@tangle-network/agent-runtime 3.0.43 → 5.0.0

package/dist/{supervise-472pyfgQ.js → supervise-rYEsVVcn.js}

@@ -1,15 +1,15 @@
-import { $n as persistHarnessTranscript, At as beginScopeRetainedOwnerDrive, B as beginScopeOwnerAttempt, Cr as inheritRuntimeOwnedExecutorAttestation, Di as spendFromUsageTotals, Dr as providerAttemptEvidence, Dt as prepareScopeRetainedOwnerTask, Et as consumeScopeRetainedOwnerResult, Fr as runtimeOwnedExecutorMaterialization, Ft as scopeRetainedOwnerRestorePoint, G as scopeOwnerExecutorNodeContext, Gr as runtimeFlowBrain, H as noteScopeOwnerPlannedExecution, Ht as scopeRetainedOwnerJournalRoot, Ir as runtimeOwnedExecutorProviderEvidence, It as noteScopeRetainedOwnerCoordination, J as providerVisibleProfile, K as coordinationMcpAlias, Lr as runtimeOwnedPendingExecutorMaterialization, Mt as scopeRetainedOwnerTurnEnded, Nr as runtimeOwnedDriveHarnessProviderEvidence, Nt as assertRetainedOwnerCoordinationRekey, O as parseWorkerToolTraceArtifact, Oi as assertValidBudget, Or as recordRuntimeOwnedDriveHarnessProviderEvidence, Ot as scopeRetainedOwnerPriorSpend, Pr as runtimeOwnedExecutorExecutionBinding, Pt as reconcileScopeRetainedOwnerEnvironment, Q as assertRecursiveReservationPolicy, Rr as runtimeOwnedScopeOwnerRuntime, Rt as bindScopeRetainedOwnerEnvironmentId, St as scopeRetainedOwnerResourceReader, Ti as newUsageTotals, Tt as abandonScopeRetainedOwnerInvocation, U as recordScopeOwnerMaterialization, Ur as isRuntimeFlowBrain, Vn as generateSpanId, Vt as scopeRetainedOwnerContext, W as restoreScopeOwnerAcceptedExecution, Wr as runtimeFlowAgent, Y as runtimeGraphMetadataKey, Zi as recordValue, _i as contentAddress, a as readRootStream, aa as RunCancellationReason, br as authoredAgentIdentity, bt as prepareScopeRetainedOwnerSeatSwitch, ca as runAbortable, ct as recordScopeOwnerBarrenPause, dr as SeatChain, ei as RetainedExecutionPendingError, er as readHarnessTranscript, fi as unavailablePauseMs, fr as SeatChainExhaustedError, ii as registerRetainedExecutorPreparation, kn as WORKER_TRACE_PROPAGATION, kt as scopeRetainedOwnerResult, li as cappedDoublingMs, lr as isLiveNodeStatus, lt as recordScopeOwnerDriverAttempt, mr as seatExecutionProfile, n as ROOT_STREAM_FILE, oi as retainedExecutorSeamKey, or as createActivityLog, ot as meterRuntimeOwnedAccounting, pi as unavailableResumeAt, pr as authoredSeatStages, q as coordinationProfileToolPrefix, r as createRootStreamSink, sa as linkAbort, st as meterRuntimeOwnedProviderAttempt, ui as jitteredMs, ur as isTerminalNodeStatus, ut as recordScopeOwnerPause, wi as meterUsageEvent, xt as releaseScopeRetainedOwnerForSeatPause, yi as executorFailure, yr as attestRuntimeOwnedScopeOwner, zn as createOtelExporter, zt as bindScopeRetainedOwnerProvider } from "./scope-Bg1uCsPR.js";
+import { An as WORKER_TRACE_PROPAGATION, Ar as recordRuntimeOwnedDriveHarnessProviderEvidence, At as beginScopeRetainedOwnerDrive, B as beginScopeOwnerAttempt, Bn as createOtelExporter, Ci as executorFailure, Dt as prepareScopeRetainedOwnerTask, Et as consumeScopeRetainedOwnerResult, Fi as assertValidBudget, Fr as runtimeOwnedDriveHarnessProviderEvidence, Ft as scopeRetainedOwnerRestorePoint, G as scopeOwnerExecutorNodeContext, H as noteScopeOwnerPlannedExecution, Hn as generateSpanId, Ht as scopeRetainedOwnerContext, Ir as runtimeOwnedExecutorExecutionBinding, It as noteScopeRetainedOwnerCoordination, J as providerVisibleProfile, Jr as runtimeFlowBrain, K as coordinationMcpAlias, Kr as isRuntimeFlowBrain, Lr as runtimeOwnedExecutorMaterialization, Mi as newUsageTotals, Mt as scopeRetainedOwnerTurnEnded, Nt as assertRetainedOwnerCoordinationRekey, O as parseWorkerToolTraceArtifact, Ot as scopeRetainedOwnerPriorSpend, Pi as spendFromUsageTotals, Pt as reconcileScopeRetainedOwnerEnvironment, Q as assertRecursiveReservationPolicy, Rr as runtimeOwnedExecutorProviderEvidence, Rt as bindScopeRetainedOwnerEnvironmentId, Sr as authoredAgentIdentity, St as scopeRetainedOwnerResourceReader, Tt as abandonScopeRetainedOwnerInvocation, U as recordScopeOwnerMaterialization, Ut as scopeRetainedOwnerJournalRoot, Vr as runtimeOwnedScopeOwnerRuntime, W as restoreScopeOwnerAcceptedExecution, Y as runtimeGraphMetadataKey, _i as unavailableResumeAt, a as readRootStream, bt as prepareScopeRetainedOwnerSeatSwitch, ct as recordScopeOwnerBarrenPause, dr as isTerminalNodeStatus, er as persistHarnessTranscript, fa as RunCancellationReason, fi as cappedDoublingMs, fr as SEAT_RECHECK_MS, gi as unavailablePauseMs, gr as seatExecutionProfile, ha as runAbortable, hi as reportedResetAt, hr as authoredSeatStages, ia as recordValue, ji as meterUsageEvent, kr as providerAttemptEvidence, kt as scopeRetainedOwnerResult, li as retainedExecutorSeamKey, lt as recordScopeOwnerDriverAttempt, ma as linkAbort, mr as SeatPauseError, n as ROOT_STREAM_FILE, ot as meterRuntimeOwnedAccounting, pi as jitteredMs, pr as SeatChain, q as coordinationProfileToolPrefix, qr as runtimeFlowAgent, r as createRootStreamSink, ri as RetainedExecutionPendingError, si as registerRetainedExecutorPreparation, sr as createActivityLog, st as meterRuntimeOwnedProviderAttempt, tr as readHarnessTranscript, ur as isLiveNodeStatus, ut as recordScopeOwnerPause, xi as contentAddress, xr as attestRuntimeOwnedScopeOwner, xt as releaseScopeRetainedOwnerForSeatPause, zr as runtimeOwnedPendingExecutorMaterialization, zt as bindScopeRetainedOwnerProvider } from "./scope-JcCkUy_z.js";
 import { f as RuntimeRunStateError, i as ConfigError, m as ValidationError } from "./errors-AzSuGI23.js";
-import { $ as isAsyncIterable, Dt as teardownExecutor, G as chargedTokens, Ot as teardownSurfaces, St as armDeadlineTimer, Tt as isDeadlineAbortReason, U as addSpend, Y as errorMessage, at as sleep, bt as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, dt as zeroSpend, gt as withBudgetResources, ht as resourceTelemetry, lt as unmeteredSpend, pt as addResourceSpend, tt as promptCacheTokenClasses, ut as withTimeout } from "./workspace-streams-8ALHaZzx.js";
-import { d as detachedSnapshot, h as errorHttpStatus, m as errMessage, p as causeChain } from "./jsonl-file-CbxMVnUj.js";
-import { $t as promptModelProfileMaterialization, At as bridgeModelRouteRefusal, B as createRouterTranscript, C as createExecutor, Ct as admitContinuationPolicy, Et as createContinuationKeeper, F as codeModeArguments, I as codeModeModelOutput, Jt as controlProfileMaterialization, Kt as assertProfileMaterialization, L as createCodeModeTools, Qt as promptControlProfileMaterialization, Rt as bridgeRuntimeAttachmentsKey, S as captureReusableExecutorConfig, St as CONTINUATIONS_DIR, Tt as checkVerdictOf, U as resolveAgentEnvironmentProvider, V as routerBrain, X as createInbox, Xt as fullProfileMaterialization, Y as INBOX_RECEIPT_KEY, Yt as defineProfileMaterializationContract, Zt as profileMaterializationAxes$1, _t as CheckUnavailableError, a as assertRunParking, c as sleepScopeWait, ct as HarnessTurnFailedError, d as runFinalizer, dt as isContentFilterRefusal, en as renderUnsupported, et as PEER_MAIL_WIRE_KEY, f as runTree, ft as summarizeDriverAttempts, g as isDriverSpec, gt as preflightPublicCoordination, h as driverExecutorFactory, ht as upstreamUnavailableSignal, i as RunParkedError, in as worktreeCliProfileMaterialization, kt as bridgeAdmissionRefusal, l as withRunParking, lt as abandonablePending, m as driverChild, mt as undispatchedCredentialExit, n as createSupervisor, nn as sandboxProfileMaterialization, o as bindScopeParkingDrain, p as createRootHandle, pt as transientFailureKind, rn as unsupportedProfileDimensions, rt as isPeerMailEnvelope, st as DriverAttemptsExhaustedError, u as bestDelivered, ut as classifyDriverFailure, vt as gateFactoryOnDeliverable, w as snapshotExecutorConfig, wt as bestComposite, x as bindReusableExecutorExecutionId, z as toolResultText, zt as bridgeStopSignalKey } from "./supervisor-BDOWzyCC.js";
+import { $ as isAsyncIterable, Dt as teardownExecutor, G as chargedTokens, St as armDeadlineTimer, Tt as isDeadlineAbortReason, U as addSpend, Y as errorMessage, at as sleep, bt as DEFAULT_SUCCESSFUL_SHUTDOWN_MS, dt as zeroSpend, gt as withBudgetResources, ht as resourceTelemetry, lt as unmeteredSpend, pt as addResourceSpend, tt as promptCacheTokenClasses, ut as withTimeout } from "./workspace-streams-8ALHaZzx.js";
+import { _ as errorText, d as detachedSnapshot, h as errorHttpStatus, m as errMessage, p as causeChain } from "./jsonl-file-CeVYTIQJ.js";
+import { $t as promptModelProfileMaterialization, At as bridgeModelRouteRefusal, B as createRouterTranscript, C as createExecutor, Ct as admitContinuationPolicy, Et as createContinuationKeeper, F as codeModeArguments, I as codeModeModelOutput, Jt as controlProfileMaterialization, Kt as assertProfileMaterialization, L as createCodeModeTools, Qt as promptControlProfileMaterialization, Rt as bridgeRuntimeAttachmentsKey, S as captureReusableExecutorConfig, St as CONTINUATIONS_DIR, Tt as checkVerdictOf, U as resolveAgentEnvironmentProvider, V as routerBrain, X as createInbox, Xt as fullProfileMaterialization, Y as INBOX_RECEIPT_KEY, Yt as defineProfileMaterializationContract, Zt as profileMaterializationAxes$1, _t as CheckUnavailableError, a as assertRunParking, c as sleepScopeWait, ct as HarnessTurnFailedError, d as runFinalizer, dt as isContentFilterRefusal, en as renderUnsupported, et as PEER_MAIL_WIRE_KEY, f as runTree, ft as summarizeDriverAttempts, g as isDriverSpec, gt as preflightPublicCoordination, h as driverExecutorFactory, ht as upstreamUnavailableSignal, i as RunParkedError, in as worktreeCliProfileMaterialization, kt as bridgeAdmissionRefusal, l as withRunParking, lt as abandonablePending, m as driverChild, mt as undispatchedCredentialExit, n as createSupervisor, nn as sandboxProfileMaterialization, o as bindScopeParkingDrain, p as createRootHandle, pt as transientFailureKind, rn as unsupportedProfileDimensions, rt as isPeerMailEnvelope, st as DriverAttemptsExhaustedError, u as bestDelivered, ut as classifyDriverFailure, vt as gateFactoryOnDeliverable, w as snapshotExecutorConfig, wt as bestComposite, x as bindReusableExecutorExecutionId, z as toolResultText, zt as bridgeStopSignalKey } from "./supervisor-B-bX69uL.js";
 import { _ as agentHarness, a as concreteProfileModel, c as profileModelExecutionSettings, l as profileProviderModel, n as assertModelAllowed, o as enforceTokenLimits, r as assertProfileModelsAllowed, s as profileBridgeWireModel, t as assertExecutableAgentProfile, v as harnessRunsAgent } from "./model-policy-JOcg3NRs.js";
 import { n as createStdioToolServer } from "./tool-server-CZWd_Opp.js";
 import { t as composeRuntimeHooks } from "./runtime-hooks-CsW2pfFk.js";
-import { _ as workerAssignmentNamespace, c as writeRunCancellation, d as coordinationEventId, f as externalExecutionId, g as supervisionRunNamespace, h as rootCoordinationOwner, i as readRunCancellation, l as canonicalExecution, m as freezeDetachedProfile, p as freezeDetached, r as readRunCancelRequest, s as watchRunCancellation, t as applyRunCancellation, u as childCoordinationOwner } from "./run-cancellation-DEW04dun.js";
-import { c as createSteerAcknowledger, d as coordinationVerbNames, f as createFileRunContext, l as budgetOverspendText, m as withRunContext, n as createCoordinationToolsForManager, p as createInMemoryRunContext, s as createCancelAcknowledger, t as createCoordinationTools, u as normalizeAnalyzeOnSettle } from "./coordination-manager-DXOwLu9T.js";
-import { o as safeJsonText } from "./coordination-map-routing-2_hUlTnz.js";
-import { a as graphRegistry, c as loadGraph } from "./graph-registry-BoaUV5g8.js";
+import { _ as workerAssignmentNamespace, c as writeRunCancellation, d as coordinationEventId, f as externalExecutionId, g as supervisionRunNamespace, h as rootCoordinationOwner, i as readRunCancellation, l as canonicalExecution, m as freezeDetachedProfile, p as freezeDetached, r as readRunCancelRequest, s as watchRunCancellation, t as applyRunCancellation, u as childCoordinationOwner } from "./run-cancellation-D5R-7UQt.js";
+import { c as createSteerAcknowledger, d as coordinationVerbNames, f as createFileRunContext, l as budgetOverspendText, m as withRunContext, n as createCoordinationToolsForManager, p as createInMemoryRunContext, s as createCancelAcknowledger, t as createCoordinationTools, u as normalizeAnalyzeOnSettle } from "./coordination-manager-D74AZg7m.js";
+import { o as safeJsonText } from "./coordination-map-routing-DVjW5Gx0.js";
+import { a as graphRegistry, c as loadGraph } from "./graph-registry-B25FxBZN.js";
 import { ATTR, agentIdentityAttributes } from "@tangle-network/agent-trace-contract";
 import { ProxySecretScopeSchema, ProxySecretsSchema, agentProfileSchema, canonicalAgentProfileDigest, canonicalCandidateDigest, canonicalCandidateJson, mergeProxySecretBindings, validateAgentProfileSecurity } from "@tangle-network/agent-interface";
 import { toolSpansToTraceAnalysisStore } from "@tangle-network/agent-eval";
@@ -96,8 +96,6 @@ const superviseOptionKeySet = /* @__PURE__ */ new Set([
 	"stopRule",
 	"watchWorkers",
 	"continuation",
-	"workerRetry",
-	"onWorkerRetry",
 	"workerSlots",
 	"recoverExecutor"
 ]);
@@ -164,7 +162,6 @@ const superviseExecutableOptionKeys = [
 	"onCoordinationEvent",
 	"onDriverAttempt",
 	"onProgressStop",
-	"onWorkerRetry",
 	"recoverExecutor",
 	"resolveDeliverable",
 	"resolveDriveHarness",
@@ -208,9 +205,9 @@ function assertNoUncapturedExecutableOption(decisionData) {
 * detached and frozen; executable ports are copied as the exact references selected at intake.
 * Service internals intentionally remain live, while replacing a callback/service on the caller's
 * mutable options object can no longer change an in-flight run. */
-function captureSuperviseOptions(opts) {
+function captureSuperviseOptions(opts, mode = "execution") {
 	assertSuperviseOptionKeys(opts, "supervise");
-	const { backend, coordination, driverBackend, deliverable, router, compaction, watchWorkers, analysts, continuation, workerRetry, ...rest } = opts;
+	const { backend, coordination, driverBackend, deliverable, router, compaction, watchWorkers, analysts, continuation, ...rest } = opts;
 	const references = {};
 	const decisionData = {};
 	for (const [key, value] of Object.entries(rest)) if (!superviseReferenceOptionKeys.has(key)) decisionData[key] = value;
@@ -227,8 +224,8 @@ function captureSuperviseOptions(opts) {
 			...onControlReady === void 0 ? {} : { onControlReady }
 		});
 	})();
-	const capturedBackend = backend === void 0 ? void 0 : snapshotExecutorConfig(backend);
-	const capturedDriverBackend = driverBackend === void 0 ? void 0 : snapshotExecutorConfig(driverBackend);
+	const capturedBackend = backend === void 0 ? void 0 : snapshotExecutorConfig(backend, mode);
+	const capturedDriverBackend = driverBackend === void 0 ? void 0 : snapshotExecutorConfig(driverBackend, mode);
 	const capturedDeliverable = deliverable === void 0 || typeof deliverable === "string" ? deliverable : captureDeliverable(deliverable, "supervise deliverable");
 	const capturedRouter = router === void 0 ? void 0 : (() => {
 		const { complete, ...routerData } = router;
@@ -250,15 +247,6 @@ function captureSuperviseOptions(opts) {
 		...detachedSnapshot({ maxFindingsPerWorker: watchWorkers.maxFindingsPerWorker }, "supervise worker-watch configuration"),
 		...watchWorkers.detectors === void 0 ? {} : { detectors: Object.freeze([...watchWorkers.detectors]) }
 	});
-	const capturedWorkerRetry = workerRetry === void 0 ? void 0 : Object.freeze({
-		...detachedSnapshot({
-			...workerRetry.enabled === void 0 ? {} : { enabled: workerRetry.enabled },
-			...workerRetry.maxTotalMs === void 0 ? {} : { maxTotalMs: workerRetry.maxTotalMs },
-			...workerRetry.initialBackoffMs === void 0 ? {} : { initialBackoffMs: workerRetry.initialBackoffMs },
-			...workerRetry.maxBackoffMs === void 0 ? {} : { maxBackoffMs: workerRetry.maxBackoffMs }
-		}, "supervise worker-retry configuration"),
-		...workerRetry.additionalPreSpawnSignatures === void 0 ? {} : { additionalPreSpawnSignatures: Object.freeze([...workerRetry.additionalPreSpawnSignatures]) }
-	});
 	const capturedAnalysts = analysts === void 0 || typeof analysts === "string" ? analysts : Object.freeze({
 		kinds: detachedSnapshot(analysts.kinds, "supervise analyst kinds"),
 		run: analysts.run,
@@ -283,8 +271,7 @@ function captureSuperviseOptions(opts) {
 		...capturedCompaction === void 0 ? {} : { compaction: capturedCompaction },
 		...capturedWatchWorkers === void 0 ? {} : { watchWorkers: capturedWatchWorkers },
 		...capturedAnalysts === void 0 ? {} : { analysts: capturedAnalysts },
-		...capturedContinuation === void 0 ? {} : { continuation: capturedContinuation },
-		...capturedWorkerRetry === void 0 ? {} : { workerRetry: capturedWorkerRetry }
+		...capturedContinuation === void 0 ? {} : { continuation: capturedContinuation }
 	});
 }
 // src/runtime/supervise/otel-spans.ts
@@ -2406,7 +2393,7 @@ function ledgerAnalyzes(ledger, edge, outcome, bytes, reason, workerId) {
 */
 function exhaustedBudgetChannels(budget, nowMs) {
 	const spent = [];
-	if (budget.tokensLeft <= 0) spent.push(`tokens: ${-budget.tokensLeft} over the cap`);
+	if (budget.tokensCapped !== false && budget.tokensLeft <= 0) spent.push(`tokens: ${-budget.tokensLeft} over the cap`);
 	if (budget.usdCapped && budget.usdLeft <= 0) spent.push(`usd: ${(-budget.usdLeft).toFixed(4)} over the cap`);
 	for (const [name, resource] of Object.entries(budget.resources ?? {})) if (!resource.known) spent.push(`resource ${name}: unmetered`);
 	else if (resource.remaining <= 0) spent.push(`resource ${name}: ${-resource.remaining} ${resource.unit} over the cap`);
@@ -2415,7 +2402,7 @@ function exhaustedBudgetChannels(budget, nowMs) {
 }
 /** A per-child budget may not exceed the conserved pool it is reserved from. */
 function assertPerWorkerWithinPool(perWorker, pool) {
-	const over = (child, total, field) => child > total ? `supervise perWorker.${field} (${child}) exceeds budget.${field} (${total})` : null;
+	const over = (child, total, field) => child !== void 0 && total !== void 0 && child > total ? `supervise perWorker.${field} (${child}) exceeds budget.${field} (${total})` : null;
 	for (const [name, resource] of Object.entries(pool.resources ?? {})) {
 		const child = perWorker.resources?.[name];
 		if (!child) throw new ValidationError(`supervise perWorker resource ${name}: child must declare its limit`);
@@ -2438,6 +2425,7 @@ function assertPerWorkerWithinPool(perWorker, pool) {
 *  next turn is refused as budget-exhausted while the child still holds the rest. */
 function assertPerWorkerAdmittable(perWorker, pool, ownerShare) {
 	const unreservable = (child, total, kept, field) => {
+		if (child === void 0 || total === void 0) return null;
 		if (ownerShare > 0) {
 			const reservable = total - kept;
 			return child > reservable ? `supervise perWorker.${field} (${child}) exceeds the reservable budget.${field} (${reservable}: ${total} less the owner's kept ${kept} at reservationPolicy.ownerShare ${ownerShare})` : null;
@@ -2445,24 +2433,26 @@ function assertPerWorkerAdmittable(perWorker, pool, ownerShare) {
 		return child >= total ? `supervise perWorker.${field} (${child}) equals the whole budget.${field} (${total}), so the first child takes every unit and the owner has none left for its next turn` : null;
 	};
 	const unadmittable = [
-		unreservable(perWorker.maxTokens, pool.maxTokens, Math.ceil(pool.maxTokens * ownerShare), "maxTokens"),
-		unreservable(perWorker.maxIterations, pool.maxIterations, Math.ceil(pool.maxIterations * ownerShare), "maxIterations"),
+		unreservable(perWorker.maxTokens, pool.maxTokens, Math.ceil((pool.maxTokens ?? 0) * ownerShare), "maxTokens"),
+		unreservable(perWorker.maxIterations, pool.maxIterations, Math.ceil((pool.maxIterations ?? 0) * ownerShare), "maxIterations"),
 		perWorker.maxUsd !== void 0 && pool.maxUsd !== void 0 && ownerShare > 0 ? unreservable(perWorker.maxUsd, pool.maxUsd, pool.maxUsd * ownerShare, "maxUsd") : null
 	].filter((x) => x !== null);
 	if (unadmittable.length > 0) throw new ValidationError(`${unadmittable.join("; ")} — lower perWorker on that channel so a child fits beside the owner's own turns; otherwise children are refused or starve at spawn hours into the run.`);
 }
-/** The slice a child gets when its manager names none: a quarter of the part of the manager's
-*  budget its children may reserve, so four default children fill that part and the manager's
-*  own share stays free for its turns. Each nested manager divides its own slice the same way. */
-function defaultPerWorker(budget, ownerShare) {
-	const share = (1 - ownerShare) / 4;
+/** The slice a child gets when its manager names none: the part of the manager's budget its
+*  children may reserve, divided by the run's worker slots (four with none), so the slots, not the
+*  budget, set how many run at once. A quarter share capped managers with 8-15 slots at 2-4
+*  children (zro-w4a16-hopper-20261104b held 4 of 8; canary-soak-20261104a queued s5-s7 163-176 s). */
+function defaultPerWorker(budget, ownerShare, workerSlots) {
+	const slots = typeof workerSlots === "number" ? workerSlots : workerSlots?.max;
+	const share = (1 - ownerShare) / (slots !== void 0 && slots > 0 ? slots : 4);
 	return {
 		...budget.resources === void 0 ? {} : { resources: Object.fromEntries(Object.entries(budget.resources).map(([name, value]) => [name, {
 			unit: value.unit,
 			limit: Math.floor(value.limit * share)
 		}])) },
-		maxIterations: Math.max(1, Math.floor(budget.maxIterations * share)),
-		maxTokens: Math.max(1, Math.floor(budget.maxTokens * share)),
+		...budget.maxIterations === void 0 ? {} : { maxIterations: Math.max(0, Math.floor(budget.maxIterations * share)) },
+		...budget.maxTokens === void 0 ? {} : { maxTokens: Math.max(0, Math.floor(budget.maxTokens * share)) },
 		...budget.maxUsd !== void 0 ? { maxUsd: budget.maxUsd * share } : {}
 	};
 }
@@ -2718,17 +2708,13 @@ async function runBrainLoop(opts) {
 	};
 }
 // src/runtime/supervise/driver-budget-guards.ts
-/** Spawn-progress is impossible: the pool can't afford another worker AND nothing is in flight to
-*  await. A long-horizon driver bounded by the conserved pool stops here instead of spinning (the
-*  in-loop budget guard the turn cap alone never provided). Checks BOTH conserved channels: tokens
-*  (can't afford a worker) and usd (a usd-capped pool whose ceiling the driver's own metered
-*  inference has drained — `meter` debits usd, so without this a huge-token/small-usd pool would
-*  overspend usd up to the turn tripwire). */
+/** Stop when no work is in flight and a capped channel cannot fund another worker.
+* Owner inference also debits the pool, so a turn limit alone cannot enforce its ceilings. */
 function poolStarved(scope, perWorker, preserveOwnerTurns = false) {
 	const b = scope.budget;
 	if (scope.view.inFlight > 0) return false;
-	const tokenStarved = preserveOwnerTurns ? b.tokensLeft <= 0 : b.tokensLeft < perWorker.maxTokens;
-	const iterationStarved = b.iterationsLeft <= 0;
+	const tokenStarved = b.tokensCapped !== false && (b.tokensLeft <= 0 || !preserveOwnerTurns && perWorker.maxTokens !== void 0 && b.tokensLeft < perWorker.maxTokens);
+	const iterationStarved = b.iterationsCapped !== false && b.iterationsLeft <= 0;
 	const usdStarved = b.usdCapped && (b.usdLeft <= 0 || !preserveOwnerTurns && perWorker.maxUsd !== void 0 && b.usdLeft < perWorker.maxUsd);
 	const resourceStarved = Object.entries(b.resources ?? {}).some(([name, value]) => !value.known || value.remaining <= 0 || !preserveOwnerTurns && value.remaining < (perWorker.resources?.[name]?.limit ?? 0));
 	return tokenStarved || iterationStarved || usdStarved || resourceStarved;
@@ -2749,7 +2735,7 @@ const UNMETERED_DRIVER_TURNS = 16;
 function ownTurnsUnbounded(scope, poolTokens, turns, maxTurns) {
 	const b = scope.budget;
 	if (maxTurns !== void 0 || b.deadlineMs > 0) return false;
-	if (poolTokens > 0 && b.tokensLeft < -poolTokens) return true;
+	if (b.tokensCapped !== false && poolTokens > 0 && b.tokensLeft < -poolTokens) return true;
 	return !b.tokensKnown && !b.usdCapped && turns > UNMETERED_DRIVER_TURNS;
 }
 /** The absolute wall-clock deadline (when the root set one) has passed. */
@@ -3590,23 +3576,24 @@ function createCoordinationCredentials(input) {
 		current = next;
 		staged = void 0;
 	};
+	let installing = false;
 	const rotate = () => {
-		if (staged) throw new ConfigError("coordination credential replacement is pending");
+		if (installing) throw new ConfigError("coordination credential replacement is pending");
+		if (staged) revoked.set(staged.token.toString(), staged.expiresAt);
 		commit(issue());
 		readerToken = randomToken();
 		controllerToken = randomToken();
 	};
 	const replace = async (install) => {
-		if (staged) throw new ConfigError("coordination credential replacement is pending");
-		const next = issue();
-		staged = next;
+		if (installing) throw new ConfigError("coordination credential replacement is pending");
+		if (!staged || staged.expiresAt <= Date.now()) staged = issue();
+		const next = staged;
+		installing = true;
 		try {
 			await install(next.headers);
 			commit(next, true);
-		} catch (error) {
-			staged = void 0;
-			revoked.set(next.token.toString(), next.expiresAt);
-			throw error;
+		} finally {
+			installing = false;
 		}
 	};
 	const matches = (supplied, expected) => supplied.length === expected.length && timingSafeEqual(supplied, expected);
@@ -4291,6 +4278,7 @@ function assertCoordinationTransport(options) {
 }
 /** Response hold cap, under the 60 s MCP tool-call timeout Claude Code and Codex apply. */
 const RESPONSE_FENCE_CAP_MS = 45e3;
+const RENEWAL_RETRY_MAX_MS = 6e4;
 /** The longest a fenced call (`submit_result`, node tools) holds its response before answering with
 *  a receipt: half of `requestTimeoutMs` (beating the transport's 504), at most {@link RESPONSE_FENCE_CAP_MS}. */
 function coordinationResponseFenceMs(requestTimeoutMs) {
@@ -4350,6 +4338,7 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 	} });
 	if ((opts.authentication || opts.onAudit) && (!identity.runId.trim() || !identity.actorId.trim())) throw new ConfigError("authenticated coordination requires a trusted run and actor identity");
 	const state = openCoordinationListenerState();
+	let renewing = false;
 	const stopUnreachable = (reason) => {
 		state.closed = true;
 		try {
@@ -4364,7 +4353,9 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 		lifetimeSignal: lifetime,
 		lifetimeExpiresAt: opts.scope.rootDeadlineAtMs,
 		isClosed: () => state.closed,
-		onExpiredBearer: () => stopUnreachable("coordination credential expired in its holder: no renewal reached it")
+		onExpiredBearer: () => {
+			if (!renewing) stopUnreachable("coordination credential expired in its holder: no renewal reached it");
+		}
 	});
 	const ctx = {
 		opts,
@@ -4440,15 +4431,25 @@ async function serveCoordinationMcpForManager(opts, lifetime) {
 			await pending;
 		};
 		stopCredentialBinding = stop;
+		let failures = 0;
 		const schedule = () => {
+			failures = 0;
+			renewing = false;
 			const expiry = credentials.expiresAt;
 			if (!active || state.closed || opts.scope.signal.aborted || lifetime?.aborted || opts.scope.rootDeadlineAtMs !== void 0 && expiry >= opts.scope.rootDeadlineAtMs) return;
 			cancelTimer = armDeadlineTimer(Math.max(1, Math.floor((expiry - Date.now()) / 2)), renew);
 		};
+		const stopped = () => !active || state.closed || opts.scope.signal.aborted || lifetime?.aborted;
+		const retry = (error) => {
+			if (stopped()) return;
+			const paced = error.retryAfterMs ?? 1e3 * 2 ** failures++;
+			console.warn(`[coordination] credential renewal retries: ${errMessage(error)}`);
+			cancelTimer = armDeadlineTimer(Math.min(paced, RENEWAL_RETRY_MAX_MS), renew);
+		};
 		const renew = () => {
-			if (!active || state.closed || opts.scope.signal.aborted || lifetime?.aborted) return;
-			pending = credentials.replace(install);
-			pending.then(schedule, () => stopUnreachable("coordination credential renewal failed"));
+			if (stopped()) return;
+			renewing = true;
+			pending = credentials.replace(install).then(schedule, retry);
 		};
 		refreshBoundCredential = () => {
 			cancelTimer?.();
@@ -4864,8 +4865,8 @@ function observeManagerControls(config, session) {
 // src/runtime/supervise/driver-retry-loop.ts
 const DEFAULT_MAX_CONSECUTIVE_FAILURES = 3;
 const DEFAULT_MAX_ATTEMPTS = Number.POSITIVE_INFINITY;
-const DEFAULT_INITIAL_BACKOFF_MS$1 = 2e3;
-const DEFAULT_MAX_BACKOFF_MS$1 = 3e4;
+const DEFAULT_INITIAL_BACKOFF_MS = 2e3;
+const DEFAULT_MAX_BACKOFF_MS = 3e4;
 const DEFAULT_TRANSIENT_OUTAGE_MS = 9e5;
 const BARREN_PAUSE_FIRST_MS = 3e5;
 const BARREN_PAUSE_MAX_MS = 36e5;
@@ -4915,7 +4916,7 @@ function abortStop(signal) {
 /** The budget's own verdict on whether another attempt may run at all. */
 function budgetStop(budget, atMs) {
 	if (budget.deadlineMs > 0 && atMs >= budget.deadlineMs) return "deadline";
-	return budget.tokensLeft <= 0 || budget.iterationsLeft <= 0 || budget.usdCapped && (budget.usdLeft <= 0 || budget.usdKnown === false) || Object.values(budget.resources ?? {}).some((r) => !r.known || r.remaining <= 0) ? "budget-exhausted" : void 0;
+	return budget.tokensCapped !== false && budget.tokensLeft <= 0 || budget.iterationsCapped !== false && budget.iterationsLeft <= 0 || budget.usdCapped && (budget.usdLeft <= 0 || budget.usdKnown === false) || Object.values(budget.resources ?? {}).some((r) => !r.known || r.remaining <= 0) ? "budget-exhausted" : void 0;
 }
 /** The cause an admission or continuation refusal carries: it has no failure of its own. */
 function admissionError(stop) {
@@ -4934,23 +4935,23 @@ function madeProgress(before, after) {
 	if (contractOf(after) === "unmet") return false;
 	return after.poolTokensSpent > before.poolTokensSpent || after.settledCount > before.settledCount;
 }
-async function defaultSleep$1(ms, signal) {
+async function defaultSleep(ms, signal) {
 	if (ms <= 0 || signal.aborted) return;
 	await sleep(ms, signal, false);
 }
 function driverRetryLimits(run) {
 	const policy = run.policy ?? {};
-	const initialBackoff = Math.max(0, policy.initialBackoffMs ?? DEFAULT_INITIAL_BACKOFF_MS$1);
+	const initialBackoff = Math.max(0, policy.initialBackoffMs ?? DEFAULT_INITIAL_BACKOFF_MS);
 	return {
 		now: run.now ?? Date.now,
-		sleep: run.sleep ?? defaultSleep$1,
+		sleep: run.sleep ?? defaultSleep,
 		random: run.random ?? Math.random,
 		policy,
 		retryEnabled: policy.enabled !== false,
 		maxConsecutive: Math.max(0, policy.maxConsecutiveFailures ?? DEFAULT_MAX_CONSECUTIVE_FAILURES),
 		maxAttempts: Math.max(1, policy.maxAttempts ?? DEFAULT_MAX_ATTEMPTS),
 		initialBackoff,
-		maxBackoff: Math.max(initialBackoff, policy.maxBackoffMs ?? DEFAULT_MAX_BACKOFF_MS$1),
+		maxBackoff: Math.max(initialBackoff, policy.maxBackoffMs ?? DEFAULT_MAX_BACKOFF_MS),
 		transientOutage: Math.max(0, policy.transientOutageMs ?? DEFAULT_TRANSIENT_OUTAGE_MS)
 	};
 }
@@ -5171,13 +5172,17 @@ var DriverRetryLoop = class {
 	async pause(failure) {
 		const { run, limits } = this;
 		const { error, progressed } = failure;
+		const unavailableSignal = upstreamUnavailableSignal(error) ?? "unavailable";
+		const rotatingSeat = run.seatChain === true && unavailableSignal === "subscription-usage-limit";
 		if (progressed) this.barrenReentries = 0;
 		const stop = (() => {
 			if (run.signal.aborted) return abortStop(run.signal);
 			if (!limits.retryEnabled) return "retry-disabled";
-			return budgetStop(run.budget(), limits.now());
+			const byBudget = budgetStop(run.budget(), limits.now());
+			if (byBudget) return byBudget;
+			const deadline = run.budget().deadlineMs;
+			return !rotatingSeat && deadline > 0 && (reportedResetAt(error, limits.now()) ?? 0) >= deadline ? "deadline" : void 0;
 		})();
-		const unavailableSignal = upstreamUnavailableSignal(error) ?? "unavailable";
 		if (stop !== void 0) {
 			await this.stopOrPause(error, stop, {
 				...this.failureRecord(failure),
@@ -5188,9 +5193,9 @@ var DriverRetryLoop = class {
 		this.pauses += 1;
 		this.consecutivePauses = progressed ? 1 : this.consecutivePauses + 1;
 		const pausedAt = limits.now();
-		const resetAt = unavailableResumeAt(errMessage(error), pausedAt);
+		const resetAt = rotatingSeat ? void 0 : unavailableResumeAt(reportedResetAt(error, limits.now()), pausedAt);
 		const deadlineMs = run.budget().deadlineMs;
-		const pause = resetAt === void 0 ? jitteredMs(unavailablePauseMs(this.consecutivePauses, limits.policy), limits.random) : Math.max(1e3, Math.min(resetAt, deadlineMs > 0 ? deadlineMs : resetAt) - pausedAt);
+		const pause = rotatingSeat ? 0 : resetAt === void 0 ? jitteredMs(unavailablePauseMs(this.consecutivePauses, limits.policy), limits.random) : Math.max(1e3, Math.min(resetAt, deadlineMs > 0 ? deadlineMs : resetAt) - pausedAt);
 		const exitCode = undispatchedCredentialExit(error);
 		const resumeAt = resetAt ?? (exitCode === void 0 ? void 0 : pausedAt + pause);
 		await this.emit({
@@ -5249,14 +5254,14 @@ var DriverRetryLoop = class {
 	failureStop(failure, failedAt) {
 		const { run, limits } = this;
 		const { error, classification, progressed, before, after } = failure;
-		const idle = classification === "transient" && !progressed && after.poolTokensSpent === before.poolTokensSpent && after.settledCount === before.settledCount;
+		const kind = classification === "transient" ? transientFailureKind(error) : void 0;
+		const idle = kind === "infra" && !progressed && after.poolTokensSpent === before.poolTokensSpent && after.settledCount === before.settledCount;
 		if (!idle) this.outageSince = void 0;
 		else this.outageSince ??= failedAt;
 		const inOutage = idle && failedAt - (this.outageSince ?? failedAt) < limits.transientOutage;
 		if (!inOutage) this.chargedFailures += 1;
 		const sameFailure = failure.durationMs >= INSTANT_FAILURE_MS ? void 0 : extend(this.sameFailure, error, failedAt);
 		this.sameFailure = sameFailure;
-		const kind = classification === "transient" ? transientFailureKind(error) : void 0;
 		if (progressed || kind === void 0 || isContentFilterRefusal(error)) this.sameIdle = void 0;
 		else if (failure.pending === void 0) this.sameIdle = extend(this.sameIdle, error, failedAt);
 		const sameIdle = this.sameIdle;
@@ -5439,96 +5444,24 @@ var DriverRetryLoop = class {
 };
 // src/runtime/supervise/driver-retry.ts
 /**
-* Root-driver retry — the root gets the same second chance a worker's transport already has.
-*
-* One dropped connection, one SIGKILLed harness process or one upstream 5xx used to end a run of
-* arbitrary length with `reason: 'driver-failed'` and tear down every live child (#741). This
-* module runs the driver again on the SAME scope, coordination server and live children until the
-* budget or the deadline says stop. It restarts no children and replays no work: the bridge
-* backend reattaches the harness session because the execution id is bound durably per node.
-*
-* Failure classes (all conservative):
-*  - TERMINAL: Runtime's own refusals (`ValidationError`/`ConfigError`, exhausted budget, the run's
-*    own abort, a client-side transport status such as 401/404/422). Retrying re-runs a decision.
-*    Fails at once.
-*  - TRANSIENT: everything foreign (harness exit without a reason, a stream cut mid-turn, a 5xx, a
-*    socket reset, an `AbortError` that neither the run's signal nor the manager's own stop
-*    issued). A harness turn that RETURNED a failed outcome is the same accident reported as
-*    a value, so the drive raises {@link HarnessTurnFailedError} and it is classified like any other.
-*  - UNAVAILABLE: the upstream said "not now" (429, 503, 529, or the router's own codes: quota,
-*    rate limit, overload). The driver PAUSES and re-enters; a pause consumes neither `maxAttempts`
-*    nor the barren streak, so only the deadline, the budget and cancellation bound it. Measured
-*    2026-09-24 on play anomaly-referee-v3d: during the router's flash quota outage four of five
-*    lead lanes ended `driver-failed` after 12 to 13 attempts with budget and an 8-hour deadline
-*    almost untouched.
-*
-* A driver that dies INSTANTLY and repeatedly spends nothing, so the budget alone cannot bound it.
-* Progress is measured between attempts; a run of attempts that changes nothing stops at
-* `maxConsecutiveFailures` once it has outlasted the outage window below. A failure that made
-* progress resets that counter.
-*
-* WHAT COUNTS AS PROGRESS was got wrong first. Reading metered spend, settled children and an
-* accepted submission measured the filesystem and the meter, never the goal: across 1,422 settled
-* discovery-lab runs it retried the runs that produced NOTHING 629 of 827 times
-* (76.1%) and the runs that HAD left an artifact 21 of 399 times (5.3%). So when the caller
-* declares a completion check, spend and settlements alone are NOT progress while it is unmet; only
-* a delivery (an accepted submission, a child that passed the check, the contract turning met, or a
-* rise in the check's best composite) resets the barren counter. A caller that declares no check
-* reports `contract: 'none'` and keeps the historical reading.
-*
-* CONTINUATION. `budgetStop` used to be consulted only after a failure, so a driver that RETURNED
-* with the contract unmet ended the run silently (376 of 376 winning lab runs ended on this loop's
-* own `stop: 'completed'`). A completed drive whose contract is unmet is now a first-class moment:
-* the manager's `continuation` policy (`./continuation.ts`) re-enters the driver with Runtime's
-* continuation note, crossing the same budget, deadline and abort bounds. Successful
-* continuations do not consume the failure allowance. Progress paces the continuations: once
-* `continuation.maxBarren` re-entered drives in a row complete without progress, the loop PAUSES
-* before each further continuation, 5 minutes and doubling per barren drive up to 60, journals one
-* `barren-pause` row per pause for an operator alarm, and re-enters. A barren streak never ends the
-* run: the check, the deadline, the budget and cancellation do. Progress resets the streak and the
-* backoff. There is no count cap and no caller veto (the old prompt-owned loop logged 896 of 1,011
-* rounds with no progress). The barren bound
-* settled a 48-hour run `no-winner` after 14.3 hours, while its last two turns updated its pages
-* and waited on its own 2^20 prove.
+* Re-enter a driver on the same scope, coordination server and live children. The harness owns
+* session/environment reuse; this loop owns retry, continuation, budget and deadline decisions.
 *
-* This loop decides WHETHER to re-enter, not WHERE the next drive runs: the drive harness owns
-* whether it continues the same session, environment or a replacement, and the caller composes the
-* re-entry task from it (`./reentry.ts`).
+* Runtime refusals and cancellation stay terminal. Canonical producer failures distinguish caller,
+* capacity, infrastructure and work; legacy transport/harness evidence remains a fallback.
+* Capacity pauses do not consume failure allowances. A seat-bearing drive first lets its existing
+* chain rotate; the chain owns its exhausted-seat wait, while the run's bounds still apply.
 *
-* A RE-ENTERED run is one this process resumed after an earlier process drove it. Its first drive
-* is entered as `run-reentered` with the workers that were open, and a drive counts toward
-* `maxBarren` only if it began after the root streamed a model event in this process; a root that
-* speaks and then stays barren is paced as any other. Measured 2026-10-19 on
-* magnetar-rust-20261019f: after a host reboot the root was driven with the bare original task and
-* no word of its three open workers, two barren continuations followed, and the barren bound of the
-* time settled the run `no-result-selected`.
+* Only idle infrastructure failures earn an outage window. Repeated deterministic failures with
+* no progress stop inside that window; work failures consume the normal attempt/barren bounds.
+* With a declared check, progress means delivery or an improved verdict, not spend alone.
 *
-* A TRANSIENT failure that spent nothing, settled nothing and made no progress is an outage until
-* its streak has lasted `transientOutageMs`: it consumes neither `maxAttempts` nor the barren
-* streak, like a pause; after it the failure bounds apply. Failures met alike (ids and times
-* blanked) on every re-entry with no progress stop with `repeated-failure` inside the window: a
-* `PartialFailureError` box at the second, a `nested` manager's failed harness turn at the third,
-* and its other failures at the repeated-failure count and window.
-* A Platform restart answered
-* `HTTP 502 ... Platform key verification unavailable` from 03:04:34 to 03:09:41Z, and the
-* coordinator's twelve attempts ran out at 03:07:12Z with no token spent.
+* Completed drives with an unmet contract continue with Runtime's note. Barren continuations
+* wait with increasing backoff; progress resets their streak. A resumed run first receives its
+* open workers, and counts barren drives only after a model event in this process.
 *
-* Every wait, a failure backoff or a pause, is jittered over its upper half so drivers that one
-* outage cut off together do not re-enter together.
-*
-* STOP-PAUSE. A run started with `driverRetry.pauseRootStops` hands its ROOT a `stopPause`;
-* no other manager gets one. Terminal refusals end the run immediately; the remaining stops wait and alarm:
-* `no-progress`, `max-attempts`, `repeated-failure`, `pending-unresolved` and
-* `budget-exhausted` each emit one record with `replacesStop` and pause 5 minutes, doubling per
-* stop-pause in a row up to 60, never past a declared deadline and not jittered. An attempt that
-* made progress resets the streak. A cancel ends the pause and settles the run; a root steer ends
-* any pause at once, a budget pause included, because a steer is how an operator changes a live
-* run. Ending a pause admits nothing by itself: the next admission reads the pool again, a pool
-* still spent pauses again with its own row, and the steer stays queued until a turn reads it.
-* After the pause the per-window counters start over and the driver is re-entered: after
-* a failure as `driver-failure` with `pausedMs`, after an admission or continuation refusal as the
-* re-entry it was about to use. Runs must not fail early: over 259 runs, 8 of the 10 stops settled runs that
-* nobody solved or stopped, including 17 roots whose harness never streamed.
+* Opted-in root stop-pauses alarm and wait instead of settling recoverable stops. Cancellation
+* ends the wait; a steer wakes it but grants no admission. The next attempt rechecks the budget.
 */
 function assertContinuationPolicy(continuation) {
 	if (continuation === void 0) return;
@@ -5928,6 +5861,7 @@ async function driveManagerTurns(inputs) {
 			sleep: (ms, signal) => sleepScopeWait(scope, ms, signal, "paused-root"),
 			...rootStopPause(config, session),
 			nested: (config.nodeContextSeed?.depth ?? 0) > 0,
+			seatChain: config.driveHarness.seatChain === true && authoredSeatStages(config.profile) !== void 0,
 			resolvePending: (failure, failures) => abandonScopeRetainedOwnerInvocation(scope, failure, failures),
 			wait: {
 				open: () => !mcp.submittedResult() && !mcp.isStopped() && session.state.progressStopReason === void 0 && (session.controls.hasOpenWork() || session.state.nextTurnInbox.pendingAuthority() > 0),
@@ -6036,7 +5970,7 @@ function readManagerProgress(loop) {
 	const submitted = Boolean(mcp.submittedResult());
 	const composite = bestComposite(controls.checkReads());
 	return {
-		poolTokensSpent: loop.baseTokensLeft - scope.budget.tokensLeft,
+		poolTokensSpent: scope.budget.tokensCapped === false ? scope.budget.committedTokens ?? 0 : loop.baseTokensLeft - scope.budget.tokensLeft,
 		settledCount: settled.length,
 		submitted,
 		deliveredCount,
@@ -6766,7 +6700,7 @@ function automaticDriverBackendSupported(backend, coordination) {
 function buildNestedManagerDeps(child) {
 	const { env, seat, admitted, spawnContext } = child;
 	const { options, ownerShare, authorizeDownFor, peerAuditFor } = env.setup;
-	const nestedPerWorker = defaultPerWorker(spawnContext.budget, ownerShare);
+	const nestedPerWorker = defaultPerWorker(spawnContext.budget, ownerShare, options.workerSlots);
 	const runMessageAuthority = authorizeDownFor(admitted.authorized, seat.depth + 1);
 	const authorizeNestedMessage = child.subtreeGraph && runMessageAuthority ? child.subtreeGraph.observeMessages(runMessageAuthority) : runMessageAuthority;
 	const policy = nestedSettlementPolicy(child);
@@ -6923,7 +6857,7 @@ async function storeCoordinationSecret(provider, secrets, name, bind, policy) {
 		if (!(date instanceof Date) || !Number.isFinite(date.getTime())) throw new ValidationError("provider secret receipt has no valid updatedAt");
 		return date.toISOString();
 	};
-	let revision;
+	let revision, adopted = false;
 	const prior = secrets.get(name);
 	if (prior?.binding === bind && prior.ready) return prior.policy;
 	if (prior?.binding === bind) throw new ValidationError("coordination binding is not ready");
@@ -6962,16 +6896,26 @@ async function storeCoordinationSecret(provider, secrets, name, bind, policy) {
 					const authority = (bindings) => canonicalCandidateDigest(bindings?.map(({ ttlSeconds: _, ...binding }) => binding));
 					if (stored.exposeInBox || authority(recovered) !== authority(policy.proxySecrets)) throw new ValidationError("stored coordination policy has different authority");
 					entry.policy = { proxySecrets: recovered };
+					adopted = true;
 				}
 			}
-			revision = stamp(await store.update(name, value, {
-				...entry.policy,
-				expectedUpdatedAt
-			}));
+			try {
+				revision = stamp(await store.update(name, value, {
+					...entry.policy,
+					expectedUpdatedAt
+				}));
+			} catch (error) {
+				if (entry.ready) revision = await store.list().then((rows) => stamp(rows.find((row) => row.name === name)), () => revision);
+				throw error;
+			}
 		});
 		entry.ready = true;
 		return entry.policy;
 	} catch (cause) {
+		if (adopted) {
+			secrets.delete(name);
+			throw cause;
+		}
 		await entry.release().catch((cleanup) => {
 			throw new AggregateError([cause, cleanup], "coordination binding and cleanup failed");
 		});
@@ -7257,7 +7201,7 @@ function leafWorker(env, seat, admitted, spawnContext) {
 	const { options, deliverable, runNamespace } = env.setup;
 	const { childDeliverable } = admitted;
 	if (childDeliverable !== deliverable && !options.backend) throw new ValidationError("supervise: resolveDeliverable selected a per-spawn deliverable but there is no backend to derive that leaf from; makeLeafAgent owns its own completion check");
-	return withModelSubstitution((childDeliverable === deliverable ? env.makeLeaf : env.withRetry(workerFromBackend(options.backend, childDeliverable)))(admitted.authorized, Object.freeze({
+	return withModelSubstitution((childDeliverable === deliverable ? env.makeLeaf : workerFromBackend(options.backend, childDeliverable))(admitted.authorized, Object.freeze({
 		...admitted.authorizedContext,
 		assignmentId: workerAssignmentNamespace(runNamespace, seat.parentOwnerId, spawnContext.assignmentId)
 	})), admitted.modelSubstitution);
@@ -7376,232 +7320,6 @@ function registerRecovery(env, makeRecursiveWorker) {
 	});
 	env.recoveryFactories.set(makeRecursiveWorker, factory);
 }
-// src/runtime/supervise/worker-retry.ts
-/**
-* WORKER-SPAWN RETRY — the second chance `driverRetry` gives the root, given to a leaf.
-*
-* `driverRetry` guards the root and nothing else. A worker that dies is typed into a `down`
-* settlement, which is the right shape when the worker RAN. It is the wrong shape when the worker
-* never started, and one failure produces exactly that:
-*
-*   bridgeExecutor: bridge stream error: host-executor: acquire timeout after 60000ms
-*   (in_flight=4/4, queued=1)
-*
-* Two live cells held 2 leads and up to 8
-* workers on one bridge whose host executor caps live harness children at 4. A worker spawn that
-* queued past the bridge's single 60 s acquire deadline died there, and the run lost that worker
-* permanently even though a slot freed seconds later. The bridge retries nothing.
-*
-* Retrying execution is dangerous by default, so this seam is FAIL-CLOSED on two independent
-* proofs that the attempt did no work:
-*
-*  1. The error carries a PRE-SPAWN signature — a refusal the backend emits before the harness
-*     child or the box exists ({@link isPreSpawnExecutorFailure}). No provider call started.
-*  2. The attempt yielded NO execution event. An attempt that streamed anything may have metered
-*     usage, and a blind re-run would double-spend, so it stays fatal whatever its message says.
-*
-* Either proof missing means no retry. This is deliberately NARROWER than "is this an
-* infrastructure hiccup": `ECONNRESET` is a transient transport failure and is NOT retried here,
-* because it can arrive mid-stream after a metered call.
-*
-* Re-entry re-invokes `execute` on the SAME executor object. Nothing is rebuilt, so the executor's
-* runtime-owned materialization attestation, its bound session id, and its inbox are all the ones
-* the kernel admitted. For the bridge backend a second `execute` is a fresh session stream over the
-* same durable execution id, and a saturation refusal happens before that session's child spawned.
-*
-* @experimental
-*/
-/**
-* The backend refusals that are emitted BEFORE any child process, box, or provider request exists.
-*
-* Each is a queue admission deadline: the executor asked for a slot, waited, and was refused
-* without anything being started. The three names are the pools cli-bridge and the container host
-* admit through — the host executor, one scoped per-run host executor, and the container pool.
-*
-* The pattern is anchored to the whole phrase, including the `after <n>ms` deadline, so a message
-* that merely mentions a queue does not qualify.
-*/
-const PRE_SPAWN_SIGNATURES = Object.freeze([/\b(?:host-executor|scoped-host-executor|container-pool): acquire timeout after \d+ms\b/u]);
-const DEFAULT_MAX_TOTAL_MS = 9e5;
-const DEFAULT_INITIAL_BACKOFF_MS = 5e3;
-const DEFAULT_MAX_BACKOFF_MS = 6e4;
-/**
-* True when `error` is a backend refusal issued before anything ran.
-*
-* This answers "did this fail BEFORE any provider call", which is a strictly narrower question
-* than "is this an infrastructure hiccup". The broader question admits `ECONNRESET` and a bare
-* `fetch failed`, both of which can arrive after a metered call, and answering the broad question
-* where the narrow one is required is what makes a retry double-spend.
-*/
-function isPreSpawnExecutorFailure(error, additionalSignatures = []) {
-	const message = error instanceof Error ? error.message : String(error);
-	for (const signature of PRE_SPAWN_SIGNATURES) if (signature.test(message)) return true;
-	for (const signature of additionalSignatures) if (signature.test(message)) return true;
-	return false;
-}
-/** Read the policy, refusing a number a run cannot act on rather than silently clamping it. */
-function resolveWorkerSpawnRetry(policy) {
-	if (policy === void 0 || policy.enabled === false) return void 0;
-	const maxTotalMs = policy.maxTotalMs ?? DEFAULT_MAX_TOTAL_MS;
-	const initialBackoffMs = policy.initialBackoffMs ?? DEFAULT_INITIAL_BACKOFF_MS;
-	const maxBackoffMs = policy.maxBackoffMs ?? DEFAULT_MAX_BACKOFF_MS;
-	for (const [name, value] of [
-		["maxTotalMs", maxTotalMs],
-		["initialBackoffMs", initialBackoffMs],
-		["maxBackoffMs", maxBackoffMs]
-	]) if (!Number.isFinite(value) || value < 0) throw new ValidationError(`workerRetry.${name} must be a nonnegative finite number of milliseconds`);
-	const signatures = policy.additionalPreSpawnSignatures ?? [];
-	for (const signature of signatures) if (!(signature instanceof RegExp)) throw new ValidationError("workerRetry.additionalPreSpawnSignatures must contain RegExp values");
-	return Object.freeze({
-		maxTotalMs,
-		initialBackoffMs,
-		maxBackoffMs: Math.max(initialBackoffMs, maxBackoffMs),
-		signatures: Object.freeze([...signatures])
-	});
-}
-/**
-* Wrap a worker seam so a leaf whose spawn is refused before it runs is re-entered instead of
-* settling dead.
-*
-* The wrapper composes the agent's `executorFactory`, which is where a leaf executor is built with
-* the real child signal and node context, and it never replaces the executor object the factory
-* returned: the retry lives in one `execute` wrapper that carries the inner executor's attestation
-* forward and delegates every other surface to it.
-*/
-function withWorkerSpawnRetry(make, policy, hooks = {}) {
-	const resolved = resolveWorkerSpawnRetry(policy);
-	if (resolved === void 0) return make;
-	return (profile, spawnContext) => {
-		const agent = make(profile, spawnContext);
-		const spec = agent.executorSpec;
-		if (spec === void 0) return agent;
-		const seamHooks = {
-			...hooks,
-			...typeof profile.name === "string" ? { worker: profile.name } : {}
-		};
-		if (spec.executorFactory !== void 0) {
-			const innerFactory = spec.executorFactory;
-			const executorFactory = (builtSpec, ctx) => retryPreSpawnRefusals(innerFactory(builtSpec, ctx), resolved, seamHooks);
-			return {
-				...agent,
-				executorSpec: {
-					...spec,
-					executorFactory
-				}
-			};
-		}
-		if (spec.executor !== void 0) {
-			const executor = retryPreSpawnRefusals(spec.executor, resolved, seamHooks);
-			return {
-				...agent,
-				executorSpec: {
-					...spec,
-					executor
-				}
-			};
-		}
-		return agent;
-	};
-}
-/**
-* Re-enter `execute` on one executor while a pre-spawn refusal keeps proving nothing ran.
-*
-* Exported so an owner of `makeLeafAgent` — which builds its own executors — gets the same seam
-* without reimplementing the two proofs.
-*/
-function retryPreSpawnRefusals(inner, policy, hooks = {}) {
-	const now = hooks.now ?? Date.now;
-	const sleep = hooks.sleep ?? defaultSleep;
-	/** The wait before the next attempt, or `null` when this failure stays fatal. */
-	const nextWait = (error, attempt, yielded, startedAt, signal) => {
-		if (yielded) return null;
-		if (signal?.aborted) return null;
-		if (!isPreSpawnExecutorFailure(error, policy.signatures)) return null;
-		const backoff = Math.min(policy.maxBackoffMs, policy.initialBackoffMs * 2 ** (attempt - 1));
-		if (now() - startedAt + backoff >= policy.maxTotalMs) return null;
-		return backoff;
-	};
-	const report = (error, attempt, waitMs) => {
-		hooks.onRetry?.({
-			attempt,
-			waitMs,
-			...hooks.worker === void 0 ? {} : { worker: hooks.worker },
-			error: error instanceof Error ? error.message : String(error)
-		});
-	};
-	const wrapped = {
-		runtime: inner.runtime,
-		...inner.budgetExempt !== void 0 ? { budgetExempt: inner.budgetExempt } : {},
-		...inner.deliver ? { deliver: (message) => inner.deliver?.(message) } : {},
-		...inner.progress ? { progress: () => inner.progress?.() } : {},
-		...inner.traceSource ? { traceSource: () => inner.traceSource?.() } : {},
-		...inner.metered ? { metered: () => inner.metered?.() } : {},
-		...inner.accounting ? { accounting: () => inner.accounting?.() } : {},
-		...inner.resultAccepted ? { resultAccepted: () => inner.resultAccepted?.() === true } : {},
-		...inner.harnessTranscript ? { harnessTranscript: () => inner.harnessTranscript?.() } : {},
-		...inner.harnessTranscriptSettled ? { harnessTranscriptSettled: () => inner.harnessTranscriptSettled?.() ?? Promise.resolve() } : {},
-		...inner.interactive === void 0 ? {} : { interactive: () => interactiveOf(inner) },
-		execute(task, signal) {
-			const first = inner.execute(task, signal);
-			const restart = () => inner.execute(task, signal);
-			return isAsyncIterable(first) ? retryStream(first, restart, signal) : retryOneShot(first, restart, signal);
-		},
-		...inner.recover ? { recover: (task, signal) => inner.recover(task, signal) } : {},
-		teardown: (grace) => inner.teardown(grace),
-		...teardownSurfaces(inner),
-		resultArtifact: () => inner.resultArtifact()
-	};
-	async function* retryStream(first, restart, signal) {
-		const startedAt = now();
-		let execution = first;
-		for (let attempt = 1;; attempt += 1) {
-			let yielded = false;
-			try {
-				for await (const event of execution) {
-					yielded = true;
-					yield event;
-				}
-				return;
-			} catch (error) {
-				const waitMs = nextWait(error, attempt, yielded, startedAt, signal);
-				if (waitMs === null) throw error;
-				report(error, attempt, waitMs);
-				await sleep(waitMs, signal);
-				const next = restart();
-				if (!isAsyncIterable(next)) throw new ValidationError("retryPreSpawnRefusals: executor changed execution shape between attempts");
-				execution = next;
-			}
-		}
-	}
-	async function retryOneShot(first, restart, signal) {
-		const startedAt = now();
-		let execution = first;
-		for (let attempt = 1;; attempt += 1) try {
-			return await execution;
-		} catch (error) {
-			const waitMs = nextWait(error, attempt, false, startedAt, signal);
-			if (waitMs === null) throw error;
-			report(error, attempt, waitMs);
-			await sleep(waitMs, signal);
-			const next = restart();
-			if (isAsyncIterable(next)) throw new ValidationError("retryPreSpawnRefusals: executor changed execution shape between attempts");
-			execution = next;
-		}
-	}
-	return inheritRuntimeOwnedExecutorAttestation(inner, wrapped);
-}
-/** Forward the inner executor's interactive contract exactly. The method is present only when the
-*  inner executor implements it, so the reachable call always has one to delegate to. */
-function interactiveOf(inner) {
-	if (inner.interactive === void 0) throw new ValidationError("retryPreSpawnRefusals: inner executor exposes no interactive session");
-	return inner.interactive();
-}
-/** The wait stays REF'd: a worker waiting out a saturated executor is live work, and an unref'd
-*  timer lets the process exit mid-backoff when nothing else is pending. */
-function defaultSleep(ms, signal) {
-	if (ms <= 0 || signal?.aborted) return Promise.resolve();
-	return sleep(ms, signal);
-}
 // src/runtime/supervise/supervise-recursive-workers.ts
 function createSuperviseWorkers(setup, cancelDurableRun) {
 	const { options, canonicalProfile, rootExecution, guidanceComposer, deliverable, analysts, journal, runId, rootOwnerId, now } = setup;
@@ -7652,15 +7370,13 @@ function createSuperviseWorkers(setup, cancelDurableRun) {
 	let makeWorkerAgent = options.makeWorkerAgent;
 	if (!makeWorkerAgent) {
 		if (!options.backend && !options.makeLeafAgent) throw new ValidationError("supervise: provide opts.backend (where workers run), opts.makeLeafAgent, or opts.makeWorkerAgent");
-		const withRetry = (make) => withWorkerSpawnRetry(make, options.workerRetry, { ...options.onWorkerRetry ? { onRetry: options.onWorkerRetry } : {} });
 		makeWorkerAgent = recursiveWorkerFactoryFor({
 			setup,
 			cancelDurableRun,
 			graphSubtasks,
 			graphOverlayFor,
 			recoveryFactories,
-			withRetry,
-			makeLeaf: withRetry(options.makeLeafAgent ?? workerFromBackend(options.backend, deliverable)),
+			makeLeaf: options.makeLeafAgent ?? workerFromBackend(options.backend, deliverable),
 			securityPolicy: options.profileSecurity ?? DEFAULT_AUTHORED_PROFILE_SECURITY_POLICY
 		}, {
 			parent: canonicalProfile,
@@ -8348,10 +8064,14 @@ var ManagerDriveSession = class {
 		}
 		const seatJournalRoot = scopeRetainedOwnerJournalRoot(scope) ?? seatSelection.rootId;
 		this.seatChain ??= new SeatChain(authoredProfile, scope.view.root, seatJournalRoot, seatSelection.journal, seatSelection.select, now, (segment, phase) => seatSelection.onSegment(scope.view.root, segment, phase), async (selection, previous) => {
-			if (previous && previous.seat !== selection.seat) {
-				const sameEnvironment = previous.provider === selection.stage.provider && previous.harness === selection.stage.harness;
-				const checkpoint = await prepareScopeRetainedOwnerSeatSwitch(scope, sameEnvironment ? "same-environment" : "replace-environment");
-				if (!sameEnvironment) this.switchedProviderCheckpointAt = checkpoint.checkpointAt;
+			if (!previous || previous.seat === selection.seat) return;
+			const sameEnvironment = previous.provider === selection.stage.provider && previous.harness === selection.stage.harness;
+			try {
+				const checkpointAt = await prepareScopeRetainedOwnerSeatSwitch(scope, sameEnvironment ? "same-environment" : "replace-environment");
+				if (!sameEnvironment) this.switchedProviderCheckpointAt = checkpointAt;
+			} catch (error) {
+				scope.signal.throwIfAborted();
+				throw new SeatPauseError(new Date(now() + SEAT_RECHECK_MS).toISOString(), `seat switch waits: ${errorText(error instanceof Error ? error.message : error)}`);
 			}
 		});
 		const usageLimit = reentry?.reason.reason === "upstream-unavailable" && reentry.reason.signal === "subscription-usage-limit";
@@ -8374,13 +8094,14 @@ var ManagerDriveSession = class {
 			if (afterRecheck) await seatSelection.onPause(scope.view.root, "", "resumed");
 			return seat;
 		} catch (error) {
-			if (!(error instanceof SeatChainExhaustedError)) throw error;
+			if (!(error instanceof SeatPauseError)) throw error;
 			if (error.resumeAt !== pausedUntil) {
 				pausedUntil = error.resumeAt;
 				await seatSelection.journal.appendEvent(seatJournalRoot, {
 					kind: "seat-paused",
 					id: scope.view.root,
 					resumeAt: error.resumeAt,
+					...error.detail === void 0 ? {} : { detail: error.detail },
 					seq: Date.parse(error.resumeAt),
 					at: new Date(now()).toISOString()
 				});
@@ -8400,7 +8121,7 @@ var ManagerDriveSession = class {
 async function executeDriverAttempt(input) {
 	const { state, scope, retainedOwner, turnCap } = input;
 	if (!(scope.view.inFlight > 0)) {
-		const spent = exhaustedBudgetChannels(scope.budget, input.now()) ?? (scope.budget.iterationsLeft <= 0 ? "iterations: none left" : void 0);
+		const spent = exhaustedBudgetChannels(scope.budget, input.now()) ?? (scope.budget.iterationsCapped !== false && scope.budget.iterationsLeft <= 0 ? "iterations: none left" : void 0);
 		if (spent) throw new ValidationError(`driveHarnessFromBackend: supervisor budget exhausted (${spent})`);
 	}
 	const identity = admitDriverProfiles(input);
@@ -8649,7 +8370,7 @@ function driveHarnessFromBackend(backend, executionId, now = Date.now, maxTurns,
 		const failures = (await Promise.allSettled([manager.closeSeatSegment(reason), ...[...state.coordinationSecrets?.values() ?? []].map((secret) => secret.release())])).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
 		if (failures.length) throw new AggregateError(failures, "manager settlement cleanup failed");
 	};
-	return attestRuntimeOwnedScopeOwner(drive, manager.ownerRuntime);
+	return attestRuntimeOwnedScopeOwner(Object.assign(drive, seatSelection ? { seatChain: true } : {}), manager.ownerRuntime);
 }
 async function bindDriveRetainedOwner(manager, { scope, profile, authoredProfile }) {
 	const { state, activeSeat } = manager;
@@ -8851,7 +8572,7 @@ function providerSpawnPreflight(provider) {
 	const validate = provider.validateProfile?.bind(provider);
 	if (validate === void 0) return void 0;
 	return async (profile) => {
-		const result = await validate(profile);
+		const result = await validate(providerVisibleProfile(profile));
 		const errors = result.issues.filter((issue) => issue.level === "error");
 		if (result.ok && errors.length === 0) return void 0;
 		const named = errors.map((issue) => `${issue.code}${issue.path === void 0 ? "" : ` at ${issue.path}`}: ${issue.message}`);
@@ -8861,6 +8582,23 @@ function providerSpawnPreflight(provider) {
 		};
 	};
 }
+/** Refuse a Runtime-managed child whose model controls its executor would refuse at its first
+*  attempt (an unknown `model.metadata` key, an ambiguous `maxTokens`): the same check, at the call. */
+function modelSettingsSpawnPreflight(runtimeOwnsManager, path) {
+	if (!runtimeOwnsManager) return void 0;
+	return async (profile) => {
+		try {
+			profileModelExecutionSettings(profile, "spawn_worker", path);
+			return;
+		} catch (error) {
+			if (!(error instanceof ConfigError)) throw error;
+			return {
+				cause: "unprovisionable-profile",
+				detail: error.message
+			};
+		}
+	};
+}
 /** Refuse a Runtime-managed child whose declared tools cannot exist on its execution path. */
 function profileToolSpawnPreflight(runtimeOwnsManager, canResolveProductTools) {
 	return async (profile) => {
@@ -8933,21 +8671,34 @@ async function assertSqlRunProvider(options) {
 	if (!capabilities.retainedControl || !capabilities.streaming.turnIdempotency || !capabilities.streaming.replay || !provider.get) throw new ValidationError("supervise: SQL runContext requires retainedControl, replay, turn idempotency, and provider.get");
 }
 // src/runtime/supervise/supervise-run-setup.ts
-function prepareSuperviseRun(profile, task, opts, testBrain) {
-	const options = captureSuperviseOptions(opts);
-	assertSqlRunOptions(options);
-	assertValidBudget(options.budget, "supervise budget");
+/** Canonical root identity is needed for control operations before executable admission. */
+function prepareSuperviseIdentity(profile, task, opts, mode = "execution") {
+	const options = captureSuperviseOptions(opts, mode);
 	const guidanceComposer = profileGuidanceComposer(options.profileGuidance);
 	const { applyTraceTools, composeSpawnProfile } = traceToolPolicy(options, guidanceComposer);
-	const peerAuditFor = peerAuditRegistry(options);
 	const registeredProfile = applyTraceTools(superviseRootProfile(profile, options.profileGuidance));
 	if (options.segment !== void 0) admitSegment(options.segment);
 	const canonicalProfile = options.segment === void 0 ? registeredProfile : withRootSegment(registeredProfile, options.segment);
-	if (!testBrain || !isRuntimeFlowBrain(testBrain)) assertExecutableAgentProfile(canonicalProfile, "supervise root");
 	const canonicalTask = freezeDetached(task);
+	return {
+		options,
+		guidanceComposer,
+		applyTraceTools,
+		composeSpawnProfile,
+		registeredProfile,
+		canonicalProfile,
+		canonicalTask,
+		rootExecution: canonicalExecution(registeredProfile, canonicalTask, options.execution, "supervise root")
+	};
+}
+function prepareSuperviseRun(profile, task, opts, testBrain) {
+	const { options, guidanceComposer, applyTraceTools, composeSpawnProfile, registeredProfile, canonicalProfile, canonicalTask, rootExecution } = prepareSuperviseIdentity(profile, task, opts);
+	assertSqlRunOptions(options);
+	assertValidBudget(options.budget, "supervise budget");
+	const peerAuditFor = peerAuditRegistry(options);
+	if (!testBrain || !isRuntimeFlowBrain(testBrain)) assertExecutableAgentProfile(canonicalProfile, "supervise root");
 	assertWorkerSeams(options);
 	const authorizeDownFor = downMessageAuthorizer(options);
-	const rootExecution = canonicalExecution(registeredProfile, canonicalTask, options.execution, "supervise root");
 	assertRunModelsAllowed(canonicalProfile, options);
 	const { deliverable, finalizer, analysts, profileTable } = resolveRunRegistry(options);
 	assertCoordinationBinding(options.coordination);
@@ -9077,7 +8828,6 @@ function peerAuditRegistry(options) {
 function assertWorkerSeams(options) {
 	if (options.makeWorkerAgent && options.authorizeSpawn) throw new ValidationError("supervise: authorizeSpawn cannot be combined with caller-owned makeWorkerAgent; use makeLeafAgent to override leaf execution inside the authorized path, or use backend-derived workers");
 	if (options.makeWorkerAgent && options.makeLeafAgent) throw new ValidationError("supervise: makeWorkerAgent replaces the worker path and makeLeafAgent overrides a leaf inside it; pass one");
-	if (options.makeWorkerAgent && (options.workerRetry || options.onWorkerRetry)) throw new ValidationError("supervise: workerRetry applies only to backend-derived workers; compose withWorkerSpawnRetry onto a caller-owned makeWorkerAgent explicitly");
 	if (options.makeWorkerAgent && options.resolveDeliverable) throw new ValidationError("supervise: resolveDeliverable applies only to backend-derived workers; wrap a caller-owned makeWorkerAgent with its completion checks explicitly");
 }
 function downMessageAuthorizer(options) {
@@ -9123,7 +8873,7 @@ function resolveRunRegistry(options) {
 function admitPerWorker(options) {
 	assertRecursiveReservationPolicy(options.reservationPolicy);
 	const ownerShare = options.reservationPolicy?.ownerShare ?? 0;
-	const perWorker = options.perWorker ?? defaultPerWorker(options.budget, ownerShare);
+	const perWorker = options.perWorker ?? defaultPerWorker(options.budget, ownerShare, options.workerSlots);
 	assertValidBudget(perWorker, "supervise perWorker");
 	assertPerWorkerWithinPool(perWorker, options.budget);
 	if (options.perWorker !== void 0) assertPerWorkerAdmittable(perWorker, options.budget, ownerShare);
@@ -9154,7 +8904,13 @@ function managerDriverPlan(options, canonicalProfile, externalRoot) {
 	if (authoredSeatStages(canonicalProfile) && !hasCustomDriveHarness && !options.selectSeat) throw new ValidationError("supervise: AgentProfile.seats requires selectSeat before execution");
 	const automaticDriver = managerBackend !== void 0 && automaticDriverBackendSupported(managerBackend, options.coordination);
 	const spawnResourceRoot = hasCustomDriveHarness ? void 0 : rootSpawnResourceRoot(managerBackend);
-	const spawnPreflight = composeSpawnPreflights(profileToolSpawnPreflight(options.makeWorkerAgent === void 0, options.resolveSupervisorTools !== void 0), coordinationChannelSpawnPreflight(options.makeWorkerAgent === void 0, hasCustomDriveHarness, managerBackend, options.coordination), options.backend?.backend === "bridge" ? bridgeSpawnPreflight(options.backend) : void 0, options.backend?.backend === "provider" && typeof options.backend.provider === "object" ? providerSpawnPreflight(options.backend.provider) : void 0);
+	const spawnPreflight = composeSpawnPreflights(async (profile, context) => {
+		const external = isExternalSupervisor(profile);
+		const manager = declaredRuntimeToolNames(profile).length > 0 || external && authoredSeatStages(profile) !== void 0;
+		const custom = manager ? external && hasCustomDriveHarness : options.makeLeafAgent !== void 0;
+		const backend = manager ? external ? managerBackend : void 0 : options.backend;
+		return modelSettingsSpawnPreflight(options.makeWorkerAgent === void 0 && !custom, backend?.backend === "provider" ? "provider" : "router")?.(profile, context);
+	}, profileToolSpawnPreflight(options.makeWorkerAgent === void 0, options.resolveSupervisorTools !== void 0), coordinationChannelSpawnPreflight(options.makeWorkerAgent === void 0, hasCustomDriveHarness, managerBackend, options.coordination), options.backend?.backend === "bridge" ? bridgeSpawnPreflight(options.backend) : void 0, options.backend?.backend === "provider" && typeof options.backend.provider === "object" ? providerSpawnPreflight(options.backend.provider) : void 0);
 	const driverMaterialization = hasCustomDriveHarness ? options.driveHarnessMaterialization ?? fullProfileMaterialization : managerBackend && automaticDriver ? backendProfileMaterialization(managerBackend) : void 0;
 	if (externalRoot && !hasCustomDriveHarness && !automaticDriver) throw new ValidationError(`supervise: external supervisor profile.harness=${JSON.stringify(canonicalProfile.harness)} requires a local bridge, a provider with authenticated coordination.publicUrl and runtime MCP attachments, or an explicit driveHarness with reachable coordination transport`);
 	return {
@@ -9185,6 +8941,8 @@ function spawnProfileComposer(options, driver, childrenCanSubmit, composeSpawnPr
 }
 // src/runtime/supervise/supervise-run-lifecycle.ts
 function superviseInternal(profile, task, opts, testBrain) {
+	const cancelled = pendingCancellationRun(profile, task, opts);
+	if (cancelled !== void 0) return cancelled;
 	const setup = prepareSuperviseRun(profile, task, opts, testBrain);
 	const { options } = setup;
 	const workers = createSuperviseWorkers(setup, (reason, request) => cancelDurableRun(reason, request));
@@ -9202,6 +8960,88 @@ function superviseInternal(profile, task, opts, testBrain) {
 		rootContinuation: void 0
 	});
 }
+/** The aborted kernel entry owns replay and resource custody without executable admission. */
+function pendingCancellationRun(profile, task, opts) {
+	const runDir = opts.runDir;
+	if (runDir === void 0 || opts.runContext?.durability === "sql") return void 0;
+	const request = readRunCancelRequest(runDir);
+	if (request === void 0) return void 0;
+	const acknowledged = readRunCancellation(runDir, request.operationId);
+	if (acknowledged !== void 0 && acknowledged.effect !== "cancel_requested") return void 0;
+	const { options, registeredProfile, canonicalProfile, canonicalTask, rootExecution } = prepareSuperviseIdentity(profile, task, opts, "control");
+	const now = options.now ?? Date.now;
+	const controller = new AbortController();
+	applyRunCancellation(runDir, (reason, request) => {
+		controller.abort(request === void 0 ? new Error(reason) : new RunCancellationReason(request.source, reason, request.operationId, request.operator));
+	}, () => new Date(now()).toISOString(), "observer");
+	const context = options.runContext ?? createFileRunContext(runDir, { withDriver: true });
+	return (async () => {
+		if (!controller.signal.aborted) throw new Error("run cancellation changed before control entry");
+		const runId = options.runId ?? context.runId ?? "supervise";
+		const journal = options.journal ?? context.journal;
+		const prior = await journal.loadTree(runId);
+		const root = prior?.find((event) => event.kind === "spawned" && event.id === runId);
+		const reopened = [...prior ?? []].reverse().find((event) => event.kind === "reopened" && event.id === runId && event.budget !== void 0);
+		const budget = options.budget ?? (reopened?.kind === "reopened" ? reopened.budget : void 0) ?? (root?.kind === "spawned" ? root.budget : void 0);
+		if (budget === void 0) throw new Error("cancelled run has no declared or recorded budget");
+		assertValidBudget(budget, "supervise budget");
+		const rootAgent = {
+			name: canonicalProfile.name ?? "supervise",
+			async act() {
+				throw new Error("cancelled run cannot enter execution");
+			}
+		};
+		const backend = options.driverBackend ?? (options.rootDriverFromBackend === false ? void 0 : options.backend);
+		if (backend?.backend === "provider" && !options.driveHarness && !options.resolveDriveHarness) {
+			const provider = typeof backend.provider === "string" ? backend.registry?.get(backend.provider) : backend.provider;
+			const priorProviders = new Set((prior ?? []).flatMap((event) => event.id === runId && event.kind === "execution-admitted" ? [event.admission.phase === "dispatched" ? event.admission.controlRef.provider : event.admission.provider] : []));
+			if (provider !== void 0 && priorProviders.size === 1 && priorProviders.has(provider.name)) attestRuntimeOwnedScopeOwner(rootAgent, root?.kind === "spawned" ? root.runtime : provider.name, {
+				provider,
+				...backend.workspaceRetention === void 0 ? {} : { checkpointCapture: {
+					port: backend.workspaceRetention,
+					profile: providerVisibleProfile(canonicalProfile)
+				} }
+			});
+		}
+		const result = await createSupervisor().run(rootAgent, canonicalTask, {
+			budget,
+			runId,
+			journal,
+			blobs: options.blobs ?? context.blobs,
+			executors: context.executors,
+			rootIdentity: rootExecution.identity,
+			rootMaterialization: {
+				runtime: root?.kind === "spawned" ? root.runtime : "inline",
+				declaration: "deferred",
+				authoredProfile: registeredProfile
+			},
+			...options.segment === void 0 ? {} : { rootSegment: {
+				registered: rootSegmentOf(registeredProfile),
+				current: {
+					...rootSegmentOf(canonicalProfile),
+					...options.segment.stack === void 0 ? {} : { stack: { ...options.segment.stack } }
+				},
+				reason: options.segment.reason
+			} },
+			...options.recoverExecutor === void 0 ? {} : { recoverExecutor: options.recoverExecutor },
+			...options.reservationPolicy === void 0 ? {} : { reservationPolicy: options.reservationPolicy },
+			...options.workerSlots === void 0 ? {} : { workerSlots: options.workerSlots },
+			...options.teardownConfirmMs === void 0 ? {} : { teardownConfirmMs: options.teardownConfirmMs },
+			...context.resume === true || options.resume === true ? { resume: true } : {},
+			retainedAtSettlement: options.retainedAtSettlement ?? "release",
+			hooks: options.hooks,
+			now,
+			signal: options.signal === void 0 ? controller.signal : AbortSignal.any([controller.signal, options.signal]),
+			interactiveBindingDir: runDir
+		});
+		recordRunCancellationOutcome(runDir, result, now);
+		return {
+			...result,
+			rootProviderModel: rootProviderModelEvidence([]),
+			...rootExecution.ref === void 0 ? {} : { execution: rootExecution.ref }
+		};
+	})();
+}
 async function startSupervisedRun(run) {
 	const { setup, runControl, cancelDurableRun } = run;
 	const { options, ctx, log, runId, rootOwnerId, canonicalTask } = setup;
@@ -9440,6 +9280,6 @@ function superviseWithContext(profile, task, opts, brain) {
 		...signal === void 0 ? {} : { signal }
 	}, brain));
 }
-export { analyzesFindingsReportPrompt as A, anyOf as B, flowRootProfile as C, defaultEdgeTraversalCap as D, validateFlowGraph as E, formatPromptHandle as F, bestSoFar as G, plateau as H, kernelPromptRegistry as I, createSupervisorSpanRecorder as J, plateauLength as K, naiveContinuationPrompt as L, delegatesWorkerBriefPrompt as M, dumbContinuationFailPrompt as N, graphRootProfile as O, dumbContinuationPassPrompt as P, promptHandle as R, createFlowRun as S, routeFlowOf as T, anytimeReport as U, noProgressFor as V, areaUnderCurve as W, coordinationControlToolNames as _, superviseRootProfile as a, createGraphOverlay as b, retryPreSpawnRefusals as c, supervisorAgent as d, supervisorAgentWithTestBrain as f, serveCoordinationMcp as g, composeReentryTask as h, profileGuidanceComposer as i, createPromptRegistry as j, validateGraphTopology as k, withWorkerSpawnRetry as l, UNPROVEN_CONTINUITY as m, superviseFleetCapabilities as n, isPreSpawnExecutorFailure as o, runToolSpans as p, renderAnytimeTable as q, superviseWithTestBrain as r, resolveWorkerSpawnRetry as s, supervise as t, workerFromBackend as u, driverAgent as v, journaledGateDecider as w, GraphRouteError as x, runBrainLoop as y, allWorkersStalled as z };
+export { dumbContinuationPassPrompt as A, areaUnderCurve as B, defaultEdgeTraversalCap as C, createPromptRegistry as D, analyzesFindingsReportPrompt as E, allWorkersStalled as F, plateauLength as H, anyOf as I, noProgressFor as L, kernelPromptRegistry as M, naiveContinuationPrompt as N, delegatesWorkerBriefPrompt as O, promptHandle as P, plateau as R, validateFlowGraph as S, validateGraphTopology as T, renderAnytimeTable as U, bestSoFar as V, createSupervisorSpanRecorder as W, GraphRouteError as _, superviseRootProfile as a, journaledGateDecider as b, supervisorAgentWithTestBrain as c, composeReentryTask as d, serveCoordinationMcp as f, createGraphOverlay as g, runBrainLoop as h, profileGuidanceComposer as i, formatPromptHandle as j, dumbContinuationFailPrompt as k, runToolSpans as l, driverAgent as m, superviseFleetCapabilities as n, workerFromBackend as o, coordinationControlToolNames as p, superviseWithTestBrain as r, supervisorAgent as s, supervise as t, UNPROVEN_CONTINUITY as u, createFlowRun as v, graphRootProfile as w, routeFlowOf as x, flowRootProfile as y, anytimeReport as z };
 
-//# sourceMappingURL=supervise-472pyfgQ.js.map
+//# sourceMappingURL=supervise-rYEsVVcn.js.map