@tangle-network/agent-runtime 0.350.2 → 0.353.2

package/dist/journal-store-BJPMUydp.js

@@ -0,0 +1,3925 @@
+import { m as ValidationError, r as BackendTransportError } from "./errors-AzSuGI23.js";
+import { D as assertResources, E as addResourceSpend, T as zeroTokenUsage, i as chargedTokens, k as withBudgetResources, l as fnv1a32Hex, m as promptCacheTokenClasses, o as cloneTokenUsage, r as addTokenUsage, u as hasCompleteCacheBreakdown } from "./util-ebWMWzY0.js";
+import { AgentTurnResultSchema, CanonicalStreamEventSchema, RuntimeEventEnvelopeSchema } from "@tangle-network/agent-interface";
+import { isRecord } from "@tangle-network/agent-core";
+import { collectAgentFinalMessageText, collectAgentResponseText } from "@tangle-network/sandbox";
+import { z } from "zod";
+import { REDACTION_VERSION, redact } from "@tangle-network/agent-eval/traces";
+import { createHash, randomUUID } from "node:crypto";
+import { LedgerCanonicalizationError, canonicalString, jsonDocument, merkleLeafHash, merkleRoot, merkleSalt, tryAcquireAtomicFileLock } from "@tangle-network/agent-eval/ledger-core";
+import { closeSync, constants, existsSync, fchmodSync, fstatSync, fsyncSync, ftruncateSync, linkSync, lstatSync, openSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync, writeSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
+// \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+// src/record-value.ts
+function recordValue(value) {
+	return isRecord(value) ? value : void 0;
+}
+// src/runtime/harness-usage.ts
+/**
+* Read and validate one codex `turn.completed` usage record.
+*
+* Every counter must be a non-negative safe integer. Two cross-field invariants hold, and they are
+* what states that the two named counters are SUBSETS of their totals rather than additions to
+* them: `cached_input_tokens <= input_tokens` and `reasoning_output_tokens <= output_tokens`.
+* Measured against the codex CLI: a turn reporting `output_tokens 1523` with
+* `reasoning_output_tokens 1516` answered with about seven tokens of text.
+*
+* `label` names the surface the record came from, so one message serves both readers.
+* Throws `ValidationError` on any violation.
+*/
+function parseCodexUsageRecord(usage, label) {
+	const record = recordValue(usage);
+	if (record === void 0) throw new ValidationError(`${label}: usage must be an object, received ${describe(usage)}`);
+	const inputTokens = naturalNumber(record.input_tokens, "input_tokens", label);
+	const cachedInputTokens = naturalNumber(record.cached_input_tokens, "cached_input_tokens", label);
+	const outputTokens = naturalNumber(record.output_tokens, "output_tokens", label);
+	const reasoningOutputTokens = naturalNumber(record.reasoning_output_tokens, "reasoning_output_tokens", label);
+	const cacheWriteInputTokens = record.cache_write_input_tokens === void 0 ? void 0 : naturalNumber(record.cache_write_input_tokens, "cache_write_input_tokens", label);
+	if (cachedInputTokens > inputTokens) throw new ValidationError(`${label}: cached_input_tokens exceeds input_tokens`);
+	if (reasoningOutputTokens > outputTokens) throw new ValidationError(`${label}: reasoning_output_tokens exceeds output_tokens`);
+	return {
+		inputTokens,
+		cachedInputTokens,
+		outputTokens,
+		reasoningOutputTokens,
+		...cacheWriteInputTokens === void 0 ? {} : { cacheWriteInputTokens }
+	};
+}
+/** Names the wire record every codex decode error is reported against. */
+const codexUsageContext = "codex turn.completed";
+/**
+* codex reports the tokens of a turn inside its own `turn.completed` event, which rides the
+* transport either as `{ type: 'raw', data: { type: 'turn.completed', usage: { … } } }` or as
+* the provider-normalized Interface envelope `{ type: 'raw', data: { type: 'raw', event: {
+* type: 'turn.completed', usage: { … } } } }`. It emits no canonical usage event, so this adapter
+* is a codex worker's only usage source.
+*
+* The record is read by `parseCodexUsageRecord`, the same reader `runLocalHarness` uses on the
+* codex CLI's own stdout, so both surfaces hold one field policy and both cross-field invariants.
+*
+* A `turn.completed` that carries a `usage` member the reader cannot read is a `ValidationError`
+* naming the field. A `turn.completed` with no `usage` member reports no usage at all, which
+* leaves the turn's tokens unknown rather than zero.
+*/
+const decodeCodexTurnUsage = (event) => {
+	if (String(event.type ?? "") !== "raw") return void 0;
+	const envelope = recordValue(event.data);
+	const data = envelope?.type === "raw" && recordValue(envelope.event) !== void 0 ? recordValue(envelope.event) : envelope;
+	if (data === void 0 || data.type !== "turn.completed" || data.usage === void 0) return;
+	const record = parseCodexUsageRecord(data.usage, codexUsageContext);
+	return {
+		harness: "codex",
+		input: record.inputTokens,
+		output: record.outputTokens,
+		cachedInput: record.cachedInputTokens,
+		reasoningOutput: record.reasoningOutputTokens,
+		...record.cacheWriteInputTokens === void 0 ? {} : { cacheWriteInput: record.cacheWriteInputTokens }
+	};
+};
+/** Claude's adapter forwards one delta per response snapshot, keyed and deduplicated there. */
+const decodeClaudeAssistantUsage = (event) => {
+	if (String(event.type ?? "") !== "raw") return void 0;
+	const envelope = recordValue(event.data);
+	const data = envelope?.type === "raw" && recordValue(envelope.event) !== void 0 ? recordValue(envelope.event) : envelope;
+	if (data?.type !== "assistant.usage") return void 0;
+	if (typeof data.message_id !== "string" || data.message_id.length === 0) throw new ValidationError("claude assistant.usage: missing response identity");
+	const usage = recordValue(data.usage);
+	if (!usage) throw new ValidationError("claude assistant.usage: usage must be an object");
+	const fresh = naturalNumber(usage.input_tokens, "input_tokens", "claude assistant.usage");
+	const cachedInput = naturalNumber(usage.cache_read_input_tokens, "cache_read_input_tokens", "claude assistant.usage");
+	const cacheWriteInput = naturalNumber(usage.cache_creation_input_tokens, "cache_creation_input_tokens", "claude assistant.usage");
+	const output = naturalNumber(usage.output_tokens, "output_tokens", "claude assistant.usage");
+	const input = fresh + cachedInput + cacheWriteInput;
+	if (!Number.isSafeInteger(input)) throw new ValidationError("claude assistant.usage: total input tokens exceed a safe integer");
+	return {
+		harness: "claude-code",
+		input,
+		output,
+		cachedInput,
+		cacheWriteInput
+	};
+};
+/**
+* The harness → usage-decoder registry. Add a harness by adding one entry.
+*
+* Keyed by `HarnessType`, the vocabulary the `harness` argument is drawn from, so a key no caller
+* can produce does not compile. A harness absent from this registry reports usage through the
+* canonical events or not at all.
+*/
+const harnessUsageDecoders = {
+	codex: decodeCodexTurnUsage,
+	"claude-code": decodeClaudeAssistantUsage
+};
+/**
+* Decode a sandbox event with one harness's adapter, or `undefined` when the event carries no
+* harness-native usage.
+*
+* A NAMED harness reads with that harness's adapter only, and a named harness with no adapter
+* reports nothing. It never falls through to another harness's adapter: a different harness's
+* `turn.completed` decoded as codex would either drop the counters codex does not name or fail on
+* a field codex requires, and both answers would be about the wrong harness. The composite over
+* every registered adapter runs only when the caller cannot name the harness.
+*
+* Throws `ValidationError` when an adapter recognizes the event as its harness's usage carrier and
+* cannot read the numbers.
+*/
+function decodeHarnessUsage(event, harness) {
+	if (!event || typeof event !== "object") return void 0;
+	if (harness !== void 0) return harnessUsageDecoders[harness]?.(event);
+	for (const decode of new Set(Object.values(harnessUsageDecoders))) {
+		const usage = decode(event);
+		if (usage !== void 0) return usage;
+	}
+}
+function naturalNumber(value, field, label) {
+	if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) throw new ValidationError(`${label}: usage.${field} must be a non-negative safe integer, received ${describe(value)}`);
+	return value;
+}
+function describe(value) {
+	if (value === null) return "null";
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	if (typeof value === "string") return JSON.stringify(value);
+	if (Array.isArray(value)) return "an array";
+	return typeof value;
+}
+// src/runtime/sandbox-events.ts
+/**
+* Forward a sandbox event to an optional observer without letting observer
+* behavior affect the run. The observer receives a defensive copy, synchronous
+* throws are swallowed, and returned promises are deliberately not awaited.
+*/
+function notifySandboxEventObserver(event, observer, meta) {
+	if (!observer) return;
+	try {
+		const result = observer(cloneEventForObserver(event), meta);
+		if (result && typeof result.then === "function") result.then(void 0, () => {});
+	} catch {}
+}
+function cloneEventForObserver(event) {
+	try {
+		return structuredClone(event);
+	} catch {
+		return copyPlainSpine(event, /* @__PURE__ */ new WeakMap());
+	}
+}
+function copyPlainSpine(value, seen) {
+	if (value === null || typeof value !== "object") return value;
+	const existing = seen.get(value);
+	if (existing !== void 0) return existing;
+	if (Array.isArray(value)) {
+		const copy = [];
+		seen.set(value, copy);
+		for (const item of value) copy.push(copyPlainSpine(item, seen));
+		return copy;
+	}
+	const proto = Object.getPrototypeOf(value);
+	if (proto !== Object.prototype && proto !== null) return {};
+	const copy = {};
+	seen.set(value, copy);
+	for (const [key, child] of Object.entries(value)) copy[key] = copyPlainSpine(child, seen);
+	return copy;
+}
+/**
+* Read the served execution identity off one Sandbox event.
+*
+* The platform reports `effectiveBackend` on `execution.started` and again on the terminal
+* event (`@tangle-network/sandbox`, `EffectiveBackend`). Absence returns `undefined`
+* and must stay unknown — a request is not a receipt, so nothing here may be inferred from
+* what was asked for.
+*/
+function sandboxEventServedBackend(event) {
+	if (!event || typeof event !== "object") return void 0;
+	const served = recordValue(recordValue(event.data)?.effectiveBackend);
+	if (!served) return void 0;
+	const provider = firstString(served.provider);
+	const model = firstString(served.model);
+	const source = firstString(served.source);
+	if (provider === void 0 && model === void 0) return void 0;
+	return {
+		...provider !== void 0 ? { provider } : {},
+		...model !== void 0 ? { model } : {},
+		...source !== void 0 ? { source } : {}
+	};
+}
+/**
+* Fail the execution when the platform reports serving a model other than the exact one asked for.
+*
+* Measured motive (agent-runtime#892, live infrastructure): 6 of 6 boxes whose profile
+* declared `zai-coding-plan/glm-5.2` reported
+* `{"provider":"openai-compat","model":"deepseek/deepseek-v4-flash","source":"environment"}`,
+* while the materialization receipt recorded the declared model as `status: "known"`. Sending
+* `backend.model` makes that substitution unlikely; only reading the report back makes it
+* detectable. A run that cannot say which model produced its evidence must not settle as one
+* that can.
+*
+* Silent when the platform reports no served model: unobserved stays unobserved.
+*/
+function assertSandboxServedModel(event, expected) {
+	const wanted = expected?.model?.trim();
+	if (!wanted) return;
+	const served = sandboxEventServedBackend(event);
+	if (served?.model === void 0) return;
+	if (sameModelId(served.model, wanted, [served.provider, expected?.provider])) return;
+	const attribution = [served.provider !== void 0 ? `provider ${JSON.stringify(served.provider)}` : void 0, served.source !== void 0 ? `source ${JSON.stringify(served.source)}` : void 0].filter((part) => part !== void 0);
+	const detail = attribution.length > 0 ? ` (${attribution.join(", ")})` : "";
+	throw new Error(`sandbox served model ${JSON.stringify(served.model)}${detail} instead of the exact profile model ${JSON.stringify(wanted)}`);
+}
+/**
+* Do two model ids name the same model, allowing for routing prefixes?
+*
+* Either side may spell the model bare (`glm-5.2`), provider-qualified
+* (`zai-coding-plan/glm-5.2`), or route-qualified, and the platform reports the provider in its
+* own field rather than always in the id. So the comparison drops any known provider prefix and
+* then accepts a `/`-boundary suffix match: a longer route to the SAME leaf model is a routing
+* difference, not a substitution.
+*
+* What it deliberately does NOT absorb is a different leaf: `glm-5.2` against `glm-5.3` stays a
+* mismatch, which is the substitution measured directly against the provider API (a request for
+* `glm-5.2` was served `glm-5.3`). A version suffix is the whole difference between two
+* instruments, so nothing here may treat it as noise.
+*/
+function sameModelId(served, wanted, providers) {
+	const a = stripProviderPrefix(served, providers);
+	const b = stripProviderPrefix(wanted, providers);
+	return a === b || a.endsWith(`/${b}`) || b.endsWith(`/${a}`);
+}
+function stripProviderPrefix(id, providers) {
+	let out = id.trim().toLowerCase();
+	for (const provider of providers) {
+		const prefix = provider?.trim().toLowerCase();
+		if (prefix && out.startsWith(`${prefix}/`)) out = out.slice(prefix.length + 1);
+	}
+	return out;
+}
+function firstString(...values) {
+	return values.find((value) => typeof value === "string" && value.length > 0);
+}
+const terminalTypes = /* @__PURE__ */ new Set([
+	"message.completed",
+	"result",
+	"final",
+	"done"
+]);
+/** True for an event type that ends a sandbox turn. */
+function isSandboxTerminalEvent(type) {
+	return terminalTypes.has(type);
+}
+/**
+* Which member of a terminal event's `data` carries its usage receipt.
+*
+* The one place the terminal types legitimately differ, stated rather than implied by two lists:
+* sandbox 0.4.0's `done` reports under `tokenUsage` with the cost at the top level, every other
+* terminal type reports under `usage`.
+*/
+function sandboxTerminalUsageField(type) {
+	return type === "done" ? "tokenUsage" : "usage";
+}
+/**
+* Extract a `RuntimeStreamEvent`-shaped `llm_call` from a sandbox event when
+* the event carries usage/cost data. Returns `undefined` for non-cost events
+* so the kernel can iterate the full stream without branching.
+*
+* Pure by contract: it never throws on a failed run. The terminal truth
+* boundary is the public Sandbox outcome tracker, applied after the complete
+* stream. Post-hoc readers — {@link sumSandboxUsage}, the
+* analyst trace store, the chat projection — must stay able to read a failed
+* turn's events, which is when reading them matters most.
+*
+* Canonical cost-carrying types observed in the wild:
+*   - `llm_call` — `data: { model, tokensIn, tokensOut, costUsd, ... }`
+*   - `message.completed` / `result` — `data: { usage: { inputTokens,
+*      outputTokens, totalCostUsd? } }`
+*   - `cost.usage` / `usage` — same shape under a dedicated type
+*
+* Numeric coercion is strict: `Number.isFinite` gates every accumulator write
+* so a sentinel `NaN` from a misbehaving backend cannot poison the ledger.
+*/
+function extractLlmCallEvent(event, agentRunName) {
+	const data = canonicalUsageData(event);
+	return data === void 0 ? void 0 : buildLlmCall(data, agentRunName);
+}
+function canonicalUsageData(event) {
+	if (!event || typeof event !== "object") return void 0;
+	const type = String(event.type ?? "");
+	const data = event.data && typeof event.data === "object" ? event.data : {};
+	if (type === "llm_call" || type === "cost.usage" || type === "usage") return usageReceiptData(data, recordValue(data.usage));
+	if (type === "error" || isSandboxTerminalEvent(type)) {
+		const field = type === "error" ? "tokenUsage" : sandboxTerminalUsageField(type);
+		return usageReceiptData(data, recordValue(data[field]) ?? recordValue(data[field === "usage" ? "tokenUsage" : "usage"]));
+	}
+}
+/** A {@link SandboxUsageLedger} for one worker. Pass the worker's harness to decode with that
+*  harness's adapter; omit it to try every registered adapter. */
+function createSandboxUsageLedger(harness) {
+	let held = [];
+	let sawCanonical = false;
+	const credited = {};
+	const receipts = /* @__PURE__ */ new Map();
+	const settledTokens = zeroTokenUsage();
+	let turnTokens = zeroTokenUsage();
+	let turnUsageUnknown = false;
+	let settledUsage;
+	return {
+		settledUsage: () => settledUsage === void 0 ? void 0 : { ...settledUsage },
+		tokenUsage() {
+			const total = cloneTokenUsage(settledTokens);
+			addTokenUsage(total, turnTokens);
+			return total;
+		},
+		observe(event, agentRunName) {
+			const call = extractLlmCallEvent(event, agentRunName);
+			if (call) {
+				sawCanonical = true;
+				const receipt = creditCanonicalUsage(event, call, credited, receipts, (receipt, mode) => {
+					refineCanonicalTokens(turnTokens, call, receipt, mode);
+				});
+				if (receipt?.tokensKnown === false) {
+					turnTokens.tokensKnown = false;
+					turnUsageUnknown = true;
+				}
+				return receipt;
+			}
+			let usage;
+			try {
+				usage = decodeHarnessUsage(event, harness);
+			} catch (err) {
+				turnUsageUnknown = true;
+				return {
+					type: "llm_call",
+					model: agentRunName,
+					tokensKnown: false,
+					usdKnown: false,
+					tokensUnknownReason: err instanceof Error ? err.message : String(err)
+				};
+			}
+			if (usage) held.push(usage);
+		},
+		settleTurn(agentRunName) {
+			const reports = held;
+			const canonical = sawCanonical;
+			held = [];
+			sawCanonical = false;
+			const receipt = !canonical && reports.length > 0 ? harnessUsageLlmCall(reports, agentRunName) : void 0;
+			if (receipt) creditCanonicalUsage({
+				type: "llm_call",
+				data: {}
+			}, receipt, credited, receipts, (credit, mode) => refineCanonicalTokens(turnTokens, receipt, credit, mode));
+			settledUsage = !turnUsageUnknown && credited.tokensIn !== void 0 && credited.tokensOut !== void 0 ? {
+				inputTokens: credited.tokensIn,
+				outputTokens: credited.tokensOut,
+				...credited.totalTokens === void 0 ? {} : { totalTokens: credited.totalTokens },
+				...credited.reasoningTokens === void 0 ? {} : { reasoningTokens: credited.reasoningTokens },
+				...credited["promptCache.readTokens"] === void 0 ? {} : { cacheReadInputTokens: credited["promptCache.readTokens"] },
+				...credited["promptCache.writeTokens"] === void 0 ? {} : { cacheCreationInputTokens: credited["promptCache.writeTokens"] },
+				...credited.costUsd === void 0 ? {} : { cost: credited.costUsd }
+			} : void 0;
+			for (const key of Object.keys(credited)) delete credited[key];
+			receipts.clear();
+			addTokenUsage(settledTokens, turnTokens);
+			turnTokens = zeroTokenUsage();
+			turnUsageUnknown = false;
+			return receipt;
+		}
+	};
+}
+/** Shared receipt semantics; an undeclared nonterminal observation is not a cumulative total. */
+function canonicalSandboxUsageMode(event) {
+	const declaredMode = recordValue(event.data)?.usageMode;
+	return declaredMode === "delta" || declaredMode === "cumulative" ? declaredMode : declaredMode === void 0 && event.type === "llm_call" ? "delta" : declaredMode === void 0 && (event.type === "error" || isSandboxTerminalEvent(String(event.type))) ? "cumulative" : void 0;
+}
+/** Terminal totals replace already credited usage; only per-call receipts add to it. */
+function creditCanonicalUsage(event, call, credited, receipts, onCredit) {
+	const mode = canonicalSandboxUsageMode(event);
+	const result = { ...call };
+	const data = recordValue(event.data) ?? {};
+	const usageData = canonicalUsageData(event) ?? {};
+	const supplemental = Object.fromEntries(["totalTokens", "reasoningTokens"].flatMap((key) => {
+		const value = usageData[key];
+		return value === void 0 ? [] : [[key, typeof value === "number" && Number.isFinite(value) ? value : null]];
+	}));
+	const explicitTokensUnknown = [
+		data,
+		recordValue(data.usage),
+		recordValue(data.tokenUsage)
+	].some((receipt) => ["tokensKnown", "tokens_known"].some((key) => receipt?.[key] !== void 0 && receipt[key] !== true));
+	if (call.tokensIn === void 0 && call.tokensOut === void 0 && !call.tokensUnknownReason && !explicitTokensUnknown) delete result.tokensKnown;
+	let reason = mode === void 0 ? "usage receipt has no declared delta or cumulative semantics" : void 0;
+	if (event.id) {
+		const signature = JSON.stringify({
+			mode,
+			call,
+			supplemental
+		});
+		const previous = receipts.get(event.id);
+		if (previous === signature) return void 0;
+		if (previous !== void 0) return {
+			type: "llm_call",
+			model: call.model,
+			tokensKnown: false,
+			usdKnown: false,
+			tokensUnknownReason: `usage receipt ${event.id} changed after it was credited`
+		};
+		receipts.set(event.id, signature);
+	}
+	const credit = (key, value) => {
+		const previous = credited[key] ?? 0;
+		if (!Number.isFinite(value) || value < 0) {
+			reason = `usage receipt has an invalid ${key}`;
+			return 0;
+		}
+		if (mode === "delta") {
+			credited[key] = previous + value;
+			return value;
+		}
+		if (value < previous) reason = `cumulative usage ${key} is below already credited usage`;
+		credited[key] = Math.max(previous, value);
+		return Math.max(0, value - previous);
+	};
+	for (const key of [
+		"tokensIn",
+		"tokensOut",
+		"costUsd",
+		"estimatedCostUsd"
+	]) if (call[key] !== void 0) result[key] = credit(key, call[key]);
+	for (const [key, value] of Object.entries(supplemental)) if (typeof value !== "number") reason = `usage receipt has an invalid ${key}`;
+	else credit(key, value);
+	if (call.promptCache) result.promptCache = Object.fromEntries(Object.entries(call.promptCache).map(([key, value]) => [key, typeof value === "number" ? credit(`promptCache.${key}`, value) : value]));
+	if (reason !== void 0) {
+		result.usdKnown = false;
+		if (call.tokensIn !== void 0 || call.tokensOut !== void 0) {
+			result.tokensKnown = false;
+			result.tokensUnknownReason = reason;
+		}
+	}
+	onCredit(result, mode);
+	return result;
+}
+/** Cache partitions belong to the original receipt, not the smaller incremental charge. */
+function refineCanonicalTokens(tokens, call, receipt, mode) {
+	const input = receipt.tokensIn ?? 0;
+	const output = receipt.tokensOut ?? 0;
+	const cache = promptCacheTokenClasses(call.tokensIn, call.promptCache);
+	if (mode !== "cumulative") {
+		addTokenUsage(tokens, {
+			input,
+			output,
+			...cache
+		});
+		return;
+	}
+	tokens.input += input;
+	tokens.output += output;
+	if (cache.freshInput !== void 0 && call.tokensIn === tokens.input && receipt.tokensKnown !== false) {
+		tokens.freshInput = cache.freshInput;
+		tokens.cacheRead = cache.cacheRead;
+		tokens.cacheWrite = cache.cacheWrite;
+		delete tokens.cacheBreakdownKnown;
+		return;
+	}
+	if (cache.cacheRead !== void 0) tokens.cacheRead = Math.max(tokens.cacheRead ?? 0, cache.cacheRead);
+	if (cache.cacheWrite !== void 0) tokens.cacheWrite = Math.max(tokens.cacheWrite ?? 0, cache.cacheWrite);
+	if ((tokens.freshInput ?? 0) + (tokens.cacheRead ?? 0) + (tokens.cacheWrite ?? 0) > tokens.input) {
+		delete tokens.freshInput;
+		delete tokens.cacheRead;
+		delete tokens.cacheWrite;
+	}
+	if (input > 0 || cache.cacheBreakdownKnown === false) tokens.cacheBreakdownKnown = false;
+}
+/**
+* Fold harness-native usage reports into the canonical `llm_call` the accounting paths read.
+*
+* Every counter a `HarnessUsage` carries beside `input` and `output` CLASSIFIES one of those two
+* totals, so none of them is added to the total it describes:
+*
+*   - the prompt-cache counters classify `input` and ride `promptCache`, the convention the
+*     terminal `tokenUsage` branch above already follows and `promptCacheTokenClasses` folds,
+*     where `freshInput = input - cacheRead - cacheWrite`;
+*   - `reasoningOutput` classifies `output`. Codex counts its reasoning tokens INSIDE
+*     `output_tokens` — a turn reporting `output_tokens 1523` with `reasoning_output_tokens 1516`
+*     answered with about seven tokens of text — and `parseCodexUsageRecord` holds that as an
+*     invariant. The canonical `llm_call` carries no reasoning class, so the count is not
+*     forwarded to {@link buildLlmCall}. Canonical output totals already include reasoning.
+*
+* A counter no report carried stays absent, because a zero would claim the provider measured none.
+*/
+function harnessUsageLlmCall(reports, agentRunName) {
+	let inputTokens = 0;
+	let outputTokens = 0;
+	let readTokens;
+	let writeTokens;
+	for (const report of reports) {
+		inputTokens += report.input;
+		outputTokens += report.output;
+		if (report.cachedInput !== void 0) readTokens = (readTokens ?? 0) + report.cachedInput;
+		if (report.cacheWriteInput !== void 0) writeTokens = (writeTokens ?? 0) + report.cacheWriteInput;
+	}
+	const promptCache = {};
+	if (readTokens !== void 0) promptCache.readTokens = readTokens;
+	if (writeTokens !== void 0) promptCache.writeTokens = writeTokens;
+	return buildLlmCall({
+		inputTokens,
+		outputTokens,
+		...Object.keys(promptCache).length > 0 ? { promptCache } : {}
+	}, agentRunName);
+}
+/**
+* Sum the token usage + USD cost of a sandbox turn's events — the one honest way to meter an
+* `openSandboxRun` cell. Folds a {@link SandboxUsageLedger} over the stream, so it reads usage off
+* EVERY backend event shape — the canonical events plus a harness that reports usage only in its
+* own event — and a `runProfileMatrix` dispatch can report it to `ctx.cost`:
+*
+*     receipt: (turn) => {
+*       const u = sumSandboxUsage(turn.events)
+*       return { model, inputTokens: u.input, outputTokens: u.output,
+*         ...(u.tokensKnown === false ? { usageUnknown: true } : {}),
+*         ...(u.usdKnown !== false && u.costUsd > 0 ? { actualCostUsd: u.costUsd } : {}),
+*         ...(u.usdKnown === false ? { costUnknown: true } : {}),
+*         ...(u.estimatedCostUsd !== undefined ? { estimatedCostUsd: u.estimatedCostUsd } : {}) }
+*     }
+*
+* Without this a cell reads `{tokens:0, cost:0}` and the backend-integrity guard correctly aborts the
+* matrix as a stub. `agentRunName` is the fallback model label for cost-only events (default `'agent'`).
+*
+* Pure by contract, like the ledger it folds: it never throws. A harness receipt the ledger cannot
+* read leaves the result at `tokensKnown: false` with `tokensUnknownReason` carrying the decode
+* message — an unreadable receipt is a different fact from a turn that reported no usage, and a
+* post-hoc reader that threw would lose the whole failed turn it exists to report.
+*/
+function sumSandboxUsage(events, agentRunName = "agent") {
+	let input = 0;
+	let output = 0;
+	let costUsd = 0;
+	let estimatedCostUsd = 0;
+	let sawEstimate = false;
+	let sawCall = false;
+	let sawTokenReceipt = false;
+	let tokensKnown = true;
+	let usdKnown = true;
+	let unreadable;
+	const ledger = createSandboxUsageLedger();
+	const credit = (call) => {
+		sawCall = true;
+		sawTokenReceipt ||= call.tokensIn !== void 0 || call.tokensOut !== void 0;
+		input += call.tokensIn ?? 0;
+		output += call.tokensOut ?? 0;
+		costUsd += call.costUsd ?? 0;
+		if (call.tokensKnown === false) tokensKnown = false;
+		if (call.usdKnown === false) usdKnown = false;
+		unreadable ??= call.tokensUnknownReason;
+		if (call.estimatedCostUsd !== void 0) {
+			estimatedCostUsd += call.estimatedCostUsd;
+			sawEstimate = true;
+		}
+	};
+	for (const ev of events) {
+		const call = ledger.observe(ev, agentRunName);
+		if (call) credit(call);
+	}
+	const harnessCall = ledger.settleTurn(agentRunName);
+	if (harnessCall) credit(harnessCall);
+	return {
+		input,
+		output,
+		costUsd,
+		...sawTokenReceipt && tokensKnown ? {} : { tokensKnown: false },
+		...sawCall && usdKnown ? {} : { usdKnown: false },
+		...sawEstimate ? { estimatedCostUsd } : {},
+		...unreadable === void 0 ? {} : { tokensUnknownReason: unreadable }
+	};
+}
+function usageReceiptData(envelope, usage = {}) {
+	const merged = {
+		...usage,
+		...envelope
+	};
+	for (const aliases of [
+		[
+			"tokensIn",
+			"inputTokens",
+			"prompt_tokens"
+		],
+		[
+			"tokensOut",
+			"outputTokens",
+			"completion_tokens"
+		],
+		[
+			"costUsd",
+			"totalCostUsd",
+			"cost_usd",
+			"cost"
+		],
+		["costProvenance", "cost_provenance"]
+	]) {
+		const key = aliases.find((alias) => envelope[alias] !== void 0);
+		if (key === void 0) continue;
+		for (const alias of aliases) delete merged[alias];
+		merged[key] = envelope[key];
+	}
+	for (const aliases of [["tokensKnown", "tokens_known"], [
+		"costKnown",
+		"cost_known",
+		"usdKnown",
+		"usd_known"
+	]]) {
+		const values = [usage, envelope].flatMap((receipt) => aliases.map((key) => receipt[key]).filter((value) => value !== void 0));
+		if (values.length > 0) merged[aliases[0]] = values.every((value) => value === true);
+	}
+	return merged;
+}
+function buildLlmCall(data, agentRunName) {
+	const tokensIn = pickFiniteNumber(data, [
+		"tokensIn",
+		"inputTokens",
+		"prompt_tokens"
+	]);
+	const outputTokens = pickFiniteNumber(data, [
+		"tokensOut",
+		"outputTokens",
+		"completion_tokens"
+	]);
+	const reasoningTokens = pickFiniteNumber(data, ["reasoningTokens"]);
+	const tokensOut = outputTokens ?? reasoningTokens;
+	const reportedCostUsd = pickFiniteNumber(data, [
+		"costUsd",
+		"totalCostUsd",
+		"cost_usd",
+		"cost"
+	]);
+	const explicitTokensKnown = data.tokensKnown ?? data.tokens_known;
+	const explicitCostKnown = data.costKnown ?? data.cost_known ?? data.usdKnown ?? data.usd_known;
+	const costProvenance = data.costProvenance ?? data.cost_provenance;
+	const explicitEstimate = pickFiniteNumber(data, ["estimatedCostUsd", "estimated_cost_usd"]);
+	const catalogEstimate = costProvenance === "catalog-estimate" ? explicitEstimate ?? reportedCostUsd : explicitEstimate;
+	const costUsd = costProvenance === "catalog-estimate" ? void 0 : reportedCostUsd;
+	const promptCache = readPromptCacheUsage(data);
+	const tokensKnown = explicitTokensKnown !== false && tokensIn !== void 0 && outputTokens !== void 0;
+	const usdKnown = explicitCostKnown !== false && costUsd !== void 0 && (costProvenance === void 0 || costProvenance === "provider-receipt" || costProvenance === "billing-receipt");
+	const tools = readOfferedTools(data.tools);
+	if (tokensIn === void 0 && tokensOut === void 0 && costUsd === void 0 && catalogEstimate === void 0 && promptCache === void 0 && tools === void 0 && explicitTokensKnown !== false && explicitCostKnown !== false) return;
+	const event = {
+		type: "llm_call",
+		model: typeof data.model === "string" && data.model.length > 0 ? data.model : agentRunName
+	};
+	if (tokensIn !== void 0) event.tokensIn = tokensIn;
+	if (tokensOut !== void 0) event.tokensOut = tokensOut;
+	if (!tokensKnown) event.tokensKnown = false;
+	if (costUsd !== void 0) event.costUsd = costUsd;
+	if (!usdKnown) event.usdKnown = false;
+	if (catalogEstimate !== void 0) event.estimatedCostUsd = catalogEstimate;
+	if (promptCache !== void 0) event.promptCache = promptCache;
+	if (tools !== void 0) event.tools = tools;
+	return event;
+}
+/** `data.tools`, when it is a non-empty array of non-empty tool-name strings. Anything else
+*  (absent, empty, wrong element type) is treated as "the producer did not report its offered
+*  set" — never a placeholder empty list, which would read as "offered zero tools" downstream. */
+function readOfferedTools(value) {
+	if (!Array.isArray(value) || value.length === 0) return void 0;
+	const names = value.filter((v) => typeof v === "string" && v.length > 0);
+	return names.length === value.length ? names : void 0;
+}
+/**
+* Every wire spelling of a prompt-cache READ counter, in precedence order: the canonical name
+* first, then the spellings observed on the paths that reach this extractor — the sandbox terminal
+* `tokenUsage` record, the cli-bridge OpenAI-compatible usage object (which normalizes every
+* backend to Anthropic's `cache_read_input_tokens`), Anthropic verbatim, OpenAI's
+* `prompt_tokens_details.cached_tokens`, and DeepSeek's `prompt_cache_hit_tokens`.
+*/
+const PROMPT_CACHE_READ_KEYS = [
+	"readTokens",
+	"read_tokens",
+	"cacheReadInputTokens",
+	"cache_read_input_tokens",
+	"cacheRead",
+	"cache_read",
+	"cachedInputTokens",
+	"cachedTokens",
+	"cached_tokens",
+	"prompt_cache_hit_tokens"
+];
+/**
+* Every wire spelling of a prompt-cache WRITE counter. OpenAI reports no write counter at all, so
+* an OpenAI-shaped usage record matches nothing here and the write stays absent — which is the
+* point: absent is not zero.
+*/
+const PROMPT_CACHE_WRITE_KEYS = [
+	"writeTokens",
+	"write_tokens",
+	"cacheWriteInputTokens",
+	"cache_write_input_tokens",
+	"cacheCreationInputTokens",
+	"cache_creation_input_tokens",
+	"cacheWrite",
+	"cache_write"
+];
+const PROMPT_CACHE_MISS_KEYS = [
+	"missTokens",
+	"miss_tokens",
+	"prompt_cache_miss_tokens"
+];
+const PROMPT_CACHE_SAVINGS_KEYS = ["readSavingsUsd", "read_savings_usd"];
+/**
+* Read the provider's own prompt-cache accounting off one usage-bearing event payload, in the
+* `PromptCacheUsage` vocabulary the router, driver, and chat-client paths already speak.
+*
+* Two sources, one record. A payload that already carries a `promptCache` / `prompt_cache` object
+* is forwarded VERBATIM — those fields are the provider's own report, and an unrecognized one must
+* stay visible rather than be bucketed away. On top of that, flat provider counters are translated
+* to the canonical names, filling only the names the verbatim object did not already define.
+*
+* A counter the payload does not carry is left out. Defaulting it to zero would assert the provider
+* measured no cache, which is a different fact from a provider that reported nothing — and it is
+* the fact the budget reads to decide whether its charge is a measurement or a bound.
+*/
+function readPromptCacheUsage(data) {
+	const declared = finiteMetadata(data.promptCache ?? data.prompt_cache);
+	const nested = recordValue(data.promptCache) ?? recordValue(data.prompt_cache);
+	const sources = [
+		nested,
+		data,
+		recordValue(data.prompt_tokens_details)
+	].filter((s) => s !== void 0);
+	const canonical = {};
+	const readTokens = pickTokenCount(sources, PROMPT_CACHE_READ_KEYS);
+	const writeTokens = pickTokenCount(sources, PROMPT_CACHE_WRITE_KEYS);
+	const missTokens = pickTokenCount(sources, PROMPT_CACHE_MISS_KEYS);
+	const readSavingsUsd = pickNonNegativeNumber(sources, PROMPT_CACHE_SAVINGS_KEYS);
+	const status = nested !== void 0 && typeof nested.status === "string" ? nested.status : void 0;
+	if (readTokens !== void 0) canonical.readTokens = readTokens;
+	if (writeTokens !== void 0) canonical.writeTokens = writeTokens;
+	if (missTokens !== void 0) canonical.missTokens = missTokens;
+	if (readSavingsUsd !== void 0) canonical.readSavingsUsd = readSavingsUsd;
+	if (status !== void 0) canonical.status = status;
+	const merged = {
+		...canonical,
+		...declared
+	};
+	return Object.keys(merged).length > 0 ? merged : void 0;
+}
+function pickTokenCount(sources, keys) {
+	for (const key of keys) for (const source of sources) {
+		const value = source[key];
+		if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) return value;
+	}
+}
+function pickNonNegativeNumber(sources, keys) {
+	for (const key of keys) for (const source of sources) {
+		const value = source[key];
+		if (typeof value === "number" && Number.isFinite(value) && value >= 0) return value;
+	}
+}
+function finiteMetadata(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+	const result = {};
+	for (const [key, entry] of Object.entries(value)) if (typeof entry === "number" && Number.isFinite(entry) || typeof entry === "string") result[key] = entry;
+	return Object.keys(result).length > 0 ? result : void 0;
+}
+function pickFiniteNumber(data, keys) {
+	for (const key of keys) {
+		const value = data[key];
+		if (typeof value === "number" && Number.isFinite(value)) return value;
+	}
+}
+/**
+* Collect one turn's events, keeping only the newest snapshot of each streamed text or
+* reasoning part.
+*
+* opencode sends `message.part.updated` once per token, and every frame carries the part's
+* whole cumulative text, so keeping every frame holds O(L²) bytes per turn: two concurrent
+* audit workflows took the platform API from 459 MB to an OOM at 1.95 GB in 11 minutes.
+* A snapshot (a frame whose part carries `text`) whose text extends the previous snapshot
+* of the same part replaces it and moves to the newest position, which is the rule the
+* Sandbox SDK's text collectors already apply, so the collected text is unchanged. The kept
+* frame drops its `delta`, because its text already holds every earlier increment and a
+* reader that joins `delta ?? part.text` across frames would otherwise read only the last
+* one. Delta-only frames and every other event are kept as they arrived.
+*/
+function createSandboxTurnEventCollector() {
+	const slots = [];
+	const snapshots = /* @__PURE__ */ new Map();
+	return {
+		push(event) {
+			const snapshot = partSnapshot(event);
+			if (!snapshot) {
+				slots.push(event);
+				return;
+			}
+			const previous = snapshots.get(snapshot.key);
+			const extends_ = previous !== void 0 && snapshot.text.startsWith(previous.text);
+			if (extends_) slots[previous.at] = void 0;
+			snapshots.set(snapshot.key, {
+				at: slots.length,
+				text: snapshot.text
+			});
+			slots.push(extends_ ? withoutDelta(event) : event);
+		},
+		events() {
+			return slots.filter((event) => event !== void 0);
+		}
+	};
+}
+function partSnapshot(event) {
+	if (event?.type !== "message.part.updated") return void 0;
+	const data = asRecord(event.data);
+	const part = asRecord(data?.part) ?? asRecord(asRecord(data?.properties)?.part);
+	if (!part || typeof part.id !== "string") return void 0;
+	if (part.type !== "text" && part.type !== "reasoning" && part.type !== "thinking") return void 0;
+	const text = typeof part.text === "string" ? part.text : typeof part.content === "string" ? part.content : void 0;
+	return text === void 0 ? void 0 : {
+		key: `${part.type}:${part.id}`,
+		text
+	};
+}
+function withoutDelta(event) {
+	const data = asRecord(event.data);
+	if (!data || !("delta" in data)) return event;
+	const { delta: _delta, ...rest } = data;
+	return {
+		...event,
+		data: rest
+	};
+}
+function asRecord(value) {
+	return value !== null && typeof value === "object" ? value : void 0;
+}
+// src/runtime/timestamps.ts
+const validTimestamp = "2026-01-01T00:00:00.000Z";
+/** Validate a timestamp with the public runtime envelope contract. */
+function assertRuntimeTimestamp(value, label) {
+	try {
+		RuntimeEventEnvelopeSchema.parse({
+			runId: "runtime",
+			eventId: "event",
+			sequence: 0,
+			occurredAt: value,
+			receivedAt: validTimestamp,
+			event: {
+				type: "status",
+				status: "processing"
+			}
+		});
+	} catch (error) {
+		throw new Error(`${label} must be a valid ISO timestamp`, { cause: error });
+	}
+}
+// src/runtime/sandbox-transport-events.ts
+/** Canonical Sandbox/provider wire-envelope decoding and transport identity. */
+const CANONICAL_STREAM_EVENT_TYPES = /* @__PURE__ */ new Set([
+	"child-task",
+	"message.part.updated",
+	"tool-heartbeat",
+	"tool-slow",
+	"model-processing",
+	"status",
+	"warning",
+	"raw",
+	"session.updated",
+	"interaction",
+	"interaction.cancel",
+	"plan.submitted"
+]);
+/** Decode one known Agent Interface event from a Sandbox event. */
+function canonicalStreamEventFromSandboxEvent(event) {
+	if (!event || typeof event !== "object") return void 0;
+	const type = String(event.type ?? "");
+	const data = event.data && typeof event.data === "object" ? event.data : {};
+	const normalized = data.normalized;
+	if (normalized === void 0 && !CANONICAL_STREAM_EVENT_TYPES.has(type)) return void 0;
+	return parseCanonicalTransportEvent(type, data, normalized, "sandbox");
+}
+/**
+* Transport type whose payload is the harness's OWN event, passed through verbatim.
+*
+* A `raw` payload names a harness-native type from a vocabulary the canonical schema does not
+* define (codex emits `thread.started` / `turn.started` / `turn.completed`). The transport type is
+* therefore the only canonical statement such an event makes, and its payload must never be read
+* as a canonical type: the mismatch guard below exists to catch a producer that MISLABELS a
+* canonical event, which a harness-native payload cannot do. A payload that does satisfy the
+* canonical `raw` shape (`backend` + `event`) still parses; anything else is not a canonical
+* event, and the caller reads it off the transport event instead.
+*/
+const harnessNativePayloadType = "raw";
+/** Parse canonical payload fields without treating transport identity as event data. */
+function parseCanonicalTransportEvent(type, data, normalized, source) {
+	if (!isRecord(data)) throw new Error(`${source} emitted a canonical event without an object payload`);
+	const outerType = String(type ?? "");
+	const harnessNative = outerType === harnessNativePayloadType;
+	if (normalized !== void 0) {
+		if (!harnessNative && typeof normalized === "object" && normalized !== null && "type" in normalized && typeof normalized.type === "string" && normalized.type !== outerType) throw new Error(`${source} canonical event type "${normalized.type}" does not match transport type "${outerType}"`);
+		const candidate = CanonicalStreamEventSchema.safeParse(normalized);
+		if (!candidate.success) {
+			if (harnessNative) return void 0;
+			throw new Error(`${source} emitted an invalid normalized canonical event`, { cause: candidate.error });
+		}
+		return candidate.data;
+	}
+	const { type: embeddedType, eventId: _eventId, cursor: _cursor, sequence: _sequence, occurredAt: _occurredAt, normalized: _normalized, ...payload } = data;
+	if (!harnessNative && embeddedType !== void 0 && embeddedType !== outerType) throw new Error(`${source} canonical event type "${String(embeddedType)}" does not match transport type "${outerType}"`);
+	const candidate = CanonicalStreamEventSchema.safeParse({
+		...payload,
+		type: outerType
+	});
+	return candidate.success ? candidate.data : void 0;
+}
+/** Extract shared event identity without privileging one provider wire shape. */
+function extractTransportEventIdentity(event) {
+	const record = isRecord(event) ? event : {};
+	const data = isRecord(record.data) ? record.data : {};
+	const providerEvent = isRecord(record.providerEvent) ? record.providerEvent : {};
+	const providerData = isRecord(providerEvent.data) ? providerEvent.data : {};
+	const eventId = canonicalEventId(record, data, providerEvent, providerData);
+	const cursor = stableString(record.cursor ?? data.cursor ?? providerEvent.cursor ?? providerData.cursor);
+	const sequence = optionalSequence(record.sequence ?? data.sequence ?? providerEvent.sequence ?? providerData.sequence);
+	const occurredAt = optionalTimestamp(record.occurredAt ?? data.occurredAt ?? providerEvent.occurredAt ?? providerData.occurredAt);
+	return {
+		...eventId === void 0 ? {} : { eventId },
+		...cursor === void 0 ? {} : { cursor },
+		...sequence === void 0 ? {} : { sequence },
+		...occurredAt === void 0 ? {} : { occurredAt }
+	};
+}
+function canonicalEventId(record, data, providerEvent, providerData) {
+	const present = [
+		["data.eventId", data.eventId],
+		["providerEvent.eventId", providerEvent.eventId],
+		["providerData.eventId", providerData.eventId],
+		["record.eventId", record.eventId]
+	].filter(([, value]) => value !== void 0);
+	if (present.length === 0) return stableString(record.id ?? providerEvent.id);
+	const normalized = present.map(([source, value]) => {
+		const eventId = stableString(value);
+		if (eventId === void 0) throw new Error(`transport event ${source} must be a stable string`);
+		return {
+			source,
+			eventId
+		};
+	});
+	const first = normalized[0];
+	if (normalized.some((candidate) => candidate.eventId !== first.eventId)) throw new Error("transport event canonical identities disagree");
+	return first.eventId;
+}
+function stableString(value) {
+	return typeof value === "string" && value.length > 0 && value.trim() === value ? value : void 0;
+}
+function finiteNonNegativeInteger(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
+function optionalSequence(value) {
+	if (value === void 0) return void 0;
+	if (finiteNonNegativeInteger(value) === void 0) throw new Error("transport event sequence must be a non-negative safe integer");
+	return value;
+}
+function optionalTimestamp(value) {
+	if (value === void 0) return void 0;
+	assertRuntimeTimestamp(value, "occurredAt");
+	return value;
+}
+// src/runtime/sandbox-executor-output.ts
+/** Streamed and terminal Sandbox executor output, using one tool-part projector. */
+/**
+* Fresh per-turn {@link SandboxToolPartState} for {@link mapSandboxToolEvent} — an
+* empty call-status map so each turn projects tool frames independently.
+*
+* @experimental
+*/
+function createSandboxToolPartState() {
+	return {
+		statusByCall: /* @__PURE__ */ new Map(),
+		seq: 0
+	};
+}
+/** Statuses that settle one tool call as a failure. A failed tool call stays a tool result:
+*  the run's terminal state comes from the public Sandbox outcome tracker, never from here. */
+const TERMINAL_FAILURE = /^(error|errored|failed|failure|cancelled|canceled|timeout|timed_out)$/i;
+/**
+* Project one `SandboxEvent` onto the `tool_call` / `tool_result` variants of
+* `RuntimeStreamEvent` — the tool-part projection `mapSandboxEvent`
+* deliberately does NOT perform. Opt-in and additive: `mapSandboxEvent`'s
+* default vocabulary (text/reasoning deltas + `llm_call`) is unchanged;
+* consumers that need the tool surface (chat UIs rendering tool activity)
+* compose this projector alongside it — `streamAgentTurn` does exactly that
+* under its `preserveToolParts` option.
+*
+* Handled shapes (observed on the opencode / claude-code sandbox backends):
+*   - `message.part.updated` with `part.type === 'tool'` — stateful: a
+*     `tool_call` on the call id's first frame (args from `state.input` or
+*     `state.metadata.input`), a `tool_result` when the status transitions to
+*     `completed` (result from `state.output` / `metadata.output`) or to a
+*     terminal failure (result is `{ error, status, output? }` — the error
+*     surfaced in-band, never dropped).
+*   - bare `tool*` event types (`tool.call`, `tool_result`, …) — stateless:
+*     `*result*` types project to `tool_result`, the rest to `tool_call`.
+*   - codex `raw` events whose inner `item.started` / `item.updated` /
+*     `item.completed` carries a command, MCP, collaboration, web search or
+*     file change item — stateful on the item id, like a tool part. Other raw
+*     events, including opencode's raw `tool_use` echoes, project nothing.
+*
+* Returns `[]` for every non-tool event.
+*
+* @experimental
+*/
+function mapSandboxToolEvent(event, state) {
+	if (!event || typeof event !== "object") return [];
+	const type = String(event.type ?? "");
+	const data = event.data && typeof event.data === "object" ? event.data : {};
+	if (type === "message.part.updated") {
+		const part = data.part && typeof data.part === "object" ? data.part : {};
+		if (String(part.type ?? "") !== "tool") return [];
+		return projectToolPart(part, state, typeof event.id === "string" ? event.id : void 0);
+	}
+	if (type === "raw") return projectCodexItem(data, state);
+	if (CANONICAL_STREAM_EVENT_TYPES.has(type)) return [];
+	if (type.includes("tool")) {
+		const callId = pickString(data, [
+			"toolCallId",
+			"tool_use_id",
+			"id"
+		]) ?? (typeof event.id === "string" ? event.id : void 0) ?? `sandbox-tool-${++state.seq}`;
+		const toolName = pickString(data, [
+			"name",
+			"toolName",
+			"tool"
+		]) ?? "sandbox_tool";
+		if (type.includes("result")) return [{
+			type: "tool_result",
+			toolName,
+			toolCallId: callId,
+			result: data.output ?? data.result ?? data.content ?? data
+		}];
+		return [{
+			type: "tool_call",
+			toolName,
+			toolCallId: callId,
+			args: data.input ?? data.args ?? {}
+		}];
+	}
+	return [];
+}
+function projectToolPart(part, state, eventId) {
+	const callId = pickString(part, [
+		"callID",
+		"callId",
+		"toolCallId",
+		"id"
+	]) ?? eventId ?? `sandbox-tool-${++state.seq}`;
+	const toolName = pickString(part, [
+		"tool",
+		"toolName",
+		"name"
+	]) ?? "sandbox_tool";
+	const toolState = part.state && typeof part.state === "object" ? part.state : {};
+	const metadata = toolState.metadata && typeof toolState.metadata === "object" ? toolState.metadata : {};
+	const status = pickString(toolState, ["status"]) ?? "updated";
+	const previous = state.statusByCall.get(callId);
+	if (previous === "completed" || previous !== void 0 && TERMINAL_FAILURE.test(previous)) return [];
+	const out = [];
+	if (previous === void 0) out.push({
+		type: "tool_call",
+		toolName,
+		toolCallId: callId,
+		args: toolState.input ?? metadata.input ?? {}
+	});
+	state.statusByCall.set(callId, status);
+	if (status === "completed") out.push({
+		type: "tool_result",
+		toolName,
+		toolCallId: callId,
+		result: toolState.output ?? metadata.output ?? ""
+	});
+	else if (TERMINAL_FAILURE.test(status)) {
+		const message = pickString(toolState, ["error", "message"]) ?? pickString(metadata, ["error", "message"]) ?? `sandbox tool ended with status ${status}`;
+		const output = toolState.output ?? metadata.output;
+		out.push({
+			type: "tool_result",
+			toolName,
+			toolCallId: callId,
+			result: {
+				error: message,
+				status,
+				...output !== void 0 ? { output } : {}
+			}
+		});
+	}
+	return out;
+}
+/** Codex item types that are tool calls. Reasoning, messages and todo lists are not. */
+const CODEX_TOOL_ITEMS = /* @__PURE__ */ new Set([
+	"command_execution",
+	"mcp_tool_call",
+	"collab_tool_call",
+	"web_search",
+	"file_change"
+]);
+/** Item fields that describe the call's progress or outcome rather than what it was asked to do. */
+const CODEX_ITEM_OUTCOME_FIELDS = /* @__PURE__ */ new Set([
+	"id",
+	"type",
+	"status",
+	"result",
+	"error",
+	"aggregated_output",
+	"exit_code"
+]);
+/**
+* Project a codex `item.started` / `item.updated` / `item.completed` tool item through the same
+* per-call state as a tool part, keyed on the item id: one `tool_call` on its first frame and one
+* `tool_result` when it completes. Tool names follow Eval's codex intake: `server/tool` for MCP.
+*/
+function projectCodexItem(data, state) {
+	if (data.backend !== "codex" || !data.event || typeof data.event !== "object") return [];
+	const inner = data.event;
+	const phase = inner.type;
+	if (phase !== "item.started" && phase !== "item.updated" && phase !== "item.completed") return [];
+	if (!inner.item || typeof inner.item !== "object") return [];
+	const item = inner.item;
+	const itemType = pickString(item, ["type"]);
+	if (itemType === void 0 || !CODEX_TOOL_ITEMS.has(itemType)) return [];
+	const error = item.error && typeof item.error === "object" ? pickString(item.error, ["message"]) ?? `${itemType} failed` : void 0;
+	const failed = item.status === "failed" || error !== void 0 || itemType === "command_execution" && typeof item.exit_code === "number" && item.exit_code !== 0;
+	const status = phase !== "item.completed" ? "running" : failed ? "failed" : "completed";
+	const input = Object.fromEntries(Object.entries(item).filter(([key]) => !CODEX_ITEM_OUTCOME_FIELDS.has(key)));
+	const output = item.result ?? item.aggregated_output ?? item.changes;
+	return projectToolPart({
+		...typeof item.id === "string" ? { callID: item.id } : {},
+		tool: codexToolName(itemType, item),
+		state: {
+			status,
+			input,
+			...output === void 0 || output === null ? {} : { output },
+			...status === "failed" ? { error: error ?? `${itemType} failed` } : {}
+		}
+	}, state, void 0);
+}
+function codexToolName(itemType, item) {
+	if (itemType === "mcp_tool_call") {
+		const name = [pickString(item, ["server"]), pickString(item, ["tool"])].filter((part) => part !== void 0).join("/");
+		return name === "" ? "mcp" : name;
+	}
+	if (itemType === "collab_tool_call") return pickString(item, ["tool"]) ?? "subagent";
+	if (itemType === "web_search" || itemType === "file_change") return itemType;
+	return pickString(item, ["name"]) ?? itemType;
+}
+function pickString(data, keys) {
+	for (const key of keys) {
+		const value = data[key];
+		if (typeof value === "string" && value.length > 0) return value;
+	}
+}
+/**
+* Project one `SandboxEvent` onto the `RuntimeStreamEvent` chat-UX vocabulary,
+* for runtimes that bridge a sandbox `streamPrompt` into the
+* `AgentRuntime.act` streaming contract. Returns `undefined` for events that
+* have no faithful projection — the raw stream is preserved separately for the
+* `OutputAdapter`, so an unmapped event never loses data.
+*
+* Mapped (the task-optional incremental variants — no synthesized task
+* lifecycle, no guessed tool-part shapes):
+*   - `message.part.updated` text part → `text_delta`
+*   - `message.part.updated` reasoning/thinking part → `reasoning_delta`
+*   - cost-bearing events → `llm_call` (shared with the ledger extractor)
+*
+* Tool parts are deliberately NOT mapped here (unchanged default) — compose
+* {@link mapSandboxToolEvent} alongside when a consumer needs them.
+*
+* The opencode backend emits incremental text as
+* `{ type: 'message.part.updated', data: { part: { type, text }, delta } }`;
+* `delta` is the increment, `part.text` the running accumulation.
+*/
+function mapSandboxEvent(event, opts = {}) {
+	if (!event || typeof event !== "object") return void 0;
+	const type = String(event.type ?? "");
+	const data = event.data && typeof event.data === "object" ? event.data : {};
+	if (type === "message.part.updated") {
+		const part = data.part && typeof data.part === "object" ? data.part : {};
+		const partType = String(part.type ?? "");
+		const text = (typeof data.delta === "string" ? data.delta : void 0) ?? (typeof part.text === "string" ? part.text : void 0);
+		if (text === void 0) return void 0;
+		if (partType === "text") return {
+			type: "text_delta",
+			text
+		};
+		if (partType === "reasoning" || partType === "thinking") return {
+			type: "reasoning_delta",
+			text
+		};
+		return;
+	}
+	return extractLlmCallEvent(event, opts.agentRunName ?? "agent");
+}
+/**
+* Project one `SandboxEvent` onto Runtime's executor progress vocabulary: incremental text and
+* reasoning, tool calls and results, and an interaction request. It composes the existing
+* projections ({@link mapSandboxEvent}, {@link mapSandboxToolEvent}, and the canonical Agent
+* Interface decode) so every sandbox-shaped executor publishes live output through one reader.
+* Usage-bearing events project to nothing here — accounting stays on the `tokens`/`cost`
+* channels.
+*
+* Pass one {@link SandboxToolPartState} per turn so a multi-frame tool call yields one call and
+* at most one result.
+*
+* @experimental
+*/
+function sandboxProgressEvents(event, state) {
+	const canonical = canonicalStreamEventFromSandboxEvent(event);
+	if (canonical?.type === "interaction") return [{
+		kind: "interaction",
+		request: canonical.request
+	}];
+	if (canonical?.type === "child-task") return [{
+		kind: "child_task",
+		event: canonical
+	}];
+	const tools = mapSandboxToolEvent(event, state).map((projected) => projected.type === "tool_call" ? {
+		kind: "tool_call",
+		toolName: projected.toolName,
+		...projected.toolCallId === void 0 ? {} : { toolCallId: projected.toolCallId },
+		...projected.args === void 0 ? {} : { args: projected.args }
+	} : {
+		kind: "tool_result",
+		toolName: projected.toolName,
+		...projected.toolCallId === void 0 ? {} : { toolCallId: projected.toolCallId },
+		...projected.result === void 0 ? {} : { result: projected.result }
+	});
+	if (tools.length > 0) return tools;
+	const mapped = mapSandboxEvent(event);
+	if (mapped?.type === "text_delta") return [{
+		kind: "text_delta",
+		text: mapped.text
+	}];
+	if (mapped?.type === "reasoning_delta") return [{
+		kind: "reasoning_delta",
+		text: mapped.text
+	}];
+	return [];
+}
+/** Project the complete Sandbox event stream into the standard executor result shape. */
+function sandboxLeafOutputFromEvents(events) {
+	const content = collectAgentFinalMessageText(events) ?? collectAgentResponseText(events);
+	const toolCalls = sandboxToolCalls(events);
+	const servedBackend = lastServedBackend(events);
+	return {
+		events,
+		content,
+		output: sandboxOutputMarker(content, events.some(carriesText)),
+		...servedBackend === void 0 ? {} : { servedBackend },
+		...toolCalls.length === 0 ? {} : { toolCalls }
+	};
+}
+/**
+* Classify observed text into the explicit output marker. `sawTextEvent` says whether the stream
+* carried a text-bearing event at all, which is what separates a box that answered nothing from a
+* box whose answer was never observed.
+*/
+function sandboxOutputMarker(content, sawTextEvent = content !== void 0) {
+	if (content !== void 0 && content.length > 0) return {
+		kind: "text",
+		bytes: Buffer.byteLength(content, "utf8")
+	};
+	return sawTextEvent ? { kind: "empty" } : { kind: "absent" };
+}
+/** True when the event carries a text field a turn's answer could come from, empty or not. */
+function carriesText(event) {
+	if (!event || typeof event !== "object") return false;
+	const data = event.data && typeof event.data === "object" ? event.data : {};
+	if (typeof data.finalText === "string" || typeof data.text === "string") return true;
+	if (typeof data.delta === "string") return true;
+	const part = data.part && typeof data.part === "object" ? data.part : void 0;
+	return part !== void 0 && part.type === "text" && typeof part.text === "string";
+}
+/** The last served identity the platform reported across a turn's events, or `undefined`. */
+function lastServedBackend(events) {
+	let served;
+	for (const event of events) {
+		const next = sandboxEventServedBackend(event);
+		if (next !== void 0) served = next;
+	}
+	return served;
+}
+function sandboxToolCalls(events) {
+	const state = createSandboxToolPartState();
+	return events.flatMap((event) => mapSandboxToolEvent(event, state).flatMap((projected) => projected.type === "tool_call" ? [{
+		...projected.toolCallId === void 0 ? {} : { id: projected.toolCallId },
+		name: projected.toolName,
+		arguments: projected.args ?? {}
+	}] : []));
+}
+/** Read the final text off a terminal sandbox event, when present. */
+function terminalTextFromSandboxEvent(event) {
+	if (!event || typeof event !== "object") return void 0;
+	if (!isSandboxTerminalEvent(String(event.type ?? ""))) return void 0;
+	const data = event.data && typeof event.data === "object" ? event.data : {};
+	for (const key of [
+		"finalText",
+		"text",
+		"response",
+		"content"
+	]) {
+		const value = data[key];
+		if (typeof value === "string") return value;
+	}
+}
+// src/runtime/supervise/spend-validation.ts
+/** Reject malformed ceilings before they can mint capacity through negative reservations. */
+function assertValidBudget(budget, label = "budget") {
+	const safeInteger = (value, field) => {
+		if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label}.${field} must be a non-negative safe integer`);
+	};
+	const finiteNonNegative = (value, field) => {
+		if (!Number.isFinite(value) || value < 0) throw new Error(`${label}.${field} must be a non-negative finite number`);
+	};
+	assertResources(budget.resources, "limit", `${label}.resources`);
+	safeInteger(budget.maxIterations, "maxIterations");
+	safeInteger(budget.maxTokens, "maxTokens");
+	if (budget.maxUsd !== void 0) finiteNonNegative(budget.maxUsd, "maxUsd");
+	if (budget.deadlineMs !== void 0) finiteNonNegative(budget.deadlineMs, "deadlineMs");
+}
+function assertValidSpend(spend, label) {
+	assertResources(spend.resources, "amount", `${label}.resources`);
+	if (!Number.isSafeInteger(spend.iterations) || spend.iterations < 0) throw new Error(`${label}.iterations must be a non-negative safe integer`);
+	for (const [field, value] of [
+		["input", spend.tokens.input],
+		["output", spend.tokens.output],
+		["freshInput", spend.tokens.freshInput],
+		["cacheRead", spend.tokens.cacheRead],
+		["cacheWrite", spend.tokens.cacheWrite]
+	]) {
+		if (value === void 0) continue;
+		if (!Number.isSafeInteger(value) || value < 0) throw new Error(`${label}.tokens.${field} must be a non-negative safe integer`);
+	}
+	for (const [field, value] of [["tokensKnown", spend.tokens.tokensKnown], ["cacheBreakdownKnown", spend.tokens.cacheBreakdownKnown]]) if (value !== void 0 && value !== false) throw new Error(`${label}.tokens.${field} must be false when present`);
+	const { freshInput, cacheRead, cacheWrite } = spend.tokens;
+	if (freshInput !== void 0 && cacheRead !== void 0 && cacheWrite !== void 0) {
+		const classified = freshInput + cacheRead + cacheWrite;
+		if (spend.tokens.cacheBreakdownKnown !== false) {
+			if (classified !== spend.tokens.input) throw new Error(`${label}.tokens cache classes must sum to input`);
+		} else if (classified > spend.tokens.input) throw new Error(`${label}.tokens cache classes must not exceed input`);
+	}
+	for (const [field, value] of [["usd", spend.usd], ["ms", spend.ms]]) if (!Number.isFinite(value) || value < 0) throw new Error(`${label}.${field} must be a non-negative finite number`);
+	if (spend.usdEstimated !== void 0) {
+		if (!Number.isFinite(spend.usdEstimated) || spend.usdEstimated < 0) throw new Error(`${label}.usdEstimated must be a non-negative finite number`);
+		if (spend.usdEstimated > spend.usd) throw new Error(`${label}.usdEstimated must not exceed ${label}.usd`);
+		if (spend.usdKnown !== false) throw new Error(`${label}.usdEstimated requires ${label}.usdKnown false`);
+	}
+}
+// src/runtime/supervise/budget-ledger.ts
+/**
+* The balances of one conserved budget pool, and the arithmetic that moves them. `createBudgetPool`
+* (`./budget`) owns tickets, the wait queue and the public contract; this module owns the numbers:
+* `total ≡ free + reserved + committed` per channel, the taint flags that say a balance is a
+* ceiling rather than a measurement, and the named-resource states.
+*/
+function openBudgetLedger(root, runStartedAtMs) {
+	return {
+		usdCapped: root.maxUsd !== void 0,
+		absoluteDeadlineMs: root.deadlineMs === void 0 ? 0 : runStartedAtMs + root.deadlineMs,
+		resources: new Map(Object.entries(root.resources ?? {}).map(([name, value]) => [name, {
+			...value,
+			remaining: value.limit,
+			reserved: 0,
+			committed: 0,
+			known: true
+		}])),
+		freeTokens: root.maxTokens,
+		reservedTokens: 0,
+		committedTokens: 0,
+		tokensTainted: false,
+		cacheBreakdownTainted: false,
+		freeUsd: root.maxUsd ?? 0,
+		reservedUsd: 0,
+		committedUsd: 0,
+		usdTainted: false,
+		usdMeasured: true,
+		freeIterations: root.maxIterations,
+		reservedIterations: 0,
+		committedIterations: 0
+	};
+}
+function ledgerValidateUnits(l, spend) {
+	for (const [name, value] of Object.entries(spend.resources ?? {})) {
+		const limit = l.resources.get(name);
+		if (limit && limit.unit !== value.unit) throw new Error(`resource ${name}: unit mismatch`);
+	}
+}
+/** Record that `spend` carried an unreported or unclassified channel. */
+function noteUnknowns(l, spend) {
+	if (spend.tokensKnown === false) l.tokensTainted = true;
+	if (!hasCompleteCacheBreakdown(spend.tokens)) l.cacheBreakdownTainted = true;
+	if (spend.usdKnown === false) l.usdMeasured = false;
+}
+/**
+* Commit named-resource spend and classify it. `allocations` is the settling reservation's own
+* allocations, or `undefined` for spend holding no reservation (`observe`, restore). Unverifiable
+* usage is a `fault` (the remaining balance is consumed so admission closes); measured usage above
+* an allocation is `overspent`; without allocations, usage leaving a root limit overdrawn is
+* `rootExceeded`. A reservation within its own allocation is never charged with a root overdraw:
+* a negative balance at its settlement was caused, and reported, by earlier spend.
+*/
+function ledgerCommitResources(l, spend, allocations, requireAll = true) {
+	let fault;
+	let rootExceeded;
+	const overspent = [];
+	for (const [name, state] of l.resources) {
+		const value = spend.resources?.[name];
+		if (!requireAll && value === void 0) continue;
+		const allocation = allocations?.[name]?.limit ?? 0;
+		const amount = value?.amount ?? 0;
+		state.reserved -= allocation;
+		const committed = state.committed + amount;
+		const overflow = !Number.isSafeInteger(committed);
+		state.committed = Math.min(committed, Number.MAX_SAFE_INTEGER);
+		state.remaining = state.limit - state.reserved - state.committed;
+		if (value?.known !== true || overflow) {
+			state.known = false;
+			const retained = Math.max(0, state.remaining);
+			state.committed += retained;
+			state.remaining -= retained;
+			fault ??= overflow ? `resource ${name}: amount overflow under an enforced limit` : `resource ${name}: unknown usage under an enforced limit`;
+		} else if (allocations !== void 0) {
+			if (amount > allocation) overspent.push({
+				channel: `resource:${name}`,
+				reserved: allocation,
+				spent: amount
+			});
+		} else if (state.remaining < 0) rootExceeded ??= `resource ${name}: exceeded root limit ${state.limit}`;
+	}
+	return {
+		...fault ? { fault } : {},
+		overspent,
+		...rootExceeded ? { rootExceeded } : {}
+	};
+}
+/** Every channel `b` does not fit, measured against the free balance less `keep`. */
+function ledgerShortfalls(l, b, keep) {
+	const wantTokens = b.maxTokens;
+	const wantUsd = b.maxUsd ?? 0;
+	const wantIterations = b.maxIterations;
+	const shortfalls = [];
+	const short = (channel, requested, free, held, closedByUnknownSpend = false) => {
+		shortfalls.push({
+			channel,
+			requested,
+			free: closedByUnknownSpend ? 0 : Math.max(0, free),
+			...closedByUnknownSpend || held <= 0 ? {} : { held },
+			...closedByUnknownSpend ? { closedByUnknownSpend: true } : {}
+		});
+	};
+	for (const [name, state] of l.resources) {
+		const limit = b.resources[name].limit;
+		if (!state.known) short(`resource:${name}`, limit, 0, 0, true);
+		else if (limit > state.remaining) short(`resource:${name}`, limit, state.remaining, state.reserved);
+	}
+	if (l.usdCapped && l.usdTainted) short("usd", wantUsd, 0, 0, true);
+	const tokensFree = l.freeTokens - (keep?.tokens ?? 0);
+	const iterationsFree = l.freeIterations - (keep?.iterations ?? 0);
+	if (wantTokens > tokensFree) short("tokens", wantTokens, tokensFree, l.reservedTokens);
+	if (wantIterations > iterationsFree) short("iterations", wantIterations, iterationsFree, l.reservedIterations);
+	const usdFree = l.freeUsd - (keep?.usd ?? 0);
+	if (l.usdCapped && !l.usdTainted && wantUsd > usdFree) short("usd", wantUsd, usdFree, l.reservedUsd);
+	return shortfalls;
+}
+/** Move `b` from free to reserved. The caller has checked that it fits. */
+function ledgerTake(l, b) {
+	for (const [name, state] of l.resources) {
+		const amount = b.resources[name].limit;
+		state.remaining -= amount;
+		state.reserved += amount;
+	}
+	l.freeTokens -= b.maxTokens;
+	l.reservedTokens += b.maxTokens;
+	l.freeIterations -= b.maxIterations;
+	l.reservedIterations += b.maxIterations;
+	const wantUsd = b.maxUsd ?? 0;
+	if (wantUsd > 0) {
+		l.freeUsd -= wantUsd;
+		l.reservedUsd += wantUsd;
+	}
+}
+/**
+* The overspends a settlement of `spent` against `held` decides, before any balance moves. An
+* OVERSPEND is measured spend above the reservation; unknown dollars under a dollar cap (a fault
+* the caller reports) are flagged `unknownUnderCap`. `usdBudgeted` is whether the child declared a
+* dollar ceiling: without `maxUsd` it reserved NO dollars, so under a capped root its dollars are
+* OBSERVED spend, committed and debited from `free` like `observe`d inference.
+*/
+function ledgerClassifyOverspend(l, held, usdBudgeted, spent) {
+	const unknownUnderCap = l.usdCapped && spent.usdKnown === false;
+	const spentTokens = chargedTokens(spent.tokens);
+	const overspent = [];
+	if (spentTokens > held.tokens) overspent.push({
+		channel: "tokens",
+		reserved: held.tokens,
+		spent: spentTokens
+	});
+	if (spent.iterations > held.iterations) overspent.push({
+		channel: "iterations",
+		reserved: held.iterations,
+		spent: spent.iterations
+	});
+	if (!unknownUnderCap && l.usdCapped && usdBudgeted && spent.usd > held.usd) overspent.push({
+		channel: "usd",
+		reserved: held.usd,
+		spent: spent.usd
+	});
+	return {
+		overspent,
+		unknownUnderCap
+	};
+}
+/**
+* Release the whole reservation `held`, then commit actual spend; the difference is the refund
+* that flows back to `free`. Unconditional arithmetic: nothing here throws on spend it can read.
+*/
+function ledgerSettle(l, held, spent, unknownUnderCap) {
+	noteUnknowns(l, spent);
+	const spentTokens = chargedTokens(spent.tokens);
+	l.reservedTokens -= held.tokens;
+	l.committedTokens += spentTokens;
+	l.freeTokens += held.tokens - spentTokens;
+	l.reservedIterations -= held.iterations;
+	l.committedIterations += spent.iterations;
+	l.freeIterations += held.iterations - spent.iterations;
+	if (l.usdCapped) {
+		l.reservedUsd -= held.usd;
+		l.committedUsd += spent.usd;
+		if (unknownUnderCap) {
+			l.usdTainted = true;
+			l.freeUsd = 0;
+		} else l.freeUsd += held.usd - spent.usd;
+	} else l.committedUsd += spent.usd;
+	return ledgerCommitResources(l, spent, held.resources ?? {});
+}
+/**
+* Direct free → committed debit (no ticket). `free` may go negative on overspend: the readout then
+* reports exhaustion and the in-loop guard halts the driver. Work with an unreported token count
+* still debits what IS known and marks the balance incomplete; refusing to record it is the "free
+* turn" the pool must never see.
+*/
+function ledgerObserve(l, spend, unknownUnderCap, requireAllResources) {
+	noteUnknowns(l, spend);
+	const tokens = chargedTokens(spend.tokens);
+	l.freeTokens -= tokens;
+	l.committedTokens += tokens;
+	l.freeIterations -= spend.iterations;
+	l.committedIterations += spend.iterations;
+	l.committedUsd += spend.usd;
+	if (l.usdCapped) l.freeUsd -= spend.usd;
+	if (unknownUnderCap) l.usdTainted = true;
+	return ledgerCommitResources(l, spend, void 0, requireAllResources);
+}
+/**
+* Reconstruct the balances from a prior process's durable record. Measured prior spend is debited
+* exactly once; a started-without-terminal child is charged at its entire reservation, so restart
+* never mints capacity and the false known flags stay visible. Direct arithmetic, not `observe`:
+* the prior spend ALREADY happened, and refusing to record it would be a zero-cost restart.
+*/
+function ledgerRestore(l, root, restore) {
+	if (restore.committed !== void 0) {
+		const committed = restore.committed;
+		assertValidSpend(committed, "budget restore committed");
+		ledgerValidateUnits(l, committed);
+		ledgerCommitResources(l, committed);
+		noteUnknowns(l, committed);
+		const tokens = chargedTokens(committed.tokens);
+		l.freeTokens -= tokens;
+		l.committedTokens += tokens;
+		l.freeIterations -= committed.iterations;
+		l.committedIterations += committed.iterations;
+		l.committedUsd += committed.usd;
+		if (l.usdCapped) {
+			l.freeUsd -= committed.usd;
+			if (committed.usdKnown === false) {
+				l.usdTainted = true;
+				if (l.freeUsd > 0) l.committedUsd += l.freeUsd;
+				l.freeUsd = 0;
+			}
+		}
+	}
+	for (const [index, uncertain] of (restore.uncertainReservations ?? []).entries()) {
+		assertValidBudget(uncertain, `budget restore uncertainReservations[${index}]`);
+		ledgerCommitResources(l, withBudgetResources({
+			iterations: 0,
+			tokens: zeroTokenUsage(),
+			usd: 0,
+			ms: 0
+		}, root));
+		l.tokensTainted = true;
+		l.usdMeasured = false;
+		l.freeTokens -= uncertain.maxTokens;
+		l.committedTokens += uncertain.maxTokens;
+		l.freeIterations -= uncertain.maxIterations;
+		l.committedIterations += uncertain.maxIterations;
+		if (!l.usdCapped) continue;
+		if (uncertain.maxUsd === void 0) {
+			l.usdTainted = true;
+			l.committedUsd += l.freeUsd > 0 ? l.freeUsd : 0;
+			l.freeUsd = 0;
+		} else {
+			l.freeUsd -= uncertain.maxUsd;
+			l.committedUsd += uncertain.maxUsd;
+		}
+	}
+}
+// src/runtime/supervise/usage-metering.ts
+/** Fold a normalized `UsageEvent` array into a `Spend`. Tokens and usd are separate
+*  channels; iterations come from `'iteration'` events. Pure; `ms` stays zero (the
+*  pool does not read wall-clock). */
+function spendFromUsageEvents(events) {
+	const totals = newUsageTotals();
+	for (const ev of events) meterUsageEvent(totals, ev);
+	return spendFromUsageTotals(totals);
+}
+/** Fresh accounting totals, optionally restored from verified committed spend. */
+function newUsageTotals(priorSpent) {
+	if (priorSpent !== void 0) assertValidSpend(priorSpent, "prior committed usage");
+	return {
+		...addResourceSpend(priorSpent?.resources),
+		tokens: priorSpent === void 0 ? zeroTokenUsage() : cloneTokenUsage(priorSpent.tokens),
+		tokensKnown: priorSpent?.tokensKnown !== false,
+		...priorSpent?.tokensProvenance === void 0 ? {} : { tokensProvenance: priorSpent.tokensProvenance },
+		usd: priorSpent?.usd ?? 0,
+		usdEstimated: priorSpent?.usdEstimated ?? 0,
+		usdKnown: priorSpent?.usdKnown !== false,
+		iterations: priorSpent?.iterations ?? 0
+	};
+}
+/**
+* Fold ONE usage event into running totals — the single place that decides which event kinds
+* meter. `progress` carries observed output rather than accounting, so it meters nothing; only
+* `iteration` advances the iteration count.
+*/
+function meterUsageEvent(totals, ev) {
+	if (ev.kind === "resource") {
+		totals.resources = addResourceSpend(totals.resources, Object.fromEntries([[ev.name, {
+			unit: ev.unit,
+			amount: ev.amount,
+			known: ev.known
+		}]])).resources;
+		return;
+	}
+	if (ev.kind === "tokens") {
+		if (ev.mode === "cumulative") {
+			if (ev.input < totals.tokens.input || ev.output < totals.tokens.output) throw new ValidationError("cumulative executor tokens must not decrease");
+			const snapshot = zeroTokenUsage();
+			addTokenUsage(snapshot, {
+				...ev,
+				...ev.freshInput === void 0 && totals.tokens.freshInput !== void 0 ? { freshInput: totals.tokens.freshInput } : {},
+				...ev.cacheRead === void 0 && totals.tokens.cacheRead !== void 0 ? { cacheRead: totals.tokens.cacheRead } : {},
+				...ev.cacheWrite === void 0 && totals.tokens.cacheWrite !== void 0 ? { cacheWrite: totals.tokens.cacheWrite } : {},
+				...totals.tokens.tokensKnown === false ? { tokensKnown: false } : {}
+			});
+			totals.tokens = snapshot;
+		} else addTokenUsage(totals.tokens, ev);
+		if (ev.tokensKnown === false) totals.tokensKnown = false;
+		const source = ev.provenance ?? "stream-receipt";
+		totals.tokensProvenance = totals.tokensProvenance === void 0 || totals.tokensProvenance === source ? source : "mixed";
+		return;
+	}
+	if (ev.kind === "cost") {
+		totals.usd += ev.usd;
+		if (ev.usdKnown === false) {
+			totals.usdEstimated += ev.usdEstimated ?? 0;
+			totals.usdKnown = false;
+		}
+		return;
+	}
+	if (ev.kind === "iteration") totals.iterations += 1;
+}
+/** Project folded totals onto the conserved-pool `Spend`. `ms` stays zero — the pool does not
+*  read wall-clock. */
+function spendFromUsageTotals(totals) {
+	return {
+		...addResourceSpend(totals.resources),
+		iterations: totals.iterations,
+		tokens: totals.tokens,
+		...totals.tokensKnown ? {} : { tokensKnown: false },
+		usd: totals.usd,
+		...totals.usdKnown ? {} : { usdKnown: false },
+		...totals.usdEstimated > 0 ? { usdEstimated: totals.usdEstimated } : {},
+		...totals.tokensProvenance === void 0 || totals.tokensProvenance === "stream-receipt" ? {} : { tokensProvenance: totals.tokensProvenance },
+		ms: 0
+	};
+}
+async function foldUsage(events) {
+	if (Array.isArray(events)) return spendFromUsageEvents(events);
+	const totals = newUsageTotals();
+	for await (const ev of events) meterUsageEvent(totals, ev);
+	return spendFromUsageTotals(totals);
+}
+// src/runtime/supervise/budget.ts
+/**
+* The conserved budget reservation pool — the invariant the whole instrument rests on (critique
+* M5/B3). One root `Budget` becomes a pool of standard quantities (tokens, usd, iterations) and
+* caller-named resources plus an absolute deadline. Children reserve atomically at spawn and
+* reconcile at settle:
+*
+*   total ≡ free + reserved + committed          (for every known quantity)
+*
+* `reserve` moves a child's whole ceiling `free` → `reserved` and fails closed when `free` can't
+* cover it (never read-then-spawn overcommit, so `Σk(treatment) ≡ Σk(blind)` by construction).
+* `reconcile` releases the reservation, commits ACTUAL spend, and refunds the remainder to `free`.
+* Tokens and usd are separate channels; iterations are conserved alongside them.
+*
+* The token unit is `chargedTokens`: every token counted ONCE, when it first enters the context
+* (`input − cacheRead + output`, which is `freshInput + cacheWrite + output` under a complete
+* split). A cached prefix was already charged when written; charging a cache read again made a
+* declared cap bite about 56x early on a real fleet (cache is 98% of the rolled-up prompt total).
+* No price weight enters the token channel; money is budgeted on `maxUsd`. The unit is additive,
+* so a rolled-up report agrees with the pool. Prompt tokens the provider never classified are
+* charged in full and `readout().cacheBreakdownKnown` reads false (an upper bound on newly-
+* presented work). The pool trusts reported usage: it is an accounting unit, not a trust boundary.
+*
+* Named resources require explicit units, ceilings, and complete executor measurements; missing
+* or unknown enforced measurements close admission for that resource. The pool trusts those
+* receipts and meters no external system. `Spend.boxMinutes` is evidence only, with no implicit
+* resource ceiling; never present estimated box lifetime as a measured resource receipt.
+*
+* Pure and deterministic: the run's start instant is supplied; no I/O, wall-clock or RNG read. A
+* ticket is single-use (fail-loud on double or unknown reconcile). Reconciling an OPEN ticket
+* always closes it: a fail-loud condition settles the reservation first and throws afterwards, so
+* no error path strands a reservation past `assertNoOpenTickets`. Measured spend above a
+* reservation is not fail-loud: the pool commits it, returns a `BudgetViolation`, and refuses
+* later reservations from the reduced free balance. A child that declared no `maxUsd` reserved no
+* dollars, so its real dollars are committed as observed spend against the root, not as an
+* overspend of a $0 ceiling. Unknowable dollar cost under a dollar limit closes the known
+* token/iteration work, marks the dollar channel unusable and refuses later reservations. An
+* unknowable TOKEN count records the work, debits what is known, and marks
+* `readout().tokensKnown` false (a ceiling, not a measurement); tokens are always capped, so one
+* unreported turn must not end the run.
+*
+* A reservation the free balance cannot cover now can WAIT (`reserve(b, holder, { wait: true })`)
+* when it would fit once open reservations return. It holds nothing while waiting, so
+* conservation is untouched; waiters are granted in asking order and refused once no open
+* reservation is left to return any.
+*
+* A pool can be RESTORED from a prior process's durable record: measured committed spend is
+* debited once, and each child journaled as started but never settled is charged at its full
+* declared ceiling. Restart never mints capacity, unknown flags stay visible, and the original
+* absolute deadline never slides.
+*
+* @experimental
+*/
+/** A reconciliation whose spend the pool cannot verify, thrown after the reservation settled.
+*  `budgetViolation` carries any measured overspend on the same settlement. */
+var BudgetReconcileFault = class extends Error {
+	budgetViolation;
+	constructor(message, budgetViolation) {
+		super(message);
+		this.name = "BudgetReconcileFault";
+		if (budgetViolation !== void 0) this.budgetViolation = budgetViolation;
+	}
+};
+/**
+* A waiting reservation that can never be granted: every open reservation settled and the free
+* balance still cannot cover it. `shortfalls` are the channels that did not fit at that moment.
+*/
+var ReservationWaitRefused = class extends Error {
+	reason = "budget-exhausted";
+	shortfalls;
+	constructor(shortfalls) {
+		super(`budget-exhausted: nothing left running could return enough budget for this worker (${shortfalls.map((shortfall) => `${shortfall.channel} requested ${shortfall.requested}, free ${shortfall.free}`).join("; ")})`);
+		this.name = "ReservationWaitRefused";
+		this.shortfalls = shortfalls;
+	}
+};
+/**
+* Create a conserved reservation pool from a root `Budget`. `runStartedAtMs` is the WALL-CLOCK
+* instant the root was recorded; the deadline is `runStartedAtMs + root.deadlineMs` (`0` when
+* none), an absolute instant. A resumed pool passes the ORIGINAL instant.
+*/
+function createBudgetPool(root, runStartedAtMs, restore = {}) {
+	assertValidBudget(root, "root budget");
+	if (!Number.isFinite(runStartedAtMs) || runStartedAtMs < 0) throw new Error("budget runStartedAtMs must be a non-negative finite number");
+	const ledger = openBudgetLedger(root, runStartedAtMs);
+	let nextTicketId = 0;
+	const open = /* @__PURE__ */ new Map();
+	/** Tickets admitted to wait for budget, in the order they asked. Each is also in `open`. */
+	const waiting = [];
+	/** Open tickets that hold nothing: waiting, or refused and not yet reconciled. */
+	const holdingNothing = /* @__PURE__ */ new Set();
+	/** Grant waiting tickets in the order they asked while the head fits. When the head does not
+	*  fit and no reservation is held that could return budget, nothing can ever cover it: refuse
+	*  it, and go on with the next. */
+	function grantWaiting() {
+		while (waiting.length > 0) {
+			const head = waiting[0];
+			const shortfalls = ledgerShortfalls(ledger, head.budget, head.keep);
+			if (shortfalls.length === 0) {
+				waiting.shift();
+				ledgerTake(ledger, head.budget);
+				holdingNothing.delete(head.ticket.id);
+				head.grant();
+				continue;
+			}
+			if (open.size > holdingNothing.size) return;
+			waiting.shift();
+			head.refuse(new ReservationWaitRefused(shortfalls));
+		}
+	}
+	/** Admit `b` to wait: it holds nothing until settlements return enough, in the order asked. */
+	function admitToWait(b, holder, keep) {
+		const id = nextTicketId++;
+		open.set(id, holder);
+		const ticket = ticketFor(id, b);
+		let grant;
+		let refuse;
+		const granted = new Promise((resolve, reject) => {
+			grant = resolve;
+			refuse = reject;
+		});
+		granted.catch(() => void 0);
+		holdingNothing.add(id);
+		waiting.push({
+			ticket,
+			budget: b,
+			keep,
+			grant,
+			refuse
+		});
+		return {
+			ok: true,
+			ticket,
+			granted
+		};
+	}
+	function reserve(b, holder = { stage: "admitted" }, options = {}) {
+		assertValidBudget(b, "reservation budget");
+		assertResourceDeclarations(ledger, b);
+		const wantUsd = b.maxUsd ?? 0;
+		const keep = options.keep;
+		const shortfalls = ledgerShortfalls(ledger, b, keep);
+		if (shortfalls.length === 0 && wantUsd > 0 && !ledger.usdCapped) return {
+			ok: false,
+			reason: "usd-unbudgeted"
+		};
+		const queueAhead = options.wait === true && waiting.length > 0;
+		if (shortfalls.length === 0 && !queueAhead) {
+			ledgerTake(ledger, b);
+			const id = nextTicketId++;
+			open.set(id, holder);
+			return {
+				ok: true,
+				ticket: ticketFor(id, b)
+			};
+		}
+		if (options.wait !== true || !fitsAfterRefunds(shortfalls)) return {
+			ok: false,
+			reason: "budget-exhausted",
+			shortfalls
+		};
+		return admitToWait(b, holder, keep);
+	}
+	function attribute(ticket, holder) {
+		const current = open.get(ticket.id);
+		if (current === void 0) return;
+		open.set(ticket.id, {
+			...current,
+			...holder
+		});
+	}
+	function reconcile(ticket, spent) {
+		if (!open.has(ticket.id)) throw new Error(`budget pool: reconcile of unknown or already-settled ticket ${ticket.id}`);
+		assertValidSpend(spent, `budget pool ticket ${ticket.id} spend`);
+		ledgerValidateUnits(ledger, spent);
+		const heldNothing = holdingNothing.delete(ticket.id);
+		if (heldNothing) {
+			const index = waiting.findIndex((entry) => entry.ticket.id === ticket.id);
+			if (index >= 0) waiting.splice(index, 1);
+		}
+		const held = heldNothing ? {
+			tokens: 0,
+			usd: 0,
+			iterations: 0,
+			resources: void 0
+		} : ticket.reserved;
+		const usdBudgeted = ticket.reserved.usdBudgeted !== false;
+		const { overspent, unknownUnderCap } = ledgerClassifyOverspend(ledger, held, usdBudgeted, spent);
+		let fault = unknownUnderCap ? `ticket ${ticket.id} reported unknown dollar cost under a dollar-capped budget` : void 0;
+		open.delete(ticket.id);
+		const resourceSettlement = ledgerSettle(ledger, held, spent, unknownUnderCap);
+		fault ??= resourceSettlement.fault;
+		overspent.push(...resourceSettlement.overspent);
+		grantWaiting();
+		const violation = overspent.length === 0 ? void 0 : Object.freeze({ overspent: Object.freeze(overspent.map((entry) => Object.freeze(entry))) });
+		if (fault !== void 0) throw new BudgetReconcileFault(`budget pool: ${fault}`, violation);
+		return violation;
+	}
+	function observe(spend, options = {}) {
+		assertValidSpend(spend, "observed spend");
+		ledgerValidateUnits(ledger, spend);
+		const unknownUnderCap = ledger.usdCapped && spend.usdKnown === false;
+		if (unknownUnderCap && options.alreadySpent !== true) throw new ValidationError("budget pool: cannot observe unknown dollar cost under a dollar-capped budget");
+		const settlement = ledgerObserve(ledger, spend, unknownUnderCap, !options.partial);
+		const violation = settlement.fault ?? settlement.rootExceeded;
+		if (violation) throw new ValidationError(`budget pool: ${violation}`);
+	}
+	function readout() {
+		return {
+			...ledger.resources.size ? { resources: Object.fromEntries([...ledger.resources].map(([name, value]) => [name, { ...value }])) } : {},
+			tokensLeft: ledger.freeTokens,
+			tokensKnown: !ledger.tokensTainted,
+			cacheBreakdownKnown: !ledger.cacheBreakdownTainted,
+			usdLeft: ledger.usdCapped ? ledger.usdTainted ? 0 : ledger.freeUsd : 0,
+			usdCapped: ledger.usdCapped,
+			usdKnown: ledger.usdMeasured && !ledger.usdTainted,
+			iterationsLeft: ledger.freeIterations,
+			deadlineMs: ledger.absoluteDeadlineMs,
+			reservedTokens: ledger.reservedTokens
+		};
+	}
+	function openReservations() {
+		return [...open].map(([ticketId, holder]) => Object.freeze({
+			ticketId,
+			...holder
+		}));
+	}
+	function assertNoOpenTickets() {
+		if (open.size > 0) throw new Error(`budget pool: ${open.size} reservation(s) still open at join barrier (${openReservations().map(describeLeakedReservation).join("; ")}) — conserved-pool invariant violated`);
+	}
+	ledgerRestore(ledger, root, restore);
+	return {
+		reserve,
+		attribute,
+		reconcile,
+		spendFrom: foldUsage,
+		readout,
+		observe,
+		assertNoOpenTickets,
+		openReservations
+	};
+}
+/** A reservation must name a limit for exactly the resources the root declared, in its units. */
+function assertResourceDeclarations(ledger, b) {
+	for (const [name, state] of ledger.resources) {
+		const wanted = b.resources?.[name];
+		if (!wanted) throw new ValidationError(`resource ${name}: child must declare its limit`);
+		if (wanted.unit !== state.unit) throw new ValidationError(`resource ${name}: unit mismatch`);
+	}
+	for (const name of Object.keys(b.resources ?? {})) if (!ledger.resources.has(name)) throw new ValidationError(`resource ${name}: root must declare its limit`);
+}
+/** Whether every short channel would fit once the open reservations return what they hold. */
+function fitsAfterRefunds(shortfalls) {
+	return shortfalls.every((shortfall) => shortfall.closedByUnknownSpend !== true && shortfall.requested <= shortfall.free + (shortfall.held ?? 0));
+}
+function ticketFor(id, b) {
+	return {
+		id,
+		reserved: {
+			...b.resources === void 0 ? {} : { resources: Object.fromEntries(Object.entries(b.resources).map(([name, value]) => [name, { ...value }])) },
+			tokens: b.maxTokens,
+			usd: b.maxUsd ?? 0,
+			iterations: b.maxIterations,
+			usdBudgeted: b.maxUsd !== void 0
+		}
+	};
+}
+/** Name one leaked reservation by its holder. */
+function describeLeakedReservation(leak) {
+	const parts = [`ticket ${leak.ticketId}`];
+	if (leak.childId !== void 0) parts.push(`child ${leak.childId}`);
+	if (leak.label !== void 0) parts.push(`label ${leak.label}`);
+	if (leak.assignment !== void 0) parts.push(`assignment ${leak.assignment}`);
+	parts.push(`stage ${leak.stage}`);
+	return parts.join(", ");
+}
+// src/redact.ts
+/**
+* Redaction for values that may leave the Runtime process. The built-in
+* redactor is agent-eval's redaction core (`@tangle-network/agent-eval/traces`,
+* default profile): credentials found by field name or value shape are
+* replaced whole, email, card, SSN and phone values in place, and token counts
+* such as `inputTokens` or `max_tokens` are kept. A customer with
+* domain-specific PII supplies their own `redact` hook.
+*
+* This is narrower than `src/sanitize.ts`, which drops fields of the runtime's
+* *event envelope* unless the caller opts in: here the value is opaque customer
+* payload, so the scrub is value-shaped, not schema-shaped.
+*
+* @experimental
+*/
+/**
+* The built-in redactor. Cycle-safe, depth-bounded and total: it never throws
+* on customer input and never mutates it.
+*/
+function defaultRedactor(value) {
+	return redact(value).value;
+}
+/** Stable identity input for saved work that depends on built-in redaction behavior. */
+function defaultRedactorIdentityMaterial() {
+	return {
+		core: "@tangle-network/agent-eval/traces redact",
+		profile: "default",
+		version: REDACTION_VERSION
+	};
+}
+/**
+* Resolve the redactor a client uses. A caller-supplied hook handles
+* domain-specific values first, then the built-in scrubber still removes
+* credentials and personal data. Returning `false` is the explicit opt-out for
+* already-reviewed public values.
+*/
+function resolveRedactor(redact) {
+	if (redact === false) return (value) => value;
+	if (!redact) return defaultRedactor;
+	return (value) => defaultRedactor(redact(value));
+}
+// src/runtime/supervise/error-message.ts
+const maxCauseDepth = 4;
+const maxMessageLength = 32768;
+const maxPartLength = 2048;
+/** A persisted failure must explain its wrappers without exporting credentials or unbounded data. */
+function errorText(value) {
+	let text;
+	try {
+		text = typeof value === "string" ? value : JSON.stringify(value) ?? String(value);
+	} catch {
+		text = "[unprintable rejection]";
+	}
+	return String(defaultRedactor(text)).slice(0, maxMessageLength);
+}
+function errorProperty(error, field) {
+	try {
+		const value = error[field];
+		return value === void 0 ? void 0 : errorText(value).slice(0, field === "name" ? 256 : maxMessageLength);
+	} catch {
+		return `[unreadable error ${field}]`;
+	}
+}
+/** An HTTP status carried on a thrown error, read without trusting its getter. Provider SDKs put
+*  one on their own error classes, so this is how a refusal is recognised outside the transport
+*  taxonomy — for the persisted message here, and for the driver's retry verdict. */
+function errorHttpStatus(error) {
+	try {
+		const status = Reflect.get(error, "status");
+		return typeof status === "number" && Number.isInteger(status) && status >= 100 && status <= 599 ? status : void 0;
+	} catch {
+		return;
+	}
+}
+/** Shared by child settlements, driver attempts, and the final no-winner result. */
+function errMessage(error) {
+	const parts = [];
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	for (let depth = 0; depth <= maxCauseDepth; depth += 1) try {
+		if (!(current instanceof Error)) {
+			parts.push(errorText(current).slice(0, maxPartLength));
+			break;
+		}
+		if (seen.has(current)) {
+			parts.push("[circular]");
+			break;
+		}
+		seen.add(current);
+		const status = errorHttpStatus(current);
+		const message = (status === void 0 ? "" : `HTTP ${status}: `) + (errorProperty(current, "message") ?? "");
+		parts.push((depth === 0 ? message : `${errorProperty(current, "name")}: ${message}`).slice(0, maxPartLength));
+		current = current.cause;
+		if (current === void 0 || current === null) break;
+		if (depth === maxCauseDepth) parts.push("[cause chain truncated]");
+	} catch {
+		parts.push("[unreadable error cause]");
+		break;
+	}
+	return parts.join(": caused by ").slice(0, maxMessageLength);
+}
+/** The error and its causes (`cause`, and `errors` members), bounded and cycle-safe. */
+function causeChain(error) {
+	const chain = [];
+	const queue = [error];
+	while (queue.length > 0 && chain.length < 12) {
+		const value = queue.shift();
+		if (typeof value !== "object" || value === null || chain.includes(value)) continue;
+		chain.push(value);
+		try {
+			const errors = Reflect.get(value, "errors");
+			if (Array.isArray(errors)) queue.push(...errors);
+			queue.push(Reflect.get(value, "cause"));
+		} catch {}
+	}
+	return chain;
+}
+// src/runtime/supervise/credential-refusal.ts
+/**
+* The account owner refused an unsupported credential route before dispatch. This is the
+* provider SDK's machine contract, not an HTTP status, class-name guess, or prose match.
+*/
+function isCredentialRefusal(error) {
+	if (!(error instanceof Error)) return false;
+	try {
+		return Object.getOwnPropertyDescriptor(error, "code")?.value === "model_credential_refused";
+	} catch {
+		return false;
+	}
+}
+/**
+* The message prefix of agent-provider-tangle's generic credential command failure. The provider
+* exports no type or constant for it, so the kernel credential test raises it through the
+* provider's own command resolver and fails when the message drifts.
+*/
+const CREDENTIAL_COMMAND_FAILURE = "Tangle credential command failed (";
+/**
+* The exit code of agent-provider-tangle's credential command (`acct sandbox resolve`) in the
+* error or its causes, or undefined.
+*
+* The provider reports the command's generic failure as `Tangle credential command failed
+* (exit N)` with the process's `exitCode` and `terminationSignal` as own fields; a refusal it can
+* parse (exit 75 or 78) arrives typed instead and is classified on its code. Before any dispatch
+* this failure ran nothing, and counting it as an unresolved pending invocation stopped 10 nodes
+* and lost 7 runs between 2026-10-12 and 2026-10-19 (test-acceptance-canary-20261015c met 26 in
+* 2.2 minutes). It pauses like a capacity refusal, bounded by the deadline, the budget and
+* cancellation as every pause is.
+*/
+function credentialCommandExit(error) {
+	for (const link of causeChain(error)) try {
+		if (!(link instanceof Error) || !link.message.startsWith(CREDENTIAL_COMMAND_FAILURE) || !Object.hasOwn(link, "terminationSignal")) continue;
+		const exitCode = Reflect.get(link, "exitCode");
+		if (typeof exitCode === "number" && Number.isInteger(exitCode) && exitCode > 0) return exitCode;
+	} catch {}
+}
+// src/runtime/json-content-hash.ts
+/**
+* Stable hash for the trace payload. Not cryptographic — only used so
+* downstream eval pipelines can group iterations whose task / output is the
+* same. Bare structural hash; non-JSON values stringify via their `toString`.
+*/
+function hashJson(value) {
+	const str = jsonContentText(value);
+	return fnv1a32Hex(str);
+}
+/** JSON text with String fallback, including quoted JSON strings and cyclic values. */
+function jsonContentText(value) {
+	let str;
+	try {
+		str = JSON.stringify(value) ?? String(value);
+	} catch {
+		str = String(value);
+	}
+	return str;
+}
+// src/runtime/supervise/executor-outcome.ts
+const outcomeSchema = AgentTurnResultSchema.pick({
+	success: true,
+	error: true
+}).extend({
+	errorCode: AgentTurnResultSchema.shape.error,
+	statusCode: z.number().int().min(400).max(599).optional()
+}).strict();
+/** Read only the executor envelope; application output and grades are not execution status. */
+function executorFailure(result) {
+	if (result.outcome === void 0) return void 0;
+	const outcome = outcomeSchema.parse(result.outcome);
+	if (outcome.success) return void 0;
+	return {
+		error: outcome.error ?? "Agent execution failed",
+		...outcome.errorCode === void 0 ? {} : { errorCode: outcome.errorCode },
+		...outcome.statusCode === void 0 ? {} : { statusCode: outcome.statusCode }
+	};
+}
+/** The failure text alone, for callers that record a settlement reason. */
+function executorFailureReason(result) {
+	return executorFailure(result)?.error;
+}
+/**
+* The platform's own failure vocabulary: machine codes and lifecycle messages that the sandbox
+* runtime, the router, or the egress path put in an executor envelope when the platform, not
+* the agent's work, ended the execution. Each entry names its evidence: the count is how many
+* down children carried it on the 2026-09-20 fleet corpus (277 down settlements across 691
+* runs), every one of them stamped `infra: false` by the hard-coded call site this table
+* replaced. The table is deliberately the platform's fixed strings, not the agent's prose.
+*/
+const PLATFORM_FAILURE_CODES = new Set([
+	"QUOTA_EXCEEDED",
+	"provider_quota_exceeded",
+	"provider_quota_exhausted",
+	"buffer.overflow",
+	"TIMEOUT",
+	"ECONNRESET",
+	"ECONNREFUSED",
+	"ETIMEDOUT",
+	"EPIPE",
+	"EADDRINUSE"
+].map((code) => code.toLowerCase()));
+const PLATFORM_FAILURE_MESSAGES = [
+	/^terminated$/u,
+	/Execution exceeded its time limit/u,
+	/Execution interrupted: the agent runtime restarted/u,
+	/Platform key[- ]verification/u,
+	/Platform key delegation failed/u,
+	/Bad Gateway/iu,
+	/Cannot connect to API/u,
+	/Failed to connect to Sandbox API/u,
+	/fetch failed/u,
+	/A sandbox lifecycle operation is already in progress/u,
+	/exceeded its string bound/u,
+	/exceeds its JSON bound/u,
+	/No provider served model/u,
+	/Invalid API key/u,
+	/provider_quota_exceeded|provider_quota_exhausted|QUOTA_EXCEEDED|rate limit/iu,
+	/is at its box cap/u,
+	/could not materialize the seat credential/u,
+	/OpenCode exited while a model step was still in progress/u,
+	/the agent runtime restarted/u
+];
+/**
+* Whether an executor envelope's failure was the platform's, as far as the envelope can say.
+*
+* `true` when the code or the message is in the platform's own vocabulary above. `undefined`
+* otherwise: the harness reported a failure and nothing in the envelope attributes it, so the
+* settlement carries no `infra` claim at all rather than a false one. This path never answers
+* `false`, because an executor envelope cannot prove the agent's work was at fault; the throw
+* path in `scope.ts` still answers `false` for an ordinary thrown result, where the runtime does
+* know. Until this function existed both envelope sites stamped `infra: false` unconditionally,
+* and the flag caught 1 of the 78 platform losses it was checked against on the fleet corpus.
+*/
+function executorFailureInfra(failure) {
+	const code = failure.errorCode?.toLowerCase();
+	if (code !== void 0 && PLATFORM_FAILURE_CODES.has(code)) return true;
+	return PLATFORM_FAILURE_MESSAGES.some((pattern) => pattern.test(failure.error)) ? true : void 0;
+}
+/** Preserve deterministic result pointers across built-in executors and replay.
+* FNV-1a is an identity convention here, not a cryptographic integrity check. */
+function contentRef(prefix, value) {
+	const str = jsonContentText(value);
+	return `${prefix}:${fnv1a32Hex(str)}`;
+}
+// src/durable/content-address.ts
+/** Stable content address shared by result and trace artifacts. */
+function contentAddress(artifact) {
+	return `sha256:${createHash("sha256").update(stableStringify(artifact), "utf-8").digest("hex")}`;
+}
+function stableStringify(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(",")}}`;
+}
+// src/runtime/supervise/snapshot.ts
+/** Deeply detach and freeze untrusted data at a runtime decision boundary. The clone prevents the
+* caller from mutating it later; the freeze prevents downstream code from mutating the snapshot.
+* Strings are immutable, so the snapshot shares the caller's strings instead of copying them. */
+function detachedSnapshot(value, context) {
+	let clone;
+	try {
+		clone = structuredClone(value);
+	} catch (error) {
+		throw new ValidationError(`${context}: input must be structured-cloneable`, { cause: error });
+	}
+	return deepFreeze(shareSourceStrings(value, clone));
+}
+/** Detach a value from its caller and freeze it, without the `ValidationError` framing
+*  {@link detachedSnapshot} adds. For a boundary that has already validated its input. */
+function detachedFrozen(value) {
+	return deepFreeze(shareSourceStrings(value, structuredClone(value)));
+}
+/**
+* Point each string in a fresh structured clone at the equal string in its source.
+*
+* `structuredClone` copies every string, and a copied string buys no isolation: only objects and
+* arrays can change through a shared reference. A spawned profile passes several boundaries, and
+* each one kept its own copy: in a reproduction of Discovery's hosted coordinator, a child profile
+* that mounts a 5.3 MB file packet was held four times per spawned child. A scope keeps every
+* child it spawned, so the heap grew about 22 MB per spawn, and hosted coordinators died with V8
+* heap OOM after 37 spawns.
+*
+* The walk pairs only own data properties of plain objects and arrays. Accessors, Maps, Sets and
+* other cloned types keep the clone's values. A string is replaced only by a string equal to it,
+* so the snapshot holds exactly the clone's value. The snapshot keeps the source's strings alive.
+*/
+function shareSourceStrings(source, clone) {
+	const visited = /* @__PURE__ */ new Set();
+	const visit = (from, to) => {
+		if (from === null || to === null || typeof from !== "object" || typeof to !== "object") return;
+		const array = Array.isArray(to);
+		if (array !== Array.isArray(from)) return;
+		if (!array && Object.getPrototypeOf(to) !== Object.prototype) return;
+		if (visited.has(to)) return;
+		visited.add(to);
+		const target = to;
+		for (const key of Object.keys(target)) {
+			const own = Object.getOwnPropertyDescriptor(from, key);
+			if (own === void 0 || !("value" in own)) continue;
+			const cloned = target[key];
+			if (typeof cloned === "string") {
+				if (own.value === cloned) target[key] = own.value;
+			} else visit(own.value, cloned);
+		}
+	};
+	visit(source, clone);
+	return clone;
+}
+/**
+* Replace each string in a freshly parsed JSON value with an equal string already in `pool`, and
+* add the new ones. One recovery pass parses every interrupted child's profile from its own blob,
+* so children that carry the same file packet would otherwise hold one copy each. The value is
+* updated in place, so it must belong to the caller; frozen objects are left as they are.
+*/
+function shareParsedStrings(value, pool) {
+	const visit = (node) => {
+		if (node === null || typeof node !== "object" || Object.isFrozen(node)) return;
+		if (!Array.isArray(node) && Object.getPrototypeOf(node) !== Object.prototype) return;
+		const target = node;
+		for (const key of Object.keys(target)) {
+			const item = target[key];
+			if (typeof item !== "string") {
+				visit(item);
+				continue;
+			}
+			const shared = pool.get(item);
+			if (shared === void 0) pool.set(item, item);
+			else target[key] = shared;
+		}
+	};
+	visit(value);
+	return value;
+}
+function deepFreeze(value, seen = /* @__PURE__ */ new Set()) {
+	if (value === null || typeof value !== "object" || ArrayBuffer.isView(value) || seen.has(value)) return value;
+	seen.add(value);
+	for (const child of Object.values(value)) deepFreeze(child, seen);
+	return Object.freeze(value);
+}
+// src/runtime/supervise/trace-root.ts
+/**
+* Trace roots: one Merkle root over the events a turn archived, so a single event can be proven
+* against the hash its journal record carries without reading the rest of the archive.
+*
+* The leaves are the archived events in stored order, each hashed with its own random salt, then
+* one summary leaf that counts the events and the tool calls among them. The artifact keeps every
+* leaf and salt and is stored under its content address in the run's result blob store, beside
+* the archive it commits to. A verifier recomputes leaf `i` from `events[i]` of the `outRef` blob
+* and `salts[i]`, checks it against `leaves[i]`, and checks `merkleRoot(leaves)` against the root
+* the journal recorded. Leaf identity is `(outRef, index)`: an event's own `id` is a session
+* buffer offset and is absent on terminal events.
+*
+* One event array has one root per node. A result always gets its own. Evidence whose events the
+* node already rooted gets none: a retained owner's deferred workspace capture stores the turn it
+* just committed again, with the workspace fields added, under another `outRef`. A second root
+* over the same events would give one turn two count candidates and two run-root leaves.
+*
+* Salts are random, so a trace root can never be recomputed from the archive alone. Recovery and
+* replay copy the recorded receipt; they never derive a new one.
+*/
+/** Schema identifier of a stored {@link TraceRootArtifact}. */
+const TRACE_ROOT_SCHEMA = "agent-runtime.trace-root.v1";
+/** Schema identifier of the {@link TraceSummary} carried by a trace root's last leaf. */
+const TRACE_SUMMARY_SCHEMA = "agent-runtime.trace-summary.v1";
+/** @internal */
+function traceRootWriter(blobs, nodeId) {
+	const roots = /* @__PURE__ */ new Map();
+	/** Digests of the event arrays this node holds a stored root for. */
+	const rooted = /* @__PURE__ */ new Set();
+	const persist = async (outRef, out, evidence) => {
+		const events = archivedEvents(out);
+		if (events === void 0) return void 0;
+		if (evidence) {
+			await Promise.allSettled([...roots.values()]);
+			if (rooted.has(await eventsDigest(events))) return void 0;
+		}
+		const stored = await persistTraceRoot(blobs, nodeId, outRef, events);
+		if (stored === void 0) return void 0;
+		rooted.add(stored.digest);
+		return stored.receipt;
+	};
+	const memoized = (outRef, out, evidence) => {
+		const known = roots.get(outRef);
+		if (known !== void 0) return known;
+		const pending = persist(outRef, out, evidence);
+		roots.set(outRef, pending);
+		pending.catch(() => roots.delete(outRef));
+		return pending;
+	};
+	return {
+		write: (outRef, out) => memoized(outRef, out, false),
+		writeEvidence: (outRef, out) => memoized(outRef, out, true),
+		async recorded(outRef) {
+			if (outRef === void 0) return void 0;
+			return roots.get(outRef)?.catch(() => void 0);
+		}
+	};
+}
+async function persistTraceRoot(blobs, nodeId, outRef, events) {
+	let built;
+	try {
+		built = await traceRootArtifact(nodeId, outRef, events);
+	} catch (error) {
+		if (error instanceof LedgerCanonicalizationError) return void 0;
+		throw error;
+	}
+	const { artifact, digest } = built;
+	await nextTurn();
+	const ref = contentAddress(artifact);
+	await nextTurn();
+	await blobs.put(ref, artifact);
+	return {
+		receipt: {
+			root: artifact.root,
+			ref,
+			leafCount: artifact.leafCount
+		},
+		digest
+	};
+}
+function archivedEvents(out) {
+	if (out === null || typeof out !== "object" || Array.isArray(out)) return void 0;
+	const events = out.events;
+	return Array.isArray(events) ? events : void 0;
+}
+/** The longest stretch of hashing between yields to the event loop. Hashing runs about 40 µs per
+*  event, and the largest archived turn holds 65,276 events: unbroken, that blocked the process
+*  for 2.7 s while sibling turns, coordination calls and heartbeats waited. A slice is measured
+*  in time, not events, because one event can be megabytes. */
+const SLICE_MS = 10;
+/** Yields to the event loop once a slice has run `SLICE_MS`; `undefined` while it has not. */
+function slicer() {
+	let started = performance.now();
+	return () => {
+		if (performance.now() - started < SLICE_MS) return void 0;
+		return nextTurn().then(() => {
+			started = performance.now();
+		});
+	};
+}
+function nextTurn() {
+	return new Promise((resolve) => setImmediate(resolve));
+}
+/** The identity of an event array as stored: the digest of each event's stored JSON, in order.
+*  Two arrays with one digest have the same leaves' content. */
+async function eventsDigest(events) {
+	const hash = createHash("sha256");
+	const slice = slicer();
+	for (const event of events) {
+		const yielded = slice();
+		if (yielded !== void 0) await yielded;
+		hash.update(storedText(event)).update("\n");
+	}
+	return hash.digest("hex");
+}
+async function traceRootArtifact(nodeId, outRef, archived) {
+	const salts = [];
+	const leaves = [];
+	const tree = merkleTree();
+	const identity = createHash("sha256");
+	const tools = createSandboxToolPartState();
+	const toolCalls = /* @__PURE__ */ new Map();
+	const slice = slicer();
+	for (const event of archived) {
+		const yielded = slice();
+		if (yielded !== void 0) await yielded;
+		const text = storedText(event);
+		identity.update(text).update("\n");
+		const stored = JSON.parse(text);
+		const salt = merkleSalt();
+		const leaf = merkleLeafHash(canonicalString(jsonDocument(stored)), salt);
+		salts.push(salt);
+		leaves.push(leaf);
+		tree.push(leaf);
+		for (const projected of mapSandboxToolEvent(stored, tools)) {
+			if (projected.type !== "tool_call") continue;
+			toolCalls.set(projected.toolName, (toolCalls.get(projected.toolName) ?? 0) + 1);
+		}
+	}
+	const summary = {
+		schema: TRACE_SUMMARY_SCHEMA,
+		events: archived.length,
+		toolCalls: Object.fromEntries(toolCalls)
+	};
+	const salt = merkleSalt();
+	const leaf = merkleLeafHash(canonicalString(summary), salt);
+	salts.push(salt);
+	leaves.push(leaf);
+	tree.push(leaf);
+	return {
+		artifact: {
+			schema: TRACE_ROOT_SCHEMA,
+			nodeId,
+			outRef,
+			root: tree.root(),
+			leafCount: leaves.length,
+			salts,
+			leaves,
+			summary
+		},
+		digest: identity.digest("hex")
+	};
+}
+/**
+* `merkleRoot(leaves)` built as the leaves arrive, so its interior hashes run inside the sliced
+* leaf loop instead of in one block after it (0.4 s for 65,277 leaves). It keeps the perfect
+* subtrees of RFC 9162, largest first, and joins two with ledger-core's own interior hash,
+* `merkleRoot([left, right])`; the root folds them from the right, as RFC 9162 splits at the
+* largest power of two.
+*/
+function merkleTree() {
+	const peaks = [];
+	return {
+		push(leaf) {
+			let hash = leaf;
+			let size = 1;
+			while (peaks.at(-1)?.size === size) {
+				hash = merkleRoot([peaks.pop().hash, hash]);
+				size *= 2;
+			}
+			peaks.push({
+				hash,
+				size
+			});
+		},
+		root() {
+			let root = peaks.at(-1).hash;
+			for (let index = peaks.length - 2; index >= 0; index -= 1) root = merkleRoot([peaks[index].hash, root]);
+			return root;
+		}
+	};
+}
+/** One array item as `JSON.stringify` writes it: `JSON.parse` of it is what `events[i]` holds. */
+function storedText(event) {
+	return JSON.stringify(event) ?? "null";
+}
+// src/runtime/supervise/upstream-unavailable.ts
+/**
+* An upstream that cannot serve NOW: how Runtime recognizes one, and how long an agent waits for it.
+*
+* A model provider's exhausted quota, a rate limit, an overload, or the router's own refused
+* credential is not a fault in the agent: the same request succeeds when capacity returns. A
+* driver that meets one re-enters after a pause (`runDriverWithRetry`), and a leaf continues in
+* its environment after the same pause (`providerAsExecutor`). Both read the refusal and the pause
+* from here, so an outage costs a director and its workers the same number of turns.
+*
+* This module imports nothing, so the provider executor can read it without the error classes of
+* `../../errors`.
+*/
+/**
+* Machine codes that say the upstream cannot serve now rather than that the request is wrong.
+* Each is a code an upstream publishes, not prose: the router's
+* (`lib/model-substitution.ts`, `lib/upstream-error-triage.ts`) and the OpenAI- and Anthropic-shaped
+* error types a relayed body carries.
+*/
+const UNAVAILABLE_CODES = /* @__PURE__ */ new Set([
+	"provider_quota_exhausted",
+	"provider_quota_exceeded",
+	"provider_rate_limit",
+	"upstream_unavailable",
+	"provider_key_invalid",
+	"rate_limit_exceeded",
+	"rate_limit_error",
+	"overloaded_error"
+]);
+/** 429 Too Many Requests, 503 Service Unavailable, and 529, which Anthropic uses for overload. */
+const UNAVAILABLE_STATUSES = /* @__PURE__ */ new Set([
+	429,
+	503,
+	529
+]);
+/**
+* A harness that flattens the router's JSON body into its own failure text leaves the router's
+* code in that text: `opencode execution failed: No provider served model "..."
+* (provider_quota_exhausted)`. The code is matched as a whole token, and a status only in the
+* `status code <n>` framing a harness prints, so prose that merely mentions a quota does not match.
+*/
+function unavailableSignalInText(text) {
+	for (const token of text.toLowerCase().matchAll(/[a-z_]+/gu)) if (UNAVAILABLE_CODES.has(token[0])) return token[0];
+	const status = text.match(/\bstatus code (\d{3})\b/u)?.[1];
+	return status !== void 0 && UNAVAILABLE_STATUSES.has(Number(status)) ? `http-${status}` : void 0;
+}
+/**
+* The code or status that marks a failed turn outcome as an upstream capacity refusal, or
+* `undefined`. The outcome's own `errorCode` decides first; the failure text is read only when no
+* code or numeric status decided, because a harness CLI can report the router's refusal as text.
+*/
+function unavailableSignalOfFailure(failure) {
+	const code = failure.errorCode?.toLowerCase();
+	if (code !== void 0 && UNAVAILABLE_CODES.has(code)) return code;
+	if (failure.statusCode !== void 0) return UNAVAILABLE_STATUSES.has(failure.statusCode) ? `http-${failure.statusCode}` : void 0;
+	return unavailableSignalInText(failure.error);
+}
+const DEFAULT_UNAVAILABLE_PAUSE_MS = 15e3;
+const DEFAULT_MAX_UNAVAILABLE_PAUSE_MS = 3e5;
+/**
+* The pause after the `consecutive`-th refusal in a row (1-based): the first pause, doubled per
+* earlier refusal, up to the ceiling. The one rule for a driver that re-enters and a leaf that
+* continues in its environment, so an outage costs both the same number of turns.
+*/
+function unavailablePauseMs(consecutive, policy = {}) {
+	return cappedDoublingMs(consecutive, policy.unavailablePauseMs ?? DEFAULT_UNAVAILABLE_PAUSE_MS, policy.maxUnavailablePauseMs ?? DEFAULT_MAX_UNAVAILABLE_PAUSE_MS);
+}
+/** `first` doubled per earlier consecutive wait (`consecutive` is 1-based), up to `ceiling`. */
+function cappedDoublingMs(consecutive, first, ceiling) {
+	const start = Math.max(0, first);
+	return Math.min(Math.max(start, ceiling), start * 2 ** Math.max(0, consecutive - 1));
+}
+/** The longest hold a refusal's own reset time may ask for: a 5-hour plan window plus a margin. */
+const MAX_RESET_HOLD_MS = 216e5;
+/** How often a refusal whose reset is beyond {@link MAX_RESET_HOLD_MS} is probed again. */
+const FAR_RESET_PROBE_MS = 36e5;
+/**
+* When a refusal says its quota resets, as epoch ms, or `undefined` when it names no usable time.
+* The Z.ai Coding Plan's opencode refusal names one in Beijing time with no zone:
+* `Usage limit reached for 5 hour. Your limit will reset at 2026-10-18 15:17:33`. On Discovery run
+* magnetar-rust-20261018b, 219 of 324 driver attempts ended on it between 06:04Z and 22:18Z, and
+* the last refusal came at 22:18Z against `reset at 2026-10-19 06:18:14`, which is 22:18:14Z at
+* +08:00. A time with its own zone is read as written. A time in the past is no reset time: the
+* caller keeps its doubling pause. A time more than MAX_RESET_HOLD_MS ahead is held for only
+* FAR_RESET_PROBE_MS at a time, so a misread zone cannot hold a seat for a day, yet the spent seat
+* is not asked again every 5 minutes: on magnetar-rust-20261019c a reset beyond 6 h drew about 12
+* attempts an hour against the refusing seat.
+*/
+function unavailableResumeAt(text, nowMs) {
+	const match = text.match(/\breset at (\d{4}-\d{2}-\d{2})[ T](\d{2}:\d{2}:\d{2})(?:\.\d+)?(Z|[+-]\d{2}:?\d{2})?/u);
+	if (match === null) return void 0;
+	const zone = match[3] ?? (/Usage limit reached for \d+ hour/u.test(text) ? "+08:00" : void 0);
+	if (zone === void 0) return void 0;
+	const at = Date.parse(`${match[1]}T${match[2]}${zone.length === 5 ? `${zone.slice(0, 3)}:${zone.slice(3)}` : zone}`);
+	if (!Number.isFinite(at) || at <= nowMs) return void 0;
+	return at - nowMs > MAX_RESET_HOLD_MS ? nowMs + FAR_RESET_PROBE_MS : at;
+}
+/**
+* Spread a wait over `[ms / 2, ms]`. Every driver a Platform restart cut off fails within the same
+* seconds; without jitter their doubling schedules stay aligned and they all re-enter together
+* when the service returns. `random` returns a value in `[0, 1)`; 0 keeps the full wait.
+*/
+function jitteredMs(ms, random) {
+	return ms - Math.floor(ms / 2 * Math.min(1, Math.max(0, random())));
+}
+// src/runtime/supervise/retained-executor.ts
+/** Scope owns the durable writer; provider executors only publish sanitized admissions. */
+const retainedExecutorSeamKey = "runtime.retainedExecutor";
+/** @internal A capture may finish after cancellation; its durable citation remains appendable. */
+function executorEvidenceWriter(args) {
+	const traceRoots = args.traceRoots ?? traceRootWriter(args.blobs, args.nodeId);
+	return async (out) => {
+		const snapshot = detachedSnapshot(out, "executor evidence");
+		const outRef = contentAddress(snapshot);
+		await args.blobs.put(outRef, snapshot);
+		const traceRoot = await traceRoots.writeEvidence(outRef, snapshot);
+		await args.journal.appendEvent(args.rootId, {
+			kind: "execution-evidence",
+			id: args.nodeId,
+			outRef,
+			...traceRoot === void 0 ? {} : { traceRoot },
+			seq: args.nextSequence(),
+			at: new Date(args.now()).toISOString()
+		});
+	};
+}
+/** @internal The journal writers for `onWorkspaceCapture` and `onWorkspaceCaptureStarted`;
+*  `nextSequence` is the node's own. */
+function workspaceCaptureWriter(args) {
+	return {
+		onWorkspaceCapture: async (capture) => {
+			await args.journal.appendEvent(args.rootId, {
+				kind: "workspace-capture",
+				id: args.nodeId,
+				...detachedSnapshot(capture, "workspace capture timing"),
+				seq: args.nextSequence(),
+				at: new Date(args.now()).toISOString()
+			});
+		},
+		onWorkspaceCaptureStarted: async (capture) => {
+			await args.journal.appendEvent(args.rootId, {
+				kind: "workspace-capture-started",
+				id: args.nodeId,
+				...detachedSnapshot(capture, "workspace capture start"),
+				seq: args.nextSequence(),
+				at: new Date(args.now()).toISOString()
+			});
+		}
+	};
+}
+function retainedExecutorContext(ctx) {
+	return ctx.seams[retainedExecutorSeamKey];
+}
+const causeMessages = {
+	unobservable: "retained provider execution requires reconciliation before replacement",
+	"provider-contract": "retained provider response violated its contract; original execution remains unresolved",
+	"request-rejected": "retained provider execution was refused before it ran; nothing to reconcile",
+	transport: "retained provider execution lost its transport; status in doubt",
+	"nested-recovery": "retained nested execution requires recovery before replacement"
+};
+/**
+* agent-provider-tangle's `TangleDispatchNotAdmittedError` (since 3.6.11): Sandbox answered a
+* dispatch with `dispatched: false` and named another execution that owns the session or turn.
+* Nothing ran for the request.
+*/
+const DISPATCH_NOT_ADMITTED_CODE = "DISPATCH_NOT_ADMITTED";
+/**
+* The Sandbox SDK's codes for a box that cannot be provisioned for this profile, sent with HTTP
+* 422 when the failure is deterministic: a profile file mount outside the box's writable roots,
+* refused before any box exists, and a profile-file materialization that would fail the same way
+* again. On Discovery run queens21-h22-capture-root-1-20261019c every child profile mounted
+* `/work/queens21_count.c` on a read-only root filesystem, and 154 attempts across 4 workers were
+* retried as a lost transport. The same codes at another status may be transient and are not
+* read here.
+*/
+const PROVISIONING_REFUSAL_CODES = /* @__PURE__ */ new Set(["PROFILE_FILE_MOUNT_OUTSIDE_ROOTS", "PROFILE_FILES_MATERIALIZE_FAILED"]);
+/** True for an error that is itself a deterministic provisioning refusal (see above). */
+function isProvisioningRefusal(value) {
+	try {
+		const code = readString(value, "code");
+		const status = readNumber(value, "status") ?? readNumber(value, "statusCode");
+		return code !== void 0 && status === 422 && PROVISIONING_REFUSAL_CODES.has(code);
+	} catch {
+		return false;
+	}
+}
+/** The contract-error codes that wrap a failed READ rather than name a broken answer. */
+const readFailureCodes = /* @__PURE__ */ new Set(["RETAINED_RESULT_READ_FAILED", "RETAINED_CONTROL_REF_READ_FAILED"]);
+/** Socket-level failures, by the codes Node and undici assign, plus the Sandbox SDK's own. */
+const TRANSPORT_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ECONNRESET",
+	"ECONNREFUSED",
+	"ETIMEDOUT",
+	"ENOTFOUND",
+	"EAI_AGAIN",
+	"EPIPE",
+	"UND_ERR_SOCKET",
+	"UND_ERR_CONNECT_TIMEOUT",
+	"UND_ERR_HEADERS_TIMEOUT",
+	"UND_ERR_BODY_TIMEOUT",
+	"NETWORK_ERROR"
+]);
+function readNumber(value, key) {
+	const read = Reflect.get(value, key);
+	return typeof read === "number" && Number.isFinite(read) ? read : void 0;
+}
+function readString(value, key) {
+	const read = Reflect.get(value, key);
+	return typeof read === "string" ? read : void 0;
+}
+const credentialAdmissionRefusals = /* @__PURE__ */ new WeakSet();
+/**
+* Walk the cause chain (bounded, cycle-safe) and name the first cause whose structure decides.
+*
+* `phase` says whether a 4xx or a client deadline can mean "refused before it ran": only at
+* admission. After admission the same status means the provider cannot resolve what it
+* admitted, and the honest name is the refusal.
+*/
+function classifyRetainedPendingCause(cause, phase = "execution") {
+	return classifyPendingCause(cause, phase);
+}
+function classifyPendingCause(cause, phase, onCredentialRefusal) {
+	const seen = /* @__PURE__ */ new Set();
+	const queue = [{
+		value: cause,
+		phase
+	}];
+	let steps = 0;
+	while (queue.length > 0 && steps < 12) {
+		steps += 1;
+		const { value, phase: at } = queue.shift();
+		if (typeof value !== "object" || value === null || seen.has(value)) continue;
+		seen.add(value);
+		if (value instanceof RetainedExecutionPendingError) {
+			if (credentialAdmissionRefusals.has(value)) {
+				if (at === "execution") return "unobservable";
+				onCredentialRefusal?.();
+			}
+			return value.pendingCause;
+		}
+		const name = readString(value, "name");
+		const code = readString(value, "code");
+		const status = readNumber(value, "status") ?? readNumber(value, "statusCode");
+		if (name === "RetainedRunProviderContractError") {
+			if (code === void 0 || !readFailureCodes.has(code)) return "provider-contract";
+			queue.unshift({
+				value: Reflect.get(value, "cause"),
+				phase: "execution"
+			});
+			continue;
+		}
+		if (name === "ZodError" || Array.isArray(Reflect.get(value, "issues")) || code === "JSON_BOUND_VIOLATION") return at === "admission" ? "request-rejected" : "provider-contract";
+		if (code === "DISPATCH_NOT_ADMITTED") return at === "admission" ? "request-rejected" : "provider-contract";
+		if (isProvisioningRefusal(value)) return "request-rejected";
+		if (isCredentialRefusal(value)) {
+			if (at === "execution") return "unobservable";
+			onCredentialRefusal?.();
+			return "request-rejected";
+		}
+		if (code !== void 0 && TRANSPORT_ERROR_CODES.has(code)) return "transport";
+		if (name === "NetworkError" || name === "ServerError") return "transport";
+		if (status === void 0 && at === "admission" && code !== void 0 && UNAVAILABLE_CODES.has(code.toLowerCase())) return "request-rejected";
+		if (status !== void 0) {
+			if (status >= 500) return "transport";
+			if (at === "admission" && status !== 408) return "request-rejected";
+			return "unobservable";
+		}
+		const errors = Reflect.get(value, "errors");
+		if (Array.isArray(errors)) for (const member of errors) queue.push({
+			value: member,
+			phase: at
+		});
+		queue.push({
+			value: Reflect.get(value, "cause"),
+			phase: at
+		});
+	}
+	return "unobservable";
+}
+/**
+* Local observation stopped; the retained provider execution has no accepted terminal result.
+*
+* The message names WHICH of the situations in {@link RetainedPendingCause} this is, and the
+* `pendingCause` field carries it as a value the settlement records, so a reader never splits
+* the population on the message's wording. The cause chain is kept for the `caused by` receipt.
+*/
+var RetainedExecutionPendingError = class extends Error {
+	pendingCause;
+	phase;
+	constructor(cause, pendingCause = "execution") {
+		let credentialRefused = false;
+		const resolved = pendingCause === "admission" || pendingCause === "execution" ? classifyPendingCause(cause, pendingCause, () => {
+			credentialRefused = true;
+		}) : pendingCause;
+		super(causeMessages[resolved], { cause });
+		this.name = "RetainedExecutionPendingError";
+		this.pendingCause = resolved;
+		this.phase = pendingCause === "admission" ? "admission" : "execution";
+		if (credentialRefused) credentialAdmissionRefusals.add(this);
+	}
+};
+/** The instruction a keyed continuation runs in the held session: the node's task is unchanged,
+*  and its conversation and workspace are where the budget stop left them. */
+const BUDGET_CONTINUATION_TASK = "Your previous turn reached its budget and stopped. Your manager gave you more budget to continue the same task in the same session: your conversation so far and the files in your workspace are where you left them. Continue from where you stopped. Do not start over.";
+/** The execution id of a leaf's later invocation, derived from its `execution-input` sequence so
+*  a recovery derives the same one. A first invocation keeps the node id. */
+function leafContinuationExecutionId(nodeId, inputSeq) {
+	return `${nodeId}:input:${inputSeq}`;
+}
+const retainedPreparations = /* @__PURE__ */ new WeakMap();
+/** Reconstruct an admitted worker through its original composition boundary. @internal */
+function registerRetainedExecutorPreparation(factory, prepare) {
+	retainedPreparations.set(factory, prepare);
+	return factory;
+}
+function prepareRetainedExecutor(factory, input) {
+	return retainedPreparations.get(factory)?.(input);
+}
+// src/runtime/failure-cause.ts
+const MAX_CAUSE_CHARS = 2048;
+const MAX_CHAIN_STEPS = 12;
+const MACHINE_CODE_PATTERN = /^[A-Za-z][A-Za-z0-9_.-]{0,63}$/u;
+/** @internal Canonical producer-supplied remediation, shared by transport and read models. */
+const runtimeFailureRemediationSchema = z.object({
+	cause: z.enum([
+		"api_key_selected",
+		"provider_unresolved",
+		"subscription_unverified",
+		"not_authenticated"
+	]),
+	fix: z.string().min(1).max(256),
+	harness: z.string().min(1).max(64),
+	provider: z.string().min(1).max(128).nullable()
+});
+/** @internal Validate Runtime-owned failure values on observation transports. */
+const runtimeFailureCauseSchema = z.object({
+	code: z.enum([
+		"aborted",
+		"deadline-exceeded",
+		"budget-exhausted",
+		"credential-refused",
+		"request-rejected",
+		"upstream-unavailable",
+		"transport",
+		"provider-contract",
+		"retained-unobservable",
+		"nested-recovery",
+		"platform",
+		"work-failed",
+		"unknown"
+	]),
+	owner: z.enum([
+		"provider",
+		"platform",
+		"runtime",
+		"work",
+		"caller",
+		"unknown"
+	]),
+	cause: z.string().max(MAX_CAUSE_CHARS),
+	/** The upstream or provider machine code the failure carried, when it carried one. */
+	providerCode: z.string().regex(MACHINE_CODE_PATTERN).optional(),
+	remediation: runtimeFailureRemediationSchema.readonly().optional()
+}).readonly();
+const retainedFailures = {
+	unobservable: {
+		code: "retained-unobservable",
+		owner: "provider"
+	},
+	"provider-contract": {
+		code: "provider-contract",
+		owner: "provider"
+	},
+	"request-rejected": {
+		code: "request-rejected",
+		owner: "caller"
+	},
+	transport: {
+		code: "transport",
+		owner: "platform"
+	},
+	"nested-recovery": {
+		code: "nested-recovery",
+		owner: "runtime"
+	}
+};
+function read(value, key) {
+	try {
+		return Reflect.get(value, key);
+	} catch {
+		return;
+	}
+}
+/** Every object in a failure's cause chain and aggregate members, bounded and cycle-safe. */
+function chain(error) {
+	const out = [];
+	const queue = [error];
+	while (queue.length > 0 && out.length < MAX_CHAIN_STEPS) {
+		const value = queue.shift();
+		if (typeof value !== "object" || value === null || out.includes(value)) continue;
+		out.push(value);
+		const members = read(value, "errors");
+		if (Array.isArray(members)) {
+			const limit = Math.min(members.length, MAX_CHAIN_STEPS);
+			for (let index = 0; index < limit; index++) queue.push(read(members, String(index)));
+		}
+		queue.push(read(value, "cause"));
+	}
+	return out;
+}
+const UNATTRIBUTED = {
+	code: "unknown",
+	owner: "unknown"
+};
+/** One link's own structure: budget refusal, credential refusal, machine code, HTTP status. */
+function structuralFailure(link) {
+	if (link instanceof ReservationWaitRefused || read(link, "reason") === "budget-exhausted") return {
+		code: "budget-exhausted",
+		owner: "caller"
+	};
+	const code = upstreamMachineCode([link]);
+	if (isCredentialRefusal(link) || code === "SEAT_NOT_LOGGED_IN") return {
+		code: "credential-refused",
+		owner: "caller"
+	};
+	const status = read(link, "status") ?? read(link, "statusCode");
+	if (code === "MODEL_NOT_FOUND") return {
+		code: "request-rejected",
+		owner: "caller"
+	};
+	if (typeof code === "string" && UNAVAILABLE_CODES.has(code.toLowerCase())) return {
+		code: "upstream-unavailable",
+		owner: "platform"
+	};
+	if (typeof status === "number" && Number.isInteger(status)) {
+		if (UNAVAILABLE_STATUSES.has(status)) return {
+			code: "upstream-unavailable",
+			owner: "platform"
+		};
+		if (status >= 500 || status === 0 || status === 408) return {
+			code: "transport",
+			owner: "platform"
+		};
+		if (status === 401 || status === 403) return {
+			code: "credential-refused",
+			owner: "caller"
+		};
+		if (status >= 400) return {
+			code: "request-rejected",
+			owner: "caller"
+		};
+	}
+	if (typeof code === "string" && TRANSPORT_ERROR_CODES.has(code)) return {
+		code: "transport",
+		owner: "platform"
+	};
+	if (typeof code === "string" && PLATFORM_FAILURE_CODES.has(code.toLowerCase())) return {
+		code: "platform",
+		owner: "platform"
+	};
+	const name = read(link, "name");
+	if (name === "NetworkError" || name === "ServerError") return {
+		code: "transport",
+		owner: "platform"
+	};
+}
+/** @internal The same machine-code validation used by public failure values. */
+function runtimeProviderCode(value) {
+	return typeof value === "string" && MACHINE_CODE_PATTERN.test(value) ? value : void 0;
+}
+function upstreamMachineCode(links) {
+	return [
+		"upstreamCode",
+		"errorCode",
+		"code"
+	].flatMap((field) => links.map((link) => runtimeProviderCode(read(link, field)))).find((code) => code !== void 0);
+}
+/**
+* Classify a thrown failure. Pass the caller's signal so a cancellation the caller asked for is
+* attributed to the caller even when the provider surfaced it as an ordinary error, and say when
+* the operation's own deadline expired so a blown deadline is never reported as a cancellation.
+*/
+function runtimeFailureCause(error, context = {}) {
+	const cause = errMessage(error).slice(0, MAX_CAUSE_CHARS);
+	const caller = context.signal?.aborted ? "aborted" : context.deadlineExpired ? "deadline-exceeded" : void 0;
+	try {
+		const links = chain(error);
+		const providerCode = upstreamMachineCode(links);
+		const upstream = links.find((link) => link instanceof BackendTransportError && link.backend === "bridge" && link.status === 403 && link.upstreamCode === "subscription_required" && link.providerDispatch === "not_started");
+		const remedy = runtimeFailureRemediationSchema.readonly().safeParse(upstream?.remediation);
+		const failure = ({ code, owner }) => ({
+			code,
+			owner,
+			cause,
+			...providerCode === void 0 ? {} : { providerCode },
+			...code === "credential-refused" && providerCode === "subscription_required" && remedy.success ? { remediation: remedy.data } : {}
+		});
+		if (caller !== void 0) return failure({
+			code: caller,
+			owner: "caller"
+		});
+		if (context.signal === void 0 && links.some((link) => read(link, "name") === "AbortError")) return failure({
+			code: "aborted",
+			owner: "caller"
+		});
+		for (const link of links) {
+			if (link instanceof RetainedExecutionPendingError) return failure(retainedFailures[link.pendingCause]);
+			if (read(link, "name") === "RetainedRunProviderContractError") return failure(retainedFailures[classifyRetainedPendingCause(link)]);
+		}
+		for (const link of links) {
+			const classified = structuralFailure(link);
+			if (classified !== void 0) return failure(classified);
+		}
+		return failure(UNATTRIBUTED);
+	} catch {
+		return {
+			...caller === void 0 ? UNATTRIBUTED : {
+				code: caller,
+				owner: "caller"
+			},
+			cause
+		};
+	}
+}
+/**
+* Classify a failure the execution reported without throwing — a Sandbox outcome or executor
+* envelope with `success: false` — from its machine code and HTTP status. A harness that reports
+* a failure with neither does not say who must act, so it is `unknown`, never the work's fault.
+*/
+function reportedFailureCause(outcome) {
+	return runtimeFailureCause(Object.assign(new Error(outcome.error ?? "execution reported a failure"), {
+		errorCode: outcome.errorCode,
+		statusCode: outcome.statusCode
+	}));
+}
+/**
+* Classify a down settlement from the typed facts Runtime recorded while the cause was still a
+* value: the retained cause, the failure classified where the executor threw, then `infra: false`,
+* the throw path's statement that the work itself failed. `infra: true` is not an owner: Runtime
+* also sets it for cancellations, budget reconcile faults and validation errors, and from the
+* platform's failure messages, so a settlement with nothing else typed is `unknown`.
+*/
+function settlementFailureCause(down) {
+	const cause = errMessage(down.reason).slice(0, MAX_CAUSE_CHARS);
+	if (down.retainedPendingCause !== void 0) return {
+		...retainedFailures[down.retainedPendingCause],
+		cause
+	};
+	if (down.failure !== void 0 && down.failure.code !== "unknown") return {
+		...down.failure,
+		cause
+	};
+	return {
+		...down.infra === false ? {
+			code: "work-failed",
+			owner: "work"
+		} : UNATTRIBUTED,
+		cause,
+		...down.failure?.providerCode === void 0 ? {} : { providerCode: down.failure.providerCode }
+	};
+}
+// src/content-digest.ts
+function sha256(value) {
+	return createHash("sha256").update(value).digest("hex");
+}
+// src/durable/run-fence.ts
+const claims = new AsyncLocalStorage();
+const publications = new AsyncLocalStorage();
+/** Bind asynchronous work, including callbacks, to the generation that admitted it. @internal */
+function runWithWriteClaim(claim, operation) {
+	return claims.run(claim, operation);
+}
+/** Capture a store's acquisition once, even when later called from an unrelated emitter. @internal */
+function captureRunWriteContext() {
+	let claim = claims.getStore();
+	return (operation) => {
+		claim ??= claims.getStore();
+		return claims.run(claim, operation);
+	};
+}
+/** Serialize claim changes and file mutations under the same cross-process guard. @internal */
+function mutateRunClaim(path, operation) {
+	const legacyGuard = `${path}.guard`;
+	if (existsSync(legacyGuard)) throw new Error(`supervisePursuit: cannot mutate ${path}; inspect ${legacyGuard} and remove it only after confirming no lock mutation is active`);
+	const deadline = performance.now() + 5e3;
+	const sleeper = new Int32Array(new SharedArrayBuffer(4));
+	for (;;) {
+		const acquisition = tryAcquireAtomicFileLock({ lockPath: `${path}.mutation` });
+		if (acquisition.acquired) try {
+			return operation();
+		} finally {
+			acquisition.lock.release();
+		}
+		if (performance.now() >= deadline) throw new Error(`run directory mutation is held: ${path}`);
+		Atomics.wait(sleeper, 0, 0, 10);
+	}
+}
+/**
+* Fence an actual file mutation, not an earlier advisory check. No await occurs between the
+* ownership check and publication, and acquire/release use this same guard. Unclaimed standalone
+* stores retain their existing single-writer contract; pursuit-owned work always carries a claim.
+* @internal
+*/
+function fenceRunWrite(operation) {
+	const claim = claims.getStore();
+	if (claim === void 0) return operation();
+	const publication = publications.getStore();
+	if (publication?.active && publication.claim.path === claim.path && publication.claim.generation === claim.generation) return operation();
+	return mutateRunClaim(claim.path, () => {
+		let holder;
+		try {
+			const fd = openSync(claim.path, "r");
+			try {
+				const stat = fstatSync(fd, { bigint: true });
+				if (stat.dev.toString() !== claim.lock.dev || stat.ino.toString() !== claim.lock.ino || stat.birthtimeNs.toString() !== claim.lock.birthtimeNs) throw new Error("run lock inode changed");
+				holder = JSON.parse(readFileSync(fd, "utf8"));
+			} finally {
+				closeSync(fd);
+			}
+		} catch (cause) {
+			throw new Error(`run directory generation ${claim.generation} lost its claim`, { cause });
+		}
+		if (holder?.generation !== claim.generation || holder.lock?.dev !== claim.lock.dev || holder.lock?.ino !== claim.lock.ino || holder.lock?.birthtimeNs !== claim.lock.birthtimeNs) throw new Error(`run directory generation ${claim.generation} lost its claim`);
+		const publication = {
+			claim,
+			active: true
+		};
+		try {
+			return publications.run(publication, operation);
+		} finally {
+			publication.active = false;
+		}
+	});
+}
+/** Persistent generation counter survives a clean release of supervise.lock. @internal */
+function runGenerationPath(runDir) {
+	return resolve(runDir, "supervise.generation");
+}
+// src/runtime/supervise/durable-file.ts
+/**
+* Small filesystem durability primitives for Runtime-owned state.
+*
+* Callers must validate their path and parent directory before invoking these functions.
+* The exclusive writer protects a no-clobber publication race; the atomic writer replaces one
+* state file after its temporary contents reach stable storage.
+*
+* @internal
+*/
+var durable_file_exports = /* @__PURE__ */ __exportAll({
+	appendDurableFile: () => appendDurableFile,
+	assertNoSymlinkDescendant: () => assertNoSymlinkDescendant,
+	publishExclusiveDurableFile: () => publishExclusiveDurableFile,
+	syncDurableDirectory: () => syncDurableDirectory,
+	writeAtomicDurableFile: () => writeAtomicDurableFile
+});
+/**
+* Publish a new file without replacing a concurrent winner. The published entry is a hard link
+* of the temporary file, so a content function sees the published file's inode.
+*/
+function publishExclusiveDurableFile(filePath, content, options = {}) {
+	return fenceRunWrite(() => publishExclusiveDurableFileUnchecked(filePath, content, options));
+}
+function publishExclusiveDurableFileUnchecked(filePath, content, options = {}) {
+	const temporaryPath = `${filePath}.${randomUUID()}.tmp`;
+	let operationFailed = false;
+	let operationError;
+	let published = false;
+	try {
+		writeExclusiveDurableFile(temporaryPath, content, options);
+		try {
+			linkSync(temporaryPath, filePath);
+			syncDurableDirectory(dirname(filePath));
+			published = true;
+		} catch (error) {
+			if (!isAlreadyExistsError(error)) throw error;
+		}
+	} catch (error) {
+		operationFailed = true;
+		operationError = error;
+	}
+	let cleanupError;
+	try {
+		unlinkSync(temporaryPath);
+	} catch (error) {
+		if (!isNoEntryError(error)) cleanupError = error;
+	}
+	if (operationFailed) throw operationError;
+	if (cleanupError !== void 0) throw cleanupError;
+	return published;
+}
+/** Fsync a directory after publishing a durable file entry. */
+function syncDurableDirectory(directoryPath) {
+	const fd = openSync(directoryPath, "r");
+	try {
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+}
+/** Fsync one durable file after its contents reach stable storage. */
+function syncDurableFile(filePath, exactMode) {
+	const fd = openSync(filePath, "r");
+	try {
+		if (exactMode !== void 0 && process.platform !== "win32") fchmodSync(fd, exactMode);
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+}
+/** Append one record with O_APPEND, then fsync the file and containing directory. */
+function appendDurableFile(filePath, content, options = {}) {
+	fenceRunWrite(() => appendDurableFileUnchecked(filePath, content, options));
+}
+function appendDurableFileUnchecked(filePath, content, options = {}) {
+	const flags = constants.O_APPEND | constants.O_CREAT | constants.O_WRONLY | (typeof constants.O_NOFOLLOW === "number" ? constants.O_NOFOLLOW : 0);
+	const fd = openSync(filePath, flags, options.mode ?? 384);
+	try {
+		if (process.platform !== "win32") fchmodSync(fd, options.mode ?? 384);
+		const expectedBytes = Buffer.byteLength(content, "utf8");
+		const writtenBytes = writeSync(fd, content, void 0, "utf8");
+		if (writtenBytes !== expectedBytes) throw new Error(`durable append wrote ${writtenBytes} of ${expectedBytes} bytes to '${filePath}'`);
+		fsyncSync(fd);
+	} finally {
+		closeSync(fd);
+	}
+	syncDurableDirectory(dirname(filePath));
+}
+/** Reject a path that escapes its run directory or traverses a symbolic link. */
+function assertNoSymlinkDescendant(root, target, label = "path") {
+	const base = resolve(root);
+	const exact = resolve(target);
+	const rel = relative(base, exact);
+	if (rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)) throw new Error(`${label} path escapes its run directory`);
+	if (existsSync(base) && lstatSync(base).isSymbolicLink()) throw new Error(`${label} path contains a symbolic link: ${base}`);
+	let current = base;
+	for (const part of rel.split(/[\\/]/u).filter(Boolean)) {
+		current = join(current, part);
+		if (!existsSync(current)) continue;
+		if (lstatSync(current).isSymbolicLink()) throw new Error(`${label} path contains a symbolic link: ${current}`);
+	}
+}
+/** Write, fsync, atomically replace, and fsync one Runtime-owned state file.
+* preserveMode retains ordinary access permissions despite the current umask; a new
+* file keeps normal creation semantics. Callers still own path validation and write exclusion. */
+function writeAtomicDurableFile(filePath, content, options = {}) {
+	fenceRunWrite(() => writeAtomicDurableFileUnchecked(filePath, content, options));
+}
+function writeAtomicDurableFileUnchecked(filePath, content, options = {}) {
+	const temporaryPath = `${filePath}.${randomUUID()}.tmp`;
+	let operationFailed = false;
+	let operationError;
+	try {
+		let mode = options.mode;
+		let exactMode = false;
+		if (options.preserveMode) try {
+			mode = statSync(filePath).mode & 511;
+			exactMode = true;
+		} catch (error) {
+			if (!isNoEntryError(error)) throw error;
+		}
+		writeExclusiveDurableFile(temporaryPath, content, { mode }, exactMode);
+		renameSync(temporaryPath, filePath);
+		syncDurableDirectory(dirname(filePath));
+	} catch (error) {
+		operationFailed = true;
+		operationError = error;
+	}
+	let cleanupError;
+	try {
+		unlinkSync(temporaryPath);
+	} catch (error) {
+		if (!isNoEntryError(error)) cleanupError = error;
+	}
+	if (operationFailed) throw operationError;
+	if (cleanupError !== void 0) throw cleanupError;
+}
+function writeExclusiveDurableFile(filePath, content, options, exactMode = false) {
+	const fd = openSync(filePath, "wx", options.mode ?? 438);
+	try {
+		const text = typeof content === "string" ? content : content(fstatSync(fd, { bigint: true }));
+		writeFileSync(fd, text, "utf8");
+	} finally {
+		closeSync(fd);
+	}
+	syncDurableFile(filePath, exactMode ? options.mode : void 0);
+}
+function isAlreadyExistsError(error) {
+	return error !== null && typeof error === "object" && "code" in error && error.code === "EEXIST";
+}
+function isNoEntryError(error) {
+	return error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT";
+}
+// src/durable/spawn-journal/event-index.ts
+/**
+* A trace root is valid only beside the output it commits to, with a well-formed root, artifact
+* reference and leaf count (at least the summary leaf). Records written before trace roots carry
+* none and stay valid.
+*/
+function assertTraceRoot(event, root) {
+	if (!("traceRoot" in event) || event.traceRoot === void 0) return;
+	const receipt = event.traceRoot;
+	const fields = receipt !== null && typeof receipt === "object" ? receipt : {};
+	if (typeof event.outRef !== "string" || typeof fields.root !== "string" || !/^sha256:[0-9a-f]{64}$/.test(fields.root) || typeof fields.ref !== "string" || !/^sha256:[0-9a-f]{64}$/.test(fields.ref) || typeof fields.leafCount !== "number" || !Number.isSafeInteger(fields.leafCount) || fields.leafCount < 1) throw new Error(`spawn journal corrupted: ${event.kind} for node '${event.id}' carries a malformed trace root in tree '${root}'`);
+}
+/** One validation implementation for memory, durable append, and cold replay. */
+/** @internal shared with the SQL-backed store. */
+var SpawnEventIndex = class {
+	root;
+	nodes = /* @__PURE__ */ new Map();
+	cursors = /* @__PURE__ */ new Set();
+	constructor(root) {
+		this.root = root;
+	}
+	assert(event) {
+		const node = this.nodes.get(event.id);
+		this.assertRetained(node, event);
+		assertTraceRoot(event, this.root);
+		if (event.kind === "execution-evidence") {
+			if (!node?.spawned || !/^sha256:[0-9a-f]{64}$/.test(event.outRef)) throw new Error("spawn journal corrupted: executor evidence has no spawned node or valid content reference");
+		}
+		if (event.kind === "materialized") {
+			if (node?.materialized) throw new Error(`spawn journal corrupted: duplicate materialization receipt for node '${event.id}' in tree '${this.root}'`);
+			if (!node?.spawned) throw new Error(`spawn journal corrupted: materialization for node '${event.id}' precedes its spawn in tree '${this.root}'`);
+		}
+		if (event.kind === "seat-materialized") {
+			if (!node?.materialized || node.authoredProfileDigest === void 0 || event.receipt.status !== "known" || event.receipt.authoredProfileDigest !== node.authoredProfileDigest || !Number.isSafeInteger(event.segmentIndex) || event.segmentIndex <= node.latestSeatMaterialization) throw new Error(`spawn journal corrupted: invalid seat materialization for node '${event.id}' in tree '${this.root}'`);
+		}
+		if (event.kind === "execution-bound") {
+			if (node?.bindings.has(event.binding.attemptId)) throw new Error(`spawn journal corrupted: duplicate execution binding for node '${event.id}' attempt '${event.binding.attemptId}' in tree '${this.root}'`);
+			if (!node?.materialized) throw new Error(`spawn journal corrupted: execution binding for node '${event.id}' precedes materialization in tree '${this.root}'`);
+		}
+		if (!outsideCursorNamespace(event) && this.cursors.has(event.seq)) throw new Error(`spawn journal corrupted: duplicate cursor seq ${event.seq} in tree '${this.root}'; the cursor order replay relies on is not unique`);
+	}
+	/** Called after validation; a file writer discards staged state if grouped publication fails. */
+	add(event) {
+		if (!outsideCursorNamespace(event)) this.cursors.add(event.seq);
+		if (event.kind !== "spawned" && event.kind !== "materialized" && event.kind !== "seat-materialized" && event.kind !== "execution-bound" && event.kind !== "execution-input" && event.kind !== "execution-admitted" && event.kind !== "execution-result" && event.kind !== "execution-abandoned" && event.kind !== "environment-teardown" && event.kind !== "environment-terminal" && !closesCursorSlot(event)) return;
+		let node = this.nodes.get(event.id);
+		if (!node) {
+			node = {
+				spawned: false,
+				closed: false,
+				materialized: false,
+				latestSeatMaterialization: 0,
+				bindings: /* @__PURE__ */ new Set(),
+				inputs: /* @__PURE__ */ new Set(),
+				input: false,
+				result: false,
+				abandoned: false,
+				admissions: /* @__PURE__ */ new Map(),
+				unusableEnvironments: /* @__PURE__ */ new Set()
+			};
+			this.nodes.set(event.id, node);
+		}
+		if (event.kind === "environment-teardown") {
+			if (event.destroyed) node.unusableEnvironments.add(event.environmentId);
+			return;
+		}
+		if (event.kind === "environment-terminal") {
+			node.unusableEnvironments.add(event.environmentId);
+			return;
+		}
+		if (event.kind === "execution-admitted" && event.admission.phase === "environment") node.lastEnvironmentId = event.admission.environmentId;
+		if (event.kind === "spawned") node.spawned = true;
+		else if (event.kind === "materialized") {
+			node.materialized = true;
+			node.authoredProfileDigest = event.receipt.authoredProfileDigest;
+		} else if (event.kind === "seat-materialized") node.latestSeatMaterialization = event.segmentIndex;
+		else if (event.kind === "execution-bound") node.bindings.add(event.binding.attemptId);
+		else if (event.kind === "execution-input") {
+			node.inputs.add(event.seq);
+			node.input = true;
+			node.latestInput = event.seq;
+			node.result = false;
+			node.abandoned = false;
+			node.admissions.clear();
+		} else if (event.kind === "execution-admitted") node.admissions.set(event.admission.phase, event.admission);
+		else if (event.kind === "execution-result") node.result = true;
+		else if (event.kind === "execution-abandoned") node.abandoned = true;
+		if (closesCursorSlot(event)) node.closed = true;
+	}
+	assertRetained(node, event) {
+		if (event.kind !== "execution-input" && event.kind !== "execution-admitted" && event.kind !== "execution-result" && event.kind !== "execution-abandoned") return;
+		function fail(reason) {
+			throw new Error(`spawn journal corrupted: retained execution '${event.id}' ${reason}`);
+		}
+		if (!node?.spawned) fail("precedes its spawn");
+		if (node.closed) fail("follows its terminal settlement");
+		if (event.kind === "execution-input") {
+			if (!/^sha256:[0-9a-f]{64}$/.test(event.taskRef)) fail("has an invalid task reference");
+			if (node.inputs.has(event.seq)) fail("has duplicate input sequence");
+			const environment = node.admissions.get("environment");
+			const ranIn = environment?.phase === "environment" ? environment.environmentId : node.lastEnvironmentId;
+			const closed = node.abandoned || ranIn !== void 0 && node.unusableEnvironments.has(ranIn);
+			if (node.input && !node.result && !closed) fail("input replaces an unfinished invocation");
+			return;
+		}
+		if (event.kind === "execution-abandoned") {
+			if (!node.input || node.latestInput !== event.inputSeq) fail("abandons an invocation that is not its latest");
+			if (node.result) fail("abandons an invocation that has a result");
+			if (node.abandoned) fail("abandons an invocation twice");
+			if (!Number.isSafeInteger(event.failures) || event.failures < 1) fail("abandons without a failure count");
+			return;
+		}
+		if (node.abandoned) fail(`${event.kind} follows its abandonment`);
+		if (event.kind === "execution-result") {
+			if (node.result) fail("has duplicate result");
+			if (!node.admissions.has("dispatched")) fail("result precedes dispatch");
+			if (!/^sha256:[0-9a-f]{64}$/.test(event.outRef)) fail("has an invalid result reference");
+			assertValidSpend(event.spent, "retained execution result");
+			executorFailureReason(event);
+			return;
+		}
+		const admission = event.admission;
+		if (!admission || ![
+			"intent",
+			"environment",
+			"dispatched"
+		].includes(admission.phase)) fail("has an invalid admission phase");
+		if (node.admissions.has(admission.phase)) fail("has duplicate admission phase");
+		if (node.result) fail("admission follows result");
+		if (!node.input) fail("admission precedes input");
+		if (admission.phase === "intent") {
+			if (node.admissions.size !== 0) fail("intent follows another admission");
+			return;
+		}
+		const intent = node.admissions.get("intent");
+		if (intent?.phase !== "intent") fail("admission precedes intent");
+		if (admission.idempotencyKey !== intent.idempotencyKey || admission.turnId !== intent.turnId) fail("changes its admitted request identity");
+		if (admission.phase === "environment") {
+			if (admission.provider !== intent.provider || admission.sessionId !== intent.sessionId || admission.executionId !== intent.executionId) fail("changes its admitted execution identity");
+			return;
+		}
+		const environment = node.admissions.get("environment");
+		if (environment?.phase !== "environment") fail("dispatch precedes environment");
+		const control = admission.controlRef;
+		if (!control || control.provider !== intent.provider || control.environmentId !== environment.environmentId || control.sessionId !== intent.sessionId || control.executionId !== intent.executionId) fail("dispatch changes its admitted execution identity");
+	}
+};
+/**
+* The records that CLOSE a node's cursor slot: a settlement or a cancellation. The complement question to {@link outsideCursorNamespace}, and the one a resume needs —
+* a kind missing here leaves a finished node looking live, so its budget is never reclaimed and
+* its reservation is replayed as still in doubt.
+*/
+function closesCursorSlot(ev) {
+	return ev.kind === "settled" || ev.kind === "cancelled";
+}
+const outsideKinds = /* @__PURE__ */ new Set([
+	"spawned",
+	"metered",
+	"materialized",
+	"execution-bound",
+	"execution-input",
+	"execution-admitted",
+	"execution-result",
+	"execution-abandoned",
+	"execution-evidence",
+	"evidence-pending",
+	"progress",
+	"reconciled",
+	"edge",
+	"teardown-unconfirmed",
+	"teardown-pending",
+	"teardown-confirmed",
+	"environment-teardown",
+	"environment-terminal",
+	"workspace-checkpoint-requested",
+	"workspace-checkpoint",
+	"workspace-checkpoint-fork-requested",
+	"workspace-checkpoint-fork-ready",
+	"workspace-checkpoint-fork-teardown",
+	"workspace-checkpoint-capture",
+	"workspace-checkpoint-cleanup",
+	"workspace-restored",
+	"workspace-capture-started",
+	"workspace-capture",
+	"trace-unpropagated",
+	"seat-segment",
+	"seat-materialized",
+	"seat-paused",
+	"run-parked",
+	"root-segment",
+	"root-reentered",
+	"reopened",
+	"paused",
+	"barren-pause",
+	"driver-attempt",
+	"node-inputs-resolved",
+	"edge-verdict",
+	"join-state"
+]);
+/** True for a node-CREATION or informational record. Narrows, so a caller keeps the union's arms. */
+function outsideCursorNamespace(ev) {
+	return outsideKinds.has(ev.kind);
+}
+/** True for a record inside the cursor namespace. Narrows to {@link CursorNamespaceEvent}. */
+function insideCursorNamespace(ev) {
+	return !outsideKinds.has(ev.kind);
+}
+// src/durable/jsonl-append.ts
+/** Commit JSONL bytes and validate their descriptor under one generation fence. @internal */
+function commitJsonLine(path, record, acknowledge) {
+	const encoded = JSON.stringify(record);
+	if (encoded === void 0) throw new TypeError("JSONL records must be JSON serializable");
+	return fenceRunWrite(() => {
+		const separator = prepareJsonlTail(path);
+		const fd = openSync(path, "a");
+		try {
+			const bytes = Buffer.from(`${separator ? "\n" : ""}${encoded}\n`);
+			let offset = 0;
+			while (offset < bytes.length) {
+				const written = writeSync(fd, bytes, offset, bytes.length - offset);
+				if (written <= 0) throw new Error(`append-only file write made no progress at byte ${offset}`);
+				offset += written;
+			}
+			fsyncSync(fd);
+			return acknowledge?.(fd);
+		} finally {
+			closeSync(fd);
+		}
+	});
+}
+/** Recover only an uncommitted tail. Caller holds the generation fence. @internal */
+function prepareJsonlTail(path) {
+	let fd;
+	try {
+		fd = openSync(path, "r+");
+	} catch (error) {
+		if (error.code === "ENOENT") return false;
+		throw error;
+	}
+	try {
+		const size = fstatSync(fd).size;
+		if (size === 0) return false;
+		const last = Buffer.allocUnsafe(1);
+		readAt(fd, last, size - 1);
+		if (last[0] === 10) return false;
+		const chunks = [];
+		let end = size;
+		let tailStart = 0;
+		while (end > 0) {
+			const start = Math.max(0, end - 65536);
+			const chunk = Buffer.allocUnsafe(end - start);
+			readAt(fd, chunk, start);
+			const newline = chunk.lastIndexOf(10);
+			chunks.push(chunk.subarray(newline + 1));
+			if (newline >= 0) {
+				tailStart = start + newline + 1;
+				break;
+			}
+			end = start;
+		}
+		try {
+			JSON.parse(Buffer.concat(chunks.reverse()).toString("utf8"));
+			return true;
+		} catch (error) {
+			if (!(error instanceof SyntaxError)) throw error;
+			ftruncateSync(fd, tailStart);
+			fsyncSync(fd);
+			return false;
+		}
+	} finally {
+		closeSync(fd);
+	}
+}
+function readAt(fd, buffer, position) {
+	let offset = 0;
+	while (offset < buffer.length) {
+		const read = readSync(fd, buffer, offset, buffer.length - offset, position + offset);
+		if (read === 0) throw new Error("journal changed while preparing its append tail");
+		offset += read;
+	}
+}
+// src/durable/jsonl-file.ts
+/** Read a fixed file prefix one record at a time, never allocating the whole journal as a string.
+* A reader cannot chase concurrent appends forever. Missing files are empty only when requested;
+* corruption, short reads, and other I/O errors remain failures. Closing the iterator closes the fd. */
+async function* readCommittedJsonLines(path, options = {}) {
+	const fs = await import("node:fs/promises");
+	let handle;
+	try {
+		handle = await fs.open(path, "r");
+	} catch (error) {
+		if (options.allowMissing && isNoEntError(error)) return;
+		throw error;
+	}
+	try {
+		const { size } = await handle.stat();
+		if (size === 0) return;
+		const { StringDecoder } = await import("node:string_decoder");
+		const decoder = new StringDecoder("utf8");
+		const stream = handle.createReadStream({
+			autoClose: false,
+			end: size - 1
+		});
+		const fragments = [];
+		let lineNumber = 1;
+		try {
+			for await (const chunk of stream) {
+				options.onBytes?.(chunk);
+				const text = decoder.write(chunk);
+				let start = 0;
+				let end = text.indexOf("\n", start);
+				while (end !== -1) {
+					fragments.push(text.slice(start, end));
+					const record = parseRecord(fragments.join(""), path, lineNumber++, true, options.allowWhitespaceLines);
+					fragments.length = 0;
+					if (record !== void 0) yield record.value;
+					start = end + 1;
+					end = text.indexOf("\n", start);
+				}
+				if (start < text.length) fragments.push(text.slice(start));
+			}
+			if (stream.bytesRead !== size) throw new Error(`${path}: journal changed while reading its committed prefix`);
+			fragments.push(decoder.end());
+			const record = parseRecord(fragments.join(""), path, lineNumber, false, options.allowWhitespaceLines);
+			if (record !== void 0) yield record.value;
+		} finally {
+			stream.destroy();
+		}
+	} finally {
+		await handle.close();
+	}
+}
+/** An invalid unterminated tail may be a torn write; other parse failures are not evidence of one. */
+function parseRecord(line, source, lineNumber, terminated, allowWhitespaceLines = false) {
+	if (line.length === 0 || allowWhitespaceLines && line.trim().length === 0) return void 0;
+	try {
+		return { value: JSON.parse(line) };
+	} catch (cause) {
+		if (!(cause instanceof SyntaxError)) throw cause;
+		if (!terminated) return void 0;
+		throw new Error(`${source}: malformed JSONL record at line ${lineNumber}`, { cause });
+	}
+}
+async function appendCommittedJsonLine(path, record, acknowledge) {
+	return commitJsonLine(path, record, acknowledge);
+}
+/** Serialize JSONL file updates across processes and aliases using Eval's existing file lock.
+* The caller owns validation and the record format. The lock path names the canonical file,
+* including its first write, so two directory aliases cannot acquire different write heads.
+* @internal
+*/
+async function withJsonlFileLock(path, operation) {
+	const fs = await import("node:fs/promises");
+	const { dirname } = await import("node:path");
+	const { tryAcquireAtomicFileLock } = await import("@tangle-network/agent-eval/ledger-core");
+	await fs.mkdir(dirname(path), { recursive: true });
+	await (await fs.open(path, "a")).close();
+	const canonicalPath = await fs.realpath(path);
+	const deadline = Date.now() + 5e3;
+	for (;;) {
+		const acquisition = tryAcquireAtomicFileLock({ lockPath: `${canonicalPath}.lock` });
+		if (!acquisition.acquired) {
+			if (Date.now() >= deadline) throw new Error(`journal file lock unavailable after 5000ms: ${canonicalPath}`);
+			await new Promise((resolve) => setTimeout(resolve, 25));
+			continue;
+		}
+		try {
+			return await operation(canonicalPath);
+		} finally {
+			acquisition.lock.release();
+		}
+	}
+}
+/** Read one keyed registry snapshot without an extra whole-file text allocation.
+* Historical registry files allow whitespace-only separators; append journals remain strict.
+* @internal
+*/
+async function readCommittedJsonFile(path) {
+	const records = [];
+	for await (const record of readCommittedJsonLines(path, {
+		allowMissing: true,
+		allowWhitespaceLines: true
+	})) records.push(record);
+	return records;
+}
+/** Replace one keyed row and publish one durable snapshot. The caller holds the file lock.
+* Keep unrelated rows in order and put the replacement last. No revision archive is retained.
+* @internal
+*/
+async function upsertCommittedJsonLine(path, record, key) {
+	const encoded = JSON.stringify(record);
+	if (encoded === void 0) throw new Error("JSONL records must be JSON serializable");
+	const snapshot = JSON.parse(encoded);
+	const id = key(snapshot);
+	const updated = [];
+	for await (const prior of readCommittedJsonLines(path, {
+		allowMissing: true,
+		allowWhitespaceLines: true
+	})) if (key(prior) !== id) updated.push(prior);
+	updated.push(snapshot);
+	const { writeAtomicDurableFile } = await Promise.resolve().then(() => durable_file_exports);
+	writeAtomicDurableFile(path, `${updated.map((row) => JSON.stringify(row)).join("\n")}\n`, { preserveMode: true });
+}
+/** Recover a torn tail under the same generation fence as durable publications. @internal */
+async function prepareJsonlAppend(path) {
+	return fenceRunWrite(() => prepareJsonlTail(path));
+}
+/** True for a filesystem error meaning "the file is not there yet" — the one condition an
+*  append-only reader treats as an empty log rather than a fault. */
+function isNoEntError(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+// src/durable/spawn-journal/record-events.ts
+/** Decode the file journal's historical single-event and atomic-group envelopes. @internal */
+function spawnJournalRecordEvents(record) {
+	if (!isRecord(record)) throw new Error("spawn journal corrupted: record must be an object");
+	if (record.kind === "begin") return [];
+	if (record.kind === "event") return [record.event];
+	if (record.kind !== "events") throw new Error(`spawn journal corrupted: unknown record kind '${String(record.kind)}'`);
+	if (!Array.isArray(record.events)) throw new Error("spawn journal group has no events array");
+	return record.events;
+}
+// src/durable/spawn-journal/journal-store.ts
+/**
+* Append every event as one grouped publication where the journal supports it (`appendEvents`),
+* preserving legacy per-event appends otherwise — the SQL contexts' fenced head advances once.
+* @internal
+*/
+async function appendSpawnEvents(journal, root, events) {
+	if (journal.appendEvents !== void 0) return journal.appendEvents(root, events);
+	for (const event of events) await journal.appendEvent(root, event);
+}
+/**
+* JSONL on disk. One line per record: the first record is `begin`, subsequent records
+* are `event` or atomic `events` envelopes. `loadTree` replays the whole file,
+* filtering by `root`, and applies the same begin-precedes-events + unique-seq
+* corruption guards as the in-memory impl. Each append fsyncs so a crash between
+* writes never loses an acknowledged event.
+*
+* @stable
+*/
+var FileSpawnJournal = class {
+	path;
+	writeContext = captureRunWriteContext();
+	appendTail = Promise.resolve();
+	appendIndex;
+	constructor(path) {
+		this.path = path;
+	}
+	async loadTree(root) {
+		let begun = false;
+		const events = [];
+		const index = new SpawnEventIndex(root);
+		for await (const record of readCommittedJsonLines(this.path, { allowMissing: true })) {
+			if (record.root !== root) continue;
+			if (record.kind === "begin") begun = true;
+			else {
+				if (!begun) throw new Error(`spawn journal corrupted: event for tree '${root}' precedes its begin record`);
+				for (const event of spawnJournalRecordEvents(record)) {
+					index.assert(event);
+					index.add(event);
+					events.push(event);
+				}
+			}
+		}
+		return begun ? events : void 0;
+	}
+	async beginTree(root, at) {
+		return this.serializeAppend(async () => {
+			const state = await this.validationIndex();
+			const existing = state.trees.get(root);
+			if (existing) {
+				if (existing.begunAt !== at) throw new Error(`spawn tree '${root}' already begun in ${this.path} at ${existing.begunAt}; refusing to overwrite with ${at}`);
+				return;
+			}
+			state.stamp = await this.writeRecord({
+				kind: "begin",
+				root,
+				at
+			});
+			state.trees.set(root, {
+				begunAt: at,
+				index: new SpawnEventIndex(root)
+			});
+		});
+	}
+	async appendEvent(root, ev) {
+		const event = detachedSnapshot(ev, "spawn event");
+		return this.serializeAppend(async () => {
+			const state = await this.validationIndex();
+			const tree = state.trees.get(root);
+			if (tree === void 0) throw new Error(`appendEvent called for unknown spawn tree '${root}'; call beginTree first`);
+			tree.index.assert(event);
+			state.stamp = await this.writeRecord({
+				kind: "event",
+				root,
+				event
+			});
+			tree.index.add(event);
+		});
+	}
+	async appendEvents(root, events) {
+		const captured = detachedSnapshot(events, "spawn events");
+		return this.serializeAppend(async () => {
+			const state = await this.validationIndex();
+			const tree = state.trees.get(root);
+			if (tree === void 0) throw new Error(`appendEvents called for unknown spawn tree '${root}'; call beginTree first`);
+			try {
+				for (const event of captured) {
+					tree.index.assert(event);
+					tree.index.add(event);
+				}
+				state.stamp = await this.writeRecord({
+					kind: "events",
+					root,
+					events: captured
+				});
+			} catch (error) {
+				this.appendIndex = void 0;
+				throw error;
+			}
+		});
+	}
+	async validationIndex() {
+		const stamp = await this.fileStamp();
+		if (this.appendIndex && this.appendIndex.stamp === stamp) return this.appendIndex;
+		this.appendIndex = void 0;
+		const trees = /* @__PURE__ */ new Map();
+		if (stamp !== void 0) for await (const record of readCommittedJsonLines(this.path)) if (record.kind === "begin") {
+			if (!trees.has(record.root)) trees.set(record.root, {
+				begunAt: record.at,
+				index: new SpawnEventIndex(record.root)
+			});
+		} else {
+			const tree = trees.get(record.root);
+			if (!tree) throw new Error(`spawn journal corrupted: event for tree '${record.root}' precedes its begin record`);
+			for (const event of spawnJournalRecordEvents(record)) {
+				tree.index.assert(event);
+				tree.index.add(event);
+			}
+		}
+		if (await this.fileStamp() !== stamp) throw new Error("spawn journal changed while rebuilding its append index");
+		this.appendIndex = {
+			stamp,
+			trees
+		};
+		return this.appendIndex;
+	}
+	async fileStamp() {
+		const fs = await import("node:fs/promises");
+		try {
+			return journalFileStamp(await fs.stat(this.path, { bigint: true }));
+		} catch (error) {
+			if (isNoEntError(error)) return void 0;
+			throw error;
+		}
+	}
+	async serializeAppend(operation) {
+		const append = this.appendTail.then(() => this.writeContext(operation));
+		this.appendTail = append.catch(() => void 0);
+		return append;
+	}
+	async writeRecord(record) {
+		const fs = await import("node:fs/promises");
+		const { dirname } = await import("node:path");
+		try {
+			await fs.mkdir(dirname(this.path), { recursive: true });
+			return await appendCommittedJsonLine(this.path, record, (fd) => {
+				const stamp = journalFileStamp(fstatSync(fd, { bigint: true }));
+				if (journalFileStamp(statSync(this.path, { bigint: true })) !== stamp) throw new Error("spawn journal changed while acknowledging its append");
+				return stamp;
+			});
+		} catch (error) {
+			this.appendIndex = void 0;
+			throw error;
+		}
+	}
+};
+/** Detect replacement, truncation, and same-size edits; this is not a cross-process write lock. */
+function journalFileStamp(stat) {
+	return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+}
+export { traceRootWriter as $, runtimeProviderCode as A, sandboxLeafOutputFromEvents as At, retainedExecutorContext as B, createSandboxUsageLedger as Bt, runGenerationPath as C, spendFromUsageEvents as Ct, runtimeFailureCause as D, createSandboxToolPartState as Dt, reportedFailureCause as E, assertValidSpend as Et, executorEvidenceWriter as F, extractTransportEventIdentity as Ft, cappedDoublingMs as G, sandboxTerminalUsageField as Gt, workspaceCaptureWriter as H, isSandboxTerminalEvent as Ht, isProvisioningRefusal as I, parseCanonicalTransportEvent as It, unavailableResumeAt as J, parseCodexUsageRecord as Jt, jitteredMs as K, sumSandboxUsage as Kt, leafContinuationExecutionId as L, assertSandboxServedModel as Lt, BUDGET_CONTINUATION_TASK as M, sandboxProgressEvents as Mt, DISPATCH_NOT_ADMITTED_CODE as N, terminalTextFromSandboxEvent as Nt, runtimeFailureCauseSchema as O, mapSandboxEvent as Ot, RetainedExecutionPendingError as P, canonicalStreamEventFromSandboxEvent as Pt, TRACE_SUMMARY_SCHEMA as Q, prepareRetainedExecutor as R, canonicalSandboxUsageMode as Rt, mutateRunClaim as S, newUsageTotals as St, sha256 as T, assertValidBudget as Tt, UNAVAILABLE_CODES as U, notifySandboxEventObserver as Ut, retainedExecutorSeamKey as V, extractLlmCallEvent as Vt, UNAVAILABLE_STATUSES as W, sandboxEventServedBackend as Wt, unavailableSignalOfFailure as X, __exportAll as Xt, unavailableSignalInText as Y, recordValue as Yt, TRACE_ROOT_SCHEMA as Z, publishExclusiveDurableFile as _, defaultRedactorIdentityMaterial as _t, isNoEntError as a, executorFailure as at, captureRunWriteContext as b, createBudgetPool as bt, readCommittedJsonLines as c, hashJson as ct, SpawnEventIndex as d, causeChain as dt, detachedFrozen as et, closesCursorSlot as f, errMessage as ft, assertNoSymlinkDescendant as g, defaultRedactor as gt, appendDurableFile as h, errorText as ht, appendCommittedJsonLine as i, contentRef as it, settlementFailureCause as j, sandboxOutputMarker as jt, runtimeFailureRemediationSchema as k, mapSandboxToolEvent as kt, upsertCommittedJsonLine as l, credentialCommandExit as lt, outsideCursorNamespace as m, errorProperty as mt, appendSpawnEvents as n, shareParsedStrings as nt, prepareJsonlAppend as o, executorFailureInfra as ot, insideCursorNamespace as p, errorHttpStatus as pt, unavailablePauseMs as q, decodeHarnessUsage as qt, spawnJournalRecordEvents as r, contentAddress as rt, readCommittedJsonFile as s, executorFailureReason as st, FileSpawnJournal as t, detachedSnapshot as tt, withJsonlFileLock as u, isCredentialRefusal as ut, syncDurableDirectory as v, resolveRedactor as vt, runWithWriteClaim as w, spendFromUsageTotals as wt, fenceRunWrite as x, meterUsageEvent as xt, writeAtomicDurableFile as y, BudgetReconcileFault as yt, registerRetainedExecutorPreparation as z, createSandboxTurnEventCollector as zt };
+
+//# sourceMappingURL=journal-store-BJPMUydp.js.map