@tangle-network/agent-runtime 0.222.1 → 0.224.2

package/dist/{supervisor-af7-tQrQ.js → supervisor-2fsHN1Mf.js}

@@ -764,7 +764,8 @@ function cloneSpend(spend) {
 		...spend.usdKnown === false ? { usdKnown: false } : {},
 		...spend.usdEstimated !== void 0 ? { usdEstimated: spend.usdEstimated } : {},
 		ms: spend.ms,
-		...boxMinutesOf(spend)
+		...boxMinutesOf(spend),
+		...spend.tokensProvenance === void 0 ? {} : { tokensProvenance: spend.tokensProvenance }
 	};
 }
 /**
@@ -14190,6 +14191,9 @@ function mergeBridgeObservedModel(current, next) {
 * unknown reconcile) so a child can never refund twice. Reconciling an OPEN ticket always
 * closes it: a fail-loud condition settles the reservation first and throws afterwards, so no
 * error path can strand a reservation past the join barrier's `assertNoOpenTickets`.
+* Measured spend above a reservation is not a fail-loud condition. The pool commits it, returns
+* it as a `BudgetViolation`, and refuses later reservations from the reduced free balance; the
+* work it paid for is not discarded.
 * A child that declared no `maxUsd` reserved no dollar allocation, so its real dollars are
 * committed as observed spend and debited from the root's balance rather than treated as an
 * overspend of a $0 ceiling it never asked for. If dollar cost is unknowable under a
@@ -14207,6 +14211,20 @@ function mergeBridgeObservedModel(current, next) {
 *
 * @experimental
 */
+/**
+* A reconciliation whose spend the pool cannot verify. It is thrown after the reservation has
+* settled. `budgetViolation` carries any measured overspend on the same settlement, so a child
+* that fails closed on the fault still records how far its known channels exceeded the
+* reservation.
+*/
+var BudgetReconcileFault = class extends Error {
+	budgetViolation;
+	constructor(message, budgetViolation) {
+		super(message);
+		this.name = "BudgetReconcileFault";
+		if (budgetViolation !== void 0) this.budgetViolation = budgetViolation;
+	}
+};
 /** Reject malformed ceilings before they can mint capacity through negative reservations. */
 function assertValidBudget(budget, label = "budget") {
 	const safeInteger = (value, field) => {
@@ -14370,12 +14388,25 @@ function createBudgetPool(root, runStartedAtMs, restore = {}) {
 			if (limit && limit.unit !== value.unit) throw new Error(`resource ${name}: unit mismatch`);
 		}
 	}
-	function commitResources(spend, reserved = {}, requireAll = true) {
-		let violation;
+	/**
+	* Commit named-resource spend and classify it. `allocations` is the settling reservation's own
+	* resource allocations, or `undefined` for spend that holds no reservation (`observe`, restore).
+	*
+	* Unverifiable usage is a `fault`: the remaining balance is consumed so admission closes.
+	* Measured usage above an allocation is `overspent`. Without allocations, measured usage that
+	* leaves a root limit overdrawn is `rootExceeded`. A reservation that stays within its own
+	* allocation is never charged with a root overdraw: `reserve` admits an allocation only from
+	* the remaining balance, so a negative balance at its settlement was caused, and reported, by
+	* earlier spend.
+	*/
+	function commitResources(spend, allocations, requireAll = true) {
+		let fault;
+		let rootExceeded;
+		const overspent = [];
 		for (const [name, state] of resources) {
 			const value = spend.resources?.[name];
 			if (!requireAll && value === void 0) continue;
-			const allocation = reserved?.[name]?.limit ?? 0;
+			const allocation = allocations?.[name]?.limit ?? 0;
 			const amount = value?.amount ?? 0;
 			state.reserved -= allocation;
 			const committed = state.committed + amount;
@@ -14387,11 +14418,20 @@ function createBudgetPool(root, runStartedAtMs, restore = {}) {
 				const retained = Math.max(0, state.remaining);
 				state.committed += retained;
 				state.remaining -= retained;
-				violation ??= overflow ? `resource ${name}: amount overflow under an enforced limit` : `resource ${name}: unknown usage under an enforced limit`;
-			} else if (reserved?.[name] && amount > allocation) violation ??= `resource ${name}: spent ${amount} > reserved ${allocation}`;
-			else if (state.remaining < 0) violation ??= `resource ${name}: exceeded root limit ${state.limit}`;
+				fault ??= overflow ? `resource ${name}: amount overflow under an enforced limit` : `resource ${name}: unknown usage under an enforced limit`;
+			} else if (allocations !== void 0) {
+				if (amount > allocation) overspent.push({
+					channel: `resource:${name}`,
+					reserved: allocation,
+					spent: amount
+				});
+			} else if (state.remaining < 0) rootExceeded ??= `resource ${name}: exceeded root limit ${state.limit}`;
 		}
-		return violation;
+		return {
+			...fault ? { fault } : {},
+			overspent,
+			...rootExceeded ? { rootExceeded } : {}
+		};
 	}
 	let nextTicketId = 0;
 	const open = /* @__PURE__ */ new Map();
@@ -14475,11 +14515,23 @@ function createBudgetPool(root, runStartedAtMs, restore = {}) {
 		const unknownUnderCap = usdCapped && spent.usdKnown === false;
 		const spentTokens = chargedTokens(spent.tokens);
 		const usdBudgeted = ticket.reserved.usdBudgeted !== false;
-		let violation;
-		if (spentTokens > rTokens) violation = `ticket ${ticket.id} spent ${spentTokens} tokens > reserved ${rTokens}`;
-		else if (spent.iterations > rIterations) violation = `ticket ${ticket.id} spent ${spent.iterations} iterations > reserved ${rIterations}`;
-		else if (unknownUnderCap) violation = `ticket ${ticket.id} reported unknown dollar cost under a dollar-capped budget`;
-		else if (usdCapped && usdBudgeted && spent.usd > rUsd) violation = `ticket ${ticket.id} spent $${spent.usd} > reserved $${rUsd}`;
+		const overspent = [];
+		if (spentTokens > rTokens) overspent.push({
+			channel: "tokens",
+			reserved: rTokens,
+			spent: spentTokens
+		});
+		if (spent.iterations > rIterations) overspent.push({
+			channel: "iterations",
+			reserved: rIterations,
+			spent: spent.iterations
+		});
+		let fault = unknownUnderCap ? `ticket ${ticket.id} reported unknown dollar cost under a dollar-capped budget` : void 0;
+		if (!unknownUnderCap && usdCapped && usdBudgeted && spent.usd > rUsd) overspent.push({
+			channel: "usd",
+			reserved: rUsd,
+			spent: spent.usd
+		});
 		open.delete(ticket.id);
 		if (spent.tokensKnown === false) tokensTainted = true;
 		if (!hasCompleteCacheBreakdown(spent.tokens)) cacheBreakdownTainted = true;
@@ -14498,9 +14550,12 @@ function createBudgetPool(root, runStartedAtMs, restore = {}) {
 				freeUsd = 0;
 			} else freeUsd += rUsd - spent.usd;
 		} else committedUsd += spent.usd;
-		const resourceViolation = commitResources(spent, ticket.reserved.resources);
-		violation ??= resourceViolation;
-		if (violation !== void 0) throw new Error(`budget pool: ${violation}`);
+		const resourceSettlement = commitResources(spent, ticket.reserved.resources ?? {});
+		fault ??= resourceSettlement.fault;
+		overspent.push(...resourceSettlement.overspent);
+		const violation = overspent.length === 0 ? void 0 : Object.freeze({ overspent: Object.freeze(overspent.map((entry) => Object.freeze(entry))) });
+		if (fault !== void 0) throw new BudgetReconcileFault(`budget pool: ${fault}`, violation);
+		return violation;
 	}
 	function observe(spend, options = {}) {
 		assertValidSpend(spend, "observed spend");
@@ -14516,7 +14571,8 @@ function createBudgetPool(root, runStartedAtMs, restore = {}) {
 		committedIterations += spend.iterations;
 		committedUsd += spend.usd;
 		if (usdCapped) freeUsd -= spend.usd;
-		const violation = commitResources(spend, {}, !options.partial);
+		const settlement = commitResources(spend, void 0, !options.partial);
+		const violation = settlement.fault ?? settlement.rootExceeded;
 		if (violation) throw new ValidationError$1(`budget pool: ${violation}`);
 	}
 	function readout() {
@@ -15450,8 +15506,10 @@ async function replaySpawnTree(journal, blobs, root) {
 				kind: "down",
 				handle: handleFor(ev.id, "cancelled"),
 				reason: ev.reason,
+				...ev.outRef === void 0 ? {} : { outRef: ev.outRef },
 				infra: ev.infra === true,
 				...ev.providerModel === void 0 ? {} : { providerModel: copyProviderModelEvidence(ev.providerModel) },
+				...budgetViolationOf(ev),
 				trace: ev.trace ?? {
 					status: "unavailable",
 					reason: "execution-did-not-start"
@@ -15468,8 +15526,10 @@ async function replaySpawnTree(journal, blobs, root) {
 				kind: "down",
 				handle: handleFor(ev.id, "failed"),
 				reason: ev.reason ?? ev.verdict?.notes ?? "child down",
+				...ev.outRef === void 0 ? {} : { outRef: ev.outRef },
 				infra: ev.infra === true,
 				...ev.providerModel === void 0 ? {} : { providerModel: copyProviderModelEvidence(ev.providerModel) },
+				...budgetViolationOf(ev),
 				trace,
 				...settlementTime(ev.at),
 				seq: ev.seq
@@ -15489,6 +15549,7 @@ async function replaySpawnTree(journal, blobs, root) {
 			verdict: ev.verdict,
 			spent: cloneSpend(ev.spent),
 			...ev.providerModel === void 0 ? {} : { providerModel: copyProviderModelEvidence(ev.providerModel) },
+			...budgetViolationOf(ev),
 			trace,
 			...settlementTime(ev.at),
 			seq: ev.seq
@@ -15569,6 +15630,7 @@ function materializeTreeView(events) {
 		node.providerModel = copyProviderModelEvidence(ev.providerModel);
 		node.outRef = ev.outRef;
 		node.trace = traceEvidenceFor(ev);
+		node.budgetViolation = budgetViolationOf(ev).budgetViolation;
 		const settledAt = Date.parse(ev.at);
 		if (Number.isFinite(settledAt)) node.settledAt = settledAt;
 	} else if (ev.kind === "woken") {
@@ -15591,6 +15653,7 @@ function materializeTreeView(events) {
 		if (ev.spent !== void 0) node.spent = cloneSpend(ev.spent);
 		node.providerModel = copyProviderModelEvidence(ev.providerModel);
 		node.outRef = ev.outRef;
+		node.budgetViolation = budgetViolationOf(ev).budgetViolation;
 		const settledAt = Date.parse(ev.at);
 		if (Number.isFinite(settledAt)) node.settledAt = settledAt;
 	}
@@ -15644,6 +15707,15 @@ function pendingWaits(events) {
 	}
 	return pending.sort((a, b) => a.ordinal - b.ordinal);
 }
+/** Copy a terminal record's overspend at the journal boundary; absent stays absent. */
+function budgetViolationOf(event) {
+	if (event.budgetViolation === void 0) return {};
+	return { budgetViolation: Object.freeze({ overspent: Object.freeze(event.budgetViolation.overspent.map((entry) => Object.freeze({
+		channel: entry.channel,
+		reserved: entry.reserved,
+		spent: entry.spent
+	}))) }) };
+}
 /** Copy provider evidence at the journal boundary so replay never exposes mutable event state. */
 function copyProviderModelEvidence(evidence) {
 	if (evidence === void 0) return void 0;
@@ -15686,6 +15758,7 @@ function freezeSnapshot(node) {
 		providerModel: node.providerModel,
 		outRef: node.outRef,
 		trace: node.trace,
+		...node.budgetViolation === void 0 ? {} : { budgetViolation: node.budgetViolation },
 		settledAt: node.settledAt,
 		spawnedAt: node.spawnedAt
 	};
@@ -19286,15 +19359,18 @@ async function prepareInterruptedExecutors(opts, events, signal, now, parentId =
 			const validation = createBudgetPool(rootBudget, 0);
 			const reservation = validation.reserve(node.budget);
 			if (!reservation.ok) throw new RuntimeRunStateError(`retained child '${node.id}' exceeds its original root budget`);
-			let violation;
+			let fault;
+			let budgetViolation;
 			try {
-				validation.reconcile(reservation.ticket, recorded.spent);
+				budgetViolation = validation.reconcile(reservation.ticket, recorded.spent);
 			} catch (error) {
-				violation = error instanceof Error ? error.message : String(error);
+				fault = error instanceof Error ? error.message : String(error);
+				if (error instanceof BudgetReconcileFault) budgetViolation = error.budgetViolation;
 			}
 			accepted.push({
 				result: recorded,
-				...violation === void 0 ? {} : { violation }
+				...fault === void 0 ? {} : { fault },
+				...budgetViolation === void 0 ? {} : { budgetViolation }
 			});
 			continue;
 		}
@@ -19336,20 +19412,21 @@ async function prepareInterruptedExecutors(opts, events, signal, now, parentId =
 		});
 	}
 	let seq = events.reduce((max, event) => closesCursorSlot(event) ? Math.max(max, event.seq) : max, -1) + 1;
-	for (const { result, violation } of accepted) {
+	for (const { result, fault, budgetViolation } of accepted) {
 		signal.throwIfAborted();
 		const failureReason = executorFailureReason(result);
-		const reason = violation ?? failureReason;
+		const reason = fault ?? failureReason;
 		await opts.journal.appendEvent(opts.runId, {
 			kind: "settled",
 			id: result.id,
 			status: reason === void 0 ? "done" : "down",
 			outRef: result.outRef,
 			...reason === void 0 ? {} : {
-				infra: violation !== void 0,
+				infra: fault !== void 0,
 				reason
 			},
 			spent: result.spent,
+			...budgetViolation === void 0 ? {} : { budgetViolation },
 			...result.verdict ? { verdict: result.verdict } : {},
 			seq: seq++,
 			at: new Date(now()).toISOString()
@@ -20461,7 +20538,7 @@ function createScope(args) {
 				try {
 					await interactiveBindingCommitted;
 				} catch {
-					resolution = downRecord("interactive worker binding persistence failed", true, s.trace, s.metered, s.providerModel);
+					resolution = downRecord("interactive worker binding persistence failed", true, s.trace, s.metered, s.providerModel, s.outRef);
 				}
 				live.resolved = resolution;
 				return resolution;
@@ -21194,6 +21271,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 	if (settlement.kind === "down") {
 		const cancellation = child.cancellationReason;
 		child.status = cancellation === void 0 ? "failed" : "cancelled";
+		child.outRef = settlement.outRef;
 		child.trace = settlement.trace;
 		child.providerModel = settlement.providerModel;
 		if (!child.recoveryPending) await args.journal.appendEvent(args.root, {
@@ -21210,6 +21288,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 			reason: settlement.reason,
 			...settlement.outRef ? { outRef: settlement.outRef } : {},
 			...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
+			...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
 			trace: settlement.trace,
 			seq,
 			at
@@ -21226,6 +21305,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 			payload: {
 				childId: child.id,
 				status: "down",
+				...settlement.outRef === void 0 ? {} : { outRef: settlement.outRef },
 				reason: settlement.reason,
 				infra: settlement.infra,
 				spent: child.spent,
@@ -21237,7 +21317,9 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 			handle,
 			reason: settlement.reason,
 			infra: settlement.infra,
+			...settlement.outRef === void 0 ? {} : { outRef: settlement.outRef },
 			...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
+			...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
 			trace: settlement.trace,
 			settledAt,
 			seq
@@ -21256,6 +21338,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 		...settlement.verdict ? { verdict: settlement.verdict } : {},
 		spent: settlement.spent,
 		...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
+		...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
 		trace: settlement.trace,
 		seq,
 		at
@@ -21286,6 +21369,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 		...settlement.verdict ? { verdict: settlement.verdict } : {},
 		spent: settlement.spent,
 		...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
+		...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
 		trace: settlement.trace,
 		settledAt,
 		seq
@@ -21308,6 +21392,7 @@ function settledNodeEvidence(child, settlement, settledAt) {
 		...child.providerModel ? { providerModel: detachedSnapshot(child.providerModel, "provider model evidence") } : {},
 		...child.materialization ? { materialization: detachedSnapshot(child.materialization, "materialization receipt") } : {},
 		...child.executionBindings.length > 0 ? { executionBindings: detachedSnapshot([...child.executionBindings], "execution binding receipts") } : {},
+		...child.budgetViolation ? { budgetViolation: detachedSnapshot(child.budgetViolation, "budget violation") } : {},
 		trace: detachedSnapshot(settlement.trace, "worker trace evidence")
 	};
 }
@@ -21392,6 +21477,28 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 	let terminalTelemetryCaptured = false;
 	let teardownStarted = false;
 	let traceEvidence;
+	let retainedOutputRef;
+	const retainOutput = async (result, measured = result.spent) => {
+		let usageError;
+		try {
+			assertReportedSpend(result.spent, `scope.spawn ${live.id}`);
+			live.spent = executor.accounting?.()?.reported ?? measured;
+			terminalTelemetryCaptured = true;
+			live.executorDone = true;
+		} catch (error) {
+			usageError = error;
+		}
+		const out = detachedSnapshot(result.out, "scope child output");
+		const outRef = contentAddress(out);
+		await blobs.put(outRef, out);
+		retainedOutputRef = outRef;
+		if (usageError !== void 0) throw usageError;
+		return {
+			...result,
+			out,
+			outRef
+		};
+	};
 	const captureTraceOnce = async () => {
 		traceEvidence ??= await captureWorkerTraceEvidence(live.readTraceSource, blobs, started);
 		return traceEvidence;
@@ -21424,13 +21531,16 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 					resources: void 0
 				}, opts.budget);
 				try {
-					pool.reconcile(ticket, spend);
-				} catch {}
+					live.budgetViolation = pool.reconcile(ticket, spend);
+				} catch (fault) {
+					if (fault instanceof BudgetReconcileFault) live.budgetViolation = fault.budgetViolation;
+				}
 				throw error;
 			}
-			pool.reconcile(ticket, spend);
+			live.budgetViolation = pool.reconcile(ticket, spend);
 			return;
 		} catch (error) {
+			if (error instanceof BudgetReconcileFault) live.budgetViolation = error.budgetViolation;
 			reconciliationError = error;
 			return error;
 		}
@@ -21455,9 +21565,9 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 				});
 			}, childAbort.signal);
 			live.spent = spend;
+			const reported = executor.resultArtifact();
+			artifact = await retainOutput(reported, preserveUnknownTelemetry(spend, reported.spent));
 			await executionEvidence.complete();
-			artifact = executor.resultArtifact();
-			assertReportedSpend(artifact.spent, `scope.spawn ${live.id}`);
 			const accounting = executor.accounting?.();
 			const terminalSpend = preserveUnknownTelemetry(spend, artifact.spent);
 			live.spent = accounting?.reported ?? terminalSpend;
@@ -21466,8 +21576,7 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 			const reconcileError = reconcileOnce(accounting?.reservation ?? terminalSpend);
 			if (reconcileError !== void 0) throw reconcileError;
 		} else {
-			const terminal = await awaitAbortable(Promise.resolve(ran), childAbort.signal);
-			assertReportedSpend(terminal.spent, `scope.spawn ${live.id}`);
+			const terminal = await retainOutput(await awaitAbortable(Promise.resolve(ran), childAbort.signal));
 			await executionEvidence.complete();
 			const accounting = executor.accounting?.();
 			live.spent = accounting?.reported ?? terminal.spent;
@@ -21482,10 +21591,9 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 		const trace = await captureTraceOnce();
 		if (childAbort.signal.aborted && live.acceptedResult === void 0) {
 			await teardownOnce(opts.shutdown ?? "brutalKill");
-			return downRecord("aborted before settle", true, trace, ownMetered, runtimeOwnedExecutorProviderEvidence(executor));
+			return downRecord("aborted before settle", true, trace, ownMetered, runtimeOwnedExecutorProviderEvidence(executor), retainedOutputRef);
 		}
-		const outRef = contentAddress(artifact.out);
-		await blobs.put(outRef, artifact.out);
+		const outRef = artifact.outRef;
 		const failureReason = executorFailureReason(artifact);
 		if (failureReason !== void 0) {
 			await teardownOnce(opts.shutdown ?? 5e3).catch(() => void 0);
@@ -21554,8 +21662,9 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 					ms
 				});
 			}
+			live.budgetViolation = void 0;
 			return {
-				...downRecord(errMessage(err), true, trace, executor.metered?.()),
+				...downRecord(errMessage(err), true, trace, executor.metered?.(), void 0, retainedOutputRef),
 				reconciled: live.spent
 			};
 		}
@@ -21579,7 +21688,7 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 		const aborted = childAbort.signal.aborted || isAbortError(err);
 		if (started && !terminalTelemetryCaptured && accounting === void 0) live.spent = unknownFloor(live.spent);
 		const reconcileError = reconcileOnce(accounting?.reservation ?? live.spent);
-		return downRecord(errMessage(err), evidenceError !== void 0 || teardownError !== void 0 || reconcileError !== void 0 || aborted || isInfraError(err), trace, executor.metered?.(), providerModel);
+		return downRecord(errMessage(err), evidenceError !== void 0 || teardownError !== void 0 || reconcileError !== void 0 || aborted || isInfraError(err), trace, executor.metered?.(), providerModel, retainedOutputRef);
 	} finally {
 		await closeRetainedWrites();
 	}
@@ -21646,7 +21755,8 @@ function makeTreeView(root, children) {
 		...c.settledAt === void 0 ? {} : { settledAt: c.settledAt },
 		...c.outRef ? { outRef: c.outRef } : {},
 		...c.trace ? { trace: c.trace } : {},
-		...c.providerModel ? { providerModel: c.providerModel } : {}
+		...c.providerModel ? { providerModel: c.providerModel } : {},
+		...c.budgetViolation ? { budgetViolation: c.budgetViolation } : {}
 	}));
 	return {
 		root,
@@ -21816,14 +21926,15 @@ function unknownFloor(spend) {
 		}])) }
 	};
 }
-function downRecord(reason, infra, trace, metered, providerModel) {
+function downRecord(reason, infra, trace, metered, providerModel, outRef) {
 	return {
 		kind: "down",
 		reason,
 		infra,
 		trace,
 		...providerModel ? { providerModel } : {},
-		...metered ? { metered } : {}
+		...metered ? { metered } : {},
+		...outRef === void 0 ? {} : { outRef }
 	};
 }
 /** The one place an absent interactive process is spelled, so every refusal reads the same. */
@@ -22441,6 +22552,9 @@ async function runDriverWithRetry(run) {
 		};
 		const decision = await run.reprompt?.onUnmetContract?.(context) ?? { steer: defaultUnmetContractSteer(context) };
 		if (decision === "stop") return { refusedBy: "caller-stop" };
+		if (run.signal.aborted) return { refusedBy: "aborted" };
+		const afterHook = budgetStop(run.budget(), now());
+		if (afterHook === "deadline" || afterHook === "budget-exhausted") return { refusedBy: afterHook };
 		const steer = typeof decision.steer === "string" ? decision.steer.trim() : "";
 		if (steer.length === 0) throw new ValidationError$1("runDriverWithRetry: onUnmetContract returned an empty steer — return a non-empty instruction or 'stop'");
 		return { steer };
@@ -22448,6 +22562,11 @@ async function runDriverWithRetry(run) {
 	for (let attempt = 1;; attempt += 1) {
 		const before = run.progress();
 		const startedAt = now();
+		const admissionStop = run.signal.aborted ? "aborted" : budgetStop(run.budget(), now());
+		if (admissionStop !== void 0) {
+			if (reentry !== void 0) return;
+			throw new DriverAttemptsExhaustedError(run.signal.aborted ? run.signal.reason : new ValidationError$1(`driver admission: ${admissionStop}`), attempts, admissionStop);
+		}
 		try {
 			await run.drive(attempt, reentry);
 		} catch (error) {
@@ -23390,6 +23509,6 @@ function isNonEmptySpend(s) {
 	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false || Object.values(s.resources ?? {}).some((resource) => resource.amount > 0 || !resource.known);
 }
 //#endregion
-export { bindReusableExecutorExecutionId as $, flatOtelSpan as $n, runtimeOwnedExecutorMaterialization as $r, addHarnessUsage as $t, waitUntil as A, randomSuffix as Ai, RunCancellationReason as An, promptResourceProfileMaterialization as Ar, spendFromUsageTotals as At, readWorkerInteractiveBinding as B, withBudgetResources as Bi, defaultRedactorIdentityMaterial as Bn, writeAllBytes as Br, createInbox as Bt, scopeOwnerExecutorNodeContext as C, addSpend as Ci, resolveAgentEnvironmentProvider as Cn, controlProfileMaterialization as Cr, workerTraceAnalysisStore as Ct, pollFor as D, hasCompleteCacheBreakdown as Di, sandboxSessionTraceSource as Dn, promptControlProfileMaterialization as Dr, meterUsageEvent as Dt, isWaitOutcome as E, deleteBoxSafe as Ei, decodeToolPart as En, profileMaterializationAxes$1 as Er, createBudgetPool as Et, scopeRetainedOwnerResult as F, unmeteredSpend as Fi, recoverRetainedRun as Fn, validateProfileMaterialization as Fr, workerTraceSeamKey as Ft, startRetainedInteractiveRun as G, promptOptionsFromAgentTurnInput as Gi, traceContextToEnv as Gn, inheritRuntimeOwnedExecutorAttestation as Gr, createPeerMailbox as Gt, workerInteractiveBindingsDir as H, abortError$2 as Hi, createPropagatingTraceEmitter as Hn, attestRuntimeOwnedScopeOwner as Hr, DEFAULT_PEER_MAIL_LIMITS as Ht, interactiveAdmissionSeamKey as I, withTimeout as Ii, startRetainedRun as In, worktreeCliProfileMaterialization as Ir, taskToPrompt as It, freeSlots as J, buildLoopSpanNodes as Jn, newExecutionAttemptId as Jr, peerMailVerbNames as Jt, destroyInteractiveEnvironment as K, providerMessageText as Ki, INTELLIGENCE_WIRE_VERSION as Kn, knownExecutionBindingReceipt as Kr, isPeerMailEnvelope as Kt, readWorkerInteractiveAdmissions as L, zeroSpend as Li, startRetainedRunInEnvironment as Ln, isNoEntError as Lr, DEFAULT_STALL_AFTER_MS as Lt, prepareScopeRetainedOwnerTask as M, stringifySafe as Mi, linkAbort as Mn, renderUnsupported as Mr, readWorkerTraceContext as Mt, scopeRetainedOwnerContext as N, throwAbort as Ni, runAbortable as Nn, sandboxActProfileMaterialization as Nr, workerTraceEnv as Nt, timerAt as O, isAbortError$2 as Oi, registerRetainedExecutorPreparation as On, promptModelProfileMaterialization as Or, newUsageTotals as Ot, scopeRetainedOwnerPriorSpend as P, throwIfAborted as Pi, reconnectRetainedRun as Pn, unsupportedProfileDimensions as Pr, workerTraceHeaders as Pt, teardownExecutor as Q, exportEvalRuns as Qn, runtimeOwnedExecutorExecutionBinding as Qr, bridgeModelRouteRefusal as Qt, workerInteractiveAdmissionFile as R, addResourceSpend as Ri, retainedCreateMaterial as Rn, parseCommittedJsonLines as Rr, createActivityLog as Rt, restoreScopeOwnerAcceptedExecution as S, sumSandboxUsage as Si, providerAsSandboxClient as Sn, assertProfileMaterialization as Sr, parseWorkerToolTraceArtifact as St, createWaitProbes as T, cloneSpend as Ti, createPushTraceSource as Tn, fullProfileMaterialization as Tr, assertValidBudget as Tt, reconnectRetainedInteractiveRun as U, awaitAbortable$1 as Ui, mergeTraceEnv as Un, authoredProfileDigest as Ur, PEER_MAIL_WIRE_KEY as Ut, workerInteractiveBindingFile as V, decodeHarnessUsage as Vi, resolveRedactor as Vn, attestRuntimeOwnedPendingExecutor as Vr, AUTHORITY_MARKERS as Vt, recoverRetainedInteractiveRun as W, promptFromAgentTurnInput as Wi, readTraceContextFromEnv as Wn, finalizeRuntimeOwnedPendingExecutor as Wr, claimsAuthority as Wt, rollingDispatch as X, createOpenInferenceFileExporter as Xn, recordRuntimeOwnedDriveHarnessProviderEvidence as Xr, isTerminalNodeStatus as Xt, queueOf as Y, buildRuntimeEventOtelSpans as Yn, providerAttemptEvidence as Yr, isLiveNodeStatus as Yt, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as Z, createOtelExporter as Zn, runtimeOwnedDriveHarnessProviderEvidence as Zr, bridgeAdmissionRefusal as Zt, createScope as _, mapSandboxEvent as _i, canonicalObservedModelParts as _n, harnessSupportsReasoningEffort as _r, pendingWaits as _t, pickBestDelivered as a, executableAgentProfileSnapshot as ai, TERMINAL_DECISIONS as an, createRuntimeEventCollector as ar, snapshotExecutorConfig as at, meterRuntimeOwnedProviderAttempt as b, sandboxEventServedBackend as bi, createAgentEnvironmentProviderRegistry as bn, CodexExecutionDiagnosticError as br, captureWorkerTraceEvidence as bt, DriverAttemptsExhaustedError as c, detachedSnapshot as ci, isTerminalDecision as cn, sanitizeKnowledgeReadinessReport as cr, createSteerableSandboxSession as ct, runDriverWithRetry as d, assertSandboxServedModel as di, probeSandboxCapabilities as dn, runWorktreeHarness as dr, FileSpawnJournal as dt, runtimeOwnedExecutorProviderEvidence as ei, createCodexRolloutStoreReader as en, generateSpanId as er, captureReusableExecutorConfig as et, driverChild as f, canonicalStreamEventFromSandboxEvent as fi, acquireSandbox as fn, captureWorktreeDiff as fr, InMemoryResultBlobStore as ft, beginScopeOwnerAttempt as g, isSandboxTerminalEvent as gi, runBrainLoop as gn, LOCAL_HARNESSES as gr, materializeTreeView as gt, withDriverExecutor as h, extractLlmCallEvent as hi, routerBrain as hn, DEFAULT_LOCAL_HARNESS as hr, loadSpawnForest as ht, collectDelivered as i, unknownMaterializationReceipt as ii, bridgeStopSignalKey as in, toOtelAttributes as ir, createExecutorRegistry as it, consumeScopeRetainedOwnerResult as j, sleep as ji, abortError as jn, renderProfileMaterializationIssues as jr, WORKER_TRACE_PROPAGATION as jt, validateWaitSpec as k, promptCacheTokenClasses as ki, retainedExecutorSeamKey as kn, promptOnlyProfileMaterialization as kr, spendFromUsageEvents as kt, classifyDriverFailure as l, projectSandboxOutcome as li, runAgentRounds as ln, sanitizeRuntimeStreamEvent as lr, createInPlaceCliExecutor as lt, isDriverSpec as m, createSandboxUsageLedger as mi, readPromptOptions as mn, removeWorktree as mr, insideCursorNamespace as mt, createSupervisor as n, runtimeOwnedScopeOwnerRuntime as ni, readCodexRolloutSession as nn, padSpanId as nr, cliWorktreeExecutor as nt, runFinalizer as o, executableAgentSpecSnapshot as oi, createSandboxForSpec as on, createRuntimeStreamEventCollector as or, createWorktreeCliExecutor as ot, driverExecutorFactory as p, createSandboxToolPartState as pi, assertBoxlessPromptOptions as pn, createWorktree as pr, InMemorySpawnJournal as pt, effectiveConcurrency as q, buildLoopOtelSpans as qn, knownMaterializationReceipt as qr, peerMailTools as qt, bestDelivered as r, unknownExecutionBindingReceipt as ri, bridgeRuntimeAttachmentsKey as rn, padTraceId as rr, createExecutor as rt, runTree as s, detachedFrozen as si, defaultSelectWinner as sn, sanitizeAgentRuntimeEvent as sr, DEFAULT_SANDBOX_STEERING_MAX_TURNS as st, createRootHandle as t, runtimeOwnedPendingExecutorMaterialization as ti, harnessUsageIsEmpty as tn, loopEventToOtelSpan as tr, cliInPlaceExecutor as tt, defaultUnmetContractSteer as u, readSandboxOutcome as ui, createSandboxLineage as un, runSettledCommand as ur, FileResultBlobStore as ut, deriveNodeExecutionIdentity as v, mapSandboxToolEvent as vi, observedModelMatchesDeclared as vn, localHarnessExecutable as vr, replaySpawnTree as vt, settledToIteration as w, chargedTokens as wi, sandboxClientAsProvider as wn, defineProfileMaterializationContract as wr, contentAddress as wt, recordScopeOwnerMaterialization as x, sandboxProgressEvents as xi, providerAsExecutor as xn, AGENT_PROFILE_MATERIALIZATION_AXES as xr, isTraceAnalysisStore as xt, meterRuntimeOwnedAccounting as y, notifySandboxEventObserver as yi, DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS as yn, parseCodexTokenUsage as yr, WORKER_TOOL_TRACE_SCHEMA_VERSION as yt, attachWorker as z, resourceTelemetry as zi, defaultRedactor as zn, prepareJsonlAppend as zr, readWorkerProgress as zt };
+export { bindReusableExecutorExecutionId as $, exportEvalRuns as $n, runtimeOwnedExecutorExecutionBinding as $r, bridgeModelRouteRefusal as $t, waitUntil as A, promptCacheTokenClasses as Ai, retainedExecutorSeamKey as An, promptOnlyProfileMaterialization as Ar, spendFromUsageEvents as At, readWorkerInteractiveBinding as B, resourceTelemetry as Bi, defaultRedactor as Bn, prepareJsonlAppend as Br, readWorkerProgress as Bt, scopeOwnerExecutorNodeContext as C, sumSandboxUsage as Ci, providerAsSandboxClient as Cn, assertProfileMaterialization as Cr, workerTraceAnalysisStore as Ct, pollFor as D, deleteBoxSafe as Di, decodeToolPart as Dn, profileMaterializationAxes$1 as Dr, createBudgetPool as Dt, isWaitOutcome as E, cloneSpend as Ei, createPushTraceSource as En, fullProfileMaterialization as Er, assertValidBudget as Et, scopeRetainedOwnerResult as F, throwIfAborted as Fi, reconnectRetainedRun as Fn, unsupportedProfileDimensions as Fr, workerTraceHeaders as Ft, startRetainedInteractiveRun as G, promptFromAgentTurnInput as Gi, readTraceContextFromEnv as Gn, finalizeRuntimeOwnedPendingExecutor as Gr, claimsAuthority as Gt, workerInteractiveBindingsDir as H, decodeHarnessUsage as Hi, resolveRedactor as Hn, attestRuntimeOwnedPendingExecutor as Hr, AUTHORITY_MARKERS as Ht, interactiveAdmissionSeamKey as I, unmeteredSpend as Ii, recoverRetainedRun as In, validateProfileMaterialization as Ir, workerTraceSeamKey as It, freeSlots as J, buildLoopOtelSpans as Jn, knownMaterializationReceipt as Jr, peerMailTools as Jt, destroyInteractiveEnvironment as K, promptOptionsFromAgentTurnInput as Ki, traceContextToEnv as Kn, inheritRuntimeOwnedExecutorAttestation as Kr, createPeerMailbox as Kt, readWorkerInteractiveAdmissions as L, withTimeout as Li, startRetainedRun as Ln, worktreeCliProfileMaterialization as Lr, taskToPrompt as Lt, prepareScopeRetainedOwnerTask as M, sleep as Mi, abortError as Mn, renderProfileMaterializationIssues as Mr, WORKER_TRACE_PROPAGATION as Mt, scopeRetainedOwnerContext as N, stringifySafe as Ni, linkAbort as Nn, renderUnsupported as Nr, readWorkerTraceContext as Nt, timerAt as O, hasCompleteCacheBreakdown as Oi, sandboxSessionTraceSource as On, promptControlProfileMaterialization as Or, meterUsageEvent as Ot, scopeRetainedOwnerPriorSpend as P, throwAbort as Pi, runAbortable as Pn, sandboxActProfileMaterialization as Pr, workerTraceEnv as Pt, teardownExecutor as Q, createOtelExporter as Qn, runtimeOwnedDriveHarnessProviderEvidence as Qr, bridgeAdmissionRefusal as Qt, workerInteractiveAdmissionFile as R, zeroSpend as Ri, startRetainedRunInEnvironment as Rn, isNoEntError as Rr, DEFAULT_STALL_AFTER_MS as Rt, restoreScopeOwnerAcceptedExecution as S, sandboxProgressEvents as Si, providerAsExecutor as Sn, AGENT_PROFILE_MATERIALIZATION_AXES as Sr, parseWorkerToolTraceArtifact as St, createWaitProbes as T, chargedTokens as Ti, sandboxClientAsProvider as Tn, defineProfileMaterializationContract as Tr, BudgetReconcileFault as Tt, reconnectRetainedInteractiveRun as U, abortError$2 as Ui, createPropagatingTraceEmitter as Un, attestRuntimeOwnedScopeOwner as Ur, DEFAULT_PEER_MAIL_LIMITS as Ut, workerInteractiveBindingFile as V, withBudgetResources as Vi, defaultRedactorIdentityMaterial as Vn, writeAllBytes as Vr, createInbox as Vt, recoverRetainedInteractiveRun as W, awaitAbortable$1 as Wi, mergeTraceEnv as Wn, authoredProfileDigest as Wr, PEER_MAIL_WIRE_KEY as Wt, rollingDispatch as X, buildRuntimeEventOtelSpans as Xn, providerAttemptEvidence as Xr, isLiveNodeStatus as Xt, queueOf as Y, buildLoopSpanNodes as Yn, newExecutionAttemptId as Yr, peerMailVerbNames as Yt, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as Z, createOpenInferenceFileExporter as Zn, recordRuntimeOwnedDriveHarnessProviderEvidence as Zr, isTerminalNodeStatus as Zt, createScope as _, isSandboxTerminalEvent as _i, runBrainLoop as _n, LOCAL_HARNESSES as _r, pendingWaits as _t, pickBestDelivered as a, unknownMaterializationReceipt as ai, bridgeStopSignalKey as an, toOtelAttributes as ar, snapshotExecutorConfig as at, meterRuntimeOwnedProviderAttempt as b, notifySandboxEventObserver as bi, DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS as bn, parseCodexTokenUsage as br, captureWorkerTraceEvidence as bt, DriverAttemptsExhaustedError as c, detachedFrozen as ci, defaultSelectWinner as cn, sanitizeAgentRuntimeEvent as cr, createSteerableSandboxSession as ct, runDriverWithRetry as d, readSandboxOutcome as di, createSandboxLineage as dn, runSettledCommand as dr, FileSpawnJournal as dt, runtimeOwnedExecutorMaterialization as ei, addHarnessUsage as en, flatOtelSpan as er, captureReusableExecutorConfig as et, driverChild as f, assertSandboxServedModel as fi, probeSandboxCapabilities as fn, runWorktreeHarness as fr, InMemoryResultBlobStore as ft, beginScopeOwnerAttempt as g, extractLlmCallEvent as gi, routerBrain as gn, DEFAULT_LOCAL_HARNESS as gr, materializeTreeView as gt, withDriverExecutor as h, createSandboxUsageLedger as hi, readPromptOptions as hn, removeWorktree as hr, loadSpawnForest as ht, collectDelivered as i, unknownExecutionBindingReceipt as ii, bridgeRuntimeAttachmentsKey as in, padTraceId as ir, createExecutorRegistry as it, consumeScopeRetainedOwnerResult as j, randomSuffix as ji, RunCancellationReason as jn, promptResourceProfileMaterialization as jr, spendFromUsageTotals as jt, validateWaitSpec as k, isAbortError$2 as ki, registerRetainedExecutorPreparation as kn, promptModelProfileMaterialization as kr, newUsageTotals as kt, classifyDriverFailure as l, detachedSnapshot as li, isTerminalDecision as ln, sanitizeKnowledgeReadinessReport as lr, createInPlaceCliExecutor as lt, isDriverSpec as m, createSandboxToolPartState as mi, assertBoxlessPromptOptions as mn, createWorktree as mr, insideCursorNamespace as mt, createSupervisor as n, runtimeOwnedPendingExecutorMaterialization as ni, harnessUsageIsEmpty as nn, loopEventToOtelSpan as nr, cliWorktreeExecutor as nt, runFinalizer as o, executableAgentProfileSnapshot as oi, TERMINAL_DECISIONS as on, createRuntimeEventCollector as or, createWorktreeCliExecutor as ot, driverExecutorFactory as p, canonicalStreamEventFromSandboxEvent as pi, acquireSandbox as pn, captureWorktreeDiff as pr, InMemorySpawnJournal as pt, effectiveConcurrency as q, providerMessageText as qi, INTELLIGENCE_WIRE_VERSION as qn, knownExecutionBindingReceipt as qr, isPeerMailEnvelope as qt, bestDelivered as r, runtimeOwnedScopeOwnerRuntime as ri, readCodexRolloutSession as rn, padSpanId as rr, createExecutor as rt, runTree as s, executableAgentSpecSnapshot as si, createSandboxForSpec as sn, createRuntimeStreamEventCollector as sr, DEFAULT_SANDBOX_STEERING_MAX_TURNS as st, createRootHandle as t, runtimeOwnedExecutorProviderEvidence as ti, createCodexRolloutStoreReader as tn, generateSpanId as tr, cliInPlaceExecutor as tt, defaultUnmetContractSteer as u, projectSandboxOutcome as ui, runAgentRounds as un, sanitizeRuntimeStreamEvent as ur, FileResultBlobStore as ut, deriveNodeExecutionIdentity as v, mapSandboxEvent as vi, canonicalObservedModelParts as vn, harnessSupportsReasoningEffort as vr, replaySpawnTree as vt, settledToIteration as w, addSpend as wi, resolveAgentEnvironmentProvider as wn, controlProfileMaterialization as wr, contentAddress as wt, recordScopeOwnerMaterialization as x, sandboxEventServedBackend as xi, createAgentEnvironmentProviderRegistry as xn, CodexExecutionDiagnosticError as xr, isTraceAnalysisStore as xt, meterRuntimeOwnedAccounting as y, mapSandboxToolEvent as yi, observedModelMatchesDeclared as yn, localHarnessExecutable as yr, WORKER_TOOL_TRACE_SCHEMA_VERSION as yt, attachWorker as z, addResourceSpend as zi, retainedCreateMaterial as zn, parseCommittedJsonLines as zr, createActivityLog as zt };
 
-//# sourceMappingURL=supervisor-af7-tQrQ.js.map
+//# sourceMappingURL=supervisor-2fsHN1Mf.js.map