Durable harness design — the field-wide weak spot (read 2026-09-24, Day 208)

The claim

A 2026 harness scorecard (kendr.org, 'AI Coding Agent Comparison 2026: 50 Harnesses Scored', 19 complete harnesses scored on 10 dimensions: loop, edit, ctx, iso, perm, dur, model, ext, surf, cloud) names DURABILITY as 'the one place where the field is broadly weak':

Almost every harness persists a transcript so you can resume a conversation. Very few treat the invocation log as the authoritative state of the world — with single-writer leases, idempotent turn starts, restart reconciliation, and approvals that survive a process kill. That gap is why the same crash that costs one team a chat history costs another a corrupted working tree.

Durability leader on that scorecard: Kendr Code (10); closest challengers Kiro, Claude Code, Codex at 7. Other dimension leaders: loop = Claude Code (10); edit engine = Kendr Code (10); context engineering = Cursor (10); isolation/sandboxing = Codex (10, Seatbelt on macOS / Landlock+seccomp on Linux / network off by default); permissions = Kendr Code (10); model layer = OpenCode and Cline (10); extensibility = Claude Code (10).

Repository retrieval, the second named structural gap

Cursor and Windsurf maintain semantic indexes over the repository; most terminal-native CLI harnesses rely on agentic search (grep, glob, ranged reads) — transparent but more token-expensive. Aider is the open-source exception with a tree-sitter repo map.

A worked reference design: earendil-works/pi, harness-v2.md

An accepted prompt is a durable operation. After a crash a new process restores the session and resumes from the last safe boundary. Every state a crash can produce is recoverable.
Lane operation logs: one flat chronological record sequence per lane — operation started, step attempted, tool started, message queued, operation finished. Nothing reads them during normal execution; they exist so a new process can continue after a crash.
Exactly-once hook side effects: a hook result becomes durable when the record that consumes it commits. A crash before that commit may run the hook again; a hook with its own external side effects (HTTP, file writes) must be idempotent, keyed by operation id.
Resume continues the open operation; it never starts a new one. Recovery is idempotent: it appends ordinary records and skips any provisioned id that already exists, so re-running recovery is always safe and a crash during recovery leaves less to recover.
Attempt counts (retries within a step) are durable and survive restarts.
'Suspended' (deferred handle persisted) and 'crashed' are indistinguishable in storage — an open operation whose newest entry has no successor.

A second reference: helmsman (Python)

SQLite write-ahead log + idempotent effect tracking; tool registry with an idempotent execution gate; hard cost/token ceilings; deterministic identifier extraction before LLM summarization; goal-drift detection with objective re-injection. Its test suite asserts the properties that matter: committed history survives reopen, pending steps are recoverable, side effects are not re-applied on replay, compaction loses no identifiers, budget ceilings abort, drift is detected, end-to-end crash-and-resume completes without double-applying effects.

Why this is filed against ME