@tangle-network/agent-runtime 6.0.8 → 8.0.0

package/dist/{scope-gIYQ5ZiL.js → supervisor-accounting-Bw4MJk-b.js}

@@ -1,10 +1,10 @@
-import { c as RetainedInteractiveAdmissionError, d as RetainedRunDispatchBindingError, f as RuntimeRunStateError, l as RetainedInteractiveBindingError, m as ValidationError, u as RetainedRunAdmissionError } from "./errors-AzSuGI23.js";
-import { A as withBudgetResources, B as singleFlightTeardown, C as unreportedSpend, D as addResourceSpend, I as armDeadlineTimer, L as boundedChildDeadlineAt, M as CHILD_DEADLINE_REASON, R as checkInIdleMs, T as zeroSpend, V as teardownExecutor, a as cloneSpend, c as errorMessage, f as isAsyncIterable, i as chargedTokens, k as resourceTelemetry, n as addSpend, o as cloneTokenUsage, t as abortError, v as sleep } from "./util-C_cdPNC4.js";
-import { $ as assertValidBudget, F as executorFailureInfra, G as budgetRecoverySeeds, H as BudgetReconcileFault, I as executorFailureReason, J as refreshBudgetLease, K as completedLeafBacking, M as contentAddress, P as executorFailure, Q as spendFromUsageTotals, U as budgetLeaseUpdates, W as budgetLeases, X as newUsageTotals, Y as meterUsageEvent, et as assertValidSpend, f as executorEvidenceWriter, g as prepareRetainedExecutor, h as leafContinuationExecutionId, j as traceRootWriter, lt as extractTransportEventIdentity, n as runtimeFailureCause, o as settlementFailureCause, q as createBudgetPool, s as BUDGET_CONTINUATION_TASK, t as reportedFailureCause, u as RetainedExecutionPendingError, ut as parseCanonicalTransportEvent, wt as recordValue, y as retainedExecutorSeamKey } from "./failure-cause-BzjUUsRz.js";
-import { a as errMessage, c as errorText, d as resolveRedactor, l as defaultRedactor, n as detachedSnapshot, r as shareParsedStrings } from "./snapshot-Cgj2Wzi6.js";
-import { t as assertExecutableAgentProfile } from "./model-policy-JOcg3NRs.js";
+import { c as RetainedInteractiveAdmissionError, d as RetainedRunDispatchBindingError, f as RuntimeRunStateError, l as RetainedInteractiveBindingError, m as ValidationError, r as BackendTransportError, u as RetainedRunAdmissionError } from "./errors-DG8yufqX.js";
+import { A as withBudgetResources, B as singleFlightTeardown, C as unreportedSpend, D as addResourceSpend, I as armDeadlineTimer, L as boundedChildDeadlineAt, M as CHILD_DEADLINE_REASON, R as checkInIdleMs, T as zeroSpend, V as teardownExecutor, a as cloneSpend, c as errorMessage, f as isAsyncIterable, i as chargedTokens, k as resourceTelemetry, n as addSpend, o as cloneTokenUsage, t as abortError, v as sleep } from "./util-fcckrkKp.js";
+import { $ as spendFromUsageTotals, F as executorFailureInfra, G as budgetLeases, I as executorFailureReason, J as createBudgetPool, K as budgetRecoverySeeds, M as contentAddress, P as executorFailure, Tt as recordValue, U as BudgetReconcileFault, W as budgetLeaseUpdates, X as meterUsageEvent, Y as refreshBudgetLease, Z as newUsageTotals, dt as parseCanonicalTransportEvent, et as assertValidBudget, f as executorEvidenceWriter, g as prepareRetainedExecutor, h as leafContinuationExecutionId, j as traceRootWriter, n as runtimeFailureCause, o as settlementFailureCause, q as completedLeafBacking, s as BUDGET_CONTINUATION_TASK, t as reportedFailureCause, tt as assertValidSpend, u as RetainedExecutionPendingError, ut as extractTransportEventIdentity, y as retainedExecutorSeamKey } from "./failure-cause-CVB-YE88.js";
+import { a as errMessage, f as resolveRedactor, l as errorText, n as detachedSnapshot, r as shareParsedStrings, u as defaultRedactor } from "./snapshot-BKI_w3JD.js";
+import { t as assertExecutableAgentProfile } from "./model-policy-yxOrDTTj.js";
 import { a as readCommittedJsonLines, c as appendCommittedJsonLine, l as sha256, r as prepareJsonlAppend, s as withJsonlFileLock, t as isNoEntError } from "./jsonl-file-DsxVI0E_.js";
-import { F as deepFreezeCandidate, h as workspaceLimits, i as readAgentCandidateWorkspaceArtifactFiles, j as verifiedArtifactChunks, m as safeArchivePath, z as sha256Bytes$1 } from "./workspace-streams-B7yNMahl.js";
+import { F as deepFreezeCandidate, h as workspaceLimits, i as readAgentCandidateWorkspaceArtifactFiles, j as verifiedArtifactChunks, m as safeArchivePath, z as sha256Bytes$1 } from "./workspace-streams-DA9R3j-p.js";
 import { a as writeAtomicDurableFile, n as assertNoSymlinkDescendant, o as captureRunWriteContext, r as publishExclusiveDurableFile, s as fenceRunWrite, t as appendDurableFile } from "./durable-file-DstVeHcj.js";
 import { a as withPursuitContext, i as notifyRuntimeHookEvent } from "./runtime-hooks-CsW2pfFk.js";
 import * as traceContract from "@tangle-network/agent-trace-contract";
@@ -130,6 +130,11 @@ function signalAbortError(signal, fallback) {
 	error.name = "AbortError";
 	return error;
 }
+/** A parent abort stops the call at once. The timeout still bounds a parent that stays open. */
+function deadlineSignal(parent, ms) {
+	const timeout = AbortSignal.timeout(ms);
+	return parent === void 0 ? timeout : AbortSignal.any([parent, timeout]);
+}
 /** Cascade source aborts and preserve their reason; release removes the source listeners. */
 function linkAbort(...sources) {
 	const controller = new AbortController();
@@ -220,6 +225,24 @@ function exactSession(environment, controlRef) {
 		controlRef: currentControlRef
 	};
 }
+/** The provider returned a different session than the one this execution admitted. A lost
+*  reply, which keeps the same coordinates and no session, is not this case. */
+const replacedSessionMessage = /* @__PURE__ */ new Set([
+	"provider reconstructed a different retained environment",
+	"provider reconstructed a different session",
+	"provider session reconstructed a different retained session",
+	"provider session returned a different exact run control reference"
+]);
+function retainedSessionReplaced(error) {
+	const seen = /* @__PURE__ */ new Set();
+	let current = error;
+	for (let depth = 0; depth < 8 && current !== void 0 && !seen.has(current); depth += 1) {
+		seen.add(current);
+		if (current instanceof Error && replacedSessionMessage.has(current.message)) return true;
+		current = current instanceof Error ? current.cause : void 0;
+	}
+	return false;
+}
 function sameControlCoordinates(left, right) {
 	return canonicalCandidateDigest(left) === canonicalCandidateDigest(right);
 }
@@ -265,6 +288,24 @@ var RetainedRunProviderContractError = class extends Error {
 		this.code = options.code ?? "RETAINED_RUN_PROVIDER_CONTRACT_ERROR";
 	}
 };
+const HTML_PAGE_START = /^<!doctype html|^<html|^<body/i;
+/** A gateway's HTML error page that reached a retained-run read as the failure text: a replay
+*  endpoint behind Cloudflare answers 5xx with markup, which is a transport failure (retry,
+*  outage window), never a contract violation inviting reconciliation of an execution that never
+*  started (#1203). Extracts the printed HTTP status and a bounded, tag-free excerpt. */
+function htmlTransportFailure(error) {
+	if (!(error instanceof Error)) return void 0;
+	const text = error.message ?? "";
+	if (!HTML_PAGE_START.test(text.trim())) return void 0;
+	const headline = /<title>([^<]*)<\/title>/i.exec(text)?.[1]?.trim() ?? text.replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+	const status = /\b([45]\d\d)\b/.exec(headline)?.[1];
+	const excerpt = headline.slice(0, 200);
+	return new BackendTransportError("provider", `provider answered an HTML error page${status === void 0 ? "" : ` (HTTP ${status})`}: ${excerpt}`, {
+		...status === void 0 ? {} : { status: Number(status) },
+		body: excerpt,
+		cause: error
+	});
+}
 function cancellationRequest(controlRef, operationId, reason) {
 	const material = {
 		operationId,
@@ -403,6 +444,14 @@ function runtimeFlowAgent(agent, brain) {
 function isRuntimeFlowAgent(agent) {
 	return typeof agent === "object" && agent !== null && flowOwners.has(agent);
 }
+/** A check node's executor factory runs a command, not a model, so it carries no model identity. */
+function runtimeCheckFactory(factory) {
+	flowOwners.add(factory);
+	return factory;
+}
+function isRuntimeCheckFactory(factory) {
+	return typeof factory === "function" && flowOwners.has(factory);
+}
 // src/runtime/supervise/executable-spec.ts
 /** Read untrusted fields once, then parse and seal the exact executable profile. */
 function executableAgentProfileSnapshot(raw, context) {
@@ -419,7 +468,7 @@ function authoredAgentProfileSnapshot(raw, context) {
 /** Snapshot an executable spec while retaining trusted callbacks by reference. */
 function executableAgentSpecSnapshot(raw, context) {
 	const { profile: rawProfile, harness, execution: rawExecution, ...runtimeExtensions } = raw;
-	const profile = raw.executor === void 0 && !isRuntimeFlowAgent(runtimeExtensions.driver) ? executableAgentProfileSnapshot(rawProfile, context) : authoredAgentProfileSnapshot(rawProfile, context);
+	const profile = raw.executor === void 0 && !isRuntimeFlowAgent(runtimeExtensions.driver) && !isRuntimeCheckFactory(raw.executorFactory) ? executableAgentProfileSnapshot(rawProfile, context) : authoredAgentProfileSnapshot(rawProfile, context);
 	const execution = rawExecution === void 0 ? void 0 : detachedSnapshot(rawExecution, `${context}: execution attribution`);
 	return Object.freeze({
 		...runtimeExtensions,
@@ -447,6 +496,7 @@ const declarationKeys = /* @__PURE__ */ new Set([
 	"authoredProfile",
 	"backend",
 	"model",
+	"resources",
 	"execution",
 	"materializer",
 	"plan",
@@ -645,6 +695,7 @@ function knownMaterializationReceipt(input) {
 	assertNonEmpty(declaration.execution?.kind, "execution.kind");
 	assertNonEmpty(declaration.execution?.id, "execution.id");
 	assertModel(declaration.model);
+	assertResources(declaration.resources);
 	let effectiveProfileDigest;
 	let materializationPlanDigest;
 	let platformAttachmentsDigest;
@@ -665,6 +716,10 @@ function knownMaterializationReceipt(input) {
 		runtime: input.runtime,
 		backend: declaration.backend,
 		model: declaration.model,
+		resources: declaration.resources ?? {
+			status: "unknown",
+			reason: "executor-did-not-report-applied-resources"
+		},
 		execution: declaration.execution,
 		materializer: declaration.materializer
 	});
@@ -770,6 +825,46 @@ function assertModel(model) {
 	}
 	throw new ValidationError("executor materialization: model.status must be known or unknown");
 }
+function assertResources(resources) {
+	if (resources === void 0) return;
+	if (typeof resources !== "object" || resources === null || Array.isArray(resources)) throw new ValidationError("executor materialization: resources must be a known/unknown report");
+	const keys = Object.keys(resources).sort().join(",");
+	if (resources.status === "unknown") {
+		if (keys !== "reason,status") throw new ValidationError("executor materialization: unknown resources accepts only status and reason");
+		assertNonEmpty(resources.reason, "resources.reason");
+		return;
+	}
+	if (resources.status !== "known") throw new ValidationError("executor materialization: resources.status must be known or unknown");
+	const sizes = {
+		cpu: resources.cpu,
+		memoryMb: resources.memoryMb,
+		diskMb: resources.diskMb
+	};
+	const allowed = /* @__PURE__ */ new Set([
+		...Object.keys(sizes),
+		"accelerator",
+		"origin",
+		"observedAt",
+		"status"
+	]);
+	const stray = Object.keys(resources).filter((key) => !allowed.has(key));
+	if (stray.length > 0) throw new ValidationError(`executor materialization: known resources accepts only ${[...allowed].sort().join(", ")}: ${stray.sort().join(", ")}`);
+	const positive = (value, integer) => Number.isFinite(value) && value > 0 && (!integer || Number.isInteger(value));
+	for (const [field, value] of Object.entries(sizes).filter(([, v]) => v !== void 0)) if (!positive(value, field !== "cpu")) throw new ValidationError(`executor materialization: resources.${field} must be a positive ${field === "cpu" ? "number" : "integer"}`);
+	if (resources.accelerator !== void 0) {
+		const accelerator = resources.accelerator;
+		assertNonEmpty(accelerator.kind, "resources.accelerator.kind");
+		if (!positive(accelerator.count, true)) throw new ValidationError("executor materialization: resources.accelerator.count must be a positive integer");
+		if (accelerator.memoryMb !== void 0 && !positive(accelerator.memoryMb, true)) throw new ValidationError("executor materialization: resources.accelerator.memoryMb must be a positive integer");
+	}
+	if (Object.values(sizes).every((v) => v === void 0) && resources.accelerator === void 0) throw new ValidationError("executor materialization: known resources needs at least one of cpu, memoryMb, diskMb, accelerator");
+	if (![
+		"estimated",
+		"measured",
+		"reported"
+	].includes(resources.origin)) throw new ValidationError("executor materialization: resources.origin must be estimated, measured or reported");
+	assertNonEmpty(resources.observedAt, "resources.observedAt");
+}
 function assertNonEmpty(value, field) {
 	if (typeof value !== "string" || value.trim().length === 0) throw new ValidationError(`executor materialization: ${field} must be a non-empty string`);
 }
@@ -1261,6 +1356,12 @@ function retainHarnessTranscript(receipt, harness) {
 		throw new ValidationError(`Invalid retained transcript receipt: ${error instanceof Error ? error.message : String(error)}`);
 	}
 }
+/** The sidecar's native inventory has written both `sha256:<hex>` and bare `<hex>` digests
+*  (#1264: whole runs skipped every file for the bare form); accept either and keep the
+*  canonical prefix. `null` still means no digest and stays unverifiable. */
+function nativeDigest(value) {
+	return typeof value === "string" && /^[0-9a-f]{64}$/.test(value) ? `sha256:${value}` : value;
+}
 function retainedCapture(receipt, harness) {
 	const { snapshot, provenance, ...source } = receipt;
 	const files = [];
@@ -1284,7 +1385,7 @@ function retainedCapture(receipt, harness) {
 			const parsed = fileSchema.safeParse({
 				path: nativeIdentity(attribution),
 				bytes: entry.sizeBytes,
-				sha256: entry.sha256,
+				sha256: nativeDigest(entry.sha256),
 				attribution
 			});
 			if (parsed.success) files.push(parsed.data);
@@ -3092,73 +3193,18 @@ function generateTraceId() {
 }
 // src/runtime/supervise/worker-trace.ts
 /**
-* Trace context handed DOWN to a spawned worker, so one supervised tree spans machines.
-*
-* WHY. `otel-spans.ts` makes the supervisor's own tree readable by any trace viewer, but it stops at
-* the process boundary: a worker running on a remote sandbox or in a child process opens its OWN
-* trace root, so the viewer shows two unrelated trees for one run. A worker that inherits the
-* parent's trace id and the spawning node's span id emits spans that JOIN the parent's trace, and
-* the viewer assembles the whole cross-machine tree with no viewer change.
-*
-* THE WIRE IS W3C `TRACEPARENT`, dual-written with the legacy pair. `traceContextToEnv`
-* (`src/mcp/trace-propagation.ts`) writes `TRACEPARENT` (the convention the ecosystem — OTel SDKs,
-* collectors, the Claude Code harness binary — reads at spawn) ALONGSIDE the bespoke
-* `TRACE_ID` / `PARENT_SPAN_ID` pair this package shipped first, and `readTraceContextFromEnv()`
-* reads `TRACEPARENT` first with the legacy pair as fallback. The bespoke pair is the fork, not
-* the standard; it is kept for one release so children on the previous package version still join,
-* then removed in the next major.
-*
-* WHICH SPAN. The stamped `PARENT_SPAN_ID` is the span of the node that DID the spawning — the
-* scope's own `parentId` — not the span of the worker's own node. At depth 0 that is the run's root
-* span; inside a driver's nested scope it is that driver child's span, so a depth-2 worker joins
-* under the middle node rather than the root. That is also the only span guaranteed to exist at the
-* moment the child's `ExecutorContext` is built (the worker's own node span is opened by the
-* `agent.spawn` hook that fires just after), so the wire needs no ordering assumption.
-*
-* OFF WHEN TRACING IS OFF. The context reaches an executor only through the `ExecutorContext` seam
-* this module names, and that seam is seeded only when a run configured `SuperviseOptions.otel` AND
-* an exporter resolved. With tracing off there is no seam, {@link workerTraceEnv} returns an empty
-* record, and every spawn environment is byte-identical to what it was before this module existed.
-*
-* TWO SEEDING SITES, because there are two ways a worker's `ExecutorContext` gets built. `Scope`
-* seeds it per child for anything the executor registry resolves — that is the path that knows the
-* spawning node and reaches arbitrary depth. `workerFromBackend` (what `supervise({ backend })`
-* uses) instead builds its leaf executor eagerly and hands it back as a bring-your-own `Executor`,
-* which the registry resolves WITHOUT consulting the scope's context at all; `supervise()` therefore
-* passes the seam to `workerFromBackend` itself, resolved against the run root, which is the node
-* that spawns every front-door worker. Miss that second site and the front door looks wired and
-* stamps nothing.
-*
-* PRECEDENCE, from lowest to highest:
-*   1. the supervisor process's own `process.env` (ambient inheritance),
-*   2. the trace context stamped here,
-*   3. the caller's own seam env (`CliSeam.env`).
-* A caller who sets `TRACE_ID` / `PARENT_SPAN_ID` on a seam wins — theirs is a deliberate
-* declaration about the worker — and the W3C wire follows: a seam that overrides the legacy pair
-* without its own `TRACEPARENT` gets `TRACEPARENT` rebuilt from ITS ids (`mergeTraceEnv` performs
-* the dual-write on the caller's behalf), never left as the recorder's, so both spellings always
-* name the same trace. Ambient `process.env` does NOT win: when the supervisor process was
-* itself launched as someone's worker, its inherited ids describe the SUPERVISOR's place in an
-* outer trace, and reusing them for a child would file the child's spans under the wrong parent.
-* The supported way to join that outer trace is `SupervisorSpanOptions.traceId` / `parentSpanId`
-* (feed them from `readTraceContextFromEnv()`), which makes the recorder's own ids the outer ones
-* and so makes every stamped child inherit them too.
-*
-* WHICH BACKENDS PROPAGATE. Only a backend with a real channel to the worker can carry this, and
-* the ones that have none say so here rather than dropping it silently:
-*   - `cli`           YES — `CliSeam.env` → the spawned subprocess.
-*   - `sandbox`       YES — `CreateSandboxOptions.env` on the box the worker runs in (single-shot
-*                     and steerable). This is the cross-MACHINE case the feature exists for.
-*   - `bridge`        YES — request headers on the bridge POST (`traceparent` plus the legacy
-*                     `x-trace-id` / `x-parent-span-id` pair, {@link workerTraceHeaders}); the
-*                     bridge stamps them into the harness child's environment at spawn.
-*   - `router`,
-*     `router-tools`  NO — a direct model HTTP call. There is no worker process to inherit anything.
-*   - `cli-worktree`,
-*     `cli-in-place`  NO — the work is dispatched through a local harness transport that exposes
-*                     no environment channel. Wiring it means adding that channel to the transport
-*                     first; until then it is honestly unpropagated.
-*   - `provider`      NO — `AgentEnvironmentProvider` has no environment field on its port.
+* Trace context handed to a spawned worker so one supervised tree spans machines. `traceContextToEnv`
+* writes W3C `TRACEPARENT` and the legacy `TRACE_ID` / `PARENT_SPAN_ID` pair; readers take
+* `TRACEPARENT` first. The legacy pair stays so a child on the previous package still joins.
+* `PARENT_SPAN_ID` is the spawning node's span (`parentId`): at depth 0 the run root, otherwise the
+* driver child, and the only span that exists when the child's `ExecutorContext` is built. With
+* `SuperviseOptions.otel` unset, {@link workerTraceEnv} is empty and spawn environments stay
+* byte-identical. `Scope` stamps registry children. `supervise({ backend })` must pass the same seam
+* into `workerFromBackend` or the front door stamps nothing. Precedence is ambient `process.env`,
+* then this stamp, then `CliSeam.env`. A seam that sets the legacy pair gets `TRACEPARENT` rebuilt
+* from those ids. Ambient ids do not win; join an outer trace with `SupervisorSpanOptions.traceId`
+* and `parentSpanId`. `cli`, `sandbox`, and `bridge` propagate. `router`, `router-tools`,
+* `cli-worktree`, `cli-in-place`, and `provider` have no worker environment channel and do not.
 */
 /**
 * The census above, as a value the compiler checks. `satisfies` against every `ExecutorConfig`
@@ -3814,6 +3860,8 @@ async function* retainedRunEvents(session, controlRef, options, now) {
 			throw abortError(options.signal.reason);
 		}
 		if (error instanceof RetainedRunProviderContractError) throw error;
+		const html = htmlTransportFailure(error);
+		if (html) throw html;
 		const fromProvider = error instanceof Error && !runtimeChecks.has(error);
 		throw new RetainedRunProviderContractError(error instanceof Error ? error.message : "provider retained event stream failed", {
 			code: fromProvider ? "RETAINED_EVENT_STREAM_READ_FAILED" : "RETAINED_EVENT_STREAM_INVALID",
@@ -4012,6 +4060,8 @@ async function retainedResult(control) {
 		candidate = await exactSessionResult(control.session);
 	} catch (error) {
 		if (error instanceof RetainedRunProviderContractError) throw error;
+		const html = htmlTransportFailure(error);
+		if (html) throw html;
 		throw new RetainedRunProviderContractError(error instanceof Error ? error.message : "provider retained result read failed", {
 			code: "RETAINED_RESULT_READ_FAILED",
 			cause: error
@@ -4231,13 +4281,7 @@ function retainedTurnForDispatch(turn, env) {
 	};
 }
 // src/runtime/retained-run-start.ts
-/**
-* Mint deterministic dispatch coordinates from the two caller-supplied keys.
-* The same `(idempotencyKey, turnId)` pair yields the same coordinates in
-* every process, so a pre-dispatch admission record always names the exact
-* session and execution the dispatch will request. A full SHA-256 digest
-* keeps provider session identifiers bounded and safe for workspace paths.
-*/
+/** Mint the same session and execution from `(idempotencyKey, turnId)` in every process. */
 function mintRetainedIdentity(idempotencyKey, turnId) {
 	const base = `${encodeURIComponent(idempotencyKey)}:${encodeURIComponent(turnId)}`;
 	const digest = canonicalCandidateDigest({
@@ -4249,17 +4293,44 @@ function mintRetainedIdentity(idempotencyKey, turnId) {
 		executionId: `retained-execution-${digest}`
 	};
 }
-/**
-* Dispatch one detached, replayable run and return only after exact durable
-* coordinates are confirmed by the provider and persisted by the caller.
-*
-* The required `onAdmission` hook first records a digest-only intent before
-* creation or receipt-authorized attachment, then records recovery coordinates and the verified exact control
-* reference. The returned promise resolves only after the dispatched admission
-* is durable, so a crash cannot lose a successful start's exact reference.
-*
-* @stable
-*/
+/** Bound from a durable intent until `provider.create` resolves. */
+const RETAINED_ENVIRONMENT_MATERIALIZATION_MS = 12e4;
+/** Create never reached an environment. The message names the stage; the driver stops. */
+var RetainedMaterializationTimeoutError = class extends Error {
+	stage = "intent";
+	constructor() {
+		super("retained run reached stage intent and did not materialize an environment");
+		this.name = "RetainedMaterializationTimeoutError";
+	}
+};
+function createRetainedEnvironment(options, parent) {
+	const timeout = AbortSignal.timeout(options.materializationTimeoutMs ?? RETAINED_ENVIRONMENT_MATERIALIZATION_MS);
+	const signal = parent === void 0 ? timeout : AbortSignal.any([parent, timeout]);
+	const create = options.provider.create({
+		...options.environment,
+		signal,
+		metadata: retainedEnvironmentMetadata(options.environment.metadata, options.environment.idempotencyKey)
+	});
+	const timedOut = () => timeout.aborted && parent?.aborted !== true;
+	return new Promise((resolve, reject) => {
+		const fail = () => {
+			reject(timedOut() ? new RetainedMaterializationTimeoutError() : parent?.reason instanceof Error ? parent.reason : /* @__PURE__ */ new Error("retained run materialization aborted"));
+		};
+		if (signal.aborted) {
+			fail();
+			return;
+		}
+		signal.addEventListener("abort", fail, { once: true });
+		create.then((environment) => {
+			signal.removeEventListener("abort", fail);
+			resolve(environment);
+		}, (error) => {
+			signal.removeEventListener("abort", fail);
+			reject(timedOut() ? new RetainedMaterializationTimeoutError() : error);
+		});
+	});
+}
+/** Dispatch one replayable run. Intent is durable before create; the promise resolves after dispatch is durable. @stable */
 async function startRetainedRun(options) {
 	assertStableText(options.environment.idempotencyKey, "environment idempotency key");
 	assertStableText(options.turn.turnId, "turn idempotency key");
@@ -4310,10 +4381,7 @@ async function startRetainedRun(options) {
 		if (!existing || existing.id !== options.existingEnvironmentId || existing.provider !== options.provider.name) throw new Error("retained provider environment is unavailable or has another identity");
 		await assertRetainedEnvironmentOwnership(options.provider, existing, options.environment.idempotencyKey);
 		environment = existing;
-	} else environment = await options.provider.create({
-		...options.environment,
-		metadata: retainedEnvironmentMetadata(options.environment.metadata, options.environment.idempotencyKey)
-	});
+	} else environment = await createRetainedEnvironment(options, attachmentSignal);
 	let capabilities;
 	let teardownFailure = "retained run environment published invalid capabilities and could not be destroyed";
 	try {
@@ -4349,15 +4417,7 @@ async function startRetainedRun(options) {
 		preserveEnvironment: options.preserveEnvironment === true || transferReceipt !== void 0 || options.existingEnvironmentId !== void 0
 	});
 }
-/**
-* Dispatch a fresh retained session inside an existing provider environment.
-*
-* This operation reuses only the environment. It does not append to a prior
-* harness chat and does not claim native conversation continuity. The caller
-* must use `RetainedRunHandle.continueNative` for a verified same-chat turn.
-*
-* @stable
-*/
+/** Fresh session in an existing environment. A same-chat turn uses `continueNative`. @stable */
 async function startRetainedRunInEnvironment(options) {
 	if (options.turn.contextTransfer !== void 0) throw new Error("accepted context transfer requires startRetainedRun with its exact profile and receipt");
 	assertStableText(options.environment.id, "retained environment id");
@@ -4398,16 +4458,7 @@ async function startRetainedRunInEnvironment(options) {
 		preserveEnvironment: true
 	});
 }
-/**
-* Bind an existing environment to the retained key it was created under, from the metadata the
-* provider's own `get` or `create` record carries. One read, no listing.
-*
-* A metadata-filtered `list` used to stand in when that record had none. The only provider with
-* detached session control and a `list` (Tangle Sandbox) filters client-side, so the fallback
-* walked the caller's whole inventory: on Braid's ~68.5k-sandbox account, ~55 pages at ~1.4 s
-* each before admission (2026-10-28), and past 2,000 sandboxes the route answered 400
-* (2026-10-04). A record without metadata cannot prove ownership, so it is refused at once.
-*/
+/** Bind an environment to the retained key on its own get/create record. Missing metadata is a refusal; do not list the account. */
 async function assertRetainedEnvironmentOwnership(provider, environment, idempotencyKey) {
 	if (environment.metadata === void 0) throw new Error(`provider "${provider.name}" returned environment "${environment.id}" without metadata, so it cannot prove retained environment ownership`);
 	if (environment.metadata.retainedIdempotencyKey !== idempotencyKey) throw new Error(`provider "${provider.name}" could not bind environment "${environment.id}" to its retained idempotency key`);
@@ -4482,12 +4533,7 @@ async function dispatchRetainedRun(options) {
 	});
 	return createRetainedRunHandle(environment, exact.session, exact.controlRef, options.capabilities, options.now);
 }
-/**
-* Await one admission record through the caller's durability hook. A rejection
-* keeps the environment alive — the provider state plus any partial admission
-* record is the recovery path — and surfaces as `RetainedRunAdmissionError` so
-* callers can distinguish a persistence failure from a provider failure.
-*/
+/** Await the durability hook. A rejection keeps the environment and throws the admission error, not a provider error. */
 async function admitDurably(onAdmission, admission) {
 	const stableAdmission = detachedSnapshot(admission, "retained run admission");
 	try {
@@ -4497,11 +4543,7 @@ async function admitDurably(onAdmission, admission) {
 		throw new RetainedRunAdmissionError(stableAdmission, { cause: error });
 	}
 }
-/**
-* Mirror each admission into `<journalRoot>/<runId>/observer.jsonl`, the observer format
-* agent-runtime-top reads. The caller's hook stays authoritative; an observer append that
-* fails never fails the run, matching `FileObserverJournal`'s contract.
-*/
+/** Mirror admissions into the observer journal. The caller's hook stays authoritative; an observer failure does not fail the run. */
 function journaledAdmissions(journalRoot, replayRunId, onAdmission) {
 	if (journalRoot === void 0) return onAdmission;
 	let runId = replayRunId;
@@ -4515,12 +4557,7 @@ function journaledAdmissions(journalRoot, replayRunId, onAdmission) {
 		});
 	};
 }
-/**
-* The interactive handle with its accepted turns and its end journaled beside its admissions, so a
-* viewer sees the run take turns and settle rather than run forever. A turn records its operation id,
-* never the prompt, so handles in different processes agree. The end is the first exited status
-* read or accepted stop.
-*/
+/** Journal accepted turns and the end beside admissions. A turn records its operation id, never the prompt. */
 function journaledInteractiveHandle(handle, journalRoot, runId) {
 	if (journalRoot === void 0) return handle;
 	const settle = async (failed, detail) => {
@@ -4724,13 +4761,7 @@ async function assertRetainedCapabilities(provider) {
 	assertRetainedCapabilityRequirements(provider.name, capabilities);
 	return capabilities;
 }
-/**
-* Select the capability document for one concrete environment.
-*
-* A measured environment document is authoritative. An absent document uses
-* the provider document because that provider claims the same guarantee for
-* every environment it creates.
-*/
+/** A measured environment capability document wins; an absent one uses the provider document. */
 function retainedCapabilitiesForEnvironment(providerName, providerCapabilities, environment) {
 	if (environment.capabilities === void 0) return providerCapabilities;
 	const measured = AgentEnvironmentCapabilitiesSchema.parse(environment.capabilities);
@@ -4745,10 +4776,7 @@ function assertRetainedCapabilityRequirements(providerName, capabilities) {
 const WORKSPACE_CHECKPOINT_MARKER_PATH = ".agent-runtime-checkpoint";
 /** Bound on one checkpoint: environment lookup, marker write, and the provider operation. */
 const WORKSPACE_CHECKPOINT_TIMEOUT_MS = 12e4;
-/** Bound on the captures one checkpoint rotation runs, all of them together, forks included.
-*  A turn's own workspace capture also cuts them short when it starts. A capture cut short keeps
-*  its checkpoint, and the owner's release, bounded by `RELEASE_CHECKPOINT_CAPTURES_MS`, captures
-*  it again. */
+/** Bound on the captures one checkpoint rotation runs. A turn capture cuts them short; the release captures again. */
 const WORKSPACE_CHECKPOINT_ROTATION_CAPTURES_MS = 12e4;
 /** Write the marker. False when the environment cannot take it, so no restore can be verified. */
 async function writeWorkspaceMarker(environment, marker, signal) {
@@ -5558,19 +5586,23 @@ async function checkpointHandle(state, sourceEnvironmentId, signal) {
 }
 /**
 * An aborted observation cannot prove that the provider never created a snapshot, so a request
-* whose lookup does not find it keeps its source alive for a later lookup, with one exception: a
-* provider that answers `not_found` for a request older than {@link WORKSPACE_CHECKPOINT_ABSENT_AFTER_MS}
-* never created it. No operation that request started can still be in flight, and keeping the
-* source then holds a sandbox for nothing: on Discovery Lab runs terraform-economics-20261005e and
-* f, each root was kept after its run settled over requests made hours earlier.
+* whose lookup does not find it keeps its source. A `not_found` older than
+* {@link WORKSPACE_CHECKPOINT_ABSENT_AFTER_MS} never created one. A parent abort starts no lookup.
 */
-async function reconcileCheckpointRequests(state, events) {
+async function reconcileCheckpointRequests(state, events, parent) {
 	const operationKey = (operation) => JSON.stringify([operation.idempotencyKey, operation.requestDigest]);
 	const resolved = new Set(events.flatMap((event) => event.kind === "workspace-checkpoint" && event.id === state.args.nodeId && event.provider === state.provider?.name ? [operationKey(event.checkpoint)] : []));
 	const pending = events.filter((event) => event.kind === "workspace-checkpoint-requested" && event.id === state.args.nodeId && event.provider === state.provider?.name && !resolved.has(operationKey(event.request)));
 	const unconfirmed = [];
 	for (const event of pending) {
-		const signal = AbortSignal.timeout(3e4);
+		if (parent?.aborted) {
+			unconfirmed.push({
+				event,
+				reason: "cancelled before checkpoint lookup"
+			});
+			continue;
+		}
+		const signal = deadlineSignal(parent, 3e4);
 		try {
 			const branching = await checkpointHandle(state, event.environmentId, signal);
 			if (branching === void 0) throw new Error("source-scoped checkpoint handle unavailable");
@@ -5627,9 +5659,8 @@ function pendingCheckpoints(events, state) {
 	return events.filter((event) => event.kind === "workspace-checkpoint" && event.id === state.args.nodeId && event.provider === state.provider?.name && !confirmed.has(JSON.stringify([event.environmentId, event.checkpoint.checkpointId])));
 }
 // src/runtime/supervise/retained-owner-checkpoint-capture.ts
-/** Delete only historically captured checkpoints, unless capacity retirement permits uncaptured
-* deletion. Source-scoped handles attest deletion; every provider operation remains bounded. */
-async function cleanCheckpoints(state, branching, checkpoints, events, _parent, uncapturable = false) {
+/** Delete captured checkpoints. An aborted parent starts no further provider call. */
+async function cleanCheckpoints(state, branching, checkpoints, events, parent, uncapturable = false) {
 	const unconfirmed = [];
 	const refused = [];
 	for (const event of checkpoints) {
@@ -5663,13 +5694,23 @@ async function cleanCheckpoints(state, branching, checkpoints, events, _parent,
 			requestDigest: workspaceCleanupRequestDigest(material)
 		};
 		let confirmed = false;
+		let reason;
+		const signal = deadlineSignal(parent, 3e4);
 		try {
-			if (branching === void 0) throw new Error("source-scoped checkpoint handle unavailable");
-			const signal = AbortSignal.timeout(3e4);
-			const acknowledgement = await runAbortable(() => branching.deleteCheckpoint(request, { signal }), signal, "retained owner checkpoint cleanup timed out");
-			confirmed = workspaceCleanupAcknowledgementMatches(request, acknowledgement) && (acknowledgement.status === "deleted" || acknowledgement.status === "already_absent");
-		} catch {}
-		if (!confirmed) unconfirmed.push(event);
+			if (parent?.aborted) reason = "cancelled before checkpoint cleanup";
+			else if (branching === void 0) throw new Error("source-scoped checkpoint handle unavailable");
+			else {
+				const acknowledgement = await runAbortable(() => branching.deleteCheckpoint(request, { signal }), signal, "retained owner checkpoint cleanup timed out");
+				confirmed = workspaceCleanupAcknowledgementMatches(request, acknowledgement) && (acknowledgement.status === "deleted" || acknowledgement.status === "already_absent");
+				if (!confirmed) reason = `provider acknowledged '${acknowledgement.status}'`;
+			}
+		} catch (error) {
+			reason = errMessage(error).slice(0, 1e3);
+		}
+		if (!confirmed) unconfirmed.push({
+			event,
+			reason: reason ?? "delete was not confirmed"
+		});
 		await state.args.journal.appendEvent(state.args.rootId, {
 			kind: "workspace-checkpoint-cleanup",
 			id: state.args.nodeId,
@@ -5677,6 +5718,7 @@ async function cleanCheckpoints(state, branching, checkpoints, events, _parent,
 			environmentId: event.environmentId,
 			checkpointId: event.checkpoint.checkpointId,
 			confirmed,
+			...reason === void 0 ? {} : { refused: reason.slice(0, 1e3) },
 			...captured.digest === void 0 ? {} : { capturedDigest: captured.digest },
 			seq: state.nextSequence(),
 			at: new Date(state.args.now()).toISOString()
@@ -5701,7 +5743,7 @@ function captureBeforeCleanup(state, event, events, uncapturable = false) {
 	return uncapturable ? {} : refuse("client checkpoint capture writers are retired; no persisted capture holds this checkpoint", false);
 }
 /** Destroy a capture's fork and journal whether the provider confirmed it. */
-async function destroyCaptureFork(state, branching, target) {
+async function destroyCaptureFork(state, branching, target, parent) {
 	const material = {
 		kind: "fork",
 		targetId: target.fork.environmentId,
@@ -5714,7 +5756,7 @@ async function destroyCaptureFork(state, branching, target) {
 	};
 	let destroyed = false;
 	try {
-		const signal = AbortSignal.timeout(3e4);
+		const signal = deadlineSignal(parent, 3e4);
 		const acknowledgement = await runAbortable(() => branching.destroyFork(request, { signal }), signal, "checkpoint capture fork cleanup timed out");
 		destroyed = workspaceCleanupAcknowledgementMatches(request, acknowledgement) && (acknowledgement.status === "deleted" || acknowledgement.status === "already_absent");
 	} catch {}
@@ -5728,12 +5770,8 @@ async function destroyCaptureFork(state, branching, target) {
 	});
 	return destroyed;
 }
-/**
-* Destroy every capture fork the journal does not show destroyed: one a crash left between its
-* request and its teardown, or whose teardown the provider did not confirm. Returns the forks
-* still not confirmed destroyed, by environment or, when none was ever named, by request key.
-*/
-async function settleCaptureForks(state) {
+/** Destroy capture forks the journal does not show destroyed. An aborted parent starts no further fork call. Returns forks still unconfirmed. */
+async function settleCaptureForks(state, parent) {
 	const { args } = state;
 	const providerName = state.provider?.name;
 	const events = (await args.journal.loadTree(args.rootId) ?? []).filter((event) => event.id === args.nodeId);
@@ -5745,7 +5783,11 @@ async function settleCaptureForks(state) {
 	for (const request of events) {
 		if (request.kind !== "workspace-checkpoint-fork-requested" || request.provider !== providerName) continue;
 		if (destroyed.has(request.idempotencyKey)) continue;
-		const signal = AbortSignal.timeout(3e4);
+		if (parent?.aborted) {
+			unresolved.push(named(request.idempotencyKey) ?? request.idempotencyKey);
+			continue;
+		}
+		const signal = deadlineSignal(parent, 3e4);
 		const branching = await checkpointHandle(state, request.environmentId, signal);
 		let forkEnvironmentId = named(request.idempotencyKey);
 		if (forkEnvironmentId === void 0 && branching !== void 0) try {
@@ -5764,7 +5806,7 @@ async function settleCaptureForks(state) {
 				idempotencyKey: request.idempotencyKey,
 				environmentId: forkEnvironmentId
 			}
-		})) unresolved.push(forkEnvironmentId ?? request.idempotencyKey);
+		}, parent)) unresolved.push(forkEnvironmentId ?? request.idempotencyKey);
 	}
 	return unresolved;
 }
@@ -5838,28 +5880,13 @@ function bindScopeRetainedOwnerProvider(scope, provider) {
 	const state = owners.get(scope);
 	if (state) state.provider = provider;
 }
-/**
-* Bind where the owner's CURRENT environment id can be read from. The drive harness supplies a
-* resolver over its active executor's materialization receipt, which every provider path
-* publishes once the environment exists. The `environment` admission is written only on the
-* retained path, and the production tangle provider declares no `retainedControl`, so a reader
-* that scanned admissions alone would refuse every read on a real sandbox root while looking
-* correct in every test that uses the retained fixture.
-*/
+/** Bind the resolver for the owner's current environment id. Admissions alone miss a provider that never writes an environment admission. */
 function bindScopeRetainedOwnerEnvironmentId(scope, liveEnvironmentId) {
 	const state = owners.get(scope);
 	if (state) state.liveEnvironmentId = liveEnvironmentId;
 }
 // src/runtime/supervise/retained-owner-checkpoint-rotation.ts
-/**
-* Note that the owner's manager made a coordination call, and checkpoint its workspace when the
-* last checkpoint is older than {@link WORKSPACE_CHECKPOINT_MIN_INTERVAL_MS}.
-*
-* A coordination call is where a manager commits work: it spawns, waits for, reads, or submits.
-* The checkpoint runs in the background and never delays the call. A failed checkpoint leaves the
-* previous one as the restore point; a provider or environment that cannot checkpoint stops the
-* attempts for this owner.
-*/
+/** Checkpoint after a coordination call once the last one is older than {@link WORKSPACE_CHECKPOINT_MIN_INTERVAL_MS}. It never delays the call, and a failure leaves the previous restore point. */
 function noteScopeRetainedOwnerCoordination(scope) {
 	const state = owners.get(scope);
 	if (state?.provider === void 0 || state.checkpointsUnavailable !== void 0) return;
@@ -5976,12 +6003,7 @@ async function requestCheckpoint(scope, state, providerName, environment, branch
 	});
 	return true;
 }
-/**
-* Delete this environment's oldest checkpoint beyond {@link WORKSPACE_CHECKPOINTS_KEPT} when no
-* capture could ever hold its files, to make room for a newer one. Keeping them all stopped the
-* restore point instead: zro-game-20261104b's box stored 25 of its 61 requests, its plan's limit,
-* and its last restore point was 7 h old. A backend that captures deletes through its rotation.
-*/
+/** Delete the oldest checkpoint past {@link WORKSPACE_CHECKPOINTS_KEPT} when no capture can hold it, so a snapshot limit cannot freeze the restore point. */
 async function deleteOldestUncapturable(state, branching, environmentId, signal) {
 	const events = await state.args.journal.loadTree(state.args.rootId) ?? [];
 	const oldest = pendingCheckpoints(events, state).filter((event) => event.environmentId === environmentId).slice(0, -2).slice(0, 1);
@@ -5989,13 +6011,6 @@ async function deleteOldestUncapturable(state, branching, environmentId, signal)
 	const { unconfirmed } = await cleanCheckpoints(state, branching, oldest, events, signal, true);
 	return unconfirmed.length === 0;
 }
-/**
-* The owner's workspace-capture journal writers. A turn's capture starting cuts short the
-* checkpoint rotation's captures: on Discovery canary test-acceptance-canary-20261019j (Runtime
-* 0.327.0) a rotation capture of an older checkpoint started 4 s before the root's final capture,
-* on the same evidence store, and the final capture spent 26.6 of its 32.6 minutes storing its
-* archive until the root's budget deadline aborted the rotation.
-*/
 // src/runtime/supervise/retained-owner-evidence.ts
 /** Retained-owner capture receipts, source verification before reuse, and accepted-turn evidence debt. */
 /** One grouping for release and the evidence gate before another owner invocation. */
@@ -6038,28 +6053,22 @@ function ownerWorkspaceAttempts(events, nodeId) {
 	flush();
 	return attempts;
 }
-/**
-* Group owner admissions by input and require a verified workspace receipt before deletion.
-*
-* The receipt is the attempt's committed result, or an evidence record of the same attempt: a
-* turn its manager stopped commits its result first and journals its capture as evidence after
-* it, and a turn that failed journals the capture it took of the stopped session. A root capture
-* failure can enter this cleanup barrier and still be resumed, so any receipt refused before
-* reuse must also preserve its source here.
-*/
+/** Group owner admissions by input. A source with no verified workspace receipt is preserved, including one a later resume can still use. */
+const UNVERIFIED_SOURCE = "provider workspace retention: source preserved because the owner execution has no verified workspace receipt";
 async function ownerWorkspaceRetentionFailures(events, owner) {
 	const attempts = ownerWorkspaceAttempts(events, owner.nodeId);
-	const failures = /* @__PURE__ */ new Set();
+	const failures = /* @__PURE__ */ new Map();
 	for (const index of attempts.keys()) {
 		const attempt = withLaterEvidence(attempts, index);
 		if (attempt.workspaceRetention !== true) continue;
 		if (attempt.environmentIds.size === 0) continue;
 		if (attempt.environmentIds.size > 1) {
-			for (const environmentId of attempt.environmentIds) failures.add(environmentId);
+			for (const environmentId of attempt.environmentIds) failures.set(environmentId, UNVERIFIED_SOURCE);
 			continue;
 		}
 		const environmentId = [...attempt.environmentIds][0];
-		if (!await ownerAttemptHasCapture(attempt, environmentId, owner.blobs, owner)) failures.add(environmentId);
+		const reason = await ownerAttemptHasCapture(attempt, environmentId, owner.blobs, owner);
+		if (reason !== void 0) failures.set(environmentId, reason);
 	}
 	return failures;
 }
@@ -6076,18 +6085,33 @@ function withLaterEvidence(attempts, index) {
 		evidence: [...attempt.evidence, ...later]
 	};
 }
+/** Undefined when a receipt authorizes destroying the source. Otherwise why it stays. */
 async function ownerAttemptHasCapture(attempt, environmentId, blobs, owner, allowPartialProcessCapture = false) {
 	const controlRef = attempt.controlByEnvironment.get(environmentId);
 	const receipts = [...attempt.result === void 0 || attempt.result.outputFormat === "json" ? [] : [attempt.result.outRef], ...attempt.evidence.map((event) => event.outRef)];
+	const identity = owner === void 0 ? void 0 : ownerCaptureIdentity(attempt, owner);
 	let verified = false;
+	let nativeHold;
 	for (const outRef of receipts) {
 		const output = await storedOutput(blobs, outRef);
-		if (hasDurableWorkspaceCapture(output, output !== null && typeof output === "object" ? output.workspaceSnapshot : void 0, environmentId, attempt.executionId, controlRef, owner === void 0 ? void 0 : ownerCaptureIdentity(attempt, owner), allowPartialProcessCapture)) {
-			verified = true;
-			break;
-		}
+		const snapshot = output !== null && typeof output === "object" ? output.workspaceSnapshot : void 0;
+		const capture = output !== null && typeof output === "object" ? output.workspaceCapture : void 0;
+		const receipt = capture !== null && typeof capture === "object" ? capture : void 0;
+		const matches = receipt !== void 0 && receipt.environmentId === environmentId && receipt.executionId === attempt.executionId;
+		const durable = hasDurableWorkspaceCapture(output, snapshot, environmentId, attempt.executionId, controlRef, identity, allowPartialProcessCapture);
+		if (matches && receipt !== void 0) {
+			const hold = nativeSessionCopyHoldReason(receipt);
+			if (hold !== void 0) {
+				nativeHold = hold;
+				verified = false;
+			} else if (durable) {
+				nativeHold = void 0;
+				verified = true;
+			}
+		} else if (nativeHold === void 0 && durable) verified = true;
 	}
-	return verified;
+	if (nativeHold !== void 0) return nativeHold;
+	return verified ? void 0 : UNVERIFIED_SOURCE;
 }
 function ownerCaptureIdentity(attempt, owner) {
 	const intent = attempt.admissions.find((admission) => admission.phase === "intent");
@@ -6118,7 +6142,7 @@ async function reconcileOwnerWorkspaceBeforeReuse(state, signal) {
 		if (attempt.workspaceRetention !== true || attempt.result === void 0) continue;
 		for (const environmentId of attempt.environmentIds) {
 			if (!reusing.has(environmentId) || unusable.has(environmentId)) continue;
-			if (await ownerAttemptHasCapture(attempt, environmentId, args.blobs, args, true)) continue;
+			if (await ownerAttemptHasCapture(attempt, environmentId, args.blobs, args, true) === void 0) continue;
 			signal.throwIfAborted();
 			const failure = capturePendingMessage(attempt.executionId ?? args.nodeId, /* @__PURE__ */ new Error("client capture writers are retired; a persisted verified receipt is required"));
 			if (executorFailureReason(attempt.result) === void 0) await owePendingEvidence(state, events, attempt, environmentId, failure);
@@ -6177,38 +6201,73 @@ function hasDurableWorkspaceCapture(output, snapshot, environmentId, executionId
 	const receipt = capture;
 	if (identity !== void 0 && (identity.profileDigest === void 0 || receipt.profileDigest !== identity.profileDigest || (identity.node === void 0 ? receipt.node !== void 0 : receipt.node === void 0 || contentAddress(receipt.node) !== contentAddress(identity.node)))) return false;
 	const capturedControl = AgentExactRunControlRefSchema.safeParse(receipt.controlRef);
-	if (executionId === void 0 || controlRef === void 0 || !capturedControl.success || !sameControlCoordinates(capturedControl.data, controlRef) || receipt.environmentId !== environmentId || receipt.executionId !== executionId || receipt.coverageComplete !== true && !(allowPartialProcessCapture && hasOnlyRawProcessCaptureGap(receipt))) return false;
+	if (executionId === void 0 || controlRef === void 0 || !capturedControl.success || !sameControlCoordinates(capturedControl.data, controlRef) || receipt.environmentId !== environmentId || receipt.executionId !== executionId || !captureAuthorizesDestroy(receipt, allowPartialProcessCapture)) return false;
 	const linked = agentCandidateWorkspaceSnapshotEvidenceSchema.safeParse(receipt.snapshot);
 	return linked.success && linked.data.digest === parsed.data.digest && JSON.stringify(linked.data.manifest) === JSON.stringify(parsed.data.manifest) && JSON.stringify(linked.data.archive) === JSON.stringify(parsed.data.archive);
 }
+const NATIVE_STORE_GAP = /(?:^|\s)((?:over_bound|store_file_):[^\s;]+)/g;
+const COVERAGE_GAP_PREFIX = "provider workspace retention coverage incomplete: ";
+const PROCESS_GAP = [
+	/^process_(?:io_missing|io_unavailable|source_unavailable)(?::[\w-]+)?$/,
+	/^Sandbox session [\w-]+ declared partial raw capture$/,
+	/^Sandbox session [\w-]+ attempt [\w-]+\/\d+: process_(?:io_missing|io_unavailable|source_unavailable)(?::[\w-]+)?$/,
+	/^Sandbox session [\w-]+ has no original process source: [\w-]+$/,
+	/^Sandbox session [\w-]+: process_(?:io_missing|io_unavailable|source_unavailable)(?::[\w-]+)?$/,
+	/^Raw native session capture for Sandbox session [\w-]+ is unavailable: process_(?:io_missing|io_unavailable|source_unavailable)(?::[\w-]+)?$/,
+	/^Session [\w-]+ process streams incomplete$/,
+	/^Attempt [\w-]+\/\d+: process_(?:io_missing|io_unavailable|source_unavailable)(?::[\w-]+)?$/
+];
+const EVENT_GAP = /(?:^|:\s)events_incomplete(?::[\w.-]+)?$/;
+/** Keep the box when the final native copy is incomplete. Process I/O or event-log gaps do not. */
+function nativeSessionCopyHoldReason(receipt) {
+	const provenance = receipt.provenance;
+	if (provenance === null || typeof provenance !== "object") return void 0;
+	const reported = provenance;
+	const sessions = Array.isArray(reported.sessions) ? reported.sessions : [];
+	let incomplete = false;
+	const tokens = /* @__PURE__ */ new Set();
+	const take = (value) => {
+		const text = Array.isArray(value) ? value.filter((item) => typeof item === "string").join("; ") : typeof value === "string" ? value : "";
+		for (const match of text.matchAll(NATIVE_STORE_GAP)) tokens.add(match[1]);
+	};
+	for (const session of sessions) {
+		if (session === null || typeof session !== "object") continue;
+		const row = session;
+		const store = row.nativeStore;
+		if (store !== null && typeof store === "object" && store.complete === false) incomplete = true;
+		take(row.nativeReason);
+		if (store !== null && typeof store === "object") take(store.missingReasons);
+	}
+	take(reported.missing);
+	if (!incomplete && tokens.size === 0) return void 0;
+	return `native session copy incomplete: ${tokens.size > 0 ? [...tokens].join("; ") : "nativeStore incomplete"}`;
+}
+function captureAuthorizesDestroy(receipt, allowPartialProcessCapture) {
+	if (nativeSessionCopyHoldReason(receipt) !== void 0) return false;
+	if (receipt.coverageComplete === true) return true;
+	return hasOnlyRawProcessCaptureGap(receipt, !allowPartialProcessCapture);
+}
+function captureGapTexts(receipt) {
+	const reason = receipt.incompleteReason;
+	const named = typeof reason === "string" && reason.startsWith(COVERAGE_GAP_PREFIX) ? reason.slice(50).split("; ") : [];
+	const provenance = receipt.provenance;
+	const missing = provenance !== null && typeof provenance === "object" && Array.isArray(provenance.missing) ? provenance.missing.filter((item) => typeof item === "string") : [];
+	return [...named, ...missing].map((gap) => gap.trim()).filter((gap) => gap.length > 0);
+}
 /**
-* A process I/O gap does not invalidate a verified workspace archive or the live environment
-* that owns it. This narrow exception is for continuation only: release still requires complete
-* capture. The historical producer assembled this reason after identity, inventory,
-* and archive checks, so any other gap keeps the accepted turn pending.
+* A process I/O gap does not invalidate a verified workspace. `includeEvents` is the release
+* rule: an event-log gap alone also authorizes destroy. Any other gap keeps the source.
 */
-function hasOnlyRawProcessCaptureGap(receipt) {
-	const reason = receipt.incompleteReason;
-	if (typeof reason !== "string" || !reason.startsWith("provider workspace retention coverage incomplete: ")) return false;
+function hasOnlyRawProcessCaptureGap(receipt, includeEvents = false) {
 	const provenance = receipt.provenance;
 	if (provenance === null || typeof provenance !== "object") return false;
 	const reported = provenance;
 	const workspace = reported.workspace;
 	if (reported.status !== "reported" || workspace === null || typeof workspace !== "object" || workspace.complete !== true) return false;
 	const sessions = reported.sessions;
-	if (!Array.isArray(sessions) || !sessions.some((session) => session !== null && typeof session === "object" && session.processStreams?.complete === false)) return false;
-	const allowed = [
-		/^process_(?:io_missing|io_unavailable|source_unavailable)(?::[\w-]+)?$/,
-		/^Sandbox session [\w-]+ declared partial raw capture$/,
-		/^Sandbox session [\w-]+ attempt [\w-]+\/\d+: process_(?:io_missing|io_unavailable|source_unavailable)(?::[\w-]+)?$/,
-		/^Sandbox session [\w-]+ has no original process source: [\w-]+$/,
-		/^Sandbox session [\w-]+: process_(?:io_missing|io_unavailable|source_unavailable)(?::[\w-]+)?$/,
-		/^Raw native session capture for Sandbox session [\w-]+ is unavailable: process_(?:io_missing|io_unavailable|source_unavailable)(?::[\w-]+)?$/,
-		/^Session [\w-]+ process streams incomplete$/,
-		/^Attempt [\w-]+\/\d+: process_(?:io_missing|io_unavailable|source_unavailable)(?::[\w-]+)?$/
-	];
-	const gaps = reason.slice(50).split("; ");
-	return gaps.length > 0 && gaps.every((gap) => allowed.some((pattern) => pattern.test(gap)));
+	if (!Array.isArray(sessions) || !sessions.some((session) => session !== null && typeof session === "object" && (session.processStreams?.complete === false || includeEvents && session.nativeEvents?.complete === false))) return false;
+	const gaps = captureGapTexts(receipt);
+	return gaps.length > 0 && gaps.every((gap) => PROCESS_GAP.some((pattern) => pattern.test(gap)) || includeEvents && EVENT_GAP.test(gap));
 }
 /** Environments that cannot execute another turn, whether absent or terminal at the provider. */
 function unusableEnvironmentIds(owned) {
@@ -6919,9 +6978,7 @@ function registerScopeRetainedOwner(scope, args) {
 	};
 	owners.set(scope, state);
 }
-/** The environment admission an invocation starting at `before` continues in: the latest earlier
-*  committed invocation's, past abandoned ones. A live process keeps its session across an
-*  abandonment, so a resumed one derives it the same way or its replay would not match. */
+/** Continue the latest committed environment, past abandoned ones. A live session stays. */
 function committedSession(events, before) {
 	let end = before;
 	for (;;) {
@@ -6936,12 +6993,19 @@ function committedSession(events, before) {
 		end = start;
 	}
 }
-/** Bounds the stop Runtime asks for before abandoning a dispatched invocation. */
 const ABANDON_STOP_TIMEOUT_MS = 3e4;
-/** Abandon the owner's in-flight invocation when its reconciliation keeps failing the same way
-*  (`DriverRetryRun.resolvePending`), only once the provider confirms the dispatched execution
-*  stopped or is not live; the journal then refuses its later admissions and results. Answers
-*  `false`, journaling nothing, without an unfinished invocation or a confirmed native stop. */
+async function releaseDeadRetainedExecution(state, events, scope) {
+	if (state.provider === void 0) return;
+	const dispatched = [...events].reverse().find((event) => event.kind === "execution-admitted" && event.admission.phase === "dispatched");
+	if (dispatched?.kind !== "execution-admitted" || dispatched.admission.phase !== "dispatched") return;
+	await stopRetainedNativeExecution({
+		provider: state.provider,
+		controlRef: dispatched.admission.controlRef,
+		signal: AbortSignal.any([scope.signal, AbortSignal.timeout(ABANDON_STOP_TIMEOUT_MS)]),
+		now: state.args.now
+	});
+}
+/** Abandon only after a confirmed stop. Without one, journal nothing. */
 async function abandonScopeRetainedOwnerInvocation(scope, failure, failures) {
 	const state = owners.get(scope);
 	if (state === void 0 || state.inputSequence === void 0) return false;
@@ -6979,9 +7043,7 @@ async function abandonScopeRetainedOwnerInvocation(scope, failure, failures) {
 	});
 	return true;
 }
-/** Resume the original backend prompt; rebuilt coordination observations cannot replace it.
-*  `session: 'fresh'` makes every invocation after the first start a new harness session in the
-*  environment it continues. */
+/** Resume the original prompt. A fresh session starts a new harness session in the environment. */
 async function prepareScopeRetainedOwnerTask(scope, task, session = "native") {
 	const state = owners.get(scope);
 	if (!state) return task;
@@ -7044,6 +7106,10 @@ async function prepareScopeRetainedOwnerTask(scope, task, session = "native") {
 			...point.marker === void 0 ? {} : { marker: point.marker }
 		};
 	};
+	if (state.replaceDeadExecution === true) {
+		state.replaceDeadExecution = false;
+		if (state.taskRef === void 0) await releaseDeadRetainedExecution(state, owned, scope);
+	}
 	if (state.taskRef !== void 0) {
 		const original = await args.blobs.get(state.taskRef);
 		if (original === void 0 || contentAddress(original) !== state.taskRef) throw new ValidationError("retained owner task is missing or corrupt");
@@ -7108,22 +7174,11 @@ function consumeScopeRetainedOwnerResult(scope) {
 function retainedOwnerReleaseRetriable(scope) {
 	return owners.get(scope)?.releaseRetriable ?? false;
 }
-/**
-* How long one release spends capturing the owner's pending checkpoints, all of them together. A
-* capture it cuts short keeps its checkpoint and the source, as a failed capture does, and the
-* release goes on to settle. Each capture is otherwise bounded only by its port, and one at a
-* time: on Discovery run terraform-dc-model-20261010h-c1 (Runtime 0.314.0) a director's release
-* waited 00:19:18Z to 01:19:38Z for one capture to reach the port's 60-minute bound, and the run
-* settled 98 minutes after its deadline. The release captures that finished there took 67 seconds
-* and 7 and 34 minutes, beside live captures of abandoned directors on the same slots.
-*/
+/** One budget for every checkpoint lookup, delete and fork this release starts. A cut-short capture keeps its checkpoint and source. */
 const RELEASE_CHECKPOINT_CAPTURES_MS = 9e5;
 /**
-* Release the owner's environment once no turn of it will run again: at the run's final
-* settlement for the root, and when a nested manager's own scope has finished. A second call while
-* one is in flight joins it. The release first waits for the end-of-turn capture of the owner's
-* last turn, so the capture always precedes the destroy. `capturesMs` bounds the checkpoint
-* captures it runs ({@link RELEASE_CHECKPOINT_CAPTURES_MS}).
+* Release the owner's environment once no turn of it will run again. A second call joins the one
+* in flight. The end-of-turn capture finishes before destroy. `capturesMs` bounds checkpoint work.
 */
 function releaseScopeRetainedOwnerEnvironment(scope, { capturesMs = RELEASE_CHECKPOINT_CAPTURES_MS } = {}) {
 	const state = owners.get(scope);
@@ -7146,8 +7201,10 @@ async function releaseOwnerEnvironment(state, provider, capturesMs) {
 	await state.checkpointing?.catch(() => void 0);
 	const capturesDeadline = Date.now() + capturesMs;
 	const events = [...await args.journal.loadTree(args.rootId) ?? []];
-	const requestFailures = await reconcileCheckpointRequests(state, events);
-	const pendingSources = new Set(requestFailures.map(({ event }) => event.environmentId));
+	const captures = new AbortController();
+	const capturesTimer = setTimeout(() => captures.abort(/* @__PURE__ */ new Error(`the release's ${capturesMs} ms for checkpoint captures ran out; checkpoint and source kept`)), Math.max(0, capturesDeadline - Date.now()));
+	let requestFailures = [];
+	const pendingSources = /* @__PURE__ */ new Set();
 	const released = new Set(events.flatMap((event) => event.kind === "environment-teardown" && event.id === args.nodeId && event.provider === provider.name && event.destroyed ? [event.environmentId] : []));
 	const environments = new Set(events.flatMap((event) => event.id === args.nodeId && event.kind === "execution-admitted" && event.admission.phase === "environment" ? [event.admission.environmentId] : []));
 	const retentionFailures = await ownerWorkspaceRetentionFailures(events, args);
@@ -7158,10 +7215,10 @@ async function releaseOwnerEnvironment(state, provider, capturesMs) {
 	const checkpointFailures = [];
 	const checkpointsKept = [];
 	const uncapturedSources = /* @__PURE__ */ new Set();
-	const pending = pendingCheckpoints(events, state).filter((event) => !retentionFailures.has(event.environmentId));
-	const captures = new AbortController();
-	const capturesTimer = setTimeout(() => captures.abort(/* @__PURE__ */ new Error(`the release's ${capturesMs} ms for checkpoint captures ran out; checkpoint and source kept`)), Math.max(0, capturesDeadline - Date.now()));
 	try {
+		requestFailures = await reconcileCheckpointRequests(state, events, captures.signal);
+		for (const { event } of requestFailures) pendingSources.add(event.environmentId);
+		const pending = pendingCheckpoints(events, state).filter((event) => !retentionFailures.has(event.environmentId));
 		for (const sourceEnvironmentId of new Set(pending.map((event) => event.environmentId))) {
 			const cleaned = await cleanCheckpoints(state, await checkpointHandle(state, sourceEnvironmentId, AbortSignal.any([captures.signal, AbortSignal.timeout(3e4)])), pending.filter((event) => event.environmentId === sourceEnvironmentId), events, captures.signal);
 			checkpointFailures.push(...cleaned.unconfirmed);
@@ -7171,14 +7228,16 @@ async function releaseOwnerEnvironment(state, provider, capturesMs) {
 	} finally {
 		clearTimeout(capturesTimer);
 	}
-	const forksUnresolved = await settleCaptureForks(state);
-	for (const event of checkpointFailures) pendingSources.add(event.environmentId);
+	const forksUnresolved = await settleCaptureForks(state, captures.signal);
+	for (const { event } of checkpointFailures) pendingSources.add(event.environmentId);
 	for (const environmentId of environments) {
 		if (released.has(environmentId)) continue;
 		let destroyed = false;
 		let detail;
-		if (retentionFailures.has(environmentId) || pendingSources.has(environmentId) || uncapturedSources.has(environmentId)) {
-			detail = pendingSources.has(environmentId) ? "checkpoint cleanup unresolved: source preserved for exact lookup and cleanup" : uncapturedSources.has(environmentId) ? "checkpoint kept uncaptured: source preserved so its checkpoint can still be forked and captured" : "provider workspace retention: source preserved because the owner execution has no verified workspace receipt";
+		const retentionReason = retentionFailures.get(environmentId);
+		const nativeHold = retentionReason?.startsWith("native session copy incomplete:") === true;
+		if (retentionReason !== void 0 || pendingSources.has(environmentId) || uncapturedSources.has(environmentId)) {
+			detail = nativeHold ? retentionReason : pendingSources.has(environmentId) ? "checkpoint cleanup unresolved: source preserved for exact lookup and cleanup" : uncapturedSources.has(environmentId) ? "checkpoint kept uncaptured: source preserved so its checkpoint can still be forked and captured" : retentionReason;
 			preserved.push(environmentId);
 			lastDetail = detail;
 		} else {
@@ -7235,12 +7294,12 @@ async function releaseOwnerEnvironment(state, provider, capturesMs) {
 	}
 	state.releaseRetriable = retriable;
 	const checkpointTeardowns = [
-		...checkpointFailures.map((event) => ({
+		...checkpointFailures.map(({ event, reason }) => ({
 			id: args.nodeId,
 			label: "scope owner workspace checkpoint",
 			runtime: provider.name,
 			status: "done",
-			detail: `checkpoint cleanup unconfirmed: ${event.checkpoint.checkpointId} from ${event.environmentId}`
+			detail: `checkpoint cleanup unconfirmed: ${event.checkpoint.checkpointId} from ${event.environmentId} (${reason})`
 		})),
 		...requestFailures.map(({ event, reason }) => ({
 			id: args.nodeId,
@@ -7303,46 +7362,14 @@ function unsettledOwnerRuns(events, nodeId, environmentId) {
 }
 // src/mcp/tools/spawn-resource-paths.ts
 /**
-* Inline resources a manager hands a child by PATH instead of by content.
-*
-* The canonical profile schema knows two resource kinds, `inline` (a content string) and `github`.
-* A manager that wants a child to receive a data file therefore had one way to do it: emit the
-* bytes inside its own `spawn` tool call. That is a transcription by a language model, and it does
-* not survive size. Measured 2026-09-12 (discovery-lab `mech-interp-foundations-glm2-b-20260912b`):
-* a 29,144-character base64 payload on the manager's disk reached three children as 15,928
-* characters with 11 substitutions, and a fourth child received the literal placeholder the
-* manager meant to replace. Seven blind-check attempts across two runs delivered no data.
-*
-* `{ kind: 'inline', name, path }` lets the coordination server be the transport: it reads the
-* file from the manager's workspace, fills `content`, and the profile that reaches the schema,
-* the journal, and the provider is an ordinary inline resource. Nothing downstream changes; the
-* model's output stops carrying the bytes.
-*
-* Where the bytes come from is a {@link SpawnResourceReader}, and there are two:
-*  - a HOST DIRECTORY, for a manager whose driver runs on this host (a loopback bridge with a
-*    `cwd`), read through the descriptor-identity checks below;
-*  - the manager's OWN EXECUTION ENVIRONMENT, for a manager inside a provider sandbox, read
-*    through the environment's `read()`. The coordination server cannot see a sandbox filesystem,
-*    but the provider that created the sandbox can, and it is already in hand.
-*
-* The second reader exists because the first one's absence was not a refusal a manager could
-* work around. Measured 2026-09-17 (discovery-lab `mech-interp-foundations-sandbox-a-20260917h`):
-* a sandbox-rooted director, refused by path, fell back to emitting its files as content and got
-* 5 characters wrong in 24,008, destroying 3 of 7 files including its instrument and both
-* drivers. At that rate 20 KB of mounts all arrive intact about 2% of the time, and gzip makes it
-* worse by turning one wrong character into total loss. Four consecutive runs in that lane lost
-* their research children to this. There is no encoding that fixes a transcription channel; the
-* only fix is a channel with no model in it.
-*
-* Fail-closed rules, each with the reason a manager needs to fix its call:
-*  - no reader available → refused (neither a host directory nor an environment with `read`)
-*  - absolute path or `..` escape → refused by both readers; a symlink that resolves outside the
-*    root → refused by the host reader (the environment reader delegates containment to the
-*    provider, which serves only the sandbox's own workspace)
-*  - not a regular file → refused
-*  - over {@link SPAWN_RESOURCE_PATH_MAX_BYTES} → refused naming the bound
-*  - bytes that are not valid UTF-8 → refused; `content` is a string, so binary data is encoded
-*    (base64) by the manager first, exactly as it would be for a content resource
+* Inline resources a manager hands a child by path. `{ kind: 'inline', name, path }` is read by the
+* coordination server into ordinary `content`, so the model does not transcribe the bytes.
+* {@link SpawnResourceReader} is either a host directory (descriptor-identity checks) or the
+* manager's own execution environment (`read()`), because the coordination server cannot see a
+* sandbox filesystem. Refuse when no reader exists, the path is absolute or escapes with `..`, a
+* host symlink resolves outside the root, the path is not a regular file, the file exceeds
+* {@link SPAWN_RESOURCE_PATH_MAX_BYTES}, or the bytes are not UTF-8. Binary content is base64,
+* encoded by the manager as it would be for a content resource.
 */
 const SPAWN_RESOURCE_PATH_MAX_BYTES = 4194304;
 /** The host-directory reader: a manager whose workspace is a directory this process can open. */
@@ -7354,9 +7381,14 @@ function hostDirectoryReader(root) {
 }
 /**
 * The environment reader: a manager running inside a provider environment whose `read()` serves
-* its own workspace. The provider owns containment — it will not serve a path outside the box —
-* but the relative-path and `..` rules are enforced here too, so the refusal names the rule the
-* manager broke rather than whatever the provider says about an escape it declined.
+* its own workspace. Containment of relative paths is the provider's property, not this
+* function's: the tangle sidecar enforces it in `resolveWorkspacePath`
+* (apps/sidecar/src/lib/workspace.ts:98-155, agent-dev-container) — relative paths stay inside
+* the sandbox workspace, absolute paths only through an allowlist, `.sidecar/` refused at any
+* depth because that tree holds the guest's orchestrator token. If that enforcement widened,
+* this reader would serve files from outside the workspace; the absolute, `..`, and `.sidecar`
+* refusals below are belt-and-braces so it stays correct for every path shape they can name
+* (#1284).
 *
 * `read()` returns a string, so an environment cannot hand back bytes that are not UTF-8; the
 * provider has already decoded. The size bound is checked on what arrives.
@@ -7377,6 +7409,10 @@ function environmentReader(environment) {
 				ok: false,
 				reason: `path ${requested} leaves the manager's workspace`
 			};
+			if (requested.split(/[\\/]/u).includes(".sidecar")) return {
+				ok: false,
+				reason: `path ${requested} names .sidecar, the guest's control tree; a spawn resource cannot read it`
+			};
 			let content;
 			try {
 				content = await environment.read(requested);
@@ -7606,20 +7642,7 @@ async function resolveSpawnResourcePaths(profile, source) {
 	};
 }
 // src/runtime/supervise/retained-owner-resource-reader.ts
-/**
-* The owner's environment as a source of by-path spawn resources.
-*
-* Built once per scope, before the environment exists: the coordination tools are created ahead
-* of the owner's first turn, and the environment is admitted during it. So the reader resolves
-* its target on every read — the latest environment admission on this node, reconstructed through
-* the bound provider the same way cleanup reconstructs it, with the same identity check. A manager
-* that has not yet been admitted, or whose provider was never bound, gets a refusal that names the
-* missing piece rather than a read from nowhere.
-*
-* The environment's `read()` serves the sandbox's own workspace; containment against that
-* workspace is the provider's. The relative-path and `..` rules are the reader's, in
-* `environmentReader`, so a manager is refused for the rule it broke.
-*/
+/** Read spawn resources from the owner's latest environment. Path rules live in `environmentReader`. A missing admission or provider is a refusal, not a read from nowhere. */
 function scopeRetainedOwnerResourceReader(scope) {
 	const state = owners.get(scope);
 	if (state === void 0) return void 0;
@@ -8023,40 +8046,10 @@ function meterRuntimeOwnedAccounting(scope, spend, detail, options) {
 }
 // src/runtime/supervise/dispatch.ts
 /**
-*
-* `rollingDispatch` — the REFILLING dispatch policy over a `Scope`. It keeps `width` children in
-* flight and admits the next queued unit of work the instant one settles, instead of waiting for
-* a whole round to drain (`fanout`) or for a driver to decide again (`spawn → await → spawn`).
-*
-* The gap it closes: `fanout` opens every item at once and then drains — one round, no refill —
-* and a driver brain's manual loop opens one worker per model turn. Between those two there was
-* nothing that holds N slots full, which is why a 5-worker run can peak at 2 live workers and sit
-* ~50% idle. This is a policy over the EXISTING `Scope.spawn` / `Scope.next` primitives: it adds
-* no second admission path, so the conserved budget pool stays the only fence on total work and
-* `width` is only a fence on simultaneous work.
-*
-* Fail-closed by construction: an admission rejection (`budget-exhausted` / `depth-exceeded`) is
-* recorded and STOPS further admission — the loop then drains what is already live and returns.
-* It never retries a rejected spawn against the same pool, and it never spawns past `width`.
-*
-* ── Concurrency ────────────────────────────────────────────────────────────────────────────────
-*
-* `width` bounds the children THIS dispatcher holds in flight. The tree-wide bound on working
-* agents is `SuperviseOptions.workerSlots` (`./worker-slots`): a spawn past it is queued by the
-* scope, not refused, so a `width` above the free slots only lengthens the allocator's queue.
-* `SandboxLineage`'s fork concurrency bounds boxes inside ONE leaf's fork wave, a different unit.
-*
-* ── Why this is not a copy of the kernel's batch loop ──────────────────────────────────────────
-*
-* `runBatch` (`src/runtime/run-loop.ts`) runs the same hold-N-slots-full shape over the KERNEL's
-* substrate: bare promises in a `Set`, raced with `Promise.race`, bounded by `maxConcurrency`.
-* This one runs it over the SUPERVISOR's substrate — `Scope.spawn`'s atomic reservation against
-* the conserved pool, `Scope.next`'s journaled settlement cursor, and the blob store behind each
-* result. Neither can be expressed in the other's terms without dragging its whole substrate
-* along: the kernel loop has no budget to reserve and no cursor to order settlements by, and this
-* one cannot race raw promises because a settlement is only real once it is journaled. The shape
-* repeating across the two deliberate layers is resonance, not duplication — do not "unify" them
-* into a shared helper that would have to know about both.
+* `rollingDispatch` keeps `width` children in flight over `Scope.spawn` and `Scope.next`.
+* An admission rejection stops further admission. `width` bounds this dispatcher; `workerSlots`
+* queues past the tree-wide bound; a sandbox fork wave is a different unit. Do not fold this
+* into `runBatch`: a Scope settlement is real only once it is journaled.
 *
 * @experimental
 */
@@ -10389,13 +10382,8 @@ async function runChild(live, executor, childAbort, task, opts, pool, ticket, bl
 		await closeRetainedWrites();
 	}
 }
-/**
-* Fold a streaming executor's running total onto the live child, so `scope.progress(id)` sees it.
-* The fold never aborts at the reservation: usage arrives after the call it measures, often last,
-* so aborting would discard completed work and save no spend; reconciliation records overspend.
-* `progress` rows, replaced by the settlement, publish on a leading-edge second (#2337, #2339);
-* awaiting-result rows always publish.
-*/
+/** Publish the running total. Do not abort the fold: usage often arrives last, and overspend is reconciled.
+*  Progress rows publish once a second; awaiting-result rows always publish. */
 async function foldExecutorStream({ live, childAbort, now }, stream, journal, journalRoot, nextProgressSeq, priorSpent) {
 	let publishedAt = Number.NEGATIVE_INFINITY;
 	return await foldStream(stream, async (running, event) => {
@@ -10448,6 +10436,10 @@ async function settleThrown(attempt, cause, executionEvidence, closeRetainedWrit
 		if (acceptedAccountingError === void 0) return await settleAccepted(attempt, accepted);
 		err = acceptedAccountingError;
 	}
+	if (retainedSessionReplaced(err)) {
+		live.recoveryPending = false;
+		return await settleCrashed(attempt, err, executionEvidence);
+	}
 	if (err instanceof RetainedExecutionPendingError || live.recoveryPending) return await settleRetainedPending(attempt, err);
 	return await settleCrashed(attempt, err, executionEvidence);
 }
@@ -10541,11 +10533,7 @@ function failureRecord(failure, trace, metered, providerModel, harnessTranscript
 		failure: reportedFailureCause(failure)
 	};
 }
-/**
-* Fold a streaming executor's usage into the conserved `Spend`, publishing the running total
-* after EVERY event: a RUNNING worker is observable (it used to report zero until the stream
-* drained) and one that throws mid-stream reconciles its real partial spend.
-*/
+/** Fold usage after every event, so a running worker is observable and a mid-stream throw keeps its partial spend. */
 async function foldStream(stream, onProgress, signal, priorSpent, onEvent) {
 	const totals = newUsageTotals(priorSpent);
 	const iterator = stream[Symbol.asyncIterator]();
@@ -10594,14 +10582,13 @@ function preserveUnknownTelemetry(streamed, terminal) {
 		...terminal.boxMinutes !== void 0 ? { boxMinutes: terminal.boxMinutes } : {},
 		...terminal.boxMinutesKnown !== void 0 ? { boxMinutesKnown: terminal.boxMinutesKnown } : {},
 		...terminal.boxMinutesProvenance !== void 0 ? { boxMinutesProvenance: terminal.boxMinutesProvenance } : {},
-		...(streamed.tokensProvenance ?? terminal.tokensProvenance) === void 0 ? {} : { tokensProvenance: streamed.tokensProvenance ?? terminal.tokensProvenance }
+		...(streamed.tokensProvenance ?? terminal.tokensProvenance) === void 0 ? {} : { tokensProvenance: streamed.tokensProvenance ?? terminal.tokensProvenance },
+		...terminal.streamedTokens === void 0 ? {} : { streamedTokens: cloneTokenUsage(terminal.streamedTokens) },
+		...terminal.unobservedTokens === void 0 ? {} : { unobservedTokens: cloneTokenUsage(terminal.unobservedTokens) },
+		...terminal.iterationsKnown === false ? { iterationsKnown: false } : {}
 	};
 }
-/**
-* Await a one-shot executor's terminal result unless an abort wins first, except for an execution
-* whose result was accepted before the abort arrived: it is ending the turn that submitted that
-* result, so it is awaited rather than discarded, and the executor bounds that wait itself.
-*/
+/** An abort wins unless the result was already accepted, in which case the executor bounds the wait. */
 async function awaitUnlessAccepted(work, signal, executor) {
 	try {
 		return await awaitAbortable(work, signal);
@@ -11093,47 +11080,6 @@ function maxSeqOf(events, pred) {
 function reservedCursorFloor(events) {
 	return Math.max(maxSeqOf(events, closesCursorSlot), events.reduce((max, event) => event.kind === "reconciled" && event.settledSeq !== void 0 ? Math.max(max, event.settledSeq) : max, -1));
 }
-/** Durable measured costs plus conservative unmeasured ceilings and remaining backing.
-* Unknown flags distinguish those charges from observed spend. */
-function sumSpendFromEvents(events) {
-	const totals = sumMeasuredSpendFromEvents(events);
-	const rootBudget = events.find((event) => event.kind === "spawned" && event.parent === void 0)?.budget;
-	let remainingRootTokens = Math.max(0, (rootBudget?.maxTokens ?? 0) - chargedTokens(totals.childWork.tokens) - chargedTokens(totals.driverInference.tokens));
-	let remainingRootIterations = Math.max(0, (rootBudget?.maxIterations ?? 0) - totals.childWork.iterations - totals.driverInference.iterations);
-	let remainingRootUsd = Math.max(0, (rootBudget?.maxUsd ?? 0) - totals.childWork.usd - totals.driverInference.usd);
-	for (const budget of uncertainSpawnBudgets(events)) {
-		const unknown = withBudgetResources(zeroSpend(), budget);
-		Object.assign(totals.childWork, addResourceSpend(totals.childWork.resources, unknown.resources));
-		const iterationCharge = budget.maxIterations ?? remainingRootIterations;
-		totals.childWork.iterations += iterationCharge;
-		remainingRootIterations = Math.max(0, remainingRootIterations - iterationCharge);
-		const tokenCharge = budget.maxTokens ?? remainingRootTokens;
-		totals.childWork.tokens.input += tokenCharge;
-		remainingRootTokens = Math.max(0, remainingRootTokens - tokenCharge);
-		totals.childWork.tokensKnown = false;
-		const usdCharge = budget.maxUsd ?? (rootBudget?.maxUsd !== void 0 ? remainingRootUsd : 0);
-		totals.childWork.usd += usdCharge;
-		totals.childWork.usdKnown = false;
-		remainingRootUsd = Math.max(0, remainingRootUsd - usdCharge);
-	}
-	for (const { budget: held } of heldSpawnBudgets(events)) totals.childWork = addSpend(totals.childWork, {
-		...zeroSpend(),
-		iterations: held.maxIterations ?? 0,
-		tokens: {
-			input: held.maxTokens ?? 0,
-			output: 0
-		},
-		tokensKnown: (held.maxTokens ?? 0) === 0,
-		usd: held.maxUsd ?? 0,
-		usdKnown: (held.maxUsd ?? 0) === 0,
-		...held.resources === void 0 ? {} : { resources: Object.fromEntries(Object.entries(held.resources).map(([name, value]) => [name, {
-			unit: value.unit,
-			amount: value.limit,
-			known: value.limit === 0
-		}])) }
-	});
-	return totals;
-}
 function sumMeasuredSpendFromEvents(events, ownerId) {
 	const budgets = new Map(events.flatMap((event) => event.kind === "spawned" ? [[event.id, event.budget]] : []));
 	let childWork = zeroSpend();
@@ -11681,52 +11627,48 @@ function makeNestedScopeSeam(args, workerSlots, childSlot, childNodeId, childBud
 }
 // src/runtime/supervise/run-layout.ts
 /**
-* The on-disk supervisor-run layout: `<root>/.agent/supervisor/<id>`.
-*
-* This is the durable, cross-process face of a supervisor run — the counterpart to the in-process
-* `Inbox` seam in `./inbox`. A run persists its state under one directory so that any OTHER process
-* can find it after the fact: `@tangle-network/traces` reads exactly this layout via
-* `traces analyze --supervisor-run-dir`, a restarted host can rehydrate a run it no longer holds
-* handles to, and a human can steer a live worker by appending one NDJSON line. Until now the
-* layout was defined only in the unpublished `loops` repo (`src/supervisor-control.ts`) — a
-* published reader depending on an unpublished writer's convention — so the contract is promoted
-* here, names preserved.
-*
-* `.agent` is the one dot-dir for ALL agent-owned state (skills already write
-* `.agent/hypotheses/`, `.agent/skill-runs.jsonl`); supervisor runs live beside them rather than
-* under a product-branded dir. Runs written by older writers used `.loops/supervisor/<id>` —
-* readers that must see those keep a legacy fallback; this writer never creates `.loops` again.
-*
-* Layout, relative to `supervisorRunDir(root, id)`:
+* On-disk supervisor run layout: `<root>/.agent/supervisor/<id>`. `@tangle-network/traces` reads it
+* via `traces analyze --supervisor-run-dir`. Older writers used `.loops/supervisor/<id>`; readers
+* keep that fallback and this writer never creates `.loops`. Layout, relative to
+* `supervisorRunDir(root, id)`:
 *
 *   steers/requests/<hash>.json    one exact, caller-idempotent {@link WorkerSteerRequest}
 *   steers/acks/<hash>.json        runtime acknowledgement for that steer operation
 *   workers/<id>.inbox.ndjson      best-effort readable projection of admitted steer requests
 *   workers/<label>.ndjson         best-effort per-worker control-event log (delivery bookkeeping)
+*   questions/<id>.json            an `ask_parent` question {@link fileEscalateQuestion} hands to an
+*                                  outside observer, who answers with a root `writeWorkerSteer`
 *   cancellations/requests.ndjson  worker-scoped cancel requests (durable inbox); each line is a
 *                                  {@link WorkerCancelRequest}
-*   cancellations/<opId>.json      the acknowledgement for one cancel operation — a
-*                                  {@link WorkerCancellation} written ONLY by the runtime
-*                                  acknowledger in the OWNING manager's turn loop: exact node
-*                                  ids route to the manager that parents them (any depth);
-*                                  label/profile-name references to the root manager alone
+*   cancellations/<opId>.json      a {@link WorkerCancellation}, written ONLY by the owning
+*                                  manager's acknowledger (labels resolve at the root alone)
 *   cancellations/run.request.json the run-scoped cancel request — one {@link RunCancelRequest},
 *                                  the whole RUN rather than one worker
-*   cancellations/run.json         the acknowledgement for the run-scoped request — a
-*                                  {@link RunCancellation} written ONLY by the runtime (the root
-*                                  manager issues the abort; the `supervise()` settle path records
-*                                  what the run actually did)
+*   cancellations/run.json         its {@link RunCancellation}, written ONLY by the runtime
 *
 * Reads are tolerant by contract: a partial trailing line (a writer mid-append) or a corrupt line
 * never poisons the rest of the file — later valid lines still matter. Duplicate operation ids
 * collapse to the first admitted request, while a payload conflict fails closed.
 *
-* Promoted from `loops/src/supervisor-control.ts`. Steer admission now requires the exact worker id
-* and a caller-owned operation id. One atomic request file is the durable inbox; the NDJSON file is
-* a readable projection only and never controls idempotency.
+* Steer admission requires the exact worker id and a caller-owned operation id. One atomic request
+* file is the durable inbox; the NDJSON file is a readable projection that never controls idempotency.
 *
 * @experimental
 */
+/** An `escalateQuestion` that writes each `ask_parent` question to `questions/<id>.json` for an
+*  out-of-process observer, who answers through `writeWorkerSteer` on the root (#1165). */
+function fileEscalateQuestion(rootDir, runId) {
+	return (question) => {
+		const dir = join(supervisorRunDir(rootDir, runId), "questions");
+		mkdirSync(dir, { recursive: true });
+		const file = join(dir, `${question.id.replace(/[^\w.-]/g, "_")}.json`);
+		writeAtomicDurableFile(file, `${JSON.stringify(question, null, 2)}\n`, { mode: 384 });
+		return {
+			delivered: true,
+			to: file
+		};
+	};
+}
 /** The root every supervisor run of one workspace lives under. */
 function supervisorRunsRoot(rootDir) {
 	return join(resolve(rootDir), ".agent", "supervisor");
@@ -12350,6 +12292,20 @@ function writeLine(fd, line) {
 		offset += written;
 	}
 }
+/** A `task` tool result names the session the harness itself spawned (`<task id="ses_...">` or
+*  `task_id: ses_...`), the same text `shared-box-worker` reads from a live part. #1264: the id
+*  reached no record, so a subagent the harness completed stayed invisible to settle and
+*  coverage alike. */
+const TASK_SESSION_ID = /(?:<task id="|task_id: )(ses_[A-Za-z0-9]+)/gu;
+function subagentSessionIdsIn(event) {
+	if (event.kind !== "tool_result" || event.toolName !== "task") return [];
+	const ids = [];
+	for (const text of [event.result, event.error?.message]) {
+		if (typeof text !== "string") continue;
+		for (const match of text.matchAll(TASK_SESSION_ID)) ids.push(match[1]);
+	}
+	return ids;
+}
 /**
 * The receipt for the root stream a run directory holds, recomputed from the file's bytes, or
 * `undefined` when the directory holds none. This is what a run that never settled — a root that
@@ -12360,15 +12316,20 @@ async function readRootStreamReceipt(runDir, file = ROOT_STREAM_FILE) {
 	const path = resolve(runDir, file);
 	const hash = createHash("sha256");
 	let events = 0;
+	const subagentSessionIds = /* @__PURE__ */ new Set();
 	try {
-		for await (const _record of readCommittedJsonLines(path, { onBytes: (bytes) => void hash.update(bytes) })) events += 1;
+		for await (const record of readCommittedJsonLines(path, { onBytes: (bytes) => void hash.update(bytes) })) {
+			events += 1;
+			if ("event" in record) for (const id of subagentSessionIdsIn(record.event)) subagentSessionIds.add(id);
+		}
 	} catch (error) {
 		if (isNoEntError(error)) return void 0;
 		throw error;
 	}
 	return Object.freeze({
 		ref: `sha256:${hash.digest("hex")}`,
-		events
+		events,
+		...subagentSessionIds.size > 0 ? { subagentSessionIds: [...subagentSessionIds] } : {}
 	});
 }
 /** Every committed line of the root stream, in order, or `undefined` when there is no file. A
@@ -13767,6 +13728,342 @@ async function recoverRetainedChildren(args, children, spawn, next) {
 		throw error;
 	}
 }
-export { hasRetriableTeardowns as $, readBoundHarnessSessions as $n, linkAbort as $r, FileResultBlobStore as $t, isTraceAnalysisStore as A, mergeTraceEnv as An, recordRuntimeOwnedProviderModel as Ar, scopeOwnerExecutorNodeContext as At, FileSpawnJournal as B, createRuntimeEventCollector as Bn, executableAgentProfileSnapshot as Br, scopeRetainedOwnerRestorePoint as Bt, writeWorkerSteerAcknowledgement as C, verifyObserverRecords as Cn, knownMaterializationReceipt as Cr, scopeRetainedOwnerResult as Ct, prepareScopeResume as D, workerTraceEnv as Dn, recordRuntimeOwnedProviderAttemptStart as Dr, recordScopeOwnerMaterialization as Dt, resolveWorkerSlots as E, WORKER_TRACE_PROPAGATION as En, recordRuntimeOwnedDriveHarnessProviderEvidence as Er, noteScopeOwnerPlannedExecution as Et, attachWorker as F, createOpenInferenceFileExporter as Fn, runtimeOwnedPendingExecutorMaterialization as Fr, beginScopeRetainedOwnerDrive as Ft, settledToIteration as G, captureBoundHarnessTranscript as Gn, RetainedRunProviderContractError as Gr, scopeRetainedOwnerContext as Gt, spawnJournalRecordEvents as H, sanitizeKnowledgeReadinessReport as Hn, isRuntimeFlowBrain as Hr, scopeRetainedOwnerCheckpointing as Ht, readWorkerInteractiveBinding as I, createOtelExporter as In, runtimeOwnedScopeOwnerControl as Ir, scopeRetainedOwnerSettled as It, freeSlots as J, harnessTranscriptFromLines as Jn, exactSession as Jr, ownedTreeRootSpawn as Jt, assertRecursiveReservationPolicy as K, captureHarnessTranscript as Kn, assertEventBinding as Kr, scopeRetainedOwnerJournalRoot as Kt, reconnectRetainedInteractiveRun as L, flatOtelSpan as Ln, runtimeOwnedScopeOwnerRuntime as Lr, scopeRetainedOwnerTurnEnded as Lt, workerTraceAnalysisStore as M, buildLoopOtelSpans as Mn, runtimeOwnedExecutorExecutionBinding as Mr, coordinationProfileToolPrefix as Mt, nestedScopeSeamKey as N, buildLoopSpanNodes as Nn, runtimeOwnedExecutorMaterialization as Nr, providerVisibleProfile as Nt, sumSpendFromEvents as O, workerTraceHeaders as On, recordRuntimeOwnedProviderDispatchNotStarted as Or, restoreScopeOwnerAcceptedExecution as Ot, interactiveAdmissionSeamKey as P, buildRuntimeEventOtelSpans as Pn, runtimeOwnedExecutorProviderEvidence as Pr, runtimeGraphMetadataKey as Pt, closeScopeAdmission as Q, HARNESS_TRANSCRIPT_READ_LIMITS as Qn, abortReason as Qr, nestedDriverTreeRoot as Qt, recoverRetainedInteractiveRun as R, generateSpanId as Rn, unknownExecutionBindingReceipt as Rr, assertRetainedOwnerCoordinationRekey as Rt, writeWorkerSteer as S, observerRecordDigest as Sn, knownExecutionBindingReceipt as Sr, scopeRetainedOwnerPriorSpend as St, openSlotGroup as T, environmentGone as Tn, providerAttemptEvidence as Tr, finalizeScopeOwnerMaterialization as Tt, appendTeardownConfirmation as U, sanitizeRuntimeStreamEvent as Un, runtimeFlowAgent as Ur, bindScopeRetainedOwnerEnvironmentId as Ut, appendSpawnEvents as V, createRuntimeStreamEventCollector as Vn, executableAgentSpecSnapshot as Vr, noteScopeRetainedOwnerCoordination as Vt, reenteredWorkers as W, HARNESS_TRANSCRIPT_SETTLE_TIMEOUT_MS as Wn, runtimeFlowBrain as Wr, bindScopeRetainedOwnerProvider as Wt, rollingDispatch as X, persistHarnessTranscript as Xn, sameControlCoordinates as Xr, attestNestedDriverTreeOwner as Xt, queueOf as Y, harnessTranscriptUnavailable as Yn, freezeControlRef as Yr, materializeTreeView as Yt, closeRetainedSlots as Z, readHarnessTranscript as Zn, RunCancellationReason as Zr, driverRuntime as Zt, supervisorRunDir as _, acceptedInteractiveControl as _n, attestRuntimeOwnedScopeOwner as _r, environmentReader as _t, readRootStream as a, executorObservationSeamKey as an, readWorkerProgress as ar, recordScopeOwnerPause as at, workerInboxFileFromEventDir as b, FileObserverJournal as bn, finalizeRuntimeOwnedPendingExecutor as br, consumeScopeRetainedOwnerResult as bt, cancelWorker as c, stopRetainedNativeExecution as cn, SEAT_RECHECK_MS as cr, releaseRetainedEnvironments as ct, legacySupervisorRunsRoot as d, mintRetainedIdentity as dn, authoredSeatStages as dr, startScopeRecoveries as dt, runAbortable as ei, encodeResultBlob as en, resolveHarnessTranscriptCapture as er, meterRuntimeOwnedAccounting as et, readWorkerCancelRequests as f, reconnectRetainedRun as fn, seatExecutionProfile as fr, unconfirmedTeardowns as ft, safeWorkerFile as g, retainedCreateMaterial as gn, attestRuntimeOwnedPendingExecutor as gr, scopeRetainedOwnerResourceReader as gt, readWorkerSteerRequests as h, startRetainedRunInEnvironment as hn, attestRuntimeOwnedExecutor as hr, releaseScopeRetainedOwnerForSeatPause as ht, nodeStreamFile as i, providerMessageText as ii, executorObservation as in, describeToolArgs as ir, recordScopeOwnerDriverAttempt as it, parseWorkerToolTraceArtifact as j, readTraceContextFromEnv as jn, runtimeOwnedDriveHarnessProviderEvidence as jr, coordinationMcpAlias as jt, replaySpawnTree as k, createPropagatingTraceEmitter as kn, recordRuntimeOwnedProviderIdentityConflict as kr, scopeOwnerExecutionObservation as kt, claimWorkerSteerDelivery as l, verifyWorkspaceMarker as ln, SeatChain as lr, retryUnconfirmedTeardowns as lt, readWorkerSteerAcknowledgement as m, startRetainedRun as mn, attestRuntimeOwnedDeferredExecutor as mr, prepareScopeRetainedOwnerSeatSwitch as mt, ROOT_STREAM_FILE as n, promptFromAgentTurnInput as ni, closesCursorSlot as nn, DEFAULT_STALL_AFTER_MS as nr, pauseScopeSeatAdmission as nt, readRootStreamReceipt as o, observeModelRequest as on, isLiveNodeStatus as or, registerNestedTeardownScope as ot, readWorkerCancellation as p, recoverRetainedRun as pn, subscriptionUsageLimitSignal as pr, waitForScopeChildren as pt, deriveNodeExecutionIdentity as q, harnessTranscriptArtifact as qn, awaitAbortable$1 as qr, loadSpawnForest as qt, createRootStreamSink as r, promptOptionsFromAgentTurnInput as ri, insideCursorNamespace as rn, createActivityLog as rr, recordScopeOwnerBarrenPause as rt, appendWorkerControlEvent as s, describeRetainedNativeStops as sn, isTerminalNodeStatus as sr, releaseHeldEnvironments as st, createScope as t, signalAbortError as ti, SpawnEventIndex as tn, retainHarnessTranscript as tr, meterRuntimeOwnedProviderAttempt as tt, legacySupervisorRunDir as u, assertRetainedRunReplayMaterial as un, SeatPauseError as ur, settleManagerWork as ut, supervisorRunsRoot as v, offerInteractiveControl as vn, authoredAgentIdentity as vr, resolveSpawnResourcePaths as vt, createWorkerSlots as w, destroyInteractiveEnvironment as wn, newExecutionAttemptId as wr, beginScopeOwnerAttempt as wt, writeWorkerCancellation as x, createFileObserverHooks as xn, inheritRuntimeOwnedExecutorAttestation as xr, prepareScopeRetainedOwnerTask as xt, workerCancellationsDir as y, prepareInteractiveDelegation as yn, authoredProfileDigest as yr, abandonScopeRetainedOwnerInvocation as yt, startRetainedInteractiveRun as z, loopEventToOtelSpan as zn, unknownMaterializationReceipt as zr, reconcileScopeRetainedOwnerEnvironment as zt };
+// src/durable/spawn-journal/provider-model-evidence.ts
+/**
+* Aggregate provider-served model evidence across one recursively owned journal forest.
+*
+* The parent tree records an owned driver's terminal summary, while that driver's own inference
+* and descendants live in its owned tree. This reducer follows the forest reader's explicit tree
+* edges and consumes each tree's metered attempts plus terminal leaf settlements exactly once.
+* A summary node is skipped because its owned tree supplies the source records. Plan materialization
+* is intentionally not read: it proves only what Runtime requested, not what a provider served.
+*
+* Missing legacy evidence, an unfinished node, an unopened owned tree, an identity conflict, and a
+* paid attempt without a qualified served snapshot all return unknown. An explicit
+* `providerDispatch: "not_started"` arm and Runtime accounting-only metered records are ignored
+* for served-model identity, while absent or malformed legacy data remains unknown here.
+*/
+function aggregateProviderModelEvidence(forest) {
+	const attempts = [];
+	const observedModels = /* @__PURE__ */ new Set();
+	const canonicalModels = /* @__PURE__ */ new Set();
+	const nodes = /* @__PURE__ */ new Map();
+	let reason;
+	let sawProviderEvidence = false;
+	for (const node of forest.nodes) nodes.set(forestNodeKey(node.treeRoot, node.id), node);
+	if (forest.missingTrees.length > 0 || forest.inDoubt.length > 0) reason = "provider-model-missing";
+	const markMissing = () => {
+		reason ??= "provider-model-missing";
+	};
+	const markConflict = () => {
+		reason = "provider-model-conflict";
+	};
+	const append = (raw) => {
+		sawProviderEvidence = true;
+		if (!isProviderEvidenceObject(raw)) {
+			markMissing();
+			return;
+		}
+		if (raw.status === "unknown") {
+			if (raw.reason === "provider-model-conflict") markConflict();
+			else if (!hasOnlyNotStartedAttempts(raw)) markMissing();
+		} else if (raw.status !== "known") {
+			markMissing();
+			return;
+		}
+		if (!Array.isArray(raw.attempts) || !Array.isArray(raw.models)) {
+			markMissing();
+			return;
+		}
+		const declared = /* @__PURE__ */ new Set();
+		for (const model of raw.models) if (typeof model !== "string" || model.length === 0) markMissing();
+		else declared.add(model);
+		const observedInRecord = /* @__PURE__ */ new Set();
+		for (const rawAttempt of raw.attempts) {
+			if (!isProviderAttemptEvidence(rawAttempt)) {
+				markMissing();
+				continue;
+			}
+			if (rawAttempt.identityConflict === true) markConflict();
+			const observations = [...rawAttempt.observations];
+			if (rawAttempt.providerDispatch === "not_started") {
+				if (observations.length > 0) markMissing();
+				attempts.push(Object.freeze({
+					observations: Object.freeze([]),
+					providerDispatch: "not_started",
+					...rawAttempt.identityConflict === true ? { identityConflict: true } : {}
+				}));
+				continue;
+			}
+			if (observations.length === 0) {
+				markMissing();
+				attempts.push(Object.freeze({
+					observations: Object.freeze([]),
+					...rawAttempt.identityConflict === true ? { identityConflict: true } : {}
+				}));
+				continue;
+			}
+			let base;
+			let snapshot;
+			for (const model of observations) {
+				if (typeof model !== "string" || model.length === 0) {
+					markMissing();
+					continue;
+				}
+				observedInRecord.add(model);
+				observedModels.add(model);
+				const identity = servedIdentityParts(model);
+				if (identity === void 0) {
+					markMissing();
+					continue;
+				}
+				if (base !== void 0 && base !== identity.base) markConflict();
+				if (snapshot !== void 0 && identity.snapshot !== void 0 && snapshot !== identity.snapshot) markConflict();
+				base = identity.base;
+				snapshot ??= identity.snapshot;
+				if (identity.snapshot !== void 0) {
+					canonicalModels.add(`${identity.base}@${identity.snapshot}`);
+					if (canonicalModels.size > 1) markConflict();
+				}
+			}
+			if (base === void 0 || snapshot === void 0) markMissing();
+			attempts.push(Object.freeze({
+				observations: Object.freeze(observations),
+				...rawAttempt.identityConflict === true ? { identityConflict: true } : {}
+			}));
+		}
+		if (declared.size !== observedInRecord.size || [...declared].some((model) => !observedInRecord.has(model))) markMissing();
+	};
+	const terminal = (treeRoot, event) => {
+		const node = nodes.get(forestNodeKey(treeRoot, event.id));
+		if (node === void 0) {
+			markMissing();
+			return;
+		}
+		if (node.ownedTreeRoot !== void 0) return;
+		if (event.kind === "cancelled" && event.providerModel === void 0) {
+			markMissing();
+			return;
+		}
+		append(event.providerModel ?? node.providerModel);
+	};
+	for (const tree of forest.trees) for (const event of tree.events) if (event.kind === "metered") {
+		if (event.accountingOnly === true) {
+			if (event.providerModel !== void 0) markMissing();
+			continue;
+		}
+		if (nodes.get(forestNodeKey(tree.root, event.id))?.ownedTreeRoot !== void 0) continue;
+		const evidence = event.providerModel;
+		if (evidence === void 0) markMissing();
+		else append(evidence);
+	} else if (event.kind === "settled" || event.kind === "cancelled") terminal(tree.root, event);
+	if (!sawProviderEvidence || attempts.length === 0 || observedModels.size === 0) reason ??= "provider-model-missing";
+	const models = Object.freeze([...observedModels]);
+	const frozenAttempts = Object.freeze(attempts);
+	return Object.freeze(reason === void 0 ? {
+		status: "known",
+		attempts: frozenAttempts,
+		models
+	} : {
+		status: "unknown",
+		attempts: frozenAttempts,
+		models,
+		reason
+	});
+}
+function forestNodeKey(treeRoot, nodeId) {
+	return `${treeRoot}\u0000${nodeId}`;
+}
+function isProviderEvidenceObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && "status" in value;
+}
+function hasOnlyNotStartedAttempts(evidence) {
+	return Array.isArray(evidence.attempts) && evidence.attempts.length > 0 && evidence.attempts.every((attempt) => isProviderAttemptEvidence(attempt) && attempt.providerDispatch === "not_started" && attempt.observations.length === 0 && attempt.identityConflict !== true);
+}
+function isProviderAttemptEvidence(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value) && Array.isArray(value.observations) && (value.providerDispatch === void 0 || value.providerDispatch === "not_started");
+}
+function servedIdentityParts(model) {
+	const at = model.lastIndexOf("@");
+	const rawBase = at < 0 ? model : model.slice(0, at);
+	const base = rawBase.slice(rawBase.lastIndexOf("/") + 1);
+	if (base.length === 0) return void 0;
+	const snapshot = at < 0 ? void 0 : model.slice(at + 1);
+	if (snapshot !== void 0 && snapshot.length === 0) return void 0;
+	return snapshot === void 0 ? { base } : {
+		base,
+		snapshot
+	};
+}
+// src/runtime/supervise/settled-usage.ts
+/** Use ownership edges to avoid counting parent summaries as additional inference attempts. */
+function settledUsage(forest, spent, providerModel, profile) {
+	let unknownAttempts = 0;
+	const nodes = new Map(forest.nodes.map((node) => [`${node.treeRoot}\0${node.id}`, node]));
+	for (const tree of forest.trees) {
+		const metered = new Set(tree.events.filter((event) => event.kind === "metered" && !event.accountingOnly).map((event) => event.id));
+		for (const event of tree.events) {
+			if (nodes.get(`${tree.root}\0${event.id}`)?.ownedTreeRoot !== void 0) continue;
+			if (event.kind === "metered" && event.accountingOnly) {
+				if (event.spend.tokensKnown === false || event.spend.tokens.tokensKnown === false) unknownAttempts = null;
+				continue;
+			}
+			let spend;
+			if (event.kind === "metered" && !event.accountingOnly) spend = event.spend;
+			else if ((event.kind === "settled" || event.kind === "cancelled") && !metered.has(event.id)) spend = event.spent;
+			else continue;
+			if (spend && spend.tokensKnown !== false && spend.tokens.tokensKnown !== false) continue;
+			const evidence = event.providerModel;
+			if (evidence?.attempts?.length !== 1) unknownAttempts = null;
+			else if (unknownAttempts !== null && evidence.attempts[0]?.providerDispatch !== "not_started") unknownAttempts++;
+		}
+	}
+	if (forest.inDoubt.length || forest.missingTrees.length) unknownAttempts = null;
+	const status = spent.tokensKnown === true ? "known" : spent.tokens.input > 0 || spent.tokens.output > 0 ? "lower-bound" : "unknown";
+	return {
+		tokens: {
+			status,
+			input: status === "unknown" ? null : spent.tokens.input,
+			output: status === "unknown" ? null : spent.tokens.output,
+			unknownAttempts: status === "known" ? 0 : unknownAttempts === 0 ? null : unknownAttempts
+		},
+		requestedModel: {
+			id: profile?.model?.default ?? null,
+			harness: profile?.harness ?? null,
+			provider: profile?.model?.provider ?? null
+		},
+		observedModels: providerModel.models
+	};
+}
+// src/runtime/supervise/supervisor-accounting.ts
+/** Terminal usage comes from receipts, never admission's conservative reservation charges.
+* Missing receipts stay named gaps; ms is wall time because parallel executor times overlap. */
+async function terminalAccounting(journal, root, elapsedMs, profile) {
+	const forest = await loadSpawnForest(journal, root);
+	const rootTree = forest.trees[0];
+	for (const event of rootTree.events) {
+		const spend = event.kind === "metered" ? event.spend : event.kind === "settled" || event.kind === "cancelled" || event.kind === "reconciled" ? event.spent : void 0;
+		if (spend !== void 0) assertValidSpend(spend, `settlement ${event.id}/${event.kind}`);
+	}
+	const { childWork, driverInference } = sumMeasuredSpendFromEvents([...rootTree.events]);
+	const gaps = spendGapsFromEvents(forest.events.map((entry) => entry.event));
+	const providerModel = aggregateProviderModelEvidence(forest);
+	const fleetYield = fleetYieldFromForest(forest);
+	const summed = addSpend(childWork, driverInference);
+	const spentTotal = {
+		...summed,
+		ms: Math.max(0, elapsedMs),
+		tokensKnown: summed.tokensKnown !== false && summed.tokens.tokensKnown !== false && !gaps.some((gap) => gap.channels.includes("tokens")),
+		usdKnown: summed.usdKnown !== false && !gaps.some((gap) => gap.channels.includes("usd"))
+	};
+	assertValidSpend(spentTotal, "settlement total");
+	const forestNodes = forest.nodes.filter((node) => node.id !== forest.root);
+	return {
+		tree: {
+			root: forest.root,
+			nodes: forestNodes.map(({ treeRoot: _treeRoot, ...node }) => node),
+			inFlight: forestNodes.filter((node) => [
+				"queued",
+				"acquiring",
+				"running"
+			].includes(node.status)).length
+		},
+		spentTotal,
+		usage: settledUsage(forest, spentTotal, providerModel, profile),
+		childWork,
+		driverInference,
+		gaps,
+		providerModel,
+		fleetYield
+	};
+}
+/** Count each child by its last terminal record across the owned forest; roots are exempt. */
+function fleetYieldFromForest(forest) {
+	const spawned = /* @__PURE__ */ new Set();
+	const terminal = /* @__PURE__ */ new Map();
+	const released = /* @__PURE__ */ new Set();
+	const unconfirmed = /* @__PURE__ */ new Set();
+	for (const { event } of forest.events) if (event.kind === "spawned") {
+		if (event.parent !== void 0) spawned.add(event.id);
+	} else if (event.kind === "settled" || event.kind === "cancelled") {
+		const bucket = event.kind === "cancelled" ? "cancelled" : event.status;
+		terminal.set(event.id, bucket);
+		released.delete(event.id);
+		unconfirmed.delete(event.id);
+		if (bucket !== "done" && event.retainedExecution === "released") released.add(event.id);
+		if (bucket !== "done" && event.retainedExecution === "release-unconfirmed") unconfirmed.add(event.id);
+	}
+	const count = (bucket) => [...terminal.values()].filter((value) => value === bucket).length;
+	const fleetYield = {
+		spawned: spawned.size,
+		done: count("done"),
+		down: count("down"),
+		cancelled: count("cancelled"),
+		neverSettled: forest.inDoubt.length,
+		releasedUnrecovered: released.size,
+		releaseUnconfirmed: unconfirmed.size
+	};
+	if (fleetYield.done + fleetYield.down + fleetYield.cancelled + fleetYield.neverSettled !== fleetYield.spawned) throw new RuntimeRunStateError(`supervisor: fleet yield does not partition the spawned children of '${forest.root}' (${JSON.stringify(fleetYield)})`);
+	if (fleetYield.releasedUnrecovered + fleetYield.releaseUnconfirmed > fleetYield.down + fleetYield.cancelled) throw new RuntimeRunStateError(`supervisor: released children exceed down + cancelled for '${forest.root}' (${JSON.stringify(fleetYield)})`);
+	return fleetYield;
+}
+/** Merge missing-receipt channels by node and cause; the root settles in result.json. */
+function spendGapsFromEvents(events) {
+	const labels = /* @__PURE__ */ new Map();
+	const budgets = /* @__PURE__ */ new Map();
+	const terminal = /* @__PURE__ */ new Set();
+	for (const ev of events) if (ev.kind === "spawned") {
+		labels.set(ev.id, ev.label);
+		budgets.set(ev.id, ev.budget);
+	} else if (closesCursorSlot(ev)) terminal.add(ev.id);
+	const gaps = /* @__PURE__ */ new Map();
+	const record = (id, kind, channels) => {
+		if (channels.length === 0) return;
+		const key = `${kind}:${id}`;
+		const existing = gaps.get(key);
+		if (existing !== void 0) for (const channel of channels) existing.channels.add(channel);
+		else gaps.set(key, {
+			id,
+			kind,
+			channels: new Set(channels)
+		});
+	};
+	for (const ev of events) if (ev.kind === "spawned" && ev.parent !== void 0 && !terminal.has(ev.id)) record(ev.id, "never-settled", [
+		"tokens",
+		"usd",
+		...Object.keys(ev.budget.resources ?? {}).map((name) => `resource:${name}`)
+	]);
+	else if (ev.kind === "cancelled" && ev.spent === void 0) record(ev.id, "unreported", [
+		"tokens",
+		"usd",
+		...Object.keys(budgets.get(ev.id)?.resources ?? {}).map((name) => `resource:${name}`)
+	]);
+	else if (ev.kind === "settled" || ev.kind === "cancelled" && ev.spent !== void 0) record(ev.id, "unreported", unknownChannels(withBudgetResources(ev.spent, budgets.get(ev.id) ?? {})));
+	else if (ev.kind === "metered") record(ev.id, "unreported", unknownChannels(ev.spend));
+	return [...gaps.values()].map((gap) => {
+		const label = labels.get(gap.id);
+		return {
+			id: gap.id,
+			...label !== void 0 ? { label } : {},
+			kind: gap.kind,
+			channels: [...gap.channels]
+		};
+	});
+}
+/** The channels a single spend record explicitly marks incomplete. */
+function unknownChannels(spend) {
+	const channels = [];
+	if (spend.tokensKnown === false || spend.tokens.tokensKnown === false) channels.push("tokens");
+	if (spend.usdKnown === false) channels.push("usd");
+	for (const [name, resource] of Object.entries(spend.resources ?? {})) if (!resource.known) channels.push(`resource:${name}`);
+	return channels;
+}
+/** True when any driver metered inference this run (so the winner carries a `spentBreakdown`).
+*  Checks every channel `addSpend` sums — including `ms` — so the gate stays consistent with the
+*  total even though the coordination driver currently stamps `ms: 0`. */
+function isNonEmptySpend(s) {
+	return s.iterations > 0 || s.tokens.input > 0 || s.tokens.output > 0 || s.usd > 0 || s.ms > 0 || s.tokensKnown === false || s.usdKnown === false || Object.values(s.resources ?? {}).some((resource) => resource.amount > 0 || !resource.known);
+}
+export { queueOf as $, harnessTranscriptFromLines as $n, awaitAbortable$1 as $r, ownedTreeRootSpawn as $t, openSlotGroup as A, environmentGone as An, providerAttemptEvidence as Ar, noteScopeOwnerPlannedExecution as At, readWorkerInteractiveBinding as B, createOpenInferenceFileExporter as Bn, runtimeOwnedPendingExecutorMaterialization as Br, scopeRetainedOwnerSettled as Bt, workerCancellationsDir as C, offerInteractiveControl as Cn, authoredAgentIdentity as Cr, abandonScopeRetainedOwnerInvocation as Ct, writeWorkerSteer as D, observerRecordDigest as Dn, knownExecutionBindingReceipt as Dr, scopeRetainedOwnerResult as Dt, writeWorkerCancellation as E, createFileObserverHooks as En, inheritRuntimeOwnedExecutorAttestation as Er, scopeRetainedOwnerPriorSpend as Et, parseWorkerToolTraceArtifact as F, mergeTraceEnv as Fn, recordRuntimeOwnedProviderModel as Fr, coordinationMcpAlias as Ft, appendSpawnEvents as G, createRuntimeEventCollector as Gn, executableAgentProfileSnapshot as Gr, noteScopeRetainedOwnerCoordination as Gt, recoverRetainedInteractiveRun as H, flatOtelSpan as Hn, runtimeOwnedScopeOwnerRuntime as Hr, assertRetainedOwnerCoordinationRekey as Ht, workerTraceAnalysisStore as I, readTraceContextFromEnv as In, runtimeOwnedDriveHarnessProviderEvidence as Ir, coordinationProfileToolPrefix as It, reenteredWorkers as J, sanitizeRuntimeStreamEvent as Jn, runtimeCheckFactory as Jr, bindScopeRetainedOwnerProvider as Jt, spawnJournalRecordEvents as K, createRuntimeStreamEventCollector as Kn, executableAgentSpecSnapshot as Kr, scopeRetainedOwnerCheckpointing as Kt, nestedScopeSeamKey as L, buildLoopOtelSpans as Ln, runtimeOwnedExecutorExecutionBinding as Lr, providerVisibleProfile as Lt, prepareScopeResume as M, workerTraceEnv as Mn, recordRuntimeOwnedProviderAttemptStart as Mr, restoreScopeOwnerAcceptedExecution as Mt, replaySpawnTree as N, workerTraceHeaders as Nn, recordRuntimeOwnedProviderDispatchNotStarted as Nr, scopeOwnerExecutionObservation as Nt, writeWorkerSteerAcknowledgement as O, verifyObserverRecords as On, knownMaterializationReceipt as Or, beginScopeOwnerAttempt as Ot, isTraceAnalysisStore as P, createPropagatingTraceEmitter as Pn, recordRuntimeOwnedProviderIdentityConflict as Pr, scopeOwnerExecutorNodeContext as Pt, freeSlots as Q, harnessTranscriptArtifact as Qn, assertEventBinding as Qr, loadSpawnForest as Qt, interactiveAdmissionSeamKey as R, buildLoopSpanNodes as Rn, runtimeOwnedExecutorMaterialization as Rr, runtimeGraphMetadataKey as Rt, workerCancelRequestsFile as S, acceptedInteractiveControl as Sn, attestRuntimeOwnedScopeOwner as Sr, resolveSpawnResourcePaths as St, workerSteerRequestsDir as T, FileObserverJournal as Tn, finalizeRuntimeOwnedPendingExecutor as Tr, prepareScopeRetainedOwnerTask as Tt, startRetainedInteractiveRun as U, generateSpanId as Un, unknownExecutionBindingReceipt as Ur, reconcileScopeRetainedOwnerEnvironment as Ut, reconnectRetainedInteractiveRun as V, createOtelExporter as Vn, runtimeOwnedScopeOwnerControl as Vr, scopeRetainedOwnerTurnEnded as Vt, FileSpawnJournal as W, loopEventToOtelSpan as Wn, unknownMaterializationReceipt as Wr, scopeRetainedOwnerRestorePoint as Wt, assertRecursiveReservationPolicy as X, captureBoundHarnessTranscript as Xn, runtimeFlowBrain as Xr, scopeRetainedOwnerContext as Xt, settledToIteration as Y, HARNESS_TRANSCRIPT_SETTLE_TIMEOUT_MS as Yn, runtimeFlowAgent as Yr, owners as Yt, deriveNodeExecutionIdentity as Z, captureHarnessTranscript as Zn, RetainedRunProviderContractError as Zr, scopeRetainedOwnerJournalRoot as Zt, readWorkerSteerAcknowledgement as _, reconnectRetainedRun as _n, seatExecutionProfile as _r, waitForScopeChildren as _t, createRootStreamSink as a, abortReason as ai, encodeResultBlob as an, resolveHarnessTranscriptCapture as ar, meterRuntimeOwnedProviderAttempt as at, supervisorRunDir as b, startRetainedRunInEnvironment as bn, attestRuntimeOwnedExecutor as br, scopeRetainedOwnerResourceReader as bt, readRootStreamReceipt as c, signalAbortError as ci, executorObservation as cn, createActivityLog as cr, recordScopeOwnerDriverAttempt as ct, claimWorkerSteerDelivery as d, providerMessageText as di, describeRetainedNativeStops as dn, isLiveNodeStatus as dr, releaseHeldEnvironments as dt, exactSession as ei, materializeTreeView as en, harnessTranscriptUnavailable as er, rollingDispatch as et, fileEscalateQuestion as f, stopRetainedNativeExecution as fn, isTerminalNodeStatus as fr, releaseRetainedEnvironments as ft, readWorkerCancellation as g, mintRetainedIdentity as gn, authoredSeatStages as gr, unconfirmedTeardowns as gt, readWorkerCancelRequests as h, assertRetainedRunReplayMaterial as hn, SeatPauseError as hr, startScopeRecoveries as ht, ROOT_STREAM_FILE as i, RunCancellationReason as ii, FileResultBlobStore as in, readBoundHarnessSessions as ir, meterRuntimeOwnedAccounting as it, resolveWorkerSlots as j, WORKER_TRACE_PROPAGATION as jn, recordRuntimeOwnedDriveHarnessProviderEvidence as jr, recordScopeOwnerMaterialization as jt, createWorkerSlots as k, destroyInteractiveEnvironment as kn, newExecutionAttemptId as kr, finalizeScopeOwnerMaterialization as kt, appendWorkerControlEvent as l, promptFromAgentTurnInput as li, executorObservationSeamKey as ln, describeToolArgs as lr, recordScopeOwnerPause as lt, legacySupervisorRunsRoot as m, RetainedMaterializationTimeoutError as mn, SeatChain as mr, settleManagerWork as mt, terminalAccounting as n, retainedSessionReplaced as ni, driverRuntime as nn, readHarnessTranscript as nr, closeScopeAdmission as nt, nodeStreamFile as o, linkAbort as oi, SpawnEventIndex as on, retainHarnessTranscript as or, pauseScopeSeatAdmission as ot, legacySupervisorRunDir as p, verifyWorkspaceMarker as pn, SEAT_RECHECK_MS as pr, retryUnconfirmedTeardowns as pt, appendTeardownConfirmation as q, sanitizeKnowledgeReadinessReport as qn, isRuntimeFlowBrain as qr, bindScopeRetainedOwnerEnvironmentId as qt, createScope as r, sameControlCoordinates as ri, nestedDriverTreeRoot as rn, HARNESS_TRANSCRIPT_READ_LIMITS as rr, hasRetriableTeardowns as rt, readRootStream as s, runAbortable as si, insideCursorNamespace as sn, DEFAULT_STALL_AFTER_MS as sr, recordScopeOwnerBarrenPause as st, isNonEmptySpend as t, freezeControlRef as ti, attestNestedDriverTreeOwner as tn, persistHarnessTranscript as tr, closeRetainedSlots as tt, cancelWorker as u, promptOptionsFromAgentTurnInput as ui, observeModelRequest as un, readWorkerProgress as ur, registerNestedTeardownScope as ut, readWorkerSteerRequests as v, recoverRetainedRun as vn, subscriptionUsageLimitSignal as vr, prepareScopeRetainedOwnerSeatSwitch as vt, workerInboxFileFromEventDir as w, prepareInteractiveDelegation as wn, authoredProfileDigest as wr, consumeScopeRetainedOwnerResult as wt, supervisorRunsRoot as x, retainedCreateMaterial as xn, attestRuntimeOwnedPendingExecutor as xr, environmentReader as xt, safeWorkerFile as y, startRetainedRun as yn, attestRuntimeOwnedDeferredExecutor as yr, releaseScopeRetainedOwnerForSeatPause as yt, attachWorker as z, buildRuntimeEventOtelSpans as zn, runtimeOwnedExecutorProviderEvidence as zr, beginScopeRetainedOwnerDrive as zt };
 
-//# sourceMappingURL=scope-gIYQ5ZiL.js.map
+//# sourceMappingURL=supervisor-accounting-Bw4MJk-b.js.map