@tangle-network/agent-runtime 0.231.1 → 0.233.0

package/dist/{supervisor-DFsXULnE.js → supervisor-C2xWmESG.js}

@@ -5754,7 +5754,18 @@ function generateTraceId() {
 	return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 //#endregion
-//#region src/runtime/native-session-evidence.ts
+//#region src/durable/content-address.ts
+/** Stable content address shared by result and trace artifacts. */
+function contentAddress(artifact) {
+	return `sha256:${createHash("sha256").update(stableStringify(artifact), "utf-8").digest("hex")}`;
+}
+function stableStringify(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+}
+//#endregion
+//#region src/runtime/harness-transcript.ts
 /**
 * Read a sandbox child's own harness transcript out of its environment before the
 * environment is destroyed, and persist it beside the tool-span `trace` receipt.
@@ -5777,9 +5788,11 @@ function generateTraceId() {
 *     `exec`. An environment with `read` but no `exec` cannot be enumerated and is also
 *     reported, not guessed at.
 *
-* Storage is NOT this module's business. The executor returns the artifact inside the result
-* it already settles with, and supervise puts that under the child's `outRef` in its own
-* `ResultBlobStore`. No destroy site learns about storage, and replay rehydrates it for free.
+* Storage is NOT the executor's business. The executor holds the in-memory capture and hands it
+* to the scope through `Executor.harnessTranscript()`; the scope persists it under its own
+* content ref with `persistHarnessTranscript` and settles the receipt. No provider or destroy
+* site learns about storage, the result blob never carries the files, and replay rehydrates a
+* pointer — the bytes are read only by `harnessTranscriptArtifact`, when someone opens them.
 *
 * Credentials are excluded by construction: enumeration lists only the transcript globs
 * for the harness, and any path matching DENY is dropped even if a producer moved a
@@ -5805,9 +5818,15 @@ const HARNESS_ROOTS = Object.freeze({
 */
 const DENY = /(^|\/)(auth\.json|\.credentials\.json|credentials|\.netrc|\.env(\..*)?|secrets?(\.|$)|.*\.(pem|key|p12|pfx)|id_[a-z0-9_]+)$/iu;
 /**
-* Bounds per file and in total. These are deliberately modest: the artifact rides inside the
-* settled result that supervise blobs under one `outRef`, so an unbounded transcript would
-* bloat every replay of that child, not just the capture.
+* Bounds per file and in total, PER CHILD. They multiply by fleet width, and the next person
+* sizing a fleet must find that here: a 132-child pursuit (mech-interp-foundations-astra-20260911f,
+* the widest retained on one operator host) at the ceiling is 132 x 16 MiB = 2.1 GiB of transcript
+* for one run (#1248).
+*
+* That figure is a DISK number, not a replay number. The artifact is persisted under its own
+* content ref in the `ResultBlobStore` and the settlement carries only the receipt, so replay and
+* resume rehydrate a ref, never the files; nothing pays for a transcript until someone opens it.
+* The bound is enforced exactly, after each read, so a child settles at or under MAX_TOTAL_BYTES.
 */
 const MAX_FILE_BYTES = 2 * 1024 * 1024;
 const MAX_TOTAL_BYTES = 16 * 1024 * 1024;
@@ -5818,17 +5837,56 @@ function unavailable$2(reason) {
 		reason
 	});
 }
+/** The one place an absent transcript is spelled, so every settlement reads the same — the
+*  settle path needs it for the reasons only IT can know (an executor that offers no transcript,
+*  a child that never started), which the capture itself never sees. */
+function harnessTranscriptUnavailable(reason) {
+	return unavailable$2(reason);
+}
 /**
 * Enumerate candidate transcript paths inside the environment.
 *
-* `find` is given the roots and prints one path per line. A missing root is not an error:
-* a child that never used a harness has no directory for it.
+* `find -printf` is given the roots and prints one `size<TAB>path` line per file. A missing root
+* is not an error: a child that never used a harness has no directory for it. GNU find is the
+* target (the Tangle Linux box); BSD and BusyBox `find` have no `-printf`, their error is
+* discarded by `2>/dev/null`, and the empty listing then reads as `no-transcript` — that is a
+* known limit, not a fallback. A path-only line (no size) is still accepted and bounded after
+* the read, which is what a stub or a wrapped `find` produces, not what BSD does.
+*
+* Two omissions used to be silent, so `skippedCount` could read 0 on an incomplete capture: a
+* `-size` filter dropped oversized files before they were ever listed, and `head` cut the listing
+* at MAX_FILES with nothing saying so. Both are reported now: an oversized file is skipped by its
+* listed size WITHOUT being read, and a listing that overflows carries one
+* `enumeration-truncated` entry naming the bound.
 */
 async function enumerate(environment, roots, signal) {
 	if (!environment.exec) return void 0;
-	const command = `find ${roots.map((r) => `"$HOME/${r}"`).join(" ")} -type f -size -${Math.floor(MAX_FILE_BYTES / 1024)}k 2>/dev/null | head -${MAX_FILES}`;
+	const command = `find ${roots.map((r) => `"$HOME/${r}"`).join(" ")} -type f -printf '%s\\t%p\\n' 2>/dev/null | head -1001`;
 	try {
-		return ((await environment.exec(command, signal ? { signal } : void 0)).stdout ?? "").split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+		const lines = ((await environment.exec(command, signal ? { signal } : void 0)).stdout ?? "").split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+		const omitted = [];
+		const paths = [];
+		for (const line of lines.slice(0, MAX_FILES)) {
+			const tab = line.indexOf("	");
+			const path = tab === -1 ? line : line.slice(tab + 1);
+			const size = tab === -1 ? void 0 : Number(line.slice(0, tab));
+			if (size !== void 0 && Number.isFinite(size) && size > MAX_FILE_BYTES) {
+				omitted.push({
+					path,
+					reason: "file-exceeds-byte-bound"
+				});
+				continue;
+			}
+			paths.push(path);
+		}
+		if (lines.length > MAX_FILES) omitted.push({
+			path: roots.join(" "),
+			reason: `enumeration-truncated-at-${MAX_FILES}`
+		});
+		return {
+			paths,
+			omitted
+		};
 	} catch {
 		return;
 	}
@@ -5841,16 +5899,17 @@ async function enumerate(environment, roots, signal) {
 * must not fail because evidence could not be collected, and every failure mode is a named
 * `reason` the settled receipt carries instead of an empty artifact that reads as coverage.
 */
-async function captureNativeSessionEvidence(environment, harness, signal) {
+async function captureHarnessTranscript(environment, harness, signal) {
 	if (!environment?.read) return unavailable$2("unsupported-environment");
 	if (harness === void 0) return unavailable$2("unknown-harness");
 	const roots = HARNESS_ROOTS[harness];
 	if (!roots) return unavailable$2("unknown-harness");
-	const paths = await enumerate(environment, roots, signal);
-	if (paths === void 0) return unavailable$2("enumeration-failed");
-	if (paths.length === 0) return unavailable$2("no-transcript");
+	const enumerated = await enumerate(environment, roots, signal);
+	if (enumerated === void 0) return unavailable$2("enumeration-failed");
+	const { paths } = enumerated;
+	if (paths.length === 0 && enumerated.omitted.length === 0) return unavailable$2("no-transcript");
 	const files = [];
-	const skipped = [];
+	const skipped = [...enumerated.omitted];
 	let total = 0;
 	for (const path of paths) {
 		if (signal?.aborted) {
@@ -5884,6 +5943,13 @@ async function captureNativeSessionEvidence(environment, harness, signal) {
 				});
 				continue;
 			}
+			if (total + bytes > MAX_TOTAL_BYTES) {
+				skipped.push({
+					path,
+					reason: "total-byte-budget-exhausted"
+				});
+				continue;
+			}
 			files.push(Object.freeze({
 				path,
 				bytes,
@@ -5897,7 +5963,11 @@ async function captureNativeSessionEvidence(environment, harness, signal) {
 			});
 		}
 	}
-	if (files.length === 0) return unavailable$2("no-transcript");
+	if (files.length === 0) return Object.freeze({
+		status: "unavailable",
+		reason: "nothing-carried",
+		skipped: Object.freeze(skipped)
+	});
 	const artifact = Object.freeze({
 		schemaVersion: 1,
 		harness,
@@ -5905,13 +5975,54 @@ async function captureNativeSessionEvidence(environment, harness, signal) {
 		skipped: Object.freeze(skipped)
 	});
 	return Object.freeze({
-		status: "available",
+		status: "captured",
 		artifact,
 		fileCount: files.length,
 		totalBytes: total,
 		skippedCount: skipped.length
 	});
 }
+/**
+* Persist a capture under its own content ref and return the receipt a settlement carries.
+*
+* The scope calls this, not the executor: storage stays out of every provider and destroy site,
+* exactly as the tool-span trace is persisted by `captureWorkerTraceEvidence` and not by the
+* source that collected it. A capture that is already unavailable passes through untouched.
+*/
+async function persistHarnessTranscript(capture, blobs) {
+	if (capture.status !== "captured") return capture;
+	const transcriptRef = contentAddress(capture.artifact);
+	try {
+		await blobs.put(transcriptRef, capture.artifact);
+	} catch {
+		return unavailable$2("transcript-persistence-failed");
+	}
+	return Object.freeze({
+		status: "available",
+		transcriptRef,
+		harness: capture.artifact.harness,
+		fileCount: capture.fileCount,
+		totalBytes: capture.totalBytes,
+		skippedCount: capture.skippedCount
+	});
+}
+/**
+* Rehydrate the exact persisted transcript a receipt points at, or `undefined` when the receipt
+* says there is none. Throws only when the receipt claims a blob the store does not hold — that
+* is corruption, not absence, and must not read as "no transcript".
+*/
+async function harnessTranscriptArtifact(evidence, blobs) {
+	if (evidence.status !== "available") return void 0;
+	const raw = await blobs.get(evidence.transcriptRef);
+	if (!isHarnessTranscriptArtifact(raw)) throw new ValidationError$1(`harnessTranscriptArtifact: blob store has no transcript artifact for '${evidence.transcriptRef}'`);
+	return raw;
+}
+/** Every entry, not just the arrays: a blob with `files: [null]` is corruption, not a transcript. */
+function isHarnessTranscriptArtifact(value) {
+	if (value === null || typeof value !== "object") return false;
+	const artifact = value;
+	return artifact.schemaVersion === 1 && typeof artifact.harness === "string" && Array.isArray(artifact.files) && artifact.files.every((file) => file !== null && typeof file === "object" && typeof file.path === "string" && typeof file.content === "string" && Number.isSafeInteger(file.bytes) && file.bytes >= 0) && Array.isArray(artifact.skipped) && artifact.skipped.every((entry) => entry !== null && typeof entry === "object" && typeof entry.path === "string" && typeof entry.reason === "string");
+}
 //#endregion
 //#region src/runtime/provider-placement.ts
 const placementMetadataKey = "runtimeProviderPlacement";
@@ -7563,6 +7674,7 @@ function createProviderExecutor(provider, profile, ctx, options, placement) {
 	let artifact;
 	let retained;
 	let pending = false;
+	let harnessTranscript = harnessTranscriptUnavailable("execution-never-started");
 	const retention = retainedExecutorContext(ctx);
 	let destroyed = false;
 	const runtime = options.runtime ?? provider.name;
@@ -7639,6 +7751,7 @@ function createProviderExecutor(provider, profile, ctx, options, placement) {
 				},
 				onEnvironment: (env) => {
 					environment = env;
+					if (harnessTranscript.status === "unavailable" && harnessTranscript.reason === "execution-never-started") harnessTranscript = harnessTranscriptUnavailable("capture-did-not-run");
 					finalizeRuntimeOwnedPendingExecutor(executor, {
 						...plannedDeclaration,
 						execution: {
@@ -7650,6 +7763,9 @@ function createProviderExecutor(provider, profile, ctx, options, placement) {
 				onArtifact: (next) => {
 					artifact = next;
 				},
+				onHarnessTranscript: (next) => {
+					harnessTranscript = next;
+				},
 				onDestroyed: () => {
 					destroyed = true;
 				}
@@ -7735,7 +7851,8 @@ function createProviderExecutor(provider, profile, ctx, options, placement) {
 			if (!artifact) throw new ValidationError(`providerAsExecutor(${provider.name}): resultArtifact() read before stream drained`);
 			return artifact;
 		},
-		traceSource: () => trace.source
+		traceSource: () => trace.source,
+		harnessTranscript: () => harnessTranscript
 	};
 	return attestRuntimeOwnedPendingExecutor(executor, runtime, plannedDeclaration, plannedBinding);
 }
@@ -7832,10 +7949,10 @@ async function* streamProviderExecutor(args) {
 		}
 		if ((args.options.requireTerminalEvent ?? true) && !terminal) throw new ValidationError(`providerAsExecutor(${args.provider.name}): stream ended without a terminal result/done/status event`);
 		yield { kind: "iteration" };
-		const nativeSession = await captureNativeSessionEvidence(environment, args.profile.harness, linked);
+		const harnessTranscript = await captureHarnessTranscript(environment, args.profile.harness, linked);
+		args.onHarnessTranscript(harnessTranscript);
 		const result = {
 			...resultFromEvents(archive.events(), text),
-			nativeSession,
 			...archive.superseded > 0 ? { supersededPartUpdates: archive.superseded } : {},
 			...explicitFailure ? { outcome: outcomeTracker.finish() } : {}
 		};
@@ -7870,6 +7987,7 @@ async function* streamProviderExecutor(args) {
 	} catch (error) {
 		failure = source.retained ? new RetainedExecutionPendingError(error) : error;
 		failed = true;
+		args.onHarnessTranscript(await captureHarnessTranscript(environment, args.profile.harness, linked));
 	} finally {
 		if ((!source.retained || settled !== void 0 && !failed) && !(source.retained && args.retention?.preserveEnvironment) && (args.options.destroyOnSettle ?? true)) try {
 			await environment.destroy?.();
@@ -15074,17 +15192,6 @@ function describeLeakedReservation(leak) {
 	return parts.join(", ");
 }
 //#endregion
-//#region src/durable/content-address.ts
-/** Stable content address shared by result and trace artifacts. */
-function contentAddress(artifact) {
-	return `sha256:${createHash("sha256").update(stableStringify(artifact), "utf-8").digest("hex")}`;
-}
-function stableStringify(value) {
-	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
-	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
-	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
-}
-//#endregion
 //#region src/runtime/supervise/trace-evidence.ts
 /**
 * Durable structured tool evidence for supervised workers.
@@ -15204,27 +15311,6 @@ function runtimeOwnedNestedDriverTreeRoot(owner, parentTreeRoot, driverNodeId) {
 //#endregion
 //#region src/durable/spawn-journal.ts
 /**
-*
-* Event-sourced spawn journal for the recursive execution atom (build steps 3 + 7).
-*
-* The supervision tree is journaled as an append-only event log: every `spawned`,
-* `settled`, and `cancelled` is recorded AFTER it is observed-committed (never
-* speculative), mirroring `ConversationJournal`'s begin/append/load shape. The log
-* holds only the THIN decision record — ids, parentage, budget, the spend a decision
-* consumed, and a content-addressed `outRef`. The payloads the driver branched on
-* (the `out` artifacts) live in a separate `ResultBlobStore`, keyed by `outRef`, so
-* the journal stays small (decisions) and replay rehydrates the exact `Settled` from
-* the blob store (evidence). This is the decision/payload split the replay argument
-* rests on (B1/B2).
-*
-* Replay determinism (B2): `seq` is the monotonic cursor order `scope.next()` yielded
-* each settlement — NOT wall-clock. `replaySpawnTree` sorts strictly by `seq` before
-* touching the blob store, so the order in which rehydration `get`s resolve can never
-* reorder the replayed `Settled[]`; the result is identical regardless of blob latency.
-*
-* @stable
-*/
-/**
 * Mint the content-addressed `outRef` for a result artifact: `sha256:<hex>` over a
 * stable JSON encoding. Producers call this to derive the `outRef` they journal and
 * `put`; the FS/in-mem stores re-derive it on `put` to verify the supplied ref
@@ -15337,14 +15423,17 @@ var InMemorySpawnJournal = class {
 		}
 		this.trees.set(root, {
 			begunAt: at,
-			events: []
+			events: [],
+			index: new SpawnEventIndex(root)
 		});
 	}
 	async appendEvent(root, ev) {
 		const tree = this.trees.get(root);
 		if (!tree) throw new Error(`appendEvent called for unknown spawn tree '${root}'; call beginTree first`);
-		assertSeqUnique(root, tree.events, ev);
-		tree.events.push(detachedSnapshot(ev, "spawn event"));
+		const event = detachedSnapshot(ev, "spawn event");
+		tree.index.assert(event);
+		tree.events.push(event);
+		tree.index.add(event);
 	}
 };
 /**
@@ -15359,6 +15448,7 @@ var InMemorySpawnJournal = class {
 var FileSpawnJournal = class {
 	path;
 	appendTail = Promise.resolve();
+	appendIndex;
 	constructor(path) {
 		this.path = path;
 	}
@@ -15373,12 +15463,14 @@ var FileSpawnJournal = class {
 		}
 		let begun = false;
 		const events = [];
+		const index = new SpawnEventIndex(root);
 		for (const record of parseCommittedJsonLines(text, this.path)) {
 			if (record.root !== root) continue;
 			if (record.kind === "begin") begun = true;
 			else {
 				if (!begun) throw new Error(`spawn journal corrupted: event for tree '${root}' precedes its begin record`);
-				assertSeqUnique(root, events, record.event);
+				index.assert(record.event);
+				index.add(record.event);
 				events.push(record.event);
 			}
 		}
@@ -15386,41 +15478,73 @@ var FileSpawnJournal = class {
 	}
 	async beginTree(root, at) {
 		return this.serializeAppend(async () => {
-			const existing = await this.loadTreeBegin(root);
+			const state = await this.validationIndex();
+			const existing = state.trees.get(root);
 			if (existing) {
-				if (existing !== at) throw new Error(`spawn tree '${root}' already begun in ${this.path} at ${existing}; refusing to overwrite with ${at}`);
+				if (existing.begunAt !== at) throw new Error(`spawn tree '${root}' already begun in ${this.path} at ${existing.begunAt}; refusing to overwrite with ${at}`);
 				return;
 			}
-			await this.writeRecord({
+			state.stamp = await this.writeRecord({
 				kind: "begin",
 				root,
 				at
 			});
+			state.trees.set(root, {
+				begunAt: at,
+				index: new SpawnEventIndex(root)
+			});
 		});
 	}
 	async appendEvent(root, ev) {
 		const event = detachedSnapshot(ev, "spawn event");
 		return this.serializeAppend(async () => {
-			const events = await this.loadTree(root);
-			if (events === void 0) throw new Error(`appendEvent called for unknown spawn tree '${root}'; call beginTree first`);
-			assertSeqUnique(root, events, event);
-			await this.writeRecord({
+			const state = await this.validationIndex();
+			const tree = state.trees.get(root);
+			if (tree === void 0) throw new Error(`appendEvent called for unknown spawn tree '${root}'; call beginTree first`);
+			tree.index.assert(event);
+			state.stamp = await this.writeRecord({
 				kind: "event",
 				root,
 				event
 			});
+			tree.index.add(event);
 		});
 	}
-	async loadTreeBegin(root) {
+	async validationIndex() {
+		const fs = await import("node:fs/promises");
+		const stamp = await this.fileStamp();
+		if (this.appendIndex && this.appendIndex.stamp === stamp) return this.appendIndex;
+		this.appendIndex = void 0;
+		const trees = /* @__PURE__ */ new Map();
+		if (stamp !== void 0) {
+			const text = await fs.readFile(this.path, "utf8");
+			if (await this.fileStamp() !== stamp) throw new Error("spawn journal changed while rebuilding its append index");
+			for (const record of parseCommittedJsonLines(text, this.path)) if (record.kind === "begin") {
+				if (!trees.has(record.root)) trees.set(record.root, {
+					begunAt: record.at,
+					index: new SpawnEventIndex(record.root)
+				});
+			} else {
+				const tree = trees.get(record.root);
+				if (!tree) throw new Error(`spawn journal corrupted: event for tree '${record.root}' precedes its begin record`);
+				tree.index.assert(record.event);
+				tree.index.add(record.event);
+			}
+		}
+		this.appendIndex = {
+			stamp,
+			trees
+		};
+		return this.appendIndex;
+	}
+	async fileStamp() {
 		const fs = await import("node:fs/promises");
-		let text;
 		try {
-			text = await fs.readFile(this.path, "utf8");
-		} catch (err) {
-			if (isNoEntError(err)) return void 0;
-			throw err;
+			return journalFileStamp(await fs.stat(this.path, { bigint: true }));
+		} catch (error) {
+			if (isNoEntError(error)) return void 0;
+			throw error;
 		}
-		for (const record of parseCommittedJsonLines(text, this.path)) if (record.root === root && record.kind === "begin") return record.at;
 	}
 	async serializeAppend(operation) {
 		const append = this.appendTail.then(operation);
@@ -15430,17 +15554,29 @@ var FileSpawnJournal = class {
 	async writeRecord(record) {
 		const fs = await import("node:fs/promises");
 		const path = await import("node:path");
-		await fs.mkdir(path.dirname(this.path), { recursive: true });
-		const needsSeparator = await prepareJsonlAppend(this.path);
-		const fh = await fs.open(this.path, "a");
 		try {
-			await writeAllBytes(fh, `${needsSeparator ? "\n" : ""}${JSON.stringify(record)}\n`);
-			await fh.sync();
-		} finally {
-			await fh.close();
+			await fs.mkdir(path.dirname(this.path), { recursive: true });
+			const needsSeparator = await prepareJsonlAppend(this.path);
+			const fh = await fs.open(this.path, "a");
+			try {
+				await writeAllBytes(fh, `${needsSeparator ? "\n" : ""}${JSON.stringify(record)}\n`);
+				await fh.sync();
+				const stamp = journalFileStamp(await fh.stat({ bigint: true }));
+				if (await this.fileStamp() !== stamp) throw new Error("spawn journal changed while acknowledging its append");
+				return stamp;
+			} finally {
+				await fh.close();
+			}
+		} catch (error) {
+			this.appendIndex = void 0;
+			throw error;
 		}
 	}
 };
+/** Detect replacement, truncation, and same-size edits; this is not a cross-process write lock. */
+function journalFileStamp(stat) {
+	return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+}
 /**
 * Load every journal tree owned by one recursive supervision run and flatten its nodes/events.
 *
@@ -15707,79 +15843,104 @@ function servedIdentityParts(model) {
 		snapshot
 	};
 }
-/** Retained records form one ordered admission chain; older journals need no such chain. */
-function assertRetainedExecutionOrder(events, event) {
-	if (event.kind !== "execution-input" && event.kind !== "execution-admitted" && event.kind !== "execution-result") return;
-	const nodeEvents = events.filter((item) => item.id === event.id);
-	let inputIndex = -1;
-	for (let index = 0; index < nodeEvents.length; index++) if (nodeEvents[index].kind === "execution-input") inputIndex = index;
-	const prior = inputIndex < 0 ? nodeEvents : nodeEvents.slice(inputIndex);
-	function fail(reason) {
-		throw new Error(`spawn journal corrupted: retained execution '${event.id}' ${reason}`);
-	}
-	if (!nodeEvents.some((item) => item.kind === "spawned")) fail("precedes its spawn");
-	if (nodeEvents.some(closesCursorSlot)) fail("follows its terminal settlement");
-	if (event.kind === "execution-input") {
-		if (!/^sha256:[0-9a-f]{64}$/.test(event.taskRef)) fail("has an invalid task reference");
-		if (nodeEvents.some((item) => item.kind === "execution-input" && item.seq === event.seq)) fail("has duplicate input sequence");
-		if (inputIndex >= 0 && !prior.some((item) => item.kind === "execution-result")) fail("input replaces an unfinished invocation");
-		return;
-	}
-	const admissions = prior.flatMap((item) => item.kind === "execution-admitted" ? [item.admission] : []);
-	if (event.kind === "execution-result") {
-		if (prior.some((item) => item.kind === "execution-result")) fail("has duplicate result");
-		if (!admissions.some((item) => item.phase === "dispatched")) fail("result precedes dispatch");
-		if (!/^sha256:[0-9a-f]{64}$/.test(event.outRef)) fail("has an invalid result reference");
-		assertValidSpend(event.spent, "retained execution result");
-		executorFailureReason(event);
-		return;
-	}
-	const admission = event.admission;
-	if (!admission || ![
-		"intent",
-		"environment",
-		"dispatched"
-	].includes(admission.phase)) fail("has an invalid admission phase");
-	if (admissions.some((item) => item.phase === admission.phase)) fail("has duplicate admission phase");
-	if (prior.some((item) => item.kind === "execution-result")) fail("admission follows result");
-	if (!prior.some((item) => item.kind === "execution-input")) fail("admission precedes input");
-	if (admission.phase === "intent") {
-		if (admissions.length !== 0) fail("intent follows another admission");
-		return;
-	}
-	const intent = admissions.find((item) => item.phase === "intent");
-	if (intent?.phase !== "intent") fail("admission precedes intent");
-	if (admission.idempotencyKey !== intent.idempotencyKey || admission.turnId !== intent.turnId) fail("changes its admitted request identity");
-	if (admission.phase === "environment") {
-		if (admission.provider !== intent.provider || admission.sessionId !== intent.sessionId || admission.executionId !== intent.executionId) fail("changes its admitted execution identity");
-		return;
-	}
-	const environment = admissions.find((item) => item.phase === "environment");
-	if (environment?.phase !== "environment") fail("dispatch precedes environment");
-	const control = admission.controlRef;
-	if (!control || control.provider !== intent.provider || control.environmentId !== environment.environmentId || control.sessionId !== intent.sessionId || control.executionId !== intent.executionId) fail("dispatch changes its admitted execution identity");
-}
-/**
-* Two `seq` namespaces share the journal: a `spawned` event's `seq` is the spawn ordinal
-* (the order children were created), and a `settled`/`cancelled` event's `seq` is the
-* monotonic CURSOR order `scope.next()` yielded that settlement (B2). The uniqueness
-* replay rests on is the cursor namespace — two settlements cannot share the position
-* replay orders by — so the guard checks only settled/cancelled events. A `spawned`
-* ordinal legitimately equals a later `settled` cursor seq and is not a collision.
-*/
-function assertSeqUnique(root, events, ev) {
-	assertRetainedExecutionOrder(events, ev);
-	if (ev.kind === "materialized") {
-		if (events.some((event) => event.kind === "materialized" && event.id === ev.id)) throw new Error(`spawn journal corrupted: duplicate materialization receipt for node '${ev.id}' in tree '${root}'`);
-		if (!events.some((event) => event.kind === "spawned" && event.id === ev.id)) throw new Error(`spawn journal corrupted: materialization for node '${ev.id}' precedes its spawn in tree '${root}'`);
-	}
-	if (ev.kind === "execution-bound") {
-		if (events.some((event) => event.kind === "execution-bound" && event.id === ev.id && event.binding.attemptId === ev.binding.attemptId)) throw new Error(`spawn journal corrupted: duplicate execution binding for node '${ev.id}' attempt '${ev.binding.attemptId}' in tree '${root}'`);
-		if (!events.some((event) => event.kind === "materialized" && event.id === ev.id)) throw new Error(`spawn journal corrupted: execution binding for node '${ev.id}' precedes materialization in tree '${root}'`);
+/** One validation implementation for memory, durable append, and cold replay. */
+var SpawnEventIndex = class {
+	root;
+	nodes = /* @__PURE__ */ new Map();
+	cursors = /* @__PURE__ */ new Set();
+	constructor(root) {
+		this.root = root;
+	}
+	assert(event) {
+		const node = this.nodes.get(event.id);
+		this.assertRetained(node, event);
+		if (event.kind === "materialized") {
+			if (node?.materialized) throw new Error(`spawn journal corrupted: duplicate materialization receipt for node '${event.id}' in tree '${this.root}'`);
+			if (!node?.spawned) throw new Error(`spawn journal corrupted: materialization for node '${event.id}' precedes its spawn in tree '${this.root}'`);
+		}
+		if (event.kind === "execution-bound") {
+			if (node?.bindings.has(event.binding.attemptId)) throw new Error(`spawn journal corrupted: duplicate execution binding for node '${event.id}' attempt '${event.binding.attemptId}' in tree '${this.root}'`);
+			if (!node?.materialized) throw new Error(`spawn journal corrupted: execution binding for node '${event.id}' precedes materialization in tree '${this.root}'`);
+		}
+		if (!outsideCursorNamespace(event) && this.cursors.has(event.seq)) throw new Error(`spawn journal corrupted: duplicate cursor seq ${event.seq} in tree '${this.root}'; the cursor order replay relies on is not unique`);
+	}
+	/** Called only after validation and, for the file writer, a successful durable append. */
+	add(event) {
+		if (!outsideCursorNamespace(event)) this.cursors.add(event.seq);
+		if (event.kind !== "spawned" && event.kind !== "materialized" && event.kind !== "execution-bound" && event.kind !== "execution-input" && event.kind !== "execution-admitted" && event.kind !== "execution-result" && !closesCursorSlot(event)) return;
+		let node = this.nodes.get(event.id);
+		if (!node) {
+			node = {
+				spawned: false,
+				closed: false,
+				materialized: false,
+				bindings: /* @__PURE__ */ new Set(),
+				inputs: /* @__PURE__ */ new Set(),
+				input: false,
+				result: false,
+				admissions: /* @__PURE__ */ new Map()
+			};
+			this.nodes.set(event.id, node);
+		}
+		if (event.kind === "spawned") node.spawned = true;
+		else if (event.kind === "materialized") node.materialized = true;
+		else if (event.kind === "execution-bound") node.bindings.add(event.binding.attemptId);
+		else if (event.kind === "execution-input") {
+			node.inputs.add(event.seq);
+			node.input = true;
+			node.result = false;
+			node.admissions.clear();
+		} else if (event.kind === "execution-admitted") node.admissions.set(event.admission.phase, event.admission);
+		else if (event.kind === "execution-result") node.result = true;
+		if (closesCursorSlot(event)) node.closed = true;
+	}
+	assertRetained(node, event) {
+		if (event.kind !== "execution-input" && event.kind !== "execution-admitted" && event.kind !== "execution-result") return;
+		function fail(reason) {
+			throw new Error(`spawn journal corrupted: retained execution '${event.id}' ${reason}`);
+		}
+		if (!node?.spawned) fail("precedes its spawn");
+		if (node.closed) fail("follows its terminal settlement");
+		if (event.kind === "execution-input") {
+			if (!/^sha256:[0-9a-f]{64}$/.test(event.taskRef)) fail("has an invalid task reference");
+			if (node.inputs.has(event.seq)) fail("has duplicate input sequence");
+			if (node.input && !node.result) fail("input replaces an unfinished invocation");
+			return;
+		}
+		if (event.kind === "execution-result") {
+			if (node.result) fail("has duplicate result");
+			if (!node.admissions.has("dispatched")) fail("result precedes dispatch");
+			if (!/^sha256:[0-9a-f]{64}$/.test(event.outRef)) fail("has an invalid result reference");
+			assertValidSpend(event.spent, "retained execution result");
+			executorFailureReason(event);
+			return;
+		}
+		const admission = event.admission;
+		if (!admission || ![
+			"intent",
+			"environment",
+			"dispatched"
+		].includes(admission.phase)) fail("has an invalid admission phase");
+		if (node.admissions.has(admission.phase)) fail("has duplicate admission phase");
+		if (node.result) fail("admission follows result");
+		if (!node.input) fail("admission precedes input");
+		if (admission.phase === "intent") {
+			if (node.admissions.size !== 0) fail("intent follows another admission");
+			return;
+		}
+		const intent = node.admissions.get("intent");
+		if (intent?.phase !== "intent") fail("admission precedes intent");
+		if (admission.idempotencyKey !== intent.idempotencyKey || admission.turnId !== intent.turnId) fail("changes its admitted request identity");
+		if (admission.phase === "environment") {
+			if (admission.provider !== intent.provider || admission.sessionId !== intent.sessionId || admission.executionId !== intent.executionId) fail("changes its admitted execution identity");
+			return;
+		}
+		const environment = node.admissions.get("environment");
+		if (environment?.phase !== "environment") fail("dispatch precedes environment");
+		const control = admission.controlRef;
+		if (!control || control.provider !== intent.provider || control.environmentId !== environment.environmentId || control.sessionId !== intent.sessionId || control.executionId !== intent.executionId) fail("dispatch changes its admitted execution identity");
 	}
-	if (outsideCursorNamespace(ev)) return;
-	if (events.some((e) => !outsideCursorNamespace(e) && e.seq === ev.seq)) throw new Error(`spawn journal corrupted: duplicate cursor seq ${ev.seq} in tree '${root}'; the cursor order replay relies on is not unique`);
-}
+};
 /**
 * The records that CLOSE a node's cursor slot: a settlement, a cancellation, or a wait being
 * woken. The complement question to {@link outsideCursorNamespace}, and the one a resume needs —
@@ -15922,6 +16083,8 @@ async function replaySpawnTree(journal, blobs, root) {
 					status: "unavailable",
 					reason: "execution-did-not-start"
 				},
+				...ev.harnessTranscript === void 0 ? {} : { harnessTranscript: ev.harnessTranscript },
+				...ev.retainedExecution === void 0 ? {} : { retainedExecution: ev.retainedExecution },
 				...settlementTime(ev.at),
 				seq: ev.seq
 			});
@@ -15939,6 +16102,8 @@ async function replaySpawnTree(journal, blobs, root) {
 				...ev.providerModel === void 0 ? {} : { providerModel: copyProviderModelEvidence(ev.providerModel) },
 				...budgetViolationOf(ev),
 				trace,
+				...ev.harnessTranscript === void 0 ? {} : { harnessTranscript: ev.harnessTranscript },
+				...ev.retainedExecution === void 0 ? {} : { retainedExecution: ev.retainedExecution },
 				...settlementTime(ev.at),
 				seq: ev.seq
 			});
@@ -15959,6 +16124,7 @@ async function replaySpawnTree(journal, blobs, root) {
 			...ev.providerModel === void 0 ? {} : { providerModel: copyProviderModelEvidence(ev.providerModel) },
 			...budgetViolationOf(ev),
 			trace,
+			...ev.harnessTranscript === void 0 ? {} : { harnessTranscript: ev.harnessTranscript },
 			...settlementTime(ev.at),
 			seq: ev.seq
 		});
@@ -16039,6 +16205,7 @@ function materializeTreeView(events) {
 		node.outRef = ev.outRef;
 		node.trace = traceEvidenceFor(ev);
 		node.budgetViolation = budgetViolationOf(ev).budgetViolation;
+		if (ev.retainedExecution !== void 0) node.retainedExecution = ev.retainedExecution;
 		const settledAt = Date.parse(ev.at);
 		if (Number.isFinite(settledAt)) node.settledAt = settledAt;
 	} else if (ev.kind === "woken") {
@@ -16062,6 +16229,7 @@ function materializeTreeView(events) {
 		node.providerModel = copyProviderModelEvidence(ev.providerModel);
 		node.outRef = ev.outRef;
 		node.budgetViolation = budgetViolationOf(ev).budgetViolation;
+		if (ev.retainedExecution !== void 0) node.retainedExecution = ev.retainedExecution;
 		const settledAt = Date.parse(ev.at);
 		if (Number.isFinite(settledAt)) node.settledAt = settledAt;
 	}
@@ -16167,6 +16335,7 @@ function freezeSnapshot(node) {
 		outRef: node.outRef,
 		trace: node.trace,
 		...node.budgetViolation === void 0 ? {} : { budgetViolation: node.budgetViolation },
+		...node.retainedExecution === void 0 ? {} : { retainedExecution: node.retainedExecution },
 		settledAt: node.settledAt,
 		spawnedAt: node.spawnedAt
 	};
@@ -20971,7 +21140,7 @@ function createScope(args) {
 				try {
 					await interactiveBindingCommitted;
 				} catch {
-					resolution = downRecord("interactive worker binding persistence failed", true, s.trace, s.metered, s.providerModel, s.outRef);
+					resolution = downRecord("interactive worker binding persistence failed", true, s.trace, s.metered, s.providerModel, s.outRef, s.harnessTranscript);
 				}
 				live.resolved = resolution;
 				return resolution;
@@ -21412,7 +21581,40 @@ function createScope(args) {
 				clearTimeout(timer);
 			}
 		}));
-		for (const { child, receipts } of released) for (const receipt of receipts) await appendEnvironmentTeardown(args.journal, args.root, child.id, receipt, new Date(now()).toISOString());
+		const prior = released.length > 0 ? await args.journal.loadTree(args.root) ?? [] : [];
+		for (const { child, receipts } of released) {
+			for (const receipt of receipts) await appendEnvironmentTeardown(args.journal, args.root, child.id, receipt, new Date(now()).toISOString());
+			if (child.cleanupConfirmed && child.recoveryPending === true && child.resolved?.kind === "down" && child.settledSeq !== void 0 && child.settledAt !== void 0 && !prior.some((event) => event.id === child.id && closesCursorSlot(event))) {
+				child.budgetViolation = child.retainedViolation;
+				const settledAt = child.settledAt;
+				await args.journal.appendEvent(args.root, terminalDownEvent(child, child.resolved, child.settledSeq, new Date(settledAt).toISOString(), "released"));
+				child.retainedExecution = "released";
+				const releasedAt = now();
+				notifyRuntimeHookEvent(args.hooks, {
+					id: `${child.id}:released`,
+					runId: args.root,
+					target: "agent.child",
+					phase: "after",
+					timestamp: releasedAt,
+					stepIndex: child.settledSeq,
+					parentId: args.parentId,
+					payload: {
+						childId: child.id,
+						status: "down",
+						retainedExecution: "released",
+						releasedAt,
+						...child.resolved.outRef === void 0 ? {} : { outRef: child.resolved.outRef },
+						reason: child.resolved.reason,
+						infra: child.resolved.infra,
+						spent: child.spent,
+						...settledNodeEvidence(child, {
+							...child.resolved,
+							metered: void 0
+						}, settledAt)
+					}
+				}, { signal: args.signal });
+			}
+		}
 	});
 	registerScopeRetainedOwner(scope, {
 		rootId: args.root,
@@ -21696,12 +21898,14 @@ async function appendSettlementMetering(journal, root, id, spend, at) {
 /** An open node's reconciled floor has the same per-child sequence discipline as its metering:
 *  outside the cursor namespace, monotonic per node, so a node reconciled once per process (a
 *  retained failure, a recovery, a second retained failure) keeps its records ordered. */
-async function appendReconciledFloor(journal, root, id, spent, at) {
+async function appendReconciledFloor(journal, root, id, spent, at, harnessTranscript) {
+	const seq = await nextPerNodeSeq(journal, root, "reconciled", id);
 	await appendAcknowledged(journal, root, {
 		kind: "reconciled",
 		id,
 		spent,
-		seq: await nextPerNodeSeq(journal, root, "reconciled", id),
+		...harnessTranscript ? { harnessTranscript } : {},
+		seq,
 		at
 	});
 }
@@ -21737,34 +21941,21 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 	if (child.wait) return finalizeWait(child, settlement, seq, args, now, handle);
 	const settledAt = now();
 	child.settledAt = settledAt;
+	child.settledSeq = seq;
 	const at = new Date(settledAt).toISOString();
 	if (settlement.metered) await appendSettlementMetering(args.journal, args.root, child.id, settlement.metered, at);
 	if (settlement.kind === "down") {
-		const cancellation = child.cancellationReason;
-		child.status = cancellation === void 0 ? "failed" : "cancelled";
+		child.status = child.cancellationReason === void 0 ? "failed" : "cancelled";
 		child.outRef = settlement.outRef;
 		child.trace = settlement.trace;
 		child.providerModel = settlement.providerModel;
-		if (!child.recoveryPending) await args.journal.appendEvent(args.root, {
-			...cancellation === void 0 ? {
-				kind: "settled",
-				status: "down"
-			} : {
-				kind: "cancelled",
-				source: cancellation.source
-			},
-			id: child.id,
-			spent: child.spent,
-			infra: settlement.infra,
-			reason: settlement.reason,
-			...settlement.outRef ? { outRef: settlement.outRef } : {},
-			...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
-			...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
-			trace: settlement.trace,
-			seq,
-			at
-		});
-		else if (settlement.reconciled !== void 0) await appendReconciledFloor(args.journal, args.root, child.id, settlement.reconciled, at);
+		const retainedPending = child.recoveryPending === true;
+		if (!retainedPending) await args.journal.appendEvent(args.root, terminalDownEvent(child, settlement, seq, at));
+		else {
+			child.retainedExecution = "pending";
+			if (settlement.reconciled !== void 0) await appendReconciledFloor(args.journal, args.root, child.id, settlement.reconciled, at, settlement.harnessTranscript);
+		}
+		const retainedExecution = retainedPending ? { retainedExecution: "pending" } : {};
 		notifyRuntimeHookEvent(args.hooks, {
 			id: `${child.id}:settled`,
 			runId: args.root,
@@ -21779,6 +21970,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 				...settlement.outRef === void 0 ? {} : { outRef: settlement.outRef },
 				reason: settlement.reason,
 				infra: settlement.infra,
+				...retainedExecution,
 				spent: child.spent,
 				...settledNodeEvidence(child, settlement, settledAt)
 			}
@@ -21788,10 +21980,12 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 			handle,
 			reason: settlement.reason,
 			infra: settlement.infra,
+			...retainedExecution,
 			...settlement.outRef === void 0 ? {} : { outRef: settlement.outRef },
 			...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
 			...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
 			trace: settlement.trace,
+			...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {},
 			settledAt,
 			seq
 		};
@@ -21811,6 +22005,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 		...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
 		...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
 		trace: settlement.trace,
+		...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {},
 		seq,
 		at
 	});
@@ -21842,6 +22037,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 		...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
 		...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
 		trace: settlement.trace,
+		...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {},
 		settledAt,
 		seq
 	};
@@ -21854,6 +22050,35 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 * absent — an unreported receipt must not read as an empty one. Snapshots are detached because
 * an observer may serialize them after the live child has moved on.
 */
+/** The one builder of a down child's terminal record, for both its writers: the settle path at
+*  the reconcile and the release sweep closing a retained slot later. Two hand-written literals
+*  for one record shape is how a field lands on one path and not the other (#1244 was exactly
+*  that for `harnessTranscript`). `cancelled` keeps its `source` from the child's own
+*  cancellation reason, so a released cancelled child records the same source it settled with. */
+function terminalDownEvent(child, settlement, seq, at, retainedExecution) {
+	const cancellation = child.cancellationReason;
+	return {
+		...cancellation === void 0 ? {
+			kind: "settled",
+			status: "down"
+		} : {
+			kind: "cancelled",
+			source: cancellation.source
+		},
+		id: child.id,
+		spent: child.spent,
+		infra: settlement.infra,
+		reason: settlement.reason,
+		...settlement.outRef ? { outRef: settlement.outRef } : {},
+		...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
+		...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
+		trace: settlement.trace,
+		...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {},
+		...retainedExecution === void 0 ? {} : { retainedExecution },
+		seq,
+		at
+	};
+}
 function settledNodeEvidence(child, settlement, settledAt) {
 	return {
 		runtime: child.runtime,
@@ -21974,6 +22199,11 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 		traceEvidence ??= await captureWorkerTraceEvidence(live.readTraceSource, blobs, started);
 		return traceEvidence;
 	};
+	let transcriptEvidence;
+	const persistTranscriptOnce = async () => {
+		transcriptEvidence ??= await persistHarnessTranscript(readHarnessTranscript(executor), blobs);
+		return transcriptEvidence;
+	};
 	const teardownOnce = async (grace) => {
 		if (teardownStarted) return;
 		teardownStarted = true;
@@ -22060,16 +22290,17 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 		live.executorDone = true;
 		const ownMetered = executor.metered?.();
 		const trace = await captureTraceOnce();
+		const childHarnessTranscript = await persistTranscriptOnce();
 		if (childAbort.signal.aborted && live.acceptedResult === void 0) {
 			await teardownOnce(opts.shutdown ?? "brutalKill");
-			return downRecord("aborted before settle", true, trace, ownMetered, runtimeOwnedExecutorProviderEvidence(executor), retainedOutputRef);
+			return downRecord("aborted before settle", true, trace, ownMetered, runtimeOwnedExecutorProviderEvidence(executor), retainedOutputRef, childHarnessTranscript);
 		}
 		const outRef = artifact.outRef;
 		const failureReason = executorFailureReason(artifact);
 		if (failureReason !== void 0) {
 			await teardownOnce(opts.shutdown ?? 5e3).catch(() => void 0);
 			return {
-				...downRecord(failureReason, false, trace, ownMetered, runtimeOwnedExecutorProviderEvidence(executor)),
+				...downRecord(failureReason, false, trace, ownMetered, runtimeOwnedExecutorProviderEvidence(executor), void 0, childHarnessTranscript),
 				outRef
 			};
 		}
@@ -22081,6 +22312,7 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 			...artifact.verdict ? { verdict: artifact.verdict } : {},
 			spent: live.spent,
 			trace,
+			harnessTranscript: childHarnessTranscript,
 			providerModel: runtimeOwnedExecutorProviderEvidence(executor),
 			...ownMetered ? { metered: ownMetered } : {}
 		};
@@ -22100,7 +22332,7 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 				const metered = executor.metered?.();
 				const failureReason = executorFailureReason(accepted);
 				if (failureReason !== void 0) return {
-					...downRecord(failureReason, false, trace, metered, runtimeOwnedExecutorProviderEvidence(executor)),
+					...downRecord(failureReason, false, trace, metered, runtimeOwnedExecutorProviderEvidence(executor), void 0, await persistTranscriptOnce()),
 					outRef: accepted.outRef
 				};
 				return {
@@ -22110,6 +22342,7 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 					...accepted.verdict ? { verdict: accepted.verdict } : {},
 					spent: live.spent,
 					trace,
+					harnessTranscript: await persistTranscriptOnce(),
 					providerModel: runtimeOwnedExecutorProviderEvidence(executor),
 					...metered ? { metered } : {}
 				};
@@ -22133,9 +22366,10 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 					ms
 				});
 			}
+			live.retainedViolation = live.budgetViolation;
 			live.budgetViolation = void 0;
 			return {
-				...downRecord(errMessage(err), true, trace, executor.metered?.(), void 0, retainedOutputRef),
+				...downRecord(errMessage(err), true, trace, executor.metered?.(), void 0, retainedOutputRef, await persistTranscriptOnce()),
 				reconciled: live.spent
 			};
 		}
@@ -22159,7 +22393,7 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 		const aborted = childAbort.signal.aborted || isAbortError(err);
 		if (started && !terminalTelemetryCaptured && accounting === void 0) live.spent = unknownFloor(live.spent);
 		const reconcileError = reconcileOnce(accounting?.reservation ?? live.spent);
-		return downRecord(errMessage(err), evidenceError !== void 0 || teardownError !== void 0 || reconcileError !== void 0 || aborted || isInfraError(err), trace, executor.metered?.(), providerModel, retainedOutputRef);
+		return downRecord(errMessage(err), evidenceError !== void 0 || teardownError !== void 0 || reconcileError !== void 0 || aborted || isInfraError(err), trace, executor.metered?.(), providerModel, retainedOutputRef, await persistTranscriptOnce());
 	} finally {
 		await closeRetainedWrites();
 	}
@@ -22227,7 +22461,8 @@ function makeTreeView(root, children) {
 		...c.outRef ? { outRef: c.outRef } : {},
 		...c.trace ? { trace: c.trace } : {},
 		...c.providerModel ? { providerModel: c.providerModel } : {},
-		...c.budgetViolation ? { budgetViolation: c.budgetViolation } : {}
+		...c.budgetViolation ? { budgetViolation: c.budgetViolation } : {},
+		...c.retainedExecution ? { retainedExecution: c.retainedExecution } : {}
 	}));
 	return {
 		root,
@@ -22397,17 +22632,47 @@ function unknownFloor(spend) {
 		}])) }
 	};
 }
-function downRecord(reason, infra, trace, metered, providerModel, outRef) {
+function downRecord(reason, infra, trace, metered, providerModel, outRef, harnessTranscript) {
 	return {
 		kind: "down",
 		reason,
 		infra,
 		trace,
+		...harnessTranscript ? { harnessTranscript } : {},
 		...providerModel ? { providerModel } : {},
 		...metered ? { metered } : {},
 		...outRef === void 0 ? {} : { outRef }
 	};
 }
+/**
+* Read one executor's harness-transcript receipt without letting a broken port escape.
+*
+* The three answers this has to keep apart, because #1214 and #1244 are both about an artifact
+* that reads as coverage without being coverage:
+*   - `available`                              the transcript survived;
+*   - a reason the CAPTURE produced            a box existed and could not be read;
+*   - `executor-exposes-no-transcript`     this runtime has no transcript to offer at all;
+*   - `execution-never-started`                no environment was ever created (the executor's
+*                                              own seed, set before `create`);
+*   - `capture-did-not-run`                    the port answered nothing, so the capture was
+*                                              skipped rather than attempted and failed.
+*
+* Mirrors `readInteractiveSession` above: an absence is always a named reason, never `undefined`.
+*/
+function readHarnessTranscript(executor) {
+	if (!executor.harnessTranscript) return harnessTranscriptUnavailable("executor-exposes-no-transcript");
+	let reported;
+	try {
+		reported = executor.harnessTranscript();
+	} catch {
+		return harnessTranscriptUnavailable("executor-exposes-no-transcript");
+	}
+	if (reported === void 0) return harnessTranscriptUnavailable("capture-did-not-run");
+	const capture = reported;
+	if (capture.status === "captured" && capture.artifact) return capture;
+	if (capture.status === "unavailable" && capture.reason) return capture;
+	return harnessTranscriptUnavailable("executor-exposes-no-transcript");
+}
 /** The one place an absent interactive process is spelled, so every refusal reads the same. */
 function noInteractiveSession(reason) {
 	return Object.freeze({
@@ -22866,7 +23131,8 @@ function unreportedSpend(total, prior) {
 * ended on this loop's own `stop: 'completed'`, with the completion gate left to label the result
 * rather than to change it. A completed drive whose contract is unmet is now a first-class moment:
 * `reprompt.maxReprompts` re-enters the SAME live session with the unmet items, and every re-entry
-* crosses the same budget, deadline, abort, and attempt bounds a retry crosses.
+* crosses the same budget, deadline, and abort bounds. Successful continuations do not consume
+* the failure retry allowance.
 */
 /**
 * The instruction a completed-but-undelivered drive is re-entered with when the caller supplies no
@@ -22983,9 +23249,14 @@ async function runDriverWithRetry(run) {
 	const maxAttempts = Math.max(1, policy.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
 	const initialBackoff = Math.max(0, policy.initialBackoffMs ?? DEFAULT_INITIAL_BACKOFF_MS);
 	const maxBackoff = Math.max(initialBackoff, policy.maxBackoffMs ?? DEFAULT_MAX_BACKOFF_MS);
-	const maxReprompts = Math.max(0, run.reprompt?.maxReprompts ?? 0);
+	const maxReprompts = run.reprompt?.maxReprompts ?? 0;
+	if (maxReprompts === "until-complete") {
+		const deadline = run.budget().deadlineMs;
+		if (!Number.isFinite(deadline) || deadline <= 0) throw new ValidationError$1("runDriverWithRetry: until-complete requires a finite positive deadline");
+	}
 	const attempts = [];
 	let consecutiveBarren = 0;
+	let failures = 0;
 	let reprompts = 0;
 	let reentry;
 	const emit = async (record) => {
@@ -22998,11 +23269,10 @@ async function runDriverWithRetry(run) {
 	* the caller's hook is consulted last, so no hook can talk the loop past a deadline.
 	*/
 	const decideReprompt = async (attempt, after) => {
-		if (reprompts >= maxReprompts) return { refusedBy: "reprompts-exhausted" };
+		if (maxReprompts !== "until-complete" && reprompts >= maxReprompts) return { refusedBy: "reprompts-exhausted" };
 		if (run.signal.aborted) return { refusedBy: "aborted" };
 		const byBudget = budgetStop(run.budget(), now());
 		if (byBudget === "deadline" || byBudget === "budget-exhausted") return { refusedBy: byBudget };
-		if (attempt >= maxAttempts) return { refusedBy: "max-attempts" };
 		const context = {
 			attempt,
 			reprompts,
@@ -23031,6 +23301,7 @@ async function runDriverWithRetry(run) {
 		try {
 			await run.drive(attempt, reentry);
 		} catch (error) {
+			failures += 1;
 			const durationMs = now() - startedAt;
 			const classification = classifyDriverFailure(error, run.signal);
 			const progressed = madeProgress(before, run.progress());
@@ -23040,7 +23311,7 @@ async function runDriverWithRetry(run) {
 				if (run.signal.aborted) return "aborted";
 				const byBudget = budgetStop(run.budget(), now());
 				if (byBudget) return byBudget;
-				if (attempt >= maxAttempts) return "max-attempts";
+				if (failures >= maxAttempts) return "max-attempts";
 				if (progressed) return void 0;
 				return consecutiveBarren + 1 >= maxConsecutive ? "no-progress" : void 0;
 			})();
@@ -23072,12 +23343,13 @@ async function runDriverWithRetry(run) {
 			if (afterWait) throw new DriverAttemptsExhaustedError(error, attempts, afterWait);
 			continue;
 		}
+		consecutiveBarren = 0;
 		const durationMs = now() - startedAt;
 		const after = run.progress();
 		const progressed = madeProgress(before, after);
 		const contract = contractOf(after);
 		const contractField = contract === "none" ? {} : { contract };
-		if (contract === "unmet" && maxReprompts > 0) {
+		if (contract === "unmet" && (maxReprompts === "until-complete" || maxReprompts > 0)) {
 			const decision = await decideReprompt(attempt, after);
 			if ("steer" in decision) {
 				reprompts += 1;
@@ -23632,7 +23904,7 @@ function createSupervisor() {
 					pool.assertNoOpenTickets();
 					const outRef = contentAddress(out);
 					await opts.blobs.put(outRef, out);
-					const { spentTotal, childWork, driverInference, gaps, providerModel } = await terminalAccounting(journal, opts.runId, now() - runEpochMs);
+					const { spentTotal, childWork, driverInference, gaps, providerModel, fleetYield } = await terminalAccounting(journal, opts.runId, now() - runEpochMs);
 					return {
 						kind: "winner",
 						out,
@@ -23642,6 +23914,7 @@ function createSupervisor() {
 						providerModel,
 						...teardownUnconfirmed.length > 0 ? { teardownUnconfirmed } : {},
 						...gaps.length > 0 ? { spendGaps: gaps } : {},
+						fleetYield,
 						...isNonEmptySpend(driverInference) ? { spentBreakdown: {
 							driverInference,
 							childWork
@@ -23652,7 +23925,7 @@ function createSupervisor() {
 			}
 			return noWinner({ error: actOutcome.error });
 			async function noWinner(rejection) {
-				const { spentTotal, gaps, providerModel } = await terminalAccounting(journal, opts.runId, now() - runEpochMs);
+				const { spentTotal, gaps, providerModel, fleetYield } = await terminalAccounting(journal, opts.runId, now() - runEpochMs);
 				const common = {
 					kind: "no-winner",
 					tree,
@@ -23661,7 +23934,8 @@ function createSupervisor() {
 					providerModel,
 					...teardownUnconfirmed.length > 0 ? { teardownUnconfirmed } : {},
 					...leakedReservations.length > 0 ? { leakedReservations } : {},
-					...gaps.length > 0 ? { spendGaps: gaps } : {}
+					...gaps.length > 0 ? { spendGaps: gaps } : {},
+					fleetYield
 				};
 				const lifecycle = classifyNoWinner(executionAborted, pool, opts, breaker, deadlineExceeded, allChildrenDownAtSettle, downCountAtSettle);
 				if (controller.signal.reason instanceof RunCancellationReason) {
@@ -23793,13 +24067,21 @@ function createIntensityBreaker(opts, trip) {
 }
 /** Decorate the journal so the breaker observes every `settled`-`down` event the scope
 *  appends, without the supervisor intercepting `scope.next()`. The decorator is
-*  transparent — it forwards every method verbatim and only reads the down events. */
+*  transparent — it forwards every method verbatim and only reads the down events.
+*
+*  A record marked `retainedExecution: 'released'` is skipped: it is the driver's earlier down
+*  re-stated by the release sweep, which runs AFTER the join barrier and before the result is
+*  classified. Counting it would trip an armed breaker on a run that has already settled and turn
+*  a delivered winner into `all-children-down`, and its backdated `at` (the settlement instant)
+*  would sit out of order in the sliding window. A retained child was never counted at its
+*  settlement either (it writes no `settled` record then), so `downCount` stays what it was:
+*  ordinary downs only; `fleetYield.down` is where a retained child is counted. */
 function wrapJournalForBreaker(journal, breaker) {
 	return {
 		loadTree: (root) => journal.loadTree(root),
 		beginTree: (root, at) => journal.beginTree(root, at),
 		appendEvent: (root, ev) => {
-			if (ev.kind === "settled" && ev.status === "down") breaker.recordDown(Date.parse(ev.at));
+			if (ev.kind === "settled" && ev.status === "down" && ev.retainedExecution === void 0) breaker.recordDown(Date.parse(ev.at));
 			return journal.appendEvent(root, ev);
 		}
 	};
@@ -23909,7 +24191,9 @@ async function terminalAccounting(journal, root, elapsedMs) {
 	if (events === void 0) throw new RuntimeRunStateError(`supervisor: spawn tree '${root}' is missing from the journal after run (corrupted log)`);
 	const { childWork, driverInference } = sumSpendFromEvents(events);
 	const gaps = spendGapsFromEvents(events);
-	const providerModel = aggregateProviderModelEvidence(await loadSpawnForest(journal, root));
+	const forest = await loadSpawnForest(journal, root);
+	const providerModel = aggregateProviderModelEvidence(forest);
+	const fleetYield = fleetYieldFromForest(forest);
 	const summed = addSpend(childWork, driverInference);
 	return {
 		spentTotal: {
@@ -23921,8 +24205,42 @@ async function terminalAccounting(journal, root, elapsedMs) {
 		childWork,
 		driverInference,
 		gaps,
-		providerModel
-	};
+		providerModel,
+		fleetYield
+	};
+}
+/** How the run's spawned children ended, by node id across every tree of the forest. Read after
+*  the join barrier and the release sweep, so the terminal records the sweep wrote are in it.
+*  Spawned records without a parent are exempt: the run root, and the re-rooted owner copy a
+*  nested driver writes as its tree's first record (`ownedTreeRootSpawn` strips the parent), so
+*  a manager is counted once, in its parent's tree. Buckets are id sets rather than record counts
+*  because the journal guards seq uniqueness, not one-terminal-per-node, and the invariant
+*  `spawned === done + down + cancelled + neverSettled` must not rest on scope discipline alone;
+*  it is asserted here so a future root-id terminal record cannot silently break the tally. */
+function fleetYieldFromForest(forest) {
+	const spawned = /* @__PURE__ */ new Set();
+	const terminal = /* @__PURE__ */ new Map();
+	const released = /* @__PURE__ */ new Set();
+	for (const { event } of forest.events) if (event.kind === "spawned") {
+		if (event.parent !== void 0) spawned.add(event.id);
+	} else if (event.kind === "settled" || event.kind === "cancelled") {
+		const bucket = event.kind === "cancelled" ? "cancelled" : event.status;
+		terminal.set(event.id, bucket);
+		if (event.retainedExecution === "released" && bucket !== "done") released.add(event.id);
+		else released.delete(event.id);
+	}
+	const count = (bucket) => [...terminal.values()].filter((value) => value === bucket).length;
+	const fleetYield = {
+		spawned: spawned.size,
+		done: count("done"),
+		down: count("down"),
+		cancelled: count("cancelled"),
+		neverSettled: forest.inDoubt.length,
+		releasedUnrecovered: released.size
+	};
+	if (fleetYield.done + fleetYield.down + fleetYield.cancelled + fleetYield.neverSettled !== fleetYield.spawned) throw new RuntimeRunStateError(`supervisor: fleet yield does not partition the spawned children of '${forest.root}' (${JSON.stringify(fleetYield)})`);
+	if (fleetYield.releasedUnrecovered > fleetYield.down + fleetYield.cancelled) throw new RuntimeRunStateError(`supervisor: released children exceed down + cancelled for '${forest.root}' (${JSON.stringify(fleetYield)})`);
+	return fleetYield;
 }
 /** The journaled nodes whose usage accounting is incomplete — one `SpendGap` per node+kind,
 *  channels merged. A spawn with no terminal record (`settled`/`cancelled`/`woken`) is
@@ -23986,6 +24304,6 @@ function isNonEmptySpend(s) {
 	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false || Object.values(s.resources ?? {}).some((resource) => resource.amount > 0 || !resource.known);
 }
 //#endregion
-export { captureReusableExecutorConfig as $, flatOtelSpan as $n, runtimeOwnedExecutorMaterialization as $r, addHarnessUsage as $t, waitUntil as A, randomSuffix as Ai, RunCancellationReason as An, promptResourceProfileMaterialization as Ar, spendFromUsageTotals as At, attachWorker as B, withBudgetResources as Bi, defaultRedactorIdentityMaterial as Bn, writeAllBytes as Br, createInbox as Bt, scopeOwnerExecutorNodeContext as C, addSpend as Ci, resolveAgentEnvironmentProvider as Cn, controlProfileMaterialization as Cr, contentAddress as Ct, pollFor as D, hasCompleteCacheBreakdown as Di, sandboxSessionTraceSource as Dn, promptControlProfileMaterialization as Dr, meterUsageEvent as Dt, isWaitOutcome as E, deleteBoxSafe as Ei, decodeToolPart as En, profileMaterializationAxes$1 as Er, createBudgetPool as Et, scopeRetainedOwnerPriorSpend as F, unmeteredSpend as Fi, recoverRetainedRun as Fn, validateProfileMaterialization as Fr, workerTraceSeamKey as Ft, recoverRetainedInteractiveRun as G, armDeadlineTimer as Gi, traceContextToEnv as Gn, inheritRuntimeOwnedExecutorAttestation as Gr, createPeerMailbox as Gt, workerInteractiveBindingFile as H, abortError$2 as Hi, createPropagatingTraceEmitter as Hn, attestRuntimeOwnedScopeOwner as Hr, DEFAULT_PEER_MAIL_LIMITS as Ht, scopeRetainedOwnerResult as I, withTimeout as Ii, startRetainedRun as In, worktreeCliProfileMaterialization as Ir, taskToPrompt as It, effectiveConcurrency as J, promptOptionsFromAgentTurnInput as Ji, buildLoopSpanNodes as Jn, newExecutionAttemptId as Jr, peerMailVerbNames as Jt, startRetainedInteractiveRun as K, teardownExecutor as Ki, INTELLIGENCE_WIRE_VERSION as Kn, knownExecutionBindingReceipt as Kr, isPeerMailEnvelope as Kt, interactiveAdmissionSeamKey as L, zeroSpend as Li, startRetainedRunInEnvironment as Ln, isNoEntError as Lr, DEFAULT_STALL_AFTER_MS as Lt, consumeScopeRetainedOwnerResult as M, stringifySafe as Mi, linkAbort as Mn, renderUnsupported as Mr, readWorkerTraceContext as Mt, prepareScopeRetainedOwnerTask as N, throwAbort as Ni, runAbortable as Nn, sandboxActProfileMaterialization as Nr, workerTraceEnv as Nt, timerAt as O, isAbortError$2 as Oi, registerRetainedExecutorPreparation as On, promptModelProfileMaterialization as Or, newUsageTotals as Ot, scopeRetainedOwnerContext as P, throwIfAborted as Pi, reconnectRetainedRun as Pn, unsupportedProfileDimensions as Pr, workerTraceHeaders as Pt, bindReusableExecutorExecutionId as Q, exportEvalRuns as Qn, runtimeOwnedExecutorExecutionBinding as Qr, bridgeModelRouteRefusal as Qt, readWorkerInteractiveAdmissions as R, addResourceSpend as Ri, retainedCreateMaterial as Rn, parseCommittedJsonLines as Rr, createActivityLog as Rt, restoreScopeOwnerAcceptedExecution as S, sumSandboxUsage as Si, providerAsSandboxClient as Sn, assertProfileMaterialization as Sr, workerTraceAnalysisStore as St, createWaitProbes as T, cloneSpend as Ti, createPushTraceSource as Tn, fullProfileMaterialization as Tr, assertValidBudget as Tt, workerInteractiveBindingsDir as U, awaitAbortable$1 as Ui, mergeTraceEnv as Un, authoredProfileDigest as Ur, PEER_MAIL_WIRE_KEY as Ut, readWorkerInteractiveBinding as V, decodeHarnessUsage as Vi, resolveRedactor as Vn, attestRuntimeOwnedPendingExecutor as Vr, AUTHORITY_MARKERS as Vt, reconnectRetainedInteractiveRun as W, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as Wi, readTraceContextFromEnv as Wn, finalizeRuntimeOwnedPendingExecutor as Wr, claimsAuthority as Wt, queueOf as X, createOpenInferenceFileExporter as Xn, recordRuntimeOwnedDriveHarnessProviderEvidence as Xr, isTerminalNodeStatus as Xt, freeSlots as Y, providerMessageText as Yi, buildRuntimeEventOtelSpans as Yn, providerAttemptEvidence as Yr, isLiveNodeStatus as Yt, rollingDispatch as Z, createOtelExporter as Zn, runtimeOwnedDriveHarnessProviderEvidence as Zr, bridgeAdmissionRefusal as Zt, createScope as _, mapSandboxEvent as _i, canonicalObservedModelParts as _n, harnessSupportsReasoningEffort as _r, replaySpawnTree as _t, pickBestDelivered as a, executableAgentProfileSnapshot as ai, TERMINAL_DECISIONS as an, createRuntimeEventCollector as ar, createWorktreeCliExecutor as at, meterRuntimeOwnedProviderAttempt as b, sandboxEventServedBackend as bi, createAgentEnvironmentProviderRegistry as bn, CodexExecutionDiagnosticError as br, isTraceAnalysisStore as bt, DriverAttemptsExhaustedError as c, detachedSnapshot as ci, isTerminalDecision as cn, sanitizeKnowledgeReadinessReport as cr, createInPlaceCliExecutor as ct, runDriverWithRetry as d, assertSandboxServedModel as di, probeSandboxCapabilities as dn, runWorktreeHarness as dr, InMemoryResultBlobStore as dt, runtimeOwnedExecutorProviderEvidence as ei, createCodexRolloutStoreReader as en, generateSpanId as er, cliInPlaceExecutor as et, driverChild as f, canonicalStreamEventFromSandboxEvent as fi, acquireSandbox as fn, captureWorktreeDiff as fr, InMemorySpawnJournal as ft, beginScopeOwnerAttempt as g, isSandboxTerminalEvent as gi, runBrainLoop as gn, LOCAL_HARNESSES as gr, pendingWaits as gt, withDriverExecutor as h, extractLlmCallEvent as hi, routerBrain as hn, DEFAULT_LOCAL_HARNESS as hr, materializeTreeView as ht, collectDelivered as i, unknownMaterializationReceipt as ii, bridgeStopSignalKey as in, toOtelAttributes as ir, snapshotExecutorConfig as it, bindScopeRetainedOwnerProvider as j, sleep as ji, abortError as jn, renderProfileMaterializationIssues as jr, WORKER_TRACE_PROPAGATION as jt, validateWaitSpec as k, promptCacheTokenClasses as ki, retainedExecutorSeamKey as kn, promptOnlyProfileMaterialization as kr, spendFromUsageEvents as kt, classifyDriverFailure as l, projectSandboxOutcome as li, runAgentRounds as ln, sanitizeRuntimeStreamEvent as lr, FileResultBlobStore as lt, isDriverSpec as m, createSandboxUsageLedger as mi, readPromptOptions as mn, removeWorktree as mr, loadSpawnForest as mt, createSupervisor as n, runtimeOwnedScopeOwnerRuntime as ni, readCodexRolloutSession as nn, padSpanId as nr, createExecutor as nt, runFinalizer as o, executableAgentSpecSnapshot as oi, createSandboxForSpec as on, createRuntimeStreamEventCollector as or, DEFAULT_SANDBOX_STEERING_MAX_TURNS as ot, driverExecutorFactory as p, createSandboxToolPartState as pi, assertBoxlessPromptOptions as pn, createWorktree as pr, insideCursorNamespace as pt, destroyInteractiveEnvironment as q, promptFromAgentTurnInput as qi, buildLoopOtelSpans as qn, knownMaterializationReceipt as qr, peerMailTools as qt, bestDelivered as r, unknownExecutionBindingReceipt as ri, bridgeRuntimeAttachmentsKey as rn, padTraceId as rr, createExecutorRegistry as rt, runTree as s, detachedFrozen as si, defaultSelectWinner as sn, sanitizeAgentRuntimeEvent as sr, createSteerableSandboxSession as st, createRootHandle as t, runtimeOwnedPendingExecutorMaterialization as ti, harnessUsageIsEmpty as tn, loopEventToOtelSpan as tr, cliWorktreeExecutor as tt, defaultUnmetContractSteer as u, readSandboxOutcome as ui, createSandboxLineage as un, runSettledCommand as ur, FileSpawnJournal as ut, deriveNodeExecutionIdentity as v, mapSandboxToolEvent as vi, observedModelMatchesDeclared as vn, localHarnessExecutable as vr, WORKER_TOOL_TRACE_SCHEMA_VERSION as vt, settledToIteration as w, chargedTokens as wi, sandboxClientAsProvider as wn, defineProfileMaterializationContract as wr, BudgetReconcileFault as wt, recordScopeOwnerMaterialization as x, sandboxProgressEvents as xi, providerAsExecutor as xn, AGENT_PROFILE_MATERIALIZATION_AXES as xr, parseWorkerToolTraceArtifact as xt, meterRuntimeOwnedAccounting as y, notifySandboxEventObserver as yi, DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS as yn, parseCodexTokenUsage as yr, captureWorkerTraceEvidence as yt, workerInteractiveAdmissionFile as z, resourceTelemetry as zi, defaultRedactor as zn, prepareJsonlAppend as zr, readWorkerProgress as zt };
+export { bindReusableExecutorExecutionId as $, providerMessageText as $i, buildRuntimeEventOtelSpans as $n, providerAttemptEvidence as $r, addHarnessUsage as $t, waitUntil as A, deleteBoxSafe as Ai, RunCancellationReason as An, profileMaterializationAxes$1 as Ar, spendFromUsageTotals as At, attachWorker as B, withTimeout as Bi, defaultRedactorIdentityMaterial as Bn, worktreeCliProfileMaterialization as Br, createInbox as Bt, scopeOwnerExecutorNodeContext as C, notifySandboxEventObserver as Ci, resolveAgentEnvironmentProvider as Cn, parseCodexTokenUsage as Cr, workerTraceAnalysisStore as Ct, pollFor as D, addSpend as Di, sandboxSessionTraceSource as Dn, controlProfileMaterialization as Dr, meterUsageEvent as Dt, isWaitOutcome as E, sumSandboxUsage as Ei, decodeToolPart as En, assertProfileMaterialization as Er, createBudgetPool as Et, scopeRetainedOwnerPriorSpend as F, sleep as Fi, recoverRetainedRun as Fn, renderProfileMaterializationIssues as Fr, workerTraceSeamKey as Ft, recoverRetainedInteractiveRun as G, decodeHarnessUsage as Gi, contentAddress as Gn, attestRuntimeOwnedPendingExecutor as Gr, createPeerMailbox as Gt, workerInteractiveBindingFile as H, addResourceSpend as Hi, captureHarnessTranscript as Hn, parseCommittedJsonLines as Hr, DEFAULT_PEER_MAIL_LIMITS as Ht, scopeRetainedOwnerResult as I, stringifySafe as Ii, startRetainedRun as In, renderUnsupported as Ir, taskToPrompt as It, errMessage as J, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as Ji, readTraceContextFromEnv as Jn, finalizeRuntimeOwnedPendingExecutor as Jr, peerMailVerbNames as Jt, startRetainedInteractiveRun as K, abortError$2 as Ki, createPropagatingTraceEmitter as Kn, attestRuntimeOwnedScopeOwner as Kr, isPeerMailEnvelope as Kt, interactiveAdmissionSeamKey as L, throwAbort as Li, startRetainedRunInEnvironment as Ln, sandboxActProfileMaterialization as Lr, DEFAULT_STALL_AFTER_MS as Lt, consumeScopeRetainedOwnerResult as M, isAbortError$2 as Mi, linkAbort as Mn, promptModelProfileMaterialization as Mr, readWorkerTraceContext as Mt, prepareScopeRetainedOwnerTask as N, promptCacheTokenClasses as Ni, runAbortable as Nn, promptOnlyProfileMaterialization as Nr, workerTraceEnv as Nt, timerAt as O, chargedTokens as Oi, registerRetainedExecutorPreparation as On, defineProfileMaterializationContract as Or, newUsageTotals as Ot, scopeRetainedOwnerContext as P, randomSuffix as Pi, reconnectRetainedRun as Pn, promptResourceProfileMaterialization as Pr, workerTraceHeaders as Pt, rollingDispatch as Q, promptOptionsFromAgentTurnInput as Qi, buildLoopSpanNodes as Qn, newExecutionAttemptId as Qr, bridgeModelRouteRefusal as Qt, readWorkerInteractiveAdmissions as R, throwIfAborted as Ri, retainedCreateMaterial as Rn, unsupportedProfileDimensions as Rr, createActivityLog as Rt, restoreScopeOwnerAcceptedExecution as S, mapSandboxToolEvent as Si, providerAsSandboxClient as Sn, localHarnessExecutable as Sr, parseWorkerToolTraceArtifact as St, createWaitProbes as T, sandboxProgressEvents as Ti, createPushTraceSource as Tn, AGENT_PROFILE_MATERIALIZATION_AXES as Tr, assertValidBudget as Tt, workerInteractiveBindingsDir as U, resourceTelemetry as Ui, harnessTranscriptArtifact as Un, prepareJsonlAppend as Ur, PEER_MAIL_WIRE_KEY as Ut, readWorkerInteractiveBinding as V, zeroSpend as Vi, resolveRedactor as Vn, isNoEntError as Vr, AUTHORITY_MARKERS as Vt, reconnectRetainedInteractiveRun as W, withBudgetResources as Wi, persistHarnessTranscript as Wn, writeAllBytes as Wr, claimsAuthority as Wt, freeSlots as X, teardownExecutor as Xi, INTELLIGENCE_WIRE_VERSION as Xn, knownExecutionBindingReceipt as Xr, isTerminalNodeStatus as Xt, effectiveConcurrency as Y, armDeadlineTimer as Yi, traceContextToEnv as Yn, inheritRuntimeOwnedExecutorAttestation as Yr, isLiveNodeStatus as Yt, queueOf as Z, promptFromAgentTurnInput as Zi, buildLoopOtelSpans as Zn, knownMaterializationReceipt as Zr, bridgeAdmissionRefusal as Zt, createScope as _, createSandboxToolPartState as _i, canonicalObservedModelParts as _n, createWorktree as _r, pendingWaits as _t, pickBestDelivered as a, runtimeOwnedPendingExecutorMaterialization as ai, TERMINAL_DECISIONS as an, loopEventToOtelSpan as ar, snapshotExecutorConfig as at, meterRuntimeOwnedProviderAttempt as b, isSandboxTerminalEvent as bi, createAgentEnvironmentProviderRegistry as bn, LOCAL_HARNESSES as br, captureWorkerTraceEvidence as bt, DriverAttemptsExhaustedError as c, unknownMaterializationReceipt as ci, isTerminalDecision as cn, toOtelAttributes as cr, createSteerableSandboxSession as ct, runDriverWithRetry as d, detachedFrozen as di, probeSandboxCapabilities as dn, sanitizeAgentRuntimeEvent as dr, FileSpawnJournal as dt, recordRuntimeOwnedDriveHarnessProviderEvidence as ei, createCodexRolloutStoreReader as en, createOpenInferenceFileExporter as er, captureReusableExecutorConfig as et, driverChild as f, detachedSnapshot as fi, acquireSandbox as fn, sanitizeKnowledgeReadinessReport as fr, InMemoryResultBlobStore as ft, beginScopeOwnerAttempt as g, canonicalStreamEventFromSandboxEvent as gi, runBrainLoop as gn, captureWorktreeDiff as gr, materializeTreeView as gt, withDriverExecutor as h, assertSandboxServedModel as hi, routerBrain as hn, runWorktreeHarness as hr, loadSpawnForest as ht, collectDelivered as i, runtimeOwnedExecutorProviderEvidence as ii, bridgeStopSignalKey as in, generateSpanId as ir, createExecutorRegistry as it, bindScopeRetainedOwnerProvider as j, hasCompleteCacheBreakdown as ji, abortError as jn, promptControlProfileMaterialization as jr, WORKER_TRACE_PROPAGATION as jt, validateWaitSpec as k, cloneSpend as ki, retainedExecutorSeamKey as kn, fullProfileMaterialization as kr, spendFromUsageEvents as kt, classifyDriverFailure as l, executableAgentProfileSnapshot as li, runAgentRounds as ln, createRuntimeEventCollector as lr, createInPlaceCliExecutor as lt, isDriverSpec as m, readSandboxOutcome as mi, readPromptOptions as mn, runSettledCommand as mr, insideCursorNamespace as mt, createSupervisor as n, runtimeOwnedExecutorExecutionBinding as ni, readCodexRolloutSession as nn, exportEvalRuns as nr, cliWorktreeExecutor as nt, runFinalizer as o, runtimeOwnedScopeOwnerRuntime as oi, createSandboxForSpec as on, padSpanId as or, createWorktreeCliExecutor as ot, driverExecutorFactory as p, projectSandboxOutcome as pi, assertBoxlessPromptOptions as pn, sanitizeRuntimeStreamEvent as pr, InMemorySpawnJournal as pt, destroyInteractiveEnvironment as q, awaitAbortable$1 as qi, mergeTraceEnv as qn, authoredProfileDigest as qr, peerMailTools as qt, bestDelivered as r, runtimeOwnedExecutorMaterialization as ri, bridgeRuntimeAttachmentsKey as rn, flatOtelSpan as rr, createExecutor as rt, runTree as s, unknownExecutionBindingReceipt as si, defaultSelectWinner as sn, padTraceId as sr, DEFAULT_SANDBOX_STEERING_MAX_TURNS as st, createRootHandle as t, runtimeOwnedDriveHarnessProviderEvidence as ti, harnessUsageIsEmpty as tn, createOtelExporter as tr, cliInPlaceExecutor as tt, defaultUnmetContractSteer as u, executableAgentSpecSnapshot as ui, createSandboxLineage as un, createRuntimeStreamEventCollector as ur, FileResultBlobStore as ut, deriveNodeExecutionIdentity as v, createSandboxUsageLedger as vi, observedModelMatchesDeclared as vn, removeWorktree as vr, replaySpawnTree as vt, settledToIteration as w, sandboxEventServedBackend as wi, sandboxClientAsProvider as wn, CodexExecutionDiagnosticError as wr, BudgetReconcileFault as wt, recordScopeOwnerMaterialization as x, mapSandboxEvent as xi, providerAsExecutor as xn, harnessSupportsReasoningEffort as xr, isTraceAnalysisStore as xt, meterRuntimeOwnedAccounting as y, extractLlmCallEvent as yi, DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS as yn, DEFAULT_LOCAL_HARNESS as yr, WORKER_TOOL_TRACE_SCHEMA_VERSION as yt, workerInteractiveAdmissionFile as z, unmeteredSpend as zi, defaultRedactor as zn, validateProfileMaterialization as zr, readWorkerProgress as zt };
 
-//# sourceMappingURL=supervisor-DFsXULnE.js.map
+//# sourceMappingURL=supervisor-C2xWmESG.js.map