Reconciliation never recovers a sandbox child: 83% of lost children end there, 0 of 35 came back, and fleet yield is reported nowhere

[drewstone]

The measurement

Across every retained pursuit on one operator host (385 runs, deduplicated across seven discovery-lab checkouts):

child runtime	spawned	never settled
tangle-sandbox	1,173	223 (19.0%)
cli	132	2 (1.5%)

Of the 223 lost sandbox children, 185 (83%) stop at exactly one lifecycle stage: reconciled. The rest stop at execution-admitted (31) or execution-result (7).

In capability-per-parameter-cpp-glm-20260915c, 0 of 35 children that reached reconciled ever settled. Not one.

This is not a budget bug

src/runtime/supervise/scope.ts states the contract, and it is correct:

The child-work floor a RETAINED-PENDING child's reservation was reconciled at. Its cursor slot stays open, so the settle path journals this as a reconciled record in place of the settled record it cannot write — otherwise every journal reader charges the ceiling the pool just refunded.

The pool refunds. I checked a reservation-leak hypothesis against this and it is wrong; spentTotal stays honest.

What is lost is the child's work. One sample record: spent: { iterations: 0, tokens: { input: 0, output: 0 }, ms: 19636 } — admitted, ran twenty seconds, produced nothing, reconciled, gone. Its transcript goes with it (#1244), and the director that spawned it simply never hears back.

Why it is invisible

Three views disagree and none of them shows the number that matters:

• the budget pool says everything is fine, because it is;
• disco report counts these as "down", which reads like a failure with a cause;
• the journal says reconciled, a word that promises recovery that never arrives.

Fleet yield — settled over spawned — is reported nowhere. Measured on the two runs from tonight:

run	spawned	settled	yield
capability-per-parameter-cpp-ds-20260915c	48	38	79%
capability-per-parameter-cpp-glm-20260915c	69	34	49%

A director lost half its fleet and nothing in the operator's view said so.

Ask

1. Make reconciliation recover, or stop calling it that. If a retained-pending execution is unobservable, the child should reach a terminal state with a stated reason rather than an open cursor slot that never closes. 0 of 35 is not a recovery path.
2. Report fleet yield. Settled over spawned, per run, in disco report and on the settle record. It is one division and it is the number that tells an operator their fleet is half working.
3. A reconciled child and a down child are different facts; a reader that renders both as "down" hides which one an operator can act on.

Related: #1244 (a dropped child's transcript dies with it), #1245 (a sandbox-placed root cannot use its coordination tools).

🤖 Generated with Claude Code

[drewstone]

Shipped, both halves.

Runtime — agent-runtime 0.233.0 (#1259, merged 14e6d982; tag v0.233.0 at 70afda1d; Publish run 35064017026 green; the served tarball carries fleetYield, retainedExecution, harnessTranscript):

1. Make reconciliation recover, or stop calling it that. On the pursuit path it never could recover — supervisePursuit refuses re-entry and forces retainedAtSettlement: 'release' — so the release sweep now closes each released node's slot with a terminal settled/cancelled record marked retainedExecution: 'released', at the seq the driver saw, carrying the reconciled floor (never the ceiling), the overspend the pool committed, and the transcript receipt. A refused release writes nothing; a crash before the sweep leaves the slot open for a real resume. spendGaps stops calling these never-settled.
2. Report fleet yield. SupervisedResult.fleetYield = { spawned, done, down, cancelled, neverSettled, releasedUnrecovered } on every arm, counted by node id over the journal forest, with spawned === done + down + cancelled + neverSettled and released ≤ down + cancelled asserted. The breaker skips the release-written record, so downCount is unchanged.
3. A reconciled child and a down child are different facts. retainedExecution: 'pending' | 'released' on Settled, the journal records, NodeSnapshot, the agent.child payload, and PursuitNodeProjection.

Lab — discovery-lab#778 (merged 9ec07bc4, stack on 0.233.0): disco report prints FLEET (Runtime settle record, whole spawn forest): spawned=… done=… … yield=34/69 (49%) under FAILURES, and buckets a retained child on the field, never on the reason text: FAILURES: 1 of 4 children down, 3 released-unrecovered. 397/397.

Known, stated in the 0.233.0 CHANGELOG rather than hidden: a crash between the destroyed: true teardown receipt and the released record leaves an open slot beside a destroyed environment.

[drewstone]

Reopening measurement in #1301: ask 2 (report fleet yield) shipped and works, but ask 1 (make reconciliation recover, or stop calling it that) did not land in practice. The released terminal record added in 0.233.0 has executed 0 times in 6,916 run journals — 7,589 settled events, none with retainedExecution: 'released', and no environment-teardown receipt on any child id. The gate at scope.ts:2085 requires proving the child's environment was destroyed, and the failure that produces these children is the environment already being gone. Rate today is 154 of 601 spawned children (25.6%) across the 108 runs carrying a fleetYield; verified-agency-20260919a lost 4 of 4. Reproduced locally on v0.240.0 in #1301.

[drewstone]

Correction to my comment above: I cited verified-agency-20260919a (4 of 4 lost) as the exhibit. That run is withdrawn — this operator host was asleep 81.0% of it (pmset -g log, 486.7 of 600.6 min across 69 DarkWake cycles), so its children were unobservable for host reasons. The population claim stands without it: 133 of 154 never-settled children (86%) had zero host sleep over their whole lifetime, against a 447-child settled control from the same runs. Details in #1301.