@tangle-network/agent-runtime 0.264.0 → 0.266.1

package/dist/{supervisor-C26k7X5-.js → supervisor-B8UMAXya.js}

@@ -5930,7 +5930,13 @@ const HARNESS_ROOTS = Object.freeze({
 		".claude/todos"
 	]),
 	codex: Object.freeze([".codex/sessions", ".codex/history.jsonl"]),
-	opencode: Object.freeze([".local/share/opencode/storage", ".local/share/opencode/log"]),
+	opencode: Object.freeze([
+		".local/share/opencode/storage",
+		".local/share/opencode/export",
+		".local/share/opencode/log",
+		".opencode/sessions",
+		".opencode/messages"
+	]),
 	pi: Object.freeze([".pi/agent/sessions"])
 });
 /**
@@ -7533,6 +7539,67 @@ function priceUnreceiptedWork(work) {
 	};
 }
 //#endregion
+//#region src/runtime/supervise/error-message.ts
+const maxCauseDepth = 4;
+const maxMessageLength = 32768;
+const maxPartLength = 2048;
+/** A persisted failure must explain its wrappers without exporting credentials or unbounded data. */
+function errorText(value) {
+	let text;
+	try {
+		text = typeof value === "string" ? value : JSON.stringify(value) ?? String(value);
+	} catch {
+		text = "[unprintable rejection]";
+	}
+	return String(defaultRedactor(text)).slice(0, maxMessageLength);
+}
+function errorProperty(error, field) {
+	try {
+		const value = error[field];
+		return value === void 0 ? void 0 : errorText(value).slice(0, field === "name" ? 256 : maxMessageLength);
+	} catch {
+		return `[unreadable error ${field}]`;
+	}
+}
+/** An HTTP status carried on a thrown error, read without trusting its getter. Provider SDKs put
+*  one on their own error classes, so this is how a refusal is recognised outside the transport
+*  taxonomy — for the persisted message here, and for the driver's retry verdict. */
+function errorHttpStatus(error) {
+	try {
+		const status = Reflect.get(error, "status");
+		return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599 ? status : void 0;
+	} catch {
+		return;
+	}
+}
+/** Shared by child settlements, driver attempts, and the final no-winner result. */
+function errMessage(error) {
+	const parts = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	for (let depth = 0; depth <= maxCauseDepth; depth += 1) try {
+		if (!(current instanceof Error)) {
+			parts.push(errorText(current).slice(0, maxPartLength));
+			break;
+		}
+		if (seen.has(current)) {
+			parts.push("[circular]");
+			break;
+		}
+		seen.add(current);
+		const status = errorHttpStatus(current);
+		const message = (status === void 0 ? "" : `HTTP ${status}: `) + (errorProperty(current, "message") ?? "");
+		parts.push((depth === 0 ? message : `${errorProperty(current, "name")}: ${message}`).slice(0, maxPartLength));
+		current = current.cause;
+		if (current === void 0 || current === null) break;
+		if (depth === maxCauseDepth) parts.push("[cause chain truncated]");
+	} catch {
+		parts.push("[unreadable error cause]");
+		break;
+	}
+	return parts.join(": caused by ").slice(0, maxMessageLength);
+}
+//#endregion
 //#region src/runtime/supervise/retained-executor.ts
 /** Scope owns the durable writer; provider executors only publish sanitized admissions. */
 const retainedExecutorSeamKey = "runtime.retainedExecutor";
@@ -7637,6 +7704,11 @@ var RetainedExecutionPendingError = class extends Error {
 		this.pendingCause = resolved;
 	}
 };
+/** The execution id of a leaf's later invocation, derived from its `execution-input` sequence so
+*  a recovery derives the same one. A first invocation keeps the node id. */
+function leafContinuationExecutionId(nodeId, inputSeq) {
+	return `${nodeId}:input:${inputSeq}`;
+}
 const retainedPreparations = /* @__PURE__ */ new WeakMap();
 /** Reconstruct an admitted manager through its original composition boundary. @internal */
 function registerRetainedExecutorPreparation(factory, prepare) {
@@ -7875,6 +7947,75 @@ function sandboxSessionTraceSource(box, sessionId, opts = {}) {
 	});
 }
 //#endregion
+//#region src/runtime/supervise/upstream-unavailable.ts
+/**
+* An upstream that cannot serve NOW: how Runtime recognizes one, and how long an agent waits for it.
+*
+* A model provider's exhausted quota, a rate limit, an overload, or the router's own refused
+* credential is not a fault in the agent: the same request succeeds when capacity returns. A
+* driver that meets one re-enters after a pause (`runDriverWithRetry`), and a leaf continues in
+* its environment after the same pause (`providerAsExecutor`). Both read the refusal and the pause
+* from here, so an outage costs a director and its workers the same number of turns.
+*
+* This module imports nothing, so the provider executor can read it without the error classes of
+* `../../errors`.
+*/
+/**
+* Machine codes that say the upstream cannot serve now rather than that the request is wrong.
+* Each is a code an upstream publishes, not prose: the router's
+* (`lib/model-substitution.ts`, `lib/upstream-error-triage.ts`) and the OpenAI- and Anthropic-shaped
+* error types a relayed body carries.
+*/
+const UNAVAILABLE_CODES = /* @__PURE__ */ new Set([
+	"provider_quota_exhausted",
+	"provider_quota_exceeded",
+	"provider_rate_limit",
+	"upstream_unavailable",
+	"provider_key_invalid",
+	"rate_limit_exceeded",
+	"rate_limit_error",
+	"overloaded_error"
+]);
+/** 429 Too Many Requests, 503 Service Unavailable, and 529, which Anthropic uses for overload. */
+const UNAVAILABLE_STATUSES = /* @__PURE__ */ new Set([
+	429,
+	503,
+	529
+]);
+/**
+* A harness that flattens the router's JSON body into its own failure text leaves the router's
+* code in that text: `opencode execution failed: No provider served model "..."
+* (provider_quota_exhausted)`. The code is matched as a whole token, and a status only in the
+* `status code <n>` framing a harness prints, so prose that merely mentions a quota does not match.
+*/
+function unavailableSignalInText(text) {
+	for (const token of text.toLowerCase().matchAll(/[a-z_]+/gu)) if (UNAVAILABLE_CODES.has(token[0])) return token[0];
+	const status = text.match(/\bstatus code (\d{3})\b/u)?.[1];
+	return status !== void 0 && UNAVAILABLE_STATUSES.has(Number(status)) ? `http-${status}` : void 0;
+}
+/**
+* The code or status that marks a failed turn outcome as an upstream capacity refusal, or
+* `undefined`. The outcome's own `errorCode` decides first; the failure text is read only when no
+* code decided, because a harness CLI reports the router's refusal as text.
+*/
+function unavailableSignalOfFailure(failure) {
+	const code = failure.errorCode?.toLowerCase();
+	if (code !== void 0 && UNAVAILABLE_CODES.has(code)) return code;
+	return unavailableSignalInText(failure.error);
+}
+const DEFAULT_UNAVAILABLE_PAUSE_MS = 15e3;
+const DEFAULT_MAX_UNAVAILABLE_PAUSE_MS = 3e5;
+/**
+* The pause after the `consecutive`-th refusal in a row (1-based): the first pause, doubled per
+* earlier refusal, up to the ceiling. The one rule for a driver that re-enters and a leaf that
+* continues in its environment, so an outage costs both the same number of turns.
+*/
+function unavailablePauseMs(consecutive, policy = {}) {
+	const first = Math.max(0, policy.unavailablePauseMs ?? DEFAULT_UNAVAILABLE_PAUSE_MS);
+	const ceiling = Math.max(first, policy.maxUnavailablePauseMs ?? DEFAULT_MAX_UNAVAILABLE_PAUSE_MS);
+	return Math.min(ceiling, first * 2 ** Math.max(0, consecutive - 1));
+}
+//#endregion
 //#region src/runtime/environment-provider.ts
 var ValidationError = class extends Error {
 	constructor(message, options) {
@@ -8043,6 +8184,11 @@ function providerTurnDefaults(options, context) {
 	const { prompt: _prompt, parts: _parts, model: _model, sessionId: _sessionId, signal: _signal, ...turn } = turnInputFromPrompt("", options);
 	return turn;
 }
+/** What a leaf is told when it continues after a refused turn. The session carries its
+*  conversation and the environment its files, so the instruction names neither the provider nor
+*  the refusal: a director told the details of a provider failure spent its children probing the
+*  infrastructure (discovery-lab AGENTS.md, measured 2026-09-11). */
+const LEAF_CONTINUATION_TASK = "Your previous turn was interrupted before it finished. This is the same task in the same session: your conversation so far and the files in your workspace are where you left them. Continue from where you stopped. Do not start over.";
 /**
 * Merge the declared turn defaults under one mapped turn.
 *
@@ -8089,6 +8235,16 @@ function providerAsExecutor(provider, options = {}) {
 		return createProviderExecutor(provider, profile, ctx, selected.options, selected.identity);
 	};
 }
+/**
+* Run a provider under a placement Runtime chose for the whole execution, such as a shared box.
+* The identity lands in the execution's materialization plan and binding, exactly where a
+* declared {@link ProviderPlacement} lands, so a record says which placement served it.
+* @internal
+*/
+function placedProviderExecutor(provider, options, identity) {
+	if (options.placements !== void 0) throw new ValidationError("placedProviderExecutor: placements select within one provider");
+	return (spec, ctx) => createProviderExecutor(provider, spec.profile, ctx, options, identity);
+}
 function createProviderExecutor(provider, profile, ctx, options, placement) {
 	if (options.workspaceRetention !== void 0) assertProviderWorkspaceRetentionPort(options.workspaceRetention, `providerAsExecutor(${provider.name})`);
 	const controller = new AbortController();
@@ -8283,51 +8439,95 @@ function createProviderExecutor(provider, profile, ctx, options, placement) {
 		beginWorkspaceExecution();
 		const linked = linkAbort(ctx.signal, signal, controller.signal);
 		try {
-			yield* streamProviderExecutor({
-				provider,
-				profile,
-				createProfile,
+			const executionStartedAt = Date.now();
+			let invocation = {
 				task,
-				signal: linked.signal,
-				...node === void 0 ? {} : { node },
-				options,
 				retention,
 				executionId,
-				trace,
-				recovering,
-				onRetained: (handle) => {
-					retained = handle;
-				},
-				onPending: (value) => {
-					pending = value;
-				},
-				onEnvironment: (env) => {
-					environment = env;
-					resetWorkspaceState(env);
-					if (harnessTranscript.status === "unavailable" && harnessTranscript.reason === "execution-never-started") harnessTranscript = harnessTranscriptUnavailable("capture-did-not-run");
-					finalizeRuntimeOwnedPendingExecutor(executor, {
-						...plannedDeclaration,
-						execution: {
-							kind: "environment",
-							id: env.id
+				recovering
+			};
+			let carried;
+			let refusalsInARow = 0;
+			for (let attempt = 1;; attempt += 1) {
+				const continued = carried !== void 0;
+				const ended = yield* streamProviderExecutor({
+					provider,
+					profile,
+					createProfile,
+					task: invocation.task,
+					signal: linked.signal,
+					...node === void 0 ? {} : { node },
+					options,
+					retention: invocation.retention,
+					executionId: invocation.executionId,
+					trace,
+					recovering: invocation.recovering,
+					...carried === void 0 ? {} : { carried },
+					executionStartedAt,
+					mayContinue: options.unavailablePause !== false && options.workspaceRetention === void 0 && invocation.retention?.continueInvocation !== void 0,
+					onRetained: (handle) => {
+						retained = handle;
+					},
+					onPending: (value) => {
+						pending = value;
+					},
+					onEnvironment: (env) => {
+						if (continued) {
+							if (env.id !== environment?.id) throw new ValidationError(`providerAsExecutor(${provider.name}): a continuation ran in environment ${env.id}, not ${environment?.id ?? "<none>"}`);
+							environment = env;
+							return;
 						}
-					}, plannedBinding);
-				},
-				onArtifact: (next) => {
-					artifact = next;
-				},
-				onHarnessTranscript: (next) => {
-					harnessTranscript = next;
-				},
-				onUnsettledFailure: () => {
-					workspacePreservationRequired = true;
-				},
-				onPublishedSnapshot: (snapshot) => {
-					workspacePublishedSnapshot = snapshot;
-				},
-				captureWorkspace,
-				destroyEnvironment
-			});
+						environment = env;
+						resetWorkspaceState(env);
+						if (harnessTranscript.status === "unavailable" && harnessTranscript.reason === "execution-never-started") harnessTranscript = harnessTranscriptUnavailable("capture-did-not-run");
+						finalizeRuntimeOwnedPendingExecutor(executor, {
+							...plannedDeclaration,
+							execution: {
+								kind: "environment",
+								id: env.id
+							}
+						}, plannedBinding);
+					},
+					onArtifact: (next) => {
+						artifact = next;
+					},
+					onHarnessTranscript: (next) => {
+						harnessTranscript = next;
+					},
+					onUnsettledFailure: () => {
+						workspacePreservationRequired = true;
+					},
+					onPublishedSnapshot: (snapshot) => {
+						workspacePublishedSnapshot = snapshot;
+					},
+					captureWorkspace,
+					destroyEnvironment
+				});
+				const refusal = ended.unavailable;
+				const continueInvocation = invocation.retention?.continueInvocation;
+				if (refusal === void 0 || continueInvocation === void 0) return;
+				refusalsInARow = ended.madeProgress ? 1 : refusalsInARow + 1;
+				const pauseMs = unavailablePauseMs(refusalsInARow, options.unavailablePause || {});
+				await invocation.retention?.onPause?.({
+					attempt,
+					signal: refusal.signal,
+					cause: refusal.cause,
+					attemptMs: ended.durationMs,
+					pauseMs,
+					madeProgress: ended.madeProgress
+				});
+				await sleep(pauseMs, linked.signal);
+				linked.signal.throwIfAborted();
+				const next = await continueInvocation(LEAF_CONTINUATION_TASK);
+				if (next.executionId === void 0) throw new ValidationError(`providerAsExecutor(${provider.name}): a continuation has no execution id of its own`);
+				carried = ended.spent;
+				invocation = {
+					task: LEAF_CONTINUATION_TASK,
+					retention: next,
+					executionId: next.executionId,
+					recovering: false
+				};
+			}
 		} finally {
 			linked.release();
 			workspaceRunActive = false;
@@ -8487,6 +8687,7 @@ async function* streamProviderExecutor(args) {
 	let settled;
 	let failure;
 	let failed = false;
+	let unavailable;
 	try {
 		const toolParts = createSandboxToolPartState();
 		for await (const event of source.events) {
@@ -8531,7 +8732,7 @@ async function* streamProviderExecutor(args) {
 			};
 		}
 		if ((args.options.requireTerminalEvent ?? true) && !terminal) throw new ValidationError(`providerAsExecutor(${args.provider.name}): stream ended without a terminal result/done/status event`);
-		yield { kind: "iteration" };
+		if (args.carried === void 0) yield { kind: "iteration" };
 		const harnessTranscript = await captureHarnessTranscript(environment, args.profile.harness, linked);
 		args.onHarnessTranscript(harnessTranscript);
 		const outcome = failures.finish();
@@ -8549,6 +8750,13 @@ async function* streamProviderExecutor(args) {
 			...sawCostEstimate ? { usdEstimated } : {},
 			ms: Date.now() - started
 		};
+		const executionSpent = args.carried === void 0 ? spent : {
+			...addSpend(args.carried, {
+				...spent,
+				iterations: 0
+			}),
+			ms: Date.now() - args.executionStartedAt
+		};
 		const verdict = await args.options.validator?.validate(result, {
 			iteration: 0,
 			...args.node === void 0 ? {} : { node: args.node },
@@ -8570,7 +8778,15 @@ async function* streamProviderExecutor(args) {
 			outRef: contentRef$1(`provider:${args.provider.name}`, settledResult),
 			out: settledResult,
 			...verdict ? { verdict } : {},
-			spent
+			spent: executionSpent
+		};
+		const refusal = args.mayContinue && source.retained && result.outcome?.status === "failed" ? unavailableSignalOfFailure({
+			error: result.outcome.error ?? "",
+			...result.outcome.errorCode ? { errorCode: result.outcome.errorCode } : {}
+		}) : void 0;
+		if (refusal !== void 0) unavailable = {
+			signal: refusal,
+			cause: errorText(result.outcome?.error ?? "")
 		};
 		if (source.retained) await args.retention?.onResult(settled);
 		args.onPending(false);
@@ -8592,7 +8808,7 @@ async function* streamProviderExecutor(args) {
 		}
 		args.onHarnessTranscript(await captureHarnessTranscript(environment, args.profile.harness, linked));
 	} finally {
-		if ((!source.retained || settled !== void 0 && !failed) && !(source.retained && args.retention?.preserveEnvironment) && (args.options.destroyOnSettle ?? true)) {
+		if ((!source.retained || settled !== void 0 && !failed) && !(source.retained && args.retention?.preserveEnvironment) && !(unavailable !== void 0 && !failed) && (args.options.destroyOnSettle ?? true)) {
 			const cleanup = await args.destroyEnvironment();
 			if (!cleanup.destroyed) {
 				const error = new Error(cleanup.detail ?? "provider environment teardown was not confirmed");
@@ -8612,6 +8828,12 @@ async function* streamProviderExecutor(args) {
 		}
 	}
 	if (failed) throw failure;
+	return {
+		...unavailable === void 0 ? {} : { unavailable },
+		...settled === void 0 ? {} : { spent: settled.spent },
+		madeProgress: tokens.input > 0 || tokens.output > 0 || usd > 0,
+		durationMs: Date.now() - started
+	};
 	/**
 	* The catalog price of this execution's whole token total, under the first model id the catalog
 	* knows. Undefined when none prices, so an unpriced model settles with no estimate at all rather
@@ -8636,6 +8858,14 @@ async function* streamProviderExecutor(args) {
 			if (priced.usdKnown === false && priced.usdEstimated !== void 0) return priced.usdEstimated;
 		}
 	}
+	/** This invocation's cumulative tokens as the execution's: a continuation adds what its earlier
+	*  invocations already reported. */
+	function executionTokens(own) {
+		if (args.carried === void 0) return own;
+		const total = cloneTokenUsage(args.carried.tokens);
+		addTokenUsage(total, own);
+		return total;
+	}
 	function* creditUsage(receipt, event) {
 		if (receipt === void 0) return;
 		if (receipt.model !== (args.profile.name ?? "agent")) observedModel = receipt.model;
@@ -8649,7 +8879,7 @@ async function* streamProviderExecutor(args) {
 			yield {
 				kind: "tokens",
 				mode: "cumulative",
-				...tokens,
+				...executionTokens(tokens),
 				...receipt.tokensKnown === false ? { tokensKnown: false } : {}
 			};
 		}
@@ -14468,7 +14698,7 @@ function readWorkerProgress(scope, executor, now, stallAfterMs = DEFAULT_STALL_A
 		startedAt: scope.startedAt,
 		lastActivityAt,
 		idleMs,
-		stalled: live && idleMs > stallAfterMs,
+		stalled: live && scope.status !== "queued" && idleMs > stallAfterMs,
 		stallAfterMs,
 		turns: executor?.turns ?? scope.turns,
 		tokens: scope.tokens,
@@ -14478,7 +14708,8 @@ function readWorkerProgress(scope, executor, now, stallAfterMs = DEFAULT_STALL_A
 		pendingMessages: executor?.pendingMessages ?? 0,
 		recentActivity: executor?.recentActivity ?? [],
 		...executor?.derived?.length ? { derived: executor.derived } : {},
-		...note ? { note } : {}
+		...note ? { note } : {},
+		...scope.team ? { team: scope.team } : {}
 	};
 }
 //#endregion
@@ -15646,6 +15877,12 @@ function mergeBridgeObservedModel(current, next) {
 * then a ceiling, not a measurement. It does not close admission the way the dollar channel does:
 * tokens are always capped, so one unreported turn must not end the run.
 *
+* A reservation the free balance cannot cover now can WAIT instead of failing (`reserve(b, holder,
+* { wait: true })`) when it would fit once the reservations still open return. It holds nothing
+* while it waits, so conservation is untouched. Waiting reservations are granted in the order they
+* asked, as settlements return budget, and are refused once no open reservation is left to return
+* any: then nothing could ever cover them.
+*
 * A pool can be RESTORED from a prior process's durable record (same-host restart): measured
 * committed spend is debited exactly once, and each child journaled as started but never settled
 * is charged at its full declared ceiling — restart never mints capacity, and the unknown flags
@@ -15667,6 +15904,19 @@ var BudgetReconcileFault = class extends Error {
 		if (budgetViolation !== void 0) this.budgetViolation = budgetViolation;
 	}
 };
+/**
+* A waiting reservation that can never be granted: every open reservation settled and the free
+* balance still cannot cover it. `shortfalls` are the channels that did not fit at that moment.
+*/
+var ReservationWaitRefused = class extends Error {
+	reason = "budget-exhausted";
+	shortfalls;
+	constructor(shortfalls) {
+		super(`budget-exhausted: nothing left running could return enough budget for this worker (${shortfalls.map((shortfall) => `${shortfall.channel} requested ${shortfall.requested}, free ${shortfall.free}`).join("; ")})`);
+		this.name = "ReservationWaitRefused";
+		this.shortfalls = shortfalls;
+	}
+};
 /** Reject malformed ceilings before they can mint capacity through negative reservations. */
 function assertValidBudget(budget, label = "budget") {
 	const safeInteger = (value, field) => {
@@ -15877,71 +16127,143 @@ function createBudgetPool(root, runStartedAtMs, restore = {}) {
 	}
 	let nextTicketId = 0;
 	const open = /* @__PURE__ */ new Map();
-	function reserve(b, holder = { stage: "admitted" }) {
-		assertValidBudget(b, "reservation budget");
-		for (const [name, state] of resources) {
-			const wanted = b.resources?.[name];
-			if (!wanted) throw new ValidationError$1(`resource ${name}: child must declare its limit`);
-			if (wanted.unit !== state.unit) throw new ValidationError$1(`resource ${name}: unit mismatch`);
-		}
-		for (const name of Object.keys(b.resources ?? {})) if (!resources.has(name)) throw new ValidationError$1(`resource ${name}: root must declare its limit`);
+	/** Tickets admitted to wait for budget, in the order they asked. Each is also in `open`. */
+	const waiting = [];
+	/** Open tickets that hold nothing: waiting, or refused and not yet reconciled. */
+	const holdingNothing = /* @__PURE__ */ new Set();
+	/** Every channel `b` does not fit, measured against the free balance less `keep`. */
+	function shortfallsFor(b, keep) {
 		const wantTokens = b.maxTokens;
 		const wantUsd = b.maxUsd ?? 0;
 		const wantIterations = b.maxIterations;
 		const shortfalls = [];
-		const short = (channel, requested, free, closedByUnknownSpend = false) => {
+		const short = (channel, requested, free, held, closedByUnknownSpend = false) => {
 			shortfalls.push({
 				channel,
 				requested,
 				free: closedByUnknownSpend ? 0 : Math.max(0, free),
+				...closedByUnknownSpend || held <= 0 ? {} : { held },
 				...closedByUnknownSpend ? { closedByUnknownSpend: true } : {}
 			});
 		};
 		for (const [name, state] of resources) {
 			const limit = b.resources[name].limit;
-			if (!state.known) short(`resource:${name}`, limit, 0, true);
-			else if (limit > state.remaining) short(`resource:${name}`, limit, state.remaining);
-		}
-		if (usdCapped && usdTainted) short("usd", wantUsd, 0, true);
-		if (wantTokens > freeTokens) short("tokens", wantTokens, freeTokens);
-		if (wantIterations > freeIterations) short("iterations", wantIterations, freeIterations);
-		if (shortfalls.length === 0 && wantUsd > 0 && !usdCapped) return {
-			ok: false,
-			reason: "usd-unbudgeted"
-		};
-		if (usdCapped && !usdTainted && wantUsd > freeUsd) short("usd", wantUsd, freeUsd);
-		if (shortfalls.length > 0) return {
-			ok: false,
-			reason: "budget-exhausted",
-			shortfalls
-		};
+			if (!state.known) short(`resource:${name}`, limit, 0, 0, true);
+			else if (limit > state.remaining) short(`resource:${name}`, limit, state.remaining, state.reserved);
+		}
+		if (usdCapped && usdTainted) short("usd", wantUsd, 0, 0, true);
+		const tokensFree = freeTokens - (keep?.tokens ?? 0);
+		const iterationsFree = freeIterations - (keep?.iterations ?? 0);
+		if (wantTokens > tokensFree) short("tokens", wantTokens, tokensFree, reservedTokens);
+		if (wantIterations > iterationsFree) short("iterations", wantIterations, iterationsFree, reservedIterations);
+		const usdFree = freeUsd - (keep?.usd ?? 0);
+		if (usdCapped && !usdTainted && wantUsd > usdFree) short("usd", wantUsd, usdFree, reservedUsd);
+		return shortfalls;
+	}
+	/** Whether every short channel would fit once the open reservations return what they hold. */
+	function fitsAfterRefunds(shortfalls) {
+		return shortfalls.every((shortfall) => shortfall.closedByUnknownSpend !== true && shortfall.requested <= shortfall.free + (shortfall.held ?? 0));
+	}
+	/** Move `b` from free to reserved. The caller has checked that it fits. */
+	function take(b) {
 		for (const [name, state] of resources) {
 			const amount = b.resources[name].limit;
 			state.remaining -= amount;
 			state.reserved += amount;
 		}
-		freeTokens -= wantTokens;
-		reservedTokens += wantTokens;
-		freeIterations -= wantIterations;
-		reservedIterations += wantIterations;
+		freeTokens -= b.maxTokens;
+		reservedTokens += b.maxTokens;
+		freeIterations -= b.maxIterations;
+		reservedIterations += b.maxIterations;
+		const wantUsd = b.maxUsd ?? 0;
 		if (wantUsd > 0) {
 			freeUsd -= wantUsd;
 			reservedUsd += wantUsd;
 		}
+	}
+	function ticketFor(id, b) {
+		return {
+			id,
+			reserved: {
+				...b.resources === void 0 ? {} : { resources: Object.fromEntries(Object.entries(b.resources).map(([name, value]) => [name, { ...value }])) },
+				tokens: b.maxTokens,
+				usd: b.maxUsd ?? 0,
+				iterations: b.maxIterations,
+				usdBudgeted: b.maxUsd !== void 0
+			}
+		};
+	}
+	/** Grant waiting tickets in the order they asked while the head fits. When the head does not
+	*  fit and no reservation is held that could return budget, nothing can ever cover it: refuse
+	*  it, and go on with the next. */
+	function grantWaiting() {
+		while (waiting.length > 0) {
+			const head = waiting[0];
+			const shortfalls = shortfallsFor(head.budget, head.keep);
+			if (shortfalls.length === 0) {
+				waiting.shift();
+				take(head.budget);
+				holdingNothing.delete(head.ticket.id);
+				head.grant();
+				continue;
+			}
+			if (open.size > holdingNothing.size) return;
+			waiting.shift();
+			head.refuse(new ReservationWaitRefused(shortfalls));
+		}
+	}
+	function reserve(b, holder = { stage: "admitted" }, options = {}) {
+		assertValidBudget(b, "reservation budget");
+		for (const [name, state] of resources) {
+			const wanted = b.resources?.[name];
+			if (!wanted) throw new ValidationError$1(`resource ${name}: child must declare its limit`);
+			if (wanted.unit !== state.unit) throw new ValidationError$1(`resource ${name}: unit mismatch`);
+		}
+		for (const name of Object.keys(b.resources ?? {})) if (!resources.has(name)) throw new ValidationError$1(`resource ${name}: root must declare its limit`);
+		const wantUsd = b.maxUsd ?? 0;
+		const keep = options.keep;
+		const shortfalls = shortfallsFor(b, keep);
+		if (shortfalls.length === 0 && wantUsd > 0 && !usdCapped) return {
+			ok: false,
+			reason: "usd-unbudgeted"
+		};
+		const queueAhead = options.wait === true && waiting.length > 0;
+		if (shortfalls.length === 0 && !queueAhead) {
+			take(b);
+			const id = nextTicketId++;
+			open.set(id, holder);
+			return {
+				ok: true,
+				ticket: ticketFor(id, b)
+			};
+		}
+		if (options.wait !== true || !fitsAfterRefunds(shortfalls)) return {
+			ok: false,
+			reason: "budget-exhausted",
+			shortfalls
+		};
 		const id = nextTicketId++;
 		open.set(id, holder);
+		const ticket = ticketFor(id, b);
+		let grant;
+		let refuse;
+		const granted = new Promise((resolve, reject) => {
+			grant = resolve;
+			refuse = reject;
+		});
+		granted.catch(() => void 0);
+		holdingNothing.add(id);
+		waiting.push({
+			ticket,
+			budget: b,
+			keep,
+			grant,
+			refuse
+		});
 		return {
 			ok: true,
-			ticket: {
-				id,
-				reserved: {
-					...b.resources === void 0 ? {} : { resources: Object.fromEntries(Object.entries(b.resources).map(([name, value]) => [name, { ...value }])) },
-					tokens: wantTokens,
-					usd: wantUsd,
-					iterations: wantIterations,
-					usdBudgeted: b.maxUsd !== void 0
-				}
-			}
+			ticket,
+			granted
 		};
 	}
 	function attribute(ticket, holder) {
@@ -15956,7 +16278,18 @@ function createBudgetPool(root, runStartedAtMs, restore = {}) {
 		if (!open.has(ticket.id)) throw new Error(`budget pool: reconcile of unknown or already-settled ticket ${ticket.id}`);
 		assertValidSpend(spent, `budget pool ticket ${ticket.id} spend`);
 		validateResourceUnits(spent);
-		const { tokens: rTokens, usd: rUsd, iterations: rIterations } = ticket.reserved;
+		const heldNothing = holdingNothing.delete(ticket.id);
+		if (heldNothing) {
+			const index = waiting.findIndex((entry) => entry.ticket.id === ticket.id);
+			if (index >= 0) waiting.splice(index, 1);
+		}
+		const held = heldNothing ? {
+			tokens: 0,
+			usd: 0,
+			iterations: 0,
+			resources: void 0
+		} : ticket.reserved;
+		const { tokens: rTokens, usd: rUsd, iterations: rIterations } = held;
 		const unknownUnderCap = usdCapped && spent.usdKnown === false;
 		const spentTokens = chargedTokens(spent.tokens);
 		const usdBudgeted = ticket.reserved.usdBudgeted !== false;
@@ -15995,9 +16328,10 @@ function createBudgetPool(root, runStartedAtMs, restore = {}) {
 				freeUsd = 0;
 			} else freeUsd += rUsd - spent.usd;
 		} else committedUsd += spent.usd;
-		const resourceSettlement = commitResources(spent, ticket.reserved.resources ?? {});
+		const resourceSettlement = commitResources(spent, held.resources ?? {});
 		fault ??= resourceSettlement.fault;
 		overspent.push(...resourceSettlement.overspent);
+		grantWaiting();
 		const violation = overspent.length === 0 ? void 0 : Object.freeze({ overspent: Object.freeze(overspent.map((entry) => Object.freeze(entry))) });
 		if (fault !== void 0) throw new BudgetReconcileFault(`budget pool: ${fault}`, violation);
 		return violation;
@@ -17007,6 +17341,7 @@ async function replaySpawnTree(journal, blobs, root) {
 				...ev.harnessTranscript === void 0 ? {} : { harnessTranscript: ev.harnessTranscript },
 				...ev.retainedExecution === void 0 ? {} : { retainedExecution: ev.retainedExecution },
 				...ev.retainedPendingCause === void 0 ? {} : { retainedPendingCause: ev.retainedPendingCause },
+				...ev.subtree === void 0 ? {} : { subtree: ev.subtree },
 				...settlementTime(ev.at),
 				seq: ev.seq
 			});
@@ -17027,6 +17362,7 @@ async function replaySpawnTree(journal, blobs, root) {
 				...ev.harnessTranscript === void 0 ? {} : { harnessTranscript: ev.harnessTranscript },
 				...ev.retainedExecution === void 0 ? {} : { retainedExecution: ev.retainedExecution },
 				...ev.retainedPendingCause === void 0 ? {} : { retainedPendingCause: ev.retainedPendingCause },
+				...ev.subtree === void 0 ? {} : { subtree: ev.subtree },
 				...settlementTime(ev.at),
 				seq: ev.seq
 			});
@@ -17048,6 +17384,7 @@ async function replaySpawnTree(journal, blobs, root) {
 			...budgetViolationOf(ev),
 			trace,
 			...ev.harnessTranscript === void 0 ? {} : { harnessTranscript: ev.harnessTranscript },
+			...ev.subtree === void 0 ? {} : { subtree: ev.subtree },
 			...settlementTime(ev.at),
 			seq: ev.seq
 		});
@@ -19289,7 +19626,8 @@ function snapshotExecutorConfig(config) {
 			});
 		}
 		case "provider": {
-			const { provider, registry, profileForCreate, taskToTurn, validator, workspaceRetention, ...decisionData } = config;
+			const { provider, registry, profileForCreate, taskToTurn, validator, workspaceRetention, shared, ...decisionData } = config;
+			if (shared !== void 0 && (decisionData.steering !== void 0 || decisionData.placements !== void 0 || workspaceRetention !== void 0)) throw new ValidationError$1("createExecutor(provider): shared placement cannot combine with steering, placements, or workspaceRetention");
 			const snapshot = detachedSnapshot(decisionData, "createExecutor provider config");
 			const resolvedProvider = resolveAgentEnvironmentProvider(provider, registry);
 			return Object.freeze({
@@ -19298,7 +19636,8 @@ function snapshotExecutorConfig(config) {
 				...profileForCreate === void 0 ? {} : { profileForCreate },
 				...taskToTurn === void 0 ? {} : { taskToTurn },
 				...validator === void 0 ? {} : { validator },
-				...workspaceRetention === void 0 ? {} : { workspaceRetention }
+				...workspaceRetention === void 0 ? {} : { workspaceRetention },
+				...shared === void 0 ? {} : { shared }
 			});
 		}
 		case "sandbox": {
@@ -19490,13 +19829,22 @@ function createExecutor(config) {
 					return wrapper;
 				}
 				const profileForCreate = providerSeam.profileForCreate;
+				const exactProfileForCreate = (profile) => {
+					const prepared = executableAgentProfileSnapshot(profileForCreate?.(profile) ?? profile, "createExecutor(provider)");
+					if (canonicalAgentProfileDigest(prepared) !== canonicalAgentProfileDigest(profile)) throw new ValidationError$1("createExecutor(provider): profileForCreate changed the exact AgentProfile; execution overlays are not allowed");
+					return prepared;
+				};
+				const shared = providerSeam.shared;
+				if (shared !== void 0 && shared.refusal(spec.profile) === void 0) {
+					const { provider: _provider, registry: _registry, shared: _shared, defaults: _defaults, ...turnOptions } = providerSeam;
+					return placedProviderExecutor(shared.providerFor(seamed.node === void 0 ? {} : { nodeId: seamed.node.nodeId }), {
+						...turnOptions,
+						profileForCreate: exactProfileForCreate
+					}, shared.identity)(spec, seamed);
+				}
 				return providerAsExecutor(provider, {
 					...providerSeam,
-					profileForCreate: (profile) => {
-						const prepared = executableAgentProfileSnapshot(profileForCreate?.(profile) ?? profile, "createExecutor(provider)");
-						if (canonicalAgentProfileDigest(prepared) !== canonicalAgentProfileDigest(profile)) throw new ValidationError$1("createExecutor(provider): profileForCreate changed the exact AgentProfile; execution overlays are not allowed");
-						return prepared;
-					}
+					profileForCreate: exactProfileForCreate
 				})(spec, seamed);
 			}
 			case "sandbox": {
@@ -19710,28 +20058,12 @@ function singleShotDriver(maxIterations) {
 * recorded and STOPS further admission — the loop then drains what is already live and returns.
 * It never retries a rejected spawn against the same pool, and it never spawns past `width`.
 *
-* ── The concurrency-cap ledger (read this before adding a fourth cap) ──────────────────────────
-*
-* Three unrelated caps bound "how much runs at once" in this stack, at three different layers.
-* They are NOT aware of each other, and the smallest one silently wins:
-*
-*   1. `SuperviseOptions.maxLiveWorkers` (`src/runtime/supervise/supervise.ts`) — supervised-tree
-*      level. One shared Scope counter bounds every spawned manager and leaf in the recursive tree;
-*      `spawn_worker` fails closed with `error: 'max-live-workers'` past it. Unset ⇒ NO tree cap.
-*      `CoordinationToolsOptions.maxLiveWorkers` remains the local form for a toolbox mounted on a
-*      caller-owned Scope that has no tree limit.
-*   2. `SandboxLineage`'s `maxConcurrency` / `DEFAULT_FORK_CONCURRENCY = 4`
-*      (`src/runtime/sandbox-lineage.ts`) — kernel level. How many BOXES one `runAgentRounds` fork wave
-*      provisions at once. It bounds a single leaf's fanout, not the supervisor's worker count.
-*   3. A host's own live-box governor (e.g. the kernel's `ComputeGovernor`, `maxSandboxes = 4`) — fleet
-*      level. How many sandboxes may exist across the whole host process.
-*
-* The honest effective limit on simultaneous WORKERS is the minimum of the caps that apply to the
-* worker layer — (1) and (3). (2) is a different unit (boxes per fork wave inside one leaf) and
-* must not be min'd into it, or a 4-way fork inside one worker reads as a 4-worker ceiling.
-* `effectiveConcurrency` computes that minimum in one place so a host derives ONE number and
-* passes it to BOTH `maxLiveWorkers` and this dispatcher's `width`, instead of leaving a fleet
-* governor of 4 and an unset worker fence as unrelated numbers.
+* ── Concurrency ────────────────────────────────────────────────────────────────────────────────
+*
+* `width` bounds the children THIS dispatcher holds in flight. The tree-wide bound on working
+* agents is `SuperviseOptions.workerSlots` (`./worker-slots`): a spawn past it is queued by the
+* scope, not refused, so a `width` above the free slots only lengthens the allocator's queue.
+* `SandboxLineage`'s fork concurrency bounds boxes inside ONE leaf's fork wave, a different unit.
 *
 * ── Why this is not a copy of the kernel's batch loop ──────────────────────────────────────────
 *
@@ -19820,23 +20152,6 @@ function freeSlots(liveCount, cap) {
 	if (cap === void 0 || cap <= 0) return null;
 	return Math.max(0, cap - liveCount);
 }
-/**
-* The ONE honest effective limit on simultaneous workers: the minimum of the caps that actually
-* bound the worker layer. Ignores unset/non-positive caps; returns `undefined` when no cap applies
-* (uncapped — the conserved pool remains the only fence).
-*
-* Deliberately does NOT fold in `SandboxLineage`'s fork concurrency: that bounds boxes inside ONE
-* leaf's fork wave, a different unit. Folding it in would report a 4-worker ceiling for what is
-* really a 4-box fanout inside a single worker.
-*
-* Use it once, at the top of a run, and pass the result to BOTH `maxLiveWorkers` and a
-* dispatcher's `width` — that is what turns three unrelated numbers into one.
-*/
-function effectiveConcurrency(caps) {
-	const applicable = [caps.maxLiveWorkers, caps.maxSandboxes].filter((c) => typeof c === "number" && c > 0);
-	if (applicable.length === 0) return void 0;
-	return Math.min(...applicable);
-}
 /** Convenience: a `DispatchUnit` factory over a fixed array of tasks, for the common case where
 *  the queue is known up front and only the refill behavior is wanted. */
 function queueOf(units, budget) {
@@ -19856,67 +20171,6 @@ function queueOf(units, budget) {
 	};
 }
 //#endregion
-//#region src/runtime/supervise/error-message.ts
-const maxCauseDepth = 4;
-const maxMessageLength = 32768;
-const maxPartLength = 2048;
-/** A persisted failure must explain its wrappers without exporting credentials or unbounded data. */
-function errorText(value) {
-	let text;
-	try {
-		text = typeof value === "string" ? value : JSON.stringify(value) ?? String(value);
-	} catch {
-		text = "[unprintable rejection]";
-	}
-	return String(defaultRedactor(text)).slice(0, maxMessageLength);
-}
-function errorProperty(error, field) {
-	try {
-		const value = error[field];
-		return value === void 0 ? void 0 : errorText(value).slice(0, field === "name" ? 256 : maxMessageLength);
-	} catch {
-		return `[unreadable error ${field}]`;
-	}
-}
-/** An HTTP status carried on a thrown error, read without trusting its getter. Provider SDKs put
-*  one on their own error classes, so this is how a refusal is recognised outside the transport
-*  taxonomy — for the persisted message here, and for the driver's retry verdict. */
-function errorHttpStatus(error) {
-	try {
-		const status = Reflect.get(error, "status");
-		return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599 ? status : void 0;
-	} catch {
-		return;
-	}
-}
-/** Shared by child settlements, driver attempts, and the final no-winner result. */
-function errMessage(error) {
-	const parts = [];
-	const seen = /* @__PURE__ */ new Set();
-	let current = error;
-	for (let depth = 0; depth <= maxCauseDepth; depth += 1) try {
-		if (!(current instanceof Error)) {
-			parts.push(errorText(current).slice(0, maxPartLength));
-			break;
-		}
-		if (seen.has(current)) {
-			parts.push("[circular]");
-			break;
-		}
-		seen.add(current);
-		const status = errorHttpStatus(current);
-		const message = (status === void 0 ? "" : `HTTP ${status}: `) + (errorProperty(current, "message") ?? "");
-		parts.push((depth === 0 ? message : `${errorProperty(current, "name")}: ${message}`).slice(0, maxPartLength));
-		current = current.cause;
-		if (current === void 0 || current === null) break;
-		if (depth === maxCauseDepth) parts.push("[cause chain truncated]");
-	} catch {
-		parts.push("[unreadable error cause]");
-		break;
-	}
-	return parts.join(": caused by ").slice(0, maxMessageLength);
-}
-//#endregion
 //#region src/runtime/retained-interactive-handle.ts
 function createRetainedInteractiveRunHandle(environment, inputRef, capabilities, requestedStart) {
 	const ref = freezeInteractiveRef(inputRef);
@@ -20727,7 +20981,8 @@ function settlementFields(subject, settlement) {
 		...settlement.providerModel ? { providerModel: settlement.providerModel } : {},
 		...subject.budgetViolation ? { budgetViolation: subject.budgetViolation } : {},
 		trace: settlement.trace,
-		...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {}
+		...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {},
+		...subject.subtree === void 0 ? {} : { subtree: subject.subtree }
 	};
 }
 /** `cancelled` keeps its `source` from the subject's own cancellation reason, so a released
@@ -20899,7 +21154,10 @@ async function prepareInterruptedExecutors(opts, events, signal, now, parentId =
 	for (const node of interrupted) {
 		signal.throwIfAborted();
 		const owned = events.filter((event) => event.id === node.id);
-		const recorded = owned.find((event) => event.kind === "execution-result");
+		const inputs = owned.filter((event) => event.kind === "execution-input");
+		const latestInput = inputs.at(-1);
+		const current = latestInput === void 0 || inputs.length === 1 ? owned : owned.slice(owned.indexOf(latestInput));
+		const recorded = current.find((event) => event.kind === "execution-result");
 		if (recorded) {
 			await assertRecordedResult(node, recorded, owned, opts);
 			if (!rootBudget) throw new RuntimeRunStateError("retained results have no original root budget");
@@ -20921,10 +21179,9 @@ async function prepareInterruptedExecutors(opts, events, signal, now, parentId =
 			});
 			continue;
 		}
-		const admissions = owned.flatMap((event) => event.kind === "execution-admitted" ? [event.admission] : []);
+		const admissions = current.flatMap((event) => event.kind === "execution-admitted" ? [event.admission] : []);
 		if (!opts.recoverExecutor || admissions.length === 0 && !node.ownedTreeRoot) continue;
-		const input = owned.find((event) => event.kind === "execution-input");
-		const taskRef = input?.kind === "execution-input" ? input.taskRef : void 0;
+		const taskRef = inputs[0]?.taskRef;
 		if (!node.profileRef || !taskRef || !node.identity?.profileDigest || !node.identity.taskDigest) throw new RuntimeRunStateError(`cannot recover '${node.id}' without exact profile and task bytes`);
 		const profile = agentProfileSchema.parse(await opts.blobs.get(node.profileRef));
 		const task = await opts.blobs.get(taskRef);
@@ -20943,12 +21200,14 @@ async function prepareInterruptedExecutors(opts, events, signal, now, parentId =
 			if (!prepared) continue;
 		}
 		const priorMaterialization = owned.find((event) => event.kind === "materialized")?.receipt;
+		const continuation = latestInput !== void 0 && inputs.length > 1 && node.ownedTreeRoot === void 0 ? await leafContinuation(node, owned, latestInput, opts) : void 0;
 		recoveries.push({
 			...detachedSnapshot({
 				spawned: node,
 				task,
 				admissions,
-				...priorMaterialization === void 0 ? {} : { priorMaterialization }
+				...priorMaterialization === void 0 ? {} : { priorMaterialization },
+				...continuation === void 0 ? {} : { continuation }
 			}, "retained child recovery"),
 			spec: prepared?.spec ?? {
 				profile,
@@ -20984,6 +21243,23 @@ async function prepareInterruptedExecutors(opts, events, signal, now, parentId =
 		recoveries
 	};
 }
+/**
+* The later invocation a leaf was running when its process stopped: its own task, and the
+* environment admission of the invocation before it, which it continued in. The execution id is
+* derived from the input sequence exactly as the live scope derived it.
+*/
+async function leafContinuation(node, owned, latestInput, opts) {
+	const priorSession = [...owned.slice(0, owned.indexOf(latestInput))].reverse().flatMap((event) => event.kind === "execution-admitted" && event.admission.phase === "environment" ? [event.admission] : [])[0];
+	if (priorSession === void 0) throw new RuntimeRunStateError(`cannot recover '${node.id}': its continuation names no environment it continued in`);
+	const task = await opts.blobs.get(latestInput.taskRef);
+	if (task === void 0 || contentAddress(task) !== latestInput.taskRef) throw new RuntimeRunStateError(`continuation task for '${node.id}' is missing or corrupt`);
+	return {
+		task,
+		inputSeq: latestInput.seq,
+		executionId: leafContinuationExecutionId(node.id, latestInput.seq),
+		priorSession
+	};
+}
 async function assertRecordedResult(node, result, events, opts) {
 	const before = events.slice(0, events.indexOf(result));
 	const receipt = before.find((event) => event.kind === "materialized")?.receipt;
@@ -22088,6 +22364,230 @@ function defaultSleep$1(ms, signal) {
 	return sleep(ms, signal);
 }
 //#endregion
+//#region src/runtime/supervise/worker-slots.ts
+/**
+* Worker slots: the one bound on how many spawned agents work at the same time.
+*
+* Every scope of a supervised tree draws from one allocator. A host that runs several trees in one
+* process can pass the same allocator to each of them, and the bound then holds across all of them.
+*
+* A spawn past the bound is never refused. It keeps its reserved budget slice and waits in a queue,
+* and it starts when a slot frees. The queue releases the deepest spawn first and then the oldest,
+* so a subtree that is already paid for finishes before the tree grows wider.
+*
+* A slot counts a working agent: a spawned agent that runs with no running child of its own. A
+* manager whose children are all running is waiting on them, so its first running child takes over
+* the manager's slot and the manager takes it back when its last running child ends. This makes
+* nested waits deadlock-free: a manager can always run one child on its own slot, so a queued subtree
+* always keeps a path to completion, whatever the bound and however deep the tree.
+*
+* The bound therefore limits working agents, not environments. The environments alive at one time
+* can exceed it by the number of managers that have a running child. The conserved budget pool and
+* the deadline bound the total work; this allocator only bounds how much of it runs at once.
+*
+* @experimental
+*/
+const allocatorStates = /* @__PURE__ */ new WeakMap();
+/**
+* Create a worker-slot allocator. `max` omitted, `0`, or negative leaves concurrency bounded by the
+* budget alone, and every spawn starts at once. Pass the returned allocator as `workerSlots` to each
+* run that should share one bound.
+*/
+function createWorkerSlots(max) {
+	const bound = normalizeWorkerSlotBound(max);
+	const state = {
+		max: bound,
+		working: 0,
+		order: 0,
+		waiters: []
+	};
+	const slots = Object.freeze({
+		max: bound,
+		get working() {
+			return state.working;
+		},
+		get queued() {
+			return state.waiters.length;
+		}
+	});
+	allocatorStates.set(slots, state);
+	return slots;
+}
+/** Accept a bound or an allocator; a number creates an allocator for one tree. */
+function resolveWorkerSlots(value) {
+	if (value === void 0 || typeof value === "number") return createWorkerSlots(value);
+	if (!allocatorStates.has(value)) throw new ValidationError$1("workerSlots must be a number or an allocator from createWorkerSlots");
+	return value;
+}
+/** @internal Open the group of one scope's children. */
+function openSlotGroup(slots, owner) {
+	const state = allocatorStates.get(slots);
+	if (state === void 0) throw new ValidationError$1("openSlotGroup: allocator was not created by createWorkerSlots");
+	const issued = owner === void 0 ? void 0 : deferredPermits.get(owner)?.() ?? owner;
+	const ownerState = issued === void 0 ? void 0 : permitStates.get(issued);
+	if (owner !== void 0 && ownerState === void 0) throw new ValidationError$1("openSlotGroup: owner permit was not issued by this allocator");
+	const group = {
+		owner: ownerState,
+		running: 0,
+		queued: 0
+	};
+	if (ownerState !== void 0) {
+		if (ownerState.children !== void 0) throw new ValidationError$1("openSlotGroup: a permit owns at most one group of children");
+		ownerState.children = group;
+	}
+	return {
+		acquire: (depth, options) => acquire(state, group, depth, options?.force === true),
+		get running() {
+			return group.running;
+		},
+		get queued() {
+			return group.queued;
+		}
+	};
+}
+const permitStates = /* @__PURE__ */ new WeakMap();
+/** Each deferred permit's reader of the permit it acquired, once it has acquired one. */
+const deferredPermits = /* @__PURE__ */ new WeakMap();
+/**
+* @internal A slot requested only once `after` resolves. A spawn that waits for budget takes no
+* slot while it waits, so it cannot hold a slot that the work it waits on needs. `ready` rejects
+* when `after` does; `release` before then withdraws the request.
+*/
+function deferSlot(after, acquire) {
+	let inner;
+	let released = false;
+	const ready = after.then(() => {
+		if (released) return;
+		inner = acquire();
+		return inner.ready;
+	});
+	ready.catch(() => void 0);
+	const handle = {
+		ready,
+		get granted() {
+			return inner?.granted ?? false;
+		},
+		release() {
+			if (released) return;
+			released = true;
+			inner?.release();
+		}
+	};
+	deferredPermits.set(handle, () => inner);
+	return handle;
+}
+function acquire(state, group, depth, force) {
+	if (!Number.isSafeInteger(depth) || depth < 0) throw new ValidationError$1(`worker slots: depth must be a non-negative integer, got ${depth}`);
+	const permit = {
+		group,
+		granted: false,
+		released: false,
+		counted: false
+	};
+	let resolveReady;
+	const ready = new Promise((resolve) => {
+		resolveReady = resolve;
+	});
+	const grant = () => {
+		grantPermit(state, permit);
+		resolveReady();
+	};
+	if (force || costOf(group) === 0 || hasCapacity(state)) grant();
+	else {
+		group.queued += 1;
+		const waiter = {
+			permit,
+			depth,
+			order: state.order++,
+			grant
+		};
+		state.waiters.push(waiter);
+	}
+	const handle = {
+		ready,
+		get granted() {
+			return permit.granted;
+		},
+		release() {
+			if (permit.released) return;
+			permit.released = true;
+			if (!permit.granted) {
+				withdraw(state, permit);
+				return;
+			}
+			releasePermit(state, permit);
+			pump(state);
+		}
+	};
+	permitStates.set(handle, permit);
+	return handle;
+}
+/** A child of `group` adds a working unit unless its manager is working on its own slot now, in
+*  which case the child takes that slot over. */
+function costOf(group) {
+	const owner = group.owner;
+	return owner?.granted && !owner.released && owner.counted ? 0 : 1;
+}
+function hasCapacity(state) {
+	return state.max === void 0 || state.working < state.max;
+}
+function grantPermit(state, permit) {
+	const group = permit.group;
+	if (costOf(group) === 0) group.owner.counted = false;
+	else state.working += 1;
+	permit.granted = true;
+	permit.counted = true;
+	group.running += 1;
+}
+function releasePermit(state, permit) {
+	if ((permit.children?.running ?? 0) > 0) return;
+	const group = permit.group;
+	group.running -= 1;
+	if (group.running < 0) throw new ValidationError$1("worker slots: a group released more than it ran");
+	if (!permit.counted) return;
+	permit.counted = false;
+	const owner = group.owner;
+	if (group.running === 0 && owner !== void 0 && owner.granted) {
+		owner.counted = true;
+		if (owner.released) releasePermit(state, owner);
+		return;
+	}
+	state.working -= 1;
+	if (state.working < 0) throw new ValidationError$1("worker slots: released more than granted");
+}
+function withdraw(state, permit) {
+	const index = state.waiters.findIndex((waiter) => waiter.permit === permit);
+	if (index === -1) return;
+	state.waiters.splice(index, 1);
+	permit.group.queued -= 1;
+}
+/** Grant every waiter that can run: any waiter whose manager is working on its own slot, and then
+*  the deepest and oldest waiters while capacity remains. */
+function pump(state) {
+	for (;;) {
+		let chosen;
+		for (let index = 0; index < state.waiters.length; index++) {
+			const waiter = state.waiters[index];
+			if (costOf(waiter.permit.group) === 0) {
+				chosen = index;
+				break;
+			}
+			if (!hasCapacity(state)) continue;
+			const best = chosen === void 0 ? void 0 : state.waiters[chosen];
+			if (best === void 0 || waiter.depth > best.depth || waiter.depth === best.depth && waiter.order < best.order) chosen = index;
+		}
+		if (chosen === void 0) return;
+		const [waiter] = state.waiters.splice(chosen, 1);
+		waiter.permit.group.queued -= 1;
+		waiter.grant();
+	}
+}
+function normalizeWorkerSlotBound(value) {
+	if (value === void 0 || value <= 0) return void 0;
+	if (!Number.isSafeInteger(value)) throw new ValidationError$1(`workerSlots must be a positive safe integer, or 0 or less for no bound, got ${String(value)}`);
+	return value;
+}
+//#endregion
 //#region src/runtime/supervise/scope.ts
 /**
 *
@@ -22130,6 +22630,17 @@ const nestedTeardownScopes = /* @__PURE__ */ new WeakMap();
 *  kept for a resume any longer. */
 const releasingScopes = /* @__PURE__ */ new WeakSet();
 const admissionSeals = /* @__PURE__ */ new WeakMap();
+/** Each scope's reader of its own team, for the settlement its owner writes one level up. */
+const subtreeReaders = /* @__PURE__ */ new WeakMap();
+/** Each scope's reader of its live team, for the progress its owner's lead reads mid-flight. */
+const liveTeamReaders = /* @__PURE__ */ new WeakMap();
+/** How many of a manager's direct children its summary lists; the counts always cover all. */
+const SUBTREE_RESULT_LIMIT = 8;
+/** @internal The bounded account of the children a scope spawned and everything below them.
+*  `undefined` when the scope spawned no worker. */
+function subtreeSummaryOf(scope) {
+	return subtreeReaders.get(scope)?.();
+}
 /** Per-child bound on a retained release: one remote destroy, answered or abandoned. */
 const RETAINED_RELEASE_TIMEOUT_MS = 3e4;
 /**
@@ -22257,13 +22768,11 @@ function hasRetriableTeardowns(scope, release) {
 function closeScopeAdmission(scope) {
 	admissionSeals.get(scope)?.();
 }
-/** Fail before execution when an opted-in run cannot leave a live slot at every depth. */
-function assertRecursiveReservationPolicy(policy, maxDepth, maxLiveWorkers) {
+/** Fail before execution when a reservation policy is malformed. */
+function assertRecursiveReservationPolicy(policy) {
 	if (policy === void 0) return;
 	if (typeof policy !== "object" || policy === null || Object.keys(policy).some((key) => key !== "ownerShare")) throw new ValidationError$1("reservationPolicy accepts only ownerShare");
 	if (!Number.isFinite(policy.ownerShare) || policy.ownerShare <= 0 || policy.ownerShare >= 1) throw new ValidationError$1("reservationPolicy.ownerShare must be greater than 0 and less than 1");
-	if (!Number.isSafeInteger(maxDepth) || maxDepth === void 0 || maxDepth < 2) throw new ValidationError$1("reservationPolicy requires maxDepth >= 2");
-	if (!Number.isSafeInteger(maxLiveWorkers) || maxLiveWorkers === void 0 || maxLiveWorkers < maxDepth) throw new ValidationError$1("reservationPolicy requires maxLiveWorkers >= maxDepth to preserve a descendant path");
 }
 /**
 * The recursion seam key. A `Scope` seeds a value of this on each child's
@@ -22272,7 +22781,7 @@ function assertRecursiveReservationPolicy(policy, maxDepth, maxLiveWorkers) {
 * here so the scope and the driver-executor agree on the seam without a circular import.
 */
 const nestedScopeSeamKey = "nested-scope";
-function makeNestedScopeSeam(args, liveWorkerCapacity, childNodeId, childBudget, childDeadlineAtMs, deferredOwner) {
+function makeNestedScopeSeam(args, workerSlots, childSlot, childNodeId, childBudget, childDeadlineAtMs, deferredOwner) {
 	const now = args.now ?? Date.now;
 	const mountScope = (nestedRoot, signal, restored) => {
 		const mountedAtMs = now();
@@ -22291,7 +22800,8 @@ function makeNestedScopeSeam(args, liveWorkerCapacity, childNodeId, childBudget,
 			seams: args.seams,
 			depth: args.depth + 1,
 			...args.maxDepth !== void 0 ? { maxDepth: args.maxDepth } : {},
-			liveWorkerCapacity,
+			workerSlots,
+			slotOwner: childSlot,
 			...args.reservationPolicy ? {
 				reservationPolicy: args.reservationPolicy,
 				ownerBudget: nestedBudget
@@ -22330,12 +22840,10 @@ function createScope(args) {
 	const settlementWrites = /* @__PURE__ */ new Set();
 	let admissionClosed = false;
 	const interactiveBindingDir = args.interactiveBindingDir;
-	const liveWorkerCapacity = args.liveWorkerCapacity ?? {
-		max: normalizeLiveWorkerLimit(args.maxLiveWorkers),
-		live: 0
-	};
+	const workerSlots = args.workerSlots ?? createWorkerSlots();
+	const slotGroup = openSlotGroup(workerSlots, args.slotOwner);
 	const reservationPolicy = args.reservationPolicy;
-	assertRecursiveReservationPolicy(reservationPolicy, args.maxDepth, liveWorkerCapacity.max);
+	assertRecursiveReservationPolicy(reservationPolicy);
 	if (reservationPolicy && !args.ownerBudget) throw new ValidationError$1("reservationPolicy requires the owning scope budget");
 	const ownerBudget = args.ownerBudget;
 	const ownerFloor = reservationPolicy && ownerBudget ? {
@@ -22343,11 +22851,12 @@ function createScope(args) {
 		iterations: Math.ceil(ownerBudget.maxIterations * reservationPolicy.ownerShare),
 		...ownerBudget.maxUsd === void 0 ? {} : { usd: ownerBudget.maxUsd * reservationPolicy.ownerShare }
 	} : void 0;
-	const admissionMax = reservationPolicy && liveWorkerCapacity.max !== void 0 && args.maxDepth !== void 0 ? liveWorkerCapacity.max - Math.max(0, args.maxDepth - (args.depth + 1)) : liveWorkerCapacity.max;
 	let spawnOrdinal = args.resumeFrom ? args.resumeFrom.maxSpawnOrdinal + 1 : 0;
 	let cursorSeq = args.resumeFrom ? args.resumeFrom.maxCursorSeq + 1 : 0;
 	let waitOrdinal = args.resumeFrom ? args.resumeFrom.maxWaitOrdinal + 1 : 0;
 	let meterSeq = 0;
+	let ownerTurns = 0;
+	let ownerLastTurnAt = 0;
 	let progressSeq = 0;
 	const now = args.now ?? Date.now;
 	const unclaimedWaits = new Map((args.resumeFrom?.waits ?? []).map((w) => [w.label, w]));
@@ -22464,54 +22973,21 @@ function createScope(args) {
 			reason: "depth-exceeded"
 		};
 		if (typeof agentOrFactory !== "function") prepared ??= prepare();
-		if (!recovery && admissionMax !== void 0 && liveWorkerCapacity.live >= admissionMax) return {
-			ok: false,
-			reason: "max-live-workers"
-		};
-		if (!recovery && ownerFloor) {
-			const available = args.pool.readout();
-			const shortfalls = [];
-			const short = (channel, requested, free) => {
-				if (requested > free) shortfalls.push({
-					channel,
-					requested,
-					free: Math.max(0, free)
-				});
-			};
-			short("tokens", opts.budget.maxTokens, available.tokensLeft - ownerFloor.tokens);
-			short("iterations", opts.budget.maxIterations, available.iterationsLeft - ownerFloor.iterations);
-			if (ownerFloor.usd !== void 0) short("usd", opts.budget.maxUsd ?? 0, available.usdLeft - ownerFloor.usd);
-			if (shortfalls.length > 0) return {
-				ok: false,
-				reason: "budget-exhausted",
-				shortfalls
-			};
-		}
-		const permit = acquireLiveWorker(liveWorkerCapacity);
-		if (!permit.ok) return {
-			ok: false,
-			reason: "max-live-workers"
-		};
 		const assignment = opts.assignmentId ?? opts.key;
 		let reservation;
-		try {
-			reservation = args.pool.reserve(opts.budget, {
-				...assignment === void 0 ? {} : { assignment },
-				label: opts.label,
-				stage: "admitted"
-			});
-		} catch (error) {
-			permit.release();
-			throw error;
-		}
-		if (!reservation.ok) {
-			permit.release();
-			return {
-				ok: false,
-				reason: reservation.reason,
-				...reservation.shortfalls === void 0 ? {} : { shortfalls: reservation.shortfalls }
-			};
-		}
+		reservation = args.pool.reserve(opts.budget, {
+			...assignment === void 0 ? {} : { assignment },
+			label: opts.label,
+			stage: "admitted"
+		}, recovery ? {} : {
+			wait: true,
+			...ownerFloor ? { keep: ownerFloor } : {}
+		});
+		if (!reservation.ok) return {
+			ok: false,
+			reason: reservation.reason,
+			...reservation.shortfalls === void 0 ? {} : { shortfalls: reservation.shortfalls }
+		};
 		let spec;
 		let resolved;
 		let identity;
@@ -22521,7 +22997,6 @@ function createScope(args) {
 			identity = prepared.identity;
 			if (opts.key !== void 0 && !isCompleteIdentity(identity)) {
 				args.pool.reconcile(reservation.ticket, withBudgetResources(zeroSpend(), opts.budget, true));
-				permit.release();
 				return {
 					ok: false,
 					reason: "invalid-identity"
@@ -22535,9 +23010,10 @@ function createScope(args) {
 			resolved = outcome;
 		} catch (error) {
 			args.pool.reconcile(reservation.ticket, withBudgetResources(zeroSpend(), opts.budget, true));
-			permit.release();
 			throw error;
 		}
+		const budgetGranted = reservation.granted;
+		const permit = budgetGranted === void 0 ? slotGroup.acquire(args.depth + 1, { force: recovery !== void 0 }) : deferSlot(budgetGranted, () => slotGroup.acquire(args.depth + 1));
 		let cascadeAbort;
 		let clearChildDeadline;
 		try {
@@ -22562,7 +23038,6 @@ function createScope(args) {
 			const recoveryReady = recovery?.spawned.ownedTreeRoot === void 0 ? void 0 : new Promise((resolve) => {
 				markRecoveryReady = resolve;
 			});
-			const admissions = [...recovery?.admissions ?? []];
 			const retainedWrites = /* @__PURE__ */ new Set();
 			let retainedWritesClosed = false;
 			const retainedWrite = (write) => {
@@ -22577,6 +23052,99 @@ function createScope(args) {
 				retainedWritesClosed = true;
 				await Promise.allSettled([...retainedWrites]);
 			};
+			let admissions = [...recovery?.admissions ?? []];
+			let inputSeq = recovery?.continuation?.inputSeq ?? ordinal;
+			let pauseSeq = 0;
+			const onAdmission = (admission) => retainedWrite(async () => {
+				controller.signal.throwIfAborted();
+				const existing = admissions.find((record) => record.phase === admission.phase);
+				if (existing) {
+					if (contentAddress(existing) !== contentAddress(admission)) throw new ValidationError$1("scope retained admission conflicts with its committed phase");
+					return;
+				}
+				if (identity?.taskDigest === void 0) throw new ValidationError$1("retained execution requires a canonical task identity");
+				await args.journal.appendEvent(args.root, {
+					kind: "execution-admitted",
+					id,
+					admission: detachedSnapshot(admission, "retained admission"),
+					seq: ordinal,
+					at: new Date(now()).toISOString()
+				});
+				admissions.push(detachedSnapshot(admission, "retained admission"));
+				live.recoveryPending = true;
+				controller.signal.throwIfAborted();
+			});
+			const onResult = (result) => retainedWrite(async () => {
+				controller.signal.throwIfAborted();
+				assertValidSpend(result.spent, "retained executor result");
+				executorFailureReason(result);
+				await pendingEvidence?.complete();
+				const outRef = contentAddress(result.out);
+				await args.blobs.put(outRef, result.out);
+				controller.signal.throwIfAborted();
+				await args.journal.appendEvent(args.root, {
+					kind: "execution-result",
+					id,
+					outRef,
+					spent: result.spent,
+					...result.verdict ? { verdict: result.verdict } : {},
+					...result.outcome ? { outcome: result.outcome } : {},
+					seq: ordinal,
+					at: new Date(now()).toISOString()
+				});
+				live.acceptedResult = detachedSnapshot({
+					...result,
+					outRef
+				}, "accepted retained child result");
+				live.recoveryPending = false;
+			});
+			const onPause = (pause) => retainedWrite(async () => {
+				await args.journal.appendEvent(args.root, {
+					kind: "paused",
+					id,
+					...pause,
+					seq: pauseSeq++,
+					at: new Date(now()).toISOString()
+				});
+			});
+			const retainedContext = (continuing) => ({
+				...continuing === void 0 ? {} : {
+					executionId: continuing.executionId,
+					priorSession: continuing.priorSession
+				},
+				admissions,
+				...markRecoveryReady && continuing === void 0 ? { onReady: markRecoveryReady } : {},
+				onAdmission,
+				onResult,
+				onPause,
+				continueInvocation: async (nextTask) => {
+					controller.signal.throwIfAborted();
+					if (live.acceptedResult === void 0) throw new ValidationError$1("scope: a retained child continues only after its invocation committed a result");
+					const environment = admissions.find((record) => record.phase === "environment");
+					if (environment?.phase !== "environment") throw new ValidationError$1("scope: a retained child continues only in an environment it was admitted to");
+					const snapshot = detachedSnapshot(nextTask, "retained child continuation");
+					const taskRef = contentAddress(snapshot);
+					const nextSeq = inputSeq + 1;
+					await retainedWrite(async () => {
+						await args.blobs.put(taskRef, snapshot);
+						controller.signal.throwIfAborted();
+						await args.journal.appendEvent(args.root, {
+							kind: "execution-input",
+							id,
+							taskRef,
+							seq: nextSeq,
+							at: new Date(now()).toISOString()
+						});
+					});
+					inputSeq = nextSeq;
+					admissions = [];
+					live.acceptedResult = void 0;
+					return retainedContext({
+						executionId: leafContinuationExecutionId(id, nextSeq),
+						priorSession: environment
+					});
+				}
+			});
 			const ctx = {
 				signal: controller.signal,
 				node: {
@@ -22589,54 +23157,11 @@ function createScope(args) {
 				},
 				seams: {
 					...args.seams,
-					[retainedExecutorSeamKey]: {
-						admissions,
-						...markRecoveryReady ? { onReady: markRecoveryReady } : {},
-						onAdmission: (admission) => retainedWrite(async () => {
-							controller.signal.throwIfAborted();
-							const existing = admissions.find((record) => record.phase === admission.phase);
-							if (existing) {
-								if (contentAddress(existing) !== contentAddress(admission)) throw new ValidationError$1("scope retained admission conflicts with its committed phase");
-								return;
-							}
-							if (identity?.taskDigest === void 0) throw new ValidationError$1("retained execution requires a canonical task identity");
-							await args.journal.appendEvent(args.root, {
-								kind: "execution-admitted",
-								id,
-								admission: detachedSnapshot(admission, "retained admission"),
-								seq: ordinal,
-								at: new Date(now()).toISOString()
-							});
-							admissions.push(detachedSnapshot(admission, "retained admission"));
-							live.recoveryPending = true;
-							controller.signal.throwIfAborted();
-						}),
-						onResult: (result) => retainedWrite(async () => {
-							controller.signal.throwIfAborted();
-							assertValidSpend(result.spent, "retained executor result");
-							executorFailureReason(result);
-							await pendingEvidence?.complete();
-							const outRef = contentAddress(result.out);
-							await args.blobs.put(outRef, result.out);
-							controller.signal.throwIfAborted();
-							await args.journal.appendEvent(args.root, {
-								kind: "execution-result",
-								id,
-								outRef,
-								spent: result.spent,
-								...result.verdict ? { verdict: result.verdict } : {},
-								...result.outcome ? { outcome: result.outcome } : {},
-								seq: ordinal,
-								at: new Date(now()).toISOString()
-							});
-							live.acceptedResult = detachedSnapshot({
-								...result,
-								outRef
-							}, "accepted retained child result");
-							live.recoveryPending = false;
-						})
-					},
-					[nestedScopeSeamKey]: makeNestedScopeSeam(args, liveWorkerCapacity, id, opts.budget, childDeadlineAtMs, deferredOwner),
+					[retainedExecutorSeamKey]: retainedContext(recovery?.continuation === void 0 ? void 0 : {
+						executionId: recovery.continuation.executionId,
+						priorSession: recovery.continuation.priorSession
+					}),
+					[nestedScopeSeamKey]: makeNestedScopeSeam(args, workerSlots, permit, id, opts.budget, childDeadlineAtMs, deferredOwner),
 					...workerTrace ? { [workerTraceSeamKey]: workerTrace } : {},
 					...interactiveBindingDir ? { [interactiveAdmissionSeamKey]: (admission) => Promise.resolve(writeWorkerInteractiveAdmission(interactiveBindingDir, id, admission, now)).then(() => void 0) } : {}
 				}
@@ -22668,7 +23193,7 @@ function createScope(args) {
 			});
 			const live = {
 				id,
-				status: "acquiring",
+				status: permit.granted ? "acquiring" : "queued",
 				runtime: executor.runtime,
 				...ownedTreeRoot === void 0 ? {} : { ownedTreeRoot },
 				...identity ? { identity } : {},
@@ -22877,10 +23402,10 @@ function createScope(args) {
 					startedAt
 				}
 			}, { signal: args.signal });
-			const childRun = runChild(live, executor, controller, task, opts, args.pool, reservation.ticket, args.blobs, now, args.journal, args.root, () => progressSeq++, materializationCommitted, {
+			const childRun = runChild(live, executor, controller, recovery?.continuation?.task ?? task, opts, args.pool, reservation.ticket, args.blobs, now, args.journal, args.root, () => progressSeq++, materializationCommitted, {
 				complete: async () => pendingEvidence?.complete(),
 				fail: async () => pendingEvidence?.fail()
-			}, childDeadlineAtMs, recovery !== void 0, closeRetainedWrites);
+			}, childDeadlineAtMs, recovery !== void 0, closeRetainedWrites, budgetGranted, permit.ready);
 			args.pool.attribute(reservation.ticket, { stage: "executing" });
 			const interactiveBindingCommitted = spawnCommitted.then(async () => {
 				if (args.interactiveBindingDir === void 0) return;
@@ -23138,14 +23663,16 @@ function createScope(args) {
 		} catch {
 			fromExecutor = void 0;
 		}
+		const team = liveTeamOf(child);
 		return readWorkerProgress({
 			id: child.id,
 			status: child.status,
 			steerable: child.deliver !== void 0 && !child.delivered,
 			startedAt: child.startedAt,
-			lastActivityAt: child.lastActivityAt,
+			lastActivityAt: Math.max(child.lastActivityAt, team?.lastActivityAt ?? 0),
 			...addResourceSpend(child.spent.resources),
-			turns: child.spent.iterations,
+			turns: Math.max(child.spent.iterations, team?.ownerTurns ?? 0),
+			...team && team.agents > 0 ? { team: teamProgress(team) } : {},
 			tokens: child.spent.tokens,
 			...child.spent.tokensKnown === false ? { tokensKnown: false } : {},
 			usd: child.spent.usd,
@@ -23192,6 +23719,8 @@ function createScope(args) {
 		} catch (error) {
 			observeError = error;
 		}
+		ownerLastTurnAt = now();
+		if (!accountingOnly) ownerTurns += 1;
 		await args.journal.appendEvent(args.root, {
 			kind: "metered",
 			id: args.parentId,
@@ -23243,8 +23772,9 @@ function createScope(args) {
 		},
 		get workerCapacity() {
 			return {
-				live: liveWorkerCapacity.live,
-				freeSlots: freeSlots(liveWorkerCapacity.live, admissionMax),
+				working: workerSlots.working,
+				queued: workerSlots.queued,
+				freeSlots: freeSlots(workerSlots.working, workerSlots.max),
 				unconfirmed: Object.freeze([...children.values()].filter((child) => isTerminalNodeStatus(child.status) && !child.cleanupConfirmed).map((child) => unconfirmedTeardownOf(child, releasingScopes.has(scope))))
 			};
 		}
@@ -23252,6 +23782,8 @@ function createScope(args) {
 	admissionSeals.set(scope, () => {
 		admissionClosed = true;
 	});
+	subtreeReaders.set(scope, () => summarizeTeam(children.values()));
+	liveTeamReaders.set(scope, () => readLiveTeam(children.values(), ownerTurns, ownerLastTurnAt));
 	runtimeOwnedProviderMeters.set(scope, async (spend, providerModel, detail, accountingOnly) => meterInternal(spend, detail, providerModel, accountingOnly));
 	let pauseSeq = 0;
 	pauseRecorders.set(scope, async (pause) => {
@@ -23740,6 +24272,9 @@ async function appendAcknowledged(journal, root, event) {
 async function finalizeSettlement(child, settlement, seq, args, now) {
 	const handle = frozenHandle(child);
 	if (child.wait) return finalizeWait(child, settlement, seq, args, now, handle);
+	const nestedScope = child.readNestedScope?.();
+	const subtree = nestedScope === void 0 ? void 0 : subtreeSummaryOf(nestedScope);
+	if (subtree !== void 0) child.subtree = subtree;
 	const settledAt = now();
 	child.settledAt = settledAt;
 	child.settledSeq = seq;
@@ -23782,6 +24317,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 				...settlement.infra === void 0 ? {} : { infra: settlement.infra },
 				...retainedExecution,
 				spent: child.spent,
+				...subtree === void 0 ? {} : { subtree },
 				...settledNodeEvidence(child, settlement, settledAt)
 			}
 		}, { signal: args.signal });
@@ -23796,6 +24332,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 			...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
 			trace: settlement.trace,
 			...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {},
+			...subtree === void 0 ? {} : { subtree },
 			settledAt,
 			seq
 		};
@@ -23816,6 +24353,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 		...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
 		trace: settlement.trace,
 		...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {},
+		...subtree === void 0 ? {} : { subtree },
 		seq,
 		at
 	});
@@ -23834,6 +24372,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 			score: settlement.verdict?.score,
 			valid: settlement.verdict?.valid,
 			spent: settlement.spent,
+			...subtree === void 0 ? {} : { subtree },
 			...settledNodeEvidence(child, settlement, settledAt)
 		}
 	}, { signal: args.signal });
@@ -23848,6 +24387,7 @@ async function finalizeSettlement(child, settlement, seq, args, now) {
 		...child.budgetViolation ? { budgetViolation: child.budgetViolation } : {},
 		trace: settlement.trace,
 		...settlement.harnessTranscript ? { harnessTranscript: settlement.harnessTranscript } : {},
+		...subtree === void 0 ? {} : { subtree },
 		settledAt,
 		seq
 	};
@@ -23925,7 +24465,7 @@ async function finalizeWait(child, settlement, seq, args, now, handle) {
 * applied per child). The reservation is reconciled on EVERY path (success, abort, throw)
 * so the conserved pool can never leak a reservation.
 */
-async function runChild(live, executor, childAbort, task, opts, pool, ticket, blobs, now, journal, journalRoot, nextProgressSeq, executionReady, executionEvidence, deadlineAtMs, recovering = false, closeRetainedWrites = async () => {}) {
+async function runChild(live, executor, childAbort, task, opts, pool, ticket, blobs, now, journal, journalRoot, nextProgressSeq, executionReady, executionEvidence, deadlineAtMs, recovering = false, closeRetainedWrites = async () => {}, budgetReady = void 0, slotReady = Promise.resolve()) {
 	let reconciled = false;
 	let reconciliationError;
 	let teardownFailure;
@@ -24010,6 +24550,8 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 	try {
 		await executionReady;
 		if (childAbort.signal.aborted) throw abortError(childAbort.signal, "execution aborted");
+		if (budgetReady !== void 0) await awaitAbortable(budgetReady, childAbort.signal);
+		await awaitAbortable(slotReady, childAbort.signal);
 		live.status = "running";
 		started = true;
 		const ran = recovering ? executor.recover(task, childAbort.signal) : executor.execute(task, childAbort.signal);
@@ -24186,25 +24728,114 @@ function settledToIteration(settled) {
 		tokenUsage: cloneTokenUsage(settled.spent.tokens)
 	};
 }
-function normalizeLiveWorkerLimit(value) {
-	if (value === void 0 || value <= 0) return void 0;
-	if (!Number.isSafeInteger(value)) throw new ValidationError$1(`createScope: maxLiveWorkers must be a positive safe integer or <= 0 for uncapped, got ${String(value)}`);
-	return value;
+/** Summarize one scope's children and everything below them, listing the best direct children
+*  and counting the rest. Wait-states are not agents and are left out. */
+/** The live team a child manager leads, read through the nested scope it owns. */
+function liveTeamOf(child) {
+	let nested;
+	try {
+		nested = child.readNestedScope?.();
+	} catch {
+		return;
+	}
+	return nested === void 0 ? void 0 : liveTeamReaders.get(nested)?.();
 }
-function acquireLiveWorker(capacity) {
-	if (capacity.max !== void 0 && capacity.live >= capacity.max) return { ok: false };
-	capacity.live += 1;
-	let released = false;
-	return {
-		ok: true,
-		release() {
-			if (released) return;
-			released = true;
-			capacity.live -= 1;
-			if (capacity.live < 0) throw new ValidationError$1("scope: live-worker capacity released more than once");
+function teamProgress(team) {
+	const { lastActivityAt: _lastActivityAt, ownerTurns: _ownerTurns, ...counts } = team;
+	return Object.freeze(counts);
+}
+/** Latest activity an executor names, or 0. A throwing read is no evidence of activity. */
+function executorActivityAt(child) {
+	try {
+		const recent = child.readProgress?.()?.recentActivity;
+		return recent?.length ? recent[recent.length - 1]?.at ?? 0 : 0;
+	} catch {
+		return 0;
+	}
+}
+/** Count a scope's team at every depth and find its newest activity. Live members are read through
+*  their own nested scopes; settled members contribute the summary their settlement carried. */
+function readLiveTeam(children, ownerTurns, ownerLastTurnAt) {
+	let agents = 0;
+	let depth = 0;
+	let working = 0;
+	let queued = 0;
+	let done = 0;
+	let down = 0;
+	let lastActivityAt = ownerLastTurnAt;
+	for (const child of children) {
+		if (child.wait) continue;
+		agents += 1;
+		lastActivityAt = Math.max(lastActivityAt, child.lastActivityAt, child.settledAt ?? 0, executorActivityAt(child));
+		if (child.status === "done") done += 1;
+		else if (child.status === "failed" || child.status === "cancelled") down += 1;
+		else if (child.status === "queued" || child.status === "pending") queued += 1;
+		else working += 1;
+		const below = isTerminalNodeStatus(child.status) ? child.subtree : liveTeamOf(child);
+		if (below === void 0 || below.agents === 0) continue;
+		agents += below.agents;
+		depth = Math.max(depth, below.depth);
+		done += below.done;
+		down += below.down;
+		if ("working" in below) {
+			working += below.working;
+			queued += below.queued;
+			lastActivityAt = Math.max(lastActivityAt, below.lastActivityAt);
 		}
+	}
+	return {
+		agents,
+		depth: agents === 0 ? 0 : depth + 1,
+		working,
+		queued,
+		done,
+		down,
+		lastActivityAt,
+		ownerTurns
 	};
 }
+function summarizeTeam(children) {
+	let agents = 0;
+	let depth = 0;
+	let done = 0;
+	let down = 0;
+	let members = 0;
+	const results = [];
+	for (const child of children) {
+		if (child.wait) continue;
+		members += 1;
+		const below = child.subtree;
+		agents += 1 + (below?.agents ?? 0);
+		depth = Math.max(depth, 1 + (below?.depth ?? 0));
+		done += below?.done ?? 0;
+		down += below?.down ?? 0;
+		const status = child.status === "done" ? "done" : child.status === "failed" || child.status === "cancelled" ? "down" : void 0;
+		if (status === void 0) continue;
+		if (status === "done") done += 1;
+		else down += 1;
+		const score = child.resolved?.kind === "done" ? child.resolved.verdict?.score : void 0;
+		results.push({
+			id: child.id,
+			label: child.label,
+			status,
+			...child.outRef === void 0 ? {} : { outRef: child.outRef },
+			...score === void 0 ? {} : { score },
+			agents: below?.agents ?? 0,
+			order: child.settledSeq ?? Number.MAX_SAFE_INTEGER
+		});
+	}
+	if (members === 0) return void 0;
+	results.sort((a, b) => (a.status === b.status ? 0 : a.status === "done" ? -1 : 1) || (b.score ?? Number.NEGATIVE_INFINITY) - (a.score ?? Number.NEGATIVE_INFINITY) || a.order - b.order);
+	const listed = results.slice(0, 8).map(({ order: _order, ...result }) => Object.freeze(result));
+	return Object.freeze({
+		agents,
+		depth,
+		done,
+		down,
+		results: Object.freeze(listed),
+		omitted: members - listed.length
+	});
+}
 function makeTreeView(root, children) {
 	const nodes = [...children.values()].map((c) => ({
 		id: c.id,
@@ -24231,7 +24862,7 @@ function makeTreeView(root, children) {
 	return {
 		root,
 		nodes,
-		inFlight: nodes.filter((n) => n.status === "running" || n.status === "acquiring").length,
+		inFlight: nodes.filter((n) => n.status === "running" || n.status === "acquiring" || n.status === "queued").length,
 		waiting: nodes.filter((n) => n.status === "waiting").length
 	};
 }
@@ -24954,8 +25585,6 @@ const DEFAULT_MAX_ATTEMPTS = 8;
 const DEFAULT_MAX_BARREN_REPROMPTS = 2;
 const DEFAULT_INITIAL_BACKOFF_MS = 2e3;
 const DEFAULT_MAX_BACKOFF_MS = 3e4;
-const DEFAULT_UNAVAILABLE_PAUSE_MS = 15e3;
-const DEFAULT_MAX_UNAVAILABLE_PAUSE_MS = 3e5;
 /**
 * Bridge error classes the bridge itself never retries: a request that fails identically on
 * every attempt, mapped below 5xx on its HTTP path (`parse_error` 400, the other two 501). On the
@@ -24991,39 +25620,6 @@ var HarnessTurnFailedError = class extends Error {
 	}
 };
 /**
-* Machine codes that say the upstream cannot serve now rather than that the request is wrong.
-* Each is a code an upstream publishes, not prose: the router's
-* (`lib/model-substitution.ts`, `lib/upstream-error-triage.ts`) and the OpenAI- and Anthropic-shaped
-* error types a relayed body carries.
-*/
-const UNAVAILABLE_CODES = /* @__PURE__ */ new Set([
-	"provider_quota_exhausted",
-	"provider_quota_exceeded",
-	"provider_rate_limit",
-	"upstream_unavailable",
-	"provider_key_invalid",
-	"rate_limit_exceeded",
-	"rate_limit_error",
-	"overloaded_error"
-]);
-/** 429 Too Many Requests, 503 Service Unavailable, and 529, which Anthropic uses for overload. */
-const UNAVAILABLE_STATUSES = /* @__PURE__ */ new Set([
-	429,
-	503,
-	529
-]);
-/**
-* A harness that flattens the router's JSON body into its own failure text leaves the router's
-* code in that text: `opencode execution failed: No provider served model "..."
-* (provider_quota_exhausted)`. The code is matched as a whole token, and a status only in the
-* `status code <n>` framing a harness prints, so prose that merely mentions a quota does not match.
-*/
-function unavailableSignalInText(text) {
-	for (const token of text.toLowerCase().matchAll(/[a-z_]+/gu)) if (UNAVAILABLE_CODES.has(token[0])) return token[0];
-	const status = text.match(/\bstatus code (\d{3})\b/u)?.[1];
-	return status !== void 0 && UNAVAILABLE_STATUSES.has(Number(status)) ? `http-${status}` : void 0;
-}
-/**
 * The code or status that marks `error` as an upstream capacity refusal, or `undefined`.
 *
 * A structured field is read first: a turn outcome's `errorCode`, a transport error's
@@ -25032,11 +25628,10 @@ function unavailableSignalInText(text) {
 */
 function upstreamUnavailableSignal(error) {
 	if (!(error instanceof Error)) return void 0;
-	if (error instanceof HarnessTurnFailedError) {
-		const code = error.errorCode?.toLowerCase();
-		if (code !== void 0 && UNAVAILABLE_CODES.has(code)) return code;
-		return unavailableSignalInText(error.message);
-	}
+	if (error instanceof HarnessTurnFailedError) return unavailableSignalOfFailure({
+		error: error.message,
+		...error.errorCode === void 0 ? {} : { errorCode: error.errorCode }
+	});
 	if (error instanceof BackendTransportError) {
 		const code = error.upstreamCode?.toLowerCase();
 		if (code !== void 0 && UNAVAILABLE_CODES.has(code)) return code;
@@ -25182,8 +25777,6 @@ async function runDriverWithRetry(run) {
 	const maxAttempts = Math.max(1, policy.maxAttempts ?? DEFAULT_MAX_ATTEMPTS);
 	const initialBackoff = Math.max(0, policy.initialBackoffMs ?? DEFAULT_INITIAL_BACKOFF_MS);
 	const maxBackoff = Math.max(initialBackoff, policy.maxBackoffMs ?? DEFAULT_MAX_BACKOFF_MS);
-	const unavailablePause = Math.max(0, policy.unavailablePauseMs ?? DEFAULT_UNAVAILABLE_PAUSE_MS);
-	const maxUnavailablePause = Math.max(unavailablePause, policy.maxUnavailablePauseMs ?? DEFAULT_MAX_UNAVAILABLE_PAUSE_MS);
 	const maxReprompts = run.reprompt?.maxReprompts ?? 0;
 	if (maxReprompts === "until-complete") {
 		const deadline = run.budget().deadlineMs;
@@ -25272,7 +25865,7 @@ async function runDriverWithRetry(run) {
 				}
 				pauses += 1;
 				consecutivePauses = progressed ? 1 : consecutivePauses + 1;
-				const pause = Math.min(maxUnavailablePause, unavailablePause * 2 ** Math.max(0, consecutivePauses - 1));
+				const pause = unavailablePauseMs(consecutivePauses, policy);
 				await emit({
 					attempt,
 					durationMs,
@@ -25553,12 +26146,8 @@ function assertResumeContract(events, opts) {
 	if (roots.length !== 1 || roots[0]?.id !== opts.runId) throw new RuntimeRunStateError(`supervisor: resumed run '${opts.runId}' must contain exactly one root identity event; found ${roots.length}`);
 	const recorded = roots[0];
 	if (contentAddress(recorded.budget) !== contentAddress(opts.budget)) throw new RuntimeRunStateError(`supervisor: resume budget mismatch for run '${opts.runId}'; use a new runId to change limits`);
-	const expectedAdmission = opts.reservationPolicy ? {
-		policy: opts.reservationPolicy,
-		maxDepth: opts.maxDepth ?? defaultMaxDepth,
-		maxLiveWorkers: opts.maxLiveWorkers
-	} : void 0;
-	if (contentAddress(recorded.recursiveAdmission ?? null) !== contentAddress(expectedAdmission ?? null)) throw new RuntimeRunStateError(`supervisor: resume reservation policy or fleet limits mismatch for run '${opts.runId}'; use a new runId`);
+	const expectedAdmission = opts.reservationPolicy ? { policy: opts.reservationPolicy } : void 0;
+	if (contentAddress(recorded.recursiveAdmission ?? null) !== contentAddress(expectedAdmission ?? null)) throw new RuntimeRunStateError(`supervisor: resume reservation policy mismatch for run '${opts.runId}'; use a new runId`);
 	if (!sameOptionalIdentity(recorded.identity, opts.rootIdentity)) throw new RuntimeRunStateError(`supervisor: resume identity mismatch for run '${opts.runId}'; ${describeIdentityMismatch(recorded.identity, opts.rootIdentity)}`);
 	const receipts = events.filter((event) => event.kind === "materialized" && event.id === opts.runId);
 	const expectedReceipt = rootMaterializationReceipt(opts);
@@ -25655,9 +26244,11 @@ function rootStartedAtMs(root) {
 	if (!Number.isFinite(startedAt)) throw new RuntimeRunStateError(`supervisor: root event for '${root.id}' has an invalid timestamp '${root.at}'`);
 	return startedAt;
 }
-/** The default runtime recursion-depth ceiling, paired with the conserved pool so a
-*  runaway recursion hits budget-exhaustion first and depth-exceeded second (R3). */
-const defaultMaxDepth = 4;
+/** The default recursion-depth ceiling. The conserved pool is what bounds a tree's depth: every
+*  level draws its slice from the level above, so a tree ends when its slices run out. This
+*  ceiling only stops a runaway recursion that keeps spawning tiny slices, so it sits well above
+*  any depth a budget can usefully pay for. */
+const DEFAULT_MAX_DEPTH = 16;
 /**
 * Normalize an arbitrary rejection into the serializable triple the result carries. A driver may
 * reject with anything (a string, a plain object, a null-prototype value), and the whole point of
@@ -25682,7 +26273,7 @@ function describeRejection(error) {
 function createSupervisor() {
 	let attached;
 	async function run(root, task, opts) {
-		const { budget, rootIdentity, rootMaterialization, runId, journal: journalStore, blobs: blobStore, executors: executorRegistry, recoverExecutor, probes, maxDepth, maxLiveWorkers, reservationPolicy, maxRestarts, withinMs, childSettleGraceMs, teardownConfirmMs, resume, retainedAtSettlement: requestedRetainedAtSettlement, ownerWorkspaceRetention, now: suppliedNow, signal, hooks, workerTrace, workerTraceUnpropagated, interactiveBindingDir } = opts;
+		const { budget, rootIdentity, rootMaterialization, runId, journal: journalStore, blobs: blobStore, executors: executorRegistry, recoverExecutor, probes, maxDepth, workerSlots, reservationPolicy, maxRestarts, withinMs, childSettleGraceMs, teardownConfirmMs, resume, retainedAtSettlement: requestedRetainedAtSettlement, ownerWorkspaceRetention, now: suppliedNow, signal, hooks, workerTrace, workerTraceUnpropagated, interactiveBindingDir } = opts;
 		const input = detachedSnapshot({
 			task,
 			options: {
@@ -25691,7 +26282,7 @@ function createSupervisor() {
 				...rootIdentity === void 0 ? {} : { rootIdentity },
 				...rootMaterialization === void 0 ? {} : { rootMaterialization },
 				...maxDepth === void 0 ? {} : { maxDepth },
-				...maxLiveWorkers === void 0 ? {} : { maxLiveWorkers },
+				...typeof workerSlots === "number" ? { workerSlots } : {},
 				...reservationPolicy === void 0 ? {} : { reservationPolicy },
 				...maxRestarts === void 0 ? {} : { maxRestarts },
 				...withinMs === void 0 ? {} : { withinMs },
@@ -25703,7 +26294,8 @@ function createSupervisor() {
 				...interactiveBindingDir === void 0 ? {} : { interactiveBindingDir }
 			}
 		}, "supervisor.run");
-		assertRecursiveReservationPolicy(reservationPolicy, maxDepth ?? defaultMaxDepth, maxLiveWorkers);
+		assertRecursiveReservationPolicy(reservationPolicy);
+		const slots = resolveWorkerSlots(workerSlots);
 		if (teardownConfirmMs !== void 0 && (typeof teardownConfirmMs !== "number" || !Number.isFinite(teardownConfirmMs) || teardownConfirmMs < 0)) throw new ValidationError$1(`supervisor: teardownConfirmMs must be a nonnegative finite number of milliseconds, got ${JSON.stringify(teardownConfirmMs)}`);
 		if (requestedRetainedAtSettlement !== void 0 && requestedRetainedAtSettlement !== "release" && requestedRetainedAtSettlement !== "keep") throw new ValidationError$1(`supervisor: retainedAtSettlement must be 'release' or 'keep', got ${JSON.stringify(requestedRetainedAtSettlement)}`);
 		opts = Object.freeze({
@@ -25766,11 +26358,7 @@ function createSupervisor() {
 					label: "root",
 					budget: opts.budget,
 					runtime: rootRuntime,
-					...opts.reservationPolicy ? { recursiveAdmission: {
-						policy: opts.reservationPolicy,
-						maxDepth: opts.maxDepth ?? defaultMaxDepth,
-						maxLiveWorkers: opts.maxLiveWorkers
-					} } : {},
+					...opts.reservationPolicy ? { recursiveAdmission: { policy: opts.reservationPolicy } } : {},
 					...opts.rootIdentity ? { identity: opts.rootIdentity } : {},
 					seq: 0,
 					at: runStartedAt
@@ -25820,8 +26408,8 @@ function createSupervisor() {
 				executors: opts.executors,
 				seams: { [retainedOwnerWorkspaceRetentionSeamKey]: ownerWorkspaceRetention === true },
 				depth: 0,
-				maxDepth: opts.maxDepth ?? defaultMaxDepth,
-				...opts.maxLiveWorkers !== void 0 ? { maxLiveWorkers: opts.maxLiveWorkers } : {},
+				maxDepth: opts.maxDepth ?? 16,
+				workerSlots: slots,
 				...opts.reservationPolicy ? {
 					reservationPolicy: opts.reservationPolicy,
 					ownerBudget: opts.budget
@@ -26231,13 +26819,14 @@ function pausable(ms) {
 /** The unconfirmed set as one error clause: the count plus the node ids behind it. One integer is
 *  not actionable after a six-hour run. */
 function describeUnconfirmed(scope) {
-	const named = scope.workerCapacity.unconfirmed.map((node) => `${node.id} (${[
+	const unconfirmed = scope.workerCapacity.unconfirmed;
+	const named = unconfirmed.map((node) => `${node.id} (${[
 		node.label,
 		node.runtime,
 		node.status,
 		...(node.environments ?? []).map((environment) => `${environment.provider}:${environment.environmentId}`)
 	].join(", ")})`).join(", ");
-	return `${scope.workerCapacity.live} executor resource(s) not confirmed destroyed${named.length > 0 ? `: ${named}` : ""}`;
+	return `${unconfirmed.length} executor resource(s) not confirmed destroyed${named.length > 0 ? `: ${named}` : ""}`;
 }
 /** The settle window a driver's children actually get: the caller's grace, never past an explicit
 *  run deadline. `null` means no timer. `0` (the default) cascades immediately. */
@@ -26411,6 +27000,6 @@ function isNonEmptySpend(s) {
 	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false || Object.values(s.resources ?? {}).some((resource) => resource.amount > 0 || !resource.known);
 }
 //#endregion
-export { attachWorker as $, stringifySafe as $i, runAbortable as $n, sandboxActProfileMaterialization as $r, AUTHORITY_MARKERS as $t, settledToIteration as A, projectSandboxOutcome as Ai, canonicalObservedModelParts as An, runWorktreeHarness as Ar, replaySpawnTree as At, prepareScopeRetainedOwnerTask as B, notifySandboxEventObserver as Bi, sandboxSessionTraceSource as Bn, terminateProcessTreeAndConfirm as Br, newUsageTotals as Bt, deriveNodeExecutionIdentity as C, runtimeOwnedScopeOwnerRuntime as Ci, createSandboxLineage as Cn, toOtelAttributes as Cr, FileSpawnJournal as Ct, recordScopeOwnerPause as D, executableAgentSpecSnapshot as Di, readPromptOptions as Dn, sanitizeKnowledgeReadinessReport as Dr, loadSpawnForest as Dt, recordScopeOwnerMaterialization as E, executableAgentProfileSnapshot as Ei, assertBoxlessPromptOptions as En, sanitizeAgentRuntimeEvent as Er, insideCursorNamespace as Et, validateWaitSpec as F, createSandboxUsageLedger as Fi, providerAsSandboxClient as Fn, LOCAL_HARNESSES as Fr, workerTraceAnalysisStore as Ft, scopeRetainedOwnerResult as G, chargedTokens as Gi, startRetainedRun as Gn, fullProfileMaterialization as Gr, workerTraceEnv as Gt, scopeRetainedOwnerContext as H, sandboxProgressEvents as Hi, retainedExecutorSeamKey as Hn, assertProfileMaterialization as Hr, spendFromUsageTotals as Ht, waitUntil as I, extractLlmCallEvent as Ii, resolveAgentEnvironmentProvider as In, harnessSupportsReasoningEffort as Ir, BudgetReconcileFault as It, hostDirectoryReader as J, hasCompleteCacheBreakdown as Ji, destroyInteractiveEnvironment as Jn, promptModelProfileMaterialization as Jr, taskToPrompt as Jt, SPAWN_RESOURCE_PATH_MAX_BYTES as K, cloneSpend as Ki, startRetainedRunInEnvironment as Kn, profileMaterializationAxes$1 as Kr, workerTraceHeaders as Kt, bindScopeRetainedOwnerEnvironmentId as L, isSandboxTerminalEvent as Li, sandboxClientAsProvider as Ln, localHarnessExecutable as Lr, assertValidBudget as Lt, isWaitOutcome as M, assertSandboxServedModel as Mi, DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS as Mn, createWorktree as Mr, captureWorkerTraceEvidence as Mt, pollFor as N, canonicalStreamEventFromSandboxEvent as Ni, createAgentEnvironmentProviderRegistry as Nn, removeWorktree as Nr, isTraceAnalysisStore as Nt, restoreScopeOwnerAcceptedExecution as O, detachedFrozen as Oi, routerBrain as On, sanitizeRuntimeStreamEvent as Or, materializeTreeView as Ot, timerAt as P, createSandboxToolPartState as Pi, providerAsExecutor as Pn, DEFAULT_LOCAL_HARNESS as Pr, parseWorkerToolTraceArtifact as Pt, workerInteractiveAdmissionFile as Q, sleep as Qi, linkAbort as Qn, renderUnsupported as Qr, createInbox as Qt, bindScopeRetainedOwnerProvider as R, mapSandboxEvent as Ri, createPushTraceSource as Rn, parseCodexTokenUsage as Rr, createBudgetPool as Rt, createScope as S, runtimeOwnedPendingExecutorMaterialization as Si, runAgentRounds as Sn, padTraceId as Sr, FileResultBlobStore as St, meterRuntimeOwnedProviderAttempt as T, unknownMaterializationReceipt as Ti, acquireSandbox as Tn, createRuntimeStreamEventCollector as Tr, InMemorySpawnJournal as Tt, scopeRetainedOwnerPriorSpend as U, sumSandboxUsage as Ui, reconnectRetainedRun as Un, controlProfileMaterialization as Ur, WORKER_TRACE_PROPAGATION as Ut, reconcileScopeRetainedOwnerEnvironment as V, sandboxEventServedBackend as Vi, registerRetainedExecutorPreparation as Vn, AGENT_PROFILE_MATERIALIZATION_AXES as Vr, spendFromUsageEvents as Vt, scopeRetainedOwnerResourceReader as W, addSpend as Wi, recoverRetainedRun as Wn, defineProfileMaterializationContract as Wr, readWorkerTraceContext as Wt, interactiveAdmissionSeamKey as X, promptCacheTokenClasses as Xi, RunCancellationReason as Xn, promptResourceProfileMaterialization as Xr, createActivityLog as Xt, resolveSpawnResourcePaths as Y, isAbortError$2 as Yi, environmentGone as Yn, promptOnlyProfileMaterialization as Yr, DEFAULT_STALL_AFTER_MS as Yt, readWorkerInteractiveAdmissions as Z, randomSuffix as Zi, abortError as Zn, renderProfileMaterializationIssues as Zr, readWorkerProgress as Zt, driverExecutorFactory as _, providerMessageText as _a, recordRuntimeOwnedDriveHarnessProviderEvidence as _i, bridgeStopSignalKey as _n, exportEvalRuns as _r, snapshotExecutorConfig as _t, pickBestDelivered as a, addResourceSpend as aa, prepareJsonlAppend as ai, peerMailTools as an, persistHarnessTranscript as ar, startRetainedInteractiveRun as at, assertRecursiveReservationPolicy as b, runtimeOwnedExecutorMaterialization as bi, defaultSelectWinner as bn, loopEventToOtelSpan as br, createSteerableSandboxSession as bt, DEFAULT_MAX_BARREN_REPROMPTS as c, decodeHarnessUsage as ca, attestRuntimeOwnedPendingExecutor as ci, isTerminalNodeStatus as cn, mergeTraceEnv as cr, freeSlots as ct, classifyDriverFailure as d, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as da, finalizeRuntimeOwnedPendingExecutor as di, bridgeModelRouteRefusal as dn, INTELLIGENCE_WIRE_VERSION as dr, bindReusableExecutorExecutionId as dt, throwAbort as ea, unsupportedProfileDimensions as ei, DEFAULT_PEER_MAIL_LIMITS as en, defaultRedactor as er, readWorkerInteractiveBinding as et, defaultUnmetContractSteer as f, armDeadlineTimer as fa, inheritRuntimeOwnedExecutorAttestation as fi, addHarnessUsage as fn, buildLoopOtelSpans as fr, captureReusableExecutorConfig as ft, driverChild as g, promptOptionsFromAgentTurnInput as ga, providerAttemptEvidence as gi, bridgeRuntimeAttachmentsKey as gn, createOtelExporter as gr, createExecutorRegistry as gt, upstreamUnavailableSignal as h, promptFromAgentTurnInput as ha, newExecutionAttemptId as hi, readCodexRolloutSession as hn, createOpenInferenceFileExporter as hr, createExecutor as ht, collectDelivered as i, zeroSpend as ia, parseCommittedJsonLines as ii, isPeerMailEnvelope as in, harnessTranscriptArtifact as ir, recoverRetainedInteractiveRun as it, createWaitProbes as j, readSandboxOutcome as ji, observedModelMatchesDeclared as jn, captureWorktreeDiff as jr, WORKER_TOOL_TRACE_SCHEMA_VERSION as jt, scopeOwnerExecutorNodeContext as k, detachedSnapshot as ki, runBrainLoop as kn, runSettledCommand as kr, pendingWaits as kt, DriverAttemptsExhaustedError as l, abortError$2 as la, attestRuntimeOwnedScopeOwner as li, executorFailure as ln, readTraceContextFromEnv as lr, queueOf as lt, summarizeDriverAttempts as m, teardownSurfaces as ma, knownMaterializationReceipt as mi, harnessUsageIsEmpty as mn, buildRuntimeEventOtelSpans as mr, cliWorktreeExecutor as mt, createSupervisor as n, unmeteredSpend as na, worktreeCliProfileMaterialization as ni, claimsAuthority as nn, resolveRedactor as nr, workerInteractiveBindingsDir as nt, runFinalizer as o, resourceTelemetry as oa, readCommittedJsonLines as oi, peerMailVerbNames as on, contentAddress as or, errMessage as ot, runDriverWithRetry as p, teardownExecutor as pa, knownExecutionBindingReceipt as pi, createCodexRolloutStoreReader as pn, buildLoopSpanNodes as pr, cliInPlaceExecutor as pt, environmentReader as q, deleteBoxSafe as qi, retainedCreateMaterial as qn, promptControlProfileMaterialization as qr, workerTraceSeamKey as qt, bestDelivered as r, withTimeout as ra, isNoEntError as ri, createPeerMailbox as rn, captureHarnessTranscript as rr, reconnectRetainedInteractiveRun as rt, runTree as s, withBudgetResources as sa, writeAllBytes as si, isLiveNodeStatus as sn, createPropagatingTraceEmitter as sr, effectiveConcurrency as st, createRootHandle as t, throwIfAborted as ta, validateProfileMaterialization as ti, PEER_MAIL_WIRE_KEY as tn, defaultRedactorIdentityMaterial as tr, workerInteractiveBindingFile as tt, HarnessTurnFailedError as u, awaitAbortable$1 as ua, authoredProfileDigest as ui, bridgeAdmissionRefusal as un, traceContextToEnv as ur, rollingDispatch as ut, isDriverSpec as v, runtimeOwnedDriveHarnessProviderEvidence as vi, TERMINAL_DECISIONS as vn, flatOtelSpan as vr, createWorktreeCliExecutor as vt, meterRuntimeOwnedAccounting as w, unknownExecutionBindingReceipt as wi, probeSandboxCapabilities as wn, createRuntimeEventCollector as wr, InMemoryResultBlobStore as wt, beginScopeOwnerAttempt as x, runtimeOwnedExecutorProviderEvidence as xi, isTerminalDecision as xn, padSpanId as xr, createInPlaceCliExecutor as xt, withDriverExecutor as y, runtimeOwnedExecutorExecutionBinding as yi, createSandboxForSpec as yn, generateSpanId as yr, DEFAULT_SANDBOX_STEERING_MAX_TURNS as yt, consumeScopeRetainedOwnerResult as z, mapSandboxToolEvent as zi, decodeToolPart as zn, CodexExecutionDiagnosticError as zr, meterUsageEvent as zt };
+export { interactiveAdmissionSeamKey as $, cloneSpend as $i, retainedCreateMaterial as $n, profileMaterializationAxes$1 as $r, readWorkerProgress as $t, restoreScopeOwnerAcceptedExecution as A, runtimeOwnedScopeOwnerRuntime as Ai, routerBrain as An, createRuntimeEventCollector as Ar, pendingWaits as At, bindScopeRetainedOwnerEnvironmentId as B, canonicalStreamEventFromSandboxEvent as Bi, sandboxClientAsProvider as Bn, DEFAULT_LOCAL_HARNESS as Br, createBudgetPool as Bt, beginScopeOwnerAttempt as C, promptOptionsFromAgentTurnInput as Ca, providerAttemptEvidence as Ci, isTerminalDecision as Cn, exportEvalRuns as Cr, FileResultBlobStore as Ct, meterRuntimeOwnedProviderAttempt as D, runtimeOwnedExecutorMaterialization as Di, acquireSandbox as Dn, padSpanId as Dr, insideCursorNamespace as Dt, meterRuntimeOwnedAccounting as E, runtimeOwnedExecutorExecutionBinding as Ei, probeSandboxCapabilities as En, loopEventToOtelSpan as Er, InMemorySpawnJournal as Et, isWaitOutcome as F, detachedFrozen as Fi, LEAF_CONTINUATION_TASK as Fn, runSettledCommand as Fr, parseWorkerToolTraceArtifact as Ft, scopeRetainedOwnerContext as G, mapSandboxEvent as Gi, sandboxSessionTraceSource as Gn, parseCodexTokenUsage as Gr, WORKER_TRACE_PROPAGATION as Gt, consumeScopeRetainedOwnerResult as H, createSandboxUsageLedger as Hi, unavailableSignalOfFailure as Hn, harnessInvocation as Hr, newUsageTotals as Ht, pollFor as I, detachedSnapshot as Ii, createAgentEnvironmentProviderRegistry as In, runWorktreeHarness as Ir, workerTraceAnalysisStore as It, scopeRetainedOwnerResult as J, sandboxEventServedBackend as Ji, errMessage as Jn, AGENT_PROFILE_MATERIALIZATION_AXES as Jr, workerTraceHeaders as Jt, scopeRetainedOwnerPriorSpend as K, mapSandboxToolEvent as Ki, registerRetainedExecutorPreparation as Kn, CodexExecutionDiagnosticError as Kr, readWorkerTraceContext as Kt, timerAt as L, projectSandboxOutcome as Li, providerAsExecutor as Ln, captureWorktreeDiff as Lr, BudgetReconcileFault as Lt, settledToIteration as M, unknownMaterializationReceipt as Mi, canonicalObservedModelParts as Mn, sanitizeAgentRuntimeEvent as Mr, WORKER_TOOL_TRACE_SCHEMA_VERSION as Mt, createWorkerSlots as N, executableAgentProfileSnapshot as Ni, observedModelMatchesDeclared as Nn, sanitizeKnowledgeReadinessReport as Nr, captureWorkerTraceEvidence as Nt, recordScopeOwnerMaterialization as O, runtimeOwnedExecutorProviderEvidence as Oi, assertBoxlessPromptOptions as On, padTraceId as Or, loadSpawnForest as Ot, createWaitProbes as P, executableAgentSpecSnapshot as Pi, DEFAULT_SANDBOX_IDLE_TIMEOUT_SECONDS as Pn, sanitizeRuntimeStreamEvent as Pr, isTraceAnalysisStore as Pt, resolveSpawnResourcePaths as Q, chargedTokens as Qi, startRetainedRunInEnvironment as Qn, fullProfileMaterialization as Qr, createActivityLog as Qt, validateWaitSpec as R, readSandboxOutcome as Ri, providerAsSandboxClient as Rn, createWorktree as Rr, ReservationWaitRefused as Rt, assertRecursiveReservationPolicy as S, promptFromAgentTurnInput as Sa, newExecutionAttemptId as Si, defaultSelectWinner as Sn, createOtelExporter as Sr, createInPlaceCliExecutor as St, deriveNodeExecutionIdentity as T, runtimeOwnedDriveHarnessProviderEvidence as Ti, createSandboxLineage as Tn, generateSpanId as Tr, InMemoryResultBlobStore as Tt, prepareScopeRetainedOwnerTask as U, extractLlmCallEvent as Ui, createPushTraceSource as Un, harnessSupportsReasoningEffort as Ur, spendFromUsageEvents as Ut, bindScopeRetainedOwnerProvider as V, createSandboxToolPartState as Vi, unavailablePauseMs as Vn, LOCAL_HARNESSES as Vr, meterUsageEvent as Vt, reconcileScopeRetainedOwnerEnvironment as W, isSandboxTerminalEvent as Wi, decodeToolPart as Wn, localHarnessExecutable as Wr, spendFromUsageTotals as Wt, environmentReader as X, sumSandboxUsage as Xi, recoverRetainedRun as Xn, controlProfileMaterialization as Xr, taskToPrompt as Xt, SPAWN_RESOURCE_PATH_MAX_BYTES as Y, sandboxProgressEvents as Yi, reconnectRetainedRun as Yn, assertProfileMaterialization as Yr, workerTraceSeamKey as Yt, hostDirectoryReader as Z, addSpend as Zi, startRetainedRun as Zn, defineProfileMaterializationContract as Zr, DEFAULT_STALL_AFTER_MS as Zt, driverChild as _, awaitAbortable$1 as _a, authoredProfileDigest as _i, readCodexRolloutSession as _n, INTELLIGENCE_WIRE_VERSION as _r, createExecutorRegistry as _t, collectDelivered as a, sleep as aa, renderUnsupported as ai, createPeerMailbox as an, runAbortable as ar, workerInteractiveBindingsDir as at, withDriverExecutor as b, teardownExecutor as ba, knownExecutionBindingReceipt as bi, TERMINAL_DECISIONS as bn, buildRuntimeEventOtelSpans as br, DEFAULT_SANDBOX_STEERING_MAX_TURNS as bt, runTree as c, throwIfAborted as ca, validateProfileMaterialization as ci, peerMailVerbNames as cn, resolveRedactor as cr, startRetainedInteractiveRun as ct, HarnessTurnFailedError as d, zeroSpend as da, parseCommittedJsonLines as di, executorFailure as dn, persistHarnessTranscript as dr, rollingDispatch as dt, deleteBoxSafe as ea, promptControlProfileMaterialization as ei, createInbox as en, destroyInteractiveEnvironment as er, readWorkerInteractiveAdmissions as et, classifyDriverFailure as f, addResourceSpend as fa, prepareJsonlAppend as fi, bridgeAdmissionRefusal as fn, contentAddress as fr, bindReusableExecutorExecutionId as ft, upstreamUnavailableSignal as g, abortError$2 as ga, attestRuntimeOwnedScopeOwner as gi, harnessUsageIsEmpty as gn, traceContextToEnv as gr, createExecutor as gt, summarizeDriverAttempts as h, decodeHarnessUsage as ha, attestRuntimeOwnedPendingExecutor as hi, createCodexRolloutStoreReader as hn, readTraceContextFromEnv as hr, cliWorktreeExecutor as ht, bestDelivered as i, randomSuffix as ia, renderProfileMaterializationIssues as ii, claimsAuthority as in, linkAbort as ir, workerInteractiveBindingFile as it, scopeOwnerExecutorNodeContext as j, unknownExecutionBindingReceipt as ji, runBrainLoop as jn, createRuntimeStreamEventCollector as jr, replaySpawnTree as jt, recordScopeOwnerPause as k, runtimeOwnedPendingExecutorMaterialization as ki, readPromptOptions as kn, toOtelAttributes as kr, materializeTreeView as kt, DEFAULT_MAX_BARREN_REPROMPTS as l, unmeteredSpend as la, worktreeCliProfileMaterialization as li, isLiveNodeStatus as ln, captureHarnessTranscript as lr, freeSlots as lt, runDriverWithRetry as m, withBudgetResources as ma, writeAllBytes as mi, addHarnessUsage as mn, mergeTraceEnv as mr, cliInPlaceExecutor as mt, createRootHandle as n, isAbortError$2 as na, promptOnlyProfileMaterialization as ni, DEFAULT_PEER_MAIL_LIMITS as nn, RunCancellationReason as nr, attachWorker as nt, pickBestDelivered as o, stringifySafe as oa, sandboxActProfileMaterialization as oi, isPeerMailEnvelope as on, defaultRedactor as or, reconnectRetainedInteractiveRun as ot, defaultUnmetContractSteer as p, resourceTelemetry as pa, readCommittedJsonLines as pi, bridgeModelRouteRefusal as pn, createPropagatingTraceEmitter as pr, captureReusableExecutorConfig as pt, scopeRetainedOwnerResourceReader as q, notifySandboxEventObserver as qi, retainedExecutorSeamKey as qn, terminateProcessTreeAndConfirm as qr, workerTraceEnv as qt, createSupervisor as r, promptCacheTokenClasses as ra, promptResourceProfileMaterialization as ri, PEER_MAIL_WIRE_KEY as rn, abortError as rr, readWorkerInteractiveBinding as rt, runFinalizer as s, throwAbort as sa, unsupportedProfileDimensions as si, peerMailTools as sn, defaultRedactorIdentityMaterial as sr, recoverRetainedInteractiveRun as st, DEFAULT_MAX_DEPTH as t, hasCompleteCacheBreakdown as ta, promptModelProfileMaterialization as ti, AUTHORITY_MARKERS as tn, environmentGone as tr, workerInteractiveAdmissionFile as tt, DriverAttemptsExhaustedError as u, withTimeout as ua, isNoEntError as ui, isTerminalNodeStatus as un, harnessTranscriptArtifact as ur, queueOf as ut, driverExecutorFactory as v, DEFAULT_SUCCESSFUL_SHUTDOWN_MS as va, finalizeRuntimeOwnedPendingExecutor as vi, bridgeRuntimeAttachmentsKey as vn, buildLoopOtelSpans as vr, snapshotExecutorConfig as vt, createScope as w, providerMessageText as wa, recordRuntimeOwnedDriveHarnessProviderEvidence as wi, runAgentRounds as wn, flatOtelSpan as wr, FileSpawnJournal as wt, SUBTREE_RESULT_LIMIT as x, teardownSurfaces as xa, knownMaterializationReceipt as xi, createSandboxForSpec as xn, createOpenInferenceFileExporter as xr, createSteerableSandboxSession as xt, isDriverSpec as y, armDeadlineTimer as ya, inheritRuntimeOwnedExecutorAttestation as yi, bridgeStopSignalKey as yn, buildLoopSpanNodes as yr, createWorktreeCliExecutor as yt, waitUntil as z, assertSandboxServedModel as zi, resolveAgentEnvironmentProvider as zn, removeWorktree as zr, assertValidBudget as zt };
 
-//# sourceMappingURL=supervisor-C26k7X5-.js.map
+//# sourceMappingURL=supervisor-B8UMAXya.js.map