
+            })));
+        }
     let verifyInventory = assertCurrent;
     if (!interrupt) {
         const importVersions = new Map();
@@ -681,7 +746,16 @@ async function reconcileOwnedSessions(context, input, interrupt, boundary) {
         }
     }
     assertCurrent();
-    const allNodes = [...nodes, ...processNodes, ...operations, ...closeNodes, ...unresolved];
+    // A clean daemon close plus a sealed interruption terminalizes an in-flight
+    // create even though its controller Session row never received an id. Do
+    // not leave the pre-terminalization `provider_identity_unknown` shadow node
+    // in the final result.
+    const terminalized = new Set(terminalizedOperations.filter(node => node.status === "completed").map(node => node.operation_id));
+    const reconciledNodes = nodes.map(node => {
+        const createId = "create_operation_id" in node && typeof node.create_operation_id === "string" ? node.create_operation_id : null;
+        return createId && terminalized.has(createId) ? { ...node, status: "completed", reason: undefined, receipt: terminalizedOperations.find(item => item.operation_id === createId)?.receipt } : node;
+    });
+    const allNodes = [...reconciledNodes, ...processNodes, ...operations, ...closeNodes, ...terminalizedOperations, ...unresolved];
     const settled = !interrupt && allNodes.every(node => node.status === "completed");
     if (settled)
         boundary?.retainVerification(verifyInventory);
@@ -706,11 +780,11 @@ export function retainedDaemonOperations(directory) {
         const requested = JSON.parse(fs.readFileSync(path.join(folder, "requested.json"), "utf8"));
         if (requested.schema_id !== "dd-flow/daemon-operation@1" || typeof requested.operation_id !== "string" || crypto.createHash("sha256").update(requested.operation_id).digest("hex") !== entry.name || typeof requested.operation !== "string")
             throw new AppError("daemon_operation_inventory_invalid", "Native operation request has a conflicting identity", 1);
-        const outcomePath = ["result.json", "observation-lost.json"].map(file => path.join(folder, file)).find(file => fs.existsSync(file));
+        const outcomePath = ["result.json", "interrupted.json", "observation-lost.json"].map(file => path.join(folder, file)).find(file => fs.existsSync(file));
         const outcome = outcomePath ? JSON.parse(fs.readFileSync(outcomePath, "utf8")) : { state: "running" };
-        if (!outcome || typeof outcome !== "object" || Array.isArray(outcome) || !["completed", "failed", "running", "awaiting_provider"].includes(String(outcome.state)) || ["operation_id", "operation", "daemon_id", "session_id"].some(key => key in outcome && outcome[key] !== requested[key]))
+        if (!outcome || typeof outcome !== "object" || Array.isArray(outcome) || !["completed", "failed", "interrupted", "running", "awaiting_provider"].includes(String(outcome.state)) || ["operation_id", "operation", "daemon_id", "session_id"].some(key => key in outcome && outcome[key] !== requested[key]))
             throw new AppError("daemon_operation_inventory_invalid", "Native operation result has an invalid identity or state", 1);
-        if (outcome.state === "completed" && (!outcome.result || typeof outcome.result !== "object" || Array.isArray(outcome.result)) || outcome.state === "failed" && (!outcome.error || typeof outcome.error !== "object" || Array.isArray(outcome.error)))
+        if (outcome.state === "completed" && (!outcome.result || typeof outcome.result !== "object" || Array.isArray(outcome.result)) || ["failed", "interrupted"].includes(String(outcome.state)) && (!outcome.error || typeof outcome.error !== "object" || Array.isArray(outcome.error)))
             throw new AppError("daemon_operation_inventory_invalid", "Native operation omits its terminal evidence", 1);
         return { ...requested, ...outcome };
     });

package/dist/services/run-controller-adapter.js

@@ -1,5 +1,6 @@
 import crypto from "node:crypto";
 import fs from "node:fs";
+import path from "node:path";
 import { AppError } from "../shared/errors.js";
 import { adapterSessionId, runHarnessAdapter } from "./harness-adapter.js";
 import { runtimeHarness } from "./execution-policy.js";
@@ -50,29 +51,155 @@ export function controllerEnvironment(context, manifest, session) {
         env.CODEX_HOME = session.codex_home;
     return env;
 }
+function settlement(value) {
+    const state = value.settlement;
+    return state && typeof state === "object" && !Array.isArray(state) ? state : null;
+}
+function settlementInspectArgs(args) {
+    const values = ["session", "inspect"];
+    for (let index = 2; index < args.length; index += 1) {
+        const value = args[index];
+        if (["--prompt", "--prompt-file", "--answers-file", "--target-json"].includes(value)) {
+            index += 1;
+            continue;
+        }
+        values.push(value);
+    }
+    return values;
+}
+function settlementRetryArgs(args, operationId) {
+    const stateDir = args[args.indexOf("--state-dir") + 1];
+    if (!stateDir)
+        throw new AppError("settlement_recovery_required", "Harness settlement has no state directory", 1, { operation_id: operationId });
+    return ["daemon", "operation", "settle", "--state-dir", stateDir, "--operation-id", operationId, "--json"];
+}
+function operationInspectArgs(args, operationId) {
+    const stateDir = args[args.indexOf("--state-dir") + 1];
+    if (!stateDir)
+        throw new AppError("controller_operation_binding_unknown", "Harness operation has no state directory", 1, { operation_id: operationId });
+    return ["daemon", "operation", "--state-dir", stateDir, "--operation-id", operationId, "--json"];
+}
+function expectedMethod(args) {
+    return `${args[0]}.${args[1] === "status" ? "inspect" : args[1]}`;
+}
+function validateReceipt(receipt, session, args) {
+    // `daemon start --session-id` names the retained state being reopened; the
+    // start receipt itself is a daemon lifecycle result and need not echo a
+    // provider Session identity.  Only session operations promise that binding.
+    const target = args[0] === "session" && args.includes("--session-id") ? args[args.indexOf("--session-id") + 1] : null;
+    if (target && adapterSessionId(receipt) !== target)
+        throw new AppError("session_identity_mismatch", "Managed adapter reply belongs to another or unidentified Session", 1);
+    if (receipt.harness !== undefined && receipt.harness !== runtimeHarness(session.profile))
+        throw new AppError("profile_integrity_violation", "Managed adapter returned another harness identity", 1);
+    const fork = receipt.fork_receipt;
+    const forkUnproven = (args[0] === "session" && args[1] === "fork" && receipt.fork_continuity_error !== undefined)
+        || (fork && typeof fork === "object" && !Array.isArray(fork) && fork.history_prefix_proven === false);
+    if (forkUnproven) {
+        throw new AppError("fork_continuity_unproven", "Native fork exists but its source-history continuity is not proven", 1);
+    }
+}
+async function recoverCompletedOperation(context, manifest, session, executable, args, operationId, signal) {
+    // Creation has no stable client Session id yet. Its durable daemon journal
+    // is reconciled by run-control after the owner is fenced; probing it from the
+    // failing transport path would be a second adapter invocation and can itself
+    // be mistaken for replay.
+    if (args[0] === "session" && args[1] === "create")
+        return null;
+    // A detached adapter without a native daemon has no durable operation
+    // journal to inspect. Avoid a second adapter invocation in that case; the
+    // original failure remains outcome-unknown and the controller will fence it.
+    if (!fs.existsSync(path.join(session.state_dir, "daemon.json")))
+        return null;
+    let observed;
+    try {
+        observed = await runHarnessAdapter({ executable, args: operationInspectArgs(args, operationId), env: controllerEnvironment(context, manifest, session), operationId: `${operationId}:observe`, runtimeOwner: session.owner, timeoutMs: 30_000, ...(signal ? { signal } : {}) });
+    }
+    catch {
+        return null;
+    }
+    const target = args.includes("--session-id") ? args[args.indexOf("--session-id") + 1] : null;
+    const result = observed.result;
+    if (observed.operation_id !== operationId || observed.operation !== expectedMethod(args) || observed.state !== "completed"
+        || !result || typeof result !== "object" || Array.isArray(result)
+        || target && (observed.session_id !== target || adapterSessionId(result) !== target))
+        return null;
+    return { ...result, ...(settlement(observed) ? { settlement: settlement(observed) } : {}) };
+}
+async function awaitSettlement(context, row, manifest, session, executable, args, operationId, initial, assertOwner, signal) {
+    let current = initial, delay = 250;
+    const deadline = Date.now() + 120_000;
+    while (["pending", "blocked"].includes(String(settlement(current)?.state))) {
+        if (signal?.aborted)
+            throw new AppError("harness_settlement_interrupted", "Harness settlement was interrupted", 1, { operation_id: operationId });
+        if (Date.now() >= deadline)
+            throw new AppError("settlement_recovery_required", "Completed provider operation requires settlement recovery", 1, { operation_id: operationId, settlement: settlement(current) });
+        await new Promise(resolve => setTimeout(resolve, Math.min(delay, Math.max(0, deadline - Date.now()))));
+        delay = Math.min(delay * 2, 8_000);
+        assertOwner?.();
+        if (Date.now() >= deadline)
+            continue;
+        try {
+            // This only retries durable bookkeeping against the same operation
+            // receipt.  It cannot replay the provider request.
+            current = await runHarnessAdapter({ executable, args: settlementRetryArgs(args, operationId), env: controllerEnvironment(context, manifest, session), operationId: `${operationId}:settlement`, runtimeOwner: session.owner, timeoutMs: Math.min(30_000, Math.max(1, deadline - Date.now())), ...(signal ? { signal } : {}) });
+        }
+        catch (error) {
+            current = { settlement: { state: "pending", reason: "inspection_error", error: errorRecord(error) } };
+        }
+        if (!(["pending", "blocked"].includes(String(settlement(current)?.state))))
+            continue;
+        // A receipt without final tree proof needs a fresh native inspection.  Do
+        // it only after the receipt-only retry, and only when this is a session.
+        if (!args.includes("--session-id") || !["tree_unsettled", "settlement_evidence_required"].includes(String(settlement(current)?.reason)) || Date.now() >= deadline)
+            continue;
+        try {
+            current = await runHarnessAdapter({ executable, args: settlementInspectArgs(args), env: controllerEnvironment(context, manifest, session), operationId: `${operationId}:settlement-inspect`, runtimeOwner: session.owner, timeoutMs: Math.min(30_000, Math.max(1, deadline - Date.now())), ...(signal ? { signal } : {}) });
+        }
+        catch (error) {
+            current = { settlement: { state: "pending", reason: "inspection_error", error: errorRecord(error) } };
+        }
+    }
+    return current;
+}
 export async function controllerAdapter(context, row, manifest, session, args, assertOwner, retainedOperationId, signal) {
     assertOwner?.();
     const operationId = retainedOperationId ?? `${row.controller_id}:${crypto.randomUUID()}`;
     const executable = manifest.adapters[runtimeHarness(session.profile)].executable;
-    const input = { executable, args, owner: session.owner.owner_id, state_dir: session.state_dir, ...(args[0] === "session" && args[1] === "prompt" ? { prompt_sha256: digestBytes(fs.readFileSync(args[args.indexOf("--prompt-file") + 1])) } : {}) };
+    const promptFile = args.indexOf("--prompt-file"), inlinePrompt = args.indexOf("--prompt");
+    const promptSha256 = promptFile >= 0 ? digestBytes(fs.readFileSync(args[promptFile + 1])) : inlinePrompt >= 0 ? digestBytes(args[inlinePrompt + 1] ?? "") : undefined;
+    const input = { executable, args, owner: session.owner.owner_id, state_dir: session.state_dir, ...(args[0] === "session" && args[1] === "prompt" && promptSha256 ? { prompt_sha256: promptSha256 } : {}) };
     const now = context.now();
     context.db.run("INSERT INTO run_controller_operations (operation_id, controller_id, generation, input_hash, input_json, status, created_at, updated_at) VALUES (?, ?, ?, ?, ?, 'dispatching', ?, ?)", [operationId, row.controller_id, row.generation, digest(input), JSON.stringify(input), now, now]);
     appendEvent(context, row.controller_id, "operation_requested", { operation_id: operationId, operation: args.slice(0, 2), session_id: session.id || null });
     try {
         assertOwner?.();
-        const receipt = await runHarnessAdapter({ executable, args, env: controllerEnvironment(context, manifest, session), operationId, runtimeOwner: session.owner, timeoutMs: args[0] === "session" && args[1] === "prompt" ? 2 * 60 * 60_000 : 120_000, ...(signal ? { signal } : {}) });
+        let receipt = await runHarnessAdapter({ executable, args, env: controllerEnvironment(context, manifest, session), operationId, runtimeOwner: session.owner, timeoutMs: args[0] === "session" && args[1] === "prompt" ? null : 120_000, ...(signal ? { signal } : {}) });
+        if (["pending", "blocked"].includes(String(settlement(receipt)?.state))) {
+            const recovered = await awaitSettlement(context, row, manifest, session, executable, args, operationId, receipt, assertOwner, signal);
+            receipt = { ...receipt, settlement: settlement(recovered) };
+        }
         context.db.run("UPDATE run_controller_operations SET receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(receipt), context.now(), operationId]);
-        const target = args[args.indexOf("--session-id") + 1];
-        if (args[0] === "session" && args.includes("--session-id") && adapterSessionId(receipt) !== target)
-            throw new AppError("session_identity_mismatch", "Managed adapter reply belongs to another or unidentified Session", 1);
-        if (receipt.harness !== undefined && receipt.harness !== runtimeHarness(session.profile))
-            throw new AppError("profile_integrity_violation", "Managed adapter returned another harness identity", 1);
+        validateReceipt(receipt, session, args);
         context.db.run("UPDATE run_controller_operations SET status = 'completed', updated_at = ? WHERE operation_id = ?", [context.now(), operationId]);
         assertOwner?.();
         appendEvent(context, row.controller_id, "operation_completed", { operation_id: operationId, operation: args.slice(0, 2), session_id: adapterSessionId(receipt) });
         return receipt;
     }
     catch (error) {
+        const retained = await recoverCompletedOperation(context, manifest, session, executable, args, operationId, signal);
+        if (retained) {
+            let receipt = retained;
+            if (["pending", "blocked"].includes(String(settlement(receipt)?.state))) {
+                const recovered = await awaitSettlement(context, row, manifest, session, executable, args, operationId, receipt, assertOwner, signal);
+                receipt = { ...receipt, settlement: settlement(recovered) };
+            }
+            context.db.run("UPDATE run_controller_operations SET receipt_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(receipt), context.now(), operationId]);
+            validateReceipt(receipt, session, args);
+            context.db.run("UPDATE run_controller_operations SET status = 'completed', error_json = NULL, updated_at = ? WHERE operation_id = ?", [context.now(), operationId]);
+            assertOwner?.();
+            appendEvent(context, row.controller_id, "operation_recovered", { operation_id: operationId, operation: args.slice(0, 2), session_id: adapterSessionId(receipt) });
+            return receipt;
+        }
         try {
             context.db.run("UPDATE run_controller_operations SET status = CASE WHEN status = 'dispatching' THEN 'outcome_unknown' ELSE status END, error_json = ?, updated_at = ? WHERE operation_id = ?", [JSON.stringify(errorRecord(error)), context.now(), operationId]);
         }

package/dist/services/run-controller.js

@@ -20,8 +20,9 @@ import { confirmManagedProcess, heartbeatManagedProcess, finishManagedProcess, p
 import { readNativeDaemonState, requireManagedDaemonBinding } from "./managed-daemon-binding.js";
 import { initCodexHome } from "./hooks.js";
 import { launchExternalWork } from "./external-work-launch.js";
-import { controllerNativeChildren, nextControllerFanout } from "./controller-fanout.js";
+import { controllerNativeChildren, controllerStageEntryPrompt, nextControllerFanout } from "./controller-fanout.js";
 import { claimQueuedMergeRequest } from "./merge-server.js";
+import { prepareVnextCodeWorkspace } from "./vnext-code.js";
 import { requireRun, requireController, controllerReceipt, appendEvent, saveState, digest, digestBytes, errorRecord } from "./run-controller-state.js";
 import { spawnController, recordControllerLauncher, claimControllerProcess, markControllerDispatchReady } from "./run-controller-process.js";
 import { controllerAdapter, controllerEnvironment, sessionArguments } from "./run-controller-adapter.js";
@@ -405,7 +406,7 @@ async function executeController(context, row, manifest, state, assertOwnership,
         throw fatal; checkOutcomes(); assertOwnership(); };
     const policy = manifest.execution_profile.settings.execution;
     const profiles = manifest.execution_profile.agent_profiles;
-    let executionContext = { ...context, env: { ...context.env, DD_FLOW_BIN: manifest.flow_executable, DD_FLOW_RESOURCE_HOME: manifest.resource_home, DD_FLOW_RUNTIME_BUDGET: manifest.budget ? JSON.stringify(manifest.budget) : undefined } };
+    let executionContext = { ...context, env: { ...context.env, DD_FLOW_BIN: manifest.flow_executable, DD_FLOW_RESOURCE_HOME: manifest.resource_home, DD_FLOW_RUNTIME_BUDGET: manifest.budget ? JSON.stringify(manifest.budget) : undefined, DD_FLOW_CODE_READINESS_OWNER: row.controller_id } };
     const bindInvocationScope = (session) => {
         executionContext = managedInvocationContext(executionContext, { harness: runtimeHarness(session.profile), stateDir: session.state_dir, sessionId: session.id,
             projectRoot: manifest.request.project_root, runId: row.run_id, generation: row.generation });
@@ -631,10 +632,17 @@ async function executeController(context, row, manifest, state, assertOwnership,
                 state.last_continuation = null;
                 saveState(context, row, state);
                 setStatus("running");
+                if (next.stage === "code" || next.stage === "code-review") {
+                    // A CODE_REVIEW fork has source files but intentionally no installed
+                    // dependencies. Its repair Work executes checks just like CODE Work.
+                    const readiness = await prepareVnextCodeWorkspace(executionContext, { projectRoot: run.project_root, runId: run.id, ownerId: row.controller_id, stage: next.stage });
+                    assertOwner();
+                    appendEvent(context, row.controller_id, "code_workspace_prepared", { stage: next.stage, readiness_status: readiness.status ?? null });
+                }
                 const responseFile = path.join(row.state_dir, `${next.stage}-${next.attempt ?? 1}.stage-start-response.json`);
                 const command = managedLifecycleCommand(executionContext, `${flowCommand(executionContext)} stage start ${run.id} --stage ${next.stage} --project-root ${JSON.stringify(run.project_root)} --context-file ${JSON.stringify(stageContext.file)} --context-sha256 ${stageContext.sha256} --require-session-binding --response-file ${JSON.stringify(responseFile)} --json --progress-jsonl`);
                 appendEvent(context, row.controller_id, "stage_entered", { stage: next.stage, session_id: session.id, context_sha256: stageContext.sha256 });
-                await prompt(session, `Start the assigned ${next.stage} Stage now. Your first tool call must be this exact standalone command:\n\n${command}\n\nRead the complete authoritative packet saved to ${JSON.stringify(responseFile)}, including worker_prompt_markdown. If a read is truncated, continue until the entire packet has been read before doing Stage work. Stop at this Stage boundary or a declared HITL/Work-graph boundary; do not start a successor Stage yourself.`);
+                await prompt(session, controllerStageEntryPrompt(next.stage, command, responseFile));
                 continue;
             }
             if (state.current_session === null)