@claudexor/orchestrator 4.1.0 → 4.2.0

package/dist/orchestrator.js

@@ -1,14 +1,16 @@
 import { applyWorkEnvelope, promptWithPointers as renderPromptWithPointers, threadContextPointer, } from "./prompt-framing.js";
 import { requestRefusalFailure } from "./runTerminalResults.js";
+import { openRunScopeCustody, scopedRouteContext, scopedSpecEnv, } from "./runScope.js";
 import { delegationBeltFor } from "./delegationBelt.js";
 import { bindProcessingAdmission, processingAttemptCostEvidence, processingAdmissionForLease, updateProcessingStreamHold, ProcessingBudgetAdmissionError, } from "./processing-dispatch.js";
 import { cancelledCandidatesResult, emptyCandidateResult, failedCandidatesResult, failAfterCandidates, } from "./candidateTerminals.js";
-import { existsSync } from "node:fs";
+import { deepScanFailureResult, readOnlyChainFailureResult, } from "./readonlyTerminals.js";
 import { effectiveAuthPreference, observeNativeSessionEvent, resumeSessionForProfile, } from "./credential-profiles.js";
 import { AdmissionProfileProbes, OrchestratorCredentials, reviewerProfileResolver, } from "./orchestrator-credentials.js";
 import { continuityWorkspace, resumableOf, resumableTerminal, } from "./continuity-terminal.js";
 import { openContinuity } from "./continue-from.js";
 import { accountPoolRows } from "./account-pool.js";
+import { PoolAttemptEvidence, terminalPoolAttempts, withPoolAttempts, } from "./pool-attempt-evidence.js";
 import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
 import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
 import { processAttemptUsage } from "./attemptUsage.js";
@@ -16,7 +18,7 @@ import { captureDirectoryCandidate, directoryHasOutput, directoryCandidateStable
 import { appliedAttemptFacts, assertDelegatedEvidence, isMutatingAccess, outerBoundaryNotice, scopedHarnessHome, selectLaneHome, followSpecHome, } from "./delegatedHome.js";
 import * as AC from "./attemptUsageCost.js";
 import * as custody from "./continuation-custody.js";
-import { candidateRoster, candidateStatuses, convergenceOutcomeFacts, isWorkingCandidate, partitionCandidates, toCandidateEvidence, unanimousDeclaredFailure, } from "./candidateEvidence.js";
+import { candidateRoster, candidateStatuses, convergenceOutcomeFacts, isWorkingCandidate, partitionCandidates, toCandidateEvidence, } from "./candidateEvidence.js";
 import { capabilityIntents } from "@claudexor/gateway";
 import { reviewCandidateRuns, resolveEngineReview, unreviewedCandidateEvidence, evaluateUnreviewedConvergence, } from "./candidateReview.js";
 import { join } from "node:path";
@@ -39,7 +41,7 @@ import { resolveRunInputDefaults } from "./run-input-resolution.js";
 import { beginAnnouncedRun } from "./runEventLog.js";
 import { arbitrationBudgetOptions } from "./decisionBudget.js";
 import { buildRevisePrompt } from "./revisePrompt.js";
-import { cancelledResult, declaredFailure, failTerminally, guardAnnouncedRun, writeFailure, attemptVendorFailure, cancelReasonFromSignalToken, } from "./runTerminals.js";
+import { cancelledResult, declaredFailure, failTerminally, guardAnnouncedRun, writeFailure, cancelReasonFromSignalToken, } from "./runTerminals.js";
 import { budgetFailureRecord, classifyBudgetFailure } from "./budgetFailure.js";
 import { finalizeStructuredOutput } from "./structuredOutput.js";
 import { admitRun } from "./runAdmission.js";
@@ -56,18 +58,18 @@ import { createAttemptTelemetry, observeAttemptTelemetry, setAttemptOutcome, tel
 import { newAttemptOutputMarkers } from "./attemptOutputMarkers.js";
 import * as delegateFailure from "./delegationFailure.js";
 import * as secretDiff from "./secretDiff.js";
-import { dominantHarnessFailureCategory, harnessFailureNextActions } from "./harnessFailure.js";
-import { finalizeAttempt, readOnlyNoSuccessTerminal, unrecoveredToolErrorFailure, webEvidenceFailure, } from "./attemptFinalize.js";
+import { finalizeAttempt, unrecoveredToolErrorFailure, webEvidenceFailure, } from "./attemptFinalize.js";
 import { resolveWorkReportEnvelope, unwrapWorkReportEnvelope, } from "./workReportEnvelope.js";
 import { buildContinuationPacket, decideContinuation, synthesizeContinuationRequest, } from "./continuation.js";
 import { interactionChannelFor } from "./interaction.js";
 import { liveAttempt } from "./live-input.js";
-import { gateSpecsFromContract, renderTestsEvidence } from "./contract-gates.js";
+import { finalVerifyRun, gateSpecsFromContract, renderTestsEvidence } from "./contract-gates.js";
 import { buildTaskContract } from "./task-contract-builder.js";
+import { prepareReviewEvidenceDir, recordReviewEvidenceCleanup } from "./reviewEvidence.js";
 import { ArtifactStore } from "@claudexor/artifact-store";
-import { buildContextPack, rawContextForEnvelope, preflightEvidence, writeEvidencePacket, } from "@claudexor/context";
+import { buildContextPack, rawContextForEnvelope, writeEvidencePacket } from "@claudexor/context";
 import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
-import { blockedDecisionOverride, finalVerifyBlocks, finalVerifyPatch, finalVerifyFiles, verifyAndDeliverFiles, verifyAndDeliver, } from "@claudexor/delivery";
+import { blockedDecisionOverride, finalVerifyBlocks, verifyAndDeliverFiles, verifyAndDeliver, } from "@claudexor/delivery";
 import { HarnessGateway } from "@claudexor/gateway";
 import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, reviewCandidate, runGates, } from "@claudexor/review";
 import { arbitrate } from "@claudexor/arbitration";
@@ -162,39 +164,54 @@ export class Orchestrator {
             this.routingRationaleByRun.delete(settledRunId);
             this.deps.delegationBudgetAuthority?.releaseRun(settledRunId);
         };
+        // Process custody (owner 1A, #449; `runScope.ts`): the marker is minted and
+        // recorded BEFORE the first launch, rides every spec env (`scopedSpecEnv`),
+        // and every announced run HOLDS its terminal until the barrier has ended
+        // what still carries it. The reap never changes the verdict.
+        const custody = await openRunScopeCustody(this.deps.runScopes, runId);
+        resolved = { ...resolved, runScopeMarker: custody.marker };
         try {
             return await guardAnnouncedRun(resolved.signal, (announce) => {
+                const announced = custody.announced(announce);
                 switch (mode) {
                     case "ask":
                         // `--deep-scan` widens the answer into the bounded multi-scout
                         // research sweep with synthesis (the old `audit --swarm`/`explore`).
                         return resolved.deepScan
-                            ? this.runDeepScan(resolved, announce)
-                            : this.runAsk(resolved, announce);
+                            ? this.runDeepScan(resolved, announced)
+                            : this.runAsk(resolved, announced);
                     case "agent":
                         // Engine strategies are FLAGS on agent (v0.9 collapse): `--until-clean`
                         // and `--attempts` select the convergence loop; `--n` selects the race
                         // width; `--create` switches the candidate intent to create_from_scratch.
                         if (resolved.untilClean)
-                            return this.runConvergence(resolved, mode, null, announce);
+                            return this.runConvergence(resolved, mode, null, announced);
                         if (resolved.attempts !== undefined && resolved.attempts !== null) {
-                            return this.runConvergence(resolved, mode, resolved.attempts, announce);
+                            return this.runConvergence(resolved, mode, resolved.attempts, announced);
                         }
-                        return this.runRace({ ...resolved, n: resolved.n ?? 1 }, mode, announce);
+                        return this.runRace({ ...resolved, n: resolved.n ?? 1 }, mode, announced);
                     case "plan":
-                        return this.runPlan(resolved, announce);
+                        return this.runPlan(resolved, announced);
                 }
-            }, async ({ runId }) => {
+            }, 
+            // The whole-run barrier: drain delegated children, then end the run's
+            // process scope and record its outcome before ANY terminal is flushed
+            // (a child-drain rejection keeps its error). Bounded by the reap deadline.
+            ({ runId }) => custody.barrier(async () => {
                 const authority = this.deps.delegationBudgetAuthority;
                 if (!authority?.hasParent(runId))
                     return;
                 authority.beginParentClose(runId);
                 await authority.waitForChildren(runId);
-            }, 
-            // Single per-run terminalization hook: release the routing-rationale map
-            // entry on EVERY terminal (incl. a run that died before its telemetry
-            // writer ran, which is the leak this closes).
-            releaseRunState);
+            }), 
+            // Single per-run terminalization hook: the custody fallback for a path
+            // that never reached the barrier, then release per-run engine state
+            // (the delegated-child drain authority is released only AFTER
+            // settlement) on EVERY terminal.
+            async (settledRunId) => {
+                await custody.record();
+                releaseRunState(settledRunId);
+            });
         }
         catch (error) {
             // A durable startup sink may refuse `run.created` before the strategy can
@@ -206,6 +223,9 @@ export class Orchestrator {
             }
             throw error;
         }
+        finally {
+            await custody.settleUnannounced();
+        }
     }
     async resolveReviewers(cwd, runAuthPreference, onIgnoredSetting) {
         if (this.deps.reviewers)
@@ -1217,7 +1237,7 @@ export class Orchestrator {
                 adapter: this.deps.registry.get(harnessId),
                 credentialProfile: sessionFields.credential_profile,
                 authPreference: sessionFields.auth_preference ?? "auto",
-                laneEnv: this.laneHomeEnvFor(runInput, harnessId, profileId) ?? {},
+                laneEnv: scopedSpecEnv(runInput.runScopeMarker, this.laneHomeEnvFor(runInput, harnessId, profileId) ?? {}) ?? {},
                 envInheritance: envInheritance(this.config(runInput.repoRoot)),
                 signal: runInput.signal,
                 processing,
@@ -1293,7 +1313,10 @@ export class Orchestrator {
      * must record what it ran under, not just why it stopped. REQUIRED (no
      * default): a silent fallback here would spawn a delegated attempt on the
      * operator's real home while the record still claimed scoped state. */
-    harnessHome, observedPaths = new Set()) {
+    harnessHome, observedPaths = new Set(), 
+    /** The caller's, like `harnessHome`: its catch keeps the tries' accounts.
+     * REQUIRED, so no caller can drop them by omission again. */
+    poolEvidence) {
         const adapter = routed.adapter;
         const knobs = this.routeSpecKnobs(routed, contract, modelHint, effortHint);
         // Isolated scoped-home sessions are never retained after disposal.
@@ -1328,6 +1351,9 @@ export class Orchestrator {
         if (routed.browserRequirement.effective && artifactRelativeDir === null) {
             throw new Error("browser artifact ownership marker was not persisted");
         }
+        // The run's scope marker rides every spec env (plus the host facts when the
+        // HOME is scoped), added AFTER the lane/profile home so that patch is kept.
+        const scopedEnv = scopedSpecEnv(runInput?.runScopeMarker, harnessHome.env);
         let spec = HarnessRunSpec.parse({
             session_id: newId("ses"),
             intent,
@@ -1359,7 +1385,7 @@ export class Orchestrator {
             ...(inPlaceEnvelope && sessionFields?.resume_session_id
                 ? { resume_session_id: sessionFields.resume_session_id }
                 : {}),
-            ...(harnessHome.env ? { env: harnessHome.env } : {}),
+            ...(scopedEnv ? { env: scopedEnv } : {}),
             raw_context_packet: rawContextPacket,
             stream_deltas: streamDeltas,
         });
@@ -1396,6 +1422,7 @@ export class Orchestrator {
         let beltFailureDisclosed = false;
         const errors = [];
         let answer = new secretDiff.CountedAnswerAssembly();
+        let currentCapture;
         const retryPolicy = transientRetryPolicy(this.config(contract.repo.root));
         // QA-024: the delegation belt is the ONLY engine-owned extra MCP server
         // injected into an agent lane (the browser MCP rides its own field), so its
@@ -1422,9 +1449,11 @@ export class Orchestrator {
             harnessHome,
             workOrder: prompt,
             firstPrompt: spec.prompt,
+            poolEvidence,
         }), { spec, continuation: runInput?.continuation, store, telemetry }));
         try {
             for (let nativeTry = 0; !signal?.aborted; nativeTry += 1) {
+                currentCapture = undefined;
                 // A3 per-try isolation: neither output nor progress markers leak across tries.
                 if (nativeTry > 0) {
                     answer = new secretDiff.CountedAnswerAssembly();
@@ -1440,9 +1469,8 @@ export class Orchestrator {
                     ? AbortSignal.any([signal, attemptAbort.signal])
                     : attemptAbort.signal;
                 activeSessionId = runSpec.session_id;
-                continuity.beginTry(runSpec, nativeTry, attemptAbort);
                 // #363: bound before the spawn — a credential change mid-try voids it.
-                const refusal = this.credentials.bindPreProgressRefusal(adapter.id, runSpec);
+                const refusal = continuity.beginTry(runSpec, nativeTry, attemptAbort);
                 const transientStart = telemetry.transientFailures.length;
                 const rateLimitStart = telemetry.rateLimits.length;
                 let rawPatch = null;
@@ -1566,30 +1594,42 @@ export class Orchestrator {
                 // #31: the centralized retry gate reads the classified `retryable` verdict.
                 const sawRetryable = newTransients.some((f) => f.retryable);
                 const sawTypedLimit = telemetry.rateLimits.length > rateLimitStart;
+                const tryFacts = {
+                    harnessErrored,
+                    originalError: errors[0],
+                    budgetStopped: streamBudgetDenied,
+                    aborted: signal?.aborted === true,
+                    requestRefused: Boolean(telemetry.requestRefusal),
+                    newTransients,
+                    markers: telemetry.outputMarkers,
+                };
+                // Its account row first: an infrastructure failure below never erases it.
+                continuity.settleTry(tryFacts);
                 if (directory)
                     await captureDirectory();
-                const currentDiff = directory ? "" : await wsm.diff(envelope);
+                currentCapture = directory
+                    ? undefined
+                    : await secretDiff.captureCandidateDiff(wsm, envelope);
+                const currentDiff = secretDiff.capturedDiff(currentCapture);
                 const workspaceUnchanged = directory
                     ? directoryCapture.files?.noChanges === true
-                    : currentDiff.trim().length === 0;
+                    : currentDiff?.trim().length === 0;
                 const deliverableEmpty = workspaceUnchanged && answer.text().length === 0;
                 const delivered = !harnessErrored && !deliverableEmpty && !signal?.aborted;
                 this.credentials.noteTryServed(refusal, telemetry.outputMarkers, delivered);
                 const verdict = await continuity.afterTry({
+                    ...tryFacts,
+                    // A cancel or deadline that landed during capture still stops the
+                    // attempt; the try's own facts above stay its evidence.
+                    stopped: signal?.aborted === true,
                     runSpec,
                     nativeTry,
-                    harnessErrored,
-                    budgetStopped: streamBudgetDenied,
-                    aborted: signal?.aborted === true,
-                    requestRefused: Boolean(telemetry.requestRefusal),
-                    newTransients,
                     sawTypedLimit,
                     sawRetryable,
                     answer,
                     rawDeliverableEmpty: deliverableEmpty,
                     workspaceDiffNonEmpty: !workspaceUnchanged,
-                    currentDiff,
-                    markers: telemetry.outputMarkers,
+                    ...(currentDiff === undefined ? {} : { currentDiff }),
                     lastLimit: telemetry.rateLimits.at(-1) ?? null,
                     refusal,
                     telemetry,
@@ -1613,8 +1653,13 @@ export class Orchestrator {
             signal?.removeEventListener("abort", onAbort);
         }
         // A pool-exhausted terminal is rotation's verdict, not the transient
-        // machinery's — no `route.transient.exhausted` rides along with it.
-        if (harnessErrored && !poolExhausted && !processingRefusal && !telemetry.requestRefusal) {
+        // machinery's, and a stopped run exhausted no retries: no
+        // `route.transient.exhausted` rides along with either.
+        if (harnessErrored &&
+            !poolExhausted &&
+            !processingRefusal &&
+            !telemetry.requestRefusal &&
+            !signal?.aborted) {
             emitTransientExhausted((t, p) => log?.emit(t, p), adapter.id, attemptId, telemetry, retryPolicy.maxRetries);
         }
         const attemptStreamEndedMs = Date.now();
@@ -1634,9 +1679,10 @@ export class Orchestrator {
             : await secretDiff.captureCandidateWorkspace({
                 ...{ wsm, envelope, inPlace: inPlaceEnvelope, projectRoot: store.repoRoot },
                 ...{ answerText, answerMatches: answer.secretLikeMatches() },
+                holder: { runId: paths.runId, runDir: paths.root },
+                incompleteCapture: currentCapture?.captureIncomplete ? currentCapture : undefined,
             });
         const { diff, captureRefusal } = captured;
-        harnessErrored = secretDiff.recordCaptureRefusal(captureRefusal, errors, harnessErrored);
         const deliverableEvidence = diff.trim().length > 0 || Boolean(answerText) || directoryHasOutput(directoryCapture.files);
         // Cancelled attempts skip gates: running a 600s-per-gate suite delays the ack
         // and burns compute on a result nobody will adopt. Diff/attempt.yaml
@@ -1650,7 +1696,7 @@ export class Orchestrator {
         }
         const gates = gateSignalAborted
             ? []
-            : await runGates(gateSpecsFromContract(contract), {
+            : await runGates(gateSpecsFromContract(contract, runInput?.runScopeMarker), {
                 cwd: envelope.worktree_path,
                 env: wsm.envFor(envelope),
                 signal,
@@ -1695,7 +1741,9 @@ export class Orchestrator {
         if (finalized.outcomeClass === "contract_failure" && unwrapped.contractViolation)
             errors.push(`work_report contract: ${unwrapped.contractViolation}`);
         const deliverablePresent = finalized.deliverablePresent;
-        const errored = harnessErrored || webBlocked;
+        if (captureRefusal)
+            errors.push(captureRefusal.detail);
+        const errored = harnessErrored || webBlocked || captureRefusal !== undefined;
         const resumable = await continuity.finish({
             runSpec: spec,
             errored,
@@ -1705,6 +1753,7 @@ export class Orchestrator {
             workState: finalized.workState,
         });
         setAttemptOutcome(telemetry, {
+            captureFailed: captureRefusal !== undefined,
             deliverablePresent,
             gatesPassed: gates.length > 0 ? gatesPassed(gates) : null,
             harnessErrored,
@@ -1818,9 +1867,11 @@ export class Orchestrator {
             probeReadyProfiles: (spec, tried) => runInput
                 ? this.credentials.readyProfileIdsForRotation(runInput, adapter.id, spec.credential_profile ?? null, tried, spec.model_hint ?? null)
                 : Promise.resolve(new Set()),
+            bindRefusal: (spec, producer) => this.credentials.bindPreProgressRefusal(adapter.id, spec, producer),
             rotationObservations: (spec, transients, refusal) => this.credentials.rotationObservations(adapter, spec, transients, refusal),
             emit: (type, payload) => log?.emit(type, payload),
             route: routed,
+            poolEvidence: lane.poolEvidence,
             newSessionId: () => newId("ses"),
             thread: runInput?.threadId
                 ? {
@@ -1842,7 +1893,7 @@ export class Orchestrator {
         const mutatingRun = isMutatingAccess(contract.access.effective_profile);
         const planBrief = verifiedPlanBrief(input);
         const quotaSnapshots = this.quotaSnapshotPreflight();
-        const { store, paths, log, ledger } = beginAnnouncedRun({
+        const { store, paths, log, ledger, runContext } = beginAnnouncedRun({
             input,
             contract,
             quotaSnapshots,
@@ -1998,6 +2049,7 @@ export class Orchestrator {
             });
         }
         const runsBySlot = new Array(slots.length);
+        runContext.attempts = () => runsBySlot.filter((run) => run !== undefined);
         // D-16d: one-shot continuation budget shared across the concurrent candidate
         // slots (parity with the read-only chain's single counter). Claimed
         // synchronously (check-then-increment with no await between), so two slots
@@ -2050,8 +2102,9 @@ export class Orchestrator {
             const effectiveWeb = this.discloseWebUpgrade(log, slot.routed, knobs.webPolicy, slot.attemptId);
             let envelope;
             // Declared OUTSIDE the try so the catch below can state what the attempt
-            // actually ran under, not merely that it stopped.
+            // actually ran under, not merely that it stopped — and on which accounts.
             let harnessHome;
+            const tried = new PoolAttemptEvidence(adapter.id, slot.attemptId);
             try {
                 log.emit("harness.started", {
                     harness_id: adapter.id,
@@ -2088,7 +2141,7 @@ export class Orchestrator {
                     budgetStopped = true;
                     return true;
                 }, input, requestedSingleCandidate, // W-C4 deltas: single-candidate chat lane only (racing = noise x N)
-                undefined, undefined, harnessHome);
+                undefined, undefined, harnessHome, undefined, tried);
                 ledger.settle(slot.lease.lease_id, attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
@@ -2153,6 +2206,7 @@ export class Orchestrator {
                                 continuation_of: run.attemptId,
                             });
                             const contLeaseId = contLease.lease?.lease_id ?? "";
+                            const contTried = new PoolAttemptEvidence(adapter.id, contAttemptId);
                             try {
                                 const contRun = await this.runCandidateInEnvelope(slot.routed, envelope, contAttemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, {
                                     lease: contLease.lease,
@@ -2166,7 +2220,7 @@ export class Orchestrator {
                                         return false;
                                     budgetStopped = true;
                                     return true;
-                                }, input, requestedSingleCandidate, undefined, packet.pointerLine ?? undefined, harnessHome);
+                                }, input, requestedSingleCandidate, undefined, packet.pointerLine ?? undefined, harnessHome, undefined, contTried);
                                 ledger.settle(contLeaseId, attemptUsageCostSettlement(contRun.cost, contRun.costEstimated, contRun.attemptId, contRun.harnessId, contRun.telemetry.authMode, contRun.telemetry.usageCost));
                                 log.emit("harness.completed", {
                                     harness_id: adapter.id,
@@ -2193,6 +2247,8 @@ export class Orchestrator {
                                     error: safeErrorMessage(err),
                                 });
                             }
+                            // Whichever attempt speaks names both attempts' failed tries, in order.
+                            effectiveRun.poolAttempts = [...(run.poolAttempts ?? []), ...contTried.snapshot()];
                         }
                         else {
                             ledger.cancel(contLease.lease?.lease_id ?? "");
@@ -2238,6 +2294,7 @@ export class Orchestrator {
                         slot.routed.delegationRequirement,
                     ], knobs.model),
                     infraPhase,
+                    poolAttempts: tried.snapshot(),
                     // Keep a TYPED pre-spawn refusal (spent quota window + its reset)
                     // alive past this catch; `message` alone would force the terminal to
                     // read prose back out.
@@ -2252,10 +2309,17 @@ export class Orchestrator {
         };
         await runParallelCandidates(slots, this.deps.runtimeConcurrencyCaps, runSlot);
         const runs = runsBySlot.filter((r) => r !== undefined);
+        // From here `runs` is the lane's one attempt collection (a synthesis that
+        // returns joins it); a synthesis that threw first leaves only its tries.
+        let thrownSynthesis = null;
+        const history = () => thrownSynthesis ? [...runs, thrownSynthesis] : runs;
+        runContext.attempts = history;
         // Fail-closed terminal: a delegated mutating run whose attempts state
         // neither historical proof nor deliberate absence refuses instead of passing.
         assertDelegatedEvidence(input.delegated === true, candidateAccess, runs);
-        const cancelledRaceResult = () => cancelledCandidatesResult({
+        // One candidate-terminal context for every race terminal below; its
+        // telemetry writer reads the live roster, so a later synth attempt counts.
+        const raceTerminal = {
             store,
             paths,
             log,
@@ -2264,6 +2328,11 @@ export class Orchestrator {
             mode,
             ledger,
             runs,
+            writeTelemetry: () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null),
+        };
+        const cancelledRaceResult = () => cancelledCandidatesResult({
+            ...raceTerminal,
+            attempts: history(),
             git: input.workspaceKind !== "directory"
                 ? {
                     live: input.inPlace === true &&
@@ -2275,7 +2344,6 @@ export class Orchestrator {
                 }
                 : undefined,
             signal: input.signal,
-            writeTelemetry: () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null),
         });
         // Revert divergence fence for the single-candidate in-place path: the
         // candidate mutated the LIVE tree during execution above, so the post-turn
@@ -2302,31 +2370,34 @@ export class Orchestrator {
         }
         const failedDelegation = delegateFailure.dominantRaceCandidateFailure(runs);
         if (failedDelegation) {
-            const failure = delegateFailure.candidateFailureTerminal(failedDelegation, "race");
             await disposeReviewEnvelopes();
-            if (mutatingRun && failedDelegation.files) {
-                await publishDirectoryCandidate({
-                    files: failedDelegation.files,
-                    store,
-                    paths,
-                    taskId,
-                    attemptId: failedDelegation.attemptId,
-                    harnessId: failedDelegation.harnessId,
-                    facts: makeOutcomeFacts("failed", { noChanges: failedDelegation.files.noChanges }),
-                    log,
-                });
-            }
-            else if (mutatingRun && input.workspaceKind !== "directory") {
-                await delegateFailure.persistFailedInPlaceWorkProduct({
-                    ...{ store, log, paths, execRoot, preTurnSha, taskId, mode },
-                    live: input.inPlace === true && failedDelegation.reviewCwd === execRoot,
-                    run: failedDelegation,
-                    postTurnSha: earlyPostTurnSha,
-                    kind: input.create === true ? "new_repo" : "patch",
+            const failedOutput = {
+                ...{ store, log, paths, execRoot, preTurnSha, taskId, mode, run: failedDelegation },
+                live: input.inPlace === true &&
+                    input.workspaceKind !== "directory" &&
+                    failedDelegation.reviewCwd === execRoot,
+                postTurnSha: earlyPostTurnSha,
+                kind: input.create === true ? "new_repo" : "patch",
+            };
+            // A live candidate whose capture failed (no Delegate failure) ends in the
+            // shared no-working-candidate terminal, as in the isolated race and
+            // convergence: a recorded budget denial, a budget terminal the ledger
+            // settled (stream hard cap, exact overshoot, unverifiable cash) or a
+            // unanimous typed refusal leads, its live receipt carries the same facts,
+            // and the capture facts and inspection actions follow. Any other dominant
+            // capture failure joins it only under a settled budget terminal.
+            if (delegateFailure.candidateFailureKind(failedDelegation) === "capture" &&
+                (failedOutput.live || ledger.terminal() !== null))
+                return failedCandidatesResult({
+                    ...raceTerminal,
+                    budgetDenial,
+                    ...(mutatingRun ? { liveCapture: failedOutput } : {}),
                 });
-            }
-            this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null);
-            return failTerminally(log, store, paths, runId, taskId, mode, failure.phase, failure.error, ledger.spend(), failure.metadata);
+            const failure = delegateFailure.candidateFailureTerminal(failedDelegation, "race");
+            if (mutatingRun)
+                await delegateFailure.persistFailedCandidateOutput(failedOutput);
+            raceTerminal.writeTelemetry();
+            return failTerminally(log, store, paths, runId, taskId, mode, failure.phase, failure.error, ledger.spend(), { ...failure.metadata, attempts: runs });
         }
         if (runs.length === 0)
             return emptyCandidateResult({
@@ -2348,18 +2419,7 @@ export class Orchestrator {
         const workingRuns = partitionCandidates(runs).working;
         if (workingRuns.length === 0) {
             await disposeReviewEnvelopes();
-            return failedCandidatesResult({
-                store,
-                paths,
-                log,
-                runId,
-                taskId,
-                mode,
-                ledger,
-                runs,
-                budgetDenial,
-                writeTelemetry: () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null),
-            });
+            return failedCandidatesResult({ ...raceTerminal, budgetDenial });
         }
         // QA-025: only announce that review STARTED when the panel will actually
         // run. A candidate that changed no files is skipped inside reviewRuns; a
@@ -2396,12 +2456,12 @@ export class Orchestrator {
             // candidates (a trivial greeting in agent mode no longer burns two reviewers on
             // "(empty diff)"). Candidates still flow through arbitration/gates so the
             // no_op/answer outcome and gate failures are unchanged.
-            evidences = await this.reviewRuns(workingRuns, reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input));
+            evidences = await this.reviewRuns(workingRuns, reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input), false, input.runScopeMarker);
         }
         catch (err) {
             // Review preflight/evidence failures end TERMINALLY with artifacts —
             // never as an escaped throw that orphans the run dir.
-            return failAfterCandidates({ log, store, paths, runId, taskId, mode, ledger, runs }, "review", err);
+            return failAfterCandidates(raceTerminal, "review", err);
         }
         finally {
             // Review preflight failures must not leak candidate worktrees.
@@ -2431,6 +2491,7 @@ export class Orchestrator {
             });
             if (lease.granted) {
                 let envelope;
+                const synthTried = new PoolAttemptEvidence(synthRouted.adapter.id, "synth");
                 try {
                     const plan = buildSynthesisPlan(evidences);
                     const synthesisInput = buildFileBackedSynthesisInput({
@@ -2459,7 +2520,7 @@ export class Orchestrator {
                             budgetStopped = true;
                             budgetDenial ??= denial;
                         },
-                    }, candidateAccess, input.onHarnessEvent, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content, undefined, synthHome);
+                    }, candidateAccess, input.onHarnessEvent, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content, undefined, synthHome, undefined, synthTried);
                     ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     reviewEnvelopes.push(envelope);
                     envelope = undefined;
@@ -2468,12 +2529,12 @@ export class Orchestrator {
                     runs.push(run);
                     try {
                         if (isWorkingCandidate(run)) {
-                            const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input));
+                            const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input), false, input.runScopeMarker);
                             evidences.push(...synthEvidence);
                             workingRuns.push(run);
                         }
                         if (input.signal?.aborted) {
-                            return cancelledResult(log, runId, taskId, mode, paths.root, candidateStatuses(runs), () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, candidateRoster(runs), null), ledger.spend(), input.signal, store);
+                            return cancelledResult(log, runId, taskId, mode, paths.root, candidateStatuses(runs), raceTerminal.writeTelemetry, ledger.spend(), input.signal, store, undefined, undefined, history());
                         }
                     }
                     finally {
@@ -2481,6 +2542,9 @@ export class Orchestrator {
                     }
                 }
                 catch (err) {
+                    // Not yet in `runs`: the run goes on, so its tries' accounts stay in the history.
+                    if (!runs.some((run) => run.attemptId === "synth"))
+                        thrownSynthesis = { poolAttempts: synthTried.snapshot() };
                     ledger.settle(lease.lease?.lease_id ?? "", AC.attemptFailureCost(err, "synthesis-error").settlement);
                     log.emit("harness.completed", {
                         attempt_id: "synth",
@@ -2506,7 +2570,7 @@ export class Orchestrator {
         }
         catch (err) {
             // Arbitration throws end terminally with artifacts, never as an orphan.
-            return failAfterCandidates({ log, store, paths, runId, taskId, mode, ledger, runs }, "arbitration", err);
+            return failAfterCandidates({ ...raceTerminal, attempts: history() }, "arbitration", err);
         }
         log.emit("arbitration.completed", {
             winner: result.decision.winner,
@@ -2570,9 +2634,7 @@ export class Orchestrator {
             facts.lifecycle === "succeeded" &&
             facts.review !== "blocked" &&
             !input.signal?.aborted) {
-            finalVerify = winnerRun.files
-                ? await finalVerifyFiles(winnerRun.files, undefined, gateSpecsFromContract(contract), log)
-                : await finalVerifyPatch(execRoot, winnerRun, gateSpecsFromContract(contract), log);
+            finalVerify = await finalVerifyRun(execRoot, winnerRun, contract, log, input);
             finalVerifyFailed = finalVerifyBlocks(finalVerify);
             if (finalVerifyFailed)
                 facts = { ...facts, checks: "failed", reason: "checks_failed" };
@@ -2588,6 +2650,9 @@ export class Orchestrator {
         });
         store.writeYaml(join(paths.arbitrationDir, "pairwise.yaml"), result.pairwise);
         const decisionPath = join(paths.arbitrationDir, "decision.yaml");
+        // Every attempt's failed tries by the FINAL outcome (delivery below can
+        // still fail the checks); a review or check block is not an account failure.
+        const racePool = () => terminalPoolAttempts(facts, history());
         if (winnerRun) {
             for (const path of materializeWinnerOutputs({
                 attemptDir: join(paths.attemptsDir, winnerRun.attemptId),
@@ -2617,7 +2682,7 @@ export class Orchestrator {
                     facts.checks !== "failed" &&
                     !workStateVetoes(facts);
                 if (input.inPlace === true && !inPlaceWinner && directoryAdoptable) {
-                    const delivered = await verifyAndDeliverFiles(execRoot, winnerRun.files, {}, gateSpecsFromContract(contract), (freshVerify) => finalVerifyBlocks(freshVerify)
+                    const delivered = await verifyAndDeliverFiles(execRoot, winnerRun.files, {}, gateSpecsFromContract(contract, input.runScopeMarker), (freshVerify) => finalVerifyBlocks(freshVerify)
                         ? (freshVerify.reason ?? "final verify failed before directory race adoption")
                         : null, log);
                     store.writeYaml(join(paths.finalDir, "delivery_receipt.yaml"), delivered);
@@ -2680,7 +2745,7 @@ export class Orchestrator {
                     }
                     else if (adoptable) {
                         // Protected apply preserves the live tree or reports tree_mutated.
-                        const applied = await verifyAndDeliver(execRoot, winnerRun.diff, { mode: "apply", protectedApply: true }, gateSpecsFromContract(contract), (freshVerify) => {
+                        const applied = await verifyAndDeliver(execRoot, winnerRun.diff, { mode: "apply", protectedApply: true }, gateSpecsFromContract(contract, input.runScopeMarker), (freshVerify) => {
                             finalVerify = freshVerify;
                             return finalVerifyBlocks(freshVerify)
                                 ? (freshVerify.reason ?? "final verify failed before race adoption")
@@ -2766,7 +2831,7 @@ export class Orchestrator {
                     },
                 });
             }
-            store.writeText(join(paths.finalDir, "summary.md"), renderSummary(runId, mode, { ...result.decision, facts }, evidences, synth.reason, actualReviewVerified, secretDiff.secretLikeSummaryLine(winnerRun.secretLike)));
+            store.writeText(join(paths.finalDir, "summary.md"), withPoolAttempts(renderSummary(runId, mode, { ...result.decision, facts }, evidences, synth.reason, actualReviewVerified, secretDiff.secretLikeSummaryLine(winnerRun.secretLike)), racePool()));
             // summary.md is a DIAGNOSTIC artifact only (V8/PLAN addendum 2): it no
             // longer carries primary-output authority. A clean applyable success or a
             // winner answer still marks it ready for legacy INV-116 ordering; any
@@ -2792,8 +2857,14 @@ export class Orchestrator {
         // (applyable, no_changes, or not-verified) is an honest completion.
         const needsDecisionTerminal = facts.review === "blocked" || facts.checks === "failed";
         const isFailureTerminal = facts.lifecycle !== "succeeded" || needsDecisionTerminal;
+        const pool = racePool();
         if (deliveryFailureReason && !finalVerifyFailed) {
-            writeFailure(store, paths, deliveryRefusalFailure(deliveryFailureReason, paths.root));
+            const refused = deliveryRefusalFailure(deliveryFailureReason, paths.root);
+            writeFailure(store, paths, {
+                ...refused,
+                safeMessage: withPoolAttempts(refused.safeMessage, pool),
+                poolAttempts: pool,
+            });
         }
         else if (finalVerifyFailed) {
             writeFailure(store, paths, {
@@ -2801,9 +2872,10 @@ export class Orchestrator {
                 // RunFailure.category is a closed enum; "validation" is the honest
                 // bucket (the winner failed re-validation on a fresh base).
                 category: "validation",
-                safeMessage: finalVerify?.applied_cleanly === null
+                safeMessage: withPoolAttempts(finalVerify?.applied_cleanly === null
                     ? `final verify ERRORED before proving the patch against a clean base: ${finalVerify?.reason ?? "verify infrastructure error"}`
-                    : `final verify failed: ${finalVerify?.reason ?? (finalVerify?.gates_passed === false ? "deterministic gates failed on the fresh verify tree" : "unknown")}`,
+                    : `final verify failed: ${finalVerify?.reason ?? (finalVerify?.gates_passed === false ? "deterministic gates failed on the fresh verify tree" : "unknown")}`, pool),
+                poolAttempts: pool,
                 runDir: paths.root,
                 nextActions: finalVerify?.applied_cleanly === null
                     ? [
@@ -2835,11 +2907,12 @@ export class Orchestrator {
                             : "internal",
                 harnessId: winnerRun?.errored ? winnerRun.harnessId : undefined,
                 attemptId: winnerRun?.errored ? winnerRun.attemptId : undefined,
-                safeMessage: needsHuman
+                safeMessage: withPoolAttempts(needsHuman
                     ? `review escalated to a human decision: ${result.decision.why_winner}`
                     : needsDecisionTerminal
                         ? `review blocked before apply: ${result.decision.why_winner}`
-                        : result.decision.why_winner,
+                        : result.decision.why_winner, pool),
+                poolAttempts: pool,
                 rawDetailRef: winnerRun?.errored
                     ? `attempts/${winnerRun.attemptId}/attempt.yaml`
                     : undefined,
@@ -2859,7 +2932,7 @@ export class Orchestrator {
                     ],
             });
             if (!winnerRun) {
-                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Phase: arbitration\n\n${result.decision.why_winner}\n`);
+                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Phase: arbitration\n\n${withPoolAttempts(result.decision.why_winner, pool)}\n`);
                 log.emit("output.ready", {
                     kind: "summary",
                     path: "final/summary.md",
@@ -2875,6 +2948,8 @@ export class Orchestrator {
                 lifecycle: facts.lifecycle,
                 facts,
                 reason: facts.reason,
+                // A work-state veto is still a block: it keeps the earlier refusals.
+                ...(pool.length > 0 ? { pool_attempts: pool } : {}),
                 ...resumableTerminal(store, paths, winnerRun ? [winnerRun] : runs, isFailureTerminal),
             });
         }
@@ -2884,6 +2959,7 @@ export class Orchestrator {
             log.emit("run.blocked", {
                 lifecycle: facts.lifecycle,
                 facts,
+                pool_attempts: pool,
                 ...resumableTerminal(store, paths, runs, isFailureTerminal),
                 phase: deliveryFailureReason && !finalVerifyFailed
                     ? "delivery"
@@ -2899,6 +2975,7 @@ export class Orchestrator {
                 facts,
                 reason: facts.reason,
                 phase: "arbitration",
+                pool_attempts: pool,
                 failure_ref: "final/failure.yaml",
                 ...resumableTerminal(store, paths, runs, isFailureTerminal),
             });
@@ -2911,7 +2988,7 @@ export class Orchestrator {
             facts,
             winner: result.decision.winner,
             runDir: paths.root,
-            summary: result.decision.why_winner,
+            summary: withPoolAttempts(result.decision.why_winner, pool),
             candidates: candidateStatuses(runs),
             decisionPath,
             reviewVerified: actualReviewVerified,
@@ -2954,7 +3031,7 @@ export class Orchestrator {
             transientRetryPolicy: input.transientRetryPolicy ?? transientRetryPolicy(this.config(input.cwd)),
         });
     }
-    async reviewRuns(runs, reviewers, reviewVerified, reviewDir, cwd, contract, store, paths, log, ledger, taskId, signal, reservationEstimateUsd, reviewUnchanged = false) {
+    async reviewRuns(runs, reviewers, reviewVerified, reviewDir, cwd, contract, store, paths, log, ledger, taskId, signal, reservationEstimateUsd, reviewUnchanged = false, runScopeMarker) {
         return reviewCandidateRuns({
             runs,
             reviewers,
@@ -2970,50 +3047,17 @@ export class Orchestrator {
             signal,
             reservationEstimateUsd,
             reviewUnchanged,
+            runScopeMarker,
         }, {
             prepareReviewEvidenceDir: this.prepareReviewEvidenceDir.bind(this),
-            recordReviewEvidenceCleanup: this.recordReviewEvidenceCleanup.bind(this),
+            recordReviewEvidenceCleanup,
             reviewScoped: this.reviewScoped.bind(this),
             config: this.config.bind(this),
         });
     }
-    prepareReviewEvidenceDir(sourceDir, _candidateCwd) {
-        // Evidence is an external runtime artifact. ReviewEngine builds a separate
-        // reviewer workspace and copies the packet there; writing/copying it into
-        // the candidate tree would contaminate the Git diff and, worse, overwrite a
-        // user-owned path with the same name.
-        if (!existsSync(sourceDir)) {
-            throw new Error(`review evidence preflight failed for ${sourceDir}: source packet missing`);
-        }
-        return this.requireReviewEvidence(sourceDir);
-    }
-    requireReviewEvidence(dir) {
-        const result = preflightEvidence(dir);
-        if (result.ok)
-            return dir;
-        const missing = result.missing.length ? `missing=${result.missing.join(",")}` : "";
-        const empty = result.empty.length ? `empty=${result.empty.join(",")}` : "";
-        throw new Error(`review evidence preflight failed for ${dir}: ${[missing, empty].filter(Boolean).join(" ")}`);
-    }
-    cleanupReviewEvidenceDir(_candidateEvidenceDir, _candidateCwd) {
-        // No candidate-tree packet exists in v2; external runtime retention is
-        // governed by the artifact/journal lifecycle rather than best-effort rm.
-        return null;
-    }
-    recordReviewEvidenceCleanup(store, metadataPath, attemptId, candidateEvidenceDir, candidateCwd) {
-        const cleanupMetadata = this.cleanupReviewEvidenceDir(candidateEvidenceDir, candidateCwd);
-        if (!cleanupMetadata)
-            return;
-        try {
-            store.writeYaml(metadataPath, {
-                ...cleanupMetadata,
-                attempt_id: attemptId,
-            });
-        }
-        catch {
-            // Cleanup telemetry must not mask the review/revalidation failure that
-            // triggered best-effort cleanup.
-        }
+    /** The instance method is the seam tests stub to make evidence setup fail. */
+    prepareReviewEvidenceDir(sourceDir, candidateCwd) {
+        return prepareReviewEvidenceDir(sourceDir, candidateCwd);
     }
     async runConvergence(input, mode, maxAttempts, announce) {
         const taskId = input.taskId ?? newId("task");
@@ -3022,7 +3066,7 @@ export class Orchestrator {
         const contract = this.buildContract(input, taskId, mode);
         const planBrief = verifiedPlanBrief(input);
         const quotaSnapshots = this.quotaSnapshotPreflight();
-        const { store, paths, log, ledger } = beginAnnouncedRun({
+        const { store, paths, log, ledger, runContext } = beginAnnouncedRun({
             input,
             contract,
             quotaSnapshots,
@@ -3159,6 +3203,8 @@ export class Orchestrator {
         let interrupted = false; // D-16 r8: terminalizes the run interrupted
         let lastFindings = [];
         let lastRun = null;
+        const convergenceRuns = [];
+        runContext.attempts = () => convergenceRuns;
         let actualReviewVerified = false;
         let lastFinalReviewClean = false;
         // Honest apply-state for in-place convergence: the attempts mutate the LIVE
@@ -3248,6 +3294,7 @@ export class Orchestrator {
                 const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
                 let run;
                 let harnessHome;
+                const tried = new PoolAttemptEvidence(adapter.id, attemptId);
                 try {
                     harnessHome = this.harnessHomeFor(wsm, envelope, routed, input);
                     log.emit("harness.started", {
@@ -3266,7 +3313,7 @@ export class Orchestrator {
                         ledger.updateHold(lease.lease?.lease_id ?? "", streamedUsd);
                         return ledger.tier() === "hard";
                     }, input, true, // convergence runs one candidate: live deltas on (W-C4)
-                    undefined, undefined, harnessHome, observedPaths);
+                    undefined, undefined, harnessHome, observedPaths, tried);
                     ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
@@ -3303,6 +3350,7 @@ export class Orchestrator {
                         errored: true,
                         costEstimated: failureCost.estimated,
                         errors: [message],
+                        poolAttempts: tried.snapshot(),
                         ...(declared.code ? { declaredFailure: declared } : {}),
                         telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb, [routed.browserRequirement, routed.denyRequirement, routed.delegationRequirement], knobs.model),
                     };
@@ -3318,6 +3366,7 @@ export class Orchestrator {
                     }
                 }
                 lastRun = run;
+                convergenceRuns.push(run);
                 // Fail-closed twin of the candidate lane's gate: this loop terminalizes
                 // per attempt, so the proof is spent per attempt.
                 assertDelegatedEvidence(input.delegated === true, convergenceAccess, [run]);
@@ -3337,34 +3386,28 @@ export class Orchestrator {
                 // Cancellation/deadline keeps priority over a belt failure finalized concurrently.
                 if (input.signal?.aborted || processingBudgetDenial)
                     break;
+                // When this attempt's capture failed (and no Delegate failure leads), a
+                // budget terminal the ledger settled on it (stream hard cap, exact overshoot,
+                // unverifiable cash) outranks that capture failure and its typed refusal
+                // (race parity): the budget-aware finalizer below names the budget cause and
+                // remedy first, with the capture facts, source and inspection actions after.
+                if (delegateFailure.candidateFailureKind(run) === "capture" && ledger.terminal()) {
+                    exhausted = true;
+                    break;
+                }
                 if (run.telemetry.requestRefusal ||
                     run.telemetry.effortResolution?.resolution === "rejected")
                     break;
                 if (delegateFailure.candidateFailureKind(run)) {
                     const failure = delegateFailure.candidateFailureTerminal(run, "convergence");
-                    if (run.files) {
-                        await publishDirectoryCandidate({
-                            files: run.files,
-                            store,
-                            paths,
-                            taskId,
-                            attemptId,
-                            harnessId: run.harnessId,
-                            facts: makeOutcomeFacts("failed", { noChanges: run.files.noChanges }),
-                            log,
-                        });
-                    }
-                    else if (input.workspaceKind !== "directory") {
-                        await delegateFailure.persistFailedInPlaceWorkProduct({
-                            ...{ store, log, paths, execRoot, preTurnSha, taskId, mode },
-                            live: input.inPlace === true,
-                            run,
-                            kind: input.create === true ? "new_repo" : "patch",
-                            attempts: attempt,
-                        });
-                    }
+                    await delegateFailure.persistFailedCandidateOutput({
+                        ...{ store, log, paths, execRoot, preTurnSha, taskId, mode, run },
+                        live: input.inPlace === true && input.workspaceKind !== "directory",
+                        kind: input.create === true ? "new_repo" : "patch",
+                        attempts: attempt,
+                    });
                     this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, attemptTelemetries, null);
-                    return failTerminally(log, store, paths, runId, taskId, mode, failure.phase, failure.error, ledger.spend(), failure.metadata);
+                    return failTerminally(log, store, paths, runId, taskId, mode, failure.phase, failure.error, ledger.spend(), { ...failure.metadata, attempts: convergenceRuns });
                 }
                 if (input.workspaceKind === "directory" && run.captureRefusal) {
                     return failedCandidatesResult({
@@ -3376,6 +3419,7 @@ export class Orchestrator {
                         runId,
                         taskId,
                         runs: [run],
+                        attempts: convergenceRuns,
                         writeTelemetry: () => this.writeRunTelemetry(store, paths, contract, runId, taskId, mode, attemptTelemetries, null),
                     });
                 }
@@ -3398,7 +3442,7 @@ export class Orchestrator {
                             log.emit("review.skipped", { reason: "not_requested", attempt_id: attemptId });
                             return evaluateUnreviewedConvergence(evidence, contract);
                         }
-                        const [evidence] = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input), true);
+                        const [evidence] = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input), true, input.runScopeMarker);
                         if (!evidence)
                             throw new Error("Convergence review produced no evidence");
                         lastFindings = evidence.findings;
@@ -3435,7 +3479,17 @@ export class Orchestrator {
                             facts: makeOutcomeFacts("failed", { noChanges: run.files.noChanges }),
                             log,
                         });
-                    return failAfterCandidates({ log, store, paths, runId, taskId, mode, ledger, runs: [run] }, "review", err);
+                    return failAfterCandidates({
+                        log,
+                        store,
+                        paths,
+                        runId,
+                        taskId,
+                        mode,
+                        ledger,
+                        runs: [run],
+                        attempts: convergenceRuns,
+                    }, "review", err);
                 }
                 if (conv.converged) {
                     converged = true;
@@ -3554,11 +3608,12 @@ export class Orchestrator {
                 facts = decision.facts;
             }
         }
-        if (lastRun?.files)
+        // Captured files decide noChanges; an incomplete capture leaves it unknown.
+        if (lastRun?.files || lastRun?.captureRefusal)
             facts = {
                 ...facts,
-                noChanges: lastRun.files.noChanges,
-                reason: facts.reason === "no_changes" && lastRun.files.noChanges !== true ? null : facts.reason,
+                noChanges: lastRun.files?.noChanges ?? null,
+                reason: facts.reason === "no_changes" && lastRun.files?.noChanges !== true ? null : facts.reason,
             };
         // A budget terminal turns a succeeded lifecycle into a failed one (D8).
         const convBudgetTerminal = ledger.terminal();
@@ -3569,6 +3624,19 @@ export class Orchestrator {
                 review_requested: contract.review_requested,
             });
         }
+        // The shared classifier owns a budget terminal's cause and remedy: a
+        // processing re-admission denial, or the ledger's settled terminal once it
+        // stopped the loop over an incomplete capture (the capture facts and
+        // inspection actions follow it in the failure record).
+        const convBudgetMapping = processingBudgetDenial ||
+            (convBudgetTerminal && lastRun?.captureRefusal && isBudgetTerminal(facts.reason))
+            ? classifyBudgetFailure({ denial: processingBudgetDenial, terminal: convBudgetTerminal })
+            : null;
+        if (convBudgetMapping &&
+            facts.lifecycle === "failed" &&
+            isBudgetTerminal(facts.reason) &&
+            facts.reason !== convBudgetMapping.reason)
+            facts = { ...facts, reason: convBudgetMapping.reason };
         // A reviewer escalation to a human forces the REVIEW axis to blocked.
         const needsHuman = lastFindings.some((f) => f.severity === "NEEDS_HUMAN" && isBlocking(f));
         if (needsHuman && facts.lifecycle === "succeeded" && facts.review !== "blocked") {
@@ -3587,13 +3655,13 @@ export class Orchestrator {
             facts.lifecycle === "succeeded" &&
             facts.review !== "blocked" &&
             !input.signal?.aborted) {
-            convFinalVerify = lastRun.files
-                ? await finalVerifyFiles(lastRun.files, undefined, gateSpecsFromContract(contract), log)
-                : await finalVerifyPatch(execRoot, lastRun, gateSpecsFromContract(contract), log);
+            convFinalVerify = await finalVerifyRun(execRoot, lastRun, contract, log, input);
             if (finalVerifyBlocks(convFinalVerify))
                 facts = { ...facts, checks: "failed", reason: "checks_failed" };
         }
         const convNeedsDecision = facts.review === "blocked" || facts.checks === "failed";
+        // Every attempt's failed tries by the actual outcome; a block is not an account failure.
+        const convPool = terminalPoolAttempts(facts, convergenceRuns);
         if (decision) {
             // Shared honesty owner (same as the race path): a needs-decision terminal
             // overrides the persisted decision; final_verify is recorded either way.
@@ -3615,16 +3683,13 @@ export class Orchestrator {
                 reviewAllowsApply(facts) &&
                 facts.checks !== "failed" &&
                 !workStateVetoes(facts);
-            if (lastRun.files) {
-                await publishDirectoryCandidate({
-                    files: lastRun.files,
-                    store,
-                    paths,
-                    taskId,
-                    attemptId: lastRun.attemptId,
-                    harnessId: lastRun.harnessId,
-                    facts,
-                    log,
+            if (lastRun.files || lastRun.captureRefusal) {
+                // An incomplete capture has no exact patch: never publish an empty one.
+                await delegateFailure.persistFailedCandidateOutput({
+                    ...{ store, log, paths, execRoot, preTurnSha, taskId, mode, facts, run: lastRun },
+                    live: input.inPlace === true && input.workspaceKind !== "directory",
+                    kind: input.create === true ? "new_repo" : "patch",
+                    attempts: attempt,
                 });
             }
             else {
@@ -3671,7 +3736,7 @@ export class Orchestrator {
                 store.writeText(join(paths.finalDir, "answer.md"), lastRun.answerText);
                 log.emit("output.ready", { kind: "answer", path: "final/answer.md" });
             }
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}${secretDiff.summaryDisclosure(lastRun.secretLike)}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `${withPoolAttempts(`# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}${secretDiff.summaryDisclosure(lastRun.secretLike)}`, convPool)}\n`);
             // Lifecycle invariant (all modes): output.ready precedes the terminal
             // event so a client that applied the terminal event has the output.
             log.emit("output.ready", {
@@ -3690,9 +3755,7 @@ export class Orchestrator {
             const convDeclared = !convNeedsDecision && facts.lifecycle === "failed" && !isBudgetTerminal(facts.reason)
                 ? lastRun?.declaredFailure
                 : undefined;
-            const processingBudgetMapping = processingBudgetDenial
-                ? classifyBudgetFailure({ denial: processingBudgetDenial, terminal: ledger.terminal() })
-                : null;
+            const inspect = secretDiff.captureInspectionActions(lastRun?.captureRefusal);
             writeFailure(store, paths, {
                 phase: convNeedsDecision ? "review" : "convergence",
                 category: isBudgetTerminal(facts.reason)
@@ -3702,50 +3765,58 @@ export class Orchestrator {
                         : convNeedsDecision
                             ? "policy"
                             : (convDeclared?.category ?? "internal"),
-                code: processingBudgetMapping?.code ?? convDeclared?.code ?? null,
+                code: convBudgetMapping?.code ?? convDeclared?.code ?? null,
                 resetsAt: convDeclared?.resetsAt ?? null,
                 requestRefusal: convDeclared?.requestRefusal,
-                safeMessage: convNeedsDecision
-                    ? `review escalated to a human decision after ${attempt} attempt(s)`
-                    : facts.reason === "stuck_no_progress"
-                        ? (stuckNoProgressReason ?? `stuck_no_progress after ${attempt} attempt(s)`)
-                        : `${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""} after ${attempt} attempt(s)${lastDiffStable ? "" : " (diff changed after review; review is stale)"}`,
                 harnessId: lastRun?.harnessId,
                 attemptId: lastRun?.attemptId,
                 runDir: paths.root,
-                nextActions: facts.lifecycle === "cancelled"
-                    ? facts.reason === "wall_clock_exceeded"
-                        ? [
-                            "Inspect the partial work kept from before the deadline",
-                            "Increase --max-seconds or narrow the scope, then re-run",
-                        ]
-                        : ["Retry if cancellation was accidental"]
-                    : convNeedsDecision
-                        ? [
-                            "Review the blocking findings on the run's turn",
-                            "Accept the risk to apply this exact patch, or discard the change",
-                        ]
-                        : facts.reason === "stuck_no_progress"
+                captureFailure: lastRun?.captureRefusal?.failure,
+                nextActions: [
+                    ...(facts.lifecycle === "cancelled"
+                        ? facts.reason === "wall_clock_exceeded"
+                            ? [
+                                "Inspect the partial work kept from before the deadline",
+                                "Increase --max-seconds or narrow the scope, then re-run",
+                            ]
+                            : ["Retry if cancellation was accidental"]
+                        : convNeedsDecision
                             ? [
-                                "Inspect the stable patch",
-                                "Inspect the failing gate output",
-                                "Fix the gate or provide a different repair instruction",
+                                "Review the blocking findings on the run's turn",
+                                "Accept the risk to apply this exact patch, or discard the change",
                             ]
-                            : [
-                                "Open diagnostics",
-                                "Inspect latest patch and review findings",
-                                "Retry with more attempts or a narrower prompt",
-                            ],
-                ...(processingBudgetMapping
-                    ? budgetFailureRecord(processingBudgetMapping, { runDir: paths.root })
+                            : facts.reason === "stuck_no_progress"
+                                ? [
+                                    "Inspect the stable patch",
+                                    "Inspect the failing gate output",
+                                    "Fix the gate or provide a different repair instruction",
+                                ]
+                                : lastRun?.captureRefusal // no latest patch exists to inspect
+                                    ? secretDiff.captureRefusalNextActions(lastRun.captureRefusal)
+                                    : [
+                                        "Open diagnostics",
+                                        "Inspect latest patch and review findings",
+                                        "Retry with more attempts or a narrower prompt",
+                                    ]),
+                    ...inspect,
+                ],
+                ...(convBudgetMapping
+                    ? budgetFailureRecord(convBudgetMapping, { runDir: paths.root, followUps: inspect })
                     : {}),
+                safeMessage: withPoolAttempts(convBudgetMapping?.safeMessage ??
+                    (convNeedsDecision
+                        ? `review escalated to a human decision after ${attempt} attempt(s)`
+                        : facts.reason === "stuck_no_progress"
+                            ? (stuckNoProgressReason ?? `stuck_no_progress after ${attempt} attempt(s)`)
+                            : `${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""} after ${attempt} attempt(s)${lastDiffStable ? "" : " (diff changed after review; review is stale)"}`), convPool),
+                poolAttempts: convPool,
             });
             // D-16 r8/r9: an INTERRUPTED envelope run still gets its diagnostic
             // summary + output.ready (only patch/work_product are withheld) — the
             // ARCHITECTURE event contract guarantees output.ready precedes the
             // terminal in every mode.
             if (!lastRun || (interrupted && input.inPlace !== true && !lastRun.files)) {
-                store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n`);
+                store.writeText(join(paths.finalDir, "summary.md"), `${withPoolAttempts(`# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}`, convPool)}\n`);
                 log.emit("output.ready", {
                     kind: "summary",
                     path: "final/summary.md",
@@ -3753,8 +3824,9 @@ export class Orchestrator {
                 });
             }
         }
-        // work_product.emitted only when a product was actually written (r9).
-        if (lastRun && (lastRun.files || !interrupted || input.inPlace === true)) {
+        // work_product.emitted only when a product was actually written (r9); a
+        // capture refusal's live record announces itself.
+        if (lastRun && !lastRun.captureRefusal && (lastRun.files || !interrupted || input.inPlace)) {
             log.emit("work_product.emitted", { winner: lastRun.attemptId });
         }
         if (!convIsFailureTerminal) {
@@ -3764,6 +3836,8 @@ export class Orchestrator {
                 facts,
                 reason: facts.reason,
                 attempts: attempt,
+                // A work-state veto is still a block: it keeps the earlier refusals.
+                ...(convPool.length > 0 ? { pool_attempts: convPool } : {}),
             });
         }
         else if (facts.lifecycle === "succeeded") {
@@ -3773,6 +3847,7 @@ export class Orchestrator {
                 facts,
                 attempts: attempt,
                 phase: "review",
+                pool_attempts: convPool,
                 failure_ref: "final/failure.yaml",
             });
         }
@@ -3784,6 +3859,7 @@ export class Orchestrator {
                 reason: facts.reason,
                 attempts: attempt,
                 phase: "convergence",
+                pool_attempts: convPool,
                 failure_ref: "final/failure.yaml",
                 // QA-041: surface the typed deadline reason on the terminal event so the
                 // daemon job result / Control API can distinguish it from a user cancel.
@@ -3806,9 +3882,9 @@ export class Orchestrator {
             ...(facts.lifecycle === "cancelled" && convAbortReason
                 ? { cancelReason: convAbortReason }
                 : {}),
-            summary: converged
+            summary: withPoolAttempts(converged
                 ? `converged in ${attempt} attempt(s)`
-                : `${facts.lifecycle} after ${attempt} attempt(s)`,
+                : `${facts.lifecycle} after ${attempt} attempt(s)`, convPool),
             candidates: lastRun
                 ? [
                     {
@@ -3848,9 +3924,9 @@ export class Orchestrator {
                     ...sessionFields,
                     ...this.harnessSpecKnobs(contract, knobs, args.intent),
                     env_inheritance: envInheritance(this.config(input.repoRoot)),
-                    env: (args.laneRun
+                    env: scopedSpecEnv(input.runScopeMarker, (args.laneRun
                         ? this.laneHomeEnvFor(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null)
-                        : null) ?? args.fallbackHome,
+                        : null) ?? args.fallbackHome),
                 });
                 this.credentials.stampProfileSelection(spec, input, adapter.id);
                 const plannerAbort = new AbortController();
@@ -3903,9 +3979,9 @@ export class Orchestrator {
         // harnesses run sequentially. Doctor, model inventory, and spawn share each
         // lane's durable HOME; the disposable context remains the non-thread fallback.
         const laneRun = Boolean(input.threadId);
-        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input), laneRun
+        const roHome = scopedRouteContext(resolveReadOnlyRouteContext(this.execRootOf(input), laneRun
             ? (id) => this.laneHomeEnvFor(input, id, input.credentialProfileId ?? null)
-            : undefined);
+            : undefined), input.runScopeMarker);
         let adapters;
         try {
             adapters = await this.resolveCandidateAdapters({ ...input, n: undefined }, "plan", ledger, log, roHome, runId);
@@ -4190,7 +4266,7 @@ export class Orchestrator {
      */
     deepScanReducerDeps(input, contract, log) {
         return {
-            newReadOnlyHome: () => resolveReadOnlyRouteContext(this.execRootOf(input)),
+            newReadOnlyHome: () => scopedRouteContext(resolveReadOnlyRouteContext(this.execRootOf(input)), input.runScopeMarker),
             costEvidence: (harnessId, attemptId, routed) => 
             // The reducer admits under a finite estimate floor (mirror of the n>1
             // scout reserve) so a subscription route is not refused for lacking a
@@ -4213,7 +4289,7 @@ export class Orchestrator {
                     resume_session_id: null,
                     ...this.harnessSpecKnobs(contract, knobs, "synthesize"),
                     env_inheritance: envInheritance(this.config(input.repoRoot)),
-                    env: homeEnv,
+                    env: scopedSpecEnv(input.runScopeMarker, homeEnv),
                 });
                 this.credentials.stampProfileSelection(spec, input, routed.adapter.id);
                 // D-16: compile the WorkReport transport onto the reducer spec (the
@@ -4242,7 +4318,7 @@ export class Orchestrator {
         // recorded user intent is the CALLER's goal.
         const contract = this.buildContract({ ...input, prompt: opts.contractIntent ?? prompt }, taskId, opts.mode);
         const quotaSnapshots = this.quotaSnapshotPreflight();
-        const { store, paths, log, ledger } = beginAnnouncedRun({
+        const { store, paths, log, ledger, runContext } = beginAnnouncedRun({
             input,
             contract,
             quotaSnapshots,
@@ -4265,9 +4341,9 @@ export class Orchestrator {
         // and the next lane turn resumes it (INV-034). Its doctor/model/spawn path
         // shares that lane HOME; deep-scan and one-shot asks keep the disposable one.
         const laneRun = Boolean(input.threadId) && opts.mode === "ask" && !opts.deepScan;
-        const roHome = resolveReadOnlyRouteContext(this.execRootOf(input), laneRun
+        const roHome = scopedRouteContext(resolveReadOnlyRouteContext(this.execRootOf(input), laneRun
             ? (id) => this.laneHomeEnvFor(input, id, input.credentialProfileId ?? null)
-            : undefined);
+            : undefined), input.runScopeMarker);
         let adapters, width;
         try {
             ({ adapters, width } = await resolveReadOnlyCandidates({
@@ -4302,6 +4378,14 @@ export class Orchestrator {
             };
         }
         const attempts = [];
+        // A launched attempt's tries' accounts, owned here until its record joins
+        // `attempts` (as an Agent slot owns them): a throw after its tries settled
+        // still names them on the run's terminal, and never twice.
+        const launched = new Set();
+        runContext.attempts = () => [
+            ...attempts,
+            ...[...launched].map((tried) => ({ poolAttempts: tried.snapshot() })),
+        ];
         const attemptTelemetries = [];
         let fallbackOpen = false;
         let budgetStopped = false;
@@ -4445,9 +4529,9 @@ export class Orchestrator {
                     // A thread lane turn spawns in its DURABLE per-lane home so the native
                     // session it records is reachable for resume next turn; everything else
                     // uses the disposable route-context home.
-                    env: (laneRun
+                    env: scopedSpecEnv(input.runScopeMarker, (laneRun
                         ? this.laneHomeEnvFor(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null)
-                        : null) ?? roHome.env,
+                        : null) ?? roHome.env),
                 });
                 this.credentials.stampProfileSelection(spec, input, adapter.id);
                 const reportInteraction = interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive);
@@ -4513,12 +4597,15 @@ export class Orchestrator {
             const retryPolicy = transientRetryPolicy(this.config(input.repoRoot));
             let activeSessionId = spec.session_id;
             const live = liveAttempt(input, routed, paths, contract, attemptId, () => activeSessionId);
+            const tried = new PoolAttemptEvidence(adapter.id, attemptId);
+            launched.add(tried);
             let continuity;
             ({ continuity, spec } = await openContinuity(this.continuityDeps(adapter, routed, contract, attemptId, paths, input, log, {
                 envelope: null,
                 harnessHome: null,
                 workOrder: input.prompt,
                 firstPrompt: spec.prompt,
+                poolEvidence: tried,
             }), { spec, continuation: input.continuation, store, telemetry }));
             const onAbort = () => void adapter.cancel?.(activeSessionId)?.catch(() => { });
             if (input.signal) {
@@ -4553,9 +4640,8 @@ export class Orchestrator {
                     runSpec.extra["abortSignal"] = input.signal
                         ? AbortSignal.any([input.signal, tryAbort.signal])
                         : tryAbort.signal;
-                    continuity.beginTry(runSpec, nativeTry, tryAbort);
                     // #363: bound before the spawn — a credential change mid-try voids it.
-                    const refusal = this.credentials.bindPreProgressRefusal(adapter.id, runSpec);
+                    const refusal = continuity.beginTry(runSpec, nativeTry, tryAbort);
                     const transientStart = telemetry.transientFailures.length;
                     const rateLimitStart = telemetry.rateLimits.length;
                     log.emit("harness.started", {
@@ -4630,8 +4716,6 @@ export class Orchestrator {
                         if (!recordAdapterThrow(telemetry, err))
                             break;
                     }
-                    if (streamBudgetDenied)
-                        break;
                     if (telemetry.requestRefusal)
                         break;
                     const newTransients = telemetry.transientFailures.slice(transientStart);
@@ -4640,10 +4724,14 @@ export class Orchestrator {
                     const reportSoFar = answer.text();
                     const delivered = !harnessError && reportSoFar.length > 0 && !input.signal?.aborted;
                     this.credentials.noteTryServed(refusal, telemetry.outputMarkers, delivered);
+                    // A budget stop ends the attempt; typed progress before it still served the account.
+                    if (streamBudgetDenied)
+                        break;
                     const verdict = await continuity.afterTry({
                         runSpec,
                         nativeTry,
                         harnessErrored: harnessError !== null,
+                        originalError: harnessError,
                         aborted: input.signal?.aborted === true,
                         requestRefused: Boolean(telemetry.requestRefusal),
                         newTransients,
@@ -4761,6 +4849,7 @@ export class Orchestrator {
                             : {}),
                     ...continuity.terminalFacts(roResumable),
                 });
+                launched.delete(tried);
                 if (opts.deepScan) {
                     store.writeText(join(paths.findingsDir, `${attemptId}-error.md`), `# Explorer ${attemptId} failed\n\n${harnessError}\n`);
                 }
@@ -4786,6 +4875,7 @@ export class Orchestrator {
                 ...(scoutInterrupted ? { interrupted: true } : {}),
                 ...continuity.terminalFacts(roResumable),
             });
+            launched.delete(tried);
             if (opts.deepScan) {
                 const warningNote = toolWarnings(telemetry).length
                     ? `\n\n> Tool warnings: ${toolWarnings(telemetry)
@@ -4946,188 +5036,20 @@ export class Orchestrator {
             harnessId: a.harnessId,
             status: a.status,
         }));
-        const cancelledTerminal = () => cancelledResult(log, runId, taskId, opts.mode, paths.root, candidateSummaries, () => this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null), ledger.spend(), input.signal, store, undefined, resumableOf(attempts, "cancelled"));
+        const cancelledTerminal = () => cancelledResult(log, runId, taskId, opts.mode, paths.root, candidateSummaries, () => this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null), ledger.spend(), input.signal, store, undefined, resumableOf(attempts, "cancelled"), attempts);
         if (input.signal?.aborted)
             return cancelledTerminal();
         const succeededReadonly = attempts.filter((a) => a.status === "success");
-        if (!opts.deepScan && succeededReadonly.length === 0) {
-            const last = attempts[attempts.length - 1];
-            const webBlocked = attempts.some((a) => a.status === "blocked");
-            // QA-050: a budget refusal is a BUDGET failure, not a harness one — route
-            // it through the shared classifier so phase/category/code/route and the
-            // remediation are budget-typed (never auth/setup) across every mode.
-            const budgetMapping = budgetStopped && !webBlocked
-                ? classifyBudgetFailure({ denial: budgetDenial, terminal: ledger.terminal() })
-                : null;
-            const singleError = budgetMapping?.safeMessage ??
-                last?.error ??
-                (budgetStopped ? "budget exhausted before any attempt" : "harness failed");
-            if (fallbackOpen || webBlocked) {
-                log.emit("route.fallback.exhausted", {
-                    harness_id: last?.harnessId ?? null,
-                    attempt_id: last?.attemptId ?? null,
-                    reason: "web_evidence_unsatisfied",
-                    error: singleError,
-                });
-                fallbackOpen = false;
-            }
-            const partialReport = [...attempts].reverse().find((a) => a.report)?.report ?? "";
-            this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null);
-            store.writeText(join(paths.contextDir, "context_error.md"), `# ${budgetMapping ? "Budget Denied" : "Harness Error"}\n\n${singleError}\n`);
-            const roEventRefs = attempts.map((a) => `attempts/${a.attemptId}/events.jsonl`);
-            if (budgetMapping) {
-                writeFailure(store, paths, budgetFailureRecord(budgetMapping, { eventRefs: roEventRefs, runDir: paths.root }));
-            }
-            else {
-                // #31: classify the harness cause across the read-only attempts so auth
-                // guidance appears only on a real auth failure.
-                const roCategory = dominantHarnessFailureCategory(attemptTelemetries.flatMap((a) => a.telemetry.transientFailures));
-                // A5: the terminal already speaks with the LAST attempt's message; its
-                // typed refusal rides along machine-readably instead of reducing to it.
-                const roDeclared = webBlocked ? undefined : last?.declaredFailure;
-                writeFailure(store, paths, {
-                    phase: "harness",
-                    category: webBlocked ? "policy" : (roDeclared?.category ?? "harness_error"),
-                    code: roDeclared?.code ?? null,
-                    harnessId: last?.harnessId,
-                    attemptId: last?.attemptId,
-                    safeMessage: singleError,
-                    eventRefs: roEventRefs,
-                    runDir: paths.root,
-                    resetsAt: roDeclared?.resetsAt ?? null,
-                    requestRefusal: roDeclared?.requestRefusal,
-                    vendorFailure: attemptVendorFailure(attemptTelemetries, last?.attemptId),
-                    nextActions: harnessFailureNextActions(roCategory),
-                });
-            }
-            // QA-036: re-check the DELIVERABLE through the shared finalizer helper —
-            // a blocked Ask that produced NO answer can no longer read as a succeeded
-            // "Needs review" run (exit 0); it is an honest failure (exit 1).
-            const roTerminal = readOnlyNoSuccessTerminal({
-                webBlocked,
-                hasDeliverable: partialReport.trim().length > 0,
-                budgetStopped,
-                attemptsCount: attempts.length,
-            });
-            const terminalFacts = makeOutcomeFacts(roTerminal.lifecycle, {
-                ...(roTerminal.review ? { review: roTerminal.review } : {}),
-                reason: budgetMapping?.reason ?? roTerminal.reason,
-            });
-            const terminalHarnessId = budgetMapping?.harnessId ?? last?.harnessId;
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harness: ${terminalHarnessId ?? "none"}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}\n\n${singleError}\n`);
-            log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
-            if (terminalFacts.lifecycle === "succeeded") {
-                log.emit("run.blocked", {
-                    lifecycle: terminalFacts.lifecycle,
-                    facts: terminalFacts,
-                    harness_id: terminalHarnessId,
-                    error: singleError,
-                    failure_ref: "final/failure.yaml",
-                    ...resumableTerminal(store, paths, attempts, true),
-                });
-            }
-            else {
-                log.emit("run.failed", {
-                    lifecycle: terminalFacts.lifecycle,
-                    facts: terminalFacts,
-                    reason: terminalFacts.reason,
-                    phase: budgetMapping?.phase,
-                    harness_id: terminalHarnessId,
-                    error: singleError,
-                    failure_ref: "final/failure.yaml",
-                    ...resumableTerminal(store, paths, attempts, true),
-                });
-            }
-            return {
-                spendUsd: ledger.spend(),
-                runId,
-                taskId,
-                mode: opts.mode,
-                lifecycle: terminalFacts.lifecycle,
-                facts: terminalFacts,
-                winner: null,
-                runDir: paths.root,
-                summary: singleError,
-                candidates: attempts.map((a) => ({
-                    attemptId: a.attemptId,
-                    harnessId: a.harnessId,
-                    status: a.status,
-                })),
-            };
-        }
+        const readonlyTerminal = {
+            ...{ store, paths, log, runId, taskId, mode: opts.mode, ledger, attempts },
+            ...{ attemptTelemetries, budgetStopped, budgetDenial },
+            writeTelemetry: () => this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null),
+        };
+        if (!opts.deepScan && succeededReadonly.length === 0)
+            return readOnlyChainFailureResult({ ...readonlyTerminal, fallbackOpen });
         const succeeded = succeededReadonly;
-        if (opts.deepScan && succeeded.length === 0) {
-            const blocked = attempts.some((a) => a.status === "blocked");
-            // QA-050/QA-019: only a pure-denial scan may claim a budget failure.
-            const scanBudgetMapping = budgetStopped && !blocked && attempts.every((a) => a.budgetDenied === true)
-                ? classifyBudgetFailure({ denial: budgetDenial, terminal: ledger.terminal() })
-                : null;
-            // D-16 r8: ALL scouts out of context → the aggregate is interrupted.
-            const allInterrupted = attempts.length > 0 && attempts.every((a) => a.interrupted === true);
-            const scanFailFacts = allInterrupted
-                ? makeOutcomeFacts("interrupted", { reason: "context_capacity_exhausted" })
-                : makeOutcomeFacts("failed", {
-                    reason: scanBudgetMapping ? scanBudgetMapping.reason : "harness_failed",
-                });
-            const message = scanBudgetMapping
-                ? scanBudgetMapping.safeMessage
-                : attempts.map((a) => `${a.attemptId}/${a.harnessId}: ${a.error ?? "failed"}`).join("\n");
-            this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null);
-            if (scanBudgetMapping) {
-                writeFailure(store, paths, budgetFailureRecord(scanBudgetMapping, {
-                    eventRefs: attempts.map((a) => `attempts/${a.attemptId}/events.jsonl`),
-                    runDir: paths.root,
-                }));
-            }
-            else {
-                // Mixed causes stay generic; only unanimous evidence may name the scan's cause.
-                const declared = blocked ? null : unanimousDeclaredFailure(attempts);
-                const scanCategory = dominantHarnessFailureCategory(attemptTelemetries.flatMap((a) => a.telemetry.transientFailures));
-                writeFailure(store, paths, {
-                    phase: "harness",
-                    category: blocked ? "policy" : (declared?.category ?? "harness_error"),
-                    code: declared?.code,
-                    resetsAt: declared?.resetsAt,
-                    requestRefusal: declared?.requestRefusal,
-                    safeMessage: message || "all explorers failed",
-                    eventRefs: attempts.map((a) => `attempts/${a.attemptId}/events.jsonl`),
-                    runDir: paths.root,
-                    nextActions: [
-                        ...harnessFailureNextActions(scanCategory).filter((a) => !a.startsWith("Retry")),
-                        "Reduce explore width",
-                        "Retry after setup",
-                    ],
-                });
-            }
-            // QA-036: no successful explorer means no synthesizable deliverable.
-            store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Lifecycle: ${scanFailFacts.lifecycle}${scanFailFacts.reason ? ` (${scanFailFacts.reason})` : ""}\n\n${message}\n`);
-            log.emit("output.ready", { kind: "summary", path: "final/summary.md", state: "diagnostic" });
-            log.emit("run.failed", {
-                lifecycle: scanFailFacts.lifecycle,
-                facts: scanFailFacts,
-                reason: scanFailFacts.reason,
-                phase: scanBudgetMapping ? scanBudgetMapping.phase : "harness",
-                error: message,
-                failure_ref: "final/failure.yaml",
-                ...resumableTerminal(store, paths, attempts, true),
-            });
-            return {
-                spendUsd: ledger.spend(),
-                runId,
-                taskId,
-                mode: opts.mode,
-                lifecycle: scanFailFacts.lifecycle,
-                facts: scanFailFacts,
-                winner: null,
-                runDir: paths.root,
-                summary: message,
-                candidates: attempts.map((a) => ({
-                    attemptId: a.attemptId,
-                    harnessId: a.harnessId,
-                    status: a.status,
-                })),
-            };
-        }
+        if (opts.deepScan && succeeded.length === 0)
+            return deepScanFailureResult(readonlyTerminal);
         const unsuccessful = attempts.filter((a) => a.status !== "success");
         // #27 / D-6: a multi-scout deep scan runs ONE bounded synthesis reducer over
         // the raw scout reports so the final artifact is a real merge, not a
@@ -5231,7 +5153,9 @@ export class Orchestrator {
             .map((a) => `${a.attemptId}:${a.harnessId}:${a.status}`)
             .join(", ");
         const secretLike = secretDiff.answerSecretLikeFinding(answerMatches);
-        store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harnesses: ${harnessLabel}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}${secretDiff.summaryDisclosure(secretLike)}\n\n${report}\n`);
+        // A delivered report that still ends unsuccessfully or blocked keeps it and names every failed try.
+        const reportPool = terminalPoolAttempts(terminalFacts, attempts);
+        store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harnesses: ${harnessLabel}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}${secretDiff.summaryDisclosure(secretLike)}\n\n${withPoolAttempts(report, reportPool)}\n`);
         const reportProducerAttemptId = opts.deepScan &&
             deepScanSynthesis?.status === "succeeded" &&
             deepScanSynthesis.reducer_attempt_id
@@ -5258,7 +5182,8 @@ export class Orchestrator {
             writeFailure(store, paths, {
                 phase: "executor",
                 category: terminalFacts.reason === "context_capacity_exhausted" ? "harness_error" : "budget",
-                safeMessage: `read-only report ended ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason.replaceAll("_", " ")})` : ""}`,
+                safeMessage: withPoolAttempts(`read-only report ended ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason.replaceAll("_", " ")})` : ""}`, reportPool),
+                poolAttempts: reportPool,
                 runDir: paths.root,
                 nextActions: terminalFacts.reason === "context_capacity_exhausted"
                     ? ["Inspect the partial report", "Re-run with a narrower scope"]
@@ -5269,6 +5194,7 @@ export class Orchestrator {
                 facts: terminalFacts,
                 reason: terminalFacts.reason,
                 phase: "executor",
+                pool_attempts: reportPool,
                 failure_ref: "final/failure.yaml",
                 ...resumableTerminal(store, paths, attempts, true),
             });
@@ -5278,6 +5204,7 @@ export class Orchestrator {
                 lifecycle: terminalFacts.lifecycle,
                 facts: terminalFacts,
                 reason: terminalFacts.reason,
+                pool_attempts: reportPool,
                 ...resumableTerminal(store, paths, attempts, true),
             });
         }
@@ -5298,7 +5225,7 @@ export class Orchestrator {
             facts: terminalFacts,
             winner: null,
             runDir: paths.root,
-            summary: redactSecrets(report).slice(0, 400),
+            summary: withPoolAttempts(redactSecrets(report).slice(0, 400), reportPool),
             candidates: candidateSummaries,
         };
     }