@claudexor/orchestrator 1.0.1 → 2.1.2

package/dist/orchestrator.js

@@ -1,33 +1,40 @@
-import { cpSync, existsSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
+import { observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, } from "./credential-profiles.js";
+import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
+import { capabilityIntents } from "@claudexor/gateway";
+import { policyFindings } from "./policyFindings.js";
 import { join } from "node:path";
-import { HarnessRunSpec, OrchestrateContract as OrchestrateContractSchema, toolRisk, DecisionRecord as DecisionRecordSchema, WorkProduct as WorkProductSchema, SessionReboundLineage as SessionReboundLineageSchema, SpecPack as SpecPackZ, ModeKind as ModeKindSchema, ReviewFinding as ReviewFindingSchema, RunTelemetry as RunTelemetrySchema, SCHEMA_VERSION, TRUST_FULL_ACCESS_CODE, TaskContract as TaskContractSchema, isBlocking, orchestratePlanJsonSchema, } from "@claudexor/schema";
+import { HarnessRunSpec, OrchestrateContract as OrchestrateContractSchema, DecisionRecord as DecisionRecordSchema, WorkProduct as WorkProductSchema, SessionReboundLineage as SessionReboundLineageSchema, SpecPack as SpecPackZ, ModeKind as ModeKindSchema, SCHEMA_VERSION, TRUST_FULL_ACCESS_CODE, FrozenTaskContractArtifact as TaskContractSchema, isBlocking, orchestratePlanJsonSchema, normalizeUserOutputSchema, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
 import { globalConfigDir, loadConfig, trustConfigPath } from "@claudexor/config";
 import { specPackToTaskContract } from "@claudexor/interview";
-import { HarnessUnavailableError, summarizeDiffPaths as diffStats, validateModel, withInactivityWatchdog } from "@claudexor/core";
+import { AnswerAssembly, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
 import { assertRouteModelsAllowed } from "./modelGovernance.js";
+import { RequestRequirementsResolver } from "./requestRequirements.js";
 import { cancelledResult, failTerminally, guardAnnouncedRun, writeFailure, } from "./runTerminals.js";
-import { transientRetryDelayMs, gateProtectedPaths, promptWithProtectedPathConstraint, sleep, redactHarnessEvent, harnessEventPayload, pushUniqueText, formatFindings, renderSummary, readRunStatus, readRunPatch, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, buildEnvelopeSubInput, deliverPlanAnswer, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, relayPriorPlansSection, } from "./runSupport.js";
-import { resolveExplicitReviewerPanel } from "./reviewerPanel.js";
+import { assertOutputSchemaCompiles, finalizeStructuredOutput } from "./structuredOutput.js";
+import { transientRetryDelayMs, promptWithProtectedPathConstraint, sleep, redactHarnessEvent, harnessEventPayload, formatFindings, renderSummary, readRunPatch, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, buildEnvelopeSubInput, deliverPlanAnswer, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, relayPriorPlansSection, deliveryRefusalFailure, writeRaceDeliveryDecision, } from "./runSupport.js";
+import { candidateStatusInRouteContext, resolveReadOnlyRouteContext, } from "./routeContext.js";
+import { resolveAutoReviewerPanel, resolveExplicitReviewerPanel } from "./reviewerPanel.js";
 import { buildOrchestratePlannerPrompt, extractOrchestratePlan } from "./orchestratePlanner.js";
-import { blockedDecisionOverride, finalVerifyBlocks, finalVerifyPatch } from "./finalVerifier.js";
+import { orchestrateFailureFor, readRunStatus } from "./outcomeReducer.js";
+import { executeOrchestratePlan, } from "./orchestrateExecutor.js";
 import { runDiffReview } from "./diffReview.js";
-import { aggregateRunWebEvidence, attemptTelemetryRecord, createAttemptTelemetry, observeAttemptTelemetry, setAttemptOutcome, telemetrySummary, toolWarnings, unrecoveredToolErrors, webUnsatisfied, } from "./attemptTelemetry.js";
+import { createAttemptTelemetry, observeAttemptTelemetry, setAttemptOutcome, telemetrySummary, toolWarnings, unrecoveredToolErrors, webUnsatisfied, } from "./attemptTelemetry.js";
 import { interactionChannelFor } from "./interaction.js";
+import { gateSpecsFromContract, renderTestsEvidence, resolveContractGates, } from "./contract-gates.js";
 import { ArtifactStore } from "@claudexor/artifact-store";
 import { EventLog } from "@claudexor/event-log";
-import { assertMandatoryContext, buildContextPack, matchAny, preflightEvidence, writeEvidencePacket, } from "@claudexor/context";
-import { WorkspaceManager, applyPatchProtected, ensureGitRepository, snapshotTree, } from "@claudexor/workspace";
-import { deliver, validateApplyGate } from "@claudexor/delivery";
+import { assertMandatoryContext, buildContextPack, rawContextForEnvelope, preflightEvidence, writeEvidencePacket, } from "@claudexor/context";
+import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, ensureGitRepository, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
+import { blockedDecisionOverride, finalVerifyBlocks, finalVerifyPatch, validateApplyGate, verifyAndDeliver, } from "@claudexor/delivery";
 import { HarnessGateway } from "@claudexor/gateway";
 import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, reviewCandidate, revalidateFindings, runGates, } from "@claudexor/review";
 import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
-import { BudgetLedger, loadHarnessMetrics, promptFingerprint, selectHarness, } from "@claudexor/budget";
-import { classifyRisk, DEFAULT_REQUIRE_HUMAN_PATHS, requireHuman, reviewDepthForRisk, } from "@claudexor/policy";
+import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, loadHarnessMetrics, promptFingerprint, unknownCostSettlement, usageCostSettlement, rankHarnesses, } from "@claudexor/budget";
 import { appendLine, assertNoInlineSecretValues, containsSecretLikeToken, hashJson, newId, noProjectRepoRoot, nowIso, redactSecrets, safeInvoke, sha256, userConfigDir, writeText, } from "@claudexor/util";
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
-const REVIEW_EVIDENCE_DIRNAME = ".claudexor-review-evidence";
 /** Concurrency cap for parallel candidates/explorers (locked decision: min(n, 4)). */
 const MAX_PARALLEL_CANDIDATES = 4;
 /** Default wait for one interactive answer before a benign decline. */
@@ -66,6 +73,11 @@ async function runBounded(items, limit, work) {
 export class Orchestrator {
     deps;
     gateway;
+    requestRequirements = new RequestRequirementsResolver();
+    /** Per-attempt cap on forwarded live delta chunks (W-C4 flood guard, sol
+     * #10): past this the deltas are dropped and the cutoff is disclosed once;
+     * the complete message always still lands. */
+    static MAX_DELTAS_PER_ATTEMPT = 4000;
     constructor(deps) {
         this.deps = deps;
         this.gateway = new HarnessGateway(deps.registry);
@@ -83,9 +95,17 @@ export class Orchestrator {
         const resolved = this.resolveRunInput(input);
         // INV-062 at the ENGINE boundary: every surface fences prompts already,
         // but a direct embedder (or the daemon-less local REPL fallback) reaches
-        // this entry without one. Prompts are durable artifacts — the hard block
-        // applies here too, so no in-process path can ever bypass it.
-        assertNoInlineSecretValues({ prompt: resolved.prompt }, "$", "run input");
+        // this entry without one. Prompts, per-run instructions, AND outputSchema
+        // are durable artifacts (all land in the TaskContract) — the hard block
+        // applies here too, so no in-process path can ever bypass it. outputSchema
+        // rides the schema-aware branch: its property NAMES are field names (a
+        // `token` field is legitimate), but string VALUES (const/default/enum) are
+        // scanned for real secrets, matching the HTTP boundary exactly.
+        assertNoInlineSecretValues({
+            prompt: resolved.prompt,
+            instructions: resolved.instructions,
+            outputSchema: resolved.outputSchema ?? undefined,
+        }, "$", "run input");
         const parsedMode = ModeKindSchema.safeParse(resolved.mode ?? "agent");
         if (!parsedMode.success) {
             throw new Error(`unknown mode: ${String(resolved.mode)}`);
@@ -95,9 +115,39 @@ export class Orchestrator {
         // executor's plan steps — on any other mode it would be a silent no-op
         // knob. The CLI and control API validate this already; a direct embedder
         // must get the same loud refusal, not quiet acceptance.
-        if (resolved.maxToolCalls !== undefined && resolved.maxToolCalls !== null && mode !== "orchestrate") {
+        if (resolved.maxToolCalls !== undefined &&
+            resolved.maxToolCalls !== null &&
+            mode !== "orchestrate") {
             throw new Error(`maxToolCalls caps the orchestrate EXECUTOR's plan steps and only applies to mode=orchestrate (got mode=${mode}); drop the knob or switch modes`);
         }
+        // denyPaths is enforced by the post-diff policy gate BEFORE delivery, which
+        // only exists on envelope/isolated runs — an in-place run mutates the live
+        // tree directly, so the gate could not contain a violation. Refuse loudly
+        // rather than accept a knob the engine cannot honor (INV-023).
+        if ((resolved.denyPaths?.length ?? 0) > 0 && resolved.inPlace === true) {
+            throw new Error("denyPaths requires an isolated/envelope run: the post-diff policy gate blocks a violating patch before delivery, which an in-place run cannot guarantee; drop --deny-path or run isolated");
+        }
+        // outputSchema constrains the run's final ANSWER. It is honored exactly
+        // where a final answer is delivered (agent race incl. synthesis, and ask);
+        // every other strategy refuses loudly rather than carrying a contract the
+        // engine would not validate (INV-023). The schema itself is normalized for
+        // the native structured-output routes here at the boundary — unsupported
+        // shapes ($ref, non-object root) are a typed refusal, not a mid-run 400.
+        if (resolved.outputSchema !== undefined && resolved.outputSchema !== null) {
+            if (mode !== "agent" && mode !== "ask") {
+                throw new Error(`outputSchema constrains the final answer and applies to agent/ask runs (got mode=${mode}); drop the schema or switch modes`);
+            }
+            if (resolved.untilClean || (resolved.attempts !== undefined && resolved.attempts !== null)) {
+                throw new Error("outputSchema is not supported with convergence flags (--until-clean/--attempts): convergence delivers a gated patch, not a structured answer; drop the schema or the convergence flags");
+            }
+            // Shape-refuse unsupported schemas, then PROVE it compiles under the same
+            // ajv the engine validator uses — a malformed schema is a preflight
+            // refusal here (before any run dir), never a mid-run validator crash. The
+            // contract keeps the ORIGINAL (conformance authority); strictify is a
+            // transport-only transform applied per-lane in harnessSpecKnobs.
+            resolved.outputSchema = normalizeUserOutputSchema(resolved.outputSchema);
+            assertOutputSchemaCompiles(resolved.outputSchema);
+        }
         // P1: a versioned `mandatory_files` contract is enforced UNIFORMLY here, for
         // every mode, so the same repo state can't pass `run`/`ask` while failing
         // `audit`. No-op when the list is empty (the default) or for no-project runs.
@@ -119,7 +169,9 @@ export class Orchestrator {
                     return this.runAsk(resolved, announce);
                 case "audit":
                     // `--swarm` selects the bounded read-only research swarm (old `explore`).
-                    return resolved.swarm ? this.runExplore(resolved, announce) : this.runAudit(resolved, announce);
+                    return resolved.swarm
+                        ? this.runExplore(resolved, announce)
+                        : this.runAudit(resolved, announce);
                 case "agent":
                     // Engine strategies are FLAGS on agent (v0.9 collapse): `--until-clean`
                     // and `--attempts` select the convergence loop; `--n` selects the race
@@ -149,73 +201,15 @@ export class Orchestrator {
         if (this.deps.reviewerPanel && this.deps.reviewerPanel.length > 0) {
             return this.resolveExplicitReviewerPanel(cwd, this.deps.reviewerPanel, runAuthPreference);
         }
-        const specs = [];
-        const seen = new Set();
-        const harnessSettings = this.config(cwd)?.global.harnesses ?? {};
-        const reviewHome = new WorkspaceManager(cwd).readOnlyHomeEnv();
-        try {
-            for (const adapter of this.deps.registry.values()) {
-                let m = null;
-                try {
-                    m = await adapter.discover();
-                }
-                catch {
-                    continue;
-                }
-                if (!m || m.kind === "fake" || seen.has(m.provider_family))
-                    continue;
-                // Per-harness settings gate reviewers before doctor/model probes: a disabled
-                // harness must not spend auth/API-key readiness checks.
-                if (harnessSettings[adapter.id]?.enabled === false)
-                    continue;
-                const authPreference = this.authPreferenceForHarness(cwd, adapter.id, runAuthPreference);
-                let report = null;
-                try {
-                    report = await adapter.doctor({ cwd, env: reviewHome.env, authPreference });
-                }
-                catch {
-                    continue;
-                }
-                if (report.status !== "ok")
-                    continue; // reviewer eligibility needs scoped doctor-OK.
-                if (!report.enabled_intents.includes("review"))
-                    continue;
-                if (!m.capabilities.review || !m.access_profiles_supported.includes("readonly"))
-                    continue;
-                // Explicit per-family override first, then the user's per-harness
-                // default model: an explicit model request makes the route provable
-                // (accepted_model_arg) on CLIs that never echo their model.
-                const requestedModel = this.deps.reviewerModels?.[m.provider_family] ??
-                    harnessSettings[adapter.id]?.default_model ??
-                    null;
-                // STRICT: the auto panel applies the SAME model truth gate as the
-                // explicit panel — a doomed reviewer model is refused here, never
-                // forwarded to die as an opaque native error mid-review.
-                if (requestedModel) {
-                    const check = validateModel(requestedModel, typeof adapter.models === "function"
-                        ? (await adapter.models({ cwd, env: reviewHome.env, authPreference })).map((x) => x.id)
-                        : m.capabilities.known_models, typeof adapter.models === "function" ? "api" : "manifest");
-                    if (check.status !== "ok") {
-                        throw new HarnessUnavailableError(`auto-selected reviewer harness '${adapter.id}' refused model '${requestedModel}': ${check.message}; ` +
-                            `fix the reviewer model override or harnesses.${adapter.id}.default_model, or run \`claudexor models --harness ${adapter.id}\``);
-                    }
-                }
-                seen.add(m.provider_family);
-                specs.push({
-                    adapter,
-                    providerFamily: m.provider_family,
-                    requestedModel,
-                    requestedEffort: this.deps.reviewerEfforts?.[m.provider_family] ?? null,
-                    authPreference,
-                });
-                if (specs.length >= 2)
-                    break;
-            }
-        }
-        finally {
-            reviewHome.dispose();
-        }
-        return specs;
+        return resolveAutoReviewerPanel({
+            cwd,
+            registry: this.deps.registry,
+            harnessSettings: this.config(cwd)?.global.harnesses ?? {},
+            authPreferenceFor: (id) => this.authPreferenceForHarness(cwd, id, runAuthPreference),
+        }, {
+            reviewerModels: this.deps.reviewerModels,
+            reviewerEfforts: this.deps.reviewerEfforts,
+        });
     }
     /**
      * Resolve reviewers INSIDE a strategy, after run-dir creation: an explicit
@@ -285,31 +279,6 @@ export class Orchestrator {
     candidateIntent(input) {
         return input.create === true ? "create_from_scratch" : "implement";
     }
-    /**
-     * Resolve the per-harness browser-tool wiring for a run spec. Returns null
-     * (no browser) unless: the run opted in (`input.browser`), the harness has the
-     * `browser_tool` capability, AND web policy is not `off` (the browser is live
-     * egress and must ride `external_context_policy`). Screenshots/PDFs are written
-     * into the run's artifact tree so they surface in the Canvas gallery. Headed by
-     * default so the user can watch; `cdp_endpoint` is filled by the headed-Chromium
-     * launcher (7B) for the shared, mirrored window.
-     */
-    browserSpecFor(input, routed, webPolicy, access, paths) {
-        if (!input?.browser || !routed.supportsBrowser || webPolicy === "off")
-            return null;
-        // The browser MCP drives a real Chromium (subprocess + live network). Codex's
-        // workspace-write sandbox cancels the navigation (live-verified across
-        // network_access / approval_policy / external-CDP variants) — only full access
-        // lets it through. Require full access rather than silently inject a browser
-        // whose first navigation will fail. The composer discloses this when the user
-        // arms the tool; a non-full run drops the browser honestly (no broken tool).
-        // headless:false -> a real headed window is the live view (locked design:
-        // the user watches the browser itself, not a mirrored feed); output_dir
-        // captures navigation snapshots into the run tree.
-        if (access !== "full" && access !== "external_sandbox_full")
-            return null;
-        return { output_dir: join(paths.root, "browser"), headless: false };
-    }
     /**
      * Session fields for a route's run spec: auth route preference + native
      * resume id. Preference precedence: explicit per-run > per-harness
@@ -324,8 +293,9 @@ export class Orchestrator {
     execRootOf(input) {
         return input.executionRoot ?? input.repoRoot;
     }
-    sessionSpecFields(input, harnessId) {
+    sessionSpecFields(input, harnessId, log) {
         const cfg = this.config(input.repoRoot)?.global;
+        const profile = this.preflightProfile(input, harnessId, log);
         const explicit = (v) => (v && v !== "auto" ? v : undefined);
         return {
             // "auto" at ANY level falls through (thread turns send the thread default
@@ -334,22 +304,72 @@ export class Orchestrator {
                 explicit(cfg?.harnesses?.[harnessId]?.auth_preference) ??
                 explicit(cfg?.routing?.auth_preference) ??
                 "auto",
-            resume_session_id: input.resumeSessions?.[harnessId] ?? null,
+            resume_session_id: resumeSessionForProfile(input.resumeSessions?.[harnessId], profile),
+            credential_profile: profile,
         };
     }
-    /** Record a harness-emitted native session id for future thread resume (observer never fails the run). */
-    observeNativeSession(input, harnessId, ev) {
-        if (!input?.onSessionObserved || ev.type !== "started")
-            return;
-        const nid = ev.payload?.["native_session_id"];
-        if (typeof nid === "string" && nid.length > 0) {
-            try {
-                input.onSessionObserved(harnessId, nid, ev.observed_model ?? null);
-            }
-            catch {
-                /* observer errors must never fail the run */
-            }
+    resolveCredentialProfile(input, harnessId) {
+        if (!input.credentialProfileId)
+            return null;
+        const registry = this.config(input.repoRoot)?.global.credential_profiles ?? [];
+        return resolveCredentialProfile(registry, input.credentialProfileId, harnessId);
+    }
+    /** The typed effective auth route for a SELECTED credential profile
+     * (round-18 #2): adapters execute strictly by credential_kind, so routing,
+     * billing classification, model truth, and quota lookup must share this
+     * one fact — never the default store's sources or a previous default-route
+     * metric. null = no profile selected or it does not resolve here. */
+    profileAuthRoute(input, harnessId) {
+        try {
+            const profile = this.resolveCredentialProfile(input, harnessId);
+            if (!profile)
+                return null;
+            return profile.credential_kind === "api_key" ? "api_key" : "local_session";
         }
+        catch {
+            return null;
+        }
+    }
+    profilePolicy(repoRoot, harnessId) {
+        const policy = this.config(repoRoot)?.global.harnesses?.[harnessId]?.profile_policy;
+        return policy ?? { limit_action: "fail", rotation_eligible: [], headroom_threshold: 0.9 };
+    }
+    /** null = no profile selected (default verdict stands); "available" = the
+     * profile's own probe admits the route; any other string = typed refusal. */
+    async profileAvailabilityOverride(input, harnessId) {
+        if (!input.credentialProfileId)
+            return null;
+        let profile;
+        try {
+            profile = this.resolveCredentialProfile(input, harnessId);
+        }
+        catch (err) {
+            return err instanceof Error ? err.message : String(err);
+        }
+        if (!profile)
+            return null;
+        const adapter = this.deps.registry.get(harnessId);
+        if (!adapter?.probeCredentialProfile) {
+            return `harness "${harnessId}" has no profile probe`;
+        }
+        const probe = await adapter.probeCredentialProfile(profile);
+        if (probe.availability === "available")
+            return "available";
+        return probe.detail ?? `${probe.availability}/${probe.verification}`;
+    }
+    preflightProfile(input, harnessId, log) {
+        const profile = this.resolveCredentialProfile(input, harnessId);
+        const policy = this.profilePolicy(input.repoRoot, harnessId);
+        const registry = this.config(input.repoRoot)?.global.credential_profiles ?? [];
+        const snapshots = this.deps.quotaSnapshots?.() ?? [];
+        const emit = (type, payload) => log?.emit(type, payload);
+        if (!profile) {
+            // Unpinned runs (INV-135 auto-balance): under `rotate`, a fresh
+            // default-subject headroom breach starts on the next eligible
+            // subscription profile instead; `fail`/`ask` change nothing.
+            return preflightDefaultSubject({ harnessId, policy, registry, snapshots, emit });
+        }
+        return preflightCredentialProfile({ profile, harnessId, policy, registry, snapshots, emit });
     }
     /**
      * Lift an adapter's auth-route override marker into the typed
@@ -361,7 +381,7 @@ export class Orchestrator {
     /**
      * Resolve candidate adapters: explicit `--harness`, else available real harnesses, then
      * **capability-gate** to those that can actually produce work for `intent` (e.g. a
-     * raw-API reviewer with `implement: false` is dropped from an implement race), and
+     * a planner-only adapter with `implement: false` is dropped from an implement race), and
      * expand to n. Fails loudly if nothing can perform the intent.
      */
     resolveRunInput(input) {
@@ -420,16 +440,16 @@ export class Orchestrator {
             primaryHarness,
             model: undefined,
             models,
-            portfolio: input.portfolio ??
-                this.deps.portfolio ??
-                cfg?.project.budget?.portfolio ??
-                cfg?.global.default_portfolio ??
-                "subscription-first",
+            routingGoal: input.routingGoal ??
+                this.deps.routingGoal ??
+                cfg?.project.budget?.routing_goal ??
+                cfg?.global.routing.goal ??
+                "auto",
             web,
             externalContextPolicy: web,
         };
     }
-    async resolveCandidateAdapters(input, intent, ledger) {
+    async resolveCandidateAdapters(input, intent, ledger, routeContext) {
         let ids = input.harnesses;
         const explicitPool = Boolean(ids && ids.length > 0);
         const harnessSettings = this.config(input.repoRoot)?.global.harnesses ?? {};
@@ -442,22 +462,47 @@ export class Orchestrator {
         const statuses = probeIds.length > 0 ? await this.gateway.statusAll({ cwd: input.repoRoot }, probeIds) : [];
         const statusById = new Map(statuses.map((s) => [s.id, s]));
         if (!ids || ids.length === 0) {
-            // Auto-pools take only doctor-OK harnesses (BIBLE §2: doctor decides
-            // readiness; a key string or degraded route is visible but not routable).
-            ids = statuses
-                .filter((s) => s.manifest?.kind !== "fake" && s.status === "ok" && s.enabledIntents.includes(intent))
-                .map((s) => s.id);
-            if (ids.length === 0) {
-                throw new HarnessUnavailableError("no doctor-ok harness for this mode; install/login codex/claude/cursor/opencode (see `claudexor doctor`), or pass --harness explicitly");
+            // INV-135 (round-18 BLOCK): an explicit credential profile NAMES its
+            // harness — the implicit pool is exactly the profile's enabled
+            // harness(es) from the registry, and the profile probe (below) is the
+            // auth verdict. Deriving the pool from default doctor-OK status would
+            // exclude a valid profile whose default store is logged out while
+            // keeping unrelated harnesses that later fail profile resolution.
+            const profilePool = input.credentialProfileId
+                ? [
+                    ...new Set((this.config(input.repoRoot)?.global.credential_profiles ?? [])
+                        .filter((p) => p.enabled && p.profile_id === input.credentialProfileId)
+                        .map((p) => p.harness_id)
+                        .filter((hid) => !disabledHarnessIds.has(hid) && this.deps.registry.has(hid))),
+                ]
+                : [];
+            if (profilePool.length > 0) {
+                ids = profilePool;
+            }
+            else if (input.credentialProfileId) {
+                // Fable-checkpoint NIT: an unknown/disabled profile id must refuse
+                // HERE, not fall through to the default auto-pool — that would run on
+                // the DEFAULT credentials while the caller explicitly named an
+                // account, surfacing later as a per-harness "not registered" error.
+                const registered = (this.config(input.repoRoot)?.global.credential_profiles ?? []).filter((p) => p.profile_id === input.credentialProfileId);
+                throw new HarnessUnavailableError(registered.length === 0
+                    ? `credential profile "${input.credentialProfileId}" is not registered (see \`claudexor profiles list\`)`
+                    : registered.every((p) => !p.enabled)
+                        ? `credential profile "${input.credentialProfileId}" is disabled`
+                        : `credential profile "${input.credentialProfileId}" belongs to unavailable harness(es): ${registered.map((p) => p.harness_id).join(", ")}`);
+            }
+            else {
+                // Auto-pools take only doctor-OK harnesses (BIBLE §2: doctor decides
+                // readiness; a key string or degraded route is visible but not routable).
+                ids = statuses
+                    .filter((s) => s.manifest?.kind !== "fake" && s.status === "ok" && s.enabledIntents.includes(intent))
+                    .map((s) => s.id);
+                if (ids.length === 0) {
+                    throw new HarnessUnavailableError("no doctor-ok harness for this mode; install/login codex/claude/cursor/opencode (see `claudexor doctor`), or pass --harness explicitly");
+                }
             }
         }
         const policy = input.web ?? input.externalContextPolicy ?? "auto";
-        // Vision is a capability: a run carrying an image attachment must route to a
-        // harness that can actually deliver it (image_input != "none"). Routing an
-        // image to cursor/opencode (image_input="none") silently drops it and the
-        // model honestly reports it saw nothing — the schema's attachment contract
-        // (attachment.ts) promises the opposite. Gate the pool below, mirroring web.
-        const needsVision = (input.attachments ?? []).some((a) => a.kind === "image");
         const pool = [];
         const dropped = [];
         for (const id of ids) {
@@ -484,7 +529,9 @@ export class Orchestrator {
                 dropped.push(why);
                 continue;
             }
-            const status = statusById.get(id);
+            // W3.3 (TZ-1 §B): a route is admitted on readiness truth from the SAME
+            // resolved env/cwd its run will spawn with (see routeContext.ts).
+            let status = await candidateStatusInRouteContext(this.gateway, routeContext, id, this.authPreferenceForHarness(input.repoRoot, id, input.authPreference), statusById);
             const manifest = status?.manifest ?? null;
             if (!status || !manifest) {
                 dropped.push(`${id} (unavailable)`);
@@ -496,14 +543,43 @@ export class Orchestrator {
             // unproven by isolated smoke) is admitted only by explicit user
             // selection — degraded means usable-with-caveats, and the caveats are
             // visible in doctor output and run events.
-            if (status.status === "unavailable") {
-                const why = `${id} is unavailable${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`;
-                if (explicitPool)
-                    throw new HarnessUnavailableError(why);
-                dropped.push(why);
-                continue;
+            // INV-135 (round-13, extended by the round-18 BLOCK): an EXPLICIT
+            // profile is authenticated by ITS store — the profile probe overrides
+            // the default auth verdict for ANY non-ok default status, and a
+            // profile-admitted route joins even an AUTO pool (the run spawns with
+            // the profile's transport, so the default store's state is not the
+            // routing truth). Capability/manifest gating above still applies.
+            let profileAdmitted = false;
+            if (status.status !== "ok") {
+                const profileVerdict = await this.profileAvailabilityOverride(input, id);
+                if (profileVerdict === "available") {
+                    // The default-store failure may have zeroed enabled_intents; with
+                    // the profile probe as the auth verdict, MANIFEST capabilities are
+                    // the honest intent truth (degraded = usable-with-caveats).
+                    status = {
+                        ...status,
+                        status: "degraded",
+                        enabledIntents: capabilityIntents(manifest.capabilities),
+                    };
+                    statusById.set(id, status);
+                    profileAdmitted = true;
+                }
+                else if (profileVerdict !== null) {
+                    const why = `${id} credential profile is not ready: ${profileVerdict}`;
+                    if (explicitPool)
+                        throw new HarnessUnavailableError(why);
+                    dropped.push(why);
+                    continue;
+                }
+                else if (status.status === "unavailable") {
+                    const why = `${id} is unavailable${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`;
+                    if (explicitPool)
+                        throw new HarnessUnavailableError(why);
+                    dropped.push(why);
+                    continue;
+                }
             }
-            if (status.status !== "ok" && !explicitPool) {
+            if (status.status !== "ok" && !explicitPool && !profileAdmitted) {
                 dropped.push(`${id} is ${status.status}${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`);
                 continue;
             }
@@ -512,18 +588,13 @@ export class Orchestrator {
                 intent === "explain" ||
                 intent === "audit" ||
                 intent === "orchestrate";
-            // Mirror buildContract: the trust-config default decides write-mode access
-            // when the run does not request a profile explicitly.
-            const requiredAccess = readOnlyIntent
+            const requiredAccess = this.requestRequirements.adapterAccess(intent, manifest.capabilities.implementation_transport, readOnlyIntent
                 ? "readonly"
-                : (input.access ?? this.config(input.repoRoot).trust.access_default);
+                : (input.access ?? this.config(input.repoRoot).trust.access_default));
             const accessSupported = !requiredAccess || manifest.access_profiles_supported.includes(requiredAccess);
             const webSupport = manifest.capabilities.web_policy;
-            // The PER-ROUTE policy is what this harness will actually execute: a
-            // per-harness `web` default upgrades a run-level `auto` (routeSpecKnobs
-            // applies the same rule when building the spec), so the capability gate
-            // must judge that effective policy — not admit a route whose configured
-            // default it could never honor.
+            // Match routeSpecKnobs: a per-harness web default upgrades run-level auto,
+            // so judge the effective per-route policy.
             const routePolicy = policy === "auto" && cfgEntry?.web && cfgEntry.web !== "auto" ? cfgEntry.web : policy;
             const routeWebRequired = routePolicy === "cached" || routePolicy === "live";
             // Web policy is a capability: `off` needs an enforceable off state and a
@@ -541,34 +612,44 @@ export class Orchestrator {
                 dropped.push(why);
                 continue;
             }
-            // Vision gate: an image-bearing run only routes to vision-capable harnesses.
-            // Exclude blind ones from auto-pools; fail loud if the user explicitly chose one.
-            if (needsVision && manifest.capability_profile.image_input === "none") {
-                const why = `${id} cannot accept image attachments (manifest image_input=none); choose a vision-capable harness (see \`claudexor doctor\` — capability image_input) or remove the image attachment`;
+            const attachmentRefusal = this.requestRequirements.attachmentRefusal(id, input.attachments ?? [], manifest.capability_profile.attachment_inputs);
+            if (attachmentRefusal) {
                 if (explicitPool)
-                    throw new HarnessUnavailableError(why);
-                dropped.push(why);
+                    throw new HarnessUnavailableError(attachmentRefusal);
+                dropped.push(attachmentRefusal);
                 continue;
             }
             const reason = status.reasons.length > 0 ? `: ${status.reasons.join("; ")}` : "";
             if (status.enabledIntents.includes(intent) && accessSupported) {
                 pool.push({
                     adapter,
+                    adapterAccess: requiredAccess,
                     webSupport,
                     providerFamily: manifest.provider_family,
                     supportsMaxTurns: manifest.capabilities.max_turns,
                     supportsToolLists: manifest.capabilities.tool_lists,
-                    supportsBrowser: manifest.capabilities.browser_tool,
+                    browserRequirement: this.requestRequirements.resolveBrowser({
+                        harnessId: id,
+                        requested: input.browser === true,
+                        manifestCapable: manifest.capabilities.browser_tool,
+                        webPolicy: routePolicy,
+                        access: requiredAccess,
+                    }),
+                    denyRequirement: this.requestRequirements.resolveDenyPaths(id, (input.denyPaths?.length ?? 0) > 0),
                     effortLevels: manifest.capabilities.effort_levels,
                     knownModels: manifest.capabilities.known_models,
+                    // A selected profile's credential_kind IS the route (round-18 #2);
+                    // the default store's sources apply only to profile-less runs.
+                    authRouteEstimate: this.profileAuthRoute(input, id) ??
+                        estimateEffectiveAuthRoute(this.authPreferenceForHarness(input.repoRoot, id, input.authPreference), status.authSources),
                     supportsInteractive: manifest.capabilities.interactive,
                     supportsJsonSchemaOutput: manifest.capabilities.json_schema_output,
+                    implementationTransport: manifest.capabilities.implementation_transport,
                     settings: cfgEntry
                         ? {
                             defaultModel: cfgEntry.default_model,
                             effort: cfgEntry.effort,
                             web: cfgEntry.web === "auto" ? null : cfgEntry.web,
-                            maxUsd: cfgEntry.max_usd,
                             maxTurns: cfgEntry.max_turns,
                             maxRounds: cfgEntry.max_rounds,
                             toolsAllow: cfgEntry.tools_allow,
@@ -584,69 +665,116 @@ export class Orchestrator {
         if (pool.length === 0) {
             throw new HarnessUnavailableError(`no harness can perform '${intent}' for this mode${dropped.length ? ` (skipped: ${dropped.join(", ")})` : ""}`);
         }
-        const ordered = this.orderPool(pool, input, statusById, ledger);
+        const ordered = this.orderPool(pool, input, intent, statusById, ledger);
+        if (ordered.length === 0) {
+            throw new HarnessUnavailableError(`no harness remains eligible for '${intent}' after budget and quota routing`);
+        }
         const n = input.n ?? ordered.length;
         const out = [];
         for (let i = 0; i < n; i++)
             out.push(ordered[i % ordered.length]);
+        this.requestRequirements.requireEffectiveBrowser(input.browser === true, out.map((lane) => lane.browserRequirement));
+        // outputSchema is MANDATORY (Quiz-6a): a selected lane that cannot
+        // natively constrain its final message would deliver best-effort text —
+        // that is a typed preflight refusal, never silent degradation. The
+        // interactive stream-json transport x --json-schema is an unverified
+        // vendor combination, so lanes that would ride it refuse too.
+        if (input.outputSchema !== undefined && input.outputSchema !== null) {
+            const incapable = out.filter((lane) => !lane.supportsJsonSchemaOutput);
+            if (incapable.length > 0) {
+                throw new HarnessUnavailableError(`outputSchema is mandatory but selected lane(s) cannot constrain output natively: ${[...new Set(incapable.map((lane) => lane.adapter.id))].join(", ")} (manifest capabilities.json_schema_output=false); choose schema-capable harnesses or drop the schema`);
+            }
+            // NOTE (DT2.1-16): the daemon ALWAYS arms an interaction channel, so an
+            // interactive-capable lane (claude) is refused for outputSchema on every
+            // daemon/CLI run today — the --json-schema x stream-json interactive combo
+            // is not yet live-verified. Structured-output runs therefore route through
+            // a non-interactive lane (codex). The message names that reality instead
+            // of pointing at a channel a daemon caller cannot turn off.
+            const interactive = Boolean(input.onInteraction)
+                ? out.filter((lane) => lane.supportsInteractive)
+                : [];
+            if (interactive.length > 0) {
+                throw new HarnessUnavailableError(`outputSchema is not yet available on interactive-transport lane(s): ${[...new Set(interactive.map((lane) => lane.adapter.id))].join(", ")} (the --json-schema x stream-json combination is unverified). Route structured-output runs through a non-interactive schema-capable harness (e.g. codex), or drop the schema`);
+            }
+        }
         // Strict pre-run model gate (INV-104) — see modelGovernance.ts.
         await assertRouteModelsAllowed(out, input.models, this.execRootOf(input));
         return out;
     }
     /**
-     * Order the eligible pool by portfolio routing utility (budget router): an
+     * Order the eligible pool by the selected routing goal (budget router): an
      * explicit user pool keeps the user's order; an explicit primary harness is
      * always pinned first. Cross-family diversity is encouraged for later slots.
      */
-    orderPool(pool, input, statusById, ledger) {
+    orderPool(pool, input, intent, statusById, ledger) {
         let ordered = pool;
-        const explicitPool = Boolean(input.harnesses && input.harnesses.length > 0);
-        if (!explicitPool && pool.length > 1) {
+        if (pool.length > 0) {
             const routeLedger = ledger ?? new BudgetLedger();
-            const portfolio = input.portfolio ?? this.deps.portfolio ?? "subscription-first";
+            const config = this.config(input.repoRoot).global;
+            const goal = input.routingGoal ?? this.deps.routingGoal ?? config.routing.goal;
             const byId = new Map(pool.map((r) => [r.adapter.id, r]));
-            // real routing metrics — observed per-harness cost/latency averages
-            // (single producer: attempt settlement) and operator-declared per-family
-            // quality priors. Absent data rides the router's neutral defaults.
+            // Settled cost is evidence for economy routing, never a provider quality prior.
             const metrics = loadHarnessMetrics(globalConfigDir());
-            const priors = this.config(input.repoRoot).global.routing.quality_priors;
             const remaining = pool.map((r) => {
                 const authModes = statusById.get(r.adapter.id)?.manifest?.auth_modes ?? [];
                 const metric = metrics[r.adapter.id];
+                // Auth mode for routing: prefer the ROUTE EVIDENCE from the
+                // last settled attempt (adapter-disclosed, persisted in metrics) over
+                // the manifest capability guess — auth_modes lists what a harness CAN
+                // use, not what it actually runs under.
+                const guessedAuthMode = authModes.includes("local_session")
+                    ? "local_session"
+                    : authModes.includes("api_key")
+                        ? "api_key"
+                        : "unknown";
+                // A selected profile's credential_kind decides the route outright
+                // (round-18 #2): an api_key profile must never inherit a
+                // subscription classification from the default store's metric.
+                const authMode = this.profileAuthRoute(input, r.adapter.id) ??
+                    (input.authPreference === "api_key"
+                        ? "api_key"
+                        : input.authPreference === "subscription"
+                            ? "local_session"
+                            : (metric?.last_auth_mode ?? guessedAuthMode));
+                // The quota subject this candidate would actually run as (release
+                // wave round-16 #2): the resolved profile id, or null for the engine
+                // default — so profile A's cooldown never excludes profile B or the
+                // default. A profile that does not resolve for this harness routes
+                // as unknown (undefined) and stays conservatively any-subject.
+                let credentialSubjectId;
+                try {
+                    credentialSubjectId =
+                        this.resolveCredentialProfile(input, r.adapter.id)?.profile_id ?? null;
+                }
+                catch {
+                    credentialSubjectId = undefined;
+                }
                 return {
                     harnessId: r.adapter.id,
-                    providerFamily: r.providerFamily,
                     available: true,
-                    authMode: authModes.includes("local_session")
-                        ? "local_session"
-                        : authModes.includes("api_key")
-                            ? "api_key"
-                            : "unknown",
-                    qualityForIntent: priors[r.providerFamily],
-                    costPerCall: metric?.avg_cost_usd ?? undefined,
-                    latencyMs: metric?.avg_duration_ms ?? undefined,
+                    model: input.models?.[r.adapter.id] ??
+                        config.harnesses[r.adapter.id]?.default_model ??
+                        undefined,
+                    effort: input.effort ?? config.harnesses[r.adapter.id]?.effort ?? undefined,
+                    billingKnowledge: authMode === "api_key" ? "metered" : "unknown",
+                    incrementalCostUsd: authMode === "api_key" ? (metric?.avg_cost_usd ?? null) : null,
+                    credentialRoute: authMode === "api_key"
+                        ? "managed_api_key"
+                        : authMode === "local_session"
+                            ? "vendor_native"
+                            : undefined,
+                    credentialSubjectId,
                 };
             });
-            const ranked = [];
-            while (remaining.length > 0) {
-                const best = selectHarness(remaining, {
-                    portfolio,
-                    ledger: routeLedger,
-                    diversityAgainst: ranked.map((r) => r.providerFamily),
-                });
-                if (!best)
-                    break; // cooldowns/zero-utility: keep residual pool order
-                const idx = remaining.findIndex((c) => c.harnessId === best.harnessId);
-                remaining.splice(idx, 1);
-                const routed = byId.get(best.harnessId);
-                if (routed)
-                    ranked.push(routed);
-            }
-            for (const c of remaining) {
-                const routed = byId.get(c.harnessId);
-                if (routed)
-                    ranked.push(routed);
-            }
+            const ranked = rankHarnesses(remaining, {
+                goal,
+                paidFallback: config.routing.paid_fallback,
+                intent,
+                qualityTiers: config.routing.quality_tiers,
+                ledger: routeLedger,
+            })
+                .map((candidate) => byId.get(candidate.harnessId))
+                .filter((candidate) => Boolean(candidate));
             ordered = ranked;
         }
         if (input.primaryHarness) {
@@ -695,22 +823,6 @@ export class Orchestrator {
             "",
         ].join("\n");
     }
-    /**
-     * Ledger a routed harness reserves from: harnesses with a configured
-     * `max_usd` get a child sub-ledger (spend rolls up to the run cap), so one
-     * harness exhausting its own budget cannot drain the whole run.
-     */
-    harnessLedger(map, parent, routed) {
-        const cap = routed.settings?.maxUsd;
-        if (!cap || cap <= 0)
-            return parent;
-        let child = map.get(routed.adapter.id);
-        if (!child) {
-            child = parent.child({ maxUsd: cap });
-            map.set(routed.adapter.id, child);
-        }
-        return child;
-    }
     /**
      * The web mode a routed harness actually executes for a requested policy.
      * Tools-permissioned web (e.g. claude) has no cached index: `cached` upgrades
@@ -762,7 +874,10 @@ export class Orchestrator {
             // turn (TurnEnqueueError.code), so surfaces key remedies on the CODE —
             // never on substring-matching this human message.
             throw Object.assign(new Error(`access profile 'full' requires allow_full_access: true in the user-level trust file for this repo ` +
-                `(${trustConfigPath(input.repoRoot)}); enable it with \`claudexor trust --allow-full-access\` — refusing to run unsandboxed`), { code: TRUST_FULL_ACCESS_CODE });
+                `(${trustConfigPath(input.repoRoot)}); enable it with \`claudexor trust --allow-full-access\` — refusing to run unsandboxed`), 
+            // Refusal semantics are born at the throw (W24): the one-time grant is
+            // a 403, and the daemon persists this status onto the job record.
+            { code: TRUST_FULL_ACCESS_CODE, status: 403 });
         }
         const externalContextPolicy = input.web ?? input.externalContextPolicy ?? "auto";
         // A frozen SpecPack's CONTENT reaches the contract (success criteria,
@@ -785,7 +900,7 @@ export class Orchestrator {
                     repoRoot: input.repoRoot,
                     mode,
                     baseRef: input.baseRef,
-                    maxUsd: input.maxUsd,
+                    paidBudget: input.paidBudget,
                 });
                 specFields = {
                     success_criteria: fromSpec.success_criteria,
@@ -795,7 +910,12 @@ export class Orchestrator {
                     task_graph: fromSpec.task_graph,
                     constraints: fromSpec.constraints,
                 };
-                specTestCommands = fromSpec.tests.commands.map((test) => test.command);
+                specTestCommands = fromSpec.tests.commands.map(({ program, args, cwd, envAllowlist }) => ({
+                    program,
+                    args,
+                    ...(cwd === undefined ? {} : { cwd }),
+                    envAllowlist,
+                }));
             }
             catch (err) {
                 // An unreadable/unfrozen spec must fail the run loudly, never silently
@@ -806,22 +926,18 @@ export class Orchestrator {
         // Deterministic gate commands come from the frozen SpecPack, explicit run
         // input, then versioned project config. Without these, gateSpecs is empty
         // and convergence is review-only; with them, convergence is test-driven.
-        const seenCommands = new Set();
-        const commands = [...specTestCommands, ...(input.tests ?? []), ...(cfg?.tests?.commands ?? [])]
-            .map((c) => c.trim())
-            .filter(Boolean)
-            .filter((command) => {
-            if (seenCommands.has(command))
-                return false;
-            seenCommands.add(command);
-            return true;
-        })
-            .map((command, i) => {
-            assertNoSecretLikeTokens(`gate command ${i + 1}`, command);
-            return { id: `gate-${i + 1}`, command, required: true };
+        const resolvedGates = resolveContractGates({
+            repoRoot: input.repoRoot,
+            effectiveAccess,
+            config: cfg,
+            trustGrants: resolvedCfg.trust.test_command_grants,
+            specCommands: specTestCommands,
+            operatorCommands: input.tests ?? [],
+            projectCommands: cfg.tests?.commands ?? [],
         });
+        const commands = resolvedGates.commands;
         const protectedPaths = [...new Set(specFields.constraints?.protected_paths ?? [])];
-        const autoProtectedPaths = [...new Set(gateProtectedPaths(commands.map((c) => c.command)))];
+        const autoProtectedPaths = resolvedGates.autoProtectedPaths;
         const protectedPathApprovals = [
             ...new Map([...(input.protectedPathApprovals ?? [])].map((approval) => [approval.path, approval])).values(),
         ];
@@ -832,6 +948,17 @@ export class Orchestrator {
             repo: { root: input.repoRoot, base_ref: input.baseRef ?? "HEAD", dirty_policy: "snapshot" },
             mode: { kind: mode },
             user_intent: { raw: redactSecrets(input.prompt) },
+            // Redacted for symmetry with user_intent.raw — a no-op on fenced input
+            // (the inline-secret fence already blocked any secret-like value at every
+            // ingress incl. this engine boundary), so task-producing lanes read back
+            // the real instructions via harnessSpecKnobs().
+            instructions: input.instructions === undefined ? undefined : redactSecrets(input.instructions),
+            // Already normalized/strictified at the engine boundary (run() refuses
+            // unsupported shapes before any run dir exists).
+            output_schema: input.outputSchema ?? null,
+            auth_preference: input.authPreference ?? "auto",
+            credential_profile_id: input.credentialProfileId ?? null,
+            max_turns: input.maxTurns ?? null,
             spec: input.specId || input.specHash || input.specPath
                 ? {
                     id: input.specId,
@@ -842,6 +969,7 @@ export class Orchestrator {
             ...specFields,
             constraints: {
                 protected_paths: protectedPaths,
+                deny_paths: [...new Set(input.denyPaths ?? [])],
                 auto_protected_paths: autoProtectedPaths,
                 protected_path_approvals: protectedPathApprovals,
             },
@@ -866,11 +994,8 @@ export class Orchestrator {
                 deny: [],
             },
             budget: {
-                portfolio: input.portfolio ?? this.deps.portfolio ?? cfg?.budget?.portfolio ?? "subscription-first",
-                // Run cap precedence: explicit run input > surface deps > the user's
-                // configured global per-run default. ($/day caps were removed; the budget
-                // priority is respecting harness-reported subscription/OAuth quota.)
-                max_usd: this.resolveMaxUsdCap(input.maxUsd, resolvedCfg),
+                routing_goal: input.routingGoal ?? this.deps.routingGoal ?? cfg?.budget?.routing_goal ?? "auto",
+                paid_budget: this.resolvePaidBudget(input.paidBudget, resolvedCfg),
             },
             // The resolved harness-scoped model map (scalar already expanded to the
             // primary by resolveRunInput). The contract is what route spec building
@@ -878,61 +1003,43 @@ export class Orchestrator {
             routing_models: input.models ?? {},
         });
     }
-    gateSpecs(contract) {
-        return contract.tests.commands.map((c) => ({
-            id: c.id,
-            command: c.command,
-            required: c.required,
-        }));
-    }
-    testsEvidence(contract, gates) {
-        const specs = this.gateSpecs(contract);
-        if (gates === undefined) {
-            if (specs.length === 0)
-                return "(no test commands configured)";
-            return [
-                "Configured test commands (not run yet):",
-                ...specs.map((spec) => `- ${spec.id}${spec.required === false ? " (optional)" : ""}: ${spec.command}`),
-            ].join("\n");
-        }
-        if (gates.length === 0) {
-            if (specs.length === 0)
-                return "(no test commands configured)";
-            return [
-                "Configured test commands did not produce gate results before this review:",
-                ...specs.map((spec) => `- ${spec.id}${spec.required === false ? " (optional)" : ""}: ${spec.command}`),
-            ].join("\n");
-        }
-        const required = gates.filter((gate) => gate.required);
-        const requiredPassed = required.filter((gate) => gate.status === "passed").length;
-        const lines = [
-            `Gate results: required ${requiredPassed}/${required.length} passed; total ${gates.length}.`,
-        ];
-        const appendTail = (label, text) => {
-            if (!text)
-                return;
-            lines.push(`  ${label}: |`);
-            for (const line of text.split(/\r?\n/))
-                lines.push(`    ${line}`);
-        };
-        for (const gate of gates) {
-            lines.push(`- ${gate.id}${gate.required === false ? " (optional)" : ""}: ${gate.status}; exit=${gate.exit_code ?? "null"}; duration_ms=${gate.duration_ms}`);
-            lines.push(`  command: ${gate.command}`);
-            if (gate.output_truncated)
-                lines.push("  output_truncated: true");
-            appendTail("stdout_tail", gate.stdout_tail);
-            appendTail("stderr_tail", gate.stderr_tail);
-        }
-        return lines.join("\n");
-    }
-    writeTestsEvidence(evidenceDir, contract, gates) {
-        writeText(join(evidenceDir, "TESTS.txt"), this.testsEvidence(contract, gates).trim() + "\n");
-    }
     /**
      * Per-harness settings applied to one route's run spec (model/effort/web
      * defaults, max_turns, tool lists). Knobs the manifest does not support are
      * RETURNED as ignored reasons (disclosed by the caller), never silently sent.
      */
+    /**
+     * The HarnessRunSpec fields every TASK-PRODUCING lane shares (primary,
+     * candidate, planner, explorer, orchestrate-planner). Extracting the identical
+     * block into ONE owner means a new task-producing field lands here once —
+     * never forgotten in one of the HarnessRunSpec.parse sites (the multi-path
+     * trap). Per-run `instructions` ride every task-producing lane but are withheld
+     * from `synthesize` (a merge of existing candidates, not a fresh task
+     * execution — owner Quiz-5a); reviewers and the auth smoke build their own
+     * specs and never call this.
+     */
+    harnessSpecKnobs(contract, knobs, intent) {
+        return {
+            external_context_policy: knobs.webPolicy,
+            tool_permission_policy: {
+                web: knobs.webPolicy,
+                allow: [...new Set([...contract.tool_permission_policy.allow, ...knobs.toolsAllow])],
+                deny: [...new Set([...contract.tool_permission_policy.deny, ...knobs.toolsDeny])],
+            },
+            model_hint: knobs.model,
+            effort_hint: knobs.effort,
+            max_turns: knobs.maxTurns,
+            ...(intent === "synthesize" ? {} : { instructions: contract.instructions }),
+            // The user's answer contract rides every answer-producing lane INCLUDING
+            // synthesis (its answer can become the final one); the orchestrate
+            // planner owns its own plan schema instead (set at its spec site). The
+            // adapter gets the vendor-STRICT transport form; the engine validator
+            // keeps the ORIGINAL contract as the conformance authority.
+            ...(intent !== "orchestrate" && contract.output_schema
+                ? { output_schema: strictifyOutputSchema(contract.output_schema) }
+                : {}),
+        };
+    }
     routeSpecKnobs(routed, contract, overrideModel, effortHint) {
         const s = routed.settings;
         const contractPolicy = contract.external_context.policy;
@@ -940,11 +1047,13 @@ export class Orchestrator {
         let maxTurns = null;
         let toolsAllow = [];
         let toolsDeny = [];
-        if (s?.maxTurns) {
+        // Run-level cap beats per-harness settings (specific beats general).
+        const requestedMaxTurns = contract.max_turns ?? s?.maxTurns ?? null;
+        if (requestedMaxTurns) {
             if (routed.supportsMaxTurns)
-                maxTurns = s.maxTurns;
+                maxTurns = requestedMaxTurns;
             else
-                ignored.push(`max_turns=${s.maxTurns} (manifest capabilities.max_turns=false for ${routed.adapter.id})`);
+                ignored.push(`max_turns=${requestedMaxTurns} (manifest capabilities.max_turns=false for ${routed.adapter.id})`);
         }
         if ((s?.toolsAllow.length ?? 0) > 0 || (s?.toolsDeny.length ?? 0) > 0) {
             if (routed.supportsToolLists) {
@@ -981,43 +1090,38 @@ export class Orchestrator {
         };
     }
     /** Run one candidate inside an already-created envelope. Never creates/disposes the envelope. */
-    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access = "workspace_write", onHarnessEvent, signal, modelHint, effortHint, intent = "implement", log, effectiveWebMode, interaction, budgetGuard, runInput) {
+    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access = "workspace_write", onHarnessEvent, signal, modelHint, effortHint, intent = "implement", log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas = false) {
         const adapter = routed.adapter;
         const knobs = this.routeSpecKnobs(routed, contract, modelHint, effortHint);
-        // In-place envelopes mutate the live tree under the user's native environment
-        // (no scoped HOME), so the vendor's own session store is reachable: the turn
-        // RESUMES the native CLI session (real continuity, like the read-only paths).
-        // Isolated envelopes (race candidates) get a fresh scoped home where that
-        // session id cannot exist — they run fresh, with a typed session.rebound
-        // disclosure, never a deterministic session-not-found failure.
+        // In-place envelopes can resume native sessions; isolated scoped homes cannot,
+        // so their session ids are never retained after disposal.
         const inPlaceEnvelope = envelope.worktree_path === envelope.repo_root;
-        const sessionFields = runInput ? this.sessionSpecFields(runInput, adapter.id) : undefined;
-        const spec = HarnessRunSpec.parse({
+        const rawContextPacket = await rawContextForEnvelope(routed.implementationTransport, envelope);
+        const sessionFields = runInput ? this.sessionSpecFields(runInput, adapter.id, log) : undefined;
+        let spec = HarnessRunSpec.parse({
             session_id: newId("ses"),
             intent,
             prompt: promptWithProtectedPathConstraint(prompt, contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals),
             attachments: runInput?.attachments ?? [],
-            browser: this.browserSpecFor(runInput, routed, knobs.webPolicy, access, paths),
+            browser: this.requestRequirements.browserSpec(routed.browserRequirement, join(paths.root, "browser")),
             cwd: envelope.worktree_path,
-            access,
-            external_context_policy: knobs.webPolicy,
-            tool_permission_policy: {
-                web: knobs.webPolicy,
-                allow: [...new Set([...contract.tool_permission_policy.allow, ...knobs.toolsAllow])],
-                deny: [...new Set([...contract.tool_permission_policy.deny, ...knobs.toolsDeny])],
-            },
-            model_hint: knobs.model,
-            effort_hint: knobs.effort,
-            max_turns: knobs.maxTurns,
-            max_usd: routed.settings?.maxUsd ?? null,
+            access: routed.adapterAccess,
+            ...this.harnessSpecKnobs(contract, knobs, intent),
             env_inheritance: envInheritance(this.config(contract.repo.root)),
-            ...(sessionFields ? { auth_preference: sessionFields.auth_preference } : {}),
+            ...(sessionFields
+                ? {
+                    auth_preference: sessionFields.auth_preference,
+                    credential_profile: sessionFields.credential_profile,
+                }
+                : {}),
             ...(inPlaceEnvelope && sessionFields?.resume_session_id
                 ? { resume_session_id: sessionFields.resume_session_id }
                 : {}),
             // Scoped harness home only for isolated envelopes; in-place runs use the
             // native environment so the resumed vendor session is actually reachable.
             ...(inPlaceEnvelope ? {} : { env: wsm.envFor(envelope) }),
+            raw_context_packet: rawContextPacket,
+            stream_deltas: streamDeltas,
         });
         if (!inPlaceEnvelope && runInput?.threadId && sessionFields?.resume_session_id) {
             log?.emit("session.rebound", SessionReboundLineageSchema.parse({
@@ -1034,15 +1138,19 @@ export class Orchestrator {
         const inactivityMs = harnessInactivityTimeoutMs(this.config(contract.repo.root));
         const attemptStartedMs = Date.now();
         const budgetSignalState = { quotaPressureDisclosed: false };
+        const triedProfiles = new Set(); // W5.4 failover: each profile at most once
         let cost = 0;
         let costEstimated = false;
         let harnessErrored = false;
+        // W-C4 delta flood budget (per attempt): counts forwarded delta chunks.
+        let deltaCount = 0;
+        let deltaCutoffDisclosed = false;
         const errors = [];
-        const messageParts = [];
+        const answer = new AnswerAssembly();
         const retryPolicy = transientRetryPolicy(this.config(contract.repo.root));
         const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
             knobs.webPolicy === "cached" ||
-            knobs.webPolicy === "live", effectiveWebMode ?? knobs.webPolicy);
+            knobs.webPolicy === "live", effectiveWebMode ?? knobs.webPolicy, [routed.browserRequirement, routed.denyRequirement], knobs.model);
         let activeSessionId = spec.session_id;
         const onAbort = () => {
             void adapter.cancel?.(activeSessionId)?.catch(() => { });
@@ -1070,6 +1178,8 @@ export class Orchestrator {
                     : attemptAbort.signal;
                 activeSessionId = runSpec.session_id;
                 const transientStart = telemetry.transientFailures.length;
+                const rateLimitStart = telemetry.rateLimits.length;
+                let rawPatch = null;
                 try {
                     const watched = withInactivityWatchdog(adapter.run(runSpec), {
                         timeoutMs: inactivityMs,
@@ -1084,7 +1194,31 @@ export class Orchestrator {
                     for await (const ev of watched) {
                         if (signal?.aborted)
                             break;
+                        rawPatch = captureRawPatchEnvelope(rawContextPacket !== null, rawPatch, ev);
+                        if (ev.type === "patch_produced")
+                            continue;
                         const safeEv = redactHarnessEvent(ev);
+                        // W-C4 flood guard (review sol #10): a per-character delta stream
+                        // would otherwise persist/SSE one journal event PER CHUNK without
+                        // bound. Delta messages are DISPLAY-only (the complete message
+                        // still follows and carries the authoritative text), so past a
+                        // per-attempt budget we DROP further deltas and disclose the
+                        // cutoff ONCE — the final answer is unaffected.
+                        if (safeEv.type === "message" && safeEv.payload?.["delta"] === true) {
+                            deltaCount += 1;
+                            if (deltaCount > Orchestrator.MAX_DELTAS_PER_ATTEMPT) {
+                                if (!deltaCutoffDisclosed) {
+                                    deltaCutoffDisclosed = true;
+                                    log?.emit("harness.event", {
+                                        harness_id: adapter.id,
+                                        attempt_id: attemptId,
+                                        type: "status",
+                                        title: `live delta stream capped at ${Orchestrator.MAX_DELTAS_PER_ATTEMPT} chunks; the complete message still lands`,
+                                    });
+                                }
+                                continue; // drop this delta; never journal past the budget
+                            }
+                        }
                         safeInvoke(onHarnessEvent, safeEv);
                         // In-place turns run in the live tree under the native environment, so
                         // the session they emit IS reachable for the next turn: record it. An
@@ -1092,13 +1226,17 @@ export class Orchestrator {
                         // deletes, so observing it would poison the thread resume map with
                         // unreachable ids — skip it there.
                         if (inPlaceEnvelope)
-                            this.observeNativeSession(runInput, adapter.id, safeEv);
+                            observeNativeSessionEvent(runInput, adapter.id, safeEv);
                         observeAuthSwitch(log, adapter.id, attemptId, safeEv);
                         observeAttemptTelemetry(telemetry, safeEv);
                         // Live plan checklist: forward the adapter's typed plan
                         // progress as a run event (LAST WINS; the UI renders the latest).
                         if (safeEv.plan_progress) {
-                            log?.emit("plan.progress", { attempt_id: attemptId, harness_id: adapter.id, items: safeEv.plan_progress.items });
+                            log?.emit("plan.progress", {
+                                attempt_id: attemptId,
+                                harness_id: adapter.id,
+                                items: safeEv.plan_progress.items,
+                            });
                         }
                         if (safeEv.type === "usage" && safeEv.usage?.cost_usd) {
                             cost += safeEv.usage.cost_usd;
@@ -1113,8 +1251,9 @@ export class Orchestrator {
                             });
                             // Mid-flight cap enforcement: the guard raises this attempt's hold
                             // to the streamed cost; a hard tier aborts NOW instead of letting a
-                            // streaming candidate overshoot max_usd until settlement.
-                            if (budgetGuard?.(cost)) {
+                            // streaming candidate overshoot the paid budget until settlement.
+                            const valuationOnly = safeEv.usage.estimated === true && telemetry.authMode === "local_session";
+                            if (!valuationOnly && budgetGuard?.(cost)) {
                                 harnessErrored = true;
                                 errors.push("budget hard cap reached mid-attempt; stream aborted");
                                 log?.emit("budget.observation", {
@@ -1132,16 +1271,21 @@ export class Orchestrator {
                             errors.push(redactSecrets(safeEv.error ?? safeEv.text ?? "harness emitted error"));
                         }
                         // Capture assistant prose so an answer-only turn (no file changes) still
-                        // has an honest output artifact instead of an empty "succeeded".
-                        if (safeEv.type === "message" &&
-                            safeEv.text &&
-                            safeEv.payload?.["auth_switched"] !== true) {
-                            pushUniqueText(messageParts, safeEv.text);
-                        }
+                        // has an honest output artifact; a TYPED final message wins verbatim.
+                        answer.observe(safeEv);
                         // Observe ALL budget/quota signals (one codex usage event carries
                         // BOTH spend and quota); pressure disclosed once per attempt.
                         observeBudgetSignals(ledger, log, adapter.id, attemptId, safeEv, budgetSignalState);
+                        this.deps.quotaEventSink?.(adapter.id, safeEv);
                     }
+                    if (rawContextPacket && !harnessErrored)
+                        await consumeRawPatchEnvelope({
+                            repoRoot: envelope.repo_root,
+                            worktreePath: envelope.worktree_path,
+                            baseCommitSha: envelope.base_sha ?? "HEAD",
+                            context: rawContextPacket,
+                            envelope: rawPatch,
+                        });
                 }
                 catch (err) {
                     // A throwing adapter must not lose the cost already streamed: record the
@@ -1151,9 +1295,35 @@ export class Orchestrator {
                 }
                 const transient = telemetry.transientFailures.at(-1) ?? null;
                 const sawTransient = telemetry.transientFailures.length > transientStart;
+                const sawTypedLimit = telemetry.rateLimits.length > rateLimitStart;
                 const currentDiff = await wsm.diff(envelope);
-                const currentAnswer = messageParts.join("\n").trim();
+                const currentAnswer = answer.text();
                 const deliverableEmpty = currentDiff.trim().length === 0 && currentAnswer.length === 0;
+                // W5.4 failover: a typed-limit hit rebuilds the spec on a NEW vendor
+                // session under the next profile with provenance (vendor_limit_rejected).
+                if (harnessErrored && runInput && !signal?.aborted) {
+                    const rotated = rotateSpecOnTypedLimit({
+                        spec,
+                        harnessId: adapter.id,
+                        attemptId,
+                        policy: this.profilePolicy(contract.repo.root, adapter.id),
+                        registry: this.config(contract.repo.root)?.global.credential_profiles ?? [],
+                        snapshots: this.deps.quotaSnapshots?.() ?? [],
+                        triedProfiles,
+                        sawTypedLimit,
+                        deliverableEmpty,
+                        lastLimit: telemetry.rateLimits.at(-1) ?? null,
+                        emit: (type, payload) => log?.emit(type, payload),
+                        newSessionId: () => newId("ses"),
+                        defaultRouteWasVendorNative: routed.authRouteEstimate === "local_session",
+                    });
+                    if (rotated) {
+                        spec = rotated;
+                        errors.length = 0;
+                        harnessErrored = false;
+                        continue;
+                    }
+                }
                 if (!harnessErrored ||
                     !sawTransient ||
                     !deliverableEmpty ||
@@ -1194,7 +1364,7 @@ export class Orchestrator {
             errors.push(`web evidence unsatisfied: ${telemetry.web.errorSummary ?? (telemetry.web.attempted ? "web tool failed without verified recovery" : "web evidence required but never attempted")}`);
         }
         const diff = await wsm.diff(envelope);
-        const answerText = messageParts.join("\n").trim() || undefined;
+        const answerText = answer.text() || undefined;
         const deliverablePresent = diff.trim().length > 0 || Boolean(answerText);
         // Cancelled attempts skip gates entirely: the operator asked to
         // stop NOW; running a 600s-per-gate suite after the abort delays the ack
@@ -1202,11 +1372,14 @@ export class Orchestrator {
         // still land, so partial work stays inspectable.
         const gateSignalAborted = signal?.aborted === true;
         if (!gateSignalAborted) {
-            log?.emit("gate.started", { attempt_id: attemptId, gates: this.gateSpecs(contract).length });
+            log?.emit("gate.started", {
+                attempt_id: attemptId,
+                gates: gateSpecsFromContract(contract).length,
+            });
         }
         const gates = gateSignalAborted
             ? []
-            : await runGates(this.gateSpecs(contract), {
+            : await runGates(gateSpecsFromContract(contract), {
                 cwd: envelope.worktree_path,
                 env: wsm.envFor(envelope),
                 signal,
@@ -1244,12 +1417,14 @@ export class Orchestrator {
             throw Object.assign(err instanceof Error ? err : new Error(String(err)), { costUsd: cost });
         }
         store.writeText(join(attemptDir, "patch.diff"), diff);
-        // Routing metrics (one owner in runSupport; clean attempts only).
+        // Routing metrics (one owner in runSupport; clean attempts only —
+        // auth-route evidence recorded regardless).
         recordCleanAttemptMetrics(globalConfigDir(), adapter.id, {
             costUsd: cost,
             streamMs: attemptStreamEndedMs - attemptStartedMs,
             errored,
             aborted: signal?.aborted === true,
+            authMode: telemetry.authMode,
         });
         const attemptDiffstat = diffStats(diff);
         store.writeYaml(join(attemptDir, "attempt.yaml"), {
@@ -1342,8 +1517,8 @@ export class Orchestrator {
     }
     /**
      * Guarantee a git boundary for write-mode runs. Non-git project folders are
-     * initialized in place (`.gitignore` seeded with `.claudexor/`, `git init`,
-     * deterministic baseline commit) and the action is announced via a
+     * initialized in place (`git init`, deterministic baseline commit) without
+     * creating or editing `.gitignore`, and the action is announced via a
      * `project.git.initialized` event. Returns the failure message when the
      * boundary cannot be established (the terminal failure events are already
      * emitted); null on success.
@@ -1406,8 +1581,17 @@ export class Orchestrator {
         const wsm = new WorkspaceManager(execRoot);
         safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
         log.emit("run.created", { mode, prompt: redactSecrets(input.prompt) });
-        const ledger = new BudgetLedger({ maxUsd: contract.budget.max_usd ?? null });
-        announce?.({ log, store, paths, runId, taskId, mode, phase: "race", spend: () => ledger.spend() });
+        const ledger = this.rootLedger(input, contract, log);
+        announce?.({
+            log,
+            store,
+            paths,
+            runId,
+            taskId,
+            mode,
+            phase: "race",
+            spend: () => ledger.spend(),
+        });
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // Write modes need a git boundary for worktree isolation and honest diffs.
@@ -1448,7 +1632,7 @@ export class Orchestrator {
         writeEvidencePacket(reviewDir, {
             userIntent: redactSecrets(input.prompt),
             diff: "(per-candidate diffs are supplied to reviewers individually)\n",
-            tests: this.testsEvidence(contract),
+            tests: renderTestsEvidence(contract),
         });
         let adapters;
         try {
@@ -1487,7 +1671,6 @@ export class Orchestrator {
             return reviewersOutcome.failed;
         const reviewers = reviewersOutcome.reviewers;
         const reviewVerified = this.routeVerified(reviewers);
-        const harnessLedgers = new Map();
         const reviewEnvelopes = [];
         const disposeReviewEnvelopes = async () => {
             const envelopes = reviewEnvelopes.splice(0);
@@ -1497,25 +1680,17 @@ export class Orchestrator {
         const candidateAccess = contract.access.effective_profile;
         let budgetStopped = false;
         let softWarned = false;
-        // The USER-requested race width, before any budget trimming.
         const requestedSingleCandidate = adapters.length === 1;
         const slots = [];
         for (let i = 0; i < adapters.length; i++) {
             const routed = adapters[i];
             const attemptId = `a${String(i + 1).padStart(2, "0")}`;
-            // Per-harness max_usd runs through a child ledger that rolls up to the run cap.
-            const lease = this.harnessLedger(harnessLedgers, ledger, routed).reserve({
+            const lease = ledger.reserve({
                 taskId,
                 attemptId,
                 intent: this.candidateIntent(input),
                 harnessId: routed.adapter.id,
-                // wave guard: every slot AFTER the first holds the estimate
-                // floor at reservation, so concurrent candidates are visible to the
-                // breaker BEFORE any usage streams and a parallel wave cannot blow
-                // past the cap between settlements. The first slot holds nothing —
-                // a cap smaller than the floor must still run ONE candidate and stop
-                // on real usage, never zero.
-                ...(i > 0 ? { estimateUsd: this.estimateUsdFloor(input.repoRoot) } : {}),
+                cost: attemptCostEvidence(routed.adapter.id, attemptId, i > 0 ? this.estimateUsdFloor(input.repoRoot) : undefined, this.routeBillingKnowledge(input, routed.adapter.id)),
             });
             log.emit("budget.lease.created", {
                 granted: lease.granted,
@@ -1538,17 +1713,16 @@ export class Orchestrator {
             });
         }
         const runsBySlot = new Array(slots.length);
-        const slotLedger = (slot) => this.harnessLedger(harnessLedgers, ledger, slot.routed);
         const runSlot = async (slot, slotIdx) => {
             if (input.signal?.aborted) {
-                slotLedger(slot).cancel(slot.leaseId);
+                ledger.cancel(slot.leaseId);
                 return;
             }
             // Leases are granted upfront (before spend exists); a worker still
             // re-checks the circuit breaker so queued slots beyond the parallel wave
             // do not start after earlier candidates already blew the hard cap.
-            if (budgetStopped || slotLedger(slot).tier() === "hard") {
-                slotLedger(slot).cancel(slot.leaseId);
+            if (budgetStopped || ledger.tier() === "hard") {
+                ledger.cancel(slot.leaseId);
                 log.emit("budget.lease.created", {
                     granted: false,
                     reason: "budget exhausted (hard cap reached)",
@@ -1563,7 +1737,7 @@ export class Orchestrator {
             // Soft + downgrade breaker (before the hard cap): soft = a one-time
             // warning; downgrade = run this attempt on the per-harness fallback_model
             // (cheaper) instead of hard-killing — gives fallback_model a real job.
-            const breakerTier = slotLedger(slot).tier();
+            const breakerTier = ledger.tier();
             if (breakerTier === "soft" && !softWarned) {
                 softWarned = true;
                 log.emit("budget.observation", {
@@ -1598,28 +1772,24 @@ export class Orchestrator {
                     baseRef: contract.repo.base_ref,
                     dirtyPolicy: "snapshot",
                     accessProfile: candidateAccess,
-                    // A single-candidate turn (agent n=1) on an in-place/isolated thread
-                    // runs directly in the execution tree so the next turn sees its work
-                    // and the native session resumes. Race candidates (n>1) always stay in
-                    // isolated envelopes; the winner is auto-adopted into the tree after.
-                    // REQUESTED width decides: a budget-degraded race whose wave
-                    // guard trimmed it to one slot still runs enveloped + adoption —
-                    // never a silent switch to direct live-tree mutation.
-                    inPlace: input.inPlace === true && requestedSingleCandidate,
+                    // Direct-workspace singletons run in place. Races and patch-envelope
+                    // transports stay isolated and adopt through the delivery service.
+                    inPlace: input.inPlace === true &&
+                        requestedSingleCandidate &&
+                        slot.routed.implementationTransport !== "git_patch_envelope",
                 });
                 const run = await this.runCandidateInEnvelope(slot.routed, envelope, slot.attemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
                     const safeEv = redactHarnessEvent(ev);
                     safeInvoke(input.onHarnessEvent, safeEv);
                     log.emit("harness.event", harnessEventPayload(adapter.id, slot.attemptId, safeEv));
                 }, input.signal, downgradeModel ?? undefined, input.effort, this.candidateIntent(input), log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, slot.attemptId, adapter.id, slot.routed.supportsInteractive), (streamedUsd) => {
-                    const lg = slotLedger(slot);
-                    lg.updateHold(slot.leaseId, streamedUsd);
-                    if (lg.tier() !== "hard")
+                    ledger.updateHold(slot.leaseId, streamedUsd);
+                    if (ledger.tier() !== "hard")
                         return false;
                     budgetStopped = true;
                     return true;
-                }, input);
-                slotLedger(slot).settle(slot.leaseId, run.cost);
+                }, input, requestedSingleCandidate);
+                ledger.settle(slot.leaseId, attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode));
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
                     attempt_id: slot.attemptId,
@@ -1637,8 +1807,10 @@ export class Orchestrator {
                 // post-stream throw (e.g. the secret-token assertion) carries its
                 // streamed spend on the error — settle the TRUE cost, never launder
                 // real spend down to 0.
-                const carriedCost = typeof err?.costUsd === "number" ? err.costUsd : 0;
-                slotLedger(slot).settle(slot.leaseId, carriedCost);
+                const carriedCost = typeof err?.costUsd === "number"
+                    ? err.costUsd
+                    : 0;
+                ledger.settle(slot.leaseId, unknownCostSettlement("post-stream-error", carriedCost));
                 const message = safeErrorMessage(err);
                 // envelope is still undefined when wsm.create() itself threw — that is
                 // a workspace-phase infrastructure failure, not a harness error.
@@ -1669,7 +1841,7 @@ export class Orchestrator {
                     errored: true,
                     costEstimated: false,
                     errors: [message],
-                    telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb),
+                    telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb, [slot.routed.browserRequirement, slot.routed.denyRequirement], knobs.model),
                     infraPhase,
                 };
             }
@@ -1702,10 +1874,14 @@ export class Orchestrator {
         }
         if (input.signal?.aborted) {
             await disposeReviewEnvelopes();
-            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({ attemptId: r.attemptId, harnessId: r.harnessId, telemetry: r.telemetry })), null), ledger.spend());
+            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({
+                attemptId: r.attemptId,
+                harnessId: r.harnessId,
+                telemetry: r.telemetry,
+            })), null), ledger.spend(), input.signal, store);
         }
         if (runs.length === 0) {
-            const status = budgetStopped ? "exhausted" : "failed";
+            const status = ledger.terminal() ?? (budgetStopped ? "exhausted" : "failed");
             const why = budgetStopped
                 ? "budget exhausted before any candidate run"
                 : "no candidates produced";
@@ -1721,7 +1897,7 @@ export class Orchestrator {
             store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: ${status}\n- Phase: budget\n\n${why}\n`);
             writeFailure(store, paths, {
                 phase: "budget",
-                category: status === "exhausted" ? "budget" : "internal",
+                category: isBudgetTerminal(status) ? "budget" : "internal",
                 safeMessage: why,
                 runDir: paths.root,
             });
@@ -1831,7 +2007,11 @@ export class Orchestrator {
             await disposeReviewEnvelopes();
         }
         if (input.signal?.aborted) {
-            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({ attemptId: r.attemptId, harnessId: r.harnessId, telemetry: r.telemetry })), null), ledger.spend());
+            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({
+                attemptId: r.attemptId,
+                harnessId: r.harnessId,
+                telemetry: r.telemetry,
+            })), null), ledger.spend(), input.signal, store);
         }
         // Synthesis: if worthwhile, run a synthesizer as a NEW, re-checked candidate.
         const synth = decideSynthesis(evidences, input.synthesis ?? "auto");
@@ -1839,14 +2019,12 @@ export class Orchestrator {
         log.emit("synthesis.started", { synthesize: synth.synthesize, reason: synth.reason });
         if (synth.synthesize && !budgetStopped) {
             const synthRouted = adapters[0];
-            // Per-harness child ledger: synthesis spend counts against the
-            // synthesizer harness's own cap, not only the run cap.
-            const synthLedger = this.harnessLedger(harnessLedgers, ledger, synthRouted);
-            const lease = synthLedger.reserve({
+            const lease = ledger.reserve({
                 taskId,
                 attemptId: "synth",
                 intent: "synthesize",
                 harnessId: synthRouted.adapter.id,
+                cost: attemptCostEvidence(synthRouted.adapter.id, "synth", undefined, this.routeBillingKnowledge(input, synthRouted.adapter.id)),
             });
             if (lease.granted) {
                 let envelope;
@@ -1868,19 +2046,23 @@ export class Orchestrator {
                         accessProfile: candidateAccess,
                     });
                     const synthPrompt = `${plan.instructions}\n\nFindings to fix:\n${plan.fixFindings.map((f) => `- ${f}`).join("\n") || "(none)"}\n\nCandidate diffs:\n${sourceDiffs}`;
-                    const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthPrompt, store, paths, wsm, synthLedger, candidateAccess, (ev) => {
+                    const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthPrompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
                         const safeEv = redactHarnessEvent(ev);
                         safeInvoke(input.onHarnessEvent, safeEv);
                         log.emit("harness.event", harnessEventPayload(synthAdapter.id, "synth", safeEv));
                     }, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input);
-                    synthLedger.settle(lease.lease?.lease_id ?? "", run.cost);
+                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode));
                     reviewEnvelopes.push(envelope);
                     envelope = undefined;
                     try {
                         const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal);
                         evidences.push(...synthEvidence);
                         if (input.signal?.aborted) {
-                            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({ attemptId: r.attemptId, harnessId: r.harnessId, telemetry: r.telemetry })), null), ledger.spend());
+                            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({
+                                attemptId: r.attemptId,
+                                harnessId: r.harnessId,
+                                telemetry: r.telemetry,
+                            })), null), ledger.spend(), input.signal, store);
                         }
                     }
                     finally {
@@ -1890,7 +2072,7 @@ export class Orchestrator {
                     workingRuns.push(run);
                 }
                 catch (err) {
-                    synthLedger.settle(lease.lease?.lease_id ?? "", 0);
+                    ledger.settle(lease.lease?.lease_id ?? "", unknownCostSettlement("synthesis-error"));
                     log.emit("harness.completed", {
                         attempt_id: "synth",
                         status: "failed",
@@ -1904,7 +2086,11 @@ export class Orchestrator {
             }
         }
         if (input.signal?.aborted) {
-            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({ attemptId: r.attemptId, harnessId: r.harnessId, telemetry: r.telemetry })), null), ledger.spend());
+            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({
+                attemptId: r.attemptId,
+                harnessId: r.harnessId,
+                telemetry: r.telemetry,
+            })), null), ledger.spend(), input.signal, store);
         }
         let result;
         try {
@@ -1933,35 +2119,35 @@ export class Orchestrator {
             ? (evidences.find((e) => e.attemptId === winnerRun.attemptId)?.reviewVerified ?? false)
             : evidences.length > 0 && evidences.every((e) => e.reviewVerified);
         let status = needsHuman && result.decision.status !== "success" ? "blocked" : result.decision.status;
-        // FinalVerifier (INV-115): an otherwise-adoptable winner with a patch
-        // must ALSO apply cleanly onto a fresh tree at its own base and pass the
-        // deterministic gates there, BEFORE adoption/apply eligibility. A failure
-        // BLOCKS the run with a typed reason instead of shipping it.
+        if (status === "success" && ledger.terminal() !== null)
+            status = ledger.terminal();
+        // FinalVerifier blocks adoption until the patch and gates pass on a fresh base.
         let finalVerify = null;
         let finalVerifyFailed = false;
-        // IN-PLACE turns are explicitly EXEMPT (not merely base-less): a thread
-        // turn's snapshot base_sha IS recorded, but its diff was produced against
-        // the LIVE tree — a fresh snapshot worktree lacks gitignored deps
-        // (node_modules etc.), so gates there would false-block green turns. The
-        // verifier's contract is isolated-envelope patches only.
-        const inPlaceWinner = input.inPlace === true && requestedSingleCandidate;
+        let deliveryFailureReason = null;
+        let raceDeliveryReceipt = null;
+        // A single in-place turn already mutated its execution tree; race adoption
+        // instead defers verification until immediately before delivery.
+        const inPlaceWinner = winnerRun?.reviewCwd === execRoot;
+        const deferredRaceVerify = input.inPlace === true && !inPlaceWinner;
         if (winnerRun &&
             !inPlaceWinner &&
+            !deferredRaceVerify &&
             winnerRun.diff.trim().length > 0 &&
             (status === "success" || status === "ungated") &&
             !input.signal?.aborted) {
-            finalVerify = await finalVerifyPatch(execRoot, winnerRun, this.gateSpecs(contract), log);
-            // FAIL CLOSED (INV-115): verify errors block like proven failures —
-            // shared verdict owner (finalVerifyBlocks). accept_risk stays available.
+            finalVerify = await finalVerifyPatch(execRoot, winnerRun, gateSpecsFromContract(contract), log);
+            // Verify errors block like proven failures; accept_risk stays available.
             finalVerifyFailed = finalVerifyBlocks(finalVerify);
             if (finalVerifyFailed)
                 status = "blocked";
         }
         store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), {
             ...result.decision,
-            // Shared honesty owner: a blocked terminal overrides the persisted
-            // decision (status/outcome/human_review + evidence fact).
-            ...(status === "blocked" ? blockedDecisionOverride(result.decision.evidence_facts, finalVerify) : {}),
+            // A blocked terminal overrides the persisted green arbitration fields.
+            ...(status === "blocked"
+                ? blockedDecisionOverride(result.decision.evidence_facts, finalVerify)
+                : {}),
             review_verified: actualReviewVerified,
             final_verify: finalVerify,
         });
@@ -1977,45 +2163,55 @@ export class Orchestrator {
             const blockers = winnerEvidence
                 ? winnerEvidence.findings.filter((f) => isBlocking(f)).length
                 : 0;
-            // An empty-diff winner that produced prose is an ANSWER (the chat shows it
-            // and the honest result_kind is "answer", not a misleading "patch").
+            // Prose from an empty-diff winner is an answer, never a patch.
             const winnerAnswer = winnerRun.answerText?.trim() ?? "";
             const resultKind = hasDiff ? "patch" : winnerAnswer.length > 0 ? "answer" : "none";
-            if (!hasDiff && winnerAnswer.length > 0) {
+            // The winner's final MESSAGE is the human-facing answer and materializes
+            // for diff-ful runs too: the chat renders final/answer.md (the projection
+            // prefers it), never the arbitration summary — "Run … Winner: a01 …" is
+            // machine telemetry, not what the agent said. The diff stays in the
+            // Diff tab; summary.md remains a diagnostics artifact.
+            if (winnerAnswer.length > 0) {
                 store.writeText(join(paths.finalDir, "answer.md"), winnerAnswer + "\n");
             }
-            // a single-candidate in-place turn already mutated the live tree (its
-            // diff IS the live change). A race (n>1) ran candidates in isolated
-            // envelopes, so the winner's patch must be ADOPTED into the live tree for
-            // the next turn to see it. Blockers / non-success stop adoption; a failed
-            // apply (the user edited the tree mid-race) is disclosed, never lost.
-            // A clean terminal to adopt is success OR ungated (review passed but no
-            // test gates were configured to certify it) — never blocked/failed/no_op.
-            // Adoption is HONEST: `adopted` reflects whether the live in-place tree was
-            // actually mutated, DECOUPLED from a clean review. A single-candidate
-            // in-place turn edits the live tree directly — so it is "applied" even when
-            // review is blocked (applyState = applied_review_blocked + Revert offered).
-            // A race (n>1) ran candidates in isolated envelopes; its winner mutates the
-            // live tree only when we apply it, which we gate on a clean terminal.
-            const adoptable = status === "success" || status === "ungated";
+            // The run's structured-output contract: ONE engine validator, called on
+            // the winner's answer regardless of diff presence (a non-conformant
+            // answer stays success-with-warnings; the receipt is the truth).
+            if (contract.output_schema) {
+                finalizeStructuredOutput({
+                    store,
+                    finalDir: paths.finalDir,
+                    log,
+                    schema: contract.output_schema,
+                    answerText: winnerAnswer,
+                });
+            }
+            // Only a fully verified success may auto-adopt; ungated remains an artifact.
+            const adoptable = status === "success";
             let adopted = null;
             let applyState = "not_applied";
             let postTurnSha = null;
+            let revertAnchorId = null;
             if (input.inPlace === true && hasDiff) {
-                if (requestedSingleCandidate) {
+                if (inPlaceWinner) {
                     // Already live: the candidate ran in-place and wrote the tree itself.
                     adopted = true;
                     applyState = adoptable ? "applied" : "applied_review_blocked";
-                    // Fence taken right after the candidate finished (pre-review), so user
-                    // edits made during review/arbitration are not folded into the target.
+                    // The pre-review fence excludes later user edits from the target.
                     postTurnSha = earlyPostTurnSha;
                 }
                 else if (adoptable) {
-                    // Protected path: --check first, restore on 3way failure —
-                    // adopted:false MUST mean the live tree is byte-identical (INV-114);
-                    // a failed restore is disclosed as tree_mutated, never hidden.
-                    const applied = await applyPatchProtected(execRoot, winnerRun.diff);
-                    if (applied.ok) {
+                    // Protected apply preserves the live tree or reports tree_mutated.
+                    const applied = await verifyAndDeliver(execRoot, winnerRun.diff, { mode: "apply", protectedApply: true }, gateSpecsFromContract(contract), (freshVerify) => {
+                        finalVerify = freshVerify;
+                        return finalVerifyBlocks(freshVerify)
+                            ? (freshVerify.reason ?? "final verify failed before race adoption")
+                            : null;
+                    }, log);
+                    raceDeliveryReceipt = applied;
+                    store.writeYaml(join(paths.finalDir, "delivery_receipt.yaml"), applied);
+                    finalVerify = applied.finalVerify;
+                    if (applied.applied) {
                         adopted = true;
                         applyState = "applied";
                         log.emit("work_product.adopted", {
@@ -2023,17 +2219,21 @@ export class Orchestrator {
                             patch_sha256: patchSha256,
                             winner: winnerRun.attemptId,
                         });
-                        // Race winner: snapshot immediately after applying (minimal window).
                         try {
                             postTurnSha = await snapshotTree(execRoot);
                         }
                         catch {
                             postTurnSha = null;
                         }
+                        revertAnchorId = createRevertAnchorFromPatchOrNull(execRoot, winnerRun.diff);
                     }
                     else {
                         adopted = false;
                         applyState = "not_applied";
+                        deliveryFailureReason = applied.detail ?? "race adoption delivery was refused";
+                        status = "blocked";
+                        if (finalVerifyBlocks(finalVerify))
+                            finalVerifyFailed = true;
                         log.emit("work_product.adopted", {
                             applied: false,
                             patch_sha256: patchSha256,
@@ -2043,18 +2243,30 @@ export class Orchestrator {
                     }
                 }
             }
+            writeRaceDeliveryDecision(store, decisionPath, {
+                decision: result.decision,
+                status,
+                reviewVerified: actualReviewVerified,
+                finalVerify,
+                deliveryFailureReason,
+                deliveryReceiptPath: raceDeliveryReceipt ? "final/delivery_receipt.yaml" : null,
+            });
+            if (inPlaceWinner && requestedSingleCandidate && adopted === true) {
+                revertAnchorId = await createRevertAnchorOrNull(execRoot, preTurnSha, postTurnSha);
+            }
             store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
                 id: newId("wp"),
                 kind: input.create === true ? "new_repo" : "patch",
                 source_task_id: taskId,
                 producer_attempt_id: winnerRun.attemptId,
+                ...(raceDeliveryReceipt
+                    ? { files: { delivery_receipt: "final/delivery_receipt.yaml" } }
+                    : {}),
                 meta: {
                     harness_id: winnerRun.harnessId,
                     synthesis: synth,
                     mode,
-                    // Terminal run status rides the artifact so the artifact-only CLI
-                    // apply path enforces the same state bar as the daemon gate (a
-                    // blocked race must read as blocked from the run dir alone).
+                    // Artifact-only apply reads the same terminal status as the daemon.
                     status,
                     review_verified: actualReviewVerified,
                     budget_stopped: budgetStopped,
@@ -2070,6 +2282,7 @@ export class Orchestrator {
                     apply_state: applyState,
                     pre_turn_sha: preTurnSha,
                     post_turn_sha: postTurnSha,
+                    revert_anchor_id: revertAnchorId,
                 },
             });
             store.writeText(join(paths.finalDir, "summary.md"), renderSummary(runId, mode, { ...result.decision, status }, evidences, synth.reason, actualReviewVerified));
@@ -2084,7 +2297,10 @@ export class Orchestrator {
             ? result.decision.winner
             : (winnerRun?.attemptId ?? null));
         const honestTerminal = status === "no_op" || status === "ungated" || status === "review_not_run";
-        if (finalVerifyFailed) {
+        if (deliveryFailureReason && !finalVerifyFailed) {
+            writeFailure(store, paths, deliveryRefusalFailure(deliveryFailureReason, paths.root));
+        }
+        else if (finalVerifyFailed) {
             writeFailure(store, paths, {
                 phase: "verification",
                 // RunFailure.category is a closed enum; "validation" is the honest
@@ -2112,7 +2328,7 @@ export class Orchestrator {
                     ? "policy"
                     : winnerRun?.errored
                         ? "harness_error"
-                        : status === "exhausted"
+                        : isBudgetTerminal(status)
                             ? "budget"
                             : "internal",
                 harnessId: winnerRun?.errored ? winnerRun.harnessId : undefined,
@@ -2154,7 +2370,11 @@ export class Orchestrator {
             // phase "verification", not "review").
             log.emit("run.blocked", {
                 status,
-                phase: finalVerifyFailed ? "verification" : "review",
+                phase: deliveryFailureReason && !finalVerifyFailed
+                    ? "delivery"
+                    : finalVerifyFailed
+                        ? "verification"
+                        : "review",
                 failure_ref: "final/failure.yaml",
             });
         }
@@ -2181,156 +2401,27 @@ export class Orchestrator {
     }
     /** Single-owner telemetry artifact (final/telemetry.yaml); surfaces project it, never recompute. */
     writeRunTelemetry(store, paths, contract, runId, taskId, mode, attempts, finalAttemptId) {
-        const records = attempts.map((a) => attemptTelemetryRecord(a.attemptId, a.harnessId, a.telemetry));
-        const finalRecord = finalAttemptId
-            ? records.find((r) => r.attempt_id === finalAttemptId)
-            : undefined;
-        const runWeb = finalRecord?.web ?? aggregateRunWebEvidence(records, contract);
-        const telemetry = RunTelemetrySchema.parse({
-            schema_version: SCHEMA_VERSION,
-            run_id: runId,
-            task_id: taskId,
+        writeRunTelemetryArtifact({
+            store,
+            finalDir: paths.finalDir,
+            contract,
+            runId,
+            taskId,
             mode,
-            requested_access: contract.access.requested_profile,
-            effective_access: contract.access.effective_profile,
-            external_context_policy: contract.external_context.policy,
-            effective_web_mode: finalRecord?.web.effective_mode ?? contract.external_context.effective_mode,
-            web_required: contract.external_context.web_required,
-            final_attempt_id: finalAttemptId,
-            web: runWeb,
-            attempts: records,
-            tool_warnings_total: records.reduce((sum, r) => sum + r.outcome.tool_warnings_count, 0),
-            generated_at: nowIso(),
+            attempts,
+            finalAttemptId,
+            resolveAuthPreference: (harnessId) => this.authPreferenceForHarness(contract.repo.root, harnessId, contract.auth_preference),
         });
-        store.writeYaml(join(paths.finalDir, "telemetry.yaml"), telemetry);
     }
     /** Review a set of runs and return their evidence (with finalReviewClean + review_verified caveat). */
-    /**
-     * Deterministic policy findings from the typed diff (no LLM, no regex over
-     * prose): protected-path changes and critical-risk diffs escalate NEEDS_HUMAN;
-     * a high-risk diff without a cross-family panel escalates as well. Each
-     * finding cites the matched files as evidence (BIBLE: evidence beats summaries).
-     */
-    policyFindings(run, reviewVerified, protectedPaths = [], autoProtectedPaths = [], protectedPathApprovals = []) {
-        const stats = diffStats(run.diff);
-        const approvalPatterns = protectedPathApprovals.map((approval) => approval.path);
-        const unapprovedExistingAutoProtectedPaths = stats.existingPaths.filter((path) => !matchAny(path, approvalPatterns));
-        const specProtectedOnly = requireHuman(stats.existingPaths, protectedPaths);
-        const autoProtectedOnly = requireHuman(unapprovedExistingAutoProtectedPaths, autoProtectedPaths);
-        const protectedOnly = {
-            required: specProtectedOnly.required || autoProtectedOnly.required,
-            reasons: [...new Set([...specProtectedOnly.reasons, ...autoProtectedOnly.reasons])],
-            matchedPaths: [
-                ...new Set([...specProtectedOnly.matchedPaths, ...autoProtectedOnly.matchedPaths]),
-            ],
-        };
-        const risk = classifyRisk({
-            changedPaths: stats.paths,
-            additions: stats.additions,
-            deletions: stats.deletions,
-            protectedPaths: protectedOnly.matchedPaths,
-        });
-        const findings = [];
-        const reviewer = {
-            harness_id: "policy",
-            requested_model: null,
-            requested_effort: null,
-            observed_model: null,
-            route_proof_status: "verified",
-        };
-        const evidenceFor = (reasons) => ({
-            files: stats.paths
-                .filter((p) => reasons.some((r) => r.includes(p)))
-                .map((path) => ({ path, lines: null })),
-        });
-        // Structured matched-path evidence (never reconstructed from prose).
-        const evidenceFromPaths = (paths) => ({
-            files: paths.map((path) => ({ path, lines: null })),
-        });
-        const reportedRisk = protectedOnly.required
-            ? {
-                level: "critical",
-                reasons: [...new Set([...risk.reasons, ...protectedOnly.reasons])],
-                matchedPaths: [...new Set([...risk.matchedPaths, ...protectedOnly.matchedPaths])],
-            }
-            : risk;
-        if (protectedOnly.required) {
-            findings.push(ReviewFindingSchema.parse({
-                id: newId("find"),
-                severity: "BLOCK",
-                category: "test_gap",
-                claim: `candidate changed protected path(s): ${protectedOnly.matchedPaths.join(", ")}`,
-                evidence: evidenceFromPaths(protectedOnly.matchedPaths),
-                reviewer,
-                status: "accepted",
-            }));
-        }
-        // Contract protected_paths escalate the human gate only for tampering with
-        // existing protected files. Creating a new test/package file for create or
-        // test-authoring flows is not tamper by itself; built-in critical paths still
-        // apply to all changed paths.
-        const builtInHumanPaths = [...new Set([...stats.paths, ...stats.existingPaths])];
-        const builtInHuman = requireHuman(builtInHumanPaths, DEFAULT_REQUIRE_HUMAN_PATHS);
-        const human = {
-            required: builtInHuman.required || protectedOnly.required,
-            reasons: [...new Set([...builtInHuman.reasons, ...protectedOnly.reasons])],
-            matchedPaths: [...new Set([...builtInHuman.matchedPaths, ...protectedOnly.matchedPaths])],
-        };
-        if (human.required) {
-            findings.push(ReviewFindingSchema.parse({
-                id: newId("find"),
-                severity: "NEEDS_HUMAN",
-                category: "security",
-                claim: `protected-path change requires human approval: ${human.reasons.join("; ")}`,
-                evidence: evidenceFromPaths(human.matchedPaths),
-                reviewer,
-                status: "accepted",
-            }));
-        }
-        const depth = reviewDepthForRisk(reportedRisk.level);
-        if (depth.humanApproval) {
-            findings.push(ReviewFindingSchema.parse({
-                id: newId("find"),
-                severity: "NEEDS_HUMAN",
-                category: "security",
-                claim: `critical-risk diff requires human approval: ${reportedRisk.reasons.join("; ")}`,
-                evidence: reportedRisk.matchedPaths.length > 0
-                    ? evidenceFromPaths(reportedRisk.matchedPaths)
-                    : evidenceFor(reportedRisk.reasons),
-                reviewer,
-                status: "accepted",
-            }));
-        }
-        else if (depth.crossFamily && !reviewVerified) {
-            findings.push(ReviewFindingSchema.parse({
-                id: newId("find"),
-                severity: "NEEDS_HUMAN",
-                category: "architecture",
-                claim: `high-risk diff requires a cross-family review panel (>=2 provider families), which is not available: ${reportedRisk.reasons.join("; ")}`,
-                evidence: reportedRisk.matchedPaths.length > 0
-                    ? evidenceFromPaths(reportedRisk.matchedPaths)
-                    : evidenceFor(reportedRisk.reasons),
-                reviewer,
-                status: "accepted",
-            }));
-        }
-        return {
-            findings,
-            risk: {
-                level: reportedRisk.level,
-                reasons: reportedRisk.reasons,
-                changedFiles: stats.paths.length,
-            },
-        };
-    }
     /**
      * SINGLE funnel for every reviewer-panel invocation: run it inside a per-review
-     * scoped harness HOME (Bible §6) so reviewer children (codex session rollouts,
-     * claude config) never write native state into the operator's real ~/.codex /
-     * ~/.claude. The codex route-proof transcript is read from this same scoped
-     * CODEX_HOME, so cross-family verification is unaffected. Every call site
-     * MUST go through here so the scoping cannot drift. Disposed once the panel
-     * settles (resolve OR reject).
+     * scoped harness HOME (Bible §6) so reviewer scratch state and injected auth
+     * routes do not enter the project or ordinary operator HOME. Native
+     * Codex/Claude routes deliberately keep their vendor-owned host-user stores;
+     * no credential file is copied into the scoped home. Every call site MUST go
+     * through here so the non-native scoping cannot drift. Disposed once the
+     * panel settles (resolve OR reject).
      */
     reviewScoped(input) {
         const reviewHome = new WorkspaceManager(input.cwd).readOnlyHomeEnv();
@@ -2347,7 +2438,7 @@ export class Orchestrator {
             const candidateCwd = run.reviewCwd ?? cwd;
             const candidateEvidenceDir = this.prepareReviewEvidenceDir(reviewDir, candidateCwd);
             try {
-                this.writeTestsEvidence(candidateEvidenceDir, contract, run.gates);
+                writeText(join(candidateEvidenceDir, "TESTS.txt"), renderTestsEvidence(contract, run.gates).trim() + "\n");
                 // a candidate that changed NO files has nothing to review — never
                 // spend a reviewer panel on "(empty diff)" (a trivial greeting in agent mode used to
                 // cost two reviewers). It still flows through policy gates and arbitration
@@ -2360,6 +2451,7 @@ export class Orchestrator {
                         attemptId: run.attemptId,
                         intent: "review",
                         harnessId: "review-panel",
+                        cost: attemptCostEvidence("review-panel", run.attemptId),
                     })
                     : undefined;
                 const result = hasDiff && reviewers.length > 0 && (reviewLease?.granted ?? true)
@@ -2387,7 +2479,7 @@ export class Orchestrator {
                         reviewSpendEstimated: false,
                     };
                 if (reviewLease?.granted) {
-                    ledger?.settle(reviewLease.lease?.lease_id ?? "", result.reviewSpendUsd ?? 0);
+                    ledger?.settle(reviewLease.lease?.lease_id ?? "", usageCostSettlement(result.reviewSpendUsd, result.reviewSpendEstimated, "review-usage", [`attempt:${run.attemptId}`, "review:panel"]));
                     if ((result.reviewSpendUsd ?? 0) > 0) {
                         log.emit("budget.observation", {
                             harness_id: "review-panel",
@@ -2417,7 +2509,7 @@ export class Orchestrator {
                 // Mirrors the convergence path (actualReviewVerified).
                 const candidateReviewVerified = reviewVerified && result.crossFamilyHealthy && result.crossFamilyVerified;
                 // Typed policy gate (risk + protected paths) merges with reviewer findings.
-                const policy = this.policyFindings(run, candidateReviewVerified, contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals);
+                const policy = policyFindings(run, candidateReviewVerified, contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals, contract.constraints.deny_paths);
                 const allFindings = [...policy.findings, ...revalidated];
                 const inconclusive = allFindings.some((f) => f.severity === "INSUFFICIENT_EVIDENCE" || f.status === "insufficient_evidence");
                 const noBlockers = !allFindings.some((f) => isBlocking(f));
@@ -2448,23 +2540,15 @@ export class Orchestrator {
         }
         return evidences;
     }
-    prepareReviewEvidenceDir(sourceDir, candidateCwd) {
-        const targetDir = join(candidateCwd, REVIEW_EVIDENCE_DIRNAME);
-        if (sourceDir === targetDir) {
-            return this.requireReviewEvidence(targetDir);
-        }
+    prepareReviewEvidenceDir(sourceDir, _candidateCwd) {
+        // Evidence is an external runtime artifact. ReviewEngine builds a separate
+        // reviewer workspace and copies the packet there; writing/copying it into
+        // the candidate tree would contaminate the Git diff and, worse, overwrite a
+        // user-owned path with the same name.
         if (!existsSync(sourceDir)) {
             throw new Error(`review evidence preflight failed for ${sourceDir}: source packet missing`);
         }
-        try {
-            rmSync(targetDir, { recursive: true, force: true });
-            cpSync(sourceDir, targetDir, { recursive: true });
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            throw new Error(`review evidence copy into candidate tree failed: ${message}`);
-        }
-        return this.requireReviewEvidence(targetDir);
+        return this.requireReviewEvidence(sourceDir);
     }
     requireReviewEvidence(dir) {
         const result = preflightEvidence(dir);
@@ -2474,20 +2558,9 @@ export class Orchestrator {
         const empty = result.empty.length ? `empty=${result.empty.join(",")}` : "";
         throw new Error(`review evidence preflight failed for ${dir}: ${[missing, empty].filter(Boolean).join(" ")}`);
     }
-    cleanupReviewEvidenceDir(candidateEvidenceDir, candidateCwd) {
-        if (candidateEvidenceDir === join(candidateCwd, REVIEW_EVIDENCE_DIRNAME)) {
-            try {
-                rmSync(candidateEvidenceDir, { recursive: true, force: true });
-            }
-            catch (error) {
-                const detail = error instanceof Error ? error.message : String(error);
-                return {
-                    review_evidence_cleanup: "failed",
-                    candidate_evidence_dir: candidateEvidenceDir,
-                    error: redactSecrets(detail),
-                };
-            }
-        }
+    cleanupReviewEvidenceDir(_candidateEvidenceDir, _candidateCwd) {
+        // No candidate-tree packet exists in v2; external runtime retention is
+        // governed by the artifact/journal lifecycle rather than best-effort rm.
         return null;
     }
     recordReviewEvidenceCleanup(store, metadataPath, attemptId, candidateEvidenceDir, candidateCwd) {
@@ -2521,11 +2594,20 @@ export class Orchestrator {
         const execRoot = this.execRootOf(input);
         const wsm = new WorkspaceManager(execRoot);
         const readiness = new ReadinessLedger();
-        const ledger = new BudgetLedger({ maxUsd: contract.budget.max_usd ?? null });
+        const ledger = this.rootLedger(input, contract, log);
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
         log.emit("run.created", { mode, prompt: redactSecrets(input.prompt) });
-        announce?.({ log, store, paths, runId, taskId, mode, phase: "convergence", spend: () => ledger.spend() });
+        announce?.({
+            log,
+            store,
+            paths,
+            runId,
+            taskId,
+            mode,
+            phase: "convergence",
+            spend: () => ledger.spend(),
+        });
         // Live (in-place) isolation deliberately tolerates non-git stateful
         // environments; only envelope isolation needs the git boundary.
         if (!input.inPlace) {
@@ -2548,7 +2630,7 @@ export class Orchestrator {
         writeEvidencePacket(reviewDir, {
             userIntent: redactSecrets(input.prompt),
             diff: "(per-attempt)\n",
-            tests: this.testsEvidence(contract),
+            tests: renderTestsEvidence(contract),
         });
         const reviewersOutcome = await this.resolveReviewersWithArtifacts(input, log, store, paths, runId, taskId, mode);
         if ("failed" in reviewersOutcome)
@@ -2558,7 +2640,8 @@ export class Orchestrator {
         // One envelope carried forward across attempts so the harness can repair its own work.
         let adapterPool;
         try {
-            adapterPool = await this.resolveCandidateAdapters({ ...input, n: undefined }, this.candidateIntent(input));
+            adapterPool = await this.resolveCandidateAdapters({ ...input, n: undefined }, this.candidateIntent(input), ledger);
+            this.requestRequirements.assertConvergenceWorkspace(input.inPlace === true, adapterPool);
         }
         catch (err) {
             const message = safeErrorMessage(err);
@@ -2655,7 +2738,6 @@ export class Orchestrator {
         const stallThreshold = input.untilClean === true ? 4 : 2;
         const allCooledDown = () => adapterPool.every((a) => ledger.cooldownActive(a.adapter.id));
         const attemptTelemetries = [];
-        const harnessLedgers = new Map();
         let lastDiffStable = true;
         let reviewSpendEstimated = false;
         try {
@@ -2707,12 +2789,12 @@ export class Orchestrator {
                     exhausted = true;
                     break;
                 }
-                // Per-harness max_usd runs through a child ledger that rolls up to the run cap.
-                const lease = this.harnessLedger(harnessLedgers, ledger, routed).reserve({
+                const lease = ledger.reserve({
                     taskId,
                     attemptId,
                     intent: "repair",
                     harnessId: adapter.id,
+                    cost: attemptCostEvidence(adapter.id, attemptId, undefined, this.routeBillingKnowledge(input, adapter.id)),
                 });
                 if (!lease.granted) {
                     exhausted = true;
@@ -2733,11 +2815,10 @@ export class Orchestrator {
                         safeInvoke(input.onHarnessEvent, safeEv);
                         log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv));
                     }, input.signal, undefined, input.effort, "repair", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive), (streamedUsd) => {
-                        const lg = this.harnessLedger(harnessLedgers, ledger, routed);
-                        lg.updateHold(lease.lease?.lease_id ?? "", streamedUsd);
-                        return lg.tier() === "hard";
-                    }, input);
-                    this.harnessLedger(harnessLedgers, ledger, routed).settle(lease.lease?.lease_id ?? "", run.cost);
+                        ledger.updateHold(lease.lease?.lease_id ?? "", streamedUsd);
+                        return ledger.tier() === "hard";
+                    }, input, true);
+                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode));
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
@@ -2749,7 +2830,7 @@ export class Orchestrator {
                 catch (err) {
                     // Envelope/setup failure before the stream; stream errors are absorbed
                     // inside runCandidateInEnvelope with their real accumulated cost.
-                    this.harnessLedger(harnessLedgers, ledger, routed).settle(lease.lease?.lease_id ?? "", 0);
+                    ledger.settle(lease.lease?.lease_id ?? "", unknownCostSettlement("attempt-error"));
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
@@ -2766,7 +2847,7 @@ export class Orchestrator {
                         errored: true,
                         costEstimated: false,
                         errors: [safeErrorMessage(err)],
-                        telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb),
+                        telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb, [routed.browserRequirement, routed.denyRequirement], knobs.model),
                     };
                 }
                 lastRun = run;
@@ -2790,7 +2871,7 @@ export class Orchestrator {
                         const candidateReviewCwd = run.reviewCwd ?? input.repoRoot;
                         const candidateReviewEvidenceDir = this.prepareReviewEvidenceDir(reviewDir, candidateReviewCwd);
                         try {
-                            this.writeTestsEvidence(candidateReviewEvidenceDir, contract, run.gates);
+                            writeText(join(candidateReviewEvidenceDir, "TESTS.txt"), renderTestsEvidence(contract, run.gates).trim() + "\n");
                             // Reviewer panels spend real money in convergence too: reserve before,
                             // settle the observed cost, and surface it as a budget observation
                             // (parity with the race path's reviewRuns metering).
@@ -2800,6 +2881,7 @@ export class Orchestrator {
                                     attemptId,
                                     intent: "review",
                                     harnessId: "review-panel",
+                                    cost: attemptCostEvidence("review-panel", attemptId),
                                 })
                                 : null;
                             const reviewResult = reviewers.length > 0 && (reviewLease?.granted ?? false)
@@ -2826,7 +2908,7 @@ export class Orchestrator {
                                     reviewSpendEstimated: false,
                                 };
                             if (reviewLease?.granted) {
-                                ledger.settle(reviewLease.lease?.lease_id ?? "", reviewResult.reviewSpendUsd ?? 0);
+                                ledger.settle(reviewLease.lease?.lease_id ?? "", usageCostSettlement(reviewResult.reviewSpendUsd, reviewResult.reviewSpendEstimated, "review-usage", [`attempt:${attemptId}`, "review:panel"]));
                                 if ((reviewResult.reviewSpendUsd ?? 0) > 0) {
                                     log.emit("budget.observation", {
                                         harness_id: "review-panel",
@@ -2856,7 +2938,7 @@ export class Orchestrator {
                                 evidenceDir: candidateReviewEvidenceDir,
                             });
                             // Typed policy gate (risk + protected paths) merges with reviewer findings.
-                            const policy = this.policyFindings(run, actualReviewVerified, contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals);
+                            const policy = policyFindings(run, actualReviewVerified, contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals, contract.constraints.deny_paths);
                             const allFindings = [...policy.findings, ...revalidated];
                             lastFindings = allFindings;
                             store.writeYaml(join(paths.reviewsDir, `${attemptId}.yaml`), {
@@ -2994,6 +3076,8 @@ export class Orchestrator {
                     : exhausted
                         ? "exhausted"
                         : "not_converged";
+        if (status === "success" && ledger.terminal() !== null)
+            status = ledger.terminal();
         let decision = null;
         if (lastRun) {
             const arb = arbitrate([
@@ -3027,7 +3111,7 @@ export class Orchestrator {
             lastRun.diff.trim().length > 0 &&
             (status === "success" || status === "ungated") &&
             !input.signal?.aborted) {
-            convFinalVerify = await finalVerifyPatch(execRoot, lastRun, this.gateSpecs(contract), log);
+            convFinalVerify = await finalVerifyPatch(execRoot, lastRun, gateSpecsFromContract(contract), log);
             if (finalVerifyBlocks(convFinalVerify))
                 status = "blocked";
         }
@@ -3036,7 +3120,9 @@ export class Orchestrator {
             // overrides the persisted decision; final_verify is recorded either way.
             decision = {
                 ...decision,
-                ...(status === "blocked" ? blockedDecisionOverride(decision.evidence_facts, convFinalVerify) : {}),
+                ...(status === "blocked"
+                    ? blockedDecisionOverride(decision.evidence_facts, convFinalVerify)
+                    : {}),
                 final_verify: convFinalVerify,
             };
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), decision);
@@ -3058,6 +3144,9 @@ export class Orchestrator {
                     ? "applied"
                     : "applied_review_blocked"
                 : "not_applied";
+            const revertAnchorId = convAdopted === true
+                ? await createRevertAnchorOrNull(execRoot, preTurnSha, lastPostTurnSha)
+                : null;
             store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
                 id: newId("wp"),
                 kind: "patch",
@@ -3065,6 +3154,7 @@ export class Orchestrator {
                 producer_attempt_id: lastRun.attemptId,
                 meta: {
                     harness_id: lastRun.harnessId,
+                    result_kind: "patch",
                     mode,
                     attempts: attempt,
                     status,
@@ -3074,6 +3164,7 @@ export class Orchestrator {
                     apply_state: convApplyState,
                     pre_turn_sha: convAdopted === true ? preTurnSha : null,
                     post_turn_sha: convAdopted === true ? lastPostTurnSha : null,
+                    revert_anchor_id: revertAnchorId,
                 },
             });
             store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: ${status}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}\n`);
@@ -3088,7 +3179,7 @@ export class Orchestrator {
         if (!converged) {
             writeFailure(store, paths, {
                 phase: "convergence",
-                category: status === "exhausted"
+                category: isBudgetTerminal(status)
                     ? "budget"
                     : status === "cancelled"
                         ? "cancelled"
@@ -3204,19 +3295,32 @@ export class Orchestrator {
         const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
         safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
         log.emit("run.created", { mode: "plan", prompt: redactSecrets(input.prompt) });
-        const ledger = new BudgetLedger({ maxUsd: contract.budget.max_usd ?? null });
-        announce?.({ log, store, paths, runId, taskId, mode: "plan", phase: "plan", spend: () => ledger.spend() });
+        const ledger = this.rootLedger(input, contract, log);
+        announce?.({
+            log,
+            store,
+            paths,
+            runId,
+            taskId,
+            mode: "plan",
+            phase: "plan",
+            spend: () => ledger.spend(),
+        });
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         const reviewersOutcome = await this.resolveReviewersWithArtifacts(input, log, store, paths, runId, taskId, "plan");
         if ("failed" in reviewersOutcome)
             return reviewersOutcome.failed;
         const reviewers = reviewersOutcome.reviewers;
+        // W3.3: ONE resolved read-only context — the routing point-probe and every
+        // planner spawn consume the SAME scoped env (see routeContext.ts).
+        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input));
         let adapters;
         try {
-            adapters = await this.resolveCandidateAdapters({ ...input, n: undefined }, "plan");
+            adapters = await this.resolveCandidateAdapters({ ...input, n: undefined }, "plan", ledger, roHome);
         }
         catch (err) {
+            roHome.dispose();
             const message = safeErrorMessage(err);
             store.writeText(join(paths.contextDir, "context_error.md"), `# Routing Error\n\n${message}\n`);
             writeFailure(store, paths, {
@@ -3251,6 +3355,7 @@ export class Orchestrator {
             contextSection = await this.lazyContextSection(input, contract, store, paths, log);
         }
         catch (err) {
+            roHome.dispose();
             const message = safeErrorMessage(err);
             store.writeText(join(paths.contextDir, "context_error.md"), `# Context Error\n\n${message}\n`);
             writeFailure(store, paths, {
@@ -3282,17 +3387,19 @@ export class Orchestrator {
         const plans = [];
         const planAttempts = [];
         const attemptTelemetries = [];
-        // scope the planners' HOME/config dirs so claude-code plan files (and any
-        // native session state) stay inside the run's scoped home, never the
-        // operator's real ~/.claude/plans. Disposed after the planners finish.
-        const roHome = new WorkspaceManager(this.execRootOf(input)).readOnlyHomeEnv();
         try {
             for (const [idx, routed] of adapters.entries()) {
                 if (input.signal?.aborted)
                     break;
                 const adapter = routed.adapter;
                 const attemptId = `p${String(idx + 1).padStart(2, "0")}`;
-                const lease = ledger.reserve({ taskId, attemptId, intent: "plan", harnessId: adapter.id });
+                const lease = ledger.reserve({
+                    taskId,
+                    attemptId,
+                    intent: "plan",
+                    harnessId: adapter.id,
+                    cost: attemptCostEvidence(adapter.id, attemptId, undefined, this.routeBillingKnowledge(input, adapter.id)),
+                });
                 if (!lease.granted) {
                     log.emit("budget.lease.created", {
                         granted: false,
@@ -3313,16 +3420,8 @@ export class Orchestrator {
                     // Planners must SEE any image/file the user attached (e.g. "plan a fix for
                     // what's in this screenshot"), not just agent/race runs.
                     attachments: input.attachments ?? [],
-                    ...this.sessionSpecFields(input, adapter.id),
-                    external_context_policy: knobs.webPolicy,
-                    tool_permission_policy: {
-                        web: knobs.webPolicy,
-                        allow: [...new Set([...contract.tool_permission_policy.allow, ...knobs.toolsAllow])],
-                        deny: [...new Set([...contract.tool_permission_policy.deny, ...knobs.toolsDeny])],
-                    },
-                    model_hint: knobs.model,
-                    effort_hint: knobs.effort,
-                    max_turns: knobs.maxTurns,
+                    ...this.sessionSpecFields(input, adapter.id, log),
+                    ...this.harnessSpecKnobs(contract, knobs, "plan"),
                     env_inheritance: envInheritance(this.config(input.repoRoot)),
                     env: roHome.env,
                 });
@@ -3334,10 +3433,13 @@ export class Orchestrator {
                 if (planInteraction)
                     spec.extra["interactionChannel"] = planInteraction;
                 const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
-                const parts = [];
+                const answer = new AnswerAssembly();
                 const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
                     knobs.webPolicy === "cached" ||
-                    knobs.webPolicy === "live", effectiveWeb);
+                    knobs.webPolicy === "live", effectiveWeb, [], 
+                // Requested-model capture: a plan lane silently downgraded to another
+                // model surfaces the mismatch in its route receipt, just like agent.
+                knobs.model);
                 const onAbort = () => {
                     void adapter.cancel?.(spec.session_id)?.catch(() => { });
                 };
@@ -3348,6 +3450,7 @@ export class Orchestrator {
                         input.signal.addEventListener("abort", onAbort, { once: true });
                 }
                 let cost = 0;
+                let costEstimated = false;
                 let harnessError = null;
                 const budgetSignalState = { quotaPressureDisclosed: false };
                 try {
@@ -3371,23 +3474,29 @@ export class Orchestrator {
                                 break;
                             const safeEv = redactHarnessEvent(ev);
                             safeInvoke(input.onHarnessEvent, safeEv);
-                            // NOT observed for resume: this read-only/plan attempt runs in a
-                            // DISPOSABLE roHome (disposed below), so its native session id is
-                            // unreachable afterwards. Recording it would poison the thread resume
-                            // map with dead ids — the read-side mirror of the agent path's
-                            // `if (inPlaceEnvelope)` guard. Codex-review-confirmed.
+                            // NOT observed for resume: a read-only planner is not a chat turn,
+                            // and attaching its session id would poison thread continuity (and
+                            // race parallel planner/reviewer sessions), regardless of whether
+                            // the vendor stored that session in the scoped or native store.
                             observeAuthSwitch(log, adapter.id, attemptId, safeEv);
                             log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv));
                             appendLine(attemptEventsPath, JSON.stringify(safeEv));
                             observeAttemptTelemetry(telemetry, safeEv);
                             if (safeEv.plan_progress) {
-                                log.emit("plan.progress", { attempt_id: attemptId, harness_id: adapter.id, items: safeEv.plan_progress.items });
+                                log.emit("plan.progress", {
+                                    attempt_id: attemptId,
+                                    harness_id: adapter.id,
+                                    items: safeEv.plan_progress.items,
+                                });
                             }
                             // read-only routes burn quota too (the orchestrate PLANNER is
                             // the loudest) — same single owner as the agent loop.
                             observeBudgetSignals(ledger, log, adapter.id, attemptId, safeEv, budgetSignalState);
+                            this.deps.quotaEventSink?.(adapter.id, safeEv);
                             if (safeEv.type === "usage" && safeEv.usage?.cost_usd) {
                                 cost += safeEv.usage.cost_usd;
+                                if (safeEv.usage.estimated)
+                                    costEstimated = true;
                                 log.emit("budget.observation", {
                                     harness_id: adapter.id,
                                     attempt_id: attemptId,
@@ -3396,11 +3505,8 @@ export class Orchestrator {
                                     estimated: safeEv.usage.estimated === true,
                                 });
                             }
-                            if (safeEv.type === "message" &&
-                                safeEv.text &&
-                                safeEv.payload?.["auth_switched"] !== true) {
-                                pushUniqueText(parts, safeEv.text);
-                            }
+                            // A TYPED final message wins verbatim over joined narration.
+                            answer.observe(safeEv);
                             if (safeEv.type === "error")
                                 harnessError = safeEv.error
                                     ? redactSecrets(safeEv.error)
@@ -3413,7 +3519,7 @@ export class Orchestrator {
                 }
                 finally {
                     input.signal?.removeEventListener("abort", onAbort);
-                    ledger.settle(lease.lease?.lease_id ?? "", cost);
+                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode));
                 }
                 attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
                 const unrecovered = unrecoveredToolErrors(telemetry);
@@ -3443,7 +3549,7 @@ export class Orchestrator {
                     });
                     continue;
                 }
-                const text = parts.join("\n").trim() || "(no output)";
+                const text = answer.text() || "(no output)";
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
                     attempt_id: attemptId,
@@ -3456,7 +3562,7 @@ export class Orchestrator {
             }
         }
         finally {
-            // Planners done (or threw) — always reclaim the scoped home (it may hold seeded creds).
+            // Planners done (or threw) — reclaim scoped scratch/API-route state.
             roHome.dispose();
         }
         if (input.signal?.aborted) {
@@ -3464,7 +3570,7 @@ export class Orchestrator {
                 attemptId: p.attemptId,
                 harnessId: p.harnessId,
                 status: p.status,
-            })), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, "plan", attemptTelemetries, null), ledger.spend());
+            })), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, "plan", attemptTelemetries, null), ledger.spend(), input.signal, store);
         }
         if (plans.length === 0) {
             const blocked = planAttempts.some((p) => p.status === "blocked");
@@ -3523,7 +3629,7 @@ export class Orchestrator {
                 userIntent: redactSecrets(input.prompt),
                 planAccepted: planEvidence,
                 diff: planReviewDiff,
-                tests: this.testsEvidence(contract),
+                tests: renderTestsEvidence(contract),
             });
             // Reserve BEFORE spending: a hard budget tier must stop the paid plan
             // review from starting, not account for it after the fact.
@@ -3532,6 +3638,7 @@ export class Orchestrator {
                 attemptId: "plan-review",
                 intent: "review",
                 harnessId: "review-panel",
+                cost: attemptCostEvidence("review-panel", "plan-review"),
             });
             if (lease.granted) {
                 const res = await this.reviewScoped({
@@ -3555,7 +3662,10 @@ export class Orchestrator {
                     route_proofs: res.routeProofs,
                     reviewer_requests: res.reviewerRequests,
                 });
-                ledger.settle(lease.lease?.lease_id ?? "", res.reviewSpendUsd ?? 0);
+                ledger.settle(lease.lease?.lease_id ?? "", usageCostSettlement(res.reviewSpendUsd, res.reviewSpendEstimated, "review-usage", [
+                    "attempt:plan-review",
+                    "review:panel",
+                ]));
                 if ((res.reviewSpendUsd ?? 0) > 0) {
                     log.emit("budget.observation", {
                         harness_id: "review-panel",
@@ -3579,7 +3689,7 @@ export class Orchestrator {
                 attemptId: p.attemptId,
                 harnessId: p.harnessId,
                 status: p.status,
-            })), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, "plan", attemptTelemetries, null), ledger.spend());
+            })), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, "plan", attemptTelemetries, null), ledger.spend(), input.signal, store);
         }
         const failedPlanners = planAttempts.filter((p) => p.status !== "success");
         // ALL review findings are shown (severity-marked), so a BLOCK like "the
@@ -3690,18 +3800,40 @@ export class Orchestrator {
             defaultPrompt: "audit this repository",
         }, announce);
     }
-    /**
-     * orchestrate: the autonomous planner. NOT a privileged harness — the planner
-     * is routed like reviewers (doctor-ok + `orchestrate` capability + headroom)
-     * and runs READ-ONLY. With default `suggest` autonomy its work product is a
-     * typed orchestration plan over the 6-tool belt (start_run / race / status /
-     * answer_question / apply / review); execution happens as subsequent thread
-     * turns. Degradation contract: any 1 harness works (single-route plan); 2+
-     * harnesses unlock cross-family race/review in the plan space.
-     */
-    /** ONE owner of the per-run USD cap precedence: explicit input -> embedder deps -> operator config. */
-    resolveMaxUsdCap(inputMaxUsd, cfg) {
-        return inputMaxUsd ?? this.deps.maxUsd ?? cfg.global.budget.max_usd_per_run ?? null;
+    resolvePaidBudget(inputBudget, cfg) {
+        return inputBudget ?? this.deps.paidBudget ?? cfg.global.budget.paid_budget_per_run;
+    }
+    rootLedger(input, contract, log) {
+        // A passed-in ledger (orchestrate sub-runs) keeps its OWNER's cash
+        // disclosure — the parent run owns the budget, so its event log gets the
+        // budget.cash events. A fresh root ledger discloses into THIS run's log:
+        // the ledger is the one owner of the cash fact (subscription-entitled
+        // work settles to 0 there), and the UI renders `budget.cash` verbatim —
+        // never inferring money from route labels (W4.3 sol #15).
+        const ledger = input.budgetLedger ??
+            new BudgetLedger(contract.budget.paid_budget, undefined, {
+                onCashSettled: (cashSpendUsd, valuationUsd) => log.emit("budget.cash", {
+                    cash_spend_usd: cashSpendUsd,
+                    valuation_usd: valuationUsd,
+                }),
+            });
+        for (const snapshot of this.deps.quotaSnapshots?.() ?? []) {
+            ledger.observeQuotaSnapshot(snapshot);
+        }
+        return ledger;
+    }
+    routeBillingKnowledge(input, harnessId) {
+        // A selected profile's credential_kind decides billing (round-18 #2).
+        const profileRoute = this.profileAuthRoute(input, harnessId);
+        if (profileRoute)
+            return profileRoute === "api_key" ? "metered" : "unknown";
+        if (input.authPreference === "api_key")
+            return "metered";
+        if (input.authPreference === "subscription")
+            return "unknown";
+        return loadHarnessMetrics(globalConfigDir())[harnessId]?.last_auth_mode === "api_key"
+            ? "metered"
+            : "unknown";
     }
     async runOrchestrate(input, announce) {
         // "Doctor-verified" must mean status ok — degraded key-present routes are
@@ -3715,15 +3847,11 @@ export class Orchestrator {
         // the executor below is its consumer. Default `suggest` (plan-only) preserves
         // the read-only contract when no autonomy is requested.
         const autonomy = input.autonomy ?? "suggest";
-        // The aggregate cap resolves the SAME chain as run(): explicit input ->
-        // orchestrator deps -> operator config default. Without the fallback an
-        // operator's max_usd_per_run capped every sub-run individually but never
-        // the aggregate (R33 finding).
-        const aggregateMaxUsd = this.resolveMaxUsdCap(input.maxUsd, this.config(input.repoRoot));
+        const paidBudget = this.resolvePaidBudget(input.paidBudget, this.config(input.repoRoot));
         const orchestrateContract = OrchestrateContractSchema.parse({
             thread_id: input.threadId ?? newId("th"),
             goal,
-            budget: { max_usd: aggregateMaxUsd, max_tool_calls: input.maxToolCalls ?? null },
+            budget: { paid_budget: paidBudget, max_tool_calls: input.maxToolCalls ?? null },
             autonomy,
         });
         const plannerPrompt = buildOrchestratePlannerPrompt(goal, pool, crossFamily, orchestrateContract);
@@ -3762,8 +3890,17 @@ export class Orchestrator {
         const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
         safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
         log.emit("run.created", { mode: opts.mode, prompt: redactSecrets(prompt) });
-        const ledger = new BudgetLedger({ maxUsd: contract.budget.max_usd ?? null });
-        announce?.({ log, store, paths, runId, taskId, mode: opts.mode, phase: "report", spend: () => ledger.spend() });
+        const ledger = this.rootLedger(input, contract, log);
+        announce?.({
+            log,
+            store,
+            paths,
+            runId,
+            taskId,
+            mode: opts.mode,
+            phase: "report",
+            spend: () => ledger.spend(),
+        });
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         if (opts.orchestrateContract) {
@@ -3814,9 +3951,12 @@ export class Orchestrator {
             : externalContextPolicy === "off"
                 ? 1
                 : Math.min(Math.max(input.n ?? 2, 1), 3);
+        // W3.3: ONE resolved read-only context — the routing point-probe and every
+        // read-only attempt spawn consume the SAME scoped env (see routeContext.ts).
+        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input));
         let adapters;
         try {
-            adapters = await this.resolveCandidateAdapters({ ...input, prompt, n: width }, opts.intent);
+            adapters = await this.resolveCandidateAdapters({ ...input, prompt, n: width }, opts.intent, ledger, roHome);
             if (!opts.swarm) {
                 const seen = new Set();
                 adapters = adapters.filter((routed) => {
@@ -3828,6 +3968,7 @@ export class Orchestrator {
             }
         }
         catch (err) {
+            roHome.dispose();
             const message = safeErrorMessage(err);
             store.writeText(join(paths.contextDir, "context_error.md"), `# Routing Error\n\n${message}\n`);
             writeFailure(store, paths, {
@@ -3855,11 +3996,6 @@ export class Orchestrator {
                 candidates: [],
             };
         }
-        // read-only routes still spawn harness processes that write native
-        // state (plan files, session rollouts). Scope their HOME/config dirs so they
-        // cannot escape into the operator's real ~/.claude, ~/.codex, etc. — the
-        // adapters seed auth into these scoped dirs (§6). Disposed at run end.
-        const roHome = new WorkspaceManager(this.execRootOf(input)).readOnlyHomeEnv();
         const attempts = [];
         const attemptTelemetries = [];
         let fallbackOpen = false;
@@ -3880,6 +4016,7 @@ export class Orchestrator {
                 attemptId,
                 intent: opts.intent,
                 harnessId: adapter.id,
+                cost: attemptCostEvidence(adapter.id, attemptId, undefined, this.routeBillingKnowledge(input, adapter.id)),
             });
             if (!lease.granted) {
                 log.emit("budget.lease.created", {
@@ -3896,11 +4033,11 @@ export class Orchestrator {
             const explorerPrompt = (opts.swarm
                 ? `${prompt}\n\nExplorer ${idx + 1}/${adapters.length}: focus on a distinct slice. Emit evidence-cited findings, explicit unknowns/omissions, and follow-up questions. Do not edit files.`
                 : prompt) + contextSection;
-            const sessionFields = this.sessionSpecFields(input, adapter.id);
+            const sessionFields = this.sessionSpecFields(input, adapter.id, log);
             const grantResume = sessionFields.resume_session_id !== null && !resumeGranted.has(adapter.id);
             if (grantResume)
                 resumeGranted.add(adapter.id);
-            const spec = HarnessRunSpec.parse({
+            let spec = HarnessRunSpec.parse({
                 session_id: newId("ses"),
                 intent: opts.intent,
                 prompt: explorerPrompt,
@@ -3911,16 +4048,9 @@ export class Orchestrator {
                 // the model honestly reported it saw nothing (the v0.13 attachment bug).
                 attachments: input.attachments ?? [],
                 auth_preference: sessionFields.auth_preference,
+                credential_profile: sessionFields.credential_profile,
                 resume_session_id: grantResume ? sessionFields.resume_session_id : null,
-                external_context_policy: knobs.webPolicy,
-                tool_permission_policy: {
-                    web: knobs.webPolicy,
-                    allow: [...new Set([...contract.tool_permission_policy.allow, ...knobs.toolsAllow])],
-                    deny: [...new Set([...contract.tool_permission_policy.deny, ...knobs.toolsDeny])],
-                },
-                model_hint: knobs.model,
-                effort_hint: knobs.effort,
-                max_turns: knobs.maxTurns,
+                ...this.harnessSpecKnobs(contract, knobs, opts.intent),
                 env_inheritance: envInheritance(this.config(input.repoRoot)),
                 env: roHome.env,
                 // Structured output: the orchestrate PLANNER's deliverable IS the
@@ -3944,10 +4074,13 @@ export class Orchestrator {
             if (reportInteraction)
                 spec.extra["interactionChannel"] = reportInteraction;
             const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
-            const parts = [];
+            const answer = new AnswerAssembly();
             const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
                 knobs.webPolicy === "cached" ||
-                knobs.webPolicy === "live", effectiveWeb);
+                knobs.webPolicy === "live", effectiveWeb, [], 
+            // Requested-model capture so ask/audit route receipts detect a silent
+            // model downgrade (typed model_mismatch), not just agent runs.
+            knobs.model);
             const retryPolicy = transientRetryPolicy(this.config(input.repoRoot));
             let activeSessionId = spec.session_id;
             const onAbort = () => {
@@ -3960,8 +4093,10 @@ export class Orchestrator {
                     input.signal.addEventListener("abort", onAbort, { once: true });
             }
             let cost = 0;
+            let costEstimated = false;
             let harnessError = null;
             try {
+                const triedProfiles = new Set(); // W5.4 failover: each profile at most once
                 for (let nativeTry = 0; !input.signal?.aborted; nativeTry += 1) {
                     const runSpec = nativeTry === 0
                         ? spec
@@ -3973,6 +4108,7 @@ export class Orchestrator {
                         });
                     activeSessionId = runSpec.session_id;
                     const transientStart = telemetry.transientFailures.length;
+                    const rateLimitStart = telemetry.rateLimits.length;
                     log.emit("harness.started", {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
@@ -3995,23 +4131,28 @@ export class Orchestrator {
                                 break;
                             const safeEv = redactHarnessEvent(ev);
                             safeInvoke(input.onHarnessEvent, safeEv);
-                            // NOT observed for resume: this read-only/plan attempt runs in a
-                            // DISPOSABLE roHome (disposed below), so its native session id is
-                            // unreachable afterwards. Recording it would poison the thread resume
-                            // map with dead ids — the read-side mirror of the agent path's
-                            // `if (inPlaceEnvelope)` guard. Codex-review-confirmed.
+                            // NOT observed for resume: this read-only attempt is not a chat
+                            // turn. Recording its id would poison thread continuity and can
+                            // race parallel read-only sessions, regardless of storage route.
                             observeAuthSwitch(log, adapter.id, attemptId, safeEv);
                             log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv));
                             appendLine(attemptEventsPath, JSON.stringify(safeEv));
                             observeAttemptTelemetry(telemetry, safeEv);
                             if (safeEv.plan_progress) {
-                                log.emit("plan.progress", { attempt_id: attemptId, harness_id: adapter.id, items: safeEv.plan_progress.items });
+                                log.emit("plan.progress", {
+                                    attempt_id: attemptId,
+                                    harness_id: adapter.id,
+                                    items: safeEv.plan_progress.items,
+                                });
                             }
                             // read-only routes burn quota too (the orchestrate PLANNER is
                             // the loudest) — same single owner as the agent loop.
                             observeBudgetSignals(ledger, log, adapter.id, attemptId, safeEv, budgetSignalState);
+                            this.deps.quotaEventSink?.(adapter.id, safeEv);
                             if (safeEv.type === "usage" && safeEv.usage?.cost_usd) {
                                 cost += safeEv.usage.cost_usd;
+                                if (safeEv.usage.estimated)
+                                    costEstimated = true;
                                 log.emit("budget.observation", {
                                     harness_id: adapter.id,
                                     attempt_id: attemptId,
@@ -4020,11 +4161,8 @@ export class Orchestrator {
                                     estimated: safeEv.usage.estimated === true,
                                 });
                             }
-                            if (safeEv.type === "message" &&
-                                safeEv.text &&
-                                safeEv.payload?.["auth_switched"] !== true) {
-                                pushUniqueText(parts, safeEv.text);
-                            }
+                            // A TYPED final message wins verbatim over joined narration.
+                            answer.observe(safeEv);
                             if (safeEv.type === "error")
                                 harnessError = safeEv.error
                                     ? redactSecrets(safeEv.error)
@@ -4036,7 +4174,32 @@ export class Orchestrator {
                     }
                     const transient = telemetry.transientFailures.at(-1) ?? null;
                     const sawTransient = telemetry.transientFailures.length > transientStart;
-                    const reportSoFar = parts.join("\n").trim();
+                    const sawTypedLimit = telemetry.rateLimits.length > rateLimitStart;
+                    const reportSoFar = answer.text();
+                    // W5.4 reactive failover, READ-ONLY lane (same contract as the
+                    // candidate lane; typed limits only, never plain transients).
+                    if (harnessError && !input.signal?.aborted) {
+                        const rotated = rotateSpecOnTypedLimit({
+                            spec,
+                            harnessId: adapter.id,
+                            attemptId,
+                            policy: this.profilePolicy(input.repoRoot, adapter.id),
+                            registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
+                            snapshots: this.deps.quotaSnapshots?.() ?? [],
+                            triedProfiles,
+                            sawTypedLimit,
+                            deliverableEmpty: reportSoFar.length === 0,
+                            lastLimit: telemetry.rateLimits.at(-1) ?? null,
+                            emit: (type, payload) => log.emit(type, payload),
+                            newSessionId: () => newId("ses"),
+                            defaultRouteWasVendorNative: routed.authRouteEstimate === "local_session",
+                        });
+                        if (rotated) {
+                            spec = rotated;
+                            harnessError = null;
+                            continue;
+                        }
+                    }
                     if (!harnessError ||
                         !sawTransient ||
                         reportSoFar.length > 0 ||
@@ -4063,7 +4226,7 @@ export class Orchestrator {
             }
             finally {
                 input.signal?.removeEventListener("abort", onAbort);
-                ledger.settle(lease.lease?.lease_id ?? "", cost);
+                ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode));
             }
             if (harnessError && telemetry.transientFailures.length > 0) {
                 log.emit("route.transient.exhausted", {
@@ -4073,7 +4236,7 @@ export class Orchestrator {
                 });
             }
             attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
-            const report = redactSecrets(parts.join("\n").trim());
+            const report = redactSecrets(answer.text());
             const unrecovered = unrecoveredToolErrors(telemetry);
             const webBlocked = webUnsatisfied(telemetry);
             const deliverablePresent = report.length > 0;
@@ -4213,8 +4376,8 @@ export class Orchestrator {
             }
         }
         finally {
-            // All read-only attempts done (or threw) — reclaim the scoped harness home
-            // (it contained every native write for this run and may hold seeded creds).
+            // All read-only attempts done (or threw) — reclaim scoped scratch and
+            // injected API-route state. Vendor-owned native credentials were not copied.
             roHome.dispose();
         }
         if (input.signal?.aborted) {
@@ -4222,7 +4385,7 @@ export class Orchestrator {
                 attemptId: a.attemptId,
                 harnessId: a.harnessId,
                 status: a.status,
-            })), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null), ledger.spend());
+            })), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null), ledger.spend(), input.signal, store);
         }
         const succeededReadonly = attempts.filter((a) => a.status === "success");
         if (!opts.swarm && succeededReadonly.length === 0) {
@@ -4377,6 +4540,18 @@ export class Orchestrator {
             ].join("\n")
             : (succeeded[0]?.report ?? "(no output)");
         store.writeText(join(paths.finalDir, opts.artifactName), `# ${opts.title}\n\n${report}\n`);
+        // ask is the only read-only strategy that can carry a structured-output
+        // contract (the boundary refuses the rest); validate the RAW answer text,
+        // not the titled artifact wrapper.
+        if (opts.mode === "ask" && contract.output_schema) {
+            finalizeStructuredOutput({
+                store,
+                finalDir: paths.finalDir,
+                log,
+                schema: contract.output_schema,
+                answerText: succeeded[0]?.report ?? "",
+            });
+        }
         // orchestrate: the planner's plan is a TYPED artifact, not just prose. Extract
         // the required fenced JSON block, validate it against the tool belt, and
         // persist final/orchestration.yaml; a missing/invalid block is disclosed in
@@ -4436,6 +4611,10 @@ export class Orchestrator {
         // terminal outcome (success / blocked / failed) becomes the run's terminal.
         const autonomy = opts.orchestrateContract?.autonomy ?? input.autonomy ?? "suggest";
         let terminal = "success";
+        let orchestrateReadOnly = true;
+        let orchestrateReceiptRefs = [];
+        if (ledger.terminal() !== null)
+            terminal = ledger.terminal();
         // orchestrate's contract output IS the typed plan. If the planner failed to
         // produce a valid one, the run is NOT a clean success — disclose it honestly
         // (the markdown plan stays as a diagnostic artifact) rather than reporting
@@ -4446,11 +4625,22 @@ export class Orchestrator {
             // Thread the GENERATED runId onto input so the executor's answer_question
             // step keys the interaction registry by this orchestrate run's id (callers
             // often invoke run() without a preassigned runId).
-            const exec = await this.executeOrchestratePlan({ ...input, runId }, orchestratePlan, autonomy, opts.orchestrateContract ?? null, store, paths, log, 
-            // The PLANNER's own settled spend counts against the same cap: the
-            // aggregate must start from it, not from zero (completeness).
-            ledger.spend());
+            const executionInput = { ...input, runId };
+            const exec = await executeOrchestratePlan({
+                plan: orchestratePlan,
+                autonomy,
+                maxToolCalls: opts.orchestrateContract?.budget.max_tool_calls ?? null,
+                signal: input.signal,
+                store,
+                paths,
+                log,
+                ledger,
+                executeSafeStep: (call) => this.executeSafeStep(executionInput, call, log, store, paths, ledger),
+                executeApplyStep: (call) => this.executeApplyStep(executionInput, call, log),
+            });
             terminal = exec.terminal;
+            orchestrateReadOnly = exec.readOnly;
+            orchestrateReceiptRefs = exec.receiptRefs;
             typedPlanNote += `\n- Executor (${autonomy}): ${exec.note}`;
         }
         const harnessLabel = attempts
@@ -4462,69 +4652,32 @@ export class Orchestrator {
             kind: "report",
             source_task_id: taskId,
             producer_attempt_id: succeeded[0]?.attemptId ?? "a01",
-            files: { [opts.artifactName]: join(paths.finalDir, opts.artifactName) },
+            files: Object.fromEntries([
+                [opts.artifactName, join(paths.finalDir, opts.artifactName)],
+                ...orchestrateReceiptRefs.map((ref, index) => [`delivery_receipt_${index + 1}`, ref]),
+            ]),
             meta: {
                 harnesses: attempts.map((a) => a.harnessId),
                 mode: opts.mode,
                 intent: opts.intent,
-                read_only: true,
+                read_only: orchestrateReadOnly,
             },
         });
         log.emit("work_product.emitted", { kind: "report", winner: succeeded[0]?.attemptId ?? null });
-        if (terminal === "blocked") {
-            writeFailure(store, paths, {
-                phase: "executor",
-                category: "policy",
-                safeMessage: "orchestrate executor stopped at a risky step (apply) under auto_safe; awaiting a human decision",
-                runDir: paths.root,
-                nextActions: [
-                    "Review the proposed apply",
-                    "Approve via the run decision endpoint",
-                    "Re-run with auto_full to apply automatically",
-                ],
-            });
+        const orchestrateFailure = orchestrateFailureFor(terminal);
+        if (terminal === "blocked" && orchestrateFailure) {
+            writeFailure(store, paths, { ...orchestrateFailure, runDir: paths.root });
             log.emit("run.blocked", {
                 status: terminal,
-                phase: "executor",
+                phase: orchestrateFailure.phase,
                 failure_ref: "final/failure.yaml",
             });
         }
-        else if (terminal === "failed") {
-            writeFailure(store, paths, {
-                phase: "executor",
-                category: "internal",
-                safeMessage: "orchestrate executor failed: a safe step errored fatally (see final/orchestration_progress.yaml)",
-                runDir: paths.root,
-                nextActions: [
-                    "Inspect final/orchestration_progress.yaml",
-                    "Open the failed sub-run",
-                    "Re-run after the cause is fixed",
-                ],
-            });
-            log.emit("run.failed", {
-                status: terminal,
-                phase: "executor",
-                failure_ref: "final/failure.yaml",
-            });
-        }
-        else if (terminal === "not_converged") {
-            // Orchestrate's typed-plan contract failed (the planner produced no valid
-            // plan): a failure-shaped terminal with artifacts, never run.completed —
-            // jobs.json and events.jsonl must agree the run did not converge.
-            writeFailure(store, paths, {
-                phase: "plan",
-                category: "harness_error",
-                safeMessage: "orchestrate planner produced no valid typed plan (see final/orchestration_parse_error.md); the markdown report is diagnostic only",
-                runDir: paths.root,
-                nextActions: [
-                    "Inspect final/orchestration_parse_error.md",
-                    "Re-run orchestrate",
-                    "Check the planner harness doctor status",
-                ],
-            });
+        else if (orchestrateFailure) {
+            writeFailure(store, paths, { ...orchestrateFailure, runDir: paths.root });
             log.emit("run.failed", {
                 status: terminal,
-                phase: "plan",
+                phase: orchestrateFailure.phase,
                 failure_ref: "final/failure.yaml",
             });
         }
@@ -4534,26 +4687,6 @@ export class Orchestrator {
             // mistake an operator abort for a clean report.
             log.emit("run.failed", { status: terminal });
         }
-        else if (terminal === "exhausted") {
-            // A budget-truncated plan is failure-shaped: skipped steps mean the
-            // goal was NOT met — `claudexor follow` and jobs.json must not read a
-            // cut-short auto_full run as a clean success (exit 0).
-            writeFailure(store, paths, {
-                phase: "executor",
-                category: "budget",
-                safeMessage: "orchestrate executor exhausted its budget before completing the plan (see final/orchestration_progress.yaml for the skipped steps)",
-                runDir: paths.root,
-                nextActions: [
-                    "Inspect final/orchestration_progress.yaml",
-                    "Re-run with a higher --max-usd / --max-tool-calls",
-                ],
-            });
-            log.emit("run.failed", {
-                status: terminal,
-                phase: "executor",
-                failure_ref: "final/failure.yaml",
-            });
-        }
         else {
             log.emit("run.completed", { status: terminal });
         }
@@ -4573,190 +4706,20 @@ export class Orchestrator {
             })),
         };
     }
-    /**
-     * Execute a typed orchestration plan under auto_safe / auto_full. Runs the
-     * tool_calls IN ORDER, classifying each via toolRisk (FAIL-CLOSED). Persists
-     * final/orchestration_progress.yaml and emits progress events. Returns the
-     * executor's terminal status (success / blocked / failed) and a short note.
-     *
-     * SAFETY INVARIANTS (see CLAUDEXOR doctrine):
-     *  1. A SAFE step NEVER mutates the live tree: start_run/race run as isolated
-     *     ENVELOPE sub-runs (inPlace=false, asserted), review/status/answer are reads.
-     *  2. Risk is fail-closed (toolRisk): any unknown/undeclared tool is risky.
-     *  3. auto_safe STOPS at the first risky step (apply) without executing it; the
-     *     run ends `blocked` awaiting a human decision.
-     *  4. answer_question / status / review are read-only w.r.t. the tree.
-     */
-    async executeOrchestratePlan(input, plan, autonomy, contract, store, paths, log, brainSpentUsd = 0) {
-        const maxToolCalls = contract?.budget.max_tool_calls ?? null;
-        // The RESOLVED aggregate cap (input -> deps -> operator config) rides the
-        // contract; raw input.maxUsd alone would ignore the config default.
-        const aggregateMaxUsd = contract?.budget.max_usd ?? input.maxUsd ?? null;
-        const steps = plan.tool_calls.map((call, index) => ({
-            index,
-            tool: call.tool,
-            risk: toolRisk(call.tool),
-            status: "pending",
-            run_id: null,
-            detail: null,
-        }));
-        let stoppedReason = null;
-        let terminal = "success";
-        const persist = () => {
-            const progress = { steps, autonomy, stopped_reason: stoppedReason };
-            store.writeYaml(join(paths.finalDir, "orchestration_progress.yaml"), progress);
-        };
-        persist();
-        log.emit("output.ready", { kind: "report", path: "final/orchestration_progress.yaml" });
-        let executed = 0;
-        // Aggregate budget: the planner's own spend plus every sub-run share
-        // ONE cap. Each sequential sub-run gets the REMAINING headroom (cap minus
-        // settled spend so far) — never the full cap again per step.
-        let aggregateSpentUsd = brainSpentUsd;
-        for (let i = 0; i < plan.tool_calls.length; i++) {
-            const call = plan.tool_calls[i];
-            const step = steps[i];
-            // Honor input.signal abort: stop, mark remaining steps skipped.
-            if (input.signal?.aborted) {
-                step.status = "skipped";
-                step.detail = "run cancelled before this step";
-                stoppedReason = "cancelled";
-                terminal = "cancelled";
-                persist();
-                break;
-            }
-            // Aggregate USD cap: stop before a step that has no headroom left.
-            if (aggregateMaxUsd !== null && aggregateSpentUsd >= aggregateMaxUsd) {
-                step.status = "skipped";
-                step.detail = `aggregate budget exhausted (${aggregateSpentUsd.toFixed(2)} of ${aggregateMaxUsd} USD spent)`;
-                stoppedReason = `aggregate budget exhausted after ${executed} step(s)`;
-                terminal = "exhausted";
-                persist();
-                break;
-            }
-            // Honor the budget cap on tool calls (count attempted executions).
-            // Same honesty as the USD cap: a plan cut short by a budget knob ends
-            // `exhausted`, never a quiet "success" whose note miscounts the steps.
-            if (maxToolCalls !== null && executed >= maxToolCalls) {
-                step.status = "skipped";
-                step.detail = `budget max_tool_calls=${maxToolCalls} reached`;
-                stoppedReason = `budget max_tool_calls=${maxToolCalls} reached after ${executed} step(s)`;
-                terminal = "exhausted";
-                persist();
-                break;
-            }
-            const risk = toolRisk(call.tool);
-            // RISKY step (apply, or any fail-closed-risky tool).
-            if (risk === "risky") {
-                if (autonomy === "auto_safe") {
-                    // STOP: do not execute the risky step; block awaiting a human decision.
-                    step.status = "blocked";
-                    step.detail = "risky step requires human approval (auto_safe)";
-                    stoppedReason = `blocked at risky step #${i} (${call.tool}) under auto_safe`;
-                    terminal = "blocked";
-                    log.emit("orchestrate.step.blocked", { index: i, tool: call.tool, autonomy });
-                    persist();
-                    break;
-                }
-                // auto_full: execute the risky step (apply) via the single gate.
-                step.status = "running";
-                persist();
-                executed++;
-                try {
-                    const r = await this.executeApplyStep(input, call);
-                    step.status = r.ok ? "done" : "failed";
-                    step.run_id = r.runId;
-                    step.detail = r.detail;
-                    log.emit("orchestrate.step.done", {
-                        index: i,
-                        tool: call.tool,
-                        ok: r.ok,
-                        run_id: r.runId,
-                    });
-                    if (!r.ok) {
-                        terminal = "failed";
-                        stoppedReason = `apply step #${i} failed: ${r.detail}`;
-                        persist();
-                        break;
-                    }
-                }
-                catch (err) {
-                    step.status = "failed";
-                    step.detail = safeErrorMessage(err);
-                    terminal = "failed";
-                    stoppedReason = `apply step #${i} threw: ${safeErrorMessage(err)}`;
-                    persist();
-                    break;
-                }
-                persist();
-                continue;
-            }
-            // SAFE step: execute as an isolated sub-run / pure read.
-            step.status = "running";
-            persist();
-            executed++;
-            try {
-                const remainingUsd = aggregateMaxUsd === null ? null : Math.max(0, aggregateMaxUsd - aggregateSpentUsd);
-                const r = await this.executeSafeStep(input, call, log, store, paths, remainingUsd);
-                aggregateSpentUsd += r.spendUsd ?? 0;
-                step.status = r.status;
-                step.run_id = r.runId;
-                step.detail = r.detail;
-                log.emit("orchestrate.step.done", {
-                    index: i,
-                    tool: call.tool,
-                    status: r.status,
-                    run_id: r.runId,
-                });
-                if (r.status === "failed") {
-                    terminal = "failed";
-                    stoppedReason = `safe step #${i} (${call.tool}) errored: ${r.detail}`;
-                    persist();
-                    break;
-                }
-            }
-            catch (err) {
-                step.status = "failed";
-                step.detail = safeErrorMessage(err);
-                terminal = "failed";
-                stoppedReason = `safe step #${i} (${call.tool}) threw: ${safeErrorMessage(err)}`;
-                persist();
-                break;
-            }
-            persist();
-        }
-        // A FINAL step can overspend its remaining headroom (spend is charged
-        // after the step; no later pre-step check exists to trip). An overshot
-        // cap must not read "success — all steps done".
-        if (terminal === "success" && aggregateMaxUsd !== null && aggregateSpentUsd > aggregateMaxUsd) {
-            terminal = "exhausted";
-            stoppedReason = `aggregate budget overshot on the final step (${aggregateSpentUsd.toFixed(2)} of ${aggregateMaxUsd} USD)`;
-        }
-        persist();
-        const done = steps.filter((s) => s.status === "done").length;
-        const note = terminal === "blocked"
-            ? `blocked at a risky step (${done}/${steps.length} safe steps done)`
-            : terminal === "failed"
-                ? `failed (${done}/${steps.length} steps done; ${stoppedReason ?? "see progress"})`
-                : terminal === "cancelled"
-                    ? `cancelled (${done}/${steps.length} steps done)`
-                    : terminal === "exhausted"
-                        ? `budget exhausted (${done}/${steps.length} steps done; ${stoppedReason ?? "see progress"})`
-                        : `all ${done}/${steps.length} steps done`;
-        return { terminal, note };
-    }
     /**
      * Run one SAFE plan step. start_run/race spawn ISOLATED ENVELOPE sub-runs
      * (inPlace=false, ASSERTED); review/status/answer_question are pure reads /
      * answer delivery that never mutate the live tree.
      */
-    async executeSafeStep(input, call, log, store, paths, remainingUsd) {
+    async executeSafeStep(input, call, log, store, paths, ledger) {
         switch (call.tool) {
             case "start_run":
             case "race": {
                 // Isolated envelope sub-run (construction owned by runSupport);
                 // recursion guard via orchestrateDepth+1, may NOT orchestrate.
-                const subInput = { ...buildEnvelopeSubInput(input, call, remainingUsd) };
+                const subInput = {
+                    ...buildEnvelopeSubInput(input, call, ledger),
+                };
                 // SAFETY INVARIANT 1 (asserted, not convention): a safe sub-run is an
                 // isolated envelope — never a live in-place turn.
                 assertEnvelopeSubRun(subInput);
@@ -4768,6 +4731,9 @@ export class Orchestrator {
                 const res = await this.run(subInput);
                 return {
                     status: res.status === "failed" || res.status === "cancelled" ? "failed" : "done",
+                    terminalStatus: res.status,
+                    terminalSource: "subrun",
+                    evidenceRefs: [`run:${res.runId}`],
                     runId: res.runId,
                     spendUsd: res.spendUsd ?? null,
                     detail: `${call.tool} sub-run ${res.runId} -> ${res.status}`,
@@ -4778,8 +4744,11 @@ export class Orchestrator {
                 const read = readRunStatus(input.repoRoot, call.run_id);
                 return {
                     status: read ? "done" : "skipped",
+                    terminalStatus: read?.status ?? null,
+                    terminalSource: "subrun",
+                    evidenceRefs: read?.evidenceRefs ?? [],
                     runId: call.run_id,
-                    detail: read ?? `run ${call.run_id} has no readable status artifacts`,
+                    detail: read?.detail ?? `run ${call.run_id} has no readable status artifacts`,
                 };
             }
             case "review": {
@@ -4791,15 +4760,21 @@ export class Orchestrator {
                 if (diff === null)
                     return {
                         status: "skipped",
+                        terminalStatus: null,
+                        terminalSource: "review",
+                        evidenceRefs: [],
                         runId: call.run_id,
                         detail: `run ${call.run_id} has no patch.diff to review`,
                     };
                 // Aggregate honesty: reviewer panels spend real money on
                 // API-keyed routes and the spend is charged AFTER the fact — with no
                 // remaining headroom the review must not start at all.
-                if (remainingUsd !== null && remainingUsd <= 0) {
+                if (ledger.terminal() !== null) {
                     return {
                         status: "skipped",
+                        terminalStatus: null,
+                        terminalSource: "review",
+                        evidenceRefs: [],
                         runId: call.run_id,
                         detail: "aggregate budget exhausted before the review step",
                     };
@@ -4808,9 +4783,28 @@ export class Orchestrator {
                 if (reviewers.length === 0)
                     return {
                         status: "skipped",
+                        terminalStatus: null,
+                        terminalSource: "review",
+                        evidenceRefs: [],
                         runId: call.run_id,
                         detail: "no doctor-OK reviewers available",
                     };
+                const reviewLease = ledger.reserve({
+                    taskId: input.taskId ?? "orchestrate",
+                    attemptId: `review-${call.run_id}`,
+                    intent: "review",
+                    harnessId: "review-panel",
+                    cost: attemptCostEvidence("review-panel", `review-${call.run_id}`),
+                });
+                if (!reviewLease.granted)
+                    return {
+                        status: "skipped",
+                        terminalStatus: ledger.terminal(),
+                        terminalSource: "review",
+                        evidenceRefs: [],
+                        runId: call.run_id,
+                        detail: reviewLease.reason ?? "root paid budget refused the review step",
+                    };
                 const evidenceDir = join(paths.reviewsDir, `orchestrate-${call.run_id}`, "evidence");
                 writeEvidencePacket(evidenceDir, {
                     userIntent: redactSecrets(input.prompt),
@@ -4829,7 +4823,13 @@ export class Orchestrator {
                     envInheritance: envInheritance(this.config(input.repoRoot)),
                     signal: input.signal,
                     onReviewerEvent: (event) => log.emit(event.type, { ...event }),
+                }).catch((error) => {
+                    ledger.settle(reviewLease.lease?.lease_id ?? "", unknownCostSettlement("review-error"));
+                    throw error;
                 });
+                ledger.settle(reviewLease.lease?.lease_id ?? "", usageCostSettlement(result.reviewSpendUsd, result.reviewSpendEstimated, "review-usage", [
+                    `orchestrate:review:${call.run_id}`,
+                ]));
                 const revalidated = await revalidateFindings(result.findings, {
                     candidateRoot: input.repoRoot,
                     evidenceDir,
@@ -4844,6 +4844,9 @@ export class Orchestrator {
                 const blockers = revalidated.filter((f) => isBlocking(f)).length;
                 return {
                     status: "done",
+                    terminalStatus: result.crossFamilyVerified && blockers === 0 ? "success" : "blocked",
+                    terminalSource: "review",
+                    evidenceRefs: [`reviews/orchestrate-${call.run_id}.yaml`],
                     runId: call.run_id,
                     detail: `reviewed ${call.run_id}: ${result.distinctProviders.length} family(ies), ${revalidated.length} finding(s), ${blockers} blocker(s)`,
                     // Reviewer panels can spend real money on API-keyed routes; the
@@ -4853,7 +4856,13 @@ export class Orchestrator {
             }
             case "answer_question": {
                 // Delivery + registry-keying rationale owned by runSupport.
-                return deliverPlanAnswer(input, call);
+                const answer = await deliverPlanAnswer(input, call);
+                return {
+                    ...answer,
+                    terminalStatus: answer.status === "done" ? "success" : null,
+                    terminalSource: "executor",
+                    evidenceRefs: [],
+                };
             }
             default: {
                 // FAIL-CLOSED: a risky tool (apply) must never reach the safe executor;
@@ -4862,13 +4871,8 @@ export class Orchestrator {
             }
         }
     }
-    /**
-     * Execute a RISKY `apply` step (auto_full only) through the SINGLE existing
-     * apply gate (`validateApplyGate`) + `deliver` — the same path
-     * accept_clean_patch uses. Reads the referenced run's patch + work_product +
-     * decision artifacts; refuses unless the gate passes.
-     */
-    async executeApplyStep(input, call) {
+    /** Execute an auto_full apply through the shared fresh-verification gate. */
+    async executeApplyStep(input, call, log) {
         const store = new ArtifactStore(input.repoRoot);
         const sub = store.runPaths(call.run_id);
         const patchPath = join(sub.finalDir, "patch.diff");
@@ -4877,25 +4881,29 @@ export class Orchestrator {
             return {
                 ok: false,
                 runId: call.run_id,
-                detail: `run ${call.run_id} has no patch.diff to apply`,
+                detail: `run ${call.run_id} has no patch.diff`,
+                receipt: null,
             };
         if (containsSecretLikeToken(patchText))
             return {
                 ok: false,
                 runId: call.run_id,
                 detail: "patch contains a secret-like token; refusing apply",
+                receipt: null,
             };
         const decision = store.readYaml(join(sub.arbitrationDir, "decision.yaml"));
         const workProduct = store.readYaml(join(sub.finalDir, "work_product.yaml"));
+        const taskContract = TaskContractSchema.safeParse(store.readYaml(join(sub.contextDir, "task.yaml")));
         const parsedDecision = decision ? DecisionRecordSchema.safeParse(decision) : null;
         const parsedWp = workProduct ? WorkProductSchema.safeParse(workProduct) : null;
-        // The referenced run's recorded original project IS this orchestrate run's
-        // repoRoot (sub-runs were spawned against it); the gate re-verifies identity.
-        const gateError = validateApplyGate({
-            // Artifact-only path (we read the referenced run's decision/work_product
-            // from disk, not a live daemon job): pass state=null and let the gate's
-            // decision.status check be the terminal-state guard. Hardcoding "succeeded"
-            // would silently bypass that check if it were ever relaxed.
+        if (!taskContract.success)
+            return {
+                ok: false,
+                runId: call.run_id,
+                detail: "fresh verification contract is missing",
+                receipt: null,
+            };
+        const applyGateInput = {
             state: null,
             decision: parsedDecision?.success ? parsedDecision.data : null,
             workProduct: parsedWp?.success ? parsedWp.data : null,
@@ -4903,16 +4911,23 @@ export class Orchestrator {
             originalRepoRoot: input.repoRoot,
             targetRepoRoot: input.repoRoot,
             operatorDecision: null,
-        });
+        };
+        const gateError = validateApplyGate(applyGateInput);
         if (gateError)
-            return { ok: false, runId: call.run_id, detail: `apply gate refused: ${gateError}` };
-        const delivered = await deliver(input.repoRoot, patchText, { mode: call.mode });
+            return {
+                ok: false,
+                runId: call.run_id,
+                detail: `apply gate refused: ${gateError}`,
+                receipt: null,
+            };
+        const delivered = await verifyAndDeliver(input.repoRoot, patchText, { mode: call.mode }, gateSpecsFromContract(taskContract.data), (finalVerify) => validateApplyGate({ ...applyGateInput, finalVerify }), log);
         return {
             ok: delivered.applied,
             runId: call.run_id,
             detail: delivered.applied
                 ? `applied (${call.mode})`
                 : `deliver failed: ${delivered.detail ?? "unknown"}`,
+            receipt: delivered,
         };
     }
 }