@tangle-network/agent-runtime 0.306.1 → 0.307.2

package/dist/{supervisor-gCfG6K1-.js → supervisor-Dz4XXtK1.js}

@@ -1,5 +1,5 @@
 import { c as RetainedInteractiveAdmissionError, d as RetainedRunDispatchBindingError, f as RuntimeRunStateError, i as ConfigError, l as RetainedInteractiveBindingError, m as ValidationError$1, r as BackendTransportError, t as AgentEvalError$1, u as RetainedRunAdmissionError } from "./errors-DodWX-cb.js";
-import { $ as randomUuid, B as addTokenUsage, G as errorMessage, H as cloneSpend, K as fnv1a32Hex, N as deepFreezeCandidate, O as verifyWorkspaceSnapshotArtifacts, Q as randomSuffix, U as cloneTokenUsage, V as chargedTokens, W as deleteBoxSafe, X as mapWithConcurrency, Y as isAsyncIterable$1, Z as promptCacheTokenClasses, _t as armDeadlineTimer, a as verifyAgentCandidateWorkspaceArtifacts, at as unmeteredSpend, bt as singleFlightTeardown, ct as zeroTokenUsage, dt as resourceTelemetry, et as roundBoxMinutes, ft as withBudgetResources, gt as ROOT_DEADLINE_REASON, i as readAgentCandidateWorkspaceArtifactFiles, it as throwIfAborted, k as verifiedArtifactChunks, lt as addResourceSpend, mt as CHILD_DEADLINE_REASON, nt as stringifySafe, o as verifyAgentCandidateWorkspaceTree, ot as withTimeout, pt as ACCEPTED_RESULT_GRACE_MS, q as hasCompleteCacheBreakdown, rt as throwAbort, st as zeroSpend, tt as sleep, u as verifyAgentCandidateWorkspaceArchive, ut as assertResources, vt as boundedChildDeadlineAt, xt as teardownExecutor, yt as isDeadlineAbortReason, z as addSpend } from "./workspace-streams-ILw0eWZ0.js";
+import { $ as randomUuid, B as addTokenUsage, G as errorMessage, H as cloneSpend, K as fnv1a32Hex, N as deepFreezeCandidate, O as verifyWorkspaceSnapshotArtifacts, Q as randomSuffix, St as teardownSurfaces, U as cloneTokenUsage, V as chargedTokens, W as deleteBoxSafe, X as mapWithConcurrency, Y as isAsyncIterable$1, Z as promptCacheTokenClasses, _t as armDeadlineTimer, a as verifyAgentCandidateWorkspaceArtifacts, at as unmeteredSpend, bt as singleFlightTeardown, ct as zeroTokenUsage, dt as resourceTelemetry, et as roundBoxMinutes, ft as withBudgetResources, gt as ROOT_DEADLINE_REASON, i as readAgentCandidateWorkspaceArtifactFiles, it as throwIfAborted, k as verifiedArtifactChunks, lt as addResourceSpend, mt as CHILD_DEADLINE_REASON, nt as stringifySafe, o as verifyAgentCandidateWorkspaceTree, ot as withTimeout, pt as ACCEPTED_RESULT_GRACE_MS, q as hasCompleteCacheBreakdown, rt as throwAbort, st as zeroSpend, tt as sleep, u as verifyAgentCandidateWorkspaceArchive, ut as assertResources, vt as boundedChildDeadlineAt, xt as teardownExecutor, yt as isDeadlineAbortReason, z as addSpend } from "./workspace-streams-DaQceg2p.js";
 import { runTaskQueue } from "./task-queue.js";
 import { _ as agentHarness, a as concreteProfileModel, c as profileModelExecutionSettings, d as assertRouterAutoDeclaration, f as assertRouterAutoResponse, g as observedModelMatchesDeclared, h as observedModelHasSnapshot, l as profileProviderModel, m as mergeObservedModelIdentity, o as enforceTokenLimits, s as profileBridgeWireModel, t as assertExecutableAgentProfile, u as resolveRouterRetryPolicy } from "./model-policy-DydyWTQg.js";
 import { n as assertNoSymlinkDescendant, r as publishExclusiveDurableFile } from "./durable-file-DWQA4ooo.js";
@@ -380,6 +380,29 @@ const decodeCodexTurnUsage = (event) => {
 		...record.cacheWriteInputTokens === void 0 ? {} : { cacheWriteInput: record.cacheWriteInputTokens }
 	};
 };
+/** Claude's adapter forwards one delta per response snapshot, keyed and deduplicated there. */
+const decodeClaudeAssistantUsage = (event) => {
+	if (String(event.type ?? "") !== "raw") return void 0;
+	const envelope = plainRecord$2(event.data);
+	const data = envelope?.type === "raw" && plainRecord$2(envelope.event) !== void 0 ? plainRecord$2(envelope.event) : envelope;
+	if (data?.type !== "assistant.usage") return void 0;
+	if (typeof data.message_id !== "string" || data.message_id.length === 0) throw new ValidationError$1("claude assistant.usage: missing response identity");
+	const usage = plainRecord$2(data.usage);
+	if (!usage) throw new ValidationError$1("claude assistant.usage: usage must be an object");
+	const fresh = naturalNumber$1(usage.input_tokens, "input_tokens", "claude assistant.usage");
+	const cachedInput = naturalNumber$1(usage.cache_read_input_tokens, "cache_read_input_tokens", "claude assistant.usage");
+	const cacheWriteInput = naturalNumber$1(usage.cache_creation_input_tokens, "cache_creation_input_tokens", "claude assistant.usage");
+	const output = naturalNumber$1(usage.output_tokens, "output_tokens", "claude assistant.usage");
+	const input = fresh + cachedInput + cacheWriteInput;
+	if (!Number.isSafeInteger(input)) throw new ValidationError$1("claude assistant.usage: total input tokens exceed a safe integer");
+	return {
+		harness: "claude-code",
+		input,
+		output,
+		cachedInput,
+		cacheWriteInput
+	};
+};
 /**
 * The harness → usage-decoder registry. Add a harness by adding one entry.
 *
@@ -387,7 +410,10 @@ const decodeCodexTurnUsage = (event) => {
 * can produce does not compile. A harness absent from this registry reports usage through the
 * canonical events or not at all.
 */
-const harnessUsageDecoders = { codex: decodeCodexTurnUsage };
+const harnessUsageDecoders = {
+	codex: decodeCodexTurnUsage,
+	"claude-code": decodeClaudeAssistantUsage
+};
 /**
 * Decode a sandbox event with one harness's adapter, or `undefined` when the event carries no
 * harness-native usage.
@@ -6635,6 +6661,30 @@ async function captureProviderCheckpointWorkspace(port, context, marker) {
 		clearDeadline();
 	}
 }
+/** Verify a running workspace copy before treating it as retained evidence. */
+async function captureProviderLiveWorkspace(port, context) {
+	assertProviderWorkspaceRetentionPort(port, "provider workspace retention");
+	if (port.captureLive === void 0) throw new ValidationError$1("provider workspace retention: the port has no captureLive");
+	const timeoutMs = port.liveTimeoutMs ?? port.timeoutMs;
+	const controller = new AbortController();
+	const clearDeadline = armDeadlineTimer(timeoutMs, () => controller.abort(/* @__PURE__ */ new Error(`live workspace capture timed out after ${timeoutMs}ms`)), true);
+	try {
+		return await runAbortable(() => withCaptureSlot(checkpointSlots(port), controller.signal, async () => {
+			const tree = detachedSnapshot(await port.captureLive({
+				...context,
+				signal: controller.signal
+			}), "live workspace capture tree");
+			if (tree?.kind !== "agent-candidate-workspace-tree") throw new Error("live workspace capture returned no workspace tree");
+			if ((await verifyAgentCandidateWorkspaceTree(tree, port.artifacts, {
+				...port.limits === void 0 ? {} : { limits: port.limits },
+				signal: controller.signal
+			})).files.length !== tree.files) throw new Error("live workspace capture tree misstates its file count");
+			return tree;
+		}), controller.signal, `live workspace capture timed out after ${timeoutMs}ms`);
+	} finally {
+		clearDeadline();
+	}
+}
 /** Validate the executable retention port at the create boundary. */
 function assertProviderWorkspaceRetentionPort(port, context) {
 	if (!Number.isSafeInteger(port.timeoutMs) || port.timeoutMs <= 0) throw new ValidationError$1(`${context}: workspaceRetention.timeoutMs must be a positive safe integer`);
@@ -6643,7 +6693,14 @@ function assertProviderWorkspaceRetentionPort(port, context) {
 	if (typeof port.capture !== "function") throw new ValidationError$1(`${context}: workspaceRetention.capture is required`);
 	if (port.captureNative !== void 0 && typeof port.captureNative !== "function") throw new ValidationError$1(`${context}: workspaceRetention.captureNative must be a function`);
 	if (port.captureCheckpoint !== void 0 && typeof port.captureCheckpoint !== "function") throw new ValidationError$1(`${context}: workspaceRetention.captureCheckpoint must be a function`);
-	for (const key of ["nativeIntervalMs", "nativeTimeoutMs"]) {
+	if (port.captureLive !== void 0 && typeof port.captureLive !== "function") throw new ValidationError$1(`${context}: workspaceRetention.captureLive must be a function`);
+	if (port.liveIntervalMs !== void 0 && port.captureLive === void 0) throw new ValidationError$1(`${context}: workspaceRetention.liveIntervalMs requires captureLive`);
+	for (const key of [
+		"nativeIntervalMs",
+		"nativeTimeoutMs",
+		"liveIntervalMs",
+		"liveTimeoutMs"
+	]) {
 		const value = port[key];
 		if (value !== void 0 && (!Number.isSafeInteger(value) || value <= 0)) throw new ValidationError$1(`${context}: workspaceRetention.${key} must be a positive safe integer`);
 	}
@@ -9694,6 +9751,9 @@ var SpawnEventIndex = class {
 			if (node?.materialized) throw new Error(`spawn journal corrupted: duplicate materialization receipt for node '${event.id}' in tree '${this.root}'`);
 			if (!node?.spawned) throw new Error(`spawn journal corrupted: materialization for node '${event.id}' precedes its spawn in tree '${this.root}'`);
 		}
+		if (event.kind === "seat-materialized") {
+			if (!node?.materialized || node.authoredProfileDigest === void 0 || event.receipt.status !== "known" || event.receipt.authoredProfileDigest !== node.authoredProfileDigest || !Number.isSafeInteger(event.segmentIndex) || event.segmentIndex <= node.latestSeatMaterialization) throw new Error(`spawn journal corrupted: invalid seat materialization for node '${event.id}' in tree '${this.root}'`);
+		}
 		if (event.kind === "execution-bound") {
 			if (node?.bindings.has(event.binding.attemptId)) throw new Error(`spawn journal corrupted: duplicate execution binding for node '${event.id}' attempt '${event.binding.attemptId}' in tree '${this.root}'`);
 			if (!node?.materialized) throw new Error(`spawn journal corrupted: execution binding for node '${event.id}' precedes materialization in tree '${this.root}'`);
@@ -9703,29 +9763,37 @@ var SpawnEventIndex = class {
 	/** Called only after validation and, for the file writer, a successful durable append. */
 	add(event) {
 		if (!outsideCursorNamespace(event)) this.cursors.add(event.seq);
-		if (event.kind !== "spawned" && event.kind !== "materialized" && event.kind !== "execution-bound" && event.kind !== "execution-input" && event.kind !== "execution-admitted" && event.kind !== "execution-result" && event.kind !== "environment-teardown" && !closesCursorSlot(event)) return;
+		if (event.kind !== "spawned" && event.kind !== "materialized" && event.kind !== "seat-materialized" && event.kind !== "execution-bound" && event.kind !== "execution-input" && event.kind !== "execution-admitted" && event.kind !== "execution-result" && event.kind !== "environment-teardown" && event.kind !== "environment-terminal" && !closesCursorSlot(event)) return;
 		let node = this.nodes.get(event.id);
 		if (!node) {
 			node = {
 				spawned: false,
 				closed: false,
 				materialized: false,
+				latestSeatMaterialization: 0,
 				bindings: /* @__PURE__ */ new Set(),
 				inputs: /* @__PURE__ */ new Set(),
 				input: false,
 				result: false,
 				admissions: /* @__PURE__ */ new Map(),
-				destroyedEnvironments: /* @__PURE__ */ new Set()
+				unusableEnvironments: /* @__PURE__ */ new Set()
 			};
 			this.nodes.set(event.id, node);
 		}
 		if (event.kind === "environment-teardown") {
-			if (event.destroyed) node.destroyedEnvironments.add(event.environmentId);
+			if (event.destroyed) node.unusableEnvironments.add(event.environmentId);
+			return;
+		}
+		if (event.kind === "environment-terminal") {
+			node.unusableEnvironments.add(event.environmentId);
 			return;
 		}
 		if (event.kind === "execution-admitted" && event.admission.phase === "environment") node.lastEnvironmentId = event.admission.environmentId;
 		if (event.kind === "spawned") node.spawned = true;
-		else if (event.kind === "materialized") node.materialized = true;
+		else if (event.kind === "materialized") {
+			node.materialized = true;
+			node.authoredProfileDigest = event.receipt.authoredProfileDigest;
+		} else if (event.kind === "seat-materialized") node.latestSeatMaterialization = event.segmentIndex;
 		else if (event.kind === "execution-bound") node.bindings.add(event.binding.attemptId);
 		else if (event.kind === "execution-input") {
 			node.inputs.add(event.seq);
@@ -9748,7 +9816,7 @@ var SpawnEventIndex = class {
 			if (node.inputs.has(event.seq)) fail("has duplicate input sequence");
 			const environment = node.admissions.get("environment");
 			const ranIn = environment?.phase === "environment" ? environment.environmentId : node.lastEnvironmentId;
-			const abandoned = ranIn !== void 0 && node.destroyedEnvironments.has(ranIn);
+			const abandoned = ranIn !== void 0 && node.unusableEnvironments.has(ranIn);
 			if (node.input && !node.result && !abandoned) fail("input replaces an unfinished invocation");
 			return;
 		}
@@ -9810,6 +9878,7 @@ const outsideKinds = /* @__PURE__ */ new Set([
 	"teardown-pending",
 	"teardown-confirmed",
 	"environment-teardown",
+	"environment-terminal",
 	"workspace-checkpoint-requested",
 	"workspace-checkpoint",
 	"workspace-checkpoint-fork-requested",
@@ -9819,6 +9888,9 @@ const outsideKinds = /* @__PURE__ */ new Set([
 	"workspace-restored",
 	"workspace-capture",
 	"trace-unpropagated",
+	"seat-segment",
+	"seat-materialized",
+	"seat-paused",
 	"paused",
 	"driver-attempt",
 	"node-inputs-resolved",
@@ -9889,6 +9961,7 @@ async function replaySpawnTree(journal, blobs, root) {
 		if (ev.kind === "teardown-unconfirmed") continue;
 		if (ev.kind === "teardown-pending" || ev.kind === "teardown-confirmed") continue;
 		if (ev.kind === "environment-teardown") continue;
+		if (ev.kind === "environment-terminal") continue;
 		if (ev.kind === "workspace-checkpoint-requested") continue;
 		if (ev.kind === "workspace-checkpoint") continue;
 		if (ev.kind === "workspace-checkpoint-fork-requested") continue;
@@ -9898,6 +9971,7 @@ async function replaySpawnTree(journal, blobs, root) {
 		if (ev.kind === "workspace-restored") continue;
 		if (ev.kind === "workspace-capture") continue;
 		if (ev.kind === "trace-unpropagated") continue;
+		if (ev.kind === "seat-segment" || ev.kind === "seat-materialized" || ev.kind === "seat-paused") continue;
 		if (ev.kind === "paused") continue;
 		if (ev.kind === "driver-attempt") continue;
 		if (ev.kind === "node-inputs-resolved") continue;
@@ -10049,7 +10123,7 @@ function materializeTreeView(events) {
 		if (Number.isFinite(settledAt)) node.settledAt = settledAt;
 	}
 	for (const ev of events) {
-		if (ev.kind !== "materialized") continue;
+		if (ev.kind !== "materialized" && ev.kind !== "seat-materialized") continue;
 		const node = requireNode(nodes, ev.id);
 		node.materialization = ev.receipt;
 		node.runtime = ev.receipt.runtime;
@@ -10930,6 +11004,7 @@ function createProviderExecutor(provider, profile, ctx, options, placement) {
 		if (workspaceSnapshot !== void 0) return workspaceSnapshot;
 		if (workspaceCapturePromise === void 0) {
 			workspaceOutcome = outcome;
+			stopLiveMirror();
 			if (nativeTimer !== void 0) clearTimeout(nativeTimer);
 			nativeTimer = void 0;
 			const captureContext = {
@@ -10945,7 +11020,7 @@ function createProviderExecutor(provider, profile, ctx, options, placement) {
 			const reportTiming = retention?.onWorkspaceCapture;
 			let timing;
 			const capturedExecutionId = workspaceExecutionId;
-			workspaceCapturePromise = (nativeInFlight ?? Promise.resolve()).then(() => captureProviderWorkspaceSnapshot(workspaceRetention, captureContext, "environment", reportTiming === void 0 ? void 0 : (measured) => {
+			workspaceCapturePromise = Promise.all([nativeInFlight, liveInFlight]).then(() => captureProviderWorkspaceSnapshot(workspaceRetention, captureContext, "environment", reportTiming === void 0 ? void 0 : (measured) => {
 				timing = measured;
 			})).finally(async () => {
 				if (timing === void 0 || reportTiming === void 0) return;
@@ -10998,6 +11073,38 @@ function createProviderExecutor(provider, profile, ctx, options, placement) {
 	const nativePort = options.workspaceRetention?.captureNative === void 0 ? void 0 : options.workspaceRetention;
 	let nativeInFlight;
 	let nativeTimer;
+	const livePort = options.workspaceRetention?.captureLive === void 0 ? void 0 : options.workspaceRetention;
+	let liveInFlight;
+	let liveTimer;
+	const stopLiveMirror = () => {
+		if (liveTimer !== void 0) clearTimeout(liveTimer);
+		liveTimer = void 0;
+	};
+	const startLiveMirror = (next) => {
+		if (livePort?.liveIntervalMs === void 0) return;
+		stopLiveMirror();
+		const schedule = () => {
+			liveTimer = setTimeout(() => {
+				if (liveInFlight === void 0 && workspaceCapturePromise === void 0) {
+					const tracked = captureProviderLiveWorkspace(livePort, {
+						environment: next,
+						executionId: workspaceExecutionId,
+						...workspaceControlRef === void 0 ? {} : { controlRef: workspaceControlRef },
+						...node === void 0 ? {} : { node },
+						providerSessionId,
+						nativeSessionId: null,
+						profile: createProfile
+					}).then(() => void 0, () => void 0).finally(() => {
+						if (liveInFlight === tracked) liveInFlight = void 0;
+					});
+					liveInFlight = tracked;
+				}
+				schedule();
+			}, livePort.liveIntervalMs);
+			liveTimer.unref?.();
+		};
+		schedule();
+	};
 	let nativeHoldsTranscript = false;
 	const stopNativeMirror = async () => {
 		if (nativeTimer !== void 0) clearTimeout(nativeTimer);
@@ -11052,6 +11159,7 @@ function createProviderExecutor(provider, profile, ctx, options, placement) {
 		return tracked;
 	};
 	const startNativeMirror = (next) => {
+		startLiveMirror(next);
 		if (nativePort === void 0) return;
 		if (nativeTimer !== void 0) clearTimeout(nativeTimer);
 		const interval = nativePort.nativeIntervalMs ?? 12e4;
@@ -11699,6 +11807,7 @@ async function* streamProviderExecutor(args) {
 			handCaptureToOwner(settledResult, outcome, true);
 		}
 	} catch (error) {
+		yield* creditUsage(usageLedger.settleTurn(args.profile.name ?? "agent"));
 		failure = source.retained ? new RetainedExecutionPendingError(error) : error;
 		failed = true;
 		if (args.options.workspaceRetention !== void 0) args.onUnsettledFailure();
@@ -20886,487 +20995,1134 @@ function singleShotDriver(maxIterations) {
 	};
 }
 //#endregion
-//#region src/runtime/supervise/dispatch.ts
+//#region src/runtime/supervise/continuation.ts
 /**
+* The continuation: what a manager with a completion check is told when its turn ends and the
+* check is unmet, and the one rule that decides whether it is sent back.
 *
-* `rollingDispatch` — the REFILLING dispatch policy over a `Scope`. It keeps `width` children in
-* flight and admits the next queued unit of work the instant one settles, instead of waiting for
-* a whole round to drain (`fanout`) or for a driver to decide again (`spawn → await → spawn`).
-*
-* The gap it closes: `fanout` opens every item at once and then drains — one round, no refill —
-* and a driver brain's manual loop opens one worker per model turn. Between those two there was
-* nothing that holds N slots full, which is why a 5-worker run can peak at 2 live workers and sit
-* ~50% idle. This is a policy over the EXISTING `Scope.spawn` / `Scope.next` primitives: it adds
-* no second admission path, so the conserved budget pool stays the only fence on total work and
-* `width` is only a fence on simultaneous work.
-*
-* Fail-closed by construction: an admission rejection (`budget-exhausted` / `depth-exceeded`) is
-* recorded and STOPS further admission — the loop then drains what is already live and returns.
-* It never retries a rejected spawn against the same pool, and it never spawns past `width`.
-*
-* ── Concurrency ────────────────────────────────────────────────────────────────────────────────
-*
-* `width` bounds the children THIS dispatcher holds in flight. The tree-wide bound on working
-* agents is `SuperviseOptions.workerSlots` (`./worker-slots`): a spawn past it is queued by the
-* scope, not refused, so a `width` above the free slots only lengthens the allocator's queue.
-* `SandboxLineage`'s fork concurrency bounds boxes inside ONE leaf's fork wave, a different unit.
+* Measured on discovery-lab before this module (2026-09-24, 670 settled runs, 1,596 re-entries):
+* 1,565 re-entries followed a failed turn and resent the original task, and 31 carried note text.
+* The note Runtime wrote itself held seven fixed lines and no field for the check's verdict. Of 40
+* episodes where the director ended on its own and the outside check disagreed, 33 were told
+* nothing before they ended. 100 of 236 resubmits sent the identical packet. So the director
+* mostly graded itself, and when it was wrong it heard nothing it could use.
 *
-* ── Why this is not a copy of the kernel's batch loop ──────────────────────────────────────────
+* The design (discovery `docs/38-one-loop-and-continuation.md`) makes three things single, and
+* this module holds the part Runtime owns:
 *
-* `runBatch` (`src/runtime/run-loop.ts`) runs the same hold-N-slots-full shape over the KERNEL's
-* substrate: bare promises in a `Set`, raced with `Promise.race`, bounded by `maxConcurrency`.
-* This one runs it over the SUPERVISOR's substrate — `Scope.spawn`'s atomic reservation against
-* the conserved pool, `Scope.next`'s journaled settlement cursor, and the blob store behind each
-* result. Neither can be expressed in the other's terms without dragging its whole substrate
-* along: the kernel loop has no budget to reserve and no cursor to order settlements by, and this
-* one cannot race raw promises because a settlement is only real once it is journaled. The shape
-* repeating across the two deliberate layers is resonance, not duplication — do not "unify" them
-* into a shared helper that would have to know about both.
+*  - ONE CHECK. A check reading is a {@link CheckVerdict}: pass, the items it read, the composite,
+*    and one `FAIL <item> <where>: <reason>` line per failed item. The same check decides
+*    `submit_result`, runs when a turn ends without an accepted result, scores the finished run,
+*    and ranks versions. A check that could not run gives no verdict ({@link CheckUnavailableError}),
+*    and the loop pauses instead of blaming the director.
+*  - ONE RESEND RULE. {@link ContinuationPolicy} is required for a manager with a check. It holds a
+*    deadline and `maxBarren`, the re-entered turns in a row that may end without progress. There
+*    is no re-prompt count and no default: a retry default in source is a research decision.
+*  - ONE NOTE. {@link composeContinuationNote} writes it. Runtime owns the facts and their order;
+*    the {@link ContinuationProfile} owns every instruction word, so an optimizer can change the
+*    words without touching code. A play may append a section, never remove or rewrite one.
 *
-* @experimental
+* Evidence behind the note's shape: located errors help (given the first mistake's true location,
+* fix rates rose 23.5 to 43.9 points, Tyen 2023); unsupported pressure does not (threats and tips
+* had no significant effect, Wharton 2025; challenges without evidence flipped correct answers,
+* FlipFlop); repeated summaries drop detail while itemized additions do not (ACE). So the note is
+* a list of located facts, findings are added and marked resolved rather than rewritten, and the
+* profile, not this file, decides how blunt the words are.
 */
 /**
-* Run the refilling dispatch loop over `scope` until the queue is dry (or a stop fires) and every
-* admitted child has settled. Returns the settlements in cursor order plus the admission ledger.
-*
-* The loop is: fill free slots from `nextUnit` → `await scope.next()` → deliver the settlement →
-* refill → repeat. Because the refill happens immediately after each settlement rather than after
-* a whole round, a slow child never idles the other slots.
+* The check could not run: its box did not start, its judge's provider refused, its program
+* crashed. It is not a verdict on the result. Inside a run the loop pauses, as it does for an
+* unavailable upstream, and the refusal tells the director its result was not judged.
 */
-async function rollingDispatch(scope, opts) {
-	if (!Number.isInteger(opts.width) || opts.width < 1) throw new ValidationError$1(`rollingDispatch: width must be a positive integer, got ${String(opts.width)}`);
-	const settled = [];
-	const rejected = [];
-	const live = /* @__PURE__ */ new Set();
-	let admitted = 0;
-	let peakLive = 0;
-	let queueDry = false;
-	let stopReason = "drained";
-	const fill = async () => {
-		while (live.size < opts.width) {
-			if (queueDry) return;
-			if (scope.signal.aborted) {
-				stopReason = "aborted";
-				queueDry = true;
-				return;
-			}
-			if (opts.shouldStop?.() === true) {
-				stopReason = "stopped";
-				queueDry = true;
-				return;
-			}
-			const unit = await opts.nextUnit();
-			if (unit === void 0) {
-				queueDry = true;
-				return;
-			}
-			const res = scope.spawn(unit.agent, unit.task, unit.opts);
-			if (!res.ok) {
-				rejected.push(`${unit.opts.label}: ${res.reason}`);
-				stopReason = "not-admitted";
-				queueDry = true;
-				return;
-			}
-			live.add(res.handle.id);
-			admitted += 1;
-			if (live.size > peakLive) peakLive = live.size;
-		}
-	};
-	await fill();
-	while (live.size > 0) {
-		const s = await scope.next();
-		if (s === null) break;
-		live.delete(s.handle.id);
-		settled.push(s);
-		await opts.onSettled?.(s);
-		await fill();
+var CheckUnavailableError = class extends Error {
+	constructor(message, options) {
+		super(message, options);
+		this.name = "CheckUnavailableError";
 	}
-	return {
-		settled,
-		admitted,
-		rejected,
-		stopReason,
-		peakLive
-	};
+};
+/** Read a check function's return value into a verdict. Anything but `true` or a passing verdict
+*  is a failure: a check fails closed. */
+function checkVerdictOf(outcome) {
+	if (outcome === true) return { pass: true };
+	if (typeof outcome !== "object" || outcome === null || Array.isArray(outcome)) return { pass: false };
+	const raw = outcome;
+	const items = typeof raw.items === "object" && raw.items !== null && !Array.isArray(raw.items) ? Object.fromEntries(Object.entries(raw.items).filter((entry) => typeof entry[1] === "number" && Number.isFinite(entry[1]))) : void 0;
+	const failures = Array.isArray(raw.failures) ? raw.failures.filter((line) => typeof line === "string" && line.trim() !== "") : void 0;
+	return Object.freeze({
+		pass: raw.pass === true,
+		...items === void 0 ? {} : { items: Object.freeze(items) },
+		...finite(raw.composite) ? { composite: raw.composite } : {},
+		...finite(raw.threshold) ? { threshold: raw.threshold } : {},
+		...failures === void 0 ? {} : { failures: Object.freeze(failures) },
+		...typeof raw.review === "string" && raw.review.trim() !== "" ? { review: raw.review.trim() } : {}
+	});
 }
 /**
-* Free worker slots under a simultaneity cap: `cap - live`, floored at 0, or `null` when there is
-* no cap (the conserved pool is then the only fence and "free slots" is not a finite number).
-* The one place the answer is computed, so the driver-facing tool payload and a dispatcher agree.
+* Read an agent-eval `JudgeScore` from a check program into a verdict.
+*
+* Each dimension is a checked item. `notes` lines that start with `FAIL ` are the failures; the
+* remaining lines are the check's review. The verdict passes when `composite >= threshold` and the
+* score is not marked `failed`; a `failed` score means the judge itself did not run, which is
+* {@link CheckUnavailableError}, not a verdict.
 */
-function freeSlots(liveCount, cap) {
-	if (cap === void 0 || cap <= 0) return null;
-	return Math.max(0, cap - liveCount);
-}
-/** Convenience: a `DispatchUnit` factory over a fixed array of tasks, for the common case where
-*  the queue is known up front and only the refill behavior is wanted. */
-function queueOf(units, budget) {
-	let i = 0;
-	return () => {
-		const u = units[i];
-		if (u === void 0) return void 0;
-		i += 1;
-		return {
-			agent: u.agent,
-			task: u.task,
-			opts: {
-				budget,
-				label: u.label
-			}
-		};
-	};
-}
-//#endregion
-//#region src/runtime/retained-interactive-handle.ts
-function createRetainedInteractiveRunHandle(environment, inputRef, capabilities, requestedStart) {
-	const ref = freezeInteractiveRef(inputRef);
-	const source = environment.interactive(ref);
-	if (!sameInteractiveRef(source.ref, ref)) throw new Error("provider reconstructed a different interactive process");
-	if (!source.sendPrompt) throw new Error("provider declared interactive prompt support but exposed no prompt method");
-	return Object.freeze({
-		ref,
-		capabilities,
-		claimControl: async (request, options) => exactClaim(ref, request, await awaitAbortable$1(Promise.resolve().then(() => source.claimControl(request, options)), options?.signal)),
-		status: async (options) => exactStatus(ref, await awaitAbortable$1(Promise.resolve().then(() => source.status(options)), options?.signal), requestedStart),
-		attach: async (request, options) => exactTerminal(ref, request, await awaitAbortable$1(Promise.resolve().then(() => source.attach(request, options)), options?.signal)),
-		sendPrompt: async (command, options) => exactPrompt(ref, await awaitAbortable$1(Promise.resolve().then(() => source.sendPrompt(command, options)), options?.signal), command),
-		stop: async (command, options) => exactStop(ref, await awaitAbortable$1(Promise.resolve().then(() => source.stop(command, options)), options?.signal), command)
+function verdictFromJudgeScore(score, threshold) {
+	if (score.failed === true) throw new CheckUnavailableError(`the check's judge did not run: ${score.notes}`);
+	const lines = score.notes.split("\n").map((line) => line.trimEnd());
+	const failures = lines.filter((line) => line.startsWith("FAIL "));
+	const review = lines.filter((line) => !line.startsWith("FAIL ") && line.trim() !== "").join("\n");
+	return checkVerdictOf({
+		pass: score.composite >= threshold,
+		items: score.dimensions,
+		composite: score.composite,
+		threshold,
+		failures,
+		...review === "" ? {} : { review }
 	});
 }
-function freezeInteractiveRef(value) {
-	return detachedSnapshot(AgentInteractiveSessionRefSchema.parse(value), "interactive session ref");
+/** Items that fail in `verdict`: every item below 1, or the named items of its FAIL lines. */
+function failedItems(verdict) {
+	if (verdict.items !== void 0) return Object.entries(verdict.items).filter(([, value]) => value < 1).map(([name]) => name);
+	return (verdict.failures ?? []).map((line) => line.slice(5).split(/[\s:]/u)[0] ?? "");
 }
-function exactClaim(ref, request, value) {
-	const acknowledgement = parseProviderAcknowledgement(AgentInteractiveSessionControlClaimAcknowledgementSchema, value, "control claim");
-	if (!agentInteractiveSessionControlClaimAcknowledgementMatchesRequest(request, acknowledgement)) throw new RetainedRunProviderContractError("provider returned a control claim acknowledgement for another request");
-	if (acknowledgement.control && !agentInteractiveSessionControlClaimMatchesRef(ref, acknowledgement.control)) throw new RetainedRunProviderContractError("provider returned a control claim for another interactive process");
-	return acknowledgement;
+/** Items that pass in `verdict`. */
+function passedItems(verdict) {
+	return Object.entries(verdict.items ?? {}).filter(([, value]) => value >= 1).map(([name]) => name);
 }
-function exactPrompt(ref, value, command) {
-	const acknowledgement = parseProviderAcknowledgement(AgentInteractiveSessionPromptAcknowledgementSchema, value, "prompt");
-	if (!agentInteractiveSessionPromptAcknowledgementMatchesCommand(command, acknowledgement)) throw new RetainedRunProviderContractError("provider returned a prompt acknowledgement for another request");
-	if (!agentInteractiveSessionControlClaimMatchesRef(ref, acknowledgement.control)) throw new RetainedRunProviderContractError("provider returned a prompt acknowledgement for another interactive process");
-	return acknowledgement;
-}
-function exactStop(ref, value, command) {
-	const acknowledgement = parseProviderAcknowledgement(AgentInteractiveSessionStopAcknowledgementSchema, value, "stop");
-	if (!agentInteractiveSessionStopAcknowledgementMatchesCommand(command, acknowledgement)) throw new RetainedRunProviderContractError("provider returned a stop acknowledgement for another request");
-	if (!agentInteractiveSessionControlClaimMatchesRef(ref, acknowledgement.control)) throw new RetainedRunProviderContractError("provider returned a stop acknowledgement for another interactive process");
-	return acknowledgement;
-}
-function parseProviderAcknowledgement(schema, value, operation) {
-	try {
-		return schema.parse(value);
-	} catch {
-		throw new RetainedRunProviderContractError(`provider returned an invalid interactive ${operation} acknowledgement`);
+/** Resolve and check a policy before any compute. Returns the deadline in epoch ms. */
+function admitContinuationPolicy(policy, context) {
+	if (typeof policy !== "object" || policy === null) throw new ValidationError$1(`${context}: continuation must be an object`);
+	const deadlineMs = typeof policy.deadline === "string" ? Date.parse(policy.deadline) : policy.deadline;
+	if (typeof deadlineMs !== "number" || !Number.isFinite(deadlineMs) || deadlineMs <= 0) throw new ValidationError$1(`${context}: continuation.deadline must be a finite time (epoch ms or ISO 8601)`);
+	if (!Number.isInteger(policy.maxBarren) || policy.maxBarren < 1) throw new ValidationError$1(`${context}: continuation.maxBarren must be an integer >= 1`);
+	if (policy.failures !== "verbatim" && policy.failures !== "off") throw new ValidationError$1(`${context}: continuation.failures must be 'verbatim' or 'off'`);
+	if (policy.panel !== "on" && policy.panel !== "off") throw new ValidationError$1(`${context}: continuation.panel must be 'on' or 'off'`);
+	if (policy.bar !== "on" && policy.bar !== "off") throw new ValidationError$1(`${context}: continuation.bar must be 'on' or 'off'`);
+	if (policy.panel === "on") {
+		if (typeof policy.runPanel !== "function") throw new ValidationError$1(`${context}: continuation.panel 'on' needs runPanel`);
+		const usd = policy.panelUsd;
+		if (usd === void 0 || !finite(usd.perContinuation) || !finite(usd.perRun) || usd.perContinuation <= 0 || usd.perRun < usd.perContinuation) throw new ValidationError$1(`${context}: continuation.panel 'on' needs panelUsd with 0 < perContinuation <= perRun`);
 	}
+	if (policy.append !== void 0 && typeof policy.append !== "function") throw new ValidationError$1(`${context}: continuation.append must be a function`);
+	admitContinuationProfile(policy.profile, context);
+	return deadlineMs;
 }
-function exactStatus(ref, value, requestedStart) {
-	let status;
-	try {
-		status = AgentInteractiveSessionStatusSchema.parse(value);
-	} catch (error) {
-		if (requestedStart === void 0) throw error;
-		throw new RetainedInteractiveBindingError(detachedSnapshot(requestedStart, "interactive status binding request"), {}, { cause: error });
+/** The facts a profile template may name. */
+const CONTINUATION_FACTS = [
+	"composite",
+	"threshold",
+	"failed",
+	"total",
+	"reads",
+	"owed",
+	"settled",
+	"delivered",
+	"continuation"
+];
+const factNames = new Set(CONTINUATION_FACTS);
+const placeholder = /\{([a-zA-Z]+)\}/gu;
+function admitContinuationProfile(profile, context) {
+	if (typeof profile !== "object" || profile === null) throw new ValidationError$1(`${context}: continuation.profile must be an object`);
+	if (typeof profile.id !== "string" || profile.id.trim() === "") throw new ValidationError$1(`${context}: continuation.profile.id must be non-empty`);
+	const texts = [
+		["opening", profile.opening],
+		["plan", profile.plan],
+		["rules", profile.rules],
+		...Object.entries(profile.headings ?? {}).map(([key, value]) => [`headings.${key}`, value]),
+		...profile.barRule === void 0 ? [] : [["barRule", profile.barRule]]
+	];
+	for (const key of [
+		"failures",
+		"protected",
+		"changed",
+		"findings",
+		"bar",
+		"plan",
+		"rules"
+	]) if (typeof profile.headings?.[key] !== "string") throw new ValidationError$1(`${context}: continuation.profile.headings.${key} must be a string`);
+	for (const [key, text] of texts) {
+		if (typeof text !== "string") throw new ValidationError$1(`${context}: continuation.profile.${key} must be a string`);
+		for (const match of text.matchAll(placeholder)) if (!factNames.has(match[1] ?? "")) throw new ValidationError$1(`${context}: continuation.profile.${key} names {${match[1]}}, which is not a fact Runtime supplies (${CONTINUATION_FACTS.join(", ")})`);
 	}
-	if (!agentInteractiveSessionStatusMatchesRef(ref, status)) {
-		if (requestedStart !== void 0) throw new RetainedInteractiveBindingError(detachedSnapshot(requestedStart, "interactive status binding request"), detachedSnapshot({ status: detachedSnapshot(status, "interactive provider status") }, "interactive provider status result"), { cause: /* @__PURE__ */ new Error("provider returned status for another interactive process") });
-		throw new Error("provider returned status for another interactive process");
+	if (profile.review !== void 0) {
+		if (typeof profile.review !== "string" || profile.review.trim() === "") throw new ValidationError$1(`${context}: continuation.profile.review must be non-empty`);
+		for (const match of profile.review.matchAll(placeholder)) if (![
+			"version",
+			"path",
+			"score"
+		].includes(match[1] ?? "")) throw new ValidationError$1(`${context}: continuation.profile.review names {${match[1]}}; it may name {version}, {path} and {score}`);
 	}
-	return status;
-}
-function exactTerminal(ref, request, terminal) {
-	const terminalRef = TerminalSessionRefSchema.parse(terminal.ref);
-	TerminalReplayWindowSchema.parse(terminal.cursors);
-	if (terminalRef.parentExecutionId !== ref.run.executionId) throw new Error("provider attached a terminal from another interactive run");
-	AgentInteractiveSessionControlClaimSchema.parse(terminal.control);
-	if (!agentInteractiveSessionControlClaimMatchesRef(ref, terminal.control)) throw new Error("provider attached a terminal with a claim for another interactive process");
-	if (canonicalCandidateDigest(terminal.control) !== canonicalCandidateDigest(request.control)) throw new Error("provider attached a terminal with a different interactive control claim");
-	return terminal;
-}
-function sameInteractiveRef(left, right) {
-	return canonicalCandidateDigest(left) === canonicalCandidateDigest(right);
+	if (profile.opening.trim() === "") throw new ValidationError$1(`${context}: continuation.profile.opening must be non-empty`);
+	for (const [index, question] of (profile.questions ?? []).entries()) if (typeof question !== "string" || question.trim() === "") throw new ValidationError$1(`${context}: continuation.profile.questions[${index}] must be a non-empty string`);
 }
-//#endregion
-//#region src/runtime/retained-interactive.ts
-/**
-* Start one retry-safe native coding-agent TUI without dispatching a headless turn.
-* The intent admission is durable before provider.create; the environment and
-* process admissions follow only after their exact provider coordinates exist.
-* @stable
-*/
-async function startRetainedInteractiveRun(options) {
-	options.signal?.throwIfAborted();
-	const startOptions = options;
-	assertStableText(startOptions.environment.idempotencyKey, "environment idempotency key");
-	assertStableText(startOptions.interactiveIdempotencyKey, "interactive idempotency key");
-	if (typeof startOptions.onAdmission !== "function") throw new Error("startRetainedInteractiveRun requires an awaited onAdmission durability hook");
-	if (!startOptions.provider.get) throw new Error(`provider "${startOptions.provider.name}" cannot reconstruct an environment by id`);
-	const profile = agentProfileSchema.parse(startOptions.environment.profile);
-	if (profile.harness === void 0) throw new Error("retained interactive runs require AgentProfile.harness");
-	const requestedProfileDigest = canonicalAgentProfileDigest(profile);
-	const identity = startOptions.intent === void 0 ? mintRetainedIdentity(startOptions.environment.idempotencyKey, startOptions.interactiveIdempotencyKey) : {
-		sessionId: startOptions.intent.sessionId,
-		executionId: startOptions.intent.executionId
-	};
-	assertStableText(identity.sessionId, "retained session id");
-	assertStableText(identity.executionId, "retained execution id");
-	const intent = interactiveIntent(startOptions, profile, identity);
-	if (startOptions.intent === void 0) await admitDurably(startOptions.onAdmission, intent);
-	else assertExactInteractiveIntent(startOptions.intent, intent);
-	const providerCapabilities = AgentEnvironmentCapabilitiesSchema.parse(await awaitAbortable$1(Promise.resolve().then(() => startOptions.provider.capabilities()), startOptions.signal));
-	assertInteractiveCapabilities(startOptions.provider.name, providerCapabilities);
-	const environment = await createInteractiveEnvironment(() => startOptions.provider.create({
-		...startOptions.environment,
-		profile,
-		signal: startOptions.signal,
-		metadata: retainedEnvironmentMetadata(startOptions.environment.metadata, startOptions.environment.idempotencyKey)
-	}), startOptions.signal);
-	let capabilities;
-	try {
-		assertExactEnvironment(startOptions.provider.name, environment);
-		startOptions.signal?.throwIfAborted();
-		capabilities = interactiveCapabilitiesForEnvironment(startOptions.provider.name, providerCapabilities, environment);
-		assertInteractiveMethods(startOptions.provider.name, environment);
-	} catch (error) {
-		await destroyUnusedEnvironment(environment, error);
-		throw error;
-	}
-	const request = interactiveRequest(startOptions, environment, profile, requestedProfileDigest, identity);
-	await admitDurably(startOptions.onAdmission, {
-		phase: "interactive_environment",
-		provider: startOptions.provider.name,
-		environmentId: environment.id,
-		idempotencyKey: startOptions.environment.idempotencyKey,
-		interactiveIdempotencyKey: startOptions.interactiveIdempotencyKey,
-		request
-	});
-	const ref = exactStartedRef(request, await startInteractiveProcess(environment, () => environment.startInteractive(request, { signal: startOptions.signal }), startOptions.signal));
-	await admitDurably(startOptions.onAdmission, {
-		phase: "interactive_started",
-		idempotencyKey: startOptions.environment.idempotencyKey,
-		interactiveIdempotencyKey: startOptions.interactiveIdempotencyKey,
-		ref
-	});
-	return createRetainedInteractiveRunHandle(environment, ref, capabilities, request);
+/** Findings reach the note only when every citation resolves, at least two distinct spans are
+*  cited, and the independent verifier agreed. The best method in Who&When found the failing step
+*  14.2% of the time, so an unverified finding is noise with a citation. */
+function admitFinding(finding) {
+	if (!finding.verified) return false;
+	if (finding.citations.length === 0) return false;
+	if (!finding.citations.every((citation) => citation.resolved)) return false;
+	return new Set(finding.citations.map((citation) => citation.uri)).size >= 2;
 }
+/** About 1,500 tokens of findings. */
+const FINDINGS_CHAR_CAP = 6e3;
 /**
-* Retry one exact start after its provider response may have been lost.
-*
-* Resolves to the handle of the admitted process (resumed through the exact,
-* idempotent start request), or `null` when the provider no longer holds the
-* environment (not found; nothing remains to stop). @stable
+* Rank the admitted findings by how many failed items they explain, drop repeats, and keep them
+* within the note's cap. Earlier findings stay as they were written (ACE: itemized additions keep
+* detail that repeated rewrites lose); a finding whose items all pass now is marked resolved.
 */
-async function recoverRetainedInteractiveRun(options) {
-	options.signal?.throwIfAborted();
-	if (typeof options.onAdmission !== "function") throw new Error("recoverRetainedInteractiveRun requires an awaited onAdmission durability hook");
-	const admission = options.admission;
-	if (admission.provider !== options.provider.name) throw new Error("interactive admission belongs to another provider");
-	if (admission.phase === "interactive_intent") {
-		if (options.replay === void 0) throw new Error("recoverRetainedInteractiveRun requires the original start material for an interactive intent");
-		return startRetainedInteractiveRun({
-			provider: options.provider,
-			...options.replay,
-			intent: admission,
-			onAdmission: options.onAdmission,
-			signal: options.signal
+function distillFindings(prior, proposed, failing, continuation) {
+	const key = (claim) => claim.toLowerCase().replace(/\s+/gu, " ").trim();
+	const known = new Set(prior.map((finding) => key(finding.claim)));
+	const carried = prior.map((finding) => finding.resolvedAt === void 0 && (finding.items?.length ?? 0) > 0 && (finding.items ?? []).every((item) => !failing.has(item)) ? {
+		...finding,
+		resolvedAt: continuation
+	} : finding);
+	const fresh = proposed.filter(admitFinding).filter((finding) => {
+		const k = key(finding.claim);
+		if (known.has(k)) return false;
+		known.add(k);
+		return true;
+	}).map((finding) => ({
+		finding,
+		links: (finding.items ?? []).filter((item) => failing.has(item)).length
+	})).sort((a, b) => b.links - a.links);
+	const out = [...carried];
+	let used = carried.filter((finding) => finding.resolvedAt === void 0).reduce((sum, finding) => sum + finding.claim.length, 0);
+	for (const { finding } of fresh) {
+		if (used + finding.claim.length > FINDINGS_CHAR_CAP) break;
+		used += finding.claim.length;
+		out.push({
+			...finding,
+			admittedAt: continuation
 		});
 	}
-	const request = exactRecoveryRequest(admission);
-	const { environment, capabilities } = await reconstructEnvironment(options.provider, admission.environmentId, options.signal);
-	if (!environment || !capabilities) return null;
-	const ref = exactStartedRef(request, await awaitAbortable$1(Promise.resolve().then(() => environment.startInteractive(request, { signal: options.signal })), options.signal));
-	await admitDurably(options.onAdmission, {
-		phase: "interactive_started",
-		idempotencyKey: admission.idempotencyKey,
-		interactiveIdempotencyKey: admission.interactiveIdempotencyKey,
-		ref
-	});
-	return createRetainedInteractiveRunHandle(environment, ref, capabilities, request);
+	return out;
 }
-function exactRecoveryRequest(admission) {
-	assertStableText(admission.environmentId, "interactive environment id");
-	assertStableText(admission.idempotencyKey, "environment idempotency key");
-	assertStableText(admission.interactiveIdempotencyKey, "interactive idempotency key");
-	const request = exactAgentInteractiveSessionStart(admission.request);
-	const identity = mintRetainedIdentity(admission.idempotencyKey, admission.interactiveIdempotencyKey);
-	if (request.run.provider !== admission.provider || request.run.environmentId !== admission.environmentId || (request.run.sessionId !== identity.sessionId || request.run.executionId !== identity.executionId) && !matchesHistoricalInteractiveIdentity(admission, request)) throw new Error("interactive admission does not match its recovery coordinates");
-	return request;
+/** Expand the profile's question templates over the failed items and the settled workers. */
+function expandQuestions(templates, failing, workers) {
+	const out = [];
+	for (const template of templates) {
+		const hasItem = template.includes("{item}");
+		const hasWorker = template.includes("{worker}");
+		if (!hasItem && !hasWorker) {
+			out.push(template);
+			continue;
+		}
+		const items = hasItem ? failing : [""];
+		const each = hasWorker ? workers.map((worker) => `${worker.id} (${worker.label})`) : [""];
+		for (const item of items) for (const worker of each) out.push(template.replaceAll("{item}", item).replaceAll("{worker}", worker));
+	}
+	return out;
 }
-function matchesHistoricalInteractiveIdentity(admission, request) {
-	const base = `${encodeURIComponent(admission.idempotencyKey)}:${encodeURIComponent(admission.interactiveIdempotencyKey)}`;
-	const digest = canonicalCandidateDigest({
-		kind: "retained-identity.v1",
-		base
-	}).slice(7);
-	const historicalId = (prefix) => {
-		const readable = `${prefix}:${base}`;
-		return readable.length <= 128 ? readable : `${prefix}:${digest}`;
-	};
-	return request.run.sessionId === historicalId("retained-session") && request.run.executionId === historicalId("retained-execution");
-}
-/** Rebuild controls for one exact provider-owned coding-agent process. @stable */
-async function reconnectRetainedInteractiveRun(options) {
-	options.signal?.throwIfAborted();
-	const ref = AgentInteractiveSessionRefSchema.parse(options.ref);
-	if (ref.run.provider !== options.provider.name) throw new Error("interactive session reference belongs to another provider");
-	const { environment, capabilities } = await reconstructEnvironment(options.provider, ref.run.environmentId, options.signal);
-	if (!environment || !capabilities) return null;
-	const handle = createRetainedInteractiveRunHandle(environment, ref, capabilities);
-	await handle.status({ signal: options.signal });
-	return handle;
-}
-function interactiveRequest(options, environment, profile, requestedProfileDigest, identity) {
-	const start = {
-		profile,
-		requestedProfileDigest,
-		...options.initialPrompt === void 0 ? {} : { initialPrompt: options.initialPrompt },
-		...options.cwd === void 0 ? {} : { cwd: options.cwd },
-		...options.cols === void 0 ? {} : { cols: options.cols },
-		...options.rows === void 0 ? {} : { rows: options.rows }
-	};
-	return exactAgentInteractiveSessionStart({
-		run: agentInteractiveSessionRunRef({
-			provider: options.provider.name,
-			environmentId: environment.id,
-			...identity
-		}, start),
-		...start
-	});
-}
-function interactiveIntent(options, profile, identity) {
-	const requestedProfileDigest = canonicalAgentProfileDigest(profile);
-	const requestDigest = canonicalCandidateDigest({
-		kind: "retained-interactive-intent.v1",
-		provider: options.provider.name,
-		idempotencyKey: options.environment.idempotencyKey,
-		interactiveIdempotencyKey: options.interactiveIdempotencyKey,
-		sessionId: identity.sessionId,
-		executionId: identity.executionId,
-		requestedProfileDigest,
-		create: retainedCreateMaterial(options.environment),
-		start: sanitizedStartMaterial(options)
-	});
-	return {
-		phase: "interactive_intent",
-		provider: options.provider.name,
-		idempotencyKey: options.environment.idempotencyKey,
-		interactiveIdempotencyKey: options.interactiveIdempotencyKey,
-		sessionId: identity.sessionId,
-		executionId: identity.executionId,
-		runId: `interactive-intent-run:${requestDigest.slice(7)}`,
-		requestedProfileDigest,
-		requestDigest
+/**
+* Write one continuation note, sections 1 to 8 of docs/38. Section 9, the run's state, is
+* `composeReentryTask`, which wraps this text. Pure: the same input writes the same note.
+*/
+function composeContinuationNote(input) {
+	const { profile, verdict } = input;
+	const items = verdict?.items ?? {};
+	const total = Object.keys(items).length;
+	const failing = verdict === void 0 ? [] : failedItems(verdict);
+	const facts = {
+		composite: verdict?.composite === void 0 ? "unknown" : format(verdict.composite),
+		threshold: verdict?.threshold === void 0 ? "unknown" : format(verdict.threshold),
+		failed: verdict === void 0 || total === 0 && (verdict.failures?.length ?? 0) === 0 ? "unknown" : String(failing.length),
+		total: total === 0 ? "unknown" : String(total),
+		reads: String(input.reads),
+		owed: input.owed?.trim() || "not described",
+		settled: String(input.progress.settledCount),
+		delivered: String(input.progress.deliveredCount ?? 0),
+		continuation: String(input.continuation)
 	};
-}
-function sanitizedStartMaterial(options) {
-	return {
-		...options.initialPrompt === void 0 ? {} : { initialPrompt: options.initialPrompt },
-		...options.cwd === void 0 ? {} : { cwd: options.cwd },
-		...options.cols === void 0 ? {} : { cols: options.cols },
-		...options.rows === void 0 ? {} : { rows: options.rows }
+	const fill = (text) => text.replace(placeholder, (_, name) => facts[name] ?? `{${name}}`);
+	const sections = [verdict === void 0 ? "No check verdict is available yet." + (input.canSubmitResult === true ? " Submit a result through submit_result to request the check." : "") : verdict.pass ? "The check passes on the current state, but no result has been accepted." + (input.canSubmitResult === true ? " Call submit_result to request acceptance." : "") : fill(profile.opening).trim()];
+	const section = (heading, body) => {
+		if (body.length === 0) return;
+		sections.push([...heading.trim() === "" ? [] : [`## ${fill(heading)}`], ...body].join("\n"));
 	};
-}
-function assertExactInteractiveIntent(received, expected) {
-	if (canonicalCandidateDigest(parseInteractiveIntent(received)) !== canonicalCandidateDigest(expected)) throw new Error("interactive intent conflicts with replay material");
-}
-function parseInteractiveIntent(value) {
-	const stable = detachedSnapshot(value, "interactive intent");
-	if (stable === null || typeof stable !== "object" || Array.isArray(stable)) throw new Error("interactive intent is malformed");
-	const record = stable;
-	const allowed = /* @__PURE__ */ new Set([
-		"phase",
-		"provider",
-		"idempotencyKey",
-		"interactiveIdempotencyKey",
-		"sessionId",
-		"executionId",
-		"runId",
-		"requestedProfileDigest",
-		"requestDigest"
-	]);
-	if (Object.keys(record).some((key) => !allowed.has(key))) throw new Error("interactive intent contains unsupported material");
-	if (record.phase !== "interactive_intent") throw new Error("interactive intent has an invalid phase");
-	for (const [key, value] of Object.entries(record)) {
-		if (key === "phase") continue;
-		if (typeof value !== "string" || value.length === 0) throw new Error(`interactive intent field "${key}" is invalid`);
+	if (input.failures === "verbatim" && verdict !== void 0) {
+		const lines = verdict.failures ?? [];
+		const shown = lines.slice(0, 40);
+		const more = lines.length - shown.length;
+		section(profile.headings.failures, [...shown, ...more > 0 ? [input.canReadMore ? `${more} more failure lines: call read_continuation with continuation ${input.continuation}.` : `${more} more failure lines are not shown.`] : []]);
+		const passing = passedItems(verdict);
+		section(profile.headings.protected, passing.length === 0 ? [] : [passing.join(", ")]);
+		if (input.previous !== void 0) {
+			const before = new Set(failedItems(input.previous));
+			const now = new Set(failing);
+			const fixed = [...before].filter((item) => !now.has(item));
+			const broke = [...now].filter((item) => !before.has(item));
+			section(profile.headings.changed, [
+				...fixed.length === 0 ? [] : [`Now passing: ${fixed.join(", ")}.`],
+				...broke.length === 0 ? [] : [`Newly failing: ${broke.join(", ")}.`],
+				...fixed.length === 0 && broke.length === 0 ? ["No item changed since the last note."] : [],
+				...input.previous.composite !== void 0 && verdict.composite !== void 0 ? [`Composite: ${format(input.previous.composite)} then ${format(verdict.composite)}.`] : []
+			]);
+		}
 	}
-	assertDigest$1(record.requestedProfileDigest, "interactive intent profile digest");
-	assertDigest$1(record.requestDigest, "interactive intent request digest");
-	return stable;
-}
-function assertDigest$1(value, label) {
-	if (typeof value !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(value)) throw new Error(`${label} is invalid`);
+	if (input.findings !== void 0) {
+		const open = input.findings.filter((finding) => finding.resolvedAt === void 0);
+		const resolved = input.findings.filter((finding) => finding.resolvedAt === input.continuation);
+		section(profile.headings.findings, [...open.map((finding) => `- [hypothesis] ${finding.claim}` + (finding.items?.length ? ` (items: ${finding.items.join(", ")})` : "") + ` Evidence: ${finding.citations.map((citation) => citation.uri).join(", ")}`), ...resolved.map((finding) => `- [resolved] ${finding.claim}`)]);
+	}
+	if (input.bar !== void 0 && verdict !== void 0) {
+		const body = [];
+		if (profile.barRule?.trim()) body.push(fill(profile.barRule).trim());
+		for (const [item, value] of Object.entries(items)) {
+			const best = input.bar.best?.verdict.items?.[item];
+			body.push(`- ${item}: ${value >= 1 ? "passes" : `fails (${format(value)})`}` + (best === void 0 ? "" : ` / ${input.bar.best?.label}: ${best >= 1 ? "passes" : `fails (${format(best)})`}`));
+		}
+		if (input.bar.best?.verdict.composite !== void 0) body.push(`Best version ${input.bar.best.label}: composite ${format(input.bar.best.verdict.composite)}.`);
+		if (input.bar.reference?.trim()) body.push(`Reference result: ${input.bar.reference.trim()}`);
+		if (verdict.review?.trim()) body.push(`The check's review: ${verdict.review.trim()}`);
+		section(profile.headings.bar, body);
+	}
+	section(profile.headings.plan, profile.plan.trim() === "" ? [] : [fill(profile.plan).trim()]);
+	section(profile.headings.rules, [...profile.rules.trim() === "" ? [] : [fill(profile.rules).trim()], ...input.sealed ? ["The score comes from cases you cannot see."] : []]);
+	for (const appended of input.appended ?? []) section(appended.heading, appended.text.trim() === "" ? [] : [appended.text.trim()]);
+	return sections.join("\n\n");
 }
-async function reconstructEnvironment(provider, environmentId, signal) {
-	if (!provider.get) throw new Error(`provider "${provider.name}" cannot reconstruct an environment by id`);
-	const providerCapabilities = AgentEnvironmentCapabilitiesSchema.parse(await awaitAbortable$1(Promise.resolve().then(() => provider.capabilities()), signal));
-	assertInteractiveCapabilities(provider.name, providerCapabilities);
-	const environment = await awaitAbortable$1(Promise.resolve().then(() => provider.get(environmentId, { signal })), signal);
-	if (!environment) return {
-		environment: null,
-		capabilities: null
-	};
-	assertExactEnvironment(provider.name, environment, environmentId);
-	const capabilities = interactiveCapabilitiesForEnvironment(provider.name, providerCapabilities, environment);
-	assertInteractiveMethods(provider.name, environment);
+function summarizeVerdict(verdict) {
+	if (verdict === void 0) return null;
+	const total = Object.keys(verdict.items ?? {}).length;
 	return {
-		environment,
-		capabilities
+		pass: verdict.pass,
+		...verdict.composite === void 0 ? {} : { composite: verdict.composite },
+		...total === 0 ? {} : {
+			failed: failedItems(verdict).length,
+			total
+		}
 	};
 }
-function exactStartedRef(request, value) {
-	const stableRequest = detachedSnapshot(request, "interactive start binding request");
-	let ref;
-	try {
-		ref = AgentInteractiveSessionRefSchema.parse(value);
-	} catch (error) {
-		throw new RetainedInteractiveBindingError(stableRequest, {}, { cause: error });
-	}
-	if (!agentInteractiveSessionRefMatchesStart(request, ref)) throw new RetainedInteractiveBindingError(stableRequest, detachedSnapshot({ ref: detachedSnapshot(ref, "interactive provider start reference") }, "interactive provider start result"), { cause: /* @__PURE__ */ new Error("provider started another interactive run than requested") });
-	return freezeInteractiveRef(ref);
-}
-function assertExactEnvironment(providerName, environment, environmentId) {
-	if (environment.provider !== providerName || environmentId && environment.id !== environmentId) throw new Error("provider returned another interactive environment");
-	assertStableText(environment.id, "interactive environment id");
-}
-function interactiveCapabilitiesForEnvironment(providerName, providerCapabilities, environment) {
-	const capabilities = environment.capabilities === void 0 ? providerCapabilities : AgentEnvironmentCapabilitiesSchema.parse(environment.capabilities);
-	assertInteractiveCapabilities(providerName, capabilities);
-	return capabilities;
-}
-function assertInteractiveCapabilities(providerName, capabilities) {
-	const interactive = capabilities.interactiveAgent;
-	if (!interactive?.start || !interactive.control || !interactive.status || !interactive.attach || !interactive.reattach || !interactive.sendPrompt || !interactive.input || !interactive.resize || !interactive.stop) throw new Error(`provider "${providerName}" cannot control an exact interactive agent`);
+function noteDigest(note) {
+	return `sha256:${createHash("sha256").update(note).digest("hex")}`;
 }
-function assertInteractiveMethods(providerName, environment) {
-	if (!environment.startInteractive || !environment.interactive) throw new Error(`provider "${providerName}" exposes incomplete interactive agent controls`);
+/** A run directory's continuation files: the root's at `<runDir>/continuations/<n>/`, a nested
+*  manager's at `<runDir>/continuations/managers/<owner>/<n>/`. */
+const CONTINUATIONS_DIR = "continuations";
+/**
+* Write one continuation's files under `<dir>/<n>/`: `note.md`, `verdict.json`, and
+* `panel.jsonl` when the panel ran. The director reads them through `read_continuation`, because
+* its box cannot read the driver's run directory.
+*/
+async function writeContinuationFiles(dir, continuation, files) {
+	const at = join(dir, String(continuation));
+	await mkdir(at, { recursive: true });
+	await writeFile(join(at, "note.md"), `${files.note}\n`, "utf8");
+	await writeFile(join(at, "verdict.json"), `${JSON.stringify(files.verdict ?? null, null, 2)}\n`, "utf8");
+	if (files.panel !== void 0) await writeFile(join(at, "panel.jsonl"), files.panel.map((line) => JSON.stringify(line)).join("\n") + (files.panel.length ? "\n" : ""), "utf8");
 }
-async function destroyUnusedEnvironment(environment, cause) {
-	try {
-		await destroyInteractiveEnvironment(environment);
-	} catch (cleanupError) {
-		throw new AggregateError([cause, cleanupError], "interactive environment was invalid and could not be destroyed");
+/** The best composite across `reads`, or `undefined` when no read scored. */
+function bestComposite(reads) {
+	let best;
+	for (const read of reads) {
+		const value = read.verdict?.composite;
+		if (value !== void 0 && (best === void 0 || value > best)) best = value;
 	}
+	return best;
 }
-//#endregion
-//#region src/runtime/supervise/worker-interactive.ts
-const WORKER_BINDING_SCHEMA_VERSION = 1;
-const SPAWN_JOURNAL_FILE = "spawn-journal.jsonl";
-/** Directory containing exact per-worker interactive binding records. @stable */
-function workerInteractiveBindingsDir(eventDir) {
-	return join(eventDir, "interactive-workers");
+function finite(value) {
+	return typeof value === "number" && Number.isFinite(value);
 }
-/** Exact durable binding file for one worker id. @stable */
-function workerInteractiveBindingFile(eventDir, workerId) {
-	const id = stableText$1(workerId, "worker id");
-	const stem = createHash("sha256").update(id).digest("hex");
-	return join(workerInteractiveBindingsDir(eventDir), `${stem}.json`);
+function format(value) {
+	return Number.isInteger(value) ? String(value) : value.toFixed(3).replace(/0+$/u, "");
 }
-/** Read and validate one exact durable worker binding. @stable */
-function readWorkerInteractiveBinding(eventDir, workerId) {
-	const id = stableText$1(workerId, "worker id");
-	const file = workerInteractiveBindingFile(eventDir, id);
+/** Build the continuation state for one manager with a check. */
+function createContinuationKeeper(input) {
+	const { policy } = input;
+	const failures = input.feedback === "pass-only" ? "off" : policy.failures;
+	const entries = [];
+	const notes = [];
+	let findings = [];
+	let panelUsd = 0;
+	let panelUsdKnown = true;
+	const latestVerdict = () => {
+		const reads = input.reads();
+		for (let i = reads.length - 1; i >= 0; i -= 1) {
+			const read = reads[i];
+			if (read?.verdict !== void 0) return {
+				verdict: read.verdict,
+				read: read.read
+			};
+		}
+		return { read: 0 };
+	};
+	const closePrevious = () => {
+		const last = entries.at(-1);
+		const lastNote = notes.at(-1);
+		if (last === void 0 || lastNote === void 0) return;
+		const latest = latestVerdict();
+		entries[entries.length - 1] = {
+			...last,
+			after: latest.read > lastNote.read ? summarizeVerdict(latest.verdict) : null
+		};
+	};
+	return {
+		async compose(context) {
+			closePrevious();
+			const continuation = entries.length + 1;
+			const { verdict, read } = latestVerdict();
+			const failing = verdict === void 0 ? [] : failedItems(verdict);
+			let panelRecord;
+			let panelLines;
+			if (policy.panel === "on" && policy.runPanel !== void 0 && policy.panelUsd !== void 0) {
+				const workers = input.workers();
+				const questions = expandQuestions(policy.profile.questions ?? [], failing, workers);
+				const left = policy.panelUsd.perRun - panelUsd;
+				const usdCap = Math.min(policy.panelUsd.perContinuation, left);
+				const asking = questions.length > 0 && usdCap > 0 && panelUsdKnown;
+				let traces;
+				let unavailable;
+				if (asking) try {
+					traces = await input.traces?.();
+					if (traces === void 0) unavailable = "the run has recorded no trace yet";
+				} catch (error) {
+					unavailable = `the run's traces could not be read: ${error instanceof Error ? error.message : String(error)}`;
+				}
+				if (asking && traces !== void 0) {
+					const result = await policy.runPanel({
+						continuation,
+						task: input.task,
+						...verdict === void 0 ? {} : { verdict },
+						reads: input.reads(),
+						questions,
+						traces,
+						workers,
+						...policy.best === void 0 ? {} : { bar: policy.best },
+						...policy.reference === void 0 ? {} : { reference: policy.reference },
+						usdCap,
+						signal: context.signal
+					});
+					if (result.usd === null) panelUsdKnown = false;
+					else panelUsd += result.usd;
+					findings = distillFindings(findings, result.findings, new Set(failing), continuation);
+					panelRecord = {
+						asked: questions.length,
+						proposed: result.findings.length,
+						admitted: findings.filter((finding) => finding.admittedAt === continuation).length,
+						usd: result.usd
+					};
+					panelLines = [...result.findings.map((finding) => ({
+						kind: "finding",
+						admitted: admitFinding(finding),
+						...finding
+					})), ...result.receipts === void 0 ? [] : [{
+						kind: "receipts",
+						receipts: result.receipts
+					}]];
+				} else panelRecord = {
+					asked: 0,
+					proposed: 0,
+					admitted: 0,
+					usd: 0,
+					...unavailable === void 0 ? {} : { unavailable }
+				};
+			}
+			const appended = policy.append ? await policy.append({
+				continuation,
+				...verdict === void 0 ? {} : { verdict },
+				reads: input.reads(),
+				signal: context.signal
+			}) : void 0;
+			const note = composeContinuationNote({
+				profile: policy.profile,
+				continuation,
+				...verdict === void 0 ? {} : { verdict },
+				...notes.at(-1)?.verdict === void 0 ? {} : { previous: notes.at(-1)?.verdict },
+				reads: input.reads().length,
+				failures,
+				...policy.panel === "on" ? { findings } : {},
+				...policy.bar === "on" ? { bar: {
+					...policy.best === void 0 ? {} : { best: policy.best },
+					...policy.reference === void 0 ? {} : { reference: policy.reference }
+				} } : {},
+				...appended === void 0 ? {} : { appended: [appended] },
+				...input.owed === void 0 ? {} : { owed: input.owed },
+				progress: context.progress,
+				canReadMore: input.canReadMore,
+				canSubmitResult: input.canSubmitResult === true,
+				...input.sealed === true ? { sealed: true } : {}
+			});
+			notes.push({
+				note,
+				...verdict === void 0 ? {} : { verdict },
+				...panelLines === void 0 ? {} : { panel: panelLines },
+				read
+			});
+			entries.push({
+				continuation,
+				attempt: context.attempt,
+				noteDigest: noteDigest(note),
+				profile: policy.profile.id,
+				switches: {
+					failures,
+					panel: policy.panel,
+					bar: policy.bar
+				},
+				before: summarizeVerdict(verdict),
+				after: null,
+				...panelRecord === void 0 ? {} : { panel: panelRecord },
+				appended: appended === void 0 ? 0 : 1
+			});
+			if (input.dir !== void 0) await writeContinuationFiles(input.dir, continuation, {
+				note,
+				...verdict === void 0 ? {} : { verdict },
+				...panelLines === void 0 ? {} : { panel: panelLines }
+			});
+			return note;
+		},
+		read(continuation) {
+			const index = continuation === void 0 ? notes.length - 1 : continuation - 1;
+			const entry = notes[index];
+			if (entry === void 0) return {
+				found: false,
+				reason: notes.length === 0 ? "no continuation has been sent in this run" : `continuations run from 1 to ${notes.length}`
+			};
+			return {
+				found: true,
+				continuation: index + 1,
+				note: entry.note,
+				verdict: failures === "off" && entry.verdict !== void 0 ? { pass: entry.verdict.pass } : entry.verdict ?? null,
+				findings: findings.filter((finding) => finding.admittedAt <= index + 1)
+			};
+		},
+		entries() {
+			closePrevious();
+			return entries.map((entry) => ({ ...entry }));
+		}
+	};
+}
+//#endregion
+//#region src/runtime/supervise/completion-gate.ts
+/**
+*
+* The completion-oracle: **settled ⟺ DELIVERED.**
+*
+* Foreman's one hard lesson (0/18 self-improvement deliverables) — "done" must mean a check
+* PASSED, not the agent's say-so. `gateOnDeliverable` wraps an `Executor` so its settlement
+* is `valid` ONLY when the deliverable check passes. The child still RUNS and settles (its
+* spend is conserved into the pool either way), but a child that ran WITHOUT delivering
+* settles `valid:false` — so a keep-best driver never counts it as done, and a gate never
+* inflates with self-judged wins.
+*
+* Dual-purpose by construction:
+*  - product: the agent fleet only advances on real, checked deliverables.
+*  - proof: the gate's `valid` is the honest settle — equal-k comparisons can't be gamed by an
+*    arm that "ran" without producing the artifact.
+*
+* The check is a DEPLOYABLE oracle — a test command, a state verifier, the commit0 judge —
+* read off the child's output, never the model judging itself. A throwing check is
+* fail-closed (not delivered), never a crash.
+*
+* @experimental
+*/
+/**
+* Wrap an `Executor` so its settlement `valid` reflects the deliverable check, not the
+* inner verdict. Handles both `execute` shapes (one-shot `Promise<ExecutorResult>` and
+* streaming `AsyncIterable<UsageEvent>` + `resultArtifact()`); the check runs once the inner
+* executor has produced its output. The inner `score` is preserved; only `valid` is gated.
+*/
+function gateOnDeliverable(inner, deliverable) {
+	let gated;
+	const check = async (out, baseScore) => {
+		let delivered;
+		try {
+			delivered = checkVerdictOf(await deliverable.check(out)).pass;
+		} catch {
+			delivered = false;
+		}
+		return {
+			valid: delivered,
+			score: baseScore ?? (delivered ? 1 : 0)
+		};
+	};
+	/**
+	* Ask the delivery question once, from whatever the inner executor managed to produce.
+	*
+	* Fail-closed on the artifact being unavailable: an executor that never produced one delivered
+	* nothing, and leaving `gated` unset keeps the existing invalid-by-default reading.
+	*/
+	const settleVerdict = async () => {
+		let art;
+		try {
+			art = inner.resultArtifact();
+		} catch {
+			return;
+		}
+		gated = await check(art.out, art.verdict?.score);
+	};
+	const gateExecution = (r) => {
+		if (isAsyncIterable$1(r)) return (async function* () {
+			try {
+				for await (const ev of r) yield ev;
+			} finally {
+				await settleVerdict();
+			}
+		})();
+		return (async () => {
+			let res;
+			try {
+				res = await r;
+			} catch (error) {
+				await settleVerdict();
+				throw error;
+			}
+			gated = await check(res.out, res.verdict?.score);
+			return {
+				...res,
+				verdict: gated
+			};
+		})();
+	};
+	return inheritRuntimeOwnedExecutorAttestation(inner, {
+		runtime: inner.runtime,
+		...inner.budgetExempt !== void 0 ? { budgetExempt: inner.budgetExempt } : {},
+		...inner.deliver ? { deliver: (m) => inner.deliver?.(m) } : {},
+		...inner.progress ? { progress: () => inner.progress?.() } : {},
+		...inner.traceSource ? { traceSource: () => inner.traceSource?.() } : {},
+		...inner.metered ? { metered: () => inner.metered?.() } : {},
+		...inner.accounting ? { accounting: () => inner.accounting?.() } : {},
+		...inner.harnessTranscript ? { harnessTranscript: () => inner.harnessTranscript?.() } : {},
+		...inner.harnessTranscriptSettled ? { harnessTranscriptSettled: () => inner.harnessTranscriptSettled?.() ?? Promise.resolve() } : {},
+		execute: (task, signal) => gateExecution(inner.execute(task, signal)),
+		...inner.recover ? { recover: (task, signal) => gateExecution(inner.recover(task, signal)) } : {},
+		teardown: (grace) => inner.teardown(grace),
+		...teardownSurfaces(inner),
+		resultArtifact() {
+			const art = inner.resultArtifact();
+			return {
+				...art,
+				verdict: gated ?? art.verdict
+			};
+		}
+	});
+}
+/**
+* Transform a Runtime executor's terminal artifact without losing its private
+* profile-materialization attestation or altering its measured spend. This is
+* the composition point for deterministic post-processing and grading; callers
+* must not rebuild an Executor around a model transport merely to change `out`.
+*/
+function mapExecutorResult(inner, map) {
+	let mapped;
+	const settle = async (result, task) => {
+		const transformed = await map(result, task);
+		mapped = {
+			outRef: transformed.outRef,
+			out: transformed.out,
+			...transformed.verdict ? { verdict: transformed.verdict } : {},
+			spent: result.spent
+		};
+		return mapped;
+	};
+	return inheritRuntimeOwnedExecutorAttestation(inner, {
+		runtime: inner.runtime,
+		...inner.budgetExempt !== void 0 ? { budgetExempt: inner.budgetExempt } : {},
+		...inner.deliver ? { deliver: (message) => inner.deliver?.(message) } : {},
+		...inner.progress ? { progress: () => inner.progress?.() } : {},
+		...inner.traceSource ? { traceSource: () => inner.traceSource?.() } : {},
+		...inner.accounting ? { accounting: () => inner.accounting?.() } : {},
+		...inner.metered ? { metered: () => inner.metered?.() } : {},
+		...inner.harnessTranscript ? { harnessTranscript: () => inner.harnessTranscript?.() } : {},
+		...inner.harnessTranscriptSettled ? { harnessTranscriptSettled: () => inner.harnessTranscriptSettled?.() ?? Promise.resolve() } : {},
+		execute(task, signal) {
+			const execution = inner.execute(task, signal);
+			if (isAsyncIterable$1(execution)) return (async function* () {
+				for await (const event of execution) yield event;
+				await settle(inner.resultArtifact(), task);
+			})();
+			return (async () => settle(await execution, task))();
+		},
+		teardown: (grace) => inner.teardown(grace),
+		...teardownSurfaces(inner),
+		resultArtifact() {
+			if (!mapped) throw new Error("mapExecutorResult: resultArtifact() read before execute()");
+			return mapped;
+		}
+	});
+}
+//#endregion
+//#region src/runtime/supervise/dispatch.ts
+/**
+*
+* `rollingDispatch` — the REFILLING dispatch policy over a `Scope`. It keeps `width` children in
+* flight and admits the next queued unit of work the instant one settles, instead of waiting for
+* a whole round to drain (`fanout`) or for a driver to decide again (`spawn → await → spawn`).
+*
+* The gap it closes: `fanout` opens every item at once and then drains — one round, no refill —
+* and a driver brain's manual loop opens one worker per model turn. Between those two there was
+* nothing that holds N slots full, which is why a 5-worker run can peak at 2 live workers and sit
+* ~50% idle. This is a policy over the EXISTING `Scope.spawn` / `Scope.next` primitives: it adds
+* no second admission path, so the conserved budget pool stays the only fence on total work and
+* `width` is only a fence on simultaneous work.
+*
+* Fail-closed by construction: an admission rejection (`budget-exhausted` / `depth-exceeded`) is
+* recorded and STOPS further admission — the loop then drains what is already live and returns.
+* It never retries a rejected spawn against the same pool, and it never spawns past `width`.
+*
+* ── Concurrency ────────────────────────────────────────────────────────────────────────────────
+*
+* `width` bounds the children THIS dispatcher holds in flight. The tree-wide bound on working
+* agents is `SuperviseOptions.workerSlots` (`./worker-slots`): a spawn past it is queued by the
+* scope, not refused, so a `width` above the free slots only lengthens the allocator's queue.
+* `SandboxLineage`'s fork concurrency bounds boxes inside ONE leaf's fork wave, a different unit.
+*
+* ── Why this is not a copy of the kernel's batch loop ──────────────────────────────────────────
+*
+* `runBatch` (`src/runtime/run-loop.ts`) runs the same hold-N-slots-full shape over the KERNEL's
+* substrate: bare promises in a `Set`, raced with `Promise.race`, bounded by `maxConcurrency`.
+* This one runs it over the SUPERVISOR's substrate — `Scope.spawn`'s atomic reservation against
+* the conserved pool, `Scope.next`'s journaled settlement cursor, and the blob store behind each
+* result. Neither can be expressed in the other's terms without dragging its whole substrate
+* along: the kernel loop has no budget to reserve and no cursor to order settlements by, and this
+* one cannot race raw promises because a settlement is only real once it is journaled. The shape
+* repeating across the two deliberate layers is resonance, not duplication — do not "unify" them
+* into a shared helper that would have to know about both.
+*
+* @experimental
+*/
+/**
+* Run the refilling dispatch loop over `scope` until the queue is dry (or a stop fires) and every
+* admitted child has settled. Returns the settlements in cursor order plus the admission ledger.
+*
+* The loop is: fill free slots from `nextUnit` → `await scope.next()` → deliver the settlement →
+* refill → repeat. Because the refill happens immediately after each settlement rather than after
+* a whole round, a slow child never idles the other slots.
+*/
+async function rollingDispatch(scope, opts) {
+	if (!Number.isInteger(opts.width) || opts.width < 1) throw new ValidationError$1(`rollingDispatch: width must be a positive integer, got ${String(opts.width)}`);
+	const settled = [];
+	const rejected = [];
+	const live = /* @__PURE__ */ new Set();
+	let admitted = 0;
+	let peakLive = 0;
+	let queueDry = false;
+	let stopReason = "drained";
+	const fill = async () => {
+		while (live.size < opts.width) {
+			if (queueDry) return;
+			if (scope.signal.aborted) {
+				stopReason = "aborted";
+				queueDry = true;
+				return;
+			}
+			if (opts.shouldStop?.() === true) {
+				stopReason = "stopped";
+				queueDry = true;
+				return;
+			}
+			const unit = await opts.nextUnit();
+			if (unit === void 0) {
+				queueDry = true;
+				return;
+			}
+			const res = scope.spawn(unit.agent, unit.task, unit.opts);
+			if (!res.ok) {
+				rejected.push(`${unit.opts.label}: ${res.reason}`);
+				stopReason = "not-admitted";
+				queueDry = true;
+				return;
+			}
+			live.add(res.handle.id);
+			admitted += 1;
+			if (live.size > peakLive) peakLive = live.size;
+		}
+	};
+	await fill();
+	while (live.size > 0) {
+		const s = await scope.next();
+		if (s === null) break;
+		live.delete(s.handle.id);
+		settled.push(s);
+		await opts.onSettled?.(s);
+		await fill();
+	}
+	return {
+		settled,
+		admitted,
+		rejected,
+		stopReason,
+		peakLive
+	};
+}
+/**
+* Free worker slots under a simultaneity cap: `cap - live`, floored at 0, or `null` when there is
+* no cap (the conserved pool is then the only fence and "free slots" is not a finite number).
+* The one place the answer is computed, so the driver-facing tool payload and a dispatcher agree.
+*/
+function freeSlots(liveCount, cap) {
+	if (cap === void 0 || cap <= 0) return null;
+	return Math.max(0, cap - liveCount);
+}
+/** Convenience: a `DispatchUnit` factory over a fixed array of tasks, for the common case where
+*  the queue is known up front and only the refill behavior is wanted. */
+function queueOf(units, budget) {
+	let i = 0;
+	return () => {
+		const u = units[i];
+		if (u === void 0) return void 0;
+		i += 1;
+		return {
+			agent: u.agent,
+			task: u.task,
+			opts: {
+				budget,
+				label: u.label
+			}
+		};
+	};
+}
+//#endregion
+//#region src/runtime/retained-interactive-handle.ts
+function createRetainedInteractiveRunHandle(environment, inputRef, capabilities, requestedStart) {
+	const ref = freezeInteractiveRef(inputRef);
+	const source = environment.interactive(ref);
+	if (!sameInteractiveRef(source.ref, ref)) throw new Error("provider reconstructed a different interactive process");
+	if (!source.sendPrompt) throw new Error("provider declared interactive prompt support but exposed no prompt method");
+	return Object.freeze({
+		ref,
+		capabilities,
+		claimControl: async (request, options) => exactClaim(ref, request, await awaitAbortable$1(Promise.resolve().then(() => source.claimControl(request, options)), options?.signal)),
+		status: async (options) => exactStatus(ref, await awaitAbortable$1(Promise.resolve().then(() => source.status(options)), options?.signal), requestedStart),
+		attach: async (request, options) => exactTerminal(ref, request, await awaitAbortable$1(Promise.resolve().then(() => source.attach(request, options)), options?.signal)),
+		sendPrompt: async (command, options) => exactPrompt(ref, await awaitAbortable$1(Promise.resolve().then(() => source.sendPrompt(command, options)), options?.signal), command),
+		stop: async (command, options) => exactStop(ref, await awaitAbortable$1(Promise.resolve().then(() => source.stop(command, options)), options?.signal), command)
+	});
+}
+function freezeInteractiveRef(value) {
+	return detachedSnapshot(AgentInteractiveSessionRefSchema.parse(value), "interactive session ref");
+}
+function exactClaim(ref, request, value) {
+	const acknowledgement = parseProviderAcknowledgement(AgentInteractiveSessionControlClaimAcknowledgementSchema, value, "control claim");
+	if (!agentInteractiveSessionControlClaimAcknowledgementMatchesRequest(request, acknowledgement)) throw new RetainedRunProviderContractError("provider returned a control claim acknowledgement for another request");
+	if (acknowledgement.control && !agentInteractiveSessionControlClaimMatchesRef(ref, acknowledgement.control)) throw new RetainedRunProviderContractError("provider returned a control claim for another interactive process");
+	return acknowledgement;
+}
+function exactPrompt(ref, value, command) {
+	const acknowledgement = parseProviderAcknowledgement(AgentInteractiveSessionPromptAcknowledgementSchema, value, "prompt");
+	if (!agentInteractiveSessionPromptAcknowledgementMatchesCommand(command, acknowledgement)) throw new RetainedRunProviderContractError("provider returned a prompt acknowledgement for another request");
+	if (!agentInteractiveSessionControlClaimMatchesRef(ref, acknowledgement.control)) throw new RetainedRunProviderContractError("provider returned a prompt acknowledgement for another interactive process");
+	return acknowledgement;
+}
+function exactStop(ref, value, command) {
+	const acknowledgement = parseProviderAcknowledgement(AgentInteractiveSessionStopAcknowledgementSchema, value, "stop");
+	if (!agentInteractiveSessionStopAcknowledgementMatchesCommand(command, acknowledgement)) throw new RetainedRunProviderContractError("provider returned a stop acknowledgement for another request");
+	if (!agentInteractiveSessionControlClaimMatchesRef(ref, acknowledgement.control)) throw new RetainedRunProviderContractError("provider returned a stop acknowledgement for another interactive process");
+	return acknowledgement;
+}
+function parseProviderAcknowledgement(schema, value, operation) {
+	try {
+		return schema.parse(value);
+	} catch {
+		throw new RetainedRunProviderContractError(`provider returned an invalid interactive ${operation} acknowledgement`);
+	}
+}
+function exactStatus(ref, value, requestedStart) {
+	let status;
+	try {
+		status = AgentInteractiveSessionStatusSchema.parse(value);
+	} catch (error) {
+		if (requestedStart === void 0) throw error;
+		throw new RetainedInteractiveBindingError(detachedSnapshot(requestedStart, "interactive status binding request"), {}, { cause: error });
+	}
+	if (!agentInteractiveSessionStatusMatchesRef(ref, status)) {
+		if (requestedStart !== void 0) throw new RetainedInteractiveBindingError(detachedSnapshot(requestedStart, "interactive status binding request"), detachedSnapshot({ status: detachedSnapshot(status, "interactive provider status") }, "interactive provider status result"), { cause: /* @__PURE__ */ new Error("provider returned status for another interactive process") });
+		throw new Error("provider returned status for another interactive process");
+	}
+	return status;
+}
+function exactTerminal(ref, request, terminal) {
+	const terminalRef = TerminalSessionRefSchema.parse(terminal.ref);
+	TerminalReplayWindowSchema.parse(terminal.cursors);
+	if (terminalRef.parentExecutionId !== ref.run.executionId) throw new Error("provider attached a terminal from another interactive run");
+	AgentInteractiveSessionControlClaimSchema.parse(terminal.control);
+	if (!agentInteractiveSessionControlClaimMatchesRef(ref, terminal.control)) throw new Error("provider attached a terminal with a claim for another interactive process");
+	if (canonicalCandidateDigest(terminal.control) !== canonicalCandidateDigest(request.control)) throw new Error("provider attached a terminal with a different interactive control claim");
+	return terminal;
+}
+function sameInteractiveRef(left, right) {
+	return canonicalCandidateDigest(left) === canonicalCandidateDigest(right);
+}
+//#endregion
+//#region src/runtime/retained-interactive.ts
+/**
+* Start one retry-safe native coding-agent TUI without dispatching a headless turn.
+* The intent admission is durable before provider.create; the environment and
+* process admissions follow only after their exact provider coordinates exist.
+* @stable
+*/
+async function startRetainedInteractiveRun(options) {
+	options.signal?.throwIfAborted();
+	const startOptions = options;
+	assertStableText(startOptions.environment.idempotencyKey, "environment idempotency key");
+	assertStableText(startOptions.interactiveIdempotencyKey, "interactive idempotency key");
+	if (typeof startOptions.onAdmission !== "function") throw new Error("startRetainedInteractiveRun requires an awaited onAdmission durability hook");
+	if (!startOptions.provider.get) throw new Error(`provider "${startOptions.provider.name}" cannot reconstruct an environment by id`);
+	const profile = agentProfileSchema.parse(startOptions.environment.profile);
+	if (profile.harness === void 0) throw new Error("retained interactive runs require AgentProfile.harness");
+	const requestedProfileDigest = canonicalAgentProfileDigest(profile);
+	const identity = startOptions.intent === void 0 ? mintRetainedIdentity(startOptions.environment.idempotencyKey, startOptions.interactiveIdempotencyKey) : {
+		sessionId: startOptions.intent.sessionId,
+		executionId: startOptions.intent.executionId
+	};
+	assertStableText(identity.sessionId, "retained session id");
+	assertStableText(identity.executionId, "retained execution id");
+	const intent = interactiveIntent(startOptions, profile, identity);
+	if (startOptions.intent === void 0) await admitDurably(startOptions.onAdmission, intent);
+	else assertExactInteractiveIntent(startOptions.intent, intent);
+	const providerCapabilities = AgentEnvironmentCapabilitiesSchema.parse(await awaitAbortable$1(Promise.resolve().then(() => startOptions.provider.capabilities()), startOptions.signal));
+	assertInteractiveCapabilities(startOptions.provider.name, providerCapabilities);
+	const environment = await createInteractiveEnvironment(() => startOptions.provider.create({
+		...startOptions.environment,
+		profile,
+		signal: startOptions.signal,
+		metadata: retainedEnvironmentMetadata(startOptions.environment.metadata, startOptions.environment.idempotencyKey)
+	}), startOptions.signal);
+	let capabilities;
+	try {
+		assertExactEnvironment(startOptions.provider.name, environment);
+		startOptions.signal?.throwIfAborted();
+		capabilities = interactiveCapabilitiesForEnvironment(startOptions.provider.name, providerCapabilities, environment);
+		assertInteractiveMethods(startOptions.provider.name, environment);
+	} catch (error) {
+		await destroyUnusedEnvironment(environment, error);
+		throw error;
+	}
+	const request = interactiveRequest(startOptions, environment, profile, requestedProfileDigest, identity);
+	await admitDurably(startOptions.onAdmission, {
+		phase: "interactive_environment",
+		provider: startOptions.provider.name,
+		environmentId: environment.id,
+		idempotencyKey: startOptions.environment.idempotencyKey,
+		interactiveIdempotencyKey: startOptions.interactiveIdempotencyKey,
+		request
+	});
+	const ref = exactStartedRef(request, await startInteractiveProcess(environment, () => environment.startInteractive(request, { signal: startOptions.signal }), startOptions.signal));
+	await admitDurably(startOptions.onAdmission, {
+		phase: "interactive_started",
+		idempotencyKey: startOptions.environment.idempotencyKey,
+		interactiveIdempotencyKey: startOptions.interactiveIdempotencyKey,
+		ref
+	});
+	return createRetainedInteractiveRunHandle(environment, ref, capabilities, request);
+}
+/**
+* Retry one exact start after its provider response may have been lost.
+*
+* Resolves to the handle of the admitted process (resumed through the exact,
+* idempotent start request), or `null` when the provider no longer holds the
+* environment (not found; nothing remains to stop). @stable
+*/
+async function recoverRetainedInteractiveRun(options) {
+	options.signal?.throwIfAborted();
+	if (typeof options.onAdmission !== "function") throw new Error("recoverRetainedInteractiveRun requires an awaited onAdmission durability hook");
+	const admission = options.admission;
+	if (admission.provider !== options.provider.name) throw new Error("interactive admission belongs to another provider");
+	if (admission.phase === "interactive_intent") {
+		if (options.replay === void 0) throw new Error("recoverRetainedInteractiveRun requires the original start material for an interactive intent");
+		return startRetainedInteractiveRun({
+			provider: options.provider,
+			...options.replay,
+			intent: admission,
+			onAdmission: options.onAdmission,
+			signal: options.signal
+		});
+	}
+	const request = exactRecoveryRequest(admission);
+	const { environment, capabilities } = await reconstructEnvironment(options.provider, admission.environmentId, options.signal);
+	if (!environment || !capabilities) return null;
+	const ref = exactStartedRef(request, await awaitAbortable$1(Promise.resolve().then(() => environment.startInteractive(request, { signal: options.signal })), options.signal));
+	await admitDurably(options.onAdmission, {
+		phase: "interactive_started",
+		idempotencyKey: admission.idempotencyKey,
+		interactiveIdempotencyKey: admission.interactiveIdempotencyKey,
+		ref
+	});
+	return createRetainedInteractiveRunHandle(environment, ref, capabilities, request);
+}
+function exactRecoveryRequest(admission) {
+	assertStableText(admission.environmentId, "interactive environment id");
+	assertStableText(admission.idempotencyKey, "environment idempotency key");
+	assertStableText(admission.interactiveIdempotencyKey, "interactive idempotency key");
+	const request = exactAgentInteractiveSessionStart(admission.request);
+	const identity = mintRetainedIdentity(admission.idempotencyKey, admission.interactiveIdempotencyKey);
+	if (request.run.provider !== admission.provider || request.run.environmentId !== admission.environmentId || (request.run.sessionId !== identity.sessionId || request.run.executionId !== identity.executionId) && !matchesHistoricalInteractiveIdentity(admission, request)) throw new Error("interactive admission does not match its recovery coordinates");
+	return request;
+}
+function matchesHistoricalInteractiveIdentity(admission, request) {
+	const base = `${encodeURIComponent(admission.idempotencyKey)}:${encodeURIComponent(admission.interactiveIdempotencyKey)}`;
+	const digest = canonicalCandidateDigest({
+		kind: "retained-identity.v1",
+		base
+	}).slice(7);
+	const historicalId = (prefix) => {
+		const readable = `${prefix}:${base}`;
+		return readable.length <= 128 ? readable : `${prefix}:${digest}`;
+	};
+	return request.run.sessionId === historicalId("retained-session") && request.run.executionId === historicalId("retained-execution");
+}
+/** Rebuild controls for one exact provider-owned coding-agent process. @stable */
+async function reconnectRetainedInteractiveRun(options) {
+	options.signal?.throwIfAborted();
+	const ref = AgentInteractiveSessionRefSchema.parse(options.ref);
+	if (ref.run.provider !== options.provider.name) throw new Error("interactive session reference belongs to another provider");
+	const { environment, capabilities } = await reconstructEnvironment(options.provider, ref.run.environmentId, options.signal);
+	if (!environment || !capabilities) return null;
+	const handle = createRetainedInteractiveRunHandle(environment, ref, capabilities);
+	await handle.status({ signal: options.signal });
+	return handle;
+}
+function interactiveRequest(options, environment, profile, requestedProfileDigest, identity) {
+	const start = {
+		profile,
+		requestedProfileDigest,
+		...options.initialPrompt === void 0 ? {} : { initialPrompt: options.initialPrompt },
+		...options.cwd === void 0 ? {} : { cwd: options.cwd },
+		...options.cols === void 0 ? {} : { cols: options.cols },
+		...options.rows === void 0 ? {} : { rows: options.rows }
+	};
+	return exactAgentInteractiveSessionStart({
+		run: agentInteractiveSessionRunRef({
+			provider: options.provider.name,
+			environmentId: environment.id,
+			...identity
+		}, start),
+		...start
+	});
+}
+function interactiveIntent(options, profile, identity) {
+	const requestedProfileDigest = canonicalAgentProfileDigest(profile);
+	const requestDigest = canonicalCandidateDigest({
+		kind: "retained-interactive-intent.v1",
+		provider: options.provider.name,
+		idempotencyKey: options.environment.idempotencyKey,
+		interactiveIdempotencyKey: options.interactiveIdempotencyKey,
+		sessionId: identity.sessionId,
+		executionId: identity.executionId,
+		requestedProfileDigest,
+		create: retainedCreateMaterial(options.environment),
+		start: sanitizedStartMaterial(options)
+	});
+	return {
+		phase: "interactive_intent",
+		provider: options.provider.name,
+		idempotencyKey: options.environment.idempotencyKey,
+		interactiveIdempotencyKey: options.interactiveIdempotencyKey,
+		sessionId: identity.sessionId,
+		executionId: identity.executionId,
+		runId: `interactive-intent-run:${requestDigest.slice(7)}`,
+		requestedProfileDigest,
+		requestDigest
+	};
+}
+function sanitizedStartMaterial(options) {
+	return {
+		...options.initialPrompt === void 0 ? {} : { initialPrompt: options.initialPrompt },
+		...options.cwd === void 0 ? {} : { cwd: options.cwd },
+		...options.cols === void 0 ? {} : { cols: options.cols },
+		...options.rows === void 0 ? {} : { rows: options.rows }
+	};
+}
+function assertExactInteractiveIntent(received, expected) {
+	if (canonicalCandidateDigest(parseInteractiveIntent(received)) !== canonicalCandidateDigest(expected)) throw new Error("interactive intent conflicts with replay material");
+}
+function parseInteractiveIntent(value) {
+	const stable = detachedSnapshot(value, "interactive intent");
+	if (stable === null || typeof stable !== "object" || Array.isArray(stable)) throw new Error("interactive intent is malformed");
+	const record = stable;
+	const allowed = /* @__PURE__ */ new Set([
+		"phase",
+		"provider",
+		"idempotencyKey",
+		"interactiveIdempotencyKey",
+		"sessionId",
+		"executionId",
+		"runId",
+		"requestedProfileDigest",
+		"requestDigest"
+	]);
+	if (Object.keys(record).some((key) => !allowed.has(key))) throw new Error("interactive intent contains unsupported material");
+	if (record.phase !== "interactive_intent") throw new Error("interactive intent has an invalid phase");
+	for (const [key, value] of Object.entries(record)) {
+		if (key === "phase") continue;
+		if (typeof value !== "string" || value.length === 0) throw new Error(`interactive intent field "${key}" is invalid`);
+	}
+	assertDigest$1(record.requestedProfileDigest, "interactive intent profile digest");
+	assertDigest$1(record.requestDigest, "interactive intent request digest");
+	return stable;
+}
+function assertDigest$1(value, label) {
+	if (typeof value !== "string" || !/^sha256:[a-f0-9]{64}$/u.test(value)) throw new Error(`${label} is invalid`);
+}
+async function reconstructEnvironment(provider, environmentId, signal) {
+	if (!provider.get) throw new Error(`provider "${provider.name}" cannot reconstruct an environment by id`);
+	const providerCapabilities = AgentEnvironmentCapabilitiesSchema.parse(await awaitAbortable$1(Promise.resolve().then(() => provider.capabilities()), signal));
+	assertInteractiveCapabilities(provider.name, providerCapabilities);
+	const environment = await awaitAbortable$1(Promise.resolve().then(() => provider.get(environmentId, { signal })), signal);
+	if (!environment) return {
+		environment: null,
+		capabilities: null
+	};
+	assertExactEnvironment(provider.name, environment, environmentId);
+	const capabilities = interactiveCapabilitiesForEnvironment(provider.name, providerCapabilities, environment);
+	assertInteractiveMethods(provider.name, environment);
+	return {
+		environment,
+		capabilities
+	};
+}
+function exactStartedRef(request, value) {
+	const stableRequest = detachedSnapshot(request, "interactive start binding request");
+	let ref;
+	try {
+		ref = AgentInteractiveSessionRefSchema.parse(value);
+	} catch (error) {
+		throw new RetainedInteractiveBindingError(stableRequest, {}, { cause: error });
+	}
+	if (!agentInteractiveSessionRefMatchesStart(request, ref)) throw new RetainedInteractiveBindingError(stableRequest, detachedSnapshot({ ref: detachedSnapshot(ref, "interactive provider start reference") }, "interactive provider start result"), { cause: /* @__PURE__ */ new Error("provider started another interactive run than requested") });
+	return freezeInteractiveRef(ref);
+}
+function assertExactEnvironment(providerName, environment, environmentId) {
+	if (environment.provider !== providerName || environmentId && environment.id !== environmentId) throw new Error("provider returned another interactive environment");
+	assertStableText(environment.id, "interactive environment id");
+}
+function interactiveCapabilitiesForEnvironment(providerName, providerCapabilities, environment) {
+	const capabilities = environment.capabilities === void 0 ? providerCapabilities : AgentEnvironmentCapabilitiesSchema.parse(environment.capabilities);
+	assertInteractiveCapabilities(providerName, capabilities);
+	return capabilities;
+}
+function assertInteractiveCapabilities(providerName, capabilities) {
+	const interactive = capabilities.interactiveAgent;
+	if (!interactive?.start || !interactive.control || !interactive.status || !interactive.attach || !interactive.reattach || !interactive.sendPrompt || !interactive.input || !interactive.resize || !interactive.stop) throw new Error(`provider "${providerName}" cannot control an exact interactive agent`);
+}
+function assertInteractiveMethods(providerName, environment) {
+	if (!environment.startInteractive || !environment.interactive) throw new Error(`provider "${providerName}" exposes incomplete interactive agent controls`);
+}
+async function destroyUnusedEnvironment(environment, cause) {
+	try {
+		await destroyInteractiveEnvironment(environment);
+	} catch (cleanupError) {
+		throw new AggregateError([cause, cleanupError], "interactive environment was invalid and could not be destroyed");
+	}
+}
+//#endregion
+//#region src/runtime/supervise/worker-interactive.ts
+const WORKER_BINDING_SCHEMA_VERSION = 1;
+const SPAWN_JOURNAL_FILE = "spawn-journal.jsonl";
+/** Directory containing exact per-worker interactive binding records. @stable */
+function workerInteractiveBindingsDir(eventDir) {
+	return join(eventDir, "interactive-workers");
+}
+/** Exact durable binding file for one worker id. @stable */
+function workerInteractiveBindingFile(eventDir, workerId) {
+	const id = stableText$1(workerId, "worker id");
+	const stem = createHash("sha256").update(id).digest("hex");
+	return join(workerInteractiveBindingsDir(eventDir), `${stem}.json`);
+}
+/** Read and validate one exact durable worker binding. @stable */
+function readWorkerInteractiveBinding(eventDir, workerId) {
+	const id = stableText$1(workerId, "worker id");
+	const file = workerInteractiveBindingFile(eventDir, id);
 	assertNoSymlinkDescendant(eventDir, file, "worker interactive");
 	if (!existsSync(file)) return void 0;
 	const binding = parseBinding(JSON.parse(readFileSync(file, "utf8")));
@@ -21798,6 +22554,25 @@ function stableText(value, label) {
 	return text;
 }
 //#endregion
+//#region src/runtime/supervise/provider-visible-profile.ts
+/** Runtime-owned coordination is mounted under this MCP alias. */
+const coordinationMcpAlias = "agent-runtime-coordination";
+/** A profile declares Runtime-owned tools with this provider-neutral prefix. */
+const coordinationProfileToolPrefix = `${coordinationMcpAlias.replaceAll("-", "_")}_`;
+/** Remove Runtime-only grants and seat policy from the provider-facing profile. */
+function providerVisibleProfile(profile) {
+	const { seats: _seats, ...withoutSeats } = profile;
+	if (profile.tools === void 0) return withoutSeats;
+	const providerTools = Object.fromEntries(Object.entries(profile.tools).filter(([name]) => !name.startsWith(coordinationProfileToolPrefix)));
+	if (Object.keys(providerTools).length === Object.keys(profile.tools).length) return withoutSeats;
+	if (Object.keys(providerTools).length > 0) return {
+		...withoutSeats,
+		tools: providerTools
+	};
+	const { tools: _runtimeTools, ...withoutTools } = withoutSeats;
+	return withoutTools;
+}
+//#endregion
 //#region src/runtime/supervise/terminal-record.ts
 /** The settlement fields every writer copies, in the terminal record's key order. The
 *  `reconciled` record is built from this same spread so it and the terminal record can never
@@ -21950,7 +22725,7 @@ async function healReleasedSlots(opts, signal, now) {
 			};
 			await opts.journal.appendEvent(tree.root, terminalDownEvent(subject, settlement, settledSeq, floor.at, "released"));
 			healed += 1;
-			const materialized = owned.find((event) => event.kind === "materialized");
+			const materialized = [...owned].reverse().find((event) => event.kind === "materialized" || event.kind === "seat-materialized");
 			const lastReceipt = receipts[receipts.length - 1];
 			notifyRuntimeHookEvent(opts.hooks, {
 				id: `${spawned.id}:released`,
@@ -22032,7 +22807,7 @@ async function prepareInterruptedExecutors(opts, events, signal, now, parentId =
 			});
 			if (!prepared) continue;
 		}
-		const priorMaterialization = owned.find((event) => event.kind === "materialized")?.receipt;
+		const priorMaterialization = [...owned].reverse().find((event) => event.kind === "materialized" || event.kind === "seat-materialized")?.receipt;
 		const continuation = latestInput !== void 0 && inputs.length > 1 && node.ownedTreeRoot === void 0 ? await leafContinuation(node, owned, latestInput, opts) : void 0;
 		recoveries.push({
 			...detachedSnapshot({
@@ -22100,7 +22875,7 @@ async function leafContinuation(node, owned, latestInput, opts) {
 }
 async function assertRecordedResult(node, result, events, opts) {
 	const before = events.slice(0, events.indexOf(result));
-	const receipt = before.find((event) => event.kind === "materialized")?.receipt;
+	const receipt = [...before].reverse().find((event) => event.kind === "materialized" || event.kind === "seat-materialized")?.receipt;
 	const binding = [...before].reverse().find((event) => event.kind === "execution-bound")?.binding;
 	if (receipt?.status !== "known" || binding?.status !== "known" || receipt.runtime !== node.runtime || receipt.authoredProfileDigest !== node.identity?.profileDigest || binding.materializationReceiptDigest !== canonicalCandidateDigest(receipt)) throw new RuntimeRunStateError(`retained result '${node.id}' has no matching execution evidence`);
 	assertValidSpend(result.spent, `retained result '${result.id}'`);
@@ -22682,6 +23457,10 @@ function registerScopeRetainedOwner(scope, args) {
 function scopeRetainedOwnerContext(scope) {
 	return owners.get(scope)?.context;
 }
+/** The journal tree that owns this manager turn, including nested driver children. */
+function scopeRetainedOwnerJournalRoot(scope) {
+	return owners.get(scope)?.args.rootId;
+}
 /**
 * Bind cleanup before replay can return an already accepted owner result. `checkpointCapture` is
 * where each checkpoint's files are stored before the checkpoint is deleted; without it, no
@@ -22796,6 +23575,59 @@ function noteScopeRetainedOwnerCoordination(scope) {
 		delete state.checkpointing;
 	});
 }
+/** A committed turn is the seat boundary. Keep its native home for a same-harness provider
+* continuation; only a provider/harness change needs a new environment. */
+async function prepareScopeRetainedOwnerSeatSwitch(scope, mode) {
+	const state = owners.get(scope);
+	if (!state?.acceptedRef || !state.acceptedConsumed) throw new ValidationError$1("seat switch requires a committed owner turn");
+	const accepted = state.acceptedRef;
+	await scopeRetainedOwnerTurnEnded(scope);
+	await state.checkpointing;
+	await checkpointOwnerWorkspace(scope, state);
+	const owned = (await state.args.journal.loadTree(state.args.rootId) ?? []).filter((event) => event.id === state.args.nodeId);
+	const acceptedIndex = owned.findIndex((event) => event.kind === "execution-result" && event.seq === accepted.seq && event.outRef === accepted.outRef);
+	if (acceptedIndex < 0) throw new ValidationError$1("seat switch has no committed result in its journal");
+	const source = owned.slice(0, acceptedIndex).reverse().find((event) => event.kind === "execution-admitted" && event.admission.phase === "environment");
+	const sourceEnvironmentId = source?.kind === "execution-admitted" && source.admission.phase === "environment" ? source.admission.environmentId : void 0;
+	const checkpoint = sourceEnvironmentId !== void 0 ? owned.slice(acceptedIndex + 1).reverse().find((event) => event.kind === "workspace-checkpoint" && event.environmentId === sourceEnvironmentId) : void 0;
+	if (checkpoint?.kind !== "workspace-checkpoint") throw new ValidationError$1("seat switch requires a checkpoint of the committed source environment");
+	if (mode === "replace-environment") {
+		await retireSeatEnvironment(scope, state);
+		state.forceNewSession = true;
+	}
+	return {
+		checkpointAt: checkpoint.at,
+		checkpointId: checkpoint.checkpoint.checkpointId,
+		sourceEnvironmentId: checkpoint.environmentId
+	};
+}
+/** The next seat receives fresh create-time credentials. Release the stopped source only after
+* its checkpoint exists, then commit the teardown so recovery never tries its old session. */
+async function retireSeatEnvironment(scope, state) {
+	const { provider, args } = state;
+	if (!provider?.get) throw new ValidationError$1("seat switch requires a provider with exact environment lookup");
+	const owned = (await args.journal.loadTree(args.rootId) ?? []).filter((event) => event.id === args.nodeId);
+	const admitted = [...owned].reverse().find((event) => event.kind === "execution-admitted" && event.admission.phase === "environment");
+	if (admitted?.kind !== "execution-admitted" || admitted.admission.phase !== "environment") throw new ValidationError$1("seat switch has no committed source environment");
+	const environmentId = admitted.admission.environmentId;
+	if (owned.some((event) => event.kind === "environment-teardown" && event.destroyed && event.environmentId === environmentId)) return;
+	const signal = AbortSignal.any([scope.signal, AbortSignal.timeout(3e4)]);
+	const environment = await runAbortable(() => provider.get(environmentId), signal, "seat switch environment lookup timed out");
+	if (environment !== null) {
+		if (environment.id !== environmentId || environment.provider !== provider.name || !environment.destroy) throw new ValidationError$1("seat switch cannot retire the exact source environment");
+		await runAbortable(() => environment.destroy(), signal, "seat switch environment retirement timed out");
+	}
+	await args.journal.appendEvent(args.rootId, {
+		kind: "environment-teardown",
+		id: args.nodeId,
+		provider: provider.name,
+		environmentId,
+		destroyed: true,
+		detail: "seat changed after a committed turn",
+		seq: state.nextSequence(),
+		at: new Date(args.now()).toISOString()
+	});
+}
 async function checkpointOwnerWorkspace(scope, state) {
 	const { provider, args } = state;
 	if (provider === void 0) return;
@@ -22973,7 +23805,8 @@ async function cleanCheckpoints(state, branching, checkpoints, events, parent) {
 	for (const event of checkpoints) {
 		const captured = await captureBeforeCleanup(state, branching, event, events, parent);
 		if ("reason" in captured) {
-			(state.captureRefused ??= /* @__PURE__ */ new Set()).add(event.checkpoint.checkpointId);
+			state.captureRefused ??= /* @__PURE__ */ new Set();
+			state.captureRefused.add(event.checkpoint.checkpointId);
 			refused.push(captured);
 			await state.args.journal.appendEvent(state.args.rootId, {
 				kind: "workspace-checkpoint-cleanup",
@@ -23193,8 +24026,8 @@ async function settleCaptureForks(state) {
 * environment needs one; a live environment is continued, never copied.
 */
 function restoreBefore(owned, inputIndex) {
-	const destroyed = destroyedEnvironmentIds(owned);
-	return owned.slice(0, inputIndex < 0 ? owned.length : inputIndex).filter((event) => event.kind === "workspace-checkpoint" && destroyed.has(event.environmentId)).at(-1);
+	const unusable = unusableEnvironmentIds(owned);
+	return owned.slice(0, inputIndex < 0 ? owned.length : inputIndex).filter((event) => event.kind === "workspace-checkpoint" && unusable.has(event.environmentId)).at(-1);
 }
 async function restoreCapable(provider) {
 	if (provider === void 0) return false;
@@ -23215,7 +24048,8 @@ async function scopeRetainedOwnerRestorePoint(scope) {
 	const latest = restoreBefore((await state.args.journal.loadTree(state.args.rootId) ?? []).filter((event) => event.id === state.args.nodeId), -1);
 	return latest === void 0 ? void 0 : {
 		checkpointId: latest.checkpoint.checkpointId,
-		takenAt: latest.at
+		takenAt: latest.at,
+		sourceEnvironmentId: latest.checkpoint.source.environmentId
 	};
 }
 /** @internal Whether another owner release could still destroy what the last one left. */
@@ -23539,9 +24373,9 @@ function hasDurableWorkspaceCapture(output, snapshot, environmentId, executionId
 	const linked = agentCandidateWorkspaceSnapshotEvidenceSchema.safeParse(receipt.snapshot);
 	return linked.success && linked.data.digest === parsed.data.digest && JSON.stringify(linked.data.manifest) === JSON.stringify(parsed.data.manifest) && JSON.stringify(linked.data.archive) === JSON.stringify(parsed.data.archive);
 }
-/** Environment ids this owner's provider confirmed gone, from their teardown receipts. */
-function destroyedEnvironmentIds(owned) {
-	return new Set(owned.flatMap((event) => event.kind === "environment-teardown" && event.destroyed ? [event.environmentId] : []));
+/** Environments that cannot execute another turn, whether absent or terminal at the provider. */
+function unusableEnvironmentIds(owned) {
+	return new Set(owned.flatMap((event) => event.kind === "environment-terminal" || event.kind === "environment-teardown" && event.destroyed ? [event.environmentId] : []));
 }
 /** The environment the owner's next invocation would continue in, when there is one: the latest
 *  environment admission of this owner, which is either the current invocation's own (recovered
@@ -23570,8 +24404,9 @@ function continuedEnvironment(owned) {
 * commissioned settled `done` two minutes later, unread.
 *
 * The reconciliation refusal protects against paying twice for an execution that may still run.
-* An environment the provider no longer holds runs nothing, so there is nothing to reconcile: the
-* loss is journaled as a destroyed teardown receipt, and the next prepare starts a new invocation.
+* An environment the provider no longer holds or reports terminal runs nothing. Runtime records
+* the provider's exact observation before the next prepare starts a new invocation. A terminal
+* record still requires cleanup at settlement; it is not a teardown receipt.
 */
 async function reconcileScopeRetainedOwnerEnvironment(scope) {
 	const state = owners.get(scope);
@@ -23581,7 +24416,7 @@ async function reconcileScopeRetainedOwnerEnvironment(scope) {
 	const continued = continuedEnvironment(owned);
 	if (continued === void 0) return { state: "none" };
 	const environmentId = continued.admission.environmentId;
-	if (destroyedEnvironmentIds(owned).has(environmentId)) return {
+	if (unusableEnvironmentIds(owned).has(environmentId)) return {
 		state: "lost",
 		environmentId
 	};
@@ -23590,21 +24425,31 @@ async function reconcileScopeRetainedOwnerEnvironment(scope) {
 		environmentId
 	};
 	let environment;
+	let terminalStatus;
 	try {
 		environment = await runAbortable(() => provider.get(environmentId), AbortSignal.any([scope.signal, AbortSignal.timeout(3e4)]), "retained owner environment check timed out");
+		if (environment !== null) {
+			const found = environment;
+			if (found.id !== environmentId || found.provider !== provider.name) return {
+				state: "unknown",
+				environmentId
+			};
+			const status = await runAbortable(() => found.status(), AbortSignal.any([scope.signal, AbortSignal.timeout(3e4)]), "retained owner environment status timed out");
+			if (status === "failed" || status === "expired") terminalStatus = status;
+		}
 	} catch {
 		return {
 			state: "unknown",
 			environmentId
 		};
 	}
-	if (environment !== null) return {
+	if (environment !== null && terminalStatus === void 0) return {
 		state: "live",
 		environmentId,
 		inFlight: continued.inFlight
 	};
 	scope.signal.throwIfAborted();
-	await args.journal.appendEvent(args.rootId, {
+	await args.journal.appendEvent(args.rootId, terminalStatus === void 0 ? {
 		kind: "environment-teardown",
 		id: args.nodeId,
 		provider: provider.name,
@@ -23613,6 +24458,14 @@ async function reconcileScopeRetainedOwnerEnvironment(scope) {
 		detail: "lost: the provider no longer holds this environment, so the next invocation starts in a new one",
 		seq: state.nextSequence(),
 		at: new Date(args.now()).toISOString()
+	} : {
+		kind: "environment-terminal",
+		id: args.nodeId,
+		provider: provider.name,
+		environmentId,
+		status: terminalStatus,
+		seq: state.nextSequence(),
+		at: new Date(args.now()).toISOString()
 	});
 	return {
 		state: "lost",
@@ -23635,9 +24488,9 @@ async function prepareScopeRetainedOwnerTask(scope, task) {
 		const accepted = [...attempt].reverse().find((event) => event.kind === "execution-result");
 		if (accepted?.kind === "execution-result") state.acceptedRef = accepted;
 	}
-	const destroyed = destroyedEnvironmentIds(owned);
+	const unusable = unusableEnvironmentIds(owned);
 	const inFlight = continuedEnvironment(owned);
-	if (inFlight?.inFlight && destroyed.has(inFlight.admission.environmentId)) {
+	if (inFlight?.inFlight && unusable.has(inFlight.admission.environmentId)) {
 		delete state.inputSequence;
 		delete state.taskRef;
 		state.admissions.length = 0;
@@ -23653,7 +24506,15 @@ async function prepareScopeRetainedOwnerTask(scope, task) {
 		state.admissions.length = 0;
 		delete state.acceptedConsumed;
 	}
-	if (state.priorSession !== void 0 && destroyed.has(state.priorSession.environmentId)) delete state.priorSession;
+	if (state.priorSession !== void 0 && unusable.has(state.priorSession.environmentId)) delete state.priorSession;
+	const segmentStarts = owned.filter((event) => event.kind === "seat-segment" && event.phase === "started");
+	const latestSeat = segmentStarts.at(-1);
+	const previousSeat = segmentStarts.at(-2);
+	if (latestSeat && previousSeat && latestSeat.provider !== previousSeat.provider && owned.indexOf(latestSeat) > owned.indexOf(latestInput)) state.forceNewSession = true;
+	if (state.forceNewSession) {
+		delete state.priorSession;
+		delete state.forceNewSession;
+	}
 	state.prepared = true;
 	const capable = await restoreCapable(state.provider);
 	const restoreFor = (inputIndex) => {
@@ -23702,26 +24563,247 @@ async function scopeRetainedOwnerResult(scope) {
 	if (out === void 0 || contentAddress(out) !== event.outRef) throw new ValidationError$1("retained owner result is missing or corrupt");
 	assertValidSpend(event.spent, "replayed retained owner result");
 	return {
-		outRef: event.outRef,
-		out,
-		spent: event.spent,
-		...event.verdict ? { verdict: event.verdict } : {},
-		...event.outcome ? { outcome: event.outcome } : {}
+		outRef: event.outRef,
+		out,
+		spent: event.spent,
+		...event.verdict ? { verdict: event.verdict } : {},
+		...event.outcome ? { outcome: event.outcome } : {}
+	};
+}
+async function scopeRetainedOwnerPriorSpend(scope) {
+	const state = owners.get(scope);
+	if (!state) return zeroSpend();
+	const events = (await state.args.journal.loadTree(state.args.rootId) ?? []).filter((event) => event.id === state.args.nodeId);
+	const input = [...events].reverse().find((event) => event.kind === "execution-input");
+	if (!input) return zeroSpend();
+	return events.slice(events.indexOf(input)).reduce((total, event) => event.kind === "metered" ? addSpend(total, event.spend) : total, zeroSpend());
+}
+/** Called only after the scope verifies the accepted invocation's materialization. */
+function consumeScopeRetainedOwnerResult(scope) {
+	const state = owners.get(scope);
+	if (!state?.acceptedRef) throw new ValidationError$1("retained owner has no accepted result");
+	state.acceptedConsumed = true;
+}
+//#endregion
+//#region src/runtime/supervise/seat-chain.ts
+var SeatChainExhaustedError = class extends Error {
+	resumeAt;
+	constructor(resumeAt) {
+		super(`authored subscription seat chain exhausted; resume at ${resumeAt}`);
+		this.name = "SeatChainExhaustedError";
+		this.resumeAt = resumeAt;
+	}
+};
+/** One logical node's durable chain. The spawn journal is the sole transition authority. */
+var SeatChain = class {
+	profile;
+	nodeId;
+	rootId;
+	journal;
+	select;
+	now;
+	onSegment;
+	beforeStart;
+	observedThrough = -1;
+	constructor(profile, nodeId, rootId, journal, select, now = Date.now, onSegment, beforeStart) {
+		this.profile = profile;
+		this.nodeId = nodeId;
+		this.rootId = rootId;
+		this.journal = journal;
+		this.select = select;
+		this.now = now;
+		this.onSegment = onSegment;
+		this.beforeStart = beforeStart;
+	}
+	async next(afterUsageLimit = false, afterRecheck = false) {
+		const stages = authoredSeatStages(this.profile);
+		if (!stages) throw new ValidationError$1("SeatChain requires authored AgentProfile.seats");
+		const allEvents = await this.journal.loadTree(this.rootId) ?? [];
+		const events = allEvents.filter((event) => event.kind === "seat-segment" && event.id === this.nodeId);
+		const destroyed = new Set(allEvents.filter((event) => event.kind === "environment-teardown" && event.id === this.nodeId && event.destroyed).map((event) => event.environmentId));
+		let admittedEnvironmentId;
+		for (const event of allEvents) if (event.kind === "execution-admitted" && event.id === this.nodeId && event.admission.phase === "environment") admittedEnvironmentId = event.admission.environmentId;
+		const retainedEnvironmentId = admittedEnvironmentId !== void 0 && !destroyed.has(admittedEnvironmentId) ? admittedEnvironmentId : void 0;
+		await this.reconcile(events);
+		const starts = events.filter((event) => event.phase === "started");
+		const last = starts.at(-1);
+		const closed = last && events.some((event) => event.phase === "ended" && event.segmentIndex === last.segmentIndex);
+		if (last && !closed && afterUsageLimit) await this.end(last, "usage-limit");
+		const resume = last && !closed && !afterUsageLimit;
+		const segmentIndex = resume ? last.segmentIndex : (last?.segmentIndex ?? -1) + 1;
+		const firstStageIndex = afterRecheck ? 0 : last?.stageIndex ?? 0;
+		let earliestReset;
+		for (let stageIndex = firstStageIndex; stageIndex < stages.length; stageIndex += 1) {
+			const stage = stages[stageIndex];
+			const excludedSeatIds = (afterRecheck ? [] : starts).filter((event) => event.stageIndex === stageIndex && (!resume || event.seat !== last.seat)).map((event) => event.seat);
+			const prior = last === void 0 ? void 0 : {
+				seat: last.seat,
+				harness: last.harness,
+				provider: last.provider,
+				model: last.model
+			};
+			const preceding = resume ? starts.at(-2) : last;
+			const requiresNativeTurnGrant = Boolean(preceding && preceding.provider === stage.provider && preceding.harness === stage.harness && (!resume || preceding.seat !== last.seat));
+			const selection = checkedSeatSelection(stage, await this.select({
+				profile: this.profile,
+				nodeId: this.nodeId,
+				stage,
+				stageIndex,
+				segmentIndex,
+				excludedSeatIds,
+				requiresNativeTurnGrant,
+				...retainedEnvironmentId === void 0 ? {} : { retainedEnvironmentId },
+				...prior === void 0 ? {} : { previous: prior },
+				...resume ? { resumeSeatId: last.seat } : {}
+			}));
+			if ("resumeAt" in selection) {
+				const reset = Date.parse(selection.resumeAt);
+				earliestReset = earliestReset === void 0 ? reset : Math.min(earliestReset, reset);
+				if (resume) break;
+				continue;
+			}
+			if (resume && selection.seat !== last.seat) throw new ValidationError$1("selectSeat: resume changed the committed seat");
+			if (excludedSeatIds.includes(selection.seat)) throw new ValidationError$1("selectSeat: selected an exhausted seat");
+			if (preceding && preceding.seat !== selection.seat && preceding.provider === stage.provider && preceding.harness === stage.harness && selection.nativeTurnGrant !== true) throw new ValidationError$1("selectSeat: same-environment seat requires a verified native turn grant");
+			const active = {
+				seat: selection.seat,
+				stageIndex,
+				segmentIndex,
+				stage,
+				backend: selection.backend,
+				...selection.nativeTurnGrant === true ? { nativeTurnGrant: true } : {},
+				...preceding === void 0 ? {} : { previous: {
+					seat: preceding.seat,
+					harness: preceding.harness,
+					provider: preceding.provider,
+					model: preceding.model
+				} }
+			};
+			if (!resume) {
+				await this.beforeStart?.(active, prior);
+				const at = new Date(this.now()).toISOString();
+				await this.journal.appendEvent(this.rootId, {
+					kind: "seat-segment",
+					id: this.nodeId,
+					segmentIndex,
+					stageIndex,
+					phase: "started",
+					seat: selection.seat,
+					harness: stage.harness,
+					provider: stage.provider,
+					model: stage.model,
+					seq: segmentIndex,
+					at
+				});
+				await this.onSegment?.({
+					seat: selection.seat,
+					harness: stage.harness,
+					provider: stage.provider,
+					model: stage.model,
+					startedAt: at
+				}, "started");
+				this.observedThrough = events.length;
+				return active;
+			}
+			return active;
+		}
+		const recheckAt = Math.max(earliestReset ?? 0, this.now() + 12e4);
+		throw new SeatChainExhaustedError(new Date(recheckAt).toISOString());
+	}
+	async close(reason) {
+		const events = (await this.journal.loadTree(this.rootId) ?? []).filter((event) => event.kind === "seat-segment" && event.id === this.nodeId);
+		await this.reconcile(events);
+		const last = events.filter((event) => event.phase === "started").at(-1);
+		if (last && !events.some((event) => event.phase === "ended" && event.segmentIndex === last.segmentIndex)) await this.end(last, reason);
+	}
+	async end(start, reason) {
+		const at = new Date(this.now()).toISOString();
+		await this.journal.appendEvent(this.rootId, {
+			...start,
+			phase: "ended",
+			reason,
+			at
+		});
+		await this.onSegment?.({
+			seat: start.seat,
+			harness: start.harness,
+			provider: start.provider,
+			model: start.model,
+			startedAt: start.at,
+			endedAt: at,
+			reason
+		}, "ended");
+		this.observedThrough += 1;
+	}
+	/** A crash may land between the authoritative journal append and observer delivery. On
+	* reconstruction, deliver every unobserved boundary again; the observer projection folds
+	* repeated boundaries by seat and start time, so a callback never decides execution identity. */
+	async reconcile(events) {
+		const starts = /* @__PURE__ */ new Map();
+		for (let index = 0; index < events.length; index += 1) {
+			const event = events[index];
+			if (event.phase === "started") starts.set(event.segmentIndex, event);
+			if (index <= this.observedThrough) continue;
+			const start = event.phase === "started" ? event : starts.get(event.segmentIndex);
+			if (!start) throw new ValidationError$1("seat segment ended without a committed start");
+			await this.onSegment?.({
+				seat: start.seat,
+				harness: start.harness,
+				provider: start.provider,
+				model: start.model,
+				startedAt: start.at,
+				...event.phase === "ended" ? {
+					endedAt: event.at,
+					reason: event.reason
+				} : {}
+			}, event.phase);
+			this.observedThrough = index;
+		}
+	}
+};
+/** Preserve the authored profile for identity; only the provider-facing copy changes stages. */
+function seatExecutionProfile(profile, stage) {
+	const { seats: _seats, ...withoutSeats } = profile;
+	return {
+		...withoutSeats,
+		harness: stage.harness,
+		...stage.tools === void 0 ? {} : { tools: stage.tools },
+		...stage.permissions === void 0 ? {} : { permissions: stage.permissions },
+		model: {
+			...profile.model,
+			default: stage.model,
+			provider: stage.provider
+		}
 	};
 }
-async function scopeRetainedOwnerPriorSpend(scope) {
-	const state = owners.get(scope);
-	if (!state) return zeroSpend();
-	const events = (await state.args.journal.loadTree(state.args.rootId) ?? []).filter((event) => event.id === state.args.nodeId);
-	const input = [...events].reverse().find((event) => event.kind === "execution-input");
-	if (!input) return zeroSpend();
-	return events.slice(events.indexOf(input)).reduce((total, event) => event.kind === "metered" ? addSpend(total, event.spend) : total, zeroSpend());
+function authoredSeatStages(profile) {
+	const seats = profile.seats;
+	if (seats === void 0) return void 0;
+	if (!Array.isArray(seats) || seats.length === 0) throw new ValidationError$1("AgentProfile.seats must be a nonempty ordered chain");
+	return seats;
 }
-/** Called only after the scope verifies the accepted invocation's materialization. */
-function consumeScopeRetainedOwnerResult(scope) {
-	const state = owners.get(scope);
-	if (!state?.acceptedRef) throw new ValidationError$1("retained owner has no accepted result");
-	state.acceptedConsumed = true;
+const USAGE_LIMIT_CODES = /* @__PURE__ */ new Set([
+	"subscription_usage_limit",
+	"usage_limit_reached",
+	"usage_limit_exceeded",
+	"weekly_limit_reached",
+	"session_limit_reached"
+]);
+/** Normalize a native harness refusal into a typed limit. A plain HTTP 429 is insufficient. */
+function subscriptionUsageLimitSignal(failure) {
+	if (failure.errorCode && USAGE_LIMIT_CODES.has(failure.errorCode.toLowerCase())) return "subscription-usage-limit";
+	if (/\bYou've hit your (?:usage|weekly|session) limit\b/iu.test(failure.error)) return "subscription-usage-limit";
+}
+/** An ineligible or misconfigured account must never turn an authored stage into another model. */
+function checkedSeatSelection(stage, selected) {
+	if ("resumeAt" in selected) {
+		if (!Number.isFinite(Date.parse(selected.resumeAt))) throw new ValidationError$1("selectSeat: resumeAt must be an ISO timestamp");
+		return selected;
+	}
+	if (!selected.seat.trim()) throw new ValidationError$1("selectSeat: seat must be nonempty");
+	if (stage.selector.kind === "seat" && stage.selector.id !== selected.seat) throw new ValidationError$1("selectSeat: selection does not match the authored seat");
+	if (selected.backend.backend !== "provider") throw new ValidationError$1("selectSeat: selection must use a provider backend");
+	return selected;
 }
 //#endregion
 //#region src/runtime/supervise/scope.ts
@@ -25139,7 +26221,23 @@ async function publishOwnerMaterialization(state, runtime, declaration, bindingI
 		await rejectOwnerMaterialization(state);
 		throw new ValidationError$1("scope owner returned invalid materialization evidence", { cause: error });
 	}
-	if (state.prior !== void 0) {
+	const committed = state.receipt ?? state.prior;
+	if (committed?.status === "known" && canonicalCandidateDigest(committed) !== canonicalCandidateDigest(receipt)) {
+		const events = await state.journal.loadTree(state.retainedRoot) ?? [];
+		const started = [...events].reverse().find((event) => event.id === state.nodeId && event.kind === "seat-segment" && event.phase === "started");
+		const latestMaterialization = [...events].reverse().find((event) => event.id === state.nodeId && (event.kind === "materialized" || event.kind === "seat-materialized"));
+		const lastSegmentIndex = latestMaterialization?.kind === "seat-materialized" ? latestMaterialization.segmentIndex : 0;
+		const authored = agentProfileSchema.safeParse(state.authoredProfile);
+		const authoredProfile = authored.success ? authored.data : void 0;
+		const stage = authoredProfile && started?.kind === "seat-segment" ? authoredSeatStages(authoredProfile)?.[started.stageIndex] : void 0;
+		if (authoredProfile && stage && started?.kind === "seat-segment" && started.segmentIndex > lastSegmentIndex && started.harness === stage.harness && started.provider === stage.provider && started.model === stage.model && receipt.status === "known" && receipt.effectiveProfileDigest === canonicalAgentProfileDigest(providerVisibleProfile(seatExecutionProfile(authoredProfile, stage))) && receipt.model.status === "known" && receipt.model.id === stage.model) {
+			await appendOwnerSeatMaterialization(state, started.segmentIndex, receipt, binding);
+			state.onReceipt?.(receipt, binding);
+			state.publishedThisProcess = true;
+			return;
+		}
+	}
+	if (state.prior !== void 0 && state.receipt === void 0) {
 		if (canonicalCandidateDigest(state.prior) !== canonicalCandidateDigest(receipt)) {
 			await rejectOwnerMaterialization(state);
 			throw new ValidationError$1("scope owner materialization changed across resume; backend, model, execution identity, and plan must match");
@@ -25221,12 +26319,12 @@ async function restoreScopeOwnerAcceptedExecution(scope) {
 	const resultIndex = latestResult === void 0 ? -1 : owned.indexOf(latestResult);
 	const result = owned[resultIndex];
 	if (inputIndex < 0 || resultIndex <= inputIndex || result?.kind !== "execution-result") throw new ValidationError$1("scope owner has no accepted retained invocation");
-	const receiptEvent = owned.slice(0, resultIndex).reverse().find((event) => event.kind === "materialized");
+	const receiptEvent = owned.slice(0, resultIndex).reverse().find((event) => event.kind === "materialized" || event.kind === "seat-materialized");
 	const bindingEvent = owned.slice(inputIndex, resultIndex).reverse().find((event) => event.kind === "execution-bound");
-	if (receiptEvent?.kind !== "materialized" || bindingEvent?.kind !== "execution-bound") throw new ValidationError$1("accepted scope owner result has no preceding materialization evidence");
+	if (receiptEvent?.kind !== "materialized" && receiptEvent?.kind !== "seat-materialized" || bindingEvent?.kind !== "execution-bound") throw new ValidationError$1("accepted scope owner result has no preceding materialization evidence");
 	const { receipt } = receiptEvent;
 	const { binding } = bindingEvent;
-	if (receipt.status !== "known" || binding.status !== "known" || receipt.runtime !== state.runtime || receipt.authoredProfileDigest !== state.authoredProfileDigest || binding.materializationReceiptDigest !== canonicalCandidateDigest(receipt) || state.prior !== void 0 && canonicalCandidateDigest(state.prior) !== canonicalCandidateDigest(receipt)) throw new ValidationError$1("accepted scope owner materialization does not match the resumed owner");
+	if (receipt.status !== "known" || binding.status !== "known" || receipt.runtime !== state.runtime || receipt.authoredProfileDigest !== state.authoredProfileDigest || binding.materializationReceiptDigest !== canonicalCandidateDigest(receipt) || (state.receipt ?? state.prior) !== void 0 && canonicalCandidateDigest(state.receipt ?? state.prior) !== canonicalCandidateDigest(receipt)) throw new ValidationError$1("accepted scope owner materialization does not match the resumed owner");
 	assertValidSpend(result.spent, "accepted scope owner result");
 	const output = await state.blobs.get(result.outRef);
 	if (output === void 0 || contentAddress(output) !== result.outRef) throw new ValidationError$1("accepted scope owner output is missing or corrupt");
@@ -25318,6 +26416,18 @@ async function appendOwnerMaterialization(state, receipt, binding) {
 	state.receipt = receipt;
 	await appendOwnerBinding(state, binding);
 }
+async function appendOwnerSeatMaterialization(state, segmentIndex, receipt, binding) {
+	await appendOwnerEvidence(state, {
+		kind: "seat-materialized",
+		id: state.nodeId,
+		segmentIndex,
+		receipt,
+		seq: segmentIndex,
+		at: new Date(state.now()).toISOString()
+	});
+	state.receipt = receipt;
+	await appendOwnerBinding(state, binding);
+}
 async function appendOwnerBinding(state, binding) {
 	await appendOwnerEvidence(state, {
 		kind: "execution-bound",
@@ -25332,10 +26442,10 @@ async function appendOwnerEvidence(state, event) {
 	for (const root of /* @__PURE__ */ new Set([state.root, state.retainedRoot])) await appendExactMaterializationEvent(state.journal, root, event);
 }
 async function appendExactMaterializationEvent(journal, root, event) {
-	const prior = (await journal.loadTree(root))?.find((item) => item.id === event.id && (event.kind === "materialized" ? item.kind === "materialized" : item.kind === "execution-bound" && item.binding.attemptId === event.binding.attemptId));
-	if (prior?.kind === "materialized" || prior?.kind === "execution-bound") {
-		const previous = prior.kind === "materialized" ? prior.receipt : prior.binding;
-		const next = event.kind === "materialized" ? event.receipt : event.binding;
+	const prior = (await journal.loadTree(root))?.find((item) => item.id === event.id && (event.kind === "materialized" ? item.kind === "materialized" : event.kind === "seat-materialized" ? item.kind === "seat-materialized" && item.segmentIndex === event.segmentIndex : item.kind === "execution-bound" && item.binding.attemptId === event.binding.attemptId));
+	if (prior?.kind === "materialized" || prior?.kind === "seat-materialized" || prior?.kind === "execution-bound") {
+		const previous = prior.kind === "execution-bound" ? prior.binding : prior.receipt;
+		const next = event.kind === "execution-bound" ? event.binding : event.receipt;
 		if (canonicalCandidateDigest(previous) !== canonicalCandidateDigest(next)) throw new ValidationError$1("scope execution evidence conflicts with its committed record");
 		return;
 	}
@@ -26213,7 +27323,7 @@ function isInfraError(err) {
 * journal so the executor can run its `act` inside a nested scope. `act` fails loud if
 * called directly — a driver child runs THROUGH its nested-scope executor, never as a root.
 */
-function driverChild(profile, driver, journal, execution, acceptedSubmission, recoverExecutor, unassessedOutput) {
+function driverChild(profile, driver, journal, execution, acceptedSubmission, recoverExecutor, unassessedOutput, leafDeliverable) {
 	const name = profile.name ?? driver.name;
 	const traceSource = driver.traceSource;
 	const progress = driver.progress;
@@ -26228,6 +27338,7 @@ function driverChild(profile, driver, journal, execution, acceptedSubmission, re
 		journal,
 		...acceptedSubmission ? { acceptedSubmission } : {},
 		...unassessedOutput ? { unassessedOutput } : {},
+		...leafDeliverable ? { leafDeliverable } : {},
 		...recoverExecutor ? { recoverExecutor } : {},
 		...traceSource ? { traceSource } : {},
 		...progress ? { progress } : {},
@@ -26435,642 +27546,144 @@ function withDriverExecutor(base) {
 			const spec = executableAgentSpecSnapshot(rawSpec, "driver executor registry");
 			if (spec.driverRuntime === "driver" && !spec.executor) return {
 				succeeded: true,
-				value: ((_ignored, context) => driverExecutorFactory(spec, context))
+				value: ((_ignored, context) => isDriverSpec(spec) && spec.leafDeliverable ? attestNestedDriverTreeOwner(gateOnDeliverable(driverExecutorFactory(spec, context), spec.leafDeliverable)) : driverExecutorFactory(spec, context))
 			};
 			const resolved = base.resolve(spec);
 			if (!resolved.succeeded) return resolved;
 			return {
-				succeeded: true,
-				value: (_ignored, context) => resolved.value(spec, context)
-			};
-		}
-	};
-}
-async function closeNestedScope(scope, controller, reason) {
-	if (!controller.signal.aborted) controller.abort(reason);
-	for (;;) if (await scope.next() === null) break;
-	const view = scope.view;
-	if (view.inFlight > 0) throw new ValidationError$1(`driverExecutor: nested cleanup left ${view.inFlight} running nodes`);
-}
-/** The nested tree's full event list — the one evidence the spend, verdict, AND driver-inference
-*  roll-ups read off the same journal the supervisor sums. */
-async function loadTreeEvents(journal, nestedRoot) {
-	const events = await journal.loadTree(nestedRoot);
-	if (events === void 0) throw new ValidationError$1(`driverExecutor: nested tree '${nestedRoot}' missing from the journal after run (corrupted log)`);
-	return events;
-}
-function isSettled(ev) {
-	return ev.kind === "settled" || ev.kind === "cancelled" && ev.spent !== void 0;
-}
-/** Sum the conserved spend over the nested tree's settled events — the honest per-channel
-*  roll-up of the whole sub-tree's child WORK. */
-function sumSpend(settled) {
-	return settled.reduce((total, ev) => addSpend(total, ev.spent), zeroSpend());
-}
-/** Sum the nested tree's `metered` events — the sub-tree's whole driver INFERENCE (this driver's
-*  own turns + any sub-driver inference already re-homed into this tree). Re-homed up to the parent
-*  as one `metered` event; never reconciled (already pool-debited live via `observe`). */
-function sumMetered(events) {
-	return events.reduce((total, ev) => ev.kind === "metered" ? addSpend(total, ev.spend) : total, zeroSpend());
-}
-/** An all-zero spend that carries an UNKNOWN marker counts as non-zero: a sub-driver whose turns
-*  went unmeasured did real work, and dropping its `metered` event here would re-hide upstream the
-*  very turn the driver refused to skip. */
-function isNonZeroSpend(s) {
-	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false || Object.keys(s.resources ?? {}).length > 0;
-}
-/** A spend, or `undefined` when it is all-zero — so `metered()` returns undefined for a driver
-*  whose sub-tree did no inference (and the parent journals no empty `metered` event). */
-function nonZeroOrUndef(s) {
-	return isNonZeroSpend(s) ? s : void 0;
-}
-/** Sum the nested tree's metered events, tolerating a missing tree (a crash before `beginTree`
-*  landed) — never throw here, or it would mask the original `act` error on the crash path. */
-async function safeRollup(journal, nestedRoot) {
-	try {
-		const events = await loadTreeEvents(journal, nestedRoot);
-		const childWork = sumSpend(events.filter(isSettled));
-		const metered = nonZeroOrUndef(sumMetered(events));
-		return {
-			metered,
-			accounting: {
-				reported: childWork,
-				reservation: addSpend(childWork, metered ?? zeroSpend())
-			}
-		};
-	} catch {
-		return;
-	}
-}
-/** Derive the driver child's delivery verdict from an accepted direct submission, or from its
-*  DIRECT children's settlements and the manager's actual finalized output: `valid` iff the
-*  manager's own assignment check accepted a submission, or a direct child delivered AND the
-*  finalizer returned a defined output;
-*  `score` = the best delivered score. Returns `undefined` when no child settled at all (the
-*  driver itself produced nothing to bubble a verdict from). Fail-closed: a child whose verdict
-*  carried no `valid` counts as not-delivered. */
-function deriveDeliveryVerdict(settled, finalizedOutput, acceptedSubmission) {
-	if (acceptedSubmission) return {
-		valid: true,
-		score: 1
-	};
-	let sawChild = false;
-	let anyValid = false;
-	let bestValidScore;
-	let bestDoneScore;
-	for (const ev of settled) {
-		sawChild = true;
-		if (ev.status !== "done") continue;
-		const score = ev.verdict?.score;
-		if (score !== void 0 && (bestDoneScore === void 0 || score > bestDoneScore)) bestDoneScore = score;
-		if (ev.verdict?.valid === true) {
-			anyValid = true;
-			if (score !== void 0 && (bestValidScore === void 0 || score > bestValidScore)) bestValidScore = score;
-		}
-	}
-	if (!sawChild) return void 0;
-	const accepted = anyValid && finalizedOutput !== void 0;
-	return {
-		valid: accepted,
-		score: accepted ? bestValidScore ?? 1 : bestDoneScore ?? 0
-	};
-}
-function readNestedScopeSeam(ctx) {
-	const seam = ctx.seams[nestedScopeSeamKey];
-	if (!seam || typeof seam.mount !== "function") throw new ValidationError$1(`driverExecutor: missing required seam "${nestedScopeSeamKey}" — a driver child must be spawned through a Scope that seeds it (the keystone scope does)`);
-	return seam;
-}
-function isAgent(value) {
-	return typeof value === "object" && value !== null && typeof value.act === "function" && typeof value.name === "string";
-}
-/** Parent journals may already contain an interrupted driver's inference prefix. */
-function unreportedSpend(total, prior) {
-	const tokens = { ...total.tokens };
-	for (const key of [
-		"input",
-		"output",
-		"freshInput",
-		"cacheRead",
-		"cacheWrite"
-	]) {
-		const value = total.tokens[key];
-		if (value !== void 0) tokens[key] = Math.max(0, value - (prior.tokens[key] ?? 0));
-	}
-	return {
-		...total,
-		...addResourceSpend(total.resources === void 0 ? void 0 : Object.fromEntries(Object.entries(total.resources).map(([name, value]) => {
-			const previous = prior.resources?.[name];
-			if (previous && previous.unit !== value.unit) throw new ValidationError$1(`resource ${name}: unit mismatch`);
-			return [name, {
-				...value,
-				amount: Math.max(0, value.amount - (previous?.amount ?? 0)),
-				known: value.known && (previous?.known ?? true)
-			}];
-		}))),
-		iterations: Math.max(0, total.iterations - prior.iterations),
-		tokens,
-		usd: Math.max(0, total.usd - prior.usd),
-		ms: Math.max(0, total.ms - prior.ms),
-		...total.usdEstimated === void 0 ? {} : { usdEstimated: Math.max(0, total.usdEstimated - (prior.usdEstimated ?? 0)) },
-		...total.boxMinutes === void 0 ? {} : { boxMinutes: Math.max(0, total.boxMinutes - (prior.boxMinutes ?? 0)) }
-	};
-}
-//#endregion
-//#region src/runtime/supervise/continuation.ts
-/**
-* The continuation: what a manager with a completion check is told when its turn ends and the
-* check is unmet, and the one rule that decides whether it is sent back.
-*
-* Measured on discovery-lab before this module (2026-09-24, 670 settled runs, 1,596 re-entries):
-* 1,565 re-entries followed a failed turn and resent the original task, and 31 carried note text.
-* The note Runtime wrote itself held seven fixed lines and no field for the check's verdict. Of 40
-* episodes where the director ended on its own and the outside check disagreed, 33 were told
-* nothing before they ended. 100 of 236 resubmits sent the identical packet. So the director
-* mostly graded itself, and when it was wrong it heard nothing it could use.
-*
-* The design (discovery `docs/38-one-loop-and-continuation.md`) makes three things single, and
-* this module holds the part Runtime owns:
-*
-*  - ONE CHECK. A check reading is a {@link CheckVerdict}: pass, the items it read, the composite,
-*    and one `FAIL <item> <where>: <reason>` line per failed item. The same check decides
-*    `submit_result`, runs when a turn ends without an accepted result, scores the finished run,
-*    and ranks versions. A check that could not run gives no verdict ({@link CheckUnavailableError}),
-*    and the loop pauses instead of blaming the director.
-*  - ONE RESEND RULE. {@link ContinuationPolicy} is required for a manager with a check. It holds a
-*    deadline and `maxBarren`, the re-entered turns in a row that may end without progress. There
-*    is no re-prompt count and no default: a retry default in source is a research decision.
-*  - ONE NOTE. {@link composeContinuationNote} writes it. Runtime owns the facts and their order;
-*    the {@link ContinuationProfile} owns every instruction word, so an optimizer can change the
-*    words without touching code. A play may append a section, never remove or rewrite one.
-*
-* Evidence behind the note's shape: located errors help (given the first mistake's true location,
-* fix rates rose 23.5 to 43.9 points, Tyen 2023); unsupported pressure does not (threats and tips
-* had no significant effect, Wharton 2025; challenges without evidence flipped correct answers,
-* FlipFlop); repeated summaries drop detail while itemized additions do not (ACE). So the note is
-* a list of located facts, findings are added and marked resolved rather than rewritten, and the
-* profile, not this file, decides how blunt the words are.
-*/
-/**
-* The check could not run: its box did not start, its judge's provider refused, its program
-* crashed. It is not a verdict on the result. Inside a run the loop pauses, as it does for an
-* unavailable upstream, and the refusal tells the director its result was not judged.
-*/
-var CheckUnavailableError = class extends Error {
-	constructor(message, options) {
-		super(message, options);
-		this.name = "CheckUnavailableError";
-	}
-};
-/** Read a check function's return value into a verdict. Anything but `true` or a passing verdict
-*  is a failure: a check fails closed. */
-function checkVerdictOf(outcome) {
-	if (outcome === true) return { pass: true };
-	if (typeof outcome !== "object" || outcome === null || Array.isArray(outcome)) return { pass: false };
-	const raw = outcome;
-	const items = typeof raw.items === "object" && raw.items !== null && !Array.isArray(raw.items) ? Object.fromEntries(Object.entries(raw.items).filter((entry) => typeof entry[1] === "number" && Number.isFinite(entry[1]))) : void 0;
-	const failures = Array.isArray(raw.failures) ? raw.failures.filter((line) => typeof line === "string" && line.trim() !== "") : void 0;
-	return Object.freeze({
-		pass: raw.pass === true,
-		...items === void 0 ? {} : { items: Object.freeze(items) },
-		...finite(raw.composite) ? { composite: raw.composite } : {},
-		...finite(raw.threshold) ? { threshold: raw.threshold } : {},
-		...failures === void 0 ? {} : { failures: Object.freeze(failures) },
-		...typeof raw.review === "string" && raw.review.trim() !== "" ? { review: raw.review.trim() } : {}
-	});
-}
-/**
-* Read an agent-eval `JudgeScore` from a check program into a verdict.
-*
-* Each dimension is a checked item. `notes` lines that start with `FAIL ` are the failures; the
-* remaining lines are the check's review. The verdict passes when `composite >= threshold` and the
-* score is not marked `failed`; a `failed` score means the judge itself did not run, which is
-* {@link CheckUnavailableError}, not a verdict.
-*/
-function verdictFromJudgeScore(score, threshold) {
-	if (score.failed === true) throw new CheckUnavailableError(`the check's judge did not run: ${score.notes}`);
-	const lines = score.notes.split("\n").map((line) => line.trimEnd());
-	const failures = lines.filter((line) => line.startsWith("FAIL "));
-	const review = lines.filter((line) => !line.startsWith("FAIL ") && line.trim() !== "").join("\n");
-	return checkVerdictOf({
-		pass: score.composite >= threshold,
-		items: score.dimensions,
-		composite: score.composite,
-		threshold,
-		failures,
-		...review === "" ? {} : { review }
-	});
+				succeeded: true,
+				value: (_ignored, context) => resolved.value(spec, context)
+			};
+		}
+	};
 }
-/** Items that fail in `verdict`: every item below 1, or the named items of its FAIL lines. */
-function failedItems(verdict) {
-	if (verdict.items !== void 0) return Object.entries(verdict.items).filter(([, value]) => value < 1).map(([name]) => name);
-	return (verdict.failures ?? []).map((line) => line.slice(5).split(/[\s:]/u)[0] ?? "");
+async function closeNestedScope(scope, controller, reason) {
+	if (!controller.signal.aborted) controller.abort(reason);
+	for (;;) if (await scope.next() === null) break;
+	const view = scope.view;
+	if (view.inFlight > 0) throw new ValidationError$1(`driverExecutor: nested cleanup left ${view.inFlight} running nodes`);
 }
-/** Items that pass in `verdict`. */
-function passedItems(verdict) {
-	return Object.entries(verdict.items ?? {}).filter(([, value]) => value >= 1).map(([name]) => name);
+/** The nested tree's full event list — the one evidence the spend, verdict, AND driver-inference
+*  roll-ups read off the same journal the supervisor sums. */
+async function loadTreeEvents(journal, nestedRoot) {
+	const events = await journal.loadTree(nestedRoot);
+	if (events === void 0) throw new ValidationError$1(`driverExecutor: nested tree '${nestedRoot}' missing from the journal after run (corrupted log)`);
+	return events;
 }
-/** Resolve and check a policy before any compute. Returns the deadline in epoch ms. */
-function admitContinuationPolicy(policy, context) {
-	if (typeof policy !== "object" || policy === null) throw new ValidationError$1(`${context}: continuation must be an object`);
-	const deadlineMs = typeof policy.deadline === "string" ? Date.parse(policy.deadline) : policy.deadline;
-	if (typeof deadlineMs !== "number" || !Number.isFinite(deadlineMs) || deadlineMs <= 0) throw new ValidationError$1(`${context}: continuation.deadline must be a finite time (epoch ms or ISO 8601)`);
-	if (!Number.isInteger(policy.maxBarren) || policy.maxBarren < 1) throw new ValidationError$1(`${context}: continuation.maxBarren must be an integer >= 1`);
-	if (policy.failures !== "verbatim" && policy.failures !== "off") throw new ValidationError$1(`${context}: continuation.failures must be 'verbatim' or 'off'`);
-	if (policy.panel !== "on" && policy.panel !== "off") throw new ValidationError$1(`${context}: continuation.panel must be 'on' or 'off'`);
-	if (policy.bar !== "on" && policy.bar !== "off") throw new ValidationError$1(`${context}: continuation.bar must be 'on' or 'off'`);
-	if (policy.panel === "on") {
-		if (typeof policy.runPanel !== "function") throw new ValidationError$1(`${context}: continuation.panel 'on' needs runPanel`);
-		const usd = policy.panelUsd;
-		if (usd === void 0 || !finite(usd.perContinuation) || !finite(usd.perRun) || usd.perContinuation <= 0 || usd.perRun < usd.perContinuation) throw new ValidationError$1(`${context}: continuation.panel 'on' needs panelUsd with 0 < perContinuation <= perRun`);
-	}
-	if (policy.append !== void 0 && typeof policy.append !== "function") throw new ValidationError$1(`${context}: continuation.append must be a function`);
-	admitContinuationProfile(policy.profile, context);
-	return deadlineMs;
+function isSettled(ev) {
+	return ev.kind === "settled" || ev.kind === "cancelled" && ev.spent !== void 0;
 }
-/** The facts a profile template may name. */
-const CONTINUATION_FACTS = [
-	"composite",
-	"threshold",
-	"failed",
-	"total",
-	"reads",
-	"owed",
-	"settled",
-	"delivered",
-	"continuation"
-];
-const factNames = new Set(CONTINUATION_FACTS);
-const placeholder = /\{([a-zA-Z]+)\}/gu;
-function admitContinuationProfile(profile, context) {
-	if (typeof profile !== "object" || profile === null) throw new ValidationError$1(`${context}: continuation.profile must be an object`);
-	if (typeof profile.id !== "string" || profile.id.trim() === "") throw new ValidationError$1(`${context}: continuation.profile.id must be non-empty`);
-	const texts = [
-		["opening", profile.opening],
-		["plan", profile.plan],
-		["rules", profile.rules],
-		...Object.entries(profile.headings ?? {}).map(([key, value]) => [`headings.${key}`, value]),
-		...profile.barRule === void 0 ? [] : [["barRule", profile.barRule]]
-	];
-	for (const key of [
-		"failures",
-		"protected",
-		"changed",
-		"findings",
-		"bar",
-		"plan",
-		"rules"
-	]) if (typeof profile.headings?.[key] !== "string") throw new ValidationError$1(`${context}: continuation.profile.headings.${key} must be a string`);
-	for (const [key, text] of texts) {
-		if (typeof text !== "string") throw new ValidationError$1(`${context}: continuation.profile.${key} must be a string`);
-		for (const match of text.matchAll(placeholder)) if (!factNames.has(match[1] ?? "")) throw new ValidationError$1(`${context}: continuation.profile.${key} names {${match[1]}}, which is not a fact Runtime supplies (${CONTINUATION_FACTS.join(", ")})`);
-	}
-	if (profile.review !== void 0) {
-		if (typeof profile.review !== "string" || profile.review.trim() === "") throw new ValidationError$1(`${context}: continuation.profile.review must be non-empty`);
-		for (const match of profile.review.matchAll(placeholder)) if (![
-			"version",
-			"path",
-			"score"
-		].includes(match[1] ?? "")) throw new ValidationError$1(`${context}: continuation.profile.review names {${match[1]}}; it may name {version}, {path} and {score}`);
-	}
-	if (profile.opening.trim() === "") throw new ValidationError$1(`${context}: continuation.profile.opening must be non-empty`);
-	for (const [index, question] of (profile.questions ?? []).entries()) if (typeof question !== "string" || question.trim() === "") throw new ValidationError$1(`${context}: continuation.profile.questions[${index}] must be a non-empty string`);
+/** Sum the conserved spend over the nested tree's settled events — the honest per-channel
+*  roll-up of the whole sub-tree's child WORK. */
+function sumSpend(settled) {
+	return settled.reduce((total, ev) => addSpend(total, ev.spent), zeroSpend());
 }
-/** Findings reach the note only when every citation resolves, at least two distinct spans are
-*  cited, and the independent verifier agreed. The best method in Who&When found the failing step
-*  14.2% of the time, so an unverified finding is noise with a citation. */
-function admitFinding(finding) {
-	if (!finding.verified) return false;
-	if (finding.citations.length === 0) return false;
-	if (!finding.citations.every((citation) => citation.resolved)) return false;
-	return new Set(finding.citations.map((citation) => citation.uri)).size >= 2;
+/** Sum the nested tree's `metered` events — the sub-tree's whole driver INFERENCE (this driver's
+*  own turns + any sub-driver inference already re-homed into this tree). Re-homed up to the parent
+*  as one `metered` event; never reconciled (already pool-debited live via `observe`). */
+function sumMetered(events) {
+	return events.reduce((total, ev) => ev.kind === "metered" ? addSpend(total, ev.spend) : total, zeroSpend());
 }
-/** About 1,500 tokens of findings. */
-const FINDINGS_CHAR_CAP = 6e3;
-/**
-* Rank the admitted findings by how many failed items they explain, drop repeats, and keep them
-* within the note's cap. Earlier findings stay as they were written (ACE: itemized additions keep
-* detail that repeated rewrites lose); a finding whose items all pass now is marked resolved.
-*/
-function distillFindings(prior, proposed, failing, continuation) {
-	const key = (claim) => claim.toLowerCase().replace(/\s+/gu, " ").trim();
-	const known = new Set(prior.map((finding) => key(finding.claim)));
-	const carried = prior.map((finding) => finding.resolvedAt === void 0 && (finding.items?.length ?? 0) > 0 && (finding.items ?? []).every((item) => !failing.has(item)) ? {
-		...finding,
-		resolvedAt: continuation
-	} : finding);
-	const fresh = proposed.filter(admitFinding).filter((finding) => {
-		const k = key(finding.claim);
-		if (known.has(k)) return false;
-		known.add(k);
-		return true;
-	}).map((finding) => ({
-		finding,
-		links: (finding.items ?? []).filter((item) => failing.has(item)).length
-	})).sort((a, b) => b.links - a.links);
-	const out = [...carried];
-	let used = carried.filter((finding) => finding.resolvedAt === void 0).reduce((sum, finding) => sum + finding.claim.length, 0);
-	for (const { finding } of fresh) {
-		if (used + finding.claim.length > FINDINGS_CHAR_CAP) break;
-		used += finding.claim.length;
-		out.push({
-			...finding,
-			admittedAt: continuation
-		});
-	}
-	return out;
+/** An all-zero spend that carries an UNKNOWN marker counts as non-zero: a sub-driver whose turns
+*  went unmeasured did real work, and dropping its `metered` event here would re-hide upstream the
+*  very turn the driver refused to skip. */
+function isNonZeroSpend(s) {
+	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false || Object.keys(s.resources ?? {}).length > 0;
 }
-/** Expand the profile's question templates over the failed items and the settled workers. */
-function expandQuestions(templates, failing, workers) {
-	const out = [];
-	for (const template of templates) {
-		const hasItem = template.includes("{item}");
-		const hasWorker = template.includes("{worker}");
-		if (!hasItem && !hasWorker) {
-			out.push(template);
-			continue;
-		}
-		const items = hasItem ? failing : [""];
-		const each = hasWorker ? workers.map((worker) => `${worker.id} (${worker.label})`) : [""];
-		for (const item of items) for (const worker of each) out.push(template.replaceAll("{item}", item).replaceAll("{worker}", worker));
+/** A spend, or `undefined` when it is all-zero — so `metered()` returns undefined for a driver
+*  whose sub-tree did no inference (and the parent journals no empty `metered` event). */
+function nonZeroOrUndef(s) {
+	return isNonZeroSpend(s) ? s : void 0;
+}
+/** Sum the nested tree's metered events, tolerating a missing tree (a crash before `beginTree`
+*  landed) — never throw here, or it would mask the original `act` error on the crash path. */
+async function safeRollup(journal, nestedRoot) {
+	try {
+		const events = await loadTreeEvents(journal, nestedRoot);
+		const childWork = sumSpend(events.filter(isSettled));
+		const metered = nonZeroOrUndef(sumMetered(events));
+		return {
+			metered,
+			accounting: {
+				reported: childWork,
+				reservation: addSpend(childWork, metered ?? zeroSpend())
+			}
+		};
+	} catch {
+		return;
 	}
-	return out;
 }
-/**
-* Write one continuation note, sections 1 to 8 of docs/38. Section 9, the run's state, is
-* `composeReentryTask`, which wraps this text. Pure: the same input writes the same note.
-*/
-function composeContinuationNote(input) {
-	const { profile, verdict } = input;
-	const items = verdict?.items ?? {};
-	const total = Object.keys(items).length;
-	const failing = verdict === void 0 ? [] : failedItems(verdict);
-	const facts = {
-		composite: verdict?.composite === void 0 ? "unknown" : format(verdict.composite),
-		threshold: verdict?.threshold === void 0 ? "unknown" : format(verdict.threshold),
-		failed: verdict === void 0 || total === 0 && (verdict.failures?.length ?? 0) === 0 ? "unknown" : String(failing.length),
-		total: total === 0 ? "unknown" : String(total),
-		reads: String(input.reads),
-		owed: input.owed?.trim() || "not described",
-		settled: String(input.progress.settledCount),
-		delivered: String(input.progress.deliveredCount ?? 0),
-		continuation: String(input.continuation)
-	};
-	const fill = (text) => text.replace(placeholder, (_, name) => facts[name] ?? `{${name}}`);
-	const sections = [verdict === void 0 ? "No check verdict is available yet." + (input.canSubmitResult === true ? " Submit a result through submit_result to request the check." : "") : verdict.pass ? "The check passes on the current state, but no result has been accepted." + (input.canSubmitResult === true ? " Call submit_result to request acceptance." : "") : fill(profile.opening).trim()];
-	const section = (heading, body) => {
-		if (body.length === 0) return;
-		sections.push([...heading.trim() === "" ? [] : [`## ${fill(heading)}`], ...body].join("\n"));
+/** Derive the driver child's delivery verdict from an accepted direct submission, or from its
+*  DIRECT children's settlements and the manager's actual finalized output: `valid` iff the
+*  manager's own assignment check accepted a submission, or a direct child delivered AND the
+*  finalizer returned a defined output;
+*  `score` = the best delivered score. Returns `undefined` when no child settled at all (the
+*  driver itself produced nothing to bubble a verdict from). Fail-closed: a child whose verdict
+*  carried no `valid` counts as not-delivered. */
+function deriveDeliveryVerdict(settled, finalizedOutput, acceptedSubmission) {
+	if (acceptedSubmission) return {
+		valid: true,
+		score: 1
 	};
-	if (input.failures === "verbatim" && verdict !== void 0) {
-		const lines = verdict.failures ?? [];
-		const shown = lines.slice(0, 40);
-		const more = lines.length - shown.length;
-		section(profile.headings.failures, [...shown, ...more > 0 ? [input.canReadMore ? `${more} more failure lines: call read_continuation with continuation ${input.continuation}.` : `${more} more failure lines are not shown.`] : []]);
-		const passing = passedItems(verdict);
-		section(profile.headings.protected, passing.length === 0 ? [] : [passing.join(", ")]);
-		if (input.previous !== void 0) {
-			const before = new Set(failedItems(input.previous));
-			const now = new Set(failing);
-			const fixed = [...before].filter((item) => !now.has(item));
-			const broke = [...now].filter((item) => !before.has(item));
-			section(profile.headings.changed, [
-				...fixed.length === 0 ? [] : [`Now passing: ${fixed.join(", ")}.`],
-				...broke.length === 0 ? [] : [`Newly failing: ${broke.join(", ")}.`],
-				...fixed.length === 0 && broke.length === 0 ? ["No item changed since the last note."] : [],
-				...input.previous.composite !== void 0 && verdict.composite !== void 0 ? [`Composite: ${format(input.previous.composite)} then ${format(verdict.composite)}.`] : []
-			]);
-		}
-	}
-	if (input.findings !== void 0) {
-		const open = input.findings.filter((finding) => finding.resolvedAt === void 0);
-		const resolved = input.findings.filter((finding) => finding.resolvedAt === input.continuation);
-		section(profile.headings.findings, [...open.map((finding) => `- [hypothesis] ${finding.claim}` + (finding.items?.length ? ` (items: ${finding.items.join(", ")})` : "") + ` Evidence: ${finding.citations.map((citation) => citation.uri).join(", ")}`), ...resolved.map((finding) => `- [resolved] ${finding.claim}`)]);
-	}
-	if (input.bar !== void 0 && verdict !== void 0) {
-		const body = [];
-		if (profile.barRule?.trim()) body.push(fill(profile.barRule).trim());
-		for (const [item, value] of Object.entries(items)) {
-			const best = input.bar.best?.verdict.items?.[item];
-			body.push(`- ${item}: ${value >= 1 ? "passes" : `fails (${format(value)})`}` + (best === void 0 ? "" : ` / ${input.bar.best?.label}: ${best >= 1 ? "passes" : `fails (${format(best)})`}`));
+	let sawChild = false;
+	let anyValid = false;
+	let bestValidScore;
+	let bestDoneScore;
+	for (const ev of settled) {
+		sawChild = true;
+		if (ev.status !== "done") continue;
+		const score = ev.verdict?.score;
+		if (score !== void 0 && (bestDoneScore === void 0 || score > bestDoneScore)) bestDoneScore = score;
+		if (ev.verdict?.valid === true) {
+			anyValid = true;
+			if (score !== void 0 && (bestValidScore === void 0 || score > bestValidScore)) bestValidScore = score;
 		}
-		if (input.bar.best?.verdict.composite !== void 0) body.push(`Best version ${input.bar.best.label}: composite ${format(input.bar.best.verdict.composite)}.`);
-		if (input.bar.reference?.trim()) body.push(`Reference result: ${input.bar.reference.trim()}`);
-		if (verdict.review?.trim()) body.push(`The check's review: ${verdict.review.trim()}`);
-		section(profile.headings.bar, body);
 	}
-	section(profile.headings.plan, profile.plan.trim() === "" ? [] : [fill(profile.plan).trim()]);
-	section(profile.headings.rules, [...profile.rules.trim() === "" ? [] : [fill(profile.rules).trim()], ...input.sealed ? ["The score comes from cases you cannot see."] : []]);
-	for (const appended of input.appended ?? []) section(appended.heading, appended.text.trim() === "" ? [] : [appended.text.trim()]);
-	return sections.join("\n\n");
-}
-function summarizeVerdict(verdict) {
-	if (verdict === void 0) return null;
-	const total = Object.keys(verdict.items ?? {}).length;
+	if (!sawChild) return void 0;
+	const accepted = anyValid && finalizedOutput !== void 0;
 	return {
-		pass: verdict.pass,
-		...verdict.composite === void 0 ? {} : { composite: verdict.composite },
-		...total === 0 ? {} : {
-			failed: failedItems(verdict).length,
-			total
-		}
+		valid: accepted,
+		score: accepted ? bestValidScore ?? 1 : bestDoneScore ?? 0
 	};
 }
-function noteDigest(note) {
-	return `sha256:${createHash("sha256").update(note).digest("hex")}`;
+function readNestedScopeSeam(ctx) {
+	const seam = ctx.seams[nestedScopeSeamKey];
+	if (!seam || typeof seam.mount !== "function") throw new ValidationError$1(`driverExecutor: missing required seam "${nestedScopeSeamKey}" — a driver child must be spawned through a Scope that seeds it (the keystone scope does)`);
+	return seam;
 }
-/** A run directory's continuation files: the root's at `<runDir>/continuations/<n>/`, a nested
-*  manager's at `<runDir>/continuations/managers/<owner>/<n>/`. */
-const CONTINUATIONS_DIR = "continuations";
-/**
-* Write one continuation's files under `<dir>/<n>/`: `note.md`, `verdict.json`, and
-* `panel.jsonl` when the panel ran. The director reads them through `read_continuation`, because
-* its box cannot read the driver's run directory.
-*/
-async function writeContinuationFiles(dir, continuation, files) {
-	const at = join(dir, String(continuation));
-	await mkdir(at, { recursive: true });
-	await writeFile(join(at, "note.md"), `${files.note}\n`, "utf8");
-	await writeFile(join(at, "verdict.json"), `${JSON.stringify(files.verdict ?? null, null, 2)}\n`, "utf8");
-	if (files.panel !== void 0) await writeFile(join(at, "panel.jsonl"), files.panel.map((line) => JSON.stringify(line)).join("\n") + (files.panel.length ? "\n" : ""), "utf8");
+function isAgent(value) {
+	return typeof value === "object" && value !== null && typeof value.act === "function" && typeof value.name === "string";
 }
-/** The best composite across `reads`, or `undefined` when no read scored. */
-function bestComposite(reads) {
-	let best;
-	for (const read of reads) {
-		const value = read.verdict?.composite;
-		if (value !== void 0 && (best === void 0 || value > best)) best = value;
+/** Parent journals may already contain an interrupted driver's inference prefix. */
+function unreportedSpend(total, prior) {
+	const tokens = { ...total.tokens };
+	for (const key of [
+		"input",
+		"output",
+		"freshInput",
+		"cacheRead",
+		"cacheWrite"
+	]) {
+		const value = total.tokens[key];
+		if (value !== void 0) tokens[key] = Math.max(0, value - (prior.tokens[key] ?? 0));
 	}
-	return best;
-}
-function finite(value) {
-	return typeof value === "number" && Number.isFinite(value);
-}
-function format(value) {
-	return Number.isInteger(value) ? String(value) : value.toFixed(3).replace(/0+$/u, "");
-}
-/** Build the continuation state for one manager with a check. */
-function createContinuationKeeper(input) {
-	const { policy } = input;
-	const failures = input.feedback === "pass-only" ? "off" : policy.failures;
-	const entries = [];
-	const notes = [];
-	let findings = [];
-	let panelUsd = 0;
-	let panelUsdKnown = true;
-	const latestVerdict = () => {
-		const reads = input.reads();
-		for (let i = reads.length - 1; i >= 0; i -= 1) {
-			const read = reads[i];
-			if (read?.verdict !== void 0) return {
-				verdict: read.verdict,
-				read: read.read
-			};
-		}
-		return { read: 0 };
-	};
-	const closePrevious = () => {
-		const last = entries.at(-1);
-		const lastNote = notes.at(-1);
-		if (last === void 0 || lastNote === void 0) return;
-		const latest = latestVerdict();
-		entries[entries.length - 1] = {
-			...last,
-			after: latest.read > lastNote.read ? summarizeVerdict(latest.verdict) : null
-		};
-	};
 	return {
-		async compose(context) {
-			closePrevious();
-			const continuation = entries.length + 1;
-			const { verdict, read } = latestVerdict();
-			const failing = verdict === void 0 ? [] : failedItems(verdict);
-			let panelRecord;
-			let panelLines;
-			if (policy.panel === "on" && policy.runPanel !== void 0 && policy.panelUsd !== void 0) {
-				const workers = input.workers();
-				const questions = expandQuestions(policy.profile.questions ?? [], failing, workers);
-				const left = policy.panelUsd.perRun - panelUsd;
-				const usdCap = Math.min(policy.panelUsd.perContinuation, left);
-				const asking = questions.length > 0 && usdCap > 0 && panelUsdKnown;
-				let traces;
-				let unavailable;
-				if (asking) try {
-					traces = await input.traces?.();
-					if (traces === void 0) unavailable = "the run has recorded no trace yet";
-				} catch (error) {
-					unavailable = `the run's traces could not be read: ${error instanceof Error ? error.message : String(error)}`;
-				}
-				if (asking && traces !== void 0) {
-					const result = await policy.runPanel({
-						continuation,
-						task: input.task,
-						...verdict === void 0 ? {} : { verdict },
-						reads: input.reads(),
-						questions,
-						traces,
-						workers,
-						...policy.best === void 0 ? {} : { bar: policy.best },
-						...policy.reference === void 0 ? {} : { reference: policy.reference },
-						usdCap,
-						signal: context.signal
-					});
-					if (result.usd === null) panelUsdKnown = false;
-					else panelUsd += result.usd;
-					findings = distillFindings(findings, result.findings, new Set(failing), continuation);
-					panelRecord = {
-						asked: questions.length,
-						proposed: result.findings.length,
-						admitted: findings.filter((finding) => finding.admittedAt === continuation).length,
-						usd: result.usd
-					};
-					panelLines = [...result.findings.map((finding) => ({
-						kind: "finding",
-						admitted: admitFinding(finding),
-						...finding
-					})), ...result.receipts === void 0 ? [] : [{
-						kind: "receipts",
-						receipts: result.receipts
-					}]];
-				} else panelRecord = {
-					asked: 0,
-					proposed: 0,
-					admitted: 0,
-					usd: 0,
-					...unavailable === void 0 ? {} : { unavailable }
-				};
-			}
-			const appended = policy.append ? await policy.append({
-				continuation,
-				...verdict === void 0 ? {} : { verdict },
-				reads: input.reads(),
-				signal: context.signal
-			}) : void 0;
-			const note = composeContinuationNote({
-				profile: policy.profile,
-				continuation,
-				...verdict === void 0 ? {} : { verdict },
-				...notes.at(-1)?.verdict === void 0 ? {} : { previous: notes.at(-1)?.verdict },
-				reads: input.reads().length,
-				failures,
-				...policy.panel === "on" ? { findings } : {},
-				...policy.bar === "on" ? { bar: {
-					...policy.best === void 0 ? {} : { best: policy.best },
-					...policy.reference === void 0 ? {} : { reference: policy.reference }
-				} } : {},
-				...appended === void 0 ? {} : { appended: [appended] },
-				...input.owed === void 0 ? {} : { owed: input.owed },
-				progress: context.progress,
-				canReadMore: input.canReadMore,
-				canSubmitResult: input.canSubmitResult === true,
-				...input.sealed === true ? { sealed: true } : {}
-			});
-			notes.push({
-				note,
-				...verdict === void 0 ? {} : { verdict },
-				...panelLines === void 0 ? {} : { panel: panelLines },
-				read
-			});
-			entries.push({
-				continuation,
-				attempt: context.attempt,
-				noteDigest: noteDigest(note),
-				profile: policy.profile.id,
-				switches: {
-					failures,
-					panel: policy.panel,
-					bar: policy.bar
-				},
-				before: summarizeVerdict(verdict),
-				after: null,
-				...panelRecord === void 0 ? {} : { panel: panelRecord },
-				appended: appended === void 0 ? 0 : 1
-			});
-			if (input.dir !== void 0) await writeContinuationFiles(input.dir, continuation, {
-				note,
-				...verdict === void 0 ? {} : { verdict },
-				...panelLines === void 0 ? {} : { panel: panelLines }
-			});
-			return note;
-		},
-		read(continuation) {
-			const index = continuation === void 0 ? notes.length - 1 : continuation - 1;
-			const entry = notes[index];
-			if (entry === void 0) return {
-				found: false,
-				reason: notes.length === 0 ? "no continuation has been sent in this run" : `continuations run from 1 to ${notes.length}`
-			};
-			return {
-				found: true,
-				continuation: index + 1,
-				note: entry.note,
-				verdict: failures === "off" && entry.verdict !== void 0 ? { pass: entry.verdict.pass } : entry.verdict ?? null,
-				findings: findings.filter((finding) => finding.admittedAt <= index + 1)
-			};
-		},
-		entries() {
-			closePrevious();
-			return entries.map((entry) => ({ ...entry }));
-		}
+		...total,
+		...addResourceSpend(total.resources === void 0 ? void 0 : Object.fromEntries(Object.entries(total.resources).map(([name, value]) => {
+			const previous = prior.resources?.[name];
+			if (previous && previous.unit !== value.unit) throw new ValidationError$1(`resource ${name}: unit mismatch`);
+			return [name, {
+				...value,
+				amount: Math.max(0, value.amount - (previous?.amount ?? 0)),
+				known: value.known && (previous?.known ?? true)
+			}];
+		}))),
+		iterations: Math.max(0, total.iterations - prior.iterations),
+		tokens,
+		usd: Math.max(0, total.usd - prior.usd),
+		ms: Math.max(0, total.ms - prior.ms),
+		...total.usdEstimated === void 0 ? {} : { usdEstimated: Math.max(0, total.usdEstimated - (prior.usdEstimated ?? 0)) },
+		...total.boxMinutes === void 0 ? {} : { boxMinutes: Math.max(0, total.boxMinutes - (prior.boxMinutes ?? 0)) }
 	};
 }
 //#endregion
@@ -27229,11 +27842,18 @@ function upstreamUnavailableSignal(error) {
 	if (!(error instanceof Error)) return void 0;
 	if (isProviderSchemaRejection(error)) return void 0;
 	if (error instanceof CheckUnavailableError) return "check-unavailable";
-	if (error instanceof HarnessTurnFailedError) return unavailableSignalOfFailure({
-		error: error.message,
-		...error.errorCode === void 0 ? {} : { errorCode: error.errorCode },
-		...error.statusCode === void 0 ? {} : { statusCode: error.statusCode }
-	});
+	if (error instanceof HarnessTurnFailedError) {
+		const usageLimit = subscriptionUsageLimitSignal({
+			error: error.message,
+			...error.errorCode === void 0 ? {} : { errorCode: error.errorCode }
+		});
+		if (usageLimit !== void 0) return usageLimit;
+		return unavailableSignalOfFailure({
+			error: error.message,
+			...error.errorCode === void 0 ? {} : { errorCode: error.errorCode },
+			...error.statusCode === void 0 ? {} : { statusCode: error.statusCode }
+		});
+	}
 	if (error instanceof BackendTransportError) {
 		const code = error.upstreamCode?.toLowerCase();
 		if (code !== void 0 && UNAVAILABLE_CODES.has(code)) return code;
@@ -28778,6 +29398,6 @@ function isNonEmptySpend(s) {
 	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false || Object.values(s.resources ?? {}).some((resource) => resource.amount > 0 || !resource.known);
 }
 //#endregion
-export { scopeRetainedOwnerPriorSpend as $, sandboxProgressEvents as $i, bridgeStopSignalKey as $n, localHarnessExecutable as $r, harnessUsageIsEmpty as $t, isDriverSpec as A, runtimeOwnedExecutorExecutionBinding as Ai, insideCursorNamespace as An, buildRuntimeEventOtelSpans as Ar, readWorkerTraceContext as At, recordScopeOwnerMaterialization as B, detachedSnapshot as Bi, isTraceAnalysisStore as Bn, createRuntimeStreamEventCollector as Br, DEFAULT_PEER_MAIL_LIMITS as Bt, distillFindings as C, inheritRuntimeOwnedExecutorAttestation as Ci, sandboxSessionTraceSource as Cn, readTraceContextFromEnv as Cr, snapshotExecutorConfig as Ct, verdictFromJudgeScore as D, providerAttemptEvidence as Di, FileSpawnJournal as Dn, resolveRedactor as Dr, createRouterTranscript as Dt, passedItems as E, newExecutionAttemptId as Ei, FileResultBlobStore as En, defaultRedactorIdentityMaterial as Er, createSteerableSandboxSession as Et, createScope as F, unknownExecutionBindingReceipt as Fi, prepareJsonlAppend as Fn, loopEventToOtelSpan as Fr, DEFAULT_STALL_AFTER_MS as Ft, beginScopeRetainedOwnerDrive as G, createSandboxToolPartState as Gi, ReservationWaitRefused as Gn, runWorktreeHarness as Gr, peerMailTools as Gt, restoreScopeOwnerAcceptedExecution as H, readSandboxOutcome as Hi, workerTraceAnalysisStore as Hn, sanitizeKnowledgeReadinessReport as Hr, claimsAuthority as Ht, deriveNodeExecutionIdentity as I, unknownMaterializationReceipt as Ii, readCommittedJsonLines as In, padSpanId as Ir, createActivityLog as It, consumeScopeRetainedOwnerResult as J, isSandboxTerminalEvent as Ji, meterUsageEvent as Jn, removeWorktree as Jr, isTerminalNodeStatus as Jt, bindScopeRetainedOwnerEnvironmentId as K, createSandboxUsageLedger as Ki, assertValidBudget as Kn, captureWorktreeDiff as Kr, peerMailVerbNames as Kt, meterRuntimeOwnedAccounting as L, executableAgentProfileSnapshot as Li, writeAllBytes as Ln, padTraceId as Lr, readWorkerProgress as Lt, SUBTREE_RESULT_LIMIT as M, runtimeOwnedExecutorProviderEvidence as Mi, materializeTreeView as Mn, createOtelExporter as Mr, workerTraceHeaders as Mt, assertRecursiveReservationPolicy as N, runtimeOwnedPendingExecutorMaterialization as Ni, replaySpawnTree as Nn, flatOtelSpan as Nr, workerTraceSeamKey as Nt, driverChild as O, recordRuntimeOwnedDriveHarnessProviderEvidence as Oi, InMemoryResultBlobStore as On, buildLoopOtelSpans as Or, createInPlaceCliExecutor as Ot, beginScopeOwnerAttempt as P, runtimeOwnedScopeOwnerRuntime as Pi, isNoEntError as Pn, generateSpanId as Pr, taskToPrompt as Pt, scopeRetainedOwnerContext as Q, sandboxEventServedBackend as Qi, bridgeRuntimeAttachmentsKey as Qn, harnessSupportsReasoningEffort as Qr, createCodexRolloutStoreReader as Qt, meterRuntimeOwnedProviderAttempt as R, executableAgentSpecSnapshot as Ri, WORKER_TOOL_TRACE_SCHEMA_VERSION as Rn, toOtelAttributes as Rr, createInbox as Rt, createContinuationKeeper as S, finalizeRuntimeOwnedPendingExecutor as Si, decodeToolPart as Sn, mergeTraceEnv as Sr, createExecutorRegistry as St, failedItems as T, knownMaterializationReceipt as Ti, retainedExecutorSeamKey as Tn, defaultRedactor as Tr, DEFAULT_SANDBOX_STEERING_MAX_TURNS as Tt, scopeOwnerExecutorNodeContext as U, assertSandboxServedModel as Ui, executorFailure as Un, sanitizeRuntimeStreamEvent as Ur, createPeerMailbox as Ut, recordScopeOwnerPause as V, projectSandboxOutcome as Vi, parseWorkerToolTraceArtifact as Vn, sanitizeAgentRuntimeEvent as Vr, PEER_MAIL_WIRE_KEY as Vt, settledToIteration as W, canonicalStreamEventFromSandboxEvent as Wi, BudgetReconcileFault as Wn, runSettledCommand as Wr, isPeerMailEnvelope as Wt, prepareScopeRetainedOwnerTask as X, mapSandboxToolEvent as Xi, spendFromUsageEvents as Xn, LOCAL_HARNESSES as Xr, bridgeModelRouteRefusal as Xt, noteScopeRetainedOwnerCoordination as Y, mapSandboxEvent as Yi, newUsageTotals as Yn, DEFAULT_LOCAL_HARNESS as Yr, bridgeAdmissionRefusal as Yt, reconcileScopeRetainedOwnerEnvironment as Z, notifySandboxEventObserver as Zi, spendFromUsageTotals as Zn, harnessInvocation as Zr, addHarnessUsage as Zt, CheckUnavailableError as _, validateProfileMaterialization as _i, providerAsSandboxClient as _n, readHarnessTranscript as _r, bindReusableExecutorExecutionId as _t, collectDelivered as a, promptOptionsFromAgentTurnInput as aa, controlProfileMaterialization as ai, runAgentRounds as an, retainedCreateMaterial as ar, environmentReader as at, bestComposite as b, attestRuntimeOwnedScopeOwner as bi, unavailableSignalOfFailure as bn, contentAddress as br, cliWorktreeExecutor as bt, runTree as c, profileMaterializationAxes$1 as ci, SandboxEvidenceRetentionError as cn, createWorkerSlots as cr, interactiveAdmissionSeamKey as ct, classifyDriverFailure as d, promptOnlyProfileMaterialization as di, readPromptOptions as dn, abortError as dr, reconnectRetainedInteractiveRun as dt, sumSandboxUsage as ea, parseCodexTokenUsage as ei, readCodexRolloutSession as en, errMessage as er, scopeRetainedOwnerResourceReader as et, runDriverWithRetry as f, promptResourceProfileMaterialization as fi, routerBrain as fn, linkAbort as fr, recoverRetainedInteractiveRun as ft, CONTINUATION_FACTS as g, unsupportedProfileDimensions as gi, providerAsExecutor as gn, persistHarnessTranscript as gr, rollingDispatch as gt, CONTINUATIONS_DIR as h, sandboxActProfileMaterialization as hi, createAgentEnvironmentProviderRegistry as hn, harnessTranscriptArtifact as hr, queueOf as ht, bestDelivered as i, promptFromAgentTurnInput as ia, assertProfileMaterialization as ii, isTerminalDecision as in, startRetainedRunInEnvironment as ir, SPAWN_RESOURCE_PATH_MAX_BYTES as it, withDriverExecutor as j, runtimeOwnedExecutorMaterialization as ji, loadSpawnForest as jn, createOpenInferenceFileExporter as jr, workerTraceEnv as jt, driverExecutorFactory as k, runtimeOwnedDriveHarnessProviderEvidence as ki, InMemorySpawnJournal as kn, buildLoopSpanNodes as kr, WORKER_TRACE_PROPAGATION as kt, DriverAttemptsExhaustedError as l, promptControlProfileMaterialization as li, captureBeforeDestroy as ln, openSlotGroup as lr, attachWorker as lt, upstreamUnavailableSignal as m, renderUnsupported as mi, LEAF_CONTINUATION_TASK as mn, captureHarnessTranscript as mr, freeSlots as mt, createRootHandle as n, abortError$1 as na, terminateProcessTreeAndConfirm as ni, createSandboxForSpec as nn, recoverRetainedRun as nr, scopeRetainedOwnerResult as nt, pickBestDelivered as o, providerMessageText as oa, defineProfileMaterializationContract as oi, createSandboxLineage as on, destroyInteractiveEnvironment as or, hostDirectoryReader as ot, summarizeDriverAttempts as p, renderProfileMaterializationIssues as pi, runBrainLoop as pn, runAbortable as pr, startRetainedInteractiveRun as pt, bindScopeRetainedOwnerProvider as q, extractLlmCallEvent as qi, createBudgetPool as qn, createWorktree as qr, isLiveNodeStatus as qt, createSupervisor as r, awaitAbortable$1 as ra, AGENT_PROFILE_MATERIALIZATION_AXES as ri, defaultSelectWinner as rn, startRetainedRun as rr, scopeRetainedOwnerTurnEnded as rt, runFinalizer as s, fullProfileMaterialization as si, acquireSandbox as sn, environmentGone as sr, resolveSpawnResourcePaths as st, DEFAULT_MAX_DEPTH as t, decodeHarnessUsage as ta, CodexExecutionDiagnosticError as ti, TERMINAL_DECISIONS as tn, reconnectRetainedRun as tr, scopeRetainedOwnerRestorePoint as tt, HarnessTurnFailedError as u, promptModelProfileMaterialization as ui, assertBoxlessPromptOptions as un, RunCancellationReason as ur, readWorkerInteractiveBinding as ut, admitContinuationPolicy as v, worktreeCliProfileMaterialization as vi, resolveAgentEnvironmentProvider as vn, resolveHarnessTranscriptCapture as vr, captureReusableExecutorConfig as vt, expandQuestions as w, knownExecutionBindingReceipt as wi, registerRetainedExecutorPreparation as wn, traceContextToEnv as wr, createWorktreeCliExecutor as wt, checkVerdictOf as x, authoredProfileDigest as xi, createPushTraceSource as xn, createPropagatingTraceEmitter as xr, createExecutor as xt, admitFinding as y, attestRuntimeOwnedPendingExecutor as yi, unavailablePauseMs as yn, retainHarnessTranscript as yr, cliInPlaceExecutor as yt, recordScopeOwnerDriverAttempt as z, detachedFrozen as zi, captureWorkerTraceEvidence as zn, createRuntimeEventCollector as zr, AUTHORITY_MARKERS as zt };
+export { hostDirectoryReader as $, readSandboxOutcome as $i, workerTraceAnalysisStore as $n, sanitizeKnowledgeReadinessReport as $r, claimsAuthority as $t, scopeOwnerExecutorNodeContext as A, attestRuntimeOwnedPendingExecutor as Ai, unavailablePauseMs as An, retainHarnessTranscript as Ar, cliInPlaceExecutor as At, noteScopeRetainedOwnerCoordination as B, runtimeOwnedDriveHarnessProviderEvidence as Bi, InMemorySpawnJournal as Bn, buildLoopSpanNodes as Br, WORKER_TRACE_PROPAGATION as Bt, deriveNodeExecutionIdentity as C, promptResourceProfileMaterialization as Ci, routerBrain as Cn, linkAbort as Cr, distillFindings as Ct, recordScopeOwnerMaterialization as D, unsupportedProfileDimensions as Di, providerAsExecutor as Dn, persistHarnessTranscript as Dr, verdictFromJudgeScore as Dt, recordScopeOwnerDriverAttempt as E, sandboxActProfileMaterialization as Ei, createAgentEnvironmentProviderRegistry as En, harnessTranscriptArtifact as Er, passedItems as Et, seatExecutionProfile as F, knownExecutionBindingReceipt as Fi, registerRetainedExecutorPreparation as Fn, traceContextToEnv as Fr, createWorktreeCliExecutor as Ft, scopeRetainedOwnerJournalRoot as G, runtimeOwnedScopeOwnerRuntime as Gi, isNoEntError as Gn, generateSpanId as Gr, taskToPrompt as Gt, prepareScopeRetainedOwnerTask as H, runtimeOwnedExecutorMaterialization as Hi, loadSpawnForest as Hn, createOpenInferenceFileExporter as Hr, workerTraceEnv as Ht, beginScopeRetainedOwnerDrive as I, knownMaterializationReceipt as Ii, retainedExecutorSeamKey as In, defaultRedactor as Ir, DEFAULT_SANDBOX_STEERING_MAX_TURNS as It, scopeRetainedOwnerRestorePoint as J, executableAgentProfileSnapshot as Ji, writeAllBytes as Jn, padTraceId as Jr, readWorkerProgress as Jt, scopeRetainedOwnerPriorSpend as K, unknownExecutionBindingReceipt as Ki, prepareJsonlAppend as Kn, loopEventToOtelSpan as Kr, DEFAULT_STALL_AFTER_MS as Kt, bindScopeRetainedOwnerEnvironmentId as L, newExecutionAttemptId as Li, FileResultBlobStore as Ln, defaultRedactorIdentityMaterial as Lr, createSteerableSandboxSession as Lt, SeatChain as M, authoredProfileDigest as Mi, createPushTraceSource as Mn, createPropagatingTraceEmitter as Mr, createExecutor as Mt, SeatChainExhaustedError as N, finalizeRuntimeOwnedPendingExecutor as Ni, decodeToolPart as Nn, mergeTraceEnv as Nr, createExecutorRegistry as Nt, recordScopeOwnerPause as O, validateProfileMaterialization as Oi, providerAsSandboxClient as On, readHarnessTranscript as Or, bindReusableExecutorExecutionId as Ot, authoredSeatStages as P, inheritRuntimeOwnedExecutorAttestation as Pi, sandboxSessionTraceSource as Pn, readTraceContextFromEnv as Pr, snapshotExecutorConfig as Pt, environmentReader as Q, projectSandboxOutcome as Qi, parseWorkerToolTraceArtifact as Qn, sanitizeAgentRuntimeEvent as Qr, PEER_MAIL_WIRE_KEY as Qt, bindScopeRetainedOwnerProvider as R, providerAttemptEvidence as Ri, FileSpawnJournal as Rn, resolveRedactor as Rr, createRouterTranscript as Rt, createScope as S, promptOnlyProfileMaterialization as Si, readPromptOptions as Sn, abortError as Sr, createContinuationKeeper as St, meterRuntimeOwnedProviderAttempt as T, renderUnsupported as Ti, LEAF_CONTINUATION_TASK as Tn, captureHarnessTranscript as Tr, failedItems as Tt, reconcileScopeRetainedOwnerEnvironment as U, runtimeOwnedExecutorProviderEvidence as Ui, materializeTreeView as Un, createOtelExporter as Ur, workerTraceHeaders as Ut, prepareScopeRetainedOwnerSeatSwitch as V, runtimeOwnedExecutorExecutionBinding as Vi, insideCursorNamespace as Vn, buildRuntimeEventOtelSpans as Vr, readWorkerTraceContext as Vt, scopeRetainedOwnerContext as W, runtimeOwnedPendingExecutorMaterialization as Wi, replaySpawnTree as Wn, flatOtelSpan as Wr, workerTraceSeamKey as Wt, scopeRetainedOwnerTurnEnded as X, detachedFrozen as Xi, captureWorkerTraceEvidence as Xn, createRuntimeEventCollector as Xr, AUTHORITY_MARKERS as Xt, scopeRetainedOwnerResult as Y, executableAgentSpecSnapshot as Yi, WORKER_TOOL_TRACE_SCHEMA_VERSION as Yn, toOtelAttributes as Yr, createInbox as Yt, SPAWN_RESOURCE_PATH_MAX_BYTES as Z, detachedSnapshot as Zi, isTraceAnalysisStore as Zn, createRuntimeStreamEventCollector as Zr, DEFAULT_PEER_MAIL_LIMITS as Zt, isDriverSpec as _, providerMessageText as _a, defineProfileMaterializationContract as _i, createSandboxLineage as _n, destroyInteractiveEnvironment as _r, CheckUnavailableError as _t, collectDelivered as a, isSandboxTerminalEvent as aa, removeWorktree as ai, isTerminalNodeStatus as an, meterUsageEvent as ar, attachWorker as at, assertRecursiveReservationPolicy as b, promptControlProfileMaterialization as bi, captureBeforeDestroy as bn, openSlotGroup as br, bestComposite as bt, runTree as c, notifySandboxEventObserver as ca, harnessInvocation as ci, addHarnessUsage as cn, spendFromUsageTotals as cr, recoverRetainedInteractiveRun as ct, classifyDriverFailure as d, sumSandboxUsage as da, parseCodexTokenUsage as di, readCodexRolloutSession as dn, errMessage as dr, queueOf as dt, assertSandboxServedModel as ea, sanitizeRuntimeStreamEvent as ei, createPeerMailbox as en, executorFailure as er, resolveSpawnResourcePaths as et, runDriverWithRetry as f, decodeHarnessUsage as fa, CodexExecutionDiagnosticError as fi, TERMINAL_DECISIONS as fn, reconnectRetainedRun as fr, rollingDispatch as ft, driverExecutorFactory as g, promptOptionsFromAgentTurnInput as ga, controlProfileMaterialization as gi, runAgentRounds as gn, retainedCreateMaterial as gr, CONTINUATION_FACTS as gt, driverChild as h, promptFromAgentTurnInput as ha, assertProfileMaterialization as hi, isTerminalDecision as hn, startRetainedRunInEnvironment as hr, CONTINUATIONS_DIR as ht, bestDelivered as i, extractLlmCallEvent as ia, createWorktree as ii, isLiveNodeStatus as in, createBudgetPool as ir, interactiveAdmissionSeamKey as it, settledToIteration as j, attestRuntimeOwnedScopeOwner as ji, unavailableSignalOfFailure as jn, contentAddress as jr, cliWorktreeExecutor as jt, restoreScopeOwnerAcceptedExecution as k, worktreeCliProfileMaterialization as ki, resolveAgentEnvironmentProvider as kn, resolveHarnessTranscriptCapture as kr, captureReusableExecutorConfig as kt, DriverAttemptsExhaustedError as l, sandboxEventServedBackend as la, harnessSupportsReasoningEffort as li, createCodexRolloutStoreReader as ln, bridgeRuntimeAttachmentsKey as lr, startRetainedInteractiveRun as lt, upstreamUnavailableSignal as m, awaitAbortable$1 as ma, AGENT_PROFILE_MATERIALIZATION_AXES as mi, defaultSelectWinner as mn, startRetainedRun as mr, mapExecutorResult as mt, createRootHandle as n, createSandboxToolPartState as na, runWorktreeHarness as ni, peerMailTools as nn, ReservationWaitRefused as nr, coordinationProfileToolPrefix as nt, pickBestDelivered as o, mapSandboxEvent as oa, DEFAULT_LOCAL_HARNESS as oi, bridgeAdmissionRefusal as on, newUsageTotals as or, readWorkerInteractiveBinding as ot, summarizeDriverAttempts as p, abortError$1 as pa, terminateProcessTreeAndConfirm as pi, createSandboxForSpec as pn, recoverRetainedRun as pr, gateOnDeliverable as pt, scopeRetainedOwnerResourceReader as q, unknownMaterializationReceipt as qi, readCommittedJsonLines as qn, padSpanId as qr, createActivityLog as qt, createSupervisor as r, createSandboxUsageLedger as ra, captureWorktreeDiff as ri, peerMailVerbNames as rn, assertValidBudget as rr, providerVisibleProfile as rt, runFinalizer as s, mapSandboxToolEvent as sa, LOCAL_HARNESSES as si, bridgeModelRouteRefusal as sn, spendFromUsageEvents as sr, reconnectRetainedInteractiveRun as st, DEFAULT_MAX_DEPTH as t, canonicalStreamEventFromSandboxEvent as ta, runSettledCommand as ti, isPeerMailEnvelope as tn, BudgetReconcileFault as tr, coordinationMcpAlias as tt, HarnessTurnFailedError as u, sandboxProgressEvents as ua, localHarnessExecutable as ui, harnessUsageIsEmpty as un, bridgeStopSignalKey as ur, freeSlots as ut, withDriverExecutor as v, fullProfileMaterialization as vi, acquireSandbox as vn, environmentGone as vr, admitContinuationPolicy as vt, meterRuntimeOwnedAccounting as w, renderProfileMaterializationIssues as wi, runBrainLoop as wn, runAbortable as wr, expandQuestions as wt, beginScopeOwnerAttempt as x, promptModelProfileMaterialization as xi, assertBoxlessPromptOptions as xn, RunCancellationReason as xr, checkVerdictOf as xt, SUBTREE_RESULT_LIMIT as y, profileMaterializationAxes$1 as yi, SandboxEvidenceRetentionError as yn, createWorkerSlots as yr, admitFinding as yt, consumeScopeRetainedOwnerResult as z, recordRuntimeOwnedDriveHarnessProviderEvidence as zi, InMemoryResultBlobStore as zn, buildLoopOtelSpans as zr, createInPlaceCliExecutor as zt };
 
-//# sourceMappingURL=supervisor-gCfG6K1-.js.map
+//# sourceMappingURL=supervisor-Dz4XXtK1.js.map