@tangle-network/agent-runtime 3.0.42 → 4.0.0

package/dist/{supervise-BO9acmsB.js → supervise-MAzd0hOk.js}

@@ -1,15 +1,15 @@
-import { $n as persistHarnessTranscript, At as beginScopeRetainedOwnerDrive, B as beginScopeOwnerAttempt, Ci as meterUsageEvent, Cr as inheritRuntimeOwnedExecutorAttestation, Di as assertValidBudget, Dr as providerAttemptEvidence, Dt as prepareScopeRetainedOwnerTask, Ei as spendFromUsageTotals, Et as consumeScopeRetainedOwnerResult, Fr as runtimeOwnedExecutorMaterialization, Ft as scopeRetainedOwnerRestorePoint, G as scopeOwnerExecutorNodeContext, Gr as runtimeFlowBrain, H as noteScopeOwnerPlannedExecution, Ht as scopeRetainedOwnerJournalRoot, Ir as runtimeOwnedExecutorProviderEvidence, It as noteScopeRetainedOwnerCoordination, J as providerVisibleProfile, K as coordinationMcpAlias, Lr as runtimeOwnedPendingExecutorMaterialization, Mt as scopeRetainedOwnerTurnEnded, Nr as runtimeOwnedDriveHarnessProviderEvidence, Nt as assertRetainedOwnerCoordinationRekey, O as parseWorkerToolTraceArtifact, Or as recordRuntimeOwnedDriveHarnessProviderEvidence, Ot as scopeRetainedOwnerPriorSpend, Pr as runtimeOwnedExecutorExecutionBinding, Pt as reconcileScopeRetainedOwnerEnvironment, Q as assertRecursiveReservationPolicy, Rr as runtimeOwnedScopeOwnerRuntime, Rt as bindScopeRetainedOwnerEnvironmentId, St as scopeRetainedOwnerResourceReader, Tt as abandonScopeRetainedOwnerInvocation, U as recordScopeOwnerMaterialization, Ur as isRuntimeFlowBrain, Vn as generateSpanId, Vt as scopeRetainedOwnerContext, W as restoreScopeOwnerAcceptedExecution, Wr as runtimeFlowAgent, Xi as recordValue, Y as runtimeGraphMetadataKey, a as readRootStream, br as authoredAgentIdentity, bt as prepareScopeRetainedOwnerSeatSwitch, ct as recordScopeOwnerBarrenPause, di as unavailablePauseMs, dr as SeatChain, ei as RetainedExecutionPendingError, er as readHarnessTranscript, fi as unavailableResumeAt, fr as SeatChainExhaustedError, gi as contentAddress, ia as RunCancellationReason, ii as registerRetainedExecutorPreparation, kn as WORKER_TRACE_PROPAGATION, kt as scopeRetainedOwnerResult, li as cappedDoublingMs, lr as isLiveNodeStatus, lt as recordScopeOwnerDriverAttempt, mr as seatExecutionProfile, n as ROOT_STREAM_FILE, oa as linkAbort, oi as retainedExecutorSeamKey, or as createActivityLog, ot as meterRuntimeOwnedAccounting, pr as authoredSeatStages, q as coordinationProfileToolPrefix, r as createRootStreamSink, sa as runAbortable, st as meterRuntimeOwnedProviderAttempt, ui as jitteredMs, ur as isTerminalNodeStatus, ut as recordScopeOwnerPause, vi as executorFailure, wi as newUsageTotals, xt as releaseScopeRetainedOwnerForSeatPause, yr as attestRuntimeOwnedScopeOwner, zn as createOtelExporter, zt as bindScopeRetainedOwnerProvider } from "./scope-D04GkJ6P.js";
+import { $n as persistHarnessTranscript, Ai as spendFromUsageTotals, At as beginScopeRetainedOwnerDrive, B as beginScopeOwnerAttempt, Di as meterUsageEvent, Dt as prepareScopeRetainedOwnerTask, Et as consumeScopeRetainedOwnerResult, Fr as runtimeOwnedExecutorExecutionBinding, Ft as scopeRetainedOwnerRestorePoint, G as scopeOwnerExecutorNodeContext, Gr as runtimeFlowAgent, H as noteScopeOwnerPlannedExecution, Ht as scopeRetainedOwnerJournalRoot, Ir as runtimeOwnedExecutorMaterialization, It as noteScopeRetainedOwnerCoordination, J as providerVisibleProfile, K as coordinationMcpAlias, Kr as runtimeFlowBrain, Lr as runtimeOwnedExecutorProviderEvidence, Mt as scopeRetainedOwnerTurnEnded, Nt as assertRetainedOwnerCoordinationRekey, O as parseWorkerToolTraceArtifact, Oi as newUsageTotals, Or as providerAttemptEvidence, Ot as scopeRetainedOwnerPriorSpend, Pr as runtimeOwnedDriveHarnessProviderEvidence, Pt as reconcileScopeRetainedOwnerEnvironment, Q as assertRecursiveReservationPolicy, Rr as runtimeOwnedPendingExecutorMaterialization, Rt as bindScopeRetainedOwnerEnvironmentId, St as scopeRetainedOwnerResourceReader, Tt as abandonScopeRetainedOwnerInvocation, U as recordScopeOwnerMaterialization, Vn as generateSpanId, Vt as scopeRetainedOwnerContext, W as restoreScopeOwnerAcceptedExecution, Wr as isRuntimeFlowBrain, Y as runtimeGraphMetadataKey, a as readRootStream, ai as registerRetainedExecutorPreparation, br as attestRuntimeOwnedScopeOwner, bt as prepareScopeRetainedOwnerSeatSwitch, ca as RunCancellationReason, ct as recordScopeOwnerBarrenPause, da as runAbortable, di as jitteredMs, dr as SEAT_RECHECK_MS, ea as recordValue, er as readHarnessTranscript, fr as SeatChain, hi as unavailableResumeAt, hr as seatExecutionProfile, ji as assertValidBudget, kn as WORKER_TRACE_PROPAGATION, kr as recordRuntimeOwnedDriveHarnessProviderEvidence, kt as scopeRetainedOwnerResult, lr as isLiveNodeStatus, lt as recordScopeOwnerDriverAttempt, mi as unavailablePauseMs, mr as authoredSeatStages, n as ROOT_STREAM_FILE, or as createActivityLog, ot as meterRuntimeOwnedAccounting, pi as reportedResetAt, pr as SeatPauseError, q as coordinationProfileToolPrefix, r as createRootStreamSink, si as retainedExecutorSeamKey, st as meterRuntimeOwnedProviderAttempt, ti as RetainedExecutionPendingError, ua as linkAbort, ui as cappedDoublingMs, ur as isTerminalNodeStatus, ut as recordScopeOwnerPause, wr as inheritRuntimeOwnedExecutorAttestation, xi as executorFailure, xr as authoredAgentIdentity, xt as releaseScopeRetainedOwnerForSeatPause, yi as contentAddress, zn as createOtelExporter, zr as runtimeOwnedScopeOwnerRuntime, zt as bindScopeRetainedOwnerProvider } from "./scope-CJ7xtrs8.js";
 import { f as RuntimeRunStateError, i as ConfigError, m as ValidationError } from "./errors-AzSuGI23.js";
 import { $ as isAsyncIterable, Dt as teardownExecutor, G as chargedTokens, Ot as teardownSurfaces, St as armDeadlineTimer, Tt as isDeadlineAbortReason, U as addSpend, Y as errorMessage, at as sleep, bt as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, dt as zeroSpend, gt as withBudgetResources, ht as resourceTelemetry, lt as unmeteredSpend, pt as addResourceSpend, tt as promptCacheTokenClasses, ut as withTimeout } from "./workspace-streams-8ALHaZzx.js";
-import { d as detachedSnapshot, h as errorHttpStatus, m as errMessage, p as causeChain } from "./jsonl-file-CbxMVnUj.js";
-import { $t as promptModelProfileMaterialization, At as bridgeModelRouteRefusal, B as createRouterTranscript, C as createExecutor, Ct as admitContinuationPolicy, Et as createContinuationKeeper, F as codeModeArguments, I as codeModeModelOutput, Jt as controlProfileMaterialization, Kt as assertProfileMaterialization, L as createCodeModeTools, Qt as promptControlProfileMaterialization, Rt as bridgeRuntimeAttachmentsKey, S as captureReusableExecutorConfig, St as CONTINUATIONS_DIR, Tt as checkVerdictOf, U as resolveAgentEnvironmentProvider, V as routerBrain, X as createInbox, Xt as fullProfileMaterialization, Y as INBOX_RECEIPT_KEY, Yt as defineProfileMaterializationContract, Zt as profileMaterializationAxes$1, _t as CheckUnavailableError, a as assertRunParking, c as sleepScopeWait, ct as HarnessTurnFailedError, d as runFinalizer, dt as classifyDriverFailure, en as renderUnsupported, et as PEER_MAIL_WIRE_KEY, f as runTree, ft as isContentFilterRefusal, g as isDriverSpec, gt as preflightPublicCoordination, h as driverExecutorFactory, ht as upstreamUnavailableSignal, i as RunParkedError, in as worktreeCliProfileMaterialization, kt as bridgeAdmissionRefusal, l as withRunParking, lt as abandonablePending, m as driverChild, mt as undispatchedCredentialExit, n as createSupervisor, nn as sandboxProfileMaterialization, o as bindScopeParkingDrain, p as createRootHandle, pt as summarizeDriverAttempts, rn as unsupportedProfileDimensions, rt as isPeerMailEnvelope, st as DriverAttemptsExhaustedError, u as bestDelivered, ut as causedByPartialFailure, vt as gateFactoryOnDeliverable, w as snapshotExecutorConfig, wt as bestComposite, x as bindReusableExecutorExecutionId, z as toolResultText, zt as bridgeStopSignalKey } from "./supervisor-BQz8lkcd.js";
+import { _ as errorText, d as detachedSnapshot, h as errorHttpStatus, m as errMessage, p as causeChain } from "./jsonl-file-CvPuwM0a.js";
+import { $t as promptModelProfileMaterialization, At as bridgeModelRouteRefusal, B as createRouterTranscript, C as createExecutor, Ct as admitContinuationPolicy, Et as createContinuationKeeper, F as codeModeArguments, I as codeModeModelOutput, Jt as controlProfileMaterialization, Kt as assertProfileMaterialization, L as createCodeModeTools, Qt as promptControlProfileMaterialization, Rt as bridgeRuntimeAttachmentsKey, S as captureReusableExecutorConfig, St as CONTINUATIONS_DIR, Tt as checkVerdictOf, U as resolveAgentEnvironmentProvider, V as routerBrain, X as createInbox, Xt as fullProfileMaterialization, Y as INBOX_RECEIPT_KEY, Yt as defineProfileMaterializationContract, Zt as profileMaterializationAxes$1, _t as CheckUnavailableError, a as assertRunParking, c as sleepScopeWait, ct as HarnessTurnFailedError, d as runFinalizer, dt as isContentFilterRefusal, en as renderUnsupported, et as PEER_MAIL_WIRE_KEY, f as runTree, ft as summarizeDriverAttempts, g as isDriverSpec, gt as preflightPublicCoordination, h as driverExecutorFactory, ht as upstreamUnavailableSignal, i as RunParkedError, in as worktreeCliProfileMaterialization, kt as bridgeAdmissionRefusal, l as withRunParking, lt as abandonablePending, m as driverChild, mt as undispatchedCredentialExit, n as createSupervisor, nn as sandboxProfileMaterialization, o as bindScopeParkingDrain, p as createRootHandle, pt as transientFailureKind, rn as unsupportedProfileDimensions, rt as isPeerMailEnvelope, st as DriverAttemptsExhaustedError, u as bestDelivered, ut as classifyDriverFailure, vt as gateFactoryOnDeliverable, w as snapshotExecutorConfig, wt as bestComposite, x as bindReusableExecutorExecutionId, z as toolResultText, zt as bridgeStopSignalKey } from "./supervisor-CwANBb9-.js";
 import { _ as agentHarness, a as concreteProfileModel, c as profileModelExecutionSettings, l as profileProviderModel, n as assertModelAllowed, o as enforceTokenLimits, r as assertProfileModelsAllowed, s as profileBridgeWireModel, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-JOcg3NRs.js";
 import { n as createStdioToolServer } from "./tool-server-CZWd_Opp.js";
 import { t as composeRuntimeHooks } from "./runtime-hooks-CsW2pfFk.js";
-import { _ as workerAssignmentNamespace, c as writeRunCancellation, d as coordinationEventId, f as externalExecutionId, g as supervisionRunNamespace, h as rootCoordinationOwner, i as readRunCancellation, l as canonicalExecution, m as freezeDetachedProfile, p as freezeDetached, r as readRunCancelRequest, s as watchRunCancellation, t as applyRunCancellation, u as childCoordinationOwner } from "./run-cancellation-Xh0hv_aO.js";
-import { c as createSteerAcknowledger, d as coordinationVerbNames, f as createFileRunContext, l as budgetOverspendText, m as withRunContext, n as createCoordinationToolsForManager, p as createInMemoryRunContext, s as createCancelAcknowledger, t as createCoordinationTools, u as normalizeAnalyzeOnSettle } from "./coordination-manager-_PcKOR-S.js";
-import { o as safeJsonText } from "./coordination-map-routing-2_hUlTnz.js";
-import { a as graphRegistry, c as loadGraph } from "./graph-registry-BoaUV5g8.js";
+import { _ as workerAssignmentNamespace, c as writeRunCancellation, d as coordinationEventId, f as externalExecutionId, g as supervisionRunNamespace, h as rootCoordinationOwner, i as readRunCancellation, l as canonicalExecution, m as freezeDetachedProfile, p as freezeDetached, r as readRunCancelRequest, s as watchRunCancellation, t as applyRunCancellation, u as childCoordinationOwner } from "./run-cancellation-CGgk54Md.js";
+import { c as createSteerAcknowledger, d as coordinationVerbNames, f as createFileRunContext, l as budgetOverspendText, m as withRunContext, n as createCoordinationToolsForManager, p as createInMemoryRunContext, s as createCancelAcknowledger, t as createCoordinationTools, u as normalizeAnalyzeOnSettle } from "./coordination-manager-C-ZoeZ73.js";
+import { o as safeJsonText } from "./coordination-map-routing-SnsZp287.js";
+import { a as graphRegistry, c as loadGraph } from "./graph-registry-CI1o16DH.js";
 import { ATTR, agentIdentityAttributes } from "@tangle-network/agent-trace-contract";
 import { ProxySecretScopeSchema, ProxySecretsSchema, agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalCandidateJson, mergeProxySecretBindings, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { toolSpansToTraceAnalysisStore } from "@tangle-network/agent-eval";
@@ -2451,11 +2451,13 @@ function assertPerWorkerAdmittable(perWorker, pool, ownerShare) {
 	].filter((x) => x !== null);
 	if (unadmittable.length > 0) throw new ValidationError(`${unadmittable.join("; ")} — lower perWorker on that channel so a child fits beside the owner's own turns; otherwise children are refused or starve at spawn hours into the run.`);
 }
-/** The slice a child gets when its manager names none: a quarter of the part of the manager's
-*  budget its children may reserve, so four default children fill that part and the manager's
-*  own share stays free for its turns. Each nested manager divides its own slice the same way. */
-function defaultPerWorker(budget, ownerShare) {
-	const share = (1 - ownerShare) / 4;
+/** The slice a child gets when its manager names none: the part of the manager's budget its
+*  children may reserve, divided by the run's worker slots (four with none), so the slots, not the
+*  budget, set how many run at once. A quarter share capped managers with 8-15 slots at 2-4
+*  children (zro-w4a16-hopper-20261104b held 4 of 8; canary-soak-20261104a queued s5-s7 163-176 s). */
+function defaultPerWorker(budget, ownerShare, workerSlots) {
+	const slots = typeof workerSlots === "number" ? workerSlots : workerSlots?.max;
+	const share = (1 - ownerShare) / (slots !== void 0 && slots > 0 ? slots : 4);
 	return {
 		...budget.resources === void 0 ? {} : { resources: Object.fromEntries(Object.entries(budget.resources).map(([name, value]) => [name, {
 			unit: value.unit,
@@ -3590,23 +3592,24 @@ function createCoordinationCredentials(input) {
 		current = next;
 		staged = void 0;
 	};
+	let installing = false;
 	const rotate = () => {
-		if (staged) throw new ConfigError("coordination credential replacement is pending");
+		if (installing) throw new ConfigError("coordination credential replacement is pending");
+		if (staged) revoked.set(staged.token.toString(), staged.expiresAt);
 		commit(issue());
 		readerToken = randomToken();
 		controllerToken = randomToken();
 	};
 	const replace = async (install) => {
-		if (staged) throw new ConfigError("coordination credential replacement is pending");
-		const next = issue();
-		staged = next;
+		if (installing) throw new ConfigError("coordination credential replacement is pending");
+		if (!staged || staged.expiresAt <= Date.now()) staged = issue();
+		const next = staged;
+		installing = true;
 		try {
 			await install(next.headers);
 			commit(next, true);
-		} catch (error) {
-			staged = void 0;
-			revoked.set(next.token.toString(), next.expiresAt);
-			throw error;
+		} finally {
+			installing = false;
 		}
 	};
 	const matches = (supplied, expected) => supplied.length === expected.length && timingSafeEqual(supplied, expected);
@@ -4291,6 +4294,7 @@ function assertCoordinationTransport(options) {
 }
 /** Response hold cap, under the 60 s MCP tool-call timeout Claude Code and Codex apply. */
 const RESPONSE_FENCE_CAP_MS = 45e3;
+const RENEWAL_RETRY_MAX_MS = 6e4;
 /** The longest a fenced call (`submit_result`, node tools) holds its response before answering with
 *  a receipt: half of `requestTimeoutMs` (beating the transport's 504), at most {@link RESPONSE_FENCE_CAP_MS}. */
 function coordinationResponseFenceMs(requestTimeoutMs) {
@@ -4350,6 +4354,7 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 	} });
 	if ((opts.authentication || opts.onAudit) && (!identity.runId.trim() || !identity.actorId.trim())) throw new ConfigError("authenticated coordination requires a trusted run and actor identity");
 	const state = openCoordinationListenerState();
+	let renewing = false;
 	const stopUnreachable = (reason) => {
 		state.closed = true;
 		try {
@@ -4364,7 +4369,9 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 		lifetimeSignal: lifetime,
 		lifetimeExpiresAt: opts.scope.rootDeadlineAtMs,
 		isClosed: () => state.closed,
-		onExpiredBearer: () => stopUnreachable("coordination credential expired in its holder: no renewal reached it")
+		onExpiredBearer: () => {
+			if (!renewing) stopUnreachable("coordination credential expired in its holder: no renewal reached it");
+		}
 	});
 	const ctx = {
 		opts,
@@ -4440,15 +4447,25 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 			await pending;
 		};
 		stopCredentialBinding = stop;
+		let failures = 0;
 		const schedule = () => {
+			failures = 0;
+			renewing = false;
 			const expiry = credentials.expiresAt;
 			if (!active || state.closed || opts.scope.signal.aborted || lifetime?.aborted || opts.scope.rootDeadlineAtMs !== void 0 && expiry >= opts.scope.rootDeadlineAtMs) return;
 			cancelTimer = armDeadlineTimer(Math.max(1, Math.floor((expiry - Date.now()) / 2)), renew);
 		};
+		const stopped = () => !active || state.closed || opts.scope.signal.aborted || lifetime?.aborted;
+		const retry = (error) => {
+			if (stopped()) return;
+			const paced = error.retryAfterMs ?? 1e3 * 2 ** failures++;
+			console.warn(`[coordination] credential renewal retries: ${errMessage(error)}`);
+			cancelTimer = armDeadlineTimer(Math.min(paced, RENEWAL_RETRY_MAX_MS), renew);
+		};
 		const renew = () => {
-			if (!active || state.closed || opts.scope.signal.aborted || lifetime?.aborted) return;
-			pending = credentials.replace(install);
-			pending.then(schedule, () => stopUnreachable("coordination credential renewal failed"));
+			if (stopped()) return;
+			renewing = true;
+			pending = credentials.replace(install).then(schedule, retry);
 		};
 		refreshBoundCredential = () => {
 			cancelTimer?.();
@@ -4901,14 +4918,12 @@ const CONTENT_FILTER_REFUSAL_LIMIT = 8;
 /** Consecutive identical reconciliation failures of one pending invocation that resolve it. */
 const SAME_PENDING_LIMIT = 2;
 /**
-* Attempts in a row failing on the same Sandbox `PartialFailureError` (a created box whose setup
-* failed) with nothing gained stop the loop: each re-entry meets the same durably bound box. Run
-* queens21-h22-capture-root-1-20261019c re-entered four such boxes 154 times in 37 minutes.
+* Invocations in a row ending in one deterministic failure with nothing gained that stop the agent
+* with no window, so its parent acts at once: a second proves what a third repeats. Over the week
+* to 2026-11-04, us-legal-exploits-20261103b:s1 retried one harness refusal for 2 hours and
+* queens21-h22-capture-root-1-20261019c re-entered four failed boxes 154 times in 37 minutes.
 */
-const SAME_PARTIAL_FAILURE_LIMIT = 2;
-/** A nested manager's harness turns that ended failed alike, gaining nothing, stop it here with
-*  no window, so its parent acts at once (us-legal-exploits-20261103b:s1 retried one 2 hours). */
-const SAME_HARNESS_FAILURE_LIMIT = 3;
+const SAME_DETERMINISTIC_LIMIT = 2;
 /** `deadline` when a deadline cut the run, else `aborted`. Read before classification, which calls
 *  every failure after an abort terminal: 61 of 62 `terminal-error` runs were a cut deadline. */
 function abortStop(signal) {
@@ -4956,11 +4971,13 @@ function driverRetryLimits(run) {
 		transientOutage: Math.max(0, policy.transientOutageMs ?? DEFAULT_TRANSIENT_OUTAGE_MS)
 	};
 }
-const harnessFailure = (error) => causeChain(error).find((cause) => cause instanceof HarnessTurnFailedError);
-/** The stream codes a refusal and the exact result does not, so an absent code matches any. */
+/** A failure compares by the first cause under any pending-reconciliation wrapper. The stream
+*  codes a refusal and the exact result does not, so an absent code matches any. */
 function extend(streak, error, at) {
-	const code = harnessFailure(error)?.errorCode;
-	const text = (code ? errMessage(error).replace(` (${code})`, "") : errMessage(error)).replace(/\d{4}-\d\d-\d\dT[\d:.]+Z?/gu, "<time>").replace(/\b(?=[\da-f-]*\d)[\da-f]{8,}(?:-[\da-f]{4,})*\b/giu, "<id>").replace(/\d{6,}/gu, "<n>");
+	const chain = causeChain(error);
+	const root = chain.find((cause) => !(cause instanceof RetainedExecutionPendingError)) ?? error;
+	const code = chain.find((cause) => cause instanceof HarnessTurnFailedError)?.errorCode;
+	const text = (code ? errMessage(root).replace(` (${code})`, "") : errMessage(root)).replace(/\d{4}-\d\d-\d\dT[\d:.]+Z?/gu, "<time>").replace(/\b(?=[\da-f-]*\d)[\da-f]{8,}(?:-[\da-f]{4,})*\b/giu, "<id>").replace(/\d{6,}/gu, "<n>");
 	if (streak?.error !== text || (streak.code ?? code) !== (code ?? streak.code)) return {
 		error: text,
 		code,
@@ -5118,6 +5135,7 @@ var DriverRetryLoop = class {
 			durationMs: failure.durationMs,
 			error: errMessage(failure.error),
 			classification: failure.classification,
+			...failure.classification === "transient" ? { failureKind: transientFailureKind(failure.error) } : {},
 			madeProgress: failure.progressed
 		};
 	}
@@ -5174,7 +5192,10 @@ var DriverRetryLoop = class {
 		const stop = (() => {
 			if (run.signal.aborted) return abortStop(run.signal);
 			if (!limits.retryEnabled) return "retry-disabled";
-			return budgetStop(run.budget(), limits.now());
+			const byBudget = budgetStop(run.budget(), limits.now());
+			if (byBudget) return byBudget;
+			const deadline = run.budget().deadlineMs;
+			return deadline > 0 && (reportedResetAt(error) ?? 0) >= deadline ? "deadline" : void 0;
 		})();
 		const unavailableSignal = upstreamUnavailableSignal(error) ?? "unavailable";
 		if (stop !== void 0) {
@@ -5187,7 +5208,7 @@ var DriverRetryLoop = class {
 		this.pauses += 1;
 		this.consecutivePauses = progressed ? 1 : this.consecutivePauses + 1;
 		const pausedAt = limits.now();
-		const resetAt = unavailableResumeAt(errMessage(error), pausedAt);
+		const resetAt = unavailableResumeAt(reportedResetAt(error), pausedAt);
 		const deadlineMs = run.budget().deadlineMs;
 		const pause = resetAt === void 0 ? jitteredMs(unavailablePauseMs(this.consecutivePauses, limits.policy), limits.random) : Math.max(1e3, Math.min(resetAt, deadlineMs > 0 ? deadlineMs : resetAt) - pausedAt);
 		const exitCode = undispatchedCredentialExit(error);
@@ -5255,15 +5276,17 @@ var DriverRetryLoop = class {
 		if (!inOutage) this.chargedFailures += 1;
 		const sameFailure = failure.durationMs >= INSTANT_FAILURE_MS ? void 0 : extend(this.sameFailure, error, failedAt);
 		this.sameFailure = sameFailure;
-		const sameIdle = classification === "transient" && !progressed && failure.pending === void 0 ? extend(this.sameIdle, error, failedAt) : void 0;
-		if (failure.pending === void 0 || progressed) this.sameIdle = sameIdle;
+		const kind = classification === "transient" ? transientFailureKind(error) : void 0;
+		if (progressed || kind === void 0 || isContentFilterRefusal(error)) this.sameIdle = void 0;
+		else if (failure.pending === void 0) this.sameIdle = extend(this.sameIdle, error, failedAt);
+		const sameIdle = this.sameIdle;
 		if (run.signal.aborted) return abortStop(run.signal);
 		if (classification === "terminal") return "terminal-error";
 		if (!limits.retryEnabled) return "retry-disabled";
 		const byBudget = budgetStop(run.budget(), failedAt);
 		if (byBudget) return byBudget;
 		if (this.refusals >= CONTENT_FILTER_REFUSAL_LIMIT) return "repeated-failure";
-		if (sameIdle !== void 0 && (causedByPartialFailure(error) ? sameIdle.count >= SAME_PARTIAL_FAILURE_LIMIT : run.nested === true && (harnessFailure(error) !== void 0 ? sameIdle.count >= SAME_HARNESS_FAILURE_LIMIT : repeatedBy(sameIdle, failedAt)))) return "repeated-failure";
+		if (sameIdle !== void 0 && (kind === "deterministic" ? sameIdle.count >= SAME_DETERMINISTIC_LIMIT : run.nested === true && repeatedBy(sameIdle, failedAt))) return "repeated-failure";
 		if (inOutage) return void 0;
 		if (this.chargedFailures >= limits.maxAttempts) return "max-attempts";
 		if (progressed) return repeatedBy(sameFailure, failedAt) ? "repeated-failure" : void 0;
@@ -6763,7 +6786,7 @@ function automaticDriverBackendSupported(backend, coordination) {
 function buildNestedManagerDeps(child) {
 	const { env, seat, admitted, spawnContext } = child;
 	const { options, ownerShare, authorizeDownFor, peerAuditFor } = env.setup;
-	const nestedPerWorker = defaultPerWorker(spawnContext.budget, ownerShare);
+	const nestedPerWorker = defaultPerWorker(spawnContext.budget, ownerShare, options.workerSlots);
 	const runMessageAuthority = authorizeDownFor(admitted.authorized, seat.depth + 1);
 	const authorizeNestedMessage = child.subtreeGraph && runMessageAuthority ? child.subtreeGraph.observeMessages(runMessageAuthority) : runMessageAuthority;
 	const policy = nestedSettlementPolicy(child);
@@ -6920,7 +6943,7 @@ async function storeCoordinationSecret(provider, secrets, name, bind, policy) {
 		if (!(date instanceof Date) || !Number.isFinite(date.getTime())) throw new ValidationError("provider secret receipt has no valid updatedAt");
 		return date.toISOString();
 	};
-	let revision;
+	let revision, adopted = false;
 	const prior = secrets.get(name);
 	if (prior?.binding === bind && prior.ready) return prior.policy;
 	if (prior?.binding === bind) throw new ValidationError("coordination binding is not ready");
@@ -6959,16 +6982,26 @@ async function storeCoordinationSecret(provider, secrets, name, bind, policy) {
 					const authority = (bindings) => canonicalCandidateDigest(bindings?.map(({ ttlSeconds: _, ...binding }) => binding));
 					if (stored.exposeInBox || authority(recovered) !== authority(policy.proxySecrets)) throw new ValidationError("stored coordination policy has different authority");
 					entry.policy = { proxySecrets: recovered };
+					adopted = true;
 				}
 			}
-			revision = stamp(await store.update(name, value, {
-				...entry.policy,
-				expectedUpdatedAt
-			}));
+			try {
+				revision = stamp(await store.update(name, value, {
+					...entry.policy,
+					expectedUpdatedAt
+				}));
+			} catch (error) {
+				if (entry.ready) revision = await store.list().then((rows) => stamp(rows.find((row) => row.name === name)), () => revision);
+				throw error;
+			}
 		});
 		entry.ready = true;
 		return entry.policy;
 	} catch (cause) {
+		if (adopted) {
+			secrets.delete(name);
+			throw cause;
+		}
 		await entry.release().catch((cleanup) => {
 			throw new AggregateError([cause, cleanup], "coordination binding and cleanup failed");
 		});
@@ -8345,10 +8378,14 @@ var ManagerDriveSession = class {
 		}
 		const seatJournalRoot = scopeRetainedOwnerJournalRoot(scope) ?? seatSelection.rootId;
 		this.seatChain ??= new SeatChain(authoredProfile, scope.view.root, seatJournalRoot, seatSelection.journal, seatSelection.select, now, (segment, phase) => seatSelection.onSegment(scope.view.root, segment, phase), async (selection, previous) => {
-			if (previous && previous.seat !== selection.seat) {
-				const sameEnvironment = previous.provider === selection.stage.provider && previous.harness === selection.stage.harness;
-				const checkpoint = await prepareScopeRetainedOwnerSeatSwitch(scope, sameEnvironment ? "same-environment" : "replace-environment");
-				if (!sameEnvironment) this.switchedProviderCheckpointAt = checkpoint.checkpointAt;
+			if (!previous || previous.seat === selection.seat) return;
+			const sameEnvironment = previous.provider === selection.stage.provider && previous.harness === selection.stage.harness;
+			try {
+				const checkpointAt = await prepareScopeRetainedOwnerSeatSwitch(scope, sameEnvironment ? "same-environment" : "replace-environment");
+				if (!sameEnvironment) this.switchedProviderCheckpointAt = checkpointAt;
+			} catch (error) {
+				scope.signal.throwIfAborted();
+				throw new SeatPauseError(new Date(now() + SEAT_RECHECK_MS).toISOString(), `seat switch waits: ${errorText(error instanceof Error ? error.message : error)}`);
 			}
 		});
 		const usageLimit = reentry?.reason.reason === "upstream-unavailable" && reentry.reason.signal === "subscription-usage-limit";
@@ -8371,13 +8408,14 @@ var ManagerDriveSession = class {
 			if (afterRecheck) await seatSelection.onPause(scope.view.root, "", "resumed");
 			return seat;
 		} catch (error) {
-			if (!(error instanceof SeatChainExhaustedError)) throw error;
+			if (!(error instanceof SeatPauseError)) throw error;
 			if (error.resumeAt !== pausedUntil) {
 				pausedUntil = error.resumeAt;
 				await seatSelection.journal.appendEvent(seatJournalRoot, {
 					kind: "seat-paused",
 					id: scope.view.root,
 					resumeAt: error.resumeAt,
+					...error.detail === void 0 ? {} : { detail: error.detail },
 					seq: Date.parse(error.resumeAt),
 					at: new Date(now()).toISOString()
 				});
@@ -8848,7 +8886,7 @@ function providerSpawnPreflight(provider) {
 	const validate = provider.validateProfile?.bind(provider);
 	if (validate === void 0) return void 0;
 	return async (profile) => {
-		const result = await validate(profile);
+		const result = await validate(providerVisibleProfile(profile));
 		const errors = result.issues.filter((issue) => issue.level === "error");
 		if (result.ok && errors.length === 0) return void 0;
 		const named = errors.map((issue) => `${issue.code}${issue.path === void 0 ? "" : ` at ${issue.path}`}: ${issue.message}`);
@@ -8858,6 +8896,23 @@ function providerSpawnPreflight(provider) {
 		};
 	};
 }
+/** Refuse a Runtime-managed child whose model controls its executor would refuse at its first
+*  attempt (an unknown `model.metadata` key, an ambiguous `maxTokens`): the same check, at the call. */
+function modelSettingsSpawnPreflight(runtimeOwnsManager, path) {
+	if (!runtimeOwnsManager) return void 0;
+	return async (profile) => {
+		try {
+			profileModelExecutionSettings(profile, "spawn_worker", path);
+			return;
+		} catch (error) {
+			if (!(error instanceof ConfigError)) throw error;
+			return {
+				cause: "unprovisionable-profile",
+				detail: error.message
+			};
+		}
+	};
+}
 /** Refuse a Runtime-managed child whose declared tools cannot exist on its execution path. */
 function profileToolSpawnPreflight(runtimeOwnsManager, canResolveProductTools) {
 	return async (profile) => {
@@ -9120,7 +9175,7 @@ function resolveRunRegistry(options) {
 function admitPerWorker(options) {
 	assertRecursiveReservationPolicy(options.reservationPolicy);
 	const ownerShare = options.reservationPolicy?.ownerShare ?? 0;
-	const perWorker = options.perWorker ?? defaultPerWorker(options.budget, ownerShare);
+	const perWorker = options.perWorker ?? defaultPerWorker(options.budget, ownerShare, options.workerSlots);
 	assertValidBudget(perWorker, "supervise perWorker");
 	assertPerWorkerWithinPool(perWorker, options.budget);
 	if (options.perWorker !== void 0) assertPerWorkerAdmittable(perWorker, options.budget, ownerShare);
@@ -9151,7 +9206,7 @@ function managerDriverPlan(options, canonicalProfile, externalRoot) {
 	if (authoredSeatStages(canonicalProfile) && !hasCustomDriveHarness && !options.selectSeat) throw new ValidationError("supervise: AgentProfile.seats requires selectSeat before execution");
 	const automaticDriver = managerBackend !== void 0 && automaticDriverBackendSupported(managerBackend, options.coordination);
 	const spawnResourceRoot = hasCustomDriveHarness ? void 0 : rootSpawnResourceRoot(managerBackend);
-	const spawnPreflight = composeSpawnPreflights(profileToolSpawnPreflight(options.makeWorkerAgent === void 0, options.resolveSupervisorTools !== void 0), coordinationChannelSpawnPreflight(options.makeWorkerAgent === void 0, hasCustomDriveHarness, managerBackend, options.coordination), options.backend?.backend === "bridge" ? bridgeSpawnPreflight(options.backend) : void 0, options.backend?.backend === "provider" && typeof options.backend.provider === "object" ? providerSpawnPreflight(options.backend.provider) : void 0);
+	const spawnPreflight = composeSpawnPreflights(modelSettingsSpawnPreflight(options.makeWorkerAgent === void 0, options.backend?.backend === "provider" ? "provider" : "router"), profileToolSpawnPreflight(options.makeWorkerAgent === void 0, options.resolveSupervisorTools !== void 0), coordinationChannelSpawnPreflight(options.makeWorkerAgent === void 0, hasCustomDriveHarness, managerBackend, options.coordination), options.backend?.backend === "bridge" ? bridgeSpawnPreflight(options.backend) : void 0, options.backend?.backend === "provider" && typeof options.backend.provider === "object" ? providerSpawnPreflight(options.backend.provider) : void 0);
 	const driverMaterialization = hasCustomDriveHarness ? options.driveHarnessMaterialization ?? fullProfileMaterialization : managerBackend && automaticDriver ? backendProfileMaterialization(managerBackend) : void 0;
 	if (externalRoot && !hasCustomDriveHarness && !automaticDriver) throw new ValidationError(`supervise: external supervisor profile.harness=${JSON.stringify(canonicalProfile.harness)} requires a local bridge, a provider with authenticated coordination.publicUrl and runtime MCP attachments, or an explicit driveHarness with reachable coordination transport`);
 	return {
@@ -9439,4 +9494,4 @@ function superviseWithContext(profile, task, opts, brain) {
 }
 export { analyzesFindingsReportPrompt as A, anyOf as B, flowRootProfile as C, defaultEdgeTraversalCap as D, validateFlowGraph as E, formatPromptHandle as F, bestSoFar as G, plateau as H, kernelPromptRegistry as I, createSupervisorSpanRecorder as J, plateauLength as K, naiveContinuationPrompt as L, delegatesWorkerBriefPrompt as M, dumbContinuationFailPrompt as N, graphRootProfile as O, dumbContinuationPassPrompt as P, promptHandle as R, createFlowRun as S, routeFlowOf as T, anytimeReport as U, noProgressFor as V, areaUnderCurve as W, coordinationControlToolNames as _, superviseRootProfile as a, createGraphOverlay as b, retryPreSpawnRefusals as c, supervisorAgent as d, supervisorAgentWithTestBrain as f, serveCoordinationMcp as g, composeReentryTask as h, profileGuidanceComposer as i, createPromptRegistry as j, validateGraphTopology as k, withWorkerSpawnRetry as l, UNPROVEN_CONTINUITY as m, superviseFleetCapabilities as n, isPreSpawnExecutorFailure as o, runToolSpans as p, renderAnytimeTable as q, superviseWithTestBrain as r, resolveWorkerSpawnRetry as s, supervise as t, workerFromBackend as u, driverAgent as v, journaledGateDecider as w, GraphRouteError as x, runBrainLoop as y, allWorkersStalled as z };
 
-//# sourceMappingURL=supervise-BO9acmsB.js.map
+//# sourceMappingURL=supervise-MAzd0hOk.js.map