@jigging/jig 0.1.0-alpha.10 → 0.1.0-alpha.11

package/libexec/installed-cli.js

@@ -6995,7 +6995,7 @@ var require_x509_transport_state = __commonJS((exports, module) => {
 });
 
 // src/installed-cli.ts
-import { realpath as realpath13 } from "fs/promises";
+import { realpath as realpath14 } from "fs/promises";
 import { dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
@@ -9289,10 +9289,20 @@ function normalizeFlowSlots(value) {
   const output = Object.create(null);
   for (const name of Object.keys(input).sort(compareUtf8)) {
     validateLocalName(name, "slot name");
-    output[name] = normalizeProjectPath(input[name], `slot ${name}`);
+    const target = parseRunTargetSelector(input[name], `slot ${name}`);
+    output[name] = target.kind === "flow" ? `flow:${target.path}` : `binding:${target.id}`;
   }
   return Object.freeze(output);
 }
+function parseRunTargetSelector(value, label) {
+  if (typeof value !== "string")
+    throw new TypeError(`${label} must be a target selector`);
+  if (value.startsWith("flow:"))
+    return flowRef(normalizeProjectPath(value.slice(5), label));
+  if (value.startsWith("binding:"))
+    return bindingRef(validateLocalName(value.slice(8), label));
+  throw new TypeError(`${label} must select flow:<path> or binding:<id>`);
+}
 function normalizeSource(value, field, canonical) {
   if (value === undefined)
     throw new TypeError(`${field} cannot be undefined`);
@@ -10039,7 +10049,8 @@ function renderFailure(error, runtime) {
   }
   if (error instanceof ProjectAdministrationError) {
     const projected = projectError(error.code);
-    runtime.writeError(error.diagnostic !== undefined ? renderProjectDiagnostic(error, projected.message) : renderDiagnostic(error.code, projected.message));
+    const hint = error.diagnostic?.code === "PROJECT_AGENT_UNAVAILABLE" ? "configure the host Agent before review; check credentials, model, and selected client" : error.diagnostic?.code === "PACKAGE_BUN_PREPARATION_FAILED" ? "locked dependencies could not be prepared; check registry access and package availability" : undefined;
+    runtime.writeError(error.diagnostic !== undefined ? renderProjectDiagnostic(error, hint ?? projected.message) : renderDiagnostic(error.code, projected.message));
     return projected.exitCode;
   }
   if (error instanceof RootAdministrationError) {
@@ -10113,7 +10124,7 @@ if (false) {}
 
 // src/internal/installed-bun-support.ts
 import { constants } from "fs";
-import { access, lstat, realpath } from "fs/promises";
+import { access, lstat, realpath as realpath2 } from "fs/promises";
 import { dirname, join as join2 } from "path";
 
 // src/internal/identity.ts
@@ -10136,6 +10147,29 @@ async function privateFileDigest(path) {
   return `sha256:${hash.digest("hex")}`;
 }
 
+// src/internal/linux-host-paths.ts
+import { realpath } from "fs/promises";
+function privateLinuxHostToolCandidates(name) {
+  return [`/usr/bin/${name}`, `/bin/${name}`, `/run/current-system/sw/bin/${name}`];
+}
+async function resolvePrivateLinuxHostPath(candidates, resolve2 = realpath) {
+  for (const path of candidates) {
+    try {
+      return await resolve2(path);
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+  }
+  throw new Error("the required system-owned host file is unavailable");
+}
+function resolvePrivateLinuxHostLoader(resolve2 = realpath) {
+  return resolvePrivateLinuxHostPath([
+    "/run/current-system/sw/share/nix-ld/lib/ld.so",
+    "/lib64/ld-linux-x86-64.so.2"
+  ], resolve2);
+}
+
 // src/internal/installed-bun-support.ts
 var ELF_INTERPRETER = "/lib64/ld-linux-x86-64.so.2";
 var LIBRARIES = Object.freeze([
@@ -10185,7 +10219,7 @@ async function openPrivateInstalledBunSupport(location) {
   })));
   const preparationWorkerPath = await exactRegularFile(join2(releaseRoot, "libexec", "preparation", "bun-native-preparation-worker.js"), false, "installed Bun preparation worker");
   const agentWorkerPath = await exactRegularFile(join2(releaseRoot, "libexec", "agent", "openai-agent-worker.js"), false, "installed Agent provider worker");
-  const loaderPath = await exactRegularFile(ELF_INTERPRETER, true, "supported-host ELF interpreter");
+  const loaderPath = await exactRegularFile(await resolvePrivateLinuxHostLoader(), true, "supported-host ELF interpreter");
   const hostLibraryDirectory = dirname(loaderPath);
   const libraries = await Promise.all(LIBRARIES.map(async (name) => Object.freeze({
     name,
@@ -10296,7 +10330,7 @@ async function resolveInstalledBun(releaseRoot) {
   throw new Error("the exact installed Bun dependency is unavailable");
 }
 async function exactRegularFile(path, executable, label) {
-  const resolved = await realpath(path);
+  const resolved = await realpath2(path);
   const information = await lstat(resolved);
   if (!information.isFile() || information.isSymbolicLink() || executable && (information.mode & 73) === 0) {
     throw new Error(`${label} is unavailable`);
@@ -10306,7 +10340,7 @@ async function exactRegularFile(path, executable, label) {
   return resolved;
 }
 async function exactDirectory(path, label) {
-  const resolved = await realpath(path);
+  const resolved = await realpath2(path);
   const information = await lstat(resolved);
   if (!information.isDirectory() || information.isSymbolicLink()) {
     throw new Error(`${label} is unavailable`);
@@ -10325,7 +10359,7 @@ import {
   open,
   readFile as readFile2,
   readdir as readdir2,
-  realpath as realpath3,
+  realpath as realpath4,
   rm,
   rmdir as rmdir2,
   statfs as statfs2,
@@ -10344,14 +10378,13 @@ import {
   access as access2,
   readFile,
   readdir,
-  realpath as realpath2,
+  realpath as realpath3,
   stat,
   statfs
 } from "fs/promises";
 import { posix } from "path";
 var CGROUP_ROOT = "/sys/fs/cgroup";
 var CGROUP2_SUPER_MAGIC = 0x6367_7270n;
-var BUBBLEWRAP_PATH = "/usr/bin/bwrap";
 var MAX_PROCESS_OUTPUT_BYTES = 16 * 1024;
 var REQUIRED_CONTROLLERS = Object.freeze(["cpu", "memory", "pids"]);
 var REQUIRED_BUBBLEWRAP_FEATURES = Object.freeze([
@@ -10444,7 +10477,11 @@ async function observe(dependencies, retained, activeRunCgroups = Object.freeze(
   }
   await dependencies.requireAccess(`${currentCgroup}/cgroup.events`, constants2.R_OK);
   await dependencies.requireAccess(`${currentCgroup}/cgroup.kill`, constants2.W_OK);
-  const bubblewrapPath = await dependencies.resolve(BUBBLEWRAP_PATH);
+  const selectedPath = dependencies.bubblewrapPath?.();
+  if (selectedPath !== undefined && (!posix.isAbsolute(selectedPath) || selectedPath.includes("\x00"))) {
+    throw new Error("JIG_BWRAP_PATH must be an absolute executable path");
+  }
+  const bubblewrapPath = await resolvePrivateLinuxHostPath(selectedPath === undefined ? privateLinuxHostToolCandidates("bwrap") : [selectedPath], dependencies.resolve);
   if (!bubblewrapPath.startsWith("/") || bubblewrapPath.includes("\x00")) {
     throw new Error("Bubblewrap did not resolve to an absolute path");
   }
@@ -10541,13 +10578,14 @@ function bubblewrapFeatureProbe(path) {
   return Object.freeze(arguments_);
 }
 var systemDependencies = Object.freeze({
+  bubblewrapPath: () => process.env.JIG_BWRAP_PATH,
   uid: () => process.getuid?.(),
   gid: () => process.getgid?.(),
   readText: (path) => readFile(path, "utf8"),
   listDirectories: async (path) => (await readdir(path, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name),
   information: (path) => stat(path),
   filesystemType: async (path) => (await statfs(path)).type,
-  resolve: (path) => realpath2(path),
+  resolve: (path) => realpath3(path),
   requireAccess: (path, mode) => access2(path, mode),
   execute: runExecutable
 });
@@ -10935,7 +10973,7 @@ function requirePrivateLinuxCgroupBackend(value) {
 async function planPrivateLinuxOwnerStateAllocation(location) {
   if (!OWNER_NAME.test(location.name))
     throw new TypeError("Linux owner-state name is invalid");
-  const parent = await realpath3(requireAbsolute(location.parent, "Linux owner-state parent"));
+  const parent = await realpath4(requireAbsolute(location.parent, "Linux owner-state parent"));
   if (parent !== location.parent)
     throw new TypeError("Linux owner-state parent must be canonical");
   const information = await lstat2(parent, { bigint: true });
@@ -11301,9 +11339,9 @@ async function observeInitialMechanism(options) {
 }
 async function observeMechanismWithAuthority(options, authority) {
   const [bunPath, bunHostLibraryPath, supervisorPath] = await Promise.all([
-    realpath3(options.bunPath),
-    realpath3(options.bunHostLibraryPath),
-    realpath3(options.supervisorPath)
+    realpath4(options.bunPath),
+    realpath4(options.bunHostLibraryPath),
+    realpath4(options.supervisorPath)
   ]);
   if (bunPath !== options.bunPath || bunHostLibraryPath !== options.bunHostLibraryPath || supervisorPath !== options.supervisorPath) {
     throw new Error("rootless Linux support paths must be canonical");
@@ -11357,7 +11395,7 @@ async function observeMechanismWithAuthority(options, authority) {
 }
 async function observeLinuxBootId() {
   const [resolved, information, filesystem, text] = await Promise.all([
-    realpath3(BOOT_ID_PATH),
+    realpath4(BOOT_ID_PATH),
     lstat2(BOOT_ID_PATH),
     statfs2(BOOT_ID_PATH),
     readFile2(BOOT_ID_PATH, "utf8")
@@ -11434,7 +11472,7 @@ async function sealPlan(plan) {
   const snapshot = snapshotPlan(plan);
   const mounts = [];
   for (const mount of snapshot.readOnlyMounts) {
-    const source = await realpath3(mount.source);
+    const source = await realpath4(mount.source);
     const [information, filesystem] = await Promise.all([
       lstat2(source, { bigint: true }),
       statfs2(source)
@@ -13633,13 +13671,13 @@ function requireApi(value) {
 }
 
 // src/internal/codex-agent-provider.ts
-import { lstat as lstat4, readFile as readFile3, realpath as realpath5 } from "fs/promises";
+import { lstat as lstat4, readFile as readFile3, realpath as realpath6 } from "fs/promises";
 import { homedir } from "os";
 import { join as join4 } from "path";
 
 // src/internal/acp-agent-provider.ts
 import { constants as constants3 } from "fs";
-import { access as access3, lstat as lstat3, realpath as realpath4 } from "fs/promises";
+import { access as access3, lstat as lstat3, realpath as realpath5 } from "fs/promises";
 var IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,255}$/;
 var SECRET_ENVIRONMENT_NAME = /(AUTH|CREDENTIAL|KEY|SECRET|TOKEN)/i;
 var STARTUP_INPUT_BYTES = 64 * 1024;
@@ -13850,7 +13888,7 @@ function requireSandboxPath(value) {
   }
 }
 async function exactFile(path, executable, label) {
-  const resolved = await realpath4(path);
+  const resolved = await realpath5(path);
   const information = await lstat3(resolved);
   if (!information.isFile() || information.isSymbolicLink() || executable && (information.mode & 73) === 0) {
     throw new Error(`${label} is unavailable`);
@@ -14111,7 +14149,7 @@ async function nativeBubblewrapFor(executablePath) {
   return path;
 }
 async function ordinaryFile(path, label) {
-  const exact = await realpath5(path);
+  const exact = await realpath6(path);
   const information = await lstat4(exact);
   if (!information.isFile() || information.isSymbolicLink()) {
     throw new Error(`${label} is invalid`);
@@ -14166,7 +14204,7 @@ function requireSubscriptionCredential(value) {
   return bytes;
 }
 async function exactFile2(path, label) {
-  const exact = await realpath5(path);
+  const exact = await realpath6(path);
   const information = await lstat4(exact);
   if (exact !== path || !information.isFile() || information.isSymbolicLink()) {
     throw new Error(`${label} is invalid`);
@@ -14223,7 +14261,7 @@ function requireBaseURL(value) {
 }
 
 // src/internal/claude-agent-provider.ts
-import { lstat as lstat5, realpath as realpath6 } from "fs/promises";
+import { lstat as lstat5, realpath as realpath7 } from "fs/promises";
 import { dirname as dirname3, join as join5 } from "path";
 var CLAUDE_CLIENT = "anthropic-claude-code";
 var DEFAULT_MODEL = "default";
@@ -14232,7 +14270,6 @@ var SANDBOX_ADAPTER_PATH2 = "/agent/claude-agent-acp.js";
 var SANDBOX_EXECUTABLE_PATH2 = "/agent/claude";
 var HOST_CERTIFICATES_PATH2 = "/etc/ssl/certs/ca-certificates.crt";
 var SANDBOX_CERTIFICATES_PATH2 = "/etc/ssl/certs/ca-certificates.crt";
-var HOST_ELF_INTERPRETER_PATH = "/lib64/ld-linux-x86-64.so.2";
 var SANDBOX_RUNTIME_LIBRARY_PATH = "/jig-runtime/lib/librt.so.1";
 var MAX_TOKEN_BYTES = 16 * 1024;
 var MAX_BASE_URL_CHARACTERS3 = 4096;
@@ -14248,7 +14285,7 @@ async function openPrivateClaudeAgentProvider(releaseRoot, environment = process
     adapterPath: join5(releaseRoot, "libexec", "agent", "claude-agent-acp.js"),
     executablePath,
     certificatesPath: await ordinaryFile2(HOST_CERTIFICATES_PATH2, "host certificate bundle"),
-    runtimeLibraryPath: await ordinaryFile2(join5(dirname3(await realpath6(HOST_ELF_INTERPRETER_PATH)), "librt.so.1"), "Claude runtime library")
+    runtimeLibraryPath: await ordinaryFile2(join5(dirname3(await resolvePrivateLinuxHostLoader()), "librt.so.1"), "Claude runtime library")
   });
   const apiKey = environment.ANTHROPIC_API_KEY;
   const authToken = environment.ANTHROPIC_AUTH_TOKEN;
@@ -14408,7 +14445,7 @@ function frameStartupInput2(value) {
   return framed;
 }
 async function ordinaryFile2(path, label) {
-  const exact = await realpath6(path);
+  const exact = await realpath7(path);
   const information = await lstat5(exact);
   if (!information.isFile() || information.isSymbolicLink()) {
     throw new Error(`${label} is invalid`);
@@ -14418,7 +14455,7 @@ async function ordinaryFile2(path, label) {
 
 // src/internal/pi-agent-provider.ts
 import { constants as constants4 } from "fs";
-import { access as access4, lstat as lstat6, readFile as readFile4, realpath as realpath7 } from "fs/promises";
+import { access as access4, lstat as lstat6, readFile as readFile4, realpath as realpath8 } from "fs/promises";
 import { homedir as homedir2 } from "os";
 import { dirname as dirname4, join as join6, resolve as resolve2 } from "path";
 var PI_CLIENT = "pi";
@@ -14721,7 +14758,7 @@ async function executableFile(path, label) {
   return exact;
 }
 async function ordinaryFile3(path, label) {
-  const exact = await realpath7(path);
+  const exact = await realpath8(path);
   const information = await lstat6(exact);
   if (!information.isFile() || information.isSymbolicLink()) {
     throw new Error(`${label} is invalid`);
@@ -14742,7 +14779,7 @@ async function piManifestFile(path) {
   return exact;
 }
 async function readCredentialFile(path) {
-  const exact = await realpath7(path);
+  const exact = await realpath8(path);
   const information = await lstat6(exact);
   const uid = process.getuid?.();
   if (!information.isFile() || information.isSymbolicLink() || information.nlink !== 1 || information.size <= 0 || information.size > MAX_CREDENTIAL_BYTES2 || uid === undefined || information.uid !== uid || (information.mode & 63) !== 0) {
@@ -14792,7 +14829,7 @@ import {
   mkdir as mkdir3,
   readFile as readFile5,
   readdir as readdir3,
-  realpath as realpath8,
+  realpath as realpath9,
   stat as stat3,
   statfs as statfs3,
   writeFile as writeFile2
@@ -14802,14 +14839,8 @@ import { isAbsolute, posix as posix3 } from "path";
 var CGROUP_ROOT2 = "/sys/fs/cgroup";
 var CGROUP2_SUPER_MAGIC3 = 0x6367_7270n;
 var CHILD_NAME = "jig";
-var MANAGER_CANDIDATES = Object.freeze([
-  "/usr/bin/systemd-run",
-  "/bin/systemd-run"
-]);
-var CONTROL_CANDIDATES = Object.freeze([
-  "/usr/bin/systemctl",
-  "/bin/systemctl"
-]);
+var MANAGER_CANDIDATES = privateLinuxHostToolCandidates("systemd-run");
+var CONTROL_CANDIDATES = privateLinuxHostToolCandidates("systemctl");
 var REQUIRED_CONTROLLERS2 = Object.freeze(["cpu", "memory", "pids"]);
 var UNIT = /^jig-[0-9a-f]{24}\.scope$/;
 var TOKEN2 = /^[0-9a-f]{64}$/;
@@ -14990,7 +15021,7 @@ function requireWords2(input, expected) {
 async function resolveManager() {
   for (const candidate of MANAGER_CANDIDATES) {
     try {
-      const resolved = await realpath8(candidate);
+      const resolved = await realpath9(candidate);
       const information = await stat3(resolved);
       if (isAbsolute(resolved) && information.isFile() && (information.mode & 73) !== 0 && (information.mode & 3072) === 0) {
         return resolved;
@@ -15114,7 +15145,7 @@ function waitForStartup(acknowledged, completion, timeoutMs) {
 async function resolveControl() {
   for (const candidate of CONTROL_CANDIDATES) {
     try {
-      const resolved = await realpath8(candidate);
+      const resolved = await realpath9(candidate);
       const information = await stat3(resolved);
       if (isAbsolute(resolved) && information.isFile() && (information.mode & 73) !== 0 && (information.mode & 3072) === 0) {
         return resolved;
@@ -15197,7 +15228,7 @@ async function observeControlGroup(controlPath, unit, environment, timeoutMs) {
         throw new Error("the user manager returned an invalid transient scope path");
       }
       const path = `${CGROUP_ROOT2}${relative}`;
-      if (await realpath8(path) !== path)
+      if (await realpath9(path) !== path)
         throw new Error("the transient scope path is not canonical");
       return path;
     }
@@ -15419,7 +15450,7 @@ var scopeDependencies = Object.freeze({
   listDirectories: async (path) => (await readdir3(path, { withFileTypes: true })).filter((entry) => entry.isDirectory()).map((entry) => entry.name),
   information: (path) => stat3(path),
   filesystemType: async (path) => (await statfs3(path)).type,
-  resolve: (path) => realpath8(path),
+  resolve: (path) => realpath9(path),
   requireAccess: (path, mode) => access5(path, mode),
   makeDirectory: (path) => mkdir3(path, { mode: 493 }),
   writeText: (path, value) => writeFile2(path, value)
@@ -17878,9 +17909,10 @@ function linkPackageProject(input, maximumActivationTargets) {
   if (maximumActivationTargets !== undefined && activationTargetCount > maximumActivationTargets) {
     invalid("PROJECT_ACTIVATION_TARGET_LIMIT", `project contains ${activationTargetCount} activation targets, exceeding the caller bound ${maximumActivationTargets}`);
   }
+  const bindingById = new Map(preparedBindings.map((binding) => [binding.id, binding]));
   const value = Object.freeze({
     flows: Object.freeze(flows.map((flow) => flow.value)),
-    bindings: Object.freeze(preparedBindings.map(linkBinding))
+    bindings: Object.freeze(preparedBindings.map((binding) => linkBinding(binding, flowByPath, bindingById)))
   });
   authenticPackageProjects.add(value);
   return value;
@@ -17987,14 +18019,13 @@ function prepareBindings(values, flowByPath, budget) {
       invalid("PROJECT_BINDING_ATTACHMENTS_UNSUPPORTED", `Binding ${id} selects a package that requires attachments, which the direct alpha does not project`, declarationPath, "/package");
     }
     validateSettings(definition.settings, flow.inspected, declarationPath);
-    validateFlowSlots(id, definition.package, definition.slots, flowByPath, declarationPath);
     return Object.freeze({ id, declarationPath, definition, flow });
   });
   bindings.sort((left, right) => compareProjectPaths(left.id, right.id));
   assertUniqueBindings(bindings);
   return Object.freeze(bindings);
 }
-function linkBinding(prepared) {
+function linkBinding(prepared, flowByPath, bindingById) {
   const { id, declarationPath, definition } = prepared;
   return Object.freeze({
     kind: "package",
@@ -18002,23 +18033,32 @@ function linkBinding(prepared) {
     declarationPath,
     packagePath: definition.package,
     settings: definition.settings,
-    slots: definition.slots
+    slots: linkFlowSlots(prepared, flowByPath, bindingById)
   });
 }
-function validateFlowSlots(bindingId, parentPath, slots, flowByPath, declarationPath) {
-  for (const [name, targetPath] of Object.entries(slots)) {
+function linkFlowSlots(binding, flowByPath, bindingById) {
+  const { id: bindingId, declarationPath, definition } = binding;
+  const slots = Object.create(null);
+  for (const [name, selector] of Object.entries(definition.slots)) {
     const pointer = `/slots/${pointerToken(name)}`;
-    const target = flowByPath.get(targetPath);
+    const identity2 = parseRunTargetSelector(selector, `slot ${name}`);
+    const childBinding = identity2.kind === "binding" ? bindingById.get(identity2.id) : undefined;
+    const target = identity2.kind === "flow" ? flowByPath.get(identity2.path) : childBinding?.flow;
     if (target === undefined) {
-      invalid("PROJECT_BINDING_SLOT_MISSING", `Binding ${bindingId} slot ${name} selects unknown Flow member ${targetPath}`, declarationPath, pointer);
+      invalid("PROJECT_BINDING_SLOT_MISSING", `Binding ${bindingId} slot ${name} selects unknown target ${selector}`, declarationPath, pointer);
     }
-    if (targetPath === parentPath) {
+    if (target.value.provenance.projectPath === definition.package) {
       invalid("PROJECT_BINDING_SLOT_RECURSIVE", `Binding ${bindingId} slot ${name} selects its own Flow package`, declarationPath, pointer);
     }
-    if (!target.value.directRun || Object.keys(target.value.uses).length !== 0) {
-      invalid("PROJECT_BINDING_SLOT_NOT_DIRECT", `Binding ${bindingId} slot ${name} must select a capability-free direct Flow package`, declarationPath, pointer);
+    if (identity2.kind === "flow" && !target.value.directRun) {
+      invalid("PROJECT_BINDING_SLOT_NOT_DIRECT", `Binding ${bindingId} slot ${name} must select a direct Flow target or configured Binding`, declarationPath, pointer);
+    }
+    if (childBinding !== undefined && Object.keys(childBinding.definition.slots).length !== 0) {
+      invalid("PROJECT_BINDING_SLOT_NOT_LEAF", `Binding ${bindingId} slot ${name} selects a Binding with child slots`, declarationPath, pointer);
     }
+    slots[name] = identity2;
   }
+  return Object.freeze(slots);
 }
 function pointerToken(value) {
   return value.replaceAll("~", "~0").replaceAll("/", "~1");
@@ -19963,7 +20003,20 @@ function normalizeRequestFlowSlots(value) {
   const output = Object.create(null);
   for (const name of Object.keys(input).sort()) {
     requireLocalName3(name, "activation Flow slot");
-    output[name] = normalizeProjectPath(input[name], `activation Flow slot ${name}`);
+    const target = exactRecord4(input[name], `activation Flow slot ${name}`);
+    if (target.kind === "flow") {
+      output[name] = Object.freeze({
+        kind: "flow",
+        path: normalizeProjectPath(exactObject(target, ["kind", "path"], `activation Flow slot ${name}`).path, `activation Flow slot ${name}`)
+      });
+    } else if (target.kind === "binding") {
+      output[name] = Object.freeze({
+        kind: "binding",
+        id: requireLocalName3(exactObject(target, ["kind", "id"], `activation Binding slot ${name}`).id, `activation Binding slot ${name}`)
+      });
+    } else {
+      throw new TypeError(`activation Flow slot ${name} must select a Flow or Binding target`);
+    }
   }
   return Object.freeze(output);
 }
@@ -20152,7 +20205,12 @@ function validateReferences(packages, bindings) {
     const selected = packages[binding.packagePath];
     if (selected === undefined)
       throw new TypeError(`Binding ${id} selects an unknown package`);
-    for (const [name, path] of Object.entries(binding.slots)) {
+    for (const [name, identity2] of Object.entries(binding.slots)) {
+      const childBinding = identity2.kind === "binding" ? bindings[identity2.id] : undefined;
+      const path = identity2.kind === "flow" ? identity2.path : childBinding?.packagePath;
+      if (path === undefined) {
+        throw new TypeError(`Binding ${id} slot ${name} selects an unknown Binding`);
+      }
       const target = packages[path];
       if (target === undefined) {
         throw new TypeError(`Binding ${id} slot ${name} selects an unknown package`);
@@ -20160,8 +20218,11 @@ function validateReferences(packages, bindings) {
       if (path === binding.packagePath) {
         throw new TypeError(`Binding ${id} slot ${name} selects its own package`);
       }
-      if (!target.directRun || Object.keys(target.uses).length !== 0) {
-        throw new TypeError(`Binding ${id} slot ${name} must select a capability-free direct Run package`);
+      if (identity2.kind === "flow" && !target.directRun) {
+        throw new TypeError(`Binding ${id} slot ${name} must select a direct Run package or configured Binding`);
+      }
+      if (childBinding !== undefined && Object.keys(childBinding.slots).length !== 0) {
+        throw new TypeError(`Binding ${id} slot ${name} selects a Binding with child slots`);
       }
     }
   }
@@ -20174,7 +20235,20 @@ function normalizeSlots(value, label) {
   const output = Object.create(null);
   for (const name of names.sort()) {
     localName(name, `${label} slot`);
-    output[name] = projectPath(input[name], `${label} slot ${name}`);
+    const target = object(input[name], `${label} slot ${name}`);
+    if (target.kind === "flow") {
+      output[name] = Object.freeze({
+        kind: "flow",
+        path: projectPath(exactObject2(target, ["kind", "path"], `${label} slot ${name}`).path, `${label} slot ${name}`)
+      });
+    } else if (target.kind === "binding") {
+      output[name] = Object.freeze({
+        kind: "binding",
+        id: localName(exactObject2(target, ["kind", "id"], `${label} slot ${name}`).id, `${label} slot ${name}`)
+      });
+    } else {
+      throw new TypeError(`${label} slot ${name} must select a Flow or Binding target`);
+    }
   }
   return Object.freeze(output);
 }
@@ -20280,6 +20354,9 @@ async function planPrivateBunDirectRun(input) {
     }
   }
   const capabilityUses = Object.values(request.capabilities);
+  if (capabilityUses.length > 0 && input.agentProvider === undefined) {
+    unavailable("PROJECT_AGENT_UNAVAILABLE", "the target requires a configured host Agent", `${request.packagePath}/FLOW.md`);
+  }
   const agentProvider = capabilityUses.length === 0 ? undefined : requirePrivateAgentProvider(input.agentProvider);
   if (capabilityUses.some(({ digest: digest3 }) => digest3 !== AGENT_RUN_CONTRACT_DIGEST) || capabilityUses.length > 1 || agentProvider !== undefined && agentProvider.contractDigest !== AGENT_RUN_CONTRACT_DIGEST) {
     throw new TypeError("private Bun recipe requires the exact supported Agent capability");
@@ -21347,7 +21424,7 @@ var CREATE_COORDINATOR_HEAD = "CREATE TABLE coordinator_head (singleton INTEGER
 var CREATE_ROOT_RUNS = "CREATE TABLE root_runs (run_id TEXT PRIMARY KEY, origin_digest TEXT NOT NULL UNIQUE, origin_bytes BLOB NOT NULL CHECK (length(origin_bytes) BETWEEN 1 AND 16777216), admission_digest TEXT NOT NULL REFERENCES admissions(admission_digest), candidate_revision INTEGER NOT NULL REFERENCES candidates(revision), coordinator_epoch INTEGER NOT NULL CHECK (coordinator_epoch BETWEEN 1 AND 9007199254740991), request_bytes BLOB NOT NULL CHECK (length(request_bytes) BETWEEN 1 AND 16777216)) STRICT";
 var CREATE_ROOT_SPAWN_INTENTS = "CREATE TABLE root_spawn_intents (run_id TEXT PRIMARY KEY REFERENCES root_runs(run_id), intent_digest TEXT NOT NULL UNIQUE, intent_bytes BLOB NOT NULL CHECK (length(intent_bytes) BETWEEN 1 AND 16777216)) STRICT";
 var CREATE_ROOT_EXECUTION_LIFECYCLES = "CREATE TABLE root_execution_lifecycles (run_id TEXT PRIMARY KEY REFERENCES root_spawn_intents(run_id), allocation_digest TEXT NOT NULL UNIQUE, allocation_bytes BLOB NOT NULL CHECK (length(allocation_bytes) BETWEEN 1 AND 16777216), plan_digest TEXT UNIQUE, plan_bytes BLOB, backing_digest TEXT UNIQUE, backing_bytes BLOB, sandbox_digest TEXT UNIQUE, sandbox_bytes BLOB, prepared_digest TEXT UNIQUE, prepared_bytes BLOB, provisional_digest TEXT UNIQUE, provisional_bytes BLOB, fence_digest TEXT UNIQUE, fence_bytes BLOB, release_digest TEXT UNIQUE, release_bytes BLOB, admitted_digest TEXT UNIQUE, admitted_bytes BLOB, CHECK ((plan_digest IS NULL) = (plan_bytes IS NULL)), CHECK ((backing_digest IS NULL) = (backing_bytes IS NULL)), CHECK ((sandbox_digest IS NULL) = (sandbox_bytes IS NULL)), CHECK ((prepared_digest IS NULL) = (prepared_bytes IS NULL)), CHECK ((provisional_digest IS NULL) = (provisional_bytes IS NULL)), CHECK ((fence_digest IS NULL) = (fence_bytes IS NULL)), CHECK ((release_digest IS NULL) = (release_bytes IS NULL)), CHECK ((admitted_digest IS NULL) = (admitted_bytes IS NULL)), CHECK (backing_digest IS NULL OR plan_digest IS NOT NULL), CHECK (sandbox_digest IS NULL OR backing_digest IS NOT NULL), CHECK (prepared_digest IS NULL OR sandbox_digest IS NOT NULL), CHECK (fence_digest IS NULL OR sandbox_digest IS NOT NULL), CHECK (admitted_digest IS NULL OR (provisional_digest IS NOT NULL AND release_digest IS NOT NULL))) STRICT";
-var CREATE_ROOT_CHILD_OWNERS = "CREATE TABLE root_child_owners (parent_run_id TEXT NOT NULL REFERENCES root_execution_lifecycles(run_id), operation_id TEXT NOT NULL, allocation_digest TEXT NOT NULL UNIQUE, allocation_bytes BLOB NOT NULL CHECK (length(allocation_bytes) BETWEEN 1 AND 16777216), sandbox_digest TEXT UNIQUE, sandbox_bytes BLOB, fence_digest TEXT UNIQUE, fence_bytes BLOB, cleanup_digest TEXT UNIQUE, cleanup_bytes BLOB, CHECK ((sandbox_digest IS NULL) = (sandbox_bytes IS NULL)), CHECK ((fence_digest IS NULL) = (fence_bytes IS NULL)), CHECK ((cleanup_digest IS NULL) = (cleanup_bytes IS NULL)), CHECK (fence_digest IS NULL OR sandbox_digest IS NOT NULL), CHECK (cleanup_digest IS NULL OR fence_digest IS NOT NULL), PRIMARY KEY (parent_run_id, operation_id)) STRICT";
+var CREATE_ROOT_CHILD_OWNERS = "CREATE TABLE root_child_owners (parent_run_id TEXT NOT NULL REFERENCES root_execution_lifecycles(run_id), scope_operation_id TEXT NOT NULL, operation_id TEXT NOT NULL, allocation_digest TEXT NOT NULL UNIQUE, allocation_bytes BLOB NOT NULL CHECK (length(allocation_bytes) BETWEEN 1 AND 16777216), sandbox_digest TEXT UNIQUE, sandbox_bytes BLOB, fence_digest TEXT UNIQUE, fence_bytes BLOB, cleanup_digest TEXT UNIQUE, cleanup_bytes BLOB, CHECK ((sandbox_digest IS NULL) = (sandbox_bytes IS NULL)), CHECK ((fence_digest IS NULL) = (fence_bytes IS NULL)), CHECK ((cleanup_digest IS NULL) = (cleanup_bytes IS NULL)), CHECK (fence_digest IS NULL OR sandbox_digest IS NOT NULL), CHECK (cleanup_digest IS NULL OR fence_digest IS NOT NULL), PRIMARY KEY (parent_run_id, scope_operation_id, operation_id)) STRICT";
 var CREATE_ROOT_TERMINALS = "CREATE TABLE root_terminals (run_id TEXT PRIMARY KEY REFERENCES root_runs(run_id), terminal_digest TEXT NOT NULL, terminal_bytes BLOB NOT NULL CHECK (length(terminal_bytes) BETWEEN 1 AND 16777216)) STRICT";
 var CREATE_COORDINATOR_LOCK = "CREATE TABLE coordinator_lock (singleton INTEGER PRIMARY KEY CHECK (singleton = 1)) STRICT";
 var EXPECTED_SCHEMA = Object.freeze([
@@ -21777,6 +21854,8 @@ async function allocatePrivateRootChildOwner(input) {
   await coordinator.verify();
   requireDigest4(input.parentRunId, "parent root Run");
   requireWireId(input.operationId, "child operation");
+  if (input.parentOperationId !== undefined)
+    requireWireId(input.parentOperationId, "parent child operation");
   const bytes = canonicalJson(input.allocation);
   requireStoredSize(bytes, "child owner allocation");
   const digest4 = privateDomainDigest("JIG-Private-Root-Child-Owner-Allocation/1", input.allocation);
@@ -21793,7 +21872,7 @@ async function allocatePrivateRootChildOwner(input) {
       if (run.coordinatorEpoch !== coordinator.epoch) {
         invalid("RUN_OWNER_CHANGED", "only the active parent coordinator may allocate child work");
       }
-      const existing = findRootChildOwner(owner.database, input.parentRunId, input.operationId);
+      const existing = findRootChildOwner(owner.database, input.parentRunId, input.operationId, input.parentOperationId);
       if (existing !== null) {
         const loaded = loadRootChildOwner(existing);
         if (loaded.allocation.digest !== digest4 || !sameBytes4(existing.allocation_bytes, bytes)) {
@@ -21801,11 +21880,15 @@ async function allocatePrivateRootChildOwner(input) {
         }
         return loaded;
       }
-      if (countRootChildOwners(owner.database, input.parentRunId) !== 0n) {
+      requireActiveChildScope(owner.database, input.parentRunId, input.parentOperationId);
+      if (input.parentOperationId !== undefined && (input.allocation === null || typeof input.allocation !== "object" || Array.isArray(input.allocation) || input.allocation.kind !== "private-root-agent-owner-allocation/1")) {
+        invalid("RUN_CHILD_OWNER_CONFLICT", "a child Flow may own only one Agent operation");
+      }
+      if (countScopedRootChildOwners(owner.database, input.parentRunId, input.parentOperationId) !== 0n) {
         invalid("RUN_CHILD_CAPACITY", "the parent Run already has an active child operation");
       }
-      runFinalized(owner.database, "INSERT INTO root_child_owners(parent_run_id, operation_id, allocation_digest, allocation_bytes) VALUES (?1, ?2, ?3, ?4)", [input.parentRunId, input.operationId, digest4, bytes]);
-      return loadRootChildOwner(requireRootChildOwner(owner.database, input.parentRunId, input.operationId));
+      runFinalized(owner.database, "INSERT INTO root_child_owners(parent_run_id, scope_operation_id, operation_id, allocation_digest, allocation_bytes) VALUES (?1, ?2, ?3, ?4, ?5)", [input.parentRunId, input.parentOperationId ?? "", input.operationId, digest4, bytes]);
+      return loadRootChildOwner(requireRootChildOwner(owner.database, input.parentRunId, input.operationId, input.parentOperationId));
     });
     await owner.finish();
     return lifecycle;
@@ -21821,6 +21904,8 @@ async function recordPrivateRootChildSandbox(input) {
   await coordinator.verify();
   requireDigest4(input.parentRunId, "parent root Run");
   requireWireId(input.operationId, "child operation");
+  if (input.parentOperationId !== undefined)
+    requireWireId(input.parentOperationId, "parent child operation");
   requireDigest4(input.allocationDigest, "child allocation");
   const bytes = canonicalJson(input.sandbox);
   requireStoredSize(bytes, "child sandbox owner");
@@ -21831,7 +21916,7 @@ async function recordPrivateRootChildSandbox(input) {
     requireCoordinatorRoot(coordinator, owner.root);
     const lifecycle = await immediate(owner, async () => {
       await coordinator.verify();
-      const row = requireRootChildOwner(owner.database, input.parentRunId, input.operationId);
+      const row = requireRootChildOwner(owner.database, input.parentRunId, input.operationId, input.parentOperationId);
       if (row.allocation_digest !== input.allocationDigest) {
         invalid("RUN_CHILD_OWNER_CONFLICT", "child sandbox names a different allocation");
       }
@@ -21848,10 +21933,11 @@ async function recordPrivateRootChildSandbox(input) {
       if (run.coordinatorEpoch !== coordinator.epoch) {
         invalid("RUN_OWNER_CHANGED", "only the active parent coordinator may seal child work");
       }
-      const changed = runFinalized(owner.database, "UPDATE root_child_owners SET sandbox_digest = ?1, sandbox_bytes = ?2 WHERE parent_run_id = ?3 AND operation_id = ?4 AND sandbox_digest IS NULL", [digest4, bytes, input.parentRunId, input.operationId]).changes;
+      requireActiveChildScope(owner.database, input.parentRunId, input.parentOperationId);
+      const changed = runFinalized(owner.database, "UPDATE root_child_owners SET sandbox_digest = ?1, sandbox_bytes = ?2 WHERE parent_run_id = ?3 AND operation_id = ?4 AND scope_operation_id = ?5 AND sandbox_digest IS NULL", [digest4, bytes, input.parentRunId, input.operationId, input.parentOperationId ?? ""]).changes;
       if (changed !== 1)
         corrupt("child sandbox owner compare-and-set failed");
-      return loadRootChildOwner(requireRootChildOwner(owner.database, input.parentRunId, input.operationId));
+      return loadRootChildOwner(requireRootChildOwner(owner.database, input.parentRunId, input.operationId, input.parentOperationId));
     });
     await owner.finish();
     return lifecycle;
@@ -21867,6 +21953,8 @@ async function recordPrivateRootChildFence(input) {
   await coordinator.verify();
   requireDigest4(input.parentRunId, "parent root Run");
   requireWireId(input.operationId, "child operation");
+  if (input.parentOperationId !== undefined)
+    requireWireId(input.parentOperationId, "parent child operation");
   requireDigest4(input.allocationDigest, "child allocation");
   requireDigest4(input.sandboxDigest, "child sandbox");
   const bytes = canonicalJson(input.fence);
@@ -21878,7 +21966,7 @@ async function recordPrivateRootChildFence(input) {
     requireCoordinatorRoot(coordinator, owner.root);
     const lifecycle = await immediate(owner, async () => {
       await coordinator.verify();
-      const row = requireRootChildOwner(owner.database, input.parentRunId, input.operationId);
+      const row = requireRootChildOwner(owner.database, input.parentRunId, input.operationId, input.parentOperationId);
       if (row.allocation_digest !== input.allocationDigest || row.sandbox_digest !== input.sandboxDigest) {
         invalid("RUN_CHILD_OWNER_CONFLICT", "child fence names a different owner");
       }
@@ -21888,10 +21976,10 @@ async function recordPrivateRootChildFence(input) {
         }
         return loadRootChildOwner(row);
       }
-      const changed = runFinalized(owner.database, "UPDATE root_child_owners SET fence_digest = ?1, fence_bytes = ?2 WHERE parent_run_id = ?3 AND operation_id = ?4 AND fence_digest IS NULL", [digest4, bytes, input.parentRunId, input.operationId]).changes;
+      const changed = runFinalized(owner.database, "UPDATE root_child_owners SET fence_digest = ?1, fence_bytes = ?2 WHERE parent_run_id = ?3 AND operation_id = ?4 AND scope_operation_id = ?5 AND fence_digest IS NULL", [digest4, bytes, input.parentRunId, input.operationId, input.parentOperationId ?? ""]).changes;
       if (changed !== 1)
         corrupt("child fence compare-and-set failed");
-      return loadRootChildOwner(requireRootChildOwner(owner.database, input.parentRunId, input.operationId));
+      return loadRootChildOwner(requireRootChildOwner(owner.database, input.parentRunId, input.operationId, input.parentOperationId));
     });
     await owner.finish();
     return lifecycle;
@@ -21907,6 +21995,8 @@ async function recordPrivateRootChildCleanup(input) {
   await coordinator.verify();
   requireDigest4(input.parentRunId, "parent root Run");
   requireWireId(input.operationId, "child operation");
+  if (input.parentOperationId !== undefined)
+    requireWireId(input.parentOperationId, "parent child operation");
   requireDigest4(input.allocationDigest, "child allocation");
   requireDigest4(input.sandboxDigest, "child sandbox");
   requireDigest4(input.fenceDigest, "child fence");
@@ -21919,7 +22009,7 @@ async function recordPrivateRootChildCleanup(input) {
     requireCoordinatorRoot(coordinator, owner.root);
     const lifecycle = await immediate(owner, async () => {
       await coordinator.verify();
-      const row = requireRootChildOwner(owner.database, input.parentRunId, input.operationId);
+      const row = requireRootChildOwner(owner.database, input.parentRunId, input.operationId, input.parentOperationId);
       if (row.allocation_digest !== input.allocationDigest || row.sandbox_digest !== input.sandboxDigest || row.fence_digest !== input.fenceDigest) {
         invalid("RUN_CHILD_OWNER_CONFLICT", "child cleanup names different durable evidence");
       }
@@ -21929,10 +22019,10 @@ async function recordPrivateRootChildCleanup(input) {
         }
         return loadRootChildOwner(row);
       }
-      const changed = runFinalized(owner.database, "UPDATE root_child_owners SET cleanup_digest = ?1, cleanup_bytes = ?2 WHERE parent_run_id = ?3 AND operation_id = ?4 AND cleanup_digest IS NULL", [digest4, bytes, input.parentRunId, input.operationId]).changes;
+      const changed = runFinalized(owner.database, "UPDATE root_child_owners SET cleanup_digest = ?1, cleanup_bytes = ?2 WHERE parent_run_id = ?3 AND operation_id = ?4 AND scope_operation_id = ?5 AND cleanup_digest IS NULL", [digest4, bytes, input.parentRunId, input.operationId, input.parentOperationId ?? ""]).changes;
       if (changed !== 1)
         corrupt("child cleanup compare-and-set failed");
-      return loadRootChildOwner(requireRootChildOwner(owner.database, input.parentRunId, input.operationId));
+      return loadRootChildOwner(requireRootChildOwner(owner.database, input.parentRunId, input.operationId, input.parentOperationId));
     });
     await owner.finish();
     return lifecycle;
@@ -21952,8 +22042,8 @@ async function listPrivateRootChildOwners(input) {
   try {
     requireCoordinatorRoot(coordinator, owner.root);
     const query = statement(owner.database, [
-      "SELECT parent_run_id, operation_id, allocation_digest, allocation_bytes, sandbox_digest, sandbox_bytes, fence_digest, fence_bytes, cleanup_digest, cleanup_bytes",
-      "FROM root_child_owners WHERE parent_run_id = ?1 ORDER BY operation_id"
+      "SELECT parent_run_id, scope_operation_id, operation_id, allocation_digest, allocation_bytes, sandbox_digest, sandbox_bytes, fence_digest, fence_bytes, cleanup_digest, cleanup_bytes",
+      "FROM root_child_owners WHERE parent_run_id = ?1 ORDER BY scope_operation_id DESC, operation_id"
     ].join(" "));
     let rows;
     try {
@@ -21976,6 +22066,8 @@ async function closePrivateRootChildOwner(input) {
   await coordinator.verify();
   requireDigest4(input.parentRunId, "parent root Run");
   requireWireId(input.operationId, "child operation");
+  if (input.parentOperationId !== undefined)
+    requireWireId(input.parentOperationId, "parent child operation");
   requireDigest4(input.allocationDigest, "child allocation");
   if (input.sandboxDigest !== null)
     requireDigest4(input.sandboxDigest, "child sandbox");
@@ -21989,13 +22081,16 @@ async function closePrivateRootChildOwner(input) {
     requireCoordinatorRoot(coordinator, owner.root);
     await immediate(owner, async () => {
       await coordinator.verify();
-      const row = findRootChildOwner(owner.database, input.parentRunId, input.operationId);
+      const row = findRootChildOwner(owner.database, input.parentRunId, input.operationId, input.parentOperationId);
+      if (input.parentOperationId === undefined && countScopedRootChildOwners(owner.database, input.parentRunId, input.operationId) !== 0n) {
+        invalid("RUN_EXECUTION_INCOMPLETE", "child Flow still has an active Agent owner");
+      }
       if (row === null)
         return;
       if (row.allocation_digest !== input.allocationDigest || row.sandbox_digest !== input.sandboxDigest || row.fence_digest !== input.fenceDigest || row.cleanup_digest !== input.cleanupDigest || row.sandbox_digest !== null && row.cleanup_digest === null) {
         invalid("RUN_CHILD_OWNER_CONFLICT", "child owner close differs from durable ownership");
       }
-      const changed = runFinalized(owner.database, "DELETE FROM root_child_owners WHERE parent_run_id = ?1 AND operation_id = ?2 AND allocation_digest = ?3", [input.parentRunId, input.operationId, input.allocationDigest]).changes;
+      const changed = runFinalized(owner.database, "DELETE FROM root_child_owners WHERE parent_run_id = ?1 AND operation_id = ?2 AND allocation_digest = ?3 AND scope_operation_id = ?4", [input.parentRunId, input.operationId, input.allocationDigest, input.parentOperationId ?? ""]).changes;
       if (changed !== 1)
         corrupt("child owner close compare-and-delete failed");
     });
@@ -22154,6 +22249,29 @@ function countRootChildOwners(database, parentRunId) {
     query.finalize();
   }
 }
+function countScopedRootChildOwners(database, parentRunId, parentOperationId) {
+  const query = statement(database, "SELECT count(*) AS count FROM root_child_owners WHERE parent_run_id = ?1 AND scope_operation_id = ?2");
+  try {
+    return query.get(parentRunId, parentOperationId ?? "")?.count ?? 0n;
+  } finally {
+    query.finalize();
+  }
+}
+function requireActiveChildScope(database, parentRunId, parentOperationId) {
+  if (requireRootExecutionLifecycle(database, parentRunId).fence_digest !== null) {
+    invalid("RUN_CHILD_PARENT_INACTIVE", "the parent root Run is fenced");
+  }
+  if (parentOperationId === undefined)
+    return;
+  const parent = findRootChildOwner(database, parentRunId, parentOperationId);
+  if (parent === null || parent.sandbox_digest === null || parent.fence_digest !== null) {
+    invalid("RUN_CHILD_PARENT_INACTIVE", "the parent child Flow has no active sandbox");
+  }
+  const allocation = loadRootChildOwner(parent).allocation.value;
+  if (allocation === null || typeof allocation !== "object" || Array.isArray(allocation) || allocation.kind !== "private-root-child-owner-allocation/1") {
+    invalid("RUN_CHILD_PARENT_INACTIVE", "only a direct child Flow may own an Agent");
+  }
+}
 async function loadPrivateRootRunForCoordinator(input) {
   const coordinator = requirePrivateProjectCoordinator(input.coordinator);
   await coordinator.verify();
@@ -22382,20 +22500,20 @@ function requireRootExecutionLifecycle(database, runId) {
     invalid("RUN_EXECUTION_UNALLOCATED", "root Run has no durable execution allocation");
   return row;
 }
-function findRootChildOwner(database, parentRunId, operationId) {
+function findRootChildOwner(database, parentRunId, operationId, parentOperationId) {
   const query = statement(database, [
-    "SELECT parent_run_id, operation_id, allocation_digest, allocation_bytes, sandbox_digest, sandbox_bytes, fence_digest, fence_bytes, cleanup_digest, cleanup_bytes",
-    "FROM root_child_owners WHERE parent_run_id = ?1 AND operation_id = ?2"
+    "SELECT parent_run_id, scope_operation_id, operation_id, allocation_digest, allocation_bytes, sandbox_digest, sandbox_bytes, fence_digest, fence_bytes, cleanup_digest, cleanup_bytes",
+    "FROM root_child_owners WHERE parent_run_id = ?1 AND operation_id = ?2 AND scope_operation_id = ?3"
   ].join(" "));
   try {
-    const row = query.get(parentRunId, operationId);
+    const row = query.get(parentRunId, operationId, parentOperationId ?? "");
     return row === null ? null : copiedRootChildOwnerRow(row);
   } finally {
     query.finalize();
   }
 }
-function requireRootChildOwner(database, parentRunId, operationId) {
-  const row = findRootChildOwner(database, parentRunId, operationId);
+function requireRootChildOwner(database, parentRunId, operationId, parentOperationId) {
+  const row = findRootChildOwner(database, parentRunId, operationId, parentOperationId);
   if (row === null)
     invalid("RUN_CHILD_OWNER_MISSING", "child operation has no durable cleanup owner");
   return row;
@@ -22403,6 +22521,7 @@ function requireRootChildOwner(database, parentRunId, operationId) {
 function copiedRootChildOwnerRow(row) {
   return Object.freeze({
     parent_run_id: row.parent_run_id,
+    scope_operation_id: row.scope_operation_id,
     operation_id: row.operation_id,
     allocation_digest: row.allocation_digest,
     allocation_bytes: copiedBlob(row.allocation_bytes, "stored child owner allocation"),
@@ -22416,6 +22535,8 @@ function copiedRootChildOwnerRow(row) {
 }
 function loadRootChildOwner(row) {
   requireDigest4(row.parent_run_id, "stored child parent Run");
+  if (row.scope_operation_id !== "")
+    requireWireId(row.scope_operation_id, "stored child parent operation");
   requireWireId(row.operation_id, "stored child operation");
   requireProtectedDigest(row.allocation_digest, "stored child allocation");
   const allocation = decodeCanonicalChildFact(row.allocation_bytes, row.allocation_digest, "JIG-Private-Root-Child-Owner-Allocation/1", "stored child owner allocation");
@@ -22454,6 +22575,7 @@ function loadRootChildOwner(row) {
   }
   return Object.freeze({
     parentRunId: row.parent_run_id,
+    ...row.scope_operation_id === "" ? {} : { parentOperationId: row.scope_operation_id },
     operationId: row.operation_id,
     allocation: Object.freeze({ digest: row.allocation_digest, value: allocation }),
     ...sandbox === undefined ? {} : { sandbox },
@@ -24402,7 +24524,7 @@ function limit(code, message, path) {
 }
 
 // src/internal/bun-native-preparation.ts
-import { lstat as lstat14, mkdir as mkdir6, realpath as realpath9 } from "fs/promises";
+import { lstat as lstat14, mkdir as mkdir6, realpath as realpath10 } from "fs/promises";
 import { join as join9 } from "path";
 
 // src/internal/bun-native-preparation-protocol.ts
@@ -24667,7 +24789,7 @@ function normalizeCheckpoint(value) {
   return Object.freeze({ allocation, owner, fence });
 }
 async function preparationOwnerParent(projectRoot) {
-  const state = await realpath9(join9(projectRoot, ".jig"));
+  const state = await realpath10(join9(projectRoot, ".jig"));
   const parent = join9(state, "private-preparation-linux-owners");
   await mkdir6(parent, { mode: 448 }).catch((error) => {
     if (!hasCode4(error, "EEXIST"))
@@ -24675,7 +24797,7 @@ async function preparationOwnerParent(projectRoot) {
   });
   const information = await lstat14(parent);
   const uid = typeof process.getuid === "function" ? process.getuid() : -1;
-  if (!information.isDirectory() || information.isSymbolicLink() || information.uid !== uid || (information.mode & 63) !== 0 || await realpath9(parent) !== parent) {
+  if (!information.isDirectory() || information.isSymbolicLink() || information.uid !== uid || (information.mode & 63) !== 0 || await realpath10(parent) !== parent) {
     throw new Error("private Bun preparation owner directory is not protected");
   }
   return parent;
@@ -24881,15 +25003,19 @@ function projectChanges(current, proposed, currentTargets, proposedTargets) {
 function changedBindingSlotDependencies(current, proposed, currentTargets, proposedTargets) {
   if (current === null)
     return [];
-  const currentFlows = new Map(currentTargets.flatMap((target) => target.request.target.kind === "flow" ? [[target.request.target.path, target]] : []));
-  const proposedFlows = new Map(proposedTargets.flatMap((target) => target.request.target.kind === "flow" ? [[target.request.target.path, target]] : []));
+  const currentByTarget = new Map(currentTargets.map((target) => [targetKey2(target.request.target), target]));
+  const proposedByTarget = new Map(proposedTargets.map((target) => [targetKey2(target.request.target), target]));
   const changed = [];
   for (const [id, binding] of Object.entries(proposed.portablePolicy.bindings)) {
     const prior = current.portablePolicy.bindings[id];
     if (prior === undefined)
       continue;
-    const paths = new Set([...Object.values(prior.slots), ...Object.values(binding.slots)]);
-    if ([...paths].some((path) => current.portablePolicy.packages[path]?.digest !== proposed.portablePolicy.packages[path]?.digest || JSON.stringify(currentFlows.get(path)) !== JSON.stringify(proposedFlows.get(path))))
+    const keys = new Set([...Object.values(prior.slots), ...Object.values(binding.slots)].map(targetKey2));
+    if ([...keys].some((key) => {
+      const before = currentByTarget.get(key);
+      const after = proposedByTarget.get(key);
+      return JSON.stringify(before) !== JSON.stringify(after) || before !== undefined && after !== undefined && current.portablePolicy.packages[before.request.packagePath]?.digest !== proposed.portablePolicy.packages[after.request.packagePath]?.digest;
+    }))
       changed.push(id);
   }
   return changed.sort(compareUtf162);
@@ -25299,7 +25425,7 @@ function isProjectIdentityLoss(error) {
 }
 
 // src/internal/root-run-controller.ts
-import { lstat as lstat18, mkdir as mkdir10, realpath as realpath12 } from "fs/promises";
+import { lstat as lstat18, mkdir as mkdir10, realpath as realpath13 } from "fs/promises";
 import { join as join13 } from "path";
 
 // src/run/session.ts
@@ -27083,487 +27209,12 @@ function invalidResult(terminal, message, details) {
 }
 
 // src/internal/root-flow-call-controller.ts
-import { lstat as lstat16, mkdir as mkdir8, realpath as realpath10 } from "fs/promises";
-import { join as join11 } from "path";
-var ALLOCATION_KIND2 = "private-root-child-owner-allocation/1";
-var SANDBOX_KIND = "private-root-child-sandbox/1";
-var CLEANUP_KIND = "private-root-child-cleanup/1";
-var CANCELLATION_GRACE_MS = 1000;
-async function executePrivateRootFlowCall(input) {
-  const selected = selectChild(input.parent, input.call.slot);
-  if (selected === undefined) {
-    return failed("UNAVAILABLE", "the requested slot has no admitted child Flow");
-  }
-  if (selected.disposition.state !== "ready") {
-    return failed("UNAVAILABLE", "the admitted child Flow is unavailable on this host");
-  }
-  if (input.signal.aborted)
-    return failed("CANCELLED", "the child Flow call was cancelled");
-  const invalidInput = await validateChildInput(input.packageStoreRoot, selected.request.package, input.call.input);
-  if (invalidInput !== undefined)
-    return invalidInput;
-  let recipe;
-  try {
-    recipe = await planPrivateDirectRun({
-      request: selected.request,
-      executionPackage: selected.disposition.executionPackage,
-      installedSupport: input.installedSupport,
-      backend: input.backend
-    });
-  } catch {
-    return failed("UNAVAILABLE", "the admitted child recipe cannot be reproduced");
-  }
-  if (recipe.digest !== selected.disposition.recipeDigest || recipe.observation.digest !== selected.disposition.observationDigest) {
-    return failed("UNAVAILABLE", "the admitted child recipe cannot be reproduced");
-  }
-  const effectiveDeadlineUnixMs = Math.min(input.parentDeadlineUnixMs, Date.now() + recipe.wallClockCeilingMs);
-  if (Date.now() >= effectiveDeadlineUnixMs) {
-    return failed("DEADLINE_EXCEEDED", "the child Flow deadline elapsed before dispatch");
-  }
-  const existing = (await listPrivateRootChildOwners({
-    coordinator: input.coordinator,
-    projectRoot: input.projectRoot,
-    parentRunId: input.parent.run.runId
-  })).find(({ operationId }) => operationId === input.call.operationId);
-  if (existing !== undefined) {
-    await recoverOne(input, existing);
-    return failed("UNCERTAIN", "a prior child dispatch was fenced without a proved result");
-  }
-  const roots = await protectedWorkRoots(input.projectRoot);
-  const identity2 = childIdentity(input.parent.run.runId, input.call.operationId);
-  const [packageAllocation, ownerAllocation] = await Promise.all([
-    allocatePrivatePackageMaterialization({
-      protectedParent: roots.materializations,
-      name: `child-${identity2.slice(0, 48)}`,
-      packageDigest: recipe.executionPackage.digest,
-      ownerToken: `sha256:${identity2}`
-    }),
-    planPrivateLinuxOwnerStateAllocation({
-      parent: roots.owners,
-      name: `c-${identity2.slice(0, 47)}`
-    })
-  ]);
-  const allocation = Object.freeze({
-    kind: ALLOCATION_KIND2,
-    parentRunId: input.parent.run.runId,
-    coordinatorEpoch: input.parent.run.coordinatorEpoch,
-    operationId: input.call.operationId,
-    requestDigest: selected.request.digest,
-    effectiveDeadlineUnixMs,
-    packageAllocation,
-    ownerAllocation
-  });
-  let lifecycle;
-  try {
-    lifecycle = await allocatePrivateRootChildOwner({
-      coordinator: input.coordinator,
-      projectRoot: input.projectRoot,
-      parentRunId: input.parent.run.runId,
-      operationId: input.call.operationId,
-      allocation
-    });
-  } catch (error) {
-    if (error instanceof CheckError && error.code === "RUN_CHILD_CAPACITY") {
-      return failed("RESOURCE_EXHAUSTED", "the parent Run already has an active child operation");
-    }
-    throw error;
-  }
-  let attemptedDispatch = false;
-  try {
-    const lease = await materializeChild(input.packageStoreRoot, recipe, packageAllocation);
-    await revalidateRecipe(recipe);
-    const sealed = await input.backend.seal(backendPlan(recipe, lease.root, identity2, effectiveDeadlineUnixMs), ownerAllocation);
-    const sandbox = Object.freeze({ kind: SANDBOX_KIND, owner: sealed.identity });
-    lifecycle = await recordPrivateRootChildSandbox({
-      coordinator: input.coordinator,
-      projectRoot: input.projectRoot,
-      parentRunId: input.parent.run.runId,
-      operationId: input.call.operationId,
-      allocationDigest: lifecycle.allocation.digest,
-      sandbox
-    });
-    const startup = startupSignal(input.signal);
-    let component;
-    try {
-      attemptedDispatch = true;
-      component = await sealed.admit(startup.signal);
-    } finally {
-      startup.dispose();
-    }
-    const provisional = await new RunHostSession(component, {
-      input: input.call.input,
-      settings: selected.request.settings,
-      attachments: Object.freeze({}),
-      scratch: recipe.scratch,
-      deadlineUnixMs: effectiveDeadlineUnixMs,
-      signal: input.signal
-    }, { cancellationGraceMs: CANCELLATION_GRACE_MS }).run();
-    const fence = await component.enforcement;
-    await releaseKnownChild(input, lifecycle, lease, fence);
-    return await admitOperationResult(input.packageStoreRoot, selected.request.package, provisional);
-  } catch (error) {
-    try {
-      const active = await findLifecycle(input, input.call.operationId);
-      if (active !== undefined)
-        await recoverOne(input, active);
-    } catch (cleanupError) {
-      if (attemptedDispatch && cleanupError instanceof PrivateLinuxFenceUnconfirmedError) {
-        return failed("UNCERTAIN", "child dispatch may have occurred but its fence is not yet confirmed");
-      }
-      throw new AggregateError([error, cleanupError], "child Flow execution and cleanup failed");
-    }
-    if (input.signal.aborted)
-      return failed("CANCELLED", "the child Flow call was cancelled");
-    if (Date.now() >= effectiveDeadlineUnixMs) {
-      return failed("DEADLINE_EXCEEDED", "the child Flow deadline elapsed");
-    }
-    return attemptedDispatch ? failed("UNCERTAIN", "child dispatch may have occurred but no result was proved") : failed("EXECUTION_FAILED", "child Flow execution failed before dispatch");
-  }
-}
-async function recoverPrivateRootFlowCallOwners(input) {
-  const owners = await listPrivateRootChildOwners({
-    coordinator: input.coordinator,
-    projectRoot: input.projectRoot,
-    parentRunId: input.parent.run.runId
-  });
-  for (const owner of owners) {
-    if (isPrivateRootFlowCallOwner(owner))
-      await recoverOne(input, owner);
-  }
-}
-function isPrivateRootFlowCallOwner(lifecycle) {
-  const value = lifecycle.allocation.value;
-  return value !== null && typeof value === "object" && !Array.isArray(value) && value.kind === ALLOCATION_KIND2;
-}
-function selectChild(parent, slot) {
-  const parentTarget = findPrivateActivationCandidateTargetV5(parent.candidate, parent.run.target);
-  if (parentTarget === undefined || parentTarget.request.digest !== parent.intent.requestDigest) {
-    throw new Error("parent Run differs from its admitted target");
-  }
-  const path = parentTarget.request.flowSlots[slot];
-  if (path === undefined)
-    return;
-  const child = findPrivateActivationCandidateTargetV5(parent.candidate, { kind: "flow", path });
-  if (child === undefined || child.request.target.kind !== "flow" || child.request.packagePath !== path || Object.keys(child.request.flowSlots).length !== 0 || Object.keys(child.request.capabilities).length !== 0) {
-    throw new Error("admitted Flow slot does not name one direct child target");
-  }
-  return child;
-}
-async function validateChildInput(store, reference, value) {
-  const captured = await captureStoredPackage(store, reference);
-  try {
-    const inspected = await inspectCapturedPackage(captured);
-    try {
-      inspected.schemas.input?.validate(value, "INVALID_INPUT");
-    } catch (error) {
-      if (!(error instanceof SchemaDiagnostic))
-        throw error;
-      return failed("INVALID_INPUT", "child Flow input does not satisfy its declared schema");
-    }
-    return;
-  } finally {
-    await captured.dispose();
-  }
-}
-async function admitOperationResult(store, reference, provisional) {
-  let admitted = provisional;
-  if (provisional.status === "succeeded") {
-    const captured = await captureStoredPackage(store, reference);
-    try {
-      admitted = admitPrivatePackageResult(await inspectCapturedPackage(captured), provisional);
-    } finally {
-      await captured.dispose();
-    }
-  }
-  if (admitted.status === "succeeded") {
-    return Object.freeze({ status: "succeeded", result: admitted.result });
-  }
-  if (admitted.code === "PROTOCOL_ERROR" || admitted.code === "CHANNEL_LOST") {
-    return failed("EXECUTION_FAILED", "the child Flow execution channel failed");
-  }
-  return failed(admitted.code, admitted.message, admitted.details);
-}
-async function materializeChild(store, recipe, allocation) {
-  const captured = await captureStoredPackage(store, recipe.executionPackage);
-  try {
-    return await materializePrivatePackageLease(captured, allocation);
-  } finally {
-    await captured.dispose();
-  }
-}
-async function revalidateRecipe(recipe) {
-  const [mechanism] = await Promise.all([
-    recipe.backend.observeMechanism(),
-    revalidatePrivateInstalledBunSupport(recipe.installedSupport)
-  ]);
-  if (mechanism.support.digest !== recipe.mechanismDigest) {
-    throw new Error("child recipe no longer matches retained host support");
-  }
-}
-function backendPlan(recipe, packageRoot, identity2, deadlineUnixMs) {
-  return Object.freeze({
-    runId: `child-${identity2.slice(0, 42)}`,
-    limits: Object.freeze({
-      ...recipe.resourceCeilings,
-      deadlineUnixMs,
-      cancellationGraceMs: CANCELLATION_GRACE_MS
-    }),
-    readOnlyMounts: Object.freeze([
-      ...recipe.installedSupport.runtimeMounts,
-      { source: packageRoot, destination: recipe.packageDestination }
-    ]),
-    command: Object.freeze([
-      recipe.sandboxExecutablePath,
-      ...recipe.bunPolicy,
-      `${recipe.packageDestination}/${recipe.request.entrypoint.path}`
-    ])
-  });
-}
-async function releaseKnownChild(input, lifecycleValue, lease, fence) {
-  let lifecycle = lifecycleValue;
-  const sandbox = parseSandbox(lifecycle);
-  lifecycle = await recordPrivateRootChildFence({
-    coordinator: input.coordinator,
-    projectRoot: input.projectRoot,
-    parentRunId: lifecycle.parentRunId,
-    operationId: lifecycle.operationId,
-    allocationDigest: lifecycle.allocation.digest,
-    sandboxDigest: lifecycle.sandbox.digest,
-    fence
-  });
-  await disposePrivatePackageMaterializationLease(lease.identity.allocation.parent.path, lease.identity);
-  const ownerRelease = await releasePrivateLinuxOwnerState(sandbox.owner, fence);
-  const cleanup = childCleanup(ownerRelease);
-  lifecycle = await recordPrivateRootChildCleanup({
-    coordinator: input.coordinator,
-    projectRoot: input.projectRoot,
-    parentRunId: lifecycle.parentRunId,
-    operationId: lifecycle.operationId,
-    allocationDigest: lifecycle.allocation.digest,
-    sandboxDigest: lifecycle.sandbox.digest,
-    fenceDigest: lifecycle.fence.digest,
-    cleanup
-  });
-  await closePrivateRootChildOwner({
-    coordinator: input.coordinator,
-    projectRoot: input.projectRoot,
-    parentRunId: lifecycle.parentRunId,
-    operationId: lifecycle.operationId,
-    allocationDigest: lifecycle.allocation.digest,
-    sandboxDigest: lifecycle.sandbox.digest,
-    fenceDigest: lifecycle.fence.digest,
-    cleanupDigest: lifecycle.cleanup.digest
-  });
-}
-async function recoverOne(input, lifecycle) {
-  const allocation = parseAllocation2(lifecycle);
-  await requireAllocationMatchesParent(input, lifecycle, allocation);
-  if (lifecycle.sandbox === undefined) {
-    const cancelled = await cancelPrivateLinuxOwnerStateAllocation(allocation.ownerAllocation);
-    await releasePrivateLinuxOwnerState(allocation.ownerAllocation, cancelled);
-  } else {
-    const sandbox = parseSandbox(lifecycle);
-    let fence;
-    if (lifecycle.fence === undefined) {
-      fence = await input.backend.recoverFence(sandbox.owner);
-      lifecycle = await recordPrivateRootChildFence({
-        coordinator: input.coordinator,
-        projectRoot: input.projectRoot,
-        parentRunId: lifecycle.parentRunId,
-        operationId: lifecycle.operationId,
-        allocationDigest: lifecycle.allocation.digest,
-        sandboxDigest: lifecycle.sandbox.digest,
-        fence
-      });
-    } else {
-      fence = parseFence(lifecycle);
-    }
-    const recovered = await recoverPrivatePackageMaterializationAllocation(allocation.packageAllocation.parent.path, allocation.packageAllocation);
-    if (recovered.state === "complete")
-      await recovered.lease.dispose();
-    const ownerRelease = await releasePrivateLinuxOwnerState(sandbox.owner, fence);
-    const cleanup = childCleanup(ownerRelease);
-    if (lifecycle.cleanup === undefined) {
-      lifecycle = await recordPrivateRootChildCleanup({
-        coordinator: input.coordinator,
-        projectRoot: input.projectRoot,
-        parentRunId: lifecycle.parentRunId,
-        operationId: lifecycle.operationId,
-        allocationDigest: lifecycle.allocation.digest,
-        sandboxDigest: lifecycle.sandbox.digest,
-        fenceDigest: lifecycle.fence.digest,
-        cleanup
-      });
-    } else {
-      requireCleanupMatches(lifecycle, cleanup);
-    }
-  }
-  if (lifecycle.sandbox === undefined) {
-    const recovered = await recoverPrivatePackageMaterializationAllocation(allocation.packageAllocation.parent.path, allocation.packageAllocation);
-    if (recovered.state === "complete")
-      await recovered.lease.dispose();
-  }
-  await closePrivateRootChildOwner({
-    coordinator: input.coordinator,
-    projectRoot: input.projectRoot,
-    parentRunId: lifecycle.parentRunId,
-    operationId: lifecycle.operationId,
-    allocationDigest: lifecycle.allocation.digest,
-    sandboxDigest: lifecycle.sandbox?.digest ?? null,
-    fenceDigest: lifecycle.fence?.digest ?? null,
-    cleanupDigest: lifecycle.cleanup?.digest ?? null
-  });
-}
-async function findLifecycle(input, operationId) {
-  return (await listPrivateRootChildOwners({
-    coordinator: input.coordinator,
-    projectRoot: input.projectRoot,
-    parentRunId: input.parent.run.runId
-  })).find((item) => item.operationId === operationId);
-}
-function parseAllocation2(lifecycle) {
-  const value = exactObject4(lifecycle.allocation.value, [
-    "kind",
-    "parentRunId",
-    "coordinatorEpoch",
-    "operationId",
-    "requestDigest",
-    "effectiveDeadlineUnixMs",
-    "packageAllocation",
-    "ownerAllocation"
-  ], "child allocation");
-  if (value.kind !== ALLOCATION_KIND2 || value.parentRunId !== lifecycle.parentRunId || value.operationId !== lifecycle.operationId || typeof value.coordinatorEpoch !== "number" || !Number.isSafeInteger(value.coordinatorEpoch) || value.coordinatorEpoch < 1 || typeof value.requestDigest !== "string" || typeof value.effectiveDeadlineUnixMs !== "number" || !Number.isSafeInteger(value.effectiveDeadlineUnixMs) || value.effectiveDeadlineUnixMs < 0) {
-    throw new TypeError("child allocation is invalid");
-  }
-  return Object.freeze({
-    kind: ALLOCATION_KIND2,
-    parentRunId: value.parentRunId,
-    coordinatorEpoch: value.coordinatorEpoch,
-    operationId: value.operationId,
-    requestDigest: value.requestDigest,
-    effectiveDeadlineUnixMs: value.effectiveDeadlineUnixMs,
-    packageAllocation: normalizePrivatePackageMaterializationAllocationIdentity(value.packageAllocation),
-    ownerAllocation: normalizePrivateLinuxOwnerStateAllocationIdentity(value.ownerAllocation)
-  });
-}
-function parseSandbox(lifecycle) {
-  if (lifecycle.sandbox === undefined)
-    throw new TypeError("child sandbox owner is absent");
-  const value = exactObject4(lifecycle.sandbox.value, ["kind", "owner"], "child sandbox");
-  if (value.kind !== SANDBOX_KIND)
-    throw new TypeError("child sandbox kind is invalid");
-  return Object.freeze({
-    kind: SANDBOX_KIND,
-    owner: normalizePrivateLinuxSealedOwnerIdentity(value.owner)
-  });
-}
-function parseFence(lifecycle) {
-  if (lifecycle.fence === undefined)
-    throw new TypeError("child fence is absent");
-  return normalizePrivateLinuxConfirmedEnforcementReceipt(lifecycle.fence.value);
-}
-function childCleanup(ownerRelease) {
-  return Object.freeze({
-    kind: CLEANUP_KIND,
-    packageReleased: true,
-    ownerRelease
-  });
-}
-function parseCleanup(lifecycle) {
-  if (lifecycle.cleanup === undefined)
-    throw new TypeError("child cleanup is absent");
-  const value = exactObject4(lifecycle.cleanup.value, ["kind", "ownerRelease", "packageReleased"], "child cleanup");
-  if (value.kind !== CLEANUP_KIND || value.packageReleased !== true) {
-    throw new TypeError("child cleanup is invalid");
-  }
-  return childCleanup(normalizePrivateLinuxOwnerStateReleaseReceipt(value.ownerRelease));
-}
-function requireCleanupMatches(lifecycle, expected) {
-  const actual = parseCleanup(lifecycle);
-  if (actual.ownerRelease.digest !== expected.ownerRelease.digest) {
-    throw new Error("durable child cleanup differs from the released owner");
-  }
-}
-async function requireAllocationMatchesParent(input, lifecycle, allocation) {
-  const parentTarget = findPrivateActivationCandidateTargetV5(input.parent.candidate, input.parent.run.target);
-  if (parentTarget === undefined || parentTarget.request.digest !== input.parent.intent.requestDigest || allocation.parentRunId !== input.parent.run.runId || allocation.coordinatorEpoch !== input.parent.run.coordinatorEpoch || allocation.operationId !== lifecycle.operationId || allocation.effectiveDeadlineUnixMs > input.parent.intent.deadlineUnixMs) {
-    throw new Error("durable child allocation differs from its parent Run");
-  }
-  const selected = Object.values(parentTarget.request.flowSlots).map((path) => findPrivateActivationCandidateTargetV5(input.parent.candidate, { kind: "flow", path })).find((target) => target?.request.digest === allocation.requestDigest);
-  if (selected === undefined || selected.request.target.kind !== "flow" || selected.disposition.state !== "ready" || Object.keys(selected.request.flowSlots).length !== 0 || Object.keys(selected.request.capabilities).length !== 0) {
-    throw new Error("durable child allocation is not an admitted direct Flow");
-  }
-  const roots = await protectedWorkRoots(input.projectRoot);
-  const identity2 = childIdentity(lifecycle.parentRunId, lifecycle.operationId);
-  if (allocation.packageAllocation.parent.path !== roots.materializations || allocation.packageAllocation.name !== `child-${identity2.slice(0, 48)}` || allocation.packageAllocation.packageDigest !== selected.disposition.executionPackage.digest || allocation.packageAllocation.ownerToken !== `sha256:${identity2}` || allocation.ownerAllocation.parent !== roots.owners || allocation.ownerAllocation.name !== `c-${identity2.slice(0, 47)}`) {
-    throw new Error("durable child allocation differs from its admitted resources");
-  }
-}
-function exactObject4(value, fields, label) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw new TypeError(`${label} must be an object`);
-  }
-  const record2 = value;
-  const actual = Object.keys(record2).sort();
-  const expected = [...fields].sort();
-  if (actual.length !== expected.length || actual.some((field, index) => field !== expected[index])) {
-    throw new TypeError(`${label} must contain exactly ${expected.join(", ")}`);
-  }
-  return record2;
-}
-function childIdentity(parentRunId, operationId) {
-  return privateDomainDigest("JIG-Private-Root-Child-Identity/1", {
-    parentRunId,
-    operationId
-  }).slice("sha256:".length);
-}
-async function protectedWorkRoots(projectRoot) {
-  const state = await realpath10(join11(projectRoot, ".jig"));
-  const materializations = join11(state, "private-root-materializations");
-  const owners = join11(state, "private-root-linux-owners");
-  await Promise.all([ensureProtectedDirectory(materializations), ensureProtectedDirectory(owners)]);
-  return Object.freeze({ materializations, owners });
-}
-async function ensureProtectedDirectory(path) {
-  await mkdir8(path, { mode: 448 }).catch((error) => {
-    if (!hasCode6(error, "EEXIST"))
-      throw error;
-  });
-  const information = await lstat16(path);
-  const uid = typeof process.getuid === "function" ? process.getuid() : -1;
-  if (!information.isDirectory() || information.isSymbolicLink() || information.uid !== uid || (information.mode & 63) !== 0 || await realpath10(path) !== path) {
-    throw new Error("child execution owner directory is not protected");
-  }
-}
-function startupSignal(signal) {
-  const controller = new AbortController;
-  const abort = () => controller.abort(signal.reason);
-  if (signal.aborted)
-    abort();
-  else
-    signal.addEventListener("abort", abort, { once: true });
-  return Object.freeze({
-    signal: controller.signal,
-    dispose() {
-      signal.removeEventListener("abort", abort);
-    }
-  });
-}
-function failed(code, message, details) {
-  return Object.freeze({
-    status: "failed",
-    code,
-    message,
-    ...details === undefined ? {} : { details }
-  });
-}
-function hasCode6(error, code) {
-  return error !== null && typeof error === "object" && error.code === code;
-}
+import { lstat as lstat17, mkdir as mkdir9, realpath as realpath12 } from "fs/promises";
+import { join as join12 } from "path";
 
 // src/internal/root-agent-run-controller.ts
-import { lstat as lstat17, mkdir as mkdir9, realpath as realpath11 } from "fs/promises";
-import { join as join12 } from "path";
+import { lstat as lstat16, mkdir as mkdir8, realpath as realpath11 } from "fs/promises";
+import { join as join11 } from "path";
 
 // node_modules/@agentclientprotocol/sdk/dist/schema/index.js
 var AGENT_METHODS = {
@@ -46341,7 +45992,7 @@ function createAbortableSSESource(body, signal) {
         abort();
       }
     },
-    async cleanup(failed2) {
+    async cleanup(failed) {
       let cleanupError;
       try {
         signal.removeEventListener("abort", abort);
@@ -46350,7 +46001,7 @@ function createAbortableSSESource(body, signal) {
       }
       if (!closed) {
         const pending = cancel();
-        if (pending && !failed2 && !signal.aborted) {
+        if (pending && !failed && !signal.aborted) {
           try {
             await pending;
           } catch (error48) {
@@ -46365,7 +46016,7 @@ function createAbortableSSESource(body, signal) {
           cleanupError ?? (cleanupError = error48);
         }
       }
-      if (cleanupError !== undefined && !failed2 && !signal.aborted) {
+      if (cleanupError !== undefined && !failed && !signal.aborted) {
         throw cleanupError;
       }
     }
@@ -46383,7 +46034,7 @@ async function* _iterSSEMessages(response, controller) {
   const lineDecoder = new LineDecoder;
   const { signal } = controller;
   const source = createAbortableSSESource(response.body, signal);
-  let failed2 = false;
+  let failed = false;
   try {
     source.start();
     for await (const sseChunk of iterSSEChunks(source.iterator)) {
@@ -46413,12 +46064,12 @@ async function* _iterSSEMessages(response, controller) {
       }
     }
   } catch (error48) {
-    failed2 = true;
+    failed = true;
     if (!signal.aborted || !isAbortError2(error48) && error48 !== signal.reason) {
       throw error48;
     }
   } finally {
-    await source.cleanup(failed2);
+    await source.cleanup(failed);
   }
 }
 var DOUBLE_NEWLINE_DELIMITER_MAX_OVERLAP_BYTES = 3;
@@ -49980,12 +49631,12 @@ class EventStream {
   }
   _run(executor) {
     setTimeout(() => {
-      let failed2 = false;
+      let failed = false;
       Promise.resolve().then(executor).catch((error49) => {
-        failed2 = true;
+        failed = true;
         __classPrivateFieldGet(this, _EventStream_instances, "m", _EventStream_handleError).call(this, error49);
       }).then(() => {
-        if (failed2) {
+        if (failed) {
           return;
         }
         try {
@@ -59006,10 +58657,10 @@ function exactKeys5(value, expected) {
 }
 
 // src/internal/root-agent-run-controller.ts
-var ALLOCATION_KIND3 = "private-root-agent-owner-allocation/1";
-var SANDBOX_KIND2 = "private-root-agent-sandbox/1";
-var CLEANUP_KIND2 = "private-root-agent-cleanup/1";
-var CANCELLATION_GRACE_MS2 = 1000;
+var ALLOCATION_KIND2 = "private-root-agent-owner-allocation/1";
+var SANDBOX_KIND = "private-root-agent-sandbox/1";
+var CLEANUP_KIND = "private-root-agent-cleanup/1";
+var CANCELLATION_GRACE_MS = 1000;
 var PROVIDER_STDERR_BYTES = 64 * 1024;
 var AGENT_PROVIDER_MINIMUM_PIDS = 128;
 var PROVIDER_INSTRUCTION_BYTES = 1048576;
@@ -59017,15 +58668,15 @@ var DIGEST11 = /^sha256:[0-9a-f]{64}$/;
 var decoder10 = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
 var encoder11 = new TextEncoder;
 async function executePrivateRootAgentRun(input) {
-  const selected = selectAgentCapability(input.parent, input.call);
+  const selected = selectAgentCapability(input, input.call);
   if (selected === undefined) {
-    return failed2("UNAVAILABLE", "the requested slot has no admitted Agent Run capability");
+    return failed("UNAVAILABLE", "the requested slot has no admitted Agent Run capability");
   }
   if (input.call.method !== "run") {
-    return failed2("UNAVAILABLE", "the Agent Run capability has no requested method");
+    return failed("UNAVAILABLE", "the Agent Run capability has no requested method");
   }
   if (input.signal.aborted)
-    return failed2("CANCELLED", "the Agent Run was cancelled");
+    return failed("CANCELLED", "the Agent Run was cancelled");
   let provider;
   let recipe;
   try {
@@ -59035,54 +58686,58 @@ async function executePrivateRootAgentRun(input) {
     }
     recipe = await reproduceParentRecipe(input);
   } catch {
-    return failed2("UNAVAILABLE", "the admitted Agent provider cannot be reproduced");
+    return failed("UNAVAILABLE", "the admitted Agent provider cannot be reproduced");
   }
   let prepared;
   try {
     prepared = await prepareCall(input, provider);
   } catch (error49) {
     if (error49 instanceof AgentInstructionLimitError || error49 instanceof SchemaDiagnostic && error49.code === "SCHEMA_LIMIT_EXCEEDED" || error49 instanceof AgentRunValidationError && error49.code === "AGENT_RUN_SKILL_PROJECTION_LIMIT") {
-      return failed2("RESOURCE_EXHAUSTED", "the Agent Run input exceeds its fixed provider bound");
+      return failed("RESOURCE_EXHAUSTED", "the Agent Run input exceeds its fixed provider bound");
     }
     if (error49 instanceof AgentRunValidationError || error49 instanceof CheckError || error49 instanceof SchemaDiagnostic || error49 instanceof TypeError) {
-      return failed2("INVALID_INPUT", "the Agent Run input or skill selection is invalid");
+      return failed("INVALID_INPUT", "the Agent Run input or skill selection is invalid");
     }
     throw error49;
   }
-  const effectiveDeadlineUnixMs = Math.min(input.parentDeadlineUnixMs, Date.now() + recipe.wallClockCeilingMs);
+  const effectiveDeadlineUnixMs = Math.min(input.parentDeadlineUnixMs, input.parent.intent.deadlineUnixMs, Date.now() + recipe.wallClockCeilingMs);
   if (Date.now() >= effectiveDeadlineUnixMs) {
-    return failed2("DEADLINE_EXCEEDED", "the Agent Run deadline elapsed before dispatch");
+    return failed("DEADLINE_EXCEEDED", "the Agent Run deadline elapsed before dispatch");
   }
   if (input.signal.aborted)
-    return failed2("CANCELLED", "the Agent Run was cancelled");
-  const owners = await listPrivateRootChildOwners({
+    return failed("CANCELLED", "the Agent Run was cancelled");
+  if (input.parentFlow !== undefined) {
+    await requireParentFlowOwner(input, input.parentFlow, effectiveDeadlineUnixMs);
+  }
+  const owners = (await listPrivateRootChildOwners({
     coordinator: input.coordinator,
     projectRoot: input.projectRoot,
     parentRunId: input.parent.run.runId
-  });
+  })).filter((owner) => owner.parentOperationId === input.parentFlow?.operationId);
   const existing = owners.find(({ operationId }) => operationId === input.call.operationId);
   if (existing !== undefined) {
     if (!isPrivateRootAgentRunOwner(existing)) {
       throw new Error("one operation identity names a different durable child owner");
     }
     await recoverPrivateRootAgentRunOwner(input, existing);
-    return failed2("UNCERTAIN", "a prior Agent dispatch was fenced without a proved result");
+    return failed("UNCERTAIN", "a prior Agent dispatch was fenced without a proved result");
   }
   if (owners.length !== 0) {
-    return failed2("RESOURCE_EXHAUSTED", "the parent Run already has an active child operation");
+    return failed("RESOURCE_EXHAUSTED", "the parent Run already has an active child operation");
   }
   const ownerParent = await protectedOwnerRoot(input.projectRoot);
-  const identity2 = agentIdentity(input.parent.run.runId, input.call.operationId);
+  const identity2 = agentIdentity(input.parent.run.runId, input.call.operationId, input.parentFlow?.operationId);
   const ownerAllocation = await planPrivateLinuxOwnerStateAllocation({
     parent: ownerParent,
     name: `a-${identity2.slice(0, 62)}`
   });
   const allocation = Object.freeze({
-    kind: ALLOCATION_KIND3,
+    kind: ALLOCATION_KIND2,
     parentRunId: input.parent.run.runId,
     coordinatorEpoch: input.parent.run.coordinatorEpoch,
     operationId: input.call.operationId,
-    parentRequestDigest: input.parent.intent.requestDigest,
+    parentRequestDigest: requireParentTarget(input).request.digest,
+    parentFlow: input.parentFlow ?? null,
     requestDigest: prepared.digest,
     providerDigest: provider.digest,
     effectiveDeadlineUnixMs,
@@ -59094,6 +58749,7 @@ async function executePrivateRootAgentRun(input) {
       coordinator: input.coordinator,
       projectRoot: input.projectRoot,
       parentRunId: input.parent.run.runId,
+      ...input.parentFlow === undefined ? {} : { parentOperationId: input.parentFlow.operationId },
       operationId: input.call.operationId,
       allocation
     });
@@ -59104,7 +58760,7 @@ async function executePrivateRootAgentRun(input) {
       throw new AggregateError([error49, cleanupError], "Agent owner allocation failed and its unused owner could not be released");
     }
     if (error49 instanceof CheckError && error49.code === "RUN_CHILD_CAPACITY") {
-      return failed2("RESOURCE_EXHAUSTED", "the parent Run already has an active child operation");
+      return failed("RESOURCE_EXHAUSTED", "the parent Run already has an active child operation");
     }
     throw error49;
   }
@@ -59112,12 +58768,13 @@ async function executePrivateRootAgentRun(input) {
   let execution;
   try {
     await revalidateProviderSupport(recipe, provider);
-    const sealed = await input.backend.seal(backendPlan2(recipe, provider, effectiveDeadlineUnixMs, identity2), ownerAllocation);
-    const sandbox = Object.freeze({ kind: SANDBOX_KIND2, owner: sealed.identity });
+    const sealed = await input.backend.seal(backendPlan(recipe, provider, effectiveDeadlineUnixMs, identity2), ownerAllocation);
+    const sandbox = Object.freeze({ kind: SANDBOX_KIND, owner: sealed.identity });
     lifecycle = await recordPrivateRootChildSandbox({
       coordinator: input.coordinator,
       projectRoot: input.projectRoot,
       parentRunId: input.parent.run.runId,
+      ...input.parentFlow === undefined ? {} : { parentOperationId: input.parentFlow.operationId },
       operationId: input.call.operationId,
       allocationDigest: lifecycle.allocation.digest,
       sandbox
@@ -59128,33 +58785,33 @@ async function executePrivateRootAgentRun(input) {
     await releaseKnownAgent(input, lifecycle, execution.fence);
   } catch (error49) {
     try {
-      const active = await findLifecycle2(input, input.call.operationId);
+      const active = await findLifecycle(input, input.call.operationId);
       if (active !== undefined)
         await recoverPrivateRootAgentRunOwner(input, active);
     } catch (cleanupError) {
       if (attemptedDispatch && cleanupError instanceof PrivateLinuxFenceUnconfirmedError) {
-        return failed2("UNCERTAIN", "Agent dispatch may have occurred but its fence is not yet confirmed");
+        return failed("UNCERTAIN", "Agent dispatch may have occurred but its fence is not yet confirmed");
       }
       throw new AggregateError([error49, cleanupError], "Agent Run execution and cleanup failed");
     }
     if (input.signal.aborted)
-      return failed2("CANCELLED", "the Agent Run was cancelled");
+      return failed("CANCELLED", "the Agent Run was cancelled");
     if (Date.now() >= effectiveDeadlineUnixMs) {
-      return failed2("DEADLINE_EXCEEDED", "the Agent Run deadline elapsed");
+      return failed("DEADLINE_EXCEEDED", "the Agent Run deadline elapsed");
     }
-    return attemptedDispatch ? failed2("UNCERTAIN", "Agent dispatch may have occurred but no result was proved") : failed2("EXECUTION_FAILED", "Agent Run execution failed before dispatch");
+    return attemptedDispatch ? failed("UNCERTAIN", "Agent dispatch may have occurred but no result was proved") : failed("EXECUTION_FAILED", "Agent Run execution failed before dispatch");
   }
   if (execution.fence.stopReason === "cancelled" || input.signal.aborted) {
-    return failed2("CANCELLED", "the Agent Run was cancelled");
+    return failed("CANCELLED", "the Agent Run was cancelled");
   }
   if (execution.fence.stopReason === "deadline" || Date.now() >= effectiveDeadlineUnixMs) {
-    return failed2("DEADLINE_EXCEEDED", "the Agent Run deadline elapsed");
+    return failed("DEADLINE_EXCEEDED", "the Agent Run deadline elapsed");
   }
   if (execution.fence.exitCode !== 0 || execution.fence.signal !== null) {
-    return failed2("EXECUTION_FAILED", "the Agent provider process failed");
+    return failed("EXECUTION_FAILED", "the Agent provider process failed");
   }
   if (execution.cancelled) {
-    return failed2("CANCELLED", "the Agent Run was cancelled");
+    return failed("CANCELLED", "the Agent Run was cancelled");
   }
   if (execution.failure !== undefined)
     return providerFailure(execution.failure);
@@ -59165,12 +58822,12 @@ async function executePrivateRootAgentRun(input) {
       result: Object.freeze({ value })
     });
   } catch {
-    return failed2("INVALID_RESULT", "the Agent provider result does not satisfy Agent Run/1");
+    return failed("INVALID_RESULT", "the Agent provider result does not satisfy Agent Run/1");
   }
 }
 function isPrivateRootAgentRunOwner(lifecycle) {
   const value = lifecycle.allocation.value;
-  return value !== null && typeof value === "object" && !Array.isArray(value) && value.kind === ALLOCATION_KIND3;
+  return value !== null && typeof value === "object" && !Array.isArray(value) && value.kind === ALLOCATION_KIND2;
 }
 async function recoverPrivateRootAgentRunOwners(input) {
   const owners = await listPrivateRootChildOwners({
@@ -59179,15 +58836,905 @@ async function recoverPrivateRootAgentRunOwners(input) {
     parentRunId: input.parent.run.runId
   });
   for (const owner of owners) {
-    if (isPrivateRootAgentRunOwner(owner)) {
+    if (isPrivateRootAgentRunOwner(owner) && (input.parentFlow === undefined || owner.parentOperationId === input.parentFlow.operationId)) {
       await recoverPrivateRootAgentRunOwner(input, owner);
     }
   }
 }
 async function recoverPrivateRootAgentRunOwner(input, lifecycleValue) {
   let lifecycle = lifecycleValue;
+  const allocation = parseAllocation2(lifecycle);
+  await requireAllocationMatchesParent(input, lifecycle, allocation);
+  if (lifecycle.sandbox === undefined) {
+    const cancelled = await cancelPrivateLinuxOwnerStateAllocation(allocation.ownerAllocation);
+    await releasePrivateLinuxOwnerState(allocation.ownerAllocation, cancelled);
+  } else {
+    const sandbox = parseSandbox(lifecycle);
+    let fence;
+    if (lifecycle.fence === undefined) {
+      fence = await input.backend.recoverFence(sandbox.owner);
+      lifecycle = await recordPrivateRootChildFence({
+        coordinator: input.coordinator,
+        projectRoot: input.projectRoot,
+        parentRunId: lifecycle.parentRunId,
+        ...lifecycle.parentOperationId === undefined ? {} : { parentOperationId: lifecycle.parentOperationId },
+        operationId: lifecycle.operationId,
+        allocationDigest: lifecycle.allocation.digest,
+        sandboxDigest: lifecycle.sandbox.digest,
+        fence
+      });
+    } else {
+      fence = parseFence(lifecycle);
+    }
+    const ownerRelease = await releasePrivateLinuxOwnerState(sandbox.owner, fence);
+    const cleanup = agentCleanup(ownerRelease);
+    if (lifecycle.cleanup === undefined) {
+      lifecycle = await recordPrivateRootChildCleanup({
+        coordinator: input.coordinator,
+        projectRoot: input.projectRoot,
+        parentRunId: lifecycle.parentRunId,
+        ...lifecycle.parentOperationId === undefined ? {} : { parentOperationId: lifecycle.parentOperationId },
+        operationId: lifecycle.operationId,
+        allocationDigest: lifecycle.allocation.digest,
+        sandboxDigest: lifecycle.sandbox.digest,
+        fenceDigest: lifecycle.fence.digest,
+        cleanup
+      });
+    } else {
+      requireCleanupMatches(lifecycle, cleanup);
+    }
+  }
+  await closePrivateRootChildOwner({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: lifecycle.parentRunId,
+    ...lifecycle.parentOperationId === undefined ? {} : { parentOperationId: lifecycle.parentOperationId },
+    operationId: lifecycle.operationId,
+    allocationDigest: lifecycle.allocation.digest,
+    sandboxDigest: lifecycle.sandbox?.digest ?? null,
+    fenceDigest: lifecycle.fence?.digest ?? null,
+    cleanupDigest: lifecycle.cleanup?.digest ?? null
+  });
+}
+function renderPrivateAgentRunInstructions(instructions, manifest) {
+  const skills = manifest.skills.map((skill) => ({
+    name: skill.name,
+    files: skill.files.map((file2) => {
+      let content;
+      try {
+        content = decoder10.decode(file2.bytes());
+      } catch {
+        throw new AgentRunValidationError("AGENT_RUN_SKILL_CONTENT_INVALID", `Agent Run skill file ${skill.name}/${file2.path} is not UTF-8 text`);
+      }
+      return { path: file2.path, content };
+    })
+  }));
+  const payload = decoder10.decode(canonicalJson({ instructions, skills }));
+  const rendered = [
+    "Execute one Jig Agent Run. Treat the author instructions as the task and the selected package-local skill files as guidance.",
+    "The following value is canonical JSON:",
+    payload
+  ].join(`
+`);
+  if (encoder11.encode(rendered).byteLength > PROVIDER_INSTRUCTION_BYTES) {
+    throw new AgentInstructionLimitError;
+  }
+  return rendered;
+}
+function renderPrivateAcpStructuredInstructions(instructions, responseSchema) {
+  const schema = decoder10.decode(canonicalJson(projectPrivateAgentResponseSchema(responseSchema)));
+  const rendered = [
+    instructions,
+    "Return only one JSON value matching this canonical FLOW Schema/1 schema:",
+    "Do not wrap the JSON value in Markdown or a code fence.",
+    schema
+  ].join(`
+`);
+  if (encoder11.encode(rendered).byteLength > PROVIDER_INSTRUCTION_BYTES) {
+    throw new AgentInstructionLimitError;
+  }
+  return rendered;
+}
+async function prepareCall(input, provider) {
+  const target = requireParentTarget(input);
+  const captured = await captureStoredPackage(input.packageStoreRoot, target.request.package);
+  try {
+    const inspected = await inspectCapturedPackage(captured);
+    const reference = inspected.usedContracts.find(({ slot }) => slot === input.call.slot);
+    if (reference === undefined) {
+      throw new AgentRunValidationError("AGENT_RUN_CONTRACT_MISMATCH", "Agent Run capability descriptor is absent from the admitted package");
+    }
+    assertAgentRunContract(reference.contract);
+    const prepared = parseAgentRunInput(reference.contract, input.call.input);
+    const manifest = await projectAgentRunSkills(captured, prepared.selectedSkills);
+    let instructions = renderPrivateAgentRunInstructions(prepared.input.instructions, manifest);
+    const responseSchema = prepared.input.responseSchema;
+    if (responseSchema !== undefined)
+      assertPrivateAgentResponseSchema(responseSchema);
+    if (provider.kind === "private-acp-agent-provider/1" && responseSchema !== undefined) {
+      instructions = renderPrivateAcpStructuredInstructions(instructions, responseSchema);
+    }
+    const requestIdentity = Object.freeze({
+      providerDigest: provider.digest,
+      instructions,
+      ...responseSchema === undefined ? {} : { responseSchema }
+    });
+    return Object.freeze({
+      input: prepared,
+      contract: reference.contract,
+      instructions,
+      ...responseSchema === undefined ? {} : { responseSchema },
+      digest: privateDomainDigest("JIG-Private-Agent-Request/1", requestIdentity)
+    });
+  } finally {
+    await captured.dispose();
+  }
+}
+function selectAgentCapability(input, call) {
+  const target = requireParentTarget(input);
+  const selected = target.request.capabilities[call.slot];
+  if (selected === undefined)
+    return;
+  if (selected.id !== AGENT_RUN_CONTRACT_ID || selected.version !== AGENT_RUN_CONTRACT_VERSION || selected.digest !== AGENT_RUN_CONTRACT_DIGEST) {
+    throw new Error("admitted Agent Run capability identity is invalid");
+  }
+  return selected;
+}
+function requireParentTarget(input) {
+  const { parent, parentFlow } = input;
+  const root = findPrivateActivationCandidateTargetV5(parent.candidate, parent.run.target);
+  if (root === undefined || root.request.digest !== parent.intent.requestDigest || root.disposition.state !== "ready") {
+    throw new Error("parent Run differs from its admitted target");
+  }
+  if (parentFlow === undefined)
+    return root;
+  const target = findPrivateActivationCandidateTargetV5(parent.candidate, parentFlow.target);
+  if (target === undefined || target.request.digest !== parentFlow.requestDigest || target.disposition.state !== "ready" || Object.keys(target.request.flowSlots).length !== 0 || !Object.values(root.request.flowSlots).some((identity2) => findPrivateActivationCandidateTargetV5(parent.candidate, identity2)?.request.digest === target.request.digest)) {
+    throw new Error("Agent parent Flow differs from its admitted child target");
+  }
+  return target;
+}
+async function reproduceParentRecipe(input) {
+  const target = requireParentTarget(input);
+  if (target.disposition.state !== "ready") {
+    throw new Error("parent Run target is unavailable");
+  }
+  const recipe = await planPrivateDirectRun({
+    request: target.request,
+    executionPackage: target.disposition.executionPackage,
+    installedSupport: input.installedSupport,
+    backend: input.backend,
+    agentProvider: input.agentProvider
+  });
+  if (recipe.digest !== target.disposition.recipeDigest || recipe.observation.digest !== target.disposition.observationDigest || recipe.agentProvider?.digest !== input.agentProvider.digest) {
+    throw new Error("parent Agent recipe differs from its admission");
+  }
+  return recipe;
+}
+async function revalidateProviderSupport(recipe, provider) {
+  const [mechanism] = await Promise.all([
+    recipe.backend.observeMechanism(),
+    revalidatePrivateInstalledBunSupport(recipe.installedSupport),
+    provider.kind === "private-acp-agent-provider/1" ? revalidatePrivateAcpAgentProvider(provider) : Promise.resolve()
+  ]);
+  if (mechanism.support.digest !== recipe.mechanismDigest || provider.kind === "private-openai-agent-provider/1" && recipe.installedSupport.agentWorkerDigest !== provider.workerDigest || recipe.agentProvider?.digest !== provider.digest) {
+    throw new Error("Agent provider support changed after admission");
+  }
+}
+function backendPlan(recipe, provider, deadlineUnixMs, identity2) {
+  const acp = provider.kind === "private-acp-agent-provider/1" ? privateAcpAgentRuntime(provider) : undefined;
+  return Object.freeze({
+    runId: `agent-${identity2.slice(0, 42)}`,
+    limits: Object.freeze({
+      ...recipe.resourceCeilings,
+      pids: Math.max(recipe.resourceCeilings.pids, AGENT_PROVIDER_MINIMUM_PIDS),
+      deadlineUnixMs,
+      cancellationGraceMs: CANCELLATION_GRACE_MS
+    }),
+    readOnlyMounts: Object.freeze([
+      ...recipe.installedSupport.runtimeMounts,
+      { source: "/etc/resolv.conf", destination: "/etc/resolv.conf" },
+      ...acp === undefined ? [{
+        source: recipe.installedSupport.agentWorkerPath,
+        destination: recipe.installedSupport.sandboxAgentWorkerPath
+      }] : [
+        { source: acp.adapterPath, destination: acp.sandboxAdapterPath },
+        { source: acp.executablePath, destination: acp.sandboxExecutablePath },
+        ...acp.readOnlyMounts
+      ]
+    ]),
+    command: Object.freeze(acp === undefined ? [
+      recipe.sandboxExecutablePath,
+      ...recipe.bunPolicy,
+      recipe.installedSupport.sandboxAgentWorkerPath
+    ] : [recipe.sandboxExecutablePath, ...recipe.bunPolicy, acp.sandboxAdapterPath]),
+    ...acp === undefined ? {} : { environment: acp.environment },
+    network: "inherited",
+    ...acp?.nestedUserNamespaces === true ? { nestedUserNamespaces: true } : {}
+  });
+}
+async function interactWithProvider(component, provider, prepared, signal) {
+  if (provider.kind === "private-acp-agent-provider/1") {
+    return await interactWithAcpProvider(component, provider, prepared, signal);
+  }
+  return await interactWithOpenAIProvider(component, provider, prepared);
+}
+async function interactWithOpenAIProvider(component, provider, prepared) {
+  const output = collectBounded3(component.stdout, PRIVATE_OPENAI_AGENT_RESPONSE_BYTES);
+  const stderr = discardBounded(component.stderr, PROVIDER_STDERR_BYTES);
+  try {
+    await component.write(encodePrivateOpenAIAgentRequest({
+      protocol: PRIVATE_OPENAI_AGENT_PROTOCOL,
+      apiKey: privateOpenAIAgentCredential(provider),
+      api: provider.api,
+      baseURL: provider.baseURL,
+      model: provider.model,
+      instructions: prepared.instructions,
+      ...prepared.responseSchema === undefined ? {} : {
+        responseSchema: prepared.responseSchema
+      }
+    }));
+    await component.closeInput();
+    const [bytes, fence] = await Promise.all([output, component.enforcement, stderr]).then(([bytes2, fence2]) => [bytes2, fence2]);
+    let response;
+    try {
+      response = decodePrivateOpenAIAgentResponse(bytes);
+    } catch {
+      return Object.freeze({
+        fence,
+        failure: "AGENT_PROVIDER_RESPONSE_INVALID",
+        cancelled: false
+      });
+    }
+    return response.status === "error" ? Object.freeze({ fence, failure: response.code, cancelled: false }) : Object.freeze({ fence, value: response.value, cancelled: false });
+  } catch (error49) {
+    await component.terminate().catch(() => {
+      return;
+    });
+    await Promise.allSettled([output, stderr, component.enforcement]);
+    throw error49;
+  }
+}
+async function interactWithAcpProvider(component, provider, prepared, signal) {
+  const runtime = privateAcpAgentRuntime(provider);
+  const stderr = discardBounded(component.stderr, PROVIDER_STDERR_BYTES);
+  try {
+    if (runtime.startupInput !== undefined) {
+      await component.write(runtime.startupInput());
+    }
+    const turn = await runPrivateAcpTurn(privateAcpComponentStream(component), {
+      cwd: "/work",
+      instructions: prepared.instructions,
+      signal,
+      configuration: runtime.configuration,
+      ...runtime.modeId === undefined ? {} : { modeId: runtime.modeId },
+      ...runtime.sessionMeta === undefined ? {} : { sessionMeta: runtime.sessionMeta },
+      ...runtime.authentication === undefined ? {} : {
+        authentication: {
+          request: runtime.authentication.request,
+          ...runtime.authentication.clientAuthCapabilities === undefined ? {} : {
+            clientAuthCapabilities: runtime.authentication.clientAuthCapabilities
+          }
+        }
+      }
+    });
+    await component.closeInput();
+    const [fence] = await Promise.all([component.enforcement, stderr]);
+    if (turn.stopReason === "cancelled") {
+      return Object.freeze({ fence, cancelled: true });
+    }
+    try {
+      return Object.freeze({
+        fence,
+        value: acpResultValue(turn, prepared.responseSchema !== undefined),
+        cancelled: false
+      });
+    } catch {
+      return Object.freeze({
+        fence,
+        failure: "AGENT_PROVIDER_RESPONSE_INVALID",
+        cancelled: false
+      });
+    }
+  } catch (error49) {
+    await component.terminate().catch(() => {
+      return;
+    });
+    await Promise.allSettled([stderr, component.enforcement]);
+    if (error49 instanceof PrivateAcpProtocolError) {
+      throw error49;
+    }
+    throw error49;
+  }
+}
+function acpResultValue(turn, structuredRequested) {
+  const outcome = turn.stopReason === "end_turn" ? "completed" : turn.stopReason === "refusal" ? "blocked" : "limit";
+  if (!structuredRequested || outcome !== "completed") {
+    return Object.freeze({ outcome, text: turn.text });
+  }
+  return Object.freeze({
+    outcome,
+    text: turn.text,
+    structured: decodePrivateAcpStructuredText(turn.text)
+  });
+}
+function decodePrivateAcpStructuredText(text) {
+  try {
+    return decodeJson1(encoder11.encode(text));
+  } catch (rawError) {
+    const match = /^```json\r?\n([\s\S]*)\r?\n```$/.exec(text.trim());
+    if (match === null)
+      throw rawError;
+    return decodeJson1(encoder11.encode(match[1]));
+  }
+}
+async function releaseKnownAgent(input, lifecycleValue, fence) {
+  let lifecycle = lifecycleValue;
+  const sandbox = parseSandbox(lifecycle);
+  lifecycle = await recordPrivateRootChildFence({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: lifecycle.parentRunId,
+    ...lifecycle.parentOperationId === undefined ? {} : { parentOperationId: lifecycle.parentOperationId },
+    operationId: lifecycle.operationId,
+    allocationDigest: lifecycle.allocation.digest,
+    sandboxDigest: lifecycle.sandbox.digest,
+    fence
+  });
+  const ownerRelease = await releasePrivateLinuxOwnerState(sandbox.owner, fence);
+  const cleanup = agentCleanup(ownerRelease);
+  lifecycle = await recordPrivateRootChildCleanup({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: lifecycle.parentRunId,
+    ...lifecycle.parentOperationId === undefined ? {} : { parentOperationId: lifecycle.parentOperationId },
+    operationId: lifecycle.operationId,
+    allocationDigest: lifecycle.allocation.digest,
+    sandboxDigest: lifecycle.sandbox.digest,
+    fenceDigest: lifecycle.fence.digest,
+    cleanup
+  });
+  await closePrivateRootChildOwner({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: lifecycle.parentRunId,
+    ...lifecycle.parentOperationId === undefined ? {} : { parentOperationId: lifecycle.parentOperationId },
+    operationId: lifecycle.operationId,
+    allocationDigest: lifecycle.allocation.digest,
+    sandboxDigest: lifecycle.sandbox.digest,
+    fenceDigest: lifecycle.fence.digest,
+    cleanupDigest: lifecycle.cleanup.digest
+  });
+}
+async function findLifecycle(input, operationId) {
+  return (await listPrivateRootChildOwners({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: input.parent.run.runId
+  })).find((item) => item.operationId === operationId && item.parentOperationId === input.parentFlow?.operationId);
+}
+function parseAllocation2(lifecycle) {
+  const value = exactObject4(lifecycle.allocation.value, [
+    "kind",
+    "parentRunId",
+    "coordinatorEpoch",
+    "operationId",
+    "parentRequestDigest",
+    "parentFlow",
+    "requestDigest",
+    "providerDigest",
+    "effectiveDeadlineUnixMs",
+    "ownerAllocation"
+  ], "Agent allocation");
+  if (value.kind !== ALLOCATION_KIND2 || value.parentRunId !== lifecycle.parentRunId || value.operationId !== lifecycle.operationId || typeof value.coordinatorEpoch !== "number" || !Number.isSafeInteger(value.coordinatorEpoch) || value.coordinatorEpoch < 1 || !isDigest(value.parentRequestDigest) || !isDigest(value.requestDigest) || !isDigest(value.providerDigest) || typeof value.effectiveDeadlineUnixMs !== "number" || !Number.isSafeInteger(value.effectiveDeadlineUnixMs) || value.effectiveDeadlineUnixMs < 0) {
+    throw new TypeError("Agent allocation is invalid");
+  }
+  return Object.freeze({
+    kind: ALLOCATION_KIND2,
+    parentRunId: value.parentRunId,
+    coordinatorEpoch: value.coordinatorEpoch,
+    operationId: value.operationId,
+    parentRequestDigest: value.parentRequestDigest,
+    parentFlow: normalizeParentFlow(value.parentFlow, lifecycle.parentOperationId),
+    requestDigest: value.requestDigest,
+    providerDigest: value.providerDigest,
+    effectiveDeadlineUnixMs: value.effectiveDeadlineUnixMs,
+    ownerAllocation: normalizePrivateLinuxOwnerStateAllocationIdentity(value.ownerAllocation)
+  });
+}
+function parseSandbox(lifecycle) {
+  if (lifecycle.sandbox === undefined)
+    throw new TypeError("Agent sandbox owner is absent");
+  const value = exactObject4(lifecycle.sandbox.value, ["kind", "owner"], "Agent sandbox");
+  if (value.kind !== SANDBOX_KIND)
+    throw new TypeError("Agent sandbox kind is invalid");
+  return Object.freeze({
+    kind: SANDBOX_KIND,
+    owner: normalizePrivateLinuxSealedOwnerIdentity(value.owner)
+  });
+}
+function parseFence(lifecycle) {
+  if (lifecycle.fence === undefined)
+    throw new TypeError("Agent fence is absent");
+  return normalizePrivateLinuxConfirmedEnforcementReceipt(lifecycle.fence.value);
+}
+function agentCleanup(ownerRelease) {
+  return Object.freeze({ kind: CLEANUP_KIND, ownerRelease });
+}
+function parseCleanup(lifecycle) {
+  if (lifecycle.cleanup === undefined)
+    throw new TypeError("Agent cleanup is absent");
+  const value = exactObject4(lifecycle.cleanup.value, ["kind", "ownerRelease"], "Agent cleanup");
+  if (value.kind !== CLEANUP_KIND)
+    throw new TypeError("Agent cleanup kind is invalid");
+  return agentCleanup(normalizePrivateLinuxOwnerStateReleaseReceipt(value.ownerRelease));
+}
+function requireCleanupMatches(lifecycle, expected) {
+  const actual = parseCleanup(lifecycle);
+  if (actual.ownerRelease.digest !== expected.ownerRelease.digest) {
+    throw new Error("durable Agent cleanup differs from the released owner");
+  }
+}
+async function requireAllocationMatchesParent(input, lifecycle, allocation) {
+  const { parentFlow: requestedParentFlow, ...rootInput } = input;
+  const parentFlow = allocation.parentFlow;
+  if (requestedParentFlow !== undefined && (parentFlow === null || requestedParentFlow.operationId !== parentFlow.operationId || requestedParentFlow.requestDigest !== parentFlow.requestDigest)) {
+    throw new Error("durable Agent allocation differs from the requested parent Flow");
+  }
+  const target = requireParentTarget({
+    ...rootInput,
+    ...parentFlow === null ? {} : { parentFlow }
+  });
+  if (allocation.parentRunId !== input.parent.run.runId || allocation.coordinatorEpoch !== input.parent.run.coordinatorEpoch || allocation.operationId !== lifecycle.operationId || allocation.parentRequestDigest !== target.request.digest || allocation.effectiveDeadlineUnixMs > input.parent.intent.deadlineUnixMs || Object.values(target.request.capabilities).length !== 1 || Object.values(target.request.capabilities)[0]?.digest !== AGENT_RUN_CONTRACT_DIGEST) {
+    throw new Error("durable Agent allocation differs from its admitted parent or provider");
+  }
+  if (parentFlow !== null) {
+    await requireParentFlowOwner(input, parentFlow, allocation.effectiveDeadlineUnixMs);
+  }
+  const ownerParent = await protectedOwnerRoot(input.projectRoot);
+  const identity2 = agentIdentity(lifecycle.parentRunId, lifecycle.operationId, lifecycle.parentOperationId);
+  if (allocation.ownerAllocation.parent !== ownerParent || allocation.ownerAllocation.name !== `a-${identity2.slice(0, 62)}`) {
+    throw new Error("durable Agent allocation differs from its admitted owner resource");
+  }
+}
+async function requireParentFlowOwner(input, parentFlow, deadlineUnixMs) {
+  const owners = await listPrivateRootChildOwners({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: input.parent.run.runId
+  });
+  const parent = owners.find((owner) => owner.parentOperationId === undefined && owner.operationId === parentFlow.operationId);
+  const allocation = parent?.allocation.value;
+  if (allocation === null || typeof allocation !== "object" || Array.isArray(allocation) || allocation.kind !== "private-root-child-owner-allocation/1" || allocation.parentRunId !== input.parent.run.runId || allocation.coordinatorEpoch !== input.parent.run.coordinatorEpoch || allocation.operationId !== parentFlow.operationId || allocation.requestDigest !== parentFlow.requestDigest || typeof allocation.effectiveDeadlineUnixMs !== "number" || !Number.isSafeInteger(allocation.effectiveDeadlineUnixMs) || allocation.effectiveDeadlineUnixMs > input.parent.intent.deadlineUnixMs || allocation.effectiveDeadlineUnixMs < deadlineUnixMs || parent?.sandbox === undefined) {
+    throw new Error("Agent parent Flow differs from its durable execution owner");
+  }
+}
+function normalizeParentFlow(value, parentOperationId) {
+  if (parentOperationId === undefined) {
+    if (value !== null)
+      throw new TypeError("root Agent allocation has a nested parent");
+    return null;
+  }
+  const parent = exactObject4(value, ["operationId", "target", "requestDigest"], "Agent parent Flow");
+  if (parent.operationId !== parentOperationId || !isDigest(parent.requestDigest)) {
+    throw new TypeError("Agent parent Flow identity is invalid");
+  }
+  const target = exactObject4(parent.target, parent.target?.kind === "flow" ? ["kind", "path"] : ["kind", "id"], "Agent parent Flow target");
+  let identity2;
+  if (target.kind === "flow" && typeof target.path === "string") {
+    validateProjectPath(target.path, "Agent parent Flow target");
+    identity2 = Object.freeze({ kind: "flow", path: target.path });
+  } else if (target.kind === "binding" && typeof target.id === "string" && /^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(target.id)) {
+    identity2 = Object.freeze({ kind: "binding", id: target.id });
+  } else {
+    throw new TypeError("Agent parent Flow target is invalid");
+  }
+  return Object.freeze({ operationId: parentOperationId, target: identity2, requestDigest: parent.requestDigest });
+}
+function providerFailure(code) {
+  if (code === "AGENT_PROVIDER_OUTPUT_LIMIT") {
+    return failed("RESOURCE_EXHAUSTED", "the Agent provider result exceeded its fixed bound");
+  }
+  if (code === "AGENT_PROVIDER_RESPONSE_INVALID") {
+    return failed("INVALID_RESULT", "the Agent provider returned an invalid result");
+  }
+  return failed("EXECUTION_FAILED", "the Agent provider request failed");
+}
+async function collectBounded3(source, maximum) {
+  const chunks = [];
+  let total = 0;
+  for await (const chunk of source) {
+    total += chunk.byteLength;
+    if (total > maximum)
+      throw new Error("Agent provider output exceeds its byte bound");
+    chunks.push(Uint8Array.from(chunk));
+  }
+  const output = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    output.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return output;
+}
+async function discardBounded(source, maximum) {
+  let total = 0;
+  for await (const chunk of source) {
+    total += chunk.byteLength;
+    if (total > maximum)
+      throw new Error("Agent provider diagnostics exceed their byte bound");
+  }
+}
+async function cancelUnusedAllocation(allocation) {
+  const cancelled = await cancelPrivateLinuxOwnerStateAllocation(allocation);
+  await releasePrivateLinuxOwnerState(allocation, cancelled);
+}
+function exactObject4(value, fields, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new TypeError(`${label} must be an object`);
+  }
+  const record3 = value;
+  const actual = Object.keys(record3).sort();
+  const expected = [...fields].sort();
+  if (actual.length !== expected.length || actual.some((field, index) => field !== expected[index])) {
+    throw new TypeError(`${label} must contain exactly ${expected.join(", ")}`);
+  }
+  return record3;
+}
+function agentIdentity(parentRunId, operationId, parentOperationId) {
+  return privateDomainDigest("JIG-Private-Root-Agent-Identity/1", {
+    parentRunId,
+    parentOperationId: parentOperationId ?? null,
+    operationId
+  }).slice("sha256:".length);
+}
+async function protectedOwnerRoot(projectRoot) {
+  const state2 = await realpath11(join11(projectRoot, ".jig"));
+  const owners = join11(state2, "private-root-linux-owners");
+  await mkdir8(owners, { mode: 448 }).catch((error49) => {
+    if (!hasCode6(error49, "EEXIST"))
+      throw error49;
+  });
+  const information = await lstat16(owners);
+  const uid = typeof process.getuid === "function" ? process.getuid() : -1;
+  if (!information.isDirectory() || information.isSymbolicLink() || information.uid !== uid || (information.mode & 63) !== 0 || await realpath11(owners) !== owners) {
+    throw new Error("Agent execution owner directory is not protected");
+  }
+  return owners;
+}
+function isDigest(value) {
+  return typeof value === "string" && DIGEST11.test(value);
+}
+function failed(code, message, details) {
+  return Object.freeze({
+    status: "failed",
+    code,
+    message,
+    ...details === undefined ? {} : { details }
+  });
+}
+function hasCode6(error49, code) {
+  return error49 !== null && typeof error49 === "object" && error49.code === code;
+}
+
+class AgentInstructionLimitError extends Error {
+}
+
+// src/internal/root-flow-call-controller.ts
+var ALLOCATION_KIND3 = "private-root-child-owner-allocation/1";
+var SANDBOX_KIND2 = "private-root-child-sandbox/1";
+var CLEANUP_KIND2 = "private-root-child-cleanup/1";
+var CANCELLATION_GRACE_MS2 = 1000;
+async function executePrivateRootFlowCall(input) {
+  const selected = selectChild(input.parent, input.call.slot);
+  if (selected === undefined) {
+    return failed2("UNAVAILABLE", "the requested slot has no admitted child Flow");
+  }
+  if (selected.disposition.state !== "ready") {
+    return failed2("UNAVAILABLE", "the admitted child Flow is unavailable on this host");
+  }
+  if (input.signal.aborted)
+    return failed2("CANCELLED", "the child Flow call was cancelled");
+  const invalidInput = await validateChildInput(input.packageStoreRoot, selected.request.package, input.call.input);
+  if (invalidInput !== undefined)
+    return invalidInput;
+  let recipe;
+  try {
+    recipe = await planPrivateDirectRun({
+      request: selected.request,
+      executionPackage: selected.disposition.executionPackage,
+      installedSupport: input.installedSupport,
+      backend: input.backend,
+      agentProvider: input.agentProvider
+    });
+  } catch {
+    return failed2("UNAVAILABLE", "the admitted child recipe cannot be reproduced");
+  }
+  if (recipe.digest !== selected.disposition.recipeDigest || recipe.observation.digest !== selected.disposition.observationDigest) {
+    return failed2("UNAVAILABLE", "the admitted child recipe cannot be reproduced");
+  }
+  const effectiveDeadlineUnixMs = Math.min(input.parentDeadlineUnixMs, input.parent.intent.deadlineUnixMs, Date.now() + recipe.wallClockCeilingMs);
+  if (Date.now() >= effectiveDeadlineUnixMs) {
+    return failed2("DEADLINE_EXCEEDED", "the child Flow deadline elapsed before dispatch");
+  }
+  const existing = (await listPrivateRootChildOwners({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: input.parent.run.runId
+  })).find(({ operationId, parentOperationId }) => parentOperationId === undefined && operationId === input.call.operationId);
+  if (existing !== undefined) {
+    await recoverOne(input, existing);
+    return failed2("UNCERTAIN", "a prior child dispatch was fenced without a proved result");
+  }
+  const roots = await protectedWorkRoots(input.projectRoot);
+  const identity2 = childIdentity(input.parent.run.runId, input.call.operationId);
+  const [packageAllocation, ownerAllocation] = await Promise.all([
+    allocatePrivatePackageMaterialization({
+      protectedParent: roots.materializations,
+      name: `child-${identity2.slice(0, 48)}`,
+      packageDigest: recipe.executionPackage.digest,
+      ownerToken: `sha256:${identity2}`
+    }),
+    planPrivateLinuxOwnerStateAllocation({
+      parent: roots.owners,
+      name: `c-${identity2.slice(0, 47)}`
+    })
+  ]);
+  const allocation = Object.freeze({
+    kind: ALLOCATION_KIND3,
+    parentRunId: input.parent.run.runId,
+    coordinatorEpoch: input.parent.run.coordinatorEpoch,
+    operationId: input.call.operationId,
+    requestDigest: selected.request.digest,
+    effectiveDeadlineUnixMs,
+    packageAllocation,
+    ownerAllocation
+  });
+  let lifecycle;
+  try {
+    lifecycle = await allocatePrivateRootChildOwner({
+      coordinator: input.coordinator,
+      projectRoot: input.projectRoot,
+      parentRunId: input.parent.run.runId,
+      operationId: input.call.operationId,
+      allocation
+    });
+  } catch (error49) {
+    if (error49 instanceof CheckError && error49.code === "RUN_CHILD_CAPACITY") {
+      return failed2("RESOURCE_EXHAUSTED", "the parent Run already has an active child operation");
+    }
+    throw error49;
+  }
+  let attemptedDispatch = false;
+  try {
+    const lease = await materializeChild(input.packageStoreRoot, recipe, packageAllocation);
+    await revalidateRecipe(recipe);
+    const sealed = await input.backend.seal(backendPlan2(recipe, lease.root, identity2, effectiveDeadlineUnixMs), ownerAllocation);
+    const sandbox = Object.freeze({ kind: SANDBOX_KIND2, owner: sealed.identity });
+    lifecycle = await recordPrivateRootChildSandbox({
+      coordinator: input.coordinator,
+      projectRoot: input.projectRoot,
+      parentRunId: input.parent.run.runId,
+      operationId: input.call.operationId,
+      allocationDigest: lifecycle.allocation.digest,
+      sandbox
+    });
+    const startup = startupSignal(input.signal);
+    let component;
+    try {
+      attemptedDispatch = true;
+      component = await sealed.admit(startup.signal);
+    } finally {
+      startup.dispose();
+    }
+    const provisional = await new RunHostSession(component, {
+      input: input.call.input,
+      settings: selected.request.settings,
+      attachments: Object.freeze({}),
+      scratch: recipe.scratch,
+      deadlineUnixMs: effectiveDeadlineUnixMs,
+      signal: input.signal
+    }, { cancellationGraceMs: CANCELLATION_GRACE_MS2 }, specialistDispatcher(input, selected, effectiveDeadlineUnixMs)).run();
+    const fence = await component.enforcement;
+    await releaseKnownChild(input, lifecycle, lease, fence);
+    return await admitOperationResult(input.packageStoreRoot, selected.request.package, provisional);
+  } catch (error49) {
+    try {
+      const active = await findLifecycle2(input, input.call.operationId);
+      if (active !== undefined)
+        await recoverOne(input, active);
+    } catch (cleanupError) {
+      if (attemptedDispatch && cleanupError instanceof PrivateLinuxFenceUnconfirmedError) {
+        return failed2("UNCERTAIN", "child dispatch may have occurred but its fence is not yet confirmed");
+      }
+      throw new AggregateError([error49, cleanupError], "child Flow execution and cleanup failed");
+    }
+    if (input.signal.aborted)
+      return failed2("CANCELLED", "the child Flow call was cancelled");
+    if (Date.now() >= effectiveDeadlineUnixMs) {
+      return failed2("DEADLINE_EXCEEDED", "the child Flow deadline elapsed");
+    }
+    return attemptedDispatch ? failed2("UNCERTAIN", "child dispatch may have occurred but no result was proved") : failed2("EXECUTION_FAILED", "child Flow execution failed before dispatch");
+  }
+}
+async function recoverPrivateRootFlowCallOwners(input) {
+  const owners = await listPrivateRootChildOwners({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: input.parent.run.runId
+  });
+  for (const owner of owners) {
+    if (isPrivateRootFlowCallOwner(owner))
+      await recoverOne(input, owner);
+  }
+}
+function isPrivateRootFlowCallOwner(lifecycle) {
+  const value = lifecycle.allocation.value;
+  return value !== null && typeof value === "object" && !Array.isArray(value) && lifecycle.parentOperationId === undefined && value.kind === ALLOCATION_KIND3;
+}
+function selectChild(parent, slot) {
+  const parentTarget = findPrivateActivationCandidateTargetV5(parent.candidate, parent.run.target);
+  if (parentTarget === undefined || parentTarget.request.digest !== parent.intent.requestDigest) {
+    throw new Error("parent Run differs from its admitted target");
+  }
+  const target = parentTarget.request.flowSlots[slot];
+  if (target === undefined)
+    return;
+  const child = findPrivateActivationCandidateTargetV5(parent.candidate, target);
+  if (child === undefined || Object.keys(child.request.flowSlots).length !== 0) {
+    throw new Error("admitted Flow slot does not name one leaf child target");
+  }
+  return child;
+}
+function specialistDispatcher(input, selected, parentDeadlineUnixMs) {
+  if (Object.keys(selected.request.capabilities).length === 0)
+    return;
+  let active = false;
+  return {
+    async callEffect(call, signal) {
+      if (input.agentProvider === undefined) {
+        return failed2("UNAVAILABLE", "the admitted Agent provider is unavailable");
+      }
+      if (active)
+        return failed2("RESOURCE_EXHAUSTED", "the specialist already has an active Agent operation");
+      active = true;
+      try {
+        return await executePrivateRootAgentRun({
+          ...input,
+          agentProvider: input.agentProvider,
+          parentFlow: {
+            operationId: input.call.operationId,
+            target: selected.request.target,
+            requestDigest: selected.request.digest
+          },
+          call,
+          parentDeadlineUnixMs,
+          signal
+        });
+      } finally {
+        active = false;
+      }
+    }
+  };
+}
+async function validateChildInput(store, reference, value) {
+  const captured = await captureStoredPackage(store, reference);
+  try {
+    const inspected = await inspectCapturedPackage(captured);
+    try {
+      inspected.schemas.input?.validate(value, "INVALID_INPUT");
+    } catch (error49) {
+      if (!(error49 instanceof SchemaDiagnostic))
+        throw error49;
+      return failed2("INVALID_INPUT", "child Flow input does not satisfy its declared schema");
+    }
+    return;
+  } finally {
+    await captured.dispose();
+  }
+}
+async function admitOperationResult(store, reference, provisional) {
+  let admitted = provisional;
+  if (provisional.status === "succeeded") {
+    const captured = await captureStoredPackage(store, reference);
+    try {
+      admitted = admitPrivatePackageResult(await inspectCapturedPackage(captured), provisional);
+    } finally {
+      await captured.dispose();
+    }
+  }
+  if (admitted.status === "succeeded") {
+    return Object.freeze({ status: "succeeded", result: admitted.result });
+  }
+  if (admitted.code === "PROTOCOL_ERROR" || admitted.code === "CHANNEL_LOST") {
+    return failed2("EXECUTION_FAILED", "the child Flow execution channel failed");
+  }
+  return failed2(admitted.code, admitted.message, admitted.details);
+}
+async function materializeChild(store, recipe, allocation) {
+  const captured = await captureStoredPackage(store, recipe.executionPackage);
+  try {
+    return await materializePrivatePackageLease(captured, allocation);
+  } finally {
+    await captured.dispose();
+  }
+}
+async function revalidateRecipe(recipe) {
+  const [mechanism] = await Promise.all([
+    recipe.backend.observeMechanism(),
+    revalidatePrivateInstalledBunSupport(recipe.installedSupport)
+  ]);
+  if (mechanism.support.digest !== recipe.mechanismDigest) {
+    throw new Error("child recipe no longer matches retained host support");
+  }
+}
+function backendPlan2(recipe, packageRoot, identity2, deadlineUnixMs) {
+  return Object.freeze({
+    runId: `child-${identity2.slice(0, 42)}`,
+    limits: Object.freeze({
+      ...recipe.resourceCeilings,
+      deadlineUnixMs,
+      cancellationGraceMs: CANCELLATION_GRACE_MS2
+    }),
+    readOnlyMounts: Object.freeze([
+      ...recipe.installedSupport.runtimeMounts,
+      { source: packageRoot, destination: recipe.packageDestination }
+    ]),
+    command: Object.freeze([
+      recipe.sandboxExecutablePath,
+      ...recipe.bunPolicy,
+      `${recipe.packageDestination}/${recipe.request.entrypoint.path}`
+    ])
+  });
+}
+async function releaseKnownChild(input, lifecycleValue, lease, fence) {
+  let lifecycle = lifecycleValue;
+  const selected = await requireAllocationMatchesParent2(input, lifecycle, parseAllocation3(lifecycle));
+  const sandbox = parseSandbox2(lifecycle);
+  lifecycle = await recordPrivateRootChildFence({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: lifecycle.parentRunId,
+    operationId: lifecycle.operationId,
+    allocationDigest: lifecycle.allocation.digest,
+    sandboxDigest: lifecycle.sandbox.digest,
+    fence
+  });
+  await recoverPrivateRootAgentRunOwners({
+    ...input,
+    parentFlow: {
+      operationId: lifecycle.operationId,
+      target: selected.request.target,
+      requestDigest: selected.request.digest
+    }
+  });
+  await disposePrivatePackageMaterializationLease(lease.identity.allocation.parent.path, lease.identity);
+  const ownerRelease = await releasePrivateLinuxOwnerState(sandbox.owner, fence);
+  const cleanup = childCleanup(ownerRelease);
+  lifecycle = await recordPrivateRootChildCleanup({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: lifecycle.parentRunId,
+    operationId: lifecycle.operationId,
+    allocationDigest: lifecycle.allocation.digest,
+    sandboxDigest: lifecycle.sandbox.digest,
+    fenceDigest: lifecycle.fence.digest,
+    cleanup
+  });
+  await closePrivateRootChildOwner({
+    coordinator: input.coordinator,
+    projectRoot: input.projectRoot,
+    parentRunId: lifecycle.parentRunId,
+    operationId: lifecycle.operationId,
+    allocationDigest: lifecycle.allocation.digest,
+    sandboxDigest: lifecycle.sandbox.digest,
+    fenceDigest: lifecycle.fence.digest,
+    cleanupDigest: lifecycle.cleanup.digest
+  });
+}
+async function recoverOne(input, lifecycle) {
   const allocation = parseAllocation3(lifecycle);
-  await requireAllocationMatchesParent2(input, lifecycle, allocation);
+  const selected = await requireAllocationMatchesParent2(input, lifecycle, allocation);
   if (lifecycle.sandbox === undefined) {
     const cancelled = await cancelPrivateLinuxOwnerStateAllocation(allocation.ownerAllocation);
     await releasePrivateLinuxOwnerState(allocation.ownerAllocation, cancelled);
@@ -59208,8 +59755,19 @@ async function recoverPrivateRootAgentRunOwner(input, lifecycleValue) {
     } else {
       fence = parseFence2(lifecycle);
     }
+    await recoverPrivateRootAgentRunOwners({
+      ...input,
+      parentFlow: {
+        operationId: lifecycle.operationId,
+        target: selected.request.target,
+        requestDigest: selected.request.digest
+      }
+    });
+    const recovered = await recoverPrivatePackageMaterializationAllocation(allocation.packageAllocation.parent.path, allocation.packageAllocation);
+    if (recovered.state === "complete")
+      await recovered.lease.dispose();
     const ownerRelease = await releasePrivateLinuxOwnerState(sandbox.owner, fence);
-    const cleanup = agentCleanup(ownerRelease);
+    const cleanup = childCleanup(ownerRelease);
     if (lifecycle.cleanup === undefined) {
       lifecycle = await recordPrivateRootChildCleanup({
         coordinator: input.coordinator,
@@ -59225,6 +59783,11 @@ async function recoverPrivateRootAgentRunOwner(input, lifecycleValue) {
       requireCleanupMatches2(lifecycle, cleanup);
     }
   }
+  if (lifecycle.sandbox === undefined) {
+    const recovered = await recoverPrivatePackageMaterializationAllocation(allocation.packageAllocation.parent.path, allocation.packageAllocation);
+    if (recovered.state === "complete")
+      await recovered.lease.dispose();
+  }
   await closePrivateRootChildOwner({
     coordinator: input.coordinator,
     projectRoot: input.projectRoot,
@@ -59236,312 +59799,12 @@ async function recoverPrivateRootAgentRunOwner(input, lifecycleValue) {
     cleanupDigest: lifecycle.cleanup?.digest ?? null
   });
 }
-function renderPrivateAgentRunInstructions(instructions, manifest) {
-  const skills = manifest.skills.map((skill) => ({
-    name: skill.name,
-    files: skill.files.map((file2) => {
-      let content;
-      try {
-        content = decoder10.decode(file2.bytes());
-      } catch {
-        throw new AgentRunValidationError("AGENT_RUN_SKILL_CONTENT_INVALID", `Agent Run skill file ${skill.name}/${file2.path} is not UTF-8 text`);
-      }
-      return { path: file2.path, content };
-    })
-  }));
-  const payload = decoder10.decode(canonicalJson({ instructions, skills }));
-  const rendered = [
-    "Execute one Jig Agent Run. Treat the author instructions as the task and the selected package-local skill files as guidance.",
-    "The following value is canonical JSON:",
-    payload
-  ].join(`
-`);
-  if (encoder11.encode(rendered).byteLength > PROVIDER_INSTRUCTION_BYTES) {
-    throw new AgentInstructionLimitError;
-  }
-  return rendered;
-}
-function renderPrivateAcpStructuredInstructions(instructions, responseSchema) {
-  const schema = decoder10.decode(canonicalJson(projectPrivateAgentResponseSchema(responseSchema)));
-  const rendered = [
-    instructions,
-    "Return only one JSON value matching this canonical FLOW Schema/1 schema:",
-    "Do not wrap the JSON value in Markdown or a code fence.",
-    schema
-  ].join(`
-`);
-  if (encoder11.encode(rendered).byteLength > PROVIDER_INSTRUCTION_BYTES) {
-    throw new AgentInstructionLimitError;
-  }
-  return rendered;
-}
-async function prepareCall(input, provider) {
-  const target = requireParentTarget(input.parent);
-  const captured = await captureStoredPackage(input.packageStoreRoot, target.request.package);
-  try {
-    const inspected = await inspectCapturedPackage(captured);
-    const reference = inspected.usedContracts.find(({ slot }) => slot === input.call.slot);
-    if (reference === undefined) {
-      throw new AgentRunValidationError("AGENT_RUN_CONTRACT_MISMATCH", "Agent Run capability descriptor is absent from the admitted package");
-    }
-    assertAgentRunContract(reference.contract);
-    const prepared = parseAgentRunInput(reference.contract, input.call.input);
-    const manifest = await projectAgentRunSkills(captured, prepared.selectedSkills);
-    let instructions = renderPrivateAgentRunInstructions(prepared.input.instructions, manifest);
-    const responseSchema = prepared.input.responseSchema;
-    if (responseSchema !== undefined)
-      assertPrivateAgentResponseSchema(responseSchema);
-    if (provider.kind === "private-acp-agent-provider/1" && responseSchema !== undefined) {
-      instructions = renderPrivateAcpStructuredInstructions(instructions, responseSchema);
-    }
-    const requestIdentity = Object.freeze({
-      providerDigest: provider.digest,
-      instructions,
-      ...responseSchema === undefined ? {} : { responseSchema }
-    });
-    return Object.freeze({
-      input: prepared,
-      contract: reference.contract,
-      instructions,
-      ...responseSchema === undefined ? {} : { responseSchema },
-      digest: privateDomainDigest("JIG-Private-Agent-Request/1", requestIdentity)
-    });
-  } finally {
-    await captured.dispose();
-  }
-}
-function selectAgentCapability(parent, call) {
-  const target = requireParentTarget(parent);
-  const selected = target.request.capabilities[call.slot];
-  if (selected === undefined)
-    return;
-  if (selected.id !== AGENT_RUN_CONTRACT_ID || selected.version !== AGENT_RUN_CONTRACT_VERSION || selected.digest !== AGENT_RUN_CONTRACT_DIGEST) {
-    throw new Error("admitted Agent Run capability identity is invalid");
-  }
-  return selected;
-}
-function requireParentTarget(parent) {
-  const target = findPrivateActivationCandidateTargetV5(parent.candidate, parent.run.target);
-  if (target === undefined || target.request.digest !== parent.intent.requestDigest || target.disposition.state !== "ready") {
-    throw new Error("parent Run differs from its admitted target");
-  }
-  return target;
-}
-async function reproduceParentRecipe(input) {
-  const target = requireParentTarget(input.parent);
-  if (target.disposition.state !== "ready") {
-    throw new Error("parent Run target is unavailable");
-  }
-  const recipe = await planPrivateDirectRun({
-    request: target.request,
-    executionPackage: target.disposition.executionPackage,
-    installedSupport: input.installedSupport,
-    backend: input.backend,
-    agentProvider: input.agentProvider
-  });
-  if (recipe.digest !== target.disposition.recipeDigest || recipe.observation.digest !== target.disposition.observationDigest || recipe.agentProvider?.digest !== input.agentProvider.digest) {
-    throw new Error("parent Agent recipe differs from its admission");
-  }
-  return recipe;
-}
-async function revalidateProviderSupport(recipe, provider) {
-  const [mechanism] = await Promise.all([
-    recipe.backend.observeMechanism(),
-    revalidatePrivateInstalledBunSupport(recipe.installedSupport),
-    provider.kind === "private-acp-agent-provider/1" ? revalidatePrivateAcpAgentProvider(provider) : Promise.resolve()
-  ]);
-  if (mechanism.support.digest !== recipe.mechanismDigest || provider.kind === "private-openai-agent-provider/1" && recipe.installedSupport.agentWorkerDigest !== provider.workerDigest || recipe.agentProvider?.digest !== provider.digest) {
-    throw new Error("Agent provider support changed after admission");
-  }
-}
-function backendPlan2(recipe, provider, deadlineUnixMs, identity2) {
-  const acp = provider.kind === "private-acp-agent-provider/1" ? privateAcpAgentRuntime(provider) : undefined;
-  return Object.freeze({
-    runId: `agent-${identity2.slice(0, 42)}`,
-    limits: Object.freeze({
-      ...recipe.resourceCeilings,
-      pids: Math.max(recipe.resourceCeilings.pids, AGENT_PROVIDER_MINIMUM_PIDS),
-      deadlineUnixMs,
-      cancellationGraceMs: CANCELLATION_GRACE_MS2
-    }),
-    readOnlyMounts: Object.freeze([
-      ...recipe.installedSupport.runtimeMounts,
-      { source: "/etc/resolv.conf", destination: "/etc/resolv.conf" },
-      ...acp === undefined ? [{
-        source: recipe.installedSupport.agentWorkerPath,
-        destination: recipe.installedSupport.sandboxAgentWorkerPath
-      }] : [
-        { source: acp.adapterPath, destination: acp.sandboxAdapterPath },
-        { source: acp.executablePath, destination: acp.sandboxExecutablePath },
-        ...acp.readOnlyMounts
-      ]
-    ]),
-    command: Object.freeze(acp === undefined ? [
-      recipe.sandboxExecutablePath,
-      ...recipe.bunPolicy,
-      recipe.installedSupport.sandboxAgentWorkerPath
-    ] : [recipe.sandboxExecutablePath, ...recipe.bunPolicy, acp.sandboxAdapterPath]),
-    ...acp === undefined ? {} : { environment: acp.environment },
-    network: "inherited",
-    ...acp?.nestedUserNamespaces === true ? { nestedUserNamespaces: true } : {}
-  });
-}
-async function interactWithProvider(component, provider, prepared, signal) {
-  if (provider.kind === "private-acp-agent-provider/1") {
-    return await interactWithAcpProvider(component, provider, prepared, signal);
-  }
-  return await interactWithOpenAIProvider(component, provider, prepared);
-}
-async function interactWithOpenAIProvider(component, provider, prepared) {
-  const output = collectBounded3(component.stdout, PRIVATE_OPENAI_AGENT_RESPONSE_BYTES);
-  const stderr = discardBounded(component.stderr, PROVIDER_STDERR_BYTES);
-  try {
-    await component.write(encodePrivateOpenAIAgentRequest({
-      protocol: PRIVATE_OPENAI_AGENT_PROTOCOL,
-      apiKey: privateOpenAIAgentCredential(provider),
-      api: provider.api,
-      baseURL: provider.baseURL,
-      model: provider.model,
-      instructions: prepared.instructions,
-      ...prepared.responseSchema === undefined ? {} : {
-        responseSchema: prepared.responseSchema
-      }
-    }));
-    await component.closeInput();
-    const [bytes, fence] = await Promise.all([output, component.enforcement, stderr]).then(([bytes2, fence2]) => [bytes2, fence2]);
-    let response;
-    try {
-      response = decodePrivateOpenAIAgentResponse(bytes);
-    } catch {
-      return Object.freeze({
-        fence,
-        failure: "AGENT_PROVIDER_RESPONSE_INVALID",
-        cancelled: false
-      });
-    }
-    return response.status === "error" ? Object.freeze({ fence, failure: response.code, cancelled: false }) : Object.freeze({ fence, value: response.value, cancelled: false });
-  } catch (error49) {
-    await component.terminate().catch(() => {
-      return;
-    });
-    await Promise.allSettled([output, stderr, component.enforcement]);
-    throw error49;
-  }
-}
-async function interactWithAcpProvider(component, provider, prepared, signal) {
-  const runtime = privateAcpAgentRuntime(provider);
-  const stderr = discardBounded(component.stderr, PROVIDER_STDERR_BYTES);
-  try {
-    if (runtime.startupInput !== undefined) {
-      await component.write(runtime.startupInput());
-    }
-    const turn = await runPrivateAcpTurn(privateAcpComponentStream(component), {
-      cwd: "/work",
-      instructions: prepared.instructions,
-      signal,
-      configuration: runtime.configuration,
-      ...runtime.modeId === undefined ? {} : { modeId: runtime.modeId },
-      ...runtime.sessionMeta === undefined ? {} : { sessionMeta: runtime.sessionMeta },
-      ...runtime.authentication === undefined ? {} : {
-        authentication: {
-          request: runtime.authentication.request,
-          ...runtime.authentication.clientAuthCapabilities === undefined ? {} : {
-            clientAuthCapabilities: runtime.authentication.clientAuthCapabilities
-          }
-        }
-      }
-    });
-    await component.closeInput();
-    const [fence] = await Promise.all([component.enforcement, stderr]);
-    if (turn.stopReason === "cancelled") {
-      return Object.freeze({ fence, cancelled: true });
-    }
-    try {
-      return Object.freeze({
-        fence,
-        value: acpResultValue(turn, prepared.responseSchema !== undefined),
-        cancelled: false
-      });
-    } catch {
-      return Object.freeze({
-        fence,
-        failure: "AGENT_PROVIDER_RESPONSE_INVALID",
-        cancelled: false
-      });
-    }
-  } catch (error49) {
-    await component.terminate().catch(() => {
-      return;
-    });
-    await Promise.allSettled([stderr, component.enforcement]);
-    if (error49 instanceof PrivateAcpProtocolError) {
-      throw error49;
-    }
-    throw error49;
-  }
-}
-function acpResultValue(turn, structuredRequested) {
-  const outcome = turn.stopReason === "end_turn" ? "completed" : turn.stopReason === "refusal" ? "blocked" : "limit";
-  if (!structuredRequested || outcome !== "completed") {
-    return Object.freeze({ outcome, text: turn.text });
-  }
-  return Object.freeze({
-    outcome,
-    text: turn.text,
-    structured: decodePrivateAcpStructuredText(turn.text)
-  });
-}
-function decodePrivateAcpStructuredText(text) {
-  try {
-    return decodeJson1(encoder11.encode(text));
-  } catch (rawError) {
-    const match = /^```json\r?\n([\s\S]*)\r?\n```$/.exec(text.trim());
-    if (match === null)
-      throw rawError;
-    return decodeJson1(encoder11.encode(match[1]));
-  }
-}
-async function releaseKnownAgent(input, lifecycleValue, fence) {
-  let lifecycle = lifecycleValue;
-  const sandbox = parseSandbox2(lifecycle);
-  lifecycle = await recordPrivateRootChildFence({
-    coordinator: input.coordinator,
-    projectRoot: input.projectRoot,
-    parentRunId: lifecycle.parentRunId,
-    operationId: lifecycle.operationId,
-    allocationDigest: lifecycle.allocation.digest,
-    sandboxDigest: lifecycle.sandbox.digest,
-    fence
-  });
-  const ownerRelease = await releasePrivateLinuxOwnerState(sandbox.owner, fence);
-  const cleanup = agentCleanup(ownerRelease);
-  lifecycle = await recordPrivateRootChildCleanup({
-    coordinator: input.coordinator,
-    projectRoot: input.projectRoot,
-    parentRunId: lifecycle.parentRunId,
-    operationId: lifecycle.operationId,
-    allocationDigest: lifecycle.allocation.digest,
-    sandboxDigest: lifecycle.sandbox.digest,
-    fenceDigest: lifecycle.fence.digest,
-    cleanup
-  });
-  await closePrivateRootChildOwner({
-    coordinator: input.coordinator,
-    projectRoot: input.projectRoot,
-    parentRunId: lifecycle.parentRunId,
-    operationId: lifecycle.operationId,
-    allocationDigest: lifecycle.allocation.digest,
-    sandboxDigest: lifecycle.sandbox.digest,
-    fenceDigest: lifecycle.fence.digest,
-    cleanupDigest: lifecycle.cleanup.digest
-  });
-}
 async function findLifecycle2(input, operationId) {
   return (await listPrivateRootChildOwners({
     coordinator: input.coordinator,
     projectRoot: input.projectRoot,
     parentRunId: input.parent.run.runId
-  })).find((item) => item.operationId === operationId);
+  })).find((item) => item.parentOperationId === undefined && item.operationId === operationId);
 }
 function parseAllocation3(lifecycle) {
   const value = exactObject5(lifecycle.allocation.value, [
@@ -59549,33 +59812,31 @@ function parseAllocation3(lifecycle) {
     "parentRunId",
     "coordinatorEpoch",
     "operationId",
-    "parentRequestDigest",
     "requestDigest",
-    "providerDigest",
     "effectiveDeadlineUnixMs",
+    "packageAllocation",
     "ownerAllocation"
-  ], "Agent allocation");
-  if (value.kind !== ALLOCATION_KIND3 || value.parentRunId !== lifecycle.parentRunId || value.operationId !== lifecycle.operationId || typeof value.coordinatorEpoch !== "number" || !Number.isSafeInteger(value.coordinatorEpoch) || value.coordinatorEpoch < 1 || !isDigest(value.parentRequestDigest) || !isDigest(value.requestDigest) || !isDigest(value.providerDigest) || typeof value.effectiveDeadlineUnixMs !== "number" || !Number.isSafeInteger(value.effectiveDeadlineUnixMs) || value.effectiveDeadlineUnixMs < 0) {
-    throw new TypeError("Agent allocation is invalid");
+  ], "child allocation");
+  if (value.kind !== ALLOCATION_KIND3 || lifecycle.parentOperationId !== undefined || value.parentRunId !== lifecycle.parentRunId || value.operationId !== lifecycle.operationId || typeof value.coordinatorEpoch !== "number" || !Number.isSafeInteger(value.coordinatorEpoch) || value.coordinatorEpoch < 1 || typeof value.requestDigest !== "string" || typeof value.effectiveDeadlineUnixMs !== "number" || !Number.isSafeInteger(value.effectiveDeadlineUnixMs) || value.effectiveDeadlineUnixMs < 0) {
+    throw new TypeError("child allocation is invalid");
   }
   return Object.freeze({
     kind: ALLOCATION_KIND3,
     parentRunId: value.parentRunId,
     coordinatorEpoch: value.coordinatorEpoch,
     operationId: value.operationId,
-    parentRequestDigest: value.parentRequestDigest,
     requestDigest: value.requestDigest,
-    providerDigest: value.providerDigest,
     effectiveDeadlineUnixMs: value.effectiveDeadlineUnixMs,
+    packageAllocation: normalizePrivatePackageMaterializationAllocationIdentity(value.packageAllocation),
     ownerAllocation: normalizePrivateLinuxOwnerStateAllocationIdentity(value.ownerAllocation)
   });
 }
 function parseSandbox2(lifecycle) {
   if (lifecycle.sandbox === undefined)
-    throw new TypeError("Agent sandbox owner is absent");
-  const value = exactObject5(lifecycle.sandbox.value, ["kind", "owner"], "Agent sandbox");
+    throw new TypeError("child sandbox owner is absent");
+  const value = exactObject5(lifecycle.sandbox.value, ["kind", "owner"], "child sandbox");
   if (value.kind !== SANDBOX_KIND2)
-    throw new TypeError("Agent sandbox kind is invalid");
+    throw new TypeError("child sandbox kind is invalid");
   return Object.freeze({
     kind: SANDBOX_KIND2,
     owner: normalizePrivateLinuxSealedOwnerIdentity(value.owner)
@@ -59583,74 +59844,46 @@ function parseSandbox2(lifecycle) {
 }
 function parseFence2(lifecycle) {
   if (lifecycle.fence === undefined)
-    throw new TypeError("Agent fence is absent");
+    throw new TypeError("child fence is absent");
   return normalizePrivateLinuxConfirmedEnforcementReceipt(lifecycle.fence.value);
 }
-function agentCleanup(ownerRelease) {
-  return Object.freeze({ kind: CLEANUP_KIND2, ownerRelease });
+function childCleanup(ownerRelease) {
+  return Object.freeze({
+    kind: CLEANUP_KIND2,
+    packageReleased: true,
+    ownerRelease
+  });
 }
 function parseCleanup2(lifecycle) {
   if (lifecycle.cleanup === undefined)
-    throw new TypeError("Agent cleanup is absent");
-  const value = exactObject5(lifecycle.cleanup.value, ["kind", "ownerRelease"], "Agent cleanup");
-  if (value.kind !== CLEANUP_KIND2)
-    throw new TypeError("Agent cleanup kind is invalid");
-  return agentCleanup(normalizePrivateLinuxOwnerStateReleaseReceipt(value.ownerRelease));
+    throw new TypeError("child cleanup is absent");
+  const value = exactObject5(lifecycle.cleanup.value, ["kind", "ownerRelease", "packageReleased"], "child cleanup");
+  if (value.kind !== CLEANUP_KIND2 || value.packageReleased !== true) {
+    throw new TypeError("child cleanup is invalid");
+  }
+  return childCleanup(normalizePrivateLinuxOwnerStateReleaseReceipt(value.ownerRelease));
 }
 function requireCleanupMatches2(lifecycle, expected) {
   const actual = parseCleanup2(lifecycle);
   if (actual.ownerRelease.digest !== expected.ownerRelease.digest) {
-    throw new Error("durable Agent cleanup differs from the released owner");
+    throw new Error("durable child cleanup differs from the released owner");
   }
 }
 async function requireAllocationMatchesParent2(input, lifecycle, allocation) {
-  const target = requireParentTarget(input.parent);
-  if (allocation.parentRunId !== input.parent.run.runId || allocation.coordinatorEpoch !== input.parent.run.coordinatorEpoch || allocation.operationId !== lifecycle.operationId || allocation.parentRequestDigest !== target.request.digest || allocation.effectiveDeadlineUnixMs > input.parent.intent.deadlineUnixMs || Object.values(target.request.capabilities).length !== 1 || Object.values(target.request.capabilities)[0]?.digest !== AGENT_RUN_CONTRACT_DIGEST) {
-    throw new Error("durable Agent allocation differs from its admitted parent or provider");
-  }
-  const ownerParent = await protectedOwnerRoot(input.projectRoot);
-  const identity2 = agentIdentity(lifecycle.parentRunId, lifecycle.operationId);
-  if (allocation.ownerAllocation.parent !== ownerParent || allocation.ownerAllocation.name !== `a-${identity2.slice(0, 62)}`) {
-    throw new Error("durable Agent allocation differs from its admitted owner resource");
-  }
-}
-function providerFailure(code) {
-  if (code === "AGENT_PROVIDER_OUTPUT_LIMIT") {
-    return failed2("RESOURCE_EXHAUSTED", "the Agent provider result exceeded its fixed bound");
-  }
-  if (code === "AGENT_PROVIDER_RESPONSE_INVALID") {
-    return failed2("INVALID_RESULT", "the Agent provider returned an invalid result");
-  }
-  return failed2("EXECUTION_FAILED", "the Agent provider request failed");
-}
-async function collectBounded3(source, maximum) {
-  const chunks = [];
-  let total = 0;
-  for await (const chunk of source) {
-    total += chunk.byteLength;
-    if (total > maximum)
-      throw new Error("Agent provider output exceeds its byte bound");
-    chunks.push(Uint8Array.from(chunk));
+  const parentTarget = findPrivateActivationCandidateTargetV5(input.parent.candidate, input.parent.run.target);
+  if (parentTarget === undefined || parentTarget.request.digest !== input.parent.intent.requestDigest || allocation.parentRunId !== input.parent.run.runId || allocation.coordinatorEpoch !== input.parent.run.coordinatorEpoch || allocation.operationId !== lifecycle.operationId || allocation.effectiveDeadlineUnixMs > input.parent.intent.deadlineUnixMs) {
+    throw new Error("durable child allocation differs from its parent Run");
   }
-  const output = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) {
-    output.set(chunk, offset);
-    offset += chunk.byteLength;
+  const selected = Object.values(parentTarget.request.flowSlots).map((target) => findPrivateActivationCandidateTargetV5(input.parent.candidate, target)).find((target) => target?.request.digest === allocation.requestDigest);
+  if (selected === undefined || selected.disposition.state !== "ready" || Object.keys(selected.request.flowSlots).length !== 0) {
+    throw new Error("durable child allocation is not an admitted leaf Flow");
   }
-  return output;
-}
-async function discardBounded(source, maximum) {
-  let total = 0;
-  for await (const chunk of source) {
-    total += chunk.byteLength;
-    if (total > maximum)
-      throw new Error("Agent provider diagnostics exceed their byte bound");
+  const roots = await protectedWorkRoots(input.projectRoot);
+  const identity2 = childIdentity(lifecycle.parentRunId, lifecycle.operationId);
+  if (allocation.packageAllocation.parent.path !== roots.materializations || allocation.packageAllocation.name !== `child-${identity2.slice(0, 48)}` || allocation.packageAllocation.packageDigest !== selected.disposition.executionPackage.digest || allocation.packageAllocation.ownerToken !== `sha256:${identity2}` || allocation.ownerAllocation.parent !== roots.owners || allocation.ownerAllocation.name !== `c-${identity2.slice(0, 47)}`) {
+    throw new Error("durable child allocation differs from its admitted resources");
   }
-}
-async function cancelUnusedAllocation(allocation) {
-  const cancelled = await cancelPrivateLinuxOwnerStateAllocation(allocation);
-  await releasePrivateLinuxOwnerState(allocation, cancelled);
+  return selected;
 }
 function exactObject5(value, fields, label) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) {
@@ -59664,28 +59897,43 @@ function exactObject5(value, fields, label) {
   }
   return record3;
 }
-function agentIdentity(parentRunId, operationId) {
-  return privateDomainDigest("JIG-Private-Root-Agent-Identity/1", {
+function childIdentity(parentRunId, operationId) {
+  return privateDomainDigest("JIG-Private-Root-Child-Identity/1", {
     parentRunId,
     operationId
   }).slice("sha256:".length);
 }
-async function protectedOwnerRoot(projectRoot) {
-  const state2 = await realpath11(join12(projectRoot, ".jig"));
+async function protectedWorkRoots(projectRoot) {
+  const state2 = await realpath12(join12(projectRoot, ".jig"));
+  const materializations = join12(state2, "private-root-materializations");
   const owners = join12(state2, "private-root-linux-owners");
-  await mkdir9(owners, { mode: 448 }).catch((error49) => {
+  await Promise.all([ensureProtectedDirectory(materializations), ensureProtectedDirectory(owners)]);
+  return Object.freeze({ materializations, owners });
+}
+async function ensureProtectedDirectory(path2) {
+  await mkdir9(path2, { mode: 448 }).catch((error49) => {
     if (!hasCode7(error49, "EEXIST"))
       throw error49;
   });
-  const information = await lstat17(owners);
+  const information = await lstat17(path2);
   const uid = typeof process.getuid === "function" ? process.getuid() : -1;
-  if (!information.isDirectory() || information.isSymbolicLink() || information.uid !== uid || (information.mode & 63) !== 0 || await realpath11(owners) !== owners) {
-    throw new Error("Agent execution owner directory is not protected");
+  if (!information.isDirectory() || information.isSymbolicLink() || information.uid !== uid || (information.mode & 63) !== 0 || await realpath12(path2) !== path2) {
+    throw new Error("child execution owner directory is not protected");
   }
-  return owners;
 }
-function isDigest(value) {
-  return typeof value === "string" && DIGEST11.test(value);
+function startupSignal(signal) {
+  const controller = new AbortController;
+  const abort = () => controller.abort(signal.reason);
+  if (signal.aborted)
+    abort();
+  else
+    signal.addEventListener("abort", abort, { once: true });
+  return Object.freeze({
+    signal: controller.signal,
+    dispose() {
+      signal.removeEventListener("abort", abort);
+    }
+  });
 }
 function failed2(code, message, details) {
   return Object.freeze({
@@ -59699,9 +59947,6 @@ function hasCode7(error49, code) {
   return error49 !== null && typeof error49 === "object" && error49.code === code;
 }
 
-class AgentInstructionLimitError extends Error {
-}
-
 // src/internal/root-run-controller.ts
 var PLAN_KIND = "private-direct-root-plan/1";
 var BACKING_KIND = "private-direct-root-backing/1";
@@ -60196,7 +60441,7 @@ async function reacquire(input) {
   });
 }
 async function protectedWorkRoots2(projectRoot) {
-  const state2 = await realpath12(join13(projectRoot, ".jig"));
+  const state2 = await realpath13(join13(projectRoot, ".jig"));
   const materializations = join13(state2, "private-root-materializations");
   const owners = join13(state2, "private-root-linux-owners");
   await Promise.all([ensureProtectedDirectory2(materializations), ensureProtectedDirectory2(owners)]);
@@ -60209,7 +60454,7 @@ async function ensureProtectedDirectory2(path2) {
   });
   const information = await lstat18(path2);
   const uid = typeof process.getuid === "function" ? process.getuid() : -1;
-  if (!information.isDirectory() || information.isSymbolicLink() || information.uid !== uid || (information.mode & 63) !== 0 || await realpath12(path2) !== path2) {
+  if (!information.isDirectory() || information.isSymbolicLink() || information.uid !== uid || (information.mode & 63) !== 0 || await realpath13(path2) !== path2) {
     throw new Error("private root execution work directory is not protected");
   }
 }
@@ -60905,13 +61150,16 @@ function projectError2(error49, operation) {
   return new ProjectAdministrationError("INTERNAL", `${operation} failed`);
 }
 function scopePrivatePackagePlanningError(error49, packagePath) {
-  if (!(error49 instanceof CheckError) || error49.kind !== "unavailable" || error49.code !== "PACKAGE_BUN_SOURCE_UNSUPPORTED" || error49.path !== "bun.lock") {
+  if (!(error49 instanceof CheckError) || error49.kind !== "unavailable") {
     return error49;
   }
-  return new CheckError(error49.kind, error49.code, error49.message, `${packagePath}/bun.lock`, error49.pointer);
+  const relativePath = error49.code === "PACKAGE_BUN_SOURCE_UNSUPPORTED" && error49.path === "bun.lock" ? "bun.lock" : error49.code === "PACKAGE_BUN_PREPARATION_FAILED" && error49.path === undefined ? "package.json" : undefined;
+  if (relativePath === undefined)
+    return error49;
+  return new CheckError(error49.kind, error49.code, error49.message, `${packagePath}/${relativePath}`, error49.pointer);
 }
 function isUnavailableDiagnosticCode(code) {
-  return code === "PACKAGE_BUN_SOURCE_UNSUPPORTED";
+  return code === "PACKAGE_BUN_SOURCE_UNSUPPORTED" || code === "PACKAGE_BUN_PREPARATION_FAILED" || code === "PROJECT_AGENT_UNAVAILABLE";
 }
 function isCandidateDiagnosticCode(code) {
   return code.startsWith("CAPABILITY_") || code.startsWith("METADATA_") || code.startsWith("SCHEMA_") || code.startsWith("PACKAGE_BUN_") || code.startsWith("PROJECT_BINDING_") || code.startsWith("PROJECT_DECLARATION_") || code.startsWith("PROJECT_EVALUATION_") || code.startsWith("PROJECT_EVALUATOR_") || code.startsWith("PROJECT_MEMBER_") || code.startsWith("PROJECT_SOURCE_") || [
@@ -60954,10 +61202,10 @@ var BUN_POLICY5 = Object.freeze([
   "--no-install",
   "--config=/dev/null"
 ]);
-var installedCliPath = await realpath13(fileURLToPath2(import.meta.url));
+var installedCliPath = await realpath14(fileURLToPath2(import.meta.url));
 var releaseRoot = dirname7(dirname7(installedCliPath));
-var executablePath = await realpath13(process.execPath);
-if (process.argv[0] !== executablePath || process.argv[1] !== installedCliPath || await realpath13("/proc/self/exe") !== executablePath || process.execArgv.length !== BUN_POLICY5.length || process.execArgv.some((value, index) => value !== BUN_POLICY5[index])) {
+var executablePath = await realpath14(process.execPath);
+if (process.argv[0] !== executablePath || process.argv[1] !== installedCliPath || await realpath14("/proc/self/exe") !== executablePath || process.execArgv.length !== BUN_POLICY5.length || process.execArgv.some((value, index) => value !== BUN_POLICY5[index])) {
   throw new Error("the installed Jig command has an invalid startup posture");
 }
 async function runPrivateInstalledCli(arguments_ = process.argv.slice(2), signal) {
@@ -60971,7 +61219,7 @@ async function runPrivateInstalledCli(arguments_ = process.argv.slice(2), signal
     if (delegation.kind === "private-rootless-linux-reexecuted/1")
       return delegation;
     const installedHost = await openPrivateInstalledBunHost({
-      releaseRoot: await realpath13(releaseRoot),
+      releaseRoot: await realpath14(releaseRoot),
       executablePath,
       installedCliPath
     });