@vtxmacro/cli 2026.9.8 → 2026.9.10

package/bin/vtx-service-bootstrap.js

@@ -16,7 +16,7 @@ import { fileURLToPath } from "node:url";
 // agent-cli-release.json
 var agent_cli_release_default = {
   package_name: "@vtxmacro/cli",
-  package_version: "2026.9.8",
+  package_version: "2026.9.10",
   codex_package_name: "@openai/codex",
   codex_version: "0.147.0",
   copilot_sdk_package_name: "@github/copilot-sdk",

package/bin/vtx.js

@@ -47,7 +47,7 @@ var init_agent_cli_release = __esm({
   "agent-cli-release.json"() {
     agent_cli_release_default = {
       package_name: "@vtxmacro/cli",
-      package_version: "2026.9.8",
+      package_version: "2026.9.10",
       codex_package_name: "@openai/codex",
       codex_version: "0.147.0",
       copilot_sdk_package_name: "@github/copilot-sdk",
@@ -21363,7 +21363,7 @@ child.once('close', async (code, signal) => {
               retryable: true
             }));
           }, Math.max(1, options.timeoutMs));
-          if (options.signal) {
+          if (options.signal && !options.retainResponseOnAbort) {
             const onAbort = () => {
               this.pending.delete(id2);
               this.retireResponseId(id2, method);
@@ -21833,7 +21833,12 @@ child.once('close', async (code, signal) => {
           }
         }, {
           timeoutMs: Math.max(1, options.deadlineAtMs - Date.now()),
-          signal: options.signal
+          signal: options.signal,
+          // Thread creation does not dispatch inference, but it can persist prompt
+          // bytes. Keep its exact reply correlated after cancellation so we can
+          // validate and delete the thread before reporting cleanup. The original
+          // RPC deadline still bounds setup; turn/start keeps normal cancellation.
+          retainResponseOnAbort: true
         });
         const thread = objectOrNull(result2.thread);
         const permission = objectOrNull(result2.activePermissionProfile);
@@ -21852,6 +21857,15 @@ child.once('close', async (code, signal) => {
           });
         }
         this.threads.set(threadId, resolvedThreadPath);
+        if (options.signal?.aborted || Date.now() >= options.deadlineAtMs) {
+          await this.deleteThread(threadId);
+          throw new CodexAppServerError({
+            message: "Codex thread setup ended before inference dispatch.",
+            category: options.signal?.aborted ? "cancelled" : "timeout",
+            code: options.signal?.aborted ? "cancelled" : "deadline_exceeded",
+            retryable: false
+          });
+        }
         return {
           threadId,
           threadPath: resolvedThreadPath,
@@ -23919,6 +23933,7 @@ var init_codex_adapter = __esm({
           }
           if (error48 instanceof CodexAppServerError) {
             const dispatchOutcome = error48.code === "server_account_context_expired_before_provider_dispatch" ? "not_dispatched" : error48.dispatchOutcome === "not_dispatched" ? currentDispatchOutcome : error48.dispatchOutcome;
+            input.onTerminalDispatchOutcome?.(dispatchOutcome);
             if (baseCheckpoint && !completedResult) {
               latestCheckpoint = {
                 ...baseCheckpoint,
@@ -23962,6 +23977,7 @@ var init_codex_adapter = __esm({
             dispatchOutcome: currentDispatchOutcome,
             cause: error48
           });
+          input.onTerminalDispatchOutcome?.(classified.dispatchOutcome);
           if (baseCheckpoint && !completedResult) {
             latestCheckpoint = {
               ...baseCheckpoint,
@@ -24716,9 +24732,14 @@ ${input.outputSchemaJson}`
             terminalStatus: "completed"
           };
         } catch (error48) {
-          if (error48 instanceof CodexAppServerError) throw error48;
+          if (error48 instanceof CodexAppServerError) {
+            input.onTerminalDispatchOutcome?.(error48.dispatchOutcome);
+            throw error48;
+          }
           const cancelled = input.signal?.aborted === true;
           const deadline = Date.now() >= input.deadlineAtMs;
+          const dispatchOutcome = providerReceiptObserved ? "confirmed_dispatched" : dispatchEntered ? "outcome_unknown" : "not_dispatched";
+          input.onTerminalDispatchOutcome?.(dispatchOutcome);
           if (dispatchEntered && session) {
             await session.abort().catch(() => void 0);
           }
@@ -24727,7 +24748,7 @@ ${input.outputSchemaJson}`
             category: cancelled ? "cancelled" : deadline ? "timeout" : "adapter",
             code: cancelled ? "cancelled" : deadline ? "deadline_exceeded" : "copilot_adapter_failure",
             retryable: false,
-            dispatchOutcome: providerReceiptObserved ? "confirmed_dispatched" : dispatchEntered ? "outcome_unknown" : "not_dispatched",
+            dispatchOutcome,
             cause: error48
           });
         } finally {
@@ -25500,12 +25521,14 @@ ${input.outputSchemaJson}`,
         } catch (error48) {
           const cancelled = input.signal?.aborted === true;
           const deadline = !cancelled && boundary.signal.aborted;
-          throw mapDeepSeekFailure({
+          const mapped = mapDeepSeekFailure({
             error: error48,
             cancelled,
             deadline,
             dispatchOutcome: proxyDispatchOutcome(proxy)
           });
+          input.onTerminalDispatchOutcome?.(mapped.dispatchOutcome);
+          throw mapped;
         } finally {
           boundary.cleanup();
           await proxy.close();
@@ -33336,6 +33359,7 @@ var init_runner = __esm({
         let stopHostHeartbeatLoop = () => {
         };
         let hostHeartbeatLoop = Promise.resolve();
+        let providerDispatchWatchdogDrainRequested = false;
         const agentAbort = new AbortController();
         let agentLoop = Promise.resolve();
         let wakeDrain;
@@ -34135,6 +34159,24 @@ var init_runner = __esm({
                   active_attempts: active.size
                 });
               },
+              onAttemptStage: (stage) => {
+                emitDiagnostic("attempt_stage_changed", {
+                  stage,
+                  job_id: claim.job_id,
+                  attempt_id: attemptId,
+                  active_attempts: active.size
+                });
+              },
+              onProviderDispatchWatchdog: (observation) => {
+                providerDispatchWatchdogDrainRequested = true;
+                emitDiagnostic("provider_dispatch_watchdog_expired", {
+                  ...observation,
+                  job_id: claim.job_id,
+                  attempt_id: attemptId,
+                  active_attempts: active.size
+                });
+                requestDrain("provider_dispatch_watchdog_expired");
+              },
               startRetryCount: nextStartRetryCount,
               onAttemptStartRetry: (observation) => {
                 attemptStartRetryCounts.set(attemptId, observation.retry_count);
@@ -34501,7 +34543,8 @@ var init_runner = __esm({
                   });
                 });
                 const shouldRollover = !this.options.once && (settings.maxConcurrency === null || active.size + prepared.length < settings.maxConcurrency);
-                await mutateReceipt((current) => {
+                pendingClaimPromotions += 1;
+                const batchReceiptDurability = mutateReceipt((current) => {
                   if (current.pending_claim_request?.claim_request_id !== request.claim_request_id) runnerIdentityMismatch("Batched claim receipt");
                   const attempts = { ...current.attempts };
                   for (const attempt of prepared) {
@@ -34517,6 +34560,8 @@ var init_runner = __esm({
                     updated_at: isoAt(now())
                   };
                   return shouldRollover ? preparePendingClaim(promoted) : promoted;
+                }).then(() => void 0).finally(() => {
+                  pendingClaimPromotions = Math.max(0, pendingClaimPromotions - 1);
                 });
                 for (let index = 0; index < prepared.length; index += 1) {
                   const item = claim.claims[index];
@@ -34529,7 +34574,8 @@ var init_runner = __esm({
                       provider_dispatch_freshness_remaining_ms: item.provider_dispatch_freshness_remaining_ms
                     },
                     roundTripMs: claimTransportResidualMs,
-                    claimResponseReceivedAtMs
+                    claimResponseReceivedAtMs,
+                    receiptDurability: batchReceiptDurability
                   });
                 }
                 if (this.options.once) requestDrain("once_complete");
@@ -34573,13 +34619,17 @@ var init_runner = __esm({
             ]);
           }
           stopHostHeartbeatLoop();
-          await hostHeartbeatLoop;
-          try {
-            await hostHeartbeat("draining", {
-              deadlineAtMs: now() + settings.drainTimeoutMs,
-              timeoutMs: settings.drainTimeoutMs
-            });
-          } catch {
+          if (providerDispatchWatchdogDrainRequested) {
+            await settlesWithin(hostHeartbeatLoop, MIN_SLEEP_MS);
+          } else {
+            await hostHeartbeatLoop;
+            await settlesWithin(
+              hostHeartbeat("draining", {
+                deadlineAtMs: now() + settings.drainTimeoutMs,
+                timeoutMs: settings.drainTimeoutMs
+              }),
+              settings.drainTimeoutMs
+            );
           }
           if (active.size > 0) {
             let timedOut = false;
@@ -34617,7 +34667,11 @@ var init_runner = __esm({
           ]);
           await settlesWithin(agentCleanup, settings.drainTimeoutMs);
           stopHostHeartbeatLoop();
-          await hostHeartbeatLoop;
+          if (providerDispatchWatchdogDrainRequested) {
+            await settlesWithin(hostHeartbeatLoop, MIN_SLEEP_MS);
+          } else {
+            await hostHeartbeatLoop;
+          }
           removeAbortListener();
           unregisterSignals();
           try {
@@ -34695,6 +34749,53 @@ var init_runner = __esm({
             "The persisted same-attempt recovery scope is invalid."
           );
         }
+        let lastPreProviderStage = "claimed";
+        const reportPreProviderStage = (stage) => {
+          if (lastPreProviderStage === stage && stage !== "claimed") return;
+          lastPreProviderStage = stage;
+          options.onAttemptStage?.(stage);
+        };
+        reportPreProviderStage("claimed");
+        const attemptAbort = new AbortController();
+        const relayAbort = () => attemptAbort.abort();
+        signal.addEventListener("abort", relayAbort, { once: true });
+        if (signal.aborted) attemptAbort.abort();
+        let watchdogArmedAtMs = now();
+        let providerDispatchWatchdog = null;
+        let providerDispatchWatchdogExpired = false;
+        let resolveProviderDispatchWatchdog;
+        const providerDispatchWatchdogSignal = new Promise((resolve6) => {
+          resolveProviderDispatchWatchdog = resolve6;
+        });
+        const clearProviderDispatchWatchdog = () => {
+          if (providerDispatchWatchdog !== null) clearTimeout(providerDispatchWatchdog);
+          providerDispatchWatchdog = null;
+        };
+        const armProviderDispatchWatchdog = (deadlineAtMs) => {
+          clearProviderDispatchWatchdog();
+          if (deadlineAtMs === void 0 || attemptReceipt.phase === "dispatched" || attemptAbort.signal.aborted) return;
+          watchdogArmedAtMs = now();
+          providerDispatchWatchdog = setTimeout(() => {
+            providerDispatchWatchdog = null;
+            if (providerDispatchedAt !== null || attemptAbort.signal.aborted) return;
+            providerDispatchWatchdogExpired = true;
+            options.onProviderDispatchWatchdog?.({
+              last_stage: lastPreProviderStage,
+              elapsed_ms: Math.max(0, now() - watchdogArmedAtMs),
+              remaining_ms: Math.max(0, deadlineAtMs - now())
+            });
+            resolveProviderDispatchWatchdog();
+            attemptAbort.abort();
+          }, Math.max(MIN_SLEEP_MS, deadlineAtMs - now()));
+        };
+        const awaitPreProviderDurability = async (operation) => Promise.race([
+          operation,
+          providerDispatchWatchdogSignal.then(() => {
+            throw new InferenceHostRecoveryRequiredError(
+              "Provider dispatch stopped because its durable receipt missed the freshness deadline."
+            );
+          })
+        ]);
         const persistAttempt = async (changes, clearPendingClaim = false) => {
           const nextAttemptReceipt = validateAttemptReceipt({
             ...attemptReceipt,
@@ -34761,6 +34862,84 @@ var init_runner = __esm({
           });
           options.onClaimPersisted?.();
         };
+        const terminalizeProviderDispatchWatchdog = async () => {
+          const failureCode = "server_account_context_expired_before_provider_dispatch";
+          const failure = {
+            category: "timeout",
+            code: failureCode,
+            retryable: false,
+            dispatchOutcome: "not_dispatched",
+            effectiveModel: null,
+            effectiveEffort: null
+          };
+          const failureId = stableOperationId("failure", [
+            claim.job_id,
+            attemptId,
+            failure.dispatchOutcome,
+            failure.category,
+            failure.code
+          ]);
+          const failureRequest = jobFailRequestSchema.parse({
+            schema_version: "external_inference_job_fail_v1",
+            contract_version: EXTERNAL_INFERENCE_CONTRACT_VERSION,
+            job_id: claim.job_id,
+            host_id: claim.host_id,
+            host_generation: claim.host_generation,
+            advertisement_generation: claim.advertisement_generation,
+            key_generation: claim.key_generation,
+            claim_generation: claim.claim_generation,
+            controller_generation: claim.controller_generation,
+            claim_handle: claim.claim_handle,
+            attempt_id: attemptId,
+            failure_id: failureId,
+            response_mode: claim.response_mode,
+            output_schema_version: claim.output_schema_version,
+            attempt_status: "failed_no_response",
+            outcome: {
+              dispatch_outcome: failure.dispatchOutcome,
+              response_outcome: "none"
+            },
+            model: {
+              requested_model: claim.requested_model,
+              requested_reasoning_effort: claim.requested_reasoning_effort,
+              effective_model: null,
+              effective_reasoning_effort: null,
+              adapter_request_id: null,
+              adapter_response_id: null
+            },
+            usage: null,
+            failure_category: failure.category,
+            failure_code: failure.code,
+            retryable: failure.retryable,
+            provider_dispatch_freshness_remaining_ms: 0,
+            membership_disposition: membershipFailureDisposition(failure),
+            failed_at: isoAt(now())
+          });
+          void persistAttempt({
+            phase: "terminal_pending",
+            dispatch_outcome: "not_dispatched",
+            terminal_operation_id: failureId,
+            terminal_request: failureRequest
+          }).catch(() => void 0);
+          const evidenceDeadlineAtMs = Date.parse(jobInput.evidence_expires_at);
+          const failureResult = await retryExact(() => mcp.callTool(
+            "inference.job.fail",
+            failureRequest,
+            { signal, deadlineAtMs: evidenceDeadlineAtMs }
+          ), { signal, deadlineAtMs: evidenceDeadlineAtMs });
+          assertTerminalResult(failureRequest, failureResult);
+          options.onAttemptOutcome?.({
+            outcome: "failed",
+            failure_category: failureRequest.failure_category,
+            failure_code: failureRequest.failure_code,
+            retryable: failureRequest.retryable,
+            dispatch_outcome: failureRequest.outcome.dispatch_outcome,
+            response_outcome: failureRequest.outcome.response_outcome,
+            latency_ms: null,
+            usage: null
+          });
+          return "failed";
+        };
         let outputContract = null;
         let inputValidationError;
         try {
@@ -34769,121 +34948,150 @@ var init_runner = __esm({
         } catch (error48) {
           inputValidationError = error48;
         }
-        if (attemptReceipt.phase === "claimed") {
-          const attemptDeadlineAtMs = Math.min(
-            Date.parse(claim.deadline_at),
-            Date.parse(claim.lease_expires_at)
-          );
-          if (attemptDeadlineAtMs <= now() + MIN_CLAIM_START_WINDOW_MS) {
-            await removeAttempt();
-            return "failed";
-          }
-          let startResult;
-          const startCallStartedAtMs = now();
-          let startCallCompletedAtMs = startCallStartedAtMs;
-          if (options.prestarted) {
-            startResult = options.prestarted.result;
-            startCallCompletedAtMs = now();
-            startRoundTripMs = Math.max(0, options.prestarted.roundTripMs);
-          } else {
-            const claimPromotionPromise = options.resumeReceipt ? Promise.resolve() : persistAttempt({ phase: "claimed" }, true);
-            const startCallPromise = retryExact(() => mcp.callTool(
-              "inference.job.start",
-              startRequest,
-              { signal, deadlineAtMs: attemptDeadlineAtMs }
-            ), { signal, deadlineAtMs: attemptDeadlineAtMs }).then((result2) => {
-              startCallCompletedAtMs = now();
-              return result2;
-            });
-            const [startOutcome, claimPromotionOutcome] = await Promise.allSettled([
-              startCallPromise,
-              claimPromotionPromise
-            ]);
-            if (claimPromotionOutcome.status === "rejected") {
-              throw claimPromotionOutcome.reason;
-            }
-            if (startOutcome.status === "rejected") {
-              const error48 = startOutcome.reason;
-              if (error48 instanceof ExternalInferenceMcpError && error48.serverFailureCode === "server_account_context_expired_before_provider_dispatch") {
-                await removeAttempt();
-                options.onAttemptOutcome?.({
-                  outcome: "freshness_rejected_before_provider_dispatch",
-                  failure_category: "freshness",
-                  failure_code: error48.serverFailureCode,
-                  dispatch_outcome: "not_dispatched"
-                });
-                return "failed";
-              }
-              if (attemptDeadlineAtMs <= now() + MIN_CLAIM_START_WINDOW_MS) {
-                await removeAttempt();
-                return "failed";
+        try {
+          if (attemptReceipt.phase === "claimed") {
+            const attemptDeadlineAtMs = Math.min(
+              Date.parse(claim.deadline_at),
+              Date.parse(claim.lease_expires_at)
+            );
+            if (attemptDeadlineAtMs <= now() + MIN_CLAIM_START_WINDOW_MS) {
+              await removeAttempt();
+              clearProviderDispatchWatchdog();
+              signal.removeEventListener("abort", relayAbort);
+              return "failed";
+            }
+            const startCallStartedAtMs = now();
+            let startCallCompletedAtMs = startCallStartedAtMs;
+            const acceptStartResult = (result2, freshnessAnchorAtMs, roundTripMs) => {
+              assertStartResult(startRequest, result2);
+              if (serverProviderDispatchDeadlineMs === void 0) return;
+              const serverRemaining = result2.provider_dispatch_freshness_remaining_ms;
+              if (!Number.isSafeInteger(serverRemaining) || Number(serverRemaining) < 0) {
+                throw new InferenceHostRunnerError(
+                  "provider_dispatch_freshness_receipt_invalid",
+                  "The Server provider-dispatch freshness receipt is unavailable."
+                );
               }
-              if (signal.aborted) throw error48;
-              if (controlPlaneFatal(error48)) throw error48;
-              const remainingMs = Math.max(
-                MIN_SLEEP_MS,
-                attemptDeadlineAtMs - now() - MIN_CLAIM_START_WINDOW_MS
+              startRoundTripMs = Math.max(0, roundTripMs);
+              serverReportedFreshnessRemainingMs = Number(serverRemaining);
+              const conservativeRemainingMs = Math.max(
+                0,
+                serverReportedFreshnessRemainingMs - startRoundTripMs
               );
-              const retryCount = Math.min(
-                Math.max(1, options.startRetryCount),
-                Number.MAX_SAFE_INTEGER
+              providerDispatchNotAfterMs = freshnessAnchorAtMs + conservativeRemainingMs;
+              armProviderDispatchWatchdog(providerDispatchNotAfterMs);
+            };
+            if (options.prestarted) {
+              startCallCompletedAtMs = now();
+              acceptStartResult(
+                options.prestarted.result,
+                options.prestarted.claimResponseReceivedAtMs,
+                options.prestarted.roundTripMs
               );
-              const retryDelayMs = Math.min(
-                remoteRetryAfterMs(error48, attemptStartRetryFallbackMs(retryCount)),
-                remainingMs
+              if (options.prestarted.receiptDurability) {
+                reportPreProviderStage("receipt_persistence");
+                await awaitPreProviderDurability(options.prestarted.receiptDurability);
+              }
+            } else {
+              reportPreProviderStage("receipt_persistence");
+              const claimPromotionPromise = options.resumeReceipt ? Promise.resolve() : awaitPreProviderDurability(
+                persistAttempt({ phase: "claimed" }, true)
               );
-              const rawErrorCode = error48 && typeof error48 === "object" && "code" in error48 ? String(error48.code) : "start_acknowledgement_failed";
-              options.onAttemptStartRetry?.({
-                failure_stage: "job_start_acknowledgement",
-                error_code: safeFailureCode(rawErrorCode, "start_acknowledgement_failed"),
-                http_status_code: error48 instanceof ExternalInferenceMcpError ? error48.httpStatusCode : null,
-                retryable: retryableRemoteError(error48),
-                definitively_not_applied: Boolean(
-                  error48 && typeof error48 === "object" && "definitivelyNotApplied" in error48 && error48.definitivelyNotApplied === true
-                ),
-                retry_after_ms: error48 instanceof ExternalInferenceMcpError ? error48.retryAfterMs : null,
-                retry_count: retryCount,
-                next_delay_ms: retryDelayMs
+              const startCallPromise = retryExact(() => mcp.callTool(
+                "inference.job.start",
+                startRequest,
+                { signal, deadlineAtMs: attemptDeadlineAtMs }
+              ), { signal, deadlineAtMs: attemptDeadlineAtMs }).then((result2) => {
+                startCallCompletedAtMs = now();
+                acceptStartResult(
+                  result2,
+                  startCallCompletedAtMs,
+                  startCallCompletedAtMs - startCallStartedAtMs
+                );
+                return result2;
               });
-              await options.sleep(retryDelayMs, signal);
-              return "retry_claimed";
+              const [startOutcome, claimPromotionOutcome] = await Promise.allSettled([
+                startCallPromise,
+                claimPromotionPromise
+              ]);
+              if (claimPromotionOutcome.status === "rejected") {
+                throw claimPromotionOutcome.reason;
+              }
+              if (startOutcome.status === "rejected") {
+                const error48 = startOutcome.reason;
+                if (error48 instanceof ExternalInferenceMcpError && error48.serverFailureCode === "server_account_context_expired_before_provider_dispatch") {
+                  await removeAttempt();
+                  options.onAttemptOutcome?.({
+                    outcome: "freshness_rejected_before_provider_dispatch",
+                    failure_category: "freshness",
+                    failure_code: error48.serverFailureCode,
+                    dispatch_outcome: "not_dispatched"
+                  });
+                  clearProviderDispatchWatchdog();
+                  signal.removeEventListener("abort", relayAbort);
+                  return "failed";
+                }
+                if (attemptDeadlineAtMs <= now() + MIN_CLAIM_START_WINDOW_MS) {
+                  await removeAttempt();
+                  clearProviderDispatchWatchdog();
+                  signal.removeEventListener("abort", relayAbort);
+                  return "failed";
+                }
+                if (signal.aborted) throw error48;
+                if (controlPlaneFatal(error48)) throw error48;
+                const remainingMs = Math.max(
+                  MIN_SLEEP_MS,
+                  attemptDeadlineAtMs - now() - MIN_CLAIM_START_WINDOW_MS
+                );
+                const retryCount = Math.min(
+                  Math.max(1, options.startRetryCount),
+                  Number.MAX_SAFE_INTEGER
+                );
+                const retryDelayMs = Math.min(
+                  remoteRetryAfterMs(error48, attemptStartRetryFallbackMs(retryCount)),
+                  remainingMs
+                );
+                const rawErrorCode = error48 && typeof error48 === "object" && "code" in error48 ? String(error48.code) : "start_acknowledgement_failed";
+                options.onAttemptStartRetry?.({
+                  failure_stage: "job_start_acknowledgement",
+                  error_code: safeFailureCode(rawErrorCode, "start_acknowledgement_failed"),
+                  http_status_code: error48 instanceof ExternalInferenceMcpError ? error48.httpStatusCode : null,
+                  retryable: retryableRemoteError(error48),
+                  definitively_not_applied: Boolean(
+                    error48 && typeof error48 === "object" && "definitivelyNotApplied" in error48 && error48.definitivelyNotApplied === true
+                  ),
+                  retry_after_ms: error48 instanceof ExternalInferenceMcpError ? error48.retryAfterMs : null,
+                  retry_count: retryCount,
+                  next_delay_ms: retryDelayMs
+                });
+                await options.sleep(retryDelayMs, signal);
+                clearProviderDispatchWatchdog();
+                signal.removeEventListener("abort", relayAbort);
+                return "retry_claimed";
+              }
             }
-            startResult = startOutcome.value;
           }
-          assertStartResult(startRequest, startResult);
-          if (serverProviderDispatchDeadlineMs !== void 0) {
-            const serverRemaining = startResult.provider_dispatch_freshness_remaining_ms;
-            if (!Number.isSafeInteger(serverRemaining) || Number(serverRemaining) < 0) {
-              throw new InferenceHostRunnerError(
-                "provider_dispatch_freshness_receipt_invalid",
-                "The Server provider-dispatch freshness receipt is unavailable."
-              );
-            }
-            if (!options.prestarted) {
-              startRoundTripMs = Math.max(0, startCallCompletedAtMs - startCallStartedAtMs);
-            }
-            serverReportedFreshnessRemainingMs = Number(serverRemaining);
-            const conservativeRemainingMs = Math.max(
-              0,
-              serverReportedFreshnessRemainingMs - startRoundTripMs
+          if (attemptReceipt.phase !== "dispatched") {
+            const providerDispatchable = inputValidationError === void 0 && outputContract !== null;
+            reportPreProviderStage("receipt_persistence");
+            await awaitPreProviderDurability(
+              persistAttempt({
+                phase: providerDispatchable ? "dispatched" : "started",
+                dispatch_outcome: providerDispatchable ? "outcome_unknown" : "not_dispatched"
+              })
             );
-            const freshnessAnchorAtMs = options.prestarted ? options.prestarted.claimResponseReceivedAtMs : startCallCompletedAtMs;
-            providerDispatchNotAfterMs = freshnessAnchorAtMs + conservativeRemainingMs;
           }
-        }
-        if (attemptReceipt.phase !== "dispatched") {
-          const providerDispatchable = inputValidationError === void 0 && outputContract !== null;
-          await persistAttempt({
-            phase: providerDispatchable ? "dispatched" : "started",
-            dispatch_outcome: providerDispatchable ? "outcome_unknown" : "not_dispatched"
-          });
+          reportPreProviderStage("thread_setup");
+        } catch (error48) {
+          clearProviderDispatchWatchdog();
+          signal.removeEventListener("abort", relayAbort);
+          if (providerDispatchWatchdogExpired) {
+            return terminalizeProviderDispatchWatchdog();
+          }
+          throw error48;
         }
         let adapterResult;
         let heartbeatFailure;
-        const attemptAbort = new AbortController();
-        const relayAbort = () => attemptAbort.abort();
-        signal.addEventListener("abort", relayAbort, { once: true });
-        if (signal.aborted) attemptAbort.abort();
         let heartbeatStopped = false;
         const heartbeatLoop = (async () => {
           while (!heartbeatStopped && !attemptAbort.signal.aborted) {
@@ -34959,7 +35167,12 @@ var init_runner = __esm({
               dispatchOutcome: "outcome_unknown"
             });
           }
-          adapterResult = await this.dependencies.codexAdapter.runAttempt({
+          let resolveTerminalDispatchOutcome;
+          const terminalDispatchOutcomeSignal = new Promise((resolve6) => {
+            resolveTerminalDispatchOutcome = resolve6;
+          });
+          let terminalDispatchOutcomeObserved = false;
+          const adapterAttempt = this.dependencies.codexAdapter.runAttempt({
             attemptId,
             inputSha256: jobInput.input_sha256,
             systemPrompt: jobInput.system_prompt,
@@ -34972,6 +35185,8 @@ var init_runner = __esm({
             onProviderDispatch: () => {
               const dispatchedAtMs = now();
               providerDispatchedAt ??= isoAt(dispatchedAtMs);
+              clearProviderDispatchWatchdog();
+              options.onAttemptStage?.("provider_dispatched");
               if (providerDispatchNotAfterMs === void 0) return;
               providerDispatchFreshnessRemainingMs = Math.max(
                 0,
@@ -34984,8 +35199,49 @@ var init_runner = __esm({
                 start_round_trip_ms: startRoundTripMs
               });
             },
+            onTerminalDispatchOutcome: (outcome) => {
+              if (terminalDispatchOutcomeObserved) return;
+              terminalDispatchOutcomeObserved = true;
+              resolveTerminalDispatchOutcome(outcome);
+            },
             signal: attemptAbort.signal
           });
+          adapterResult = await Promise.race([
+            adapterAttempt,
+            providerDispatchWatchdogSignal.then(async () => {
+              const classified = await Promise.race([
+                adapterAttempt.then(
+                  (result2) => ({ kind: "result", result: result2 }),
+                  (error48) => ({ kind: "error", error: error48 })
+                ),
+                terminalDispatchOutcomeSignal.then((outcome) => ({
+                  kind: "dispatch_outcome",
+                  outcome
+                })),
+                options.sleep(options.attemptHeartbeatMs).then(() => ({
+                  kind: "unsettled"
+                }))
+              ]);
+              if (classified.kind === "result") return classified.result;
+              if (classified.kind === "error") throw classified.error;
+              if (classified.kind === "dispatch_outcome" && classified.outcome === "not_dispatched") {
+                throw new CodexAppServerError({
+                  message: "The Server account context expired before provider dispatch.",
+                  category: "timeout",
+                  code: "server_account_context_expired_before_provider_dispatch",
+                  retryable: false,
+                  dispatchOutcome: "not_dispatched"
+                });
+              }
+              throw new CodexAppServerError({
+                message: "Provider dispatch could not be excluded after the freshness watchdog expired.",
+                category: "timeout",
+                code: "provider_dispatch_outcome_unknown",
+                retryable: false,
+                dispatchOutcome: classified.kind === "dispatch_outcome" ? classified.outcome : "outcome_unknown"
+              });
+            })
+          ]);
           adapterResultReadyAt = isoAt(now());
           await persistAttempt({
             phase: "dispatched",
@@ -35170,8 +35426,15 @@ var init_runner = __esm({
               rateLimits: error48.rateLimits
             });
           }
-          const classified = classifyFailure(heartbeatFailure ?? error48, adapterResult);
-          const processExit = heartbeatFailure === void 0 && error48 instanceof CodexAppServerError && error48.code === "codex_process_closed" && error48.processExit?.expected_shutdown === false ? error48.processExit : null;
+          const effectiveError = providerDispatchWatchdogExpired && error48 instanceof CodexAppServerError && error48.dispatchOutcome === "not_dispatched" ? new CodexAppServerError({
+            message: "The Server account context expired before provider dispatch.",
+            category: "timeout",
+            code: "server_account_context_expired_before_provider_dispatch",
+            retryable: false,
+            dispatchOutcome: "not_dispatched"
+          }) : error48;
+          const classified = classifyFailure(heartbeatFailure ?? effectiveError, adapterResult);
+          const processExit = heartbeatFailure === void 0 && effectiveError instanceof CodexAppServerError && effectiveError.code === "codex_process_closed" && effectiveError.processExit?.expected_shutdown === false ? effectiveError.processExit : null;
           const heartbeatAmbiguous = ambiguousHeartbeatTransport(heartbeatFailure);
           const failure = heartbeatAmbiguous ? {
             ...classified,
@@ -35180,7 +35443,7 @@ var init_runner = __esm({
             effectiveModel: adapterResult?.effectiveModel ?? classified.effectiveModel,
             effectiveEffort: adapterResult?.effectiveReasoningEffort ?? classified.effectiveEffort
           } : classified;
-          const dispatchOutcome = heartbeatAmbiguous ? "outcome_unknown" : error48 instanceof CodexAppServerError ? error48.dispatchOutcome : failure.dispatchOutcome;
+          const dispatchOutcome = heartbeatAmbiguous ? "outcome_unknown" : effectiveError instanceof CodexAppServerError ? effectiveError.dispatchOutcome : failure.dispatchOutcome;
           await persistAttempt({
             phase: dispatchOutcome === "not_dispatched" ? "started" : "dispatched",
             dispatch_outcome: dispatchOutcome
@@ -35221,7 +35484,7 @@ var init_runner = __esm({
               adapter_request_id: canReportEffective ? adapterResult?.adapterRequestId ?? null : null,
               adapter_response_id: canReportEffective ? adapterResult?.adapterResponseId ?? null : null
             },
-            usage: adapterResult ? reportedUsage(adapterResult, usageSource) : error48 instanceof CodexAppServerError && error48.usage ? reportedTokenUsage(error48.usage, usageSource) : null,
+            usage: adapterResult ? reportedUsage(adapterResult, usageSource) : effectiveError instanceof CodexAppServerError && effectiveError.usage ? reportedTokenUsage(effectiveError.usage, usageSource) : null,
             failure_category: failure.category,
             failure_code: failure.code,
             retryable: failure.retryable,
@@ -35271,6 +35534,7 @@ var init_runner = __esm({
           });
           return "failed";
         } finally {
+          clearProviderDispatchWatchdog();
           signal.removeEventListener("abort", relayAbort);
           await stopHeartbeat();
         }
@@ -42281,7 +42545,7 @@ var init_network_debug = __esm({
 });
 
 // lib/runtime/hyperliquid-account-state-adapter.ts
-var unsupportedUserActiveAssetCache, MAX_UNSUPPORTED_USER_ACTIVE_ASSET_CACHE_KEYS, UNSUPPORTED_USER_ACTIVE_ASSET_STORAGE_KEY, USER_FILLS_CACHE_STORAGE_PREFIX, ACCOUNT_STATE_CACHE_STORAGE_PREFIX, INFO_RATE_LIMIT_COOLDOWN_STORAGE_PREFIX, INFO_RATE_LIMIT_COOLDOWN_MIN_MS, INFO_RATE_LIMIT_COOLDOWN_MAX_MS, browserUserFillsCache, browserUserFillsInFlight, HYPERLIQUID_USER_FILLS_PROVIDER_PAGE_CAP, browserAccountStateCache, browserAccountStateInFlight, browserInfoRateLimitCooldowns, UNSUPPORTED_USER_ACTIVE_ASSET_DETAIL_PATTERNS, unsupportedUserActiveAssetCacheHydrated, hydrateUnsupportedUserActiveAssetCache, persistUnsupportedUserActiveAssetCache, toPositiveFinite, toFinite, firstFiniteNumber, parseFundingUsdcFromInfoPosition, buildActiveAssetCacheKey, buildUserFillsCacheKey, buildUserFillsStorageKey, buildAccountStateCacheKey, buildAccountStateStorageKey, normalizeInfoRateLimitApiUrl, normalizeInfoRequestType, buildInfoRateLimitCooldownKey, buildInfoRateLimitCooldownStorageKey, readInfoRateLimitCooldownUntilMs, hasActiveInfoRateLimitCooldown, writeInfoRateLimitCooldown, extractInfoRequestTypeFromRateLimitError, recordInfoRateLimitCooldownFromError, requireNonNegativeConfigSeconds, requireAccountStateCacheConfig, requireUserFillsCacheConfig, normalizeFillSymbol, buildSymbolFilter, filterFillsBySymbols, readBrowserUserFillsCache, writeBrowserUserFillsCache, cloneBrowserAccountStateResult, readBrowserAccountStateCache, writeBrowserAccountStateCache, isRateLimitError, createAbortError, waitForSharedBrowserRequest, waitForSharedBrowserUserFills, getBrowserActiveAssetTypeCandidates, normalizeHyperliquidErrorDetail, isUnsupportedUserActiveAssetError, rememberUnsupportedUserActiveAssetKey, parseInfoPositions, requireFinitePromptMetric, requirePromptClearinghouseState, requirePromptSpotState, normalizePerpDexName, listConfiguredPerpDexs, listPerpDexsForAccountState, prefixHip3PositionCoins, aggregateClearinghouseResponses, normalizeBrowserFillToTradeHistory, isPerpFill, fetchHyperliquidInfoPayload, requireHyperliquidApiUrl, requireWalletAddress, parseInfoPositionSnapshot, fetchBrowserAccountState, fetchBrowserAccountStateUncached, fetchBrowserUserFills, fetchBrowserPositionSnapshot;
+var unsupportedUserActiveAssetCache, MAX_UNSUPPORTED_USER_ACTIVE_ASSET_CACHE_KEYS, UNSUPPORTED_USER_ACTIVE_ASSET_STORAGE_KEY, USER_FILLS_CACHE_STORAGE_PREFIX, ACCOUNT_STATE_CACHE_STORAGE_PREFIX, INFO_RATE_LIMIT_COOLDOWN_STORAGE_PREFIX, INFO_RATE_LIMIT_COOLDOWN_MIN_MS, INFO_RATE_LIMIT_COOLDOWN_MAX_MS, browserUserFillsCache, browserUserFillsInFlight, HYPERLIQUID_USER_FILLS_PROVIDER_PAGE_CAP, browserAccountStateCache, browserAccountStateInFlight, browserInfoRateLimitCooldowns, UNSUPPORTED_USER_ACTIVE_ASSET_DETAIL_PATTERNS, unsupportedUserActiveAssetCacheHydrated, hydrateUnsupportedUserActiveAssetCache, persistUnsupportedUserActiveAssetCache, toPositiveFinite, toFinite, firstFiniteNumber, parseFundingUsdcFromInfoPosition, buildActiveAssetCacheKey, buildUserFillsCacheKey, buildUserFillsStorageKey, buildAccountStateCacheKey, buildAccountStateStorageKey, normalizeInfoRateLimitApiUrl, normalizeInfoRequestType, buildInfoRateLimitCooldownKey, buildInfoRateLimitCooldownStorageKey, readInfoRateLimitCooldownUntilMs, hasActiveInfoRateLimitCooldown, writeInfoRateLimitCooldown, extractInfoRequestTypeFromRateLimitError, recordInfoRateLimitCooldownFromError, requireNonNegativeConfigSeconds, requireAccountStateCacheConfig, requireUserFillsCacheConfig, normalizeFillSymbol, buildSymbolFilter, filterFillsBySymbols, readBrowserUserFillsCache, writeBrowserUserFillsCache, cloneBrowserAccountStateResult, withAccountStateEvidence, readBrowserAccountStateCache, writeBrowserAccountStateCache, isRateLimitError, createAbortError, waitForSharedBrowserRequest, waitForSharedBrowserUserFills, getBrowserActiveAssetTypeCandidates, normalizeHyperliquidErrorDetail, isUnsupportedUserActiveAssetError, rememberUnsupportedUserActiveAssetKey, parseInfoPositions, requireFinitePromptMetric, requirePromptClearinghouseState, requirePromptSpotState, normalizePerpDexName, listConfiguredPerpDexs, listPerpDexsForAccountState, prefixHip3PositionCoins, aggregateClearinghouseResponses, normalizeBrowserFillToTradeHistory, isPerpFill, fetchHyperliquidInfoPayload, requireHyperliquidApiUrl, requireWalletAddress, parseInfoPositionSnapshot, fetchBrowserAccountState, fetchBrowserAccountStateUncached, fetchBrowserUserFills, fetchBrowserPositionSnapshot;
 var init_hyperliquid_account_state_adapter = __esm({
   "lib/runtime/hyperliquid-account-state-adapter.ts"() {
     "use strict";
@@ -42621,12 +42885,26 @@ var init_hyperliquid_account_state_adapter = __esm({
       }
     };
     cloneBrowserAccountStateResult = (result2) => ({
+      ...result2.evidence ? { evidence: { ...result2.evidence } } : {},
       accountSummary: { ...result2.accountSummary },
       availableToTrade: { ...result2.availableToTrade },
       positions: result2.positions.map((position) => ({ ...position })),
       ...result2.takerRate == null ? {} : { takerRate: result2.takerRate },
       ...result2.promptRescueEvidence == null ? {} : { promptRescueEvidence: { ...result2.promptRescueEvidence } }
     });
+    withAccountStateEvidence = (result2, source, fetchedAtMs, freshnessLimitMs) => {
+      const observedAtMs = Date.now();
+      return {
+        ...cloneBrowserAccountStateResult(result2),
+        evidence: {
+          source,
+          fetchedAtMs,
+          observedAtMs,
+          cacheAgeMs: Math.max(0, observedAtMs - fetchedAtMs),
+          freshnessLimitMs
+        }
+      };
+    };
     readBrowserAccountStateCache = (cacheKey) => {
       const memoryEntry = browserAccountStateCache.get(cacheKey);
       if (memoryEntry) {
@@ -43105,7 +43383,7 @@ var init_hyperliquid_account_state_adapter = __esm({
       const now = Date.now();
       const cached2 = readBrowserAccountStateCache(cacheKey);
       if (!input.forceRefresh && cached2 && now - cached2.fetchedAtMs <= ttlMs) {
-        return cloneBrowserAccountStateResult(cached2.result);
+        return withAccountStateEvidence(cached2.result, "cache", cached2.fetchedAtMs, ttlMs);
       }
       if (!input.forceRefresh && cached2 && now - cached2.fetchedAtMs <= staleIf429MaxAgeMs && hasActiveInfoRateLimitCooldown(apiUrl, [
         "clearinghouseState",
@@ -43114,7 +43392,7 @@ var init_hyperliquid_account_state_adapter = __esm({
         ...includeExactAccountMode ? ["userAbstraction", "userDexAbstraction"] : [],
         ...includeActiveAssetData ? activeAssetRequestTypes : []
       ], now)) {
-        return cloneBrowserAccountStateResult(cached2.result);
+        return withAccountStateEvidence(cached2.result, "stale_if_429", cached2.fetchedAtMs, staleIf429MaxAgeMs);
       }
       let inFlight = input.forceRefresh ? void 0 : browserAccountStateInFlight.get(cacheKey);
       if (!inFlight) {
@@ -43130,11 +43408,9 @@ var init_hyperliquid_account_state_adapter = __esm({
           dexNames,
           staleIf429MaxAgeMs
         }).then((result2) => {
-          writeBrowserAccountStateCache(cacheKey, {
-            fetchedAtMs: Date.now(),
-            result: result2
-          });
-          return cloneBrowserAccountStateResult(result2);
+          const fetchedAtMs = Date.now();
+          writeBrowserAccountStateCache(cacheKey, { fetchedAtMs, result: result2 });
+          return withAccountStateEvidence(result2, "live", fetchedAtMs, null);
         }).finally(() => {
           if (!input.forceRefresh) {
             browserAccountStateInFlight.delete(cacheKey);
@@ -43154,7 +43430,7 @@ var init_hyperliquid_account_state_adapter = __esm({
         recordInfoRateLimitCooldownFromError(apiUrl, error48, staleIf429MaxAgeMs);
         const staleCache = readBrowserAccountStateCache(cacheKey);
         if (!input.forceRefresh && isRateLimitError(error48) && staleCache && Date.now() - staleCache.fetchedAtMs <= staleIf429MaxAgeMs) {
-          return cloneBrowserAccountStateResult(staleCache.result);
+          return withAccountStateEvidence(staleCache.result, "stale_if_429", staleCache.fetchedAtMs, staleIf429MaxAgeMs);
         }
         throw error48;
       }
@@ -43405,7 +43681,7 @@ var init_hyperliquid_account_state_adapter = __esm({
           }
         };
       }
-      if (cached2 && now - cached2.fetchedAtMs <= staleIf429MaxAgeMs && hasActiveInfoRateLimitCooldown(apiUrl, ["userFills"], now)) {
+      if (!input.forceRefresh && cached2 && now - cached2.fetchedAtMs <= staleIf429MaxAgeMs && hasActiveInfoRateLimitCooldown(apiUrl, ["userFills"], now)) {
         const scopedFills = filterFillsBySymbols(cached2.rawFills, input.symbols);
         const tradeHistory2 = scopedFills.map(normalizeBrowserFillToTradeHistory).filter((fill) => fill !== null);
         return {
@@ -43465,7 +43741,7 @@ var init_hyperliquid_account_state_adapter = __esm({
       } catch (error48) {
         recordInfoRateLimitCooldownFromError(apiUrl, error48, staleIf429MaxAgeMs);
         const staleCache = readBrowserUserFillsCache(cacheKey);
-        if (isRateLimitError(error48)) {
+        if (isRateLimitError(error48) && !input.forceRefresh) {
           evidenceSource = "stale_if_429";
           rawWalletFills = staleCache && Date.now() - staleCache.fetchedAtMs <= staleIf429MaxAgeMs ? staleCache.rawFills : [];
           providerRowCount = staleCache?.providerRowCount ?? 0;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vtxmacro/cli",
-  "version": "2026.9.8",
+  "version": "2026.9.10",
   "description": "VTX Macro CLI, MCP server, and durable external inference host.",
   "type": "module",
   "license": "UNLICENSED",