@claudexor/orchestrator 2.1.2 → 3.0.0

package/dist/orchestrator.js

@@ -1,23 +1,25 @@
-import { existsSync, readFileSync } from "node:fs";
-import { observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, } from "./credential-profiles.js";
+import { existsSync } from "node:fs";
+import { observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, selectedProfileAvailability, } from "./credential-profiles.js";
 import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
+import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
+import { processAttemptUsage } from "./attemptUsage.js";
+import { toCandidateEvidence } from "./candidateEvidence.js";
 import { capabilityIntents } from "@claudexor/gateway";
 import { policyFindings } from "./policyFindings.js";
 import { join } from "node:path";
-import { HarnessRunSpec, OrchestrateContract as OrchestrateContractSchema, DecisionRecord as DecisionRecordSchema, WorkProduct as WorkProductSchema, SessionReboundLineage as SessionReboundLineageSchema, SpecPack as SpecPackZ, ModeKind as ModeKindSchema, SCHEMA_VERSION, TRUST_FULL_ACCESS_CODE, FrozenTaskContractArtifact as TaskContractSchema, isBlocking, orchestratePlanJsonSchema, normalizeUserOutputSchema, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
+import { finalizePlanRun, runCouncilPlan, writePlanHarnessFailure, } from "./planRun.js";
+import { HarnessRunSpec, ModeKind as ModeKindSchema, SCHEMA_VERSION, TRUST_FULL_ACCESS_CODE, FrozenTaskContractArtifact as TaskContractSchema, isBlocking, makeOutcomeFacts, normalizeUserOutputSchema, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
 import { globalConfigDir, loadConfig, trustConfigPath } from "@claudexor/config";
-import { specPackToTaskContract } from "@claudexor/interview";
-import { AnswerAssembly, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
+import { AnswerAssembly, CLAUDEXOR_ARTIFACT_DIR, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
 import { assertRouteModelsAllowed } from "./modelGovernance.js";
 import { RequestRequirementsResolver } from "./requestRequirements.js";
 import { cancelledResult, failTerminally, guardAnnouncedRun, writeFailure, } from "./runTerminals.js";
 import { assertOutputSchemaCompiles, finalizeStructuredOutput } from "./structuredOutput.js";
-import { transientRetryDelayMs, promptWithProtectedPathConstraint, sleep, redactHarnessEvent, harnessEventPayload, formatFindings, renderSummary, readRunPatch, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, buildEnvelopeSubInput, deliverPlanAnswer, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, relayPriorPlansSection, deliveryRefusalFailure, writeRaceDeliveryDecision, } from "./runSupport.js";
+import { transientRetryDelayMs, promptWithProtectedPathConstraint, sleep, redactHarnessEvent, harnessEventPayload, formatFindings, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, deliveryRefusalFailure, writeRaceDeliveryDecision, } from "./runSupport.js";
 import { candidateStatusInRouteContext, resolveReadOnlyRouteContext, } from "./routeContext.js";
 import { resolveAutoReviewerPanel, resolveExplicitReviewerPanel } from "./reviewerPanel.js";
-import { buildOrchestratePlannerPrompt, extractOrchestratePlan } from "./orchestratePlanner.js";
-import { orchestrateFailureFor, readRunStatus } from "./outcomeReducer.js";
-import { executeOrchestratePlan, } from "./orchestrateExecutor.js";
+import { buildContinuation, } from "./continuity.js";
+import { activePlanPointer, resolveContinuitySummary, workspaceAnchor, } from "./continuity-facts.js";
 import { runDiffReview } from "./diffReview.js";
 import { createAttemptTelemetry, observeAttemptTelemetry, setAttemptOutcome, telemetrySummary, toolWarnings, unrecoveredToolErrors, webUnsatisfied, } from "./attemptTelemetry.js";
 import { interactionChannelFor } from "./interaction.js";
@@ -26,34 +28,26 @@ import { ArtifactStore } from "@claudexor/artifact-store";
 import { EventLog } from "@claudexor/event-log";
 import { assertMandatoryContext, buildContextPack, rawContextForEnvelope, preflightEvidence, writeEvidencePacket, } from "@claudexor/context";
 import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, ensureGitRepository, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
-import { blockedDecisionOverride, finalVerifyBlocks, finalVerifyPatch, validateApplyGate, verifyAndDeliver, } from "@claudexor/delivery";
+import { blockedDecisionOverride, finalVerifyBlocks, finalVerifyPatch, verifyAndDeliver, } from "@claudexor/delivery";
 import { HarnessGateway } from "@claudexor/gateway";
 import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, reviewCandidate, revalidateFindings, runGates, } from "@claudexor/review";
 import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
-import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, loadHarnessMetrics, promptFingerprint, unknownCostSettlement, usageCostSettlement, rankHarnesses, } from "@claudexor/budget";
-import { appendLine, assertNoInlineSecretValues, containsSecretLikeToken, hashJson, newId, noProjectRepoRoot, nowIso, redactSecrets, safeInvoke, sha256, userConfigDir, writeText, } from "@claudexor/util";
+import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, loadHarnessMetrics, promptFingerprint, unknownCostSettlement, rankHarnesses, reviewUsageCostSettlement, } from "@claudexor/budget";
+import { readTextSafe, appendLine, assertNoInlineSecretValues, containsSecretLikeToken, DELEGATION_ENV, hashJson, newId, noProjectRepoRoot, nowIso, redactSecrets, safeInvoke, sha256, userConfigDir, writeText, } from "@claudexor/util";
+/** A routed candidate adapter plus its manifest capabilities and user settings. */
+/** The two access profiles that map to codex `danger-full-access` / an
+ * unsandboxed lane — the only ones under which a full-access-requiring MCP
+ * injection (the belt on codex) can reach the daemon. */
+export function isFullAccess(access) {
+    return access === "full" || access === "external_sandbox_full";
+}
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
 /** Concurrency cap for parallel candidates/explorers (locked decision: min(n, 4)). */
 const MAX_PARALLEL_CANDIDATES = 4;
 /** Default wait for one interactive answer before a benign decline. */
 const DEFAULT_INTERACTION_TIMEOUT_MS = 900_000;
-/**
- * SAFETY INVARIANT 1 (asserted, not convention): a sub-run spawned by the
- * orchestrate executor for a SAFE step (start_run/race) MUST run as an isolated
- * ENVELOPE — never a live in-place turn on a thread. Throws loudly if a caller
- * ever constructs a safe sub-run that could mutate the live tree.
- */
-function assertEnvelopeSubRun(sub) {
-    if (sub.inPlace === true) {
-        throw new Error("orchestrate safe sub-run must be an isolated envelope (inPlace must be false), refusing live-tree mutation");
-    }
-    if (sub.threadId !== undefined || sub.executionRoot !== undefined) {
-        throw new Error("orchestrate safe sub-run must not bind a thread or in-place execution root (isolation envelope only)");
-    }
-}
-/** Changed paths and +/- line counts parsed from a unified git diff. */
 /** Run `work` over `items` with bounded concurrency, preserving item order via index. */
 async function runBounded(items, limit, work) {
     if (items.length === 0)
@@ -111,15 +105,6 @@ export class Orchestrator {
             throw new Error(`unknown mode: ${String(resolved.mode)}`);
         }
         const mode = parsedMode.data;
-        // INV-023 at the ENGINE boundary too: maxToolCalls caps the orchestrate
-        // executor's plan steps — on any other mode it would be a silent no-op
-        // knob. The CLI and control API validate this already; a direct embedder
-        // must get the same loud refusal, not quiet acceptance.
-        if (resolved.maxToolCalls !== undefined &&
-            resolved.maxToolCalls !== null &&
-            mode !== "orchestrate") {
-            throw new Error(`maxToolCalls caps the orchestrate EXECUTOR's plan steps and only applies to mode=orchestrate (got mode=${mode}); drop the knob or switch modes`);
-        }
         // denyPaths is enforced by the post-diff policy gate BEFORE delivery, which
         // only exists on envelope/isolated runs — an in-place run mutates the live
         // tree directly, so the gate could not contain a violation. Refuse loudly
@@ -166,12 +151,11 @@ export class Orchestrator {
         return guardAnnouncedRun(resolved.signal, (announce) => {
             switch (mode) {
                 case "ask":
-                    return this.runAsk(resolved, announce);
-                case "audit":
-                    // `--swarm` selects the bounded read-only research swarm (old `explore`).
-                    return resolved.swarm
-                        ? this.runExplore(resolved, announce)
-                        : this.runAudit(resolved, announce);
+                    // `--deep-scan` widens the answer into the bounded multi-scout
+                    // research sweep with synthesis (the old `audit --swarm`/`explore`).
+                    return resolved.deepScan
+                        ? this.runDeepScan(resolved, announce)
+                        : this.runAsk(resolved, announce);
                 case "agent":
                     // Engine strategies are FLAGS on agent (v0.9 collapse): `--until-clean`
                     // and `--attempts` select the convergence loop; `--n` selects the race
@@ -184,14 +168,6 @@ export class Orchestrator {
                     return this.runRace({ ...resolved, n: resolved.n ?? 1 }, mode, announce);
                 case "plan":
                     return this.runPlan(resolved, announce);
-                case "orchestrate":
-                    // Recursion guard: a sub-run spawned by the orchestrate executor carries
-                    // orchestrateDepth>0 and must NOT itself orchestrate (no infinite planner
-                    // recursion). Fail loudly rather than silently degrade.
-                    if ((resolved.orchestrateDepth ?? 0) > 0) {
-                        throw new Error("orchestrate-within-orchestrate is forbidden: a sub-run spawned by the orchestrate executor cannot itself orchestrate");
-                    }
-                    return this.runOrchestrate(resolved, announce);
             }
         });
     }
@@ -231,10 +207,12 @@ export class Orchestrator {
                 safeMessage: message,
                 runDir: paths.root,
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: failed\n- Phase: review preflight\n\n${message}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: review preflight\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                reason: "harness_failed",
                 phase: "review_preflight",
                 error: message,
                 failure_ref: "final/failure.yaml",
@@ -244,7 +222,8 @@ export class Orchestrator {
                     runId,
                     taskId,
                     mode,
-                    status: "failed",
+                    lifecycle: "failed",
+                    facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
                     winner: null,
                     runDir: paths.root,
                     summary: message,
@@ -308,11 +287,55 @@ export class Orchestrator {
             credential_profile: profile,
         };
     }
+    /**
+     * The DURABLE per-lane read-only HOME env for a THREAD turn (INV-034), or
+     * null for a non-thread one-shot (which keeps the disposable route-context
+     * home). Anchored to the PROJECT partition (`input.repoRoot`), not the
+     * per-turn execution root, so the home is the SAME across turns of the same
+     * lane and the lifecycle owners (which key off `thread.repo.root`) reach it.
+     * Keyed by the run's REQUESTED credential profile — the same key the daemon's
+     * `resumeMap` lookup uses (INV-135), so record and resume land in one home.
+     */
+    laneHomeEnvFor(input, harnessId) {
+        if (!input.threadId)
+            return null;
+        return new WorkspaceManager(input.repoRoot).laneHomeEnv(input.threadId, harnessId, 
+        // The lane is keyed by the EFFECTIVE account (INV-135): an explicit pin,
+        // else null resolves the same home the recorded native session lives in.
+        this.effectiveProfileId(input, harnessId)).env;
+    }
+    /**
+     * The per-harness EFFECTIVE credential profile id (INV-135 accounts
+     * authority): an explicit per-run/per-thread pin wins; else null — POOL AUTO,
+     * the native/CLI login default subject (enabled profiles route only by
+     * explicit pin or quota rotation, never as a silent Active default).
+     */
+    effectiveProfileId(input, _harnessId) {
+        return input.credentialProfileId ?? null;
+    }
+    /** Whether the native/CLI login is EXCLUDED from this harness's credential
+     * ladder (INV-135). When excluded, a harness with no effective profile has
+     * nothing routable and must refuse — never silently fall back into it. */
+    nativeCredentialsDisabled(repoRoot, harnessId) {
+        return (this.config(repoRoot)?.global.harnesses?.[harnessId]?.native_credentials_enabled === false);
+    }
     resolveCredentialProfile(input, harnessId) {
-        if (!input.credentialProfileId)
+        const explicit = input.credentialProfileId ?? null;
+        const wanted = this.effectiveProfileId(input, harnessId);
+        if (!wanted)
             return null;
         const registry = this.config(input.repoRoot)?.global.credential_profiles ?? [];
-        return resolveCredentialProfile(registry, input.credentialProfileId, harnessId);
+        try {
+            return resolveCredentialProfile(registry, wanted, harnessId);
+        }
+        catch (err) {
+            // With Active removed, `wanted` is always the explicit pin; keep the
+            // fail-closed guard so any future non-pin source still refuses loudly.
+            if (!explicit) {
+                throw new Error(`harness "${harnessId}" credential profile "${wanted}" is unusable: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            throw err;
+        }
     }
     /** The typed effective auth route for a SELECTED credential profile
      * (round-18 #2): adapters execute strictly by credential_kind, so routing,
@@ -334,29 +357,6 @@ export class Orchestrator {
         const policy = this.config(repoRoot)?.global.harnesses?.[harnessId]?.profile_policy;
         return policy ?? { limit_action: "fail", rotation_eligible: [], headroom_threshold: 0.9 };
     }
-    /** null = no profile selected (default verdict stands); "available" = the
-     * profile's own probe admits the route; any other string = typed refusal. */
-    async profileAvailabilityOverride(input, harnessId) {
-        if (!input.credentialProfileId)
-            return null;
-        let profile;
-        try {
-            profile = this.resolveCredentialProfile(input, harnessId);
-        }
-        catch (err) {
-            return err instanceof Error ? err.message : String(err);
-        }
-        if (!profile)
-            return null;
-        const adapter = this.deps.registry.get(harnessId);
-        if (!adapter?.probeCredentialProfile) {
-            return `harness "${harnessId}" has no profile probe`;
-        }
-        const probe = await adapter.probeCredentialProfile(profile);
-        if (probe.availability === "available")
-            return "available";
-        return probe.detail ?? `${probe.availability}/${probe.verification}`;
-    }
     preflightProfile(input, harnessId, log) {
         const profile = this.resolveCredentialProfile(input, harnessId);
         const policy = this.profilePolicy(input.repoRoot, harnessId);
@@ -371,13 +371,6 @@ export class Orchestrator {
         }
         return preflightCredentialProfile({ profile, harnessId, policy, registry, snapshots, emit });
     }
-    /**
-     * Lift an adapter's auth-route override marker into the typed
-     * `route.fallback.auth_switched` run event (validated payload). An explicit
-     * subscription/api_key preference that could not be honored is never silent;
-     * neither is an `auto` choice that selects a smoke-proven paid route over an
-     * available native route.
-     */
     /**
      * Resolve candidate adapters: explicit `--harness`, else available real harnesses, then
      * **capability-gate** to those that can actually produce work for `intent` (e.g. a
@@ -391,13 +384,7 @@ export class Orchestrator {
         }
         const cfg = this.config(input.repoRoot);
         const configuredPool = cfg?.global.routing.eligible_harnesses;
-        const policy = cfg?.global.routing.default_policy;
-        const harnesses = input.harnesses ??
-            (configuredPool && configuredPool.length > 0
-                ? configuredPool
-                : policy === "primary" && cfg?.global.routing.primary_harness
-                    ? [cfg.global.routing.primary_harness]
-                    : undefined);
+        const harnesses = input.harnesses ?? (configuredPool && configuredPool.length > 0 ? configuredPool : undefined);
         const primaryHarness = input.primaryHarness ?? cfg?.global.routing.primary_harness ?? undefined;
         if (primaryHarness &&
             harnesses &&
@@ -449,7 +436,7 @@ export class Orchestrator {
             externalContextPolicy: web,
         };
     }
-    async resolveCandidateAdapters(input, intent, ledger, routeContext) {
+    async resolveCandidateAdapters(input, intent, ledger, log, routeContext) {
         let ids = input.harnesses;
         const explicitPool = Boolean(ids && ids.length > 0);
         const harnessSettings = this.config(input.repoRoot)?.global.harnesses ?? {};
@@ -529,6 +516,18 @@ export class Orchestrator {
                 dropped.push(why);
                 continue;
             }
+            // INV-135 accounts authority: with the native/CLI login excluded and no
+            // explicit pin, an unpinned run has nothing routable. Refuse an explicit
+            // request naming the setting; drop it from an auto pool — never silently
+            // fall back INTO the disabled login.
+            if (this.effectiveProfileId(input, id) === null &&
+                this.nativeCredentialsDisabled(input.repoRoot, id)) {
+                const why = `${id} has no routable credential: the CLI login is disabled (harnesses.${id}.native_credentials_enabled=false) and no account is pinned (--profile)`;
+                if (explicitPool)
+                    throw new HarnessUnavailableError(why);
+                dropped.push(why);
+                continue;
+            }
             // W3.3 (TZ-1 §B): a route is admitted on readiness truth from the SAME
             // resolved env/cwd its run will spawn with (see routeContext.ts).
             let status = await candidateStatusInRouteContext(this.gateway, routeContext, id, this.authPreferenceForHarness(input.repoRoot, id, input.authPreference), statusById);
@@ -537,9 +536,7 @@ export class Orchestrator {
                 dropped.push(`${id} (unavailable)`);
                 continue;
             }
-            // Doctor status is the readiness truth: auto-pools take only doctor-OK
-            // routes, and explicitly selecting an UNAVAILABLE harness fails loudly
-            // with the doctor's reasons. A DEGRADED harness (e.g. key present but
+            // Doctor status is the readiness truth. A DEGRADED harness (e.g. key present but
             // unproven by isolated smoke) is admitted only by explicit user
             // selection — degraded means usable-with-caveats, and the caveats are
             // visible in doctor output and run events.
@@ -550,44 +547,47 @@ export class Orchestrator {
             // the profile's transport, so the default store's state is not the
             // routing truth). Capability/manifest gating above still applies.
             let profileAdmitted = false;
-            if (status.status !== "ok") {
-                const profileVerdict = await this.profileAvailabilityOverride(input, id);
+            const profileAdapter = this.deps.registry.get(id);
+            const profileVerdict = await selectedProfileAvailability({
+                registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
+                // The EFFECTIVE account (INV-135): an explicit pin is authenticated by ITS store.
+                profileId: this.effectiveProfileId(input, id),
+                harnessId: id,
+                probe: profileAdapter?.probeCredentialProfile?.bind(profileAdapter),
+            });
+            if (profileVerdict !== null) {
                 if (profileVerdict === "available") {
-                    // The default-store failure may have zeroed enabled_intents; with
-                    // the profile probe as the auth verdict, MANIFEST capabilities are
-                    // the honest intent truth (degraded = usable-with-caveats).
-                    status = {
-                        ...status,
-                        status: "degraded",
-                        enabledIntents: capabilityIntents(manifest.capabilities),
-                    };
-                    statusById.set(id, status);
                     profileAdmitted = true;
+                    // A valid profile restores manifest intent truth when the default store failed.
+                    if (status.status !== "ok") {
+                        status = {
+                            ...status,
+                            status: "degraded",
+                            enabledIntents: capabilityIntents(manifest.capabilities),
+                        };
+                        statusById.set(id, status);
+                    }
                 }
-                else if (profileVerdict !== null) {
+                else {
                     const why = `${id} credential profile is not ready: ${profileVerdict}`;
                     if (explicitPool)
                         throw new HarnessUnavailableError(why);
                     dropped.push(why);
                     continue;
                 }
-                else if (status.status === "unavailable") {
-                    const why = `${id} is unavailable${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`;
-                    if (explicitPool)
-                        throw new HarnessUnavailableError(why);
-                    dropped.push(why);
-                    continue;
-                }
+            }
+            if (status.status === "unavailable" && !profileAdmitted) {
+                const why = `${id} is unavailable${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`;
+                if (explicitPool)
+                    throw new HarnessUnavailableError(why);
+                dropped.push(why);
+                continue;
             }
             if (status.status !== "ok" && !explicitPool && !profileAdmitted) {
                 dropped.push(`${id} is ${status.status}${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`);
                 continue;
             }
-            const readOnlyIntent = intent === "plan" ||
-                intent === "spec" ||
-                intent === "explain" ||
-                intent === "audit" ||
-                intent === "orchestrate";
+            const readOnlyIntent = intent === "plan" || intent === "spec" || intent === "explain" || intent === "audit";
             const requiredAccess = this.requestRequirements.adapterAccess(intent, manifest.capabilities.implementation_transport, readOnlyIntent
                 ? "readonly"
                 : (input.access ?? this.config(input.repoRoot).trust.access_default));
@@ -644,6 +644,8 @@ export class Orchestrator {
                         estimateEffectiveAuthRoute(this.authPreferenceForHarness(input.repoRoot, id, input.authPreference), status.authSources),
                     supportsInteractive: manifest.capabilities.interactive,
                     supportsJsonSchemaOutput: manifest.capabilities.json_schema_output,
+                    supportsMcpInjection: manifest.capability_profile.mcp_injection,
+                    mcpInjectionRequiresFullAccess: manifest.capability_profile.mcp_injection_requires_full_access,
                     implementationTransport: manifest.capabilities.implementation_transport,
                     settings: cfgEntry
                         ? {
@@ -669,11 +671,33 @@ export class Orchestrator {
         if (ordered.length === 0) {
             throw new HarnessUnavailableError(`no harness remains eligible for '${intent}' after budget and quota routing`);
         }
+        emitPrimaryDivergence(log, input.primaryHarness, ordered, pool, dropped);
         const n = input.n ?? ordered.length;
         const out = [];
         for (let i = 0; i < n; i++)
             out.push(ordered[i % ordered.length]);
         this.requestRequirements.requireEffectiveBrowser(input.browser === true, out.map((lane) => lane.browserRequirement));
+        // Delegation belt (D32): agent-only, and only on a lane whose adapter can
+        // inject MCP servers. A requested delegate with NO injecting lane is a typed
+        // preflight refusal naming the harness(es) — never a silently dropped belt.
+        if (input.delegate === true && !out.some((lane) => lane.supportsMcpInjection)) {
+            const names = [...new Set(out.map((lane) => lane.adapter.id))].join(", ");
+            throw new HarnessUnavailableError(`--delegate requires a harness that can host the Claudexor delegation belt (capability_profile.mcp_injection); the routed harness(es) [${names}] cannot inject MCP servers — choose claude or codex, or drop --delegate`);
+        }
+        // A belt-injecting lane may still be UNABLE to reach the daemon at its
+        // access: codex's workspace-write seatbelt cancels the belt's daemon-crossing
+        // MCP call, so codex only hosts the belt at FULL access (same as its browser
+        // MCP). If EVERY injecting lane requires full access but runs below it, the
+        // belt would be injected only to be silently cancelled by the sandbox — the
+        // exact non-delegation this guard prevents. Refuse with the real remedy.
+        if (input.delegate === true) {
+            const injecting = out.filter((lane) => lane.supportsMcpInjection);
+            const canHostBelt = injecting.some((lane) => !lane.mcpInjectionRequiresFullAccess || isFullAccess(lane.adapterAccess));
+            if (!canHostBelt) {
+                const names = [...new Set(injecting.map((lane) => lane.adapter.id))].join(", ");
+                throw new HarnessUnavailableError(`--delegate needs a belt-hosting lane at full access: [${names}] can inject MCP servers but sandbox-cancel the delegation belt below full access (capability_profile.mcp_injection_requires_full_access) — re-run with --access full, or route a lane (e.g. claude) that hosts the belt at workspace_write`);
+            }
+        }
         // outputSchema is MANDATORY (Quiz-6a): a selected lane that cannot
         // natively constrain its final message would deliver best-effort text —
         // that is a typed preflight refusal, never silent degradation. The
@@ -859,7 +883,7 @@ export class Orchestrator {
     buildContract(input, taskId, mode) {
         const resolvedCfg = this.config(input.repoRoot);
         const cfg = resolvedCfg.project;
-        const readOnlyMode = mode === "ask" || mode === "plan" || mode === "audit" || mode === "orchestrate";
+        const readOnlyMode = mode === "ask" || mode === "plan";
         const requestedAccess = input.access ?? (readOnlyMode ? "readonly" : resolvedCfg.trust.access_default);
         // Effective access is COMPUTED by the engine, never echoed from a client:
         // read-only modes clamp to readonly regardless of the request.
@@ -880,63 +904,19 @@ export class Orchestrator {
             { code: TRUST_FULL_ACCESS_CODE, status: 403 });
         }
         const externalContextPolicy = input.web ?? input.externalContextPolicy ?? "auto";
-        // A frozen SpecPack's CONTENT reaches the contract (success criteria,
-        // non-goals, forbidden approaches, tradeoffs, task graph) — previously only
-        // its metadata did, leaving the arbitration acceptance axis permanently
-        // empty and the interview pipeline dead in production.
-        let specFields = {};
-        let specTestCommands = [];
-        if (input.specPath) {
-            try {
-                const spec = SpecPackZ.parse(JSON.parse(readFileSync(input.specPath, "utf8")));
-                // Tamper fence (INV-081): the frozen spec's recorded hash must
-                // match what we just read — a spec.json edited AFTER freeze would
-                // otherwise silently rewrite success criteria/tests/protected paths
-                // while the contract records the stale hash as provenance.
-                if (input.specHash && hashJson(spec) !== input.specHash) {
-                    throw new Error(`frozen SpecPack hash mismatch (expected ${input.specHash}, got ${hashJson(spec)}); the spec was modified after freeze — re-freeze it or drop --spec`);
-                }
-                const fromSpec = specPackToTaskContract(spec, {
-                    repoRoot: input.repoRoot,
-                    mode,
-                    baseRef: input.baseRef,
-                    paidBudget: input.paidBudget,
-                });
-                specFields = {
-                    success_criteria: fromSpec.success_criteria,
-                    non_goals: fromSpec.non_goals,
-                    forbidden_approaches: fromSpec.forbidden_approaches,
-                    decided_tradeoffs: fromSpec.decided_tradeoffs,
-                    task_graph: fromSpec.task_graph,
-                    constraints: fromSpec.constraints,
-                };
-                specTestCommands = fromSpec.tests.commands.map(({ program, args, cwd, envAllowlist }) => ({
-                    program,
-                    args,
-                    ...(cwd === undefined ? {} : { cwd }),
-                    envAllowlist,
-                }));
-            }
-            catch (err) {
-                // An unreadable/unfrozen spec must fail the run loudly, never silently
-                // degrade into an unspecced contract.
-                throw new Error(`failed to resolve frozen SpecPack at ${input.specPath}: ${safeErrorMessage(err)}`);
-            }
-        }
-        // Deterministic gate commands come from the frozen SpecPack, explicit run
-        // input, then versioned project config. Without these, gateSpecs is empty
-        // and convergence is review-only; with them, convergence is test-driven.
+        // Deterministic gate commands come from explicit run input, then versioned
+        // project config. Without these, gateSpecs is empty and convergence is
+        // review-only; with them, convergence is test-driven.
         const resolvedGates = resolveContractGates({
             repoRoot: input.repoRoot,
             effectiveAccess,
             config: cfg,
             trustGrants: resolvedCfg.trust.test_command_grants,
-            specCommands: specTestCommands,
             operatorCommands: input.tests ?? [],
             projectCommands: cfg.tests?.commands ?? [],
         });
         const commands = resolvedGates.commands;
-        const protectedPaths = [...new Set(specFields.constraints?.protected_paths ?? [])];
+        const protectedPaths = [];
         const autoProtectedPaths = resolvedGates.autoProtectedPaths;
         const protectedPathApprovals = [
             ...new Map([...(input.protectedPathApprovals ?? [])].map((approval) => [approval.path, approval])).values(),
@@ -959,14 +939,6 @@ export class Orchestrator {
             auth_preference: input.authPreference ?? "auto",
             credential_profile_id: input.credentialProfileId ?? null,
             max_turns: input.maxTurns ?? null,
-            spec: input.specId || input.specHash || input.specPath
-                ? {
-                    id: input.specId,
-                    hash: input.specHash,
-                    path: input.specPath,
-                }
-                : undefined,
-            ...specFields,
             constraints: {
                 protected_paths: protectedPaths,
                 deny_paths: [...new Set(input.denyPaths ?? [])],
@@ -1018,6 +990,39 @@ export class Orchestrator {
      * execution — owner Quiz-5a); reviewers and the auth smoke build their own
      * specs and never call this.
      */
+    /** The extra MCP servers injected into one agent lane's sandbox. Today only
+     * the delegation belt (D32): present when `--delegate` is on, the daemon built
+     * a belt descriptor, the lane's adapter can inject MCP servers, and the lane is
+     * a WRITING agent intent (the delegator integrates results in its workspace;
+     * read lanes and reviewers have nothing to delegate). */
+    delegationBeltFor(input, intent, routed, resolvedBudget) {
+        if (!input?.delegate || !input.delegationBelt || !routed.supportsMcpInjection)
+            return [];
+        // A lane that sandbox-cancels the belt below full access (codex) must NOT
+        // receive a belt it cannot use — that is the silent non-delegation. The
+        // preflight already refused a run whose ONLY injecting lanes are such lanes
+        // below full access; here we simply skip injecting into an individual lane
+        // that cannot host it, so a mixed pool keeps the belt on the lanes that can.
+        if (routed.mcpInjectionRequiresFullAccess && !isFullAccess(routed.adapterAccess))
+            return [];
+        const writingIntents = ["implement", "create_from_scratch", "repair"];
+        if (!writingIntents.includes(intent))
+            return [];
+        // The CLI built the descriptor from the RAW request budget (undefined when
+        // the caller relied on a config/dep default), which would leave the belt
+        // unlimited while the real run is capped. Rebind the belt's parent-budget
+        // env to the RESOLVED budget (resolvePaidBudget output) so sub-run draws are
+        // bounded by the same headroom the parent run enforces — one budget owner.
+        return [
+            {
+                ...input.delegationBelt,
+                env: {
+                    ...input.delegationBelt.env,
+                    [DELEGATION_ENV.budget]: JSON.stringify(resolvedBudget),
+                },
+            },
+        ];
+    }
     harnessSpecKnobs(contract, knobs, intent) {
         return {
             external_context_policy: knobs.webPolicy,
@@ -1031,11 +1036,10 @@ export class Orchestrator {
             max_turns: knobs.maxTurns,
             ...(intent === "synthesize" ? {} : { instructions: contract.instructions }),
             // The user's answer contract rides every answer-producing lane INCLUDING
-            // synthesis (its answer can become the final one); the orchestrate
-            // planner owns its own plan schema instead (set at its spec site). The
-            // adapter gets the vendor-STRICT transport form; the engine validator
-            // keeps the ORIGINAL contract as the conformance authority.
-            ...(intent !== "orchestrate" && contract.output_schema
+            // synthesis (its answer can become the final one). The adapter gets the
+            // vendor-STRICT transport form; the engine validator keeps the ORIGINAL
+            // contract as the conformance authority.
+            ...(contract.output_schema
                 ? { output_schema: strictifyOutputSchema(contract.output_schema) }
                 : {}),
         };
@@ -1089,21 +1093,138 @@ export class Orchestrator {
             ignored,
         };
     }
-    /** Run one candidate inside an already-created envelope. Never creates/disposes the envelope. */
-    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access = "workspace_write", onHarnessEvent, signal, modelHint, effortHint, intent = "implement", log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas = false) {
+    /**
+     * Build the per-lane continuation packet for a thread turn (INV-137).
+     * Resolves the lane (harness + effective profile), computes the delta since
+     * the lane's checkpoint, reads prior outputs + the git anchor, and — for a
+     * lane switch or gap — materializes `context/THREAD.md` and returns the
+     * one-line prompt pointer. Emits `session.continuity` and stamps the turn.
+     * Returns null (no packet, no pointer) for native resume, a fresh thread, or
+     * a non-thread run. Never throws: continuity failure degrades to no packet.
+     */
+    async resolveContinuity(runInput, harnessId, resolvedProfileId, nativeResumeAvailable, store, paths, repoRoot, log) {
+        const ctx = runInput.threadContinuity;
+        if (!runInput.threadId || !ctx)
+            return null;
+        try {
+            const profileId = resolvedProfileId ?? ctx.profileId ?? null;
+            const lane = { harness: harnessId, profileId };
+            const checkpoint = ctx.laneCheckpoints.find((c) => c.harness === harnessId && (c.profileId ?? null) === profileId);
+            const headTurnId = ctx.priorTurns.length
+                ? ctx.priorTurns[ctx.priorTurns.length - 1].id
+                : null;
+            const priorHeadOwner = headTurnId
+                ? ctx.laneCheckpoints.find((c) => c.turnId === headTurnId)
+                : undefined;
+            const priorHeadLane = priorHeadOwner
+                ? { harness: priorHeadOwner.harness, profileId: priorHeadOwner.profileId ?? null }
+                : null;
+            const priorTurns = ctx.priorTurns.map((t) => ({
+                id: t.id,
+                prompt: t.prompt,
+                outputText: t.runId
+                    ? (readTextSafe(join(store.runPaths(t.runId).finalDir, "answer.md")) ?? "")
+                    : "",
+            }));
+            const req = {
+                lane,
+                priorTurns,
+                laneCheckpointTurnId: checkpoint?.turnId ?? null,
+                nativeResumeAvailable,
+                priorHeadLane,
+                activePlan: activePlanPointer(ctx.priorTurns, store),
+                anchor: await workspaceAnchor(repoRoot),
+            };
+            // V9c: when the packet would collapse an older prefix, replace the
+            // mechanical one-liners with a cached (or freshly summarized) prose
+            // summary. Same credential route + scoped lane home a real read-only
+            // thread turn uses (INV-034/135). Best-effort in its OWN guard — a summary
+            // failure keeps the full mechanical packet, never drops it.
+            const sessionFields = this.sessionSpecFields(runInput, harnessId);
+            req.cachedSummary = await resolveContinuitySummary({
+                req,
+                threadId: runInput.threadId,
+                projectRoot: runInput.repoRoot,
+                cwd: repoRoot,
+                adapter: this.deps.registry.get(harnessId),
+                credentialProfile: sessionFields.credential_profile,
+                authPreference: sessionFields.auth_preference ?? "auto",
+                laneEnv: this.laneHomeEnvFor(runInput, harnessId) ?? {},
+                envInheritance: envInheritance(this.config(runInput.repoRoot)),
+                signal: runInput.signal,
+            });
+            const result = buildContinuation(req);
+            // Disclose on every lane and stamp the turn (INV-137: never silent).
+            log?.emit("session.continuity", {
+                thread_id: runInput.threadId,
+                harness_id: harnessId,
+                kind: result.disclosure.kind,
+                packet_turns: result.disclosure.packetTurns,
+                summarized: result.disclosure.summarized,
+                lane_switched_from: result.disclosure.laneSwitchedFrom,
+            });
+            runInput.onContinuityResolved?.(ctx.turnId, result.disclosure);
+            if (!result.packetMarkdown)
+                return { pointerLine: null };
+            const briefPath = join(paths.contextDir, "THREAD.md");
+            store.writeText(briefPath, result.packetMarkdown);
+            return {
+                pointerLine: `Earlier conversation context for this thread is at: ${briefPath} — read it before answering.`,
+            };
+        }
+        catch (err) {
+            // Continuity is best-effort — a packet-build failure must never fail the
+            // run — but it is NEVER silent (INV-137). Disclose the degradation: emit
+            // the session.continuity event carrying the reason (so the failure is in
+            // the run log), and stamp the turn as fresh — it honestly ran WITHOUT the
+            // thread packet. Absent this, a summarization/anchor/read failure vanished.
+            const reason = err instanceof Error ? err.message : String(err);
+            log?.emit("session.continuity", {
+                thread_id: runInput.threadId,
+                harness_id: harnessId,
+                kind: "fresh",
+                packet_turns: 0,
+                summarized: false,
+                lane_switched_from: null,
+                degraded: true,
+                reason,
+            });
+            runInput.onContinuityResolved?.(ctx.turnId, {
+                kind: "fresh",
+                packetTurns: 0,
+                summarized: false,
+                laneSwitchedFrom: null,
+            });
+            return { pointerLine: null };
+        }
+    }
+    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access = "workspace_write", onHarnessEvent, signal, modelHint, effortHint, intent = "implement", log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas = false, fileBackedContext) {
         const adapter = routed.adapter;
         const knobs = this.routeSpecKnobs(routed, contract, modelHint, effortHint);
-        // In-place envelopes can resume native sessions; isolated scoped homes cannot,
-        // so their session ids are never retained after disposal.
+        // Isolated scoped-home sessions are never retained after disposal.
         const inPlaceEnvelope = envelope.worktree_path === envelope.repo_root;
         const rawContextPacket = await rawContextForEnvelope(routed.implementationTransport, envelope);
         const sessionFields = runInput ? this.sessionSpecFields(runInput, adapter.id, log) : undefined;
+        // Continuity (INV-137): once the lane (harness + resolved profile) is known,
+        // build the continuation packet, materialize context/THREAD.md, and point
+        // the prompt at it — never embed the packet body in the prompt. Replaces the
+        // old static session.rebound "not_portable" phrase with a real disclosure.
+        const laneContinuity = runInput
+            ? await this.resolveContinuity(runInput, adapter.id, sessionFields?.credential_profile?.profile_id ?? runInput.credentialProfileId ?? null, inPlaceEnvelope && !!sessionFields?.resume_session_id, store, paths, envelope.repo_root, log)
+            : null;
+        const promptWithContinuity = laneContinuity?.pointerLine
+            ? `${prompt}\n\n${laneContinuity.pointerLine}`
+            : prompt;
         let spec = HarnessRunSpec.parse({
             session_id: newId("ses"),
             intent,
-            prompt: promptWithProtectedPathConstraint(prompt, contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals),
+            prompt: promptWithProtectedPathConstraint(promptWithContinuity, contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals),
             attachments: runInput?.attachments ?? [],
-            browser: this.requestRequirements.browserSpec(routed.browserRequirement, join(paths.root, "browser")),
+            browser: this.requestRequirements.browserSpec(routed.browserRequirement, 
+            // F4: browser-MCP screenshots land in the claudexor-owned
+            // artifact dir inside the worktree — excluded from the diff, gallery-collected.
+            join(envelope.worktree_path, CLAUDEXOR_ARTIFACT_DIR, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR)),
+            extra_mcp_servers: this.delegationBeltFor(runInput, intent, routed, contract.budget.paid_budget),
             cwd: envelope.worktree_path,
             access: routed.adapterAccess,
             ...this.harnessSpecKnobs(contract, knobs, intent),
@@ -1123,16 +1244,6 @@ export class Orchestrator {
             raw_context_packet: rawContextPacket,
             stream_deltas: streamDeltas,
         });
-        if (!inPlaceEnvelope && runInput?.threadId && sessionFields?.resume_session_id) {
-            log?.emit("session.rebound", SessionReboundLineageSchema.parse({
-                thread_id: runInput.threadId,
-                harness_id: adapter.id,
-                from_native_session_id: sessionFields.resume_session_id,
-                to_session_id: null,
-                summary: "isolated envelope turn runs fresh: the native session is not portable into a scoped harness home; continuity rides on the thread prompt + repo state",
-                reason: "not_portable",
-            }));
-        }
         if (interaction)
             spec.extra["interactionChannel"] = interaction;
         const inactivityMs = harnessInactivityTimeoutMs(this.config(contract.repo.root));
@@ -1163,6 +1274,7 @@ export class Orchestrator {
         }
         try {
             for (let nativeTry = 0; !signal?.aborted; nativeTry += 1) {
+                const clearFileBackedContext = stageFileBackedContext(envelope.worktree_path, fileBackedContext);
                 const runSpec = nativeTry === 0
                     ? spec
                     : HarnessRunSpec.parse({ ...spec, session_id: newId("ses"), extra: { ...spec.extra } });
@@ -1238,31 +1350,23 @@ export class Orchestrator {
                                 items: safeEv.plan_progress.items,
                             });
                         }
-                        if (safeEv.type === "usage" && safeEv.usage?.cost_usd) {
-                            cost += safeEv.usage.cost_usd;
-                            if (safeEv.usage.estimated)
-                                costEstimated = true;
-                            log?.emit("budget.observation", {
-                                harness_id: adapter.id,
-                                attempt_id: attemptId,
-                                kind: "spend",
-                                usd: safeEv.usage.cost_usd,
-                                estimated: safeEv.usage.estimated === true,
+                        if (safeEv.type === "usage") {
+                            const usage = processAttemptUsage({
+                                event: safeEv,
+                                telemetry,
+                                harnessId: adapter.id,
+                                attemptId,
+                                cost,
+                                costEstimated,
+                                emit: (type, payload) => log?.emit(type, payload),
+                                budgetGuard,
+                                cancel: () => void adapter.cancel?.(runSpec.session_id)?.catch(() => { }),
                             });
-                            // Mid-flight cap enforcement: the guard raises this attempt's hold
-                            // to the streamed cost; a hard tier aborts NOW instead of letting a
-                            // streaming candidate overshoot the paid budget until settlement.
-                            const valuationOnly = safeEv.usage.estimated === true && telemetry.authMode === "local_session";
-                            if (!valuationOnly && budgetGuard?.(cost)) {
+                            cost = usage.cost;
+                            costEstimated = usage.costEstimated;
+                            if (usage.hardCapReached) {
                                 harnessErrored = true;
                                 errors.push("budget hard cap reached mid-attempt; stream aborted");
-                                log?.emit("budget.observation", {
-                                    harness_id: adapter.id,
-                                    attempt_id: attemptId,
-                                    kind: "cooldown",
-                                    detail: "hard cap mid-flight abort",
-                                });
-                                void adapter.cancel?.(runSpec.session_id)?.catch(() => { });
                                 break;
                             }
                         }
@@ -1293,6 +1397,9 @@ export class Orchestrator {
                     harnessErrored = true;
                     errors.push(safeErrorMessage(err));
                 }
+                finally {
+                    clearFileBackedContext();
+                }
                 const transient = telemetry.transientFailures.at(-1) ?? null;
                 const sawTransient = telemetry.transientFailures.length > transientStart;
                 const sawTypedLimit = telemetry.rateLimits.length > rateLimitStart;
@@ -1416,9 +1523,6 @@ export class Orchestrator {
             // must carry it so the slot catch settles the TRUE cost, not 0.
             throw Object.assign(err instanceof Error ? err : new Error(String(err)), { costUsd: cost });
         }
-        store.writeText(join(attemptDir, "patch.diff"), diff);
-        // Routing metrics (one owner in runSupport; clean attempts only —
-        // auth-route evidence recorded regardless).
         recordCleanAttemptMetrics(globalConfigDir(), adapter.id, {
             costUsd: cost,
             streamMs: attemptStreamEndedMs - attemptStartedMs,
@@ -1426,26 +1530,25 @@ export class Orchestrator {
             aborted: signal?.aborted === true,
             authMode: telemetry.authMode,
         });
-        const attemptDiffstat = diffStats(diff);
-        store.writeYaml(join(attemptDir, "attempt.yaml"), {
-            attempt_id: attemptId,
-            harness_id: adapter.id,
-            label,
-            cost_usd: cost,
-            cost_estimated: costEstimated,
-            errored,
-            errors: errors.slice(0, 5),
-            ...telemetrySummary(telemetry),
-            outcome: telemetry.outcome,
-            gates: gates.map((g) => ({ id: g.id, status: g.status })),
-            // Candidate-card evidence: the Candidates tab renders per-attempt
-            // diffstat without re-parsing patch bytes client-side.
-            diffstat: {
-                files: attemptDiffstat.paths.length,
-                additions: attemptDiffstat.additions,
-                deletions: attemptDiffstat.deletions,
+        const producedFiles = writeCandidateAttemptArtifacts({
+            store,
+            attemptDir,
+            worktreePath: envelope.worktree_path,
+            diff,
+            answerText,
+            record: {
+                attempt_id: attemptId,
+                harness_id: adapter.id,
+                label,
+                cost_usd: cost,
+                cost_estimated: costEstimated,
+                errored,
+                errors: errors.slice(0, 5),
+                ...telemetrySummary(telemetry),
+                outcome: telemetry.outcome,
+                gates: gates.map((g) => ({ id: g.id, status: g.status })),
+                branch: envelope.branch_name,
             },
-            branch: envelope.branch_name,
         });
         return {
             attemptId,
@@ -1455,6 +1558,7 @@ export class Orchestrator {
             answerText,
             reviewCwd: envelope.worktree_path,
             baseSha: envelope.base_sha ?? undefined,
+            producedFiles,
             gates,
             cost,
             errored,
@@ -1463,51 +1567,6 @@ export class Orchestrator {
             telemetry,
         };
     }
-    toEvidence(run, contract, findings, finalReviewClean, reviewVerified = false) {
-        const passed = gatesPassed(run.gates) && !run.errored;
-        // Honest acceptance evidence: 0/0 when the contract has no success criteria
-        // (no spec). The old code fabricated a 1/1 ("AC-implicit") cover, which made
-        // arbitration report a vacuous "acceptance=100%" that just restated gates.
-        const acTotal = contract.success_criteria.length;
-        const acCovered = passed && contract.success_criteria.length > 0
-            ? contract.success_criteria.map((c) => c.id)
-            : [];
-        // Treat a harness error as a failed required gate so it cannot win arbitration.
-        const gates = run.errored
-            ? [
-                ...run.gates,
-                {
-                    id: "harness",
-                    command: "harness",
-                    exit_code: 1,
-                    status: "failed",
-                    duration_ms: 0,
-                    required: true,
-                    stdout_tail: null,
-                    stderr_tail: null,
-                    output_truncated: false,
-                },
-            ]
-            : run.gates;
-        return {
-            attemptId: run.attemptId,
-            label: run.label,
-            gates,
-            acceptanceCovered: acCovered,
-            acceptanceTotal: acTotal,
-            findings,
-            // Counted from the EVIDENCE gates (including the injected harness-failure
-            // gate), so an errored candidate scores 0/1 — never a vacuous 0/0.
-            testsPassed: gates.filter((g) => g.status === "passed").length,
-            testsTotal: gates.length,
-            finalReviewClean,
-            reviewVerified,
-            toolWarningsCount: run.telemetry.outcome?.toolWarningsCount ?? toolWarnings(run.telemetry).length,
-            diffSize: run.diff.split("\n").length,
-            diffBytes: Buffer.byteLength(run.diff, "utf8"),
-            costUsd: run.cost,
-        };
-    }
     interactionChannelFor(input, log, runId, taskId, attemptId, harnessId, 
     // REQUIRED (no default): every call site must state the routed manifest's
     // `interactive` capability, or a future site would silently bypass the gate.
@@ -1552,10 +1611,12 @@ export class Orchestrator {
                     "Retry the run",
                 ],
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: failed\n- Phase: workspace\n\n${message}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: workspace\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                reason: "harness_failed",
                 phase: "workspace",
                 error: message,
                 failure_ref: "final/failure.yaml",
@@ -1563,6 +1624,37 @@ export class Orchestrator {
             return message;
         }
     }
+    /**
+     * Freeze-on-implement delivery (D17/D27): verify the frozen plan's hash and
+     * materialize it as context/PLAN.md in the run artifact tree — OUTSIDE every
+     * worktree, so it can never dirty a diff — then point the prompt at the
+     * absolute path. A mismatched or unreadable plan fails LOUDLY before any
+     * harness spawns (the tamper fence; retry replays planRef verbatim, so a
+     * retried implement can never silently run without its plan).
+     */
+    withPlanBrief(input, store, paths, log) {
+        if (!input.planRef)
+            return input;
+        const text = readTextSafe(input.planRef.path);
+        if (!text || !text.trim()) {
+            throw new Error(`implement plan: the frozen plan at ${input.planRef.path} is missing or unreadable`);
+        }
+        const digest = sha256(text).replace(/^sha256:/, "");
+        if (digest !== input.planRef.sha256) {
+            throw new Error(`implement plan: plan hash mismatch (expected ${input.planRef.sha256}, got ${digest}) — the plan was modified after freeze; re-run Implement from the plan turn`);
+        }
+        const briefPath = join(paths.contextDir, "PLAN.md");
+        store.writeText(briefPath, text);
+        log.emit("plan.brief.materialized", {
+            plan_run_id: input.planRef.runId,
+            sha256: input.planRef.sha256,
+            path: "context/PLAN.md",
+        });
+        return {
+            ...input,
+            prompt: `${input.prompt}\n\nThe approved plan is at: ${briefPath} — read it before starting and re-read it as needed.`,
+        };
+    }
     async runRace(input, mode, announce) {
         const taskId = input.taskId ?? newId("task");
         const runId = input.runId ?? newId("run");
@@ -1573,6 +1665,7 @@ export class Orchestrator {
         const store = this.artifactStore(input);
         const paths = store.createRun(runId);
         const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
+        input = this.withPlanBrief(input, store, paths, log);
         // The execution root is the tree the harness mutates: the project itself for
         // in-place threads/ordinary runs, or the thread's persistent worktree for an
         // isolated thread. Config/artifacts/contract stay anchored to repoRoot. Both
@@ -1606,7 +1699,8 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode,
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
                 winner: null,
                 runDir: paths.root,
                 summary: gitPreconditionError,
@@ -1636,6 +1730,7 @@ export class Orchestrator {
         });
         let adapters;
         try {
+            // Best-of races the whole pool (no divergence `log`: the pool still runs).
             adapters = await this.resolveCandidateAdapters(input, this.candidateIntent(input), ledger);
         }
         catch (err) {
@@ -1647,10 +1742,12 @@ export class Orchestrator {
                 safeMessage: message,
                 runDir: paths.root,
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: failed\n- Phase: routing\n\n${message}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: routing\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                reason: "harness_failed",
                 phase: "routing",
                 error: message,
                 failure_ref: "final/failure.yaml",
@@ -1659,7 +1756,8 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode,
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
                 winner: null,
                 runDir: paths.root,
                 summary: message,
@@ -1789,7 +1887,7 @@ export class Orchestrator {
                     budgetStopped = true;
                     return true;
                 }, input, requestedSingleCandidate);
-                ledger.settle(slot.leaseId, attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode));
+                ledger.settle(slot.leaseId, attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
                     attempt_id: slot.attemptId,
@@ -1881,29 +1979,34 @@ export class Orchestrator {
             })), null), ledger.spend(), input.signal, store);
         }
         if (runs.length === 0) {
-            const status = ledger.terminal() ?? (budgetStopped ? "exhausted" : "failed");
+            const budgetReason = ledger.terminal();
+            const facts = makeOutcomeFacts("failed", {
+                reason: budgetReason ?? (budgetStopped ? "budget_exhausted" : "harness_failed"),
+                noChanges: true,
+            });
             const why = budgetStopped
                 ? "budget exhausted before any candidate run"
                 : "no candidates produced";
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), {
                 winner: null,
-                status,
-                outcome: "blocked",
+                facts,
                 why_winner: why,
                 evidence_facts: ["no candidates were produced"],
                 apply_recommendation: "continue",
                 budget_summary: { spend_usd: ledger.spend(), estimated: false },
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: ${status}\n- Phase: budget\n\n${why}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Phase: budget\n\n${why}\n`);
             writeFailure(store, paths, {
                 phase: "budget",
-                category: isBudgetTerminal(status) ? "budget" : "internal",
+                category: isBudgetTerminal(facts.reason) ? "budget" : "internal",
                 safeMessage: why,
                 runDir: paths.root,
             });
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
-                status,
+                lifecycle: facts.lifecycle,
+                facts,
+                reason: facts.reason,
                 phase: "budget",
                 error: why,
                 failure_ref: "final/failure.yaml",
@@ -1912,7 +2015,8 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode,
-                status,
+                lifecycle: facts.lifecycle,
+                facts,
                 winner: null,
                 runDir: paths.root,
                 summary: why,
@@ -1933,11 +2037,10 @@ export class Orchestrator {
             const rootCause = runs
                 .map((r) => `${r.attemptId}/${r.harnessId}: ${r.errors[0] ?? "failed before producing work"}`)
                 .join("; ");
-            const status = "failed";
+            const facts = makeOutcomeFacts("failed", { reason: "harness_failed", noChanges: true });
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), {
                 winner: null,
-                status,
-                outcome: "blocked",
+                facts,
                 why_winner: rootCause,
                 evidence_facts: runs.map((r) => `${r.attemptId} produced no work: ${r.errors[0] ?? "unknown"}`),
                 apply_recommendation: "continue",
@@ -1948,7 +2051,7 @@ export class Orchestrator {
                 harnessId: r.harnessId,
                 telemetry: r.telemetry,
             })), null);
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: ${status}\n- Phase: ${phase}\n\n${rootCause}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}\n- Phase: ${phase}\n\n${rootCause}\n`);
             const existingEventRefs = runs
                 .map((r) => `attempts/${r.attemptId}/events.jsonl`)
                 .filter((rel) => existsSync(join(paths.root, rel)));
@@ -1967,7 +2070,9 @@ export class Orchestrator {
             });
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
-                status,
+                lifecycle: facts.lifecycle,
+                facts,
+                reason: facts.reason,
                 phase,
                 error: rootCause,
                 failure_ref: "final/failure.yaml",
@@ -1976,7 +2081,8 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode,
-                status,
+                lifecycle: facts.lifecycle,
+                facts,
                 winner: null,
                 runDir: paths.root,
                 summary: rootCause,
@@ -2030,9 +2136,11 @@ export class Orchestrator {
                 let envelope;
                 try {
                     const plan = buildSynthesisPlan(evidences);
-                    const sourceDiffs = workingRuns
-                        .map((r) => `### ${r.label} (${r.attemptId})\n${r.diff}`)
-                        .join("\n\n");
+                    const synthesisInput = buildFileBackedSynthesisInput({
+                        instructions: plan.instructions,
+                        findings: plan.fixFindings,
+                        candidates: workingRuns,
+                    });
                     const synthAdapter = synthRouted.adapter;
                     // Disclose against the PER-ROUTE policy (per-harness web defaults
                     // included), exactly like the candidate slots do.
@@ -2045,13 +2153,12 @@ export class Orchestrator {
                         dirtyPolicy: "snapshot",
                         accessProfile: candidateAccess,
                     });
-                    const synthPrompt = `${plan.instructions}\n\nFindings to fix:\n${plan.fixFindings.map((f) => `- ${f}`).join("\n") || "(none)"}\n\nCandidate diffs:\n${sourceDiffs}`;
-                    const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthPrompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
+                    const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthesisInput.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
                         const safeEv = redactHarnessEvent(ev);
                         safeInvoke(input.onHarnessEvent, safeEv);
                         log.emit("harness.event", harnessEventPayload(synthAdapter.id, "synth", safeEv));
-                    }, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input);
-                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode));
+                    }, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content);
+                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     reviewEnvelopes.push(envelope);
                     envelope = undefined;
                     try {
@@ -2105,7 +2212,7 @@ export class Orchestrator {
         }
         log.emit("arbitration.completed", {
             winner: result.decision.winner,
-            status: result.decision.status,
+            lifecycle: result.decision.facts.lifecycle,
         });
         // Winner can only be a candidate that actually produced work; corpses are
         // excluded from arbitration upstream and from the fallback here.
@@ -2118,9 +2225,18 @@ export class Orchestrator {
         const actualReviewVerified = winnerRun
             ? (evidences.find((e) => e.attemptId === winnerRun.attemptId)?.reviewVerified ?? false)
             : evidences.length > 0 && evidences.every((e) => e.reviewVerified);
-        let status = needsHuman && result.decision.status !== "success" ? "blocked" : result.decision.status;
-        if (status === "success" && ledger.terminal() !== null)
-            status = ledger.terminal();
+        let facts = result.decision.facts;
+        // A reviewer NEEDS_HUMAN escalation forces the REVIEW axis to blocked (a
+        // needs-decision terminal), unless the decision is already applyable-clean.
+        if (needsHuman && facts.lifecycle === "succeeded" && facts.review !== "blocked") {
+            facts = { ...facts, review: "blocked", reason: facts.reason ?? "review_blocked" };
+        }
+        // A budget terminal turns a succeeded lifecycle into a failed one (D8): the
+        // budget reason IS a RunReason.
+        const budgetTerminal = ledger.terminal();
+        if (facts.lifecycle === "succeeded" && budgetTerminal) {
+            facts = makeOutcomeFacts("failed", { reason: budgetTerminal, noChanges: facts.noChanges });
+        }
         // FinalVerifier blocks adoption until the patch and gates pass on a fresh base.
         let finalVerify = null;
         let finalVerifyFailed = false;
@@ -2134,26 +2250,37 @@ export class Orchestrator {
             !inPlaceWinner &&
             !deferredRaceVerify &&
             winnerRun.diff.trim().length > 0 &&
-            (status === "success" || status === "ungated") &&
+            facts.lifecycle === "succeeded" &&
+            facts.review !== "blocked" &&
             !input.signal?.aborted) {
             finalVerify = await finalVerifyPatch(execRoot, winnerRun, gateSpecsFromContract(contract), log);
             // Verify errors block like proven failures; accept_risk stays available.
+            // A failed fresh verify lands on the CHECKS axis (a needs-decision block).
             finalVerifyFailed = finalVerifyBlocks(finalVerify);
             if (finalVerifyFailed)
-                status = "blocked";
+                facts = { ...facts, checks: "failed", reason: "checks_failed" };
         }
+        // A needs-decision terminal (review blocked or checks failed) overrides the
+        // persisted green arbitration fields; otherwise the facts pass through.
+        const needsDec = facts.review === "blocked" || facts.checks === "failed";
         store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), {
             ...result.decision,
-            // A blocked terminal overrides the persisted green arbitration fields.
-            ...(status === "blocked"
+            ...(needsDec
                 ? blockedDecisionOverride(result.decision.evidence_facts, finalVerify)
-                : {}),
+                : { facts }),
             review_verified: actualReviewVerified,
             final_verify: finalVerify,
         });
         store.writeYaml(join(paths.arbitrationDir, "pairwise.yaml"), result.pairwise);
         const decisionPath = join(paths.arbitrationDir, "decision.yaml");
         if (winnerRun) {
+            for (const path of materializeWinnerOutputs({
+                attemptDir: join(paths.attemptsDir, winnerRun.attemptId),
+                runRoot: paths.root,
+                paths: winnerRun.producedFiles ?? [],
+            })) {
+                log.emit("output.ready", { kind: "artifact", path });
+            }
             assertNoSecretLikeTokens("final patch diff", winnerRun.diff);
             const patchSha256 = sha256(winnerRun.diff);
             store.writeText(join(paths.finalDir, "patch.diff"), winnerRun.diff);
@@ -2186,8 +2313,9 @@ export class Orchestrator {
                     answerText: winnerAnswer,
                 });
             }
-            // Only a fully verified success may auto-adopt; ungated remains an artifact.
-            const adoptable = status === "success";
+            // Only a fully verified, applyable success may auto-adopt; a not-verified
+            // or needs-decision terminal remains an inspectable artifact.
+            const adoptable = facts.lifecycle === "succeeded" && facts.review === "approved" && facts.checks !== "failed";
             let adopted = null;
             let applyState = "not_applied";
             let postTurnSha = null;
@@ -2231,7 +2359,7 @@ export class Orchestrator {
                         adopted = false;
                         applyState = "not_applied";
                         deliveryFailureReason = applied.detail ?? "race adoption delivery was refused";
-                        status = "blocked";
+                        facts = { ...facts, checks: "failed", reason: "checks_failed" };
                         if (finalVerifyBlocks(finalVerify))
                             finalVerifyFailed = true;
                         log.emit("work_product.adopted", {
@@ -2245,7 +2373,7 @@ export class Orchestrator {
             }
             writeRaceDeliveryDecision(store, decisionPath, {
                 decision: result.decision,
-                status,
+                facts,
                 reviewVerified: actualReviewVerified,
                 finalVerify,
                 deliveryFailureReason,
@@ -2266,8 +2394,9 @@ export class Orchestrator {
                     harness_id: winnerRun.harnessId,
                     synthesis: synth,
                     mode,
-                    // Artifact-only apply reads the same terminal status as the daemon.
-                    status,
+                    // Artifact-only apply reads the same terminal axes as the daemon (D8).
+                    lifecycle: facts.lifecycle,
+                    outcome_facts: facts,
                     review_verified: actualReviewVerified,
                     budget_stopped: budgetStopped,
                     patch_sha256: patchSha256,
@@ -2285,18 +2414,31 @@ export class Orchestrator {
                     revert_anchor_id: revertAnchorId,
                 },
             });
-            store.writeText(join(paths.finalDir, "summary.md"), renderSummary(runId, mode, { ...result.decision, status }, evidences, synth.reason, actualReviewVerified));
-            // A non-success run's summary/patch is diagnostic context, not an applyable green output.
+            store.writeText(join(paths.finalDir, "summary.md"), renderSummary(runId, mode, { ...result.decision, facts }, evidences, synth.reason, actualReviewVerified));
+            // summary.md is a DIAGNOSTIC artifact only (V8/PLAN addendum 2): it no
+            // longer carries primary-output authority. A clean applyable success or a
+            // winner answer still marks it ready for legacy INV-116 ordering; any
+            // other terminal is diagnostic context.
             log.emit("output.ready", {
                 kind: "summary",
                 path: "final/summary.md",
-                ...(status === "success" ? {} : { state: "diagnostic" }),
+                state: (facts.lifecycle === "succeeded" &&
+                    facts.review === "approved" &&
+                    facts.checks !== "failed") ||
+                    winnerAnswer.length > 0
+                    ? "ready"
+                    : "diagnostic",
             });
         }
-        this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({ attemptId: r.attemptId, harnessId: r.harnessId, telemetry: r.telemetry })), result.decision.status === "success"
+        this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({ attemptId: r.attemptId, harnessId: r.harnessId, telemetry: r.telemetry })), result.decision.facts.lifecycle === "succeeded"
             ? result.decision.winner
             : (winnerRun?.attemptId ?? null));
-        const honestTerminal = status === "no_op" || status === "ungated" || status === "review_not_run";
+        // A needs-decision terminal (review blocked or checks failed) OR a
+        // non-succeeded lifecycle writes a failure record and fires
+        // run.blocked/run.failed; a succeeded, non-needs-decision terminal
+        // (applyable, no_changes, or not-verified) is an honest completion.
+        const needsDecisionTerminal = facts.review === "blocked" || facts.checks === "failed";
+        const isFailureTerminal = facts.lifecycle !== "succeeded" || needsDecisionTerminal;
         if (deliveryFailureReason && !finalVerifyFailed) {
             writeFailure(store, paths, deliveryRefusalFailure(deliveryFailureReason, paths.root));
         }
@@ -2321,14 +2463,14 @@ export class Orchestrator {
                     ],
             });
         }
-        else if (status !== "success" && !honestTerminal) {
+        else if (isFailureTerminal) {
             writeFailure(store, paths, {
                 phase: needsHuman ? "review" : "arbitration",
                 category: needsHuman
                     ? "policy"
                     : winnerRun?.errored
                         ? "harness_error"
-                        : isBudgetTerminal(status)
+                        : isBudgetTerminal(facts.reason)
                             ? "budget"
                             : "internal",
                 harnessId: winnerRun?.errored ? winnerRun.harnessId : undefined,
@@ -2353,7 +2495,7 @@ export class Orchestrator {
                     ],
             });
             if (!winnerRun) {
-                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: ${status}\n- Phase: arbitration\n\n${result.decision.why_winner}\n`);
+                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Phase: arbitration\n\n${result.decision.why_winner}\n`);
                 log.emit("output.ready", {
                     kind: "summary",
                     path: "final/summary.md",
@@ -2362,14 +2504,15 @@ export class Orchestrator {
             }
         }
         log.emit("work_product.emitted", { winner: result.decision.winner });
-        if (status === "success" || honestTerminal) {
-            log.emit("run.completed", { status, outcome: result.decision.outcome });
+        if (!isFailureTerminal) {
+            log.emit("run.completed", { lifecycle: facts.lifecycle, facts, reason: facts.reason });
         }
-        else if (status === "blocked") {
-            // The event's phase must agree with failure.yaml (a verify block is
-            // phase "verification", not "review").
+        else if (facts.lifecycle === "succeeded") {
+            // needsDecision at terminal — the event's phase must agree with
+            // failure.yaml (a verify block is phase "verification", not "review").
             log.emit("run.blocked", {
-                status,
+                lifecycle: facts.lifecycle,
+                facts,
                 phase: deliveryFailureReason && !finalVerifyFailed
                     ? "delivery"
                     : finalVerifyFailed
@@ -2379,13 +2522,20 @@ export class Orchestrator {
             });
         }
         else {
-            log.emit("run.failed", { status, phase: "arbitration", failure_ref: "final/failure.yaml" });
+            log.emit("run.failed", {
+                lifecycle: facts.lifecycle,
+                facts,
+                reason: facts.reason,
+                phase: "arbitration",
+                failure_ref: "final/failure.yaml",
+            });
         }
         return {
             runId,
             taskId,
             mode,
-            status,
+            lifecycle: facts.lifecycle,
+            facts,
             winner: result.decision.winner,
             runDir: paths.root,
             summary: result.decision.why_winner,
@@ -2477,15 +2627,21 @@ export class Orchestrator {
                         distinctProviders: [],
                         reviewSpendUsd: 0,
                         reviewSpendEstimated: false,
+                        reviewCashUsd: 0,
+                        reviewValuationUsd: 0,
+                        reviewUnknownUsd: 0,
                     };
                 if (reviewLease?.granted) {
-                    ledger?.settle(reviewLease.lease?.lease_id ?? "", usageCostSettlement(result.reviewSpendUsd, result.reviewSpendEstimated, "review-usage", [`attempt:${run.attemptId}`, "review:panel"]));
+                    ledger?.settle(reviewLease.lease?.lease_id ?? "", reviewUsageCostSettlement(result.reviewCashUsd, result.reviewValuationUsd, result.reviewSpendEstimated, [`attempt:${run.attemptId}`, "review:panel"], result.reviewUnknownUsd));
                     if ((result.reviewSpendUsd ?? 0) > 0) {
                         log.emit("budget.observation", {
                             harness_id: "review-panel",
                             attempt_id: run.attemptId,
                             kind: "spend",
                             usd: result.reviewSpendUsd,
+                            cash_usd: result.reviewCashUsd,
+                            valuation_usd: result.reviewValuationUsd,
+                            unknown_usd: result.reviewUnknownUsd,
                             estimated: result.reviewSpendEstimated === true,
                         });
                     }
@@ -2517,6 +2673,7 @@ export class Orchestrator {
                 store.writeYaml(join(paths.reviewsDir, `${run.attemptId}.yaml`), {
                     attempt_id: run.attemptId,
                     review_verified: candidateReviewVerified,
+                    final_review_clean: reviewClean,
                     cross_family_healthy: result.crossFamilyHealthy,
                     cross_family_verified: result.crossFamilyVerified,
                     healthy_providers: result.healthyProviders,
@@ -2532,7 +2689,7 @@ export class Orchestrator {
                         severity: f.severity,
                         status: f.status,
                     });
-                evidences.push(this.toEvidence(run, contract, allFindings, reviewClean, candidateReviewVerified));
+                evidences.push(toCandidateEvidence(run, contract, allFindings, reviewClean, candidateReviewVerified));
             }
             finally {
                 this.recordReviewEvidenceCleanup(store, join(paths.reviewsDir, `${run.attemptId}-evidence-cleanup.yaml`), run.attemptId, candidateEvidenceDir, candidateCwd);
@@ -2586,6 +2743,7 @@ export class Orchestrator {
         const store = this.artifactStore(input);
         const paths = store.createRun(runId);
         const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
+        input = this.withPlanBrief(input, store, paths, log);
         // The execution root is the tree the harness mutates (thread worktree for an
         // isolated thread, else the project). The WorkspaceManager AND the git
         // boundary must resolve against the SAME root — the race path does so via the
@@ -2618,7 +2776,8 @@ export class Orchestrator {
                     runId,
                     taskId,
                     mode,
-                    status: "failed",
+                    lifecycle: "failed",
+                    facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
                     winner: null,
                     runDir: paths.root,
                     summary: gitPreconditionError,
@@ -2640,7 +2799,7 @@ export class Orchestrator {
         // One envelope carried forward across attempts so the harness can repair its own work.
         let adapterPool;
         try {
-            adapterPool = await this.resolveCandidateAdapters({ ...input, n: undefined }, this.candidateIntent(input), ledger);
+            adapterPool = await this.resolveCandidateAdapters({ ...input, n: undefined }, this.candidateIntent(input), ledger, log);
             this.requestRequirements.assertConvergenceWorkspace(input.inPlace === true, adapterPool);
         }
         catch (err) {
@@ -2652,10 +2811,12 @@ export class Orchestrator {
                 safeMessage: message,
                 runDir: paths.root,
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: failed\n- Phase: routing\n\n${message}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: routing\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                reason: "harness_failed",
                 phase: "routing",
                 error: message,
                 failure_ref: "final/failure.yaml",
@@ -2665,7 +2826,8 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode,
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
                 winner: null,
                 runDir: paths.root,
                 summary: message,
@@ -2689,10 +2851,12 @@ export class Orchestrator {
                     "Check harness doctor for reviewer readiness",
                 ],
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: failed\n- Phase: review preflight\n\n${message}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: review preflight\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                reason: "harness_failed",
                 phase: "review",
                 error: message,
                 failure_ref: "final/failure.yaml",
@@ -2702,7 +2866,8 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode,
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
                 winner: null,
                 runDir: paths.root,
                 summary: message,
@@ -2818,7 +2983,7 @@ export class Orchestrator {
                         ledger.updateHold(lease.lease?.lease_id ?? "", streamedUsd);
                         return ledger.tier() === "hard";
                     }, input, true);
-                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode));
+                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
@@ -2906,15 +3071,21 @@ export class Orchestrator {
                                     distinctProviders: [],
                                     reviewSpendUsd: 0,
                                     reviewSpendEstimated: false,
+                                    reviewCashUsd: 0,
+                                    reviewValuationUsd: 0,
+                                    reviewUnknownUsd: 0,
                                 };
                             if (reviewLease?.granted) {
-                                ledger.settle(reviewLease.lease?.lease_id ?? "", usageCostSettlement(reviewResult.reviewSpendUsd, reviewResult.reviewSpendEstimated, "review-usage", [`attempt:${attemptId}`, "review:panel"]));
+                                ledger.settle(reviewLease.lease?.lease_id ?? "", reviewUsageCostSettlement(reviewResult.reviewCashUsd, reviewResult.reviewValuationUsd, reviewResult.reviewSpendEstimated, [`attempt:${attemptId}`, "review:panel"], reviewResult.reviewUnknownUsd));
                                 if ((reviewResult.reviewSpendUsd ?? 0) > 0) {
                                     log.emit("budget.observation", {
                                         harness_id: "review-panel",
                                         attempt_id: attemptId,
                                         kind: "spend",
                                         usd: reviewResult.reviewSpendUsd,
+                                        cash_usd: reviewResult.reviewCashUsd,
+                                        valuation_usd: reviewResult.reviewValuationUsd,
+                                        unknown_usd: reviewResult.reviewUnknownUsd,
                                         estimated: reviewResult.reviewSpendEstimated === true,
                                     });
                                     if (reviewResult.reviewSpendEstimated === true)
@@ -2941,9 +3112,15 @@ export class Orchestrator {
                             const policy = policyFindings(run, actualReviewVerified, contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals, contract.constraints.deny_paths);
                             const allFindings = [...policy.findings, ...revalidated];
                             lastFindings = allFindings;
+                            const inconclusive = allFindings.some((f) => f.severity === "INSUFFICIENT_EVIDENCE" || f.status === "insufficient_evidence");
+                            const finalReviewClean = reviewResult.crossFamilyHealthy &&
+                                reviewResult.crossFamilyVerified &&
+                                !inconclusive &&
+                                !allFindings.some((f) => isBlocking(f));
                             store.writeYaml(join(paths.reviewsDir, `${attemptId}.yaml`), {
                                 attempt_id: attemptId,
                                 review_verified: actualReviewVerified,
+                                final_review_clean: finalReviewClean,
                                 cross_family_healthy: reviewResult.crossFamilyHealthy,
                                 cross_family_verified: reviewResult.crossFamilyVerified,
                                 healthy_providers: reviewResult.healthyProviders,
@@ -2953,11 +3130,6 @@ export class Orchestrator {
                                 findings: allFindings,
                                 route_proofs: reviewResult.routeProofs,
                             });
-                            const inconclusive = allFindings.some((f) => f.severity === "INSUFFICIENT_EVIDENCE" || f.status === "insufficient_evidence");
-                            const finalReviewClean = reviewResult.crossFamilyHealthy &&
-                                reviewResult.crossFamilyVerified &&
-                                !inconclusive &&
-                                !allFindings.some((f) => isBlocking(f));
                             lastFinalReviewClean = finalReviewClean;
                             // Measure diff stability instead of asserting it: the tree must not have
                             // changed between the candidate diff capture and the end of review.
@@ -3067,38 +3239,51 @@ export class Orchestrator {
             if (envelope)
                 await wsm.dispose(envelope);
         }
-        let status = input.signal?.aborted
-            ? "cancelled"
+        // Base terminal AXES (D8) from the convergence loop outcome. Attempts-cap
+        // exhaustion maps to budget_exhausted (an attempt budget); the give-up
+        // states map to their matching RunReason.
+        let facts = input.signal?.aborted
+            ? makeOutcomeFacts("cancelled", { reason: "user_cancelled" })
             : converged
-                ? "success"
+                ? makeOutcomeFacts("succeeded")
                 : stuckNoProgress
-                    ? "stuck_no_progress"
+                    ? makeOutcomeFacts("failed", { reason: "stuck_no_progress" })
                     : exhausted
-                        ? "exhausted"
-                        : "not_converged";
-        if (status === "success" && ledger.terminal() !== null)
-            status = ledger.terminal();
+                        ? makeOutcomeFacts("failed", { reason: "budget_exhausted" })
+                        : makeOutcomeFacts("failed", { reason: "not_converged" });
         let decision = null;
         if (lastRun) {
             const arb = arbitrate([
-                this.toEvidence(lastRun, contract, lastFindings, lastFinalReviewClean, actualReviewVerified),
+                toCandidateEvidence(lastRun, contract, lastFindings, lastFinalReviewClean, actualReviewVerified),
             ], {
                 spendUsd: ledger.spend(),
                 estimatedSpend: lastRun.costEstimated || reviewSpendEstimated,
             });
             decision = arb.decision;
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), decision);
-            if (converged && decision.status !== "not_converged") {
-                status = decision.status;
+            // A converged run adopts the arbitration axes (checks/review); an
+            // otherwise not-converged loop that nonetheless produced an applyable
+            // decision adopts it too.
+            if (converged) {
+                facts = decision.facts;
             }
-            else if (status === "not_converged" && decision.status !== "success") {
-                status = decision.status;
+            else if (facts.reason === "not_converged" && decision.facts.lifecycle === "succeeded") {
+                facts = decision.facts;
             }
         }
-        // A reviewer escalation to a human is a BLOCKED terminal, not a silent risk note.
+        // A budget terminal turns a succeeded lifecycle into a failed one (D8).
+        const convBudgetTerminal = ledger.terminal();
+        if (facts.lifecycle === "succeeded" && convBudgetTerminal) {
+            facts = makeOutcomeFacts("failed", {
+                reason: convBudgetTerminal,
+                noChanges: facts.noChanges,
+            });
+        }
+        // A reviewer escalation to a human forces the REVIEW axis to blocked.
         const needsHuman = lastFindings.some((f) => f.severity === "NEEDS_HUMAN" && isBlocking(f));
-        if (needsHuman && status !== "success" && status !== "cancelled")
-            status = "blocked";
+        if (needsHuman && facts.lifecycle === "succeeded" && facts.review !== "blocked") {
+            facts = { ...facts, review: "blocked", reason: facts.reason ?? "review_blocked" };
+        }
         // FinalVerifier (INV-115) applies to EVERY applyable envelope-mode patch,
         // not only race winners: a convergence run's delivered patch must also
         // survive a fresh tree at its own base + the deterministic gates there.
@@ -3109,20 +3294,22 @@ export class Orchestrator {
         if (input.inPlace !== true &&
             lastRun &&
             lastRun.diff.trim().length > 0 &&
-            (status === "success" || status === "ungated") &&
+            facts.lifecycle === "succeeded" &&
+            facts.review !== "blocked" &&
             !input.signal?.aborted) {
             convFinalVerify = await finalVerifyPatch(execRoot, lastRun, gateSpecsFromContract(contract), log);
             if (finalVerifyBlocks(convFinalVerify))
-                status = "blocked";
+                facts = { ...facts, checks: "failed", reason: "checks_failed" };
         }
+        const convNeedsDecision = facts.review === "blocked" || facts.checks === "failed";
         if (decision) {
-            // Shared honesty owner (same as the race path): a blocked terminal
+            // Shared honesty owner (same as the race path): a needs-decision terminal
             // overrides the persisted decision; final_verify is recorded either way.
             decision = {
                 ...decision,
-                ...(status === "blocked"
+                ...(convNeedsDecision
                     ? blockedDecisionOverride(decision.evidence_facts, convFinalVerify)
-                    : {}),
+                    : { facts }),
                 final_verify: convFinalVerify,
             };
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), decision);
@@ -3137,7 +3324,7 @@ export class Orchestrator {
             // convergence run with inPlace mutated the live tree directly across its
             // attempts, so it is "applied" even when review blocked (Revert offered).
             const convHasDiff = lastRun.diff.trim().length > 0;
-            const convAdoptable = status === "success" || status === "ungated";
+            const convAdoptable = facts.lifecycle === "succeeded" && facts.review === "approved" && facts.checks !== "failed";
             const convAdopted = input.inPlace === true && convHasDiff ? true : null;
             const convApplyState = convAdopted === true
                 ? convAdoptable
@@ -3157,7 +3344,8 @@ export class Orchestrator {
                     result_kind: "patch",
                     mode,
                     attempts: attempt,
-                    status,
+                    lifecycle: facts.lifecycle,
+                    outcome_facts: facts,
                     review_verified: actualReviewVerified,
                     patch_sha256: patchSha256,
                     adopted: convAdopted,
@@ -3167,42 +3355,45 @@ export class Orchestrator {
                     revert_anchor_id: revertAnchorId,
                 },
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: ${status}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}\n`);
             // Lifecycle invariant (all modes): output.ready precedes the terminal
             // event so a client that applied the terminal event has the output.
             log.emit("output.ready", {
                 kind: "summary",
                 path: "final/summary.md",
-                ...(status === "success" ? {} : { state: "diagnostic" }),
+                ...(convAdoptable ? {} : { state: "diagnostic" }),
             });
         }
-        if (!converged) {
+        // A needs-decision terminal (review blocked / checks failed) writes a
+        // failure record + fires run.blocked even though the lifecycle succeeded.
+        const convIsFailureTerminal = facts.lifecycle !== "succeeded" || convNeedsDecision;
+        if (convIsFailureTerminal) {
             writeFailure(store, paths, {
-                phase: "convergence",
-                category: isBudgetTerminal(status)
+                phase: convNeedsDecision ? "review" : "convergence",
+                category: isBudgetTerminal(facts.reason)
                     ? "budget"
-                    : status === "cancelled"
+                    : facts.lifecycle === "cancelled"
                         ? "cancelled"
-                        : status === "blocked"
+                        : convNeedsDecision
                             ? "policy"
                             : "internal",
-                safeMessage: status === "blocked"
+                safeMessage: convNeedsDecision
                     ? `review escalated to a human decision after ${attempt} attempt(s)`
-                    : status === "stuck_no_progress"
+                    : facts.reason === "stuck_no_progress"
                         ? (stuckNoProgressReason ?? `stuck_no_progress after ${attempt} attempt(s)`)
-                        : `${status} after ${attempt} attempt(s)${lastDiffStable ? "" : " (diff changed after review; review is stale)"}`,
+                        : `${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""} after ${attempt} attempt(s)${lastDiffStable ? "" : " (diff changed after review; review is stale)"}`,
                 harnessId: lastRun?.harnessId,
                 attemptId: lastRun?.attemptId,
                 runDir: paths.root,
-                nextActions: status === "cancelled"
+                nextActions: facts.lifecycle === "cancelled"
                     ? ["Retry if cancellation was accidental"]
-                    : status === "blocked"
+                    : convNeedsDecision
                         ? [
                             "Open the review queue",
                             "Decide the NEEDS_HUMAN findings",
                             "Re-run after the decision",
                         ]
-                        : status === "stuck_no_progress"
+                        : facts.reason === "stuck_no_progress"
                             ? [
                                 "Inspect the stable patch",
                                 "Inspect the failing gate output",
@@ -3215,7 +3406,7 @@ export class Orchestrator {
                             ],
             });
             if (!lastRun) {
-                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Status: ${status}\n- Attempts: ${attempt}\n`);
+                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}\n- Attempts: ${attempt}\n`);
                 log.emit("output.ready", {
                     kind: "summary",
                     path: "final/summary.md",
@@ -3224,13 +3415,18 @@ export class Orchestrator {
             }
         }
         log.emit("work_product.emitted", { winner: lastRun?.attemptId ?? null });
-        const completed = converged || status === "no_op" || status === "ungated" || status === "review_not_run";
-        if (completed) {
-            log.emit("run.completed", { status, attempts: attempt });
+        if (!convIsFailureTerminal) {
+            log.emit("run.completed", {
+                lifecycle: facts.lifecycle,
+                facts,
+                reason: facts.reason,
+                attempts: attempt,
+            });
         }
-        else if (status === "blocked") {
+        else if (facts.lifecycle === "succeeded") {
             log.emit("run.blocked", {
-                status,
+                lifecycle: facts.lifecycle,
+                facts,
                 attempts: attempt,
                 phase: "review",
                 failure_ref: "final/failure.yaml",
@@ -3238,7 +3434,9 @@ export class Orchestrator {
         }
         else {
             log.emit("run.failed", {
-                status,
+                lifecycle: facts.lifecycle,
+                facts,
+                reason: facts.reason,
                 attempts: attempt,
                 phase: "convergence",
                 failure_ref: "final/failure.yaml",
@@ -3249,19 +3447,26 @@ export class Orchestrator {
             runId,
             taskId,
             mode,
-            status,
+            lifecycle: facts.lifecycle,
+            facts,
             winner: lastRun?.attemptId ?? null,
             runDir: paths.root,
             summary: converged
                 ? `converged in ${attempt} attempt(s)`
-                : `${status} after ${attempt} attempt(s)`,
+                : `${facts.lifecycle} after ${attempt} attempt(s)`,
             candidates: lastRun
-                ? [{ attemptId: lastRun.attemptId, harnessId: lastRun.harnessId, status }]
+                ? [
+                    {
+                        attemptId: lastRun.attemptId,
+                        harnessId: lastRun.harnessId,
+                        status: facts.lifecycle,
+                    },
+                ]
                 : [],
             reviewVerified: actualReviewVerified,
         };
     }
-    /** plan mode: multi-harness planning -> aggregate -> (optional) plan review -> SpecPack. Read-only. */
+    /** plan mode: multi-harness planning -> aggregate -> (optional) plan review -> plan. Read-only. */
     /**
      * Wrap the user's goal in an explicit "plan, do not implement" instruction.
      * Without this the raw prompt ("make a racing game") reaches the harness with
@@ -3280,10 +3485,222 @@ export class Orchestrator {
             `1. Approach — 2-3 sentences on how you'd solve this.`,
             `2. Steps — a numbered list; each step names the file(s) it touches and what changes.`,
             `3. Risks & edge cases.`,
-            `4. Open questions — anything ambiguous that needs a decision before implementation.`,
+            `4. End your response with a section titled exactly:`,
+            ``,
+            `## Open Questions`,
+            ``,
+            `List every decision the user must make before implementation, one per bullet, in EXACTLY this format:`,
+            ``,
+            `- [single] <question> :: <option A> :: <option B>`,
+            `- [multi] <question> :: <option A> :: <option B>`,
+            `- [text] <question that has no good fixed options>`,
+            ``,
+            `Rules: [single] = pick exactly one; [multi] = pick one or more; [text] = free-form (no "::" options). Ground every option in THIS repository. If nothing is ambiguous, write a single bullet: - (none)`,
+            ``,
             `Keep it concise. Reference real paths you found. Do NOT paste large code blocks; describe the change instead.`,
         ].join("\n");
     }
+    /**
+     * Run ONE planner spawn (native plan mode, read-only) end to end: budget
+     * lease, spec build, continuity hydration, event streaming, telemetry, and
+     * settle. Shared by the solo plan loop (each pool member is a sequential
+     * fallback) and the Council strategy (each member is a parallel draft, then
+     * one merge iteration on the primary — same machinery, different prompt +
+     * intent). The caller owns bookkeeping that differs per path: which artifact
+     * a success writes to, fallback disclosure, and accumulation.
+     */
+    async runPlannerAttempt(args) {
+        const { input, contract, taskId, runId, log, store, paths, ledger, routed, attemptId } = args;
+        const adapter = routed.adapter;
+        const lease = ledger.reserve({
+            taskId,
+            attemptId,
+            intent: args.intent,
+            harnessId: adapter.id,
+            cost: attemptCostEvidence(adapter.id, attemptId, undefined, this.routeBillingKnowledge(input, adapter.id)),
+        });
+        if (!lease.granted) {
+            log.emit("budget.lease.created", {
+                granted: false,
+                reason: lease.reason,
+                attempt_id: attemptId,
+                harness_id: adapter.id,
+            });
+            return {
+                attemptId,
+                harnessId: adapter.id,
+                status: "failed",
+                error: lease.reason ?? "budget lease denied",
+                text: null,
+                telemetry: null,
+                budgetDenied: true,
+            };
+        }
+        const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
+        const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
+        const planSessionFields = this.sessionSpecFields(input, adapter.id, log);
+        // Continuity (INV-137): a thread PLAN turn is a chat turn — hydrate a
+        // lane switch/gap with a packet and disclose it.
+        const laneContinuity = args.laneRun
+            ? await this.resolveContinuity(input, adapter.id, planSessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, planSessionFields.resume_session_id !== null, store, paths, this.execRootOf(input), log)
+            : null;
+        const spec = HarnessRunSpec.parse({
+            session_id: newId("ses"),
+            intent: args.intent,
+            prompt: laneContinuity?.pointerLine
+                ? `${args.promptBody}\n\n${laneContinuity.pointerLine}`
+                : args.promptBody,
+            cwd: this.execRootOf(input),
+            access: "readonly",
+            // Planners must SEE any image/file the user attached (e.g. "plan a fix for
+            // what's in this screenshot"), not just agent/race runs.
+            attachments: input.attachments ?? [],
+            ...planSessionFields,
+            ...this.harnessSpecKnobs(contract, knobs, args.intent),
+            env_inheritance: envInheritance(this.config(input.repoRoot)),
+            // A thread plan turn spawns in its DURABLE per-lane home so its native
+            // session is reachable for resume next turn (INV-034); a non-thread
+            // plan keeps the disposable route-context home.
+            env: (args.laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? args.fallbackHome,
+        });
+        const plannerAbort = new AbortController();
+        spec.extra["abortSignal"] = input.signal
+            ? AbortSignal.any([input.signal, plannerAbort.signal])
+            : plannerAbort.signal;
+        const planInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
+        if (planInteraction)
+            spec.extra["interactionChannel"] = planInteraction;
+        const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
+        const answer = new AnswerAssembly();
+        const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
+            knobs.webPolicy === "cached" ||
+            knobs.webPolicy === "live", effectiveWeb, [], 
+        // Requested-model capture: a plan lane silently downgraded to another
+        // model surfaces the mismatch in its route receipt, just like agent.
+        knobs.model);
+        const onAbort = () => {
+            void adapter.cancel?.(spec.session_id)?.catch(() => { });
+        };
+        if (input.signal) {
+            if (input.signal.aborted)
+                onAbort();
+            else
+                input.signal.addEventListener("abort", onAbort, { once: true });
+        }
+        let cost = 0;
+        let costEstimated = false;
+        let harnessError = null;
+        const budgetSignalState = { quotaPressureDisclosed: false };
+        try {
+            log.emit("harness.started", {
+                harness_id: adapter.id,
+                attempt_id: attemptId,
+                external_context_policy: knobs.webPolicy,
+                ...(knobs.ignored.length > 0 ? { ignored_settings: knobs.ignored } : {}),
+            });
+            if (!input.signal?.aborted) {
+                const watchedPlan = withInactivityWatchdog(adapter.run(spec), {
+                    timeoutMs: harnessInactivityTimeoutMs(this.config(input.repoRoot)),
+                    onTimeout: () => {
+                        plannerAbort.abort();
+                        void adapter.cancel?.(spec.session_id)?.catch(() => { });
+                    },
+                    isSuspended: () => (planInteraction?.pendingCount?.() ?? 0) > 0,
+                });
+                for await (const ev of watchedPlan) {
+                    if (input.signal?.aborted)
+                        break;
+                    const safeEv = redactHarnessEvent(ev);
+                    safeInvoke(input.onHarnessEvent, safeEv);
+                    // A thread PLAN turn IS a chat turn now (INV-034): its native
+                    // session lives in the DURABLE per-lane home, so record it for the
+                    // next lane turn's resume. Council members are distinct lanes.
+                    if (args.laneRun)
+                        observeNativeSessionEvent(input, adapter.id, safeEv);
+                    observeAuthSwitch(log, adapter.id, attemptId, safeEv);
+                    log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv));
+                    appendLine(attemptEventsPath, JSON.stringify(safeEv));
+                    observeAttemptTelemetry(telemetry, safeEv);
+                    if (safeEv.plan_progress) {
+                        log.emit("plan.progress", {
+                            attempt_id: attemptId,
+                            harness_id: adapter.id,
+                            items: safeEv.plan_progress.items,
+                        });
+                    }
+                    // read-only routes burn quota too — same single owner as the agent loop.
+                    observeBudgetSignals(ledger, log, adapter.id, attemptId, safeEv, budgetSignalState);
+                    this.deps.quotaEventSink?.(adapter.id, safeEv);
+                    if (safeEv.type === "usage" && safeEv.usage?.cost_usd) {
+                        cost += safeEv.usage.cost_usd;
+                        if (safeEv.usage.estimated)
+                            costEstimated = true;
+                        log.emit("budget.observation", {
+                            harness_id: adapter.id,
+                            attempt_id: attemptId,
+                            kind: "spend",
+                            usd: safeEv.usage.cost_usd,
+                            estimated: safeEv.usage.estimated === true,
+                        });
+                    }
+                    // A TYPED final message wins verbatim over joined narration.
+                    answer.observe(safeEv);
+                    if (safeEv.type === "error")
+                        harnessError = safeEv.error ? redactSecrets(safeEv.error) : "harness emitted an error";
+                }
+            }
+        }
+        catch (err) {
+            harnessError = safeErrorMessage(err);
+        }
+        finally {
+            input.signal?.removeEventListener("abort", onAbort);
+            ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode, telemetry.usageCost));
+        }
+        const unrecovered = unrecoveredToolErrors(telemetry);
+        const webBlocked = webUnsatisfied(telemetry);
+        if (!harnessError && webBlocked) {
+            harnessError = `web evidence unsatisfied: ${telemetry.web.errorSummary ?? (telemetry.web.attempted ? "web tool failed without verified recovery" : "web evidence required but never attempted")}`;
+        }
+        if (!harnessError && unrecovered.length > 0) {
+            const first = unrecovered[0];
+            harnessError = `${first.tool} failed without recovery: ${first.summary}`;
+        }
+        if (harnessError) {
+            log.emit("harness.completed", {
+                harness_id: adapter.id,
+                attempt_id: attemptId,
+                status: webBlocked ? "blocked" : "failed",
+                error: harnessError,
+                ...telemetrySummary(telemetry),
+            });
+            return {
+                attemptId,
+                harnessId: adapter.id,
+                status: webBlocked ? "blocked" : "failed",
+                error: harnessError,
+                text: null,
+                telemetry,
+                budgetDenied: false,
+            };
+        }
+        const text = answer.text() || "(no output)";
+        log.emit("harness.completed", {
+            harness_id: adapter.id,
+            attempt_id: attemptId,
+            status: "success",
+            ...telemetrySummary(telemetry),
+        });
+        return {
+            attemptId,
+            harnessId: adapter.id,
+            status: "success",
+            error: null,
+            text,
+            telemetry,
+            budgetDenied: false,
+        };
+    }
     async runPlan(input, announce) {
         const taskId = input.taskId ?? newId("task");
         const runId = input.runId ?? newId("run");
@@ -3308,16 +3725,19 @@ export class Orchestrator {
         });
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
-        const reviewersOutcome = await this.resolveReviewersWithArtifacts(input, log, store, paths, runId, taskId, "plan");
-        if ("failed" in reviewersOutcome)
-            return reviewersOutcome.failed;
-        const reviewers = reviewersOutcome.reviewers;
         // W3.3: ONE resolved read-only context — the routing point-probe and every
-        // planner spawn consume the SAME scoped env (see routeContext.ts).
+        // planner spawn consume the SAME scoped env (see routeContext.ts). The
+        // probe home stays a disposable throwaway even for a thread lane turn (auth
+        // truth is home-independent); only the planner spawn swaps in the durable
+        // per-lane home below so its recorded native session survives.
         const roHome = resolveReadOnlyRouteContext(this.execRootOf(input));
+        // A thread PLAN turn is a chat turn (INV-034): plan candidates are distinct
+        // harnesses run sequentially, so each records its own lane's native session
+        // and the next lane turn resumes it via `sessionSpecFields.resume_session_id`.
+        const laneRun = Boolean(input.threadId);
         let adapters;
         try {
-            adapters = await this.resolveCandidateAdapters({ ...input, n: undefined }, "plan", ledger, roHome);
+            adapters = await this.resolveCandidateAdapters({ ...input, n: undefined }, "plan", ledger, log, roHome);
         }
         catch (err) {
             roHome.dispose();
@@ -3329,10 +3749,12 @@ export class Orchestrator {
                 safeMessage: message,
                 runDir: paths.root,
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (plan)\n\n- Status: failed\n- Phase: routing\n\n${message}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (plan)\n\n- Lifecycle: failed\n- Phase: routing\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                reason: "harness_failed",
                 phase: "routing",
                 error: message,
                 failure_ref: "final/failure.yaml",
@@ -3342,7 +3764,8 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode: "plan",
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
                 winner: null,
                 runDir: paths.root,
                 summary: message,
@@ -3364,10 +3787,12 @@ export class Orchestrator {
                 safeMessage: message,
                 runDir: paths.root,
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (plan)\n\n- Status: failed\n- Phase: context\n\n${message}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (plan)\n\n- Lifecycle: failed\n- Phase: context\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                reason: "harness_failed",
                 phase: "context",
                 error: message,
                 failure_ref: "final/failure.yaml",
@@ -3377,188 +3802,106 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode: "plan",
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
                 winner: null,
                 runDir: paths.root,
                 summary: `context failed: ${message}`,
                 candidates: [],
             };
         }
+        // Council strategy (INV-031): N members draft in parallel, the primary
+        // merges them into ONE plan + one question set. It owns roHome disposal.
+        if (input.council) {
+            return runCouncilPlan(this.planRunDeps(), {
+                input,
+                contract,
+                taskId,
+                runId,
+                store,
+                paths,
+                log,
+                ledger,
+                adapters,
+                roHome,
+                contextSection,
+                laneRun,
+            });
+        }
         const plans = [];
+        let fallbackFrom = null;
         const planAttempts = [];
         const attemptTelemetries = [];
         try {
             for (const [idx, routed] of adapters.entries()) {
                 if (input.signal?.aborted)
                     break;
-                const adapter = routed.adapter;
                 const attemptId = `p${String(idx + 1).padStart(2, "0")}`;
-                const lease = ledger.reserve({
+                const outcome = await this.runPlannerAttempt({
+                    input,
+                    contract,
                     taskId,
+                    runId,
+                    log,
+                    store,
+                    paths,
+                    ledger,
+                    routed,
                     attemptId,
+                    laneRun,
+                    fallbackHome: roHome.env,
+                    promptBody: this.planPrompt(input.prompt) + contextSection,
                     intent: "plan",
-                    harnessId: adapter.id,
-                    cost: attemptCostEvidence(adapter.id, attemptId, undefined, this.routeBillingKnowledge(input, adapter.id)),
                 });
-                if (!lease.granted) {
-                    log.emit("budget.lease.created", {
-                        granted: false,
-                        reason: lease.reason,
-                        attempt_id: attemptId,
-                        harness_id: adapter.id,
-                    });
+                if (outcome.budgetDenied)
                     break;
-                }
-                const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
-                const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
-                const spec = HarnessRunSpec.parse({
-                    session_id: newId("ses"),
-                    intent: "plan",
-                    prompt: this.planPrompt(input.prompt) + contextSection + relayPriorPlansSection(plans),
-                    cwd: this.execRootOf(input),
-                    access: "readonly",
-                    // Planners must SEE any image/file the user attached (e.g. "plan a fix for
-                    // what's in this screenshot"), not just agent/race runs.
-                    attachments: input.attachments ?? [],
-                    ...this.sessionSpecFields(input, adapter.id, log),
-                    ...this.harnessSpecKnobs(contract, knobs, "plan"),
-                    env_inheritance: envInheritance(this.config(input.repoRoot)),
-                    env: roHome.env,
-                });
-                const plannerAbort = new AbortController();
-                spec.extra["abortSignal"] = input.signal
-                    ? AbortSignal.any([input.signal, plannerAbort.signal])
-                    : plannerAbort.signal;
-                const planInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
-                if (planInteraction)
-                    spec.extra["interactionChannel"] = planInteraction;
-                const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
-                const answer = new AnswerAssembly();
-                const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
-                    knobs.webPolicy === "cached" ||
-                    knobs.webPolicy === "live", effectiveWeb, [], 
-                // Requested-model capture: a plan lane silently downgraded to another
-                // model surfaces the mismatch in its route receipt, just like agent.
-                knobs.model);
-                const onAbort = () => {
-                    void adapter.cancel?.(spec.session_id)?.catch(() => { });
-                };
-                if (input.signal) {
-                    if (input.signal.aborted)
-                        onAbort();
-                    else
-                        input.signal.addEventListener("abort", onAbort, { once: true });
-                }
-                let cost = 0;
-                let costEstimated = false;
-                let harnessError = null;
-                const budgetSignalState = { quotaPressureDisclosed: false };
-                try {
-                    log.emit("harness.started", {
-                        harness_id: adapter.id,
-                        attempt_id: attemptId,
-                        external_context_policy: knobs.webPolicy,
-                        ...(knobs.ignored.length > 0 ? { ignored_settings: knobs.ignored } : {}),
+                if (outcome.telemetry)
+                    attemptTelemetries.push({
+                        attemptId,
+                        harnessId: outcome.harnessId,
+                        telemetry: outcome.telemetry,
                     });
-                    if (!input.signal?.aborted) {
-                        const watchedPlan = withInactivityWatchdog(adapter.run(spec), {
-                            timeoutMs: harnessInactivityTimeoutMs(this.config(input.repoRoot)),
-                            onTimeout: () => {
-                                plannerAbort.abort();
-                                void adapter.cancel?.(spec.session_id)?.catch(() => { });
-                            },
-                            isSuspended: () => (planInteraction?.pendingCount?.() ?? 0) > 0,
+                planAttempts.push({
+                    attemptId,
+                    harnessId: outcome.harnessId,
+                    status: outcome.status,
+                    error: outcome.error,
+                });
+                if (outcome.status !== "success") {
+                    const next = adapters[idx + 1];
+                    if (next && !input.signal?.aborted) {
+                        fallbackFrom = outcome.harnessId;
+                        log.emit("route.fallback.started", {
+                            from_harness: outcome.harnessId,
+                            to_harness: next.adapter.id,
+                            attempt_id: attemptId,
+                            reason: "planner_failed",
                         });
-                        for await (const ev of watchedPlan) {
-                            if (input.signal?.aborted)
-                                break;
-                            const safeEv = redactHarnessEvent(ev);
-                            safeInvoke(input.onHarnessEvent, safeEv);
-                            // NOT observed for resume: a read-only planner is not a chat turn,
-                            // and attaching its session id would poison thread continuity (and
-                            // race parallel planner/reviewer sessions), regardless of whether
-                            // the vendor stored that session in the scoped or native store.
-                            observeAuthSwitch(log, adapter.id, attemptId, safeEv);
-                            log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv));
-                            appendLine(attemptEventsPath, JSON.stringify(safeEv));
-                            observeAttemptTelemetry(telemetry, safeEv);
-                            if (safeEv.plan_progress) {
-                                log.emit("plan.progress", {
-                                    attempt_id: attemptId,
-                                    harness_id: adapter.id,
-                                    items: safeEv.plan_progress.items,
-                                });
-                            }
-                            // read-only routes burn quota too (the orchestrate PLANNER is
-                            // the loudest) — same single owner as the agent loop.
-                            observeBudgetSignals(ledger, log, adapter.id, attemptId, safeEv, budgetSignalState);
-                            this.deps.quotaEventSink?.(adapter.id, safeEv);
-                            if (safeEv.type === "usage" && safeEv.usage?.cost_usd) {
-                                cost += safeEv.usage.cost_usd;
-                                if (safeEv.usage.estimated)
-                                    costEstimated = true;
-                                log.emit("budget.observation", {
-                                    harness_id: adapter.id,
-                                    attempt_id: attemptId,
-                                    kind: "spend",
-                                    usd: safeEv.usage.cost_usd,
-                                    estimated: safeEv.usage.estimated === true,
-                                });
-                            }
-                            // A TYPED final message wins verbatim over joined narration.
-                            answer.observe(safeEv);
-                            if (safeEv.type === "error")
-                                harnessError = safeEv.error
-                                    ? redactSecrets(safeEv.error)
-                                    : "harness emitted an error";
-                        }
                     }
+                    else if (fallbackFrom || next === undefined) {
+                        log.emit("route.fallback.exhausted", {
+                            harness_id: outcome.harnessId,
+                            attempt_id: attemptId,
+                            reason: "planner_failed",
+                        });
+                    }
+                    continue;
                 }
-                catch (err) {
-                    harnessError = safeErrorMessage(err);
-                }
-                finally {
-                    input.signal?.removeEventListener("abort", onAbort);
-                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode));
-                }
-                attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
-                const unrecovered = unrecoveredToolErrors(telemetry);
-                const webBlocked = webUnsatisfied(telemetry);
-                if (!harnessError && webBlocked) {
-                    harnessError = `web evidence unsatisfied: ${telemetry.web.errorSummary ?? (telemetry.web.attempted ? "web tool failed without verified recovery" : "web evidence required but never attempted")}`;
-                }
-                if (!harnessError && unrecovered.length > 0) {
-                    const first = unrecovered[0];
-                    harnessError = `${first.tool} failed without recovery: ${first.summary}`;
-                }
-                if (harnessError) {
-                    // One failed planner does not abort a multi-harness plan; the run fails
-                    // only when EVERY planner fails (parity with explore).
-                    log.emit("harness.completed", {
-                        harness_id: adapter.id,
+                const text = outcome.text ?? "(no output)";
+                plans.push({ id: outcome.harnessId, text });
+                store.writeText(join(paths.root, "plans", `${outcome.harnessId}.md`), redactSecrets(text) + "\n");
+                // Solo planning (D31): the FIRST successful planner is the plan; later
+                // pool members are a sequential fallback chain (ask parity), not
+                // parallel co-authors. Council re-enables the multi-draft round.
+                if (fallbackFrom) {
+                    log.emit("route.fallback.completed", {
+                        harness_id: outcome.harnessId,
                         attempt_id: attemptId,
-                        status: webBlocked ? "blocked" : "failed",
-                        error: harnessError,
-                        ...telemetrySummary(telemetry),
+                        status: "success",
+                        reason: "planner_failed",
                     });
-                    planAttempts.push({
-                        attemptId,
-                        harnessId: adapter.id,
-                        status: webBlocked ? "blocked" : "failed",
-                        error: harnessError,
-                    });
-                    continue;
                 }
-                const text = answer.text() || "(no output)";
-                log.emit("harness.completed", {
-                    harness_id: adapter.id,
-                    attempt_id: attemptId,
-                    status: "success",
-                    ...telemetrySummary(telemetry),
-                });
-                planAttempts.push({ attemptId, harnessId: adapter.id, status: "success", error: null });
-                plans.push({ id: adapter.id, text });
-                store.writeText(join(paths.root, "plans", `${adapter.id}.md`), redactSecrets(text) + "\n");
+                break;
             }
         }
         finally {
@@ -3573,116 +3916,18 @@ export class Orchestrator {
             })), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, "plan", attemptTelemetries, null), ledger.spend(), input.signal, store);
         }
         if (plans.length === 0) {
-            const blocked = planAttempts.some((p) => p.status === "blocked");
-            const message = planAttempts
-                .map((p) => `${p.attemptId}/${p.harnessId}: ${p.error ?? "failed"}`)
-                .join("\n") || "all planners failed";
-            this.writeRunTelemetry(store, paths, contract, runId, taskId, "plan", attemptTelemetries, null);
-            store.writeText(join(paths.contextDir, "context_error.md"), `# Harness Error\n\n${message}\n`);
-            writeFailure(store, paths, {
-                phase: "harness",
-                category: blocked ? "policy" : "harness_error",
-                safeMessage: message,
-                eventRefs: planAttempts.map((p) => `attempts/${p.attemptId}/events.jsonl`),
-                runDir: paths.root,
-                nextActions: ["Open diagnostics", "Check harness authentication", "Retry after setup"],
-            });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (plan)\n\n- Status: ${blocked ? "blocked" : "failed"}\n\n${message}\n`);
-            log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
-            if (blocked)
-                log.emit("run.blocked", {
-                    status: "blocked",
-                    phase: "harness",
-                    error: message,
-                    failure_ref: "final/failure.yaml",
-                });
-            else
-                log.emit("run.failed", {
-                    status: "failed",
-                    phase: "harness",
-                    error: message,
-                    failure_ref: "final/failure.yaml",
-                });
-            return {
-                spendUsd: ledger.spend(),
-                runId,
-                taskId,
-                mode: "plan",
-                status: blocked ? "blocked" : "failed",
-                winner: null,
-                runDir: paths.root,
-                summary: message,
-                candidates: planAttempts.map((p) => ({
-                    attemptId: p.attemptId,
-                    harnessId: p.harnessId,
-                    status: p.status,
-                })),
-            };
-        }
-        let ambiguities = [];
-        let reviewFindings = [];
-        if (reviewers.length > 0 && plans.length > 0) {
-            const reviewDir = join(paths.root, "review-evidence");
-            const planEvidence = plans.map((p) => `## Plan from ${p.id}\n${p.text}`).join("\n\n");
-            const planReviewDiff = "(plan review — no code diff)\n";
-            writeEvidencePacket(reviewDir, {
-                userIntent: redactSecrets(input.prompt),
-                planAccepted: planEvidence,
-                diff: planReviewDiff,
-                tests: renderTestsEvidence(contract),
-            });
-            // Reserve BEFORE spending: a hard budget tier must stop the paid plan
-            // review from starting, not account for it after the fact.
-            const lease = ledger.reserve({
+            return writePlanHarnessFailure(this.planRunDeps(), {
+                input,
+                contract,
                 taskId,
-                attemptId: "plan-review",
-                intent: "review",
-                harnessId: "review-panel",
-                cost: attemptCostEvidence("review-panel", "plan-review"),
-            });
-            if (lease.granted) {
-                const res = await this.reviewScoped({
-                    candidateLabel: "Plan",
-                    diff: planReviewDiff,
-                    evidenceDir: reviewDir,
-                    artifactsDir: join(paths.reviewsDir, "plan-reviewers"),
-                    cwd: this.execRootOf(input),
-                    reviewers,
-                    envInheritance: envInheritance(this.config(input.repoRoot)),
-                    signal: input.signal,
-                    onReviewerEvent: (event) => log.emit(event.type, { ...event }),
-                });
-                reviewFindings = await revalidateFindings(res.findings, {
-                    candidateRoot: this.execRootOf(input),
-                    evidenceDir: reviewDir,
-                });
-                ambiguities = reviewFindings.filter((f) => f.category === "spec_gap" || f.severity === "NEEDS_HUMAN");
-                store.writeYaml(join(paths.reviewsDir, "plan-review.yaml"), {
-                    findings: reviewFindings,
-                    route_proofs: res.routeProofs,
-                    reviewer_requests: res.reviewerRequests,
-                });
-                ledger.settle(lease.lease?.lease_id ?? "", usageCostSettlement(res.reviewSpendUsd, res.reviewSpendEstimated, "review-usage", [
-                    "attempt:plan-review",
-                    "review:panel",
-                ]));
-                if ((res.reviewSpendUsd ?? 0) > 0) {
-                    log.emit("budget.observation", {
-                        harness_id: "review-panel",
-                        kind: "spend",
-                        usd: res.reviewSpendUsd,
-                        estimated: res.reviewSpendEstimated,
-                    });
-                }
-            }
-            else {
-                log.emit("budget.lease.created", {
-                    granted: false,
-                    reason: lease.reason,
-                    attempt_id: "plan-review",
-                    harness_id: "review-panel",
-                });
-            }
+                runId,
+                store,
+                paths,
+                log,
+                ledger,
+                planAttempts,
+                attemptTelemetries,
+            }, "all planners failed");
         }
         if (input.signal?.aborted) {
             return cancelledResult(log, runId, taskId, "plan", paths.root, planAttempts.map((p) => ({
@@ -3691,132 +3936,69 @@ export class Orchestrator {
                 status: p.status,
             })), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, "plan", attemptTelemetries, null), ledger.spend(), input.signal, store);
         }
-        const failedPlanners = planAttempts.filter((p) => p.status !== "success");
-        // ALL review findings are shown (severity-marked), so a BLOCK like "the
-        // requested feature is not delivered" is visible on the plan itself — not
-        // silently filtered down to spec_gap/NEEDS_HUMAN the way v0.9 hid it.
-        const blockingFindings = reviewFindings.filter((f) => isBlocking(f));
-        const sevMark = {
-            BLOCK: "🔴 BLOCK",
-            FIX_FIRST: "🟠 FIX_FIRST",
-            NEEDS_HUMAN: "🟠 NEEDS_HUMAN",
-        };
-        const planDoc = [
-            `# Plan`,
-            "",
-            `## Goal`,
-            redactSecrets(input.prompt),
-            "",
-            `## Plan${plans.length > 1 ? "s" : ""} (${plans.length}/${planAttempts.length} planner${planAttempts.length === 1 ? "" : "s"})`,
-            ...plans.map((p) => `\n### Plan — ${p.id}\n${redactSecrets(p.text)}`),
-            ...(reviewFindings.length > 0
-                ? [
-                    "",
-                    "## Review findings",
-                    ...reviewFindings.map((f) => `- ${sevMark[f.severity] ?? f.severity}: ${redactSecrets(f.claim)}`),
-                ]
-                : []),
-            ...(ambiguities.length > 0
-                ? ["", "## Open questions", ...ambiguities.map((a) => `- ${redactSecrets(a.claim)}`)]
-                : []),
-            ...(failedPlanners.length > 0
-                ? [
-                    "",
-                    "## Planner omissions",
-                    ...failedPlanners.map((p) => `- ${p.attemptId} / ${p.harnessId} ${p.status}: ${p.error}`),
-                ]
-                : []),
-            "",
-        ].join("\n");
-        store.writeText(join(paths.finalDir, "plan.md"), planDoc + "\n");
-        // A plan is a delivered work product (a report), even with risks — parity
-        // with the other read-only modes (removes the "only successful mode with no
-        // work_product" anomaly). result_kind=plan tells surfaces NO files changed.
-        store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
-            id: newId("wp"),
-            kind: "report",
-            source_task_id: taskId,
-            producer_attempt_id: planAttempts.find((p) => p.status === "success")?.attemptId ?? null,
-            meta: {
-                mode: "plan",
-                result_kind: "plan",
-                planners: plans.length,
-                diffstat: { files: 0, additions: 0, deletions: 0 },
-                blockers: blockingFindings.length,
-                adopted: null,
-            },
+        return finalizePlanRun(this.planRunDeps(), {
+            input,
+            contract,
+            taskId,
+            runId,
+            store,
+            paths,
+            log,
+            ledger,
+            plans,
+            planAttempts,
+            attemptTelemetries,
+            council: null,
         });
-        // Canonical summary artifact (parity with every other mode's final/ layout).
-        store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (plan)\n\n- Status: success (plan only — no files changed)\n- Planners: ${plans.length}/${planAttempts.length} succeeded\n- Plan: final/plan.md\n- Review blockers: ${blockingFindings.length}\n- Open questions: ${ambiguities.length}\n${failedPlanners.length > 0 ? `- Omissions: ${failedPlanners.map((p) => `${p.harnessId} ${p.status}`).join(", ")}\n` : ""}`);
-        this.writeRunTelemetry(store, paths, contract, runId, taskId, "plan", attemptTelemetries, planAttempts.find((p) => p.status === "success")?.attemptId ?? null);
-        log.emit("output.ready", { kind: "plan", path: "final/plan.md" });
-        log.emit("run.completed", { status: "success" });
+    }
+    /** Bind the few orchestrator methods planRun.ts needs (the rest of its
+     * collaborators are module-level imports). Kept as a factory so each call
+     * gets correctly-bound `this` without leaking the whole orchestrator. */
+    planRunDeps() {
         return {
-            spendUsd: ledger.spend(),
-            runId,
-            taskId,
-            mode: "plan",
-            status: "success",
-            winner: null,
-            runDir: paths.root,
-            summary: `Plan from ${plans.length} planner(s); ${blockingFindings.length} blocker(s), ${ambiguities.length} open question(s).`,
-            candidates: planAttempts.map((p) => ({
-                attemptId: p.attemptId,
-                harnessId: p.harnessId,
-                status: p.status,
-            })),
+            runPlannerAttempt: (a) => this.runPlannerAttempt(a),
+            writeRunTelemetry: (store, paths, contract, runId, taskId, mode, attempts, finalAttemptId) => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, attempts, finalAttemptId),
+            execRootOf: (input) => this.execRootOf(input),
+            planPrompt: (goal) => this.planPrompt(goal),
         };
     }
     /** ask: one selected harness answers read-only questions; no patch/apply controls. */
     async runAsk(input, announce) {
         return this.runReadOnlyReport(input, {
             mode: "ask",
-            swarm: false,
+            deepScan: false,
             intent: "explain",
             title: "Answer",
             artifactName: "answer.md",
             defaultPrompt: "Answer the user's question.",
         }, announce);
     }
-    /** audit --swarm: bounded read-only research swarm (the old `explore` mode). */
-    async runExplore(input, announce) {
-        return this.runReadOnlyReport(input, {
-            mode: "audit",
-            swarm: true,
-            intent: "audit",
-            title: "Explore synthesis",
-            artifactName: "explore.md",
-            defaultPrompt: "Explore this repository and synthesize evidence-cited findings, omissions, and follow-up questions.",
-        }, announce);
-    }
-    /** audit: single read-only audit/map report. */
-    async runAudit(input, announce) {
+    /** ask --deep-scan: bounded multi-scout research sweep with synthesis
+     * (the old `audit --swarm` / `explore`). */
+    async runDeepScan(input, announce) {
         return this.runReadOnlyReport(input, {
-            mode: "audit",
-            swarm: false,
+            mode: "ask",
+            deepScan: true,
             intent: "audit",
-            title: "Audit report",
+            title: "Deep scan synthesis",
             artifactName: "report.md",
-            defaultPrompt: "audit this repository",
+            defaultPrompt: "Explore this repository and synthesize evidence-cited findings, omissions, and follow-up questions.",
         }, announce);
     }
     resolvePaidBudget(inputBudget, cfg) {
         return inputBudget ?? this.deps.paidBudget ?? cfg.global.budget.paid_budget_per_run;
     }
-    rootLedger(input, contract, log) {
-        // A passed-in ledger (orchestrate sub-runs) keeps its OWNER's cash
-        // disclosure — the parent run owns the budget, so its event log gets the
-        // budget.cash events. A fresh root ledger discloses into THIS run's log:
-        // the ledger is the one owner of the cash fact (subscription-entitled
-        // work settles to 0 there), and the UI renders `budget.cash` verbatim —
-        // never inferring money from route labels (W4.3 sol #15).
-        const ledger = input.budgetLedger ??
-            new BudgetLedger(contract.budget.paid_budget, undefined, {
-                onCashSettled: (cashSpendUsd, valuationUsd) => log.emit("budget.cash", {
-                    cash_spend_usd: cashSpendUsd,
-                    valuation_usd: valuationUsd,
-                }),
-            });
+    rootLedger(_input, contract, log) {
+        // The root ledger discloses into THIS run's log: the ledger is the one
+        // owner of the cash fact (subscription-entitled work settles to 0 there),
+        // and the UI renders `budget.cash` verbatim — never inferring money from
+        // route labels (W4.3 sol #15).
+        const ledger = new BudgetLedger(contract.budget.paid_budget, undefined, {
+            onCashSettled: (cashSpendUsd, valuationUsd) => log.emit("budget.cash", {
+                cash_spend_usd: cashSpendUsd,
+                valuation_usd: valuationUsd,
+            }),
+        });
         for (const snapshot of this.deps.quotaSnapshots?.() ?? []) {
             ledger.observeQuotaSnapshot(snapshot);
         }
@@ -3835,55 +4017,12 @@ export class Orchestrator {
             ? "metered"
             : "unknown";
     }
-    async runOrchestrate(input, announce) {
-        // "Doctor-verified" must mean status ok — degraded key-present routes are
-        // excluded from the pool the planner plans over (readiness honesty).
-        const pool = await this.gateway.doctorOkReal({ cwd: input.repoRoot }, "orchestrate");
-        const crossFamily = pool.length >= 2;
-        const goal = input.prompt || "Plan the next move for this repository.";
-        // The typed orchestration contract is a REAL persisted artifact (producer
-        // here, consumers: the planner prompt below + the plan validator).
-        // Autonomy is producer-supplied (control-api/CLI -> daemon -> RunInput);
-        // the executor below is its consumer. Default `suggest` (plan-only) preserves
-        // the read-only contract when no autonomy is requested.
-        const autonomy = input.autonomy ?? "suggest";
-        const paidBudget = this.resolvePaidBudget(input.paidBudget, this.config(input.repoRoot));
-        const orchestrateContract = OrchestrateContractSchema.parse({
-            thread_id: input.threadId ?? newId("th"),
-            goal,
-            budget: { paid_budget: paidBudget, max_tool_calls: input.maxToolCalls ?? null },
-            autonomy,
-        });
-        const plannerPrompt = buildOrchestratePlannerPrompt(goal, pool, crossFamily, orchestrateContract);
-        return this.runReadOnlyReport(
-        // The executed pool is pinned to the PLANNED pool (no double doctor
-        // resolution drift between the prompt's claims and the actual route).
-        // The planner must NOT resume or overwrite the thread's conversational
-        // session — it speaks its own tool-belt framing, not the user's chat.
-        {
-            ...input,
-            resumeSessions: undefined,
-            onSessionObserved: undefined,
-            harnesses: input.harnesses ?? (pool.length > 0 ? pool : undefined),
-            prompt: plannerPrompt,
-        }, {
-            mode: "orchestrate",
-            swarm: false,
-            intent: "orchestrate",
-            title: "Orchestration plan",
-            artifactName: "orchestration.md",
-            defaultPrompt: plannerPrompt,
-            contractIntent: goal,
-            orchestrateContract,
-        }, announce);
-    }
     async runReadOnlyReport(input, opts, announce) {
         const taskId = input.taskId ?? newId("task");
         const runId = input.runId ?? newId("run");
         const prompt = input.prompt || opts.defaultPrompt;
         // Contract validation BEFORE the run is announced (see runRace). The
-        // recorded user intent is the CALLER's goal, not a synthesized wrapper
-        // prompt (orchestrate wraps the goal in a planner prompt).
+        // recorded user intent is the CALLER's goal.
         const contract = this.buildContract({ ...input, prompt: opts.contractIntent ?? prompt }, taskId, opts.mode);
         const store = this.artifactStore(input);
         const paths = store.createRun(runId);
@@ -3903,61 +4042,32 @@ export class Orchestrator {
         });
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
-        if (opts.orchestrateContract) {
-            store.writeYaml(join(paths.contextDir, "orchestrate_contract.yaml"), opts.orchestrateContract);
-        }
-        // Lazy ContextPack: explore/audit attach the compact scope atlas; ask stays bare.
-        let contextSection = "";
-        if (opts.mode !== "ask") {
-            try {
-                contextSection = await this.lazyContextSection(input, contract, store, paths, log);
-            }
-            catch (err) {
-                const message = safeErrorMessage(err);
-                store.writeText(join(paths.contextDir, "context_error.md"), `# Context Error\n\n${message}\n`);
-                writeFailure(store, paths, {
-                    phase: "context",
-                    category: "project",
-                    safeMessage: message,
-                    runDir: paths.root,
-                });
-                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Status: failed\n- Phase: context\n\n${message}\n`);
-                log.emit("output.ready", {
-                    kind: "summary",
-                    path: "final/summary.md",
-                    state: "diagnostic",
-                });
-                log.emit("run.failed", {
-                    status: "failed",
-                    phase: "context",
-                    error: message,
-                    failure_ref: "final/failure.yaml",
-                });
-                return {
-                    runId,
-                    taskId,
-                    mode: opts.mode,
-                    status: "failed",
-                    winner: null,
-                    runDir: paths.root,
-                    summary: `context failed: ${message}`,
-                    candidates: [],
-                };
-            }
-        }
+        // The ask/deep-scan report stays bare (its scouts read the tree themselves);
+        // no lazy ContextPack section is attached here.
+        const contextSection = "";
         const externalContextPolicy = contract.external_context.policy;
-        const width = opts.swarm
+        const width = opts.deepScan
             ? Math.min(Math.max(input.n ?? 4, 1), 8)
             : externalContextPolicy === "off"
                 ? 1
                 : Math.min(Math.max(input.n ?? 2, 1), 3);
         // W3.3: ONE resolved read-only context — the routing point-probe and every
         // read-only attempt spawn consume the SAME scoped env (see routeContext.ts).
+        // The point-probe home is a disposable throwaway even for a thread lane
+        // turn: readiness auth truth is home-INDEPENDENT (credentials come from the
+        // profile/keychain/default store, never the scoped home), so the probe and
+        // the run share the same auth source; only the ACTUAL spawn swaps in the
+        // durable per-lane home below so the recorded native session survives.
         const roHome = resolveReadOnlyRouteContext(this.execRootOf(input));
+        // A thread ASK turn is a chat turn: its native session is recorded per lane
+        // and the next lane turn resumes it (INV-034). Deep-scan (multi-scout
+        // research) and orchestrate (tool-belt planner, not the user's chat) are
+        // NOT lane chat turns — they keep the disposable home and record nothing.
+        const laneRun = Boolean(input.threadId) && opts.mode === "ask" && !opts.deepScan;
         let adapters;
         try {
-            adapters = await this.resolveCandidateAdapters({ ...input, prompt, n: width }, opts.intent, ledger, roHome);
-            if (!opts.swarm) {
+            adapters = await this.resolveCandidateAdapters({ ...input, prompt, n: width }, opts.intent, ledger, log, roHome);
+            if (!opts.deepScan) {
                 const seen = new Set();
                 adapters = adapters.filter((routed) => {
                     if (seen.has(routed.adapter.id))
@@ -3977,10 +4087,12 @@ export class Orchestrator {
                 safeMessage: message,
                 runDir: paths.root,
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Status: failed\n- Phase: routing\n\n${message}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Lifecycle: failed\n- Phase: routing\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                reason: "harness_failed",
                 phase: "routing",
                 error: message,
                 failure_ref: "final/failure.yaml",
@@ -3989,7 +4101,8 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode: opts.mode,
-                status: "failed",
+                lifecycle: "failed",
+                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
                 winner: null,
                 runDir: paths.root,
                 summary: message,
@@ -4030,17 +4143,26 @@ export class Orchestrator {
             }
             const knobs = this.routeSpecKnobs(routed, contract, modelOverride, input.effort);
             const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
-            const explorerPrompt = (opts.swarm
+            const explorerPrompt = (opts.deepScan
                 ? `${prompt}\n\nExplorer ${idx + 1}/${adapters.length}: focus on a distinct slice. Emit evidence-cited findings, explicit unknowns/omissions, and follow-up questions. Do not edit files.`
                 : prompt) + contextSection;
             const sessionFields = this.sessionSpecFields(input, adapter.id, log);
             const grantResume = sessionFields.resume_session_id !== null && !resumeGranted.has(adapter.id);
             if (grantResume)
                 resumeGranted.add(adapter.id);
+            // Continuity (INV-137): a thread ASK turn is a chat turn — hydrate a lane
+            // switch/gap with a packet and disclose it. Gated on laneRun (deep-scan
+            // scouts are excluded from laneRun); native resume is available only when
+            // this slot was granted the lane's recorded session.
+            const laneContinuity = laneRun
+                ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, grantResume, store, paths, this.execRootOf(input), log)
+                : null;
             let spec = HarnessRunSpec.parse({
                 session_id: newId("ses"),
                 intent: opts.intent,
-                prompt: explorerPrompt,
+                prompt: laneContinuity?.pointerLine
+                    ? `${explorerPrompt}\n\n${laneContinuity.pointerLine}`
+                    : explorerPrompt,
                 cwd: this.execRootOf(input),
                 access: "readonly",
                 // ASK/EXPLORE/AUDIT read-only runs must forward the user's attachments —
@@ -4052,19 +4174,10 @@ export class Orchestrator {
                 resume_session_id: grantResume ? sessionFields.resume_session_id : null,
                 ...this.harnessSpecKnobs(contract, knobs, opts.intent),
                 env_inheritance: envInheritance(this.config(input.repoRoot)),
-                env: roHome.env,
-                // Structured output: the orchestrate PLANNER's deliverable IS the
-                // typed plan — constrain schema-capable routes to it. Capability-gated:
-                // routes without json_schema_output keep fenced-JSON parsing. ALSO
-                // gated off when this spec will ride the INTERACTIVE stream-json
-                // transport (an interaction channel will be offered): --json-schema x
-                // interactive is an unverified vendor combination — fenced parsing
-                // carries those runs until it is live-verified.
-                ...(opts.intent === "orchestrate" &&
-                    routed.supportsJsonSchemaOutput &&
-                    !(Boolean(input.onInteraction) && routed.supportsInteractive)
-                    ? { output_schema: orchestratePlanJsonSchema() }
-                    : {}),
+                // A thread lane turn spawns in its DURABLE per-lane home so the native
+                // session it records is reachable for resume next turn; everything else
+                // uses the disposable route-context home.
+                env: (laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? roHome.env,
             });
             const reportAbort = new AbortController();
             spec.extra["abortSignal"] = input.signal
@@ -4131,9 +4244,14 @@ export class Orchestrator {
                                 break;
                             const safeEv = redactHarnessEvent(ev);
                             safeInvoke(input.onHarnessEvent, safeEv);
-                            // NOT observed for resume: this read-only attempt is not a chat
-                            // turn. Recording its id would poison thread continuity and can
-                            // race parallel read-only sessions, regardless of storage route.
+                            // A thread ASK turn IS a chat turn now (INV-034): its native
+                            // session lives in the DURABLE per-lane home, so record it for the
+                            // next lane turn's resume. The read-only fallback chain is
+                            // sequential (never the parallel deep-scan swarm, which is
+                            // excluded from `laneRun`), so recordSession's upsert keeps the
+                            // latest lane session without a race.
+                            if (laneRun)
+                                observeNativeSessionEvent(input, adapter.id, safeEv);
                             observeAuthSwitch(log, adapter.id, attemptId, safeEv);
                             log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv));
                             appendLine(attemptEventsPath, JSON.stringify(safeEv));
@@ -4226,7 +4344,7 @@ export class Orchestrator {
             }
             finally {
                 input.signal?.removeEventListener("abort", onAbort);
-                ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode));
+                ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode, telemetry.usageCost));
             }
             if (harnessError && telemetry.transientFailures.length > 0) {
                 log.emit("route.transient.exhausted", {
@@ -4269,7 +4387,7 @@ export class Orchestrator {
                     error: harnessError,
                     telemetry,
                 });
-                if (opts.swarm) {
+                if (opts.deepScan) {
                     store.writeText(join(paths.findingsDir, `${attemptId}-error.md`), `# Explorer ${attemptId} failed\n\n${harnessError}\n`);
                 }
                 return;
@@ -4288,7 +4406,7 @@ export class Orchestrator {
                 error: null,
                 telemetry,
             });
-            if (opts.swarm) {
+            if (opts.deepScan) {
                 const warningNote = toolWarnings(telemetry).length
                     ? `\n\n> Tool warnings: ${toolWarnings(telemetry)
                         .map((e) => `${e.tool}: ${e.summary}`)
@@ -4298,7 +4416,7 @@ export class Orchestrator {
             }
         };
         try {
-            if (opts.swarm) {
+            if (opts.deepScan) {
                 // Explorer swarm runs in parallel (bounded), mirroring parallel candidates.
                 await runBounded(adapters, Math.min(adapters.length, MAX_PARALLEL_CANDIDATES), runReadonlyAttempt);
             }
@@ -4388,7 +4506,7 @@ export class Orchestrator {
             })), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null), ledger.spend(), input.signal, store);
         }
         const succeededReadonly = attempts.filter((a) => a.status === "success");
-        if (!opts.swarm && succeededReadonly.length === 0) {
+        if (!opts.deepScan && succeededReadonly.length === 0) {
             const last = attempts[attempts.length - 1];
             const webBlocked = attempts.some((a) => a.status === "blocked");
             const singleError = last?.error ?? (budgetStopped ? "budget exhausted before any attempt" : "harness failed");
@@ -4422,16 +4540,17 @@ export class Orchestrator {
                 runDir: paths.root,
                 nextActions: ["Open diagnostics", "Check harness authentication", "Retry after setup"],
             });
-            const terminal = webBlocked
-                ? "blocked"
+            const terminalFacts = webBlocked
+                ? makeOutcomeFacts("succeeded", { review: "blocked", reason: "review_blocked" })
                 : budgetStopped && attempts.length === 0
-                    ? "exhausted"
-                    : "failed";
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harness: ${last?.harnessId ?? "none"}\n- Status: ${terminal}\n\n${singleError}\n`);
+                    ? makeOutcomeFacts("failed", { reason: "budget_exhausted" })
+                    : makeOutcomeFacts("failed", { reason: "harness_failed" });
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harness: ${last?.harnessId ?? "none"}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}\n\n${singleError}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
-            if (terminal === "blocked") {
+            if (terminalFacts.lifecycle === "succeeded") {
                 log.emit("run.blocked", {
-                    status: terminal,
+                    lifecycle: terminalFacts.lifecycle,
+                    facts: terminalFacts,
                     harness_id: last?.harnessId,
                     error: singleError,
                     failure_ref: "final/failure.yaml",
@@ -4439,7 +4558,9 @@ export class Orchestrator {
             }
             else {
                 log.emit("run.failed", {
-                    status: terminal,
+                    lifecycle: terminalFacts.lifecycle,
+                    facts: terminalFacts,
+                    reason: terminalFacts.reason,
                     harness_id: last?.harnessId,
                     error: singleError,
                     failure_ref: "final/failure.yaml",
@@ -4450,7 +4571,8 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode: opts.mode,
-                status: terminal,
+                lifecycle: terminalFacts.lifecycle,
+                facts: terminalFacts,
                 winner: null,
                 runDir: paths.root,
                 summary: singleError,
@@ -4462,7 +4584,7 @@ export class Orchestrator {
             };
         }
         const succeeded = succeededReadonly;
-        if (opts.swarm && succeeded.length === 0) {
+        if (opts.deepScan && succeeded.length === 0) {
             const message = attempts
                 .map((a) => `${a.attemptId}/${a.harnessId}: ${a.error ?? "failed"}`)
                 .join("\n");
@@ -4481,18 +4603,24 @@ export class Orchestrator {
                     "Retry after setup",
                 ],
             });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Status: ${blocked ? "blocked" : "failed"}\n\n${message}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Lifecycle: ${blocked ? "succeeded (needs review)" : "failed"}\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
+            const scanFailFacts = blocked
+                ? makeOutcomeFacts("succeeded", { review: "blocked", reason: "review_blocked" })
+                : makeOutcomeFacts("failed", { reason: "harness_failed" });
             if (blocked)
                 log.emit("run.blocked", {
-                    status: "blocked",
+                    lifecycle: scanFailFacts.lifecycle,
+                    facts: scanFailFacts,
                     phase: "harness",
                     error: message,
                     failure_ref: "final/failure.yaml",
                 });
             else
                 log.emit("run.failed", {
-                    status: "failed",
+                    lifecycle: scanFailFacts.lifecycle,
+                    facts: scanFailFacts,
+                    reason: scanFailFacts.reason,
                     phase: "harness",
                     error: message,
                     failure_ref: "final/failure.yaml",
@@ -4502,7 +4630,8 @@ export class Orchestrator {
                 runId,
                 taskId,
                 mode: opts.mode,
-                status: blocked ? "blocked" : "failed",
+                lifecycle: scanFailFacts.lifecycle,
+                facts: scanFailFacts,
                 winner: null,
                 runDir: paths.root,
                 summary: message,
@@ -4514,7 +4643,7 @@ export class Orchestrator {
             };
         }
         const unsuccessful = attempts.filter((a) => a.status !== "success");
-        const report = opts.swarm
+        const report = opts.deepScan
             ? [
                 `Explorers succeeded: ${succeeded.length}/${attempts.length}.`,
                 "",
@@ -4552,36 +4681,12 @@ export class Orchestrator {
                 answerText: succeeded[0]?.report ?? "",
             });
         }
-        // orchestrate: the planner's plan is a TYPED artifact, not just prose. Extract
-        // the required fenced JSON block, validate it against the tool belt, and
-        // persist final/orchestration.yaml; a missing/invalid block is disclosed in
-        // the summary and events (suggest autonomy: the plan is the work product).
-        let typedPlanNote = "";
-        let orchestratePlan = null;
-        if (opts.mode === "orchestrate") {
-            const extracted = extractOrchestratePlan(report);
-            if (extracted.plan) {
-                orchestratePlan = extracted.plan;
-                store.writeYaml(join(paths.finalDir, "orchestration.yaml"), extracted.plan);
-                log.emit("output.ready", { kind: "report", path: "final/orchestration.yaml" });
-                typedPlanNote = `\n- Typed plan: final/orchestration.yaml (${extracted.plan.tool_calls.length} tool call(s))`;
-            }
-            else {
-                store.writeText(join(paths.finalDir, "orchestration_parse_error.md"), `# Typed plan missing\n\n${extracted.error}\n`);
-                log.emit("output.ready", {
-                    kind: "report",
-                    path: "final/orchestration_parse_error.md",
-                    state: "diagnostic",
-                });
-                typedPlanNote = `\n- Typed plan: MISSING (${extracted.error}); the markdown plan above is the only artifact`;
-            }
-        }
-        this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, opts.swarm ? null : (succeeded[0]?.attemptId ?? null));
+        this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, opts.deepScan ? null : (succeeded[0]?.attemptId ?? null));
         log.emit("output.ready", {
             kind: opts.mode === "ask" ? "answer" : "report",
             path: `final/${opts.artifactName}`,
         });
-        if (opts.swarm) {
+        if (opts.deepScan) {
             store.writeYaml(join(paths.finalDir, "explore-findings.yaml"), {
                 mode: "explore",
                 width,
@@ -4603,99 +4708,60 @@ export class Orchestrator {
             });
             store.writeText(join(paths.finalDir, "omissions.md"), `# Omissions\n\n${unsuccessful.map((a) => `- ${a.attemptId} / ${a.harnessId} (${a.status}): ${a.error}`).join("\n") || "- None recorded by the runner. Synthesis claims still require evidence checks."}\n`);
         }
-        // orchestrate executor (auto_safe/auto_full): the plan is no longer just a
-        // suggestion — run its tool_calls in order, classifying each via toolRisk
-        // (fail-closed). SAFE steps run as isolated envelope sub-runs / pure reads;
-        // a RISKY step (apply) blocks under auto_safe (awaiting a human decision) and
-        // applies through the single existing gate under auto_full. The executor's
-        // terminal outcome (success / blocked / failed) becomes the run's terminal.
-        const autonomy = opts.orchestrateContract?.autonomy ?? input.autonomy ?? "suggest";
-        let terminal = "success";
-        let orchestrateReadOnly = true;
-        let orchestrateReceiptRefs = [];
-        if (ledger.terminal() !== null)
-            terminal = ledger.terminal();
-        // orchestrate's contract output IS the typed plan. If the planner failed to
-        // produce a valid one, the run is NOT a clean success — disclose it honestly
-        // (the markdown plan stays as a diagnostic artifact) rather than reporting
-        // success alongside an orchestration_parse_error.md.
-        if (opts.mode === "orchestrate" && !orchestratePlan)
-            terminal = "not_converged";
-        if (opts.mode === "orchestrate" && autonomy !== "suggest" && orchestratePlan) {
-            // Thread the GENERATED runId onto input so the executor's answer_question
-            // step keys the interaction registry by this orchestrate run's id (callers
-            // often invoke run() without a preassigned runId).
-            const executionInput = { ...input, runId };
-            const exec = await executeOrchestratePlan({
-                plan: orchestratePlan,
-                autonomy,
-                maxToolCalls: opts.orchestrateContract?.budget.max_tool_calls ?? null,
-                signal: input.signal,
-                store,
-                paths,
-                log,
-                ledger,
-                executeSafeStep: (call) => this.executeSafeStep(executionInput, call, log, store, paths, ledger),
-                executeApplyStep: (call) => this.executeApplyStep(executionInput, call, log),
-            });
-            terminal = exec.terminal;
-            orchestrateReadOnly = exec.readOnly;
-            orchestrateReceiptRefs = exec.receiptRefs;
-            typedPlanNote += `\n- Executor (${autonomy}): ${exec.note}`;
-        }
+        // A read-only report (ask / deep-scan) has no live-tree work; the only
+        // non-clean terminal is an aggregate paid-budget stop.
+        let terminalFacts = makeOutcomeFacts("succeeded");
+        const reportBudgetTerminal = ledger.terminal();
+        if (reportBudgetTerminal)
+            terminalFacts = makeOutcomeFacts("failed", { reason: reportBudgetTerminal });
         const harnessLabel = attempts
             .map((a) => `${a.attemptId}:${a.harnessId}:${a.status}`)
             .join(", ");
-        store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harnesses: ${harnessLabel}\n- Status: ${terminal}${typedPlanNote}\n\n${report}\n`);
+        store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harnesses: ${harnessLabel}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}\n\n${report}\n`);
         store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
             id: newId("wp"),
             kind: "report",
             source_task_id: taskId,
             producer_attempt_id: succeeded[0]?.attemptId ?? "a01",
-            files: Object.fromEntries([
-                [opts.artifactName, join(paths.finalDir, opts.artifactName)],
-                ...orchestrateReceiptRefs.map((ref, index) => [`delivery_receipt_${index + 1}`, ref]),
-            ]),
+            files: Object.fromEntries([[opts.artifactName, join(paths.finalDir, opts.artifactName)]]),
             meta: {
                 harnesses: attempts.map((a) => a.harnessId),
                 mode: opts.mode,
                 intent: opts.intent,
-                read_only: orchestrateReadOnly,
+                read_only: true,
             },
         });
         log.emit("work_product.emitted", { kind: "report", winner: succeeded[0]?.attemptId ?? null });
-        const orchestrateFailure = orchestrateFailureFor(terminal);
-        if (terminal === "blocked" && orchestrateFailure) {
-            writeFailure(store, paths, { ...orchestrateFailure, runDir: paths.root });
-            log.emit("run.blocked", {
-                status: terminal,
-                phase: orchestrateFailure.phase,
-                failure_ref: "final/failure.yaml",
+        if (terminalFacts.lifecycle === "failed") {
+            writeFailure(store, paths, {
+                phase: "executor",
+                category: "budget",
+                safeMessage: `read-only report ended ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason.replaceAll("_", " ")})` : ""}`,
+                runDir: paths.root,
+                nextActions: ["Inspect the report artifacts", "Adjust the budget and retry"],
             });
-        }
-        else if (orchestrateFailure) {
-            writeFailure(store, paths, { ...orchestrateFailure, runDir: paths.root });
             log.emit("run.failed", {
-                status: terminal,
-                phase: orchestrateFailure.phase,
+                lifecycle: terminalFacts.lifecycle,
+                facts: terminalFacts,
+                reason: terminalFacts.reason,
+                phase: "executor",
                 failure_ref: "final/failure.yaml",
             });
         }
-        else if (terminal === "cancelled") {
-            // Cancel is failure-shaped (parity with every other mode's cancel
-            // terminal): tailers waiting for run.completed-as-success must not
-            // mistake an operator abort for a clean report.
-            log.emit("run.failed", { status: terminal });
-        }
         else {
-            log.emit("run.completed", { status: terminal });
+            log.emit("run.completed", {
+                lifecycle: terminalFacts.lifecycle,
+                facts: terminalFacts,
+                reason: terminalFacts.reason,
+            });
         }
         return {
             spendUsd: ledger.spend(),
             runId,
             taskId,
             mode: opts.mode,
-            status: terminal,
+            lifecycle: terminalFacts.lifecycle,
+            facts: terminalFacts,
             winner: null,
             runDir: paths.root,
             summary: redactSecrets(report).slice(0, 400),
@@ -4706,230 +4772,6 @@ export class Orchestrator {
             })),
         };
     }
-    /**
-     * Run one SAFE plan step. start_run/race spawn ISOLATED ENVELOPE sub-runs
-     * (inPlace=false, ASSERTED); review/status/answer_question are pure reads /
-     * answer delivery that never mutate the live tree.
-     */
-    async executeSafeStep(input, call, log, store, paths, ledger) {
-        switch (call.tool) {
-            case "start_run":
-            case "race": {
-                // Isolated envelope sub-run (construction owned by runSupport);
-                // recursion guard via orchestrateDepth+1, may NOT orchestrate.
-                const subInput = {
-                    ...buildEnvelopeSubInput(input, call, ledger),
-                };
-                // SAFETY INVARIANT 1 (asserted, not convention): a safe sub-run is an
-                // isolated envelope — never a live in-place turn.
-                assertEnvelopeSubRun(subInput);
-                log.emit("orchestrate.subrun.started", {
-                    tool: call.tool,
-                    mode: subInput.mode,
-                    n: subInput.n ?? null,
-                });
-                const res = await this.run(subInput);
-                return {
-                    status: res.status === "failed" || res.status === "cancelled" ? "failed" : "done",
-                    terminalStatus: res.status,
-                    terminalSource: "subrun",
-                    evidenceRefs: [`run:${res.runId}`],
-                    runId: res.runId,
-                    spendUsd: res.spendUsd ?? null,
-                    detail: `${call.tool} sub-run ${res.runId} -> ${res.status}`,
-                };
-            }
-            case "status": {
-                // Pure read of the referenced run's decision/work_product artifacts.
-                const read = readRunStatus(input.repoRoot, call.run_id);
-                return {
-                    status: read ? "done" : "skipped",
-                    terminalStatus: read?.status ?? null,
-                    terminalSource: "subrun",
-                    evidenceRefs: read?.evidenceRefs ?? [],
-                    runId: call.run_id,
-                    detail: read?.detail ?? `run ${call.run_id} has no readable status artifacts`,
-                };
-            }
-            case "review": {
-                // Read-only review over the referenced run's recorded patch diff. The
-                // step ACTUALLY runs the reviewer panel (evidence beats summaries — a
-                // "done" review must mean a review happened), persists its artifacts, and
-                // reports the real outcome; eligibility alone is never reported as done.
-                const diff = readRunPatch(input.repoRoot, call.run_id);
-                if (diff === null)
-                    return {
-                        status: "skipped",
-                        terminalStatus: null,
-                        terminalSource: "review",
-                        evidenceRefs: [],
-                        runId: call.run_id,
-                        detail: `run ${call.run_id} has no patch.diff to review`,
-                    };
-                // Aggregate honesty: reviewer panels spend real money on
-                // API-keyed routes and the spend is charged AFTER the fact — with no
-                // remaining headroom the review must not start at all.
-                if (ledger.terminal() !== null) {
-                    return {
-                        status: "skipped",
-                        terminalStatus: null,
-                        terminalSource: "review",
-                        evidenceRefs: [],
-                        runId: call.run_id,
-                        detail: "aggregate budget exhausted before the review step",
-                    };
-                }
-                const reviewers = await this.resolveReviewers(input.repoRoot, input.authPreference);
-                if (reviewers.length === 0)
-                    return {
-                        status: "skipped",
-                        terminalStatus: null,
-                        terminalSource: "review",
-                        evidenceRefs: [],
-                        runId: call.run_id,
-                        detail: "no doctor-OK reviewers available",
-                    };
-                const reviewLease = ledger.reserve({
-                    taskId: input.taskId ?? "orchestrate",
-                    attemptId: `review-${call.run_id}`,
-                    intent: "review",
-                    harnessId: "review-panel",
-                    cost: attemptCostEvidence("review-panel", `review-${call.run_id}`),
-                });
-                if (!reviewLease.granted)
-                    return {
-                        status: "skipped",
-                        terminalStatus: ledger.terminal(),
-                        terminalSource: "review",
-                        evidenceRefs: [],
-                        runId: call.run_id,
-                        detail: reviewLease.reason ?? "root paid budget refused the review step",
-                    };
-                const evidenceDir = join(paths.reviewsDir, `orchestrate-${call.run_id}`, "evidence");
-                writeEvidencePacket(evidenceDir, {
-                    userIntent: redactSecrets(input.prompt),
-                    planAccepted: `orchestrate review tool requested a read-only review of run ${call.run_id}.`,
-                    diff,
-                    tests: input.tests?.join("\n") || "(no test commands configured)",
-                    decidedTradeoffs: "This review is scoped to the referenced run patch and must use typed reviewer artifacts, not summary-only evidence.",
-                });
-                const result = await this.reviewScoped({
-                    candidateLabel: `Run ${call.run_id}`,
-                    diff,
-                    evidenceDir,
-                    artifactsDir: join(paths.reviewsDir, `orchestrate-${call.run_id}`),
-                    cwd: input.repoRoot,
-                    reviewers,
-                    envInheritance: envInheritance(this.config(input.repoRoot)),
-                    signal: input.signal,
-                    onReviewerEvent: (event) => log.emit(event.type, { ...event }),
-                }).catch((error) => {
-                    ledger.settle(reviewLease.lease?.lease_id ?? "", unknownCostSettlement("review-error"));
-                    throw error;
-                });
-                ledger.settle(reviewLease.lease?.lease_id ?? "", usageCostSettlement(result.reviewSpendUsd, result.reviewSpendEstimated, "review-usage", [
-                    `orchestrate:review:${call.run_id}`,
-                ]));
-                const revalidated = await revalidateFindings(result.findings, {
-                    candidateRoot: input.repoRoot,
-                    evidenceDir,
-                });
-                store.writeYaml(join(paths.reviewsDir, `orchestrate-${call.run_id}.yaml`), {
-                    target_run_id: call.run_id,
-                    cross_family_healthy: result.crossFamilyHealthy,
-                    cross_family_verified: result.crossFamilyVerified,
-                    findings: revalidated,
-                    route_proofs: result.routeProofs,
-                });
-                const blockers = revalidated.filter((f) => isBlocking(f)).length;
-                return {
-                    status: "done",
-                    terminalStatus: result.crossFamilyVerified && blockers === 0 ? "success" : "blocked",
-                    terminalSource: "review",
-                    evidenceRefs: [`reviews/orchestrate-${call.run_id}.yaml`],
-                    runId: call.run_id,
-                    detail: `reviewed ${call.run_id}: ${result.distinctProviders.length} family(ies), ${revalidated.length} finding(s), ${blockers} blocker(s)`,
-                    // Reviewer panels can spend real money on API-keyed routes; the
-                    // aggregate cap must charge it like any other step.
-                    spendUsd: result.reviewSpendUsd ?? null,
-                };
-            }
-            case "answer_question": {
-                // Delivery + registry-keying rationale owned by runSupport.
-                const answer = await deliverPlanAnswer(input, call);
-                return {
-                    ...answer,
-                    terminalStatus: answer.status === "done" ? "success" : null,
-                    terminalSource: "executor",
-                    evidenceRefs: [],
-                };
-            }
-            default: {
-                // FAIL-CLOSED: a risky tool (apply) must never reach the safe executor;
-                // the caller routes risky steps to executeApplyStep / the auto_safe block.
-                throw new Error(`executeSafeStep refused a non-safe tool '${call.tool}' (risky tools must not run as safe steps)`);
-            }
-        }
-    }
-    /** Execute an auto_full apply through the shared fresh-verification gate. */
-    async executeApplyStep(input, call, log) {
-        const store = new ArtifactStore(input.repoRoot);
-        const sub = store.runPaths(call.run_id);
-        const patchPath = join(sub.finalDir, "patch.diff");
-        const patchText = existsSync(patchPath) ? readFileSync(patchPath, "utf8") : null;
-        if (patchText === null)
-            return {
-                ok: false,
-                runId: call.run_id,
-                detail: `run ${call.run_id} has no patch.diff`,
-                receipt: null,
-            };
-        if (containsSecretLikeToken(patchText))
-            return {
-                ok: false,
-                runId: call.run_id,
-                detail: "patch contains a secret-like token; refusing apply",
-                receipt: null,
-            };
-        const decision = store.readYaml(join(sub.arbitrationDir, "decision.yaml"));
-        const workProduct = store.readYaml(join(sub.finalDir, "work_product.yaml"));
-        const taskContract = TaskContractSchema.safeParse(store.readYaml(join(sub.contextDir, "task.yaml")));
-        const parsedDecision = decision ? DecisionRecordSchema.safeParse(decision) : null;
-        const parsedWp = workProduct ? WorkProductSchema.safeParse(workProduct) : null;
-        if (!taskContract.success)
-            return {
-                ok: false,
-                runId: call.run_id,
-                detail: "fresh verification contract is missing",
-                receipt: null,
-            };
-        const applyGateInput = {
-            state: null,
-            decision: parsedDecision?.success ? parsedDecision.data : null,
-            workProduct: parsedWp?.success ? parsedWp.data : null,
-            patch: patchText,
-            originalRepoRoot: input.repoRoot,
-            targetRepoRoot: input.repoRoot,
-            operatorDecision: null,
-        };
-        const gateError = validateApplyGate(applyGateInput);
-        if (gateError)
-            return {
-                ok: false,
-                runId: call.run_id,
-                detail: `apply gate refused: ${gateError}`,
-                receipt: null,
-            };
-        const delivered = await verifyAndDeliver(input.repoRoot, patchText, { mode: call.mode }, gateSpecsFromContract(taskContract.data), (finalVerify) => validateApplyGate({ ...applyGateInput, finalVerify }), log);
-        return {
-            ok: delivered.applied,
-            runId: call.run_id,
-            detail: delivered.applied
-                ? `applied (${call.mode})`
-                : `deliver failed: ${delivered.detail ?? "unknown"}`,
-            receipt: delivered,
-        };
-    }
 }
 function assertNoSecretLikeTokens(label, text) {
     if (containsSecretLikeToken(text)) {