@claudexor/orchestrator 3.5.0 → 3.8.0

package/dist/orchestrator.js

@@ -1,5 +1,7 @@
 import { existsSync } from "node:fs";
-import { effectiveAuthPreference, observeNativeSessionEvent, preflightCredentialProfile, preflightDefaultSubject, probeCredentialProfileStatus, profileHeadroomBreach, profileStatusAdmits, resolveCredentialProfile, resumeSessionForProfile, rotateSpecOnTypedLimit, selectedProfileAvailability, staticRotationCandidates, vendorVerifiedProfileStatus, } from "./credential-profiles.js";
+import { effectiveAuthPreference, observeNativeSessionEvent, resumeSessionForProfile, rotateSpecOnTypedLimit, selectedProfileAvailability, } from "./credential-profiles.js";
+import { OrchestratorCredentials, rotatedSpecInLaneHome } from "./orchestrator-credentials.js";
+import { accountPoolRows } from "./account-pool.js";
 import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
 import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
 import { processAttemptUsage } from "./attemptUsage.js";
@@ -13,8 +15,8 @@ import { finalizePlanRun, runCouncilPlan, writePlanHarnessFailure, } from "./pla
 import { runPlannerAttempt as executePlannerAttempt, } from "./plannerAttempt.js";
 import { HarnessRunSpec, ModeKind as ModeKindSchema, QuotaSnapshot as QuotaSnapshotSchema, isBlocking, makeOutcomeFacts, normalizeUserOutputSchema, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
 import { globalConfigDir, loadConfig } from "@claudexor/config";
-import { AnswerAssembly, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
-import { assertRouteModelsAllowed } from "./modelGovernance.js";
+import { acceptedTryOutput, AnswerAssembly, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
+import { assertRouteModelsAllowed, runModelGovernedRoute } from "./modelGovernance.js";
 import { authModeForCredentialRoute, authModeForPreference } from "./auth-route-classification.js";
 import { governRouteEffort } from "./effortGovernance.js";
 import { isFullAccess, RequestRequirementsResolver } from "./requestRequirements.js";
@@ -31,7 +33,8 @@ import { buildRevisePrompt } from "./revisePrompt.js";
 import { cancelledResult, declaredFailure, failTerminally, guardAnnouncedRun, writeFailure, } from "./runTerminals.js";
 import { budgetFailureRecord, classifyBudgetFailure } from "./budgetFailure.js";
 import { assertOutputSchemaCompiles, finalizeStructuredOutput } from "./structuredOutput.js";
-import { transientRetryDelayMs, promptWithEngineConstraints, sleep, redactHarnessEvent, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
+import { dropDeltaPastBudget, emitPlanProgress, emitTransientExhausted, emitTransientRetryPlan, observeReadonlySpend, } from "./laneStreamEvents.js";
+import { promptWithEngineConstraints, sleep, redactHarnessEvent, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPrimaryDivergence, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
 import { candidateStatusInRouteContext, resolveReadOnlyRouteContext, } from "./routeContext.js";
 import { resolveAutoReviewerPanel, resolveExplicitReviewerPanel } from "./reviewerPanel.js";
 import { ensureWriteModeGitBoundary } from "./git-precondition.js";
@@ -40,6 +43,7 @@ import { activePlanPointer, resolveContinuitySummary, workspaceAnchor, } from ".
 import { runDiffReview } from "./diffReview.js";
 import { rawScoutBundle, resolveDeepScanSynthesis, } from "./deepScanReducer.js";
 import { classifyAdapterThrow, createAttemptTelemetry, observeAttemptTelemetry, setAttemptOutcome, telemetrySummary, toolWarnings, unrecoveredToolErrors, webUnsatisfied, } from "./attemptTelemetry.js";
+import { newAttemptOutputMarkers } from "./attemptOutputMarkers.js";
 import * as delegateFailure from "./delegationFailure.js";
 import * as secretDiff from "./secretDiff.js";
 import { dominantHarnessFailureCategory, harnessFailureNextActions } from "./harnessFailure.js";
@@ -332,11 +336,21 @@ export class Orchestrator {
         const cfg = this.config(input.repoRoot)?.global;
         const profile = quotaAdmission?.model === model
             ? quotaAdmission.profile
-            : await this.preflightProfile(input, harnessId, model, log, defaultRoute);
+            : await this.credentials.preflightProfile(input, harnessId, model, log, defaultRoute);
+        // Q3=A: the PAID api_key route serves ONLY the EXPLICIT api_key
+        // preference (the user's paid election, or the sole permitted service of
+        // an empty/exhausted pool) — never silently under auto, which terminalizes
+        // typed instead; quotaAdmission.route carries the admission verdict.
+        const forcedApiKeyRoute = profile === null &&
+            (quotaAdmission?.model === model
+                ? quotaAdmission.route === "managed_api_key"
+                : this.credentials.poolApiKeyRoute(input, harnessId));
         return {
             // "auto" at ANY level falls through (thread turns send the thread default
             // "auto" as a per-run value; it must not shadow a configured preference).
-            auth_preference: effectiveAuthPreference(input.authPreference, cfg?.harnesses?.[harnessId]?.auth_preference, cfg?.routing?.auth_preference),
+            auth_preference: forcedApiKeyRoute
+                ? "api_key"
+                : effectiveAuthPreference(input.authPreference, cfg?.harnesses?.[harnessId]?.auth_preference, cfg?.routing?.auth_preference),
             resume_session_id: resumeSessionForProfile(input.resumeSessions?.[harnessId], profile),
             credential_profile: profile,
         };
@@ -350,138 +364,26 @@ export class Orchestrator {
      * Keyed by the run's REQUESTED credential profile — the same key the daemon's
      * `resumeMap` lookup uses (INV-135), so record and resume land in one home.
      */
-    laneHomeEnvFor(input, harnessId) {
+    laneHomeEnvFor(input, harnessId, 
+    // Keyed by the RESOLVED account (INV-135/137): the same key the recorded
+    // native session carries, so record and resume share one home.
+    resolvedProfileId) {
         if (!input.threadId)
             return null;
-        return new WorkspaceManager(input.repoRoot).laneHomeEnv(input.threadId, harnessId, 
-        // The lane is keyed by the EFFECTIVE account (INV-135): an explicit pin,
-        // else null resolves the same home the recorded native session lives in.
-        this.effectiveProfileId(input, harnessId)).env;
-    }
-    /**
-     * The per-harness EFFECTIVE credential profile id (INV-135 accounts
-     * authority): an explicit per-run/per-thread pin wins; else null — POOL AUTO,
-     * the native/CLI login default subject (enabled profiles route only by
-     * explicit pin or quota rotation, never as a silent Active default).
-     */
-    effectiveProfileId(input, _harnessId) {
-        return input.credentialProfileId ?? null;
-    }
-    /** Whether the native/CLI login is EXCLUDED from this harness's credential
-     * ladder (INV-135). When excluded, a harness with no effective profile has
-     * nothing routable and must refuse — never silently fall back into it. */
-    nativeCredentialsDisabled(repoRoot, harnessId) {
-        return (this.config(repoRoot)?.global.harnesses?.[harnessId]?.native_credentials_enabled === false);
-    }
-    resolveCredentialProfile(input, harnessId) {
-        const explicit = input.credentialProfileId ?? null;
-        const wanted = this.effectiveProfileId(input, harnessId);
-        if (!wanted)
-            return null;
-        const registry = this.config(input.repoRoot)?.global.credential_profiles ?? [];
-        try {
-            return resolveCredentialProfile(registry, wanted, harnessId);
-        }
-        catch (err) {
-            // With Active removed, `wanted` is always the explicit pin; keep the
-            // fail-closed guard so any future non-pin source still refuses loudly.
-            if (!explicit) {
-                throw new Error(`harness "${harnessId}" credential profile "${wanted}" is unusable: ${err instanceof Error ? err.message : String(err)}`);
-            }
-            throw err;
-        }
-    }
-    /** The typed effective auth route for a SELECTED credential profile
-     * (round-18 #2): adapters execute strictly by credential_kind, so routing,
-     * billing classification, model truth, and quota lookup must share this
-     * one fact — never the default store's sources or a previous default-route
-     * metric. null = no profile selected or it does not resolve here. */
-    profileAuthRoute(input, harnessId) {
-        try {
-            const profile = this.resolveCredentialProfile(input, harnessId);
-            if (!profile)
-                return null;
-            return profile.credential_kind === "api_key" ? "api_key" : "local_session";
-        }
-        catch {
-            return null;
-        }
-    }
-    profilePolicy(repoRoot, harnessId) {
-        const policy = this.config(repoRoot)?.global.harnesses?.[harnessId]?.profile_policy;
-        return policy ?? { limit_action: "fail", rotation_eligible: [], headroom_threshold: 0.9 };
-    }
-    /** The quota poller's authenticated vendor evidence for THIS decision epoch,
-     * read once so every profile in the epoch is judged against one observation
-     * set. This is what makes profile readiness at admission mean the same thing
-     * it means on the Accounts card (INV-135 honesty). */
-    vendorQuotaObservations() {
-        return {
-            snapshots: this.deps.quotaSnapshots?.() ?? [],
-            absences: this.deps.quotaAbsences?.() ?? [],
-        };
-    }
-    /** Fresh profile readiness for one rotation decision epoch. Accounts uses
-     * the same probe wrapper + vendor overlay + admission predicate when
-     * projecting next_up. */
-    async readyProfileIdsForRotation(input, harnessId, current, excluded = new Set()) {
-        const profiles = staticRotationCandidates({
-            registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
-            harnessId,
-            policy: this.profilePolicy(input.repoRoot, harnessId),
-            current,
-            excluded,
-        });
-        const adapter = this.deps.registry.get(harnessId);
-        const quota = this.vendorQuotaObservations();
-        const entries = await Promise.all(profiles.map(async (profile) => ({
-            profile,
-            // Rotating INTO a profile the vendor has already rejected would spend a
-            // whole attempt to rediscover the 401 the poller reported a minute ago.
-            status: vendorVerifiedProfileStatus(await probeCredentialProfileStatus(profile, adapter?.probeCredentialProfile?.bind(adapter)), quota),
-        })));
-        return new Set(entries
-            .filter(({ profile, status }) => profileStatusAdmits(profile, status))
-            .map(({ profile }) => profile.profile_id));
-    }
-    async preflightProfile(input, harnessId, model, log, defaultRoute) {
-        const profile = this.resolveCredentialProfile(input, harnessId);
-        const policy = this.profilePolicy(input.repoRoot, harnessId);
-        const registry = this.config(input.repoRoot)?.global.credential_profiles ?? [];
-        const snapshots = this.deps.quotaSnapshots?.() ?? [];
-        const emit = (type, payload) => log?.emit(type, payload);
-        const breach = profileHeadroomBreach(snapshots, harnessId, profile?.profile_id ?? null, policy.headroom_threshold, model);
-        const readyProfileIds = policy.limit_action === "rotate" &&
-            breach !== null &&
-            (profile !== null || defaultRoute === "local_session")
-            ? await this.readyProfileIdsForRotation(input, harnessId, profile)
-            : new Set();
-        if (!profile) {
-            // Unpinned runs (INV-135 auto-balance): under `rotate`, a fresh
-            // default-subject headroom breach starts on the next eligible
-            // subscription profile instead; `fail`/`ask` change nothing.
-            return preflightDefaultSubject({
-                harnessId,
-                policy,
-                registry,
-                snapshots,
-                readyProfileIds,
-                defaultRoute,
-                model,
-                emit,
-            });
-        }
-        return preflightCredentialProfile({
-            profile,
-            harnessId,
-            policy,
-            registry,
-            snapshots,
-            readyProfileIds,
-            model,
-            emit,
-        });
+        return new WorkspaceManager(input.repoRoot).laneHomeEnv(input.threadId, harnessId, resolvedProfileId).env;
     }
+    /** Credential-resolution cluster (INV-135), split to orchestrator-credentials.ts. */
+    credentials = new OrchestratorCredentials({
+        // Accessor functions: the field initializer runs before the constructor
+        // assigns this.deps, so every read defers to call time.
+        config: (repoRoot) => this.config(repoRoot),
+        registry: () => this.deps.registry,
+        quotaSnapshots: () => this.deps.quotaSnapshots?.() ?? [],
+        quotaAbsences: () => this.deps.quotaAbsences?.() ?? [],
+        credentialUnusable: () => this.deps.credentialUnusable?.() ?? [],
+        recordCredentialUnusable: (obs) => this.deps.recordCredentialUnusable?.(obs),
+        authPreferenceForHarness: (repoRoot, harnessId, runPreference) => this.authPreferenceForHarness(repoRoot, harnessId, runPreference),
+    });
     /**
      * Resolve candidate adapters: explicit `--harness`, else available real harnesses, then
      * **capability-gate** to those that can actually produce work for `intent` (e.g. a
@@ -547,10 +449,18 @@ export class Orchestrator {
                         : `credential profile "${input.credentialProfileId}" belongs to unavailable harness(es): ${registered.map((p) => p.harness_id).join(", ")}`);
             }
             else {
-                // Auto-pools take only doctor-OK harnesses (BIBLE §2: doctor decides
-                // readiness; a key string or degraded route is visible but not routable).
+                // Auto-pools take doctor-OK harnesses (BIBLE §2: doctor decides
+                // readiness; a key string or degraded route is visible but not
+                // routable) PLUS harnesses with enabled account rows: the default
+                // doctor only sees the default store, and a signed-in registry row is
+                // invisible to it (cursor after the host-Keychain retirement, or a
+                // named-rows-only claude/codex install). Row-bearing lanes still pass
+                // the per-lane row probe below before they are admitted.
+                const registry = this.config(input.repoRoot)?.global.credential_profiles ?? [];
                 ids = statuses
-                    .filter((s) => s.manifest?.kind !== "fake" && s.status === "ok" && s.enabledIntents.includes(intent))
+                    .filter((s) => s.manifest?.kind !== "fake" &&
+                    ((s.status === "ok" && s.enabledIntents.includes(intent)) ||
+                        accountPoolRows(registry, s.id).length > 0))
                     .map((s) => s.id);
                 if (ids.length === 0) {
                     throw new HarnessUnavailableError("no doctor-ok harness for this mode; install/login codex/claude/cursor/opencode (see `claudexor doctor`), or pass --harness explicitly");
@@ -598,7 +508,7 @@ export class Orchestrator {
         };
         // One observation set for the whole admission pass, so two lanes cannot be
         // judged against different vendor epochs.
-        const vendorQuota = this.vendorQuotaObservations();
+        const vendorQuota = this.credentials.vendorQuotaObservations();
         for (const id of ids) {
             const adapter = this.deps.registry.get(id);
             if (!adapter) {
@@ -621,13 +531,22 @@ export class Orchestrator {
                 dropLane(id, "settings", why);
                 continue;
             }
-            // INV-135 accounts authority: with the native/CLI login excluded and no
-            // explicit pin, an unpinned run has nothing routable. Refuse an explicit
-            // request naming the setting; drop it from an auto pool — never silently
-            // fall back INTO the disabled login.
-            if (this.effectiveProfileId(input, id) === null &&
-                this.nativeCredentialsDisabled(input.repoRoot, id)) {
-                const why = `${id} has no routable credential: the CLI login is disabled (harnesses.${id}.native_credentials_enabled=false) and no account is pinned (--profile)`;
+            // Incomplete unified-accounts migration refuses THIS harness only.
+            const migrationBlock = this.deps.accountsMigrationGate?.(id) ?? null;
+            if (migrationBlock) {
+                dropLane(id, "credential", migrationBlock.reason);
+                continue;
+            }
+            // INV-135: native login excluded + no rows + no pin ⇒ only the
+            // EXPLICITLY-requested paid route can serve (Q3=A — `auto` never
+            // silently takes the API key); everything else refuses/drops here,
+            // never a silent spawn INTO the disabled login.
+            if (this.credentials.effectiveProfileId(input, id) === null &&
+                this.credentials.nativeCredentialsDisabled(input.repoRoot, id) &&
+                accountPoolRows(this.config(input.repoRoot)?.global.credential_profiles ?? [], id)
+                    .length === 0 &&
+                this.authPreferenceForHarness(input.repoRoot, id, input.authPreference) !== "api_key") {
+                const why = `${id} has no routable credential: the CLI login is disabled (harnesses.${id}.native_credentials_enabled=false), no account is signed in, and the paid API-key route requires the explicit api_key preference (pin an account with --profile or connect one)`;
                 dropLane(id, "credential", why);
                 continue;
             }
@@ -656,37 +575,64 @@ export class Orchestrator {
             // routing truth). Capability/manifest gating above still applies.
             let profileAdmitted = false;
             const profileAdapter = this.deps.registry.get(id);
-            const profileVerdict = await selectedProfileAvailability({
-                registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
-                // The EFFECTIVE account (INV-135): an explicit pin is authenticated by ITS store.
-                profileId: this.effectiveProfileId(input, id),
-                harnessId: id,
-                probe: profileAdapter?.probeCredentialProfile?.bind(profileAdapter),
-                // `verification: passed` from the local store only means a login file
-                // is present. The poller's authenticated vendor call is the only
-                // liveness evidence we have, and admission is the surface that must
-                // act on it — otherwise the run dispatches into a revoked token.
-                quota: vendorQuota,
-            });
-            if (profileVerdict !== null) {
-                if (profileVerdict === "available") {
+            const profileProbe = profileAdapter?.probeCredentialProfile?.bind(profileAdapter);
+            const explicitPin = this.credentials.effectiveProfileId(input, id);
+            // The account candidates whose readiness may overlay the default-store
+            // verdict: the explicit pin when set; otherwise — row-aware UNPINNED
+            // admission — the thread-bound row followed by the harness's enabled
+            // pool rows, consulted only when the default doctor did not already
+            // admit the lane. A signed-in registry row is invisible to the default
+            // doctor (cursor after the host-Keychain retirement, or a named-rows-
+            // only claude/codex install), so an unpinned run must be admitted on
+            // row readiness exactly the way explicit pins already are.
+            const rowCandidateIds = [];
+            if (explicitPin) {
+                rowCandidateIds.push(explicitPin);
+            }
+            else if (status.status !== "ok") {
+                const pool = accountPoolRows(this.config(input.repoRoot)?.global.credential_profiles ?? [], id);
+                const bound = input.threadAccountBindings?.[id] ?? null;
+                rowCandidateIds.push(...(bound && pool.some((row) => row.profile_id === bound) ? [bound] : []), ...pool.map((row) => row.profile_id).filter((rowId) => rowId !== bound));
+            }
+            let lastRowVerdict = null;
+            for (const candidateId of rowCandidateIds) {
+                const verdict = await selectedProfileAvailability({
+                    registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
+                    profileId: candidateId,
+                    harnessId: id,
+                    probe: profileProbe,
+                    // `verification: passed` from the local store only means a login file
+                    // is present. The poller's authenticated vendor call is the only
+                    // liveness evidence we have, and admission is the surface that must
+                    // act on it — otherwise the run dispatches into a revoked token.
+                    quota: vendorQuota,
+                });
+                if (verdict === "available") {
                     profileAdmitted = true;
-                    // A valid profile restores manifest intent truth when the default store failed.
-                    if (status.status !== "ok") {
-                        status = {
-                            ...status,
-                            status: "degraded",
-                            enabledIntents: capabilityIntents(manifest.capabilities),
-                        };
-                        statusById.set(id, status);
-                    }
+                    break;
                 }
-                else {
-                    const why = `${id} credential profile is not ready: ${profileVerdict}`;
-                    dropLane(id, "credential", why);
-                    continue;
+                lastRowVerdict = verdict;
+            }
+            if (profileAdmitted) {
+                // A valid account row restores manifest intent truth when the default store failed.
+                if (status.status !== "ok") {
+                    status = {
+                        ...status,
+                        status: "degraded",
+                        enabledIntents: capabilityIntents(manifest.capabilities),
+                    };
+                    statusById.set(id, status);
                 }
             }
+            else if (explicitPin) {
+                // An explicit pin that is not ready refuses/drops the lane; a
+                // not-ready UNPINNED row merely leaves the default doctor verdict in
+                // charge (the gates below keep the refusal honest when neither a row
+                // nor a default login exists).
+                const why = `${id} credential profile is not ready: ${lastRowVerdict}`;
+                dropLane(id, "credential", why);
+                continue;
+            }
             if (status.status === "unavailable" && !profileAdmitted) {
                 const why = `${id} is unavailable${status.reasons.length ? `: ${status.reasons.join("; ")}` : ""}`;
                 dropLane(id, "doctor", why);
@@ -749,7 +695,7 @@ export class Orchestrator {
                     knownModels: manifest.capabilities.known_models,
                     // A selected profile's credential_kind IS the route (round-18 #2);
                     // the default store's sources apply only to profile-less runs.
-                    authRouteEstimate: this.profileAuthRoute(input, id) ??
+                    authRouteEstimate: this.credentials.profileAuthRoute(input, id) ??
                         estimateEffectiveAuthRoute(this.authPreferenceForHarness(input.repoRoot, id, input.authPreference), status.authSources),
                     quotaAdmission: { model: null, profile: null, route: null },
                     supportsSynthesize: manifest.capabilities.synthesize,
@@ -790,20 +736,41 @@ export class Orchestrator {
         // particular, an opt-in default-subject rotation has to select its ready
         // profile before the budget router filters the exhausted default away.
         // The same resolved profile is reused by the first spec build below.
-        const quotaPreparedPool = await Promise.all(pool.map(async (routed) => {
+        const quotaPrepared = await Promise.all(pool.map(async (routed) => {
             const model = input.models?.[routed.adapter.id] ?? routed.settings?.defaultModel ?? null;
-            const profile = await this.preflightProfile(input, routed.adapter.id, model, log, routed.authRouteEstimate);
+            let profile;
+            try {
+                profile = await this.credentials.preflightProfile(input, routed.adapter.id, model, log, routed.authRouteEstimate);
+            }
+            catch (err) {
+                // Q3=A: ONE harness's exhausted account pool must not kill an AUTO
+                // multi-harness run — the lane drops with the typed disclosure and a
+                // surviving sibling serves. An EXPLICIT pool (and the last remaining
+                // auto lane) keeps the typed `credential_pool_exhausted` terminal so
+                // its code + earliest reset reach failure.yaml intact.
+                if (!explicitPool &&
+                    pool.length > 1 &&
+                    err.code === "credential_pool_exhausted") {
+                    dropLane(routed.adapter.id, "credential", safeErrorMessage(err));
+                    return null;
+                }
+                throw err;
+            }
             const route = profile
                 ? profile.credential_kind === "api_key"
                     ? "managed_api_key"
                     : "vendor_native"
-                : routed.authRouteEstimate === "api_key"
-                    ? "managed_api_key"
-                    : routed.authRouteEstimate === "local_session"
-                        ? "vendor_native"
-                        : null;
+                : // The explicitly-opted PAID route (Q3=A) classifies as managed_api_key.
+                    this.credentials.poolApiKeyRoute(input, routed.adapter.id)
+                        ? "managed_api_key"
+                        : routed.authRouteEstimate === "api_key"
+                            ? "managed_api_key"
+                            : routed.authRouteEstimate === "local_session"
+                                ? "vendor_native"
+                                : null;
             return { ...routed, quotaAdmission: { model, profile, route } };
         }));
+        const quotaPreparedPool = quotaPrepared.filter((routed) => routed !== null);
         const ordered = this.orderPool(quotaPreparedPool, input, intent, statusById, ledger, runId);
         if (ordered.length === 0) {
             throw new HarnessUnavailableError(`no harness remains eligible for '${intent}' after budget and quota routing`);
@@ -883,7 +850,7 @@ export class Orchestrator {
             }
         }
         // Strict pre-run model gate (INV-104) — see modelGovernance.ts.
-        await assertRouteModelsAllowed(out, input.models, this.execRootOf(input));
+        await assertRouteModelsAllowed(out, input.models, this.execRootOf(input), (id) => routeContext ? (routeContext.envForHarness?.(id) ?? routeContext.env) : undefined);
         return out;
     }
     /**
@@ -1347,7 +1314,7 @@ export class Orchestrator {
                 adapter: this.deps.registry.get(harnessId),
                 credentialProfile: sessionFields.credential_profile,
                 authPreference: sessionFields.auth_preference ?? "auto",
-                laneEnv: this.laneHomeEnvFor(runInput, harnessId) ?? {},
+                laneEnv: this.laneHomeEnvFor(runInput, harnessId, profileId) ?? {},
                 envInheritance: envInheritance(this.config(runInput.repoRoot)),
                 signal: runInput.signal,
             });
@@ -1501,13 +1468,12 @@ export class Orchestrator {
         let cost = 0;
         let costEstimated = false;
         let harnessErrored = false;
-        // W-C4 delta flood budget (per attempt): counts forwarded delta chunks.
-        let deltaCount = 0;
-        let deltaCutoffDisclosed = false;
+        let poolExhausted = null; // A5: typed pool-exhausted refusal
+        const deltaFlood = { count: 0, disclosed: false }; // W-C4 per-attempt delta budget
         // QA-024: emit the belt-failure disclosure event at most once per attempt.
         let beltFailureDisclosed = false;
         const errors = [];
-        const answer = new AnswerAssembly();
+        let answer = new AnswerAssembly();
         const retryPolicy = transientRetryPolicy(this.config(contract.repo.root));
         // QA-024: the delegation belt is the ONLY engine-owned extra MCP server
         // injected into an agent lane (the browser MCP rides its own field), so its
@@ -1533,6 +1499,11 @@ export class Orchestrator {
         }
         try {
             for (let nativeTry = 0; !signal?.aborted; nativeTry += 1) {
+                // A3 per-try isolation: neither output nor progress markers leak across tries.
+                if (nativeTry > 0) {
+                    answer = new AnswerAssembly();
+                    telemetry.outputMarkers = newAttemptOutputMarkers();
+                }
                 const clearFileBackedContext = stageFileBackedContext(envelope.worktree_path, fileBackedContext);
                 const runSpec = nativeTry === 0
                     ? spec
@@ -1552,7 +1523,7 @@ export class Orchestrator {
                 const rateLimitStart = telemetry.rateLimits.length;
                 let rawPatch = null;
                 try {
-                    const watched = withInactivityWatchdog(adapter.run(runSpec), {
+                    const watched = withInactivityWatchdog(runModelGovernedRoute(routed, runSpec), {
                         timeoutMs: inactivityMs,
                         countsAsProgress: countsAsAgentProgress,
                         onTimeout: () => {
@@ -1572,27 +1543,8 @@ export class Orchestrator {
                         if (ev.type === "patch_produced")
                             continue;
                         const safeEv = redactHarnessEvent(ev);
-                        // W-C4 flood guard (review sol #10): a per-character delta stream
-                        // would otherwise persist/SSE one journal event PER CHUNK without
-                        // bound. Delta messages are DISPLAY-only (the complete message
-                        // still follows and carries the authoritative text), so past a
-                        // per-attempt budget we DROP further deltas and disclose the
-                        // cutoff ONCE — the final answer is unaffected.
-                        if (safeEv.type === "message" && safeEv.payload?.["delta"] === true) {
-                            deltaCount += 1;
-                            if (deltaCount > Orchestrator.MAX_DELTAS_PER_ATTEMPT) {
-                                if (!deltaCutoffDisclosed) {
-                                    deltaCutoffDisclosed = true;
-                                    log?.emit("harness.event", {
-                                        harness_id: adapter.id,
-                                        attempt_id: attemptId,
-                                        type: "status",
-                                        title: `live delta stream capped at ${Orchestrator.MAX_DELTAS_PER_ATTEMPT} chunks; the complete message still lands`,
-                                    });
-                                }
-                                continue; // drop this delta; never journal past the budget
-                            }
-                        }
+                        if (dropDeltaPastBudget(safeEv, deltaFlood, Orchestrator.MAX_DELTAS_PER_ATTEMPT, (t, p) => log?.emit(t, p), adapter.id, attemptId))
+                            continue;
                         safeInvoke(onHarnessEvent, safeEv);
                         // In-place turns run in the live tree under the native environment, so
                         // the session they emit IS reachable for the next turn: record it. An
@@ -1619,15 +1571,7 @@ export class Orchestrator {
                                 reason: "mcp_server_failed_to_start",
                             });
                         }
-                        // Live plan checklist: forward the adapter's typed plan
-                        // progress as a run event (LAST WINS; the UI renders the latest).
-                        if (safeEv.plan_progress) {
-                            log?.emit("plan.progress", {
-                                attempt_id: attemptId,
-                                harness_id: adapter.id,
-                                items: safeEv.plan_progress.items,
-                            });
-                        }
+                        emitPlanProgress((t, p) => log?.emit(t, p), adapter.id, attemptId, safeEv);
                         if (safeEv.type === "usage") {
                             const usage = processAttemptUsage({
                                 event: safeEv,
@@ -1683,38 +1627,53 @@ export class Orchestrator {
                 }
                 const newTransients = telemetry.transientFailures.slice(transientStart);
                 const transient = newTransients.at(-1) ?? null;
-                // #31: the centralized retry gate reads the classified `retryable`, not a
-                // bare "saw any transient" boolean.
+                // #31: the centralized retry gate reads the classified `retryable` verdict.
                 const sawRetryable = newTransients.some((f) => f.retryable);
                 const sawTypedLimit = telemetry.rateLimits.length > rateLimitStart;
                 const currentDiff = await wsm.diff(envelope);
-                const currentAnswer = answer.text();
-                const deliverableEmpty = currentDiff.trim().length === 0 && currentAnswer.length === 0;
-                // W5.4 failover: a typed-limit hit rebuilds the spec on a NEW vendor
-                // session under the next profile with provenance (vendor_limit_rejected).
+                const deliverableEmpty = currentDiff.trim().length === 0 && answer.text().length === 0;
+                // W5.4 + A2 failover: a typed-limit hit OR a structural pre-progress
+                // death rebuilds the spec on a NEW session under the next profile.
                 if (harnessErrored && runInput && !signal?.aborted) {
-                    const rotationPolicy = this.profilePolicy(contract.repo.root, adapter.id);
-                    const readyProfileIds = sawTypedLimit && deliverableEmpty && rotationPolicy.limit_action === "rotate"
-                        ? await this.readyProfileIdsForRotation(runInput, adapter.id, spec.credential_profile ?? null, triedProfiles)
-                        : new Set();
-                    const rotated = rotateSpecOnTypedLimit({
+                    const rotated = await rotateSpecOnTypedLimit({
                         spec,
                         harnessId: adapter.id,
                         attemptId,
-                        policy: rotationPolicy,
+                        policy: this.credentials.profilePolicy(contract.repo.root, adapter.id),
                         registry: this.config(contract.repo.root)?.global.credential_profiles ?? [],
                         snapshots: this.deps.quotaSnapshots?.() ?? [],
-                        readyProfileIds,
+                        probeReadyProfiles: () => this.credentials.readyProfileIdsForRotation(runInput, adapter.id, spec.credential_profile ?? null, triedProfiles, spec.model_hint ?? null),
+                        ...this.credentials.rotationObservations(adapter, spec, newTransients),
                         triedProfiles,
+                        markers: telemetry.outputMarkers,
                         sawTypedLimit,
-                        deliverableEmpty,
+                        sawRetryable,
+                        attemptErrored: harnessErrored,
+                        // Rotation evidence reads the POLICY-accepted try output: refusal
+                        // prose arriving as mid-stream MESSAGE events (claude org-disabled)
+                        // is no deliverable; the transient gate keeps RAW deliverableEmpty.
+                        deliverableEmpty: currentDiff.trim().length === 0 &&
+                            acceptedTryOutput(answer, harnessErrored).length === 0,
+                        workspaceDiffNonEmpty: currentDiff.trim().length > 0,
                         lastLimit: telemetry.rateLimits.at(-1) ?? null,
                         emit: (type, payload) => log?.emit(type, payload),
                         newSessionId: () => newId("ses"),
                         defaultRouteWasVendorNative: routed.authRouteEstimate === "local_session",
+                        // D-U6: an explicit pin never rotates; pool-selected rows do.
+                        pinned: runInput.credentialProfileId != null,
                     });
+                    // A5 ordering: an exhausted pool terminalizes TYPED here, BEFORE the
+                    // transient gate below burns same-profile retries (limits classify
+                    // as retryable) on the already-refused subject.
+                    if (rotated && "poolExhausted" in rotated) {
+                        poolExhausted = rotated.poolExhausted;
+                        errors.push(safeErrorMessage(poolExhausted));
+                        break;
+                    }
                     if (rotated) {
-                        spec = rotated;
+                        // INV-137: the rotated row runs in ITS OWN lane home (no-op for
+                        // isolated envelopes and native-env in-place turns).
+                        spec = rotatedSpecInLaneHome(spec, rotated, (id) => this.laneHomeEnvFor(runInput, adapter.id, id), runInput.credentialProfileId ?? null);
                         applied = appliedNow();
                         errors.length = 0;
                         harnessErrored = false;
@@ -1727,21 +1686,7 @@ export class Orchestrator {
                     nativeTry >= retryPolicy.maxRetries ||
                     signal?.aborted)
                     break;
-                const nextTry = nativeTry + 1;
-                const delayMs = transientRetryDelayMs(transient?.retryDelayMs ?? null, retryPolicy, nativeTry);
-                log?.emit("route.transient.detected", {
-                    harness_id: adapter.id,
-                    attempt_id: attemptId,
-                    kind: transient?.kind ?? "unknown",
-                    category: transient?.category ?? "unknown_harness_error",
-                    native_try: nativeTry + 1,
-                });
-                log?.emit("route.transient.retry_scheduled", {
-                    harness_id: adapter.id,
-                    attempt_id: attemptId,
-                    retry: nextTry,
-                    delay_ms: delayMs,
-                });
+                const delayMs = emitTransientRetryPlan((t, p) => log?.emit(t, p), adapter.id, attemptId, transient, nativeTry, retryPolicy);
                 errors.length = 0;
                 harnessErrored = false;
                 await sleep(delayMs);
@@ -1750,22 +1695,18 @@ export class Orchestrator {
         finally {
             signal?.removeEventListener("abort", onAbort);
         }
-        if (harnessErrored && telemetry.transientFailures.length > 0) {
-            log?.emit("route.transient.exhausted", {
-                harness_id: adapter.id,
-                attempt_id: attemptId,
-                category: telemetry.transientFailures.at(-1)?.category ?? "unknown_harness_error",
-                retries: retryPolicy.maxRetries,
-            });
+        // A pool-exhausted terminal is rotation's verdict, not the transient
+        // machinery's — no `route.transient.exhausted` rides along with it.
+        if (harnessErrored && !poolExhausted) {
+            emitTransientExhausted((t, p) => log?.emit(t, p), adapter.id, attemptId, telemetry, retryPolicy.maxRetries);
         }
         const attemptStreamEndedMs = Date.now();
         if (webUnsatisfied(telemetry)) {
             errors.push(webEvidenceFailure(telemetry.web));
         }
-        // D-16: remove the WorkReport transport so answer.md persists only the deliverable.
-        const unwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", workReportMode, {
-            sideToolReport: telemetry.sideToolWorkReport ?? undefined,
-        });
+        // D-16: answer.md persists only the deliverable. A3: an errored attempt
+        // with no typed final contributes no answer material (acceptedTryOutput).
+        const unwrapped = unwrapWorkReportEnvelope(acceptedTryOutput(answer, harnessErrored), workReportMode, { sideToolReport: telemetry.sideToolWorkReport ?? undefined });
         const redacted = redactSecrets(unwrapped.deliverable);
         const candidateAnswer = redacted.trim().length > 0 ? redacted : undefined;
         const { diff, refusal: secretDiffRefusal } = await secretDiff.quarantineCandidateWorkspace(wsm, envelope, inPlaceEnvelope, candidateAnswer);
@@ -1892,6 +1833,8 @@ export class Orchestrator {
             errors: errors.slice(0, 8),
             telemetry,
             ...(secretDiffRefusal ? { secretDiffRefusal } : {}),
+            // A5: the typed refusal survives NORMAL attempt finalization (no throw).
+            ...(poolExhausted ? { declaredFailure: declaredFailure(poolExhausted) } : {}),
             outcomeClass: finalized.outcomeClass,
             applied,
         };
@@ -2313,7 +2256,7 @@ export class Orchestrator {
                     error: message,
                     phase: infraPhase,
                 });
-                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message, appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.effectiveProfileId(input, adapter.id))));
+                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message, appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.credentials.effectiveProfileId(input, adapter.id))));
                 runsBySlot[slotIdx] = {
                     attemptId: slot.attemptId,
                     harnessId: adapter.id,
@@ -2334,7 +2277,7 @@ export class Orchestrator {
                     // alive past this catch; `message` alone would force the terminal to
                     // read prose back out.
                     ...(declared.code ? { declaredFailure: declared } : {}),
-                    applied: appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.effectiveProfileId(input, adapter.id)),
+                    applied: appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.credentials.effectiveProfileId(input, adapter.id)),
                 };
             }
             finally {
@@ -3466,6 +3409,8 @@ export class Orchestrator {
                     // carry their route-specific settlement from runCandidateInEnvelope.
                     const failureCost = AC.attemptFailureCost(err, "attempt-error");
                     const message = safeErrorMessage(err);
+                    // A5: keep a TYPED refusal alive past this catch (race-lane parity).
+                    const declared = declaredFailure(err);
                     ledger.settle(lease.lease?.lease_id ?? "", failureCost.settlement);
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
@@ -3473,9 +3418,9 @@ export class Orchestrator {
                         status: "failed",
                         error: message,
                     });
-                    store.writeYaml(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message, appliedAttemptFacts(harnessHome, routed.adapterAccess, this.effectiveProfileId(input, adapter.id))));
+                    store.writeYaml(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message, appliedAttemptFacts(harnessHome, routed.adapterAccess, this.credentials.effectiveProfileId(input, adapter.id))));
                     run = {
-                        applied: appliedAttemptFacts(harnessHome, routed.adapterAccess, this.effectiveProfileId(input, adapter.id)),
+                        applied: appliedAttemptFacts(harnessHome, routed.adapterAccess, this.credentials.effectiveProfileId(input, adapter.id)),
                         attemptId,
                         harnessId: adapter.id,
                         label: `Attempt ${attempt}`,
@@ -3485,6 +3430,7 @@ export class Orchestrator {
                         errored: true,
                         costEstimated: failureCost.estimated,
                         errors: [message],
+                        ...(declared.code ? { declaredFailure: declared } : {}),
                         telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb, [routed.browserRequirement, routed.denyRequirement, routed.delegationRequirement], knobs.model),
                     };
                 }
@@ -3884,6 +3830,11 @@ export class Orchestrator {
         // failure record + fires run.blocked even though the lifecycle succeeded.
         const convIsFailureTerminal = facts.lifecycle !== "succeeded" || convNeedsDecision;
         if (convIsFailureTerminal) {
+            // A5 last-result lift: the LAST attempt's typed mid-attempt refusal
+            // survives onto the terminal; budget/cancel/needs-decision outrank it.
+            const convDeclared = !convNeedsDecision && facts.lifecycle === "failed" && !isBudgetTerminal(facts.reason)
+                ? lastRun?.declaredFailure
+                : undefined;
             writeFailure(store, paths, {
                 phase: convNeedsDecision ? "review" : "convergence",
                 category: isBudgetTerminal(facts.reason)
@@ -3892,7 +3843,9 @@ export class Orchestrator {
                         ? "cancelled"
                         : convNeedsDecision
                             ? "policy"
-                            : "internal",
+                            : (convDeclared?.category ?? "internal"),
+                code: convDeclared?.code ?? null,
+                resetsAt: convDeclared?.resetsAt ?? null,
                 safeMessage: convNeedsDecision
                     ? `review escalated to a human decision after ${attempt} attempt(s)`
                     : facts.reason === "stuck_no_progress"
@@ -4030,7 +3983,9 @@ export class Orchestrator {
                     ...sessionFields,
                     ...this.harnessSpecKnobs(contract, knobs, args.intent),
                     env_inheritance: envInheritance(this.config(input.repoRoot)),
-                    env: (args.laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? args.fallbackHome,
+                    env: (args.laneRun
+                        ? this.laneHomeEnvFor(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null)
+                        : null) ?? args.fallbackHome,
                 });
                 const plannerAbort = new AbortController();
                 spec.extra["abortSignal"] = input.signal
@@ -4077,15 +4032,14 @@ export class Orchestrator {
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // W3.3: ONE resolved read-only context — the routing point-probe and every
-        // planner spawn consume the SAME scoped env (see routeContext.ts). The
-        // probe home stays a disposable throwaway even for a thread lane turn (auth
-        // truth is home-independent); only the planner spawn swaps in the durable
-        // per-lane home below so its recorded native session survives.
-        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input));
+        // planner spawn consume the SAME scoped env (see routeContext.ts).
         // A thread PLAN turn is a chat turn (INV-034): plan candidates are distinct
-        // harnesses run sequentially, so each records its own lane's native session
-        // and the next lane turn resumes it via `sessionSpecFields.resume_session_id`.
+        // harnesses run sequentially. Doctor, model inventory, and spawn share each
+        // lane's durable HOME; the disposable context remains the non-thread fallback.
         const laneRun = Boolean(input.threadId);
+        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input), laneRun
+            ? (id) => this.laneHomeEnvFor(input, id, input.credentialProfileId ?? null)
+            : undefined);
         let adapters;
         try {
             adapters = await this.resolveCandidateAdapters({ ...input, n: undefined }, "plan", ledger, log, roHome, runId);
@@ -4348,7 +4302,7 @@ export class Orchestrator {
     }
     routeBillingKnowledge(input, harnessId) {
         // A selected profile's credential_kind decides billing (round-18 #2).
-        const profileRoute = this.profileAuthRoute(input, harnessId);
+        const profileRoute = this.credentials.profileAuthRoute(input, harnessId);
         if (profileRoute)
             return profileRoute === "api_key" ? "metered" : "unknown";
         // Deps-closure site: no selected route exists yet, so the RESOLVED
@@ -4446,17 +4400,13 @@ export class Orchestrator {
                 : Math.min(Math.max(input.n ?? 2, 1), 3);
         // W3.3: ONE resolved read-only context — the routing point-probe and every
         // read-only attempt spawn consume the SAME scoped env (see routeContext.ts).
-        // The point-probe home is a disposable throwaway even for a thread lane
-        // turn: readiness auth truth is home-INDEPENDENT (credentials come from the
-        // profile/keychain/default store, never the scoped home), so the probe and
-        // the run share the same auth source; only the ACTUAL spawn swaps in the
-        // durable per-lane home below so the recorded native session survives.
-        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input));
         // A thread ASK turn is a chat turn: its native session is recorded per lane
-        // and the next lane turn resumes it (INV-034). Deep-scan (multi-scout
-        // research) and orchestrate (tool-belt planner, not the user's chat) are
-        // NOT lane chat turns — they keep the disposable home and record nothing.
+        // and the next lane turn resumes it (INV-034). Its doctor/model/spawn path
+        // shares that lane HOME; deep-scan and one-shot asks keep the disposable one.
         const laneRun = Boolean(input.threadId) && opts.mode === "ask" && !opts.deepScan;
+        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input), laneRun
+            ? (id) => this.laneHomeEnvFor(input, id, input.credentialProfileId ?? null)
+            : undefined);
         let adapters;
         try {
             adapters = await this.resolveCandidateAdapters({ ...input, prompt, n: width }, opts.intent, ledger, log, roHome, runId, 
@@ -4640,7 +4590,9 @@ export class Orchestrator {
                     // A thread lane turn spawns in its DURABLE per-lane home so the native
                     // session it records is reachable for resume next turn; everything else
                     // uses the disposable route-context home.
-                    env: (laneRun ? this.laneHomeEnvFor(input, adapter.id) : null) ?? roHome.env,
+                    env: (laneRun
+                        ? this.laneHomeEnvFor(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null)
+                        : null) ?? roHome.env,
                 });
                 const reportAbort = new AbortController();
                 spec.extra["abortSignal"] = input.signal
@@ -4687,6 +4639,7 @@ export class Orchestrator {
                     harnessErrored: true,
                     webRequiredUnsatisfied: false,
                 });
+                const preDeclared = declaredFailure(preparation.error);
                 attempts.push({
                     attemptId,
                     harnessId: adapter.id,
@@ -4694,6 +4647,7 @@ export class Orchestrator {
                     report: "",
                     error: message,
                     telemetry,
+                    ...(preDeclared.code ? { declaredFailure: preDeclared } : {}), // typed pre-spawn refusal
                 });
                 attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
                 if (opts.deepScan) {
@@ -4701,7 +4655,8 @@ export class Orchestrator {
                 }
                 return { status: "launched" };
             }
-            const { knobs, spec: preparedSpec, reportAbort, reportInteraction, readonlyWorkMode, attemptEventsPath, answer, telemetry, } = preparation.value;
+            const { knobs, spec: preparedSpec, reportAbort, reportInteraction, readonlyWorkMode, attemptEventsPath, telemetry, } = preparation.value;
+            let { answer } = preparation.value;
             let spec = preparedSpec;
             const retryPolicy = transientRetryPolicy(this.config(input.repoRoot));
             let activeSessionId = spec.session_id;
@@ -4717,9 +4672,16 @@ export class Orchestrator {
             let cost = 0;
             let costEstimated = false;
             let harnessError = null;
+            let poolExhausted = null; // A5: typed pool-exhausted refusal
             try {
                 const triedProfiles = new Set(); // W5.4 failover: each profile at most once
                 for (let nativeTry = 0; !input.signal?.aborted; nativeTry += 1) {
+                    // A3 per-try isolation (candidate-lane parity): neither a failed try's
+                    // output nor its progress markers leak into the next try's evidence.
+                    if (nativeTry > 0) {
+                        answer = new AnswerAssembly();
+                        telemetry.outputMarkers = newAttemptOutputMarkers();
+                    }
                     const runSpec = nativeTry === 0
                         ? spec
                         : HarnessRunSpec.parse({
@@ -4740,7 +4702,7 @@ export class Orchestrator {
                         ...(knobs.ignored.length > 0 ? { ignored_settings: knobs.ignored } : {}),
                     });
                     try {
-                        const watchedReport = withInactivityWatchdog(adapter.run(runSpec), {
+                        const watchedReport = withInactivityWatchdog(runModelGovernedRoute(routed, runSpec), {
                             timeoutMs: harnessInactivityTimeoutMs(this.config(input.repoRoot)),
                             countsAsProgress: countsAsAgentProgress,
                             onTimeout: () => {
@@ -4767,29 +4729,14 @@ export class Orchestrator {
                             log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv));
                             appendLine(attemptEventsPath, JSON.stringify(safeEv));
                             observeAttemptTelemetry(telemetry, safeEv);
-                            if (safeEv.plan_progress) {
-                                log.emit("plan.progress", {
-                                    attempt_id: attemptId,
-                                    harness_id: adapter.id,
-                                    items: safeEv.plan_progress.items,
-                                });
-                            }
+                            emitPlanProgress((t, p) => log.emit(t, p), adapter.id, attemptId, safeEv);
                             // read-only routes burn quota too (the orchestrate PLANNER is
                             // the loudest) — same single owner as the agent loop.
                             observeBudgetSignals(ledger, log, adapter.id, attemptId, safeEv, budgetSignalState);
                             this.deps.quotaEventSink?.(adapter.id, safeEv);
-                            if (safeEv.type === "usage" && safeEv.usage?.cost_usd) {
-                                cost += safeEv.usage.cost_usd;
-                                if (safeEv.usage.estimated)
-                                    costEstimated = true;
-                                log.emit("budget.observation", {
-                                    harness_id: adapter.id,
-                                    attempt_id: attemptId,
-                                    kind: "spend",
-                                    usd: safeEv.usage.cost_usd,
-                                    estimated: safeEv.usage.estimated === true,
-                                });
-                            }
+                            const spend = observeReadonlySpend(safeEv, (t, p) => log.emit(t, p), adapter.id, attemptId);
+                            cost += spend.costUsd;
+                            costEstimated ||= spend.estimated;
                             // A TYPED final message wins verbatim over joined narration.
                             answer.observe(safeEv);
                             if (safeEv.type === "error")
@@ -4800,8 +4747,7 @@ export class Orchestrator {
                     }
                     catch (err) {
                         harnessError = safeErrorMessage(err);
-                        // #31: classify the throw so the retry gate and required-actions read
-                        // a typed category (watchdog timeout vs process crash).
+                        // #31: classify the throw (watchdog timeout vs process crash) as typed.
                         telemetry.transientFailures.push(classifyAdapterThrow({ errorName: err instanceof Error ? err.name : null }));
                     }
                     const newTransients = telemetry.transientFailures.slice(transientStart);
@@ -4809,31 +4755,48 @@ export class Orchestrator {
                     const sawRetryable = newTransients.some((f) => f.retryable);
                     const sawTypedLimit = telemetry.rateLimits.length > rateLimitStart;
                     const reportSoFar = answer.text();
-                    // W5.4 reactive failover, READ-ONLY lane (same contract as the
-                    // candidate lane; typed limits only, never plain transients).
+                    // W5.4 + A2 reactive failover, READ-ONLY lane (same contract as the
+                    // candidate lane: typed limit or structural pre-progress death).
                     if (harnessError && !input.signal?.aborted) {
-                        const rotationPolicy = this.profilePolicy(input.repoRoot, adapter.id);
-                        const readyProfileIds = sawTypedLimit && reportSoFar.length === 0 && rotationPolicy.limit_action === "rotate"
-                            ? await this.readyProfileIdsForRotation(input, adapter.id, spec.credential_profile ?? null, triedProfiles)
-                            : new Set();
-                        const rotated = rotateSpecOnTypedLimit({
+                        const rotated = await rotateSpecOnTypedLimit({
                             spec,
                             harnessId: adapter.id,
                             attemptId,
-                            policy: rotationPolicy,
+                            policy: this.credentials.profilePolicy(input.repoRoot, adapter.id),
                             registry: this.config(input.repoRoot)?.global.credential_profiles ?? [],
                             snapshots: this.deps.quotaSnapshots?.() ?? [],
-                            readyProfileIds,
+                            probeReadyProfiles: () => this.credentials.readyProfileIdsForRotation(input, adapter.id, spec.credential_profile ?? null, triedProfiles, spec.model_hint ?? null),
+                            ...this.credentials.rotationObservations(adapter, spec, newTransients),
                             triedProfiles,
+                            markers: telemetry.outputMarkers,
                             sawTypedLimit,
-                            deliverableEmpty: reportSoFar.length === 0,
+                            sawRetryable,
+                            attemptErrored: harnessError !== null,
+                            // Same policy owner as the candidate lane: an errored try's
+                            // narration is not a report; the transient gate keeps reportSoFar.
+                            deliverableEmpty: acceptedTryOutput(answer, harnessError !== null).length === 0,
                             lastLimit: telemetry.rateLimits.at(-1) ?? null,
                             emit: (type, payload) => log.emit(type, payload),
                             newSessionId: () => newId("ses"),
                             defaultRouteWasVendorNative: routed.authRouteEstimate === "local_session",
+                            // D-U6: an explicit pin never rotates; pool-selected rows do.
+                            pinned: input.credentialProfileId != null,
                         });
+                        // A5 ordering: same as the candidate lane — terminalize typed
+                        // before the transient gate burns same-profile retries. The pool
+                        // refusal APPENDS to the original harness error (candidate-lane
+                        // parity: errors.push) instead of erasing the true failure.
+                        if (rotated && "poolExhausted" in rotated) {
+                            poolExhausted = rotated.poolExhausted;
+                            harnessError = harnessError
+                                ? `${harnessError}; ${safeErrorMessage(poolExhausted)}`
+                                : safeErrorMessage(poolExhausted);
+                            break;
+                        }
                         if (rotated) {
-                            spec = rotated;
+                            // INV-137: the rotated row's session must land in ITS OWN lane
+                            // home — never the previous row's lane store.
+                            spec = rotatedSpecInLaneHome(spec, rotated, (id) => this.laneHomeEnvFor(input, adapter.id, id), input.credentialProfileId ?? null);
                             harnessError = null;
                             continue;
                         }
@@ -4844,21 +4807,7 @@ export class Orchestrator {
                         nativeTry >= retryPolicy.maxRetries ||
                         input.signal?.aborted)
                         break;
-                    const nextTry = nativeTry + 1;
-                    const delayMs = transientRetryDelayMs(transient?.retryDelayMs ?? null, retryPolicy, nativeTry);
-                    log.emit("route.transient.detected", {
-                        harness_id: adapter.id,
-                        attempt_id: attemptId,
-                        kind: transient?.kind ?? "unknown",
-                        category: transient?.category ?? "unknown_harness_error",
-                        native_try: nativeTry + 1,
-                    });
-                    log.emit("route.transient.retry_scheduled", {
-                        harness_id: adapter.id,
-                        attempt_id: attemptId,
-                        retry: nextTry,
-                        delay_ms: delayMs,
-                    });
+                    const delayMs = emitTransientRetryPlan((t, p) => log.emit(t, p), adapter.id, attemptId, transient, nativeTry, retryPolicy);
                     harnessError = null;
                     await sleep(delayMs);
                 }
@@ -4877,19 +4826,13 @@ export class Orchestrator {
                     preStreamFailureSource: "readonly-pre-stream",
                 });
             }
-            if (harnessError && telemetry.transientFailures.length > 0) {
-                log.emit("route.transient.exhausted", {
-                    harness_id: adapter.id,
-                    attempt_id: attemptId,
-                    category: telemetry.transientFailures.at(-1)?.category ?? "unknown_harness_error",
-                    retries: retryPolicy.maxRetries,
-                });
+            if (harnessError && !poolExhausted) {
+                emitTransientExhausted((t, p) => log.emit(t, p), adapter.id, attemptId, telemetry, retryPolicy.maxRetries);
             }
             attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
-            // D-16: remove the WorkReport transport; the deliverable is the report.
-            const roUnwrapped = unwrapWorkReportEnvelope(answer.machineText() ?? "", readonlyWorkMode, {
-                sideToolReport: telemetry.sideToolWorkReport ?? undefined,
-            });
+            // D-16: the deliverable is the report. A3: an errored attempt with no
+            // typed final contributes no report material (acceptedTryOutput).
+            const roUnwrapped = unwrapWorkReportEnvelope(acceptedTryOutput(answer, harnessError !== null), readonlyWorkMode, { sideToolReport: telemetry.sideToolWorkReport ?? undefined });
             // Trim symmetrically with the plan path: a whitespace-only answer is not
             // a delivered report (the final-artifact wrapper heading would otherwise
             // make it read as present content by construction).
@@ -4944,6 +4887,7 @@ export class Orchestrator {
                     report,
                     error: harnessError,
                     telemetry,
+                    ...(poolExhausted ? { declaredFailure: declaredFailure(poolExhausted) } : {}),
                 });
                 if (opts.deepScan) {
                     store.writeText(join(paths.findingsDir, `${attemptId}-error.md`), `# Explorer ${attemptId} failed\n\n${harnessError}\n`);
@@ -5169,14 +5113,19 @@ export class Orchestrator {
                 // #31: classify the harness cause across the read-only attempts so auth
                 // guidance appears only on a real auth failure.
                 const roCategory = dominantHarnessFailureCategory(attemptTelemetries.flatMap((a) => a.telemetry.transientFailures));
+                // A5: the terminal already speaks with the LAST attempt's message; its
+                // typed refusal rides along machine-readably instead of reducing to it.
+                const roDeclared = webBlocked ? undefined : last?.declaredFailure;
                 writeFailure(store, paths, {
                     phase: "harness",
-                    category: webBlocked ? "policy" : "harness_error",
+                    category: webBlocked ? "policy" : (roDeclared?.category ?? "harness_error"),
+                    code: roDeclared?.code ?? null,
                     harnessId: last?.harnessId,
                     attemptId: last?.attemptId,
                     safeMessage: singleError,
                     eventRefs: roEventRefs,
                     runDir: paths.root,
+                    resetsAt: roDeclared?.resetsAt ?? null,
                     nextActions: harnessFailureNextActions(roCategory),
                 });
             }