fix(supervise): settle a released retained child with a terminal record and report fleet yield

CHANGELOG.md

@@ -65,6 +65,50 @@ blobs)`. Consequences, all deliberate:
 Settlements recorded before this release carry no `harnessTranscript` on the record, which is not
 the same fact as a recorded `unavailable`, and stays absent rather than defaulting.
 
+**A released retained child now settles (#1247).** A child whose provider execution was RETAINED
+— admitted durably, result read lost — settles `down` with its cursor slot open and its
+reservation reconciled at the floor it had streamed (0.230.0, #1190), so that a later process
+could resume the run and reconcile the paid execution. On the pursuit path no later process ever
+comes: `supervisePursuit` writes a settle record that refuses re-entry and forces
+`retainedAtSettlement: 'release'`, so every one of these children is released at root settlement
+and none is ever recovered — by construction, not by accident. Measured 2026-09-15: on
+`capability-per-parameter-cpp-glm-20260915c`, 0 of 35 reconciled children ever settled, and 185
+of 223 lost sandbox children across 385 runs stopped at `reconciled`. Each one read as
+`never-settled` to every journal reader and was charged its ceiling, while the pool had committed
+the floor; Lab told them apart from ordinary downs by matching the reason string.
+
+- The release sweep now writes the node's terminal record after the `environment-teardown`
+  receipt, once the executor confirms teardown: the settlement the driver received (reason,
+  `infra`, `trace`, `harnessTranscript`, `outRef`, `providerModel`), under the seq the driver
+  saw, marked `retainedExecution: 'released'`. Its `spent` is the node's child-work component
+  of the reconcile the pool committed — the streamed floor for a leaf, `accounting().reported`
+  for a recursive executor — never the reservation. A cancelled retained child keeps the
+  `cancelled` kind and its `source`. The overspend a retained reconcile returned, which the
+  open-slot surfaces withhold, is carried on this record, because when the run releases the node
+  the floor is its final charge. A refused release (`destroyed: false`, or an executor whose
+  teardown will not confirm) writes nothing: the environment may still exist, so the slot stays
+  open and the node stays in `teardownUnconfirmed`.
+- `retainedExecution: 'pending' | 'released'` (new `RetainedExecutionState`) is stated on
+  `Settled`'s down arm (`'pending'` at the reconcile, `'released'` on replay of a closed node),
+  on the journal's `settled`/`cancelled` records (`'released'` only), on `NodeSnapshot` from
+  both the live and the materialized tree, on the `agent.child` payload (a second event per
+  released node, carrying `releasedAt`), and on `PursuitNodeProjection`. A reader never splits
+  the population on `reason` text again. `PursuitStatus` stays three-valued.
+- `SupervisedResult` gains `fleetYield` on every arm (new `FleetYield`): `spawned`, `done`,
+  `down`, `cancelled`, `neverSettled`, `releasedUnrecovered`, counted by node id across the
+  whole journal forest, with `spawned === done + down + cancelled + neverSettled` asserted.
+  Always present; zeros are facts. It rides into `result.json`. `spendGaps` stays root-tree
+  scoped, so the two disagree on a nested run by design. A no-winner's `downCount` is unchanged:
+  the breaker skips released records, so a retained child is counted in `fleetYield.down` and
+  never in `downCount` — as it never was.
+- `spentTotal.tokensKnown`/`usdKnown` stay `false` on a run with a released child: its record
+  carries the unknown-flagged floor, so the gap changes kind from `never-settled` (a ceiling) to
+  `unreported` (a floor), not presence. The one exception is a ticket already reconciled at a
+  measured terminal spend (a persistence failure after the artifact landed), whose released record
+  is known. The pool half — the refund at the reconcile (#1190) — is unchanged.
+- A crash between the receipt and the terminal record leaves an open slot beside a destroyed
+  environment; the next process cannot self-heal it and this release does not try.
+
 ## 0.231.1
 
 Allow Sandbox 0.40.x beside Runtime without a consumer dependency override.

api-surface.json

@@ -505,7 +505,7 @@
       "PursuitNodeCost": "type 2ae084b090ba",
       "PursuitNodePlacement": "type 744e7b45dc01",
       "PursuitNodePlatform": "type 1d5dc2e2dd89",
-      "PursuitNodeProjection": "type 85fb852e6043",
+      "PursuitNodeProjection": "type 6d2b6c593df9",
       "PursuitNodeTiming": "type 8cb37b8dca25",
       "PursuitNodeUsage": "type 951e957775ab",
       "PursuitProjection": "type 8d4e8a08d707",
@@ -944,6 +944,7 @@
       "FinalizeContext": "type e45cea6eacef",
       "FinalizerSettled": "type c525a06427fc",
       "FlatWidenGate": "type 825b8b585b72",
+      "FleetYield": "type c6e215cee2d9",
       "ForkCapableBox": "type 87d9804bb9f3",
       "ForkRequest": "type 7cd1fb62a8d3",
       "GitWorkspaceOptions": "type 47832f185060",
@@ -1043,7 +1044,7 @@
       "NoWinnerError": "type adcf245eb125",
       "NodeExecutionIdentity": "type 76b27bc384d1",
       "NodeId": "type ba5552a40a12",
-      "NodeSnapshot": "type a9b2602d5c10",
+      "NodeSnapshot": "type 7a1dd9177e44",
       "NodeStatus": "type 2073c1387091",
       "Observation": "type c276b53b9eb0",
       "ObservationAnalysis": "type b23fcc6368fb",
@@ -1140,6 +1141,7 @@
       "ResultBlobStore": "type 69e6e03b75ab",
       "ResumedKeyState": "type 018905da27e4",
       "ResumedWork": "type 57b7c709155a",
+      "RetainedExecutionState": "type 0bb1e591e45f",
       "RetainedInteractiveAdmission": "type ecfa4c1fe733",
       "RetainedInteractiveAdmissionHook": "type bfe9af8b2361",
       "RetainedInteractiveEnvironmentAdmission": "type b1361c236b09",
@@ -1209,13 +1211,13 @@
       "SessionCapableBox": "type 9db08b40cab8",
       "SessionMessageLike": "type 726215634de7",
       "SessionTraceBox": "type b8d989093064",
-      "Settled": "type 4694c79a44d1",
+      "Settled": "type 24da40c1d786",
       "ShapeBudget": "type a1cb1a8d0995",
       "ShapeContext": "type a266c1b7e746",
       "ShapeRegistry": "type b567a5be55ec",
       "Shell": "type c676fe970f79",
       "ShotSpec": "type bf645fd74234",
-      "SpawnEvent": "type e74c7b38c734",
+      "SpawnEvent": "type f9c5663b41cd",
       "SpawnForest": "type 7308f34da226",
       "SpawnForestEvent": "type 230e369c6548",
       "SpawnForestInDoubtNode": "type 4e4bddd6a7d9",
@@ -1263,7 +1265,7 @@
       "SuperviseRegistryTable": "type cc1468cd50c1",
       "SuperviseSurfaceOptions": "type 8a7daaf98896",
       "SuperviseSurfaceResult": "type 2c378dbc3193",
-      "SupervisedResult": "type 924803bb65bd",
+      "SupervisedResult": "type e23388c4e1ca",
       "Supervisor": "type 7d9aff9cd744",
       "SupervisorAgentDeps": "type b2683b00f9e6",
       "SupervisorCleanupReceipt": "type d862eb60266d",
@@ -1626,7 +1628,7 @@
       "streamAgentTurn": "value d21f23205538",
       "structuralRollout": "value fc852ab503f9",
       "sumSandboxUsage": "value 368f5c1a5123",
-      "supervise": "value ec5717d6f3aa",
+      "supervise": "value 0f64939f8d20",
       "superviseDispatch": "value 8f93690a9eb5",
       "superviseSurface": "value 730f753cfb58",
       "supervisorAgent": "value 880407b0dab3",
@@ -1980,7 +1982,7 @@
       "loadAgentImprovementProposalFixture": "value 2f33e49d4be9",
       "loadAgentProfileImprovementFixture": "value 3bf4543ae6f7",
       "runGraphWithTestBrain": "value 5d9fea087acc",
-      "superviseWithTestBrain": "value 68eed805ecfe",
+      "superviseWithTestBrain": "value 837346617a33",
       "supervisorAgentWithTestBrain": "value 5c814f8dd593"
     },
     "./tool-loop": {