@tangle-network/agent-runtime 0.192.5 → 0.194.0

package/dist/{coordination-driver-pQobxl2Z.js → coordination-driver-iSN-m3VX.js}

@@ -1,16 +1,212 @@
-import { d as providerAttemptEvidence } from "./materialization-CekWK6OO.js";
+import { E as detachedFrozen, d as providerAttemptEvidence } from "./materialization-vZssF9Nx.js";
 import { f as RuntimeRunStateError, m as ValidationError } from "./errors-CDZ8XsVj.js";
-import { t as detachedFrozen } from "./snapshot-CTAf4uuA.js";
-import { b as workerTraceAnalysisStore, i as InMemorySpawnJournal, n as FileSpawnJournal, r as InMemoryResultBlobStore, t as FileResultBlobStore, y as parseWorkerToolTraceArtifact } from "./spawn-journal-B9eTmVAn.js";
-import { r as chargedTokens, u as promptCacheTokenClasses, v as unmeteredSpend } from "./util-mCNUeboW.js";
-import { i as writeAllBytes, n as parseCommittedJsonLines, r as prepareJsonlAppend, t as isNoEntError } from "./jsonl-file-CDfsCI5s.js";
-import { Et as createInbox, Ft as isLiveNodeStatus, It as isTerminalNodeStatus, Q as assertValidBudget, Xt as runBrainLoop, b as meterRuntimeOwnedProviderAttempt, d as pickBestDelivered, f as runFinalizer, h as withDriverExecutor, jt as createPeerMailbox, l as bestDelivered, p as runTree, q as freeSlots, r as resolveRedactor, ut as createExecutorRegistry } from "./redact-Ct7s2j86.js";
+import { i as writeAllBytes, n as parseCommittedJsonLines, r as prepareJsonlAppend, t as isNoEntError } from "./jsonl-file-Bh1Q9nt0.js";
+import { $t as workerTraceAnalysisStore, Bt as FileSpawnJournal, Et as createInbox, Ft as isLiveNodeStatus, Ht as InMemorySpawnJournal, It as isTerminalNodeStatus, Q as assertValidBudget, Qt as parseWorkerToolTraceArtifact, Vt as InMemoryResultBlobStore, b as meterRuntimeOwnedProviderAttempt, d as pickBestDelivered, f as runFinalizer, fn as runBrainLoop, h as withDriverExecutor, jt as createPeerMailbox, l as bestDelivered, p as runTree, q as freeSlots, r as resolveRedactor, ut as createExecutorRegistry, zt as FileResultBlobStore } from "./redact-BOU77QfQ.js";
+import { g as promptCacheTokenClasses, l as chargedTokens, w as unmeteredSpend } from "./environment-provider-Dr-wfnHg.js";
 import { A as writeWorkerCancellation, M as writeWorkerSteerAcknowledgement, c as readWorkerCancelRequests, d as readWorkerSteerRequests, k as writeRunCancellation, l as readWorkerCancellation, o as readRunCancelRequest, r as claimWorkerSteerDelivery, s as readRunCancellation, u as readWorkerSteerAcknowledgement } from "./run-layout-B8I_LXN-.js";
 import { agentProfileSchema, canonicalCandidateDigest } from "@tangle-network/agent-interface";
 import { argHash, errorStreakDetector, observeAll, repeatedActionDetector } from "@tangle-network/agent-eval";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
+//#region src/runtime/supervise/coordination-log.ts
+/**
+* Durable side-log for coordination evidence the spawn journal does not own: questions, analyst
+* findings, answer decisions, authorized continuation receipts, delivery-attempt markers, and
+* delivery outcomes. A durable run
+* (`supervise({ runDir })`) appends them as they publish and loads them on resume, so a restarted
+* coordinator retains the exact evidence produced by prior processes.
+*
+* Answer down-events also fold status on load: a question answered before the crash reloads as
+* `answered`, not as a re-blocking `open`. Settled events are skipped (the spawn journal is their
+* ledger). A receipt followed by an attempt but no outcome proves the process died in the delivery
+* window; that outcome remains unknown and no prior instruction is auto-delivered.
+*
+* JSONL, one fsynced record per event, keyed by `runId` — several runs may share one log file
+* exactly as they share one spawn-journal file.
+*
+* @experimental
+*/
+/** Persist prior context plus exact continuation authorization, attempt, and result evidence.
+* Settlements have their own journal. */
+function persisted(event) {
+	return event.type !== "settled";
+}
+/** FS-backed `CoordinationLog`: append-only JSONL, fsynced per record. */
+var FileCoordinationLog = class {
+	path;
+	appendTail = Promise.resolve();
+	constructor(path) {
+		this.path = path;
+	}
+	async append(runId, record, ownerId) {
+		if (!persisted(record.event)) return;
+		const append = this.appendTail.then(() => this.appendRecord(runId, record, ownerId));
+		this.appendTail = append.catch(() => void 0);
+		return append;
+	}
+	async appendRecord(runId, busRecord, ownerId) {
+		const fs = await import("node:fs/promises");
+		const path = await import("node:path");
+		await fs.mkdir(path.dirname(this.path), { recursive: true });
+		const record = {
+			runId,
+			...ownerId !== void 0 ? { ownerId } : {},
+			...busRecord
+		};
+		const needsSeparator = await prepareJsonlAppend(this.path);
+		const fh = await fs.open(this.path, "a");
+		try {
+			await writeAllBytes(fh, `${needsSeparator ? "\n" : ""}${JSON.stringify(record)}\n`);
+			await fh.sync();
+		} finally {
+			await fh.close();
+		}
+	}
+	async load(runId, ownerId) {
+		const fs = await import("node:fs/promises");
+		let text;
+		try {
+			text = await fs.readFile(this.path, "utf8");
+		} catch (err) {
+			if (isNoEntError(err)) return emptyPriorCoordination(ownerId);
+			throw err;
+		}
+		const byId = /* @__PURE__ */ new Map();
+		const findings = [];
+		const escalations = [];
+		const analystDefinitions = [];
+		const continuations = [];
+		const deliveryEvidence = [];
+		const mail = [];
+		const records = [];
+		let legacySeq = 0;
+		for (const stored of parseCommittedJsonLines(text, this.path)) {
+			if (stored.runId !== runId) continue;
+			if (ownerId !== void 0 && stored.ownerId !== ownerId) continue;
+			const record = "seq" in stored ? {
+				seq: stored.seq,
+				at: stored.at,
+				priority: stored.priority,
+				event: stored.event
+			} : {
+				seq: legacySeq++,
+				at: Date.parse(stored.at),
+				priority: 0,
+				event: stored.event
+			};
+			records.push(record);
+			const ev = record.event;
+			if (ev.type === "delivery-attempt" || ev.type === "steer" || ev.type === "answer") deliveryEvidence.push(ev);
+			if (ev.type === "question") byId.set(ev.question.id, ev.question);
+			else if (ev.type === "finding") findings.push(ev.finding);
+			else if (ev.type === "answer") {
+				const prior = byId.get(ev.questionId);
+				if (prior && ev.down.delivered) byId.set(ev.questionId, {
+					...prior,
+					status: "answered",
+					decision: {
+						kind: "answer",
+						answer: ev.down.instruction,
+						by: "prior-run"
+					}
+				});
+			} else if (ev.type === "instruction") continuations.push(ev.instruction);
+			else if (ev.type === "mail") mail.push(ev.mail);
+			else if (ev.type === "escalation") escalations.push(ev.escalation);
+			else if (ev.type === "analyst-defined") analystDefinitions.push(ev.analyst);
+		}
+		return {
+			...ownerId !== void 0 ? { ownerId } : {},
+			questions: [...byId.values()],
+			findings,
+			escalations,
+			analystDefinitions,
+			continuations,
+			deliveryEvidence,
+			mail,
+			records
+		};
+	}
+};
+function emptyPriorCoordination(ownerId) {
+	return {
+		...ownerId !== void 0 ? { ownerId } : {},
+		questions: [],
+		findings: [],
+		escalations: [],
+		analystDefinitions: [],
+		continuations: [],
+		deliveryEvidence: [],
+		mail: [],
+		records: []
+	};
+}
+//#endregion
+//#region src/runtime/supervise/run-context.ts
+/**
+*
+* `createInMemoryRunContext` — the one-call bundle of the in-memory stores a
+* `createSupervisor().run(root, task, opts)` needs: a fresh `InMemorySpawnJournal`
+* (the event-sourced spawn log), a fresh `InMemoryResultBlobStore` (the
+* content-addressed `outRef` payload store the driver's `observe`/`finalize` reads
+* settled outputs through), and a fresh `createExecutorRegistry()` (the open
+* `AgentSpec → Executor` resolver).
+*
+* It exists to kill the boilerplate every offline/local supervised run repeats by
+* hand — three constructors threaded into `SupervisorOpts` — and to single-source the
+* ONE wiring invariant that is easy to get wrong: when the root is the recursive
+* `driverAgent` LLM-driver brain AND it may spawn nested managed children, the registry MUST be
+* wrapped with `withDriverExecutor` so a child constructed by `driverChild` resolves to the
+* nested-scope executor — and that SAME blob
+* store MUST be the one passed to `driverAgent({ blobs })`, or the driver
+* reads from a different store than the scope writes to. Pass `{ withDriver: true }`
+* and reuse the returned `blobs` for both.
+*
+* The spread shape matches `SupervisorOpts` exactly, so the call site reads:
+*   const run = createInMemoryRunContext()
+*   await createSupervisor().run(root, task, { budget, runId, ...run })
+*
+* @experimental
+*/
+/**
+* Build a fresh in-memory run context. Every call returns NEW stores (no shared global
+* state between runs), so two runs never cross-contaminate their journals/blobs.
+*/
+function createInMemoryRunContext(opts = {}) {
+	const base = createExecutorRegistry();
+	return {
+		journal: new InMemorySpawnJournal(),
+		blobs: new InMemoryResultBlobStore(),
+		executors: opts.withDriver ? withDriverExecutor(base) : base
+	};
+}
+/**
+* Build a DURABLE run context: the spawn journal and the result blobs are file-backed (fsynced
+* per append/write) under `dir`, and the context carries `resume: true` so spreading it into
+* `SupervisorOpts` makes the supervisor `loadTree`-first. A run that dies mid-flight therefore
+* resumes when it is re-run with the SAME `runId` and the SAME `dir`: the committed children come
+* back on `Scope.resume` (rehydrated by `replaySpawnTree`) instead of being re-executed.
+*
+* Layout: `${dir}/spawn-journal.jsonl` (one JSONL record per event), `${dir}/blobs/` (one
+* content-addressed JSON file per settled result), and `${dir}/coordination-log.jsonl`
+* (questions, findings, answer decisions, and authorized continuation receipts retained as
+* evidence). The directory is created on first write.
+*
+* Opt-in by construction — `createInMemoryRunContext()` is unchanged and stays the default, so no
+* existing consumer writes to disk or resumes unless it asks for this.
+*/
+function createFileRunContext(dir, opts = {}) {
+	const base = createExecutorRegistry();
+	return {
+		journal: new FileSpawnJournal(`${dir}/spawn-journal.jsonl`),
+		blobs: new FileResultBlobStore(`${dir}/blobs`),
+		executors: opts.withDriver ? withDriverExecutor(base) : base,
+		resume: true,
+		coordinationLog: new FileCoordinationLog(`${dir}/coordination-log.jsonl`)
+	};
+}
+//#endregion
 //#region src/runtime/supervise/detector-monitor.ts
 /**
 *
@@ -392,6 +588,7 @@ const journalEventKinds = [
 	"question",
 	"settled",
 	"finding",
+	"submission",
 	"steer",
 	"answer",
 	"instruction",
@@ -616,10 +813,12 @@ function spawnProfileArg() {
 /** Build the driver's MCP tools over a live scope. */
 function createCoordinationTools(opts) {
 	const deliverable = opts.deliverable;
-	let stopped = false;
-	let reason;
+	const priorSubmission = deliverable === void 0 ? void 0 : opts.priorJournal?.find((record) => record.event.type === "submission");
+	let stopped = priorSubmission !== void 0;
+	let reason = priorSubmission === void 0 ? void 0 : "result-accepted";
 	let stopNotified = false;
-	let submitted;
+	let submitted = priorSubmission === void 0 ? void 0 : detachedFrozen({ result: priorSubmission.event.result });
+	let submissionInFlight;
 	let questionSeq = 0;
 	const ledger = [];
 	const questions = [...opts.priorQuestions ?? []];
@@ -1174,6 +1373,10 @@ function createCoordinationTools(opts) {
 			type: "finding",
 			...ev.finding
 		};
+		if (ev.type === "submission") return {
+			type: "submission",
+			result: ev.result
+		};
 		if (ev.type === "answer") return {
 			type: "answer",
 			...ev.down,
@@ -1586,7 +1789,7 @@ function createCoordinationTools(opts) {
 	const tools = [
 		{
 			name: "spawn_worker",
-			description: "Start a worker the driver will drive. `profile` is the worker or another driver; `task` is what it should do. Reserves budget from the conserved pool and fails closed. Pass an optional `budget` (per-field) to give a hard sub-task more than the default — it merges over the per-worker default; the conserved pool is still the hard fence. When a max-live-workers cap is set it also fails closed (`error: \"max-live-workers\"`) while that many workers are still in flight — settle or steer one before spawning another. Pass a `key` naming the assignment to make it run-once ACROSS restarts: a key that already completed returns the finished result (`resumed: \"completed\"` — no work re-runs, nothing is spent), a key whose prior attempt failed or was lost with a dead process spawns fresh and says so (`resumed: \"retried\" | \"lost\"`), and a key still running is refused (`error: \"duplicate-key\"`). Returns `freeSlots`: how many MORE workers you can start right now (`null` = uncapped). While `freeSlots > 0` there is idle capacity — call this again to fill it rather than waiting; parallel workers finish the run sooner than one at a time.",
+			description: "Start a worker the driver will drive. `profile` is the worker or another driver; `task` is what it should do. Reserves budget from the conserved pool and fails closed. Pass an optional `budget` (per-field) to give a hard sub-task more than the default — it merges over the per-worker default; the conserved pool is still the hard fence. When a max-live-workers cap is set it also fails closed (`error: \"max-live-workers\"`) while that many workers are still in flight — settle or steer one before spawning another. Pass a `key` naming the assignment to make it run-once ACROSS restarts: a key that already completed returns the finished result (`resumed: \"completed\"` — no work re-runs, nothing is spent), a key whose prior attempt failed (`down`) spawns fresh and says so (`resumed: \"retried\"`), and a key with no terminal receipt is refused (`error: \"in-doubt\"`) until its exact prior execution is recovered. A key still running is refused (`error: \"duplicate-key\"`). Returns `freeSlots`: how many MORE workers you can start right now (`null` = uncapped). While `freeSlots > 0` there is idle capacity — call this again to fill it rather than waiting; parallel workers finish the run sooner than one at a time.",
 			inputSchema: {
 				type: "object",
 				properties: {
@@ -1736,8 +1939,8 @@ function createCoordinationTools(opts) {
 					...priorHistory
 				} : {
 					error: res.reason,
-					reason: res.reason === "usd-unbudgeted" ? "this run's root budget declares no maxUsd, so a child budget naming maxUsd can never be admitted at any amount — spawn with a budget that omits maxUsd" : `the conserved pool refused this spawn (${String(res.reason)}); the run has no allocation left to give this worker`,
-					...res.reason === "usd-unbudgeted" ? { hint: "This run's root budget declares no maxUsd, so a child budget naming maxUsd can never be admitted — at any amount. Retrying with a smaller maxUsd will fail identically. Spawn with a budget that omits maxUsd, or ask the caller to give the run a root maxUsd." } : {},
+					reason: res.reason === "usd-unbudgeted" ? "this run's root budget declares no maxUsd, so a child budget naming maxUsd can never be admitted at any amount — spawn with a budget that omits maxUsd" : res.reason === "in-doubt" ? "this key has a prior worker recorded as started without a terminal receipt; no replacement was started because that remote worker may still be running — inspect or recover the exact prior execution before retrying" : `the conserved pool refused this spawn (${String(res.reason)}); the run has no allocation left to give this worker`,
+					...res.reason === "usd-unbudgeted" ? { hint: "This run's root budget declares no maxUsd, so a child budget naming maxUsd can never be admitted — at any amount. Retrying with a smaller maxUsd will fail identically. Spawn with a budget that omits maxUsd, or ask the caller to give the run a root maxUsd." } : res.reason === "in-doubt" ? { hint: "Do not retry this key. Use the recorded prior worker identity to inspect or recover that exact execution. A terminal receipt or explicit recovery is required before replacement work can start." } : {},
 					live: liveWorkerCount(),
 					freeSlots: freeWorkerSlots()
 				});
@@ -2042,10 +2245,30 @@ function createCoordinationTools(opts) {
 					retained: "earlier-passing-result",
 					stop: true
 				};
-				submitted = Object.freeze({ result });
-				stopped = true;
-				reason = "result-accepted";
-				notifyStop();
+				if (submissionInFlight) {
+					await submissionInFlight;
+					return {
+						accepted: true,
+						retained: "earlier-passing-result",
+						stop: true
+					};
+				}
+				const acceptedSubmission = detachedFrozen({ result });
+				const commit = bus.publish({
+					type: "submission",
+					result: acceptedSubmission.result
+				}, { queue: false }).then(() => {
+					submitted = acceptedSubmission;
+					stopped = true;
+					reason = "result-accepted";
+					notifyStop();
+				});
+				submissionInFlight = commit;
+				try {
+					await commit;
+				} finally {
+					if (submissionInFlight === commit) submissionInFlight = void 0;
+				}
 				return {
 					accepted: true,
 					retained: "this-result",
@@ -2332,204 +2555,6 @@ function safeJsonText(value) {
 	}
 }
 //#endregion
-//#region src/runtime/supervise/coordination-log.ts
-/**
-* Durable side-log for coordination evidence the spawn journal does not own: questions, analyst
-* findings, answer decisions, authorized continuation receipts, delivery-attempt markers, and
-* delivery outcomes. A durable run
-* (`supervise({ runDir })`) appends them as they publish and loads them on resume, so a restarted
-* coordinator retains the exact evidence produced by prior processes.
-*
-* Answer down-events also fold status on load: a question answered before the crash reloads as
-* `answered`, not as a re-blocking `open`. Settled events are skipped (the spawn journal is their
-* ledger). A receipt followed by an attempt but no outcome proves the process died in the delivery
-* window; that outcome remains unknown and no prior instruction is auto-delivered.
-*
-* JSONL, one fsynced record per event, keyed by `runId` — several runs may share one log file
-* exactly as they share one spawn-journal file.
-*
-* @experimental
-*/
-/** Persist prior context plus exact continuation authorization, attempt, and result evidence.
-* Settlements have their own journal. */
-function persisted(event) {
-	return event.type !== "settled";
-}
-/** FS-backed `CoordinationLog`: append-only JSONL, fsynced per record. */
-var FileCoordinationLog = class {
-	path;
-	appendTail = Promise.resolve();
-	constructor(path) {
-		this.path = path;
-	}
-	async append(runId, record, ownerId) {
-		if (!persisted(record.event)) return;
-		const append = this.appendTail.then(() => this.appendRecord(runId, record, ownerId));
-		this.appendTail = append.catch(() => void 0);
-		return append;
-	}
-	async appendRecord(runId, busRecord, ownerId) {
-		const fs = await import("node:fs/promises");
-		const path = await import("node:path");
-		await fs.mkdir(path.dirname(this.path), { recursive: true });
-		const record = {
-			runId,
-			...ownerId !== void 0 ? { ownerId } : {},
-			...busRecord
-		};
-		const needsSeparator = await prepareJsonlAppend(this.path);
-		const fh = await fs.open(this.path, "a");
-		try {
-			await writeAllBytes(fh, `${needsSeparator ? "\n" : ""}${JSON.stringify(record)}\n`);
-			await fh.sync();
-		} finally {
-			await fh.close();
-		}
-	}
-	async load(runId, ownerId) {
-		const fs = await import("node:fs/promises");
-		let text;
-		try {
-			text = await fs.readFile(this.path, "utf8");
-		} catch (err) {
-			if (isNoEntError(err)) return emptyPriorCoordination(ownerId);
-			throw err;
-		}
-		const byId = /* @__PURE__ */ new Map();
-		const findings = [];
-		const escalations = [];
-		const analystDefinitions = [];
-		const continuations = [];
-		const deliveryEvidence = [];
-		const mail = [];
-		const records = [];
-		let legacySeq = 0;
-		for (const stored of parseCommittedJsonLines(text, this.path)) {
-			if (stored.runId !== runId) continue;
-			if (ownerId !== void 0 && stored.ownerId !== ownerId) continue;
-			const record = "seq" in stored ? {
-				seq: stored.seq,
-				at: stored.at,
-				priority: stored.priority,
-				event: stored.event
-			} : {
-				seq: legacySeq++,
-				at: Date.parse(stored.at),
-				priority: 0,
-				event: stored.event
-			};
-			records.push(record);
-			const ev = record.event;
-			if (ev.type === "delivery-attempt" || ev.type === "steer" || ev.type === "answer") deliveryEvidence.push(ev);
-			if (ev.type === "question") byId.set(ev.question.id, ev.question);
-			else if (ev.type === "finding") findings.push(ev.finding);
-			else if (ev.type === "answer") {
-				const prior = byId.get(ev.questionId);
-				if (prior && ev.down.delivered) byId.set(ev.questionId, {
-					...prior,
-					status: "answered",
-					decision: {
-						kind: "answer",
-						answer: ev.down.instruction,
-						by: "prior-run"
-					}
-				});
-			} else if (ev.type === "instruction") continuations.push(ev.instruction);
-			else if (ev.type === "mail") mail.push(ev.mail);
-			else if (ev.type === "escalation") escalations.push(ev.escalation);
-			else if (ev.type === "analyst-defined") analystDefinitions.push(ev.analyst);
-		}
-		return {
-			...ownerId !== void 0 ? { ownerId } : {},
-			questions: [...byId.values()],
-			findings,
-			escalations,
-			analystDefinitions,
-			continuations,
-			deliveryEvidence,
-			mail,
-			records
-		};
-	}
-};
-function emptyPriorCoordination(ownerId) {
-	return {
-		...ownerId !== void 0 ? { ownerId } : {},
-		questions: [],
-		findings: [],
-		escalations: [],
-		analystDefinitions: [],
-		continuations: [],
-		deliveryEvidence: [],
-		mail: [],
-		records: []
-	};
-}
-//#endregion
-//#region src/runtime/supervise/run-context.ts
-/**
-*
-* `createInMemoryRunContext` — the one-call bundle of the in-memory stores a
-* `createSupervisor().run(root, task, opts)` needs: a fresh `InMemorySpawnJournal`
-* (the event-sourced spawn log), a fresh `InMemoryResultBlobStore` (the
-* content-addressed `outRef` payload store the driver's `observe`/`finalize` reads
-* settled outputs through), and a fresh `createExecutorRegistry()` (the open
-* `AgentSpec → Executor` resolver).
-*
-* It exists to kill the boilerplate every offline/local supervised run repeats by
-* hand — three constructors threaded into `SupervisorOpts` — and to single-source the
-* ONE wiring invariant that is easy to get wrong: when the root is the recursive
-* `driverAgent` LLM-driver brain AND it may spawn DRIVER children (agents
-* driving agents), the registry MUST be wrapped with `withDriverExecutor` so a
-* `role: 'driver'` child resolves to the nested-scope executor — and that SAME blob
-* store MUST be the one passed to `driverAgent({ blobs })`, or the driver
-* reads from a different store than the scope writes to. Pass `{ withDriver: true }`
-* and reuse the returned `blobs` for both.
-*
-* The spread shape matches `SupervisorOpts` exactly, so the call site reads:
-*   const run = createInMemoryRunContext()
-*   await createSupervisor().run(root, task, { budget, runId, ...run })
-*
-* @experimental
-*/
-/**
-* Build a fresh in-memory run context. Every call returns NEW stores (no shared global
-* state between runs), so two runs never cross-contaminate their journals/blobs.
-*/
-function createInMemoryRunContext(opts = {}) {
-	const base = createExecutorRegistry();
-	return {
-		journal: new InMemorySpawnJournal(),
-		blobs: new InMemoryResultBlobStore(),
-		executors: opts.withDriver ? withDriverExecutor(base) : base
-	};
-}
-/**
-* Build a DURABLE run context: the spawn journal and the result blobs are file-backed (fsynced
-* per append/write) under `dir`, and the context carries `resume: true` so spreading it into
-* `SupervisorOpts` makes the supervisor `loadTree`-first. A run that dies mid-flight therefore
-* resumes when it is re-run with the SAME `runId` and the SAME `dir`: the committed children come
-* back on `Scope.resume` (rehydrated by `replaySpawnTree`) instead of being re-executed.
-*
-* Layout: `${dir}/spawn-journal.jsonl` (one JSONL record per event), `${dir}/blobs/` (one
-* content-addressed JSON file per settled result), and `${dir}/coordination-log.jsonl`
-* (questions, findings, answer decisions, and authorized continuation receipts retained as
-* evidence). The directory is created on first write.
-*
-* Opt-in by construction — `createInMemoryRunContext()` is unchanged and stays the default, so no
-* existing consumer writes to disk or resumes unless it asks for this.
-*/
-function createFileRunContext(dir, opts = {}) {
-	const base = createExecutorRegistry();
-	return {
-		journal: new FileSpawnJournal(`${dir}/spawn-journal.jsonl`),
-		blobs: new FileResultBlobStore(`${dir}/blobs`),
-		executors: opts.withDriver ? withDriverExecutor(base) : base,
-		resume: true,
-		coordinationLog: new FileCoordinationLog(`${dir}/coordination-log.jsonl`)
-	};
-}
-//#endregion
 //#region src/runtime/anytime.ts
 /**
 * The best-so-far fold — the ONE definition of "how good was the run after k results", shared by
@@ -3346,6 +3371,8 @@ function terminatedDescendants(dir, nodeId, sinceIso) {
 */
 function driverAgent(opts) {
 	if (typeof opts.brain !== "function") throw new ValidationError("driverAgent: opts.brain must be a function");
+	if (!Array.isArray(opts.toolNames)) throw new ValidationError("driverAgent: toolNames must name every granted tool explicitly");
+	if (new Set(opts.toolNames).size !== opts.toolNames.length) throw new ValidationError("driverAgent: toolNames contains a duplicate name");
 	if ((opts.extraTools?.length ?? 0) > 0 && typeof opts.executeExtraTool !== "function") throw new ValidationError("driverAgent: extraTools requires executeExtraTool (how to run a work-tool call)");
 	if ((opts.analyzeOnSettle ?? []).map(normalizeAnalyzeOnSettle).some((route) => route.agent === void 0) && !opts.analysts) throw new ValidationError("driverAgent: analyzeOnSettle requires analysts (the lens registry the kinds resolve against)");
 	const reserved = new Set(coordinationVerbNames);
@@ -3391,7 +3418,25 @@ function driverAgent(opts) {
 				...opts.priorCoordination?.analystDefinitions?.length ? { priorAnalystDefinitions: opts.priorCoordination.analystDefinitions } : {}
 			});
 			await coord.ready();
-			opts.onCoordinationTools?.(coord.tools);
+			const availableTools = [...coord.tools, ...opts.nodeTools ?? []];
+			const availableByName = new Map(availableTools.map((tool) => [tool.name, tool]));
+			const extraByName = new Map((opts.extraTools ?? []).map((tool) => [tool.name, tool]));
+			const selectedTools = opts.toolNames.map((name) => {
+				const descriptor = availableByName.get(name);
+				if (descriptor !== void 0) return {
+					kind: "descriptor",
+					descriptor
+				};
+				const extra = extraByName.get(name);
+				if (extra === void 0) throw new ValidationError(`driverAgent: requested tool ${JSON.stringify(name)} is unavailable`);
+				return {
+					kind: "extra",
+					extra
+				};
+			});
+			const modelTools = selectedTools.flatMap((selected) => selected.kind === "descriptor" ? [selected.descriptor] : []);
+			const selectedExtraNames = new Set(selectedTools.flatMap((selected) => selected.kind === "extra" ? [selected.extra.name] : []));
+			opts.onCoordinationTools?.(modelTools);
 			const acknowledger = opts.controlDir === void 0 ? void 0 : createCancelAcknowledger({
 				dir: opts.controlDir,
 				coord,
@@ -3411,33 +3456,22 @@ function driverAgent(opts) {
 				const rearmed = scope.wait(w.spec, { label: w.label });
 				if (!rearmed.ok) throw new RuntimeRunStateError(`driverAgent: cannot re-arm resumed wait '${w.label}' (${rearmed.reason})`);
 			}
-			const byName = new Map([...coord.tools, ...opts.nodeTools ?? []].map((t) => [t.name, t]));
-			const toolSpecs = [
-				...coord.tools.map((t) => ({
-					type: "function",
-					function: {
-						name: t.name,
-						description: t.description,
-						parameters: t.inputSchema
-					}
-				})),
-				...(opts.nodeTools ?? []).map((t) => ({
-					type: "function",
-					function: {
-						name: t.name,
-						description: t.description,
-						parameters: t.inputSchema
-					}
-				})),
-				...(opts.extraTools ?? []).map((t) => ({
-					type: "function",
-					function: {
-						name: t.name,
-						description: t.description,
-						parameters: t.parameters
-					}
-				}))
-			];
+			const byName = new Map(modelTools.map((tool) => [tool.name, tool]));
+			const toolSpecs = selectedTools.map((selected) => selected.kind === "descriptor" ? {
+				type: "function",
+				function: {
+					name: selected.descriptor.name,
+					description: selected.descriptor.description,
+					parameters: selected.descriptor.inputSchema
+				}
+			} : {
+				type: "function",
+				function: {
+					name: selected.extra.name,
+					description: selected.extra.description,
+					parameters: selected.extra.parameters
+				}
+			});
 			const system = typeof opts.systemPrompt === "function" ? opts.systemPrompt(task) : opts.systemPrompt;
 			const tracker = opts.stopRule ? createProgressTracker({ now }) : void 0;
 			let progressStopReason;
@@ -3538,7 +3572,7 @@ function driverAgent(opts) {
 				tools: toolSpecs,
 				...compaction ? { compaction } : {},
 				execute: async (name, args) => {
-					if (opts.executeExtraTool) {
+					if (opts.executeExtraTool && selectedExtraNames.has(name)) {
 						const worked = await runExtraTool(opts.executeExtraTool, name, args);
 						if (worked !== null && worked !== void 0) return worked;
 					}
@@ -3591,7 +3625,10 @@ function driverAgent(opts) {
 			acknowledger?.pass("final");
 			acknowledger?.finish();
 			const submitted = coord.submittedResult();
-			if (submitted) return submitted.result;
+			if (submitted) {
+				opts.onAcceptedSubmission?.(submitted.result);
+				return submitted.result;
+			}
 			return runFinalizer(opts.finalizer ?? bestDelivered, {
 				settled: coord.settled(),
 				blobs: opts.blobs,
@@ -3603,7 +3640,7 @@ function driverAgent(opts) {
 }
 /**
 * The factual context a resumed driver starts from — everything the durable stores prove about
-* the prior process(es): committed settlements, per-key states (completed / lost / failed),
+* the prior process(es): committed settlements, per-key states (completed / in-doubt / failed),
 * re-armed waits, carried-over questions/findings/continuation receipts, and spend already paid.
 * Injected as the brain's first user-context on a resumed run so it continues from unresolved work;
 * old continuation receipts are evidence and are never auto-delivered.
@@ -3620,10 +3657,10 @@ function resumeBrief(resume, prior) {
 	for (const s of resume.settled) lines.push(s.kind === "done" ? `- ${s.handle.id} (${s.handle.label}): done, score=${s.verdict?.score ?? 0}, valid=${s.verdict?.valid ?? false}, outRef=${s.outRef}` : `- ${s.handle.id} (${s.handle.label}): down, reason=${s.reason}`);
 	const byState = (state) => [...resume.keys].filter(([, v]) => v.state === state);
 	const completed = byState("completed");
-	const lost = byState("in-doubt");
+	const inDoubt = byState("in-doubt");
 	const failed = byState("down");
 	if (completed.length > 0) lines.push("", "COMPLETED keys — spawn_worker with the same key returns the finished result, spending nothing:", ...completed.map(([k, v]) => `- ${k} → ${v.id} (${v.label})`));
-	if (lost.length > 0) lines.push("", "Keys LOST in flight with the prior process — this is the unresolved work; spawn_worker with the same key starts a fresh attempt:", ...lost.map(([k, v]) => `- ${k} (prior attempt ${v.id}, ${v.label})`));
+	if (inDoubt.length > 0) lines.push("", "Keys IN DOUBT — a prior process recorded them as started but never recorded a terminal receipt. Do NOT spawn a replacement under these keys; inspect or recover each exact prior execution first:", ...inDoubt.map(([k, v]) => `- ${k} (prior attempt ${v.id}, ${v.label})`));
 	if (failed.length > 0) lines.push("", "Keys whose prior attempt FAILED (settled down) — spawn_worker with the same key retries:", ...failed.map(([k, v]) => `- ${k} (prior attempt ${v.id}, ${v.label})`));
 	if (resume.waits.length > 0) lines.push("", "Pending waits RE-ARMED on their original deadlines (they settle through await_event):", ...resume.waits.map((w) => `- ${w.label} (${w.spec.kind})`));
 	appendPriorCoordination(lines, prior);
@@ -3632,7 +3669,7 @@ function resumeBrief(resume, prior) {
 	return lines.join("\n");
 }
 function hasPriorCoordination(prior) {
-	return prior !== void 0 && (prior.questions.length > 0 || prior.findings.length > 0 || prior.continuations.length > 0 || prior.deliveryEvidence.length > 0);
+	return prior !== void 0 && (prior.questions.length > 0 || prior.findings.length > 0 || prior.continuations.length > 0 || prior.deliveryEvidence.length > 0 || prior.records.some((record) => record.event.type === "submission"));
 }
 function priorCoordinationBrief(prior) {
 	const lines = [
@@ -3699,6 +3736,6 @@ function errMessage(e) {
 	return e instanceof Error ? e.message : String(e);
 }
 //#endregion
-export { questionEscalationTargets as A, analystToolGroupNames as C, downMessageRefusalReasons as D, createCoordinationTools as E, defaultToolDetectors as M, watchTrace as N, normalizeAnalyzeOnSettle as O, DEFAULT_AWAIT_EVENT_TIMEOUT_MS as S, coordinationVerbNames as T, renderAnytimeTable as _, allOf as a, FileCoordinationLog as b, createProgressTracker as c, progressStop as d, sampleFromSettled as f, plateauLength as g, bestSoFar as h, finalizeBestDelivered as i, createEventBus as j, parseAuthoredAnalystDefinition as k, noProgressFor as l, areaUnderCurve as m, createSteerAcknowledger as n, allWorkersStalled as o, anytimeReport as p, driverAgent as r, anyOf as s, createCancelAcknowledger as t, plateau as u, createFileRunContext as v, canonicalFindingEvent as w, ANALYST_DEFINITION_BOUNDS as x, createInMemoryRunContext as y };
+export { watchTrace as A, createCoordinationTools as C, questionEscalationTargets as D, parseAuthoredAnalystDefinition as E, createInMemoryRunContext as M, FileCoordinationLog as N, createEventBus as O, coordinationVerbNames as S, normalizeAnalyzeOnSettle as T, renderAnytimeTable as _, allOf as a, analystToolGroupNames as b, createProgressTracker as c, progressStop as d, sampleFromSettled as f, plateauLength as g, bestSoFar as h, finalizeBestDelivered as i, createFileRunContext as j, defaultToolDetectors as k, noProgressFor as l, areaUnderCurve as m, createSteerAcknowledger as n, allWorkersStalled as o, anytimeReport as p, driverAgent as r, anyOf as s, createCancelAcknowledger as t, plateau as u, ANALYST_DEFINITION_BOUNDS as v, downMessageRefusalReasons as w, canonicalFindingEvent as x, DEFAULT_AWAIT_EVENT_TIMEOUT_MS as y };
 
-//# sourceMappingURL=coordination-driver-pQobxl2Z.js.map
+//# sourceMappingURL=coordination-driver-iSN-m3VX.js.map