@claudexor/orchestrator 3.0.4 → 3.1.1

package/dist/orchestrator.js

@@ -3,7 +3,7 @@ import { observeNativeSessionEvent, preflightCredentialProfile, preflightDefault
 import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
 import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
 import { processAttemptUsage } from "./attemptUsage.js";
-import { toCandidateEvidence } from "./candidateEvidence.js";
+import { candidateRoster, convergenceOutcomeFacts, isWorkingCandidate, partitionCandidates, toCandidateEvidence, } from "./candidateEvidence.js";
 import { capabilityIntents } from "@claudexor/gateway";
 import { policyFindings } from "./policyFindings.js";
 import { join } from "node:path";
@@ -12,29 +12,37 @@ import { HarnessRunSpec, ModeKind as ModeKindSchema, SCHEMA_VERSION, TRUST_FULL_
 import { globalConfigDir, loadConfig, trustConfigPath } from "@claudexor/config";
 import { AnswerAssembly, CLAUDEXOR_ARTIFACT_DIR, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
 import { assertRouteModelsAllowed } from "./modelGovernance.js";
+import { governRouteEffort } from "./effortGovernance.js";
 import { RequestRequirementsResolver } from "./requestRequirements.js";
+import { buildRevisePrompt } from "./revisePrompt.js";
 import { cancelledResult, failTerminally, guardAnnouncedRun, writeFailure, } from "./runTerminals.js";
+import { budgetFailureRecord, classifyBudgetFailure } from "./budgetFailure.js";
 import { assertOutputSchemaCompiles, finalizeStructuredOutput } from "./structuredOutput.js";
-import { transientRetryDelayMs, promptWithProtectedPathConstraint, sleep, redactHarnessEvent, harnessEventPayload, formatFindings, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, deliveryRefusalFailure, writeRaceDeliveryDecision, } from "./runSupport.js";
+import { transientRetryDelayMs, promptWithEngineConstraints, sleep, redactHarnessEvent, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, emitPoolDegraded, deliveryRefusalFailure, writeRaceDeliveryDecision, } from "./runSupport.js";
 import { candidateStatusInRouteContext, resolveReadOnlyRouteContext, } from "./routeContext.js";
 import { resolveAutoReviewerPanel, resolveExplicitReviewerPanel } from "./reviewerPanel.js";
 import { buildContinuation, } from "./continuity.js";
 import { activePlanPointer, resolveContinuitySummary, workspaceAnchor, } from "./continuity-facts.js";
 import { runDiffReview } from "./diffReview.js";
-import { createAttemptTelemetry, observeAttemptTelemetry, setAttemptOutcome, telemetrySummary, toolWarnings, unrecoveredToolErrors, webUnsatisfied, } from "./attemptTelemetry.js";
+import { rawScoutBundle, resolveDeepScanSynthesis, } from "./deepScanReducer.js";
+import { classifyAdapterThrow, createAttemptTelemetry, observeAttemptTelemetry, setAttemptOutcome, telemetrySummary, toolWarnings, unrecoveredToolErrors, webUnsatisfied, } from "./attemptTelemetry.js";
+import { dominantHarnessFailureCategory, harnessFailureNextActions } from "./harnessFailure.js";
+import { finalizeAttempt, readOnlyNoSuccessTerminal, resolveWorkReportEnvelope, unrecoveredToolErrorFailure, unwrapWorkReportEnvelope, webEvidenceFailure, } from "./attemptFinalize.js";
+import { buildContinuationPacket, decideContinuation, synthesizeContinuationRequest, } from "./continuation.js";
 import { interactionChannelFor } from "./interaction.js";
 import { gateSpecsFromContract, renderTestsEvidence, resolveContractGates, } from "./contract-gates.js";
 import { ArtifactStore } from "@claudexor/artifact-store";
 import { EventLog } from "@claudexor/event-log";
 import { assertMandatoryContext, buildContextPack, rawContextForEnvelope, preflightEvidence, writeEvidencePacket, } from "@claudexor/context";
-import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, ensureGitRepository, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
+import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, ensureClaudeBridge, ensureGitRepository, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
 import { blockedDecisionOverride, finalVerifyBlocks, finalVerifyPatch, verifyAndDeliver, } from "@claudexor/delivery";
 import { HarnessGateway } from "@claudexor/gateway";
 import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, reviewCandidate, revalidateFindings, runGates, } from "@claudexor/review";
 import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
-import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, loadHarnessMetrics, promptFingerprint, unknownCostSettlement, rankHarnesses, reviewUsageCostSettlement, } from "@claudexor/budget";
+import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, explainRanking, loadHarnessMetrics, promptFingerprint, unknownCostSettlement, rankHarnesses, reviewUsageCostSettlement, } from "@claudexor/budget";
 import { readTextSafe, appendLine, assertNoInlineSecretValues, containsSecretLikeToken, DELEGATION_ENV, hashJson, newId, noProjectRepoRoot, nowIso, redactSecrets, safeInvoke, sha256, userConfigDir, writeText, } from "@claudexor/util";
+import { assertWriteIsolation } from "./write-isolation.js";
 /** A routed candidate adapter plus its manifest capabilities and user settings. */
 /** The two access profiles that map to codex `danger-full-access` / an
  * unsandboxed lane — the only ones under which a full-access-requiring MCP
@@ -42,6 +50,25 @@ import { readTextSafe, appendLine, assertNoInlineSecretValues, containsSecretLik
 export function isFullAccess(access) {
     return access === "full" || access === "external_sandbox_full";
 }
+/**
+ * A routing preflight refusal (`RoutingPreflightError`: quality routing with no
+ * comparable user-declared tier for the intent) is a CONFIGURATION error, not a
+ * harness-availability problem (A-1/D-9/#22). Classifying it as
+ * `harness_unavailable` sent the operator to re-auth or wait for a harness; the
+ * real fix is to configure a tier or change the routing goal. Detected by the
+ * typed `code` (robust across duplicate `@claudexor/budget` package copies) so
+ * EVERY strategy's routing catch (ask/agent/plan/deep-scan/council) classifies
+ * it identically. Returns the failure category + matching remediation.
+ */
+export function routingFailureClassification(err) {
+    const isPreflightRefusal = !!err &&
+        typeof err === "object" &&
+        err.code === "routing_preflight_refused";
+    if (isPreflightRefusal) {
+        return { category: "config_error", nextActions: harnessFailureNextActions("config_error") };
+    }
+    return { category: "harness_unavailable" };
+}
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
 /** Concurrency cap for parallel candidates/explorers (locked decision: min(n, 4)). */
@@ -68,6 +95,11 @@ export class Orchestrator {
     deps;
     gateway;
     requestRequirements = new RequestRequirementsResolver();
+    /** QA-034: the typed routing rationale computed ONCE at pool ordering, keyed
+     * by run id so the terminal telemetry writer can record it as run evidence
+     * (RunTelemetry.routing_rationale). Cleared when the run's telemetry is
+     * written. Absent for runs with an explicit single-harness pool (no ranking). */
+    routingRationaleByRun = new Map();
     /** Per-attempt cap on forwarded live delta chunks (W-C4 flood guard, sol
      * #10): past this the deltas are dropped and the cutoff is disclosed once;
      * the complete message always still lands. */
@@ -105,19 +137,21 @@ export class Orchestrator {
             throw new Error(`unknown mode: ${String(resolved.mode)}`);
         }
         const mode = parsedMode.data;
-        // denyPaths is enforced by the post-diff policy gate BEFORE delivery, which
-        // only exists on envelope/isolated runs — an in-place run mutates the live
-        // tree directly, so the gate could not contain a violation. Refuse loudly
-        // rather than accept a knob the engine cannot honor (INV-023).
-        if ((resolved.denyPaths?.length ?? 0) > 0 && resolved.inPlace === true) {
-            throw new Error("denyPaths requires an isolated/envelope run: the post-diff policy gate blocks a violating patch before delivery, which an in-place run cannot guarantee; drop --deny-path or run isolated");
-        }
+        const projectProtectedPaths = mode === "agent" ? this.projectConfig(resolved.repoRoot).constraints.protected_paths : [];
+        assertWriteIsolation({
+            mode,
+            protectedPaths: projectProtectedPaths,
+            denyPaths: resolved.denyPaths,
+            inPlace: resolved.inPlace,
+            repoRoot: resolved.repoRoot,
+            executionRoot: this.execRootOf(resolved),
+        });
         // outputSchema constrains the run's final ANSWER. It is honored exactly
         // where a final answer is delivered (agent race incl. synthesis, and ask);
         // every other strategy refuses loudly rather than carrying a contract the
         // engine would not validate (INV-023). The schema itself is normalized for
         // the native structured-output routes here at the boundary — unsupported
-        // shapes ($ref, non-object root) are a typed refusal, not a mid-run 400.
+        // shapes (external/cyclic $ref, non-object root) are a typed refusal, not a mid-run 400.
         if (resolved.outputSchema !== undefined && resolved.outputSchema !== null) {
             if (mode !== "agent" && mode !== "ask") {
                 throw new Error(`outputSchema constrains the final answer and applies to agent/ask runs (got mode=${mode}); drop the schema or switch modes`);
@@ -128,8 +162,8 @@ export class Orchestrator {
             // Shape-refuse unsupported schemas, then PROVE it compiles under the same
             // ajv the engine validator uses — a malformed schema is a preflight
             // refusal here (before any run dir), never a mid-run validator crash. The
-            // contract keeps the ORIGINAL (conformance authority); strictify is a
-            // transport-only transform applied per-lane in harnessSpecKnobs.
+            // contract keeps the ORIGINAL (conformance authority); local-ref inlining
+            // and strictification are transport-only transforms in harnessSpecKnobs.
             resolved.outputSchema = normalizeUserOutputSchema(resolved.outputSchema);
             assertOutputSchemaCompiles(resolved.outputSchema);
         }
@@ -169,9 +203,13 @@ export class Orchestrator {
                 case "plan":
                     return this.runPlan(resolved, announce);
             }
-        });
+        }, 
+        // Single per-run terminalization hook: release the routing-rationale map
+        // entry on EVERY terminal (incl. a run that died before its telemetry
+        // writer ran, which is the leak this closes).
+        (runId) => this.routingRationaleByRun.delete(runId));
     }
-    async resolveReviewers(cwd, runAuthPreference) {
+    async resolveReviewers(cwd, runAuthPreference, onIgnoredSetting) {
         if (this.deps.reviewers)
             return this.deps.reviewers;
         if (this.deps.reviewerPanel && this.deps.reviewerPanel.length > 0) {
@@ -182,10 +220,8 @@ export class Orchestrator {
             registry: this.deps.registry,
             harnessSettings: this.config(cwd)?.global.harnesses ?? {},
             authPreferenceFor: (id) => this.authPreferenceForHarness(cwd, id, runAuthPreference),
-        }, {
-            reviewerModels: this.deps.reviewerModels,
-            reviewerEfforts: this.deps.reviewerEfforts,
-        });
+            onIgnoredSetting,
+        }, { reviewerModels: this.deps.reviewerModels, reviewerEfforts: this.deps.reviewerEfforts });
     }
     /**
      * Resolve reviewers INSIDE a strategy, after run-dir creation: an explicit
@@ -196,7 +232,9 @@ export class Orchestrator {
      */
     async resolveReviewersWithArtifacts(input, log, store, paths, runId, taskId, mode) {
         try {
-            return { reviewers: await this.resolveReviewers(input.repoRoot, input.authPreference) };
+            // Auto-panel dropped knobs (reviewerEfforts) → ignored-settings channel (QA-070):
+            const warn = (d) => void log.emit("review.preflight", { ignored_settings: [d] });
+            return { reviewers: await this.resolveReviewers(input.repoRoot, input.authPreference, warn) };
         }
         catch (err) {
             const message = safeErrorMessage(err);
@@ -385,25 +423,38 @@ export class Orchestrator {
         const cfg = this.config(input.repoRoot);
         const configuredPool = cfg?.global.routing.eligible_harnesses;
         const harnesses = input.harnesses ?? (configuredPool && configuredPool.length > 0 ? configuredPool : undefined);
-        const primaryHarness = input.primaryHarness ?? cfg?.global.routing.primary_harness ?? undefined;
+        // GH #25 precedence: an explicit --primary-harness wins and is validated
+        // against the pool; else a single-item explicit pool infers itself as
+        // primary (shipped in #34); else the configured default primary applies.
+        const explicitPrimary = input.primaryHarness;
+        const configPrimary = cfg?.global.routing.primary_harness;
+        const primaryHarness = explicitPrimary ??
+            (input.harnesses?.length === 1 ? input.harnesses[0] : undefined) ??
+            configPrimary ??
+            undefined;
         if (primaryHarness &&
             harnesses &&
             harnesses.length > 0 &&
             !harnesses.includes(primaryHarness)) {
-            throw new Error(`primary harness '${primaryHarness}' is not in the eligible harness pool (${harnesses.join(", ")})`);
+            if (explicitPrimary) {
+                // An explicit primary must be a member of the eligible pool (authoritative).
+                throw new Error(`primary harness '${explicitPrimary}' is not in the eligible harness pool (${harnesses.join(", ")}); ` +
+                    `pass --primary-harness as one of [${harnesses.join(", ")}], or add '${explicitPrimary}' to --harness`);
+            }
+            // GH #25 remainder: a MULTI-harness pool whose CONFIGURED default primary
+            // is absent, with no --primary-harness pinned, is ambiguous — the engine
+            // must not silently reroute. Refuse with a structured, copy-pasteable fix
+            // naming the pool, the missing primary, and the exact flag to add.
+            throw new HarnessUnavailableError(`ambiguous primary harness: the configured default primary '${primaryHarness}' is not in the selected pool [${harnesses.join(", ")}], ` +
+                `and no --primary-harness was given. Pin one explicitly, e.g. \`--primary-harness ${harnesses[0]}\` ` +
+                `(or another of [${harnesses.join(", ")}]).`);
         }
         if (input.web && input.externalContextPolicy && input.web !== input.externalContextPolicy) {
             throw new Error(`contradictory web policy: web='${input.web}' vs externalContextPolicy='${input.externalContextPolicy}' (pass one, or equal values)`);
         }
         const web = input.web ?? input.externalContextPolicy ?? "auto";
-        // INV-103: model choice is harness-scoped end-to-end. The scalar
-        // `model` is a convenience that expands to the RESOLVED PRIMARY only —
-        // never the whole pool (the old global fallback poisoned every pool
-        // member with one vendor's model id). Specific beats general: an explicit
-        // per-harness map entry wins over the scalar.
-        //
-        // Map KEYS fail loudly (INV-021): a typo'd harness id ("claud") must
-        // never silently no-op into "the run used defaults and nothing said why".
+        // INV-103: scalar `model` expands only to the resolved primary, never the pool;
+        // an explicit per-harness map wins. Unknown map keys fail loudly (INV-021).
         const knownHarnessIds = new Set(this.deps.registry.keys());
         for (const key of Object.keys(input.models ?? {})) {
             if (!knownHarnessIds.has(key)) {
@@ -421,6 +472,19 @@ export class Orchestrator {
             }
             models[scalarTarget] ??= input.model;
         }
+        // QA-035: FREEZE the config-derived per-harness default_model into the
+        // resolved model map at initial normalization, exactly like an explicit
+        // input. Without this the TaskContract records `routing_models: {}` and an
+        // Exact Retry re-resolves the model against CURRENT settings — silently
+        // changing the route after a settings edit. A per-turn/scalar value already
+        // set wins (??=). Only a known resolved pool can be frozen here; a pure
+        // auto pool's lanes are not yet known (documented seam).
+        const harnessCfg = cfg?.global.harnesses ?? {};
+        for (const hid of harnesses ?? []) {
+            const def = harnessCfg[hid]?.default_model;
+            if (def)
+                models[hid] ??= def;
+        }
         return {
             ...input,
             harnesses,
@@ -436,7 +500,16 @@ export class Orchestrator {
             externalContextPolicy: web,
         };
     }
-    async resolveCandidateAdapters(input, intent, ledger, log, routeContext) {
+    async resolveCandidateAdapters(input, intent, ledger, log, routeContext, 
+    /** QA-034: when provided, the pool-ordering rationale is recorded under this
+     * run id so the terminal telemetry writer can persist it. */
+    runId, 
+    /** Deep-scan opts in: multi-scout coverage repeats a surviving harness to
+     * reach the requested width (distinct SLICES, not distinct harnesses), so a
+     * dropped lane must not clamp the scout count. Best-of leaves this false —
+     * its width is distinct-harness diversity, so a dropped lane clamps rather
+     * than self-races (QA-043). */
+    allowDuplicateFill = false) {
         let ids = input.harnesses;
         const explicitPool = Boolean(ids && ids.length > 0);
         const harnessSettings = this.config(input.repoRoot)?.global.harnesses ?? {};
@@ -492,6 +565,21 @@ export class Orchestrator {
         const policy = input.web ?? input.externalContextPolicy ?? "auto";
         const pool = [];
         const dropped = [];
+        // Structured requested-vs-effective route receipt (QA-043): every auto-pool
+        // drop is recorded with its typed STAGE so the disclosure preserves the
+        // real cause instead of collapsing to one reason.
+        const droppedLanes = [];
+        // The ONE explicit-lane admission gate shared by every drop site (QA-043 /
+        // QA-047 meta-move): an EXPLICITLY selected lane that becomes ineligible is
+        // a loud typed refusal naming the lane + reason — never a silent
+        // substitution or self-race duplication; an AUTO lane is dropped with a
+        // typed omission recorded for the degradation receipt.
+        const dropLane = (harnessId, stage, detail) => {
+            if (explicitPool)
+                throw new HarnessUnavailableError(detail);
+            dropped.push(detail);
+            droppedLanes.push({ harnessId, stage, detail });
+        };
         for (const id of ids) {
             const adapter = this.deps.registry.get(id);
             if (!adapter) {
@@ -502,7 +590,7 @@ export class Orchestrator {
                     const known = [...this.deps.registry.keys()].sort().join(", ");
                     throw new HarnessUnavailableError(`unknown harness '${id}' (registered: ${known}); run \`claudexor harness list --all\``);
                 }
-                dropped.push(`${id} (not registered)`);
+                dropLane(id, "discovery", `${id} (not registered)`);
                 continue;
             }
             // Per-harness settings: a user-disabled harness never routes. Explicit
@@ -511,9 +599,7 @@ export class Orchestrator {
             const cfgEntry = harnessSettings[id];
             if (cfgEntry && cfgEntry.enabled === false) {
                 const why = `${id} is disabled in settings (harnesses.${id}.enabled=false)`;
-                if (explicitPool)
-                    throw new HarnessUnavailableError(why);
-                dropped.push(why);
+                dropLane(id, "settings", why);
                 continue;
             }
             // INV-135 accounts authority: with the native/CLI login excluded and no
@@ -523,9 +609,7 @@ export class Orchestrator {
             if (this.effectiveProfileId(input, id) === null &&
                 this.nativeCredentialsDisabled(input.repoRoot, id)) {
                 const why = `${id} has no routable credential: the CLI login is disabled (harnesses.${id}.native_credentials_enabled=false) and no account is pinned (--profile)`;
-                if (explicitPool)
-                    throw new HarnessUnavailableError(why);
-                dropped.push(why);
+                dropLane(id, "credential", why);
                 continue;
             }
             // W3.3 (TZ-1 §B): a route is admitted on readiness truth from the SAME
@@ -533,7 +617,12 @@ export class Orchestrator {
             let status = await candidateStatusInRouteContext(this.gateway, routeContext, id, this.authPreferenceForHarness(input.repoRoot, id, input.authPreference), statusById);
             const manifest = status?.manifest ?? null;
             if (!status || !manifest) {
-                dropped.push(`${id} (unavailable)`);
+                // QA-047: an explicit member with no doctor manifest (absent binary /
+                // unconfigured provider) is unavailable — it must fail LOUDLY for an
+                // explicit pool (naming the real doctor reasons), not vanish before the
+                // later explicit-status guard because a healthier lane survived.
+                const reasons = status?.reasons?.length ? `: ${status.reasons.join("; ")}` : "";
+                dropLane(id, "doctor", `${id} is unavailable${reasons || " (no manifest / not ready)"}`);
                 continue;
             }
             // Doctor status is the readiness truth. A DEGRADED harness (e.g. key present but
@@ -570,21 +659,17 @@ export class Orchestrator {
                 }
                 else {
                     const why = `${id} credential profile is not ready: ${profileVerdict}`;
-                    if (explicitPool)
-                        throw new HarnessUnavailableError(why);
-                    dropped.push(why);
+                    dropLane(id, "credential", why);
                     continue;
                 }
             }
             if (status.status === "unavailable" && !profileAdmitted) {
                 const why = `${id} is unavailable${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`;
-                if (explicitPool)
-                    throw new HarnessUnavailableError(why);
-                dropped.push(why);
+                dropLane(id, "doctor", why);
                 continue;
             }
             if (status.status !== "ok" && !explicitPool && !profileAdmitted) {
-                dropped.push(`${id} is ${status.status}${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`);
+                dropLane(id, "doctor", `${id} is ${status.status}${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`);
                 continue;
             }
             const readOnlyIntent = intent === "plan" || intent === "spec" || intent === "explain" || intent === "audit";
@@ -607,16 +692,12 @@ export class Orchestrator {
                 (routeWebRequired && (webSupport === "none" || webSupport === "uncontrolled"));
             if (webIncompatible) {
                 const why = `${id} cannot enforce web policy '${routePolicy}' (manifest web_policy=${webSupport}); choose a web-capable/enforceable harness or change --web to a compatible policy`;
-                if (explicitPool)
-                    throw new HarnessUnavailableError(why);
-                dropped.push(why);
+                dropLane(id, "web", why);
                 continue;
             }
             const attachmentRefusal = this.requestRequirements.attachmentRefusal(id, input.attachments ?? [], manifest.capability_profile.attachment_inputs);
             if (attachmentRefusal) {
-                if (explicitPool)
-                    throw new HarnessUnavailableError(attachmentRefusal);
-                dropped.push(attachmentRefusal);
+                dropLane(id, "attachment", attachmentRefusal);
                 continue;
             }
             const reason = status.reasons.length > 0 ? `: ${status.reasons.join("; ")}` : "";
@@ -642,8 +723,11 @@ export class Orchestrator {
                     // the default store's sources apply only to profile-less runs.
                     authRouteEstimate: this.profileAuthRoute(input, id) ??
                         estimateEffectiveAuthRoute(this.authPreferenceForHarness(input.repoRoot, id, input.authPreference), status.authSources),
+                    supportsSynthesize: manifest.capabilities.synthesize,
                     supportsInteractive: manifest.capabilities.interactive,
                     supportsJsonSchemaOutput: manifest.capabilities.json_schema_output,
+                    workReportTransport: manifest.capabilities.work_report_transport,
+                    structuredOutputChannel: manifest.capabilities.structured_output_channel,
                     supportsMcpInjection: manifest.capability_profile.mcp_injection,
                     mcpInjectionRequiresFullAccess: manifest.capability_profile.mcp_injection_requires_full_access,
                     implementationTransport: manifest.capabilities.implementation_transport,
@@ -661,21 +745,51 @@ export class Orchestrator {
                         : null,
                 });
             }
-            else
-                dropped.push(`${id} (${accessSupported ? `cannot ${intent}${reason}` : `cannot enforce ${requiredAccess}`})`);
+            else {
+                // QA-043: an intent- or access-incompatible lane. For an EXPLICIT pool
+                // this is a loud refusal (dropLane throws) naming the lane and the
+                // exact capability gap — never a silent omission that a surviving lane
+                // then masks by modulo self-duplication. The typed stage distinguishes
+                // an access refusal from a capability one so the disclosure is honest.
+                dropLane(id, accessSupported ? "capability" : "access", `${id} (${accessSupported ? `cannot ${intent}${reason}` : `cannot enforce ${requiredAccess}`})`);
+            }
         }
         if (pool.length === 0) {
             throw new HarnessUnavailableError(`no harness can perform '${intent}' for this mode${dropped.length ? ` (skipped: ${dropped.join(", ")})` : ""}`);
         }
-        const ordered = this.orderPool(pool, input, intent, statusById, ledger);
+        const ordered = this.orderPool(pool, input, intent, statusById, ledger, runId);
         if (ordered.length === 0) {
             throw new HarnessUnavailableError(`no harness remains eligible for '${intent}' after budget and quota routing`);
         }
         emitPrimaryDivergence(log, input.primaryHarness, ordered, pool, dropped);
         const n = input.n ?? ordered.length;
         const out = [];
-        for (let i = 0; i < n; i++)
-            out.push(ordered[i % ordered.length]);
+        if (droppedLanes.length > 0 && !allowDuplicateFill) {
+            // QA-043: lanes were dropped from an AUTO best-of pool (an explicit pool
+            // would have thrown at the drop). NEVER refill a dropped lane's slot by
+            // duplicating a surviving harness — that manufactures a self-race that
+            // masks the omission. Clamp to distinct survivors and disclose below.
+            // (Deep-scan sets allowDuplicateFill: its width is scout coverage, not
+            // harness diversity, so a dropped lane must not cut the scout count.)
+            for (let i = 0; i < Math.min(n, ordered.length); i++)
+                out.push(ordered[i]);
+        }
+        else {
+            // No lane was dropped: a pool smaller than `n` is an intentional
+            // best-of-N on the available harness(es) (e.g. explicit `--harness codex
+            // -n 3`), so the historical width fill is preserved.
+            for (let i = 0; i < n; i++)
+                out.push(ordered[i % ordered.length]);
+        }
+        // Disclose an auto-pool omission / width clamp once, with the
+        // requested-vs-effective route receipt (never silent — QA-043).
+        emitPoolDegraded(log, {
+            requestedHarnesses: ids,
+            effectiveHarnesses: [...new Set(out.map((lane) => lane.adapter.id))],
+            requestedN: n,
+            effectiveN: out.length,
+            droppedLanes,
+        });
         this.requestRequirements.requireEffectiveBrowser(input.browser === true, out.map((lane) => lane.browserRequirement));
         // Delegation belt (D32): agent-only, and only on a lane whose adapter can
         // inject MCP servers. A requested delegate with NO injecting lane is a typed
@@ -730,7 +844,7 @@ export class Orchestrator {
      * explicit user pool keeps the user's order; an explicit primary harness is
      * always pinned first. Cross-family diversity is encouraged for later slots.
      */
-    orderPool(pool, input, intent, statusById, ledger) {
+    orderPool(pool, input, intent, statusById, ledger, runId) {
         let ordered = pool;
         if (pool.length > 0) {
             const routeLedger = ledger ?? new BudgetLedger();
@@ -740,7 +854,8 @@ export class Orchestrator {
             // Settled cost is evidence for economy routing, never a provider quality prior.
             const metrics = loadHarnessMetrics(globalConfigDir());
             const remaining = pool.map((r) => {
-                const authModes = statusById.get(r.adapter.id)?.manifest?.auth_modes ?? [];
+                const status = statusById.get(r.adapter.id);
+                const authModes = status?.manifest?.auth_modes ?? [];
                 const metric = metrics[r.adapter.id];
                 // Auth mode for routing: prefer the ROUTE EVIDENCE from the
                 // last settled attempt (adapter-disclosed, persisted in metrics) over
@@ -773,13 +888,23 @@ export class Orchestrator {
                 catch {
                     credentialSubjectId = undefined;
                 }
+                // QA-034: the typed auth-route evidence (doctor source verification x the
+                // resolved route) is AUTHORITATIVE for billing knowledge in the router —
+                // a VERIFIED native route proves subscription_entitlement, so it survives
+                // paid_fallback:never and ranks with a real economy tuple instead of
+                // reading as unknown/paid. Absent (unknown route) falls back to the
+                // metric-derived billingKnowledge below.
+                const authRoute = this.authRouteEvidenceFor(authMode, status?.authSources ?? []);
                 return {
                     harnessId: r.adapter.id,
                     available: true,
                     model: input.models?.[r.adapter.id] ??
                         config.harnesses[r.adapter.id]?.default_model ??
                         undefined,
-                    effort: input.effort ?? config.harnesses[r.adapter.id]?.effort ?? undefined,
+                    effort: input.efforts?.[r.adapter.id] ??
+                        input.effort ??
+                        config.harnesses[r.adapter.id]?.effort ??
+                        undefined,
                     billingKnowledge: authMode === "api_key" ? "metered" : "unknown",
                     incrementalCostUsd: authMode === "api_key" ? (metric?.avg_cost_usd ?? null) : null,
                     credentialRoute: authMode === "api_key"
@@ -787,18 +912,25 @@ export class Orchestrator {
                         : authMode === "local_session"
                             ? "vendor_native"
                             : undefined,
+                    ...(authRoute ? { authRoute } : {}),
                     credentialSubjectId,
                 };
             });
-            const ranked = rankHarnesses(remaining, {
+            const routeCtx = {
                 goal,
                 paidFallback: config.routing.paid_fallback,
                 intent,
                 qualityTiers: config.routing.quality_tiers,
                 ledger: routeLedger,
-            })
+                now: Date.now(), // ONE instant for the sort AND the rationale below
+            };
+            const ranked = rankHarnesses(remaining, routeCtx)
                 .map((candidate) => byId.get(candidate.harnessId))
                 .filter((candidate) => Boolean(candidate));
+            // QA-034: the rationale is run evidence recorded ONCE at pool ordering,
+            // pinned to routeCtx.now so it cannot disagree with the order just taken.
+            if (runId)
+                this.routingRationaleByRun.set(runId, explainRanking(remaining, routeCtx));
             ordered = ranked;
         }
         if (input.primaryHarness) {
@@ -808,6 +940,30 @@ export class Orchestrator {
         }
         return ordered;
     }
+    /**
+     * Typed auth-route evidence for one candidate (QA-034): the concrete
+     * credential route the resolved auth mode maps to, plus the doctor's
+     * verification for the source that route runs under. `local_session` →
+     * vendor_native + the native/OAuth source verification; `api_key` →
+     * managed_api_key + the key source verification. Unknown route → no evidence
+     * (the router keeps its conservative metric-derived billing). Verification is
+     * the source's typed verdict — never inferred from mere availability.
+     */
+    authRouteEvidenceFor(authMode, sources) {
+        const usable = (s) => s.availability === "available" && s.verification !== "failed";
+        if (authMode === "local_session") {
+            const native = sources.find((s) => usable(s) && (s.source === "native_session" || s.source === "oauth_token_env"));
+            return { route: "vendor_native", verification: native?.verification ?? "not_run" };
+        }
+        if (authMode === "api_key") {
+            const key = sources.find((s) => usable(s) &&
+                (s.source === "api_key_env" ||
+                    s.source === "api_key_flag" ||
+                    s.source === "provider_auth_file"));
+            return { route: "managed_api_key", verification: key?.verification ?? "not_run" };
+        }
+        return undefined;
+    }
     /**
      * Lazy ContextPack: built ONLY for the read-only report modes
      * (explore/plan/readonly_audit) that consume it. Persisted to
@@ -916,7 +1072,7 @@ export class Orchestrator {
             projectCommands: cfg.tests?.commands ?? [],
         });
         const commands = resolvedGates.commands;
-        const protectedPaths = [];
+        const protectedPaths = [...new Set(cfg.constraints.protected_paths)];
         const autoProtectedPaths = resolvedGates.autoProtectedPaths;
         const protectedPathApprovals = [
             ...new Map([...(input.protectedPathApprovals ?? [])].map((approval) => [approval.path, approval])).values(),
@@ -973,6 +1129,22 @@ export class Orchestrator {
             // primary by resolveRunInput). The contract is what route spec building
             // reads — there is no run-global model (INV-103).
             routing_models: input.models ?? {},
+            // QA-035: freeze the RESOLVED reasoning-effort per known lane so Exact
+            // Retry replays it instead of re-resolving current settings. Precedence
+            // (specific beats general): the harness-scoped `efforts` map entry, then a
+            // per-turn scalar `input.effort`, then the harness settings default — the
+            // same map that Exact Retry replays so a NON-PRIMARY lane keeps its own
+            // frozen effort (QA-035 completeness). Only known-pool lanes are frozen
+            // here (a pure auto pool's lanes resolve later — documented seam).
+            routing_efforts: Object.fromEntries([...new Set([...(input.harnesses ?? []), ...Object.keys(input.efforts ?? {})])]
+                .map((hid) => [
+                hid,
+                input.efforts?.[hid] ??
+                    input.effort ??
+                    resolvedCfg.global.harnesses?.[hid]?.effort ??
+                    null,
+            ])
+                .filter((entry) => entry[1] !== null)),
         });
     }
     /**
@@ -1044,6 +1216,41 @@ export class Orchestrator {
                 : {}),
         };
     }
+    /**
+     * D-16: the WorkReport transport envelope for one route. Called at every
+     * task-producing spec-build site AFTER harnessSpecKnobs so it OVERRIDES the
+     * plain caller-schema transport with the compiled `{work_report, output}`
+     * envelope on capable routes. The returned `mode` is retained by the caller
+     * and handed to `unwrapWorkReportEnvelope` when the answer is finalized.
+     */
+    workReportEnvelopeFor(routed, contract, interactive) {
+        return resolveWorkReportEnvelope({
+            transport: routed.workReportTransport,
+            channel: routed.structuredOutputChannel,
+            supportsJsonSchemaOutput: routed.supportsJsonSchemaOutput,
+            interactive,
+            callerSchema: contract.output_schema ?? null,
+        });
+    }
+    /**
+     * D-16: apply the resolved WorkReport transport to a built spec — set the
+     * envelope output_schema (constrained/side_tool routes) and APPEND the fenced
+     * envelope instruction (validated routes, e.g. cursor). Mutates the spec in
+     * place and returns the mode the answer unwrap consumes. Called at every
+     * task-producing spec-build site so the transport is never wired one-off.
+     */
+    applyWorkEnvelope(spec, workEnvelope) {
+        if (workEnvelope.outputSchema !== undefined)
+            spec.output_schema = workEnvelope.outputSchema;
+        const instruction = workEnvelope.mode.instruction;
+        if (instruction) {
+            spec.instructions =
+                spec.instructions && spec.instructions.trim()
+                    ? `${spec.instructions}\n\n${instruction}`
+                    : instruction;
+        }
+        return workEnvelope.mode;
+    }
     routeSpecKnobs(routed, contract, overrideModel, effortHint) {
         const s = routed.settings;
         const contractPolicy = contract.external_context.policy;
@@ -1076,13 +1283,16 @@ export class Orchestrator {
         // per-harness map, which beats the per-harness settings default. There is
         // no run-global model.
         const model = overrideModel ?? contract.routing_models[routed.adapter.id] ?? s?.defaultModel ?? null;
-        // Effort disclosure (INV-105): a requested effort on a harness with no
-        // declared ladder is DISCLOSED as ignored, never silently dropped.
-        let effort = effortHint ?? s?.effort ?? null;
-        if (effort && routed.effortLevels.length === 0) {
-            ignored.push(`effort=${effort} (manifest capabilities.effort_levels is empty for ${routed.adapter.id})`);
-            effort = null;
-        }
+        // Effort disclosure (INV-105) against the harness's advertised ladder. This
+        // gate only DISCLOSES an unplaceable level; the clamp belongs to the adapter,
+        // which resolves against the catalog for the profile env the child runs in
+        // (the manifest here is the DEFAULT account's — see effortGovernance.ts). The
+        // contract's FROZEN per-lane effort (QA-035) wins so Exact Retry replays it
+        // without re-reading settings; `effortHint`/settings apply only to an unfrozen lane.
+        const governed = governRouteEffort(contract.routing_efforts[routed.adapter.id] ?? effortHint ?? s?.effort ?? null, { id: routed.adapter.id, ...routed });
+        const effort = governed.effort;
+        if (governed.ignored)
+            ignored.push(governed.ignored);
         return {
             model,
             effort,
@@ -1198,7 +1408,11 @@ export class Orchestrator {
             return { pointerLine: null };
         }
     }
-    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access = "workspace_write", onHarnessEvent, signal, modelHint, effortHint, intent = "implement", log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas = false, fileBackedContext) {
+    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access = "workspace_write", onHarnessEvent, signal, modelHint, effortHint, intent = "implement", log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas = false, fileBackedContext, 
+    /** D-16d: when set, the mechanical continuation checkpoint pointer for a
+     * one-shot fresh-session continuation — appended to the prompt so the model
+     * (and the offline fake) re-grounds in the exhausted attempt's partial work. */
+    continuationPointer) {
         const adapter = routed.adapter;
         const knobs = this.routeSpecKnobs(routed, contract, modelHint, effortHint);
         // Isolated scoped-home sessions are never retained after disposal.
@@ -1212,13 +1426,14 @@ export class Orchestrator {
         const laneContinuity = runInput
             ? await this.resolveContinuity(runInput, adapter.id, sessionFields?.credential_profile?.profile_id ?? runInput.credentialProfileId ?? null, inPlaceEnvelope && !!sessionFields?.resume_session_id, store, paths, envelope.repo_root, log)
             : null;
-        const promptWithContinuity = laneContinuity?.pointerLine
-            ? `${prompt}\n\n${laneContinuity.pointerLine}`
-            : prompt;
         let spec = HarnessRunSpec.parse({
             session_id: newId("ses"),
             intent,
-            prompt: promptWithProtectedPathConstraint(promptWithContinuity, contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals),
+            // Engine-derived read-only prompt constraints: protected/auto-protected
+            // paths PLUS the exact typed gate argv the run will execute (QA-022 FIX B).
+            prompt: promptWithEngineConstraints([prompt, laneContinuity?.pointerLine, continuationPointer]
+                .filter((s) => typeof s === "string" && s.length > 0)
+                .join("\n\n"), contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals, contract.tests.commands),
             attachments: runInput?.attachments ?? [],
             browser: this.requestRequirements.browserSpec(routed.browserRequirement, 
             // F4: browser-MCP screenshots land in the claudexor-owned
@@ -1246,6 +1461,10 @@ export class Orchestrator {
         });
         if (interaction)
             spec.extra["interactionChannel"] = interaction;
+        // D-16: compile the WorkReport envelope onto the spec (overriding the plain
+        // caller-schema transport) and keep the mode for the answer unwrap.
+        const workEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(interaction));
+        const workReportMode = this.applyWorkEnvelope(spec, workEnvelope);
         const inactivityMs = harnessInactivityTimeoutMs(this.config(contract.repo.root));
         const attemptStartedMs = Date.now();
         const budgetSignalState = { quotaPressureDisclosed: false };
@@ -1256,12 +1475,25 @@ export class Orchestrator {
         // W-C4 delta flood budget (per attempt): counts forwarded delta chunks.
         let deltaCount = 0;
         let deltaCutoffDisclosed = false;
+        // QA-024: emit the belt-failure disclosure event at most once per attempt.
+        let beltFailureDisclosed = false;
         const errors = [];
         const answer = new AnswerAssembly();
         const retryPolicy = transientRetryPolicy(this.config(contract.repo.root));
+        // QA-024: the delegation belt is the ONLY engine-owned extra MCP server
+        // injected into an agent lane (the browser MCP rides its own field), so its
+        // presence in the spec marks the belt requested-and-injected for THIS
+        // attempt. A mixed pool leaves it off lanes that cannot host it, so this is
+        // per-attempt truth, not the run-wide --delegate flag.
+        const beltServerName = spec.extra_mcp_servers?.[0]?.name ?? null;
+        // QA-040: the browser MCP is injected under the fixed `browser` namespace
+        // (codex `mcp_servers.browser.*`, claude `mcp__browser__*`). Its presence in
+        // the spec marks the browser armed for THIS attempt — the telemetry fold
+        // then recognizes browser tool calls as trusted live-web evidence.
+        const browserServerName = spec.browser ? "browser" : null;
         const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
             knobs.webPolicy === "cached" ||
-            knobs.webPolicy === "live", effectiveWebMode ?? knobs.webPolicy, [routed.browserRequirement, routed.denyRequirement], knobs.model);
+            knobs.webPolicy === "live", effectiveWebMode ?? knobs.webPolicy, [routed.browserRequirement, routed.denyRequirement], knobs.model, beltServerName, browserServerName);
         let activeSessionId = spec.session_id;
         const onAbort = () => {
             void adapter.cancel?.(activeSessionId)?.catch(() => { });
@@ -1341,6 +1573,23 @@ export class Orchestrator {
                             observeNativeSessionEvent(runInput, adapter.id, safeEv);
                         observeAuthSwitch(log, adapter.id, attemptId, safeEv);
                         observeAttemptTelemetry(telemetry, safeEv);
+                        // QA-024: the injected delegation belt's MCP server reported `failed`
+                        // to start. Disclose it ONCE as a typed run event the moment the
+                        // `started` frame reveals it — the harness is about to run without
+                        // `mcp__<belt>__*` tools and may degrade to its own native subagent.
+                        // The terminal outcome axis (delegationBeltUnavailable) reflects it
+                        // too; this event makes the failure visible while the run is live.
+                        if (telemetry.delegationBelt.requested &&
+                            telemetry.delegationBelt.failed &&
+                            !beltFailureDisclosed) {
+                            beltFailureDisclosed = true;
+                            log?.emit("delegation.belt.unavailable", {
+                                attempt_id: attemptId,
+                                harness_id: adapter.id,
+                                server_name: telemetry.delegationBelt.serverName,
+                                reason: "mcp_server_failed_to_start",
+                            });
+                        }
                         // Live plan checklist: forward the adapter's typed plan
                         // progress as a run event (LAST WINS; the UI renders the latest).
                         if (safeEv.plan_progress) {
@@ -1393,15 +1642,21 @@ export class Orchestrator {
                 }
                 catch (err) {
                     // A throwing adapter must not lose the cost already streamed: record the
-                    // error here and let the caller settle the REAL accumulated spend.
+                    // error here and let the caller settle the REAL accumulated spend. #31:
+                    // classify the throw (watchdog timeout vs process crash) so the retry
+                    // gate and required-actions read a typed category, not a bare boolean.
                     harnessErrored = true;
                     errors.push(safeErrorMessage(err));
+                    telemetry.transientFailures.push(classifyAdapterThrow({ errorName: err instanceof Error ? err.name : null }));
                 }
                 finally {
                     clearFileBackedContext();
                 }
-                const transient = telemetry.transientFailures.at(-1) ?? null;
-                const sawTransient = telemetry.transientFailures.length > transientStart;
+                const newTransients = telemetry.transientFailures.slice(transientStart);
+                const transient = newTransients.at(-1) ?? null;
+                // #31: the centralized retry gate reads the classified `retryable`, not a
+                // bare "saw any transient" boolean.
+                const sawRetryable = newTransients.some((f) => f.retryable);
                 const sawTypedLimit = telemetry.rateLimits.length > rateLimitStart;
                 const currentDiff = await wsm.diff(envelope);
                 const currentAnswer = answer.text();
@@ -1432,7 +1687,7 @@ export class Orchestrator {
                     }
                 }
                 if (!harnessErrored ||
-                    !sawTransient ||
+                    !sawRetryable ||
                     !deliverableEmpty ||
                     nativeTry >= retryPolicy.maxRetries ||
                     signal?.aborted)
@@ -1443,6 +1698,7 @@ export class Orchestrator {
                     harness_id: adapter.id,
                     attempt_id: attemptId,
                     kind: transient?.kind ?? "unknown",
+                    category: transient?.category ?? "unknown_harness_error",
                     native_try: nativeTry + 1,
                 });
                 log?.emit("route.transient.retry_scheduled", {
@@ -1463,16 +1719,23 @@ export class Orchestrator {
             log?.emit("route.transient.exhausted", {
                 harness_id: adapter.id,
                 attempt_id: attemptId,
+                category: telemetry.transientFailures.at(-1)?.category ?? "unknown_harness_error",
                 retries: retryPolicy.maxRetries,
             });
         }
         const attemptStreamEndedMs = Date.now();
         if (webUnsatisfied(telemetry)) {
-            errors.push(`web evidence unsatisfied: ${telemetry.web.errorSummary ?? (telemetry.web.attempted ? "web tool failed without verified recovery" : "web evidence required but never attempted")}`);
+            errors.push(webEvidenceFailure(telemetry.web));
         }
         const diff = await wsm.diff(envelope);
-        const answerText = answer.text() || undefined;
-        const deliverablePresent = diff.trim().length > 0 || Boolean(answerText);
+        // D-16: un-nest {work_report, output} so answer.md persists the OUTPUT, not the envelope.
+        const unwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", workReportMode, {
+            sideToolReport: telemetry.sideToolWorkReport ?? undefined,
+        });
+        // X119: persist the VERBATIM redacted bytes; trim ONLY for the emptiness check.
+        const redacted = redactSecrets(unwrapped.deliverable);
+        const answerText = redacted.trim().length > 0 ? redacted : undefined;
+        const deliverableEvidence = diff.trim().length > 0 || Boolean(answerText);
         // Cancelled attempts skip gates entirely: the operator asked to
         // stop NOW; running a 600s-per-gate suite after the abort delays the ack
         // and burns compute on a result nobody will adopt. Diff/attempt.yaml
@@ -1507,12 +1770,28 @@ export class Orchestrator {
             });
         }
         const webBlocked = webUnsatisfied(telemetry);
+        // D-16 unified finalizer: fold the WorkReport / context signals into the
+        // deliverable + work_state. A broken contract on a constrained route
+        // elevates harnessErrored (never a prose success).
+        const finalized = finalizeAttempt({
+            deliverableEvidence,
+            harnessErrored,
+            workReport: unwrapped.workReport,
+            workReportSource: unwrapped.source,
+            workReportViolation: unwrapped.contractViolation,
+            contextTerminalExhausted: telemetry.contextExhausted,
+        });
+        harnessErrored = finalized.harnessErrored;
+        if (finalized.outcomeClass === "contract_failure" && unwrapped.contractViolation)
+            errors.push(`work_report contract: ${unwrapped.contractViolation}`);
+        const deliverablePresent = finalized.deliverablePresent;
         const errored = harnessErrored || webBlocked;
         setAttemptOutcome(telemetry, {
             deliverablePresent,
             gatesPassed: gates.length > 0 ? gatesPassed(gates) : null,
             harnessErrored,
             webRequiredUnsatisfied: webBlocked,
+            workState: finalized.workState,
         });
         const attemptDir = join(paths.attemptsDir, attemptId);
         try {
@@ -1565,6 +1844,7 @@ export class Orchestrator {
             costEstimated,
             errors: errors.slice(0, 8),
             telemetry,
+            outcomeClass: finalized.outcomeClass,
         };
     }
     interactionChannelFor(input, log, runId, taskId, attemptId, harnessId, 
@@ -1624,6 +1904,40 @@ export class Orchestrator {
             return message;
         }
     }
+    /**
+     * D-14 layer 3 (AGENTS.md unification, INV-113): the ONE new live-tree write.
+     * When the PROJECT root has `AGENTS.md` and no `CLAUDE.md`, drop a thin
+     * `CLAUDE.md` (`@AGENTS.md` import + Claudexor ownership marker) so a Claude
+     * Code route reads the same instruction file codex/cursor read natively.
+     *
+     * Fenced exactly where the automatic git-init boundary is: read-only modes
+     * never reach this run-prep stage; `--in-place` stateful targets are left
+     * untouched; the write targets the PROJECT root (`repoRoot`), never a worktree
+     * envelope. The workspace helper adds exclusive-create + no-follow +
+     * idempotency, so a hand-written or symlinked `CLAUDE.md` is never overwritten
+     * and a concurrent/second prep is a no-op. Announced via a typed
+     * `project.claude_bridge.created` event on an actual create only — the git-init
+     * pattern. A bridge is a convenience, not a precondition: any failure is
+     * swallowed so it can never fail an otherwise-valid write run.
+     */
+    ensureClaudeBridgeForRun(repoRoot, inPlace, log) {
+        if (repoRoot === NO_PROJECT_ROOT || inPlace)
+            return;
+        let result;
+        try {
+            result = ensureClaudeBridge(repoRoot);
+        }
+        catch {
+            return;
+        }
+        if (result.created) {
+            log.emit("project.claude_bridge.created", {
+                project_root: repoRoot,
+                path: "CLAUDE.md",
+                source: "AGENTS.md",
+            });
+        }
+    }
     /**
      * Freeze-on-implement delivery (D17/D27): verify the frozen plan's hash and
      * materialize it as context/PLAN.md in the run artifact tree — OUTSIDE every
@@ -1707,6 +2021,9 @@ export class Orchestrator {
                 candidates: [],
             };
         }
+        // Same run-prep stage as the git boundary: if the PROJECT root uses AGENTS.md
+        // with no CLAUDE.md, bridge it so a Claude Code candidate reads it (INV-113).
+        this.ensureClaudeBridgeForRun(input.repoRoot, input.inPlace === true, log);
         // Pre-turn snapshot of the live tree for in-place runs: the revert restore
         // target (server-owned revertInPlace). A snapshot failure must never fail the
         // run — revert is simply unavailable then.
@@ -1730,17 +2047,23 @@ export class Orchestrator {
         });
         let adapters;
         try {
-            // Best-of races the whole pool (no divergence `log`: the pool still runs).
-            adapters = await this.resolveCandidateAdapters(input, this.candidateIntent(input), ledger);
+            // Best-of races the whole pool. The `log` is passed so an AUTO pool that
+            // drops a lane / clamps width discloses `route.pool.degraded` (QA-043) —
+            // the resolver never refills a dropped slot with a duplicate harness.
+            adapters = await this.resolveCandidateAdapters(input, this.candidateIntent(input), ledger, log, undefined, runId);
         }
         catch (err) {
             const message = safeErrorMessage(err);
             store.writeText(join(paths.contextDir, "context_error.md"), `# Routing Error\n\n${message}\n`);
+            // A routing preflight refusal is a config_error, not harness_unavailable
+            // (A-1/#22): classify identically across every strategy's routing catch.
+            const routingFailure = routingFailureClassification(err);
             writeFailure(store, paths, {
                 phase: "routing",
-                category: "harness_unavailable",
+                category: routingFailure.category,
                 safeMessage: message,
                 runDir: paths.root,
+                ...(routingFailure.nextActions ? { nextActions: routingFailure.nextActions } : {}),
             });
             store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: routing\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
@@ -1777,6 +2100,9 @@ export class Orchestrator {
         };
         const candidateAccess = contract.access.effective_profile;
         let budgetStopped = false;
+        // QA-050: keep the ledger's typed denial so the zero-candidate terminal
+        // emits budget remediation (not an empty/auth action list).
+        let budgetDenial = null;
         let softWarned = false;
         const requestedSingleCandidate = adapters.length === 1;
         const slots = [];
@@ -1801,6 +2127,12 @@ export class Orchestrator {
                 // already granted; only a tripped hard cap stops everything.
                 if (lease.denied !== "estimate_headroom")
                     budgetStopped = true;
+                budgetDenial ??= {
+                    code: lease.denied ?? "hard_cap",
+                    reason: lease.reason ?? "budget lease denied",
+                    harnessId: routed.adapter.id,
+                    attemptId,
+                };
                 break; // do not spawn more paid work
             }
             slots.push({
@@ -1811,6 +2143,11 @@ export class Orchestrator {
             });
         }
         const runsBySlot = new Array(slots.length);
+        // D-16d: one-shot continuation budget shared across the concurrent candidate
+        // slots (parity with the read-only chain's single counter). Claimed
+        // synchronously (check-then-increment with no await between), so two slots
+        // that both exhaust cannot both consume the single continuation.
+        let candidateContinuationCount = 0;
         const runSlot = async (slot, slotIdx) => {
             if (input.signal?.aborted) {
                 ledger.cancel(slot.leaseId);
@@ -1891,11 +2228,109 @@ export class Orchestrator {
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
                     attempt_id: slot.attemptId,
-                    status: run.errored ? "failed" : "success",
+                    // QA-027: never claim `success` over an attempt the operator/deadline
+                    // cut short. An abort makes the run non-successful; the top-level
+                    // status axis must say `cancelled` (the nested outcome axis already
+                    // rides in telemetrySummary), not launder a torn-off stream as clean.
+                    status: input.signal?.aborted ? "cancelled" : run.errored ? "failed" : "success",
                     cost_usd: run.cost,
                     ...telemetrySummary(run.telemetry),
                 });
-                runsBySlot[slotIdx] = run;
+                // D-16d one-shot continuation for an ENVELOPED candidate (parity with the
+                // read-only loop, which had the ONLY continuation wiring). An eligible
+                // terminal context exhaustion (repeated_refill, no completed report) gets
+                // ONE fresh-session re-run in the SAME envelope, re-grounded by a
+                // mechanical checkpoint packet; the exhausted candidate is superseded ONLY
+                // after the continuation completes. In-place candidates are excluded (a
+                // fresh session cannot safely resume mutation of the live tree).
+                let effectiveRun = run;
+                const envInPlace = envelope.worktree_path === envelope.repo_root;
+                if (!run.errored && !input.signal?.aborted && candidateContinuationCount === 0) {
+                    const contDecision = decideContinuation({
+                        contextExhausted: run.telemetry.contextExhausted,
+                        contextExhaustedCause: run.telemetry.contextExhaustedCause,
+                        workStateCompleted: run.telemetry.outcome?.workState?.state === "completed",
+                        continuationCount: candidateContinuationCount,
+                        runKind: envInPlace ? "in_place" : "enveloped",
+                    });
+                    if (contDecision.eligible) {
+                        const contAttemptId = `${slot.attemptId}c`;
+                        const packet = buildContinuationPacket(synthesizeContinuationRequest({
+                            harness: adapter.id,
+                            profileId: input.credentialProfileId ?? null,
+                            priorPrompt: input.prompt,
+                            priorOutput: run.answerText ?? run.diff ?? "",
+                        }));
+                        // Reserve the continuation lease BEFORE any disclosure: a denied lease
+                        // must never emit run.continuation (which claims a continuation
+                        // launched) and must not consume the one-shot with no attempt. Grant ->
+                        // claim + disclose + run; refusal -> typed run.continuation.denied.
+                        const contLease = ledger.reserve({
+                            taskId,
+                            attemptId: contAttemptId,
+                            intent: this.candidateIntent(input),
+                            harnessId: adapter.id,
+                            cost: attemptCostEvidence(adapter.id, contAttemptId, this.estimateUsdFloor(input.repoRoot), this.routeBillingKnowledge(input, adapter.id)),
+                        });
+                        if (contLease.granted) {
+                            candidateContinuationCount += 1; // claim the one-shot only once it launches
+                            log.emit("run.continuation", {
+                                from_attempt: run.attemptId,
+                                cause: run.telemetry.contextExhaustedCause,
+                                continuation_count: candidateContinuationCount,
+                                packet_turns: packet.continuity.disclosure.packetTurns,
+                            });
+                            const contLeaseId = contLease.lease?.lease_id ?? "";
+                            try {
+                                const contRun = await this.runCandidateInEnvelope(slot.routed, envelope, contAttemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
+                                    const safeEv = redactHarnessEvent(ev);
+                                    safeInvoke(input.onHarnessEvent, safeEv);
+                                    log.emit("harness.event", harnessEventPayload(adapter.id, contAttemptId, safeEv));
+                                }, input.signal, downgradeModel ?? undefined, input.effort, this.candidateIntent(input), log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, contAttemptId, adapter.id, slot.routed.supportsInteractive), (streamedUsd) => {
+                                    ledger.updateHold(contLeaseId, streamedUsd);
+                                    if (ledger.tier() !== "hard")
+                                        return false;
+                                    budgetStopped = true;
+                                    return true;
+                                }, input, requestedSingleCandidate, undefined, packet.pointerLine ?? undefined);
+                                ledger.settle(contLeaseId, attemptUsageCostSettlement(contRun.cost, contRun.costEstimated, contRun.attemptId, contRun.harnessId, contRun.telemetry.authMode, contRun.telemetry.usageCost));
+                                log.emit("harness.completed", {
+                                    harness_id: adapter.id,
+                                    attempt_id: contAttemptId,
+                                    status: input.signal?.aborted
+                                        ? "cancelled"
+                                        : contRun.errored
+                                            ? "failed"
+                                            : "success",
+                                    cost_usd: contRun.cost,
+                                    ...telemetrySummary(contRun.telemetry),
+                                });
+                                // Supersede the exhausted candidate ONLY after the continuation
+                                // actually completes cleanly (never over a torn-off/aborted stream).
+                                if (!contRun.errored && !input.signal?.aborted)
+                                    effectiveRun = contRun;
+                            }
+                            catch (err) {
+                                ledger.settle(contLeaseId, unknownCostSettlement("continuation-error", 0));
+                                log.emit("harness.completed", {
+                                    harness_id: adapter.id,
+                                    attempt_id: contAttemptId,
+                                    status: "failed",
+                                    error: safeErrorMessage(err),
+                                });
+                            }
+                        }
+                        else {
+                            ledger.cancel(contLease.lease?.lease_id ?? "");
+                            log.emit("run.continuation.denied", {
+                                from_attempt: run.attemptId,
+                                cause: run.telemetry.contextExhaustedCause,
+                                reason: contLease.reason ?? contLease.denied ?? "budget lease denied",
+                            });
+                        }
+                    }
+                }
+                runsBySlot[slotIdx] = effectiveRun;
                 reviewEnvelopes.push(envelope);
                 envelope = undefined;
             }
@@ -1972,42 +2407,54 @@ export class Orchestrator {
         }
         if (input.signal?.aborted) {
             await disposeReviewEnvelopes();
-            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({
-                attemptId: r.attemptId,
-                harnessId: r.harnessId,
-                telemetry: r.telemetry,
-            })), null), ledger.spend(), input.signal, store);
+            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null), ledger.spend(), input.signal, store);
         }
         if (runs.length === 0) {
             const budgetReason = ledger.terminal();
+            // QA-050: when the zero-candidate cause is a budget refusal, the shared
+            // classifier owns the typed code, the refused route/slot, and actionable
+            // budget remediation (previously an empty nextActions array).
+            const agentBudgetMapping = budgetStopped || budgetReason
+                ? classifyBudgetFailure({ denial: budgetDenial, terminal: budgetReason })
+                : null;
             const facts = makeOutcomeFacts("failed", {
-                reason: budgetReason ?? (budgetStopped ? "budget_exhausted" : "harness_failed"),
+                reason: agentBudgetMapping?.reason ?? (budgetStopped ? "budget_exhausted" : "harness_failed"),
                 noChanges: true,
             });
-            const why = budgetStopped
-                ? "budget exhausted before any candidate run"
-                : "no candidates produced";
+            const why = agentBudgetMapping?.safeMessage ?? "no candidates produced";
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), {
                 winner: null,
                 facts,
                 why_winner: why,
                 evidence_facts: ["no candidates were produced"],
                 apply_recommendation: "continue",
-                budget_summary: { spend_usd: ledger.spend(), estimated: false },
-            });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Phase: budget\n\n${why}\n`);
-            writeFailure(store, paths, {
-                phase: "budget",
-                category: isBudgetTerminal(facts.reason) ? "budget" : "internal",
-                safeMessage: why,
-                runDir: paths.root,
+                budget_summary: {
+                    spend_usd: ledger.spend(),
+                    estimated: false,
+                    cash_usd: ledger.spend(),
+                    valuation_usd: ledger.valuation(),
+                },
             });
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Phase: ${agentBudgetMapping ? "budget" : "executor"}\n\n${why}\n`);
+            if (agentBudgetMapping) {
+                writeFailure(store, paths, budgetFailureRecord(agentBudgetMapping, { runDir: paths.root }));
+            }
+            else {
+                writeFailure(store, paths, {
+                    phase: "executor",
+                    category: "internal",
+                    safeMessage: why,
+                    runDir: paths.root,
+                    nextActions: ["Open diagnostics", "Retry the run"],
+                });
+            }
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
                 lifecycle: facts.lifecycle,
                 facts,
                 reason: facts.reason,
-                phase: "budget",
+                phase: agentBudgetMapping ? "budget" : "executor",
+                ...(agentBudgetMapping?.harnessId ? { harness_id: agentBudgetMapping.harnessId } : {}),
                 error: why,
                 failure_ref: "final/failure.yaml",
             });
@@ -2029,32 +2476,34 @@ export class Orchestrator {
         // producing anything are corpses: reviewing "(empty diff)" spends real
         // reviewer money on nothing and buries the root cause behind an
         // arbitration scoring string.
-        const workingRuns = runs.filter((r) => !r.errored || r.diff.length > 0);
+        const workingRuns = partitionCandidates(runs).working;
         if (workingRuns.length === 0) {
             await disposeReviewEnvelopes();
             const first = runs[0];
             const phase = first.infraPhase ?? "harness";
-            const rootCause = runs
-                .map((r) => `${r.attemptId}/${r.harnessId}: ${r.errors[0] ?? "failed before producing work"}`)
-                .join("; ");
-            const facts = makeOutcomeFacts("failed", { reason: "harness_failed", noChanges: true });
+            const { facts, why: rootCause } = partitionCandidates(runs);
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), {
                 winner: null,
                 facts,
                 why_winner: rootCause,
                 evidence_facts: runs.map((r) => `${r.attemptId} produced no work: ${r.errors[0] ?? "unknown"}`),
                 apply_recommendation: "continue",
-                budget_summary: { spend_usd: ledger.spend(), estimated: false },
+                budget_summary: {
+                    spend_usd: ledger.spend(),
+                    estimated: false,
+                    cash_usd: ledger.spend(),
+                    valuation_usd: ledger.valuation(),
+                },
             });
-            this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({
-                attemptId: r.attemptId,
-                harnessId: r.harnessId,
-                telemetry: r.telemetry,
-            })), null);
+            this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null);
             store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}\n- Phase: ${phase}\n\n${rootCause}\n`);
             const existingEventRefs = runs
                 .map((r) => `attempts/${r.attemptId}/events.jsonl`)
                 .filter((rel) => existsSync(join(paths.root, rel)));
+            // #31: auth guidance only on a classified auth failure; every other
+            // harness cause (timeout, rate limit, crash, config) gets remediation that
+            // fits it, instead of a doomed "Check harness authentication".
+            const harnessCategory = dominantHarnessFailureCategory(first.telemetry.transientFailures);
             writeFailure(store, paths, {
                 phase,
                 category: phase === "workspace" ? "project" : "harness_error",
@@ -2066,7 +2515,7 @@ export class Orchestrator {
                 runDir: paths.root,
                 nextActions: phase === "workspace"
                     ? ["Check the project folder", "Open diagnostics", "Retry the run"]
-                    : ["Open diagnostics", "Check harness authentication", "Retry the run"],
+                    : harnessFailureNextActions(harnessCategory),
             });
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
@@ -2094,7 +2543,31 @@ export class Orchestrator {
                 spendUsd: ledger.spend(),
             };
         }
-        log.emit("review.started", { reviewers: reviewers.length, review_verified: reviewVerified });
+        // QA-025: only announce that review STARTED when the panel will actually
+        // run. A candidate that changed no files is skipped inside reviewRuns; a
+        // start event before that check falsely claims a paid review began (and its
+        // `review_verified` payload was the PRELIMINARY route-family count, not any
+        // real verification). Compute the reviewable set first and emit a typed
+        // `review.skipped` when nothing is reviewable, so every start has a matching
+        // terminal and the no-diff path records `not_run` consistently.
+        const reviewableRuns = workingRuns.filter((r) => r.diff.trim().length > 0);
+        const configuredFamilies = new Set(reviewers.map((r) => r.providerFamily)).size;
+        if (reviewableRuns.length === 0 || reviewers.length === 0) {
+            log.emit("review.skipped", {
+                reason: reviewers.length === 0 ? "no_reviewers" : "no_changes",
+                reviewable_candidates: reviewableRuns.length,
+                configured_reviewers: reviewers.length,
+                configured_provider_families: configuredFamilies,
+            });
+        }
+        else {
+            log.emit("review.started", {
+                reviewers: reviewers.length,
+                reviewable_candidates: reviewableRuns.length,
+                configured_provider_families: configuredFamilies,
+                cross_family_route_eligible: reviewVerified,
+            });
+        }
         let evidences;
         try {
             // reviewRuns internally SKIPS the paid reviewer call for empty-diff
@@ -2113,11 +2586,7 @@ export class Orchestrator {
             await disposeReviewEnvelopes();
         }
         if (input.signal?.aborted) {
-            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({
-                attemptId: r.attemptId,
-                harnessId: r.harnessId,
-                telemetry: r.telemetry,
-            })), null), ledger.spend(), input.signal, store);
+            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null), ledger.spend(), input.signal, store);
         }
         // Synthesis: if worthwhile, run a synthesizer as a NEW, re-checked candidate.
         const synth = decideSynthesis(evidences, input.synthesis ?? "auto");
@@ -2161,22 +2630,22 @@ export class Orchestrator {
                     ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     reviewEnvelopes.push(envelope);
                     envelope = undefined;
+                    // D-16 r8: only a WORKING synth is reviewed/adopted (same veto owner
+                    // as the race lane); `runs` still records it for telemetry.
+                    runs.push(run);
                     try {
-                        const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal);
-                        evidences.push(...synthEvidence);
+                        if (isWorkingCandidate(run)) {
+                            const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal);
+                            evidences.push(...synthEvidence);
+                            workingRuns.push(run);
+                        }
                         if (input.signal?.aborted) {
-                            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({
-                                attemptId: r.attemptId,
-                                harnessId: r.harnessId,
-                                telemetry: r.telemetry,
-                            })), null), ledger.spend(), input.signal, store);
+                            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null), ledger.spend(), input.signal, store);
                         }
                     }
                     finally {
                         await disposeReviewEnvelopes();
                     }
-                    runs.push(run);
-                    workingRuns.push(run);
                 }
                 catch (err) {
                     ledger.settle(lease.lease?.lease_id ?? "", unknownCostSettlement("synthesis-error"));
@@ -2193,17 +2662,17 @@ export class Orchestrator {
             }
         }
         if (input.signal?.aborted) {
-            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({
-                attemptId: r.attemptId,
-                harnessId: r.harnessId,
-                telemetry: r.telemetry,
-            })), null), ledger.spend(), input.signal, store);
+            return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null), ledger.spend(), input.signal, store);
         }
         let result;
         try {
             result = arbitrate(evidences, {
                 spendUsd: ledger.spend(),
                 estimatedSpend: runs.some((r) => r.costEstimated),
+                // QA-010b: carry the settled cash + subscription-valuation totals
+                // (reviewer panel included) onto the decision record.
+                cashUsd: ledger.spend(),
+                valuationUsd: ledger.valuation(),
             });
         }
         catch (err) {
@@ -2213,6 +2682,11 @@ export class Orchestrator {
         log.emit("arbitration.completed", {
             winner: result.decision.winner,
             lifecycle: result.decision.facts.lifecycle,
+            // QA-028: surface the axis that actually separated the winner from the
+            // runner-up (null on an exact tie) so live surfaces can explain the pick.
+            ...(result.decision.decisive_axis
+                ? { decisive_axis: result.decision.decisive_axis.key }
+                : {}),
         });
         // Winner can only be a candidate that actually produced work; corpses are
         // excluded from arbitration upstream and from the fallback here.
@@ -2266,7 +2740,7 @@ export class Orchestrator {
         store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), {
             ...result.decision,
             ...(needsDec
-                ? blockedDecisionOverride(result.decision.evidence_facts, finalVerify)
+                ? blockedDecisionOverride(result.decision.evidence_facts, facts, finalVerify)
                 : { facts }),
             review_verified: actualReviewVerified,
             final_verify: finalVerify,
@@ -2291,7 +2765,7 @@ export class Orchestrator {
                 ? winnerEvidence.findings.filter((f) => isBlocking(f)).length
                 : 0;
             // Prose from an empty-diff winner is an answer, never a patch.
-            const winnerAnswer = winnerRun.answerText?.trim() ?? "";
+            const winnerAnswer = winnerRun.answerText ?? "";
             const resultKind = hasDiff ? "patch" : winnerAnswer.length > 0 ? "answer" : "none";
             // The winner's final MESSAGE is the human-facing answer and materializes
             // for diff-ful runs too: the chat renders final/answer.md (the projection
@@ -2430,7 +2904,7 @@ export class Orchestrator {
                     : "diagnostic",
             });
         }
-        this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, runs.map((r) => ({ attemptId: r.attemptId, harnessId: r.harnessId, telemetry: r.telemetry })), result.decision.facts.lifecycle === "succeeded"
+        this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), result.decision.facts.lifecycle === "succeeded"
             ? result.decision.winner
             : (winnerRun?.attemptId ?? null));
         // A needs-decision terminal (review blocked or checks failed) OR a
@@ -2464,9 +2938,16 @@ export class Orchestrator {
             });
         }
         else if (isFailureTerminal) {
+            // QA-010c: a reviewer-accepted BLOCK/FIX_FIRST (or a failed deterministic
+            // gate) that BLOCKS the run is an operator-decision terminal, not an
+            // internal engine error. Only a genuinely unexpected non-decision terminal
+            // stays `internal`. A review/checks block is `policy` (the acceptance
+            // path), phase `review`, and its remedy names the decision, not "retry
+            // with a different harness".
+            const decisionBlock = needsHuman || needsDecisionTerminal;
             writeFailure(store, paths, {
-                phase: needsHuman ? "review" : "arbitration",
-                category: needsHuman
+                phase: decisionBlock ? "review" : "arbitration",
+                category: decisionBlock
                     ? "policy"
                     : winnerRun?.errored
                         ? "harness_error"
@@ -2477,16 +2958,20 @@ export class Orchestrator {
                 attemptId: winnerRun?.errored ? winnerRun.attemptId : undefined,
                 safeMessage: needsHuman
                     ? `review escalated to a human decision: ${result.decision.why_winner}`
-                    : result.decision.why_winner,
+                    : needsDecisionTerminal
+                        ? `review blocked before apply: ${result.decision.why_winner}`
+                        : result.decision.why_winner,
                 rawDetailRef: winnerRun?.errored
                     ? `attempts/${winnerRun.attemptId}/attempt.yaml`
                     : undefined,
                 runDir: paths.root,
-                nextActions: needsHuman
+                nextActions: decisionBlock
                     ? [
-                        "Open the review queue",
-                        "Decide the NEEDS_HUMAN findings",
-                        "Re-run after the decision",
+                        "Review the blocking findings on the run's turn",
+                        "Accept the risk to apply this exact patch, or discard the change",
+                        ...(facts.checks === "failed"
+                            ? ["Configure/approve the deterministic test command, then re-run"]
+                            : []),
                     ]
                     : [
                         "Open diagnostics",
@@ -2550,7 +3035,11 @@ export class Orchestrator {
         };
     }
     /** Single-owner telemetry artifact (final/telemetry.yaml); surfaces project it, never recompute. */
-    writeRunTelemetry(store, paths, contract, runId, taskId, mode, attempts, finalAttemptId) {
+    writeRunTelemetry(store, paths, contract, runId, taskId, mode, attempts, finalAttemptId, deepScanSynthesis) {
+        // QA-034: attach the routing rationale recorded at pool ordering (if this
+        // run computed one), then clear it — telemetry is written once at terminal.
+        const routingRationale = this.routingRationaleByRun.get(runId) ?? null;
+        this.routingRationaleByRun.delete(runId);
         writeRunTelemetryArtifact({
             store,
             finalDir: paths.finalDir,
@@ -2560,6 +3049,8 @@ export class Orchestrator {
             mode,
             attempts,
             finalAttemptId,
+            routingRationale,
+            deepScanSynthesis: deepScanSynthesis ?? null,
             resolveAuthPreference: (harnessId) => this.authPreferenceForHarness(contract.repo.root, harnessId, contract.auth_preference),
         });
     }
@@ -2784,6 +3275,11 @@ export class Orchestrator {
                     candidates: [],
                 };
             }
+            // Same run-prep stage as the git boundary (and the same `!inPlace`
+            // exclusion — we are inside that branch, so inPlace is false here): bridge
+            // an AGENTS.md-only PROJECT root so a Claude Code convergence attempt reads
+            // it (INV-113).
+            this.ensureClaudeBridgeForRun(input.repoRoot, false, log);
         }
         const reviewDir = join(paths.root, "review-evidence");
         writeEvidencePacket(reviewDir, {
@@ -2799,17 +3295,21 @@ export class Orchestrator {
         // One envelope carried forward across attempts so the harness can repair its own work.
         let adapterPool;
         try {
-            adapterPool = await this.resolveCandidateAdapters({ ...input, n: undefined }, this.candidateIntent(input), ledger, log);
+            adapterPool = await this.resolveCandidateAdapters({ ...input, n: undefined }, this.candidateIntent(input), ledger, log, undefined, runId);
             this.requestRequirements.assertConvergenceWorkspace(input.inPlace === true, adapterPool);
         }
         catch (err) {
             const message = safeErrorMessage(err);
             store.writeText(join(paths.contextDir, "context_error.md"), `# Routing Error\n\n${message}\n`);
+            // A routing preflight refusal is a config_error, not harness_unavailable
+            // (A-1/#22): classify identically across every strategy's routing catch.
+            const routingFailure = routingFailureClassification(err);
             writeFailure(store, paths, {
                 phase: "routing",
-                category: "harness_unavailable",
+                category: routingFailure.category,
                 safeMessage: message,
                 runDir: paths.root,
+                ...(routingFailure.nextActions ? { nextActions: routingFailure.nextActions } : {}),
             });
             store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: routing\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
@@ -2881,6 +3381,7 @@ export class Orchestrator {
         let attempt = 0;
         let converged = false;
         let exhausted = false;
+        let interrupted = false; // D-16 r8: terminalizes the run interrupted
         let lastFindings = [];
         let lastRun = null;
         let actualReviewVerified = false;
@@ -2939,7 +3440,7 @@ export class Orchestrator {
                     : "";
                 const prompt = attempt === 1
                     ? input.prompt
-                    : `${input.prompt}\n\nThe previous attempt did not converge. Address these review findings (verify each against the code; fix valid ones, rebut invalid ones with evidence):\n${formatFindings(lastFindings)}${runtimeErrors}`;
+                    : buildRevisePrompt(input.prompt, lastFindings, runtimeErrors);
                 // Loop detection (budget router): the 3rd identical repair prompt means
                 // findings/errors are not changing — stop burning paid attempts.
                 const fingerprint = promptFingerprint(prompt);
@@ -2987,7 +3488,8 @@ export class Orchestrator {
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
-                        status: run.errored ? "failed" : "success",
+                        // QA-027: an aborted attempt is `cancelled`, never a clean `success`.
+                        status: input.signal?.aborted ? "cancelled" : run.errored ? "failed" : "success",
                         cost_usd: run.cost,
                         ...telemetrySummary(run.telemetry),
                     });
@@ -3017,6 +3519,12 @@ export class Orchestrator {
                 }
                 lastRun = run;
                 attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry: run.telemetry });
+                // D-16 r8: interrupted (errored===false) would CONVERGE a partial diff
+                // as clean — break BEFORE review; a harness error still gate-retries.
+                if (run.outcomeClass === "interrupted") {
+                    interrupted = true;
+                    break;
+                }
                 // Post-mutation fence for in-place: snapshot the live tree NOW (after the
                 // harness mutated it, before this attempt's review). The last attempt's
                 // value is the revert target persisted into work_product.yaml.
@@ -3242,22 +3750,41 @@ export class Orchestrator {
         // Base terminal AXES (D8) from the convergence loop outcome. Attempts-cap
         // exhaustion maps to budget_exhausted (an attempt budget); the give-up
         // states map to their matching RunReason.
-        let facts = input.signal?.aborted
-            ? makeOutcomeFacts("cancelled", { reason: "user_cancelled" })
-            : converged
-                ? makeOutcomeFacts("succeeded")
-                : stuckNoProgress
-                    ? makeOutcomeFacts("failed", { reason: "stuck_no_progress" })
-                    : exhausted
-                        ? makeOutcomeFacts("failed", { reason: "budget_exhausted" })
-                        : makeOutcomeFacts("failed", { reason: "not_converged" });
+        //
+        // QA-041 terminal-causality precedence: convergence used to hard-code EVERY
+        // aborted signal to `user_cancelled`, which (a) fabricated an operator action
+        // that never happened when the maxSeconds wall-clock deadline fired, and
+        // (b) discarded an already-proven `stuck_no_progress` terminal. The typed
+        // abort reason (`wall_clock_exceeded` from the deadline controller, carried
+        // on `input.signal.reason` via AbortSignal.any) is now read at the source,
+        // and an established semantic terminal (stuck_no_progress) wins over the
+        // abort so the deadline that only ended a redundant post-proof panel does
+        // not overwrite the actionable no-progress reason. `user_cancelled` is
+        // emitted ONLY for a real control cancel (no typed deadline reason).
+        const convAbortReason = typeof input.signal?.reason === "string" && input.signal.reason
+            ? input.signal.reason
+            : undefined;
+        const convCancelFacts = () => makeOutcomeFacts("cancelled", {
+            reason: convAbortReason === "wall_clock_exceeded" ? "wall_clock_exceeded" : "user_cancelled",
+        });
+        let facts = convergenceOutcomeFacts({
+            converged,
+            interrupted,
+            stuckNoProgress,
+            aborted: Boolean(input.signal?.aborted),
+            exhausted,
+        }, convCancelFacts);
         let decision = null;
-        if (lastRun) {
+        // D-16 r8: interrupted is never arbitrated; the partial stays diagnostic.
+        if (lastRun && !interrupted) {
             const arb = arbitrate([
                 toCandidateEvidence(lastRun, contract, lastFindings, lastFinalReviewClean, actualReviewVerified),
             ], {
                 spendUsd: ledger.spend(),
                 estimatedSpend: lastRun.costEstimated || reviewSpendEstimated,
+                // QA-010b: settled cash + valuation (reviewer panel included).
+                cashUsd: ledger.spend(),
+                valuationUsd: ledger.valuation(),
             });
             decision = arb.decision;
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), decision);
@@ -3308,15 +3835,18 @@ export class Orchestrator {
             decision = {
                 ...decision,
                 ...(convNeedsDecision
-                    ? blockedDecisionOverride(decision.evidence_facts, convFinalVerify)
+                    ? blockedDecisionOverride(decision.evidence_facts, facts, convFinalVerify)
                     : { facts }),
                 final_verify: convFinalVerify,
             };
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), decision);
         }
         this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, attemptTelemetries, lastRun?.attemptId ?? null);
-        // Deliver the converged/last work to final/ so `apply` and `inspect` can use it.
-        if (lastRun) {
+        // Deliver the converged/last work to final/ so `apply` and `inspect` can
+        // use it. D-16 r8: an INTERRUPTED envelope run delivers no applyable
+        // work_product (its partial patch.diff stays diagnostic via attempts/);
+        // in-place keeps the product so the honest Revert offer survives.
+        if (lastRun && (!interrupted || input.inPlace === true)) {
             assertNoSecretLikeTokens("final patch diff", lastRun.diff);
             const patchSha256 = sha256(lastRun.diff);
             store.writeText(join(paths.finalDir, "patch.diff"), lastRun.diff);
@@ -3386,12 +3916,16 @@ export class Orchestrator {
                 attemptId: lastRun?.attemptId,
                 runDir: paths.root,
                 nextActions: facts.lifecycle === "cancelled"
-                    ? ["Retry if cancellation was accidental"]
+                    ? facts.reason === "wall_clock_exceeded"
+                        ? [
+                            "Inspect the partial work kept from before the deadline",
+                            "Increase --max-seconds or narrow the scope, then re-run",
+                        ]
+                        : ["Retry if cancellation was accidental"]
                     : convNeedsDecision
                         ? [
-                            "Open the review queue",
-                            "Decide the NEEDS_HUMAN findings",
-                            "Re-run after the decision",
+                            "Review the blocking findings on the run's turn",
+                            "Accept the risk to apply this exact patch, or discard the change",
                         ]
                         : facts.reason === "stuck_no_progress"
                             ? [
@@ -3405,8 +3939,12 @@ export class Orchestrator {
                                 "Retry with more attempts or a narrower prompt",
                             ],
             });
-            if (!lastRun) {
-                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}\n- Attempts: ${attempt}\n`);
+            // D-16 r8/r9: an INTERRUPTED envelope run still gets its diagnostic
+            // summary + output.ready (only patch/work_product are withheld) — the
+            // ARCHITECTURE event contract guarantees output.ready precedes the
+            // terminal in every mode.
+            if (!lastRun || (interrupted && input.inPlace !== true)) {
+                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n`);
                 log.emit("output.ready", {
                     kind: "summary",
                     path: "final/summary.md",
@@ -3414,7 +3952,10 @@ export class Orchestrator {
                 });
             }
         }
-        log.emit("work_product.emitted", { winner: lastRun?.attemptId ?? null });
+        // work_product.emitted only when a product was actually written (r9).
+        if (lastRun && (!interrupted || input.inPlace === true)) {
+            log.emit("work_product.emitted", { winner: lastRun.attemptId });
+        }
         if (!convIsFailureTerminal) {
             log.emit("run.completed", {
                 lifecycle: facts.lifecycle,
@@ -3440,6 +3981,11 @@ export class Orchestrator {
                 attempts: attempt,
                 phase: "convergence",
                 failure_ref: "final/failure.yaml",
+                // QA-041: surface the typed deadline reason on the terminal event so the
+                // daemon job result / Control API can distinguish it from a user cancel.
+                ...(facts.lifecycle === "cancelled" && convAbortReason
+                    ? { cancel_reason: convAbortReason }
+                    : {}),
             });
         }
         return {
@@ -3451,6 +3997,11 @@ export class Orchestrator {
             facts,
             winner: lastRun?.attemptId ?? null,
             runDir: paths.root,
+            // QA-041: carry the typed deadline reason on the result so daemon/Control
+            // API/CLI never falsely attribute a maxSeconds deadline to the user.
+            ...(facts.lifecycle === "cancelled" && convAbortReason
+                ? { cancelReason: convAbortReason }
+                : {}),
             summary: converged
                 ? `converged in ${attempt} attempt(s)`
                 : `${facts.lifecycle} after ${attempt} attempt(s)`,
@@ -3500,15 +4051,7 @@ export class Orchestrator {
             `Keep it concise. Reference real paths you found. Do NOT paste large code blocks; describe the change instead.`,
         ].join("\n");
     }
-    /**
-     * Run ONE planner spawn (native plan mode, read-only) end to end: budget
-     * lease, spec build, continuity hydration, event streaming, telemetry, and
-     * settle. Shared by the solo plan loop (each pool member is a sequential
-     * fallback) and the Council strategy (each member is a parallel draft, then
-     * one merge iteration on the primary — same machinery, different prompt +
-     * intent). The caller owns bookkeeping that differs per path: which artifact
-     * a success writes to, fallback disclosure, and accumulation.
-     */
+    /** One read-only planner spawn shared by solo fallback, Council drafts, and merge. */
     async runPlannerAttempt(args) {
         const { input, contract, taskId, runId, log, store, paths, ledger, routed, attemptId } = args;
         const adapter = routed.adapter;
@@ -3523,6 +4066,7 @@ export class Orchestrator {
             log.emit("budget.lease.created", {
                 granted: false,
                 reason: lease.reason,
+                denied: lease.denied,
                 attempt_id: attemptId,
                 harness_id: adapter.id,
             });
@@ -3530,10 +4074,17 @@ export class Orchestrator {
                 attemptId,
                 harnessId: adapter.id,
                 status: "failed",
+                outcomeClass: "clean", // never spawned: refused pre-flight by the budget gate
                 error: lease.reason ?? "budget lease denied",
                 text: null,
                 telemetry: null,
                 budgetDenied: true,
+                budgetDenial: {
+                    code: lease.denied ?? "hard_cap",
+                    reason: lease.reason ?? "budget lease denied",
+                    harnessId: adapter.id,
+                    attemptId,
+                },
             };
         }
         const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
@@ -3570,6 +4121,10 @@ export class Orchestrator {
         const planInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
         if (planInteraction)
             spec.extra["interactionChannel"] = planInteraction;
+        // D-16: compile the WorkReport envelope for the plan lane (require plan text
+        // below folds the deliverable; the veto rides work_state).
+        const planWorkEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(planInteraction));
+        const planWorkMode = this.applyWorkEnvelope(spec, planWorkEnvelope);
         const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
         const answer = new AnswerAssembly();
         const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
@@ -3657,34 +4212,74 @@ export class Orchestrator {
             input.signal?.removeEventListener("abort", onAbort);
             ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode, telemetry.usageCost));
         }
+        // D-16: unwrap and require PLAN TEXT — a plan with no text is not delivered.
+        // The unwrap runs BEFORE the error axes: the deliverable it yields is what
+        // decides whether an unrecovered tool error is fatal (explorer parity).
+        const planUnwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", planWorkMode, {
+            sideToolReport: telemetry.sideToolWorkReport ?? undefined,
+        });
+        const planText = redactSecrets(planUnwrapped.deliverable).trim();
         const unrecovered = unrecoveredToolErrors(telemetry);
         const webBlocked = webUnsatisfied(telemetry);
         if (!harnessError && webBlocked) {
-            harnessError = `web evidence unsatisfied: ${telemetry.web.errorSummary ?? (telemetry.web.attempted ? "web tool failed without verified recovery" : "web evidence required but never attempted")}`;
+            harnessError = webEvidenceFailure(telemetry.web);
         }
-        if (!harnessError && unrecovered.length > 0) {
-            const first = unrecovered[0];
-            harnessError = `${first.tool} failed without recovery: ${first.summary}`;
+        // INV-043/INV-044, explorer parity: a DELIVERED plan keeps an unrecovered
+        // non-web tool error as warning evidence instead of discarding the plan (see
+        // the helper). Web keeps its hard gate above; the finalizer outranks both.
+        harnessError ??= unrecoveredToolErrorFailure(unrecovered, planText.length > 0);
+        const planFinalized = finalizeAttempt({
+            deliverableEvidence: planText.length > 0,
+            harnessErrored: harnessError !== null && !webBlocked,
+            workReport: planUnwrapped.workReport,
+            workReportSource: planUnwrapped.source,
+            workReportViolation: planUnwrapped.contractViolation,
+            contextTerminalExhausted: telemetry.contextExhausted,
+        });
+        // A broken WorkReport contract is a hard failure only when the finalizer
+        // ranked it so (a terminal context exhaustion outranks it).
+        if (!harnessError && planFinalized.outcomeClass === "contract_failure") {
+            harnessError = `work_report contract: ${planUnwrapped.contractViolation}`;
         }
-        if (harnessError) {
+        // D-16 r9: an interrupted (context-exhausted) planner is NEVER a clean
+        // plan — partial text must not become final/plan.md as success. A VETO
+        // (needs_input/incomplete work_state) is DIFFERENT by the sealed D-16
+        // contract (X35, INV-116 canaries): the plan still delivers, lifecycle
+        // succeeded, and the work_state veto rides the OUTCOME (non-zero exit) —
+        // it must not be laundered into a harness failure either direction.
+        if (!harnessError && planFinalized.outcomeClass === "interrupted") {
+            harnessError = "context capacity exhausted before the plan completed";
+        }
+        const attemptError = harnessError ??
+            (planFinalized.deliverablePresent ? null : "planner produced no plan text") ??
+            (input.signal?.aborted ? "planner cancelled" : null);
+        setAttemptOutcome(telemetry, {
+            deliverablePresent: planFinalized.deliverablePresent,
+            gatesPassed: null,
+            harnessErrored: (harnessError !== null && !webBlocked) || planFinalized.harnessErrored,
+            webRequiredUnsatisfied: webBlocked,
+            workState: planFinalized.workState,
+        });
+        if (attemptError) {
             log.emit("harness.completed", {
                 harness_id: adapter.id,
                 attempt_id: attemptId,
                 status: webBlocked ? "blocked" : "failed",
-                error: harnessError,
+                error: attemptError,
                 ...telemetrySummary(telemetry),
             });
             return {
                 attemptId,
                 harnessId: adapter.id,
                 status: webBlocked ? "blocked" : "failed",
-                error: harnessError,
+                outcomeClass: planFinalized.outcomeClass,
+                error: attemptError,
                 text: null,
                 telemetry,
                 budgetDenied: false,
             };
         }
-        const text = answer.text() || "(no output)";
+        const text = planText || "(no output)";
         log.emit("harness.completed", {
             harness_id: adapter.id,
             attempt_id: attemptId,
@@ -3695,6 +4290,7 @@ export class Orchestrator {
             attemptId,
             harnessId: adapter.id,
             status: "success",
+            outcomeClass: planFinalized.outcomeClass,
             error: null,
             text,
             telemetry,
@@ -3737,17 +4333,21 @@ export class Orchestrator {
         const laneRun = Boolean(input.threadId);
         let adapters;
         try {
-            adapters = await this.resolveCandidateAdapters({ ...input, n: undefined }, "plan", ledger, log, roHome);
+            adapters = await this.resolveCandidateAdapters({ ...input, n: undefined }, "plan", ledger, log, roHome, runId);
         }
         catch (err) {
             roHome.dispose();
             const message = safeErrorMessage(err);
             store.writeText(join(paths.contextDir, "context_error.md"), `# Routing Error\n\n${message}\n`);
+            // A routing preflight refusal is a config_error, not harness_unavailable
+            // (A-1/#22): classify identically across every strategy's routing catch.
+            const routingFailure = routingFailureClassification(err);
             writeFailure(store, paths, {
                 phase: "routing",
-                category: "harness_unavailable",
+                category: routingFailure.category,
                 safeMessage: message,
                 runDir: paths.root,
+                ...(routingFailure.nextActions ? { nextActions: routingFailure.nextActions } : {}),
             });
             store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (plan)\n\n- Lifecycle: failed\n- Phase: routing\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
@@ -3832,6 +4432,9 @@ export class Orchestrator {
         let fallbackFrom = null;
         const planAttempts = [];
         const attemptTelemetries = [];
+        // QA-050: the ledger's typed denial when a planner slot was refused
+        // pre-spawn, so the terminal is a budget failure (not "all planners failed").
+        let planBudgetDenial = null;
         try {
             for (const [idx, routed] of adapters.entries()) {
                 if (input.signal?.aborted)
@@ -3853,8 +4456,20 @@ export class Orchestrator {
                     promptBody: this.planPrompt(input.prompt) + contextSection,
                     intent: "plan",
                 });
-                if (outcome.budgetDenied)
+                if (outcome.budgetDenied) {
+                    // QA-050: retain the denied planner slot before breaking so the
+                    // terminal names the refused route and does not read "all planners
+                    // failed"; capture the typed denial for the budget classifier.
+                    planBudgetDenial ??= outcome.budgetDenial ?? null;
+                    planAttempts.push({
+                        attemptId,
+                        harnessId: outcome.harnessId,
+                        status: outcome.status,
+                        outcomeClass: outcome.outcomeClass,
+                        error: outcome.error,
+                    });
                     break;
+                }
                 if (outcome.telemetry)
                     attemptTelemetries.push({
                         attemptId,
@@ -3865,6 +4480,7 @@ export class Orchestrator {
                     attemptId,
                     harnessId: outcome.harnessId,
                     status: outcome.status,
+                    outcomeClass: outcome.outcomeClass,
                     error: outcome.error,
                 });
                 if (outcome.status !== "success") {
@@ -3878,7 +4494,7 @@ export class Orchestrator {
                             reason: "planner_failed",
                         });
                     }
-                    else if (fallbackFrom || next === undefined) {
+                    else if (!input.signal?.aborted && (fallbackFrom || next === undefined)) {
                         log.emit("route.fallback.exhausted", {
                             harness_id: outcome.harnessId,
                             attempt_id: attemptId,
@@ -3927,6 +4543,7 @@ export class Orchestrator {
                 ledger,
                 planAttempts,
                 attemptTelemetries,
+                budgetDenial: planBudgetDenial,
             }, "all planners failed");
         }
         if (input.signal?.aborted) {
@@ -4017,6 +4634,58 @@ export class Orchestrator {
             ? "metered"
             : "unknown";
     }
+    /**
+     * #27 / D-6: build the engine-side deps closure for the deep-scan bounded
+     * synthesis reducer (packages/orchestrator/src/deepScanReducer.ts owns the
+     * spawn/stream/settle machinery). The closure keeps the private
+     * route/session/knob machinery HERE and hands the module only finished public
+     * types (a `HarnessRunSpec`, cost evidence, a disposable home).
+     */
+    deepScanReducerDeps(input, contract, log) {
+        return {
+            newReadOnlyHome: () => resolveReadOnlyRouteContext(this.execRootOf(input)),
+            costEvidence: (harnessId, attemptId) => 
+            // The reducer admits under a finite estimate floor (mirror of the n>1
+            // scout reserve) so a subscription route is not refused for lacking a
+            // cash quote.
+            attemptCostEvidence(harnessId, attemptId, this.estimateUsdFloor(input.repoRoot), this.routeBillingKnowledge(input, harnessId)),
+            buildSpec: (routed, homeEnv, prompt, attemptId) => {
+                const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
+                const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
+                const sessionFields = this.sessionSpecFields(input, routed.adapter.id, log);
+                const spec = HarnessRunSpec.parse({
+                    session_id: newId("ses"),
+                    intent: "synthesize",
+                    prompt,
+                    cwd: this.execRootOf(input),
+                    access: "readonly",
+                    attachments: [],
+                    auth_preference: sessionFields.auth_preference,
+                    credential_profile: sessionFields.credential_profile,
+                    // A FRESH session — the reducer never resumes a scout's conversation.
+                    resume_session_id: null,
+                    ...this.harnessSpecKnobs(contract, knobs, "synthesize"),
+                    env_inheritance: envInheritance(this.config(input.repoRoot)),
+                    env: homeEnv,
+                });
+                // D-16: compile the WorkReport transport onto the reducer spec (the
+                // reducer is non-interactive) so its output is unwrapped + finalized
+                // through the shared attempt contract, not a fourth deliverable predicate.
+                const workReportMode = this.applyWorkEnvelope(spec, this.workReportEnvelopeFor(routed, contract, false));
+                return {
+                    spec,
+                    webPolicy: knobs.webPolicy,
+                    effectiveWeb,
+                    model: knobs.model,
+                    workReportMode,
+                };
+            },
+            hardTimeoutMs: reviewerTimeoutMs(this.config(input.repoRoot)),
+            inactivityTimeoutMs: harnessInactivityTimeoutMs(this.config(input.repoRoot)),
+            webRequired: contract.external_context.web_required,
+            quotaEventSink: this.deps.quotaEventSink,
+        };
+    }
     async runReadOnlyReport(input, opts, announce) {
         const taskId = input.taskId ?? newId("task");
         const runId = input.runId ?? newId("run");
@@ -4066,7 +4735,10 @@ export class Orchestrator {
         const laneRun = Boolean(input.threadId) && opts.mode === "ask" && !opts.deepScan;
         let adapters;
         try {
-            adapters = await this.resolveCandidateAdapters({ ...input, prompt, n: width }, opts.intent, ledger, log, roHome);
+            adapters = await this.resolveCandidateAdapters({ ...input, prompt, n: width }, opts.intent, ledger, log, roHome, runId, 
+            // Deep-scan repeats a surviving harness to reach scout width; a dropped
+            // lane must not clamp coverage (QA-043 clamp is best-of-only).
+            opts.deepScan === true);
             if (!opts.deepScan) {
                 const seen = new Set();
                 adapters = adapters.filter((routed) => {
@@ -4081,11 +4753,15 @@ export class Orchestrator {
             roHome.dispose();
             const message = safeErrorMessage(err);
             store.writeText(join(paths.contextDir, "context_error.md"), `# Routing Error\n\n${message}\n`);
+            // A routing preflight refusal is a config_error, not harness_unavailable
+            // (A-1/#22): classify identically across every strategy's routing catch.
+            const routingFailure = routingFailureClassification(err);
             writeFailure(store, paths, {
                 phase: "routing",
-                category: "harness_unavailable",
+                category: routingFailure.category,
                 safeMessage: message,
                 runDir: paths.root,
+                ...(routingFailure.nextActions ? { nextActions: routingFailure.nextActions } : {}),
             });
             store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Lifecycle: failed\n- Phase: routing\n\n${message}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
@@ -4113,34 +4789,101 @@ export class Orchestrator {
         const attemptTelemetries = [];
         let fallbackOpen = false;
         let budgetStopped = false;
+        // QA-050: keep the ledger's TYPED denial (not just a boolean) so the
+        // terminal names the budget sub-code, the refused route/slot, and budget
+        // remediation instead of a harness auth/setup template. First denial wins —
+        // it is the decisive pre-spawn refusal.
+        let budgetDenial = null;
         // in a swarm the same harness appears in several slots; resuming the
         // ONE native session id from all of them races the vendor's session store
         // (and is semantically wrong — N explorers continuing one conversation).
         // Grant resume to the first slot of each harness only; the rest run fresh.
         const resumeGranted = new Set();
-        const runReadonlyAttempt = async (routed, idx, modelOverride) => {
+        // QA-019 disclosure: a scout the budget gate refused before spawn is
+        // recorded as a failed attempt with a placeholder telemetry and a
+        // budget_denied marker. It enters the denominator (honest 1/2), omissions,
+        // and telemetry.yaml, and the marker lets the all-denied terminal still
+        // route through the QA-050 budget classifier (never harness_error).
+        const recordBudgetDeniedScout = (harnessId, attemptId, reason) => {
+            const telemetry = createAttemptTelemetry(contract.external_context.policy, contract.external_context.web_required, contract.external_context.effective_mode);
+            const error = `budget denied before spawn: ${reason}`;
+            setAttemptOutcome(telemetry, {
+                deliverablePresent: false,
+                gatesPassed: null,
+                harnessErrored: false,
+                webRequiredUnsatisfied: false,
+            });
+            attempts.push({
+                attemptId,
+                harnessId,
+                status: "failed",
+                report: "",
+                error,
+                telemetry,
+                budgetDenied: true,
+            });
+            attemptTelemetries.push({ attemptId, harnessId, telemetry });
+            if (opts.deepScan) {
+                store.writeText(join(paths.findingsDir, `${attemptId}-budget-denied.md`), `# Explorer ${attemptId} not started\n\n${error}\n`);
+            }
+        };
+        const runReadonlyAttempt = async (routed, idx, modelOverride, 
+        // D-16d: a one-shot continuation re-run injects its checkpoint packet
+        // pointer here; the attempt runs a FRESH session (resume is never granted
+        // to a same-adapter follow-up slot) and is tagged `-cont`.
+        continuationPointer, 
+        // D-16d: fired exactly once AFTER the budget lease is granted and BEFORE the
+        // attempt streams — the continuation caller emits run.continuation here so
+        // the disclosure never precedes (or outlives) a denied lease. The result
+        // carries the denial reason so a refusal discloses run.continuation.denied.
+        onLaunch) => {
             const adapter = routed.adapter;
-            const attemptId = modelOverride
-                ? `a${String(idx + 1).padStart(2, "0")}-fb`
-                : `a${String(idx + 1).padStart(2, "0")}`;
+            const attemptId = continuationPointer
+                ? `a${String(idx + 1).padStart(2, "0")}-cont`
+                : modelOverride
+                    ? `a${String(idx + 1).padStart(2, "0")}-fb`
+                    : `a${String(idx + 1).padStart(2, "0")}`;
             const budgetSignalState = { quotaPressureDisclosed: false };
             const lease = ledger.reserve({
                 taskId,
                 attemptId,
                 intent: opts.intent,
                 harnessId: adapter.id,
-                cost: attemptCostEvidence(adapter.id, attemptId, undefined, this.routeBillingKnowledge(input, adapter.id)),
+                // QA-019: an n>1 deep-scan scout admits under a FINITE estimate floor
+                // (mirror of the candidate loop): the first scout reserves without a
+                // floor, but later scouts pass the repo's usd floor so a subscription
+                // swarm is not refused for lacking a per-attempt cash quote under a cap.
+                cost: attemptCostEvidence(adapter.id, attemptId, opts.deepScan && idx > 0 ? this.estimateUsdFloor(input.repoRoot) : undefined, this.routeBillingKnowledge(input, adapter.id)),
             });
             if (!lease.granted) {
                 log.emit("budget.lease.created", {
                     granted: false,
                     reason: lease.reason,
+                    denied: lease.denied,
                     attempt_id: attemptId,
                     harness_id: adapter.id,
                 });
                 budgetStopped = true;
-                return;
+                budgetDenial ??= {
+                    code: lease.denied ?? "hard_cap",
+                    reason: lease.reason ?? "budget lease denied",
+                    harnessId: adapter.id,
+                    attemptId,
+                };
+                // QA-019 disclosure: a still-denied deep-scan scout must not vanish from
+                // the denominator. Record a placeholder failed attempt with a
+                // budget_denied marker so the explore-findings map counts it (1/2, not
+                // 1/1), omissions and telemetry record the denial, and the all-denied
+                // terminal still routes through the QA-050 budget classifier. The
+                // sequential ask/audit path has no denominator — a denial there stays a
+                // pure budget stop (no phantom failed attempt), preserving its terminal.
+                if (opts.deepScan) {
+                    recordBudgetDeniedScout(adapter.id, attemptId, lease.reason ?? "budget lease denied");
+                }
+                return { status: "budget_denied", reason: lease.reason ?? "budget lease denied" };
             }
+            // Lease granted: the attempt is now committed to run — disclose the launch.
+            onLaunch?.();
             const knobs = this.routeSpecKnobs(routed, contract, modelOverride, input.effort);
             const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
             const explorerPrompt = (opts.deepScan
@@ -4157,12 +4900,15 @@ export class Orchestrator {
             const laneContinuity = laneRun
                 ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, grantResume, store, paths, this.execRootOf(input), log)
                 : null;
+            // D-16d: the continuation packet pointer rides after the lane pointer so
+            // the fresh session is re-grounded in the exhausted attempt's work.
+            const promptWithPointers = [explorerPrompt, laneContinuity?.pointerLine, continuationPointer]
+                .filter((p) => Boolean(p))
+                .join("\n\n");
             let spec = HarnessRunSpec.parse({
                 session_id: newId("ses"),
                 intent: opts.intent,
-                prompt: laneContinuity?.pointerLine
-                    ? `${explorerPrompt}\n\n${laneContinuity.pointerLine}`
-                    : explorerPrompt,
+                prompt: promptWithPointers,
                 cwd: this.execRootOf(input),
                 access: "readonly",
                 // ASK/EXPLORE/AUDIT read-only runs must forward the user's attachments —
@@ -4186,6 +4932,9 @@ export class Orchestrator {
             const reportInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
             if (reportInteraction)
                 spec.extra["interactionChannel"] = reportInteraction;
+            // D-16: compile the WorkReport envelope for the read-only lane.
+            const readonlyWorkEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(reportInteraction));
+            const readonlyWorkMode = this.applyWorkEnvelope(spec, readonlyWorkEnvelope);
             const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
             const answer = new AnswerAssembly();
             const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
@@ -4289,9 +5038,13 @@ export class Orchestrator {
                     }
                     catch (err) {
                         harnessError = safeErrorMessage(err);
+                        // #31: classify the throw so the retry gate and required-actions read
+                        // a typed category (watchdog timeout vs process crash).
+                        telemetry.transientFailures.push(classifyAdapterThrow({ errorName: err instanceof Error ? err.name : null }));
                     }
-                    const transient = telemetry.transientFailures.at(-1) ?? null;
-                    const sawTransient = telemetry.transientFailures.length > transientStart;
+                    const newTransients = telemetry.transientFailures.slice(transientStart);
+                    const transient = newTransients.at(-1) ?? null;
+                    const sawRetryable = newTransients.some((f) => f.retryable);
                     const sawTypedLimit = telemetry.rateLimits.length > rateLimitStart;
                     const reportSoFar = answer.text();
                     // W5.4 reactive failover, READ-ONLY lane (same contract as the
@@ -4319,7 +5072,7 @@ export class Orchestrator {
                         }
                     }
                     if (!harnessError ||
-                        !sawTransient ||
+                        !sawRetryable ||
                         reportSoFar.length > 0 ||
                         nativeTry >= retryPolicy.maxRetries ||
                         input.signal?.aborted)
@@ -4330,6 +5083,7 @@ export class Orchestrator {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
                         kind: transient?.kind ?? "unknown",
+                        category: transient?.category ?? "unknown_harness_error",
                         native_try: nativeTry + 1,
                     });
                     log.emit("route.transient.retry_scheduled", {
@@ -4350,26 +5104,43 @@ export class Orchestrator {
                 log.emit("route.transient.exhausted", {
                     harness_id: adapter.id,
                     attempt_id: attemptId,
+                    category: telemetry.transientFailures.at(-1)?.category ?? "unknown_harness_error",
                     retries: retryPolicy.maxRetries,
                 });
             }
             attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
-            const report = redactSecrets(answer.text());
+            // D-16: un-nest the {work_report, output} envelope; the OUTPUT is the report.
+            const roUnwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", readonlyWorkMode, {
+                sideToolReport: telemetry.sideToolWorkReport ?? undefined,
+            });
+            const report = redactSecrets(roUnwrapped.deliverable);
             const unrecovered = unrecoveredToolErrors(telemetry);
             const webBlocked = webUnsatisfied(telemetry);
-            const deliverablePresent = report.length > 0;
+            const reportPresent = report.length > 0;
             if (!harnessError && webBlocked) {
-                harnessError = `web evidence unsatisfied: ${telemetry.web.errorSummary ?? (telemetry.web.attempted ? "web tool failed without verified recovery" : "web evidence required but never attempted")}`;
+                harnessError = webEvidenceFailure(telemetry.web);
             }
-            if (!harnessError && unrecovered.length > 0 && !deliverablePresent) {
-                const first = unrecovered[0];
-                harnessError = `${first.tool} failed without recovery: ${first.summary}`;
+            harnessError ??= unrecoveredToolErrorFailure(unrecovered, reportPresent);
+            const roFinalized = finalizeAttempt({
+                deliverableEvidence: reportPresent,
+                harnessErrored: harnessError !== null && !webBlocked,
+                workReport: roUnwrapped.workReport,
+                workReportSource: roUnwrapped.source,
+                workReportViolation: roUnwrapped.contractViolation,
+                contextTerminalExhausted: telemetry.contextExhausted,
+            });
+            // A broken WorkReport contract is a hard failure ONLY when the finalizer
+            // ranked it so — a concurrent terminal context exhaustion outranks it
+            // (interrupted, not a contract failure). Let the finalizer own precedence.
+            if (!harnessError && roFinalized.outcomeClass === "contract_failure") {
+                harnessError = `work_report contract: ${roUnwrapped.contractViolation}`;
             }
             setAttemptOutcome(telemetry, {
-                deliverablePresent,
+                deliverablePresent: roFinalized.deliverablePresent,
                 gatesPassed: null,
                 harnessErrored: harnessError !== null && !webBlocked,
                 webRequiredUnsatisfied: webBlocked,
+                workState: roFinalized.workState,
             });
             if (harnessError) {
                 log.emit("harness.completed", {
@@ -4390,21 +5161,25 @@ export class Orchestrator {
                 if (opts.deepScan) {
                     store.writeText(join(paths.findingsDir, `${attemptId}-error.md`), `# Explorer ${attemptId} failed\n\n${harnessError}\n`);
                 }
-                return;
+                return { status: "launched" };
             }
+            // D-16 r8: an interrupted scout is a FAILED omission, never reducer input;
+            // the sequential ask/audit winner folds at its own terminal (stays success).
+            const scoutInterrupted = opts.deepScan && roFinalized.outcomeClass === "interrupted";
             log.emit("harness.completed", {
                 harness_id: adapter.id,
                 attempt_id: attemptId,
-                status: "success",
+                status: scoutInterrupted ? "interrupted" : "success",
                 ...telemetrySummary(telemetry),
             });
             attempts.push({
                 attemptId,
                 harnessId: adapter.id,
-                status: "success",
+                status: scoutInterrupted ? "failed" : "success",
                 report: report || "(no output)",
-                error: null,
+                error: scoutInterrupted ? "context capacity exhausted before the scout completed" : null,
                 telemetry,
+                ...(scoutInterrupted ? { interrupted: true } : {}),
             });
             if (opts.deepScan) {
                 const warningNote = toolWarnings(telemetry).length
@@ -4412,22 +5187,82 @@ export class Orchestrator {
                         .map((e) => `${e.tool}: ${e.summary}`)
                         .join("; ")}\n`
                     : "";
-                store.writeText(join(paths.findingsDir, `${attemptId}.md`), `# Explorer ${attemptId} (${adapter.id})\n\n${report || "(no output)"}${warningNote}\n`);
+                const scoutTag = scoutInterrupted
+                    ? " interrupted (context capacity exhausted)"
+                    : ` (${adapter.id})`;
+                store.writeText(join(paths.findingsDir, `${attemptId}${scoutInterrupted ? "-interrupted" : ""}.md`), `# Explorer ${attemptId}${scoutTag}\n\n${report || "(no output)"}${warningNote}\n`);
             }
+            return { status: "launched" };
         };
         try {
             if (opts.deepScan) {
-                // Explorer swarm runs in parallel (bounded), mirroring parallel candidates.
-                await runBounded(adapters, Math.min(adapters.length, MAX_PARALLEL_CANDIDATES), runReadonlyAttempt);
+                // Explorer swarm runs in parallel (bounded), mirroring parallel
+                // candidates. The swarm has no continuation lane, so the launched/denied
+                // return is unused here.
+                await runBounded(adapters, Math.min(adapters.length, MAX_PARALLEL_CANDIDATES), async (routed, idx) => {
+                    await runReadonlyAttempt(routed, idx);
+                });
             }
             else {
                 // ask/audit: sequential fallback chain — first success wins; a blocked
                 // attempt opens a fallback arc to the next eligible harness.
+                let continuationCount = 0; // D-16d: one-shot budget across the chain
                 for (const [idx, routed] of adapters.entries()) {
                     if (input.signal?.aborted)
                         break;
                     await runReadonlyAttempt(routed, idx);
                     let last = attempts[attempts.length - 1];
+                    // D-16d one-shot continuation: an ELIGIBLE terminal context exhaustion
+                    // (repeated_refill, no completed report) gets ONE fresh-session re-run,
+                    // re-grounded by a mechanical checkpoint packet. On completion the
+                    // exhausted attempt is superseded so the continuation wins the terminal.
+                    if (last?.status === "success" && continuationCount === 0 && !budgetStopped) {
+                        const decision = decideContinuation({
+                            contextExhausted: last.telemetry.contextExhausted,
+                            contextExhaustedCause: last.telemetry.contextExhaustedCause,
+                            workStateCompleted: last.telemetry.outcome?.workState?.state === "completed",
+                            continuationCount,
+                            runKind: "read_only",
+                        });
+                        if (decision.eligible) {
+                            const exhausted = last;
+                            const packet = buildContinuationPacket(synthesizeContinuationRequest({
+                                harness: exhausted.harnessId,
+                                profileId: input.credentialProfileId ?? null,
+                                priorPrompt: prompt,
+                                priorOutput: exhausted.report,
+                            }));
+                            // The continuation lease is reserved INSIDE runReadonlyAttempt; emit
+                            // run.continuation via onLaunch (fires only AFTER the grant, before the
+                            // stream) so a denied lease never leaves a false "launched" disclosure
+                            // nor consumes the one-shot. A refusal emits run.continuation.denied.
+                            const outcome = await runReadonlyAttempt(routed, idx, undefined, packet.pointerLine ?? undefined, () => {
+                                continuationCount += 1;
+                                log.emit("run.continuation", {
+                                    from_attempt: exhausted.attemptId,
+                                    cause: last.telemetry.contextExhaustedCause,
+                                    continuation_count: continuationCount,
+                                    packet_turns: packet.continuity.disclosure.packetTurns,
+                                });
+                            });
+                            if (outcome.status === "budget_denied") {
+                                log.emit("run.continuation.denied", {
+                                    from_attempt: exhausted.attemptId,
+                                    cause: last.telemetry.contextExhaustedCause,
+                                    reason: outcome.reason,
+                                });
+                            }
+                            else {
+                                const cont = attempts[attempts.length - 1];
+                                if (cont && cont !== exhausted && cont.status === "success") {
+                                    exhausted.status = "failed";
+                                    exhausted.error =
+                                        exhausted.error ?? "superseded by one-shot continuation (context exhausted)";
+                                    last = cont;
+                                }
+                            }
+                        }
+                    }
                     // Per-harness fallback_model: one same-harness retry on FAILURE (not
                     // policy blocks) before falling through to the next harness.
                     const fallbackModel = routed.settings?.fallbackModel;
@@ -4498,18 +5333,27 @@ export class Orchestrator {
             // injected API-route state. Vendor-owned native credentials were not copied.
             roHome.dispose();
         }
-        if (input.signal?.aborted) {
-            return cancelledResult(log, runId, taskId, opts.mode, paths.root, attempts.map((a) => ({
-                attemptId: a.attemptId,
-                harnessId: a.harnessId,
-                status: a.status,
-            })), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null), ledger.spend(), input.signal, store);
-        }
+        const candidateSummaries = attempts.map((a) => ({
+            attemptId: a.attemptId,
+            harnessId: a.harnessId,
+            status: a.status,
+        }));
+        const cancelledTerminal = () => cancelledResult(log, runId, taskId, opts.mode, paths.root, candidateSummaries, () => this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null), ledger.spend(), input.signal, store);
+        if (input.signal?.aborted)
+            return cancelledTerminal();
         const succeededReadonly = attempts.filter((a) => a.status === "success");
         if (!opts.deepScan && succeededReadonly.length === 0) {
             const last = attempts[attempts.length - 1];
             const webBlocked = attempts.some((a) => a.status === "blocked");
-            const singleError = last?.error ?? (budgetStopped ? "budget exhausted before any attempt" : "harness failed");
+            // QA-050: a budget refusal is a BUDGET failure, not a harness one — route
+            // it through the shared classifier so phase/category/code/route and the
+            // remediation are budget-typed (never auth/setup) across every mode.
+            const budgetMapping = budgetStopped && !webBlocked
+                ? classifyBudgetFailure({ denial: budgetDenial, terminal: ledger.terminal() })
+                : null;
+            const singleError = budgetMapping?.safeMessage ??
+                last?.error ??
+                (budgetStopped ? "budget exhausted before any attempt" : "harness failed");
             if (fallbackOpen || webBlocked) {
                 log.emit("route.fallback.exhausted", {
                     harness_id: last?.harnessId ?? null,
@@ -4529,29 +5373,47 @@ export class Orchestrator {
                 });
             }
             this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null);
-            store.writeText(join(paths.contextDir, "context_error.md"), `# Harness Error\n\n${singleError}\n`);
-            writeFailure(store, paths, {
-                phase: "harness",
-                category: webBlocked ? "policy" : budgetStopped ? "budget" : "harness_error",
-                harnessId: last?.harnessId,
-                attemptId: last?.attemptId,
-                safeMessage: singleError,
-                eventRefs: attempts.map((a) => `attempts/${a.attemptId}/events.jsonl`),
-                runDir: paths.root,
-                nextActions: ["Open diagnostics", "Check harness authentication", "Retry after setup"],
+            store.writeText(join(paths.contextDir, "context_error.md"), `# ${budgetMapping ? "Budget Denied" : "Harness Error"}\n\n${singleError}\n`);
+            const roEventRefs = attempts.map((a) => `attempts/${a.attemptId}/events.jsonl`);
+            if (budgetMapping) {
+                writeFailure(store, paths, budgetFailureRecord(budgetMapping, { eventRefs: roEventRefs, runDir: paths.root }));
+            }
+            else {
+                // #31: classify the harness cause across the read-only attempts so auth
+                // guidance appears only on a real auth failure.
+                const roCategory = dominantHarnessFailureCategory(attemptTelemetries.flatMap((a) => a.telemetry.transientFailures));
+                writeFailure(store, paths, {
+                    phase: "harness",
+                    category: webBlocked ? "policy" : "harness_error",
+                    harnessId: last?.harnessId,
+                    attemptId: last?.attemptId,
+                    safeMessage: singleError,
+                    eventRefs: roEventRefs,
+                    runDir: paths.root,
+                    nextActions: harnessFailureNextActions(roCategory),
+                });
+            }
+            // QA-036: re-check the DELIVERABLE through the shared finalizer helper —
+            // a blocked Ask that produced NO answer can no longer read as a succeeded
+            // "Needs review" run (exit 0); it is an honest failure (exit 1).
+            const roTerminal = readOnlyNoSuccessTerminal({
+                webBlocked,
+                hasDeliverable: partialReport.trim().length > 0,
+                budgetStopped,
+                attemptsCount: attempts.length,
+            });
+            const terminalFacts = makeOutcomeFacts(roTerminal.lifecycle, {
+                ...(roTerminal.review ? { review: roTerminal.review } : {}),
+                reason: roTerminal.reason,
             });
-            const terminalFacts = webBlocked
-                ? makeOutcomeFacts("succeeded", { review: "blocked", reason: "review_blocked" })
-                : budgetStopped && attempts.length === 0
-                    ? makeOutcomeFacts("failed", { reason: "budget_exhausted" })
-                    : makeOutcomeFacts("failed", { reason: "harness_failed" });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harness: ${last?.harnessId ?? "none"}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}\n\n${singleError}\n`);
+            const terminalHarnessId = budgetMapping?.harnessId ?? last?.harnessId;
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harness: ${terminalHarnessId ?? "none"}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}\n\n${singleError}\n`);
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             if (terminalFacts.lifecycle === "succeeded") {
                 log.emit("run.blocked", {
                     lifecycle: terminalFacts.lifecycle,
                     facts: terminalFacts,
-                    harness_id: last?.harnessId,
+                    harness_id: terminalHarnessId,
                     error: singleError,
                     failure_ref: "final/failure.yaml",
                 });
@@ -4561,7 +5423,8 @@ export class Orchestrator {
                     lifecycle: terminalFacts.lifecycle,
                     facts: terminalFacts,
                     reason: terminalFacts.reason,
-                    harness_id: last?.harnessId,
+                    phase: budgetMapping?.phase,
+                    harness_id: terminalHarnessId,
                     error: singleError,
                     failure_ref: "final/failure.yaml",
                 });
@@ -4585,46 +5448,62 @@ export class Orchestrator {
         }
         const succeeded = succeededReadonly;
         if (opts.deepScan && succeeded.length === 0) {
-            const message = attempts
-                .map((a) => `${a.attemptId}/${a.harnessId}: ${a.error ?? "failed"}`)
-                .join("\n");
             const blocked = attempts.some((a) => a.status === "blocked");
-            this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null);
-            writeFailure(store, paths, {
-                phase: "harness",
-                category: blocked ? "policy" : "harness_error",
-                safeMessage: message || "all explorers failed",
-                eventRefs: attempts.map((a) => `attempts/${a.attemptId}/events.jsonl`),
-                runDir: paths.root,
-                nextActions: [
-                    "Open diagnostics",
-                    "Check harness authentication",
-                    "Reduce explore width",
-                    "Retry after setup",
-                ],
-            });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Lifecycle: ${blocked ? "succeeded (needs review)" : "failed"}\n\n${message}\n`);
-            log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
-            const scanFailFacts = blocked
-                ? makeOutcomeFacts("succeeded", { review: "blocked", reason: "review_blocked" })
-                : makeOutcomeFacts("failed", { reason: "harness_failed" });
-            if (blocked)
-                log.emit("run.blocked", {
-                    lifecycle: scanFailFacts.lifecycle,
-                    facts: scanFailFacts,
-                    phase: "harness",
-                    error: message,
-                    failure_ref: "final/failure.yaml",
+            // QA-050/QA-019: an all-denied scan (finite-zero, or every scout refused
+            // before spawn) is a BUDGET failure, not harness_error — route it through
+            // the shared classifier. Only a pure-denial scan (no scout actually errored
+            // in the harness) qualifies, so a real explorer failure is never masked.
+            const scanBudgetMapping = budgetStopped && !blocked && attempts.every((a) => a.budgetDenied === true)
+                ? classifyBudgetFailure({ denial: budgetDenial, terminal: ledger.terminal() })
+                : null;
+            // D-16 r8: ALL scouts out of context → the aggregate is interrupted.
+            const allInterrupted = attempts.length > 0 && attempts.every((a) => a.interrupted === true);
+            const scanFailFacts = allInterrupted
+                ? makeOutcomeFacts("interrupted", { reason: "context_capacity_exhausted" })
+                : makeOutcomeFacts("failed", {
+                    reason: scanBudgetMapping ? scanBudgetMapping.reason : "harness_failed",
                 });
-            else
-                log.emit("run.failed", {
-                    lifecycle: scanFailFacts.lifecycle,
-                    facts: scanFailFacts,
-                    reason: scanFailFacts.reason,
+            const message = scanBudgetMapping
+                ? scanBudgetMapping.safeMessage
+                : attempts.map((a) => `${a.attemptId}/${a.harnessId}: ${a.error ?? "failed"}`).join("\n");
+            this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null);
+            if (scanBudgetMapping) {
+                writeFailure(store, paths, budgetFailureRecord(scanBudgetMapping, {
+                    eventRefs: attempts.map((a) => `attempts/${a.attemptId}/events.jsonl`),
+                    runDir: paths.root,
+                }));
+            }
+            else {
+                // #31: classify the scout failures; keep the scan-specific width hint but
+                // drop the unconditional auth line unless the cause was a real auth failure.
+                const scanCategory = dominantHarnessFailureCategory(attemptTelemetries.flatMap((a) => a.telemetry.transientFailures));
+                writeFailure(store, paths, {
                     phase: "harness",
-                    error: message,
-                    failure_ref: "final/failure.yaml",
+                    category: blocked ? "policy" : "harness_error",
+                    safeMessage: message || "all explorers failed",
+                    eventRefs: attempts.map((a) => `attempts/${a.attemptId}/events.jsonl`),
+                    runDir: paths.root,
+                    nextActions: [
+                        ...harnessFailureNextActions(scanCategory).filter((a) => !a.startsWith("Retry")),
+                        "Reduce explore width",
+                        "Retry after setup",
+                    ],
                 });
+            }
+            // QA-036: with ZERO successful explorers there is no synthesizable
+            // deliverable, so a blocked scan can no longer read as a succeeded
+            // "needs review" run (exit 0). An empty scan is a failure whether the
+            // explorers were blocked or errored.
+            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Lifecycle: ${scanFailFacts.lifecycle}${scanFailFacts.reason ? ` (${scanFailFacts.reason})` : ""}\n\n${message}\n`);
+            log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
+            log.emit("run.failed", {
+                lifecycle: scanFailFacts.lifecycle,
+                facts: scanFailFacts,
+                reason: scanFailFacts.reason,
+                phase: scanBudgetMapping ? scanBudgetMapping.phase : "harness",
+                error: message,
+                failure_ref: "final/failure.yaml",
+            });
             return {
                 spendUsd: ledger.spend(),
                 runId,
@@ -4643,45 +5522,54 @@ export class Orchestrator {
             };
         }
         const unsuccessful = attempts.filter((a) => a.status !== "success");
-        const report = opts.deepScan
-            ? [
-                `Explorers succeeded: ${succeeded.length}/${attempts.length}.`,
-                "",
-                "## Synthesis",
-                ...succeeded.map((a) => {
-                    const warnings = toolWarnings(a.telemetry);
-                    const warningText = warnings.length
-                        ? `\n\n> Tool warnings: ${warnings.map((e) => `${e.tool}: ${e.summary}`).join("; ")}`
-                        : "";
-                    return `\n### ${a.attemptId} / ${a.harnessId}\n\n${a.report}${warningText}`;
-                }),
-                "",
-                "## Omissions / Uncertainty",
-                ...(unsuccessful.length
-                    ? unsuccessful.map((a) => `- ${a.attemptId} / ${a.harnessId} ${a.status}: ${a.error}`)
-                    : [
-                        "- No explorer failures recorded. Claims still need evidence review before edit execution.",
-                    ]),
-                "",
-                "## Follow-up Questions",
-                "- Which findings should become a frozen implementation spec?",
-                "- Should web research be allowed for a second Explore pass?",
-            ].join("\n")
-            : (succeeded[0]?.report ?? "(no output)");
+        // #27 / D-6: a multi-scout deep scan runs ONE bounded synthesis reducer over
+        // the raw scout reports so the final artifact is a real merge, not a
+        // concatenation. A single report (width-1) needs no merge; a failed/denied
+        // reducer degrades to an HONEST raw scout bundle, never a fake synthesis. The
+        // whole decision + reducer spawn lives in deepScanReducer.ts (its owner).
+        let deepScanSynthesis = null;
+        let reducedReport = null;
+        if (opts.deepScan) {
+            ({ deepScanSynthesis, reducedReport } = await resolveDeepScanSynthesis(this.deepScanReducerDeps(input, contract, log), {
+                succeeded,
+                adapters,
+                budgetStopped,
+                aborted: Boolean(input.signal?.aborted),
+                taskId,
+                goal: prompt,
+                findingsDir: paths.findingsDir,
+                ledger,
+                log,
+                paths,
+                signal: input.signal,
+                onHarnessEvent: input.onHarnessEvent,
+                attemptTelemetries,
+            }));
+        }
+        // INV-116: a cancel that landed WHILE the bounded reducer ran (scouts done,
+        // synthesis in flight) is a cancelled terminal — never a laundered success.
+        if (input.signal?.aborted)
+            return cancelledTerminal();
+        const report = !opts.deepScan
+            ? (succeeded[0]?.report ?? "(no output)")
+            : reducedReport !== null
+                ? reducedReport
+                : rawScoutBundle({ succeeded, unsuccessful, status: deepScanSynthesis });
         store.writeText(join(paths.finalDir, opts.artifactName), `# ${opts.title}\n\n${report}\n`);
         // ask is the only read-only strategy that can carry a structured-output
-        // contract (the boundary refuses the rest); validate the RAW answer text,
-        // not the titled artifact wrapper.
+        // contract (the boundary refuses the rest); validate the FINAL aggregate
+        // (the reduced synthesis, or the honest bundle for a degraded scan) — never
+        // the first scout's raw report — and never the titled artifact wrapper.
         if (opts.mode === "ask" && contract.output_schema) {
             finalizeStructuredOutput({
                 store,
                 finalDir: paths.finalDir,
                 log,
                 schema: contract.output_schema,
-                answerText: succeeded[0]?.report ?? "",
+                answerText: opts.deepScan ? report : (succeeded[0]?.report ?? ""),
             });
         }
-        this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, opts.deepScan ? null : (succeeded[0]?.attemptId ?? null));
+        this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, opts.deepScan ? null : (succeeded[0]?.attemptId ?? null), deepScanSynthesis);
         log.emit("output.ready", {
             kind: opts.mode === "ask" ? "answer" : "report",
             path: `final/${opts.artifactName}`,
@@ -4712,8 +5600,31 @@ export class Orchestrator {
         // non-clean terminal is an aggregate paid-budget stop.
         let terminalFacts = makeOutcomeFacts("succeeded");
         const reportBudgetTerminal = ledger.terminal();
-        if (reportBudgetTerminal)
+        if (reportBudgetTerminal) {
             terminalFacts = makeOutcomeFacts("failed", { reason: reportBudgetTerminal });
+        }
+        else if (!opts.deepScan) {
+            // D-16: fold the winning read-only attempt's work_state into the terminal.
+            // A terminal context exhaustion with no completed report ⇒ interrupted;
+            // a needs_input/incomplete report ⇒ a succeeded run whose work_state
+            // vetoes applyability and a clean exit (INV-116). answer.md was already
+            // persisted from the unwrapped OUTPUT.
+            const winnerTelemetry = succeeded[0]?.telemetry;
+            const winnerWorkState = winnerTelemetry?.outcome?.workState;
+            if (winnerTelemetry?.contextExhausted && winnerWorkState?.state !== "completed") {
+                terminalFacts = makeOutcomeFacts("interrupted", { reason: "context_capacity_exhausted" });
+            }
+            else if (winnerWorkState?.state === "needs_input" ||
+                winnerWorkState?.state === "incomplete") {
+                terminalFacts = makeOutcomeFacts("succeeded", {
+                    reason: winnerWorkState.state === "needs_input" ? "input_required" : "work_incomplete",
+                    work_state: winnerWorkState,
+                });
+            }
+            else if (winnerWorkState) {
+                terminalFacts = makeOutcomeFacts("succeeded", { work_state: winnerWorkState });
+            }
+        }
         const harnessLabel = attempts
             .map((a) => `${a.attemptId}:${a.harnessId}:${a.status}`)
             .join(", ");
@@ -4732,13 +5643,17 @@ export class Orchestrator {
             },
         });
         log.emit("work_product.emitted", { kind: "report", winner: succeeded[0]?.attemptId ?? null });
-        if (terminalFacts.lifecycle === "failed") {
+        const workVetoed = terminalFacts.work_state?.state === "needs_input" ||
+            terminalFacts.work_state?.state === "incomplete";
+        if (terminalFacts.lifecycle !== "succeeded") {
             writeFailure(store, paths, {
                 phase: "executor",
-                category: "budget",
+                category: terminalFacts.reason === "context_capacity_exhausted" ? "harness_error" : "budget",
                 safeMessage: `read-only report ended ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason.replaceAll("_", " ")})` : ""}`,
                 runDir: paths.root,
-                nextActions: ["Inspect the report artifacts", "Adjust the budget and retry"],
+                nextActions: terminalFacts.reason === "context_capacity_exhausted"
+                    ? ["Inspect the partial report", "Re-run with a narrower scope"]
+                    : ["Inspect the report artifacts", "Adjust the budget and retry"],
             });
             log.emit("run.failed", {
                 lifecycle: terminalFacts.lifecycle,
@@ -4748,6 +5663,16 @@ export class Orchestrator {
                 failure_ref: "final/failure.yaml",
             });
         }
+        else if (workVetoed) {
+            // D-16: a succeeded lifecycle whose work_state vetoes is a needs-me
+            // terminal — run.blocked (not run.completed); the outcome-aware exit
+            // projection returns non-zero from the same facts.
+            log.emit("run.blocked", {
+                lifecycle: terminalFacts.lifecycle,
+                facts: terminalFacts,
+                reason: terminalFacts.reason,
+            });
+        }
         else {
             log.emit("run.completed", {
                 lifecycle: terminalFacts.lifecycle,
@@ -4765,11 +5690,7 @@ export class Orchestrator {
             winner: null,
             runDir: paths.root,
             summary: redactSecrets(report).slice(0, 400),
-            candidates: attempts.map((a) => ({
-                attemptId: a.attemptId,
-                harnessId: a.harnessId,
-                status: a.status,
-            })),
+            candidates: candidateSummaries,
         };
     }
 }
@@ -4778,7 +5699,4 @@ function assertNoSecretLikeTokens(label, text) {
         throw new Error(`${label} contains secret-like token; refusing to persist artifact`);
     }
 }
-function safeErrorMessage(err) {
-    return redactSecrets(err instanceof Error ? err.message : String(err));
-}
 //# sourceMappingURL=orchestrator.js.map