@claudexor/orchestrator 3.1.2 → 3.3.7-rc.0

package/dist/orchestrator.js

@@ -1,17 +1,19 @@
 import { existsSync } from "node:fs";
-import { observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, selectedProfileAvailability, } from "./credential-profiles.js";
+import { effectiveAuthPreference, observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, probeCredentialProfileStatus, profileHeadroomBreach, profileStatusAdmits, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, selectedProfileAvailability, staticRotationCandidates, vendorVerifiedProfileStatus, } from "./credential-profiles.js";
 import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
 import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
 import { processAttemptUsage } from "./attemptUsage.js";
+import { appliedAttemptFacts, assertDelegatedEvidence, confinementNotice, externallyConfinedLane, scopedHarnessHome, } from "./delegatedHome.js";
 import * as AC from "./attemptUsageCost.js";
-import { candidateRoster, convergenceOutcomeFacts, isWorkingCandidate, partitionCandidates, toCandidateEvidence, } from "./candidateEvidence.js";
+import { candidateRoster, convergenceOutcomeFacts, isWorkingCandidate, partitionCandidates, toCandidateEvidence, unanimousDeclaredFailure, } from "./candidateEvidence.js";
 import { capabilityIntents } from "@claudexor/gateway";
 import { policyFindings } from "./policyFindings.js";
 import { join } from "node:path";
 import { finalizePlanRun, runCouncilPlan, writePlanHarnessFailure, } from "./planRun.js";
-import { HarnessRunSpec, ModeKind as ModeKindSchema, SCHEMA_VERSION, TRUST_FULL_ACCESS_CODE, FrozenTaskContractArtifact as TaskContractSchema, isBlocking, makeOutcomeFacts, normalizeUserOutputSchema, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
-import { globalConfigDir, loadConfig, trustConfigPath } from "@claudexor/config";
-import { AnswerAssembly, CLAUDEXOR_ARTIFACT_DIR, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
+import { runPlannerAttempt as executePlannerAttempt, } from "./plannerAttempt.js";
+import { HarnessRunSpec, ModeKind as ModeKindSchema, QuotaSnapshot as QuotaSnapshotSchema, isBlocking, makeOutcomeFacts, normalizeUserOutputSchema, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
+import { globalConfigDir, loadConfig } from "@claudexor/config";
+import { AnswerAssembly, CLAUDEXOR_ARTIFACT_DIR, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
 import { assertRouteModelsAllowed } from "./modelGovernance.js";
 import { governRouteEffort } from "./effortGovernance.js";
 import { isFullAccess, RequestRequirementsResolver } from "./requestRequirements.js";
@@ -20,16 +22,18 @@ import { routingFailureClassification } from "./routing-failure.js";
 export { routingFailureClassification } from "./routing-failure.js";
 import { runBounded } from "./run-bounded.js";
 import { planPrompt } from "./plan-prompt.js";
+import { verifiedPlanBrief, withPlanBrief } from "./planBrief.js";
 import { resolveRunInputDefaults } from "./run-input-resolution.js";
-import { createRootLedger } from "./root-ledger.js";
+import { beginAnnouncedRun } from "./runEventLog.js";
 import { arbitrationBudgetOptions, decisionBudgetSummary } from "./decisionBudget.js";
 import { buildRevisePrompt } from "./revisePrompt.js";
-import { announcedRunContext, cancelledResult, failTerminally, guardAnnouncedRun, writeFailure, } from "./runTerminals.js";
+import { cancelledResult, declaredFailure, failTerminally, guardAnnouncedRun, writeFailure, } from "./runTerminals.js";
 import { budgetFailureRecord, classifyBudgetFailure } from "./budgetFailure.js";
 import { assertOutputSchemaCompiles, finalizeStructuredOutput } from "./structuredOutput.js";
-import { transientRetryDelayMs, promptWithEngineConstraints, sleep, redactHarnessEvent, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, emitPoolDegraded, deliveryRefusalFailure, writeRaceDeliveryDecision, } from "./runSupport.js";
+import { transientRetryDelayMs, promptWithEngineConstraints, sleep, redactHarnessEvent, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
 import { candidateStatusInRouteContext, resolveReadOnlyRouteContext, } from "./routeContext.js";
 import { resolveAutoReviewerPanel, resolveExplicitReviewerPanel } from "./reviewerPanel.js";
+import { ensureWriteModeGitBoundary } from "./git-precondition.js";
 import { buildContinuation, } from "./continuity.js";
 import { activePlanPointer, resolveContinuitySummary, workspaceAnchor, } from "./continuity-facts.js";
 import { runDiffReview } from "./diffReview.js";
@@ -41,18 +45,18 @@ import { dominantHarnessFailureCategory, harnessFailureNextActions } from "./har
 import { finalizeAttempt, readOnlyNoSuccessTerminal, resolveWorkReportEnvelope, unrecoveredToolErrorFailure, unwrapWorkReportEnvelope, webEvidenceFailure, } from "./attemptFinalize.js";
 import { buildContinuationPacket, decideContinuation, synthesizeContinuationRequest, } from "./continuation.js";
 import { interactionChannelFor } from "./interaction.js";
-import { gateSpecsFromContract, renderTestsEvidence, resolveContractGates, } from "./contract-gates.js";
+import { gateSpecsFromContract, renderTestsEvidence } from "./contract-gates.js";
+import { buildTaskContract } from "./task-contract-builder.js";
 import { ArtifactStore } from "@claudexor/artifact-store";
-import { EventLog } from "@claudexor/event-log";
 import { assertMandatoryContext, buildContextPack, rawContextForEnvelope, preflightEvidence, writeEvidencePacket, } from "@claudexor/context";
-import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, ensureClaudeBridge, ensureGitRepository, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
+import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, ensureClaudeBridge, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
 import { blockedDecisionOverride, finalVerifyBlocks, finalVerifyPatch, verifyAndDeliver, } from "@claudexor/delivery";
 import { HarnessGateway } from "@claudexor/gateway";
 import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, reviewCandidate, revalidateFindings, runGates, } from "@claudexor/review";
 import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
 import { attemptCostEvidence, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, explainRanking, loadHarnessMetrics, promptFingerprint, rankHarnesses, reviewUsageCostSettlement, } from "@claudexor/budget";
-import { readTextSafe, appendLine, assertNoInlineSecretValues, containsSecretLikeToken, DELEGATION_ENV, hashJson, newId, noProjectRepoRoot, nowIso, redactSecrets, safeInvoke, sha256, userConfigDir, writeText, } from "@claudexor/util";
+import { readTextSafe, appendLine, assertNoInlineSecretValues, DELEGATION_ENV, hashJson, newId, noProjectRepoRoot, redactSecrets, safeInvoke, sha256, userConfigDir, writeText, } from "@claudexor/util";
 import { assertWriteIsolation } from "./write-isolation.js";
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
@@ -110,10 +114,14 @@ export class Orchestrator {
             throw new Error(`Delegate is an agent-only strategy (got mode=${mode})`);
         }
         const runId = resolved.runId ?? newId("run");
+        let delegatedLedgerAttached = false;
         resolved = {
             ...resolved,
             runId,
             taskId: resolved.taskId ?? newId("task"),
+            onDelegatedLedgerAttached: () => {
+                delegatedLedgerAttached = true;
+            },
         };
         if (resolved.delegate === true) {
             resolved = {
@@ -157,50 +165,63 @@ export class Orchestrator {
         if (resolved.repoRoot !== NO_PROJECT_ROOT) {
             assertMandatoryContext(resolved.repoRoot, this.projectConfig(resolved.repoRoot).context.mandatory_files);
         }
-        // Reviewer panels are validated only inside the strategies that actually
-        // review (race/convergence under agent, and plan) — AFTER run-dir
+        // Reviewer panels are validated only inside Agent strategies that actually
+        // review (race/convergence; Plan Council is the plan critique path) — AFTER run-dir
         // creation, so a doomed explicit panel yields typed failure ARTIFACTS
         // (failure.yaml naming the refusal) instead of a bare pre-run throw.
-        // ask/audit never spawn reviewers, so a panel there never spends doctor/
+        // Ask and Plan never spawn code reviewers, so a panel there never spends doctor/
         // model probes and never fails a run that would not use it.
         // Whole-strategy terminal net: once a strategy ANNOUNCES its
         // run, any escaped throw still stamps failure.yaml + summary + run.failed
         // instead of orphaning events.jsonl.
-        return guardAnnouncedRun(resolved.signal, (announce) => {
-            switch (mode) {
-                case "ask":
-                    // `--deep-scan` widens the answer into the bounded multi-scout
-                    // research sweep with synthesis (the old `audit --swarm`/`explore`).
-                    return resolved.deepScan
-                        ? this.runDeepScan(resolved, announce)
-                        : this.runAsk(resolved, announce);
-                case "agent":
-                    // Engine strategies are FLAGS on agent (v0.9 collapse): `--until-clean`
-                    // and `--attempts` select the convergence loop; `--n` selects the race
-                    // width; `--create` switches the candidate intent to create_from_scratch.
-                    if (resolved.untilClean)
-                        return this.runConvergence(resolved, mode, null, announce);
-                    if (resolved.attempts !== undefined && resolved.attempts !== null) {
-                        return this.runConvergence(resolved, mode, resolved.attempts, announce);
-                    }
-                    return this.runRace({ ...resolved, n: resolved.n ?? 1 }, mode, announce);
-                case "plan":
-                    return this.runPlan(resolved, announce);
+        const releaseRunState = (settledRunId) => {
+            this.routingRationaleByRun.delete(settledRunId);
+            this.deps.delegationBudgetAuthority?.releaseRun(settledRunId);
+        };
+        try {
+            return await guardAnnouncedRun(resolved.signal, (announce) => {
+                switch (mode) {
+                    case "ask":
+                        // `--deep-scan` widens the answer into the bounded multi-scout
+                        // research sweep with synthesis (the old `audit --swarm`/`explore`).
+                        return resolved.deepScan
+                            ? this.runDeepScan(resolved, announce)
+                            : this.runAsk(resolved, announce);
+                    case "agent":
+                        // Engine strategies are FLAGS on agent (v0.9 collapse): `--until-clean`
+                        // and `--attempts` select the convergence loop; `--n` selects the race
+                        // width; `--create` switches the candidate intent to create_from_scratch.
+                        if (resolved.untilClean)
+                            return this.runConvergence(resolved, mode, null, announce);
+                        if (resolved.attempts !== undefined && resolved.attempts !== null) {
+                            return this.runConvergence(resolved, mode, resolved.attempts, announce);
+                        }
+                        return this.runRace({ ...resolved, n: resolved.n ?? 1 }, mode, announce);
+                    case "plan":
+                        return this.runPlan(resolved, announce);
+                }
+            }, async ({ runId }) => {
+                const authority = this.deps.delegationBudgetAuthority;
+                if (!authority?.hasParent(runId))
+                    return;
+                authority.beginParentClose(runId);
+                await authority.waitForChildren(runId);
+            }, 
+            // Single per-run terminalization hook: release the routing-rationale map
+            // entry on EVERY terminal (incl. a run that died before its telemetry
+            // writer ran, which is the leak this closes).
+            releaseRunState);
+        }
+        catch (error) {
+            // A durable startup sink may refuse `run.created` before the strategy can
+            // announce its context. Release only a delegated child ledger acquired by
+            // THIS invocation; a caller-supplied run-id collision must never release
+            // another live parent/child authority or its routing state.
+            if (delegatedLedgerAttached) {
+                this.deps.delegationBudgetAuthority?.releaseRun(runId);
             }
-        }, async ({ runId }) => {
-            const authority = this.deps.delegationBudgetAuthority;
-            if (!authority?.hasParent(runId))
-                return;
-            authority.beginParentClose(runId);
-            await authority.waitForChildren(runId);
-        }, 
-        // Single per-run terminalization hook: release the routing-rationale map
-        // entry on EVERY terminal (incl. a run that died before its telemetry
-        // writer ran, which is the leak this closes).
-        (runId) => {
-            this.routingRationaleByRun.delete(runId);
-            this.deps.delegationBudgetAuthority?.releaseRun(runId);
-        });
+            throw error;
+        }
     }
     async resolveReviewers(cwd, runAuthPreference, onIgnoredSetting) {
         if (this.deps.reviewers)
@@ -273,11 +294,7 @@ export class Orchestrator {
     }
     authPreferenceForHarness(repoRoot, harnessId, runAuthPreference) {
         const cfg = this.config(repoRoot)?.global;
-        const explicit = (v) => v && v !== "auto" ? v : undefined;
-        return (explicit(runAuthPreference) ??
-            explicit(cfg?.harnesses?.[harnessId]?.auth_preference) ??
-            explicit(cfg?.routing?.auth_preference) ??
-            "auto");
+        return effectiveAuthPreference(runAuthPreference, cfg?.harnesses?.[harnessId]?.auth_preference, cfg?.routing?.auth_preference);
     }
     artifactStore(input) {
         if (input.mode === "ask" && input.contextMode === "off" && input.repoRoot === NO_PROJECT_ROOT) {
@@ -300,20 +317,23 @@ export class Orchestrator {
     estimateUsdFloor(repoRoot) {
         return this.config(repoRoot)?.global.budget.estimate_usd_floor ?? 0.05;
     }
+    /** Delegate children overlap their still-running parent, so child-side paid
+     * units use the same bounded floor as later slots in a parallel wave. */
+    reservationEstimateUsd(input, parallel = false) {
+        return parallel || Boolean(input.delegatedFromRunId)
+            ? this.estimateUsdFloor(input.repoRoot)
+            : undefined;
+    }
     execRootOf(input) {
         return input.executionRoot ?? input.repoRoot;
     }
-    sessionSpecFields(input, harnessId, log) {
+    async sessionSpecFields(input, harnessId, log, defaultRoute = null) {
         const cfg = this.config(input.repoRoot)?.global;
-        const profile = this.preflightProfile(input, harnessId, log);
-        const explicit = (v) => (v && v !== "auto" ? v : undefined);
+        const profile = await this.preflightProfile(input, harnessId, log, defaultRoute);
         return {
             // "auto" at ANY level falls through (thread turns send the thread default
             // "auto" as a per-run value; it must not shadow a configured preference).
-            auth_preference: explicit(input.authPreference) ??
-                explicit(cfg?.harnesses?.[harnessId]?.auth_preference) ??
-                explicit(cfg?.routing?.auth_preference) ??
-                "auto",
+            auth_preference: effectiveAuthPreference(input.authPreference, cfg?.harnesses?.[harnessId]?.auth_preference, cfg?.routing?.auth_preference),
             resume_session_id: resumeSessionForProfile(input.resumeSessions?.[harnessId], profile),
             credential_profile: profile,
         };
@@ -388,19 +408,74 @@ export class Orchestrator {
         const policy = this.config(repoRoot)?.global.harnesses?.[harnessId]?.profile_policy;
         return policy ?? { limit_action: "fail", rotation_eligible: [], headroom_threshold: 0.9 };
     }
-    preflightProfile(input, harnessId, log) {
+    /** The quota poller's authenticated vendor evidence for THIS decision epoch,
+     * read once so every profile in the epoch is judged against one observation
+     * set. This is what makes profile readiness at admission mean the same thing
+     * it means on the Accounts card (INV-135 honesty). */
+    vendorQuotaObservations() {
+        return {
+            snapshots: this.deps.quotaSnapshots?.() ?? [],
+            absences: this.deps.quotaAbsences?.() ?? [],
+        };
+    }
+    /** Fresh profile readiness for one rotation decision epoch. Accounts uses
+     * the same probe wrapper + vendor overlay + admission predicate when
+     * projecting next_up. */
+    async readyProfileIdsForRotation(input, harnessId, current, excluded = new Set()) {
+        const profiles = staticRotationCandidates({
+            registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
+            harnessId,
+            policy: this.profilePolicy(input.repoRoot, harnessId),
+            current,
+            excluded,
+        });
+        const adapter = this.deps.registry.get(harnessId);
+        const quota = this.vendorQuotaObservations();
+        const entries = await Promise.all(profiles.map(async (profile) => ({
+            profile,
+            // Rotating INTO a profile the vendor has already rejected would spend a
+            // whole attempt to rediscover the 401 the poller reported a minute ago.
+            status: vendorVerifiedProfileStatus(await probeCredentialProfileStatus(profile, adapter?.probeCredentialProfile?.bind(adapter)), quota),
+        })));
+        return new Set(entries
+            .filter(({ profile, status }) => profileStatusAdmits(profile, status))
+            .map(({ profile }) => profile.profile_id));
+    }
+    async preflightProfile(input, harnessId, log, defaultRoute) {
         const profile = this.resolveCredentialProfile(input, harnessId);
         const policy = this.profilePolicy(input.repoRoot, harnessId);
         const registry = this.config(input.repoRoot)?.global.credential_profiles ?? [];
         const snapshots = this.deps.quotaSnapshots?.() ?? [];
         const emit = (type, payload) => log?.emit(type, payload);
+        const breach = profileHeadroomBreach(snapshots, harnessId, profile?.profile_id ?? null, policy.headroom_threshold);
+        const readyProfileIds = policy.limit_action === "rotate" &&
+            breach !== null &&
+            (profile !== null || defaultRoute === "local_session")
+            ? await this.readyProfileIdsForRotation(input, harnessId, profile)
+            : new Set();
         if (!profile) {
             // Unpinned runs (INV-135 auto-balance): under `rotate`, a fresh
             // default-subject headroom breach starts on the next eligible
             // subscription profile instead; `fail`/`ask` change nothing.
-            return preflightDefaultSubject({ harnessId, policy, registry, snapshots, emit });
+            return preflightDefaultSubject({
+                harnessId,
+                policy,
+                registry,
+                snapshots,
+                readyProfileIds,
+                defaultRoute,
+                emit,
+            });
         }
-        return preflightCredentialProfile({ profile, harnessId, policy, registry, snapshots, emit });
+        return preflightCredentialProfile({
+            profile,
+            harnessId,
+            policy,
+            registry,
+            snapshots,
+            readyProfileIds,
+            emit,
+        });
     }
     /**
      * Resolve candidate adapters: explicit `--harness`, else available real harnesses, then
@@ -477,6 +552,27 @@ export class Orchestrator {
                 }
             }
         }
+        const attachments = input.attachments ?? [];
+        // Resolve the complete attachment pool once from manifest truth. If any
+        // lane still lacks usable discovery truth, preserve the existing per-lane
+        // discovery/doctor precedence and resolve that lane inside the route loop.
+        const canResolveAttachmentPool = attachments.length > 0 &&
+            ids.every((id) => {
+                const status = statusById.get(id);
+                return status?.manifest != null && status.status !== "unavailable";
+            });
+        const attachmentPoolAdmission = canResolveAttachmentPool
+            ? this.requestRequirements.resolveAttachmentPool(explicitPool ? "explicit" : "auto", attachments, ids.map((id) => ({
+                harnessId: id,
+                declarations: statusById.get(id)?.manifest?.capability_profile.attachment_inputs ?? null,
+                available: true,
+            })))
+            : null;
+        if (attachmentPoolAdmission?.outcome === "refused") {
+            throw new HarnessUnavailableError(attachmentPoolAdmission.message ??
+                "no available harness lane can receive the selected attachments");
+        }
+        const attachmentRejectionById = new Map(attachmentPoolAdmission?.rejected.map((admission) => [admission.harnessId, admission]) ?? []);
         const policy = input.web ?? input.externalContextPolicy ?? "auto";
         const pool = [];
         const dropped = [];
@@ -495,6 +591,9 @@ export class Orchestrator {
             dropped.push(detail);
             droppedLanes.push({ harnessId, stage, detail });
         };
+        // One observation set for the whole admission pass, so two lanes cannot be
+        // judged against different vendor epochs.
+        const vendorQuota = this.vendorQuotaObservations();
         for (const id of ids) {
             const adapter = this.deps.registry.get(id);
             if (!adapter) {
@@ -558,6 +657,11 @@ export class Orchestrator {
                 profileId: this.effectiveProfileId(input, id),
                 harnessId: id,
                 probe: profileAdapter?.probeCredentialProfile?.bind(profileAdapter),
+                // `verification: passed` from the local store only means a login file
+                // is present. The poller's authenticated vendor call is the only
+                // liveness evidence we have, and admission is the surface that must
+                // act on it — otherwise the run dispatches into a revoked token.
+                quota: vendorQuota,
             });
             if (profileVerdict !== null) {
                 if (profileVerdict === "available") {
@@ -590,7 +694,7 @@ export class Orchestrator {
             const readOnlyIntent = intent === "plan" || intent === "spec" || intent === "explain" || intent === "audit";
             const requiredAccess = this.requestRequirements.adapterAccess(intent, manifest.capabilities.implementation_transport, readOnlyIntent
                 ? "readonly"
-                : (input.access ?? this.config(input.repoRoot).trust.access_default));
+                : (input.access ?? this.config(input.repoRoot).trust.access_default), externallyConfinedLane(input.delegated === true));
             const accessSupported = !requiredAccess || manifest.access_profiles_supported.includes(requiredAccess);
             const webSupport = manifest.capabilities.web_policy;
             // Match routeSpecKnobs: a per-harness web default upgrades run-level auto,
@@ -610,9 +714,10 @@ export class Orchestrator {
                 dropLane(id, "web", why);
                 continue;
             }
-            const attachmentRefusal = this.requestRequirements.attachmentRefusal(id, input.attachments ?? [], manifest.capability_profile.attachment_inputs);
-            if (attachmentRefusal) {
-                dropLane(id, "attachment", attachmentRefusal);
+            const attachmentAdmission = attachmentRejectionById.get(id) ??
+                this.requestRequirements.resolveAttachmentLane(id, attachments, manifest.capability_profile.attachment_inputs);
+            if (!attachmentAdmission.admitted) {
+                dropLane(id, "attachment", attachmentAdmission.message ?? `${id} rejects attachments`);
                 continue;
             }
             const reason = status.reasons.length > 0 ? `: ${status.reasons.join("; ")}` : "";
@@ -981,119 +1086,9 @@ export class Orchestrator {
         return this.config(repoRoot).project;
     }
     buildContract(input, taskId, mode) {
-        const resolvedCfg = this.config(input.repoRoot);
-        const cfg = resolvedCfg.project;
-        const readOnlyMode = mode === "ask" || mode === "plan";
-        const requestedAccess = input.access ?? (readOnlyMode ? "readonly" : resolvedCfg.trust.access_default);
-        // Effective access is COMPUTED by the engine, never echoed from a client:
-        // read-only modes clamp to readonly regardless of the request.
-        const effectiveAccess = readOnlyMode ? "readonly" : requestedAccess;
-        // TrustConfig is USER-LEVEL only (versioned repo config must never
-        // self-grant sensitive powers): unsandboxed full access requires an
-        // explicit allow in ~/.claudexor trust settings — loud error, no downgrade.
-        // The gate applies to the EFFECTIVE profile: a read-only run clamped to
-        // readonly never runs unsandboxed and needs no trust allow.
-        if (effectiveAccess === "full" && !resolvedCfg.trust.allow_full_access) {
-            // Typed refusal: the `code` rides the daemon job record onto the thread
-            // turn (TurnEnqueueError.code), so surfaces key remedies on the CODE —
-            // never on substring-matching this human message.
-            throw Object.assign(new Error(`access profile 'full' requires allow_full_access: true in the user-level trust file for this repo ` +
-                `(${trustConfigPath(input.repoRoot)}); enable it with \`claudexor trust --allow-full-access\` — refusing to run unsandboxed`), 
-            // Refusal semantics are born at the throw (W24): the one-time grant is
-            // a 403, and the daemon persists this status onto the job record.
-            { code: TRUST_FULL_ACCESS_CODE, status: 403 });
-        }
-        const externalContextPolicy = input.web ?? input.externalContextPolicy ?? "auto";
-        // Deterministic gate commands come from explicit run input, then versioned
-        // project config. Without these, gateSpecs is empty and convergence is
-        // review-only; with them, convergence is test-driven.
-        const resolvedGates = resolveContractGates({
-            repoRoot: input.repoRoot,
-            effectiveAccess,
-            config: cfg,
-            trustGrants: resolvedCfg.trust.test_command_grants,
-            operatorCommands: input.tests ?? [],
-            projectCommands: cfg.tests?.commands ?? [],
-        });
-        const commands = resolvedGates.commands;
-        const protectedPaths = [...new Set(cfg.constraints.protected_paths)];
-        const autoProtectedPaths = resolvedGates.autoProtectedPaths;
-        const protectedPathApprovals = [
-            ...new Map([...(input.protectedPathApprovals ?? [])].map((approval) => [approval.path, approval])).values(),
-        ];
-        return TaskContractSchema.parse({
-            schema_version: SCHEMA_VERSION,
-            task_id: taskId,
-            created_at: nowIso(),
-            repo: { root: input.repoRoot, base_ref: input.baseRef ?? "HEAD", dirty_policy: "snapshot" },
-            mode: { kind: mode },
-            delegation_requested: input.delegate === true,
-            run_lineage: {
-                parent_run_id: input.parentRunId ?? null,
-                delegated_from_run_id: input.delegatedFromRunId ?? null,
-            },
-            user_intent: { raw: redactSecrets(input.prompt) },
-            // Redacted for symmetry with user_intent.raw — a no-op on fenced input
-            // (the inline-secret fence already blocked any secret-like value at every
-            // ingress incl. this engine boundary), so task-producing lanes read back
-            // the real instructions via harnessSpecKnobs().
-            instructions: input.instructions === undefined ? undefined : redactSecrets(input.instructions),
-            // Already normalized/strictified at the engine boundary (run() refuses
-            // unsupported shapes before any run dir exists).
-            output_schema: input.outputSchema ?? null,
-            auth_preference: input.authPreference ?? "auto",
-            credential_profile_id: input.credentialProfileId ?? null,
-            max_turns: input.maxTurns ?? null,
-            constraints: {
-                protected_paths: protectedPaths,
-                deny_paths: [...new Set(input.denyPaths ?? [])],
-                auto_protected_paths: autoProtectedPaths,
-                protected_path_approvals: protectedPathApprovals,
-            },
-            tests: { commands },
-            access: {
-                requested_profile: requestedAccess,
-                effective_profile: effectiveAccess,
-            },
-            external_context: {
-                policy: externalContextPolicy,
-                web_required: externalContextPolicy === "cached" || externalContextPolicy === "live",
-                // Per-route upgrades (e.g. claude cached->live) are disclosed in events
-                // and telemetry.yaml; the immutable contract records the requested policy.
-                effective_mode: externalContextPolicy,
-            },
-            // Harness-native tool names are adapter knowledge; the neutral contract
-            // carries only the policy plus user-configured allow/deny lists (wired
-            // from per-harness settings).
-            tool_permission_policy: {
-                web: externalContextPolicy,
-                allow: [],
-                deny: [],
-            },
-            budget: {
-                routing_goal: input.routingGoal ?? this.deps.routingGoal ?? cfg?.budget?.routing_goal ?? "auto",
-                paid_budget: this.resolvePaidBudget(input.paidBudget, resolvedCfg),
-            },
-            // The resolved harness-scoped model map (scalar already expanded to the
-            // primary by resolveRunInput). The contract is what route spec building
-            // reads — there is no run-global model (INV-103).
-            routing_models: input.models ?? {},
-            // QA-035: freeze the RESOLVED reasoning-effort per known lane so Exact
-            // Retry replays it instead of re-resolving current settings. Precedence
-            // (specific beats general): the harness-scoped `efforts` map entry, then a
-            // per-turn scalar `input.effort`, then the harness settings default — the
-            // same map that Exact Retry replays so a NON-PRIMARY lane keeps its own
-            // frozen effort (QA-035 completeness). Only known-pool lanes are frozen
-            // here (a pure auto pool's lanes resolve later — documented seam).
-            routing_efforts: Object.fromEntries([...new Set([...(input.harnesses ?? []), ...Object.keys(input.efforts ?? {})])]
-                .map((hid) => [
-                hid,
-                input.efforts?.[hid] ??
-                    input.effort ??
-                    resolvedCfg.global.harnesses?.[hid]?.effort ??
-                    null,
-            ])
-                .filter((entry) => entry[1] !== null)),
+        return buildTaskContract(input, taskId, mode, {
+            paidBudget: this.deps.paidBudget,
+            routingGoal: this.deps.routingGoal,
         });
     }
     /**
@@ -1172,9 +1167,9 @@ export class Orchestrator {
     /**
      * D-16: the WorkReport transport envelope for one route. Called at every
      * task-producing spec-build site AFTER harnessSpecKnobs so it OVERRIDES the
-     * plain caller-schema transport with the compiled `{work_report, output}`
-     * envelope on capable routes. The returned `mode` is retained by the caller
-     * and handed to `unwrapWorkReportEnvelope` when the answer is finalized.
+     * plain caller-schema transport with the resolved WorkReport channel on
+     * capable routes. The returned `mode` is retained by the caller and handed
+     * to `unwrapWorkReportEnvelope` when the answer is finalized.
      */
     workReportEnvelopeFor(routed, contract, interactive) {
         return resolveWorkReportEnvelope({
@@ -1188,7 +1183,7 @@ export class Orchestrator {
     /**
      * D-16: apply the resolved WorkReport transport to a built spec — set the
      * envelope output_schema (constrained/side_tool routes) and APPEND the fenced
-     * envelope instruction (validated routes, e.g. cursor). Mutates the spec in
+     * metadata instruction (validated routes, e.g. cursor). Mutates the spec in
      * place and returns the mode the answer unwrap consumes. Called at every
      * task-producing spec-build site so the transport is never wired one-off.
      */
@@ -1265,7 +1260,7 @@ export class Orchestrator {
      * Returns null (no packet, no pointer) for native resume, a fresh thread, or
      * a non-thread run. Never throws: continuity failure degrades to no packet.
      */
-    async resolveContinuity(runInput, harnessId, resolvedProfileId, nativeResumeAvailable, store, paths, repoRoot, log) {
+    async resolveContinuity(runInput, harnessId, resolvedProfileId, nativeResumeAvailable, sessionFields, store, paths, repoRoot, log) {
         const ctx = runInput.threadContinuity;
         if (!runInput.threadId || !ctx)
             return null;
@@ -1303,7 +1298,6 @@ export class Orchestrator {
             // summary. Same credential route + scoped lane home a real read-only
             // thread turn uses (INV-034/135). Best-effort in its OWN guard — a summary
             // failure keeps the full mechanical packet, never drops it.
-            const sessionFields = this.sessionSpecFields(runInput, harnessId);
             req.cachedSummary = await resolveContinuitySummary({
                 req,
                 threadId: runInput.threadId,
@@ -1361,30 +1355,51 @@ export class Orchestrator {
             return { pointerLine: null };
         }
     }
-    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access = "workspace_write", onHarnessEvent, signal, modelHint, effortHint, intent = "implement", log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas = false, fileBackedContext, 
+    /**
+     * The ONE place an attempt's HOME and OS boundary are decided.
+     *
+     * Called by every caller of `runCandidateInEnvelope` INSIDE that caller's
+     * try, so a delegated refusal is caught by the same catch that writes the
+     * attempt record, and so the decided home is in scope there.
+     */
+    harnessHomeFor(wsm, envelope, routed, runInput) {
+        // Refuses (never silently degrades) when a delegated run cannot be confined.
+        return scopedHarnessHome(wsm, envelope, envelope.worktree_path === envelope.repo_root, runInput?.delegated === true, routed.adapterAccess);
+    }
+    async runCandidateInEnvelope(routed, envelope, attemptId, label, contract, prompt, store, paths, wsm, ledger, access, onHarnessEvent, signal, modelHint, effortHint, intent, log, effectiveWebMode, interaction, budgetGuard, runInput, streamDeltas, fileBackedContext, 
     /** D-16d: when set, the mechanical continuation checkpoint pointer for a
      * one-shot fresh-session continuation — appended to the prompt so the model
      * (and the offline fake) re-grounds in the exhausted attempt's partial work. */
-    continuationPointer) {
+    continuationPointer, 
+    /** Decided by `harnessHomeFor` in the CALLER, so the per-attempt applied
+     * facts exist in the caller's catch too: an attempt that ran and then threw
+     * must record what it ran under, not just why it stopped. REQUIRED (no
+     * default): a silent fallback here would spawn a delegated child on the
+     * operator's real home while the record still claimed confinement. */
+    harnessHome) {
         const adapter = routed.adapter;
         const knobs = this.routeSpecKnobs(routed, contract, modelHint, effortHint);
         // Isolated scoped-home sessions are never retained after disposal.
         const inPlaceEnvelope = envelope.worktree_path === envelope.repo_root;
         const rawContextPacket = await rawContextForEnvelope(routed.implementationTransport, envelope);
-        const sessionFields = runInput ? this.sessionSpecFields(runInput, adapter.id, log) : undefined;
+        const sessionFields = runInput
+            ? await this.sessionSpecFields(runInput, adapter.id, log, routed.authRouteEstimate)
+            : undefined;
         // Continuity (INV-137): once the lane (harness + resolved profile) is known,
         // build the continuation packet, materialize context/THREAD.md, and point
         // the prompt at it — never embed the packet body in the prompt. Replaces the
         // old static session.rebound "not_portable" phrase with a real disclosure.
         const laneContinuity = runInput
-            ? await this.resolveContinuity(runInput, adapter.id, sessionFields?.credential_profile?.profile_id ?? runInput.credentialProfileId ?? null, inPlaceEnvelope && !!sessionFields?.resume_session_id, store, paths, envelope.repo_root, log)
+            ? await this.resolveContinuity(runInput, adapter.id, sessionFields?.credential_profile?.profile_id ?? runInput.credentialProfileId ?? null, inPlaceEnvelope && !!sessionFields?.resume_session_id, sessionFields, store, paths, envelope.repo_root, log)
             : null;
         let spec = HarnessRunSpec.parse({
             session_id: newId("ses"),
             intent,
             // Engine-derived read-only prompt constraints: protected/auto-protected
             // paths PLUS the exact typed gate argv the run will execute (QA-022 FIX B).
-            prompt: promptWithEngineConstraints([prompt, laneContinuity?.pointerLine, continuationPointer]
+            prompt: promptWithEngineConstraints(
+            // A child running without an OS boundary is TOLD so (disclosure 2 of 3).
+            [prompt, confinementNotice(harnessHome), laneContinuity?.pointerLine, continuationPointer]
                 .filter((s) => typeof s === "string" && s.length > 0)
                 .join("\n\n"), contract.constraints.protected_paths, contract.constraints.auto_protected_paths, contract.constraints.protected_path_approvals, contract.tests.commands),
             attachments: runInput?.attachments ?? [],
@@ -1406,9 +1421,14 @@ export class Orchestrator {
             ...(inPlaceEnvelope && sessionFields?.resume_session_id
                 ? { resume_session_id: sessionFields.resume_session_id }
                 : {}),
-            // Scoped harness home only for isolated envelopes; in-place runs use the
-            // native environment so the resumed vendor session is actually reachable.
-            ...(inPlaceEnvelope ? {} : { env: wsm.envFor(envelope) }),
+            // Scoped harness home for isolated envelopes AND for every delegated run;
+            // an ordinary in-place run keeps the native environment so the resumed
+            // vendor session is reachable. See scopedHarnessHome for the cost a
+            // delegated in-place attempt pays for that confinement.
+            ...(harnessHome.env ? { env: harnessHome.env } : {}),
+            // The OS boundary itself. The shared CLI run loop wraps the argv with it;
+            // no adapter opts in, so no adapter can forget.
+            confinement: harnessHome.confinement,
             raw_context_packet: rawContextPacket,
             stream_deltas: streamDeltas,
         });
@@ -1419,6 +1439,9 @@ export class Orchestrator {
         const workEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(interaction));
         const workReportMode = this.applyWorkEnvelope(spec, workEnvelope);
         const inactivityMs = harnessInactivityTimeoutMs(this.config(contract.repo.root));
+        // Named once: the attempt record, the CandidateRun and the terminal gate all
+        // read the SAME applied facts rather than three re-derivations.
+        const applied = appliedAttemptFacts(harnessHome, spec.access, sessionFields?.credential_profile?.profile_id ?? runInput?.credentialProfileId ?? null);
         const attemptStartedMs = Date.now();
         const budgetSignalState = { quotaPressureDisclosed: false };
         const triedProfiles = new Set(); // W5.4 failover: each profile at most once
@@ -1480,13 +1503,16 @@ export class Orchestrator {
                 try {
                     const watched = withInactivityWatchdog(adapter.run(runSpec), {
                         timeoutMs: inactivityMs,
+                        countsAsProgress: countsAsAgentProgress,
                         onTimeout: () => {
                             attemptAbort.abort();
                             void adapter.cancel?.(activeSessionId)?.catch(() => { });
                         },
-                        // Waiting on the USER (pending interaction) is legitimate
-                        // silence — the interaction channel enforces its own wait budget.
+                        // Waiting on the USER is legitimate silence. The interaction policy
+                        // either enforces a finite deadline or waits until answer/cancel/
+                        // terminal/restart when the timeout is disabled.
                         isSuspended: () => (interaction?.pendingCount?.() ?? 0) > 0,
+                        suspensionVersion: () => interaction?.suspensionVersion?.() ?? 0,
                     });
                     for await (const ev of watched) {
                         if (signal?.aborted)
@@ -1616,13 +1642,18 @@ export class Orchestrator {
                 // W5.4 failover: a typed-limit hit rebuilds the spec on a NEW vendor
                 // session under the next profile with provenance (vendor_limit_rejected).
                 if (harnessErrored && runInput && !signal?.aborted) {
+                    const rotationPolicy = this.profilePolicy(contract.repo.root, adapter.id);
+                    const readyProfileIds = sawTypedLimit && deliverableEmpty && rotationPolicy.limit_action === "rotate"
+                        ? await this.readyProfileIdsForRotation(runInput, adapter.id, spec.credential_profile ?? null, triedProfiles)
+                        : new Set();
                     const rotated = rotateSpecOnTypedLimit({
                         spec,
                         harnessId: adapter.id,
                         attemptId,
-                        policy: this.profilePolicy(contract.repo.root, adapter.id),
+                        policy: rotationPolicy,
                         registry: this.config(contract.repo.root)?.global.credential_profiles ?? [],
                         snapshots: this.deps.quotaSnapshots?.() ?? [],
+                        readyProfileIds,
                         triedProfiles,
                         sawTypedLimit,
                         deliverableEmpty,
@@ -1679,7 +1710,7 @@ export class Orchestrator {
         if (webUnsatisfied(telemetry)) {
             errors.push(webEvidenceFailure(telemetry.web));
         }
-        // D-16: un-nest {work_report, output} so answer.md persists the OUTPUT, not the envelope.
+        // D-16: remove the WorkReport transport so answer.md persists only the deliverable.
         const unwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", workReportMode, {
             sideToolReport: telemetry.sideToolWorkReport ?? undefined,
         });
@@ -1782,6 +1813,10 @@ export class Orchestrator {
                 ...(secretDiffRefusal ? { secret_diff_refusal: secretDiffRefusal } : {}),
                 gates: gates.map((g) => ({ id: g.id, status: g.status })),
                 branch: envelope.branch_name,
+                // Applied facts, not promises: the caller of a delegated run
+                // verifies the confinement it asked for instead of trusting it.
+                // Built by the SAME shape the failure path writes.
+                ...applied,
             },
         }), {
             totalUsd: cost,
@@ -1805,6 +1840,7 @@ export class Orchestrator {
             telemetry,
             ...(secretDiffRefusal ? { secretDiffRefusal } : {}),
             outcomeClass: finalized.outcomeClass,
+            applied,
         };
     }
     interactionChannelFor(input, log, runId, taskId, attemptId, harnessId, 
@@ -1814,66 +1850,17 @@ export class Orchestrator {
         // Thin delegate — the channel mechanics live in interaction.ts.
         return interactionChannelFor(input, log, runId, taskId, attemptId, harnessId, supportsInteractive, DEFAULT_INTERACTION_TIMEOUT_MS);
     }
-    /**
-     * Guarantee a git boundary for write-mode runs. Non-git project folders are
-     * initialized in place (`git init`, deterministic baseline commit) without
-     * creating or editing `.gitignore`, and the action is announced via a
-     * `project.git.initialized` event. Returns the failure message when the
-     * boundary cannot be established (the terminal failure events are already
-     * emitted); null on success.
-     */
-    async ensureWriteModeGitBoundary(repoRoot, log, store, paths, runId, mode) {
-        if (repoRoot === NO_PROJECT_ROOT)
-            return null;
-        try {
-            const result = await ensureGitRepository(repoRoot);
-            if (result.initialized || result.baselineCommitted) {
-                log.emit("project.git.initialized", {
-                    repo_root: repoRoot,
-                    initialized: result.initialized,
-                    baseline_committed: result.baselineCommitted,
-                    gitignore_seeded: result.gitignoreSeeded,
-                    head_sha: result.headSha,
-                });
-            }
-            return null;
-        }
-        catch (err) {
-            const message = safeErrorMessage(err);
-            writeFailure(store, paths, {
-                phase: "workspace",
-                category: "project",
-                safeMessage: message,
-                runDir: paths.root,
-                nextActions: [
-                    "Check the project folder permissions",
-                    "Initialize git manually (git init)",
-                    "Retry the run",
-                ],
-            });
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: failed\n- Phase: workspace\n\n${message}\n`);
-            log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
-            log.emit("run.failed", {
-                lifecycle: "failed",
-                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
-                reason: "harness_failed",
-                phase: "workspace",
-                error: message,
-                failure_ref: "final/failure.yaml",
-            });
-            return message;
-        }
-    }
     /**
      * D-14 layer 3 (AGENTS.md unification, INV-113): the ONE new live-tree write.
      * When the PROJECT root has `AGENTS.md` and no `CLAUDE.md`, drop a thin
      * `CLAUDE.md` (`@AGENTS.md` import + Claudexor ownership marker) so a Claude
      * Code route reads the same instruction file codex/cursor read natively.
      *
-     * Fenced exactly where the automatic git-init boundary is: read-only modes
-     * never reach this run-prep stage; `--in-place` stateful targets are left
-     * untouched; the write targets the PROJECT root (`repoRoot`), never a worktree
-     * envelope. The workspace helper adds exclusive-create + no-follow +
+     * The project-root bridge has its own narrower fence: read-only modes never
+     * reach this run-prep stage and `--in-place` stateful targets are left
+     * untouched. Git admission is independently owned by `runStartRequiresGit`.
+     * The write targets the PROJECT root (`repoRoot`), never a worktree envelope.
+     * The workspace helper adds exclusive-create + no-follow +
      * idempotency, so a hand-written or symlinked `CLAUDE.md` is never overwritten
      * and a concurrent/second prep is a no-op. Announced via a typed
      * `project.claude_bridge.created` event on an actual create only — the git-init
@@ -1898,37 +1885,6 @@ export class Orchestrator {
             });
         }
     }
-    /**
-     * Freeze-on-implement delivery (D17/D27): verify the frozen plan's hash and
-     * materialize it as context/PLAN.md in the run artifact tree — OUTSIDE every
-     * worktree, so it can never dirty a diff — then point the prompt at the
-     * absolute path. A mismatched or unreadable plan fails LOUDLY before any
-     * harness spawns (the tamper fence; retry replays planRef verbatim, so a
-     * retried implement can never silently run without its plan).
-     */
-    withPlanBrief(input, store, paths, log) {
-        if (!input.planRef)
-            return input;
-        const text = readTextSafe(input.planRef.path);
-        if (!text || !text.trim()) {
-            throw new Error(`implement plan: the frozen plan at ${input.planRef.path} is missing or unreadable`);
-        }
-        const digest = sha256(text).replace(/^sha256:/, "");
-        if (digest !== input.planRef.sha256) {
-            throw new Error(`implement plan: plan hash mismatch (expected ${input.planRef.sha256}, got ${digest}) — the plan was modified after freeze; re-run Implement from the plan turn`);
-        }
-        const briefPath = join(paths.contextDir, "PLAN.md");
-        store.writeText(briefPath, text);
-        log.emit("plan.brief.materialized", {
-            plan_run_id: input.planRef.runId,
-            sha256: input.planRef.sha256,
-            path: "context/PLAN.md",
-        });
-        return {
-            ...input,
-            prompt: `${input.prompt}\n\nThe approved plan is at: ${briefPath} — read it before starting and re-read it as needed.`,
-        };
-    }
     async runRace(input, mode, announce) {
         const taskId = input.taskId ?? newId("task");
         const runId = input.runId ?? newId("run");
@@ -1936,20 +1892,28 @@ export class Orchestrator {
         // announced: a refused run must fail the request loudly, not 200 a runId
         // and leave an orphaned run dir without a terminal event.
         const contract = this.buildContract(input, taskId, mode);
-        const store = this.artifactStore(input);
-        const paths = store.createRun(runId);
-        const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
-        input = this.withPlanBrief(input, store, paths, log);
-        // The execution root is the tree the harness mutates: the project itself for
-        // in-place threads/ordinary runs, or the thread's persistent worktree for an
-        // isolated thread. Config/artifacts/contract stay anchored to repoRoot. Both
-        // the WorkspaceManager and the git boundary resolve against this SINGLE root.
+        const planBrief = verifiedPlanBrief(input);
+        const quotaSnapshots = this.quotaSnapshotPreflight();
+        const { store, paths, log, ledger } = beginAnnouncedRun({
+            input,
+            contract,
+            quotaSnapshots,
+            store: this.artifactStore(input),
+            authority: this.deps.delegationBudgetAuthority,
+            runId,
+            taskId,
+            mode,
+            phase: "race",
+            prompt: input.prompt,
+        }, announce);
+        input = withPlanBrief(input, store, paths, log, planBrief);
+        // The execution root is the tree the harness mutates: the project itself
+        // for in-place threads/ordinary runs, or the thread's persistent worktree
+        // for an isolated thread. Config/artifacts/contract stay anchored to
+        // repoRoot. Both the WorkspaceManager and the git boundary resolve against
+        // this SINGLE root.
         const execRoot = this.execRootOf(input);
         const wsm = new WorkspaceManager(execRoot);
-        safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
-        log.emit("run.created", { mode, prompt: redactSecrets(input.prompt) });
-        const ledger = this.rootLedger(input, contract, log);
-        announce?.(announcedRunContext({ log, store, paths, runId, taskId, mode, phase: "race" }, ledger, () => this.deps.delegationBudgetAuthority?.hasParent(runId) === true));
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // Write modes need a git boundary for worktree isolation and honest diffs.
@@ -1958,17 +1922,17 @@ export class Orchestrator {
         // silent mutation (user-locked decision, comparator: Codex requires git).
         // For an isolated thread the execution root is already a git worktree, so
         // this is a no-op there; for in-place it ensures the live project is git.
-        const gitPreconditionError = await this.ensureWriteModeGitBoundary(execRoot, log, store, paths, runId, mode);
+        const gitPreconditionError = await ensureWriteModeGitBoundary(execRoot, log, store, paths, runId, mode);
         if (gitPreconditionError) {
             return {
                 runId,
                 taskId,
                 mode,
                 lifecycle: "failed",
-                facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                facts: makeOutcomeFacts("failed", { reason: gitPreconditionError.reason }),
                 winner: null,
                 runDir: paths.root,
-                summary: gitPreconditionError,
+                summary: gitPreconditionError.message,
                 candidates: [],
             };
         }
@@ -2066,7 +2030,7 @@ export class Orchestrator {
                 attemptId,
                 intent: this.candidateIntent(input),
                 harnessId: routed.adapter.id,
-                cost: attemptCostEvidence(routed.adapter.id, attemptId, i > 0 ? this.estimateUsdFloor(input.repoRoot) : undefined, this.routeBillingKnowledge(input, routed.adapter.id)),
+                cost: attemptCostEvidence(routed.adapter.id, attemptId, this.reservationEstimateUsd(input, i > 0), this.routeBillingKnowledge(input, routed.adapter.id)),
             });
             log.emit("budget.lease.created", {
                 granted: lease.granted,
@@ -2146,6 +2110,9 @@ export class Orchestrator {
             const knobs = this.routeSpecKnobs(slot.routed, contract, downgradeModel ?? undefined, input.effort);
             const effectiveWeb = this.discloseWebUpgrade(log, slot.routed, knobs.webPolicy, slot.attemptId);
             let envelope;
+            // Declared OUTSIDE the try so the catch below can state what the attempt
+            // actually ran under, not merely that it stopped.
+            let harnessHome;
             try {
                 log.emit("harness.started", {
                     harness_id: adapter.id,
@@ -2165,6 +2132,7 @@ export class Orchestrator {
                         requestedSingleCandidate &&
                         slot.routed.implementationTransport !== "git_patch_envelope",
                 });
+                harnessHome = this.harnessHomeFor(wsm, envelope, slot.routed, input);
                 const run = await this.runCandidateInEnvelope(slot.routed, envelope, slot.attemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
                     const safeEv = redactHarnessEvent(ev);
                     safeInvoke(input.onHarnessEvent, safeEv);
@@ -2175,7 +2143,8 @@ export class Orchestrator {
                         return false;
                     budgetStopped = true;
                     return true;
-                }, input, requestedSingleCandidate);
+                }, input, requestedSingleCandidate, // W-C4 deltas: single-candidate chat lane only (racing = noise x N)
+                undefined, undefined, harnessHome);
                 ledger.settle(slot.leaseId, attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
@@ -2232,6 +2201,13 @@ export class Orchestrator {
                                 continuation_count: candidateContinuationCount,
                                 packet_turns: packet.continuity.disclosure.packetTurns,
                             });
+                            log.emit("harness.started", {
+                                harness_id: adapter.id,
+                                attempt_id: contAttemptId,
+                                external_context_policy: knobs.webPolicy,
+                                ...(knobs.ignored.length > 0 ? { ignored_settings: knobs.ignored } : {}),
+                                continuation_of: run.attemptId,
+                            });
                             const contLeaseId = contLease.lease?.lease_id ?? "";
                             try {
                                 const contRun = await this.runCandidateInEnvelope(slot.routed, envelope, contAttemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
@@ -2244,7 +2220,7 @@ export class Orchestrator {
                                         return false;
                                     budgetStopped = true;
                                     return true;
-                                }, input, requestedSingleCandidate, undefined, packet.pointerLine ?? undefined);
+                                }, input, requestedSingleCandidate, undefined, packet.pointerLine ?? undefined, harnessHome);
                                 ledger.settle(contLeaseId, attemptUsageCostSettlement(contRun.cost, contRun.costEstimated, contRun.attemptId, contRun.harnessId, contRun.telemetry.authMode, contRun.telemetry.usageCost));
                                 log.emit("harness.completed", {
                                     harness_id: adapter.id,
@@ -2290,6 +2266,7 @@ export class Orchestrator {
                 const failureCost = AC.attemptFailureCost(err, "post-stream-error", 0);
                 ledger.settle(slot.leaseId, failureCost.settlement);
                 const message = safeErrorMessage(err);
+                const declared = declaredFailure(err);
                 const infraPhase = envelope === undefined ? "workspace" : "harness";
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
@@ -2298,7 +2275,7 @@ export class Orchestrator {
                     error: message,
                     phase: infraPhase,
                 });
-                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message));
+                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message, appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.effectiveProfileId(input, adapter.id))));
                 runsBySlot[slotIdx] = {
                     attemptId: slot.attemptId,
                     harnessId: adapter.id,
@@ -2315,6 +2292,11 @@ export class Orchestrator {
                         slot.routed.delegationRequirement,
                     ], knobs.model),
                     infraPhase,
+                    // Keep a TYPED pre-spawn refusal (spent quota window + its reset)
+                    // alive past this catch; `message` alone would force the terminal to
+                    // read prose back out.
+                    ...(declared.code ? { declaredFailure: declared } : {}),
+                    applied: appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.effectiveProfileId(input, adapter.id)),
                 };
             }
             finally {
@@ -2324,6 +2306,9 @@ export class Orchestrator {
         };
         await runBounded(slots, Math.min(slots.length, MAX_PARALLEL_CANDIDATES), runSlot);
         const runs = runsBySlot.filter((r) => r !== undefined);
+        // Fail-closed terminal: a delegated mutating run whose attempts cannot state
+        // their applied confinement refuses instead of passing.
+        assertDelegatedEvidence(input.delegated === true, candidateAccess, runs);
         const cancelledCandidates = () => runs.map((r) => ({
             attemptId: r.attemptId,
             harnessId: r.harnessId,
@@ -2447,15 +2432,21 @@ export class Orchestrator {
             // harness cause (timeout, rate limit, crash, config) gets remediation that
             // fits it, instead of a doomed "Check harness authentication".
             const harnessCategory = dominantHarnessFailureCategory(first.telemetry.transientFailures);
+            // A run speaks with a candidate's TYPED refusal only when EVERY candidate
+            // died of the same one (candidateEvidence owns that rule); mixed causes
+            // keep the honest harness terminal.
+            const unanimous = unanimousDeclaredFailure(runs);
             writeFailure(store, paths, {
                 phase,
-                category: phase === "workspace" ? "project" : "harness_error",
+                category: unanimous?.category ?? (phase === "workspace" ? "project" : "harness_error"),
+                code: unanimous?.code ?? null,
                 harnessId: first.harnessId,
                 attemptId: first.attemptId,
                 safeMessage: rootCause,
                 rawDetailRef: `attempts/${first.attemptId}/attempt.yaml`,
                 eventRefs: existingEventRefs,
                 runDir: paths.root,
+                resetsAt: unanimous?.resetsAt ?? null,
                 nextActions: first.secretDiffRefusal
                     ? secretDiff.secretDiffNextActions(first.secretDiffRefusal)
                     : phase === "workspace"
@@ -2519,7 +2510,7 @@ export class Orchestrator {
             // candidates (a trivial greeting in agent mode no longer burns two reviewers on
             // "(empty diff)"). Candidates still flow through arbitration/gates so the
             // no_op/answer outcome and gate failures are unchanged.
-            evidences = await this.reviewRuns(workingRuns, reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal);
+            evidences = await this.reviewRuns(workingRuns, reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input));
         }
         catch (err) {
             // Review preflight/evidence failures end TERMINALLY with artifacts —
@@ -2544,7 +2535,7 @@ export class Orchestrator {
                 attemptId: "synth",
                 intent: "synthesize",
                 harnessId: synthRouted.adapter.id,
-                cost: attemptCostEvidence(synthRouted.adapter.id, "synth", undefined, this.routeBillingKnowledge(input, synthRouted.adapter.id)),
+                cost: attemptCostEvidence(synthRouted.adapter.id, "synth", this.reservationEstimateUsd(input), this.routeBillingKnowledge(input, synthRouted.adapter.id)),
             });
             if (lease.granted) {
                 let envelope;
@@ -2567,11 +2558,12 @@ export class Orchestrator {
                         dirtyPolicy: "snapshot",
                         accessProfile: candidateAccess,
                     });
+                    const synthHome = this.harnessHomeFor(wsm, envelope, synthRouted, input);
                     const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthesisInput.prompt, store, paths, wsm, ledger, candidateAccess, (ev) => {
                         const safeEv = redactHarnessEvent(ev);
                         safeInvoke(input.onHarnessEvent, safeEv);
                         log.emit("harness.event", harnessEventPayload(synthAdapter.id, "synth", safeEv));
-                    }, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content);
+                    }, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content, undefined, synthHome);
                     ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     reviewEnvelopes.push(envelope);
                     envelope = undefined;
@@ -2580,7 +2572,7 @@ export class Orchestrator {
                     runs.push(run);
                     try {
                         if (isWorkingCandidate(run)) {
-                            const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal);
+                            const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input));
                             evidences.push(...synthEvidence);
                             workingRuns.push(run);
                         }
@@ -2629,8 +2621,12 @@ export class Orchestrator {
         // Winner can only be a candidate that actually produced work; corpses are
         // excluded from arbitration upstream and from the fallback here.
         const winnerRun = workingRuns.find((r) => r.attemptId === result.decision.winner) ?? workingRuns[0];
-        // A reviewer escalation to a human is a BLOCKED terminal, not a silent risk note.
-        const needsHuman = evidences.some((e) => e.findings.some((f) => f.severity === "NEEDS_HUMAN" && isBlocking(f)));
+        const winnerEvidence = winnerRun
+            ? evidences.find((e) => e.attemptId === winnerRun.attemptId)
+            : undefined;
+        // D9 winner-only NEEDS_HUMAN gate, fail-closed on a winner with no review
+        // evidence record (see winnerNeedsHuman).
+        const needsHuman = winnerNeedsHuman(winnerRun?.attemptId ?? null, evidences);
         // Run-level review_verified is the WINNER's verification: an
         // empty-diff loser's unverified route must not drag the shipped result's
         // flag false. No winner -> fall back to the all-candidates view.
@@ -2693,12 +2689,11 @@ export class Orchestrator {
             })) {
                 log.emit("output.ready", { kind: "artifact", path });
             }
-            assertNoSecretLikeTokens("final patch diff", winnerRun.diff);
+            secretDiff.assertNoSecretLikeTokens("final patch diff", winnerRun.diff);
             const patchSha256 = sha256(winnerRun.diff);
             store.writeText(join(paths.finalDir, "patch.diff"), winnerRun.diff);
             const wstats = diffStats(winnerRun.diff);
             const hasDiff = winnerRun.diff.trim().length > 0;
-            const winnerEvidence = evidences.find((e) => e.attemptId === winnerRun.attemptId);
             const blockers = winnerEvidence
                 ? winnerEvidence.findings.filter((f) => isBlocking(f)).length
                 : 0;
@@ -3011,7 +3006,7 @@ export class Orchestrator {
             env: reviewHome.env,
         }).finally(() => reviewHome.dispose());
     }
-    async reviewRuns(runs, reviewers, reviewVerified, reviewDir, cwd, contract, store, paths, log, ledger, taskId, signal) {
+    async reviewRuns(runs, reviewers, reviewVerified, reviewDir, cwd, contract, store, paths, log, ledger, taskId, signal, reservationEstimateUsd) {
         const evidences = [];
         for (const run of runs) {
             const candidateCwd = run.reviewCwd ?? cwd;
@@ -3030,7 +3025,7 @@ export class Orchestrator {
                         attemptId: run.attemptId,
                         intent: "review",
                         harnessId: "review-panel",
-                        cost: attemptCostEvidence("review-panel", run.attemptId),
+                        cost: attemptCostEvidence("review-panel", run.attemptId, reservationEstimateUsd),
                     })
                     : undefined;
                 const result = hasDiff && reviewers.length > 0 && (reviewLease?.granted ?? true)
@@ -3174,10 +3169,21 @@ export class Orchestrator {
         const runId = input.runId ?? newId("run");
         // Contract validation BEFORE the run is announced (see runRace).
         const contract = this.buildContract(input, taskId, mode);
-        const store = this.artifactStore(input);
-        const paths = store.createRun(runId);
-        const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
-        input = this.withPlanBrief(input, store, paths, log);
+        const planBrief = verifiedPlanBrief(input);
+        const quotaSnapshots = this.quotaSnapshotPreflight();
+        const { store, paths, log, ledger } = beginAnnouncedRun({
+            input,
+            contract,
+            quotaSnapshots,
+            store: this.artifactStore(input),
+            authority: this.deps.delegationBudgetAuthority,
+            runId,
+            taskId,
+            mode,
+            phase: "convergence",
+            prompt: input.prompt,
+        }, announce);
+        input = withPlanBrief(input, store, paths, log, planBrief);
         // The execution root is the tree the harness mutates (thread worktree for an
         // isolated thread, else the project). The WorkspaceManager AND the git
         // boundary must resolve against the SAME root — the race path does so via the
@@ -3186,27 +3192,11 @@ export class Orchestrator {
         const execRoot = this.execRootOf(input);
         const wsm = new WorkspaceManager(execRoot);
         const readiness = new ReadinessLedger();
-        let ledger;
-        try {
-            ledger = this.rootLedger(input, contract, log);
-            store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
-            safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
-            log.emit("run.created", { mode, prompt: redactSecrets(input.prompt) });
-            announce?.(announcedRunContext({ log, store, paths, runId, taskId, mode, phase: "convergence" }, ledger, () => this.deps.delegationBudgetAuthority?.hasParent(runId) === true));
-        }
-        catch (error) {
-            // A delegated child attaches its scoped financial view before the run is
-            // announced. If any fallible artifact/start callback in that narrow gap
-            // throws, the terminal net has no run context, so detach here explicitly.
-            if (input.delegatedFromRunId) {
-                this.deps.delegationBudgetAuthority?.releaseRun(runId);
-            }
-            throw error;
-        }
+        store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         // Live (in-place) isolation deliberately tolerates non-git stateful
         // environments; only envelope isolation needs the git boundary.
         if (!input.inPlace) {
-            const gitPreconditionError = await this.ensureWriteModeGitBoundary(execRoot, log, store, paths, runId, mode);
+            const gitPreconditionError = await ensureWriteModeGitBoundary(execRoot, log, store, paths, runId, mode);
             if (gitPreconditionError) {
                 return {
                     spendUsd: ledger.spend(),
@@ -3214,10 +3204,10 @@ export class Orchestrator {
                     taskId,
                     mode,
                     lifecycle: "failed",
-                    facts: makeOutcomeFacts("failed", { reason: "harness_failed" }),
+                    facts: makeOutcomeFacts("failed", { reason: gitPreconditionError.reason }),
                     winner: null,
                     runDir: paths.root,
-                    summary: gitPreconditionError,
+                    summary: gitPreconditionError.message,
                     candidates: [],
                 };
             }
@@ -3406,7 +3396,7 @@ export class Orchestrator {
                     attemptId,
                     intent: "repair",
                     harnessId: adapter.id,
-                    cost: attemptCostEvidence(adapter.id, attemptId, undefined, this.routeBillingKnowledge(input, adapter.id)),
+                    cost: attemptCostEvidence(adapter.id, attemptId, this.reservationEstimateUsd(input), this.routeBillingKnowledge(input, adapter.id)),
                 });
                 if (!lease.granted) {
                     exhausted = true;
@@ -3415,7 +3405,9 @@ export class Orchestrator {
                 const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
                 const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
                 let run;
+                let harnessHome;
                 try {
+                    harnessHome = this.harnessHomeFor(wsm, envelope, routed, input);
                     log.emit("harness.started", {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
@@ -3429,7 +3421,8 @@ export class Orchestrator {
                     }, input.signal, undefined, input.effort, "repair", log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive), (streamedUsd) => {
                         ledger.updateHold(lease.lease?.lease_id ?? "", streamedUsd);
                         return ledger.tier() === "hard";
-                    }, input, true);
+                    }, input, true, // convergence runs one candidate: live deltas on (W-C4)
+                    undefined, undefined, harnessHome);
                     ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
@@ -3452,8 +3445,9 @@ export class Orchestrator {
                         status: "failed",
                         error: message,
                     });
-                    store.writeYaml(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message));
+                    store.writeYaml(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message, appliedAttemptFacts(harnessHome, routed.adapterAccess, this.effectiveProfileId(input, adapter.id))));
                     run = {
+                        applied: appliedAttemptFacts(harnessHome, routed.adapterAccess, this.effectiveProfileId(input, adapter.id)),
                         attemptId,
                         harnessId: adapter.id,
                         label: `Attempt ${attempt}`,
@@ -3467,6 +3461,9 @@ export class Orchestrator {
                     };
                 }
                 lastRun = run;
+                // Fail-closed twin of the candidate lane's gate: this loop terminalizes
+                // per attempt, so the proof is spent per attempt.
+                assertDelegatedEvidence(input.delegated === true, convergenceAccess, [run]);
                 attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry: run.telemetry });
                 // Cancellation/deadline keeps priority over a belt failure finalized concurrently.
                 if (input.signal?.aborted)
@@ -3518,7 +3515,7 @@ export class Orchestrator {
                                     attemptId,
                                     intent: "review",
                                     harnessId: "review-panel",
-                                    cost: attemptCostEvidence("review-panel", attemptId),
+                                    cost: attemptCostEvidence("review-panel", attemptId, this.reservationEstimateUsd(input)),
                                 })
                                 : null;
                             const reviewResult = reviewers.length > 0 && (reviewLease?.granted ?? false)
@@ -3808,7 +3805,7 @@ export class Orchestrator {
         // work_product (its partial patch.diff stays diagnostic via attempts/);
         // in-place keeps the product so the honest Revert offer survives.
         if (lastRun && (!interrupted || input.inPlace === true)) {
-            assertNoSecretLikeTokens("final patch diff", lastRun.diff);
+            secretDiff.assertNoSecretLikeTokens("final patch diff", lastRun.diff);
             const patchSha256 = sha256(lastRun.diff);
             store.writeText(join(paths.finalDir, "patch.diff"), lastRun.diff);
             // Honest apply-state (parity with runRace single-candidate in-place): a
@@ -3978,265 +3975,77 @@ export class Orchestrator {
             reviewVerified: actualReviewVerified,
         };
     }
-    /** One read-only planner spawn shared by solo fallback, Council drafts, and merge. */
-    async runPlannerAttempt(args) {
-        const { input, contract, taskId, runId, log, store, paths, ledger, routed, attemptId } = args;
-        const adapter = routed.adapter;
-        const lease = ledger.reserve({
-            taskId,
-            attemptId,
-            intent: args.intent,
-            harnessId: adapter.id,
-            cost: attemptCostEvidence(adapter.id, attemptId, undefined, this.routeBillingKnowledge(input, adapter.id)),
-        });
-        if (!lease.granted) {
-            log.emit("budget.lease.created", {
-                granted: false,
-                reason: lease.reason,
-                denied: lease.denied,
-                attempt_id: attemptId,
-                harness_id: adapter.id,
-            });
-            return {
-                attemptId,
-                harnessId: adapter.id,
-                status: "failed",
-                outcomeClass: "clean", // never spawned: refused pre-flight by the budget gate
-                error: lease.reason ?? "budget lease denied",
-                text: null,
-                telemetry: null,
-                budgetDenied: true,
-                budgetDenial: {
-                    code: lease.denied ?? "hard_cap",
-                    reason: lease.reason ?? "budget lease denied",
-                    harnessId: adapter.id,
-                    attemptId,
-                },
-            };
-        }
-        const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
-        const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
-        const planSessionFields = this.sessionSpecFields(input, adapter.id, log);
-        // Continuity (INV-137): a thread PLAN turn is a chat turn — hydrate a
-        // lane switch/gap with a packet and disclose it.
-        const laneContinuity = args.laneRun
-            ? await this.resolveContinuity(input, adapter.id, planSessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, planSessionFields.resume_session_id !== null, store, paths, this.execRootOf(input), log)
-            : null;
-        const spec = HarnessRunSpec.parse({
-            session_id: newId("ses"),
-            intent: args.intent,
-            prompt: laneContinuity?.pointerLine
-                ? `${args.promptBody}\n\n${laneContinuity.pointerLine}`
-                : args.promptBody,
-            cwd: this.execRootOf(input),
-            access: "readonly",
-            // Planners must SEE any image/file the user attached (e.g. "plan a fix for
-            // what's in this screenshot"), not just agent/race runs.
-            attachments: input.attachments ?? [],
-            ...planSessionFields,
-            ...this.harnessSpecKnobs(contract, knobs, args.intent),
-            env_inheritance: envInheritance(this.config(input.repoRoot)),
-            // A thread plan turn spawns in its DURABLE per-lane home so its native
-            // session is reachable for resume next turn (INV-034); a non-thread
-            // plan keeps the disposable route-context home.
-            env: (args.laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? args.fallbackHome,
-        });
-        const plannerAbort = new AbortController();
-        spec.extra["abortSignal"] = input.signal
-            ? AbortSignal.any([input.signal, plannerAbort.signal])
-            : plannerAbort.signal;
-        const planInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
-        if (planInteraction)
-            spec.extra["interactionChannel"] = planInteraction;
-        // D-16: compile the WorkReport envelope for the plan lane (require plan text
-        // below folds the deliverable; the veto rides work_state).
-        const planWorkEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(planInteraction));
-        const planWorkMode = this.applyWorkEnvelope(spec, planWorkEnvelope);
-        const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
-        const answer = new AnswerAssembly();
-        const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
-            knobs.webPolicy === "cached" ||
-            knobs.webPolicy === "live", effectiveWeb, [], 
-        // Requested-model capture: a plan lane silently downgraded to another
-        // model surfaces the mismatch in its route receipt, just like agent.
-        knobs.model);
-        const onAbort = () => {
-            void adapter.cancel?.(spec.session_id)?.catch(() => { });
-        };
-        if (input.signal) {
-            if (input.signal.aborted)
-                onAbort();
-            else
-                input.signal.addEventListener("abort", onAbort, { once: true });
-        }
-        let cost = 0;
-        let costEstimated = false;
-        let harnessError = null;
-        const budgetSignalState = { quotaPressureDisclosed: false };
-        try {
-            log.emit("harness.started", {
-                harness_id: adapter.id,
-                attempt_id: attemptId,
-                external_context_policy: knobs.webPolicy,
-                ...(knobs.ignored.length > 0 ? { ignored_settings: knobs.ignored } : {}),
-            });
-            if (!input.signal?.aborted) {
-                const watchedPlan = withInactivityWatchdog(adapter.run(spec), {
-                    timeoutMs: harnessInactivityTimeoutMs(this.config(input.repoRoot)),
-                    onTimeout: () => {
-                        plannerAbort.abort();
-                        void adapter.cancel?.(spec.session_id)?.catch(() => { });
-                    },
-                    isSuspended: () => (planInteraction?.pendingCount?.() ?? 0) > 0,
-                });
-                for await (const ev of watchedPlan) {
-                    if (input.signal?.aborted)
-                        break;
-                    const safeEv = redactHarnessEvent(ev);
-                    safeInvoke(input.onHarnessEvent, safeEv);
-                    // A thread PLAN turn IS a chat turn now (INV-034): its native
-                    // session lives in the DURABLE per-lane home, so record it for the
-                    // next lane turn's resume. Council members are distinct lanes.
-                    if (args.laneRun)
-                        observeNativeSessionEvent(input, adapter.id, safeEv);
-                    observeAuthSwitch(log, adapter.id, attemptId, safeEv);
-                    log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv));
-                    appendLine(attemptEventsPath, JSON.stringify(safeEv));
-                    observeAttemptTelemetry(telemetry, safeEv);
-                    if (safeEv.plan_progress) {
-                        log.emit("plan.progress", {
-                            attempt_id: attemptId,
-                            harness_id: adapter.id,
-                            items: safeEv.plan_progress.items,
-                        });
-                    }
-                    // read-only routes burn quota too — same single owner as the agent loop.
-                    observeBudgetSignals(ledger, log, adapter.id, attemptId, safeEv, budgetSignalState);
-                    this.deps.quotaEventSink?.(adapter.id, safeEv);
-                    if (safeEv.type === "usage" && safeEv.usage?.cost_usd) {
-                        cost += safeEv.usage.cost_usd;
-                        if (safeEv.usage.estimated)
-                            costEstimated = true;
-                        log.emit("budget.observation", {
-                            harness_id: adapter.id,
-                            attempt_id: attemptId,
-                            kind: "spend",
-                            usd: safeEv.usage.cost_usd,
-                            estimated: safeEv.usage.estimated === true,
-                        });
-                    }
-                    // A TYPED final message wins verbatim over joined narration.
-                    answer.observe(safeEv);
-                    if (safeEv.type === "error")
-                        harnessError = safeEv.error ? redactSecrets(safeEv.error) : "harness emitted an error";
-                }
-            }
-        }
-        catch (err) {
-            harnessError = safeErrorMessage(err);
-        }
-        finally {
-            input.signal?.removeEventListener("abort", onAbort);
-            ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode, telemetry.usageCost));
-        }
-        // D-16: unwrap and require PLAN TEXT — a plan with no text is not delivered.
-        // The unwrap runs BEFORE the error axes: the deliverable it yields is what
-        // decides whether an unrecovered tool error is fatal (explorer parity).
-        const planUnwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", planWorkMode, {
-            sideToolReport: telemetry.sideToolWorkReport ?? undefined,
-        });
-        const planText = redactSecrets(planUnwrapped.deliverable).trim();
-        const unrecovered = unrecoveredToolErrors(telemetry);
-        const webBlocked = webUnsatisfied(telemetry);
-        if (!harnessError && webBlocked) {
-            harnessError = webEvidenceFailure(telemetry.web);
-        }
-        // INV-043/INV-044, explorer parity: a DELIVERED plan keeps an unrecovered
-        // non-web tool error as warning evidence instead of discarding the plan (see
-        // the helper). Web keeps its hard gate above; the finalizer outranks both.
-        harnessError ??= unrecoveredToolErrorFailure(unrecovered, planText.length > 0);
-        const planFinalized = finalizeAttempt({
-            deliverableEvidence: planText.length > 0,
-            harnessErrored: harnessError !== null && !webBlocked,
-            workReport: planUnwrapped.workReport,
-            workReportSource: planUnwrapped.source,
-            workReportViolation: planUnwrapped.contractViolation,
-            contextTerminalExhausted: telemetry.contextExhausted,
-        });
-        // A broken WorkReport contract is a hard failure only when the finalizer
-        // ranked it so (a terminal context exhaustion outranks it).
-        if (!harnessError && planFinalized.outcomeClass === "contract_failure") {
-            harnessError = `work_report contract: ${planUnwrapped.contractViolation}`;
-        }
-        // D-16 r9: an interrupted (context-exhausted) planner is NEVER a clean
-        // plan — partial text must not become final/plan.md as success. A VETO
-        // (needs_input/incomplete work_state) is DIFFERENT by the sealed D-16
-        // contract (X35, INV-116 canaries): the plan still delivers, lifecycle
-        // succeeded, and the work_state veto rides the OUTCOME (non-zero exit) —
-        // it must not be laundered into a harness failure either direction.
-        if (!harnessError && planFinalized.outcomeClass === "interrupted") {
-            harnessError = "context capacity exhausted before the plan completed";
-        }
-        const attemptError = harnessError ??
-            (planFinalized.deliverablePresent ? null : "planner produced no plan text") ??
-            (input.signal?.aborted ? "planner cancelled" : null);
-        setAttemptOutcome(telemetry, {
-            deliverablePresent: planFinalized.deliverablePresent,
-            gatesPassed: null,
-            harnessErrored: (harnessError !== null && !webBlocked) || planFinalized.harnessErrored,
-            webRequiredUnsatisfied: webBlocked,
-            workState: planFinalized.workState,
-        });
-        if (attemptError) {
-            log.emit("harness.completed", {
-                harness_id: adapter.id,
-                attempt_id: attemptId,
-                status: webBlocked ? "blocked" : "failed",
-                error: attemptError,
-                ...telemetrySummary(telemetry),
-            });
-            return {
-                attemptId,
-                harnessId: adapter.id,
-                status: webBlocked ? "blocked" : "failed",
-                outcomeClass: planFinalized.outcomeClass,
-                error: attemptError,
-                text: null,
-                telemetry,
-                budgetDenied: false,
-            };
-        }
-        const text = planText || "(no output)";
-        log.emit("harness.completed", {
-            harness_id: adapter.id,
-            attempt_id: attemptId,
-            status: "success",
-            ...telemetrySummary(telemetry),
-        });
+    /** Bind private route/session preparation to the planner-attempt owner. */
+    plannerAttemptDeps() {
         return {
-            attemptId,
-            harnessId: adapter.id,
-            status: "success",
-            outcomeClass: planFinalized.outcomeClass,
-            error: null,
-            text,
-            telemetry,
-            budgetDenied: false,
+            billingKnowledge: (input, harnessId) => this.routeBillingKnowledge(input, harnessId),
+            inactivityTimeoutMs: (repoRoot) => harnessInactivityTimeoutMs(this.config(repoRoot)),
+            quotaEventSink: this.deps.quotaEventSink,
+            prepare: async (args) => {
+                const { input, contract, taskId, runId, log, store, paths, routed, attemptId } = args;
+                const adapter = routed.adapter;
+                const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
+                const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
+                const sessionFields = await this.sessionSpecFields(input, adapter.id, log, routed.authRouteEstimate);
+                const laneContinuity = args.laneRun
+                    ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, sessionFields.resume_session_id !== null, sessionFields, store, paths, this.execRootOf(input), log)
+                    : null;
+                const spec = HarnessRunSpec.parse({
+                    session_id: newId("ses"),
+                    intent: args.intent,
+                    prompt: laneContinuity?.pointerLine
+                        ? `${args.promptBody}\n\n${laneContinuity.pointerLine}`
+                        : args.promptBody,
+                    cwd: this.execRootOf(input),
+                    access: "readonly",
+                    attachments: input.attachments ?? [],
+                    ...sessionFields,
+                    ...this.harnessSpecKnobs(contract, knobs, args.intent),
+                    env_inheritance: envInheritance(this.config(input.repoRoot)),
+                    env: (args.laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? args.fallbackHome,
+                });
+                const plannerAbort = new AbortController();
+                spec.extra["abortSignal"] = input.signal
+                    ? AbortSignal.any([input.signal, plannerAbort.signal])
+                    : plannerAbort.signal;
+                const planInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
+                if (planInteraction)
+                    spec.extra["interactionChannel"] = planInteraction;
+                const planWorkMode = this.applyWorkEnvelope(spec, this.workReportEnvelopeFor(routed, contract, Boolean(planInteraction)));
+                return {
+                    knobs,
+                    effectiveWeb,
+                    spec,
+                    plannerAbort,
+                    planInteraction,
+                    planWorkMode,
+                };
+            },
         };
     }
+    /** One read-only planner spawn shared by solo fallback, Council drafts, and merge. */
+    async runPlannerAttempt(args) {
+        return executePlannerAttempt(this.plannerAttemptDeps(), args);
+    }
     async runPlan(input, announce) {
         const taskId = input.taskId ?? newId("task");
         const runId = input.runId ?? newId("run");
         // Plan runs get the same immutable contract truth as every other mode;
         // contract validation runs BEFORE the run is announced (see runRace).
         const contract = this.buildContract(input, taskId, "plan");
-        const store = this.artifactStore(input);
-        const paths = store.createRun(runId);
-        const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
-        safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
-        log.emit("run.created", { mode: "plan", prompt: redactSecrets(input.prompt) });
-        const ledger = this.rootLedger(input, contract, log);
-        announce?.(announcedRunContext({ log, store, paths, runId, taskId, mode: "plan", phase: "plan" }, ledger, () => this.deps.delegationBudgetAuthority?.hasParent(runId) === true));
+        const quotaSnapshots = this.quotaSnapshotPreflight();
+        const { store, paths, log, ledger } = beginAnnouncedRun({
+            input,
+            contract,
+            quotaSnapshots,
+            store: this.artifactStore(input),
+            authority: this.deps.delegationBudgetAuthority,
+            runId,
+            taskId,
+            mode: "plan",
+            phase: "plan",
+            prompt: input.prompt,
+        }, announce);
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // W3.3: ONE resolved read-only context — the routing point-probe and every
@@ -4344,6 +4153,7 @@ export class Orchestrator {
                 roHome,
                 contextSection,
                 laneRun,
+                estimateUsdFloor: this.estimateUsdFloor(input.repoRoot),
             });
         }
         const plans = [];
@@ -4373,6 +4183,7 @@ export class Orchestrator {
                     fallbackHome: roHome.env,
                     promptBody: planPrompt(input.prompt) + contextSection,
                     intent: "plan",
+                    reservationEstimateUsd: this.reservationEstimateUsd(input),
                 });
                 if (outcome.budgetDenied) {
                     // QA-050: retain the denied planner slot before breaking so the
@@ -4451,7 +4262,6 @@ export class Orchestrator {
         }
         if (plans.length === 0) {
             return writePlanHarnessFailure(this.planRunDeps(), {
-                input,
                 contract,
                 taskId,
                 runId,
@@ -4520,17 +4330,8 @@ export class Orchestrator {
             defaultPrompt: "Explore this repository and synthesize evidence-cited findings, omissions, and follow-up questions.",
         }, announce);
     }
-    resolvePaidBudget(inputBudget, cfg) {
-        return inputBudget ?? this.deps.paidBudget ?? cfg.global.budget.paid_budget_per_run;
-    }
-    rootLedger(input, contract, log) {
-        return createRootLedger({
-            input,
-            contract,
-            log,
-            authority: this.deps.delegationBudgetAuthority,
-            quotaSnapshots: this.deps.quotaSnapshots?.() ?? [],
-        });
+    quotaSnapshotPreflight() {
+        return [...(this.deps.quotaSnapshots?.() ?? [])].map((snapshot) => QuotaSnapshotSchema.parse(snapshot));
     }
     routeBillingKnowledge(input, harnessId) {
         // A selected profile's credential_kind decides billing (round-18 #2).
@@ -4560,10 +4361,10 @@ export class Orchestrator {
             // scout reserve) so a subscription route is not refused for lacking a
             // cash quote.
             attemptCostEvidence(harnessId, attemptId, this.estimateUsdFloor(input.repoRoot), this.routeBillingKnowledge(input, harnessId)),
-            buildSpec: (routed, homeEnv, prompt, attemptId) => {
+            buildSpec: async (routed, homeEnv, prompt, attemptId) => {
                 const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
                 const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
-                const sessionFields = this.sessionSpecFields(input, routed.adapter.id, log);
+                const sessionFields = await this.sessionSpecFields(input, routed.adapter.id, log, routed.authRouteEstimate);
                 const spec = HarnessRunSpec.parse({
                     session_id: newId("ses"),
                     intent: "synthesize",
@@ -4604,13 +4405,19 @@ export class Orchestrator {
         // Contract validation BEFORE the run is announced (see runRace). The
         // recorded user intent is the CALLER's goal.
         const contract = this.buildContract({ ...input, prompt: opts.contractIntent ?? prompt }, taskId, opts.mode);
-        const store = this.artifactStore(input);
-        const paths = store.createRun(runId);
-        const log = new EventLog(paths.eventsPath, runId, taskId, input.onEvent, input.threadId);
-        safeInvoke(input.onRunStart, { runId, taskId, runDir: paths.root });
-        log.emit("run.created", { mode: opts.mode, prompt: redactSecrets(prompt) });
-        const ledger = this.rootLedger(input, contract, log);
-        announce?.(announcedRunContext({ log, store, paths, runId, taskId, mode: opts.mode, phase: "report" }, ledger, () => this.deps.delegationBudgetAuthority?.hasParent(runId) === true));
+        const quotaSnapshots = this.quotaSnapshotPreflight();
+        const { store, paths, log, ledger } = beginAnnouncedRun({
+            input,
+            contract,
+            quotaSnapshots,
+            store: this.artifactStore(input),
+            authority: this.deps.delegationBudgetAuthority,
+            runId,
+            taskId,
+            mode: opts.mode,
+            phase: "report",
+            prompt,
+        }, announce);
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // The ask/deep-scan report stays bare (its scouts read the tree themselves);
@@ -4752,10 +4559,10 @@ export class Orchestrator {
                 intent: opts.intent,
                 harnessId: adapter.id,
                 // QA-019: an n>1 deep-scan scout admits under a FINITE estimate floor
-                // (mirror of the candidate loop): the first scout reserves without a
-                // floor, but later scouts pass the repo's usd floor so a subscription
-                // swarm is not refused for lacking a per-attempt cash quote under a cap.
-                cost: attemptCostEvidence(adapter.id, attemptId, opts.deepScan && idx > 0 ? this.estimateUsdFloor(input.repoRoot) : undefined, this.routeBillingKnowledge(input, adapter.id)),
+                // (mirror of the candidate loop): the first top-level scout reserves
+                // without a floor; later scouts and every real Delegate child pass the
+                // repo floor because they overlap an existing family unit.
+                cost: attemptCostEvidence(adapter.id, attemptId, this.reservationEstimateUsd(input, opts.deepScan && idx > 0), this.routeBillingKnowledge(input, adapter.id)),
             });
             if (!lease.granted) {
                 log.emit("budget.lease.created", {
@@ -4784,67 +4591,120 @@ export class Orchestrator {
                 }
                 return { status: "budget_denied", reason: lease.reason ?? "budget lease denied" };
             }
-            // Lease granted: the attempt is now committed to run — disclose the launch.
-            onLaunch?.();
-            const knobs = this.routeSpecKnobs(routed, contract, modelOverride, input.effort);
-            const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
-            const explorerPrompt = (opts.deepScan
-                ? `${prompt}\n\nExplorer ${idx + 1}/${adapters.length}: focus on a distinct slice. Emit evidence-cited findings, explicit unknowns/omissions, and follow-up questions. Do not edit files.`
-                : prompt) + contextSection;
-            const sessionFields = this.sessionSpecFields(input, adapter.id, log);
-            const grantResume = sessionFields.resume_session_id !== null && !resumeGranted.has(adapter.id);
-            if (grantResume)
-                resumeGranted.add(adapter.id);
-            // Continuity (INV-137): a thread ASK turn is a chat turn — hydrate a lane
-            // switch/gap with a packet and disclose it. Gated on laneRun (deep-scan
-            // scouts are excluded from laneRun); native resume is available only when
-            // this slot was granted the lane's recorded session.
-            const laneContinuity = laneRun
-                ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, grantResume, store, paths, this.execRootOf(input), log)
-                : null;
-            // D-16d: the continuation packet pointer rides after the lane pointer so
-            // the fresh session is re-grounded in the exhausted attempt's work.
-            const promptWithPointers = [explorerPrompt, laneContinuity?.pointerLine, continuationPointer]
-                .filter((p) => Boolean(p))
-                .join("\n\n");
-            let spec = HarnessRunSpec.parse({
-                session_id: newId("ses"),
-                intent: opts.intent,
-                prompt: promptWithPointers,
-                cwd: this.execRootOf(input),
-                access: "readonly",
-                // ASK/EXPLORE/AUDIT read-only runs must forward the user's attachments —
-                // a live "describe this image" turn sent an image that was being dropped here, so
-                // the model honestly reported it saw nothing (the v0.13 attachment bug).
-                attachments: input.attachments ?? [],
-                auth_preference: sessionFields.auth_preference,
-                credential_profile: sessionFields.credential_profile,
-                resume_session_id: grantResume ? sessionFields.resume_session_id : null,
-                ...this.harnessSpecKnobs(contract, knobs, opts.intent),
-                env_inheritance: envInheritance(this.config(input.repoRoot)),
-                // A thread lane turn spawns in its DURABLE per-lane home so the native
-                // session it records is reachable for resume next turn; everything else
-                // uses the disposable route-context home.
-                env: (laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? roHome.env,
-            });
-            const reportAbort = new AbortController();
-            spec.extra["abortSignal"] = input.signal
-                ? AbortSignal.any([input.signal, reportAbort.signal])
-                : reportAbort.signal;
-            const reportInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
-            if (reportInteraction)
-                spec.extra["interactionChannel"] = reportInteraction;
-            // D-16: compile the WorkReport envelope for the read-only lane.
-            const readonlyWorkEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(reportInteraction));
-            const readonlyWorkMode = this.applyWorkEnvelope(spec, readonlyWorkEnvelope);
-            const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
-            const answer = new AnswerAssembly();
-            const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
-                knobs.webPolicy === "cached" ||
-                knobs.webPolicy === "live", effectiveWeb, [], 
-            // Requested-model capture so ask/audit route receipts detect a silent
-            // model downgrade (typed model_mismatch), not just agent runs.
-            knobs.model);
+            // As with planners, the granted lease owns profile/continuity/spec
+            // preparation. Contain a pre-stream rejection as this attempt's failure;
+            // parallel siblings can then finish before the shared HOME is disposed.
+            const preparation = await (async () => {
+                // Lease granted: the attempt is now committed to run — disclose the launch.
+                onLaunch?.();
+                const knobs = this.routeSpecKnobs(routed, contract, modelOverride, input.effort);
+                const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
+                const explorerPrompt = (opts.deepScan
+                    ? `${prompt}\n\nExplorer ${idx + 1}/${adapters.length}: focus on a distinct slice. Emit evidence-cited findings, explicit unknowns/omissions, and follow-up questions. Do not edit files.`
+                    : prompt) + contextSection;
+                const sessionFields = await this.sessionSpecFields(input, adapter.id, log, routed.authRouteEstimate);
+                const grantResume = sessionFields.resume_session_id !== null && !resumeGranted.has(adapter.id);
+                if (grantResume)
+                    resumeGranted.add(adapter.id);
+                // Continuity (INV-137): a thread ASK turn is a chat turn — hydrate a lane
+                // switch/gap with a packet and disclose it. Gated on laneRun (deep-scan
+                // scouts are excluded from laneRun); native resume is available only when
+                // this slot was granted the lane's recorded session.
+                const laneContinuity = laneRun
+                    ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, grantResume, sessionFields, store, paths, this.execRootOf(input), log)
+                    : null;
+                // D-16d: the continuation packet pointer rides after the lane pointer so
+                // the fresh session is re-grounded in the exhausted attempt's work.
+                const promptWithPointers = [
+                    explorerPrompt,
+                    laneContinuity?.pointerLine,
+                    continuationPointer,
+                ]
+                    .filter((p) => Boolean(p))
+                    .join("\n\n");
+                const spec = HarnessRunSpec.parse({
+                    session_id: newId("ses"),
+                    intent: opts.intent,
+                    prompt: promptWithPointers,
+                    cwd: this.execRootOf(input),
+                    access: "readonly",
+                    // ASK/EXPLORE/AUDIT read-only runs must forward the user's attachments —
+                    // a live "describe this image" turn sent an image that was being dropped here, so
+                    // the model honestly reported it saw nothing (the v0.13 attachment bug).
+                    attachments: input.attachments ?? [],
+                    auth_preference: sessionFields.auth_preference,
+                    credential_profile: sessionFields.credential_profile,
+                    resume_session_id: grantResume ? sessionFields.resume_session_id : null,
+                    ...this.harnessSpecKnobs(contract, knobs, opts.intent),
+                    env_inheritance: envInheritance(this.config(input.repoRoot)),
+                    // A thread lane turn spawns in its DURABLE per-lane home so the native
+                    // session it records is reachable for resume next turn; everything else
+                    // uses the disposable route-context home.
+                    env: (laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? roHome.env,
+                });
+                const reportAbort = new AbortController();
+                spec.extra["abortSignal"] = input.signal
+                    ? AbortSignal.any([input.signal, reportAbort.signal])
+                    : reportAbort.signal;
+                const reportInteraction = this.interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
+                if (reportInteraction)
+                    spec.extra["interactionChannel"] = reportInteraction;
+                // D-16: compile the WorkReport envelope for the read-only lane.
+                const readonlyWorkEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(reportInteraction));
+                const readonlyWorkMode = this.applyWorkEnvelope(spec, readonlyWorkEnvelope);
+                const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
+                const answer = new AnswerAssembly();
+                const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required ||
+                    knobs.webPolicy === "cached" ||
+                    knobs.webPolicy === "live", effectiveWeb, [], 
+                // Requested-model capture so ask/audit route receipts detect a silent
+                // model downgrade (typed model_mismatch), not just agent runs.
+                knobs.model);
+                return {
+                    knobs,
+                    spec,
+                    reportAbort,
+                    reportInteraction,
+                    readonlyWorkMode,
+                    attemptEventsPath,
+                    answer,
+                    telemetry,
+                };
+            })().then((value) => ({ ok: true, value }), (error) => ({ ok: false, error }));
+            if (!preparation.ok) {
+                const message = `read-only attempt setup failed: ${safeErrorMessage(preparation.error)}`;
+                AC.settleGrantedAttemptLease({
+                    ledger,
+                    leaseId: lease.lease?.lease_id ?? "",
+                    attemptId,
+                    harnessId: adapter.id,
+                    costUsd: 0,
+                    costEstimated: false,
+                    preStreamFailureSource: "readonly-pre-stream",
+                });
+                const telemetry = createAttemptTelemetry(contract.external_context.policy, contract.external_context.web_required, contract.external_context.effective_mode);
+                setAttemptOutcome(telemetry, {
+                    deliverablePresent: false,
+                    gatesPassed: null,
+                    harnessErrored: true,
+                    webRequiredUnsatisfied: false,
+                });
+                attempts.push({
+                    attemptId,
+                    harnessId: adapter.id,
+                    status: "failed",
+                    report: "",
+                    error: message,
+                    telemetry,
+                });
+                attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
+                if (opts.deepScan) {
+                    store.writeText(join(paths.findingsDir, `${attemptId}-error.md`), `# Explorer ${attemptId} failed\n\n${message}\n`);
+                }
+                return { status: "launched" };
+            }
+            const { knobs, spec: preparedSpec, reportAbort, reportInteraction, readonlyWorkMode, attemptEventsPath, answer, telemetry, } = preparation.value;
+            let spec = preparedSpec;
             const retryPolicy = transientRetryPolicy(this.config(input.repoRoot));
             let activeSessionId = spec.session_id;
             const onAbort = () => {
@@ -4884,11 +4744,13 @@ export class Orchestrator {
                     try {
                         const watchedReport = withInactivityWatchdog(adapter.run(runSpec), {
                             timeoutMs: harnessInactivityTimeoutMs(this.config(input.repoRoot)),
+                            countsAsProgress: countsAsAgentProgress,
                             onTimeout: () => {
                                 reportAbort.abort();
                                 void adapter.cancel?.(activeSessionId)?.catch(() => { });
                             },
                             isSuspended: () => (reportInteraction?.pendingCount?.() ?? 0) > 0,
+                            suspensionVersion: () => reportInteraction?.suspensionVersion?.() ?? 0,
                         });
                         for await (const ev of watchedReport) {
                             if (input.signal?.aborted)
@@ -4952,13 +4814,18 @@ export class Orchestrator {
                     // W5.4 reactive failover, READ-ONLY lane (same contract as the
                     // candidate lane; typed limits only, never plain transients).
                     if (harnessError && !input.signal?.aborted) {
+                        const rotationPolicy = this.profilePolicy(input.repoRoot, adapter.id);
+                        const readyProfileIds = sawTypedLimit && reportSoFar.length === 0 && rotationPolicy.limit_action === "rotate"
+                            ? await this.readyProfileIdsForRotation(input, adapter.id, spec.credential_profile ?? null, triedProfiles)
+                            : new Set();
                         const rotated = rotateSpecOnTypedLimit({
                             spec,
                             harnessId: adapter.id,
                             attemptId,
-                            policy: this.profilePolicy(input.repoRoot, adapter.id),
+                            policy: rotationPolicy,
                             registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
                             snapshots: this.deps.quotaSnapshots?.() ?? [],
+                            readyProfileIds,
                             triedProfiles,
                             sawTypedLimit,
                             deliverableEmpty: reportSoFar.length === 0,
@@ -5000,7 +4867,17 @@ export class Orchestrator {
             }
             finally {
                 input.signal?.removeEventListener("abort", onAbort);
-                ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(cost, costEstimated, attemptId, adapter.id, telemetry.authMode, telemetry.usageCost));
+                AC.settleGrantedAttemptLease({
+                    ledger,
+                    leaseId: lease.lease?.lease_id ?? "",
+                    attemptId,
+                    harnessId: adapter.id,
+                    costUsd: cost,
+                    costEstimated,
+                    authMode: telemetry.authMode,
+                    usageCost: telemetry.usageCost,
+                    preStreamFailureSource: "readonly-pre-stream",
+                });
             }
             if (harnessError && telemetry.transientFailures.length > 0) {
                 log.emit("route.transient.exhausted", {
@@ -5011,11 +4888,14 @@ export class Orchestrator {
                 });
             }
             attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
-            // D-16: un-nest the {work_report, output} envelope; the OUTPUT is the report.
+            // D-16: remove the WorkReport transport; the deliverable is the report.
             const roUnwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", readonlyWorkMode, {
                 sideToolReport: telemetry.sideToolWorkReport ?? undefined,
             });
-            const report = redactSecrets(roUnwrapped.deliverable);
+            // Trim symmetrically with the plan path: a whitespace-only answer is not
+            // a delivered report (the final-artifact wrapper heading would otherwise
+            // make it read as present content by construction).
+            const report = redactSecrets(roUnwrapped.deliverable).trim();
             const unrecovered = unrecoveredToolErrors(telemetry);
             const webBlocked = webUnsatisfied(telemetry);
             const reportPresent = report.length > 0;
@@ -5043,6 +4923,13 @@ export class Orchestrator {
                 harnessErrored: harnessError !== null && !webBlocked,
                 webRequiredUnsatisfied: webBlocked,
                 workState: roFinalized.workState,
+                // A read-only attempt that completed CLEANLY with an honestly empty
+                // answer is a success with deliverable_present=false ("(no output)"),
+                // never a fake contract failure — the trim above must not convert a
+                // phantom deliverable into a phantom harness failure. Only the clean
+                // finalizer class qualifies: contract failures, vetoes, and context
+                // interruptions keep the strict deliverable requirement.
+                emptyDeliverableAllowed: roFinalized.outcomeClass === "clean",
             });
             if (harnessError) {
                 log.emit("harness.completed", {
@@ -5473,7 +5360,7 @@ export class Orchestrator {
         }
         this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, opts.deepScan ? null : (succeeded[0]?.attemptId ?? null), deepScanSynthesis);
         log.emit("output.ready", {
-            kind: opts.mode === "ask" ? "answer" : "report",
+            kind: opts.deepScan ? "report" : "answer",
             path: `final/${opts.artifactName}`,
         });
         if (opts.deepScan) {
@@ -5531,11 +5418,16 @@ export class Orchestrator {
             .map((a) => `${a.attemptId}:${a.harnessId}:${a.status}`)
             .join(", ");
         store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harnesses: ${harnessLabel}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}\n\n${report}\n`);
+        const reportProducerAttemptId = opts.deepScan &&
+            deepScanSynthesis?.status === "succeeded" &&
+            deepScanSynthesis.reducer_attempt_id
+            ? deepScanSynthesis.reducer_attempt_id
+            : (succeeded[0]?.attemptId ?? "a01");
         store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
             id: newId("wp"),
             kind: "report",
             source_task_id: taskId,
-            producer_attempt_id: succeeded[0]?.attemptId ?? "a01",
+            producer_attempt_id: reportProducerAttemptId,
             files: Object.fromEntries([[opts.artifactName, join(paths.finalDir, opts.artifactName)]]),
             meta: {
                 harnesses: attempts.map((a) => a.harnessId),
@@ -5544,7 +5436,7 @@ export class Orchestrator {
                 read_only: true,
             },
         });
-        log.emit("work_product.emitted", { kind: "report", winner: succeeded[0]?.attemptId ?? null });
+        log.emit("work_product.emitted", { kind: "report", winner: reportProducerAttemptId });
         const workVetoed = terminalFacts.work_state?.state === "needs_input" ||
             terminalFacts.work_state?.state === "incomplete";
         if (terminalFacts.lifecycle !== "succeeded") {
@@ -5596,9 +5488,4 @@ export class Orchestrator {
         };
     }
 }
-function assertNoSecretLikeTokens(label, text) {
-    if (containsSecretLikeToken(text)) {
-        throw new Error(`${label} contains secret-like token; refusing to persist artifact`);
-    }
-}
 //# sourceMappingURL=orchestrator.js.map