@tangle-network/agent-runtime 0.153.1 → 0.155.0

package/dist/{supervisor-DBVlPONC.js → supervisor-BmXD0WCJ.js}

@@ -1,12 +1,12 @@
-import { C as unknownExecutionBindingReceipt, S as runtimeOwnedScopeOwnerRuntime, a as authoredProfileDigest, b as runtimeOwnedExecutorProviderEvidence, c as knownExecutionBindingReceipt, f as recordRuntimeOwnedProviderAttemptStart, g as runtimeOwnedDeferredExecutorRuntime, h as recordRuntimeOwnedProviderModel, l as knownMaterializationReceipt, m as recordRuntimeOwnedProviderIdentityConflict, n as attestRuntimeOwnedExecutor, o as finalizeRuntimeOwnedPendingExecutor, p as recordRuntimeOwnedProviderDispatchNotStarted, r as attestRuntimeOwnedPendingExecutor, s as inheritRuntimeOwnedExecutorAttestation, t as attestRuntimeOwnedDeferredExecutor, u as newExecutionAttemptId, v as runtimeOwnedExecutorExecutionBinding, w as unknownMaterializationReceipt, x as runtimeOwnedPendingExecutorMaterialization, y as runtimeOwnedExecutorMaterialization } from "./materialization-Bo6j3Hg9.js";
+import { C as runtimeOwnedScopeOwnerRuntime, S as runtimeOwnedPendingExecutorMaterialization, T as unknownMaterializationReceipt, _ as runtimeOwnedDeferredExecutorRuntime, a as authoredProfileDigest, b as runtimeOwnedExecutorMaterialization, c as knownExecutionBindingReceipt, g as recordRuntimeOwnedProviderModel, h as recordRuntimeOwnedProviderIdentityConflict, l as knownMaterializationReceipt, m as recordRuntimeOwnedProviderDispatchNotStarted, n as attestRuntimeOwnedExecutor, o as finalizeRuntimeOwnedPendingExecutor, p as recordRuntimeOwnedProviderAttemptStart, r as attestRuntimeOwnedPendingExecutor, s as inheritRuntimeOwnedExecutorAttestation, t as attestRuntimeOwnedDeferredExecutor, u as newExecutionAttemptId, w as unknownExecutionBindingReceipt, x as runtimeOwnedExecutorProviderEvidence, y as runtimeOwnedExecutorExecutionBinding } from "./materialization-Ct3I4wu3.js";
 import { f as RuntimeRunStateError, m as ValidationError, r as BackendTransportError } from "./errors-CDZ8XsVj.js";
-import { t as detachedSnapshot } from "./snapshot-cK9K420n.js";
-import { S as contentAddress, a as aggregateProviderModelEvidence, c as pendingWaits, g as runtimeOwnedNestedDriverTreeRoot, h as nestedDriverTreeRoot, l as replaySpawnTree, m as driverRuntime, o as loadSpawnForest, p as attestNestedDriverTreeOwner, s as materializeTreeView, v as captureWorkerTraceEvidence } from "./spawn-journal-CLguaA2A.js";
-import { _ as withTimeout, a as cloneTokenUsage, d as randomSuffix, f as randomUuid, g as throwIfAborted, h as throwAbort, l as mapWithConcurrency, m as stringifySafe, n as addTokenUsage, o as deleteBoxSafe, p as sleep, r as chargedTokens, s as hasCompleteCacheBreakdown, t as addSpend, u as promptCacheTokenClasses, v as zeroSpend, y as zeroTokenUsage } from "./util-Bncw0o_F.js";
-import { c as sandboxEventServedBackend, i as extractLlmCallEvent, l as sandboxProgressEvents, o as mapSandboxToolEvent, r as createSandboxToolPartState, s as notifySandboxEventObserver, t as assertSandboxServedModel } from "./sandbox-events-DMijDq2p.js";
-import { n as executableAgentSpecSnapshot, r as projectSandboxOutcome, t as executableAgentProfileSnapshot } from "./executable-spec-BUcUcEPk.js";
+import { n as detachedSnapshot } from "./snapshot-CTAf4uuA.js";
+import { _ as captureWorkerTraceEvidence, a as aggregateProviderModelEvidence, c as loadSpawnForest, d as replaySpawnTree, f as attestNestedDriverTreeOwner, h as runtimeOwnedNestedDriverTreeRoot, l as materializeTreeView, m as nestedDriverTreeRoot, o as closesCursorSlot, p as driverRuntime, u as pendingWaits, x as contentAddress } from "./spawn-journal-duo0EkOp.js";
+import { _ as unmeteredSpend, a as cloneTokenUsage, b as zeroTokenUsage, d as randomSuffix, f as randomUuid, g as throwIfAborted, h as throwAbort, l as mapWithConcurrency, m as stringifySafe, n as addTokenUsage, o as deleteBoxSafe, p as sleep, r as chargedTokens, s as hasCompleteCacheBreakdown, t as addSpend, u as promptCacheTokenClasses, v as withTimeout, y as zeroSpend } from "./util-D6ZEuBMi.js";
+import { c as notifySandboxEventObserver, i as extractLlmCallEvent, l as sandboxEventServedBackend, r as createSandboxToolPartState, s as mapSandboxToolEvent, t as assertSandboxServedModel, u as sandboxProgressEvents } from "./sandbox-events-BVjstFgb.js";
+import { n as executableAgentSpecSnapshot, r as projectSandboxOutcome, t as executableAgentProfileSnapshot } from "./executable-spec-7ovS7PBo.js";
 import { a as concreteProfileModel, c as profileModelExecutionSettings, d as agentHarness, o as enforceTokenLimits, s as profileBridgeWireModel, t as assertExecutableAgentProfile, u as resolveRouterRetryPolicy } from "./model-policy-Sw4ywhtL.js";
-import { i as resolveAgentEnvironmentProvider, n as providerAsExecutor, r as providerAsSandboxClient } from "./environment-provider-D_MXw3jK.js";
+import { c as linkAbort, i as resolveAgentEnvironmentProvider, l as runAbortable, n as providerAsExecutor, r as providerAsSandboxClient, s as abortError } from "./environment-provider-Dz9JB-X_.js";
 import { i as notifyRuntimeHookEvent } from "./runtime-hooks-tXpAarhW.js";
 import { AGENT_PROFILE_MATERIALIZATION_AXES, AgentTurnInputSchema, REASONING_EFFORTS, agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, profileMaterializationAxes, profileMaterializationAxes as profileMaterializationAxes$1, renderInputPartsAsText, sha256DigestSchema } from "@tangle-network/agent-interface";
 import { estimateCost, isModelPriced } from "@tangle-network/agent-eval";
@@ -5274,6 +5274,36 @@ function priceUnreceiptedWork(work) {
 	};
 }
 //#endregion
+//#region src/runtime/supervise/node-status.ts
+/**
+* Which {@link NodeStatus} values mean the node is finished.
+*
+* `'waiting'` is deliberately NOT terminal: a wait-state node holds no executor, no box and no
+* conserved budget, so it is neither in flight nor settled. Callers that must also exclude it say
+* so at their own site, because "finished" and "not a live worker" are different questions.
+*/
+const terminalNodeStatuses = /* @__PURE__ */ new Set([
+	"done",
+	"failed",
+	"cancelled"
+]);
+/**
+* True once a node has reached a terminal status.
+*
+* The single owner of this rule. Written per call site it drifts silently: a status added to
+* `NodeStatus` is classified by whichever sites the author remembered, and the ones they missed
+* keep a dead node in the live set — a stop rule that never fires, mail delivered to a worker that
+* cannot read it, or a cancel answered `not_live` for a node that is still running.
+*/
+function isTerminalNodeStatus(status) {
+	return terminalNodeStatuses.has(status);
+}
+/** True while a node has not yet reached a terminal status. The complement of
+*  {@link isTerminalNodeStatus}, so the two can never disagree. */
+function isLiveNodeStatus(status) {
+	return !terminalNodeStatuses.has(status);
+}
+//#endregion
 //#region src/runtime/supervise/peer-mail.ts
 /**
 *
@@ -5359,7 +5389,6 @@ function isPeerMailEnvelope(value) {
 function isPeerMailKind(value) {
 	return value === "ask" || value === "tell" || value === "challenge" || value === "answer";
 }
-const isLiveStatus = (status) => status !== "done" && status !== "failed" && status !== "cancelled";
 /** Create the run's post office. One per manager scope; the manager's siblings are its addresses. */
 function createPeerMailbox(opts) {
 	const limits = Object.freeze({
@@ -5399,7 +5428,7 @@ function createPeerMailbox(opts) {
 		await opts.publish(event);
 		return event;
 	};
-	const liveNodes = () => opts.scope.view.nodes.filter((node) => isLiveStatus(node.status));
+	const liveNodes = () => opts.scope.view.nodes.filter((node) => isLiveNodeStatus(node.status));
 	const mailbox = {
 		limits,
 		setEndpoint(baseUrl) {
@@ -5474,7 +5503,7 @@ function createPeerMailbox(opts) {
 			if (opts.scope.signal.aborted) return record(envelope, "scope-stopped");
 			const node = opts.scope.view.nodes.find((candidate) => candidate.id === to);
 			if (node === void 0) return record(envelope, "unknown-worker");
-			if (!isLiveStatus(node.status)) return record(envelope, "already-settled");
+			if (!isLiveNodeStatus(node.status)) return record(envelope, "already-settled");
 			let delivered = false;
 			try {
 				delivered = opts.scope.send(to, { [PEER_MAIL_WIRE_KEY]: envelope });
@@ -5701,6 +5730,29 @@ function createInbox() {
 }
 //#endregion
 //#region src/runtime/supervise/progress.ts
+/**
+*
+* The LIVE read-model of a still-RUNNING worker — what a driver can see BEFORE the worker settles.
+*
+* Until this existed, `observe_agent` on a running worker returned `{status:'running', spent:{0,0},
+* outRef:null, output:null}`: nothing a brain could act on, so a brain that wanted to steer had no
+* evidence to steer FROM. This is the other half of the steering wire (the first half is
+* `Executor.deliver`): a supervisor cannot correct a worker it cannot watch.
+*
+* Two layers, both pull-based — no timer, no background task, so it is safe to leave on:
+*
+*   - The SCOPE layer, available for EVERY executor with no executor cooperation at all: usage
+*     events are timestamped as they arrive, so `lastActivityAt` / `idleMs` / `stalled` /
+*     `tokens` / `turns` are derived from the stream the conserved pool already meters.
+*   - The EXECUTOR layer, optional enrichment via `Executor.progress()`: the tool/file activity
+*     the harness exposes, its own turn count, and how many steers are queued but unread.
+*
+* `stalled` is a DERIVED read, computed at observation time against `stallAfterMs` — never a
+* background watchdog. A worker that has produced no metered activity for longer than the
+* threshold reads `stalled: true`; nothing is killed, nothing is retried. The driver decides.
+*
+* @experimental
+*/
 /** How long a worker may produce no metered activity before a `progress()` read calls it stalled.
 *  Deliberately generous: a coding harness routinely spends minutes inside one tool call, and a
 *  false stall that provokes a steer is worse than a late one. */
@@ -5743,7 +5795,7 @@ function createActivityLog(limit = 12) {
 /** Fold the scope-derived facts and the executor's optional enrichment into one read. Pure: the
 *  caller supplies `now`, so a test can observe a stall without waiting for one. */
 function readWorkerProgress(scope, executor, now, stallAfterMs = DEFAULT_STALL_AFTER_MS) {
-	const live = scope.status !== "done" && scope.status !== "failed" && scope.status !== "cancelled";
+	const live = isLiveNodeStatus(scope.status);
 	const executorActivityAt = executor?.recentActivity?.length ? executor.recentActivity[executor.recentActivity.length - 1].at : 0;
 	const lastActivityAt = Math.max(scope.lastActivityAt, executorActivityAt);
 	const idleMs = Math.max(0, now - lastActivityAt);
@@ -5850,15 +5902,21 @@ const decodeOpenAiPart = (p) => {
 		...str(p.id) ? { callId: p.id } : str(fn?.id) ? { callId: fn?.id } : {}
 	};
 };
-/** The harness → decoder registry. Add a harness by adding one entry. */
+/** kimi-code streams BOTH shapes on one session — an Anthropic `tool_use` content block AND a
+*  top-level OpenAI `tool_calls` entry (cli-bridge `kimi.ts` surfaces each from a different part of
+*  the wire). A decoder that reads only one of them drops half of a kimi worker's tool calls, and
+*  drops them silently: the trace simply reports fewer calls. */
+const decodeKimiPart = (p) => decodeAnthropicPart(p) ?? decodeOpenAiPart(p);
+/** The harness → decoder registry. Add a harness by adding one entry.
+*
+*  Keyed by `HarnessType`, the vocabulary the `harness` argument is actually drawn from, so a key
+*  no caller can produce does not compile. `codex` is registered although the bridge's `codex.ts`
+*  never yields `tool_calls`; the entry states which family it would belong to. */
 const toolPartDecoders = {
 	opencode: decodeOpencodePart,
 	"claude-code": decodeAnthropicPart,
-	anthropic: decodeAnthropicPart,
 	codex: decodeOpenAiPart,
-	openai: decodeOpenAiPart,
-	router: decodeOpenAiPart,
-	kimi: decodeOpenAiPart
+	"kimi-code": decodeKimiPart
 };
 /** Decode a part with a specific harness's adapter when known, else try every registered adapter
 *  (the composite — robust to mixed/unknown streams). Never throws. */
@@ -6503,7 +6561,7 @@ function createWorktreeCliExecutor(options) {
 		runtime: "cli",
 		budgetExempt,
 		async execute(task, signal) {
-			const linked = linkSignals$1(signal, controller.signal);
+			const linked = linkAbort(signal, controller.signal).signal;
 			const started = Date.now();
 			const taskPrompt = executionTaskPrompt(task, options.taskPrompt);
 			run = await runWorktreeHarness({
@@ -6628,20 +6686,6 @@ function executionTaskPrompt(task, configuredPrompt) {
 	}
 	throw new ValidationError("createWorktreeCliExecutor: execute task must be JSON-serializable");
 }
-/** Link two abort signals into one that fires when either does. Returns `undefined` when neither
-*  is present so the harness runner gets no signal at all. */
-function linkSignals$1(a, b) {
-	if (a.aborted || b.aborted) {
-		const c = new AbortController();
-		c.abort();
-		return c.signal;
-	}
-	const c = new AbortController();
-	const onAbort = () => c.abort();
-	a.addEventListener("abort", onAbort, { once: true });
-	b.addEventListener("abort", onAbort, { once: true });
-	return c.signal;
-}
 //#endregion
 //#region src/runtime/supervise/runtime.ts
 /**
@@ -6813,36 +6857,6 @@ function contentRef(prefix, value) {
 	return `${prefix}:${(h >>> 0).toString(16).padStart(8, "0")}`;
 }
 /**
-* The spend of work that HAPPENED and reported no usage receipt.
-*
-* Not the same value as a plain zero even though both carry `{0,0}` tokens and `$0`. A bare zero
-* asserts a MEASUREMENT — "this ran and cost nothing" — and every consumer downstream reads it that
-* way: the pool keeps reporting `readout().tokensKnown === true`, the journal totals stay clean, the
-* OTEL span records a priced zero, and a caller's token-denominated ceiling can never fire no matter
-* how much the work really burned. A ceiling that cannot fire is worse than no ceiling, because it
-* reads as protection.
-*
-* `Spend.tokensKnown` is the marker the substrate already threads end to end for exactly this case
-* (`budget.ts`, `otel-spans.ts`, `spawn-journal.ts`, `supervisor.ts`): the work is recorded, the
-* zero is labelled a floor rather than a total, and every rollup that touches it reports its balance
-* as a ceiling rather than a measurement. Use this — never a bare zero — whenever a runtime cannot
-* see what its worker spent.
-*
-* The same rule applies to dollars. A dollar-capped run must refuse an executor whose billed spend
-* is unknowable; `budgetExempt` does not authorize Runtime to relabel unknown spend as a measured
-* zero. Callers that require dollar accounting must use a backend with a trusted billing receipt.
-*/
-function unmeteredSpend(ms) {
-	return {
-		iterations: 0,
-		tokens: zeroTokenUsage(),
-		tokensKnown: false,
-		usd: 0,
-		usdKnown: false,
-		ms
-	};
-}
-/**
 * A direct OpenAI-compatible Router chat-completion. One-shot: resolves a
 * `ExecutorResult` and reports its terminal usage as `UsageEvent`s through the
 * conserved pool. Reports REAL token usage — when the provider omits `usage`,
@@ -6872,12 +6886,7 @@ const routerInlineExecutor = (spec, ctx) => {
 	if (!seam.routerBaseUrl || !seam.routerKey) throw new ValidationError("routerInlineExecutor: RouterSeam.routerBaseUrl + routerKey required");
 	const profileExecution = routerProfileExecution(spec.profile, seam, { multiTurn: false });
 	const requestIdentity = routerRequestIdentity(ctx);
-	const controller = new AbortController();
-	const abortIfSignalled = () => {
-		if (ctx.signal.aborted) controller.abort();
-	};
-	abortIfSignalled();
-	if (!ctx.signal.aborted) ctx.signal.addEventListener("abort", abortIfSignalled, { once: true });
+	const controller = linkAbort(ctx.signal);
 	let artifact;
 	const executionId = ctx.node?.nodeId ?? `router-request-${randomUUID()}`;
 	const attemptId = ctx.node?.attemptId ?? newExecutionAttemptId(executionId);
@@ -6887,7 +6896,7 @@ const routerInlineExecutor = (spec, ctx) => {
 		async execute(task, signal) {
 			const messages = taskToMessages(task, spec, profileExecution.systemPrompt);
 			const started = Date.now();
-			const linked = linkSignals(signal, controller.signal);
+			const linked = linkAbort(signal, controller.signal).signal;
 			const extraBody = {
 				...profileExecution.extraBody ?? {},
 				...profileExecution.reasoningEffort ? { reasoning_effort: profileExecution.reasoningEffort } : {}
@@ -6928,7 +6937,7 @@ const routerInlineExecutor = (spec, ctx) => {
 				tokens: r.usage ? cloneTokenUsage({
 					input: r.usage.input,
 					output: r.usage.output,
-					...routerPromptCacheUsage(r.usage.input, r.cache)
+					...promptCacheTokenClasses(r.usage.input, r.cache)
 				}) : zeroTokenUsage(),
 				usd: r.billedCostUsd ?? 0,
 				...r.usage ? {} : { tokensKnown: false },
@@ -7027,22 +7036,6 @@ function mergePromptCache(target, cache) {
 	}
 	if (cache.status !== void 0) target.status = cache.status;
 }
-/** Preserve a complete Router cache split; an incomplete provider receipt stays unknown. */
-function routerPromptCacheUsage(input, cache) {
-	if (cache === void 0) return {};
-	const read = cache.readTokens;
-	const write = cache.writeTokens;
-	if (read === void 0 && write === void 0) return {};
-	if (input === void 0 || !isCacheTokenCount(read) || !isCacheTokenCount(write) || read + write > input) return { cacheBreakdownKnown: false };
-	return {
-		freshInput: input - read - write,
-		cacheRead: read,
-		cacheWrite: write
-	};
-}
-function isCacheTokenCount(value) {
-	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
 async function runRouterTransport(context, call) {
 	try {
 		return await call();
@@ -7070,12 +7063,7 @@ const routerToolsInlineExecutor = (spec, ctx) => {
 	const enabledToolNames = new Set(seam.tools.map((tool) => tool.function.name));
 	const maxTurns = profileExecution.maxTurns ?? 0;
 	const requestIdentity = routerRequestIdentity(ctx);
-	const controller = new AbortController();
-	const abortIfSignalled = () => {
-		if (ctx.signal.aborted) controller.abort();
-	};
-	abortIfSignalled();
-	if (!ctx.signal.aborted) ctx.signal.addEventListener("abort", abortIfSignalled, { once: true });
+	const controller = linkAbort(ctx.signal);
 	const inbox = createInbox();
 	let artifact;
 	const executionId = ctx.node?.nodeId ?? `router-tools-run-${randomUUID()}`;
@@ -7110,7 +7098,7 @@ const routerToolsInlineExecutor = (spec, ctx) => {
 				});
 				return pending.length > 0;
 			};
-			const external = mergeAbortSignals(signal, controller.signal);
+			const external = linkAbort(signal, controller.signal).signal;
 			try {
 				for (let t = 0; maxTurns === 0 || t < maxTurns; t += 1) {
 					flush();
@@ -7163,12 +7151,12 @@ const routerToolsInlineExecutor = (spec, ctx) => {
 						addTokenUsage(tokens, {
 							input: res.usage.input,
 							output: res.usage.output,
-							...routerPromptCacheUsage(res.usage.input, res.cache)
+							...promptCacheTokenClasses(res.usage.input, res.cache)
 						});
 						if (res.usage.reasoning !== void 0) reasoningTokens += res.usage.reasoning;
 						else reasoningKnown = false;
 					} else {
-						addTokenUsage(tokens, routerPromptCacheUsage(void 0, res.cache));
+						addTokenUsage(tokens, promptCacheTokenClasses(void 0, res.cache));
 						tokensKnown = false;
 						reasoningKnown = false;
 					}
@@ -7386,12 +7374,7 @@ const sandboxExecutor = (spec, ctx) => {
 	if (!Number.isFinite(maxIterations) || maxIterations <= 0) throw new ValidationError("sandboxExecutor: maxIterations must be > 0");
 	const sandboxTokenLimits = enforceTokenLimits(profileModelExecutionSettings(spec.profile, "sandboxExecutor").tokenLimits, "sandbox", "sandboxExecutor");
 	const traceEnv = workerTraceEnv(ctx);
-	const controller = new AbortController();
-	const abortIfSignalled = () => {
-		if (ctx.signal.aborted) controller.abort();
-	};
-	abortIfSignalled();
-	if (!ctx.signal.aborted) ctx.signal.addEventListener("abort", abortIfSignalled, { once: true });
+	const controller = linkAbort(ctx.signal);
 	let artifact;
 	const executionId = ctx.node?.nodeId ?? `sandbox-run-${randomUUID()}`;
 	const attemptId = ctx.node?.attemptId ?? newExecutionAttemptId(executionId);
@@ -7508,14 +7491,7 @@ const sandboxExecutor = (spec, ctx) => {
 	}, sandboxMaterialization, sandboxBinding);
 };
 async function* streamSandboxLeaf(args) {
-	const linked = new AbortController();
-	const cascadeExternal = () => linked.abort(abortReasonOf(args.signal));
-	const cascadeScope = () => linked.abort(abortReasonOf(args.controller.signal));
-	if (args.signal.aborted || args.controller.signal.aborted) linked.abort(abortReasonOf(args.signal.aborted ? args.signal : args.controller.signal));
-	else {
-		args.signal.addEventListener("abort", cascadeExternal, { once: true });
-		args.controller.signal.addEventListener("abort", cascadeScope, { once: true });
-	}
+	const linked = linkAbort(args.signal, args.controller.signal);
 	const agentRun = {
 		profile: args.spec.profile,
 		taskToPrompt: (t) => taskToPrompt(t),
@@ -7603,8 +7579,7 @@ async function* streamSandboxLeaf(args) {
 			provenance: "uncaptured"
 		};
 	} finally {
-		args.signal.removeEventListener("abort", cascadeExternal);
-		args.controller.signal.removeEventListener("abort", cascadeScope);
+		linked.release();
 	}
 }
 /** The loop's own failure, when NO iteration produced an output: the first error it
@@ -7650,12 +7625,7 @@ const cliExecutor = (_spec, ctx) => {
 	const seam = readSeam(ctx, cliSeamKey, "cli");
 	if (!seam.bin) throw new ValidationError("cliExecutor: CliSeam.bin required");
 	const traceEnv = workerTraceEnv(ctx);
-	const controller = new AbortController();
-	const abortIfSignalled = () => {
-		if (ctx.signal.aborted) controller.abort();
-	};
-	abortIfSignalled();
-	if (!ctx.signal.aborted) ctx.signal.addEventListener("abort", abortIfSignalled, { once: true });
+	const controller = linkAbort(ctx.signal);
 	let proc;
 	let artifact;
 	const executionId = ctx.node?.nodeId ?? `cli-process-${randomUUID()}`;
@@ -7822,12 +7792,7 @@ const bridgeExecutor = (spec, ctx) => {
 	const sessionId = seam.sessionId ?? `bridge-${spec.profile.name ?? "worker"}-${randomUUID()}`;
 	const attemptId = ctx.node?.attemptId ?? newExecutionAttemptId(sessionId);
 	const traceHeaders = workerTraceHeaders(ctx);
-	const controller = new AbortController();
-	const abortIfSignalled = () => {
-		if (ctx.signal.aborted) controller.abort();
-	};
-	abortIfSignalled();
-	if (!ctx.signal.aborted) ctx.signal.addEventListener("abort", abortIfSignalled, { once: true });
+	const controller = linkAbort(ctx.signal);
 	const inbox = createInbox();
 	let artifact;
 	const activeRuns = /* @__PURE__ */ new Map();
@@ -8182,7 +8147,7 @@ function readBridgeRunState(runId, body) {
 async function* streamBridgeSession(args) {
 	const { seam, inbox, observation } = args;
 	const started = Date.now();
-	const external = mergeAbortSignals(args.signal, args.controller.signal);
+	const external = linkAbort(args.signal, args.controller.signal).signal;
 	const tokens = zeroTokenUsage();
 	let tokensKnown = true;
 	let usd = 0;
@@ -9310,7 +9275,7 @@ function bridgeWorktreeExecutor(spec, ctx, seam) {
 		execute(task, signal) {
 			return (async function* bridgeWorktreeStream() {
 				const started = Date.now();
-				const linked = mergeAbortSignals(signal, controller.signal);
+				const linked = linkAbort(signal, controller.signal).signal;
 				let bridgeArtifact;
 				try {
 					worktree = await createWorktree({
@@ -9587,6 +9552,11 @@ function snapshotExecutorConfig(config) {
 			});
 		}
 		case "cli": return detachedSnapshot(config, `createExecutor ${config.backend} config`);
+		default: {
+			const named = config.backend;
+			const supported = Object.keys(WORKER_TRACE_PROPAGATION).sort().join(", ");
+			throw new ValidationError(`createExecutor: no backend named ${JSON.stringify(named)}; supported backends are ${supported}`);
+		}
 	}
 }
 /** A backend config reused for multiple workers/managers cannot pin execution identity. */
@@ -9922,113 +9892,6 @@ function singleShotDriver(maxIterations) {
 		}
 	};
 }
-/** Link two abort signals into one that fires when either does. Returns
-*  `undefined` when neither is present so `fetch` gets no signal at all. */
-function linkSignals(a, b) {
-	if (a.aborted || b.aborted) {
-		const c = new AbortController();
-		c.abort(abortReasonOf(a.aborted ? a : b));
-		return c.signal;
-	}
-	const c = new AbortController();
-	a.addEventListener("abort", () => c.abort(abortReasonOf(a)), { once: true });
-	b.addEventListener("abort", () => c.abort(abortReasonOf(b)), { once: true });
-	return c.signal;
-}
-/** The reason a signal carries, or a named fallback. A cascade that drops the upstream reason
-*  turns every downstream death into the generic "execution aborted": the worker's `down`
-*  record then says nothing about WHY, which is what makes a whole class of child mortality
-*  undiagnosable from the journal alone. */
-function abortReasonOf(signal, fallback = "aborted by parent scope") {
-	const reason = signal.reason;
-	if (typeof reason === "string" && reason.length > 0) return reason;
-	if (reason instanceof Error && reason.name !== "AbortError" && reason.message.length > 0) return reason.message;
-	return fallback;
-}
-/** Combine N abort signals into one that fires when ANY does. Node-portable (no `AbortSignal.any`,
-*  which needs >=20.3 — the package floor is >=20). Module-exported (not package surface) so
-*  sibling leaf executors share the one portable implementation. */
-function mergeAbortSignals(...signals) {
-	const c = new AbortController();
-	const onAbort = () => c.abort();
-	for (const s of signals) {
-		if (s.aborted) {
-			c.abort();
-			break;
-		}
-		s.addEventListener("abort", onAbort, { once: true });
-	}
-	return c.signal;
-}
-//#endregion
-//#region src/runtime/supervise/abortable.ts
-/**
-* One abort race for the supervision tree.
-*
-* Every layer that can be cancelled needs the same two things: an `AbortError` that
-* carries the signal's own reason, and a settle-once race between the work and the
-* signal. Written per layer, the race drifts — the listener stops being removed on
-* one path, or a late resolution overwrites a cancellation that already won.
-*
-* The fallback message is the only thing a layer supplies, so the error still names
-* which layer cancelled.
-*/
-/** An `AbortError` carrying the signal's own string reason, or `fallback` when it states none. */
-function abortError(signal, fallback) {
-	const reason = signal.reason;
-	const error = new Error(typeof reason === "string" && reason.length > 0 ? reason : fallback);
-	error.name = "AbortError";
-	return error;
-}
-/**
-* Settle `act()` against `signal`. The first outcome wins and the listener is always
-* removed, so neither a late resolution nor a late abort can settle the promise twice.
-* The losing promise stays observed, so a late rejection cannot surface as an unhandled
-* process error.
-*
-* The abort rejection is deferred one microtask so a result the action had ALREADY
-* produced still wins. It does not hand the race to a listener the action registers
-* from inside `act()`: this function subscribes before it calls `act()`, so its own
-* abort handler runs first and settles the promise. A caller that must let the action
-* observe the abort itself has to hold a live promise and await that instead.
-*
-* A synchronous throw from `act()` propagates as the rejection, not as an abort.
-*/
-async function runAbortable(act, signal, fallback) {
-	if (signal.aborted) throw abortError(signal, fallback);
-	return await new Promise((resolve, reject) => {
-		let settled = false;
-		const cleanup = () => signal.removeEventListener("abort", onAbort);
-		const onAbort = () => {
-			queueMicrotask(() => {
-				if (settled) return;
-				settled = true;
-				cleanup();
-				reject(abortError(signal, fallback));
-			});
-		};
-		signal.addEventListener("abort", onAbort, { once: true });
-		let work;
-		try {
-			work = Promise.resolve(act());
-		} catch (error) {
-			cleanup();
-			reject(error);
-			return;
-		}
-		work.then((value) => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			resolve(value);
-		}, (error) => {
-			if (settled) return;
-			settled = true;
-			cleanup();
-			reject(error);
-		});
-	});
-}
 //#endregion
 //#region src/runtime/supervise/budget.ts
 /**
@@ -11497,13 +11360,10 @@ function createScope(args) {
 			return;
 		}
 	}
-	function terminalNodeStatus(status) {
-		return status === "done" || status === "failed" || status === "cancelled";
-	}
 	function interactive(nodeId) {
 		const child = children.get(nodeId);
 		if (!child) return noInteractiveSession("unknown-node");
-		if (child.wait || child.executorDone || terminalNodeStatus(child.status)) return noInteractiveSession("not-live");
+		if (child.wait || child.executorDone || isTerminalNodeStatus(child.status)) return noInteractiveSession("not-live");
 		if (!child.readInteractive) return noInteractiveSession("executor-exposes-no-interactive-session");
 		let reported;
 		try {
@@ -11577,7 +11437,7 @@ function createScope(args) {
 			return {
 				live: liveWorkerCapacity.live,
 				freeSlots: freeSlots(liveWorkerCapacity.live, liveWorkerCapacity.max),
-				unconfirmed: Object.freeze([...children.values()].filter((child) => (child.status === "done" || child.status === "failed" || child.status === "cancelled") && !child.cleanupConfirmed).map((child) => Object.freeze({
+				unconfirmed: Object.freeze([...children.values()].filter((child) => isTerminalNodeStatus(child.status) && !child.cleanupConfirmed).map((child) => Object.freeze({
 					id: child.id,
 					label: child.label,
 					runtime: child.runtime,
@@ -12515,32 +12375,13 @@ function isSettled(ev) {
 /** Sum the conserved spend over the nested tree's settled events — the honest per-channel
 *  roll-up of the whole sub-tree's child WORK. */
 function sumSpend(settled) {
-	const total = zeroSpend();
-	for (const ev of settled) {
-		total.iterations += ev.spent.iterations;
-		addTokenUsage(total.tokens, ev.spent.tokens);
-		if (ev.spent.tokensKnown === false) total.tokensKnown = false;
-		total.usd += ev.spent.usd;
-		if (ev.spent.usdKnown === false) total.usdKnown = false;
-		total.ms += ev.spent.ms;
-	}
-	return total;
+	return settled.reduce((total, ev) => addSpend(total, ev.spent), zeroSpend());
 }
 /** Sum the nested tree's `metered` events — the sub-tree's whole driver INFERENCE (this driver's
 *  own turns + any sub-driver inference already re-homed into this tree). Re-homed up to the parent
 *  as one `metered` event; never reconciled (already pool-debited live via `observe`). */
 function sumMetered(events) {
-	const total = zeroSpend();
-	for (const ev of events) {
-		if (ev.kind !== "metered") continue;
-		total.iterations += ev.spend.iterations;
-		addTokenUsage(total.tokens, ev.spend.tokens);
-		if (ev.spend.tokensKnown === false) total.tokensKnown = false;
-		total.usd += ev.spend.usd;
-		if (ev.spend.usdKnown === false) total.usdKnown = false;
-		total.ms += ev.spend.ms;
-	}
-	return total;
+	return events.reduce((total, ev) => ev.kind === "metered" ? addSpend(total, ev.spend) : total, zeroSpend());
 }
 /** An all-zero spend that carries an UNKNOWN marker counts as non-zero: a sub-driver whose turns
 *  went unmeasured did real work, and dropping its `metered` event here would re-hide upstream the
@@ -12725,8 +12566,8 @@ async function runFinalizer(finalizer, args) {
 *  - Join barrier: when `act()` settles (resolve OR reject), every still-live child is
 *    torn down before `run` returns — the generalization of the kernel's
 *    `finally{ Promise.allSettled(destroy) }` barrier (run-loop.ts) from boxes to the
-*    whole sub-tree. A teardown failure is `allSettled`'d and journaled as a
-*    `cancelled` event; it NEVER masks act()'s own outcome. act()'s rejection is the
+*    whole sub-tree. A teardown failure is `allSettled`'d and journaled per node as a
+*    `teardown-unconfirmed` event; it NEVER masks act()'s own outcome. act()'s rejection is the
 *    PRIMARY error (the kernel's firstError precedence), so a teardown throw during the
 *    barrier can never overwrite the real failure.
 *  - Abort cascade: a root abort (caller signal, `RootHandle.abort`, a tripped breaker,
@@ -12882,7 +12723,7 @@ function rootDeadline(root) {
 }
 /** Child reservations whose spawn was durable but whose terminal record never landed. */
 function uncertainSpawnBudgets(events) {
-	const terminal = new Set(events.filter((event) => event.kind === "settled" || event.kind === "cancelled" || event.kind === "woken").map((event) => event.id));
+	const terminal = new Set(events.filter(closesCursorSlot).map((event) => event.id));
 	return events.filter((event) => event.kind === "spawned" && event.parent !== void 0 && !terminal.has(event.id)).map((event) => event.budget);
 }
 /** Highest `seq` among events matching `pred`, or `-1` when none match (so a resumed scope's
@@ -12982,7 +12823,7 @@ function createSupervisor() {
 					settled,
 					view: materializeTreeView(prior),
 					maxSpawnOrdinal: maxSeqOf(prior, (ev) => ev.kind === "spawned"),
-					maxCursorSeq: maxSeqOf(prior, (ev) => ev.kind === "settled" || ev.kind === "cancelled" || ev.kind === "woken"),
+					maxCursorSeq: maxSeqOf(prior, closesCursorSlot),
 					maxWaitOrdinal: maxSeqOf(prior, (ev) => ev.kind === "waiting"),
 					waits: pendingWaits(prior),
 					keys: keyedAssignments(prior, settled),
@@ -13422,7 +13263,7 @@ function spendGapsFromEvents(events) {
 	const labels = /* @__PURE__ */ new Map();
 	const terminal = /* @__PURE__ */ new Set();
 	for (const ev of events) if (ev.kind === "spawned") labels.set(ev.id, ev.label);
-	else if (ev.kind === "settled" || ev.kind === "cancelled" || ev.kind === "woken") terminal.add(ev.id);
+	else if (closesCursorSlot(ev)) terminal.add(ev.id);
 	const gaps = /* @__PURE__ */ new Map();
 	const record = (id, kind, channels) => {
 		if (channels.length === 0) return;
@@ -13474,35 +13315,15 @@ function sumSpendFromEvents(events) {
 	return totals;
 }
 function sumMeasuredSpendFromEvents(events) {
-	const childWork = {
-		iterations: 0,
-		tokens: zeroTokenUsage(),
-		usd: 0,
-		ms: 0
-	};
-	const driverInference = {
-		iterations: 0,
-		tokens: zeroTokenUsage(),
-		usd: 0,
-		ms: 0
-	};
-	for (const ev of events) if (ev.kind === "settled") accumulate(childWork, ev.spent);
-	else if (ev.kind === "metered") accumulate(driverInference, ev.spend);
+	let childWork = zeroSpend();
+	let driverInference = zeroSpend();
+	for (const ev of events) if (ev.kind === "settled") childWork = addSpend(childWork, ev.spent);
+	else if (ev.kind === "metered") driverInference = addSpend(driverInference, ev.spend);
 	return {
 		childWork,
 		driverInference
 	};
 }
-/** Add `b` into `a` in place, per channel. */
-function accumulate(a, b) {
-	a.iterations += b.iterations;
-	addTokenUsage(a.tokens, b.tokens);
-	if (b.tokensKnown === false) a.tokensKnown = false;
-	a.usd += b.usd;
-	if (b.usdKnown === false) a.usdKnown = false;
-	if (b.usdEstimated !== void 0) a.usdEstimated = (a.usdEstimated ?? 0) + b.usdEstimated;
-	a.ms += b.ms;
-}
 /** True when any driver metered inference this run (so the winner carries a `spentBreakdown`).
 *  Checks every channel `addSpend` sums — including `ms` — so the gate stays consistent with the
 *  total even though the coordination driver currently stamps `ms: 0`. */
@@ -13510,6 +13331,6 @@ function isNonEmptySpend(s) {
 	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false;
 }
 //#endregion
-export { DEFAULT_STALL_AFTER_MS as $, localHarnessExecutable as $t, createBudgetPool as A, buildRuntimeEventOtelSpans as At, createExecutorRegistry as B, createRuntimeEventCollector as Bt, effectiveConcurrency as C, createPropagatingTraceEmitter as Ct, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as D, INTELLIGENCE_WIRE_VERSION as Dt, rollingDispatch as E, traceContextToEnv as Et, bridgeRuntimeAttachmentsKey as F, generateSpanId as Ft, workerTraceEnv as G, runSettledCommand as Gt, createWorktreeCliExecutor as H, sanitizeAgentRuntimeEvent as Ht, bridgeStopSignalKey as I, loopEventToOtelSpan as It, DEFAULT_SANDBOX_STEERING_MAX_TURNS as J, createWorktree as Jt, workerTraceHeaders as K, runWorktreeHarness as Kt, captureReusableExecutorConfig as L, padSpanId as Lt, bindReusableExecutorExecutionId as M, createOtelExporter as Mt, bridgeAdmissionRead as N, exportEvalRuns as Nt, teardownExecutor as O, buildLoopOtelSpans as Ot, bridgeModelRouteRefusal as P, flatOtelSpan as Pt, sandboxSessionTraceSource as Q, harnessSupportsReasoningEffort as Qt, cliWorktreeExecutor as R, padTraceId as Rt, waitUntil as S, observedModelMatchesDeclared as St, queueOf as T, readTraceContextFromEnv as Tt, WORKER_TRACE_PROPAGATION as U, sanitizeKnowledgeReadinessReport as Ut, snapshotExecutorConfig as V, createRuntimeStreamEventCollector as Vt, readWorkerTraceContext as W, sanitizeRuntimeStreamEvent as Wt, createPushTraceSource as X, DEFAULT_LOCAL_HARNESS as Xt, createSteerableSandboxSession as Y, removeWorktree as Yt, decodeToolPart as Z, LOCAL_HARNESSES as Zt, createWaitProbes as _, worktreeCliProfileMaterialization as _n, probeSandboxCapabilities as _t, pickBestDelivered as a, defineProfileMaterializationContract as an, PEER_MAIL_WIRE_KEY as at, timerAt as b, runBrainLoop as bt, driverChild as c, promptControlProfileMaterialization as cn, isPeerMailEnvelope as ct, deriveNodeExecutionIdentity as d, promptResourceProfileMaterialization as dn, TERMINAL_DECISIONS as dt, parseCodexTokenUsage as en, createActivityLog as et, meterRuntimeOwnedAccounting as f, renderProfileMaterializationIssues as fn, createSandboxForSpec as ft, settledToIteration as g, validateProfileMaterialization as gn, createSandboxLineage as gt, scopeOwnerExecutorNodeContext as h, unsupportedProfileDimensions as hn, runAgentRounds as ht, collectDelivered as i, controlProfileMaterialization as in, DEFAULT_PEER_MAIL_LIMITS as it, spendFromUsageEvents as j, createOpenInferenceFileExporter as jt, assertValidBudget as k, buildLoopSpanNodes as kt, withDriverExecutor as l, promptModelProfileMaterialization as ln, peerMailTools as lt, recordScopeOwnerMaterialization as m, sandboxActProfileMaterialization as mn, isTerminalDecision as mt, createSupervisor as n, AGENT_PROFILE_MATERIALIZATION_AXES as nn, createInbox as nt, runFinalizer as o, fullProfileMaterialization as on, claimsAuthority as ot, meterRuntimeOwnedProviderAttempt as p, renderUnsupported as pn, defaultSelectWinner as pt, workerTraceSeamKey as q, captureWorktreeDiff as qt, bestDelivered as r, assertProfileMaterialization as rn, AUTHORITY_MARKERS as rt, runTree as s, profileMaterializationAxes$1 as sn, createPeerMailbox as st, createRootHandle as t, CodexExecutionDiagnosticError as tn, readWorkerProgress as tt, createScope as u, promptOnlyProfileMaterialization as un, peerMailVerbNames as ut, isWaitOutcome as v, acquireSandbox as vt, freeSlots as w, mergeTraceEnv as wt, validateWaitSpec as x, canonicalObservedModel as xt, pollFor as y, routerBrain as yt, createExecutor as z, toOtelAttributes as zt };
+export { DEFAULT_STALL_AFTER_MS as $, LOCAL_HARNESSES as $t, createBudgetPool as A, buildLoopOtelSpans as At, createExecutorRegistry as B, padTraceId as Bt, effectiveConcurrency as C, canonicalObservedModel as Ct, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as D, readTraceContextFromEnv as Dt, rollingDispatch as E, mergeTraceEnv as Et, bridgeRuntimeAttachmentsKey as F, exportEvalRuns as Ft, workerTraceEnv as G, sanitizeKnowledgeReadinessReport as Gt, createWorktreeCliExecutor as H, createRuntimeEventCollector as Ht, bridgeStopSignalKey as I, flatOtelSpan as It, DEFAULT_SANDBOX_STEERING_MAX_TURNS as J, runWorktreeHarness as Jt, workerTraceHeaders as K, sanitizeRuntimeStreamEvent as Kt, captureReusableExecutorConfig as L, generateSpanId as Lt, bindReusableExecutorExecutionId as M, buildRuntimeEventOtelSpans as Mt, bridgeAdmissionRead as N, createOpenInferenceFileExporter as Nt, teardownExecutor as O, traceContextToEnv as Ot, bridgeModelRouteRefusal as P, createOtelExporter as Pt, sandboxSessionTraceSource as Q, DEFAULT_LOCAL_HARNESS as Qt, cliWorktreeExecutor as R, loopEventToOtelSpan as Rt, waitUntil as S, runBrainLoop as St, queueOf as T, createPropagatingTraceEmitter as Tt, WORKER_TRACE_PROPAGATION as U, createRuntimeStreamEventCollector as Ut, snapshotExecutorConfig as V, toOtelAttributes as Vt, readWorkerTraceContext as W, sanitizeAgentRuntimeEvent as Wt, createPushTraceSource as X, createWorktree as Xt, createSteerableSandboxSession as Y, captureWorktreeDiff as Yt, decodeToolPart as Z, removeWorktree as Zt, createWaitProbes as _, unsupportedProfileDimensions as _n, runAgentRounds as _t, pickBestDelivered as a, assertProfileMaterialization as an, PEER_MAIL_WIRE_KEY as at, timerAt as b, acquireSandbox as bt, driverChild as c, fullProfileMaterialization as cn, isPeerMailEnvelope as ct, deriveNodeExecutionIdentity as d, promptModelProfileMaterialization as dn, isLiveNodeStatus as dt, harnessSupportsReasoningEffort as en, createActivityLog as et, meterRuntimeOwnedAccounting as f, promptOnlyProfileMaterialization as fn, isTerminalNodeStatus as ft, settledToIteration as g, sandboxActProfileMaterialization as gn, isTerminalDecision as gt, scopeOwnerExecutorNodeContext as h, renderUnsupported as hn, defaultSelectWinner as ht, collectDelivered as i, AGENT_PROFILE_MATERIALIZATION_AXES as in, DEFAULT_PEER_MAIL_LIMITS as it, spendFromUsageEvents as j, buildLoopSpanNodes as jt, assertValidBudget as k, INTELLIGENCE_WIRE_VERSION as kt, withDriverExecutor as l, profileMaterializationAxes$1 as ln, peerMailTools as lt, recordScopeOwnerMaterialization as m, renderProfileMaterializationIssues as mn, createSandboxForSpec as mt, createSupervisor as n, parseCodexTokenUsage as nn, createInbox as nt, runFinalizer as o, controlProfileMaterialization as on, claimsAuthority as ot, meterRuntimeOwnedProviderAttempt as p, promptResourceProfileMaterialization as pn, TERMINAL_DECISIONS as pt, workerTraceSeamKey as q, runSettledCommand as qt, bestDelivered as r, CodexExecutionDiagnosticError as rn, AUTHORITY_MARKERS as rt, runTree as s, defineProfileMaterializationContract as sn, createPeerMailbox as st, createRootHandle as t, localHarnessExecutable as tn, readWorkerProgress as tt, createScope as u, promptControlProfileMaterialization as un, peerMailVerbNames as ut, isWaitOutcome as v, validateProfileMaterialization as vn, createSandboxLineage as vt, freeSlots as w, observedModelMatchesDeclared as wt, validateWaitSpec as x, routerBrain as xt, pollFor as y, worktreeCliProfileMaterialization as yn, probeSandboxCapabilities as yt, createExecutor as z, padSpanId as zt };
 
-//# sourceMappingURL=supervisor-DBVlPONC.js.map
+//# sourceMappingURL=supervisor-BmXD0WCJ.js.map