@tangle-network/agent-runtime 3.0.43 → 4.0.0

package/dist/{supervise-472pyfgQ.js → supervise-MAzd0hOk.js}

@@ -1,15 +1,15 @@
-import { $n as persistHarnessTranscript, At as beginScopeRetainedOwnerDrive, B as beginScopeOwnerAttempt, Cr as inheritRuntimeOwnedExecutorAttestation, Di as spendFromUsageTotals, Dr as providerAttemptEvidence, Dt as prepareScopeRetainedOwnerTask, Et as consumeScopeRetainedOwnerResult, Fr as runtimeOwnedExecutorMaterialization, Ft as scopeRetainedOwnerRestorePoint, G as scopeOwnerExecutorNodeContext, Gr as runtimeFlowBrain, H as noteScopeOwnerPlannedExecution, Ht as scopeRetainedOwnerJournalRoot, Ir as runtimeOwnedExecutorProviderEvidence, It as noteScopeRetainedOwnerCoordination, J as providerVisibleProfile, K as coordinationMcpAlias, Lr as runtimeOwnedPendingExecutorMaterialization, Mt as scopeRetainedOwnerTurnEnded, Nr as runtimeOwnedDriveHarnessProviderEvidence, Nt as assertRetainedOwnerCoordinationRekey, O as parseWorkerToolTraceArtifact, Oi as assertValidBudget, Or as recordRuntimeOwnedDriveHarnessProviderEvidence, Ot as scopeRetainedOwnerPriorSpend, Pr as runtimeOwnedExecutorExecutionBinding, Pt as reconcileScopeRetainedOwnerEnvironment, Q as assertRecursiveReservationPolicy, Rr as runtimeOwnedScopeOwnerRuntime, Rt as bindScopeRetainedOwnerEnvironmentId, St as scopeRetainedOwnerResourceReader, Ti as newUsageTotals, Tt as abandonScopeRetainedOwnerInvocation, U as recordScopeOwnerMaterialization, Ur as isRuntimeFlowBrain, Vn as generateSpanId, Vt as scopeRetainedOwnerContext, W as restoreScopeOwnerAcceptedExecution, Wr as runtimeFlowAgent, Y as runtimeGraphMetadataKey, Zi as recordValue, _i as contentAddress, a as readRootStream, aa as RunCancellationReason, br as authoredAgentIdentity, bt as prepareScopeRetainedOwnerSeatSwitch, ca as runAbortable, ct as recordScopeOwnerBarrenPause, dr as SeatChain, ei as RetainedExecutionPendingError, er as readHarnessTranscript, fi as unavailablePauseMs, fr as SeatChainExhaustedError, ii as registerRetainedExecutorPreparation, kn as WORKER_TRACE_PROPAGATION, kt as scopeRetainedOwnerResult, li as cappedDoublingMs, lr as isLiveNodeStatus, lt as recordScopeOwnerDriverAttempt, mr as seatExecutionProfile, n as ROOT_STREAM_FILE, oi as retainedExecutorSeamKey, or as createActivityLog, ot as meterRuntimeOwnedAccounting, pi as unavailableResumeAt, pr as authoredSeatStages, q as coordinationProfileToolPrefix, r as createRootStreamSink, sa as linkAbort, st as meterRuntimeOwnedProviderAttempt, ui as jitteredMs, ur as isTerminalNodeStatus, ut as recordScopeOwnerPause, wi as meterUsageEvent, xt as releaseScopeRetainedOwnerForSeatPause, yi as executorFailure, yr as attestRuntimeOwnedScopeOwner, zn as createOtelExporter, zt as bindScopeRetainedOwnerProvider } from "./scope-Bg1uCsPR.js";
+import { $n as persistHarnessTranscript, Ai as spendFromUsageTotals, At as beginScopeRetainedOwnerDrive, B as beginScopeOwnerAttempt, Di as meterUsageEvent, Dt as prepareScopeRetainedOwnerTask, Et as consumeScopeRetainedOwnerResult, Fr as runtimeOwnedExecutorExecutionBinding, Ft as scopeRetainedOwnerRestorePoint, G as scopeOwnerExecutorNodeContext, Gr as runtimeFlowAgent, H as noteScopeOwnerPlannedExecution, Ht as scopeRetainedOwnerJournalRoot, Ir as runtimeOwnedExecutorMaterialization, It as noteScopeRetainedOwnerCoordination, J as providerVisibleProfile, K as coordinationMcpAlias, Kr as runtimeFlowBrain, Lr as runtimeOwnedExecutorProviderEvidence, Mt as scopeRetainedOwnerTurnEnded, Nt as assertRetainedOwnerCoordinationRekey, O as parseWorkerToolTraceArtifact, Oi as newUsageTotals, Or as providerAttemptEvidence, Ot as scopeRetainedOwnerPriorSpend, Pr as runtimeOwnedDriveHarnessProviderEvidence, Pt as reconcileScopeRetainedOwnerEnvironment, Q as assertRecursiveReservationPolicy, Rr as runtimeOwnedPendingExecutorMaterialization, Rt as bindScopeRetainedOwnerEnvironmentId, St as scopeRetainedOwnerResourceReader, Tt as abandonScopeRetainedOwnerInvocation, U as recordScopeOwnerMaterialization, Vn as generateSpanId, Vt as scopeRetainedOwnerContext, W as restoreScopeOwnerAcceptedExecution, Wr as isRuntimeFlowBrain, Y as runtimeGraphMetadataKey, a as readRootStream, ai as registerRetainedExecutorPreparation, br as attestRuntimeOwnedScopeOwner, bt as prepareScopeRetainedOwnerSeatSwitch, ca as RunCancellationReason, ct as recordScopeOwnerBarrenPause, da as runAbortable, di as jitteredMs, dr as SEAT_RECHECK_MS, ea as recordValue, er as readHarnessTranscript, fr as SeatChain, hi as unavailableResumeAt, hr as seatExecutionProfile, ji as assertValidBudget, kn as WORKER_TRACE_PROPAGATION, kr as recordRuntimeOwnedDriveHarnessProviderEvidence, kt as scopeRetainedOwnerResult, lr as isLiveNodeStatus, lt as recordScopeOwnerDriverAttempt, mi as unavailablePauseMs, mr as authoredSeatStages, n as ROOT_STREAM_FILE, or as createActivityLog, ot as meterRuntimeOwnedAccounting, pi as reportedResetAt, pr as SeatPauseError, q as coordinationProfileToolPrefix, r as createRootStreamSink, si as retainedExecutorSeamKey, st as meterRuntimeOwnedProviderAttempt, ti as RetainedExecutionPendingError, ua as linkAbort, ui as cappedDoublingMs, ur as isTerminalNodeStatus, ut as recordScopeOwnerPause, wr as inheritRuntimeOwnedExecutorAttestation, xi as executorFailure, xr as authoredAgentIdentity, xt as releaseScopeRetainedOwnerForSeatPause, yi as contentAddress, zn as createOtelExporter, zr as runtimeOwnedScopeOwnerRuntime, zt as bindScopeRetainedOwnerProvider } from "./scope-CJ7xtrs8.js";
 import { f as RuntimeRunStateError, i as ConfigError, m as ValidationError } from "./errors-AzSuGI23.js";
 import { $ as isAsyncIterable, Dt as teardownExecutor, G as chargedTokens, Ot as teardownSurfaces, St as armDeadlineTimer, Tt as isDeadlineAbortReason, U as addSpend, Y as errorMessage, at as sleep, bt as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, dt as zeroSpend, gt as withBudgetResources, ht as resourceTelemetry, lt as unmeteredSpend, pt as addResourceSpend, tt as promptCacheTokenClasses, ut as withTimeout } from "./workspace-streams-8ALHaZzx.js";
-import { d as detachedSnapshot, h as errorHttpStatus, m as errMessage, p as causeChain } from "./jsonl-file-CbxMVnUj.js";
-import { $t as promptModelProfileMaterialization, At as bridgeModelRouteRefusal, B as createRouterTranscript, C as createExecutor, Ct as admitContinuationPolicy, Et as createContinuationKeeper, F as codeModeArguments, I as codeModeModelOutput, Jt as controlProfileMaterialization, Kt as assertProfileMaterialization, L as createCodeModeTools, Qt as promptControlProfileMaterialization, Rt as bridgeRuntimeAttachmentsKey, S as captureReusableExecutorConfig, St as CONTINUATIONS_DIR, Tt as checkVerdictOf, U as resolveAgentEnvironmentProvider, V as routerBrain, X as createInbox, Xt as fullProfileMaterialization, Y as INBOX_RECEIPT_KEY, Yt as defineProfileMaterializationContract, Zt as profileMaterializationAxes$1, _t as CheckUnavailableError, a as assertRunParking, c as sleepScopeWait, ct as HarnessTurnFailedError, d as runFinalizer, dt as isContentFilterRefusal, en as renderUnsupported, et as PEER_MAIL_WIRE_KEY, f as runTree, ft as summarizeDriverAttempts, g as isDriverSpec, gt as preflightPublicCoordination, h as driverExecutorFactory, ht as upstreamUnavailableSignal, i as RunParkedError, in as worktreeCliProfileMaterialization, kt as bridgeAdmissionRefusal, l as withRunParking, lt as abandonablePending, m as driverChild, mt as undispatchedCredentialExit, n as createSupervisor, nn as sandboxProfileMaterialization, o as bindScopeParkingDrain, p as createRootHandle, pt as transientFailureKind, rn as unsupportedProfileDimensions, rt as isPeerMailEnvelope, st as DriverAttemptsExhaustedError, u as bestDelivered, ut as classifyDriverFailure, vt as gateFactoryOnDeliverable, w as snapshotExecutorConfig, wt as bestComposite, x as bindReusableExecutorExecutionId, z as toolResultText, zt as bridgeStopSignalKey } from "./supervisor-BDOWzyCC.js";
+import { _ as errorText, d as detachedSnapshot, h as errorHttpStatus, m as errMessage, p as causeChain } from "./jsonl-file-CvPuwM0a.js";
+import { $t as promptModelProfileMaterialization, At as bridgeModelRouteRefusal, B as createRouterTranscript, C as createExecutor, Ct as admitContinuationPolicy, Et as createContinuationKeeper, F as codeModeArguments, I as codeModeModelOutput, Jt as controlProfileMaterialization, Kt as assertProfileMaterialization, L as createCodeModeTools, Qt as promptControlProfileMaterialization, Rt as bridgeRuntimeAttachmentsKey, S as captureReusableExecutorConfig, St as CONTINUATIONS_DIR, Tt as checkVerdictOf, U as resolveAgentEnvironmentProvider, V as routerBrain, X as createInbox, Xt as fullProfileMaterialization, Y as INBOX_RECEIPT_KEY, Yt as defineProfileMaterializationContract, Zt as profileMaterializationAxes$1, _t as CheckUnavailableError, a as assertRunParking, c as sleepScopeWait, ct as HarnessTurnFailedError, d as runFinalizer, dt as isContentFilterRefusal, en as renderUnsupported, et as PEER_MAIL_WIRE_KEY, f as runTree, ft as summarizeDriverAttempts, g as isDriverSpec, gt as preflightPublicCoordination, h as driverExecutorFactory, ht as upstreamUnavailableSignal, i as RunParkedError, in as worktreeCliProfileMaterialization, kt as bridgeAdmissionRefusal, l as withRunParking, lt as abandonablePending, m as driverChild, mt as undispatchedCredentialExit, n as createSupervisor, nn as sandboxProfileMaterialization, o as bindScopeParkingDrain, p as createRootHandle, pt as transientFailureKind, rn as unsupportedProfileDimensions, rt as isPeerMailEnvelope, st as DriverAttemptsExhaustedError, u as bestDelivered, ut as classifyDriverFailure, vt as gateFactoryOnDeliverable, w as snapshotExecutorConfig, wt as bestComposite, x as bindReusableExecutorExecutionId, z as toolResultText, zt as bridgeStopSignalKey } from "./supervisor-CwANBb9-.js";
 import { _ as agentHarness, a as concreteProfileModel, c as profileModelExecutionSettings, l as profileProviderModel, n as assertModelAllowed, o as enforceTokenLimits, r as assertProfileModelsAllowed, s as profileBridgeWireModel, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-JOcg3NRs.js";
 import { n as createStdioToolServer } from "./tool-server-CZWd_Opp.js";
 import { t as composeRuntimeHooks } from "./runtime-hooks-CsW2pfFk.js";
-import { _ as workerAssignmentNamespace, c as writeRunCancellation, d as coordinationEventId, f as externalExecutionId, g as supervisionRunNamespace, h as rootCoordinationOwner, i as readRunCancellation, l as canonicalExecution, m as freezeDetachedProfile, p as freezeDetached, r as readRunCancelRequest, s as watchRunCancellation, t as applyRunCancellation, u as childCoordinationOwner } from "./run-cancellation-DEW04dun.js";
-import { c as createSteerAcknowledger, d as coordinationVerbNames, f as createFileRunContext, l as budgetOverspendText, m as withRunContext, n as createCoordinationToolsForManager, p as createInMemoryRunContext, s as createCancelAcknowledger, t as createCoordinationTools, u as normalizeAnalyzeOnSettle } from "./coordination-manager-DXOwLu9T.js";
-import { o as safeJsonText } from "./coordination-map-routing-2_hUlTnz.js";
-import { a as graphRegistry, c as loadGraph } from "./graph-registry-BoaUV5g8.js";
+import { _ as workerAssignmentNamespace, c as writeRunCancellation, d as coordinationEventId, f as externalExecutionId, g as supervisionRunNamespace, h as rootCoordinationOwner, i as readRunCancellation, l as canonicalExecution, m as freezeDetachedProfile, p as freezeDetached, r as readRunCancelRequest, s as watchRunCancellation, t as applyRunCancellation, u as childCoordinationOwner } from "./run-cancellation-CGgk54Md.js";
+import { c as createSteerAcknowledger, d as coordinationVerbNames, f as createFileRunContext, l as budgetOverspendText, m as withRunContext, n as createCoordinationToolsForManager, p as createInMemoryRunContext, s as createCancelAcknowledger, t as createCoordinationTools, u as normalizeAnalyzeOnSettle } from "./coordination-manager-C-ZoeZ73.js";
+import { o as safeJsonText } from "./coordination-map-routing-SnsZp287.js";
+import { a as graphRegistry, c as loadGraph } from "./graph-registry-CI1o16DH.js";
 import { ATTR, agentIdentityAttributes } from "@tangle-network/agent-trace-contract";
 import { ProxySecretScopeSchema, ProxySecretsSchema, agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalCandidateJson, mergeProxySecretBindings, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { toolSpansToTraceAnalysisStore } from "@tangle-network/agent-eval";
@@ -2451,11 +2451,13 @@ function assertPerWorkerAdmittable(perWorker, pool, ownerShare) {
 	].filter((x) => x !== null);
 	if (unadmittable.length > 0) throw new ValidationError(`${unadmittable.join("; ")} — lower perWorker on that channel so a child fits beside the owner's own turns; otherwise children are refused or starve at spawn hours into the run.`);
 }
-/** The slice a child gets when its manager names none: a quarter of the part of the manager's
-*  budget its children may reserve, so four default children fill that part and the manager's
-*  own share stays free for its turns. Each nested manager divides its own slice the same way. */
-function defaultPerWorker(budget, ownerShare) {
-	const share = (1 - ownerShare) / 4;
+/** The slice a child gets when its manager names none: the part of the manager's budget its
+*  children may reserve, divided by the run's worker slots (four with none), so the slots, not the
+*  budget, set how many run at once. A quarter share capped managers with 8-15 slots at 2-4
+*  children (zro-w4a16-hopper-20261104b held 4 of 8; canary-soak-20261104a queued s5-s7 163-176 s). */
+function defaultPerWorker(budget, ownerShare, workerSlots) {
+	const slots = typeof workerSlots === "number" ? workerSlots : workerSlots?.max;
+	const share = (1 - ownerShare) / (slots !== void 0 && slots > 0 ? slots : 4);
 	return {
 		...budget.resources === void 0 ? {} : { resources: Object.fromEntries(Object.entries(budget.resources).map(([name, value]) => [name, {
 			unit: value.unit,
@@ -3590,23 +3592,24 @@ function createCoordinationCredentials(input) {
 		current = next;
 		staged = void 0;
 	};
+	let installing = false;
 	const rotate = () => {
-		if (staged) throw new ConfigError("coordination credential replacement is pending");
+		if (installing) throw new ConfigError("coordination credential replacement is pending");
+		if (staged) revoked.set(staged.token.toString(), staged.expiresAt);
 		commit(issue());
 		readerToken = randomToken();
 		controllerToken = randomToken();
 	};
 	const replace = async (install) => {
-		if (staged) throw new ConfigError("coordination credential replacement is pending");
-		const next = issue();
-		staged = next;
+		if (installing) throw new ConfigError("coordination credential replacement is pending");
+		if (!staged || staged.expiresAt <= Date.now()) staged = issue();
+		const next = staged;
+		installing = true;
 		try {
 			await install(next.headers);
 			commit(next, true);
-		} catch (error) {
-			staged = void 0;
-			revoked.set(next.token.toString(), next.expiresAt);
-			throw error;
+		} finally {
+			installing = false;
 		}
 	};
 	const matches = (supplied, expected) => supplied.length === expected.length && timingSafeEqual(supplied, expected);
@@ -4291,6 +4294,7 @@ function assertCoordinationTransport(options) {
 }
 /** Response hold cap, under the 60 s MCP tool-call timeout Claude Code and Codex apply. */
 const RESPONSE_FENCE_CAP_MS = 45e3;
+const RENEWAL_RETRY_MAX_MS = 6e4;
 /** The longest a fenced call (`submit_result`, node tools) holds its response before answering with
 *  a receipt: half of `requestTimeoutMs` (beating the transport's 504), at most {@link RESPONSE_FENCE_CAP_MS}. */
 function coordinationResponseFenceMs(requestTimeoutMs) {
@@ -4350,6 +4354,7 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 	} });
 	if ((opts.authentication || opts.onAudit) && (!identity.runId.trim() || !identity.actorId.trim())) throw new ConfigError("authenticated coordination requires a trusted run and actor identity");
 	const state = openCoordinationListenerState();
+	let renewing = false;
 	const stopUnreachable = (reason) => {
 		state.closed = true;
 		try {
@@ -4364,7 +4369,9 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 		lifetimeSignal: lifetime,
 		lifetimeExpiresAt: opts.scope.rootDeadlineAtMs,
 		isClosed: () => state.closed,
-		onExpiredBearer: () => stopUnreachable("coordination credential expired in its holder: no renewal reached it")
+		onExpiredBearer: () => {
+			if (!renewing) stopUnreachable("coordination credential expired in its holder: no renewal reached it");
+		}
 	});
 	const ctx = {
 		opts,
@@ -4440,15 +4447,25 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 			await pending;
 		};
 		stopCredentialBinding = stop;
+		let failures = 0;
 		const schedule = () => {
+			failures = 0;
+			renewing = false;
 			const expiry = credentials.expiresAt;
 			if (!active || state.closed || opts.scope.signal.aborted || lifetime?.aborted || opts.scope.rootDeadlineAtMs !== void 0 && expiry >= opts.scope.rootDeadlineAtMs) return;
 			cancelTimer = armDeadlineTimer(Math.max(1, Math.floor((expiry - Date.now()) / 2)), renew);
 		};
+		const stopped = () => !active || state.closed || opts.scope.signal.aborted || lifetime?.aborted;
+		const retry = (error) => {
+			if (stopped()) return;
+			const paced = error.retryAfterMs ?? 1e3 * 2 ** failures++;
+			console.warn(`[coordination] credential renewal retries: ${errMessage(error)}`);
+			cancelTimer = armDeadlineTimer(Math.min(paced, RENEWAL_RETRY_MAX_MS), renew);
+		};
 		const renew = () => {
-			if (!active || state.closed || opts.scope.signal.aborted || lifetime?.aborted) return;
-			pending = credentials.replace(install);
-			pending.then(schedule, () => stopUnreachable("coordination credential renewal failed"));
+			if (stopped()) return;
+			renewing = true;
+			pending = credentials.replace(install).then(schedule, retry);
 		};
 		refreshBoundCredential = () => {
 			cancelTimer?.();
@@ -5175,7 +5192,10 @@ var DriverRetryLoop = class {
 		const stop = (() => {
 			if (run.signal.aborted) return abortStop(run.signal);
 			if (!limits.retryEnabled) return "retry-disabled";
-			return budgetStop(run.budget(), limits.now());
+			const byBudget = budgetStop(run.budget(), limits.now());
+			if (byBudget) return byBudget;
+			const deadline = run.budget().deadlineMs;
+			return deadline > 0 && (reportedResetAt(error) ?? 0) >= deadline ? "deadline" : void 0;
 		})();
 		const unavailableSignal = upstreamUnavailableSignal(error) ?? "unavailable";
 		if (stop !== void 0) {
@@ -5188,7 +5208,7 @@ var DriverRetryLoop = class {
 		this.pauses += 1;
 		this.consecutivePauses = progressed ? 1 : this.consecutivePauses + 1;
 		const pausedAt = limits.now();
-		const resetAt = unavailableResumeAt(errMessage(error), pausedAt);
+		const resetAt = unavailableResumeAt(reportedResetAt(error), pausedAt);
 		const deadlineMs = run.budget().deadlineMs;
 		const pause = resetAt === void 0 ? jitteredMs(unavailablePauseMs(this.consecutivePauses, limits.policy), limits.random) : Math.max(1e3, Math.min(resetAt, deadlineMs > 0 ? deadlineMs : resetAt) - pausedAt);
 		const exitCode = undispatchedCredentialExit(error);
@@ -6766,7 +6786,7 @@ function automaticDriverBackendSupported(backend, coordination) {
 function buildNestedManagerDeps(child) {
 	const { env, seat, admitted, spawnContext } = child;
 	const { options, ownerShare, authorizeDownFor, peerAuditFor } = env.setup;
-	const nestedPerWorker = defaultPerWorker(spawnContext.budget, ownerShare);
+	const nestedPerWorker = defaultPerWorker(spawnContext.budget, ownerShare, options.workerSlots);
 	const runMessageAuthority = authorizeDownFor(admitted.authorized, seat.depth + 1);
 	const authorizeNestedMessage = child.subtreeGraph && runMessageAuthority ? child.subtreeGraph.observeMessages(runMessageAuthority) : runMessageAuthority;
 	const policy = nestedSettlementPolicy(child);
@@ -6923,7 +6943,7 @@ async function storeCoordinationSecret(provider, secrets, name, bind, policy) {
 		if (!(date instanceof Date) || !Number.isFinite(date.getTime())) throw new ValidationError("provider secret receipt has no valid updatedAt");
 		return date.toISOString();
 	};
-	let revision;
+	let revision, adopted = false;
 	const prior = secrets.get(name);
 	if (prior?.binding === bind && prior.ready) return prior.policy;
 	if (prior?.binding === bind) throw new ValidationError("coordination binding is not ready");
@@ -6962,16 +6982,26 @@ async function storeCoordinationSecret(provider, secrets, name, bind, policy) {
 					const authority = (bindings) => canonicalCandidateDigest(bindings?.map(({ ttlSeconds: _, ...binding }) => binding));
 					if (stored.exposeInBox || authority(recovered) !== authority(policy.proxySecrets)) throw new ValidationError("stored coordination policy has different authority");
 					entry.policy = { proxySecrets: recovered };
+					adopted = true;
 				}
 			}
-			revision = stamp(await store.update(name, value, {
-				...entry.policy,
-				expectedUpdatedAt
-			}));
+			try {
+				revision = stamp(await store.update(name, value, {
+					...entry.policy,
+					expectedUpdatedAt
+				}));
+			} catch (error) {
+				if (entry.ready) revision = await store.list().then((rows) => stamp(rows.find((row) => row.name === name)), () => revision);
+				throw error;
+			}
 		});
 		entry.ready = true;
 		return entry.policy;
 	} catch (cause) {
+		if (adopted) {
+			secrets.delete(name);
+			throw cause;
+		}
 		await entry.release().catch((cleanup) => {
 			throw new AggregateError([cause, cleanup], "coordination binding and cleanup failed");
 		});
@@ -8348,10 +8378,14 @@ var ManagerDriveSession = class {
 		}
 		const seatJournalRoot = scopeRetainedOwnerJournalRoot(scope) ?? seatSelection.rootId;
 		this.seatChain ??= new SeatChain(authoredProfile, scope.view.root, seatJournalRoot, seatSelection.journal, seatSelection.select, now, (segment, phase) => seatSelection.onSegment(scope.view.root, segment, phase), async (selection, previous) => {
-			if (previous && previous.seat !== selection.seat) {
-				const sameEnvironment = previous.provider === selection.stage.provider && previous.harness === selection.stage.harness;
-				const checkpoint = await prepareScopeRetainedOwnerSeatSwitch(scope, sameEnvironment ? "same-environment" : "replace-environment");
-				if (!sameEnvironment) this.switchedProviderCheckpointAt = checkpoint.checkpointAt;
+			if (!previous || previous.seat === selection.seat) return;
+			const sameEnvironment = previous.provider === selection.stage.provider && previous.harness === selection.stage.harness;
+			try {
+				const checkpointAt = await prepareScopeRetainedOwnerSeatSwitch(scope, sameEnvironment ? "same-environment" : "replace-environment");
+				if (!sameEnvironment) this.switchedProviderCheckpointAt = checkpointAt;
+			} catch (error) {
+				scope.signal.throwIfAborted();
+				throw new SeatPauseError(new Date(now() + SEAT_RECHECK_MS).toISOString(), `seat switch waits: ${errorText(error instanceof Error ? error.message : error)}`);
 			}
 		});
 		const usageLimit = reentry?.reason.reason === "upstream-unavailable" && reentry.reason.signal === "subscription-usage-limit";
@@ -8374,13 +8408,14 @@ var ManagerDriveSession = class {
 			if (afterRecheck) await seatSelection.onPause(scope.view.root, "", "resumed");
 			return seat;
 		} catch (error) {
-			if (!(error instanceof SeatChainExhaustedError)) throw error;
+			if (!(error instanceof SeatPauseError)) throw error;
 			if (error.resumeAt !== pausedUntil) {
 				pausedUntil = error.resumeAt;
 				await seatSelection.journal.appendEvent(seatJournalRoot, {
 					kind: "seat-paused",
 					id: scope.view.root,
 					resumeAt: error.resumeAt,
+					...error.detail === void 0 ? {} : { detail: error.detail },
 					seq: Date.parse(error.resumeAt),
 					at: new Date(now()).toISOString()
 				});
@@ -8851,7 +8886,7 @@ function providerSpawnPreflight(provider) {
 	const validate = provider.validateProfile?.bind(provider);
 	if (validate === void 0) return void 0;
 	return async (profile) => {
-		const result = await validate(profile);
+		const result = await validate(providerVisibleProfile(profile));
 		const errors = result.issues.filter((issue) => issue.level === "error");
 		if (result.ok && errors.length === 0) return void 0;
 		const named = errors.map((issue) => `${issue.code}${issue.path === void 0 ? "" : ` at ${issue.path}`}: ${issue.message}`);
@@ -8861,6 +8896,23 @@ function providerSpawnPreflight(provider) {
 		};
 	};
 }
+/** Refuse a Runtime-managed child whose model controls its executor would refuse at its first
+*  attempt (an unknown `model.metadata` key, an ambiguous `maxTokens`): the same check, at the call. */
+function modelSettingsSpawnPreflight(runtimeOwnsManager, path) {
+	if (!runtimeOwnsManager) return void 0;
+	return async (profile) => {
+		try {
+			profileModelExecutionSettings(profile, "spawn_worker", path);
+			return;
+		} catch (error) {
+			if (!(error instanceof ConfigError)) throw error;
+			return {
+				cause: "unprovisionable-profile",
+				detail: error.message
+			};
+		}
+	};
+}
 /** Refuse a Runtime-managed child whose declared tools cannot exist on its execution path. */
 function profileToolSpawnPreflight(runtimeOwnsManager, canResolveProductTools) {
 	return async (profile) => {
@@ -9123,7 +9175,7 @@ function resolveRunRegistry(options) {
 function admitPerWorker(options) {
 	assertRecursiveReservationPolicy(options.reservationPolicy);
 	const ownerShare = options.reservationPolicy?.ownerShare ?? 0;
-	const perWorker = options.perWorker ?? defaultPerWorker(options.budget, ownerShare);
+	const perWorker = options.perWorker ?? defaultPerWorker(options.budget, ownerShare, options.workerSlots);
 	assertValidBudget(perWorker, "supervise perWorker");
 	assertPerWorkerWithinPool(perWorker, options.budget);
 	if (options.perWorker !== void 0) assertPerWorkerAdmittable(perWorker, options.budget, ownerShare);
@@ -9154,7 +9206,7 @@ function managerDriverPlan(options, canonicalProfile, externalRoot) {
 	if (authoredSeatStages(canonicalProfile) && !hasCustomDriveHarness && !options.selectSeat) throw new ValidationError("supervise: AgentProfile.seats requires selectSeat before execution");
 	const automaticDriver = managerBackend !== void 0 && automaticDriverBackendSupported(managerBackend, options.coordination);
 	const spawnResourceRoot = hasCustomDriveHarness ? void 0 : rootSpawnResourceRoot(managerBackend);
-	const spawnPreflight = composeSpawnPreflights(profileToolSpawnPreflight(options.makeWorkerAgent === void 0, options.resolveSupervisorTools !== void 0), coordinationChannelSpawnPreflight(options.makeWorkerAgent === void 0, hasCustomDriveHarness, managerBackend, options.coordination), options.backend?.backend === "bridge" ? bridgeSpawnPreflight(options.backend) : void 0, options.backend?.backend === "provider" && typeof options.backend.provider === "object" ? providerSpawnPreflight(options.backend.provider) : void 0);
+	const spawnPreflight = composeSpawnPreflights(modelSettingsSpawnPreflight(options.makeWorkerAgent === void 0, options.backend?.backend === "provider" ? "provider" : "router"), profileToolSpawnPreflight(options.makeWorkerAgent === void 0, options.resolveSupervisorTools !== void 0), coordinationChannelSpawnPreflight(options.makeWorkerAgent === void 0, hasCustomDriveHarness, managerBackend, options.coordination), options.backend?.backend === "bridge" ? bridgeSpawnPreflight(options.backend) : void 0, options.backend?.backend === "provider" && typeof options.backend.provider === "object" ? providerSpawnPreflight(options.backend.provider) : void 0);
 	const driverMaterialization = hasCustomDriveHarness ? options.driveHarnessMaterialization ?? fullProfileMaterialization : managerBackend && automaticDriver ? backendProfileMaterialization(managerBackend) : void 0;
 	if (externalRoot && !hasCustomDriveHarness && !automaticDriver) throw new ValidationError(`supervise: external supervisor profile.harness=${JSON.stringify(canonicalProfile.harness)} requires a local bridge, a provider with authenticated coordination.publicUrl and runtime MCP attachments, or an explicit driveHarness with reachable coordination transport`);
 	return {
@@ -9442,4 +9494,4 @@ function superviseWithContext(profile, task, opts, brain) {
 }
 export { analyzesFindingsReportPrompt as A, anyOf as B, flowRootProfile as C, defaultEdgeTraversalCap as D, validateFlowGraph as E, formatPromptHandle as F, bestSoFar as G, plateau as H, kernelPromptRegistry as I, createSupervisorSpanRecorder as J, plateauLength as K, naiveContinuationPrompt as L, delegatesWorkerBriefPrompt as M, dumbContinuationFailPrompt as N, graphRootProfile as O, dumbContinuationPassPrompt as P, promptHandle as R, createFlowRun as S, routeFlowOf as T, anytimeReport as U, noProgressFor as V, areaUnderCurve as W, coordinationControlToolNames as _, superviseRootProfile as a, createGraphOverlay as b, retryPreSpawnRefusals as c, supervisorAgent as d, supervisorAgentWithTestBrain as f, serveCoordinationMcp as g, composeReentryTask as h, profileGuidanceComposer as i, createPromptRegistry as j, validateGraphTopology as k, withWorkerSpawnRetry as l, UNPROVEN_CONTINUITY as m, superviseFleetCapabilities as n, isPreSpawnExecutorFailure as o, runToolSpans as p, renderAnytimeTable as q, superviseWithTestBrain as r, resolveWorkerSpawnRetry as s, supervise as t, workerFromBackend as u, driverAgent as v, journaledGateDecider as w, GraphRouteError as x, runBrainLoop as y, allWorkersStalled as z };
 
-//# sourceMappingURL=supervise-472pyfgQ.js.map
+//# sourceMappingURL=supervise-MAzd0hOk.js.map