@claudexor/orchestrator 3.1.1 → 3.2.0

package/dist/orchestrator.js

@@ -1,96 +1,68 @@
 import { existsSync } from "node:fs";
-import { observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, selectedProfileAvailability, } from "./credential-profiles.js";
+import { effectiveAuthPreference, observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, probeCredentialProfileStatus, profileHeadroomBreach, profileStatusAdmits, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, selectedProfileAvailability, staticRotationCandidates, } from "./credential-profiles.js";
 import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
 import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
 import { processAttemptUsage } from "./attemptUsage.js";
+import * as AC from "./attemptUsageCost.js";
 import { candidateRoster, convergenceOutcomeFacts, isWorkingCandidate, partitionCandidates, toCandidateEvidence, } from "./candidateEvidence.js";
 import { capabilityIntents } from "@claudexor/gateway";
 import { policyFindings } from "./policyFindings.js";
 import { join } from "node:path";
 import { finalizePlanRun, runCouncilPlan, writePlanHarnessFailure, } from "./planRun.js";
-import { HarnessRunSpec, ModeKind as ModeKindSchema, SCHEMA_VERSION, TRUST_FULL_ACCESS_CODE, FrozenTaskContractArtifact as TaskContractSchema, isBlocking, makeOutcomeFacts, normalizeUserOutputSchema, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
-import { globalConfigDir, loadConfig, trustConfigPath } from "@claudexor/config";
-import { AnswerAssembly, CLAUDEXOR_ARTIFACT_DIR, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
+import { runPlannerAttempt as executePlannerAttempt, } from "./plannerAttempt.js";
+import { HarnessRunSpec, ModeKind as ModeKindSchema, QuotaSnapshot as QuotaSnapshotSchema, isBlocking, makeOutcomeFacts, normalizeUserOutputSchema, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
+import { globalConfigDir, loadConfig } from "@claudexor/config";
+import { AnswerAssembly, CLAUDEXOR_ARTIFACT_DIR, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
 import { assertRouteModelsAllowed } from "./modelGovernance.js";
 import { governRouteEffort } from "./effortGovernance.js";
-import { RequestRequirementsResolver } from "./requestRequirements.js";
+import { isFullAccess, RequestRequirementsResolver } from "./requestRequirements.js";
+import { activateDelegationParent } from "./delegation-parent-activation.js";
+import { routingFailureClassification } from "./routing-failure.js";
+export { routingFailureClassification } from "./routing-failure.js";
+import { runBounded } from "./run-bounded.js";
+import { planPrompt } from "./plan-prompt.js";
+import { verifiedPlanBrief, withPlanBrief } from "./planBrief.js";
+import { resolveRunInputDefaults } from "./run-input-resolution.js";
+import { beginAnnouncedRun } from "./runEventLog.js";
+import { arbitrationBudgetOptions, decisionBudgetSummary } from "./decisionBudget.js";
 import { buildRevisePrompt } from "./revisePrompt.js";
 import { cancelledResult, failTerminally, guardAnnouncedRun, writeFailure, } from "./runTerminals.js";
 import { budgetFailureRecord, classifyBudgetFailure } from "./budgetFailure.js";
 import { assertOutputSchemaCompiles, finalizeStructuredOutput } from "./structuredOutput.js";
-import { transientRetryDelayMs, promptWithEngineConstraints, sleep, redactHarnessEvent, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, emitPoolDegraded, deliveryRefusalFailure, writeRaceDeliveryDecision, } from "./runSupport.js";
+import { transientRetryDelayMs, promptWithEngineConstraints, sleep, redactHarnessEvent, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
 import { candidateStatusInRouteContext, resolveReadOnlyRouteContext, } from "./routeContext.js";
 import { resolveAutoReviewerPanel, resolveExplicitReviewerPanel } from "./reviewerPanel.js";
+import { ensureWriteModeGitBoundary } from "./git-precondition.js";
 import { buildContinuation, } from "./continuity.js";
 import { activePlanPointer, resolveContinuitySummary, workspaceAnchor, } from "./continuity-facts.js";
 import { runDiffReview } from "./diffReview.js";
 import { rawScoutBundle, resolveDeepScanSynthesis, } from "./deepScanReducer.js";
 import { classifyAdapterThrow, createAttemptTelemetry, observeAttemptTelemetry, setAttemptOutcome, telemetrySummary, toolWarnings, unrecoveredToolErrors, webUnsatisfied, } from "./attemptTelemetry.js";
+import * as delegateFailure from "./delegationFailure.js";
+import * as secretDiff from "./secretDiff.js";
 import { dominantHarnessFailureCategory, harnessFailureNextActions } from "./harnessFailure.js";
 import { finalizeAttempt, readOnlyNoSuccessTerminal, resolveWorkReportEnvelope, unrecoveredToolErrorFailure, unwrapWorkReportEnvelope, webEvidenceFailure, } from "./attemptFinalize.js";
 import { buildContinuationPacket, decideContinuation, synthesizeContinuationRequest, } from "./continuation.js";
 import { interactionChannelFor } from "./interaction.js";
-import { gateSpecsFromContract, renderTestsEvidence, resolveContractGates, } from "./contract-gates.js";
+import { gateSpecsFromContract, renderTestsEvidence } from "./contract-gates.js";
+import { buildTaskContract } from "./task-contract-builder.js";
 import { ArtifactStore } from "@claudexor/artifact-store";
-import { EventLog } from "@claudexor/event-log";
 import { assertMandatoryContext, buildContextPack, rawContextForEnvelope, preflightEvidence, writeEvidencePacket, } from "@claudexor/context";
-import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, ensureClaudeBridge, ensureGitRepository, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
+import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, ensureClaudeBridge, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
 import { blockedDecisionOverride, finalVerifyBlocks, finalVerifyPatch, verifyAndDeliver, } from "@claudexor/delivery";
 import { HarnessGateway } from "@claudexor/gateway";
 import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, reviewCandidate, revalidateFindings, runGates, } from "@claudexor/review";
 import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
-import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, explainRanking, loadHarnessMetrics, promptFingerprint, unknownCostSettlement, rankHarnesses, reviewUsageCostSettlement, } from "@claudexor/budget";
-import { readTextSafe, appendLine, assertNoInlineSecretValues, containsSecretLikeToken, DELEGATION_ENV, hashJson, newId, noProjectRepoRoot, nowIso, redactSecrets, safeInvoke, sha256, userConfigDir, writeText, } from "@claudexor/util";
+import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, explainRanking, loadHarnessMetrics, promptFingerprint, rankHarnesses, reviewUsageCostSettlement, } from "@claudexor/budget";
+import { readTextSafe, appendLine, assertNoInlineSecretValues, DELEGATION_ENV, hashJson, newId, noProjectRepoRoot, redactSecrets, safeInvoke, sha256, userConfigDir, writeText, } from "@claudexor/util";
 import { assertWriteIsolation } from "./write-isolation.js";
-/** A routed candidate adapter plus its manifest capabilities and user settings. */
-/** The two access profiles that map to codex `danger-full-access` / an
- * unsandboxed lane — the only ones under which a full-access-requiring MCP
- * injection (the belt on codex) can reach the daemon. */
-export function isFullAccess(access) {
-    return access === "full" || access === "external_sandbox_full";
-}
-/**
- * A routing preflight refusal (`RoutingPreflightError`: quality routing with no
- * comparable user-declared tier for the intent) is a CONFIGURATION error, not a
- * harness-availability problem (A-1/D-9/#22). Classifying it as
- * `harness_unavailable` sent the operator to re-auth or wait for a harness; the
- * real fix is to configure a tier or change the routing goal. Detected by the
- * typed `code` (robust across duplicate `@claudexor/budget` package copies) so
- * EVERY strategy's routing catch (ask/agent/plan/deep-scan/council) classifies
- * it identically. Returns the failure category + matching remediation.
- */
-export function routingFailureClassification(err) {
-    const isPreflightRefusal = !!err &&
-        typeof err === "object" &&
-        err.code === "routing_preflight_refused";
-    if (isPreflightRefusal) {
-        return { category: "config_error", nextActions: harnessFailureNextActions("config_error") };
-    }
-    return { category: "harness_unavailable" };
-}
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
 /** Concurrency cap for parallel candidates/explorers (locked decision: min(n, 4)). */
 const MAX_PARALLEL_CANDIDATES = 4;
 /** Default wait for one interactive answer before a benign decline. */
 const DEFAULT_INTERACTION_TIMEOUT_MS = 900_000;
-/** Run `work` over `items` with bounded concurrency, preserving item order via index. */
-async function runBounded(items, limit, work) {
-    if (items.length === 0)
-        return;
-    const concurrency = Math.max(1, Math.min(limit, items.length));
-    let next = 0;
-    const workers = Array.from({ length: concurrency }, async () => {
-        for (;;) {
-            const idx = next++;
-            if (idx >= items.length)
-                return;
-            await work(items[idx], idx);
-        }
-    });
-    await Promise.all(workers);
-}
 export class Orchestrator {
     deps;
     gateway;
@@ -118,7 +90,7 @@ export class Orchestrator {
         });
     }
     async run(input) {
-        const resolved = this.resolveRunInput(input);
+        let resolved = this.resolveRunInput(input);
         // INV-062 at the ENGINE boundary: every surface fences prompts already,
         // but a direct embedder (or the daemon-less local REPL fallback) reaches
         // this entry without one. Prompts, per-run instructions, AND outputSchema
@@ -137,6 +109,25 @@ export class Orchestrator {
             throw new Error(`unknown mode: ${String(resolved.mode)}`);
         }
         const mode = parsedMode.data;
+        if (resolved.delegate === true && mode !== "agent") {
+            throw new Error(`Delegate is an agent-only strategy (got mode=${mode})`);
+        }
+        const runId = resolved.runId ?? newId("run");
+        let delegatedLedgerAttached = false;
+        resolved = {
+            ...resolved,
+            runId,
+            taskId: resolved.taskId ?? newId("task"),
+            onDelegatedLedgerAttached: () => {
+                delegatedLedgerAttached = true;
+            },
+        };
+        if (resolved.delegate === true) {
+            resolved = {
+                ...resolved,
+                delegationParentRunId: runId,
+            };
+        }
         const projectProtectedPaths = mode === "agent" ? this.projectConfig(resolved.repoRoot).constraints.protected_paths : [];
         assertWriteIsolation({
             mode,
@@ -173,41 +164,63 @@ export class Orchestrator {
         if (resolved.repoRoot !== NO_PROJECT_ROOT) {
             assertMandatoryContext(resolved.repoRoot, this.projectConfig(resolved.repoRoot).context.mandatory_files);
         }
-        // Reviewer panels are validated only inside the strategies that actually
-        // review (race/convergence under agent, and plan) — AFTER run-dir
+        // Reviewer panels are validated only inside Agent strategies that actually
+        // review (race/convergence; Plan Council is the plan critique path) — AFTER run-dir
         // creation, so a doomed explicit panel yields typed failure ARTIFACTS
         // (failure.yaml naming the refusal) instead of a bare pre-run throw.
-        // ask/audit never spawn reviewers, so a panel there never spends doctor/
+        // Ask and Plan never spawn code reviewers, so a panel there never spends doctor/
         // model probes and never fails a run that would not use it.
         // Whole-strategy terminal net: once a strategy ANNOUNCES its
         // run, any escaped throw still stamps failure.yaml + summary + run.failed
         // instead of orphaning events.jsonl.
-        return guardAnnouncedRun(resolved.signal, (announce) => {
-            switch (mode) {
-                case "ask":
-                    // `--deep-scan` widens the answer into the bounded multi-scout
-                    // research sweep with synthesis (the old `audit --swarm`/`explore`).
-                    return resolved.deepScan
-                        ? this.runDeepScan(resolved, announce)
-                        : this.runAsk(resolved, announce);
-                case "agent":
-                    // Engine strategies are FLAGS on agent (v0.9 collapse): `--until-clean`
-                    // and `--attempts` select the convergence loop; `--n` selects the race
-                    // width; `--create` switches the candidate intent to create_from_scratch.
-                    if (resolved.untilClean)
-                        return this.runConvergence(resolved, mode, null, announce);
-                    if (resolved.attempts !== undefined && resolved.attempts !== null) {
-                        return this.runConvergence(resolved, mode, resolved.attempts, announce);
-                    }
-                    return this.runRace({ ...resolved, n: resolved.n ?? 1 }, mode, announce);
-                case "plan":
-                    return this.runPlan(resolved, announce);
+        const releaseRunState = (settledRunId) => {
+            this.routingRationaleByRun.delete(settledRunId);
+            this.deps.delegationBudgetAuthority?.releaseRun(settledRunId);
+        };
+        try {
+            return await guardAnnouncedRun(resolved.signal, (announce) => {
+                switch (mode) {
+                    case "ask":
+                        // `--deep-scan` widens the answer into the bounded multi-scout
+                        // research sweep with synthesis (the old `audit --swarm`/`explore`).
+                        return resolved.deepScan
+                            ? this.runDeepScan(resolved, announce)
+                            : this.runAsk(resolved, announce);
+                    case "agent":
+                        // Engine strategies are FLAGS on agent (v0.9 collapse): `--until-clean`
+                        // and `--attempts` select the convergence loop; `--n` selects the race
+                        // width; `--create` switches the candidate intent to create_from_scratch.
+                        if (resolved.untilClean)
+                            return this.runConvergence(resolved, mode, null, announce);
+                        if (resolved.attempts !== undefined && resolved.attempts !== null) {
+                            return this.runConvergence(resolved, mode, resolved.attempts, announce);
+                        }
+                        return this.runRace({ ...resolved, n: resolved.n ?? 1 }, mode, announce);
+                    case "plan":
+                        return this.runPlan(resolved, announce);
+                }
+            }, async ({ runId }) => {
+                const authority = this.deps.delegationBudgetAuthority;
+                if (!authority?.hasParent(runId))
+                    return;
+                authority.beginParentClose(runId);
+                await authority.waitForChildren(runId);
+            }, 
+            // Single per-run terminalization hook: release the routing-rationale map
+            // entry on EVERY terminal (incl. a run that died before its telemetry
+            // writer ran, which is the leak this closes).
+            releaseRunState);
+        }
+        catch (error) {
+            // A durable startup sink may refuse `run.created` before the strategy can
+            // announce its context. Release only a delegated child ledger acquired by
+            // THIS invocation; a caller-supplied run-id collision must never release
+            // another live parent/child authority or its routing state.
+            if (delegatedLedgerAttached) {
+                this.deps.delegationBudgetAuthority?.releaseRun(runId);
             }
-        }, 
-        // Single per-run terminalization hook: release the routing-rationale map
-        // entry on EVERY terminal (incl. a run that died before its telemetry
-        // writer ran, which is the leak this closes).
-        (runId) => this.routingRationaleByRun.delete(runId));
+            throw error;
+        }
     }
     async resolveReviewers(cwd, runAuthPreference, onIgnoredSetting) {
         if (this.deps.reviewers)
@@ -280,11 +293,7 @@ export class Orchestrator {
     }
     authPreferenceForHarness(repoRoot, harnessId, runAuthPreference) {
         const cfg = this.config(repoRoot)?.global;
-        const explicit = (v) => v && v !== "auto" ? v : undefined;
-        return (explicit(runAuthPreference) ??
-            explicit(cfg?.harnesses?.[harnessId]?.auth_preference) ??
-            explicit(cfg?.routing?.auth_preference) ??
-            "auto");
+        return effectiveAuthPreference(runAuthPreference, cfg?.harnesses?.[harnessId]?.auth_preference, cfg?.routing?.auth_preference);
     }
     artifactStore(input) {
         if (input.mode === "ask" && input.contextMode === "off" && input.repoRoot === NO_PROJECT_ROOT) {
@@ -307,20 +316,23 @@ export class Orchestrator {
     estimateUsdFloor(repoRoot) {
         return this.config(repoRoot)?.global.budget.estimate_usd_floor ?? 0.05;
     }
+    /** Delegate children overlap their still-running parent, so child-side paid
+     * units use the same bounded floor as later slots in a parallel wave. */
+    reservationEstimateUsd(input, parallel = false) {
+        return parallel || Boolean(input.delegatedFromRunId)
+            ? this.estimateUsdFloor(input.repoRoot)
+            : undefined;
+    }
     execRootOf(input) {
         return input.executionRoot ?? input.repoRoot;
     }
-    sessionSpecFields(input, harnessId, log) {
+    async sessionSpecFields(input, harnessId, log, defaultRoute = null) {
         const cfg = this.config(input.repoRoot)?.global;
-        const profile = this.preflightProfile(input, harnessId, log);
-        const explicit = (v) => (v && v !== "auto" ? v : undefined);
+        const profile = await this.preflightProfile(input, harnessId, log, defaultRoute);
         return {
             // "auto" at ANY level falls through (thread turns send the thread default
             // "auto" as a per-run value; it must not shadow a configured preference).
-            auth_preference: explicit(input.authPreference) ??
-                explicit(cfg?.harnesses?.[harnessId]?.auth_preference) ??
-                explicit(cfg?.routing?.auth_preference) ??
-                "auto",
+            auth_preference: effectiveAuthPreference(input.authPreference, cfg?.harnesses?.[harnessId]?.auth_preference, cfg?.routing?.auth_preference),
             resume_session_id: resumeSessionForProfile(input.resumeSessions?.[harnessId], profile),
             credential_profile: profile,
         };
@@ -395,19 +407,60 @@ export class Orchestrator {
         const policy = this.config(repoRoot)?.global.harnesses?.[harnessId]?.profile_policy;
         return policy ?? { limit_action: "fail", rotation_eligible: [], headroom_threshold: 0.9 };
     }
-    preflightProfile(input, harnessId, log) {
+    /** Fresh profile readiness for one rotation decision epoch. Accounts uses
+     * the same probe wrapper + admission predicate when projecting next_up. */
+    async readyProfileIdsForRotation(input, harnessId, current, excluded = new Set()) {
+        const profiles = staticRotationCandidates({
+            registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
+            harnessId,
+            policy: this.profilePolicy(input.repoRoot, harnessId),
+            current,
+            excluded,
+        });
+        const adapter = this.deps.registry.get(harnessId);
+        const entries = await Promise.all(profiles.map(async (profile) => ({
+            profile,
+            status: await probeCredentialProfileStatus(profile, adapter?.probeCredentialProfile?.bind(adapter)),
+        })));
+        return new Set(entries
+            .filter(({ profile, status }) => profileStatusAdmits(profile, status))
+            .map(({ profile }) => profile.profile_id));
+    }
+    async preflightProfile(input, harnessId, log, defaultRoute) {
         const profile = this.resolveCredentialProfile(input, harnessId);
         const policy = this.profilePolicy(input.repoRoot, harnessId);
         const registry = this.config(input.repoRoot)?.global.credential_profiles ?? [];
         const snapshots = this.deps.quotaSnapshots?.() ?? [];
         const emit = (type, payload) => log?.emit(type, payload);
+        const breach = profileHeadroomBreach(snapshots, harnessId, profile?.profile_id ?? null, policy.headroom_threshold);
+        const readyProfileIds = policy.limit_action === "rotate" &&
+            breach !== null &&
+            (profile !== null || defaultRoute === "local_session")
+            ? await this.readyProfileIdsForRotation(input, harnessId, profile)
+            : new Set();
         if (!profile) {
             // Unpinned runs (INV-135 auto-balance): under `rotate`, a fresh
             // default-subject headroom breach starts on the next eligible
             // subscription profile instead; `fail`/`ask` change nothing.
-            return preflightDefaultSubject({ harnessId, policy, registry, snapshots, emit });
+            return preflightDefaultSubject({
+                harnessId,
+                policy,
+                registry,
+                snapshots,
+                readyProfileIds,
+                defaultRoute,
+                emit,
+            });
         }
-        return preflightCredentialProfile({ profile, harnessId, policy, registry, snapshots, emit });
+        return preflightCredentialProfile({
+            profile,
+            harnessId,
+            policy,
+            registry,
+            snapshots,
+            readyProfileIds,
+            emit,
+        });
     }
     /**
      * Resolve candidate adapters: explicit `--harness`, else available real harnesses, then
@@ -416,89 +469,11 @@ export class Orchestrator {
      * expand to n. Fails loudly if nothing can perform the intent.
      */
     resolveRunInput(input) {
-        if (input.contextMode === "off" &&
-            !(input.mode === "ask" && input.repoRoot === NO_PROJECT_ROOT)) {
-            throw new Error("contextMode 'off' is only supported for Ask without a repoRoot");
-        }
-        const cfg = this.config(input.repoRoot);
-        const configuredPool = cfg?.global.routing.eligible_harnesses;
-        const harnesses = input.harnesses ?? (configuredPool && configuredPool.length > 0 ? configuredPool : undefined);
-        // GH #25 precedence: an explicit --primary-harness wins and is validated
-        // against the pool; else a single-item explicit pool infers itself as
-        // primary (shipped in #34); else the configured default primary applies.
-        const explicitPrimary = input.primaryHarness;
-        const configPrimary = cfg?.global.routing.primary_harness;
-        const primaryHarness = explicitPrimary ??
-            (input.harnesses?.length === 1 ? input.harnesses[0] : undefined) ??
-            configPrimary ??
-            undefined;
-        if (primaryHarness &&
-            harnesses &&
-            harnesses.length > 0 &&
-            !harnesses.includes(primaryHarness)) {
-            if (explicitPrimary) {
-                // An explicit primary must be a member of the eligible pool (authoritative).
-                throw new Error(`primary harness '${explicitPrimary}' is not in the eligible harness pool (${harnesses.join(", ")}); ` +
-                    `pass --primary-harness as one of [${harnesses.join(", ")}], or add '${explicitPrimary}' to --harness`);
-            }
-            // GH #25 remainder: a MULTI-harness pool whose CONFIGURED default primary
-            // is absent, with no --primary-harness pinned, is ambiguous — the engine
-            // must not silently reroute. Refuse with a structured, copy-pasteable fix
-            // naming the pool, the missing primary, and the exact flag to add.
-            throw new HarnessUnavailableError(`ambiguous primary harness: the configured default primary '${primaryHarness}' is not in the selected pool [${harnesses.join(", ")}], ` +
-                `and no --primary-harness was given. Pin one explicitly, e.g. \`--primary-harness ${harnesses[0]}\` ` +
-                `(or another of [${harnesses.join(", ")}]).`);
-        }
-        if (input.web && input.externalContextPolicy && input.web !== input.externalContextPolicy) {
-            throw new Error(`contradictory web policy: web='${input.web}' vs externalContextPolicy='${input.externalContextPolicy}' (pass one, or equal values)`);
-        }
-        const web = input.web ?? input.externalContextPolicy ?? "auto";
-        // INV-103: scalar `model` expands only to the resolved primary, never the pool;
-        // an explicit per-harness map wins. Unknown map keys fail loudly (INV-021).
-        const knownHarnessIds = new Set(this.deps.registry.keys());
-        for (const key of Object.keys(input.models ?? {})) {
-            if (!knownHarnessIds.has(key)) {
-                throw new Error(`models map names unknown harness '${key}' (registered: ${[...knownHarnessIds].sort().join(", ")}); ` +
-                    `run \`claudexor harness list --all\``);
-            }
-        }
-        const models = { ...input.models };
-        if (input.model) {
-            const scalarTarget = primaryHarness ?? (harnesses && harnesses.length === 1 ? harnesses[0] : undefined);
-            if (!scalarTarget) {
-                throw new Error(`a scalar model ('${input.model}') is ambiguous without a primary harness: ` +
-                    `the pool is ${harnesses && harnesses.length > 0 ? `[${harnesses.join(", ")}]` : "auto-resolved"} — ` +
-                    `set a primary harness, pass exactly one --harness, or use a harness-scoped model map`);
-            }
-            models[scalarTarget] ??= input.model;
-        }
-        // QA-035: FREEZE the config-derived per-harness default_model into the
-        // resolved model map at initial normalization, exactly like an explicit
-        // input. Without this the TaskContract records `routing_models: {}` and an
-        // Exact Retry re-resolves the model against CURRENT settings — silently
-        // changing the route after a settings edit. A per-turn/scalar value already
-        // set wins (??=). Only a known resolved pool can be frozen here; a pure
-        // auto pool's lanes are not yet known (documented seam).
-        const harnessCfg = cfg?.global.harnesses ?? {};
-        for (const hid of harnesses ?? []) {
-            const def = harnessCfg[hid]?.default_model;
-            if (def)
-                models[hid] ??= def;
-        }
-        return {
-            ...input,
-            harnesses,
-            primaryHarness,
-            model: undefined,
-            models,
-            routingGoal: input.routingGoal ??
-                this.deps.routingGoal ??
-                cfg?.project.budget?.routing_goal ??
-                cfg?.global.routing.goal ??
-                "auto",
-            web,
-            externalContextPolicy: web,
-        };
+        return resolveRunInputDefaults(input, {
+            config: this.config(input.repoRoot),
+            registryIds: this.deps.registry.keys(),
+            routingGoal: this.deps.routingGoal,
+        });
     }
     async resolveCandidateAdapters(input, intent, ledger, log, routeContext, 
     /** QA-034: when provided, the pool-ordering rationale is recorded under this
@@ -562,6 +537,27 @@ export class Orchestrator {
                 }
             }
         }
+        const attachments = input.attachments ?? [];
+        // Resolve the complete attachment pool once from manifest truth. If any
+        // lane still lacks usable discovery truth, preserve the existing per-lane
+        // discovery/doctor precedence and resolve that lane inside the route loop.
+        const canResolveAttachmentPool = attachments.length > 0 &&
+            ids.every((id) => {
+                const status = statusById.get(id);
+                return status?.manifest != null && status.status !== "unavailable";
+            });
+        const attachmentPoolAdmission = canResolveAttachmentPool
+            ? this.requestRequirements.resolveAttachmentPool(explicitPool ? "explicit" : "auto", attachments, ids.map((id) => ({
+                harnessId: id,
+                declarations: statusById.get(id)?.manifest?.capability_profile.attachment_inputs ?? null,
+                available: true,
+            })))
+            : null;
+        if (attachmentPoolAdmission?.outcome === "refused") {
+            throw new HarnessUnavailableError(attachmentPoolAdmission.message ??
+                "no available harness lane can receive the selected attachments");
+        }
+        const attachmentRejectionById = new Map(attachmentPoolAdmission?.rejected.map((admission) => [admission.harnessId, admission]) ?? []);
         const policy = input.web ?? input.externalContextPolicy ?? "auto";
         const pool = [];
         const dropped = [];
@@ -695,9 +691,10 @@ export class Orchestrator {
                 dropLane(id, "web", why);
                 continue;
             }
-            const attachmentRefusal = this.requestRequirements.attachmentRefusal(id, input.attachments ?? [], manifest.capability_profile.attachment_inputs);
-            if (attachmentRefusal) {
-                dropLane(id, "attachment", attachmentRefusal);
+            const attachmentAdmission = attachmentRejectionById.get(id) ??
+                this.requestRequirements.resolveAttachmentLane(id, attachments, manifest.capability_profile.attachment_inputs);
+            if (!attachmentAdmission.admitted) {
+                dropLane(id, "attachment", attachmentAdmission.message ?? `${id} rejects attachments`);
                 continue;
             }
             const reason = status.reasons.length > 0 ? `: ${status.reasons.join("; ")}` : "";
@@ -717,6 +714,14 @@ export class Orchestrator {
                         access: requiredAccess,
                     }),
                     denyRequirement: this.requestRequirements.resolveDenyPaths(id, (input.denyPaths?.length ?? 0) > 0),
+                    delegationRequirement: this.requestRequirements.resolveDelegation({
+                        harnessId: id,
+                        requested: input.delegate === true,
+                        runtimeAvailable: input.delegationBelt != null,
+                        manifestCapable: manifest.capability_profile.mcp_injection,
+                        requiresFullAccess: manifest.capability_profile.mcp_injection_requires_full_access,
+                        fullAccess: isFullAccess(requiredAccess),
+                    }),
                     effortLevels: manifest.capabilities.effort_levels,
                     knownModels: manifest.capabilities.known_models,
                     // A selected profile's credential_kind IS the route (round-18 #2);
@@ -763,6 +768,7 @@ export class Orchestrator {
         }
         emitPrimaryDivergence(log, input.primaryHarness, ordered, pool, dropped);
         const n = input.n ?? ordered.length;
+        const selectionOrder = ordered;
         const out = [];
         if (droppedLanes.length > 0 && !allowDuplicateFill) {
             // QA-043: lanes were dropped from an AUTO best-of pool (an explicit pool
@@ -771,15 +777,15 @@ export class Orchestrator {
             // masks the omission. Clamp to distinct survivors and disclose below.
             // (Deep-scan sets allowDuplicateFill: its width is scout coverage, not
             // harness diversity, so a dropped lane must not cut the scout count.)
-            for (let i = 0; i < Math.min(n, ordered.length); i++)
-                out.push(ordered[i]);
+            for (let i = 0; i < Math.min(n, selectionOrder.length); i++)
+                out.push(selectionOrder[i]);
         }
         else {
             // No lane was dropped: a pool smaller than `n` is an intentional
             // best-of-N on the available harness(es) (e.g. explicit `--harness codex
             // -n 3`), so the historical width fill is preserved.
             for (let i = 0; i < n; i++)
-                out.push(ordered[i % ordered.length]);
+                out.push(selectionOrder[i % selectionOrder.length]);
         }
         // Disclose an auto-pool omission / width clamp once, with the
         // requested-vs-effective route receipt (never silent — QA-043).
@@ -791,25 +797,24 @@ export class Orchestrator {
             droppedLanes,
         });
         this.requestRequirements.requireEffectiveBrowser(input.browser === true, out.map((lane) => lane.browserRequirement));
-        // Delegation belt (D32): agent-only, and only on a lane whose adapter can
-        // inject MCP servers. A requested delegate with NO injecting lane is a typed
-        // preflight refusal naming the harness(es) — never a silently dropped belt.
-        if (input.delegate === true && !out.some((lane) => lane.supportsMcpInjection)) {
-            const names = [...new Set(out.map((lane) => lane.adapter.id))].join(", ");
-            throw new HarnessUnavailableError(`--delegate requires a harness that can host the Claudexor delegation belt (capability_profile.mcp_injection); the routed harness(es) [${names}] cannot inject MCP servers — choose claude or codex, or drop --delegate`);
-        }
-        // A belt-injecting lane may still be UNABLE to reach the daemon at its
-        // access: codex's workspace-write seatbelt cancels the belt's daemon-crossing
-        // MCP call, so codex only hosts the belt at FULL access (same as its browser
-        // MCP). If EVERY injecting lane requires full access but runs below it, the
-        // belt would be injected only to be silently cancelled by the sandbox — the
-        // exact non-delegation this guard prevents. Refuse with the real remedy.
+        // Owner decision (2026-07-26): known PRE-START belt unavailability does
+        // not discard the requested Agent work. Continue without Delegate and emit
+        // a durable typed warning. Once a descriptor is injected, typed startup
+        // failure stays terminal in attemptTelemetry (no mid-attempt downgrade).
         if (input.delegate === true) {
-            const injecting = out.filter((lane) => lane.supportsMcpInjection);
-            const canHostBelt = injecting.some((lane) => !lane.mcpInjectionRequiresFullAccess || isFullAccess(lane.adapterAccess));
-            if (!canHostBelt) {
-                const names = [...new Set(injecting.map((lane) => lane.adapter.id))].join(", ");
-                throw new HarnessUnavailableError(`--delegate needs a belt-hosting lane at full access: [${names}] can inject MCP servers but sandbox-cancel the delegation belt below full access (capability_profile.mcp_injection_requires_full_access) — re-run with --access full, or route a lane (e.g. claude) that hosts the belt at workspace_write`);
+            const unavailable = out
+                .map((lane) => lane.delegationRequirement)
+                .filter((resolution) => !resolution.effective);
+            if (unavailable.length > 0) {
+                log?.emit("delegation.belt.degraded", {
+                    requested: true,
+                    effective: out.some((lane) => lane.delegationRequirement.effective),
+                    reason: unavailable[0]?.reason ?? "runtime_unavailable",
+                    lanes: unavailable.map((resolution) => ({
+                        harness_id: resolution.harness_id,
+                        reason: resolution.reason,
+                    })),
+                });
             }
         }
         // outputSchema is MANDATORY (Quiz-6a): a selected lane that cannot
@@ -846,6 +851,8 @@ export class Orchestrator {
      */
     orderPool(pool, input, intent, statusById, ledger, runId) {
         let ordered = pool;
+        let rationale = null;
+        let selectionReason = null;
         if (pool.length > 0) {
             const routeLedger = ledger ?? new BudgetLedger();
             const config = this.config(input.repoRoot).global;
@@ -927,16 +934,35 @@ export class Orchestrator {
             const ranked = rankHarnesses(remaining, routeCtx)
                 .map((candidate) => byId.get(candidate.harnessId))
                 .filter((candidate) => Boolean(candidate));
-            // QA-034: the rationale is run evidence recorded ONCE at pool ordering,
-            // pinned to routeCtx.now so it cannot disagree with the order just taken.
-            if (runId)
-                this.routingRationaleByRun.set(runId, explainRanking(remaining, routeCtx));
+            rationale = explainRanking(remaining, routeCtx);
             ordered = ranked;
         }
+        if (input.delegate === true && input.primaryHarnessExplicit !== true) {
+            const delegateFirst = [
+                ...ordered.filter((lane) => lane.delegationRequirement.effective),
+                ...ordered.filter((lane) => !lane.delegationRequirement.effective),
+            ];
+            if (delegateFirst.some((lane, index) => lane !== ordered[index])) {
+                ordered = delegateFirst;
+                selectionReason = "delegate_effective_first";
+            }
+        }
         if (input.primaryHarness) {
             const primary = ordered.find((r) => r.adapter.id === input.primaryHarness);
-            if (primary)
+            if (primary && primary !== ordered[0]) {
                 ordered = [primary, ...ordered.filter((r) => r !== primary)];
+                selectionReason = "explicit_primary";
+            }
+        }
+        // QA-034: persist the FINAL selected order, including request constraints
+        // that intentionally override the underlying cost/quota ranking. This is
+        // what keeps route evidence aligned with the lane actually executed.
+        if (runId && rationale) {
+            this.routingRationaleByRun.set(runId, {
+                ...rationale,
+                order: ordered.map((lane) => lane.adapter.id),
+                reason: selectionReason ?? rationale.reason,
+            });
         }
         return ordered;
     }
@@ -1037,114 +1063,9 @@ export class Orchestrator {
         return this.config(repoRoot).project;
     }
     buildContract(input, taskId, mode) {
-        const resolvedCfg = this.config(input.repoRoot);
-        const cfg = resolvedCfg.project;
-        const readOnlyMode = mode === "ask" || mode === "plan";
-        const requestedAccess = input.access ?? (readOnlyMode ? "readonly" : resolvedCfg.trust.access_default);
-        // Effective access is COMPUTED by the engine, never echoed from a client:
-        // read-only modes clamp to readonly regardless of the request.
-        const effectiveAccess = readOnlyMode ? "readonly" : requestedAccess;
-        // TrustConfig is USER-LEVEL only (versioned repo config must never
-        // self-grant sensitive powers): unsandboxed full access requires an
-        // explicit allow in ~/.claudexor trust settings — loud error, no downgrade.
-        // The gate applies to the EFFECTIVE profile: a read-only run clamped to
-        // readonly never runs unsandboxed and needs no trust allow.
-        if (effectiveAccess === "full" && !resolvedCfg.trust.allow_full_access) {
-            // Typed refusal: the `code` rides the daemon job record onto the thread
-            // turn (TurnEnqueueError.code), so surfaces key remedies on the CODE —
-            // never on substring-matching this human message.
-            throw Object.assign(new Error(`access profile 'full' requires allow_full_access: true in the user-level trust file for this repo ` +
-                `(${trustConfigPath(input.repoRoot)}); enable it with \`claudexor trust --allow-full-access\` — refusing to run unsandboxed`), 
-            // Refusal semantics are born at the throw (W24): the one-time grant is
-            // a 403, and the daemon persists this status onto the job record.
-            { code: TRUST_FULL_ACCESS_CODE, status: 403 });
-        }
-        const externalContextPolicy = input.web ?? input.externalContextPolicy ?? "auto";
-        // Deterministic gate commands come from explicit run input, then versioned
-        // project config. Without these, gateSpecs is empty and convergence is
-        // review-only; with them, convergence is test-driven.
-        const resolvedGates = resolveContractGates({
-            repoRoot: input.repoRoot,
-            effectiveAccess,
-            config: cfg,
-            trustGrants: resolvedCfg.trust.test_command_grants,
-            operatorCommands: input.tests ?? [],
-            projectCommands: cfg.tests?.commands ?? [],
-        });
-        const commands = resolvedGates.commands;
-        const protectedPaths = [...new Set(cfg.constraints.protected_paths)];
-        const autoProtectedPaths = resolvedGates.autoProtectedPaths;
-        const protectedPathApprovals = [
-            ...new Map([...(input.protectedPathApprovals ?? [])].map((approval) => [approval.path, approval])).values(),
-        ];
-        return TaskContractSchema.parse({
-            schema_version: SCHEMA_VERSION,
-            task_id: taskId,
-            created_at: nowIso(),
-            repo: { root: input.repoRoot, base_ref: input.baseRef ?? "HEAD", dirty_policy: "snapshot" },
-            mode: { kind: mode },
-            user_intent: { raw: redactSecrets(input.prompt) },
-            // Redacted for symmetry with user_intent.raw — a no-op on fenced input
-            // (the inline-secret fence already blocked any secret-like value at every
-            // ingress incl. this engine boundary), so task-producing lanes read back
-            // the real instructions via harnessSpecKnobs().
-            instructions: input.instructions === undefined ? undefined : redactSecrets(input.instructions),
-            // Already normalized/strictified at the engine boundary (run() refuses
-            // unsupported shapes before any run dir exists).
-            output_schema: input.outputSchema ?? null,
-            auth_preference: input.authPreference ?? "auto",
-            credential_profile_id: input.credentialProfileId ?? null,
-            max_turns: input.maxTurns ?? null,
-            constraints: {
-                protected_paths: protectedPaths,
-                deny_paths: [...new Set(input.denyPaths ?? [])],
-                auto_protected_paths: autoProtectedPaths,
-                protected_path_approvals: protectedPathApprovals,
-            },
-            tests: { commands },
-            access: {
-                requested_profile: requestedAccess,
-                effective_profile: effectiveAccess,
-            },
-            external_context: {
-                policy: externalContextPolicy,
-                web_required: externalContextPolicy === "cached" || externalContextPolicy === "live",
-                // Per-route upgrades (e.g. claude cached->live) are disclosed in events
-                // and telemetry.yaml; the immutable contract records the requested policy.
-                effective_mode: externalContextPolicy,
-            },
-            // Harness-native tool names are adapter knowledge; the neutral contract
-            // carries only the policy plus user-configured allow/deny lists (wired
-            // from per-harness settings).
-            tool_permission_policy: {
-                web: externalContextPolicy,
-                allow: [],
-                deny: [],
-            },
-            budget: {
-                routing_goal: input.routingGoal ?? this.deps.routingGoal ?? cfg?.budget?.routing_goal ?? "auto",
-                paid_budget: this.resolvePaidBudget(input.paidBudget, resolvedCfg),
-            },
-            // The resolved harness-scoped model map (scalar already expanded to the
-            // primary by resolveRunInput). The contract is what route spec building
-            // reads — there is no run-global model (INV-103).
-            routing_models: input.models ?? {},
-            // QA-035: freeze the RESOLVED reasoning-effort per known lane so Exact
-            // Retry replays it instead of re-resolving current settings. Precedence
-            // (specific beats general): the harness-scoped `efforts` map entry, then a
-            // per-turn scalar `input.effort`, then the harness settings default — the
-            // same map that Exact Retry replays so a NON-PRIMARY lane keeps its own
-            // frozen effort (QA-035 completeness). Only known-pool lanes are frozen
-            // here (a pure auto pool's lanes resolve later — documented seam).
-            routing_efforts: Object.fromEntries([...new Set([...(input.harnesses ?? []), ...Object.keys(input.efforts ?? {})])]
-                .map((hid) => [
-                hid,
-                input.efforts?.[hid] ??
-                    input.effort ??
-                    resolvedCfg.global.harnesses?.[hid]?.effort ??
-                    null,
-            ])
-                .filter((entry) => entry[1] !== null)),
+        return buildTaskContract(input, taskId, mode, {
+            paidBudget: this.deps.paidBudget,
+            routingGoal: this.deps.routingGoal,
         });
     }
     /**
@@ -1168,13 +1089,15 @@ export class Orchestrator {
      * a WRITING agent intent (the delegator integrates results in its workspace;
      * read lanes and reviewers have nothing to delegate). */
     delegationBeltFor(input, intent, routed, resolvedBudget) {
-        if (!input?.delegate || !input.delegationBelt || !routed.supportsMcpInjection)
+        if (!input?.delegate ||
+            !input.delegationBelt ||
+            !input.delegationParentRunId ||
+            !routed.delegationRequirement.effective)
             return [];
         // A lane that sandbox-cancels the belt below full access (codex) must NOT
-        // receive a belt it cannot use — that is the silent non-delegation. The
-        // preflight already refused a run whose ONLY injecting lanes are such lanes
-        // below full access; here we simply skip injecting into an individual lane
-        // that cannot host it, so a mixed pool keeps the belt on the lanes that can.
+        // receive a belt it cannot use. Per-lane requirement resolution records the
+        // typed degradation, while a mixed pool keeps the belt on lanes that can
+        // host it.
         if (routed.mcpInjectionRequiresFullAccess && !isFullAccess(routed.adapterAccess))
             return [];
         const writingIntents = ["implement", "create_from_scratch", "repair"];
@@ -1190,6 +1113,8 @@ export class Orchestrator {
                 ...input.delegationBelt,
                 env: {
                     ...input.delegationBelt.env,
+                    [DELEGATION_ENV.parentRunId]: input.delegationParentRunId,
+                    [DELEGATION_ENV.repoRoot]: input.repoRoot,
                     [DELEGATION_ENV.budget]: JSON.stringify(resolvedBudget),
                 },
             },
@@ -1219,9 +1144,9 @@ export class Orchestrator {
     /**
      * D-16: the WorkReport transport envelope for one route. Called at every
      * task-producing spec-build site AFTER harnessSpecKnobs so it OVERRIDES the
-     * plain caller-schema transport with the compiled `{work_report, output}`
-     * envelope on capable routes. The returned `mode` is retained by the caller
-     * and handed to `unwrapWorkReportEnvelope` when the answer is finalized.
+     * plain caller-schema transport with the resolved WorkReport channel on
+     * capable routes. The returned `mode` is retained by the caller and handed
+     * to `unwrapWorkReportEnvelope` when the answer is finalized.
      */
     workReportEnvelopeFor(routed, contract, interactive) {
         return resolveWorkReportEnvelope({
@@ -1235,7 +1160,7 @@ export class Orchestrator {
     /**
      * D-16: apply the resolved WorkReport transport to a built spec — set the
      * envelope output_schema (constrained/side_tool routes) and APPEND the fenced
-     * envelope instruction (validated routes, e.g. cursor). Mutates the spec in
+     * metadata instruction (validated routes, e.g. cursor). Mutates the spec in
      * place and returns the mode the answer unwrap consumes. Called at every
      * task-producing spec-build site so the transport is never wired one-off.
      */
@@ -1312,7 +1237,7 @@ export class Orchestrator {
      * Returns null (no packet, no pointer) for native resume, a fresh thread, or
      * a non-thread run. Never throws: continuity failure degrades to no packet.
      */
-    async resolveContinuity(runInput, harnessId, resolvedProfileId, nativeResumeAvailable, store, paths, repoRoot, log) {
+    async resolveContinuity(runInput, harnessId, resolvedProfileId, nativeResumeAvailable, sessionFields, store, paths, repoRoot, log) {
         const ctx = runInput.threadContinuity;
         if (!runInput.threadId || !ctx)
             return null;
@@ -1350,7 +1275,6 @@ export class Orchestrator {
             // summary. Same credential route + scoped lane home a real read-only
             // thread turn uses (INV-034/135). Best-effort in its OWN guard — a summary
             // failure keeps the full mechanical packet, never drops it.
-            const sessionFields = this.sessionSpecFields(runInput, harnessId);
             req.cachedSummary = await resolveContinuitySummary({
                 req,
                 threadId: runInput.threadId,
@@ -1418,13 +1342,15 @@ export class Orchestrator {
         // Isolated scoped-home sessions are never retained after disposal.
         const inPlaceEnvelope = envelope.worktree_path === envelope.repo_root;
         const rawContextPacket = await rawContextForEnvelope(routed.implementationTransport, envelope);
-        const sessionFields = runInput ? this.sessionSpecFields(runInput, adapter.id, log) : undefined;
+        const sessionFields = runInput
+            ? await this.sessionSpecFields(runInput, adapter.id, log, routed.authRouteEstimate)
+            : undefined;
         // Continuity (INV-137): once the lane (harness + resolved profile) is known,
         // build the continuation packet, materialize context/THREAD.md, and point
         // the prompt at it — never embed the packet body in the prompt. Replaces the
         // old static session.rebound "not_portable" phrase with a real disclosure.
         const laneContinuity = runInput
-            ? await this.resolveContinuity(runInput, adapter.id, sessionFields?.credential_profile?.profile_id ?? runInput.credentialProfileId ?? null, inPlaceEnvelope && !!sessionFields?.resume_session_id, store, paths, envelope.repo_root, log)
+            ? await this.resolveContinuity(runInput, adapter.id, sessionFields?.credential_profile?.profile_id ?? runInput.credentialProfileId ?? null, inPlaceEnvelope && !!sessionFields?.resume_session_id, sessionFields, store, paths, envelope.repo_root, log)
             : null;
         let spec = HarnessRunSpec.parse({
             session_id: newId("ses"),
@@ -1493,7 +1419,7 @@ export class Orchestrator {
         const browserServerName = spec.browser ? "browser" : null;
         const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
             knobs.webPolicy === "cached" ||
-            knobs.webPolicy === "live", effectiveWebMode ?? knobs.webPolicy, [routed.browserRequirement, routed.denyRequirement], knobs.model, beltServerName, browserServerName);
+            knobs.webPolicy === "live", effectiveWebMode ?? knobs.webPolicy, [routed.browserRequirement, routed.denyRequirement, routed.delegationRequirement], knobs.model, beltServerName, browserServerName);
         let activeSessionId = spec.session_id;
         const onAbort = () => {
             void adapter.cancel?.(activeSessionId)?.catch(() => { });
@@ -1527,13 +1453,16 @@ export class Orchestrator {
                 try {
                     const watched = withInactivityWatchdog(adapter.run(runSpec), {
                         timeoutMs: inactivityMs,
+                        countsAsProgress: countsAsAgentProgress,
                         onTimeout: () => {
                             attemptAbort.abort();
                             void adapter.cancel?.(activeSessionId)?.catch(() => { });
                         },
-                        // Waiting on the USER (pending interaction) is legitimate
-                        // silence — the interaction channel enforces its own wait budget.
+                        // Waiting on the USER is legitimate silence. The interaction policy
+                        // either enforces a finite deadline or waits until answer/cancel/
+                        // terminal/restart when the timeout is disabled.
                         isSuspended: () => (interaction?.pendingCount?.() ?? 0) > 0,
+                        suspensionVersion: () => interaction?.suspensionVersion?.() ?? 0,
                     });
                     for await (const ev of watched) {
                         if (signal?.aborted)
@@ -1573,10 +1502,9 @@ export class Orchestrator {
                             observeNativeSessionEvent(runInput, adapter.id, safeEv);
                         observeAuthSwitch(log, adapter.id, attemptId, safeEv);
                         observeAttemptTelemetry(telemetry, safeEv);
-                        // QA-024: the injected delegation belt's MCP server reported `failed`
-                        // to start. Disclose it ONCE as a typed run event the moment the
-                        // `started` frame reveals it — the harness is about to run without
-                        // `mcp__<belt>__*` tools and may degrade to its own native subagent.
+                        // QA-024: the injected delegation belt's MCP server reported a
+                        // terminal startup failure. Disclose it ONCE while live; recoverable
+                        // exact tool-result failures are evaluated at attempt finalization.
                         // The terminal outcome axis (delegationBeltUnavailable) reflects it
                         // too; this event makes the failure visible while the run is live.
                         if (telemetry.delegationBelt.requested &&
@@ -1664,13 +1592,18 @@ export class Orchestrator {
                 // W5.4 failover: a typed-limit hit rebuilds the spec on a NEW vendor
                 // session under the next profile with provenance (vendor_limit_rejected).
                 if (harnessErrored && runInput && !signal?.aborted) {
+                    const rotationPolicy = this.profilePolicy(contract.repo.root, adapter.id);
+                    const readyProfileIds = sawTypedLimit && deliverableEmpty && rotationPolicy.limit_action === "rotate"
+                        ? await this.readyProfileIdsForRotation(runInput, adapter.id, spec.credential_profile ?? null, triedProfiles)
+                        : new Set();
                     const rotated = rotateSpecOnTypedLimit({
                         spec,
                         harnessId: adapter.id,
                         attemptId,
-                        policy: this.profilePolicy(contract.repo.root, adapter.id),
+                        policy: rotationPolicy,
                         registry: this.config(contract.repo.root)?.global.credential_profiles ?? [],
                         snapshots: this.deps.quotaSnapshots?.() ?? [],
+                        readyProfileIds,
                         triedProfiles,
                         sawTypedLimit,
                         deliverableEmpty,
@@ -1727,20 +1660,20 @@ export class Orchestrator {
         if (webUnsatisfied(telemetry)) {
             errors.push(webEvidenceFailure(telemetry.web));
         }
-        const diff = await wsm.diff(envelope);
-        // D-16: un-nest {work_report, output} so answer.md persists the OUTPUT, not the envelope.
+        // D-16: remove the WorkReport transport so answer.md persists only the deliverable.
         const unwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", workReportMode, {
             sideToolReport: telemetry.sideToolWorkReport ?? undefined,
         });
-        // X119: persist the VERBATIM redacted bytes; trim ONLY for the emptiness check.
         const redacted = redactSecrets(unwrapped.deliverable);
-        const answerText = redacted.trim().length > 0 ? redacted : undefined;
+        const candidateAnswer = redacted.trim().length > 0 ? redacted : undefined;
+        const { diff, refusal: secretDiffRefusal } = await secretDiff.quarantineCandidateWorkspace(wsm, envelope, inPlaceEnvelope, candidateAnswer);
+        harnessErrored = secretDiff.recordSecretDiffRefusal(secretDiffRefusal, errors, harnessErrored);
+        const answerText = secretDiffRefusal ? undefined : candidateAnswer;
         const deliverableEvidence = diff.trim().length > 0 || Boolean(answerText);
-        // Cancelled attempts skip gates entirely: the operator asked to
-        // stop NOW; running a 600s-per-gate suite after the abort delays the ack
+        // Cancelled attempts skip gates: running a 600s-per-gate suite delays the ack
         // and burns compute on a result nobody will adopt. Diff/attempt.yaml
         // still land, so partial work stays inspectable.
-        const gateSignalAborted = signal?.aborted === true;
+        const gateSignalAborted = signal?.aborted === true || secretDiffRefusal !== undefined;
         if (!gateSignalAborted) {
             log?.emit("gate.started", {
                 attempt_id: attemptId,
@@ -1770,6 +1703,14 @@ export class Orchestrator {
             });
         }
         const webBlocked = webUnsatisfied(telemetry);
+        // A descriptor that was injected and then reported failed is past the
+        // pre-start degradation boundary. Hard-fail this attempt; never continue as
+        // ordinary Agent or let a native vendor subagent masquerade as belt work.
+        const delegationError = delegateFailure.delegationFailureError(telemetry);
+        if (delegationError) {
+            harnessErrored = true;
+            errors.push(delegationError);
+        }
         // D-16 unified finalizer: fold the WorkReport / context signals into the
         // deliverable + work_state. A broken contract on a constrained route
         // elevates harnessErrored (never a prose success).
@@ -1794,14 +1735,6 @@ export class Orchestrator {
             workState: finalized.workState,
         });
         const attemptDir = join(paths.attemptsDir, attemptId);
-        try {
-            assertNoSecretLikeTokens("candidate patch diff", diff);
-        }
-        catch (err) {
-            // The stream already settled real spend; a post-stream assertion throw
-            // must carry it so the slot catch settles the TRUE cost, not 0.
-            throw Object.assign(err instanceof Error ? err : new Error(String(err)), { costUsd: cost });
-        }
         recordCleanAttemptMetrics(globalConfigDir(), adapter.id, {
             costUsd: cost,
             streamMs: attemptStreamEndedMs - attemptStartedMs,
@@ -1809,11 +1742,13 @@ export class Orchestrator {
             aborted: signal?.aborted === true,
             authMode: telemetry.authMode,
         });
-        const producedFiles = writeCandidateAttemptArtifacts({
+        const producedFiles = AC.withAttemptFailureCost(() => writeCandidateAttemptArtifacts({
             store,
             attemptDir,
             worktreePath: envelope.worktree_path,
             diff,
+            persistPatch: secretDiffRefusal === undefined,
+            persistProducedMedia: secretDiffRefusal === undefined,
             answerText,
             record: {
                 attempt_id: attemptId,
@@ -1825,9 +1760,14 @@ export class Orchestrator {
                 errors: errors.slice(0, 5),
                 ...telemetrySummary(telemetry),
                 outcome: telemetry.outcome,
+                ...(secretDiffRefusal ? { secret_diff_refusal: secretDiffRefusal } : {}),
                 gates: gates.map((g) => ({ id: g.id, status: g.status })),
                 branch: envelope.branch_name,
             },
+        }), {
+            totalUsd: cost,
+            estimated: costEstimated,
+            settlement: attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode, telemetry.usageCost),
         });
         return {
             attemptId,
@@ -1844,6 +1784,7 @@ export class Orchestrator {
             costEstimated,
             errors: errors.slice(0, 8),
             telemetry,
+            ...(secretDiffRefusal ? { secretDiffRefusal } : {}),
             outcomeClass: finalized.outcomeClass,
         };
     }
@@ -1854,66 +1795,17 @@ export class Orchestrator {
         // Thin delegate — the channel mechanics live in interaction.ts.
         return interactionChannelFor(input, log, runId, taskId, attemptId, harnessId, supportsInteractive, DEFAULT_INTERACTION_TIMEOUT_MS);
     }
-    /**
-     * Guarantee a git boundary for write-mode runs. Non-git project folders are
-     * initialized in place (`git init`, deterministic baseline commit) without
-     * creating or editing `.gitignore`, and the action is announced via a
-     * `project.git.initialized` event. Returns the failure message when the
-     * boundary cannot be established (the terminal failure events are already
-     * emitted); null on success.
-     */
-    async ensureWriteModeGitBoundary(repoRoot, log, store, paths, runId, mode) {
-        if (repoRoot === NO_PROJECT_ROOT)
-            return null;
-        try {
-            const result = await ensureGitRepository(repoRoot);
-            if (result.initialized || result.baselineCommitted) {
-                log.emit("project.git.initialized", {
-                    repo_root: repoRoot,
-                    initialized: result.initialized,
-                    baseline_committed: result.baselineCommitted,
-                    gitignore_seeded: result.gitignoreSeeded,
-                    head_sha: result.headSha,
-                });
-            }
-            return null;
-        }
-        catch (err) {
-            const message = safeErrorMessage(err);
-            writeFailure(store, paths, {
-                phase: "workspace",
-                category: "project",
-                safeMessage: message,
-                runDir: paths.root,
-                nextActions: [
-                    "Check the project folder permissions",
-                    "Initialize git manually (git init)",
-                    "Retry the run",
-                ],
-            });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: workspace\n\n${message}\n`);
-            log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
-            log.emit("run.failed", {
-                lifecycle: "failed",
-                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
-                reason: "harness_failed",
-                phase: "workspace",
-                error: message,
-                failure_ref: "final/failure.yaml",
-            });
-            return message;
-        }
-    }
     /**
      * D-14 layer 3 (AGENTS.md unification, INV-113): the ONE new live-tree write.
      * When the PROJECT root has `AGENTS.md` and no `CLAUDE.md`, drop a thin
      * `CLAUDE.md` (`@AGENTS.md` import + Claudexor ownership marker) so a Claude
      * Code route reads the same instruction file codex/cursor read natively.
      *
-     * Fenced exactly where the automatic git-init boundary is: read-only modes
-     * never reach this run-prep stage; `--in-place` stateful targets are left
-     * untouched; the write targets the PROJECT root (`repoRoot`), never a worktree
-     * envelope. The workspace helper adds exclusive-create + no-follow +
+     * The project-root bridge has its own narrower fence: read-only modes never
+     * reach this run-prep stage and `--in-place` stateful targets are left
+     * untouched. Git admission is independently owned by `runStartRequiresGit`.
+     * The write targets the PROJECT root (`repoRoot`), never a worktree envelope.
+     * The workspace helper adds exclusive-create + no-follow +
      * idempotency, so a hand-written or symlinked `CLAUDE.md` is never overwritten
      * and a concurrent/second prep is a no-op. Announced via a typed
      * `project.claude_bridge.created` event on an actual create only — the git-init
@@ -1938,37 +1830,6 @@ export class Orchestrator {
             });
         }
     }
-    /**
-     * Freeze-on-implement delivery (D17/D27): verify the frozen plan's hash and
-     * materialize it as context/PLAN.md in the run artifact tree — OUTSIDE every
-     * worktree, so it can never dirty a diff — then point the prompt at the
-     * absolute path. A mismatched or unreadable plan fails LOUDLY before any
-     * harness spawns (the tamper fence; retry replays planRef verbatim, so a
-     * retried implement can never silently run without its plan).
-     */
-    withPlanBrief(input, store, paths, log) {
-        if (!input.planRef)
-            return input;
-        const text = readTextSafe(input.planRef.path);
-        if (!text || !text.trim()) {
-            throw new Error(`implement plan: the frozen plan at ${input.planRef.path} is missing or unreadable`);
-        }
-        const digest = sha256(text).replace(/^sha256:/, "");
-        if (digest !== input.planRef.sha256) {
-            throw new Error(`implement plan: plan hash mismatch (expected ${input.planRef.sha256}, got ${digest}) — the plan was modified after freeze; re-run Implement from the plan turn`);
-        }
-        const briefPath = join(paths.contextDir, "PLAN.md");
-        store.writeText(briefPath, text);
-        log.emit("plan.brief.materialized", {
-            plan_run_id: input.planRef.runId,
-            sha256: input.planRef.sha256,
-            path: "context/PLAN.md",
-        });
-        return {
-            ...input,
-            prompt: `${input.prompt}\n\nThe approved plan is at: ${briefPath} — read it before starting and re-read it as needed.`,
-        };
-    }
     async runRace(input, mode, announce) {
         const taskId = input.taskId ?? newId("task");
         const runId = input.runId ?? newId("run");
@@ -1976,29 +1837,28 @@ export class Orchestrator {
         // announced: a refused run must fail the request loudly, not 200 a runId
         // and leave an orphaned run dir without a terminal event.
         const contract = this.buildContract(input, taskId, mode);
-        const store = this.artifactStore(input);
-        const paths = store.createRun(runId);
-        const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
-        input = this.withPlanBrief(input, store, paths, log);
-        // The execution root is the tree the harness mutates: the project itself for
-        // in-place threads/ordinary runs, or the thread's persistent worktree for an
-        // isolated thread. Config/artifacts/contract stay anchored to repoRoot. Both
-        // the WorkspaceManager and the git boundary resolve against this SINGLE root.
-        const execRoot = this.execRootOf(input);
-        const wsm = new WorkspaceManager(execRoot);
-        safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
-        log.emit("run.created", { mode, prompt: redactSecrets(input.prompt) });
-        const ledger = this.rootLedger(input, contract, log);
-        announce?.({
-            log,
-            store,
-            paths,
+        const planBrief = verifiedPlanBrief(input);
+        const quotaSnapshots = this.quotaSnapshotPreflight();
+        const { store, paths, log, ledger } = beginAnnouncedRun({
+            input,
+            contract,
+            quotaSnapshots,
+            store: this.artifactStore(input),
+            authority: this.deps.delegationBudgetAuthority,
             runId,
             taskId,
             mode,
             phase: "race",
-            spend: () => ledger.spend(),
-        });
+            prompt: input.prompt,
+        }, announce);
+        input = withPlanBrief(input, store, paths, log, planBrief);
+        // The execution root is the tree the harness mutates: the project itself
+        // for in-place threads/ordinary runs, or the thread's persistent worktree
+        // for an isolated thread. Config/artifacts/contract stay anchored to
+        // repoRoot. Both the WorkspaceManager and the git boundary resolve against
+        // this SINGLE root.
+        const execRoot = this.execRootOf(input);
+        const wsm = new WorkspaceManager(execRoot);
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // Write modes need a git boundary for worktree isolation and honest diffs.
@@ -2007,17 +1867,17 @@ export class Orchestrator {
         // silent mutation (user-locked decision, comparator: Codex requires git).
         // For an isolated thread the execution root is already a git worktree, so
         // this is a no-op there; for in-place it ensures the live project is git.
-        const gitPreconditionError = await this.ensureWriteModeGitBoundary(execRoot, log, store, paths, runId, mode);
+        const gitPreconditionError = await ensureWriteModeGitBoundary(execRoot, log, store, paths, runId, mode);
         if (gitPreconditionError) {
             return {
                 runId,
                 taskId,
                 mode,
                 lifecycle: "failed",
-                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                facts: makeOutcomeFacts("failed", { reason: gitPreconditionError.reason }),
                 winner: null,
                 runDir: paths.root,
-                summary: gitPreconditionError,
+                summary: gitPreconditionError.message,
                 candidates: [],
             };
         }
@@ -2087,6 +1947,7 @@ export class Orchestrator {
                 candidates: [],
             };
         }
+        activateDelegationParent(this.deps.delegationBudgetAuthority, input, runId, ledger, adapters, log);
         const reviewersOutcome = await this.resolveReviewersWithArtifacts(input, log, store, paths, runId, taskId, mode);
         if ("failed" in reviewersOutcome)
             return reviewersOutcome.failed;
@@ -2114,7 +1975,7 @@ export class Orchestrator {
                 attemptId,
                 intent: this.candidateIntent(input),
                 harnessId: routed.adapter.id,
-                cost: attemptCostEvidence(routed.adapter.id, attemptId, i > 0 ? this.estimateUsdFloor(input.repoRoot) : undefined, this.routeBillingKnowledge(input, routed.adapter.id)),
+                cost: attemptCostEvidence(routed.adapter.id, attemptId, this.reservationEstimateUsd(input, i > 0), this.routeBillingKnowledge(input, routed.adapter.id)),
             });
             log.emit("budget.lease.created", {
                 granted: lease.granted,
@@ -2280,6 +2141,13 @@ export class Orchestrator {
                                 continuation_count: candidateContinuationCount,
                                 packet_turns: packet.continuity.disclosure.packetTurns,
                             });
+                            log.emit("harness.started", {
+                                harness_id: adapter.id,
+                                attempt_id: contAttemptId,
+                                external_context_policy: knobs.webPolicy,
+                                ...(knobs.ignored.length > 0 ? { ignored_settings: knobs.ignored } : {}),
+                                continuation_of: run.attemptId,
+                            });
                             const contLeaseId = contLease.lease?.lease_id ?? "";
                             try {
                                 const contRun = await this.runCandidateInEnvelope(slot.routed, envelope, contAttemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
@@ -2311,7 +2179,7 @@ export class Orchestrator {
                                     effectiveRun = contRun;
                             }
                             catch (err) {
-                                ledger.settle(contLeaseId, unknownCostSettlement("continuation-error", 0));
+                                ledger.settle(contLeaseId, AC.attemptFailureCost(err, "continuation-error", 0).settlement);
                                 log.emit("harness.completed", {
                                     harness_id: adapter.id,
                                     attempt_id: contAttemptId,
@@ -2335,18 +2203,9 @@ export class Orchestrator {
                 envelope = undefined;
             }
             catch (err) {
-                // Envelope creation (or another pre-stream step) failed; stream errors
-                // are absorbed inside runCandidateInEnvelope with their real cost. A
-                // post-stream throw (e.g. the secret-token assertion) carries its
-                // streamed spend on the error — settle the TRUE cost, never launder
-                // real spend down to 0.
-                const carriedCost = typeof err?.costUsd === "number"
-                    ? err.costUsd
-                    : 0;
-                ledger.settle(slot.leaseId, unknownCostSettlement("post-stream-error", carriedCost));
+                const failureCost = AC.attemptFailureCost(err, "post-stream-error", 0);
+                ledger.settle(slot.leaseId, failureCost.settlement);
                 const message = safeErrorMessage(err);
-                // envelope is still undefined when wsm.create() itself threw — that is
-                // a workspace-phase infrastructure failure, not a harness error.
                 const infraPhase = envelope === undefined ? "workspace" : "harness";
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
@@ -2355,26 +2214,22 @@ export class Orchestrator {
                     error: message,
                     phase: infraPhase,
                 });
-                // Minimal attempt record so failure.yaml's rawDetailRef never dangles.
-                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), {
-                    attempt_id: slot.attemptId,
-                    harness_id: adapter.id,
-                    cost_usd: carriedCost,
-                    errored: true,
-                    phase: infraPhase,
-                    errors: [message],
-                });
+                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message));
                 runsBySlot[slotIdx] = {
                     attemptId: slot.attemptId,
                     harnessId: adapter.id,
                     label: slot.label,
                     diff: "",
                     gates: [],
-                    cost: 0,
+                    cost: failureCost.totalUsd,
                     errored: true,
-                    costEstimated: false,
+                    costEstimated: failureCost.estimated,
                     errors: [message],
-                    telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb, [slot.routed.browserRequirement, slot.routed.denyRequirement], knobs.model),
+                    telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb, [
+                        slot.routed.browserRequirement,
+                        slot.routed.denyRequirement,
+                        slot.routed.delegationRequirement,
+                    ], knobs.model),
                     infraPhase,
                 };
             }
@@ -2397,7 +2252,7 @@ export class Orchestrator {
         // arbitration (as the race-adoption path does) would fold those user edits
         // into the revert target and let a later revert clobber them.
         let earlyPostTurnSha = null;
-        if (input.inPlace === true && requestedSingleCandidate) {
+        if (input.inPlace && requestedSingleCandidate && runs.every((run) => !run.secretDiffRefusal)) {
             try {
                 earlyPostTurnSha = await snapshotTree(execRoot);
             }
@@ -2409,6 +2264,20 @@ export class Orchestrator {
             await disposeReviewEnvelopes();
             return cancelledResult(log, runId, taskId, mode, paths.root, cancelledCandidates(), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null), ledger.spend(), input.signal, store);
         }
+        const failedDelegation = delegateFailure.dominantRaceCandidateFailure(runs);
+        if (failedDelegation) {
+            const failure = delegateFailure.candidateFailureTerminal(failedDelegation, "race");
+            await disposeReviewEnvelopes();
+            await delegateFailure.persistFailedInPlaceWorkProduct({
+                ...{ store, log, paths, execRoot, preTurnSha, taskId, mode },
+                live: input.inPlace === true && failedDelegation.reviewCwd === execRoot,
+                run: failedDelegation,
+                postTurnSha: earlyPostTurnSha,
+                kind: input.create === true ? "new_repo" : "patch",
+            });
+            this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null);
+            return failTerminally(log, store, paths, runId, taskId, mode, failure.phase, failure.error, ledger.spend(), failure.metadata);
+        }
         if (runs.length === 0) {
             const budgetReason = ledger.terminal();
             // QA-050: when the zero-candidate cause is a budget refusal, the shared
@@ -2428,12 +2297,7 @@ export class Orchestrator {
                 why_winner: why,
                 evidence_facts: ["no candidates were produced"],
                 apply_recommendation: "continue",
-                budget_summary: {
-                    spend_usd: ledger.spend(),
-                    estimated: false,
-                    cash_usd: ledger.spend(),
-                    valuation_usd: ledger.valuation(),
-                },
+                budget_summary: decisionBudgetSummary(ledger),
             });
             store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Phase: ${agentBudgetMapping ? "budget" : "executor"}\n\n${why}\n`);
             if (agentBudgetMapping) {
@@ -2480,7 +2344,7 @@ export class Orchestrator {
         if (workingRuns.length === 0) {
             await disposeReviewEnvelopes();
             const first = runs[0];
-            const phase = first.infraPhase ?? "harness";
+            const phase = first.secretDiffRefusal ? "artifact_security" : (first.infraPhase ?? "harness");
             const { facts, why: rootCause } = partitionCandidates(runs);
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), {
                 winner: null,
@@ -2488,12 +2352,7 @@ export class Orchestrator {
                 why_winner: rootCause,
                 evidence_facts: runs.map((r) => `${r.attemptId} produced no work: ${r.errors[0] ?? "unknown"}`),
                 apply_recommendation: "continue",
-                budget_summary: {
-                    spend_usd: ledger.spend(),
-                    estimated: false,
-                    cash_usd: ledger.spend(),
-                    valuation_usd: ledger.valuation(),
-                },
+                budget_summary: decisionBudgetSummary(ledger),
             });
             this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null);
             store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}\n- Phase: ${phase}\n\n${rootCause}\n`);
@@ -2513,9 +2372,11 @@ export class Orchestrator {
                 rawDetailRef: `attempts/${first.attemptId}/attempt.yaml`,
                 eventRefs: existingEventRefs,
                 runDir: paths.root,
-                nextActions: phase === "workspace"
-                    ? ["Check the project folder", "Open diagnostics", "Retry the run"]
-                    : harnessFailureNextActions(harnessCategory),
+                nextActions: first.secretDiffRefusal
+                    ? secretDiff.secretDiffNextActions(first.secretDiffRefusal)
+                    : phase === "workspace"
+                        ? ["Check the project folder", "Open diagnostics", "Retry the run"]
+                        : harnessFailureNextActions(harnessCategory),
             });
             log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
             log.emit("run.failed", {
@@ -2574,7 +2435,7 @@ export class Orchestrator {
             // candidates (a trivial greeting in agent mode no longer burns two reviewers on
             // "(empty diff)"). Candidates still flow through arbitration/gates so the
             // no_op/answer outcome and gate failures are unchanged.
-            evidences = await this.reviewRuns(workingRuns, reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal);
+            evidences = await this.reviewRuns(workingRuns, reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input));
         }
         catch (err) {
             // Review preflight/evidence failures end TERMINALLY with artifacts —
@@ -2599,7 +2460,7 @@ export class Orchestrator {
                 attemptId: "synth",
                 intent: "synthesize",
                 harnessId: synthRouted.adapter.id,
-                cost: attemptCostEvidence(synthRouted.adapter.id, "synth", undefined, this.routeBillingKnowledge(input, synthRouted.adapter.id)),
+                cost: attemptCostEvidence(synthRouted.adapter.id, "synth", this.reservationEstimateUsd(input), this.routeBillingKnowledge(input, synthRouted.adapter.id)),
             });
             if (lease.granted) {
                 let envelope;
@@ -2635,7 +2496,7 @@ export class Orchestrator {
                     runs.push(run);
                     try {
                         if (isWorkingCandidate(run)) {
-                            const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal);
+                            const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input));
                             evidences.push(...synthEvidence);
                             workingRuns.push(run);
                         }
@@ -2648,7 +2509,7 @@ export class Orchestrator {
                     }
                 }
                 catch (err) {
-                    ledger.settle(lease.lease?.lease_id ?? "", unknownCostSettlement("synthesis-error"));
+                    ledger.settle(lease.lease?.lease_id ?? "", AC.attemptFailureCost(err, "synthesis-error").settlement);
                     log.emit("harness.completed", {
                         attempt_id: "synth",
                         status: "failed",
@@ -2666,14 +2527,7 @@ export class Orchestrator {
         }
         let result;
         try {
-            result = arbitrate(evidences, {
-                spendUsd: ledger.spend(),
-                estimatedSpend: runs.some((r) => r.costEstimated),
-                // QA-010b: carry the settled cash + subscription-valuation totals
-                // (reviewer panel included) onto the decision record.
-                cashUsd: ledger.spend(),
-                valuationUsd: ledger.valuation(),
-            });
+            result = arbitrate(evidences, arbitrationBudgetOptions(ledger));
         }
         catch (err) {
             // Arbitration throws end terminally with artifacts, never as an orphan.
@@ -2691,8 +2545,12 @@ export class Orchestrator {
         // Winner can only be a candidate that actually produced work; corpses are
         // excluded from arbitration upstream and from the fallback here.
         const winnerRun = workingRuns.find((r) => r.attemptId === result.decision.winner) ?? workingRuns[0];
-        // A reviewer escalation to a human is a BLOCKED terminal, not a silent risk note.
-        const needsHuman = evidences.some((e) => e.findings.some((f) => f.severity === "NEEDS_HUMAN" && isBlocking(f)));
+        const winnerEvidence = winnerRun
+            ? evidences.find((e) => e.attemptId === winnerRun.attemptId)
+            : undefined;
+        // D9 winner-only NEEDS_HUMAN gate, fail-closed on a winner with no review
+        // evidence record (see winnerNeedsHuman).
+        const needsHuman = winnerNeedsHuman(winnerRun?.attemptId ?? null, evidences);
         // Run-level review_verified is the WINNER's verification: an
         // empty-diff loser's unverified route must not drag the shipped result's
         // flag false. No winner -> fall back to the all-candidates view.
@@ -2755,12 +2613,11 @@ export class Orchestrator {
             })) {
                 log.emit("output.ready", { kind: "artifact", path });
             }
-            assertNoSecretLikeTokens("final patch diff", winnerRun.diff);
+            secretDiff.assertNoSecretLikeTokens("final patch diff", winnerRun.diff);
             const patchSha256 = sha256(winnerRun.diff);
             store.writeText(join(paths.finalDir, "patch.diff"), winnerRun.diff);
             const wstats = diffStats(winnerRun.diff);
             const hasDiff = winnerRun.diff.trim().length > 0;
-            const winnerEvidence = evidences.find((e) => e.attemptId === winnerRun.attemptId);
             const blockers = winnerEvidence
                 ? winnerEvidence.findings.filter((f) => isBlocking(f)).length
                 : 0;
@@ -3073,7 +2930,7 @@ export class Orchestrator {
             env: reviewHome.env,
         }).finally(() => reviewHome.dispose());
     }
-    async reviewRuns(runs, reviewers, reviewVerified, reviewDir, cwd, contract, store, paths, log, ledger, taskId, signal) {
+    async reviewRuns(runs, reviewers, reviewVerified, reviewDir, cwd, contract, store, paths, log, ledger, taskId, signal, reservationEstimateUsd) {
         const evidences = [];
         for (const run of runs) {
             const candidateCwd = run.reviewCwd ?? cwd;
@@ -3086,13 +2943,13 @@ export class Orchestrator {
                 // (so a failing test gate or no_op outcome is unchanged), just unreviewed.
                 const hasDiff = run.diff.trim().length > 0;
                 // Reviewer panels spend real money: reserve before, settle the observed cost.
-                const reviewLease = hasDiff
+                const reviewLease = hasDiff && reviewers.length > 0
                     ? ledger?.reserve({
                         taskId: taskId ?? "task",
                         attemptId: run.attemptId,
                         intent: "review",
                         harnessId: "review-panel",
-                        cost: attemptCostEvidence("review-panel", run.attemptId),
+                        cost: attemptCostEvidence("review-panel", run.attemptId, reservationEstimateUsd),
                     })
                     : undefined;
                 const result = hasDiff && reviewers.length > 0 && (reviewLease?.granted ?? true)
@@ -3119,11 +2976,16 @@ export class Orchestrator {
                         reviewSpendUsd: 0,
                         reviewSpendEstimated: false,
                         reviewCashUsd: 0,
+                        reviewCashKnowledge: "unknown",
                         reviewValuationUsd: 0,
+                        reviewValuationKnowledge: "unknown",
                         reviewUnknownUsd: 0,
                     };
                 if (reviewLease?.granted) {
-                    ledger?.settle(reviewLease.lease?.lease_id ?? "", reviewUsageCostSettlement(result.reviewCashUsd, result.reviewValuationUsd, result.reviewSpendEstimated, [`attempt:${run.attemptId}`, "review:panel"], result.reviewUnknownUsd));
+                    ledger?.settle(reviewLease.lease?.lease_id ?? "", reviewUsageCostSettlement(result.reviewCashUsd, result.reviewValuationUsd, {
+                        cash: result.reviewCashKnowledge,
+                        valuation: result.reviewValuationKnowledge,
+                    }, [`attempt:${run.attemptId}`, "review:panel"], result.reviewUnknownUsd));
                     if ((result.reviewSpendUsd ?? 0) > 0) {
                         log.emit("budget.observation", {
                             harness_id: "review-panel",
@@ -3231,10 +3093,21 @@ export class Orchestrator {
         const runId = input.runId ?? newId("run");
         // Contract validation BEFORE the run is announced (see runRace).
         const contract = this.buildContract(input, taskId, mode);
-        const store = this.artifactStore(input);
-        const paths = store.createRun(runId);
-        const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
-        input = this.withPlanBrief(input, store, paths, log);
+        const planBrief = verifiedPlanBrief(input);
+        const quotaSnapshots = this.quotaSnapshotPreflight();
+        const { store, paths, log, ledger } = beginAnnouncedRun({
+            input,
+            contract,
+            quotaSnapshots,
+            store: this.artifactStore(input),
+            authority: this.deps.delegationBudgetAuthority,
+            runId,
+            taskId,
+            mode,
+            phase: "convergence",
+            prompt: input.prompt,
+        }, announce);
+        input = withPlanBrief(input, store, paths, log, planBrief);
         // The execution root is the tree the harness mutates (thread worktree for an
         // isolated thread, else the project). The WorkspaceManager AND the git
         // boundary must resolve against the SAME root — the race path does so via the
@@ -3243,24 +3116,11 @@ export class Orchestrator {
         const execRoot = this.execRootOf(input);
         const wsm = new WorkspaceManager(execRoot);
         const readiness = new ReadinessLedger();
-        const ledger = this.rootLedger(input, contract, log);
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
-        safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
-        log.emit("run.created", { mode, prompt: redactSecrets(input.prompt) });
-        announce?.({
-            log,
-            store,
-            paths,
-            runId,
-            taskId,
-            mode,
-            phase: "convergence",
-            spend: () => ledger.spend(),
-        });
         // Live (in-place) isolation deliberately tolerates non-git stateful
         // environments; only envelope isolation needs the git boundary.
         if (!input.inPlace) {
-            const gitPreconditionError = await this.ensureWriteModeGitBoundary(execRoot, log, store, paths, runId, mode);
+            const gitPreconditionError = await ensureWriteModeGitBoundary(execRoot, log, store, paths, runId, mode);
             if (gitPreconditionError) {
                 return {
                     spendUsd: ledger.spend(),
@@ -3268,10 +3128,10 @@ export class Orchestrator {
                     taskId,
                     mode,
                     lifecycle: "failed",
-                    facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                    facts: makeOutcomeFacts("failed", { reason: gitPreconditionError.reason }),
                     winner: null,
                     runDir: paths.root,
-                    summary: gitPreconditionError,
+                    summary: gitPreconditionError.message,
                     candidates: [],
                 };
             }
@@ -3334,6 +3194,7 @@ export class Orchestrator {
                 candidates: [],
             };
         }
+        activateDelegationParent(this.deps.delegationBudgetAuthority, input, runId, ledger, adapterPool, log);
         // Fail fast on a provably unwinnable predicate instead of burning paid
         // rounds: the default convergence predicate requires a clean cross-family
         // review, which needs >=2 healthy reviewer provider families.
@@ -3405,7 +3266,6 @@ export class Orchestrator {
         const allCooledDown = () => adapterPool.every((a) => ledger.cooldownActive(a.adapter.id));
         const attemptTelemetries = [];
         let lastDiffStable = true;
-        let reviewSpendEstimated = false;
         try {
             // The contract's ENGINE-COMPUTED effective profile drives the envelope and
             // every attempt spec (parity with runRace); telemetry must never claim an
@@ -3460,7 +3320,7 @@ export class Orchestrator {
                     attemptId,
                     intent: "repair",
                     harnessId: adapter.id,
-                    cost: attemptCostEvidence(adapter.id, attemptId, undefined, this.routeBillingKnowledge(input, adapter.id)),
+                    cost: attemptCostEvidence(adapter.id, attemptId, this.reservationEstimateUsd(input), this.routeBillingKnowledge(input, adapter.id)),
                 });
                 if (!lease.granted) {
                     exhausted = true;
@@ -3495,30 +3355,48 @@ export class Orchestrator {
                     });
                 }
                 catch (err) {
-                    // Envelope/setup failure before the stream; stream errors are absorbed
-                    // inside runCandidateInEnvelope with their real accumulated cost.
-                    ledger.settle(lease.lease?.lease_id ?? "", unknownCostSettlement("attempt-error"));
+                    // Setup failures remain unknown; post-stream persistence failures
+                    // carry their route-specific settlement from runCandidateInEnvelope.
+                    const failureCost = AC.attemptFailureCost(err, "attempt-error");
+                    const message = safeErrorMessage(err);
+                    ledger.settle(lease.lease?.lease_id ?? "", failureCost.settlement);
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
                         status: "failed",
-                        error: safeErrorMessage(err),
+                        error: message,
                     });
+                    store.writeYaml(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message));
                     run = {
                         attemptId,
                         harnessId: adapter.id,
                         label: `Attempt ${attempt}`,
                         diff: "",
                         gates: [],
-                        cost: 0,
+                        cost: failureCost.totalUsd,
                         errored: true,
-                        costEstimated: false,
-                        errors: [safeErrorMessage(err)],
-                        telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb, [routed.browserRequirement, routed.denyRequirement], knobs.model),
+                        costEstimated: failureCost.estimated,
+                        errors: [message],
+                        telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb, [routed.browserRequirement, routed.denyRequirement, routed.delegationRequirement], knobs.model),
                     };
                 }
                 lastRun = run;
                 attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry: run.telemetry });
+                // Cancellation/deadline keeps priority over a belt failure finalized concurrently.
+                if (input.signal?.aborted)
+                    break;
+                if (delegateFailure.candidateFailureKind(run)) {
+                    const failure = delegateFailure.candidateFailureTerminal(run, "convergence");
+                    await delegateFailure.persistFailedInPlaceWorkProduct({
+                        ...{ store, log, paths, execRoot, preTurnSha, taskId, mode },
+                        live: input.inPlace === true,
+                        run,
+                        kind: input.create === true ? "new_repo" : "patch",
+                        attempts: attempt,
+                    });
+                    this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, attemptTelemetries, null);
+                    return failTerminally(log, store, paths, runId, taskId, mode, failure.phase, failure.error, ledger.spend(), failure.metadata);
+                }
                 // D-16 r8: interrupted (errored===false) would CONVERGE a partial diff
                 // as clean — break BEFORE review; a harness error still gate-retries.
                 if (run.outcomeClass === "interrupted") {
@@ -3554,7 +3432,7 @@ export class Orchestrator {
                                     attemptId,
                                     intent: "review",
                                     harnessId: "review-panel",
-                                    cost: attemptCostEvidence("review-panel", attemptId),
+                                    cost: attemptCostEvidence("review-panel", attemptId, this.reservationEstimateUsd(input)),
                                 })
                                 : null;
                             const reviewResult = reviewers.length > 0 && (reviewLease?.granted ?? false)
@@ -3580,11 +3458,16 @@ export class Orchestrator {
                                     reviewSpendUsd: 0,
                                     reviewSpendEstimated: false,
                                     reviewCashUsd: 0,
+                                    reviewCashKnowledge: "unknown",
                                     reviewValuationUsd: 0,
+                                    reviewValuationKnowledge: "unknown",
                                     reviewUnknownUsd: 0,
                                 };
                             if (reviewLease?.granted) {
-                                ledger.settle(reviewLease.lease?.lease_id ?? "", reviewUsageCostSettlement(reviewResult.reviewCashUsd, reviewResult.reviewValuationUsd, reviewResult.reviewSpendEstimated, [`attempt:${attemptId}`, "review:panel"], reviewResult.reviewUnknownUsd));
+                                ledger.settle(reviewLease.lease?.lease_id ?? "", reviewUsageCostSettlement(reviewResult.reviewCashUsd, reviewResult.reviewValuationUsd, {
+                                    cash: reviewResult.reviewCashKnowledge,
+                                    valuation: reviewResult.reviewValuationKnowledge,
+                                }, [`attempt:${attemptId}`, "review:panel"], reviewResult.reviewUnknownUsd));
                                 if ((reviewResult.reviewSpendUsd ?? 0) > 0) {
                                     log.emit("budget.observation", {
                                         harness_id: "review-panel",
@@ -3596,8 +3479,6 @@ export class Orchestrator {
                                         unknown_usd: reviewResult.reviewUnknownUsd,
                                         estimated: reviewResult.reviewSpendEstimated === true,
                                     });
-                                    if (reviewResult.reviewSpendEstimated === true)
-                                        reviewSpendEstimated = true;
                                 }
                             }
                             else if (reviewLease && !reviewLease.granted) {
@@ -3779,13 +3660,7 @@ export class Orchestrator {
         if (lastRun && !interrupted) {
             const arb = arbitrate([
                 toCandidateEvidence(lastRun, contract, lastFindings, lastFinalReviewClean, actualReviewVerified),
-            ], {
-                spendUsd: ledger.spend(),
-                estimatedSpend: lastRun.costEstimated || reviewSpendEstimated,
-                // QA-010b: settled cash + valuation (reviewer panel included).
-                cashUsd: ledger.spend(),
-                valuationUsd: ledger.valuation(),
-            });
+            ], arbitrationBudgetOptions(ledger));
             decision = arb.decision;
             store.writeYaml(join(paths.arbitrationDir, "decision.yaml"), decision);
             // A converged run adopts the arbitration axes (checks/review); an
@@ -3847,7 +3722,7 @@ export class Orchestrator {
         // work_product (its partial patch.diff stays diagnostic via attempts/);
         // in-place keeps the product so the honest Revert offer survives.
         if (lastRun && (!interrupted || input.inPlace === true)) {
-            assertNoSecretLikeTokens("final patch diff", lastRun.diff);
+            secretDiff.assertNoSecretLikeTokens("final patch diff", lastRun.diff);
             const patchSha256 = sha256(lastRun.diff);
             store.writeText(join(paths.finalDir, "patch.diff"), lastRun.diff);
             // Honest apply-state (parity with runRace single-candidate in-place): a
@@ -4017,285 +3892,57 @@ export class Orchestrator {
             reviewVerified: actualReviewVerified,
         };
     }
-    /** plan mode: multi-harness planning -> aggregate -> (optional) plan review -> plan. Read-only. */
-    /**
-     * Wrap the user's goal in an explicit "plan, do not implement" instruction.
-     * Without this the raw prompt ("make a racing game") reaches the harness with
-     * only a read-only sandbox, so the model tries to BUILD it and dumps code into
-     * the plan when writes are blocked — the v0.9 "HTML in the plan" bug. The
-     * read-only access still enforces it; this gives the model the right job.
-     */
-    planPrompt(goal) {
-        return [
-            `You are planning, NOT implementing. Explore the repository read-only and produce a plan another agent will execute later. Do not write files or output full implementations.`,
-            ``,
-            `## Goal`,
-            goal,
-            ``,
-            `## Required output (markdown)`,
-            `1. Approach — 2-3 sentences on how you'd solve this.`,
-            `2. Steps — a numbered list; each step names the file(s) it touches and what changes.`,
-            `3. Risks & edge cases.`,
-            `4. End your response with a section titled exactly:`,
-            ``,
-            `## Open Questions`,
-            ``,
-            `List every decision the user must make before implementation, one per bullet, in EXACTLY this format:`,
-            ``,
-            `- [single] <question> :: <option A> :: <option B>`,
-            `- [multi] <question> :: <option A> :: <option B>`,
-            `- [text] <question that has no good fixed options>`,
-            ``,
-            `Rules: [single] = pick exactly one; [multi] = pick one or more; [text] = free-form (no "::" options). Ground every option in THIS repository. If nothing is ambiguous, write a single bullet: - (none)`,
-            ``,
-            `Keep it concise. Reference real paths you found. Do NOT paste large code blocks; describe the change instead.`,
-        ].join("\n");
+    /** Bind private route/session preparation to the planner-attempt owner. */
+    plannerAttemptDeps() {
+        return {
+            billingKnowledge: (input, harnessId) => this.routeBillingKnowledge(input, harnessId),
+            inactivityTimeoutMs: (repoRoot) => harnessInactivityTimeoutMs(this.config(repoRoot)),
+            quotaEventSink: this.deps.quotaEventSink,
+            prepare: async (args) => {
+                const { input, contract, taskId, runId, log, store, paths, routed, attemptId } = args;
+                const adapter = routed.adapter;
+                const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
+                const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
+                const sessionFields = await this.sessionSpecFields(input, adapter.id, log, routed.authRouteEstimate);
+                const laneContinuity = args.laneRun
+                    ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, sessionFields.resume_session_id !== null, sessionFields, store, paths, this.execRootOf(input), log)
+                    : null;
+                const spec = HarnessRunSpec.parse({
+                    session_id: newId("ses"),
+                    intent: args.intent,
+                    prompt: laneContinuity?.pointerLine
+                        ? `${args.promptBody}\n\n${laneContinuity.pointerLine}`
+                        : args.promptBody,
+                    cwd: this.execRootOf(input),
+                    access: "readonly",
+                    attachments: input.attachments ?? [],
+                    ...sessionFields,
+                    ...this.harnessSpecKnobs(contract, knobs, args.intent),
+                    env_inheritance: envInheritance(this.config(input.repoRoot)),
+                    env: (args.laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? args.fallbackHome,
+                });
+                const plannerAbort = new AbortController();
+                spec.extra["abortSignal"] = input.signal
+                    ? AbortSignal.any([input.signal, plannerAbort.signal])
+                    : plannerAbort.signal;
+                const planInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
+                if (planInteraction)
+                    spec.extra["interactionChannel"] = planInteraction;
+                const planWorkMode = this.applyWorkEnvelope(spec, this.workReportEnvelopeFor(routed, contract, Boolean(planInteraction)));
+                return {
+                    knobs,
+                    effectiveWeb,
+                    spec,
+                    plannerAbort,
+                    planInteraction,
+                    planWorkMode,
+                };
+            },
+        };
     }
     /** One read-only planner spawn shared by solo fallback, Council drafts, and merge. */
     async runPlannerAttempt(args) {
-        const { input, contract, taskId, runId, log, store, paths, ledger, routed, attemptId } = args;
-        const adapter = routed.adapter;
-        const lease = ledger.reserve({
-            taskId,
-            attemptId,
-            intent: args.intent,
-            harnessId: adapter.id,
-            cost: attemptCostEvidence(adapter.id, attemptId, undefined, this.routeBillingKnowledge(input, adapter.id)),
-        });
-        if (!lease.granted) {
-            log.emit("budget.lease.created", {
-                granted: false,
-                reason: lease.reason,
-                denied: lease.denied,
-                attempt_id: attemptId,
-                harness_id: adapter.id,
-            });
-            return {
-                attemptId,
-                harnessId: adapter.id,
-                status: "failed",
-                outcomeClass: "clean", // never spawned: refused pre-flight by the budget gate
-                error: lease.reason ?? "budget lease denied",
-                text: null,
-                telemetry: null,
-                budgetDenied: true,
-                budgetDenial: {
-                    code: lease.denied ?? "hard_cap",
-                    reason: lease.reason ?? "budget lease denied",
-                    harnessId: adapter.id,
-                    attemptId,
-                },
-            };
-        }
-        const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
-        const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
-        const planSessionFields = this.sessionSpecFields(input, adapter.id, log);
-        // Continuity (INV-137): a thread PLAN turn is a chat turn — hydrate a
-        // lane switch/gap with a packet and disclose it.
-        const laneContinuity = args.laneRun
-            ? await this.resolveContinuity(input, adapter.id, planSessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, planSessionFields.resume_session_id !== null, store, paths, this.execRootOf(input), log)
-            : null;
-        const spec = HarnessRunSpec.parse({
-            session_id: newId("ses"),
-            intent: args.intent,
-            prompt: laneContinuity?.pointerLine
-                ? `${args.promptBody}\n\n${laneContinuity.pointerLine}`
-                : args.promptBody,
-            cwd: this.execRootOf(input),
-            access: "readonly",
-            // Planners must SEE any image/file the user attached (e.g. "plan a fix for
-            // what's in this screenshot"), not just agent/race runs.
-            attachments: input.attachments ?? [],
-            ...planSessionFields,
-            ...this.harnessSpecKnobs(contract, knobs, args.intent),
-            env_inheritance: envInheritance(this.config(input.repoRoot)),
-            // A thread plan turn spawns in its DURABLE per-lane home so its native
-            // session is reachable for resume next turn (INV-034); a non-thread
-            // plan keeps the disposable route-context home.
-            env: (args.laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? args.fallbackHome,
-        });
-        const plannerAbort = new AbortController();
-        spec.extra["abortSignal"] = input.signal
-            ? AbortSignal.any([input.signal, plannerAbort.signal])
-            : plannerAbort.signal;
-        const planInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
-        if (planInteraction)
-            spec.extra["interactionChannel"] = planInteraction;
-        // D-16: compile the WorkReport envelope for the plan lane (require plan text
-        // below folds the deliverable; the veto rides work_state).
-        const planWorkEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(planInteraction));
-        const planWorkMode = this.applyWorkEnvelope(spec, planWorkEnvelope);
-        const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
-        const answer = new AnswerAssembly();
-        const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
-            knobs.webPolicy === "cached" ||
-            knobs.webPolicy === "live", effectiveWeb, [], 
-        // Requested-model capture: a plan lane silently downgraded to another
-        // model surfaces the mismatch in its route receipt, just like agent.
-        knobs.model);
-        const onAbort = () => {
-            void adapter.cancel?.(spec.session_id)?.catch(() => { });
-        };
-        if (input.signal) {
-            if (input.signal.aborted)
-                onAbort();
-            else
-                input.signal.addEventListener("abort", onAbort, { once: true });
-        }
-        let cost = 0;
-        let costEstimated = false;
-        let harnessError = null;
-        const budgetSignalState = { quotaPressureDisclosed: false };
-        try {
-            log.emit("harness.started", {
-                harness_id: adapter.id,
-                attempt_id: attemptId,
-                external_context_policy: knobs.webPolicy,
-                ...(knobs.ignored.length > 0 ? { ignored_settings: knobs.ignored } : {}),
-            });
-            if (!input.signal?.aborted) {
-                const watchedPlan = withInactivityWatchdog(adapter.run(spec), {
-                    timeoutMs: harnessInactivityTimeoutMs(this.config(input.repoRoot)),
-                    onTimeout: () => {
-                        plannerAbort.abort();
-                        void adapter.cancel?.(spec.session_id)?.catch(() => { });
-                    },
-                    isSuspended: () => (planInteraction?.pendingCount?.() ?? 0) > 0,
-                });
-                for await (const ev of watchedPlan) {
-                    if (input.signal?.aborted)
-                        break;
-                    const safeEv = redactHarnessEvent(ev);
-                    safeInvoke(input.onHarnessEvent, safeEv);
-                    // A thread PLAN turn IS a chat turn now (INV-034): its native
-                    // session lives in the DURABLE per-lane home, so record it for the
-                    // next lane turn's resume. Council members are distinct lanes.
-                    if (args.laneRun)
-                        observeNativeSessionEvent(input, adapter.id, safeEv);
-                    observeAuthSwitch(log, adapter.id, attemptId, safeEv);
-                    log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv));
-                    appendLine(attemptEventsPath, JSON.stringify(safeEv));
-                    observeAttemptTelemetry(telemetry, safeEv);
-                    if (safeEv.plan_progress) {
-                        log.emit("plan.progress", {
-                            attempt_id: attemptId,
-                            harness_id: adapter.id,
-                            items: safeEv.plan_progress.items,
-                        });
-                    }
-                    // read-only routes burn quota too — same single owner as the agent loop.
-                    observeBudgetSignals(ledger, log, adapter.id, attemptId, safeEv, budgetSignalState);
-                    this.deps.quotaEventSink?.(adapter.id, safeEv);
-                    if (safeEv.type === "usage" && safeEv.usage?.cost_usd) {
-                        cost += safeEv.usage.cost_usd;
-                        if (safeEv.usage.estimated)
-                            costEstimated = true;
-                        log.emit("budget.observation", {
-                            harness_id: adapter.id,
-                            attempt_id: attemptId,
-                            kind: "spend",
-                            usd: safeEv.usage.cost_usd,
-                            estimated: safeEv.usage.estimated === true,
-                        });
-                    }
-                    // A TYPED final message wins verbatim over joined narration.
-                    answer.observe(safeEv);
-                    if (safeEv.type === "error")
-                        harnessError = safeEv.error ? redactSecrets(safeEv.error) : "harness emitted an error";
-                }
-            }
-        }
-        catch (err) {
-            harnessError = safeErrorMessage(err);
-        }
-        finally {
-            input.signal?.removeEventListener("abort", onAbort);
-            ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode, telemetry.usageCost));
-        }
-        // D-16: unwrap and require PLAN TEXT — a plan with no text is not delivered.
-        // The unwrap runs BEFORE the error axes: the deliverable it yields is what
-        // decides whether an unrecovered tool error is fatal (explorer parity).
-        const planUnwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", planWorkMode, {
-            sideToolReport: telemetry.sideToolWorkReport ?? undefined,
-        });
-        const planText = redactSecrets(planUnwrapped.deliverable).trim();
-        const unrecovered = unrecoveredToolErrors(telemetry);
-        const webBlocked = webUnsatisfied(telemetry);
-        if (!harnessError && webBlocked) {
-            harnessError = webEvidenceFailure(telemetry.web);
-        }
-        // INV-043/INV-044, explorer parity: a DELIVERED plan keeps an unrecovered
-        // non-web tool error as warning evidence instead of discarding the plan (see
-        // the helper). Web keeps its hard gate above; the finalizer outranks both.
-        harnessError ??= unrecoveredToolErrorFailure(unrecovered, planText.length > 0);
-        const planFinalized = finalizeAttempt({
-            deliverableEvidence: planText.length > 0,
-            harnessErrored: harnessError !== null && !webBlocked,
-            workReport: planUnwrapped.workReport,
-            workReportSource: planUnwrapped.source,
-            workReportViolation: planUnwrapped.contractViolation,
-            contextTerminalExhausted: telemetry.contextExhausted,
-        });
-        // A broken WorkReport contract is a hard failure only when the finalizer
-        // ranked it so (a terminal context exhaustion outranks it).
-        if (!harnessError && planFinalized.outcomeClass === "contract_failure") {
-            harnessError = `work_report contract: ${planUnwrapped.contractViolation}`;
-        }
-        // D-16 r9: an interrupted (context-exhausted) planner is NEVER a clean
-        // plan — partial text must not become final/plan.md as success. A VETO
-        // (needs_input/incomplete work_state) is DIFFERENT by the sealed D-16
-        // contract (X35, INV-116 canaries): the plan still delivers, lifecycle
-        // succeeded, and the work_state veto rides the OUTCOME (non-zero exit) —
-        // it must not be laundered into a harness failure either direction.
-        if (!harnessError && planFinalized.outcomeClass === "interrupted") {
-            harnessError = "context capacity exhausted before the plan completed";
-        }
-        const attemptError = harnessError ??
-            (planFinalized.deliverablePresent ? null : "planner produced no plan text") ??
-            (input.signal?.aborted ? "planner cancelled" : null);
-        setAttemptOutcome(telemetry, {
-            deliverablePresent: planFinalized.deliverablePresent,
-            gatesPassed: null,
-            harnessErrored: (harnessError !== null && !webBlocked) || planFinalized.harnessErrored,
-            webRequiredUnsatisfied: webBlocked,
-            workState: planFinalized.workState,
-        });
-        if (attemptError) {
-            log.emit("harness.completed", {
-                harness_id: adapter.id,
-                attempt_id: attemptId,
-                status: webBlocked ? "blocked" : "failed",
-                error: attemptError,
-                ...telemetrySummary(telemetry),
-            });
-            return {
-                attemptId,
-                harnessId: adapter.id,
-                status: webBlocked ? "blocked" : "failed",
-                outcomeClass: planFinalized.outcomeClass,
-                error: attemptError,
-                text: null,
-                telemetry,
-                budgetDenied: false,
-            };
-        }
-        const text = planText || "(no output)";
-        log.emit("harness.completed", {
-            harness_id: adapter.id,
-            attempt_id: attemptId,
-            status: "success",
-            ...telemetrySummary(telemetry),
-        });
-        return {
-            attemptId,
-            harnessId: adapter.id,
-            status: "success",
-            outcomeClass: planFinalized.outcomeClass,
-            error: null,
-            text,
-            telemetry,
-            budgetDenied: false,
-        };
+        return executePlannerAttempt(this.plannerAttemptDeps(), args);
     }
     async runPlan(input, announce) {
         const taskId = input.taskId ?? newId("task");
@@ -4303,22 +3950,19 @@ export class Orchestrator {
         // Plan runs get the same immutable contract truth as every other mode;
         // contract validation runs BEFORE the run is announced (see runRace).
         const contract = this.buildContract(input, taskId, "plan");
-        const store = this.artifactStore(input);
-        const paths = store.createRun(runId);
-        const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
-        safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
-        log.emit("run.created", { mode: "plan", prompt: redactSecrets(input.prompt) });
-        const ledger = this.rootLedger(input, contract, log);
-        announce?.({
-            log,
-            store,
-            paths,
+        const quotaSnapshots = this.quotaSnapshotPreflight();
+        const { store, paths, log, ledger } = beginAnnouncedRun({
+            input,
+            contract,
+            quotaSnapshots,
+            store: this.artifactStore(input),
+            authority: this.deps.delegationBudgetAuthority,
             runId,
             taskId,
             mode: "plan",
             phase: "plan",
-            spend: () => ledger.spend(),
-        });
+            prompt: input.prompt,
+        }, announce);
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // W3.3: ONE resolved read-only context — the routing point-probe and every
@@ -4426,6 +4070,7 @@ export class Orchestrator {
                 roHome,
                 contextSection,
                 laneRun,
+                estimateUsdFloor: this.estimateUsdFloor(input.repoRoot),
             });
         }
         const plans = [];
@@ -4453,8 +4098,9 @@ export class Orchestrator {
                     attemptId,
                     laneRun,
                     fallbackHome: roHome.env,
-                    promptBody: this.planPrompt(input.prompt) + contextSection,
+                    promptBody: planPrompt(input.prompt) + contextSection,
                     intent: "plan",
+                    reservationEstimateUsd: this.reservationEstimateUsd(input),
                 });
                 if (outcome.budgetDenied) {
                     // QA-050: retain the denied planner slot before breaking so the
@@ -4533,7 +4179,6 @@ export class Orchestrator {
         }
         if (plans.length === 0) {
             return writePlanHarnessFailure(this.planRunDeps(), {
-                input,
                 contract,
                 taskId,
                 runId,
@@ -4576,7 +4221,7 @@ export class Orchestrator {
             runPlannerAttempt: (a) => this.runPlannerAttempt(a),
             writeRunTelemetry: (store, paths, contract, runId, taskId, mode, attempts, finalAttemptId) => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, attempts, finalAttemptId),
             execRootOf: (input) => this.execRootOf(input),
-            planPrompt: (goal) => this.planPrompt(goal),
+            planPrompt,
         };
     }
     /** ask: one selected harness answers read-only questions; no patch/apply controls. */
@@ -4602,24 +4247,8 @@ export class Orchestrator {
             defaultPrompt: "Explore this repository and synthesize evidence-cited findings, omissions, and follow-up questions.",
         }, announce);
     }
-    resolvePaidBudget(inputBudget, cfg) {
-        return inputBudget ?? this.deps.paidBudget ?? cfg.global.budget.paid_budget_per_run;
-    }
-    rootLedger(_input, contract, log) {
-        // The root ledger discloses into THIS run's log: the ledger is the one
-        // owner of the cash fact (subscription-entitled work settles to 0 there),
-        // and the UI renders `budget.cash` verbatim — never inferring money from
-        // route labels (W4.3 sol #15).
-        const ledger = new BudgetLedger(contract.budget.paid_budget, undefined, {
-            onCashSettled: (cashSpendUsd, valuationUsd) => log.emit("budget.cash", {
-                cash_spend_usd: cashSpendUsd,
-                valuation_usd: valuationUsd,
-            }),
-        });
-        for (const snapshot of this.deps.quotaSnapshots?.() ?? []) {
-            ledger.observeQuotaSnapshot(snapshot);
-        }
-        return ledger;
+    quotaSnapshotPreflight() {
+        return [...(this.deps.quotaSnapshots?.() ?? [])].map((snapshot) => QuotaSnapshotSchema.parse(snapshot));
     }
     routeBillingKnowledge(input, harnessId) {
         // A selected profile's credential_kind decides billing (round-18 #2).
@@ -4649,10 +4278,10 @@ export class Orchestrator {
             // scout reserve) so a subscription route is not refused for lacking a
             // cash quote.
             attemptCostEvidence(harnessId, attemptId, this.estimateUsdFloor(input.repoRoot), this.routeBillingKnowledge(input, harnessId)),
-            buildSpec: (routed, homeEnv, prompt, attemptId) => {
+            buildSpec: async (routed, homeEnv, prompt, attemptId) => {
                 const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
                 const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
-                const sessionFields = this.sessionSpecFields(input, routed.adapter.id, log);
+                const sessionFields = await this.sessionSpecFields(input, routed.adapter.id, log, routed.authRouteEstimate);
                 const spec = HarnessRunSpec.parse({
                     session_id: newId("ses"),
                     intent: "synthesize",
@@ -4693,22 +4322,19 @@ export class Orchestrator {
         // Contract validation BEFORE the run is announced (see runRace). The
         // recorded user intent is the CALLER's goal.
         const contract = this.buildContract({ ...input, prompt: opts.contractIntent ?? prompt }, taskId, opts.mode);
-        const store = this.artifactStore(input);
-        const paths = store.createRun(runId);
-        const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
-        safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
-        log.emit("run.created", { mode: opts.mode, prompt: redactSecrets(prompt) });
-        const ledger = this.rootLedger(input, contract, log);
-        announce?.({
-            log,
-            store,
-            paths,
+        const quotaSnapshots = this.quotaSnapshotPreflight();
+        const { store, paths, log, ledger } = beginAnnouncedRun({
+            input,
+            contract,
+            quotaSnapshots,
+            store: this.artifactStore(input),
+            authority: this.deps.delegationBudgetAuthority,
             runId,
             taskId,
             mode: opts.mode,
             phase: "report",
-            spend: () => ledger.spend(),
-        });
+            prompt,
+        }, announce);
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // The ask/deep-scan report stays bare (its scouts read the tree themselves);
@@ -4850,10 +4476,10 @@ export class Orchestrator {
                 intent: opts.intent,
                 harnessId: adapter.id,
                 // QA-019: an n>1 deep-scan scout admits under a FINITE estimate floor
-                // (mirror of the candidate loop): the first scout reserves without a
-                // floor, but later scouts pass the repo's usd floor so a subscription
-                // swarm is not refused for lacking a per-attempt cash quote under a cap.
-                cost: attemptCostEvidence(adapter.id, attemptId, opts.deepScan && idx > 0 ? this.estimateUsdFloor(input.repoRoot) : undefined, this.routeBillingKnowledge(input, adapter.id)),
+                // (mirror of the candidate loop): the first top-level scout reserves
+                // without a floor; later scouts and every real Delegate child pass the
+                // repo floor because they overlap an existing family unit.
+                cost: attemptCostEvidence(adapter.id, attemptId, this.reservationEstimateUsd(input, opts.deepScan && idx > 0), this.routeBillingKnowledge(input, adapter.id)),
             });
             if (!lease.granted) {
                 log.emit("budget.lease.created", {
@@ -4882,67 +4508,120 @@ export class Orchestrator {
                 }
                 return { status: "budget_denied", reason: lease.reason ?? "budget lease denied" };
             }
-            // Lease granted: the attempt is now committed to run — disclose the launch.
-            onLaunch?.();
-            const knobs = this.routeSpecKnobs(routed, contract, modelOverride, input.effort);
-            const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
-            const explorerPrompt = (opts.deepScan
-                ? `${prompt}\n\nExplorer ${idx + 1}/${adapters.length}: focus on a distinct slice. Emit evidence-cited findings, explicit unknowns/omissions, and follow-up questions. Do not edit files.`
-                : prompt) + contextSection;
-            const sessionFields = this.sessionSpecFields(input, adapter.id, log);
-            const grantResume = sessionFields.resume_session_id !== null && !resumeGranted.has(adapter.id);
-            if (grantResume)
-                resumeGranted.add(adapter.id);
-            // Continuity (INV-137): a thread ASK turn is a chat turn — hydrate a lane
-            // switch/gap with a packet and disclose it. Gated on laneRun (deep-scan
-            // scouts are excluded from laneRun); native resume is available only when
-            // this slot was granted the lane's recorded session.
-            const laneContinuity = laneRun
-                ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, grantResume, store, paths, this.execRootOf(input), log)
-                : null;
-            // D-16d: the continuation packet pointer rides after the lane pointer so
-            // the fresh session is re-grounded in the exhausted attempt's work.
-            const promptWithPointers = [explorerPrompt, laneContinuity?.pointerLine, continuationPointer]
-                .filter((p) => Boolean(p))
-                .join("\n\n");
-            let spec = HarnessRunSpec.parse({
-                session_id: newId("ses"),
-                intent: opts.intent,
-                prompt: promptWithPointers,
-                cwd: this.execRootOf(input),
-                access: "readonly",
-                // ASK/EXPLORE/AUDIT read-only runs must forward the user's attachments —
-                // a live "describe this image" turn sent an image that was being dropped here, so
-                // the model honestly reported it saw nothing (the v0.13 attachment bug).
-                attachments: input.attachments ?? [],
-                auth_preference: sessionFields.auth_preference,
-                credential_profile: sessionFields.credential_profile,
-                resume_session_id: grantResume ? sessionFields.resume_session_id : null,
-                ...this.harnessSpecKnobs(contract, knobs, opts.intent),
-                env_inheritance: envInheritance(this.config(input.repoRoot)),
-                // A thread lane turn spawns in its DURABLE per-lane home so the native
-                // session it records is reachable for resume next turn; everything else
-                // uses the disposable route-context home.
-                env: (laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? roHome.env,
-            });
-            const reportAbort = new AbortController();
-            spec.extra["abortSignal"] = input.signal
-                ? AbortSignal.any([input.signal, reportAbort.signal])
-                : reportAbort.signal;
-            const reportInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
-            if (reportInteraction)
-                spec.extra["interactionChannel"] = reportInteraction;
-            // D-16: compile the WorkReport envelope for the read-only lane.
-            const readonlyWorkEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(reportInteraction));
-            const readonlyWorkMode = this.applyWorkEnvelope(spec, readonlyWorkEnvelope);
-            const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
-            const answer = new AnswerAssembly();
-            const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
-                knobs.webPolicy === "cached" ||
-                knobs.webPolicy === "live", effectiveWeb, [], 
-            // Requested-model capture so ask/audit route receipts detect a silent
-            // model downgrade (typed model_mismatch), not just agent runs.
-            knobs.model);
+            // As with planners, the granted lease owns profile/continuity/spec
+            // preparation. Contain a pre-stream rejection as this attempt's failure;
+            // parallel siblings can then finish before the shared HOME is disposed.
+            const preparation = await (async () => {
+                // Lease granted: the attempt is now committed to run — disclose the launch.
+                onLaunch?.();
+                const knobs = this.routeSpecKnobs(routed, contract, modelOverride, input.effort);
+                const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
+                const explorerPrompt = (opts.deepScan
+                    ? `${prompt}\n\nExplorer ${idx + 1}/${adapters.length}: focus on a distinct slice. Emit evidence-cited findings, explicit unknowns/omissions, and follow-up questions. Do not edit files.`
+                    : prompt) + contextSection;
+                const sessionFields = await this.sessionSpecFields(input, adapter.id, log, routed.authRouteEstimate);
+                const grantResume = sessionFields.resume_session_id !== null && !resumeGranted.has(adapter.id);
+                if (grantResume)
+                    resumeGranted.add(adapter.id);
+                // Continuity (INV-137): a thread ASK turn is a chat turn — hydrate a lane
+                // switch/gap with a packet and disclose it. Gated on laneRun (deep-scan
+                // scouts are excluded from laneRun); native resume is available only when
+                // this slot was granted the lane's recorded session.
+                const laneContinuity = laneRun
+                    ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, grantResume, sessionFields, store, paths, this.execRootOf(input), log)
+                    : null;
+                // D-16d: the continuation packet pointer rides after the lane pointer so
+                // the fresh session is re-grounded in the exhausted attempt's work.
+                const promptWithPointers = [
+                    explorerPrompt,
+                    laneContinuity?.pointerLine,
+                    continuationPointer,
+                ]
+                    .filter((p) => Boolean(p))
+                    .join("\n\n");
+                const spec = HarnessRunSpec.parse({
+                    session_id: newId("ses"),
+                    intent: opts.intent,
+                    prompt: promptWithPointers,
+                    cwd: this.execRootOf(input),
+                    access: "readonly",
+                    // ASK/EXPLORE/AUDIT read-only runs must forward the user's attachments —
+                    // a live "describe this image" turn sent an image that was being dropped here, so
+                    // the model honestly reported it saw nothing (the v0.13 attachment bug).
+                    attachments: input.attachments ?? [],
+                    auth_preference: sessionFields.auth_preference,
+                    credential_profile: sessionFields.credential_profile,
+                    resume_session_id: grantResume ? sessionFields.resume_session_id : null,
+                    ...this.harnessSpecKnobs(contract, knobs, opts.intent),
+                    env_inheritance: envInheritance(this.config(input.repoRoot)),
+                    // A thread lane turn spawns in its DURABLE per-lane home so the native
+                    // session it records is reachable for resume next turn; everything else
+                    // uses the disposable route-context home.
+                    env: (laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? roHome.env,
+                });
+                const reportAbort = new AbortController();
+                spec.extra["abortSignal"] = input.signal
+                    ? AbortSignal.any([input.signal, reportAbort.signal])
+                    : reportAbort.signal;
+                const reportInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
+                if (reportInteraction)
+                    spec.extra["interactionChannel"] = reportInteraction;
+                // D-16: compile the WorkReport envelope for the read-only lane.
+                const readonlyWorkEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(reportInteraction));
+                const readonlyWorkMode = this.applyWorkEnvelope(spec, readonlyWorkEnvelope);
+                const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
+                const answer = new AnswerAssembly();
+                const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
+                    knobs.webPolicy === "cached" ||
+                    knobs.webPolicy === "live", effectiveWeb, [], 
+                // Requested-model capture so ask/audit route receipts detect a silent
+                // model downgrade (typed model_mismatch), not just agent runs.
+                knobs.model);
+                return {
+                    knobs,
+                    spec,
+                    reportAbort,
+                    reportInteraction,
+                    readonlyWorkMode,
+                    attemptEventsPath,
+                    answer,
+                    telemetry,
+                };
+            })().then((value) => ({ ok: true, value }), (error) => ({ ok: false, error }));
+            if (!preparation.ok) {
+                const message = `read-only attempt setup failed: ${safeErrorMessage(preparation.error)}`;
+                AC.settleGrantedAttemptLease({
+                    ledger,
+                    leaseId: lease.lease?.lease_id ?? "",
+                    attemptId,
+                    harnessId: adapter.id,
+                    costUsd: 0,
+                    costEstimated: false,
+                    preStreamFailureSource: "readonly-pre-stream",
+                });
+                const telemetry = createAttemptTelemetry(contract.external_context.policy, contract.external_context.web_required, contract.external_context.effective_mode);
+                setAttemptOutcome(telemetry, {
+                    deliverablePresent: false,
+                    gatesPassed: null,
+                    harnessErrored: true,
+                    webRequiredUnsatisfied: false,
+                });
+                attempts.push({
+                    attemptId,
+                    harnessId: adapter.id,
+                    status: "failed",
+                    report: "",
+                    error: message,
+                    telemetry,
+                });
+                attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
+                if (opts.deepScan) {
+                    store.writeText(join(paths.findingsDir, `${attemptId}-error.md`), `# Explorer ${attemptId} failed\n\n${message}\n`);
+                }
+                return { status: "launched" };
+            }
+            const { knobs, spec: preparedSpec, reportAbort, reportInteraction, readonlyWorkMode, attemptEventsPath, answer, telemetry, } = preparation.value;
+            let spec = preparedSpec;
             const retryPolicy = transientRetryPolicy(this.config(input.repoRoot));
             let activeSessionId = spec.session_id;
             const onAbort = () => {
@@ -4982,11 +4661,13 @@ export class Orchestrator {
                     try {
                         const watchedReport = withInactivityWatchdog(adapter.run(runSpec), {
                             timeoutMs: harnessInactivityTimeoutMs(this.config(input.repoRoot)),
+                            countsAsProgress: countsAsAgentProgress,
                             onTimeout: () => {
                                 reportAbort.abort();
                                 void adapter.cancel?.(activeSessionId)?.catch(() => { });
                             },
                             isSuspended: () => (reportInteraction?.pendingCount?.() ?? 0) > 0,
+                            suspensionVersion: () => reportInteraction?.suspensionVersion?.() ?? 0,
                         });
                         for await (const ev of watchedReport) {
                             if (input.signal?.aborted)
@@ -5050,13 +4731,18 @@ export class Orchestrator {
                     // W5.4 reactive failover, READ-ONLY lane (same contract as the
                     // candidate lane; typed limits only, never plain transients).
                     if (harnessError && !input.signal?.aborted) {
+                        const rotationPolicy = this.profilePolicy(input.repoRoot, adapter.id);
+                        const readyProfileIds = sawTypedLimit && reportSoFar.length === 0 && rotationPolicy.limit_action === "rotate"
+                            ? await this.readyProfileIdsForRotation(input, adapter.id, spec.credential_profile ?? null, triedProfiles)
+                            : new Set();
                         const rotated = rotateSpecOnTypedLimit({
                             spec,
                             harnessId: adapter.id,
                             attemptId,
-                            policy: this.profilePolicy(input.repoRoot, adapter.id),
+                            policy: rotationPolicy,
                             registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
                             snapshots: this.deps.quotaSnapshots?.() ?? [],
+                            readyProfileIds,
                             triedProfiles,
                             sawTypedLimit,
                             deliverableEmpty: reportSoFar.length === 0,
@@ -5098,7 +4784,17 @@ export class Orchestrator {
             }
             finally {
                 input.signal?.removeEventListener("abort", onAbort);
-                ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode, telemetry.usageCost));
+                AC.settleGrantedAttemptLease({
+                    ledger,
+                    leaseId: lease.lease?.lease_id ?? "",
+                    attemptId,
+                    harnessId: adapter.id,
+                    costUsd: cost,
+                    costEstimated,
+                    authMode: telemetry.authMode,
+                    usageCost: telemetry.usageCost,
+                    preStreamFailureSource: "readonly-pre-stream",
+                });
             }
             if (harnessError && telemetry.transientFailures.length > 0) {
                 log.emit("route.transient.exhausted", {
@@ -5109,11 +4805,14 @@ export class Orchestrator {
                 });
             }
             attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
-            // D-16: un-nest the {work_report, output} envelope; the OUTPUT is the report.
+            // D-16: remove the WorkReport transport; the deliverable is the report.
             const roUnwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", readonlyWorkMode, {
                 sideToolReport: telemetry.sideToolWorkReport ?? undefined,
             });
-            const report = redactSecrets(roUnwrapped.deliverable);
+            // Trim symmetrically with the plan path: a whitespace-only answer is not
+            // a delivered report (the final-artifact wrapper heading would otherwise
+            // make it read as present content by construction).
+            const report = redactSecrets(roUnwrapped.deliverable).trim();
             const unrecovered = unrecoveredToolErrors(telemetry);
             const webBlocked = webUnsatisfied(telemetry);
             const reportPresent = report.length > 0;
@@ -5141,6 +4840,13 @@ export class Orchestrator {
                 harnessErrored: harnessError !== null && !webBlocked,
                 webRequiredUnsatisfied: webBlocked,
                 workState: roFinalized.workState,
+                // A read-only attempt that completed CLEANLY with an honestly empty
+                // answer is a success with deliverable_present=false ("(no output)"),
+                // never a fake contract failure — the trim above must not convert a
+                // phantom deliverable into a phantom harness failure. Only the clean
+                // finalizer class qualifies: contract failures, vetoes, and context
+                // interruptions keep the strict deliverable requirement.
+                emptyDeliverableAllowed: roFinalized.outcomeClass === "clean",
             });
             if (harnessError) {
                 log.emit("harness.completed", {
@@ -5571,7 +5277,7 @@ export class Orchestrator {
         }
         this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, opts.deepScan ? null : (succeeded[0]?.attemptId ?? null), deepScanSynthesis);
         log.emit("output.ready", {
-            kind: opts.mode === "ask" ? "answer" : "report",
+            kind: opts.deepScan ? "report" : "answer",
             path: `final/${opts.artifactName}`,
         });
         if (opts.deepScan) {
@@ -5629,11 +5335,16 @@ export class Orchestrator {
             .map((a) => `${a.attemptId}:${a.harnessId}:${a.status}`)
             .join(", ");
         store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harnesses: ${harnessLabel}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}\n\n${report}\n`);
+        const reportProducerAttemptId = opts.deepScan &&
+            deepScanSynthesis?.status === "succeeded" &&
+            deepScanSynthesis.reducer_attempt_id
+            ? deepScanSynthesis.reducer_attempt_id
+            : (succeeded[0]?.attemptId ?? "a01");
         store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
             id: newId("wp"),
             kind: "report",
             source_task_id: taskId,
-            producer_attempt_id: succeeded[0]?.attemptId ?? "a01",
+            producer_attempt_id: reportProducerAttemptId,
             files: Object.fromEntries([[opts.artifactName, join(paths.finalDir, opts.artifactName)]]),
             meta: {
                 harnesses: attempts.map((a) => a.harnessId),
@@ -5642,7 +5353,7 @@ export class Orchestrator {
                 read_only: true,
             },
         });
-        log.emit("work_product.emitted", { kind: "report", winner: succeeded[0]?.attemptId ?? null });
+        log.emit("work_product.emitted", { kind: "report", winner: reportProducerAttemptId });
         const workVetoed = terminalFacts.work_state?.state === "needs_input" ||
             terminalFacts.work_state?.state === "incomplete";
         if (terminalFacts.lifecycle !== "succeeded") {
@@ -5694,9 +5405,4 @@ export class Orchestrator {
         };
     }
 }
-function assertNoSecretLikeTokens(label, text) {
-    if (containsSecretLikeToken(text)) {
-        throw new Error(`${label} contains secret-like token; refusing to persist artifact`);
-    }
-}
 //# sourceMappingURL=orchestrator.js.map