@tangle-network/agent-runtime 0.233.1 → 0.235.0

package/dist/{supervisor-C2xWmESG.js → supervisor-CBtuIoqP.js}

@@ -6239,6 +6239,23 @@ function assertRequestedInteractionCapabilities(providerName, requested, capabil
 }
 //#endregion
 //#region src/runtime/retained-run-events.ts
+/** The runtime's own contract checks inside the stream loop, so the catch can tell a broken
+*  answer (a verdict) from a read the provider's iterator failed (a wrapper). */
+const runtimeChecks = /* @__PURE__ */ new WeakSet();
+function contractCheckFailed(message) {
+	const error = new Error(message);
+	runtimeChecks.add(error);
+	throw error;
+}
+/** Run one of the runtime's own checks; whatever it throws is a verdict, not a failed read. */
+function verdict(check) {
+	try {
+		return check();
+	} catch (error) {
+		if (error instanceof Error) runtimeChecks.add(error);
+		throw error;
+	}
+}
 async function* retainedRunEvents(session, controlRef, options, now) {
 	const after = options?.after;
 	if (after) {
@@ -6261,24 +6278,24 @@ async function* retainedRunEvents(session, controlRef, options, now) {
 			const source = next.value;
 			const identity = extractTransportEventIdentity(source);
 			const sourceCursor = identity.cursor ?? identity.eventId;
-			assertEventBinding(source, controlRef);
+			verdict(() => assertEventBinding(source, controlRef));
 			if (sourceCursor === after?.cursor) continue;
 			const event = canonicalEvent(source);
 			if (!event) continue;
-			assertCanonicalEventBinding(controlRef, event);
+			verdict(() => assertCanonicalEventBinding(controlRef, event));
 			if (firstAfterEvent && after !== void 0) {
-				if (identity.sequence !== void 0 && identity.sequence <= after.sequence) throw new Error("provider replay did not prove that the first event follows the requested cursor");
+				if (identity.sequence !== void 0 && identity.sequence <= after.sequence) contractCheckFailed("provider replay did not prove that the first event follows the requested cursor");
 				firstAfterEvent = false;
 			}
 			const eventId = identity.eventId ?? identity.cursor;
-			if (!eventId) throw new Error("replayable canonical event has no stable provider event id or cursor");
+			if (!eventId) contractCheckFailed("replayable canonical event has no stable provider event id or cursor");
 			assertStableText(eventId, "provider event id");
-			if (seen.has(eventId)) throw new Error(`provider replay repeated event id "${eventId}"`);
+			if (seen.has(eventId)) contractCheckFailed(`provider replay repeated event id "${eventId}"`);
 			seen.add(eventId);
 			const sequence = identity.sequence ?? nextSequence;
-			if (sequence <= lastSequence) throw new Error(`provider event sequence is not monotonic: ${sequence} follows ${lastSequence}`);
+			if (sequence <= lastSequence) contractCheckFailed(`provider event sequence is not monotonic: ${sequence} follows ${lastSequence}`);
 			const occurredAt = identity.occurredAt;
-			yield RuntimeEventEnvelopeSchema.parse({
+			yield verdict(() => RuntimeEventEnvelopeSchema.parse({
 				runId: controlRef.runId,
 				eventId,
 				sequence,
@@ -6286,7 +6303,7 @@ async function* retainedRunEvents(session, controlRef, options, now) {
 				...occurredAt === void 0 ? {} : { occurredAt },
 				receivedAt: new Date(now()).toISOString(),
 				event
-			});
+			}));
 			lastSequence = sequence;
 			nextSequence = sequence + 1;
 		}
@@ -6298,8 +6315,9 @@ async function* retainedRunEvents(session, controlRef, options, now) {
 			throw abortError$2(options.signal.reason);
 		}
 		if (error instanceof RetainedRunProviderContractError) throw error;
+		const fromProvider = error instanceof Error && !runtimeChecks.has(error);
 		throw new RetainedRunProviderContractError(error instanceof Error ? error.message : "provider retained event stream failed", {
-			code: "RETAINED_EVENT_STREAM_INVALID",
+			code: fromProvider ? "RETAINED_EVENT_STREAM_READ_FAILED" : "RETAINED_EVENT_STREAM_INVALID",
 			cause: error
 		});
 	} finally {
@@ -7208,11 +7226,102 @@ const retainedExecutorSeamKey = "runtime.retainedExecutor";
 function retainedExecutorContext(ctx) {
 	return ctx.seams[retainedExecutorSeamKey];
 }
-/** Local observation stopped; the retained provider execution has no accepted terminal result. */
+const causeMessages = {
+	unobservable: "retained provider execution requires reconciliation before replacement",
+	"provider-contract": "retained provider execution ended on a provider contract violation; nothing to reconcile",
+	"request-rejected": "retained provider execution was refused before it ran; nothing to reconcile",
+	transport: "retained provider execution lost its transport; status in doubt",
+	"nested-recovery": "retained nested execution requires recovery before replacement"
+};
+/** The contract-error codes that wrap a failed READ rather than name a broken answer. */
+const readFailureCodes = /* @__PURE__ */ new Set(["RETAINED_RESULT_READ_FAILED", "RETAINED_CONTROL_REF_READ_FAILED"]);
+/** Socket-level failures, by the codes Node and undici assign, plus the Sandbox SDK's own. */
+const transportCodes = /* @__PURE__ */ new Set([
+	"ECONNRESET",
+	"ECONNREFUSED",
+	"ETIMEDOUT",
+	"ENOTFOUND",
+	"EAI_AGAIN",
+	"EPIPE",
+	"UND_ERR_SOCKET",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_BODY_TIMEOUT",
+	"NETWORK_ERROR"
+]);
+function readNumber(value, key) {
+	const read = Reflect.get(value, key);
+	return typeof read === "number" && Number.isFinite(read) ? read : void 0;
+}
+function readString(value, key) {
+	const read = Reflect.get(value, key);
+	return typeof read === "string" ? read : void 0;
+}
+/**
+* Walk the cause chain (bounded, cycle-safe) and name the first cause whose structure decides.
+*
+* `phase` says whether a 4xx or a client deadline can mean "refused before it ran": only at
+* admission. After admission the same status means the provider cannot resolve what it
+* admitted, and the honest name is the refusal.
+*/
+function classifyRetainedPendingCause(cause, phase = "execution") {
+	const seen = /* @__PURE__ */ new Set();
+	const queue = [{
+		value: cause,
+		phase
+	}];
+	let steps = 0;
+	while (queue.length > 0 && steps < 12) {
+		steps += 1;
+		const { value, phase: at } = queue.shift();
+		if (typeof value !== "object" || value === null || seen.has(value)) continue;
+		seen.add(value);
+		if (value instanceof RetainedExecutionPendingError) return value.pendingCause;
+		const name = readString(value, "name");
+		const code = readString(value, "code");
+		const status = readNumber(value, "status") ?? readNumber(value, "statusCode");
+		if (name === "RetainedRunProviderContractError") {
+			if (code === void 0 || !readFailureCodes.has(code)) return "provider-contract";
+			queue.unshift({
+				value: Reflect.get(value, "cause"),
+				phase: "execution"
+			});
+			continue;
+		}
+		if (name === "ZodError" || Array.isArray(Reflect.get(value, "issues"))) return at === "admission" ? "request-rejected" : "provider-contract";
+		if (code !== void 0 && transportCodes.has(code)) return "transport";
+		if (name === "NetworkError" || name === "ServerError") return "transport";
+		if (status !== void 0) {
+			if (status >= 500) return "transport";
+			if (at === "admission" && status !== 408) return "request-rejected";
+			return "unobservable";
+		}
+		const errors = Reflect.get(value, "errors");
+		if (Array.isArray(errors)) for (const member of errors) queue.push({
+			value: member,
+			phase: at
+		});
+		queue.push({
+			value: Reflect.get(value, "cause"),
+			phase: at
+		});
+	}
+	return "unobservable";
+}
+/**
+* Local observation stopped; the retained provider execution has no accepted terminal result.
+*
+* The message names WHICH of the situations in {@link RetainedPendingCause} this is, and the
+* `pendingCause` field carries it as a value the settlement records, so a reader never splits
+* the population on the message's wording. The cause chain is kept for the `caused by` receipt.
+*/
 var RetainedExecutionPendingError = class extends Error {
-	constructor(cause) {
-		super("retained provider execution requires reconciliation before replacement", { cause });
+	pendingCause;
+	constructor(cause, pendingCause = "execution") {
+		const resolved = pendingCause === "admission" || pendingCause === "execution" ? classifyRetainedPendingCause(cause, pendingCause) : pendingCause;
+		super(causeMessages[resolved], { cause });
 		this.name = "RetainedExecutionPendingError";
+		this.pendingCause = resolved;
 	}
 };
 const retainedPreparations = /* @__PURE__ */ new WeakMap();
@@ -8193,7 +8302,14 @@ async function providerExecutionSource(args, turn, signal) {
 							break;
 						}
 						if (next.done) break;
-						assertEventBinding(next.value, handle.controlRef);
+						try {
+							assertEventBinding(next.value, handle.controlRef);
+						} catch (error) {
+							throw new RetainedRunProviderContractError(error instanceof Error ? error.message : "provider event bound to another run", {
+								code: "RETAINED_EVENT_BINDING_INVALID",
+								cause: error
+							});
+						}
 						if (next.value.id !== void 0) lastReplayPosition = next.value.id;
 						if (isTerminalEnvironmentEvent(next.value)) sawTerminal = true;
 						yield next.value;
@@ -8244,7 +8360,7 @@ async function providerExecutionSource(args, turn, signal) {
 			retained: true
 		};
 	} catch (error) {
-		if (admitted) throw new RetainedExecutionPendingError(error);
+		if (admitted) throw new RetainedExecutionPendingError(error, "admission");
 		throw error;
 	}
 }
@@ -16085,6 +16201,7 @@ async function replaySpawnTree(journal, blobs, root) {
 				},
 				...ev.harnessTranscript === void 0 ? {} : { harnessTranscript: ev.harnessTranscript },
 				...ev.retainedExecution === void 0 ? {} : { retainedExecution: ev.retainedExecution },
+				...ev.retainedPendingCause === void 0 ? {} : { retainedPendingCause: ev.retainedPendingCause },
 				...settlementTime(ev.at),
 				seq: ev.seq
 			});
@@ -16104,6 +16221,7 @@ async function replaySpawnTree(journal, blobs, root) {
 				trace,
 				...ev.harnessTranscript === void 0 ? {} : { harnessTranscript: ev.harnessTranscript },
 				...ev.retainedExecution === void 0 ? {} : { retainedExecution: ev.retainedExecution },
+				...ev.retainedPendingCause === void 0 ? {} : { retainedPendingCause: ev.retainedPendingCause },
 				...settlementTime(ev.at),
 				seq: ev.seq
 			});
@@ -16206,6 +16324,7 @@ function materializeTreeView(events) {
 		node.trace = traceEvidenceFor(ev);
 		node.budgetViolation = budgetViolationOf(ev).budgetViolation;
 		if (ev.retainedExecution !== void 0) node.retainedExecution = ev.retainedExecution;
+		if (ev.retainedPendingCause !== void 0) node.retainedPendingCause = ev.retainedPendingCause;
 		const settledAt = Date.parse(ev.at);
 		if (Number.isFinite(settledAt)) node.settledAt = settledAt;
 	} else if (ev.kind === "woken") {
@@ -16230,6 +16349,7 @@ function materializeTreeView(events) {
 		node.outRef = ev.outRef;
 		node.budgetViolation = budgetViolationOf(ev).budgetViolation;
 		if (ev.retainedExecution !== void 0) node.retainedExecution = ev.retainedExecution;
+		if (ev.retainedPendingCause !== void 0) node.retainedPendingCause = ev.retainedPendingCause;
 		const settledAt = Date.parse(ev.at);
 		if (Number.isFinite(settledAt)) node.settledAt = settledAt;
 	}
@@ -16336,6 +16456,7 @@ function freezeSnapshot(node) {
 		trace: node.trace,
 		...node.budgetViolation === void 0 ? {} : { budgetViolation: node.budgetViolation },
 		...node.retainedExecution === void 0 ? {} : { retainedExecution: node.retainedExecution },
+		...node.retainedPendingCause === void 0 ? {} : { retainedPendingCause: node.retainedPendingCause },
 		settledAt: node.settledAt,
 		spawnedAt: node.spawnedAt
 	};
@@ -19856,7 +19977,178 @@ function stableText(value, label) {
 	return text;
 }
 //#endregion
+//#region src/runtime/supervise/terminal-record.ts
+/** The settlement fields every writer copies, in the terminal record's key order. The
+*  `reconciled` record is built from this same spread so it and the terminal record can never
+*  disagree on a field. */
+function settlementFields(subject, settlement) {
+	return {
+		spent: subject.spent,
+		infra: settlement.infra,
+		reason: settlement.reason,
+		...settlement.retainedPendingCause === void 0 ? {} : { retainedPendingCause: settlement.retainedPendingCause },
+		...settlement.outRef ? { outRef: settlement.outRef } : {},
+		...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
+		...subject.budgetViolation ? { budgetViolation: subject.budgetViolation } : {},
+		trace: settlement.trace,
+		...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {}
+	};
+}
+/** `cancelled` keeps its `source` from the subject's own cancellation reason, so a released
+*  cancelled child records the same source it settled with. */
+function terminalDownEvent(subject, settlement, seq, at, retainedExecution) {
+	const cancellation = subject.cancellationReason;
+	return {
+		...cancellation === void 0 ? {
+			kind: "settled",
+			status: "down"
+		} : {
+			kind: "cancelled",
+			source: cancellation.source
+		},
+		id: subject.id,
+		...settlementFields(subject, settlement),
+		...retainedExecution === void 0 ? {} : { retainedExecution },
+		seq,
+		at
+	};
+}
+/**
+* The evidence a settled node carries beyond its status: the receipts that name what actually
+* ran, the own-inference spend the parent tree re-homes as a `metered` event, and the wall-clock
+* window. One builder feeds BOTH terminal paths, so an observer never sees a `down` node
+* described in different terms from a `done` one. Every field is omitted when the fact is
+* absent — an unreported receipt must not read as an empty one. Snapshots are detached because
+* an observer may serialize them after the live child has moved on.
+*/
+function settledNodeEvidence(subject, settlement, settledAt) {
+	return {
+		runtime: subject.runtime,
+		startedAt: subject.startedAt,
+		settledAt,
+		...settlement.metered ? { metered: detachedSnapshot(settlement.metered, "metered") } : {},
+		...subject.providerModel ? { providerModel: detachedSnapshot(subject.providerModel, "provider model evidence") } : {},
+		...subject.materialization ? { materialization: detachedSnapshot(subject.materialization, "materialization receipt") } : {},
+		...subject.executionBindings.length > 0 ? { executionBindings: detachedSnapshot([...subject.executionBindings], "execution binding receipts") } : {},
+		...subject.budgetViolation ? { budgetViolation: detachedSnapshot(subject.budgetViolation, "budget violation") } : {},
+		trace: detachedSnapshot(settlement.trace, "worker trace evidence")
+	};
+}
+/** The `agent.child` payload of the release: the settlement restated as released, `settledAt`
+*  kept at the settlement instant and `metered` omitted so the driver's inference is not summed
+*  twice. The sweep and the resume heal emit it from the same builder. */
+function releasedChildPayload(subject, settlement, settledAt, releasedAt) {
+	return {
+		childId: subject.id,
+		status: "down",
+		retainedExecution: "released",
+		...settlement.retainedPendingCause === void 0 ? {} : { retainedPendingCause: settlement.retainedPendingCause },
+		releasedAt,
+		...settlement.outRef === void 0 ? {} : { outRef: settlement.outRef },
+		reason: settlement.reason,
+		infra: settlement.infra,
+		spent: subject.spent,
+		...settledNodeEvidence(subject, {
+			...settlement,
+			metered: void 0
+		}, settledAt)
+	};
+}
+//#endregion
 //#region src/runtime/supervise/recover-executors.ts
+/** The environment id the node's latest durable admission names — the executor's own rule
+*  (`admittedEnvironmentId` in environment-provider.ts), read off the journal. */
+function journaledEnvironmentId(owned) {
+	for (const event of [...owned].reverse()) {
+		if (event.kind !== "execution-admitted") continue;
+		if (event.admission.phase === "dispatched") return event.admission.controlRef.environmentId;
+		if (event.admission.phase === "environment") return event.admission.environmentId;
+	}
+}
+/**
+* Close the cursor slot of every node the release sweep destroyed but never recorded: the
+* settling process died between the last `environment-teardown` receipt and the terminal record
+* (the 0.233.0 crash window). The record is the sweep's own — the same builder, the cursor seq
+* `next()` stamped on the delivery and the settlement instant, all read back from the node's
+* latest `reconciled` record — so a healed journal replays as one the sweep completed.
+*
+* The gate is fail-closed, every clause required, because the heal cannot re-ask the executor
+* to confirm teardown the way the sweep does:
+*  - the latest `reconciled` record carries `settledSeq`, `reason`, `infra` and `trace` (a record
+*    written before those fields existed names no cursor position and is not healed);
+*  - at least one receipt sits after that record and every such receipt reads `destroyed: true`
+*    (an empty set must not close the slot vacuously, and a receipt from an earlier process
+*    belongs to an earlier settlement);
+*  - the environment the latest admission names is among those receipts, so a receipt for an
+*    environment the journal never admitted, or a re-admitted node whose receipt names the
+*    earlier environment, is left open where the live sweep would have closed it.
+* A node with an `execution-result` is left to the recorded-result branch of
+* {@link prepareInterruptedExecutors}, which settles it from the durable blob and takes
+* precedence. The walk is over the whole forest because a nested manager settled on the ordinary
+* path is never restored, so a per-tree heal inside the resume of its tree would never reach its
+* grandchild. Returns the number of records written.
+*/
+async function healReleasedSlots(opts, signal, now) {
+	const forest = await loadSpawnForest(opts.journal, opts.runId);
+	let healed = 0;
+	for (const tree of forest.trees) {
+		signal.throwIfAborted();
+		const events = tree.events;
+		const closed = new Set(events.filter(closesCursorSlot).map((event) => event.id));
+		const recorded = new Set(events.flatMap((event) => event.kind === "execution-result" ? [event.id] : []));
+		for (const spawned of events) {
+			if (spawned.kind !== "spawned" || spawned.parent === void 0) continue;
+			if (closed.has(spawned.id) || recorded.has(spawned.id)) continue;
+			const owned = events.filter((event) => event.id === spawned.id);
+			const floor = owned.reduce((latest, event) => event.kind === "reconciled" && (latest === void 0 || event.seq > latest.seq) ? event : latest, void 0);
+			if (floor?.settledSeq === void 0 || floor.reason === void 0 || floor.infra === void 0 || floor.trace === void 0) continue;
+			const receipts = owned.slice(owned.indexOf(floor) + 1).filter((event) => event.kind === "environment-teardown");
+			if (receipts.length === 0 || !receipts.every((receipt) => receipt.destroyed)) continue;
+			const held = journaledEnvironmentId(owned);
+			if (held === void 0 || !receipts.some((receipt) => receipt.environmentId === held)) continue;
+			const settledSeq = floor.settledSeq;
+			if (events.some((event) => closesCursorSlot(event) && event.seq === settledSeq)) throw new RuntimeRunStateError(`retained child '${spawned.id}' cannot be released at cursor seq ${settledSeq}: tree '${tree.root}' already closes that seq`);
+			const subject = {
+				id: spawned.id,
+				spent: floor.spent,
+				...floor.budgetViolation ? { budgetViolation: floor.budgetViolation } : {},
+				...floor.cancellation ? { cancellationReason: floor.cancellation } : {}
+			};
+			const settlement = {
+				kind: "down",
+				reason: floor.reason,
+				infra: floor.infra,
+				trace: floor.trace,
+				...floor.outRef ? { outRef: floor.outRef } : {},
+				...floor.providerModel ? { providerModel: floor.providerModel } : {},
+				...floor.harnessTranscript ? { harnessTranscript: floor.harnessTranscript } : {},
+				...floor.retainedPendingCause ? { retainedPendingCause: floor.retainedPendingCause } : {}
+			};
+			await opts.journal.appendEvent(tree.root, terminalDownEvent(subject, settlement, settledSeq, floor.at, "released"));
+			healed += 1;
+			const materialized = owned.find((event) => event.kind === "materialized");
+			const lastReceipt = receipts[receipts.length - 1];
+			notifyRuntimeHookEvent(opts.hooks, {
+				id: `${spawned.id}:released`,
+				runId: tree.root,
+				target: "agent.child",
+				phase: "after",
+				timestamp: now(),
+				stepIndex: settledSeq,
+				parentId: tree.ownerNodeId ?? opts.runId,
+				payload: releasedChildPayload({
+					...subject,
+					runtime: materialized?.receipt.runtime ?? spawned.runtime,
+					startedAt: Date.parse(spawned.at),
+					...materialized === void 0 ? {} : { materialization: materialized.receipt },
+					executionBindings: owned.flatMap((event) => event.kind === "execution-bound" ? [event.binding] : []),
+					...floor.providerModel ? { providerModel: floor.providerModel } : {}
+				}, settlement, Date.parse(floor.at), Date.parse(lastReceipt.at))
+			}, { signal });
+		}
+	}
+	return healed;
+}
 /** Validate durable inputs without waiting for work that may need its resumed manager. */
 async function prepareInterruptedExecutors(opts, events, signal, now, parentId = opts.runId) {
 	signal.throwIfAborted();
@@ -19929,7 +20221,7 @@ async function prepareInterruptedExecutors(opts, events, signal, now, parentId =
 			factory: prepared?.factory ?? opts.recoverExecutor
 		});
 	}
-	let seq = events.reduce((max, event) => closesCursorSlot(event) ? Math.max(max, event.seq) : max, -1) + 1;
+	let seq = reservedCursorFloor(events) + 1;
 	for (const { result, fault, budgetViolation } of accepted) {
 		signal.throwIfAborted();
 		const failureReason = executorFailureReason(result);
@@ -20011,6 +20303,19 @@ function maxSeqOf(events, pred) {
 	for (const ev of events) if (pred(ev) && ev.seq > max) max = ev.seq;
 	return max;
 }
+/**
+* The highest cursor seq any record in the journal already owns, closed OR reserved.
+*
+* A closed slot owns its seq outright. An open retained node owns the `settledSeq` its
+* `reconciled` record carries: that is the seq the driver already branched on, and the seq the
+* heal (or a later release sweep) writes the terminal record under. Every writer that mints a
+* new cursor seq in a resumed process — the recorded-result settlements below and the resumed
+* scope's own cursor — must start past BOTH, or a recovered result lands on a seq an open node
+* has reserved and the heal can only ever collide. One function so no writer can drift.
+*/
+function reservedCursorFloor(events) {
+	return Math.max(maxSeqOf(events, closesCursorSlot), events.reduce((max, event) => event.kind === "reconciled" && event.settledSeq !== void 0 ? Math.max(max, event.settledSeq) : max, -1));
+}
 /** Per-channel sum over a journaled event list: `settled` = spawned-child work (reconciled), plus
 *  the reconciled floor of every node still open, plus the declared ceiling of every open node
 *  nothing reconciled; `metered` = driver inference (re-homed up the tree, so a single root-tree
@@ -20060,6 +20365,7 @@ function sumMeasuredSpendFromEvents(events) {
 }
 /** Restore the same journal projection and accounting for root and nested scopes. @internal */
 async function prepareScopeResume(opts, events, signal, now, parentId = opts.runId) {
+	if (parentId === opts.runId && await healReleasedSlots(opts, signal, now) > 0) events = await opts.journal.loadTree(opts.runId) ?? events;
 	const prepared = await prepareInterruptedExecutors(opts, events, signal, now, parentId);
 	const prior = prepared.events;
 	const recovering = new Set(prepared.recoveries.map((item) => item.spawned.id));
@@ -20079,7 +20385,7 @@ async function prepareScopeResume(opts, events, signal, now, parentId = opts.run
 			settled,
 			view: materializeTreeView(prior),
 			maxSpawnOrdinal: maxSeqOf(prior, (event) => event.kind === "spawned"),
-			maxCursorSeq: maxSeqOf(prior, closesCursorSlot),
+			maxCursorSeq: reservedCursorFloor(prior),
 			maxWaitOrdinal: maxSeqOf(prior, (event) => event.kind === "waiting"),
 			waits: pendingWaits(prior),
 			keys: keyedAssignments(prior, settled),
@@ -21598,20 +21904,7 @@ function createScope(args) {
 					timestamp: releasedAt,
 					stepIndex: child.settledSeq,
 					parentId: args.parentId,
-					payload: {
-						childId: child.id,
-						status: "down",
-						retainedExecution: "released",
-						releasedAt,
-						...child.resolved.outRef === void 0 ? {} : { outRef: child.resolved.outRef },
-						reason: child.resolved.reason,
-						infra: child.resolved.infra,
-						spent: child.spent,
-						...settledNodeEvidence(child, {
-							...child.resolved,
-							metered: void 0
-						}, settledAt)
-					}
+					payload: releasedChildPayload(child, child.resolved, settledAt, releasedAt)
 				}, { signal: args.signal });
 			}
 		}
@@ -21897,14 +22190,18 @@ async function appendSettlementMetering(journal, root, id, spend, at) {
 }
 /** An open node's reconciled floor has the same per-child sequence discipline as its metering:
 *  outside the cursor namespace, monotonic per node, so a node reconciled once per process (a
-*  retained failure, a recovery, a second retained failure) keeps its records ordered. */
-async function appendReconciledFloor(journal, root, id, spent, at, harnessTranscript) {
-	const seq = await nextPerNodeSeq(journal, root, "reconciled", id);
+*  retained failure, a recovery, a second retained failure) keeps its records ordered. It carries
+*  the whole settlement and the cursor seq (`settledSeq`) beside the floor, through the same
+*  field spread the terminal record uses, so a resume that finds the release sweep died before
+*  its record can write that record byte-for-byte instead of inventing one. */
+async function appendReconciledFloor(journal, root, subject, settlement, settledSeq, at) {
+	const seq = await nextPerNodeSeq(journal, root, "reconciled", subject.id);
 	await appendAcknowledged(journal, root, {
 		kind: "reconciled",
-		id,
-		spent,
-		...harnessTranscript ? { harnessTranscript } : {},
+		id: subject.id,
+		...settlementFields(subject, settlement),
+		...subject.cancellationReason === void 0 ? {} : { cancellation: { source: subject.cancellationReason.source } },
+		settledSeq,
 		seq,
 		at
 	});
@@ -21953,9 +22250,18 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 		if (!retainedPending) await args.journal.appendEvent(args.root, terminalDownEvent(child, settlement, seq, at));
 		else {
 			child.retainedExecution = "pending";
-			if (settlement.reconciled !== void 0) await appendReconciledFloor(args.journal, args.root, child.id, settlement.reconciled, at, settlement.harnessTranscript);
-		}
-		const retainedExecution = retainedPending ? { retainedExecution: "pending" } : {};
+			child.retainedPendingCause = settlement.retainedPendingCause;
+			if (settlement.reconciled !== void 0) await appendReconciledFloor(args.journal, args.root, {
+				id: child.id,
+				spent: settlement.reconciled,
+				...child.retainedViolation === void 0 ? {} : { budgetViolation: child.retainedViolation },
+				...child.cancellationReason === void 0 ? {} : { cancellationReason: child.cancellationReason }
+			}, settlement, seq, at);
+		}
+		const retainedExecution = retainedPending ? {
+			retainedExecution: "pending",
+			...settlement.retainedPendingCause === void 0 ? {} : { retainedPendingCause: settlement.retainedPendingCause }
+		} : {};
 		notifyRuntimeHookEvent(args.hooks, {
 			id: `${child.id}:settled`,
 			runId: args.root,
@@ -22042,56 +22348,6 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 		seq
 	};
 }
-/**
-* The evidence a settled node carries beyond its status: the receipts that name what actually
-* ran, the own-inference spend the parent tree re-homes as a `metered` event, and the wall-clock
-* window. One builder feeds BOTH terminal paths, so an observer never sees a `down` node
-* described in different terms from a `done` one. Every field is omitted when the fact is
-* absent — an unreported receipt must not read as an empty one. Snapshots are detached because
-* an observer may serialize them after the live child has moved on.
-*/
-/** The one builder of a down child's terminal record, for both its writers: the settle path at
-*  the reconcile and the release sweep closing a retained slot later. Two hand-written literals
-*  for one record shape is how a field lands on one path and not the other (#1244 was exactly
-*  that for `harnessTranscript`). `cancelled` keeps its `source` from the child's own
-*  cancellation reason, so a released cancelled child records the same source it settled with. */
-function terminalDownEvent(child, settlement, seq, at, retainedExecution) {
-	const cancellation = child.cancellationReason;
-	return {
-		...cancellation === void 0 ? {
-			kind: "settled",
-			status: "down"
-		} : {
-			kind: "cancelled",
-			source: cancellation.source
-		},
-		id: child.id,
-		spent: child.spent,
-		infra: settlement.infra,
-		reason: settlement.reason,
-		...settlement.outRef ? { outRef: settlement.outRef } : {},
-		...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
-		...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
-		trace: settlement.trace,
-		...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {},
-		...retainedExecution === void 0 ? {} : { retainedExecution },
-		seq,
-		at
-	};
-}
-function settledNodeEvidence(child, settlement, settledAt) {
-	return {
-		runtime: child.runtime,
-		startedAt: child.startedAt,
-		settledAt,
-		...settlement.metered ? { metered: detachedSnapshot(settlement.metered, "metered") } : {},
-		...child.providerModel ? { providerModel: detachedSnapshot(child.providerModel, "provider model evidence") } : {},
-		...child.materialization ? { materialization: detachedSnapshot(child.materialization, "materialization receipt") } : {},
-		...child.executionBindings.length > 0 ? { executionBindings: detachedSnapshot([...child.executionBindings], "execution binding receipts") } : {},
-		...child.budgetViolation ? { budgetViolation: detachedSnapshot(child.budgetViolation, "budget violation") } : {},
-		trace: detachedSnapshot(settlement.trace, "worker trace evidence")
-	};
-}
 /** Journal a wait-state's settlement as a `woken` event and project it onto the same `Settled`
 *  the driver branches on. `by` names WHY it woke — `fired` / `timeout` / `cancelled` — which is
 *  the fact a resumed reader needs and cannot recover from a payload it may never fetch. */
@@ -22370,7 +22626,8 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 			live.budgetViolation = void 0;
 			return {
 				...downRecord(errMessage(err), true, trace, executor.metered?.(), void 0, retainedOutputRef, await persistTranscriptOnce()),
-				reconciled: live.spent
+				reconciled: live.spent,
+				retainedPendingCause: err instanceof RetainedExecutionPendingError ? err.pendingCause : "unobservable"
 			};
 		}
 		live.executorDone = true;
@@ -22462,7 +22719,8 @@ function makeTreeView(root, children) {
 		...c.trace ? { trace: c.trace } : {},
 		...c.providerModel ? { providerModel: c.providerModel } : {},
 		...c.budgetViolation ? { budgetViolation: c.budgetViolation } : {},
-		...c.retainedExecution ? { retainedExecution: c.retainedExecution } : {}
+		...c.retainedExecution ? { retainedExecution: c.retainedExecution } : {},
+		...c.retainedPendingCause ? { retainedPendingCause: c.retainedPendingCause } : {}
 	}));
 	return {
 		root,
@@ -22843,8 +23101,8 @@ const driverExecutorFactory = (rawSpec, ctx) => {
 			const prior = await journal.loadTree(nestedRoot) ?? [];
 			if (prior.length === 0) await journal.appendEvent(nestedRoot, ownedSpawn);
 			else if (contentAddress(prior[0]) !== contentAddress(ownedSpawn)) throw new ValidationError$1("driverExecutor: nested recovery changed its owning parent spawn");
-			else if (prior.length !== 1 && !recovering) throw new RetainedExecutionPendingError(new ValidationError$1("driverExecutor: interrupted nested execution requires recovery"));
-			if (recovering && (!spec.recoverExecutor || !seam.restore)) throw new RetainedExecutionPendingError(new ValidationError$1("driverExecutor: nested recovery has no original executor reconstruction"));
+			else if (prior.length !== 1 && !recovering) throw new RetainedExecutionPendingError(new ValidationError$1("driverExecutor: interrupted nested execution requires recovery"), "nested-recovery");
+			if (recovering && (!spec.recoverExecutor || !seam.restore)) throw new RetainedExecutionPendingError(new ValidationError$1("driverExecutor: nested recovery has no original executor reconstruction"), "nested-recovery");
 			signal.throwIfAborted();
 			const controller = new AbortController();
 			const onParentAbort = () => controller.abort(signal.reason);
@@ -22856,7 +23114,7 @@ const driverExecutorFactory = (rawSpec, ctx) => {
 			} catch (error) {
 				controller.abort(error);
 				signal.removeEventListener("abort", onParentAbort);
-				throw new RetainedExecutionPendingError(error);
+				throw new RetainedExecutionPendingError(error, "nested-recovery");
 			}
 			active = {
 				controller,
@@ -22895,7 +23153,7 @@ const driverExecutorFactory = (rawSpec, ctx) => {
 				accounting = partial?.accounting;
 				const events = await journal.loadTree(nestedRoot).catch(() => void 0);
 				const settledIds = new Set(events?.filter((event) => event.kind === "settled" || event.kind === "cancelled").map((event) => event.id));
-				if (events?.some((event) => event.kind === "execution-admitted" && event.id === seam.nodeId || event.kind === "spawned" && event.parent !== void 0 && event.runtime !== "inline" && !settledIds.has(event.id))) throw new RetainedExecutionPendingError(err);
+				if (events?.some((event) => event.kind === "execution-admitted" && event.id === seam.nodeId || event.kind === "spawned" && event.parent !== void 0 && event.runtime !== "inline" && !settledIds.has(event.id))) throw new RetainedExecutionPendingError(err, "nested-recovery");
 				if (cleanupError !== void 0) throw cleanupError;
 				throw err;
 			} finally {
@@ -24306,4 +24564,4 @@ function isNonEmptySpend(s) {
 //#endregion
 export { bindReusableExecutorExecutionId as $, providerMessageText as $i, buildRuntimeEventOtelSpans as $n, providerAttemptEvidence as $r, addHarnessUsage as $t, waitUntil as A, deleteBoxSafe as Ai, RunCancellationReason as An, profileMaterializationAxes$1 as Ar, spendFromUsageTotals as At, attachWorker as B, withTimeout as Bi, defaultRedactorIdentityMaterial as Bn, worktreeCliProfileMaterialization as Br, createInbox as Bt, scopeOwnerExecutorNodeContext as C, notifySandboxEventObserver as Ci, resolveAgentEnvironmentProvider as Cn, parseCodexTokenUsage as Cr, workerTraceAnalysisStore as Ct, pollFor as D, addSpend as Di, sandboxSessionTraceSource as Dn, controlProfileMaterialization as Dr, meterUsageEvent as Dt, isWaitOutcome as E, sumSandboxUsage as Ei, decodeToolPart as En, assertProfileMaterialization as Er, createBudgetPool as Et, scopeRetainedOwnerPriorSpend as F, sleep as Fi, recoverRetainedRun as Fn, renderProfileMaterializationIssues as Fr, workerTraceSeamKey as Ft, recoverRetainedInteractiveRun as G, decodeHarnessUsage as Gi, contentAddress as Gn, attestRuntimeOwnedPendingExecutor as Gr, createPeerMailbox as Gt, workerInteractiveBindingFile as H, addResourceSpend as Hi, captureHarnessTranscript as Hn, parseCommittedJsonLines as Hr, DEFAULT_PEER_MAIL_LIMITS as Ht, scopeRetainedOwnerResult as I, stringifySafe as Ii, startRetainedRun as In, renderUnsupported as Ir, taskToPrompt as It, errMessage as J, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as Ji, readTraceContextFromEnv as Jn, finalizeRuntimeOwnedPendingExecutor as Jr, peerMailVerbNames as Jt, startRetainedInteractiveRun as K, abortError$2 as Ki, createPropagatingTraceEmitter as Kn, attestRuntimeOwnedScopeOwner as Kr, isPeerMailEnvelope as Kt, interactiveAdmissionSeamKey as L, throwAbort as Li, startRetainedRunInEnvironment as Ln, sandboxActProfileMaterialization as Lr, DEFAULT_STALL_AFTER_MS as Lt, consumeScopeRetainedOwnerResult as M, isAbortError$2 as Mi, linkAbort as Mn, promptModelProfileMaterialization as Mr, readWorkerTraceContext as Mt, prepareScopeRetainedOwnerTask as N, promptCacheTokenClasses as Ni, runAbortable as Nn, promptOnlyProfileMaterialization as Nr, workerTraceEnv as Nt, timerAt as O, chargedTokens as Oi, registerRetainedExecutorPreparation as On, defineProfileMaterializationContract as Or, newUsageTotals as Ot, scopeRetainedOwnerContext as P, randomSuffix as Pi, reconnectRetainedRun as Pn, promptResourceProfileMaterialization as Pr, workerTraceHeaders as Pt, rollingDispatch as Q, promptOptionsFromAgentTurnInput as Qi, buildLoopSpanNodes as Qn, newExecutionAttemptId as Qr, bridgeModelRouteRefusal as Qt, readWorkerInteractiveAdmissions as R, throwIfAborted as Ri, retainedCreateMaterial as Rn, unsupportedProfileDimensions as Rr, createActivityLog as Rt, restoreScopeOwnerAcceptedExecution as S, mapSandboxToolEvent as Si, providerAsSandboxClient as Sn, localHarnessExecutable as Sr, parseWorkerToolTraceArtifact as St, createWaitProbes as T, sandboxProgressEvents as Ti, createPushTraceSource as Tn, AGENT_PROFILE_MATERIALIZATION_AXES as Tr, assertValidBudget as Tt, workerInteractiveBindingsDir as U, resourceTelemetry as Ui, harnessTranscriptArtifact as Un, prepareJsonlAppend as Ur, PEER_MAIL_WIRE_KEY as Ut, readWorkerInteractiveBinding as V, zeroSpend as Vi, resolveRedactor as Vn, isNoEntError as Vr, AUTHORITY_MARKERS as Vt, reconnectRetainedInteractiveRun as W, withBudgetResources as Wi, persistHarnessTranscript as Wn, writeAllBytes as Wr, claimsAuthority as Wt, freeSlots as X, teardownExecutor as Xi, INTELLIGENCE_WIRE_VERSION as Xn, knownExecutionBindingReceipt as Xr, isTerminalNodeStatus as Xt, effectiveConcurrency as Y, armDeadlineTimer as Yi, traceContextToEnv as Yn, inheritRuntimeOwnedExecutorAttestation as Yr, isLiveNodeStatus as Yt, queueOf as Z, promptFromAgentTurnInput as Zi, buildLoopOtelSpans as Zn, knownMaterializationReceipt as Zr, bridgeAdmissionRefusal as Zt, createScope as _, createSandboxToolPartState as _i, canonicalObservedModelParts as _n, createWorktree as _r, pendingWaits as _t, pickBestDelivered as a, runtimeOwnedPendingExecutorMaterialization as ai, TERMINAL_DECISIONS as an, loopEventToOtelSpan as ar, snapshotExecutorConfig as at, meterRuntimeOwnedProviderAttempt as b, isSandboxTerminalEvent as bi, createAgentEnvironmentProviderRegistry as bn, LOCAL_HARNESSES as br, captureWorkerTraceEvidence as bt, DriverAttemptsExhaustedError as c, unknownMaterializationReceipt as ci, isTerminalDecision as cn, toOtelAttributes as cr, createSteerableSandboxSession as ct, runDriverWithRetry as d, detachedFrozen as di, probeSandboxCapabilities as dn, sanitizeAgentRuntimeEvent as dr, FileSpawnJournal as dt, recordRuntimeOwnedDriveHarnessProviderEvidence as ei, createCodexRolloutStoreReader as en, createOpenInferenceFileExporter as er, captureReusableExecutorConfig as et, driverChild as f, detachedSnapshot as fi, acquireSandbox as fn, sanitizeKnowledgeReadinessReport as fr, InMemoryResultBlobStore as ft, beginScopeOwnerAttempt as g, canonicalStreamEventFromSandboxEvent as gi, runBrainLoop as gn, captureWorktreeDiff as gr, materializeTreeView as gt, withDriverExecutor as h, assertSandboxServedModel as hi, routerBrain as hn, runWorktreeHarness as hr, loadSpawnForest as ht, collectDelivered as i, runtimeOwnedExecutorProviderEvidence as ii, bridgeStopSignalKey as in, generateSpanId as ir, createExecutorRegistry as it, bindScopeRetainedOwnerProvider as j, hasCompleteCacheBreakdown as ji, abortError as jn, promptControlProfileMaterialization as jr, WORKER_TRACE_PROPAGATION as jt, validateWaitSpec as k, cloneSpend as ki, retainedExecutorSeamKey as kn, fullProfileMaterialization as kr, spendFromUsageEvents as kt, classifyDriverFailure as l, executableAgentProfileSnapshot as li, runAgentRounds as ln, createRuntimeEventCollector as lr, createInPlaceCliExecutor as lt, isDriverSpec as m, readSandboxOutcome as mi, readPromptOptions as mn, runSettledCommand as mr, insideCursorNamespace as mt, createSupervisor as n, runtimeOwnedExecutorExecutionBinding as ni, readCodexRolloutSession as nn, exportEvalRuns as nr, cliWorktreeExecutor as nt, runFinalizer as o, runtimeOwnedScopeOwnerRuntime as oi, createSandboxForSpec as on, padSpanId as or, createWorktreeCliExecutor as ot, driverExecutorFactory as p, projectSandboxOutcome as pi, assertBoxlessPromptOptions as pn, sanitizeRuntimeStreamEvent as pr, InMemorySpawnJournal as pt, destroyInteractiveEnvironment as q, awaitAbortable$1 as qi, mergeTraceEnv as qn, authoredProfileDigest as qr, peerMailTools as qt, bestDelivered as r, runtimeOwnedExecutorMaterialization as ri, bridgeRuntimeAttachmentsKey as rn, flatOtelSpan as rr, createExecutor as rt, runTree as s, unknownExecutionBindingReceipt as si, defaultSelectWinner as sn, padTraceId as sr, DEFAULT_SANDBOX_STEERING_MAX_TURNS as st, createRootHandle as t, runtimeOwnedDriveHarnessProviderEvidence as ti, harnessUsageIsEmpty as tn, createOtelExporter as tr, cliInPlaceExecutor as tt, defaultUnmetContractSteer as u, executableAgentSpecSnapshot as ui, createSandboxLineage as un, createRuntimeStreamEventCollector as ur, FileResultBlobStore as ut, deriveNodeExecutionIdentity as v, createSandboxUsageLedger as vi, observedModelMatchesDeclared as vn, removeWorktree as vr, replaySpawnTree as vt, settledToIteration as w, sandboxEventServedBackend as wi, sandboxClientAsProvider as wn, CodexExecutionDiagnosticError as wr, BudgetReconcileFault as wt, recordScopeOwnerMaterialization as x, mapSandboxEvent as xi, providerAsExecutor as xn, harnessSupportsReasoningEffort as xr, isTraceAnalysisStore as xt, meterRuntimeOwnedAccounting as y, extractLlmCallEvent as yi, DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS as yn, DEFAULT_LOCAL_HARNESS as yr, WORKER_TOOL_TRACE_SCHEMA_VERSION as yt, workerInteractiveAdmissionFile as z, unmeteredSpend as zi, defaultRedactor as zn, validateProfileMaterialization as zr, readWorkerProgress as zt };
 
-//# sourceMappingURL=supervisor-C2xWmESG.js.map
+//# sourceMappingURL=supervisor-CBtuIoqP.js.map