@claudexor/orchestrator 5.0.2 → 6.0.0

package/dist/orchestrator.js

@@ -7,7 +7,7 @@ import { openRunScopeCustody, scopedRouteContext, scopedSpecEnv, } from "./runSc
 import { delegationBeltFor } from "./delegationBelt.js";
 import { routePromptCacheTtl, withReviewerPromptCacheTtl } from "./prompt-cache-routing.js";
 import { bindProcessingAdmission, processingAttemptCostEvidence, processingAdmissionForLease, updateProcessingStreamHold, } from "./processing-dispatch.js";
-import { cancelledCandidatesResult, emptyCandidateResult, failedCandidatesResult, failAfterCandidates, } from "./candidateTerminals.js";
+import { cancelledCandidatesResult, emptyCandidateResult, erroredWinnerFailure, failedCandidatesResult, failAfterCandidates, convergenceCause, raceStatement, } from "./candidateTerminals.js";
 import { deepScanFailureResult, readOnlyChainFailureResult, } from "./readonlyTerminals.js";
 import { effectiveAuthPreference, observeNativeSessionEvent, resumeSessionForProfile, } from "./credential-profiles.js";
 import { AdmissionProfileProbes, OrchestratorCredentials, reviewerProfileResolver, } from "./orchestrator-credentials.js";
@@ -15,14 +15,14 @@ import { continuityWorkspace, carryingAttempts, resumableOf, resumableTerminal,
 import { openContinuity } from "./continue-from.js";
 import { accountPoolRows } from "./account-pool.js";
 import { PoolAttemptEvidence, terminalPoolAttempts, withPoolAttempts, } from "./pool-attempt-evidence.js";
-import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
+import { pickTelemetry, writeRunTelemetryArtifact, } from "./runTelemetryWriter.js";
 import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
 import { processAttemptUsage } from "./attemptUsage.js";
 import { captureDirectoryCandidate, directoryPreparationNotice, directoryHasOutput, directoryCandidateStable, observeDirectoryPaths, publishDirectoryCandidate, } from "./directoryCandidate.js";
 import { appliedAttemptFacts, assertDelegatedEvidence, isMutatingAccess, outerBoundaryNotice, scopedHarnessHome, selectLaneHome, followSpecHome, } from "./delegatedHome.js";
 import * as AC from "./attemptUsageCost.js";
 import * as custody from "./continuation-custody.js";
-import { candidateCaptureRefusals, candidateCompletion, candidateRoster, candidateStatuses, convergenceOutcomeFacts, isWorkingCandidate, partitionCandidates, toCandidateEvidence, } from "./candidateEvidence.js";
+import { capturedNoGitChangeValue, candidateCaptureRefusals, candidateCompletion, candidateRoster, candidateStatuses, convergenceOutcomeFacts, declaredFailureSpeaks, interruptionOf, isWorkingCandidate, needsPostTurnFence, partitionCandidates, toCandidateEvidence, } from "./candidateEvidence.js";
 import { capabilityIntents } from "@claudexor/gateway";
 import { reviewCandidateRuns, unreviewedCandidateEvidence, evaluateUnreviewedConvergence, } from "./candidateReview.js";
 import { join } from "node:path";
@@ -33,7 +33,7 @@ import { globalConfigDir } from "@claudexor/config";
 import { executionRunConfig } from "./run-defaults.js";
 import { preflightOneShot } from "./one-shot-preflight.js";
 import { prepareRoutedProcessing, processingCostEvidence, prepareReviewerProcessing, } from "./processing-routing.js";
-import { acceptedTryOutput, AccessProfileIncompatibleError, AnswerAssembly, appendHarnessEvent, AuxiliaryWritableRootsUnsupportedError, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, withInactivityWatchdog, } from "@claudexor/core";
+import { acceptedTryOutput, AccessProfileIncompatibleError, AnswerAssembly, appendHarnessEvent, AuxiliaryWritableRootsUnsupportedError, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, ModelSelectionRequiredError, missingRouteModel, withInactivityWatchdog, } from "@claudexor/core";
 import { assertRouteModelsAllowed, isDispatchRefusal, runModelGovernedRoute, } from "./modelGovernance.js";
 import { authModeForCredentialRoute, authModeForPreference, authRouteEvidenceFor, } from "./auth-route-classification.js";
 import { isFullAccess, RequestRequirementsResolver } from "./requestRequirements.js";
@@ -50,21 +50,21 @@ import { cancelledResult, declaredFailure, failTerminally, guardAnnouncedRun, wr
 import { budgetFailureRecord, classifyBudgetFailure } from "./budgetFailure.js";
 import { finalizeStructuredOutput } from "./structuredOutput.js";
 import { prepareRunAdmission } from "./runAdmission.js";
-import { dropDeltaPastBudget, emitPlanProgress, emitTransientExhausted, observeReadonlySpend, recordAdapterThrow, } from "./laneStreamEvents.js";
+import { dropDeltaPastBudget, emitPlanProgress, emitTransientExhausted, observeUsageSpend, recordAdapterThrow, } from "./laneStreamEvents.js";
 import { promptWithEngineConstraints, sleep, harnessEventPayload, safeErrorMessage, renderSummary, observeBudgetSignals, rotateOnStall, recordCleanAttemptMetrics, envInheritance, transientRetryPolicy, reviewerTimeoutMs, harnessInactivityTimeoutMs, observeAuthSwitch, emitPoolDegraded, deliveryRefusalFailure, winnerNeedsHuman, writeRaceDeliveryDecision, } from "./runSupport.js";
 import { candidateStatusInRouteContext, resolveReadOnlyRouteContext, } from "./routeContext.js";
 import { resolveAutoReviewerPanel, resolveExplicitReviewerPanel } from "./reviewerPanel.js";
 import { ensureClaudeBridgeForRun, ensureWriteModeGitBoundary } from "./git-precondition.js";
-import { buildContinuation, } from "./continuity.js";
-import { activePlanPointer, resolveContinuitySummary, workspaceAnchor, } from "./continuity-facts.js";
+import { buildContinuation } from "./continuity.js";
+import { resolveContinuitySummary, threadContinuityRequest } from "./continuity-facts.js";
 import { runDiffReview } from "./diffReview.js";
 import { rawScoutBundle, resolveDeepScanSynthesis, } from "./deepScanReducer.js";
 import { createAttemptTelemetry, observeAttemptTelemetry, setAttemptOutcome, telemetrySummary, toolWarnings, unrecoveredToolErrors, webUnsatisfied, } from "./attemptTelemetry.js";
 import { beginNativeRetry } from "./native-retry-telemetry.js";
 import * as delegateFailure from "./delegationFailure.js";
 import * as secretDiff from "./secretDiff.js";
-import { finalizeAttempt, unrecoveredToolErrorFailure, webEvidenceFailure, } from "./attemptFinalize.js";
-import { resolveWorkReportEnvelope, unwrapWorkReportEnvelope, } from "./workReportEnvelope.js";
+import { attemptInterruption, finalizeAttempt, interruptionDetail, unrecoveredToolErrorFailure, webEvidenceFailure, } from "./attemptFinalize.js";
+import { resolveWorkReportEnvelope, unwrapAttemptAnswer, } from "./workReportEnvelope.js";
 import { buildContinuationPacket, decideContinuation, synthesizeContinuationRequest, } from "./continuation.js";
 import { interactionChannelFor } from "./interaction.js";
 import { liveAttempt } from "./live-input.js";
@@ -74,15 +74,17 @@ import { recordProcessingIntent } from "./retry-processing-intent.js";
 import { prepareReviewEvidenceDir, recordReviewEvidenceCleanup } from "./reviewEvidence.js";
 import { savedForSynthesis } from "./savedCandidate.js";
 import { ArtifactStore } from "@claudexor/artifact-store";
-import { buildContextPack, rawContextSizer, writeEvidencePacket } from "@claudexor/context";
-import { WorkspaceManager, captureRawPatchEnvelope, consumeRawPatchEnvelope, snapshotTree, } from "@claudexor/workspace";
+import { buildContextPack, writeEvidencePacket } from "@claudexor/context";
+import { RawAdoption, RawPatchLane, correctableRefusal, endsConvergence } from "./rawPatchLane.js";
+import { runRuntimeRoot } from "./run-runtime-root.js";
+import { WorkspaceManager, rawAwareSnapshot, } from "@claudexor/workspace";
 import { blockedDecisionOverride, finalVerifyBlocks, verifyAndDeliverFiles, verifyAndDeliver, } from "@claudexor/delivery";
 import { HarnessGateway } from "@claudexor/gateway";
-import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, reviewCandidate, runGates, } from "@claudexor/review";
+import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, requireReadingReviewers, reviewCandidate, runGates, } from "@claudexor/review";
 import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
 import { billingKnowledgeForAuthRoute, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, explainRanking, loadHarnessMetrics, promptFingerprint, rankHarnesses, } from "@claudexor/budget";
-import { readTextSafe, hashJson, newId, noProjectRepoRoot, redactSecrets, safeInvoke, userConfigDir, } from "@claudexor/util";
+import { hashJson, newId, noProjectRepoRoot, redactSecrets, safeInvoke, userConfigDir, } from "@claudexor/util";
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
 export class Orchestrator {
@@ -191,7 +193,7 @@ export class Orchestrator {
     }
     async resolveReviewers(run, onIgnoredSetting) {
         if (this.deps.reviewers)
-            return this.deps.reviewers;
+            return requireReadingReviewers(this.deps.reviewers);
         const { repoRoot: cwd, authPreference, signal } = run;
         const panelDeps = {
             cwd,
@@ -269,7 +271,7 @@ export class Orchestrator {
         if (input.mode === "ask" && input.contextMode === "off" && input.repoRoot === NO_PROJECT_ROOT) {
             return new ArtifactStore(input.repoRoot, { claudexorDir: userConfigDir() });
         }
-        return new ArtifactStore(input.repoRoot);
+        return new ArtifactStore(input.repoRoot, { claudexorDir: runRuntimeRoot(input) });
     }
     /** The producing intent a candidate plays (create flag switches it; not hardcoded to implement). */
     candidateIntent(input) {
@@ -425,6 +427,8 @@ export class Orchestrator {
                     throw new AuxiliaryWritableRootsUnsupportedError(detail);
                 if (stage === "access")
                     throw new AccessProfileIncompatibleError(detail);
+                if (stage === "model")
+                    throw new ModelSelectionRequiredError(detail);
                 throw new HarnessUnavailableError(detail);
             }
             dropped.push(detail);
@@ -587,6 +591,13 @@ export class Orchestrator {
                 dropLane(id, "capability", readRefusal);
                 continue;
             }
+            const modelRefusal = status.enabledIntents.includes(intent)
+                ? missingRouteModel(adapter, input.models?.[id] ?? cfgEntry?.default_model)
+                : null;
+            if (modelRefusal) {
+                dropLane(id, "model", modelRefusal);
+                continue;
+            }
             const reason = status.reasons.length > 0 ? `: ${status.reasons.join("; ")}` : "";
             if (status.enabledIntents.includes(intent) && accessSupported) {
                 pool.push({
@@ -594,6 +605,7 @@ export class Orchestrator {
                     adapterAccess: requiredAccess,
                     auxiliaryWritableRoots,
                     webSupport,
+                    accessControl: manifest.capability_profile.access_control,
                     providerFamily: manifest.provider_family,
                     supportsMaxTurns: manifest.capabilities.max_turns,
                     supportsToolLists: manifest.capabilities.tool_lists,
@@ -1136,33 +1148,7 @@ export class Orchestrator {
             return null;
         try {
             const profileId = resolvedProfileId ?? ctx.profileId ?? null;
-            const lane = { harness: harnessId, profileId };
-            const checkpoint = ctx.laneCheckpoints.find((c) => c.harness === harnessId && (c.profileId ?? null) === profileId);
-            const headTurnId = ctx.priorTurns.length
-                ? ctx.priorTurns[ctx.priorTurns.length - 1].id
-                : null;
-            const priorHeadOwner = headTurnId
-                ? ctx.laneCheckpoints.find((c) => c.turnId === headTurnId)
-                : undefined;
-            const priorHeadLane = priorHeadOwner
-                ? { harness: priorHeadOwner.harness, profileId: priorHeadOwner.profileId ?? null }
-                : null;
-            const priorTurns = ctx.priorTurns.map((t) => ({
-                id: t.id,
-                prompt: t.prompt,
-                outputText: t.runId
-                    ? (readTextSafe(join(store.runPaths(t.runId).finalDir, "answer.md")) ?? "")
-                    : "",
-            }));
-            const req = {
-                lane,
-                priorTurns,
-                laneCheckpointTurnId: checkpoint?.turnId ?? null,
-                nativeResumeAvailable,
-                priorHeadLane,
-                activePlan: activePlanPointer(ctx.priorTurns, store),
-                anchor: await workspaceAnchor(repoRoot),
-            };
+            const req = await threadContinuityRequest(ctx, { harness: harnessId, profileId }, nativeResumeAvailable, store, repoRoot);
             // V9c: when the packet would collapse an older prefix, replace the
             // mechanical one-liners with a cached (or freshly summarized) prose
             // summary. Same credential route + scoped lane home a real read-only
@@ -1173,7 +1159,9 @@ export class Orchestrator {
                 threadId: runInput.threadId,
                 projectRoot: runInput.repoRoot,
                 cwd: repoRoot,
+                inputFileDir: paths.contextDir,
                 adapter: this.deps.registry.get(harnessId),
+                model: this.deps.registry.get(harnessId)?.modelRequirement && runInput.models?.[harnessId],
                 credentialProfile: sessionFields.credential_profile,
                 authPreference: sessionFields.auth_preference ?? "auto",
                 laneEnv: scopedSpecEnv(runInput.runScopeMarker, this.laneHomeEnvFor(runInput, harnessId, profileId) ?? {}) ?? {},
@@ -1320,6 +1308,7 @@ export class Orchestrator {
                 : join(envelope.worktree_path, artifactRelativeDir, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR)),
             extra_mcp_servers: delegationBeltFor(runInput, intent, routed, contract.budget.paid_budget),
             cwd: envelope.worktree_path,
+            input_file_dir: paths.contextDir,
             access: routed.adapterAccess,
             // Writable lanes only: routing admitted this list for this exact lane.
             auxiliary_writable_roots: routed.auxiliaryWritableRoots,
@@ -1342,13 +1331,8 @@ export class Orchestrator {
         // #147: bound to the project's context config; each try's dispatch sizes its own
         // packet for THIS request from the catalog read the gate makes for that try.
         const { context } = this.projectConfig(contract.repo.root);
-        const sizeRawContext = rawContextSizer(routed.implementationTransport, envelope, context);
-        let rawContextPacket = null;
-        const dispatch = sizeRawContext
-            ? {
-                rawContext: async (capacity) => (rawContextPacket = await sizeRawContext(capacity)),
-            }
-            : {};
+        const rawLane = new RawPatchLane(routed.implementationTransport, envelope, context);
+        const { dispatch } = rawLane;
         bindProcessingAdmission(spec, ledger, processingLease.lease, adapter.id, attemptId, processingLease.onDenied, processingAdmission);
         // Profile-less processing keeps its existing route estimate. Named rows
         // receive their own verification at the shared physical-dispatch gate.
@@ -1433,8 +1417,7 @@ export class Orchestrator {
                 const refusal = continuity.beginTry(runSpec, nativeTry, attemptAbort);
                 const transientStart = telemetry.transientFailures.length;
                 const rateLimitStart = telemetry.rateLimits.length;
-                let rawPatch = null;
-                rawContextPacket = null; // a patch binds only the packet its own try sent
+                rawLane.beginTry();
                 try {
                     const watched = withInactivityWatchdog(runModelGovernedRoute(routed, runSpec, dispatch), {
                         timeoutMs: inactivityMs,
@@ -1454,7 +1437,7 @@ export class Orchestrator {
                         // After Stop: stored evidence only, but file paths are still collected for the capture.
                         const stopped = signal?.aborted === true;
                         if (!stopped)
-                            rawPatch = captureRawPatchEnvelope(sizeRawContext !== null, rawPatch, ev);
+                            rawLane.observe(ev);
                         if (ev.type === "patch_produced")
                             continue;
                         if (directory)
@@ -1525,14 +1508,7 @@ export class Orchestrator {
                         observeBudgetSignals(ledger, log, adapter.id, attemptId, ev, budgetSignalState);
                         this.deps.quotaEventSink?.(adapter.id, ev);
                     }
-                    if (sizeRawContext && !harnessErrored)
-                        await consumeRawPatchEnvelope({
-                            repoRoot: envelope.repo_root,
-                            worktreePath: envelope.worktree_path,
-                            baseCommitSha: envelope.base_sha ?? "HEAD",
-                            context: rawContextPacket,
-                            envelope: rawPatch,
-                        });
+                    await rawLane.settle(harnessErrored);
                 }
                 catch (err) {
                     // A throwing adapter must not lose the cost already streamed: record the
@@ -1545,14 +1521,12 @@ export class Orchestrator {
                         processingRefusal = err;
                         break;
                     }
-                    if (!recordAdapterThrow(telemetry, err))
+                    if (!rawLane.refused(err) && !recordAdapterThrow(telemetry, err))
                         break;
                 }
                 finally {
                     clearFileBackedContext();
                 }
-                if (telemetry.requestRefusal)
-                    break;
                 const newTransients = telemetry.transientFailures.slice(transientStart);
                 // #31: the centralized retry gate reads the classified `retryable` verdict.
                 const sawRetryable = newTransients.some((f) => f.retryable);
@@ -1582,6 +1556,8 @@ export class Orchestrator {
                 this.credentials.noteTryServed(refusal, telemetry.outputMarkers, delivered);
                 const verdict = await continuity.afterTry({
                     ...tryFacts,
+                    // A refused patch is its account row above, but no retry or rotation repairs it.
+                    requestRefused: tryFacts.requestRefused || rawLane.refusal !== null,
                     // A cancel or deadline that landed during capture still stops the
                     // attempt; the try's own facts above stay its evidence.
                     stopped: signal?.aborted === true,
@@ -1621,6 +1597,7 @@ export class Orchestrator {
         if (harnessErrored &&
             !poolExhausted &&
             !processingRefusal &&
+            !rawLane.refusal &&
             !telemetry.requestRefusal &&
             !signal?.aborted) {
             emitTransientExhausted((t, p) => log?.emit(t, p), adapter.id, attemptId, telemetry, retryPolicy.maxRetries);
@@ -1631,7 +1608,7 @@ export class Orchestrator {
         }
         // D-16: answer.md persists only the deliverable. A3: an errored attempt
         // with no typed final contributes no answer material (acceptedTryOutput).
-        const unwrapped = unwrapWorkReportEnvelope(acceptedTryOutput(answer, harnessErrored), workReportMode, { sideToolReport: telemetry.sideToolWorkReport ?? undefined });
+        const unwrapped = unwrapAttemptAnswer(acceptedTryOutput(answer, harnessErrored), harnessErrored && !answer.hasFinal(), workReportMode, { sideToolReport: telemetry.sideToolWorkReport ?? undefined });
         const answerText = unwrapped.deliverable.trim().length > 0 ? unwrapped.deliverable : undefined;
         if (directory)
             await captureDirectory(true);
@@ -1697,7 +1674,7 @@ export class Orchestrator {
             workReportSource: unwrapped.source,
             workReportViolation: unwrapped.contractViolation,
             workReportUnverified: unwrapped.unverified ?? null,
-            contextTerminalExhausted: telemetry.contextExhausted,
+            interruption: attemptInterruption(telemetry),
         });
         harnessErrored = finalized.harnessErrored;
         if (finalized.outcomeClass === "contract_failure" && unwrapped.contractViolation)
@@ -1725,6 +1702,7 @@ export class Orchestrator {
         const attemptDir = join(paths.attemptsDir, attemptId);
         recordCleanAttemptMetrics(globalConfigDir(), adapter.id, {
             costUsd: cost,
+            usageCost: telemetry.usageCost,
             streamMs: attemptStreamEndedMs - attemptStartedMs,
             errored,
             aborted: signal?.aborted === true,
@@ -1797,8 +1775,10 @@ export class Orchestrator {
             // A5: the typed refusal survives NORMAL attempt finalization (no throw).
             ...(telemetry.requestRefusal
                 ? { declaredFailure: requestRefusalFailure(telemetry.requestRefusal) }
-                : poolExhausted || processingRefusal
-                    ? { declaredFailure: declaredFailure(processingRefusal ?? poolExhausted) }
+                : poolExhausted || processingRefusal || rawLane.refusal
+                    ? {
+                        declaredFailure: declaredFailure(processingRefusal ?? rawLane.refusal ?? poolExhausted),
+                    }
                     : {}),
             outcomeClass: finalized.outcomeClass,
             applied,
@@ -1878,7 +1858,7 @@ export class Orchestrator {
         // this SINGLE root.
         const execRoot = this.execRootOf(input);
         const projectRoot = input.repoRoot;
-        const wsm = new WorkspaceManager(execRoot, { projectRoot });
+        const wsm = new WorkspaceManager(execRoot, { projectRoot, runtimeRoot: runRuntimeRoot(input) });
         const anchors = secretDiff.revertAnchors(execRoot, projectRoot);
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
         log.emit("task.contract.created", { task_contract_hash: hashJson(contract) });
@@ -1914,12 +1894,7 @@ export class Orchestrator {
         // run — revert is simply unavailable then.
         let preTurnSha = null;
         if (mutatingRun && input.inPlace === true && input.workspaceKind !== "directory") {
-            try {
-                preTurnSha = await snapshotTree(execRoot);
-            }
-            catch {
-                preTurnSha = null;
-            }
+            preTurnSha = await rawAwareSnapshot(execRoot).catch(() => null);
         }
         // ContextPack is LAZY: agent/race candidates explore the live tree
         // themselves inside their envelopes; only the read-only report modes
@@ -1970,6 +1945,7 @@ export class Orchestrator {
             for (const env of envelopes)
                 await kept.settle(wsm, env, runsBySlot);
         };
+        const rawAdoption = new RawAdoption(execRoot, input);
         const candidateAccess = contract.access.effective_profile;
         let budgetStopped = false;
         // QA-050: keep the ledger's typed denial so the zero-candidate terminal
@@ -2094,6 +2070,9 @@ export class Orchestrator {
                             requestedSingleCandidate &&
                             slot.routed.implementationTransport !== "git_patch_envelope"),
                 });
+                // A continueFrom envelope already owns its record: no empty source overwrites it.
+                if (!input.continuation?.adopt)
+                    await rawAdoption.seed(envelope.worktree_path);
                 harnessHome = this.harnessHomeFor(wsm, envelope, slot.routed, input);
                 const run = await this.runCandidateInEnvelope(slot.routed, envelope, slot.attemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, {
                     lease: slot.lease,
@@ -2214,6 +2193,8 @@ export class Orchestrator {
                         }
                     }
                 }
+                if (!effectiveRun.errored && secretDiff.hasCandidateChanges(effectiveRun))
+                    await rawAdoption.keep(effectiveRun.attemptId, envelope.worktree_path);
                 runsBySlot[slotIdx] = effectiveRun;
                 reviewEnvelopes.push(envelope);
                 envelope = undefined;
@@ -2224,6 +2205,7 @@ export class Orchestrator {
                 const message = safeErrorMessage(err);
                 const declared = declaredFailure(err);
                 const infraPhase = envelope === undefined ? "workspace" : "harness";
+                const applied = appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.credentials.effectiveProfileId(input, adapter.id));
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
                     attempt_id: slot.attemptId,
@@ -2231,7 +2213,7 @@ export class Orchestrator {
                     error: message,
                     phase: infraPhase,
                 });
-                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message, appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.credentials.effectiveProfileId(input, adapter.id))));
+                store.writeYaml(join(paths.attemptsDir, slot.attemptId, "attempt.yaml"), AC.attemptFailureRecord(slot.attemptId, adapter.id, failureCost, infraPhase, message, applied));
                 runsBySlot[slotIdx] = {
                     attemptId: slot.attemptId,
                     harnessId: adapter.id,
@@ -2252,8 +2234,10 @@ export class Orchestrator {
                     // Keep a TYPED pre-spawn refusal (spent quota window + its reset)
                     // alive past this catch; `message` alone would force the terminal to
                     // read prose back out.
-                    ...(declared.code ? { declaredFailure: declared } : {}),
-                    applied: appliedAttemptFacts(harnessHome, slot.routed.adapterAccess, this.credentials.effectiveProfileId(input, adapter.id)),
+                    ...(declared.code || declared.quotaRefusal ? { declaredFailure: declared } : {}),
+                    applied,
+                    // No HOME was decided, so no child started (#648); never read from a record.
+                    ...(harnessHome === undefined ? { homeUndecided: true } : {}),
                 };
             }
             finally {
@@ -2300,24 +2284,18 @@ export class Orchestrator {
                 : undefined,
             signal: input.signal,
         });
-        // Revert divergence fence for the single-candidate in-place path: the
-        // candidate mutated the LIVE tree during execution above, so the post-turn
-        // snapshot must be taken NOW — before review/synthesis/arbitration, which can
-        // run for a long time during which the user may edit files. Snapshotting after
-        // arbitration (as the race-adoption path does) would fold those user edits
-        // into the revert target and let a later revert clobber them.
+        // Revert divergence fence for the single-candidate in-place path.
+        // The candidate mutated the LIVE tree above. Snapshot NOW, before slow
+        // review/synthesis/arbitration, or later user edits enter the revert target
+        // and a revert can clobber them. The race-adoption path snapshots later.
+        // No change, no fence.
         let earlyPostTurnSha = null;
         if (mutatingRun &&
             input.workspaceKind !== "directory" &&
             input.inPlace &&
             requestedSingleCandidate &&
-            runs.every((run) => !run.captureRefusal)) {
-            try {
-                earlyPostTurnSha = await snapshotTree(execRoot);
-            }
-            catch {
-                earlyPostTurnSha = null;
-            }
+            needsPostTurnFence(runs)) {
+            earlyPostTurnSha = await rawAwareSnapshot(execRoot).catch(() => null);
         }
         if (input.signal?.aborted) {
             await disposeReviewEnvelopes();
@@ -2470,6 +2448,7 @@ export class Orchestrator {
                             workspaceKind: input.workspaceKind,
                             scopePaths: input.scopePaths,
                         });
+                        await rawAdoption.seed(envelope.worktree_path);
                         const synthHome = this.harnessHomeFor(wsm, envelope, synthRouted, input);
                         const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthesisInput.prompt, store, paths, wsm, ledger, {
                             lease: lease.lease,
@@ -2479,6 +2458,8 @@ export class Orchestrator {
                             },
                         }, candidateAccess, input.onHarnessEvent, input.signal, undefined, input.effort, "synthesize", log, effectiveWeb, interactionChannelFor(input, log, runId, taskId, "synth", synthAdapter.id, synthRouted.supportsInteractive), undefined, input, false, synthesisInput.content, undefined, synthHome, undefined, synthTried);
                         ledger.settle(lease.lease?.lease_id ?? "", attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
+                        if (!run.errored && secretDiff.hasCandidateChanges(run))
+                            await rawAdoption.keep(run.attemptId, envelope.worktree_path);
                         reviewEnvelopes.push(envelope);
                         envelope = undefined;
                         // D-16 r8: only a WORKING synth is reviewed/adopted (same veto owner
@@ -2723,8 +2704,9 @@ export class Orchestrator {
                                 applied: true,
                                 patch_sha256: patchSha256,
                                 winner: winnerRun.attemptId,
+                                ...(await rawAdoption.publish(winnerRun.attemptId)),
                             });
-                            postTurnSha = await snapshotTree(execRoot).catch(() => null);
+                            postTurnSha = await rawAwareSnapshot(execRoot).catch(() => null);
                             revertAnchorId = await anchors.after(winnerRun, applied);
                         }
                         else {
@@ -2742,6 +2724,7 @@ export class Orchestrator {
                                 patch_sha256: patchSha256,
                                 detail: redactSecrets(applied.detail ?? "apply failed"),
                                 tree_mutated: applied.treeMutated,
+                                ...(adopted ? await rawAdoption.publish(winnerRun.attemptId) : {}),
                             });
                         }
                     }
@@ -2757,6 +2740,7 @@ export class Orchestrator {
                 if (inPlaceWinner && requestedSingleCandidate && adopted === true) {
                     revertAnchorId = await anchors.turn(preTurnSha, postTurnSha);
                 }
+                const capturedNoGitChange = capturedNoGitChangeValue(winnerRun);
                 store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
                     id: newId("wp"),
                     kind: input.create === true ? "new_repo" : "patch",
@@ -2776,6 +2760,7 @@ export class Orchestrator {
                         budget_stopped: budgetStopped,
                         ...{ patch_sha256: patchSha256, ...savedPatch.meta },
                         result_kind: resultKind,
+                        ...(capturedNoGitChange !== null ? { capturedNoGitChange } : {}),
                         diffstat: {
                             files: wstats.paths.length,
                             additions: wstats.additions,
@@ -2817,6 +2802,8 @@ export class Orchestrator {
         // (applyable, no_changes, or not-verified) is an honest completion.
         const needsDecisionTerminal = facts.review === "blocked" || facts.checks === "failed";
         const isFailureTerminal = facts.lifecycle !== "succeeded" || needsDecisionTerminal;
+        const decisionBlock = needsHuman || needsDecisionTerminal;
+        const statement = raceStatement(winnerRun, decisionBlock, result.decision.why_winner);
         const pool = racePool();
         // Beside whichever failure record leads, a source another attempt kept stays named.
         const keptSources = candidateCaptureRefusals(runs).flatMap(secretDiff.captureInspectionActions);
@@ -2861,7 +2848,6 @@ export class Orchestrator {
             // stays `internal`. A review/checks block is `policy` (the acceptance
             // path), phase `review`, and its remedy names the decision, not "retry
             // with a different harness".
-            const decisionBlock = needsHuman || needsDecisionTerminal;
             writeFailure(store, paths, {
                 phase: decisionBlock ? "review" : "arbitration",
                 category: decisionBlock
@@ -2877,7 +2863,7 @@ export class Orchestrator {
                     ? `review escalated to a human decision: ${result.decision.why_winner}`
                     : needsDecisionTerminal
                         ? `review blocked before apply: ${result.decision.why_winner}`
-                        : result.decision.why_winner, pool),
+                        : statement, pool),
                 poolAttempts: pool,
                 rawDetailRef: winnerRun?.errored
                     ? `attempts/${winnerRun.attemptId}/attempt.yaml`
@@ -2899,6 +2885,7 @@ export class Orchestrator {
                         ]),
                     ...keptSources,
                 ],
+                ...(decisionBlock ? {} : erroredWinnerFailure(winnerRun, keptSources)),
             });
             if (!winnerRun) {
                 store.writeText(join(paths.finalDir, "summary.md"), `# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Phase: arbitration\n\n${withPoolAttempts(result.decision.why_winner, pool)}\n`);
@@ -2957,7 +2944,7 @@ export class Orchestrator {
             facts,
             winner: result.decision.winner,
             runDir: paths.root,
-            summary: withPoolAttempts(result.decision.why_winner, pool),
+            summary: withPoolAttempts(statement, pool),
             candidates: candidateStatuses(runs),
             decisionPath,
             reviewVerified: actualReviewVerified,
@@ -3054,7 +3041,10 @@ export class Orchestrator {
         // local `execRoot`; this path previously ensured the boundary on repoRoot,
         // which for an isolated thread is the project, not the mutated worktree.
         const execRoot = this.execRootOf(input);
-        const wsm = new WorkspaceManager(execRoot, { projectRoot: input.repoRoot });
+        const wsm = new WorkspaceManager(execRoot, {
+            projectRoot: input.repoRoot,
+            runtimeRoot: runRuntimeRoot(input),
+        });
         const anchors = secretDiff.revertAnchors(execRoot, input.repoRoot);
         const readiness = new ReadinessLedger();
         store.writeYaml(join(paths.contextDir, "task.yaml"), contract);
@@ -3170,7 +3160,7 @@ export class Orchestrator {
         let converged = false;
         let exhausted = false;
         let processingBudgetDenial = null;
-        let interrupted = false; // D-16 r8: terminalizes the run interrupted
+        let interrupted = null; // D-16 r8, #299
         let lastFindings = [];
         let lastRun = null;
         const convergenceRuns = [];
@@ -3204,12 +3194,7 @@ export class Orchestrator {
             // access level the envelope did not actually run with.
             const convergenceAccess = contract.access.effective_profile;
             if (input.inPlace === true && input.workspaceKind !== "directory") {
-                try {
-                    preTurnSha = await snapshotTree(execRoot);
-                }
-                catch {
-                    preTurnSha = null;
-                }
+                preTurnSha = await rawAwareSnapshot(execRoot).catch(() => null);
             }
             envelope = await wsm.create({
                 taskId,
@@ -3302,15 +3287,16 @@ export class Orchestrator {
                     // A5: keep a TYPED refusal alive past this catch (race-lane parity).
                     const declared = declaredFailure(err);
                     ledger.settle(lease.lease?.lease_id ?? "", failureCost.settlement);
+                    const applied = appliedAttemptFacts(harnessHome, routed.adapterAccess, this.credentials.effectiveProfileId(input, adapter.id));
                     log.emit("harness.completed", {
                         harness_id: adapter.id,
                         attempt_id: attemptId,
                         status: "failed",
                         error: message,
                     });
-                    store.writeYaml(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message, appliedAttemptFacts(harnessHome, routed.adapterAccess, this.credentials.effectiveProfileId(input, adapter.id))));
+                    store.writeYaml(join(paths.attemptsDir, attemptId, "attempt.yaml"), AC.attemptFailureRecord(attemptId, adapter.id, failureCost, "harness", message, applied));
                     run = {
-                        applied: appliedAttemptFacts(harnessHome, routed.adapterAccess, this.credentials.effectiveProfileId(input, adapter.id)),
+                        applied,
                         attemptId,
                         harnessId: adapter.id,
                         label: `Attempt ${attempt}`,
@@ -3321,7 +3307,7 @@ export class Orchestrator {
                         costEstimated: failureCost.estimated,
                         errors: [message],
                         poolAttempts: tried.snapshot(),
-                        ...(declared.code ? { declaredFailure: declared } : {}),
+                        ...(declared.code || declared.quotaRefusal ? { declaredFailure: declared } : {}),
                         telemetry: createAttemptTelemetry(knobs.webPolicy, contract.external_context.web_required, effectiveWeb, [routed.browserRequirement, routed.denyRequirement, routed.delegationRequirement], knobs.model),
                     };
                     if (envelope.workspace_kind === "directory") {
@@ -3333,24 +3319,22 @@ export class Orchestrator {
                             holder: { runId: paths.runId, runDir: paths.root },
                         }));
                     }
+                    // Refused before its HOME was decided, no child ran: that refusal ends the run (#648).
+                    if (input.delegated === true && harnessHome === undefined)
+                        throw err;
                 }
                 lastRun = run;
                 convergenceRuns.push(run);
                 // Fail-closed twin of the candidate lane's gate: this loop terminalizes
                 // per attempt, so the proof is spent per attempt.
                 assertDelegatedEvidence(input.delegated === true, convergenceAccess, [run]);
-                attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry: run.telemetry });
+                attemptTelemetries.push({ attemptId, harnessId: adapter.id, ...pickTelemetry(run) });
                 lastPostTurnSha = null;
                 // Post-mutation fence for in-place: snapshot the live tree NOW (after the
                 // harness mutated it, before this attempt's review). The last attempt's
-                // value is the revert target persisted into work_product.yaml.
-                if (input.inPlace === true && input.workspaceKind !== "directory" && !run.captureRefusal) {
-                    try {
-                        lastPostTurnSha = await snapshotTree(execRoot);
-                    }
-                    catch {
-                        lastPostTurnSha = null;
-                    }
+                // value is the revert target persisted into work_product.yaml (an unchanged one has none).
+                if (input.inPlace && input.workspaceKind !== "directory" && needsPostTurnFence([run])) {
+                    lastPostTurnSha = await rawAwareSnapshot(execRoot).catch(() => null);
                 }
                 // Cancellation/deadline keeps priority over a belt failure finalized concurrently.
                 if (input.signal?.aborted || processingBudgetDenial)
@@ -3364,8 +3348,7 @@ export class Orchestrator {
                     exhausted = true;
                     break;
                 }
-                if (run.telemetry.requestRefusal ||
-                    run.telemetry.effortResolution?.resolution === "rejected")
+                if (endsConvergence(run))
                     break;
                 if (delegateFailure.candidateFailureKind(run)) {
                     const failure = delegateFailure.candidateFailureTerminal(run, "convergence");
@@ -3396,7 +3379,7 @@ export class Orchestrator {
                 // D-16 r8: interrupted (errored===false) would CONVERGE a partial diff
                 // as clean — break BEFORE review; a harness error still gate-retries.
                 if (run.outcomeClass === "interrupted") {
-                    interrupted = true;
+                    interrupted = interruptionOf(run);
                     break;
                 }
                 // The review round is wrapped so a preflight/revalidation throw ends the
@@ -3466,7 +3449,8 @@ export class Orchestrator {
                     converged = true;
                     break;
                 }
-                const requiredGateFailing = run.gates.length > 0 && !gatesPassed(run.gates);
+                const refusal = correctableRefusal(run); // INV-047: a refused patch has no result
+                const requiredGateFailing = !refusal && run.gates.length > 0 && !gatesPassed(run.gates);
                 const diffHash = run.files
                     ? run.files.manifestSha256
                     : input.workspaceKind === "directory"
@@ -3475,7 +3459,7 @@ export class Orchestrator {
                 if (requiredGateFailing && diffHash !== null && diffHash === lastFailingGateDiffHash) {
                     sameFailingGateDiffs += 1;
                 }
-                else {
+                else if (!refusal) {
                     sameFailingGateDiffs = requiredGateFailing ? 1 : 0;
                     lastFailingGateDiffHash = requiredGateFailing ? (diffHash ?? "") : "";
                 }
@@ -3493,11 +3477,9 @@ export class Orchestrator {
                     });
                     break;
                 }
-                const sig = failureSignature([
-                    ...conv.reasons,
-                    ...(run.files ? [`files_manifest:${run.files.manifestSha256}`] : []),
-                ]);
-                readiness.recordRound(sig, conv.reasons.join("; "));
+                const manifest = run.files ? [`files_manifest:${run.files.manifestSha256}`] : [];
+                const sig = refusal ?? failureSignature([...conv.reasons, ...manifest]);
+                readiness.recordRound(sig, refusal ?? conv.reasons.join("; "));
                 if (sig !== lastSig) {
                     triedSinceProgress = new Set();
                     lastSig = sig;
@@ -3633,6 +3615,7 @@ export class Orchestrator {
         const convNeedsDecision = facts.review === "blocked" || facts.checks === "failed";
         // Every attempt's failed tries by the actual outcome; a block is not an account failure.
         const convPool = terminalPoolAttempts(facts, convergenceRuns);
+        const convCause = convergenceCause(lastRun, facts, Boolean(convBudgetMapping));
         if (decision) {
             // Shared honesty owner (same as the race path): a needs-decision terminal
             // overrides the persisted decision; final_verify is recorded either way.
@@ -3678,6 +3661,7 @@ export class Orchestrator {
                         : "applied_review_blocked"
                     : "not_applied";
                 const revertAnchorId = convAdopted === true ? await anchors.turn(preTurnSha, lastPostTurnSha) : null;
+                const capturedNoGitChange = capturedNoGitChangeValue(lastRun);
                 store.writeYaml(join(paths.finalDir, "work_product.yaml"), {
                     id: newId("wp"),
                     kind: "patch",
@@ -3686,6 +3670,7 @@ export class Orchestrator {
                     meta: {
                         harness_id: lastRun.harnessId,
                         result_kind: "patch",
+                        ...(capturedNoGitChange !== null ? { capturedNoGitChange } : {}),
                         mode,
                         attempts: attempt,
                         lifecycle: facts.lifecycle,
@@ -3706,7 +3691,7 @@ export class Orchestrator {
                 store.writeText(join(paths.finalDir, "answer.md"), lastRun.answerText);
                 log.emit("output.ready", { kind: "answer", path: "final/answer.md" });
             }
-            store.writeText(join(paths.finalDir, "summary.md"), `${withPoolAttempts(`# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}${secretDiff.resultSummaryDisclosure(lastRun)}`, convPool)}\n`);
+            store.writeText(join(paths.finalDir, "summary.md"), `${withPoolAttempts(`# Run ${runId} (${mode})\n\n- Lifecycle: ${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""}\n- Attempts: ${attempt}\n- Winner: ${lastRun.attemptId}\n- Review verified (cross-family): ${actualReviewVerified}\n- Apply recommendation: ${decision?.apply_recommendation ?? "inspect"}${stuckNoProgressReason ? `\n- No-progress reason: ${stuckNoProgressReason}` : ""}${convCause ? `\n- Failure: ${convCause}` : ""}${secretDiff.resultSummaryDisclosure(lastRun)}`, convPool)}\n`);
             // Lifecycle invariant (all modes): output.ready precedes the terminal
             // event so a client that applied the terminal event has the output.
             log.emit("output.ready", {
@@ -3742,6 +3727,7 @@ export class Orchestrator {
                 rawContextShortfall: convDeclared?.rawContextShortfall,
                 harnessId: lastRun?.harnessId,
                 attemptId: lastRun?.attemptId,
+                vendorFailure: convCause ? lastRun?.telemetry.vendorFailure : null,
                 runDir: paths.root,
                 captureFailure: lastRun?.captureRefusal?.failure,
                 nextActions: [
@@ -3780,7 +3766,7 @@ export class Orchestrator {
                         ? `review escalated to a human decision after ${attempt} attempt(s)`
                         : facts.reason === "stuck_no_progress"
                             ? (stuckNoProgressReason ?? `stuck_no_progress after ${attempt} attempt(s)`)
-                            : `${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""} after ${attempt} attempt(s)${lastDiffStable ? "" : " (diff changed after review; review is stale)"}`), convPool),
+                            : `${convCause ? `${convCause}\n` : ""}${facts.lifecycle}${facts.reason ? ` (${facts.reason})` : ""} after ${attempt} attempt(s)${lastDiffStable ? "" : " (diff changed after review; review is stale)"}`), convPool),
                 poolAttempts: convPool,
             });
             // D-16 r8/r9: an INTERRUPTED envelope run still gets its diagnostic
@@ -3856,7 +3842,7 @@ export class Orchestrator {
                 : {}),
             summary: withPoolAttempts(converged
                 ? `converged in ${attempt} attempt(s)`
-                : `${facts.lifecycle} after ${attempt} attempt(s)`, convPool),
+                : `${convCause ? `${convCause}\n` : ""}${facts.lifecycle} after ${attempt} attempt(s)`, convPool),
             candidates: lastRun
                 ? [
                     {
@@ -3891,6 +3877,7 @@ export class Orchestrator {
                         ? `${args.promptBody}\n\n${laneContinuity.pointerLine}`
                         : args.promptBody,
                     cwd: this.execRootOf(input),
+                    input_file_dir: paths.contextDir,
                     access: "readonly",
                     attachments: input.attachments ?? [],
                     ...sessionFields,
@@ -4084,6 +4071,8 @@ export class Orchestrator {
                 if (outcome.status !== "success") {
                     if (outcome.telemetry?.effortResolution?.resolution === "rejected")
                         break;
+                    if (outcome.telemetry?.turnLimitReached)
+                        break; // #299: the cap ends the run
                     const next = adapters[idx + 1];
                     if (next && !input.signal?.aborted) {
                         fallbackFrom = outcome.harnessId;
@@ -4237,7 +4226,7 @@ export class Orchestrator {
      * route/session/knob machinery HERE and hands the module only finished public
      * types (a `HarnessRunSpec`, cost evidence, a disposable home).
      */
-    deepScanReducerDeps(input, contract, log) {
+    deepScanReducerDeps(input, contract, log, paths) {
         return {
             newReadOnlyHome: () => scopedRouteContext(resolveReadOnlyRouteContext(this.execRootOf(input)), input.runScopeMarker),
             costEvidence: (harnessId, attemptId, routed) => 
@@ -4254,6 +4243,7 @@ export class Orchestrator {
                     intent: "synthesize",
                     prompt,
                     cwd: this.execRootOf(input),
+                    input_file_dir: paths.contextDir,
                     access: "readonly",
                     attachments: [],
                     auth_preference: sessionFields.auth_preference,
@@ -4487,6 +4477,7 @@ export class Orchestrator {
                     intent: opts.intent,
                     prompt: promptWithPointers,
                     cwd: this.execRootOf(input),
+                    input_file_dir: paths.contextDir,
                     access: "readonly",
                     // ASK/EXPLORE/AUDIT read-only runs must forward the user's attachments —
                     // a live "describe this image" turn sent an image that was being dropped here, so
@@ -4553,7 +4544,8 @@ export class Orchestrator {
                     report: "",
                     error: message,
                     telemetry,
-                    ...(preDeclared.code ? { declaredFailure: preDeclared } : {}), // typed pre-spawn refusal
+                    // A typed pre-spawn refusal, a provider refusal with no code of its own included (#558).
+                    ...(declaredFailureSpeaks(preDeclared) ? { declaredFailure: preDeclared } : {}),
                 });
                 attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
                 if (opts.deepScan) {
@@ -4661,7 +4653,7 @@ export class Orchestrator {
                             // the loudest) — same single owner as the agent loop.
                             observeBudgetSignals(ledger, log, adapter.id, attemptId, ev, budgetSignalState);
                             this.deps.quotaEventSink?.(adapter.id, ev);
-                            const spend = observeReadonlySpend(ev, (t, p) => log.emit(t, p), adapter.id, attemptId);
+                            const spend = observeUsageSpend(ev, (t, p) => log.emit(t, p), adapter.id, attemptId, telemetry.usageCost);
                             cost += spend.costUsd;
                             costEstimated ||= spend.estimated;
                             const streamDenial = updateProcessingStreamHold(runSpec, telemetry.usageCost, ledger, lease.lease.lease_id, adapter.id, attemptId);
@@ -4689,8 +4681,6 @@ export class Orchestrator {
                         if (!recordAdapterThrow(telemetry, err))
                             break;
                     }
-                    if (telemetry.requestRefusal)
-                        break;
                     const newTransients = telemetry.transientFailures.slice(transientStart);
                     const sawRetryable = newTransients.some((f) => f.retryable);
                     const sawTypedLimit = telemetry.rateLimits.length > rateLimitStart;
@@ -4752,7 +4742,7 @@ export class Orchestrator {
             attemptTelemetries.push({ attemptId, harnessId: adapter.id, telemetry });
             // D-16: the deliverable is the report. A3: an errored attempt with no
             // typed final contributes no report material (acceptedTryOutput).
-            const roUnwrapped = unwrapWorkReportEnvelope(acceptedTryOutput(answer, harnessError !== null), readonlyWorkMode, { sideToolReport: telemetry.sideToolWorkReport ?? undefined });
+            const roUnwrapped = unwrapAttemptAnswer(acceptedTryOutput(answer, harnessError !== null), harnessError !== null && !answer.hasFinal(), readonlyWorkMode, { sideToolReport: telemetry.sideToolWorkReport ?? undefined });
             // Trim symmetrically with the plan path: a whitespace-only answer is not
             // a delivered report (the final-artifact wrapper heading would otherwise
             // make it read as present content by construction).
@@ -4771,7 +4761,7 @@ export class Orchestrator {
                 workReportSource: roUnwrapped.source,
                 workReportViolation: roUnwrapped.contractViolation,
                 workReportUnverified: roUnwrapped.unverified ?? null,
-                contextTerminalExhausted: telemetry.contextExhausted,
+                interruption: attemptInterruption(telemetry),
             });
             // A broken WorkReport contract is a hard failure ONLY when the finalizer
             // ranked it so — a concurrent terminal context exhaustion outranks it
@@ -4842,9 +4832,8 @@ export class Orchestrator {
                 harnessId: adapter.id,
                 status: scoutInterrupted ? "failed" : "success",
                 report: report || "(no output)",
-                error: scoutInterrupted ? "context capacity exhausted before the scout completed" : null,
+                error: scoutInterrupted ? interruptionDetail(roFinalized.reason) : null,
                 telemetry,
-                ...(scoutInterrupted ? { interrupted: true } : {}),
                 ...continuity.terminalFacts(roResumable),
             });
             launched.delete(tried);
@@ -4855,7 +4844,7 @@ export class Orchestrator {
                         .join("; ")}\n`
                     : "";
                 const scoutTag = scoutInterrupted
-                    ? " interrupted (context capacity exhausted)"
+                    ? ` interrupted (${interruptionDetail(roFinalized.reason)})`
                     : ` (${adapter.id})`;
                 store.writeText(join(paths.findingsDir, `${attemptId}${scoutInterrupted ? "-interrupted" : ""}.md`), `# Explorer ${attemptId}${scoutTag}\n\n${report || "(no output)"}${warningNote}\n`);
             }
@@ -4933,12 +4922,13 @@ export class Orchestrator {
                     if (last?.telemetry.effortResolution?.resolution === "rejected")
                         break;
                     // Per-harness fallback_model: one same-harness retry on FAILURE (not
-                    // policy blocks) before falling through to the next harness.
+                    // policy blocks or the caller's max-turns cap, #299) before the next harness.
                     const fallbackModel = routed.settings?.fallbackModel;
                     const firstModel = contract.routing_models[routed.adapter.id] ?? routed.settings?.defaultModel ?? null;
                     if (last &&
                         last.status === "failed" &&
                         !last.telemetry.requestRefusal &&
+                        !last.telemetry.turnLimitReached &&
                         fallbackModel &&
                         fallbackModel !== firstModel &&
                         !budgetStopped &&
@@ -5032,7 +5022,7 @@ export class Orchestrator {
         let deepScanSynthesis = null;
         let reducedReport = null;
         if (opts.deepScan) {
-            ({ deepScanSynthesis, reducedReport } = await resolveDeepScanSynthesis(this.deepScanReducerDeps(input, contract, log), {
+            ({ deepScanSynthesis, reducedReport } = await resolveDeepScanSynthesis(this.deepScanReducerDeps(input, contract, log, paths), {
                 succeeded,
                 adapters,
                 budgetStopped,