@claudexor/orchestrator 4.8.2 → 5.0.1

package/dist/orchestrator.js

@@ -6,12 +6,12 @@ import { requestRefusalFailure } from "./runTerminalResults.js";
 import { openRunScopeCustody, scopedRouteContext, scopedSpecEnv, } from "./runScope.js";
 import { delegationBeltFor } from "./delegationBelt.js";
 import { routePromptCacheTtl, withReviewerPromptCacheTtl } from "./prompt-cache-routing.js";
-import { bindProcessingAdmission, processingAttemptCostEvidence, processingAdmissionForLease, updateProcessingStreamHold, ProcessingBudgetAdmissionError, } from "./processing-dispatch.js";
+import { bindProcessingAdmission, processingAttemptCostEvidence, processingAdmissionForLease, updateProcessingStreamHold, } from "./processing-dispatch.js";
 import { cancelledCandidatesResult, emptyCandidateResult, failedCandidatesResult, failAfterCandidates, } from "./candidateTerminals.js";
 import { deepScanFailureResult, readOnlyChainFailureResult, } from "./readonlyTerminals.js";
 import { effectiveAuthPreference, observeNativeSessionEvent, resumeSessionForProfile, } from "./credential-profiles.js";
 import { AdmissionProfileProbes, OrchestratorCredentials, reviewerProfileResolver, } from "./orchestrator-credentials.js";
-import { continuityWorkspace, resumableOf, resumableTerminal, } from "./continuity-terminal.js";
+import { continuityWorkspace, carryingAttempts, resumableOf, resumableTerminal, } from "./continuity-terminal.js";
 import { openContinuity } from "./continue-from.js";
 import { accountPoolRows } from "./account-pool.js";
 import { PoolAttemptEvidence, terminalPoolAttempts, withPoolAttempts, } from "./pool-attempt-evidence.js";
@@ -33,8 +33,8 @@ import { globalConfigDir } from "@claudexor/config";
 import { executionRunConfig } from "./run-defaults.js";
 import { preflightOneShot } from "./one-shot-preflight.js";
 import { prepareRoutedProcessing, processingCostEvidence, prepareReviewerProcessing, } from "./processing-routing.js";
-import { acceptedTryOutput, AccessProfileIncompatibleError, AuxiliaryWritableRootsUnsupportedError, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
-import { assertRouteModelsAllowed, runModelGovernedRoute } from "./modelGovernance.js";
+import { acceptedTryOutput, AccessProfileIncompatibleError, AnswerAssembly, appendHarnessEvent, AuxiliaryWritableRootsUnsupportedError, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, withInactivityWatchdog, } from "@claudexor/core";
+import { assertRouteModelsAllowed, isDispatchRefusal, runModelGovernedRoute, } from "./modelGovernance.js";
 import { authModeForCredentialRoute, authModeForPreference, authRouteEvidenceFor, } from "./auth-route-classification.js";
 import { isFullAccess, RequestRequirementsResolver } from "./requestRequirements.js";
 import { activateDelegationParent } from "./delegation-parent-activation.js";
@@ -51,7 +51,7 @@ import { budgetFailureRecord, classifyBudgetFailure } from "./budgetFailure.js";
 import { finalizeStructuredOutput } from "./structuredOutput.js";
 import { prepareRunAdmission } from "./runAdmission.js";
 import { dropDeltaPastBudget, emitPlanProgress, emitTransientExhausted, observeReadonlySpend, recordAdapterThrow, } from "./laneStreamEvents.js";
-import { promptWithEngineConstraints, sleep, redactHarnessEvent, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
+import { promptWithEngineConstraints, sleep, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
 import { candidateStatusInRouteContext, resolveReadOnlyRouteContext, } from "./routeContext.js";
 import { resolveAutoReviewerPanel, resolveExplicitReviewerPanel } from "./reviewerPanel.js";
 import { ensureClaudeBridgeForRun, ensureWriteModeGitBoundary } from "./git-precondition.js";
@@ -72,16 +72,17 @@ import { finalVerifyRun, gateSpecsFromContract, renderTestsEvidence } from "./co
 import { buildTaskContract } from "./task-contract-builder.js";
 import { recordProcessingIntent } from "./retry-processing-intent.js";
 import { prepareReviewEvidenceDir, recordReviewEvidenceCleanup } from "./reviewEvidence.js";
+import { savedForSynthesis } from "./savedCandidate.js";
 import { ArtifactStore } from "@claudexor/artifact-store";
-import { buildContextPack, rawContextForEnvelope, writeEvidencePacket } from "@claudexor/context";
-import { WorkspaceManager, captureRawPatchEnvelope, createRevertAnchorFromPatchOrNull, createRevertAnchorOrNull, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
+import { buildContextPack, rawContextSizer, writeEvidencePacket } from "@claudexor/context";
+import { WorkspaceManager, captureRawPatchEnvelope, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
 import { blockedDecisionOverride, finalVerifyBlocks, verifyAndDeliverFiles, verifyAndDeliver, } from "@claudexor/delivery";
 import { HarnessGateway } from "@claudexor/gateway";
 import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, reviewCandidate, runGates, } from "@claudexor/review";
 import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
-import { billingKnowledgeForAuthRoute, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, RoutingPreflightError, explainRanking, loadHarnessMetrics, promptFingerprint, rankHarnesses, } from "@claudexor/budget";
-import { readTextSafe, appendLine, hashJson, newId, noProjectRepoRoot, redactSecrets, safeInvoke, sha256, userConfigDir, } from "@claudexor/util";
+import { billingKnowledgeForAuthRoute, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, explainRanking, loadHarnessMetrics, promptFingerprint, rankHarnesses, } from "@claudexor/budget";
+import { readTextSafe, hashJson, newId, noProjectRepoRoot, redactSecrets, safeInvoke, userConfigDir, } from "@claudexor/util";
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
 export class Orchestrator {
@@ -188,20 +189,24 @@ export class Orchestrator {
             await custody.settleUnannounced();
         }
     }
-    async resolveReviewers(cwd, runAuthPreference, onIgnoredSetting) {
+    async resolveReviewers(run, onIgnoredSetting) {
         if (this.deps.reviewers)
             return this.deps.reviewers;
-        if (this.deps.reviewerPanel && this.deps.reviewerPanel.length > 0) {
-            return this.resolveExplicitReviewerPanel(cwd, this.deps.reviewerPanel, runAuthPreference, onIgnoredSetting);
-        }
-        return resolveAutoReviewerPanel({
+        const { repoRoot: cwd, authPreference, signal } = run;
+        const panelDeps = {
             cwd,
             registry: this.deps.registry,
             harnessSettings: this.config(cwd)?.global.harnesses ?? {},
-            authPreferenceFor: (id) => this.authPreferenceForHarness(cwd, id, runAuthPreference),
-            resolveReviewerProfile: reviewerProfileResolver(this.credentials, cwd),
+            authPreferenceFor: (id) => this.authPreferenceForHarness(cwd, id, authPreference),
+            resolveReviewerProfile: reviewerProfileResolver(this.credentials, cwd, signal),
             onIgnoredSetting,
-        }, { reviewerModels: this.deps.reviewerModels, reviewerEfforts: this.deps.reviewerEfforts });
+        };
+        if (this.deps.reviewerPanel && this.deps.reviewerPanel.length > 0)
+            return resolveExplicitReviewerPanel(panelDeps, this.deps.reviewerPanel);
+        return resolveAutoReviewerPanel(panelDeps, {
+            reviewerModels: this.deps.reviewerModels,
+            reviewerEfforts: this.deps.reviewerEfforts,
+        });
     }
     /**
      * Resolve reviewers INSIDE a strategy, after run-dir creation: an explicit
@@ -217,7 +222,7 @@ export class Orchestrator {
             // Reviewer knobs a panel omitted or dropped → ignored-settings channel (QA-070):
             const warn = (d) => void log.emit("review.preflight", { ignored_settings: [d] });
             const config = this.config(input.repoRoot).global;
-            const reviewers = await this.resolveReviewers(input.repoRoot, input.authPreference, warn);
+            const reviewers = await this.resolveReviewers(input, warn);
             return {
                 reviewers: await prepareReviewerProcessing(withReviewerPromptCacheTtl(reviewers, input.promptCacheTtl, warn), input, config, input.paidBudget ?? this.deps.paidBudget ?? config.budget.paid_budget_per_run),
             };
@@ -256,16 +261,6 @@ export class Orchestrator {
             };
         }
     }
-    async resolveExplicitReviewerPanel(cwd, panel, runAuthPreference, onIgnoredSetting) {
-        return resolveExplicitReviewerPanel({
-            cwd,
-            registry: this.deps.registry,
-            harnessSettings: this.config(cwd)?.global.harnesses ?? {},
-            authPreferenceFor: (id) => this.authPreferenceForHarness(cwd, id, runAuthPreference),
-            resolveReviewerProfile: reviewerProfileResolver(this.credentials, cwd),
-            onIgnoredSetting,
-        }, panel);
-    }
     authPreferenceForHarness(repoRoot, harnessId, runAuthPreference) {
         const cfg = this.config(repoRoot)?.global;
         return effectiveAuthPreference(runAuthPreference, cfg?.harnesses?.[harnessId]?.auth_preference, cfg?.routing?.auth_preference);
@@ -587,6 +582,11 @@ export class Orchestrator {
                 dropLane(id, "access", `${id} (cannot apply execution.auxiliaryWritableRoots under ${requiredAccess})`);
                 continue;
             }
+            const readRefusal = this.requestRequirements.projectReadRefusal(intent, input, status);
+            if (readRefusal) {
+                dropLane(id, "capability", readRefusal);
+                continue;
+            }
             const reason = status.reasons.length > 0 ? `: ${status.reasons.join("; ")}` : "";
             if (status.enabledIntents.includes(intent) && accessSupported) {
                 pool.push({
@@ -720,7 +720,7 @@ export class Orchestrator {
                 throw primaryQuotaRefusal.error;
             throw new HarnessUnavailableError(`no harness remains eligible for '${intent}' after budget and quota routing`);
         }
-        emitPrimaryDivergence(log, input.primaryHarness, ordered, pool, dropped, browserOmissions);
+        emitPrimaryDivergence(log, input.primaryHarness, ordered, pool, dropped, browserOmissions, statusById);
         const n = input.n ?? ordered.length;
         const selectionOrder = ordered;
         const out = [];
@@ -1268,7 +1268,6 @@ export class Orchestrator {
             artifactRoot: join(paths.attemptsDir, attemptId),
             observedPaths: [...observedPaths],
         }));
-        const rawContextPacket = await rawContextForEnvelope(routed.implementationTransport, envelope);
         const sessionFields = runInput
             ? await this.sessionSpecFields(runInput, adapter.id, knobs.model, log, routed.authRouteEstimate, routed.quotaAdmission)
             : undefined;
@@ -1334,11 +1333,20 @@ export class Orchestrator {
                 ? { resume_session_id: sessionFields.resume_session_id }
                 : {}),
             ...(scopedEnv ? { env: scopedEnv } : {}),
-            raw_context_packet: rawContextPacket,
             stream_deltas: streamDeltas,
         });
         if (runInput)
             this.credentials.stampProfileSelection(spec, runInput, adapter.id);
+        // #147: bound to the project's context config; each try's dispatch sizes its own
+        // packet for THIS request from the catalog read the gate makes for that try.
+        const { context } = this.projectConfig(contract.repo.root);
+        const sizeRawContext = rawContextSizer(routed.implementationTransport, envelope, context);
+        let rawContextPacket = null;
+        const dispatch = sizeRawContext
+            ? {
+                rawContext: async (capacity) => (rawContextPacket = await sizeRawContext(capacity)),
+            }
+            : {};
         bindProcessingAdmission(spec, ledger, processingLease.lease, adapter.id, attemptId, processingLease.onDenied, processingAdmission);
         // Profile-less processing keeps its existing route estimate. Named rows
         // receive their own verification at the shared physical-dispatch gate.
@@ -1369,7 +1377,7 @@ export class Orchestrator {
         // QA-024: emit the belt-failure disclosure event at most once per attempt.
         let beltFailureDisclosed = false;
         const errors = [];
-        let answer = new secretDiff.CountedAnswerAssembly();
+        let answer = new AnswerAssembly();
         let currentCapture;
         const retryPolicy = transientRetryPolicy(this.config(contract.repo.root));
         // QA-024: the delegation belt is the ONLY engine-owned extra MCP server
@@ -1398,13 +1406,15 @@ export class Orchestrator {
             workOrder: prompt,
             firstPrompt: spec.prompt,
             poolEvidence,
+            later: continuationPointer ? "checkpoint" : undefined, // repair/synthesis never re-plan
+            explicitModel: modelHint !== undefined,
         }), { spec, continuation: runInput?.continuation, store, telemetry }));
         try {
             for (let nativeTry = 0; !signal?.aborted; nativeTry += 1) {
                 currentCapture = undefined;
                 // A3 per-try isolation: no output, progress marker or model proof crosses tries.
                 if (nativeTry > 0) {
-                    answer = new secretDiff.CountedAnswerAssembly();
+                    answer = new AnswerAssembly();
                     beginNativeRetry(telemetry);
                 }
                 const clearFileBackedContext = stageFileBackedContext(envelope.worktree_path, fileBackedContext);
@@ -1422,8 +1432,9 @@ export class Orchestrator {
                 const transientStart = telemetry.transientFailures.length;
                 const rateLimitStart = telemetry.rateLimits.length;
                 let rawPatch = null;
+                rawContextPacket = null; // a patch binds only the packet its own try sent
                 try {
-                    const watched = withInactivityWatchdog(runModelGovernedRoute(routed, runSpec), {
+                    const watched = withInactivityWatchdog(runModelGovernedRoute(routed, runSpec, dispatch), {
                         timeoutMs: inactivityMs,
                         countsAsProgress: countsAsAgentProgress,
                         onTimeout: () => {
@@ -1435,31 +1446,34 @@ export class Orchestrator {
                         // terminal/restart when the timeout is disabled.
                         isSuspended: () => (interaction?.pendingCount?.() ?? 0) > 0,
                         suspensionVersion: () => interaction?.suspensionVersion?.() ?? 0,
+                        stopSignal: signal, // after Stop: drained events are recorded, never used
                     });
                     for await (const ev of watched) {
-                        rawPatch = captureRawPatchEnvelope(rawContextPacket !== null, rawPatch, ev);
+                        // After Stop: stored evidence only, but file paths are still collected for the capture.
+                        const stopped = signal?.aborted === true;
+                        if (!stopped)
+                            rawPatch = captureRawPatchEnvelope(sizeRawContext !== null, rawPatch, ev);
                         if (ev.type === "patch_produced")
                             continue;
-                        const safeEv = redactHarnessEvent(ev);
                         if (directory)
-                            observeDirectoryPaths(observedPaths, safeEv, envelope.worktree_path);
-                        const capped = dropDeltaPastBudget(safeEv, deltaFlood, Orchestrator.MAX_DELTAS_PER_ATTEMPT, (t, p) => log?.emit(t, p), adapter.id, attemptId);
-                        const display = !capped && safeEv.payload?.["buffered"] !== true;
-                        log?.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv), display);
+                            observeDirectoryPaths(observedPaths, ev, envelope.worktree_path);
+                        const capped = dropDeltaPastBudget(ev, deltaFlood, Orchestrator.MAX_DELTAS_PER_ATTEMPT, (t, p) => log?.emit(t, p), adapter.id, attemptId);
+                        const display = !stopped && !capped && ev.payload?.["buffered"] !== true;
+                        log?.emit("harness.event", harnessEventPayload(adapter.id, attemptId, ev), display);
                         if (signal?.aborted)
-                            break;
+                            continue; // a live observer may itself have pressed Stop
                         if (display)
-                            safeInvoke(onHarnessEvent, safeEv);
-                        observeAuthSwitch(log, adapter.id, attemptId, safeEv);
-                        observeAttemptTelemetry(telemetry, safeEv);
-                        const mismatch = continuity.observe(safeEv, runSpec, telemetry.outputMarkers);
+                            safeInvoke(onHarnessEvent, ev);
+                        observeAuthSwitch(log, adapter.id, attemptId, ev);
+                        observeAttemptTelemetry(telemetry, ev);
+                        const mismatch = continuity.observe(ev, runSpec, telemetry.outputMarkers);
                         if (mismatch) {
                             harnessErrored = true;
                             errors.push(mismatch);
                             break;
                         }
                         if (inPlaceEnvelope && continuity.mayPublishSession)
-                            observeNativeSessionEvent(runInput, adapter.id, safeEv);
+                            observeNativeSessionEvent(runInput, adapter.id, ev);
                         // QA-024: the injected delegation belt's MCP server reported a
                         // terminal startup failure. Disclose it ONCE while live; recoverable
                         // exact tool-result failures are evaluated at attempt finalization.
@@ -1476,10 +1490,10 @@ export class Orchestrator {
                                 reason: "mcp_server_failed_to_start",
                             });
                         }
-                        emitPlanProgress((t, p) => log?.emit(t, p), adapter.id, attemptId, safeEv);
-                        if (safeEv.type === "usage") {
+                        emitPlanProgress((t, p) => log?.emit(t, p), adapter.id, attemptId, ev);
+                        if (ev.type === "usage") {
                             const usage = processAttemptUsage({
-                                event: safeEv,
+                                event: ev,
                                 telemetry,
                                 harnessId: adapter.id,
                                 attemptId,
@@ -1497,19 +1511,19 @@ export class Orchestrator {
                                 break;
                             }
                         }
-                        if (safeEv.type === "error") {
+                        if (ev.type === "error") {
                             harnessErrored = true;
-                            errors.push(redactSecrets(safeEv.error ?? safeEv.text ?? "harness emitted error"));
+                            errors.push(redactSecrets(ev.error ?? ev.text ?? "harness emitted error"));
                         }
                         // Capture assistant prose so an answer-only turn (no file changes) still
                         // has an honest output artifact; a TYPED final message wins verbatim.
-                        answer.observeCounted(ev, safeEv);
+                        answer.observe(ev);
                         // Observe ALL budget/quota signals (one codex usage event carries
                         // BOTH spend and quota); pressure disclosed once per attempt.
-                        observeBudgetSignals(ledger, log, adapter.id, attemptId, safeEv, budgetSignalState);
-                        this.deps.quotaEventSink?.(adapter.id, safeEv);
+                        observeBudgetSignals(ledger, log, adapter.id, attemptId, ev, budgetSignalState);
+                        this.deps.quotaEventSink?.(adapter.id, ev);
                     }
-                    if (rawContextPacket && !harnessErrored)
+                    if (sizeRawContext && !harnessErrored)
                         await consumeRawPatchEnvelope({
                             repoRoot: envelope.repo_root,
                             worktreePath: envelope.worktree_path,
@@ -1525,8 +1539,7 @@ export class Orchestrator {
                     // gate and required-actions read a typed category, not a bare boolean.
                     harnessErrored = true;
                     errors.push(safeErrorMessage(err));
-                    if (err instanceof ProcessingBudgetAdmissionError ||
-                        err instanceof RoutingPreflightError) {
+                    if (isDispatchRefusal(err)) {
                         processingRefusal = err;
                         break;
                     }
@@ -1557,11 +1570,11 @@ export class Orchestrator {
                     await captureDirectory();
                 currentCapture = directory
                     ? undefined
-                    : await secretDiff.captureCandidateDiff(wsm, envelope);
+                    : await secretDiff.captureCandidateDiff(wsm, envelope, paths.root);
                 const currentDiff = secretDiff.capturedDiff(currentCapture);
                 const workspaceUnchanged = directory
                     ? !isMutatingAccess(access) || directoryCapture.files?.noChanges === true
-                    : currentDiff?.trim().length === 0;
+                    : secretDiff.captureUnchanged(currentCapture);
                 const deliverableEmpty = workspaceUnchanged && answer.text().length === 0;
                 const delivered = !harnessErrored && !deliverableEmpty && !signal?.aborted;
                 this.credentials.noteTryServed(refusal, telemetry.outputMarkers, delivered);
@@ -1617,21 +1630,20 @@ export class Orchestrator {
         // D-16: answer.md persists only the deliverable. A3: an errored attempt
         // with no typed final contributes no answer material (acceptedTryOutput).
         const unwrapped = unwrapWorkReportEnvelope(acceptedTryOutput(answer, harnessErrored), workReportMode, { sideToolReport: telemetry.sideToolWorkReport ?? undefined });
-        const redacted = redactSecrets(unwrapped.deliverable);
-        // INV-062: the (already redacted) answer is kept whatever the patch holds.
-        const answerText = redacted.trim().length > 0 ? redacted : undefined;
+        const answerText = unwrapped.deliverable.trim().length > 0 ? unwrapped.deliverable : undefined;
         if (directory)
             await captureDirectory();
         const captured = directory
             ? { diff: "", captureRefusal: directoryCapture.refusal }
             : await secretDiff.captureCandidateWorkspace({
-                ...{ wsm, envelope, inPlace: inPlaceEnvelope, projectRoot: store.repoRoot },
-                ...{ answerText, answerMatches: answer.secretLikeMatches() },
+                ...{ wsm, envelope, inPlace: inPlaceEnvelope, contract },
                 holder: { runId: paths.runId, runDir: paths.root },
                 incompleteCapture: currentCapture?.captureIncomplete ? currentCapture : undefined,
             });
-        const { diff, captureRefusal } = captured;
-        const deliverableEvidence = diff.trim().length > 0 || Boolean(answerText) || directoryHasOutput(directoryCapture.files);
+        const { captureRefusal } = captured;
+        const deliverableEvidence = secretDiff.hasCandidateChanges(captured) ||
+            Boolean(answerText) ||
+            directoryHasOutput(directoryCapture.files);
         // Cancelled attempts skip gates: running a 600s-per-gate suite delays the ack
         // and burns compute on a result nobody will adopt. Diff/attempt.yaml
         // still land, so partial work stays inspectable.
@@ -1694,7 +1706,7 @@ export class Orchestrator {
         const errored = harnessErrored || webBlocked || captureRefusal !== undefined;
         const resumable = await continuity.finish({
             runSpec: spec,
-            errored,
+            errored: harnessErrored || webBlocked, // a capture refusal is packaging, not work
             nonSuccess: !gatesPassed(gates),
             aborted: signal?.aborted === true,
             cancelReason: typeof signal?.reason === "string" ? signal.reason : null,
@@ -1716,14 +1728,14 @@ export class Orchestrator {
             aborted: signal?.aborted === true,
             authMode: telemetry.authMode,
         });
-        const producedFiles = AC.withAttemptFailureCost(() => writeCandidateAttemptArtifacts({
+        const { produced: producedFiles, omitted: producedOmitted } = AC.withAttemptFailureCost(() => writeCandidateAttemptArtifacts({
             store,
             attemptDir,
             worktreePath: envelope.worktree_path,
             artifactRelativeDir,
-            ...{ diff, persistedDiff: captured.persistedDiff },
+            ...secretDiff.attemptPatchInput(captured),
             persistPatch: !directory && captureRefusal === undefined && isMutatingAccess(access),
-            persistProducedMedia: !directory && captureRefusal === undefined,
+            persistProducedMedia: !directory,
             answerText,
             record: {
                 attempt_id: attemptId,
@@ -1773,6 +1785,7 @@ export class Orchestrator {
             reviewCwd: envelope.worktree_path,
             baseSha: envelope.base_sha ?? undefined,
             producedFiles,
+            ...(producedOmitted.length ? { producedOmitted } : {}),
             gates,
             cost,
             errored,
@@ -1787,7 +1800,7 @@ export class Orchestrator {
                     : {}),
             outcomeClass: finalized.outcomeClass,
             applied,
-            ...continuity.terminalFacts(resumable),
+            ...continuity.terminalFacts(resumable, captureRefusal !== undefined),
         };
     }
     continuityDeps(adapter, routed, contract, attemptId, paths, runInput, log, lane) {
@@ -1803,9 +1816,11 @@ export class Orchestrator {
             workspace: continuityWorkspace(lane.envelope, cwd),
             workOrder: lane.workOrder,
             firstPrompt: lane.firstPrompt,
+            later: lane.later,
+            explicitModel: lane.explicitModel,
             registry: this.config(repoRoot)?.global.credential_profiles ?? [],
             policy: this.credentials.profilePolicy(repoRoot, adapter.id),
-            snapshots: this.deps.quotaSnapshots?.() ?? [],
+            quotaSnapshots: () => this.deps.quotaSnapshots?.() ?? [],
             retryPolicy: transientRetryPolicy(this.config(repoRoot)),
             pinned: runInput?.credentialProfileId != null, // D-U6: a pin never rotates
             defaultRouteWasVendorNative: routed.authRouteEstimate === "local_session",
@@ -1860,7 +1875,9 @@ export class Orchestrator {
         // repoRoot. Both the WorkspaceManager and the git boundary resolve against
         // this SINGLE root.
         const execRoot = this.execRootOf(input);
-        const wsm = new WorkspaceManager(execRoot);
+        const projectRoot = input.repoRoot;
+        const wsm = new WorkspaceManager(execRoot, { projectRoot });
+        const anchors = secretDiff.revertAnchors(execRoot, projectRoot);
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
         // Write modes need a git boundary for worktree isolation and honest diffs.
@@ -1908,7 +1925,7 @@ export class Orchestrator {
         const reviewDir = join(paths.root, "review-evidence");
         if (contract.review_requested !== false)
             writeEvidencePacket(reviewDir, {
-                userIntent: redactSecrets(input.prompt),
+                userIntent: input.prompt,
                 diff: "(per-candidate diffs are supplied to reviewers individually)\n",
                 tests: renderTestsEvidence(contract),
             });
@@ -2125,7 +2142,7 @@ export class Orchestrator {
                             harness: adapter.id,
                             profileId: input.credentialProfileId ?? null,
                             priorPrompt: input.prompt,
-                            priorOutput: run.answerText ?? run.persistedDiff ?? run.diff ?? "",
+                            priorOutput: run.answerText ?? run.diff ?? "",
                         }));
                         // Reserve the continuation lease BEFORE any disclosure: a denied lease
                         // must never emit run.continuation (which claims a continuation
@@ -2287,6 +2304,7 @@ export class Orchestrator {
                         requestedSingleCandidate &&
                         runs[0]?.reviewCwd === execRoot,
                     execRoot,
+                    projectRoot: input.repoRoot,
                     preTurnSha,
                     postTurnSha: earlyPostTurnSha,
                 }
@@ -2321,6 +2339,7 @@ export class Orchestrator {
             await disposeReviewEnvelopes();
             const failedOutput = {
                 ...{ store, log, paths, execRoot, preTurnSha, taskId, mode, run: failedDelegation },
+                projectRoot: input.repoRoot,
                 live: input.inPlace === true &&
                     input.workspaceKind !== "directory" &&
                     failedDelegation.reviewCwd === execRoot,
@@ -2376,7 +2395,7 @@ export class Orchestrator {
         // real verification). Compute the reviewable set first and emit a typed
         // `review.skipped` when nothing is reviewable, so every start has a matching
         // terminal and the no-diff path records `not_run` consistently.
-        const reviewableRuns = workingRuns.filter((r) => r.files ? r.files.noChanges !== true : r.diff.trim().length > 0);
+        const reviewableRuns = workingRuns.filter((r) => secretDiff.hasCandidateChanges(r));
         const configuredFamilies = new Set(reviewers.map((r) => r.providerFamily)).size;
         if (reviewableRuns.length === 0 || reviewers.length === 0) {
             log.emit("review.skipped", {
@@ -2407,18 +2426,15 @@ export class Orchestrator {
             evidences = await this.reviewRuns(workingRuns, reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input), false, input.runScopeMarker);
         }
         catch (err) {
-            // Review preflight/evidence failures end TERMINALLY with artifacts —
-            // never as an escaped throw that orphans the run dir.
-            return failAfterCandidates(raceTerminal, "review", err);
-        }
-        finally {
-            // Review preflight failures must not leak candidate worktrees.
+            // Review failures end TERMINALLY with artifacts and leak no candidate worktree.
             await disposeReviewEnvelopes();
+            return failAfterCandidates(raceTerminal, "review", err);
         }
         if (input.signal?.aborted) {
+            await disposeReviewEnvelopes();
             return cancelledRaceResult();
         }
-        // Synthesis: if worthwhile, run a synthesizer as a NEW, re-checked candidate.
+        // Synthesis, if worthwhile: a NEW re-checked candidate; workspaces stay until it ends (#535).
         const synth = mutatingRun
             ? decideSynthesis(evidences, input.synthesis ?? "auto")
             : {
@@ -2426,86 +2442,95 @@ export class Orchestrator {
                 reason: "readonly access has no write-backed synthesis lifecycle",
                 sources: evidences.map((evidence) => evidence.attemptId),
             };
-        store.writeYaml(join(paths.arbitrationDir, "synthesis.yaml"), synth);
-        log.emit("synthesis.started", { synthesize: synth.synthesize, reason: synth.reason });
-        if (synth.synthesize && !budgetStopped) {
-            const synthRouted = adapters[0];
-            const lease = ledger.reserve({
-                taskId,
-                attemptId: "synth",
-                intent: "synthesize",
-                harnessId: synthRouted.adapter.id,
-                cost: processingAttemptCostEvidence(synthRouted.adapter.id, "synth", this.reservationEstimateUsd(input), this.routeBillingKnowledge(input, synthRouted.adapter.id, synthRouted), synthRouted.processing),
-            });
-            if (lease.granted) {
-                let envelope;
-                const synthTried = new PoolAttemptEvidence(synthRouted.adapter.id, "synth");
-                try {
-                    const plan = buildSynthesisPlan(evidences);
-                    const synthesisInput = buildFileBackedSynthesisInput({
-                        instructions: plan.instructions,
-                        findings: plan.fixFindings,
-                        candidates: workingRuns,
-                    });
-                    const synthAdapter = synthRouted.adapter;
-                    // Disclose against the PER-ROUTE policy (per-harness web defaults
-                    // included), exactly like the candidate slots do.
-                    const synthKnobs = this.routeSpecKnobs(synthRouted, contract, undefined, input.effort);
-                    const effectiveWeb = this.discloseWebUpgrade(log, synthRouted, synthKnobs.webPolicy, "synth");
-                    envelope = await wsm.create({
-                        taskId,
-                        attemptId: "synth",
-                        baseRef: contract.repo.base_ref,
-                        dirtyPolicy: "snapshot",
-                        accessProfile: candidateAccess,
-                        workspaceKind: input.workspaceKind,
-                        scopePaths: input.scopePaths,
-                    });
-                    const synthHome = this.harnessHomeFor(wsm, envelope, synthRouted, input);
-                    const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthesisInput.prompt, store, paths, wsm, ledger, {
-                        lease: lease.lease,
-                        onDenied: (denial) => {
-                            budgetStopped = true;
-                            budgetDenial ??= denial;
-                        },
-                    }, candidateAccess, input.onHarnessEvent, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content, undefined, synthHome, undefined, synthTried);
-                    ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
-                    reviewEnvelopes.push(envelope);
-                    envelope = undefined;
-                    // D-16 r8: only a WORKING synth is reviewed/adopted (same veto owner
-                    // as the race lane); `runs` still records it for telemetry.
-                    runs.push(run);
+        try {
+            store.writeYaml(join(paths.arbitrationDir, "synthesis.yaml"), synth);
+            log.emit("synthesis.started", { synthesize: synth.synthesize, reason: synth.reason });
+            if (synth.synthesize && !budgetStopped) {
+                const synthRouted = adapters[0];
+                const lease = ledger.reserve({
+                    taskId,
+                    attemptId: "synth",
+                    intent: "synthesize",
+                    harnessId: synthRouted.adapter.id,
+                    cost: processingAttemptCostEvidence(synthRouted.adapter.id, "synth", this.reservationEstimateUsd(input), this.routeBillingKnowledge(input, synthRouted.adapter.id, synthRouted), synthRouted.processing),
+                });
+                if (lease.granted) {
+                    let envelope;
+                    const synthTried = new PoolAttemptEvidence(synthRouted.adapter.id, "synth");
+                    let disposeSaved;
                     try {
-                        if (isWorkingCandidate(run)) {
-                            const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input), false, input.runScopeMarker);
-                            evidences.push(...synthEvidence);
-                            workingRuns.push(run);
+                        const plan = buildSynthesisPlan(evidences);
+                        const saved = await savedForSynthesis(workingRuns, paths.root, contract.repo.root);
+                        disposeSaved = saved.dispose;
+                        const synthesisInput = buildFileBackedSynthesisInput({
+                            instructions: plan.instructions,
+                            findings: plan.fixFindings,
+                            candidates: saved.candidates,
+                        });
+                        const synthAdapter = synthRouted.adapter;
+                        // Disclose against the PER-ROUTE policy (per-harness web defaults
+                        // included), exactly like the candidate slots do.
+                        const synthKnobs = this.routeSpecKnobs(synthRouted, contract, undefined, input.effort);
+                        const effectiveWeb = this.discloseWebUpgrade(log, synthRouted, synthKnobs.webPolicy, "synth");
+                        envelope = await wsm.create({
+                            taskId,
+                            attemptId: "synth",
+                            baseRef: contract.repo.base_ref,
+                            dirtyPolicy: "snapshot",
+                            accessProfile: candidateAccess,
+                            workspaceKind: input.workspaceKind,
+                            scopePaths: input.scopePaths,
+                        });
+                        const synthHome = this.harnessHomeFor(wsm, envelope, synthRouted, input);
+                        const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthesisInput.prompt, store, paths, wsm, ledger, {
+                            lease: lease.lease,
+                            onDenied: (denial) => {
+                                budgetStopped = true;
+                                budgetDenial ??= denial;
+                            },
+                        }, candidateAccess, input.onHarnessEvent, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content, undefined, synthHome, undefined, synthTried);
+                        ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
+                        reviewEnvelopes.push(envelope);
+                        envelope = undefined;
+                        // D-16 r8: only a WORKING synth is reviewed/adopted (same veto owner
+                        // as the race lane); `runs` still records it for telemetry.
+                        runs.push(run);
+                        try {
+                            if (isWorkingCandidate(run)) {
+                                const synthEvidence = await this.reviewRuns([run], reviewers, reviewVerified, reviewDir, input.repoRoot, contract, store, paths, log, ledger, taskId, input.signal, this.reservationEstimateUsd(input), false, input.runScopeMarker);
+                                evidences.push(...synthEvidence);
+                                workingRuns.push(run);
+                            }
+                            if (input.signal?.aborted) {
+                                return cancelledResult(log, runId, taskId, mode, paths.root, candidateStatuses(runs), raceTerminal.writeTelemetry, ledger.spend(), input.signal, store, undefined, undefined, history());
+                            }
                         }
-                        if (input.signal?.aborted) {
-                            return cancelledResult(log, runId, taskId, mode, paths.root, candidateStatuses(runs), raceTerminal.writeTelemetry, ledger.spend(), input.signal, store, undefined, undefined, history());
+                        finally {
+                            await disposeReviewEnvelopes();
                         }
                     }
+                    catch (err) {
+                        // Not yet in `runs`: the run goes on, so its tries' accounts stay in the history.
+                        if (!runs.some((run) => run.attemptId === "synth"))
+                            thrownSynthesis = { poolAttempts: synthTried.snapshot() };
+                        ledger.settle(lease.lease?.lease_id ?? "", AC.attemptFailureCost(err, "synthesis-error").settlement);
+                        log.emit("harness.completed", {
+                            attempt_id: "synth",
+                            status: "failed",
+                            error: safeErrorMessage(err),
+                        });
+                    }
                     finally {
-                        await disposeReviewEnvelopes();
+                        await disposeSaved?.();
+                        if (envelope)
+                            await wsm.dispose(envelope);
                     }
                 }
-                catch (err) {
-                    // Not yet in `runs`: the run goes on, so its tries' accounts stay in the history.
-                    if (!runs.some((run) => run.attemptId === "synth"))
-                        thrownSynthesis = { poolAttempts: synthTried.snapshot() };
-                    ledger.settle(lease.lease?.lease_id ?? "", AC.attemptFailureCost(err, "synthesis-error").settlement);
-                    log.emit("harness.completed", {
-                        attempt_id: "synth",
-                        status: "failed",
-                        error: safeErrorMessage(err),
-                    });
-                }
-                finally {
-                    if (envelope)
-                        await wsm.dispose(envelope);
-                }
             }
         }
+        finally {
+            await disposeReviewEnvelopes();
+        }
         if (input.signal?.aborted) {
             return cancelledRaceResult();
         }
@@ -2578,7 +2603,7 @@ export class Orchestrator {
             winnerRun &&
             !inPlaceWinner &&
             !deferredRaceVerify &&
-            (winnerRun.files ? winnerRun.files.noChanges !== true : winnerRun.diff.trim().length > 0) &&
+            secretDiff.hasCandidateChanges(winnerRun) &&
             facts.lifecycle === "succeeded" &&
             facts.review !== "blocked" &&
             !input.signal?.aborted) {
@@ -2667,8 +2692,8 @@ export class Orchestrator {
             else if (mutatingRun) {
                 const savedPatch = secretDiff.persistFinalPatch(store, paths.finalDir, winnerRun);
                 const patchSha256 = savedPatch.patchSha256;
-                const wstats = diffStats(winnerRun.diff);
-                const hasDiff = winnerRun.diff.trim().length > 0;
+                const wstats = secretDiff.resultDiffStats(winnerRun);
+                const hasDiff = secretDiff.hasCandidateChanges(winnerRun);
                 const blockers = winnerEvidence
                     ? winnerEvidence.findings.filter((f) => isBlocking(f)).length
                     : 0;
@@ -2693,7 +2718,7 @@ export class Orchestrator {
                     }
                     else if (adoptable) {
                         // Protected apply preserves the live tree or reports tree_mutated.
-                        const applied = await verifyAndDeliver(execRoot, winnerRun.diff, { mode: "apply", protectedApply: true }, gateSpecsFromContract(contract, input.runScopeMarker), (freshVerify) => {
+                        const applied = await verifyAndDeliver(execRoot, secretDiff.deliverableOf(winnerRun), { mode: "apply", protectedApply: true, projectRoot, owner: paths.root }, gateSpecsFromContract(contract, input.runScopeMarker), (freshVerify) => {
                             finalVerify = freshVerify;
                             return finalVerifyBlocks(freshVerify)
                                 ? (freshVerify.reason ?? "final verify failed before race adoption")
@@ -2710,17 +2735,15 @@ export class Orchestrator {
                                 patch_sha256: patchSha256,
                                 winner: winnerRun.attemptId,
                             });
-                            try {
-                                postTurnSha = await snapshotTree(execRoot);
-                            }
-                            catch {
-                                postTurnSha = null;
-                            }
-                            revertAnchorId = createRevertAnchorFromPatchOrNull(execRoot, winnerRun.diff);
+                            postTurnSha = await snapshotTree(execRoot).catch(() => null);
+                            revertAnchorId = await anchors.after(winnerRun, applied);
                         }
                         else {
-                            adopted = false;
-                            applyState = "not_applied";
+                            // A write that could not be taken back stays live and revertable (INV-114).
+                            adopted = applied.treeMutated === true;
+                            applyState = adopted ? "applied_review_blocked" : "not_applied";
+                            if (adopted)
+                                revertAnchorId = await anchors.after(winnerRun, applied);
                             deliveryFailureReason = applied.detail ?? "race adoption delivery was refused";
                             facts = { ...facts, checks: "failed", reason: "checks_failed" };
                             if (finalVerifyBlocks(finalVerify))
@@ -2743,7 +2766,7 @@ export class Orchestrator {
                     deliveryReceiptPath: raceDeliveryReceipt || directoryDeliveryReceipt ? "final/delivery_receipt.yaml" : null,
                 });
                 if (inPlaceWinner && requestedSingleCandidate && adopted === true) {
-                    revertAnchorId = await createRevertAnchorOrNull(execRoot, preTurnSha, postTurnSha);
+                    revertAnchorId = await anchors.turn(preTurnSha, postTurnSha);
                 }
                 store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
                     id: newId("wp"),
@@ -2779,7 +2802,7 @@ export class Orchestrator {
                     },
                 });
             }
-            store.writeText(join(paths.finalDir, "summary.md"), withPoolAttempts(renderSummary(runId, mode, { ...result.decision, facts }, evidences, synth.reason, actualReviewVerified, secretDiff.secretLikeSummaryLine(winnerRun.secretLike)), racePool()));
+            store.writeText(join(paths.finalDir, "summary.md"), withPoolAttempts(renderSummary(runId, mode, { ...result.decision, facts }, evidences, synth.reason, actualReviewVerified, secretDiff.resultSummaryLines(winnerRun)), racePool()));
             // summary.md is a DIAGNOSTIC artifact only (V8/PLAN addendum 2): it no
             // longer carries primary-output authority. A clean applyable success or a
             // winner answer still marks it ready for legacy INV-116 ordering; any
@@ -3033,7 +3056,8 @@ export class Orchestrator {
         // local `execRoot`; this path previously ensured the boundary on repoRoot,
         // which for an isolated thread is the project, not the mutated worktree.
         const execRoot = this.execRootOf(input);
-        const wsm = new WorkspaceManager(execRoot);
+        const wsm = new WorkspaceManager(execRoot, { projectRoot: input.repoRoot });
+        const anchors = secretDiff.revertAnchors(execRoot, input.repoRoot);
         const readiness = new ReadinessLedger();
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         // Legacy Git envelopes need their boundary; explicit directory execution
@@ -3063,7 +3087,7 @@ export class Orchestrator {
         const reviewDir = join(paths.root, "review-evidence");
         if (contract.review_requested !== false)
             writeEvidencePacket(reviewDir, {
-                userIntent: redactSecrets(input.prompt),
+                userIntent: input.prompt,
                 diff: "(per-attempt)\n",
                 tests: renderTestsEvidence(contract),
             });
@@ -3257,7 +3281,7 @@ export class Orchestrator {
                             exhausted = true;
                             processingBudgetDenial ??= denial;
                         },
-                    }, convergenceAccess, input.onHarnessEvent, input.signal, undefined, input.effort, "repair", log, effectiveWeb, interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive), (streamedUsd) => {
+                    }, convergenceAccess, input.onHarnessEvent, input.signal, undefined, input.effort, this.requestRequirements.convergenceIntent(routed, this.candidateIntent(input)), log, effectiveWeb, interactionChannelFor(input, log, runId, taskId, attemptId, adapter.id, routed.supportsInteractive), (streamedUsd) => {
                         ledger.updateHold(lease.lease?.lease_id ?? "", streamedUsd);
                         return ledger.tier() === "hard";
                     }, input, true, // convergence runs one candidate: live deltas on (W-C4)
@@ -3350,6 +3374,7 @@ export class Orchestrator {
                     const failure = delegateFailure.candidateFailureTerminal(run, "convergence");
                     await delegateFailure.persistFailedCandidateOutput({
                         ...{ store, log, paths, execRoot, preTurnSha, taskId, mode, run },
+                        projectRoot: input.repoRoot,
                         live: input.inPlace === true && input.workspaceKind !== "directory",
                         kind: input.create === true ? "new_repo" : "patch",
                         attempts: attempt,
@@ -3398,7 +3423,8 @@ export class Orchestrator {
                         actualReviewVerified = evidence.reviewVerified ?? false;
                         lastDiffStable = run.files
                             ? await directoryCandidateStable(wsm, envelope, run.files)
-                            : sha256(await wsm.diff(envelope)) === sha256(run.diff);
+                            : secretDiff.captureIdentity(await wsm.captureDiff(envelope, paths.root)) ===
+                                secretDiff.captureIdentity(run);
                         const evaluated = evaluateConvergence({
                             predicate: contract.convergence,
                             gates: evidence.gates,
@@ -3448,7 +3474,7 @@ export class Orchestrator {
                     ? run.files.manifestSha256
                     : input.workspaceKind === "directory"
                         ? null
-                        : sha256(run.diff);
+                        : secretDiff.captureIdentity(run);
                 if (requiredGateFailing && diffHash !== null && diffHash === lastFailingGateDiffHash) {
                     sameFailingGateDiffs += 1;
                 }
@@ -3461,7 +3487,7 @@ export class Orchestrator {
                     const failedGateIds = run.gates
                         .filter((g) => g.required && g.status !== "passed")
                         .map((g) => g.id);
-                    stuckNoProgressReason = `same candidate diff (${diffHash}) produced ${sameFailingGateDiffs} consecutive failing required gate round(s): ${failedGateIds.join(", ") || "unknown gate"}`;
+                    stuckNoProgressReason = `same candidate result (${diffHash}) produced ${sameFailingGateDiffs} consecutive failing required gate round(s): ${failedGateIds.join(", ") || "unknown gate"}`;
                     log.emit("finding.revalidated", {
                         attempt_id: attemptId,
                         stuck_no_progress: true,
@@ -3599,7 +3625,7 @@ export class Orchestrator {
         let convFinalVerify = null;
         if (input.inPlace !== true &&
             lastRun &&
-            (lastRun.files ? lastRun.files.noChanges !== true : lastRun.diff.trim().length > 0) &&
+            secretDiff.hasCandidateChanges(lastRun) &&
             facts.lifecycle === "succeeded" &&
             facts.review !== "blocked" &&
             !input.signal?.aborted) {
@@ -3635,6 +3661,7 @@ export class Orchestrator {
                 // An incomplete capture has no exact patch: never publish an empty one.
                 await delegateFailure.persistFailedCandidateOutput({
                     ...{ store, log, paths, execRoot, preTurnSha, taskId, mode, facts, run: lastRun },
+                    projectRoot: input.repoRoot,
                     live: input.inPlace === true && input.workspaceKind !== "directory",
                     kind: input.create === true ? "new_repo" : "patch",
                     attempts: attempt,
@@ -3646,16 +3673,14 @@ export class Orchestrator {
                 // Honest apply-state (parity with runRace single-candidate in-place): a
                 // convergence run with inPlace mutated the live tree directly across its
                 // attempts, so it is "applied" even when review blocked (Revert offered).
-                const convHasDiff = lastRun.diff.trim().length > 0;
+                const convHasDiff = secretDiff.hasCandidateChanges(lastRun);
                 const convAdopted = input.inPlace === true && convHasDiff ? true : null;
                 const convApplyState = convAdopted === true
                     ? convAdoptable
                         ? "applied"
                         : "applied_review_blocked"
                     : "not_applied";
-                const revertAnchorId = convAdopted === true
-                    ? await createRevertAnchorOrNull(execRoot, preTurnSha, lastPostTurnSha)
-                    : null;
+                const revertAnchorId = convAdopted === true ? await anchors.turn(preTurnSha, lastPostTurnSha) : null;
                 store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
                     id: newId("wp"),
                     kind: "patch",
@@ -3679,12 +3704,12 @@ export class Orchestrator {
                     },
                 });
             }
-            // INV-062: the answer is kept for every convergence result, patch or files.
+            // The exact answer is kept for every convergence result, patch or files.
             if (lastRun.answerText) {
                 store.writeText(join(paths.finalDir, "answer.md"), lastRun.answerText);
                 log.emit("output.ready", { kind: "answer", path: "final/answer.md" });
             }
-            store.writeText(join(paths.finalDir, "summary.md"), `${withPoolAttempts(`# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}${secretDiff.summaryDisclosure(lastRun.secretLike)}`, convPool)}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `${withPoolAttempts(`# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}${secretDiff.resultSummaryDisclosure(lastRun)}`, convPool)}\n`);
             // Lifecycle invariant (all modes): output.ready precedes the terminal
             // event so a client that applied the terminal event has the output.
             log.emit("output.ready", {
@@ -3716,6 +3741,8 @@ export class Orchestrator {
                 code: convBudgetMapping?.code ?? convDeclared?.code ?? null,
                 resetsAt: convDeclared?.resetsAt ?? null,
                 requestRefusal: convDeclared?.requestRefusal,
+                quotaRefusal: convDeclared?.quotaRefusal,
+                rawContextShortfall: convDeclared?.rawContextShortfall,
                 harnessId: lastRun?.harnessId,
                 attemptId: lastRun?.attemptId,
                 runDir: paths.root,
@@ -4081,7 +4108,8 @@ export class Orchestrator {
                 }
                 const text = outcome.text ?? "(no output)";
                 plans.push({ id: outcome.harnessId, text });
-                store.writeText(join(paths.root, "plans", `${outcome.harnessId}.md`), redactSecrets(text) + "\n");
+                // The planner's own saved copy keeps its exact text (INV-146).
+                store.writeText(join(paths.root, "plans", `${outcome.harnessId}.md`), text + "\n");
                 // Solo planning (D31): the FIRST successful planner is the plan; later
                 // pool members are a sequential fallback chain (ask parity), not
                 // parallel co-authors. Council re-enables the multi-draft round.
@@ -4387,11 +4415,8 @@ export class Orchestrator {
         // carries the denial reason so a refusal discloses run.continuation.denied.
         onLaunch) => {
             const adapter = routed.adapter;
-            const attemptId = continuationPointer
-                ? `a${String(idx + 1).padStart(2, "0")}-cont`
-                : modelOverride
-                    ? `a${String(idx + 1).padStart(2, "0")}-fb`
-                    : `a${String(idx + 1).padStart(2, "0")}`;
+            const suffix = continuationPointer ? "-cont" : modelOverride ? "-fb" : "";
+            const attemptId = `a${String(idx + 1).padStart(2, "0")}${suffix}`;
             const budgetSignalState = { quotaPressureDisclosed: false };
             const lease = ledger.reserve({
                 taskId,
@@ -4490,7 +4515,7 @@ export class Orchestrator {
                 const readonlyWorkEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(reportInteraction));
                 const readonlyWorkMode = applyWorkEnvelope(spec, readonlyWorkEnvelope);
                 const attemptEventsPath = join(paths.attemptsDir, attemptId, "events.jsonl");
-                const answer = new secretDiff.CountedAnswerAssembly();
+                const answer = new AnswerAssembly();
                 const telemetry = createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb, [], 
                 // Requested-model capture so ask/audit route receipts detect a silent
                 // model downgrade (typed model_mismatch), not just agent runs.
@@ -4555,6 +4580,8 @@ export class Orchestrator {
                 workOrder: input.prompt,
                 firstPrompt: spec.prompt,
                 poolEvidence: tried,
+                later: continuationPointer ? "checkpoint" : "fallback",
+                explicitModel: modelOverride !== undefined,
             }), { spec, continuation: input.continuation, store, telemetry }));
             const onAbort = () => void adapter.cancel?.(activeSessionId)?.catch(() => { });
             if (input.signal) {
@@ -4574,7 +4601,7 @@ export class Orchestrator {
                     // A3 per-try isolation (candidate-lane parity): a failed try's output,
                     // progress markers and model proof never carry into the next try.
                     if (nativeTry > 0) {
-                        answer = new secretDiff.CountedAnswerAssembly();
+                        answer = new AnswerAssembly();
                         beginNativeRetry(telemetry);
                     }
                     const runSpec = nativeTry === 0
@@ -4611,30 +4638,33 @@ export class Orchestrator {
                             },
                             isSuspended: () => (reportInteraction?.pendingCount?.() ?? 0) > 0,
                             suspensionVersion: () => reportInteraction?.suspensionVersion?.() ?? 0,
+                            stopSignal: input.signal, // after Stop: drained events are recorded, never used
                         });
                         for await (const ev of watchedReport) {
-                            const safeEv = redactHarnessEvent(ev);
-                            if (safeEv.payload?.["buffered"] !== true)
-                                safeInvoke(input.onHarnessEvent, safeEv);
-                            observeAuthSwitch(log, adapter.id, attemptId, safeEv);
-                            log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, safeEv), safeEv.payload?.["buffered"] !== true);
-                            appendLine(attemptEventsPath, JSON.stringify(safeEv));
+                            // A read after Stop is stored evidence only; a callback may itself press Stop.
+                            const shown = !input.signal?.aborted && ev.payload?.["buffered"] !== true;
+                            if (shown)
+                                safeInvoke(input.onHarnessEvent, ev);
+                            observeAuthSwitch(log, adapter.id, attemptId, ev);
+                            const live = shown && !input.signal?.aborted; // the callback may have pressed Stop
+                            log.emit("harness.event", harnessEventPayload(adapter.id, attemptId, ev), live);
+                            appendHarnessEvent(attemptEventsPath, ev);
                             if (input.signal?.aborted)
-                                break;
-                            observeAttemptTelemetry(telemetry, safeEv);
-                            const mismatch = continuity.observe(safeEv, runSpec, telemetry.outputMarkers);
+                                continue;
+                            observeAttemptTelemetry(telemetry, ev);
+                            const mismatch = continuity.observe(ev, runSpec, telemetry.outputMarkers);
                             if (mismatch) {
                                 harnessError = mismatch;
                                 break;
                             }
                             if (laneRun && continuity.mayPublishSession)
-                                observeNativeSessionEvent(input, adapter.id, safeEv);
-                            emitPlanProgress((t, p) => log.emit(t, p), adapter.id, attemptId, safeEv);
+                                observeNativeSessionEvent(input, adapter.id, ev);
+                            emitPlanProgress((t, p) => log.emit(t, p), adapter.id, attemptId, ev);
                             // read-only routes burn quota too (the orchestrate PLANNER is
                             // the loudest) — same single owner as the agent loop.
-                            observeBudgetSignals(ledger, log, adapter.id, attemptId, safeEv, budgetSignalState);
-                            this.deps.quotaEventSink?.(adapter.id, safeEv);
-                            const spend = observeReadonlySpend(safeEv, (t, p) => log.emit(t, p), adapter.id, attemptId);
+                            observeBudgetSignals(ledger, log, adapter.id, attemptId, ev, budgetSignalState);
+                            this.deps.quotaEventSink?.(adapter.id, ev);
+                            const spend = observeReadonlySpend(ev, (t, p) => log.emit(t, p), adapter.id, attemptId);
                             cost += spend.costUsd;
                             costEstimated ||= spend.estimated;
                             const streamDenial = updateProcessingStreamHold(runSpec, telemetry.usageCost, ledger, lease.lease.lease_id, adapter.id, attemptId);
@@ -4647,17 +4677,14 @@ export class Orchestrator {
                                 break;
                             }
                             // A TYPED final message wins verbatim over joined narration.
-                            answer.observeCounted(ev, safeEv);
-                            if (safeEv.type === "error")
-                                harnessError = safeEv.error
-                                    ? redactSecrets(safeEv.error)
-                                    : "harness emitted an error";
+                            answer.observe(ev);
+                            if (ev.type === "error")
+                                harnessError = ev.error ? redactSecrets(ev.error) : "harness emitted an error";
                         }
                     }
                     catch (err) {
                         harnessError = safeErrorMessage(err);
-                        if (err instanceof ProcessingBudgetAdmissionError ||
-                            err instanceof RoutingPreflightError) {
+                        if (isDispatchRefusal(err)) {
                             processingRefusal = err;
                             break;
                         }
@@ -4732,7 +4759,7 @@ export class Orchestrator {
             // Trim symmetrically with the plan path: a whitespace-only answer is not
             // a delivered report (the final-artifact wrapper heading would otherwise
             // make it read as present content by construction).
-            const report = redactSecrets(roUnwrapped.deliverable).trim();
+            const report = roUnwrapped.deliverable.trim();
             const unrecovered = unrecoveredToolErrors(telemetry);
             const webBlocked = webUnsatisfied(telemetry);
             const reportPresent = report.length > 0;
@@ -4818,7 +4845,6 @@ export class Orchestrator {
                 harnessId: adapter.id,
                 status: scoutInterrupted ? "failed" : "success",
                 report: report || "(no output)",
-                answerMatches: answer.secretLikeMatches(),
                 error: scoutInterrupted ? "context capacity exhausted before the scout completed" : null,
                 telemetry,
                 ...(scoutInterrupted ? { interrupted: true } : {}),
@@ -4985,7 +5011,8 @@ export class Orchestrator {
             harnessId: a.harnessId,
             status: a.status,
         }));
-        const cancelledTerminal = () => cancelledResult(log, runId, taskId, opts.mode, paths.root, candidateSummaries, () => this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null), ledger.spend(), input.signal, store, undefined, resumableOf(attempts, "cancelled"), attempts);
+        const carried = () => (opts.deepScan ? attempts : carryingAttempts(attempts, paths.root));
+        const cancelledTerminal = () => cancelledResult(log, runId, taskId, opts.mode, paths.root, candidateSummaries, () => this.writeRunTelemetry(store, paths, contract, runId, taskId, opts.mode, attemptTelemetries, null), ledger.spend(), input.signal, store, undefined, resumableOf(carried(), "cancelled"), attempts);
         if (input.signal?.aborted)
             return cancelledTerminal();
         const succeededReadonly = attempts.filter((a) => a.status === "success");
@@ -5007,9 +5034,8 @@ export class Orchestrator {
         // whole decision + reducer spawn lives in deepScanReducer.ts (its owner).
         let deepScanSynthesis = null;
         let reducedReport = null;
-        let answerMatches = succeeded.reduce((sum, a) => sum + (a.answerMatches ?? 0), 0);
         if (opts.deepScan) {
-            ({ deepScanSynthesis, reducedReport, answerMatches } = await resolveDeepScanSynthesis(this.deepScanReducerDeps(input, contract, log), {
+            ({ deepScanSynthesis, reducedReport } = await resolveDeepScanSynthesis(this.deepScanReducerDeps(input, contract, log), {
                 succeeded,
                 adapters,
                 budgetStopped,
@@ -5101,10 +5127,9 @@ export class Orchestrator {
         const harnessLabel = attempts
             .map((a) => `${a.attemptId}:${a.harnessId}:${a.status}`)
             .join(", ");
-        const secretLike = secretDiff.answerSecretLikeFinding(answerMatches);
         // A delivered report that still ends unsuccessfully or blocked keeps it and names every failed try.
         const reportPool = terminalPoolAttempts(terminalFacts, attempts);
-        store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harnesses: ${harnessLabel}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}${secretDiff.summaryDisclosure(secretLike)}\n\n${withPoolAttempts(report, reportPool)}\n`);
+        store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${opts.mode})\n\n- Harnesses: ${harnessLabel}\n- Lifecycle: ${terminalFacts.lifecycle}${terminalFacts.reason ? ` (${terminalFacts.reason})` : ""}\n\n${withPoolAttempts(report, reportPool)}\n`);
         const reportProducerAttemptId = opts.deepScan &&
             deepScanSynthesis?.status === "succeeded" &&
             deepScanSynthesis.reducer_attempt_id
@@ -5121,7 +5146,6 @@ export class Orchestrator {
                 mode: opts.mode,
                 intent: opts.intent,
                 read_only: true,
-                ...(secretLike ? { secret_like: secretLike } : {}),
             },
         });
         log.emit("work_product.emitted", { kind: "report", winner: reportProducerAttemptId });
@@ -5145,7 +5169,7 @@ export class Orchestrator {
                 phase: "executor",
                 pool_attempts: reportPool,
                 failure_ref: "final/failure.yaml",
-                ...resumableTerminal(store, paths, attempts, true),
+                ...resumableTerminal(store, paths, carried(), true),
             });
         }
         else if (workVetoed) {
@@ -5154,7 +5178,7 @@ export class Orchestrator {
                 facts: terminalFacts,
                 reason: terminalFacts.reason,
                 pool_attempts: reportPool,
-                ...resumableTerminal(store, paths, attempts, true),
+                ...resumableTerminal(store, paths, carried(), true),
             });
         }
         else {
@@ -5162,7 +5186,7 @@ export class Orchestrator {
                 lifecycle: terminalFacts.lifecycle,
                 facts: terminalFacts,
                 reason: terminalFacts.reason,
-                ...resumableTerminal(store, paths, attempts),
+                ...resumableTerminal(store, paths, carried()),
             });
         }
         return {
@@ -5174,7 +5198,7 @@ export class Orchestrator {
             facts: terminalFacts,
             winner: null,
             runDir: paths.root,
-            summary: withPoolAttempts(redactSecrets(report).slice(0, 400), reportPool),
+            summary: withPoolAttempts(report.slice(0, 400), reportPool),
             candidates: candidateSummaries,
         };
     }