@eir-labs/coltrane 0.24.30 → 0.24.31

package/dist/src/runtime.js

@@ -5,10 +5,14 @@
 // that carries model_version + (empty, v0) eval_scores — honestly un-tempered.
 import { lineageAdoption } from "./lineage_adoption.js";
 import { randomUUID } from "node:crypto";
+import { performance } from "node:perf_hooks";
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join as joinPath, relative as relPath, isAbsolute as isAbsPath, sep as pathSep } from "node:path";
 import { PRIMITIVE_OUTPUT_TYPE, CORE_TYPES } from "./core_types.js";
 import { executeSkillAsync } from "./skill_subprocess.js";
 import { loadSkillPackage } from "./skills.js";
-import { resolveModel } from "./claude_invoker.js";
+import { resolveModel, sessionUuidFor } from "./claude_invoker.js";
 import { resolveAgentGrants } from "./tool_providers.js";
 import { resolveAndRealize } from "./venue_realize.js";
 // core type → the process primitive that produces it (reverse of PRIMITIVE_OUTPUT_TYPE).
@@ -27,6 +31,34 @@ import { drainGigHeader } from "./output_mirror.js";
 import { LEDGER_SCHEMA_VERSION } from "./ledger.js";
 import { PlacementRefused } from "./placement.js";
 import { COLTRANE_VERSION } from "./version.js";
+// #seat-effort — the ONE place effort precedence resolves, mirroring how `depth` threads. The
+// RESOLVED value is set on AgentInvocationContext.effort and reaches both invokers. Order: the
+// dispatch effort wins, else the agent's declared effort, else the agent's tier default
+// (economy→low, standard→medium, premium→high), else `medium` for an untiered agent — never the
+// operator's ~/.claude/settings.json. Total by construction (always returns a level), which is what
+// makes an undeclared, untiered seat still carry an explicit effort to the spawn (O3).
+function resolveEffort(dispatchEffort, agent) {
+    if (dispatchEffort)
+        return dispatchEffort;
+    if (agent.effort)
+        return agent.effort;
+    switch (agent.model_tier) {
+        case "economy": return "low";
+        case "standard": return "medium";
+        case "premium": return "high";
+        default: return "medium";
+    }
+}
+// contract-seat-context-ceiling-v1 (O2) — the ONE place the context ceiling resolves, a sibling of
+// resolveEffort but with NO floor: dispatch ▷ agent ▷ none. Absent everywhere ⇒ `undefined`, which the
+// completions invoker reads as "no ceiling" and runs to done past any context (I1) — never a guessed
+// default. Set on AgentInvocationContext.max_context_tokens at the invoke ctx site, the same seam
+// `effort` threads through.
+function resolveMaxContextTokens(dispatchCap, agent) {
+    if (dispatchCap !== undefined)
+        return dispatchCap;
+    return agent.max_context_tokens;
+}
 /**
  * #236 — settled spend used to be discarded on every failed gig: `usage` was written only on
  * the success path, and the async dispatcher's `.catch` set status/error and nothing else. A
@@ -131,51 +163,139 @@ export function abortReasonText(signal) {
     return "cancelled";
 }
 /**
- * Raised when a gig's budget cannot cover the next agent's cost-of-append.
- * Carries the agent_slug, the available balance, and the required cost so
- * the caller can render the exact reason. The in-memory BudgetState is
- * also attached for downstream telemetry.
+ * Raised when a gig's SETTLED dollar spend reaches its `max_usd` ceiling and the next batch may
+ * not start (O2/O5). Denominated in dollars: `spent_usd`, `max_usd`, `unit: "usd"`, and a message
+ * that names the amounts with `$` and `usd` — never append-units. The in-memory BudgetState is
+ * attached so a caller can render the full snapshot.
  */
 export class BudgetExhausted extends Error {
     agent_slug;
-    balance;
-    cost;
+    spent_usd;
+    max_usd;
+    unit = "usd";
     state;
-    constructor(agent_slug, balance, cost, state) {
-        super(`BudgetExhausted: agent "${agent_slug}" needs cost=${cost} but balance=${balance} (opening=${state.opening}, spent=${state.spent}, credit=${state.credit})`);
+    constructor(agent_slug, spent_usd, max_usd, state) {
+        super(`BudgetExhausted: gig stopped before agent "${agent_slug}" — settled spend $${spent_usd} reached the $${max_usd} usd ceiling`);
         this.name = "BudgetExhausted";
         this.agent_slug = agent_slug;
-        this.balance = balance;
-        this.cost = cost;
+        this.spent_usd = spent_usd;
+        this.max_usd = max_usd;
         this.state = state;
     }
 }
 /**
- * Cost-of-append for an agent invocation, in synthetic append units (see BudgetState.unit).
- * Deterministic function of the input context size — same input → same cost. Keeps cost
- * calculation inside the runtime (not the invoker) so budget enforcement cannot be spoofed by
- * a misbehaving invoker.
- *
- * #233 — this used to serialize `input_ids`: the UUIDs of the upstream outputs a chair
- * consumes, not their data. An upstream output contributed exactly 36 bytes whether it was a
- * one-line signal or a 40-page draft, so the proxy was not even monotonic in the thing that
- * drives real cost. It now measures the CONTENT the invoker actually receives.
- *
- * Still excluded, honestly: resolved skills, the agent charter, type schemas, model tier,
- * max_tool_calls, and the entire output side. This is a rate limiter on consumed context, not
- * a price. Money is `BudgetState.settled_usd`.
+ * Raised when a gig under a dollar ceiling cannot VERIFY its spend (F3): a settled invocation
+ * reported usage but no `total_cost_usd`, so the runtime cannot know whether the next batch is
+ * affordable. Fail-closed — no further batch starts. `reason` is the typed `budget_unverifiable`,
+ * and the message names the chairs whose dollar spend is unknown.
+ */
+export class BudgetUnverifiable extends Error {
+    reason = "budget_unverifiable";
+    chairs;
+    state;
+    constructor(chairs, state) {
+        super(`budget_unverifiable: cannot enforce the usd ceiling — chair(s) settled without reporting usd: ${chairs.join(", ")}`);
+        this.name = "BudgetUnverifiable";
+        this.chairs = chairs;
+        this.state = state;
+    }
+}
+/**
+ * The model that DID a chair's work: the model that WROTE the most output tokens across the chair's
+ * `modelUsage` breakdown — NOT whichever key the CLI listed first. Claude Code spends a small
+ * background call on a fast model before the real work, and that model is listed FIRST while writing
+ * almost nothing, so a first-key stamp names a model that did none of the chair's work. Output
+ * tokens are the honest signal of which model produced the answer. Ties break on the model id
+ * (lexicographic ascending), so the stamp is deterministic regardless of the breakdown's key order.
+ * An empty map (a transport that reported no per-model breakdown) yields undefined — nothing to
+ * stamp, exactly as before.
  */
-export function computeAppendCost(ctx, base_cost, k) {
-    // Canonical serialization of what the invoker actually sees. JSON.stringify
-    // is sufficient for v0 — deterministic order isn't required since size is
-    // the only thing we extract, and Record key order in V8 is insertion-stable.
-    const size_bytes = JSON.stringify({
-        agent_slug: ctx.agent.slug,
-        phase: ctx.phase,
-        inputs: ctx.inputs.map((i) => i.data),
-        gig_input: ctx.gig_input,
-    }).length;
-    return base_cost + k * size_bytes;
+export function workingModel(outputByModel) {
+    let best;
+    let bestTokens = -1;
+    for (const [model, tokens] of outputByModel) {
+        if (tokens > bestTokens || (tokens === bestTokens && best !== undefined && model < best)) {
+            best = model;
+            bestTokens = tokens;
+        }
+    }
+    return best;
+}
+function gitInTree(tree_root, args) {
+    return execFileSync("git", ["-C", tree_root, ...args]).toString();
+}
+// The it/test titles a law blob declares, in file order — the `tests` the reviewer is handed instead
+// of a sentence about the law. Matches `it(...)`/`test(...)` (with any `.only`/`.skip`/… chain) taking
+// a string literal as its first argument; the leading \b keeps `it`/`test` from matching inside a
+// longer identifier (submit, audit, …). Escaped quotes/backslashes in the title are unescaped.
+function testTitlesIn(body) {
+    const re = /\b(?:it|test)(?:\.\w+)*\s*\(\s*(['"`])((?:\\.|(?!\1)[\s\S])*?)\1/g;
+    const titles = [];
+    for (let m = re.exec(body); m !== null; m = re.exec(body)) {
+        titles.push(m[2].replace(/\\(["'`\\])/g, "$1"));
+    }
+    return titles;
+}
+/**
+ * Stamp each law's `blob_sha` (`git rev-parse <commit>:<path>`) and `tests` (the it/test titles in
+ * that blob, in file order) from a supplied `{path, commit}`, reading git in `tree_root`.
+ * REFUSALS: no `tree_root` → `tree_root_unknown` (never a `process.cwd()` fallback); an address that
+ * does not resolve (unknown commit, or a path absent at that commit) → `law_record_unresolvable`
+ * naming `path@commit`; a seat-supplied `blob_sha`/`tests` that disagrees with git → `law_bytes_mismatch`
+ * naming the path and field.
+ */
+export function stampLawAddresses(laws, tree_root) {
+    if (tree_root === undefined) {
+        throw new RuntimeError("tree_root_unknown: a red-spec carrying `laws` cannot be stamped without a RunDeps.tree_root — the seal reads git objects from a named tree and never falls back to process.cwd().");
+    }
+    return laws.map((law) => {
+        let blob_sha;
+        try {
+            blob_sha = gitInTree(tree_root, ["rev-parse", `${law.commit}:${law.path}`]).trim();
+        }
+        catch {
+            throw new RuntimeError(`law_record_unresolvable: the law ${law.path}@${law.commit} does not resolve in tree_root — git holds no object for that <commit>:<path>. Nothing is sealed.`);
+        }
+        const body = gitInTree(tree_root, ["show", `${law.commit}:${law.path}`]);
+        const tests = testTitlesIn(body);
+        if (law.blob_sha !== undefined && law.blob_sha !== blob_sha) {
+            throw new RuntimeError(`law_bytes_mismatch: the seat-supplied blob_sha for law ${law.path} (${law.blob_sha}) disagrees with the engine (${blob_sha}). A seat's claim is refused, never overwritten. Nothing is sealed.`);
+        }
+        if (law.tests !== undefined && (law.tests.length !== tests.length || law.tests.some((t, i) => t !== tests[i]))) {
+            throw new RuntimeError(`law_bytes_mismatch: the seat-supplied tests for law ${law.path} disagree with the titles git holds in that blob. A seat's claim is refused, never overwritten. Nothing is sealed.`);
+        }
+        return { path: law.path, commit: law.commit, blob_sha, tests };
+    });
+}
+/**
+ * Stamp each change's `blob_sha` (`git hash-object` of the file in `tree_root`, or the literal
+ * `"deleted"` when the file is absent from the tree), `patch_sha256` (sha256 of `git diff <base> --
+ * <path>` in `tree_root`) and `bytes` (that diff's length) from a supplied `{path, base}`.
+ * REFUSALS: no `tree_root` → `tree_root_unknown`; a seat-supplied `blob_sha`/`patch_sha256`/`bytes`
+ * that disagrees with git → `law_bytes_mismatch` naming the path and field.
+ */
+export function stampChangeAddresses(changes, tree_root) {
+    if (tree_root === undefined) {
+        throw new RuntimeError("tree_root_unknown: a change-set carrying `changes` cannot be stamped without a RunDeps.tree_root — the seal reads git objects from a named tree and never falls back to process.cwd().");
+    }
+    return changes.map((change) => {
+        const blob_sha = existsSync(joinPath(tree_root, change.path))
+            ? gitInTree(tree_root, ["hash-object", change.path]).trim()
+            : "deleted";
+        const diff = gitInTree(tree_root, ["diff", change.base, "--", change.path]);
+        const patch_sha256 = sha256Hex(diff);
+        const bytes = Buffer.byteLength(diff, "utf8");
+        if (change.blob_sha !== undefined && change.blob_sha !== blob_sha) {
+            throw new RuntimeError(`law_bytes_mismatch: the seat-supplied blob_sha for change ${change.path} (${change.blob_sha}) disagrees with the engine (${blob_sha}). A seat's claim is refused, never overwritten. Nothing is sealed.`);
+        }
+        if (change.patch_sha256 !== undefined && change.patch_sha256 !== patch_sha256) {
+            throw new RuntimeError(`law_bytes_mismatch: the seat-supplied patch_sha256 for change ${change.path} disagrees with the sha256 of the real diff. A seat's claim is refused, never overwritten. Nothing is sealed.`);
+        }
+        if (change.bytes !== undefined && change.bytes !== bytes) {
+            throw new RuntimeError(`law_bytes_mismatch: the seat-supplied bytes for change ${change.path} (${change.bytes}) disagrees with the engine (${bytes}). A seat's claim is refused, never overwritten. Nothing is sealed.`);
+        }
+        return { path: change.path, base: change.base, blob_sha, patch_sha256, bytes };
+    });
 }
 // Deterministic hash over the definitions a gig touches: the standard + its agents,
 // in a canonical (sorted, JCS) form. This is the reproducibility key — same defs,
@@ -372,8 +492,32 @@ export async function runGig(standard, gigInput, deps) {
     // only granularity that means anything. Returns whether THIS chair ever reported usage.
     const makeUsageSink = () => {
         let saw = false;
+        let sawCost = false;
+        // contract-spend-survives-v1 (O1/I1) — this chair's own settled usage, accumulated ALONGSIDE the
+        // gig-wide `usage` fold below so the per-chair rows reconcile to the gig total by construction.
+        const chairOwnUsage = { input_tokens: 0, output_tokens: 0, total_cost_usd: 0, by_model: {} };
+        // Per-chair, alongside the gig-level fold. The gig's `by_model` cannot separate two chairs in
+        // one run, which is exactly the question per-chair routing asks. Output tokens per model id,
+        // accumulated across this chair's `result` events; `workingModel` picks the one that did the
+        // work (the argmax) at report time rather than trusting the CLI's first key.
+        const chairOutputByModel = new Map();
+        let chairCost = 0;
+        let chairTokens = 0;
+        let chairSaw = false;
         return {
             attributed: () => saw,
+            reportedCost: () => sawCost,
+            usage: () => (chairSaw ? chairOwnUsage : undefined),
+            reported: () => {
+                if (!chairSaw)
+                    return {};
+                const model = workingModel(chairOutputByModel);
+                return {
+                    ...(model !== undefined ? { model } : {}),
+                    cost_usd: chairCost,
+                    tokens_used: chairTokens,
+                };
+            },
             fold(ev) {
                 if (ev.type !== "result")
                     return;
@@ -393,17 +537,42 @@ export async function runGig(standard, gigInput, deps) {
                 // number this engine could produce about money.
                 if (!hasCost && !hasTokens && !hasBreakdown)
                     return;
+                chairSaw = true;
+                if (hasCost)
+                    sawCost = true;
+                chairTokens +=
+                    (typeof inRaw === "number" ? inRaw : 0) + (typeof outRaw === "number" ? outRaw : 0);
+                chairCost += hasCost ? costRaw : 0;
                 usage.input_tokens += typeof inRaw === "number" ? inRaw : 0;
                 usage.output_tokens += typeof outRaw === "number" ? outRaw : 0;
                 usage.total_cost_usd += hasCost ? costRaw : 0;
+                // The SAME fold, kept per-chair for the durable chair_spend row (O1/I1). Summing every
+                // chair's own usage reconstructs the gig-wide `usage` above, which is what I1 pins.
+                chairOwnUsage.input_tokens += typeof inRaw === "number" ? inRaw : 0;
+                chairOwnUsage.output_tokens += typeof outRaw === "number" ? outRaw : 0;
+                chairOwnUsage.total_cost_usd += hasCost ? costRaw : 0;
                 // Per-model breakdown keyed by the ACTUAL model id that ran (not the configured tier).
                 if (hasBreakdown) {
                     for (const [model, m] of Object.entries(mu)) {
+                        const outTok = typeof m["outputTokens"] === "number" ? m["outputTokens"] : 0;
                         const slot = usage.by_model[model] ?? { input_tokens: 0, output_tokens: 0, cost_usd: 0 };
                         slot.input_tokens += typeof m["inputTokens"] === "number" ? m["inputTokens"] : 0;
-                        slot.output_tokens += typeof m["outputTokens"] === "number" ? m["outputTokens"] : 0;
+                        slot.output_tokens += outTok;
                         slot.cost_usd += typeof m["costUSD"] === "number" ? m["costUSD"] : 0;
                         usage.by_model[model] = slot;
+                        // Per-chair by_model, keyed the same way, so the chair_spend row's own breakdown stands
+                        // on its own rather than pointing back at the gig-wide total.
+                        const cslot = chairOwnUsage.by_model[model] ?? { input_tokens: 0, output_tokens: 0, cost_usd: 0 };
+                        cslot.input_tokens += typeof m["inputTokens"] === "number" ? m["inputTokens"] : 0;
+                        cslot.output_tokens += outTok;
+                        cslot.cost_usd += typeof m["costUSD"] === "number" ? m["costUSD"] : 0;
+                        chairOwnUsage.by_model[model] = cslot;
+                        // The stamp is the model that WROTE this chair's output, decided at report time by
+                        // `workingModel` (argmax over output tokens). The CLI lists a fast background call's
+                        // model FIRST though it writes almost nothing, so the old first-key `??=` stamped a
+                        // model that did none of the work. Accumulate per-model output; the gig-level `by_model`
+                        // total above is untouched.
+                        chairOutputByModel.set(model, (chairOutputByModel.get(model) ?? 0) + outTok);
                     }
                 }
                 else {
@@ -550,41 +719,38 @@ export async function runGig(standard, gigInput, deps) {
         // idempotent, which is what makes it safe on this path. No merge conflict; tsc caught it.
         throw new GigAborted(gig_id, reason, finalizeUsage(), produced);
     };
-    // Budget state. When deps.budget is undefined, enforcement is OFF (back-compat).
-    // When present, we track an in-memory BudgetState mirroring budget-state.json.
-    // #turn-budget — the gig reserve pool opens from the dispatch payload FIRST, then the standard's
-    // default, then 0. `??` (not max/sum) so the dispatch declaration wins deterministically when both
-    // are present and absent stays distinct from a declared 0.
-    const poolOpening = deps.budget?.pool ?? standard.reserve_pool ?? 0;
-    const budget = deps.budget
+    // Budget state (budget-in-dollars). A DOLLAR ceiling is in play iff `deps.budget.max_usd` is set;
+    // a TURN POOL is in play iff `turn_pool` or `Standard.reserve_pool` names one. The snapshot exists
+    // whenever EITHER is present (O6): pool fields always, dollar fields only under a ceiling.
+    //
+    // O6 — the pool opens from RunDeps.turn_pool FIRST, then the standard default. `??` (not max/sum)
+    // so the dispatch declaration wins deterministically, and absence stays distinct from a declared 0.
+    const maxUsd = deps.budget?.max_usd;
+    const hasCeiling = typeof maxUsd === "number";
+    const poolSource = deps.turn_pool ?? standard.reserve_pool; // undefined when neither names one
+    const poolInPlay = poolSource !== undefined;
+    const poolOpening = poolSource ?? 0;
+    const budget = (hasCeiling || poolInPlay)
         ? {
-            opening: deps.budget.opening,
-            spent: 0,
-            credit: 0,
-            balance: deps.budget.opening,
             agent_state: "active",
             depleted_agent: null,
             depleted_at: null,
-            base_cost: deps.budget.base_cost ?? 1,
-            k: deps.budget.k ?? 0.1,
-            unit: "append-units",
-            settled_usd: 0,
             pool_remaining: poolOpening,
             draws: [],
+            ...(hasCeiling ? { max_usd: maxUsd, spent_usd: 0, unit: "usd" } : {}),
         }
         : null;
-    // #turn-budget — reserve turns HELD by prepared-but-not-yet-settled chairs, the pool's mirror of
-    // the append-unit `reserved` above. `prepareChair` runs synchronously for the whole ready batch
-    // before any invoke, so an offer computed against `pool_remaining - poolReserved` cannot let two
-    // parallel chairs over-lend the same turns. A grant converts the hold to a real draw-down; a
-    // no-draw or denial releases it. Conservation therefore holds for every ordering, not by luck.
+    // #turn-budget — reserve turns HELD by prepared-but-not-yet-settled chairs. `prepareChair` runs
+    // synchronously for the whole ready batch before any invoke, so an offer computed against
+    // `pool_remaining - poolReserved` cannot let two parallel chairs over-lend the same turns. A grant
+    // converts the hold to a real draw-down; a no-draw or denial releases it. Conservation therefore
+    // holds for every ordering, not by luck.
     let poolReserved = 0;
-    // #232 — cost RESERVED by chairs that passed the gate but have not settled. `prepareChair`
-    // runs eagerly for the whole ready batch, so the gate must see its batch siblings' holds;
-    // but a hold is not spend. It converts to `spent` only when the invocation succeeds, and is
-    // released (never charged) when it fails or when a later sibling trips the gate and the
-    // batch is abandoned before a single invoker is called.
-    let reserved = 0;
+    // F3 — under a ceiling, the agent slugs of chairs that SETTLED (reported usage) but reported NO
+    // usd. Their dollar spend is unknown, so the next batch cannot be verified affordable and must not
+    // start; this list is what BudgetUnverifiable names. A fully-stubbed chair that reports no usage at
+    // all is not here — that is every no-cost test fixture, and it completes as before.
+    const unverifiedChairs = [];
     // Resolve agent-by-slug once.
     const agentBySlug = new Map(standard.agents.map((a) => [a.slug, a]));
     // ── dispatch preflight: the UNIFIED t=0 dead-reference sweep ────────────────
@@ -1036,7 +1202,11 @@ export async function runGig(standard, gigInput, deps) {
                     const core = deps.outputs.coreTypeOf(domain_type) ?? domain_type;
                     const primitive = CORE_TO_PRIMITIVE[core] ?? "JUDGE";
                     const approvalInputs = hc.depends_on.flatMap((d) => producedByRole.get(d) ?? []);
-                    const t0 = Date.now();
+                    // contract-seat-time-monotonic-v1 (O2) — seat time is measured on the monotonic clock
+                    // (performance.now), never Date.now: a wall-clock jump during the seat (lid sleep, NTP step)
+                    // is machine time, not seat time. Rounded to whole ms at the difference, since performance.now
+                    // is fractional.
+                    const t0 = performance.now();
                     emit({ type: "chair_start", phase: phase.name, role: hc.role, producer: deps.approved_by ?? "human" });
                     const rec = deps.outputs.write({
                         core_type: core,
@@ -1057,7 +1227,9 @@ export async function runGig(standard, gigInput, deps) {
                     produced.push(rec);
                     emit({
                         type: "chair_complete", phase: phase.name, role: hc.role, producer: deps.approved_by ?? "human",
-                        output_types: [domain_type], duration_ms: Date.now() - t0,
+                        output_types: [domain_type], duration_ms: Math.round(performance.now() - t0),
+                        // A human seat forwards no agent write events, so there is nothing to measure: null, not 0.
+                        first_write_ms: null, context_tokens_at_first_write: null,
                     });
                     // A sealed lineage-verdict either grounds an institution or does not. Decide it here,
                     // where the verdict and the record it approved are both in hand, and report the answer
@@ -1126,6 +1298,27 @@ export async function runGig(standard, gigInput, deps) {
                     const chosenRoles = new Set(chosen.map((c) => c.role));
                     ready = ready.filter((c) => chosenRoles.has(c.role));
                 }
+                // ── BUDGET BATCH-BOUNDARY GATE (O2/F3) ──────────────────────────────────────────────────
+                // The dollar ceiling is checked HERE, before this ready batch starts, against SETTLED spend
+                // (reconciled at each prior batch boundary). The batch already running is never interrupted;
+                // it is the NEXT batch that does not start. Two fail-closed conditions, both naming the chair
+                // that would have run next:
+                //   F3 — a prior settled invocation reported no usd, so affordability is UNVERIFIABLE; and
+                //   O2 — settled spend has reached max_usd.
+                if (hasCeiling && budget) {
+                    if (unverifiedChairs.length > 0) {
+                        budget.agent_state = "depleted";
+                        budget.depleted_agent = ready[0]?.agent_slug ?? null;
+                        budget.depleted_at = new Date().toISOString();
+                        throw new BudgetUnverifiable([...unverifiedChairs], budget);
+                    }
+                    if ((budget.spent_usd ?? 0) >= maxUsd) {
+                        budget.agent_state = "depleted";
+                        budget.depleted_agent = ready[0]?.agent_slug ?? null;
+                        budget.depleted_at = new Date().toISOString();
+                        throw new BudgetExhausted(ready[0]?.agent_slug ?? "?", budget.spent_usd ?? 0, maxUsd, budget);
+                    }
+                }
                 // Per-chair work happens in two stages so non-invocation failures
                 // (BudgetExhausted, contract violations, programming-level errors like
                 // TypeError from a circular gig_input) propagate UNWRAPPED through the
@@ -1151,11 +1344,11 @@ export async function runGig(standard, gigInput, deps) {
                         noteCheckpointRole(ch.role, phase.name, r.value);
                     }
                 }
-                // #233 — BATCH BOUNDARY is the only point at which real settled dollars can be
-                // reconciled into the budget: prepareChair ran for every chair in this batch before any
-                // of them was invoked, so no chair could have seen its siblings' cost. Reporting only.
-                if (budget)
-                    budget.settled_usd = usage.total_cost_usd;
+                // O2 — BATCH BOUNDARY reconcile: the settled dollars this batch added are folded into the
+                // snapshot here, so the NEXT batch's gate (top of the while loop) sees them. prepareChair ran
+                // for every chair in this batch before any was invoked, so no chair saw its siblings' cost.
+                if (budget && hasCeiling)
+                    budget.spent_usd = usage.total_cost_usd;
                 // Bank progress BEFORE the failure throw below. A batch whose siblings succeeded has
                 // durable outputs either way; the checkpoint is what makes them reachable next time,
                 // and writing it only on the happy path would forfeit exactly the runs that need it.
@@ -1186,7 +1379,14 @@ export async function runGig(standard, gigInput, deps) {
             if (examineRounds > 0) {
                 const allChairs = standard.phases.flatMap((p) => p.chairs);
                 const phaseNameOf = (role) => standard.phases.find((p) => p.chairs.some((c) => c.role === role))?.name ?? phase.name;
-                const primitivesOf = (slug) => standard.agents.find((a) => a.slug === slug)?.primitives ?? [];
+                // O3 — a verify SEAT is a chair whose output resolves to core type Verdict, whatever produces
+                // it (agent or skill chair). Keying on the agent's VERIFY primitive (as this did) meant a
+                // skill-backed verify chair sealing `pass: false` never triggered an amend: a skill chair
+                // binds no agent, so it has no primitive to match.
+                const producesVerdict = (c) => {
+                    const out = c.output_contract[0];
+                    return !!out && (deps.outputs.coreTypeOf(out) ?? "") === "Verdict";
+                };
                 const dropFromProduced = (recs) => {
                     for (const r of recs) {
                         const idx = produced.indexOf(r);
@@ -1197,7 +1397,7 @@ export async function runGig(standard, gigInput, deps) {
                 const failingVerdict = (role) => (producedByRole.get(role) ?? []).find((r) => (deps.outputs.coreTypeOf(r.domain_type) ?? "") === "Verdict" &&
                     r.data.pass === false);
                 for (const vch of phase.chairs) {
-                    if (!primitivesOf(vch.agent_slug).includes("VERIFY"))
+                    if (!producesVerdict(vch))
                         continue;
                     let verdict = failingVerdict(vch.role);
                     if (!verdict)
@@ -1210,11 +1410,35 @@ export async function runGig(standard, gigInput, deps) {
                         const out = c.output_contract[0];
                         return !!out && (deps.outputs.coreTypeOf(out) ?? "") === "Artifact";
                     };
-                    const makers = vch.depends_on
+                    const makerSet = vch.depends_on
                         .map((role) => allChairs.find((c) => c.role === role))
                         .filter((c) => !!c && producesArtifact(c));
-                    if (makers.length === 0)
+                    if (makerSet.length === 0)
                         continue; // nothing to re-run — a verify with no maker to amend
+                    // contract-amend-nearest-makers-v1 (O1/I1/F1) — an amend round spends a seat ONLY where the
+                    // verdict's fix can land. Of today's maker set, re-invoke only the makers that no OTHER maker in
+                    // the set depends on, directly or transitively through depends_on. An upstream maker's inputs do
+                    // not change between rounds, so re-running it re-does settled work AND replaces the exact record
+                    // the downstream fix was built on (its sealed record must instead be carried unchanged — O2:
+                    // producedByRole still holds it, and the amend loop below never touches a skipped maker's role,
+                    // so prepareChair gathers it as-is). Independent makers keep no dependant in the set, so they all
+                    // re-run as today (I1). A composed standard's depends_on graph is acyclic, so the maker set always
+                    // has at least one sink — the narrowed selection is never empty and never the whole set (F1).
+                    const chairByRole = new Map(allChairs.map((c) => [c.role, c]));
+                    const transitiveDepsOf = (role) => {
+                        const seen = new Set();
+                        const stack = [...(chairByRole.get(role)?.depends_on ?? [])];
+                        while (stack.length > 0) {
+                            const r = stack.pop();
+                            if (seen.has(r))
+                                continue;
+                            seen.add(r);
+                            for (const d of chairByRole.get(r)?.depends_on ?? [])
+                                stack.push(d);
+                        }
+                        return seen;
+                    };
+                    const makers = makerSet.filter((m) => !makerSet.some((other) => other.role !== m.role && transitiveDepsOf(other.role).has(m.role)));
                     for (let round = 1; round <= examineRounds && verdict; round++) {
                         checkpoint();
                         emit({ type: "phase_start", phase: `${phase.name}:amend#${round}`, roles: [...makers.map((m) => m.role), vch.role] });
@@ -1222,24 +1446,42 @@ export async function runGig(standard, gigInput, deps) {
                         // AMEND: each maker re-runs with the failing verdict fed in as an extra input, so
                         // the seat that built the change fixes the exact thing the verify caught.
                         for (const mk of makers) {
-                            const prep = prepareChair(mk, phaseNameOf(mk.role));
-                            if (!prep.inputs.includes(feedback))
-                                prep.inputs.push(feedback);
+                            // O1/I3 — carry the maker's OWN work from the round just judged, plus the failing
+                            // verdict, INTO prepareChair, so both are among `inputs` when lookupReuse computes the
+                            // key. Pushing the verdict in AFTER prep (as this did) left the amend key identical to
+                            // round 1's, so a reuse-wired amend was served round 1's failing artifact from the
+                            // cache. producedByRole holds ONLY the round just judged, so the amend carries exactly
+                            // one prior artifact and one verdict, both the latest — never a pile of drafts.
+                            const priorWork = producedByRole.get(mk.role) ?? [];
+                            // contract-chair-session-continuity-v1 (O3/O5) — an amend RESUMES the maker's own session
+                            // (the invoker gets ctx.resume) and is never served from the reuse cache.
+                            // O1 — the initial invocation is round 1 (the default), so the amend loop's iteration
+                            // `round` (1-based) stamps round `round + 1`: each re-run of a seat gets a distinct,
+                            // monotonic round and no two chair_spend rows for one role collide.
+                            const prep = prepareChair(mk, phaseNameOf(mk.role), [...priorWork, feedback], { resume: true, round: round + 1 });
                             const recs = await invokeAndWriteChair(prep);
                             dropFromProduced(producedByRole.get(mk.role) ?? []);
                             producedByRole.set(mk.role, recs);
                             produced.push(...recs);
                             noteCheckpointRole(mk.role, phaseNameOf(mk.role), recs);
                         }
-                        // RE-VERIFY the amended artifact.
-                        const vprep = prepareChair(vch, phase.name);
+                        // RE-VERIFY the amended artifact. contract-resumed-gig-session-v1 (O1/I1) — the re-verify
+                        // RESUMES the verifier's own round-one session (`resume: true`), never re-opens `--session-id`
+                        // for a live id: the id is deterministic in (gig_id, role), so a second `--session-id` open
+                        // collides ("already in use"). Resuming carries `--resume <uuid>` instead. `keep_prompt` keeps
+                        // the FULL prompt rather than the maker's trimmed amend continuation: unlike a maker (whose
+                        // failing verdict IS the one new thing to send), a re-verify re-reads the amended tree from its
+                        // own identity, and a stateless door (chat-completions) that holds no conversation must still
+                        // carry the verify seat's identity — the trimmed continuation would strip it. buildInvokerArgs
+                        // still emits `--resume` (it keys on `resume`, not the prompt), so O1's arg law holds.
+                        const vprep = prepareChair(vch, phase.name, [], { resume: true, keep_prompt: true, round: round + 1 });
                         const vrecs = await invokeAndWriteChair(vprep);
                         dropFromProduced(producedByRole.get(vch.role) ?? []);
                         producedByRole.set(vch.role, vrecs);
                         produced.push(...vrecs);
                         noteCheckpointRole(vch.role, phase.name, vrecs);
-                        if (budget)
-                            budget.settled_usd = usage.total_cost_usd;
+                        if (budget && hasCeiling)
+                            budget.spent_usd = usage.total_cost_usd;
                         saveCheckpoint();
                         verdict = failingVerdict(vch.role); // undefined once it passes → loop ends
                     }
@@ -1350,6 +1592,28 @@ export async function runGig(standard, gigInput, deps) {
             }
             return { key, hit: { cache_key: key, source_gig_id: entry.source_gig_id, outputs: entry.outputs } };
         }
+        /**
+         * contract-seat-primer-v1 (O2/I3) — the MOST RECENT `seat-primer` this agent sealed for `area`,
+         * across gigs. Agent-specific by construction: a chair never forks a primer sealed by a DIFFERENT
+         * agent, even for the same area (I3), because the (agent_slug, area) filter admits only its own.
+         * "Most recent" so re-priming an area updates every later fork — staleness is decided per blob at
+         * fork time, not pinned to one primer id. Returns undefined when the agent has never primed the area.
+         */
+        function mostRecentSeatPrimer(agentSlug, area) {
+            let best;
+            for (const r of deps.outputs.all()) {
+                if (r.domain_type !== "seat-primer")
+                    continue;
+                const d = r.data;
+                if (d["agent_slug"] !== agentSlug || d["area"] !== area)
+                    continue;
+                // `>=` prefers the later-iterated record on an equal timestamp; all() is insertion-ordered, so
+                // the newest primer wins even when two sealed in the same millisecond.
+                if (!best || r.created_at >= best.created_at)
+                    best = r;
+            }
+            return best;
+        }
         /**
          * Offer an ENTRY chair the seeds a chart edge carried in.
          *
@@ -1369,7 +1633,7 @@ export async function runGig(standard, gigInput, deps) {
                 seedsConsumed.set(s.id, s);
             }
         }
-        function prepareChair(chair, phaseName) {
+        function prepareChair(chair, phaseName, extraInputs = [], opts = {}) {
             // A skill-backed chair runs the skill's deterministic code half — no agent, no model.
             if (chair.skill_slug && (chair.agent_slug ?? "") === "") {
                 const dir = deps.skill_dirs?.get(chair.skill_slug);
@@ -1388,6 +1652,11 @@ export async function runGig(standard, gigInput, deps) {
                     inputs.push(...recs);
                 }
                 pullSeeds(chair, inputs, chair.input_contract);
+                // Amend carriage: extra inputs (the maker's own prior work + the failing verdict) join the
+                // frontier so they enter the reuse key — see the EXAMINE⇄AMEND block. Empty otherwise.
+                for (const ex of extraInputs)
+                    if (!inputs.includes(ex))
+                        inputs.push(ex);
                 if (chair.input_contract.length > 0) {
                     for (const need of chair.input_contract) {
                         // #156: a type satisfied by an upstream record OR by the gig payload (entry-chair seed).
@@ -1425,6 +1694,7 @@ export async function runGig(standard, gigInput, deps) {
                     producer_slug: chair.skill_slug, domain: standard.domain,
                     ...(skillReuse ? { reuse_key: skillReuse.key } : {}),
                     ...(skillReuse?.hit ? { reuse_hit: skillReuse.hit } : {}),
+                    ...(opts.round !== undefined ? { round: opts.round } : {}),
                 };
             }
             const agent = standard.agents.find((a) => a.slug === chair.agent_slug);
@@ -1477,6 +1747,14 @@ export async function runGig(standard, gigInput, deps) {
                 // upstream record — by type, as records, so provenance survives the movement boundary.
                 pullSeeds(chair, inputs, [...chair.input_contract, ...agent.input_types]);
             }
+            // Amend carriage (O1/I3): the maker's own round-just-judged artifact and the failing verdict are
+            // threaded in as extra inputs so they enter `inputs` BEFORE lookupReuse — the amend key then
+            // describes what the maker actually receives, and a reuse-wired amend is no longer served round
+            // 1's failing artifact from the cache. Empty on every non-amend prep, so round-1 keys stay
+            // byte-identical (the I1 control).
+            for (const ex of extraInputs)
+                if (!inputs.includes(ex))
+                    inputs.push(ex);
             // Runtime input_contract check: every type the chair declares it expects
             // on input must be satisfied by its actual upstream inputs. Subtype-aware
             // (docs/genome-extension.md): a core-type requirement is met by any domain
@@ -1563,36 +1841,88 @@ export async function runGig(standard, gigInput, deps) {
             // context, so charging it (or worse, refusing it for lack of allowance) would be the budget
             // enforcing a cost that is not going to be incurred.
             const lookup = lookupReuse({ chair, phaseName, inputs, output_specs, agent, skills, producer_slug: agent.slug, domain });
-            // BUDGET GATE — pre-invocation, and a RESERVATION only (#232). Synchronous so
-            // BudgetExhausted (and a TypeError thrown from JSON.stringify on a circular gig_input)
-            // propagate unwrapped to the caller rather than being aggregated as a chair failure.
-            //
-            // The gate compares against `balance - reserved` so a batch of parallel chairs cannot each
-            // spend the same balance; the hold converts to `spent` only in settleChairCost, after the
-            // invoker actually returns. Before this, `spent += cost` happened HERE — so when a later
-            // member of an eagerly-prepared batch tripped the gate, every earlier member was already
-            // charged and `invokeAndWriteChair` then ran for nobody. The operator saw spend for work
-            // that never started, and that inflated figure is what BudgetExhausted.state reported.
-            let reservedCost;
-            if (budget && !lookup?.hit) {
-                const cost = computeAppendCost({ agent, phase: phaseName, inputs, gig_input: gigInput }, budget.base_cost, budget.k);
-                const available = budget.balance - reserved;
-                if (available < cost) {
-                    budget.agent_state = "depleted";
-                    budget.depleted_agent = agent.slug;
-                    budget.depleted_at = new Date().toISOString();
-                    throw new BudgetExhausted(agent.slug, available, cost, budget);
+            // contract-seat-primer-v1 (O2/O3/O4/F1) — FORK WIRING. A chair with fork_from looks up the most
+            // recent seat-primer for (its agent, area) across gigs and warm-starts from it. Resolved here so
+            // the reuse gate below can withhold the hit (O5) and so the invocation carries the primer session
+            // and the blob-stale paths. A fork with NO primer (F1) records `primer_missing` and runs cold.
+            let fork;
+            let fork_fallback;
+            if (chair.fork_from) {
+                const area = chair.fork_from.primer;
+                const primer = mostRecentSeatPrimer(agent.slug, area);
+                if (!primer) {
+                    fork_fallback = "primer_missing";
+                }
+                else {
+                    const pd = primer.data;
+                    // contract-rolling-seat-primer-v1 (O4/I1) — a `max_context_tokens` ceiling REPLACES a bloated
+                    // primer instead of forking it: when the primer's recorded context size exceeds the ceiling, the
+                    // chair does NOT fork — it runs COLD (a fresh `--session-id`, its full prompt) and records
+                    // `primer_too_large`. Absent ceiling (I1) → the fork happens whatever the size, so size gates the
+                    // fork ONLY through this ceiling.
+                    const ceiling = chair.fork_from.max_context_tokens;
+                    const primer_context = typeof pd["context_tokens"] === "number" ? pd["context_tokens"] : 0;
+                    if (ceiling !== undefined && primer_context > ceiling) {
+                        fork_fallback = "primer_too_large";
+                    }
+                    else {
+                        // O4 — staleness is decided by BLOBS against the working tree, through the SAME gitInTree seam
+                        // the law/change stampers use. A file git can no longer hash (removed since priming) is stale.
+                        const files = Array.isArray(pd["files"]) ? pd["files"] : [];
+                        const stale_paths = files
+                            .filter((f) => {
+                            if (deps.tree_root === undefined)
+                                return false;
+                            let current;
+                            try {
+                                current = gitInTree(deps.tree_root, ["hash-object", f.path]).trim();
+                            }
+                            catch {
+                                return true;
+                            }
+                            return current !== f.blob_sha;
+                        })
+                            .map((f) => f.path);
+                        fork = {
+                            primer_session_id: String(pd["session_id"] ?? ""),
+                            primer_id: primer.id,
+                            primer_commit: String(pd["commit"] ?? ""),
+                            stale_paths,
+                            // contract-rolling-seat-primer-v1 (O2) — carry the forked primer's own files so a prime+fork
+                            // chair can seal a fresher primer unioning them with this seat's reads.
+                            primer_files: files,
+                            // contract-primer-reading-frontier-v1 (O2/F2) — the primer's recorded reading frontier, so the
+                            // fork's first spawn cuts the resumed conversation there. Absent ⇒ the whole session resumes.
+                            ...(typeof pd["frontier"] === "string" ? { frontier: pd["frontier"] } : {}),
+                        };
+                    }
                 }
-                reserved += cost;
-                reservedCost = cost;
             }
+            // contract-chair-session-continuity-v1 (O5) — a RESUMED (amend-round) invocation is NEVER served
+            // from the reuse cache: the seat resumes its own conversation, which carries what the failing
+            // verdict prompted it to reconsider, and none of that is in the reuse key. Serving the cached
+            // artifact would replay the very work the amend exists to redo. The key is still kept below (the
+            // amend's own output is cacheable on the round-one terms), only the HIT is withheld.
+            // contract-seat-primer-v1 (O5) — the SAME withholding for a FORK: a warm-started conversation the
+            // reuse key cannot describe would replay the very reading the fork exists to reuse. The hit is
+            // withheld here AND recorded (below, in executeChair) so the cache-was-live signal survives — a
+            // fork always invokes, even on a key that would otherwise hit.
+            const effectiveHit = (opts.resume || fork) ? undefined : lookup?.hit;
+            // O5 — record the withheld fork hit so executeChair marks the cache LIVE without serving it.
+            const fork_reuse_withheld = fork && lookup?.hit
+                ? { cache_key: lookup.hit.cache_key, source_gig_id: lookup.hit.source_gig_id, output_types: lookup.hit.outputs.map((o) => o.domain_type) }
+                : undefined;
+            // BUDGET GATE — the append-unit pre-invocation gate is GONE (O3). Payload size / base_cost / k
+            // no longer decide whether a chair runs. The dollar ceiling is enforced against SETTLED spend at
+            // BATCH BOUNDARIES (O2, in the dispatch loop), not per-chair here. This block now only computes
+            // the reserve OFFER against the gig pool.
             // #turn-budget — RESERVE OFFER. Only a chair that DECLARED a `turn_reserve` reaches for the pool;
             // one that declared none threads no ctx.turn_reserve, so the invoker's own opts-level reserve is
-            // undisturbed (the #329 continuation path). When a budget is enforced the offer is capped to what
-            // the pool can still lend (min(own reserve, pool_remaining - poolReserved)) and HELD; with no
-            // budget there is no pool to cap against, so the declared reserve threads through directly.
+            // undisturbed (the #329 continuation path). When a pool is in play the offer is capped to what it
+            // can still lend (min(own reserve, pool_remaining - poolReserved)) and HELD; with no pool at all
+            // (`budget` null) the declared reserve threads through directly.
             let reserveOffer;
-            if (chair.turn_reserve !== undefined && !lookup?.hit) {
+            if (chair.turn_reserve !== undefined && !effectiveHit) {
                 if (budget) {
                     const poolAvailable = Math.max(0, budget.pool_remaining - poolReserved);
                     reserveOffer = Math.min(chair.turn_reserve, poolAvailable);
@@ -1605,42 +1935,23 @@ export async function runGig(standard, gigInput, deps) {
             return {
                 chair, phaseName, agent, primitive, domain_type, output_specs, inputs, skills,
                 missing_skills: missing, producer_slug: agent.slug, domain,
-                ...(reservedCost !== undefined ? { cost: reservedCost } : {}),
                 ...(reserveOffer !== undefined ? { reserve_offer: reserveOffer } : {}),
                 ...(lookup ? { reuse_key: lookup.key } : {}),
-                ...(lookup?.hit ? { reuse_hit: lookup.hit } : {}),
+                ...(effectiveHit ? { reuse_hit: effectiveHit } : {}),
+                ...(opts.resume ? { resume: true } : {}),
+                ...(opts.keep_prompt ? { resume_keep_prompt: true } : {}),
+                ...(opts.round !== undefined ? { round: opts.round } : {}),
+                ...(fork ? { fork } : {}),
+                ...(fork_fallback !== undefined ? { fork_fallback } : {}),
+                ...(fork_reuse_withheld ? { fork_reuse_withheld } : {}),
             };
         }
-        // #232 — convert a chair's reservation into settled spend, or release it. `spent` moves ONLY
-        // for a chair whose invocation actually returned, which is what the budget contract always
-        // claimed. A chair that was prepared and then never invoked (its batch sibling tripped the
-        // gate) never reaches here at all — so it is never charged, which is the point.
-        function settleChairCost(p, succeeded) {
-            if (!budget || p.cost === undefined)
-                return;
-            reserved -= p.cost;
-            if (!succeeded)
-                return;
-            budget.spent += p.cost;
-            budget.balance = budget.opening - budget.spent + budget.credit;
-        }
         // Stage 2 — actual invocation + post-invocation output_contract check + write.
         // Errors here ARE aggregated by Promise.allSettled and surfaced as a phase-
-        // level RuntimeError naming every failing chair role.
-        //
-        // The thin wrapper is where a chair's budget RESERVATION settles (#232): a hold becomes
-        // `spent` on success and is released on failure. Both paths must run, so the accounting
-        // cannot drift no matter how the chair ends.
+        // level RuntimeError naming every failing chair role. There is no per-chair budget
+        // reservation to settle any more — the ceiling is a batch-boundary check on settled USD.
         async function invokeAndWriteChair(p) {
-            try {
-                const written = await executeChair(p);
-                settleChairCost(p, true);
-                return written;
-            }
-            catch (e) {
-                settleChairCost(p, false);
-                throw e;
-            }
+            return executeChair(p);
             // THE ROOM IS NOT TORN DOWN HERE. It used to be, in this chair-level `finally`, described as
             // "idempotent and a no-op when no venue was named". Idempotent yes; a no-op no —
             // `src/venue_realize.ts` sets `torn = true`, and `canReach()` is `!torn && egress.includes(...)`.
@@ -1655,8 +1966,55 @@ export async function runGig(standard, gigInput, deps) {
             // on both the success and failure paths — see the `finally` on runGig's outer try.
         }
         async function executeChair(p) {
+            // What the transport SAID about this chair, hoisted out of the invocation block so the seal
+            // can prefer a measurement over the tier table's guess. Empty for a skill-backed chair.
+            let chairReport = {};
             const { chair, phaseName, inputs, skills, output_specs, producer_slug, domain } = p;
-            const t0 = Date.now();
+            // contract-seat-time-monotonic-v1 (O1) — the chair's timings (first_write_ms, duration_ms below)
+            // are monotonic differences (performance.now), never Date.now: a wall-clock jump mid-chair is
+            // machine time, not seat time. Rounded to whole ms at each difference, since performance.now is
+            // fractional.
+            const t0 = performance.now();
+            // #seat-metrics — the seat's FIRST write and the context it carried then, measured from the
+            // chair's forwarded agent events (below). Null until a write happens; a chair that never writes
+            // (or forwards no events, like a skill chair) leaves both null.
+            let firstWriteMs = null;
+            let contextAtFirstWrite = null;
+            let lastAssistantContext = null;
+            // #seat-effort (O5) — the effort the model chair resolved to, captured at the invoke ctx site
+            // (below) so the chair_complete emit can record what the seat ran at. Stays undefined for a skill
+            // chair, which runs no model at an effort.
+            let resolvedEffort;
+            // contract-amend-resume-prompt-v1 (F1) — set when the invoker reports a resume whose session was
+            // gone and fell back cold (the `resume_fallback` stream event). Recorded on chair_complete so the
+            // fallback is observable rather than a resume the record falsely claims happened.
+            let resumeFellBack = false;
+            // contract-resumed-gig-session-v1 (O3) — set when the invoker RESUMED a collided --session-id open
+            // (the `resume_on_collision` stream event): a first spawn whose deterministic session id was already
+            // in use continued the conversation instead of failing. `p.resume` is false on such a spawn (it is a
+            // first open, not an amend), so this is what makes chair_complete record the continuation truthfully.
+            let resumedOnCollision = false;
+            // contract-seat-primer-v1 (O1/I2) — the files a PRIME seat Read, captured from the invoker's
+            // forwarded `seat_reads` event, so the seat-primer is sealed from exactly what the seat read.
+            let primerReads;
+            // contract-rolling-seat-primer-v1 (O3) — the context size (input+cache_read+cache_creation) of the
+            // LAST usage the seat reported, captured from the invoker's forwarded `seat_context` event. Under an
+            // injected `run` seam the streamed assistant usages never reach onEvent, so the invoker parses the
+            // last one from the returned stdout and forwards it, the same way it forwards `seat_reads`.
+            let primerContextTokens;
+            // contract-primer-reading-frontier-v1 (O1) — the reading frontier the invoker derived from the seat's
+            // stream (the last user line before its first write), forwarded on the `seat_reads` event and sealed
+            // onto the seat-primer. Absent when the seat called no write tool (I3) or had no user line before it (F1).
+            let primerFrontier;
+            // contract-primer-reading-frontier-v1 (O4/I1) — a PRIME chair's tree snapshot at chair START (git
+            // stash create, or HEAD when clean), so a file Read before the frontier is sealed at the blob it had
+            // when the chair began — not the post-edit blob the seat may have written after reading it. Undefined
+            // when there is no tree_root (no git resolution) or the snapshot could not be taken.
+            let primerStartSnapshot;
+            // contract-seat-primer-v1 (F2) — set when the invoker reported the primer's session could not be
+            // resumed and fell back cold (the `fork_fallback` stream event). Recorded on chair_complete.
+            let forkFellBackReason;
+            const WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "NotebookEdit"]);
             // ── REUSE HIT ────────────────────────────────────────────────────────────────────────
             // Everything that could refuse this was decided at prep, before a byte was written. What
             // is left is a normal seal: the record is written through the SAME `deps.outputs.write`
@@ -1673,6 +2031,12 @@ export async function runGig(standard, gigInput, deps) {
                     const rec = deps.outputs.write({
                         core_type: spec.core_type,
                         domain_type: o.domain_type,
+                        // O4 — a recall keeps the version it was SEALED at. Omitting this let outputs.write default
+                        // to 1, so a record sealed against a v2 type recalled as v1 — a DIFFERENT content_sha than
+                        // the record it recalls. A pre-migration entry carries no version; on a HIT the current
+                        // version equals the sealed one (else lookupReuse's re-hash would already have refused the
+                        // entry), so the fallback re-hashes identically.
+                        domain_type_version: o.domain_type_version ?? deps.outputs.typeVersionOf(o.domain_type),
                         domain,
                         gig_id,
                         agent_slug: producer_slug,
@@ -1713,6 +2077,16 @@ export async function runGig(standard, gigInput, deps) {
             }
             const producerHint = chair.skill_slug || p.agent?.slug || chair.agent_slug || chair.role;
             emit({ type: "chair_start", phase: phaseName, role: chair.role, producer: producerHint });
+            // contract-seat-primer-v1 (O5) — a fork whose reuse key WOULD hit: the cache is LIVE (record the
+            // hit so the signal survives) but the fork is NEVER served — it invokes below, carrying warm
+            // conversation the reuse key cannot describe.
+            if (p.fork_reuse_withheld) {
+                reuseReport.hits.push({
+                    phase: phaseName, role: chair.role,
+                    cache_key: p.fork_reuse_withheld.cache_key, source_gig_id: p.fork_reuse_withheld.source_gig_id,
+                    output_types: p.fork_reuse_withheld.output_types,
+                });
+            }
             let data;
             // Skill-backed chairs record which skill (version + verified code_hash + tier) sealed the
             // output, so the ledger entry traces back to the exact SkillChainEvent. Undefined for agents.
@@ -1729,7 +2103,13 @@ export async function runGig(standard, gigInput, deps) {
                 // even be DELIVERED. `gig_abort` during a skill chair was a promise the engine could
                 // not keep — #249's shape again, but a missing opportunity to kill rather than a
                 // missing kill.
-                const r = await executeSkillAsync(p.skill_dir, skillInput, 120_000, { signal: deps.signal });
+                // contract-skill-chair-runs-in-tree-v1 (O1/I1) — a skill chair's code half runs in the GIG'S
+                // tree: forward RunDeps.tree_root as the child's working directory when the run has one. A run
+                // with no tree_root passes no cwd, so the child inherits the engine process's directory (I2).
+                const r = await executeSkillAsync(p.skill_dir, skillInput, 120_000, {
+                    signal: deps.signal,
+                    ...(deps.tree_root !== undefined ? { cwd: deps.tree_root } : {}),
+                });
                 if (!r.ok)
                     throw new RuntimeError(`skill chair "${chair.role}" ("${chair.skill_slug}") failed: ${r.error}`);
                 data = (r.output && typeof r.output === "object" ? r.output : {});
@@ -1793,8 +2173,30 @@ export async function runGig(standard, gigInput, deps) {
                         }
                         placedHydration = decision.hydration;
                     }
+                    // #seat-effort (O2) — resolve precedence ONCE here and set the RESOLVED value on the ctx, the
+                    // same seam `depth` threads through. Captured so chair_complete records what the seat ran at.
+                    resolvedEffort = resolveEffort(deps.effort, agent);
+                    // contract-seat-context-ceiling-v1 (O2) — resolve the context ceiling ONCE here (dispatch ▷
+                    // agent ▷ none) and set the RESOLVED value on the ctx only when one exists, so an undeclared
+                    // seat carries no ceiling and the completions invoker runs it uncapped (I1).
+                    const resolvedMaxContext = resolveMaxContextTokens(deps.max_context_tokens, agent);
+                    // contract-primer-reading-frontier-v1 (O4/I1) — snapshot the tree the moment BEFORE a PRIME seat
+                    // runs (git stash create captures the working tree without touching it; empty output ⇒ a clean
+                    // tree, so HEAD is the snapshot). A file the seat reads then edits is sealed at this pre-edit blob
+                    // (git rev-parse <snapshot>:<path>), and a carried file the seat never re-reads keeps its forked
+                    // blob — so a fork remembers exactly what the primer READ, not what it then DID. Best-effort: a
+                    // tree that cannot be snapshotted leaves this undefined and the seal falls back to hash-object.
+                    if (chair.prime && deps.tree_root !== undefined) {
+                        try {
+                            const created = gitInTree(deps.tree_root, ["stash", "create"]).trim();
+                            primerStartSnapshot = created.length > 0 ? created : gitInTree(deps.tree_root, ["rev-parse", "HEAD"]).trim();
+                        }
+                        catch {
+                            primerStartSnapshot = undefined;
+                        }
+                    }
                     data = await deps.invoke({
-                        agent, phase: phaseName, gig_id, inputs, gig_input: gigInput, skills,
+                        agent, phase: phaseName, role: chair.role, gig_id, inputs, gig_input: gigInput, skills,
                         missing_skills: p.missing_skills, // #241 — what did NOT resolve, so the prompt can't assert it
                         // THE SEAT IS WHERE THE INSTITUTION'S DATA ENTERS. Validated at compose time (the dead-slot
                         // refusal) and, until now, dropped on the floor immediately afterwards.
@@ -1809,12 +2211,31 @@ export async function runGig(standard, gigInput, deps) {
                         // itself, so an invoker can kill its child and shape what it asks the model for.
                         ...(deps.signal ? { signal: deps.signal } : {}),
                         ...(deps.depth ? { depth: deps.depth } : {}),
+                        // #seat-effort (O2) — the RESOLVED effort reaches the invoker on the ctx, always present
+                        // (resolveEffort floors to medium), so both invokers carry it without re-deriving.
+                        effort: resolvedEffort,
+                        // contract-seat-context-ceiling-v1 (O2/O3) — the RESOLVED ceiling reaches the invoker on the
+                        // ctx, present ONLY when declared (no floor), so an undeclared seat stays uncapped (I1).
+                        ...(resolvedMaxContext !== undefined ? { max_context_tokens: resolvedMaxContext } : {}),
                         // #turn-budget — the chair's own turn budget threads through exactly as `depth` does; the
                         // reserve is the pool-capped OFFER, not the raw declaration, and is present only when the
                         // chair declared a reserve (so a reserve-less chair leaves the invoker's opts-level default
                         // untouched — the #329 continuation path stays byte-identical).
                         ...(p.chair.turn_budget !== undefined ? { turn_budget: p.chair.turn_budget } : {}),
                         ...(p.reserve_offer !== undefined ? { turn_reserve: p.reserve_offer } : {}),
+                        // contract-chair-session-continuity-v1 (O3) — an amend re-invocation resumes the maker's
+                        // own prior-round session; the invoker reads this to pass --resume instead of --session-id.
+                        ...(p.resume ? { resume: true } : {}),
+                        // contract-resumed-gig-session-v1 (O1) — a re-verify resumes its session but keeps the full
+                        // prompt; thread it so buildPrompt skips the maker's trimmed continuation for this seat.
+                        ...(p.resume_keep_prompt ? { resume_keep_prompt: true } : {}),
+                        // contract-seat-primer-v1 (O1/I2) — a PRIME chair: the invoker parses its Read events and
+                        // emits them so the runtime seals the seat-primer from exactly what this seat read.
+                        ...(chair.prime ? { prime: chair.prime } : {}),
+                        // contract-seat-primer-v1 (O2/O4) — a FORK chair with a primer: the invoker warm-starts from
+                        // the primer's session and names the stale paths in the prompt. Absent on a plain chair or a
+                        // fork whose primer is missing (F1), so both spawn a fresh session and never --fork-session.
+                        ...(p.fork ? { fork: { primer_session_id: p.fork.primer_session_id, stale_paths: p.fork.stale_paths, ...(p.fork.frontier !== undefined ? { frontier: p.fork.frontier } : {}) } } : {}),
                         // The venue → dispatch wire: thread the realized room onto the chair's ctx ONLY when a
                         // venue resolved, so the invoker narrows the spawn by construction; both fields stay
                         // absent otherwise (the venue-less path is unchanged).
@@ -1831,6 +2252,53 @@ export async function runGig(standard, gigInput, deps) {
                         onEvent: (ev) => {
                             sink.fold(ev);
                             emit({ type: "agent_event", phase: phaseName, role: chair.role, event: ev });
+                            // contract-amend-resume-prompt-v1 (F1) — the invoker's cold-fallback signal. Captured here
+                            // (the one seam every chair event flows through) so chair_complete can record it.
+                            if (ev.type === "resume_fallback")
+                                resumeFellBack = true;
+                            // contract-resumed-gig-session-v1 (O3) — the invoker's collision-resume signal, captured on
+                            // the same seam so chair_complete can record the chair CONTINUED its session.
+                            if (ev.type === "resume_on_collision")
+                                resumedOnCollision = true;
+                            // contract-seat-primer-v1 (O1/I2) — a PRIME seat's forwarded reads, so the seat-primer is
+                            // sealed (below) from exactly the files it Read.
+                            if (ev.type === "seat_reads") {
+                                const r = ev.raw?.reads;
+                                primerReads = Array.isArray(r) ? r.filter((x) => typeof x === "string") : [];
+                                // contract-primer-reading-frontier-v1 (O1) — the frontier travels on the same event.
+                                const f = ev.raw?.frontier;
+                                primerFrontier = typeof f === "string" ? f : undefined;
+                            }
+                            // contract-rolling-seat-primer-v1 (O3) — the seat's context size at seal, forwarded by the
+                            // invoker (the injected `run` seam bypasses the streamed usages onEvent would otherwise fold).
+                            if (ev.type === "seat_context") {
+                                const c = ev.raw?.context_tokens;
+                                if (typeof c === "number")
+                                    primerContextTokens = c;
+                            }
+                            // contract-seat-primer-v1 (F2) — the fork's primer session could not be resumed and it fell
+                            // back cold. Captured so chair_complete records the fallback (naming the session), not a
+                            // fork that never happened.
+                            if (ev.type === "fork_fallback") {
+                                const reason = ev.raw?.reason;
+                                forkFellBackReason = typeof reason === "string" ? reason : "the primer session could not be resumed";
+                            }
+                            // #seat-metrics — track the last assistant context and the FIRST write, BEFORE the
+                            // budget early-return below (which fires whenever no budget is wired). An assistant
+                            // event's raw.message.usage carries the context; the first Write/Edit/MultiEdit/
+                            // NotebookEdit tool_use marks the first write and snapshots the context as of the last
+                            // assistant usage before it.
+                            if (ev.type === "assistant") {
+                                const u = ev.raw?.message?.usage;
+                                if (u) {
+                                    lastAssistantContext =
+                                        (u.input_tokens ?? 0) + (u.cache_read_input_tokens ?? 0) + (u.cache_creation_input_tokens ?? 0);
+                                }
+                            }
+                            else if (firstWriteMs === null && ev.type === "tool_use" && ev.tool !== undefined && WRITE_TOOLS.has(ev.tool)) {
+                                firstWriteMs = Math.round(performance.now() - t0);
+                                contextAtFirstWrite = lastAssistantContext;
+                            }
                             if (!budget)
                                 return;
                             // A chair crossed its budget into a granted reserve. Set `yielding` (D1: one condition
@@ -1871,6 +2339,12 @@ export async function runGig(standard, gigInput, deps) {
                 finally {
                     if (sink.attributed())
                         attributedInvocations++;
+                    // F3 — under a ceiling, a chair that reported usage but NO settled usd leaves the next
+                    // batch unverifiable: the runtime cannot know whether it is affordable. Record it (never
+                    // silent). A chair that reported nothing at all (a plain stub) is not here.
+                    if (hasCeiling && sink.attributed() && !sink.reportedCost())
+                        unverifiedChairs.push(agent.slug);
+                    chairReport = sink.reported();
                 }
                 // The drawing chair LANDED within its reserve → clear yielding back to `active` (O12/INV16).
                 // The gig-end success path then settles it; an idle chair that held but never drew releases here.
@@ -1879,6 +2353,29 @@ export async function runGig(standard, gigInput, deps) {
                     emit({ type: "budget_state", phase: phaseName, role: chair.role, agent_state: "active", pool_remaining: budget.pool_remaining });
                 }
                 releaseHold();
+                // ── contract-spend-survives-v1 (O1/I2/O2/F1) — the DURABLE chair_spend row ─────────────────
+                // Appended the moment THIS chair's invocation settled — before the next chair is invoked, and
+                // before the output_contract check below (which can throw) — so a kill or a failure on a later
+                // chair leaves this one's captured spend behind. An attributed chair carries its own usage; an
+                // unattributed one seals captured:false with NO cost, never a $0 row (#235). The gig-wide fold
+                // still writes the single gig row on success; these rows are the per-chair record that survives
+                // when that row is never sealed. Appended only for a model invocation — a skill chair runs no
+                // model and settles no spend — and never for a reuse hit (which returns before reaching here).
+                const chairSettledUsage = sink.usage();
+                deps.ledger.append({
+                    kind: "chair_spend",
+                    schema_version: LEDGER_SCHEMA_VERSION,
+                    entry_id: `chair_spend:${gig_id}:${chair.role}:${p.round ?? 1}:${randomUUID()}`,
+                    gig_id,
+                    role: chair.role,
+                    phase: phaseName,
+                    round: p.round ?? 1,
+                    captured: sink.attributed(),
+                    output_hashes: [],
+                    started_at: new Date(t0).toISOString(),
+                    finished_at: new Date().toISOString(),
+                    ...(chairSettledUsage ? { usage: chairSettledUsage } : {}),
+                });
                 // Runtime output_contract check: every type the chair promised must be covered by the
                 // bound agent's declared output_types (compose-time mirror; a hand-rolled literal could
                 // still ship a mismatch).
@@ -1990,6 +2487,25 @@ export async function runGig(standard, gigInput, deps) {
             // #243 — DECIDE BEFORE SEALING. Every check that can throw now runs against resolved
             // slices while nothing has been written yet.
             //
+            // AN INVOKER'S TYPED REFUSAL IS A REASON, NOT A MALFORMED OUTPUT. An invoker that declines —
+            // a chair granting a tool that port does not carry, a tier the deployment never mapped, an
+            // upstream that could not be reached — returns `{ok:false, refusal, message}` rather than
+            // throwing, so the refusal is a value the engine can act on. Without this it fell straight
+            // through to the seal path and the operator was told
+            //
+            //   cannot seal "p": ... additionalProperties: must NOT have additional properties 'refusal'
+            //
+            // which is the shape complaint of the very object carrying the answer. The reason was present
+            // and nothing read it — a refusal typed and then discarded is the same defect as a mechanism
+            // nothing reaches, one seam over.
+            //
+            // Narrow on purpose: `ok === false` with BOTH a string refusal and a string message. A domain
+            // type is free to have an `ok` field; it is not plausibly carrying all three.
+            const refusal = data["refusal"];
+            const refusalWhy = data["message"];
+            if (data["ok"] === false && typeof refusal === "string" && typeof refusalWhy === "string") {
+                throw new RuntimeError(`chair "${chair.role}" refused: ${refusal} — ${refusalWhy}`);
+            }
             // The floor check used to sit AFTER the write loop, which created a failure class that did
             // not previously exist: a chair delivering part of its contract sealed those records,
             // append-flushed them to `outputs/<gig_id>.jsonl`, and only THEN threw — so the gig failed
@@ -2000,7 +2516,37 @@ export async function runGig(standard, gigInput, deps) {
             const resolved = [];
             for (const spec of output_specs) {
                 const keyed = data[spec.domain_type];
-                const raw = keyed !== undefined && keyed !== null ? keyed : single ? data : undefined;
+                // WRAPPER vs FIELD — THE TYPE'S OWN SCHEMA DECIDES, never the data's shape. A chair may return
+                // its record bare, or keyed under its type slug (`{ <type>: <record> }`). But a record whose
+                // OWN schema declares a field named like its type (a type `line` with a `line` field) puts a
+                // value under `data[<type>]` that is a FIELD, not a wrapper — and the shape alone cannot tell
+                // the two apart (law 2: an OBJECT field looks exactly like a wrapped record). The schema can:
+                // the keyed value is a wrapper only if it VALIDATES as a record of the type while the whole
+                // `data` does not. So when `data[<type>]` cannot itself be a record of this type but the whole
+                // `data` can, `data[<type>]` is a field and the whole record seals; otherwise the keyed wrapper
+                // is honoured (control law 3), and multi-output (`single` false) is untouched — its blob is
+                // keyed by construction. An array under the key is the multi-record seal list; honour it as-is.
+                let raw;
+                if (keyed === undefined || keyed === null) {
+                    raw = single ? data : undefined;
+                }
+                else if (single && !Array.isArray(keyed)) {
+                    const keyedIsRecord = typeof keyed === "object" &&
+                        deps.outputs.validateWrite({
+                            core_type: spec.core_type,
+                            domain_type: spec.domain_type,
+                            data: keyed,
+                        }).valid;
+                    const wholeIsRecord = deps.outputs.validateWrite({
+                        core_type: spec.core_type,
+                        domain_type: spec.domain_type,
+                        data,
+                    }).valid;
+                    raw = !keyedIsRecord && wholeIsRecord ? data : keyed;
+                }
+                else {
+                    raw = keyed;
+                }
                 if (raw === undefined || raw === null)
                     continue;
                 // MULTI-RECORD SEAL. captureOutputWrites hands the runtime a LIST of records per declared type
@@ -2020,6 +2566,21 @@ export async function runGig(standard, gigInput, deps) {
             // that throw also lands before the first write, rather than midway through them.
             for (const { slice } of resolved)
                 backfillShas(slice);
+            // RECORDS BY ADDRESS — the seal stamps law/change addresses from git, beside the *_sha backfill
+            // and before any validateWrite or write, so a stamping refusal fails the chair with its typed
+            // reason and nothing is sealed. A sealed `red-spec` carrying `laws` (or a `change-set` carrying
+            // `changes`) has those entries REPLACED with the engine-stamped ones; a record carrying only
+            // `diffs` and no `laws`/`changes` is left exactly as today (the pre-migration shape this gig's
+            // own attester and builder still seal). tree_root is required only once a record actually carries
+            // an address — a stamp with no tree_root refuses (`tree_root_unknown`), never reads process.cwd().
+            for (const { spec, slice } of resolved) {
+                if (spec.domain_type === "red-spec" && Array.isArray(slice["laws"])) {
+                    slice["laws"] = stampLawAddresses(slice["laws"], deps.tree_root);
+                }
+                else if (spec.domain_type === "change-set" && Array.isArray(slice["changes"])) {
+                    slice["changes"] = stampChangeAddresses(slice["changes"], deps.tree_root);
+                }
+            }
             // The output_contract is a FLOOR, not merely a selector. `written.length === 0` alone let a
             // chair that promised two types and sealed one complete silently. The old in-code
             // justification — a keyed type may be conditional, and a downstream input_contract check
@@ -2078,6 +2639,15 @@ export async function runGig(standard, gigInput, deps) {
             // Only now does anything become durable.
             const written = [];
             for (const { spec, slice } of resolved) {
+                // contract-chair-cost-once-v1 — one chair invocation is settled ONCE (its `result` event
+                // reports a single total_cost_usd), so its spend is attributed to exactly ONE sealed record.
+                // The FIRST record this invocation seals carries `chairReport.cost_usd` / `tokens_used`; every
+                // later record omits both and carries `cost_on`: the first record's id. Stamping the whole
+                // chairReport on every record made a chair of width N report its spend N times, so summing
+                // `cost_usd` over a gig double-counted every multi-output chair (coltrane-ui#242). `written` is
+                // this invocation's records in seal order, so it is empty exactly at the first record and its
+                // head is the cost carrier for the rest.
+                const costCarrier = written[0];
                 const rec = deps.outputs.write({
                     core_type: spec.core_type,
                     domain_type: spec.domain_type,
@@ -2097,10 +2667,28 @@ export async function runGig(standard, gigInput, deps) {
                     // WHICH model produced this, resolved through the invoker's own function so the stamp
                     // and the spawn cannot disagree. Absent for a skill-backed chair — no model ran, and
                     // absent must mean unknown rather than "the default".
+                    // WHICH model produced this. The transport's own word wins: `resolveModel` is one
+                    // invoker's tier table, and the runtime calls it for EVERY invoker — so a chair served by
+                    // any other port used to seal a stamp naming a model it never touched. The fallback stays
+                    // (a transport may report nothing) but it no longer masquerades as a measurement:
+                    // `model_reported` says which of the two this is. Absent for skill-backed chairs — no
+                    // model ran, and absent must mean unknown rather than "the default".
                     ...(p.agent
                         ? {
-                            model: resolveModel(p.agent.model_tier, deps.model_version),
+                            model: chairReport.model ?? resolveModel(p.agent.model_tier, deps.model_version),
+                            ...(chairReport.model !== undefined ? { model_reported: true } : {}),
                             ...(p.agent.model_tier ? { model_tier: p.agent.model_tier } : {}),
+                            // Per-chair spend, declared in the record's own schema since it was written and
+                            // populated by nothing. The gig total cannot separate two chairs on two tiers,
+                            // which is the only question per-chair routing asks. Attributed ONCE per invocation
+                            // (contract-chair-cost-once-v1): the first record carries the settled cost + tokens;
+                            // every later record carries `cost_on` at the carrier and no cost of its own.
+                            ...(costCarrier === undefined
+                                ? {
+                                    ...(chairReport.cost_usd !== undefined ? { cost_usd: chairReport.cost_usd } : {}),
+                                    ...(chairReport.tokens_used !== undefined ? { tokens_used: chairReport.tokens_used } : {}),
+                                }
+                                : { cost_on: costCarrier.id }),
                         }
                         : {}),
                     skill_provenance,
@@ -2131,6 +2719,8 @@ export async function runGig(standard, gigInput, deps) {
                         core_type: w.core_type, domain_type: w.domain_type, domain: w.domain,
                         primitive: w.primitive, agent_slug: w.agent_slug, phase: phaseName,
                         data: w.data, content_sha: w.content_sha, type_fingerprint: fp, source_output_id: w.id,
+                        // O4 — carry the sealed version so a recall re-stamps it and hashes as the record it recalls.
+                        domain_type_version: w.domain_type_version,
                         ...(w.skill_provenance ? { skill_provenance: w.skill_provenance } : {}),
                     });
                 }
@@ -2148,16 +2738,180 @@ export async function runGig(standard, gigInput, deps) {
                     }
                 }
             }
+            // contract-seat-primer-v1 (O1/I2) — a PRIME chair seals a `seat-primer` record DERIVED by the
+            // engine (never typed by the model): its own (gig, role) session, HEAD at seal, and the files its
+            // seat Read, each with the `git hash-object` blob in the tree at seal. The reads arrive through the
+            // invoker's `seat_reads` event (captured above); the record is sealed HERE, through the same write
+            // boundary a derived output crosses, so it enters this gig's store and any later fork can find it.
+            if (chair.prime) {
+                const area = chair.prime.area;
+                const session_id = sessionUuidFor(gig_id, chair.role);
+                const reads = primerReads ?? [];
+                const commit = deps.tree_root ? gitInTree(deps.tree_root, ["rev-parse", "HEAD"]).trim() : "";
+                // contract-rolling-seat-primer-v1 (O2) — a chair that ALSO forked a primer (p.fork resolved) seals
+                // a FRESHER primer: the forked primer's files UNIONed with this seat's own reads, de-duped by path
+                // (forked first, then own reads), each RE-BLOBBED against the tree at seal. A chair that fell back
+                // cold (primer_too_large / primer_missing → no p.fork) unions nothing and seals only its own reads,
+                // which is the fresh, small primer the ceiling/first-primer path calls for. The `session_id` stays
+                // this build's own (gig, role) uuid — the fork branch the next build resumes.
+                const forkedFiles = p.fork?.primer_files ?? [];
+                // contract-seat-primer-paths-v1 (O1/I1/F1) — a seat-primer must name its files the way the
+                // repository does, so ANY checkout of this commit can use it. A seat's Read event carries an
+                // ABSOLUTE checkout path, which ties the primer to one machine's location. Normalize each read to
+                // its tree_root-relative POSIX path (an already-relative read is resolved against tree_root first,
+                // so both spellings of the same file collapse to one key — I1), and DROP any path that resolves
+                // OUTSIDE tree_root — it is not part of the area and must never be stored, above all not as an
+                // absolute path escaping it (F1). With paths stored relative, the fork-time staleness hash
+                // (gitInTree hash-object) resolves them in the FORKING run's own checkout, so a primer sealed
+                // under one checkout is fresh in another of the same content (O2). Without a tree_root there is no
+                // anchor (and no git resolution downstream), so the raw path is kept unchanged.
+                const toTreeRelative = (raw) => {
+                    if (deps.tree_root === undefined)
+                        return raw;
+                    const abs = isAbsPath(raw) ? raw : joinPath(deps.tree_root, raw);
+                    const rel = relPath(deps.tree_root, abs);
+                    if (rel === "" || rel.startsWith("..") || isAbsPath(rel))
+                        return undefined; // outside tree_root
+                    return rel.split(pathSep).join("/");
+                };
+                // The seat's OWN reads — already CUT to those before the reading frontier by the invoker
+                // (contract-primer-reading-frontier-v1 O4) — normalized to tree-relative and de-duped.
+                const readRel = [];
+                const readSet = new Set();
+                for (const raw of reads) {
+                    const rel = toTreeRelative(raw);
+                    if (rel !== undefined && !readSet.has(rel)) {
+                        readSet.add(rel);
+                        readRel.push(rel);
+                    }
+                }
+                // contract-carried-primer-paths-v1 (O1/I1/F1) — a CARRIED file obeys the SAME path rules as a
+                // read: normalize each forked path through the SAME toTreeRelative (absolute-under-tree_root →
+                // tree_root-relative POSIX; a path resolving OUTSIDE tree_root is dropped, never stored — F1)
+                // BEFORE de-duping, so a carried absolute spelling and a relative read of the same file collapse
+                // to one tree-relative key (I1). The blob map is keyed by the NORMALIZED path (first carried
+                // entry wins), so a carried file the seat did NOT re-read keeps the blob the forked primer
+                // recorded — never re-blobbed against the tree (O1; contract-primer-reading-frontier-v1 I1).
+                const carriedRel = [];
+                const forkedBlob = new Map();
+                for (const f of forkedFiles) {
+                    const rel = toTreeRelative(f.path);
+                    if (rel === undefined)
+                        continue; // outside tree_root — never stored (F1)
+                    if (!forkedBlob.has(rel))
+                        forkedBlob.set(rel, f.blob_sha);
+                    carriedRel.push(rel);
+                }
+                // Union: carried (forked) first, then the seat's own reads, de-duped by NORMALIZED path.
+                const orderedPaths = [];
+                const seenPaths = new Set();
+                for (const path of [...carriedRel, ...readRel]) {
+                    if (!seenPaths.has(path)) {
+                        seenPaths.add(path);
+                        orderedPaths.push(path);
+                    }
+                }
+                // contract-primer-reading-frontier-v1 (O4/I1) — a file the seat READ before its frontier is sealed
+                // at its CHAIR-START blob: `git rev-parse <snapshot>:<path>` against the pre-invoke snapshot, so a
+                // file read-then-edited keeps its pre-edit blob (what the fork remembers), and a path the snapshot
+                // does not hold (untracked at chair start) is hashed at seal. A carried file the seat did NOT
+                // re-read keeps the blob the forked primer recorded — the reseal never launders a stale file fresh.
+                const blobFor = (path) => {
+                    if (readSet.has(path)) {
+                        if (deps.tree_root === undefined)
+                            return "";
+                        if (primerStartSnapshot !== undefined) {
+                            try {
+                                return gitInTree(deps.tree_root, ["rev-parse", `${primerStartSnapshot}:${path}`]).trim();
+                            }
+                            catch { /* untracked at chair start — hash at seal below */ }
+                        }
+                        try {
+                            return gitInTree(deps.tree_root, ["hash-object", path]).trim();
+                        }
+                        catch {
+                            return "";
+                        }
+                    }
+                    return forkedBlob.get(path) ?? "";
+                };
+                const files = orderedPaths.map((path) => ({ path, blob_sha: blobFor(path) }));
+                // contract-rolling-seat-primer-v1 (O3) — the context size of the LAST usage the seat reported:
+                // the invoker-forwarded value under an injected `run` seam, else the streamed fold. Recorded ONLY
+                // when a usage was actually reported — a seat that reported none has no "last usage" to stamp, so
+                // the field is omitted (the same conditional discipline as `session_id`), which also keeps a seat-
+                // primer type that never declared context_tokens sealing cleanly.
+                const contextTokens = primerContextTokens ?? (lastAssistantContext ?? undefined);
+                deps.outputs.write({
+                    core_type: "Signal",
+                    domain_type: "seat-primer",
+                    domain,
+                    gig_id,
+                    agent_slug: producer_slug,
+                    from_role: chair.role,
+                    phase: phaseName,
+                    primitive: CORE_TO_PRIMITIVE["Signal"] ?? "SENSE",
+                    // `source` is the Signal core's substance floor; the rest is the derived primer.
+                    data: {
+                        agent_slug: producer_slug, area,
+                        ...(session_id !== undefined ? { session_id } : {}),
+                        commit, files,
+                        // contract-rolling-seat-primer-v1 (O3) — the context size the seat carried at seal
+                        // (input+cache_read+cache_creation of its LAST usage): what the next build's ceiling weighs.
+                        ...(contextTokens !== undefined ? { context_tokens: contextTokens } : {}),
+                        // contract-primer-reading-frontier-v1 (O1) — seal the reading frontier ONLY when the seat wrote
+                        // (the invoker derived one); a read-only or user-less-write seat records none (I3/F1), so a
+                        // frontier is never guessed.
+                        ...(primerFrontier !== undefined ? { frontier: primerFrontier } : {}),
+                        source: `seat-primer://${producer_slug}/${area}`,
+                    },
+                });
+            }
             // A DECLARED-optional absence is still a fact about this run. Legitimising a shortfall is
             // not the same as hiding it, so it keeps its row in the manifest.
             if (missing.length > 0)
                 unfulfilledOutputs.push({ role: chair.role, phase: phaseName, missing });
+            // contract-seat-primer-v1 (O3/O4/F1/F2) — a fork that WARM-STARTED records where it forked from and
+            // the paths stale since priming; a fork that FELL BACK cold (no primer, or an unresumable session)
+            // records the fallback instead. `forkFellBackReason` is set by the invoker's cold-fallback event
+            // (F2); `p.fork_fallback` is the prep-time "primer_missing" (F1). A cold fallback did NOT fork, so
+            // it records neither forked_from nor primer_stale_paths.
+            const forkFellBack = forkFellBackReason !== undefined;
             emit({
                 type: "chair_complete", phase: phaseName, role: chair.role, producer: producer_slug,
-                output_types: written.map((w) => w.domain_type), duration_ms: Date.now() - t0,
+                output_types: written.map((w) => w.domain_type), duration_ms: Math.round(performance.now() - t0),
+                first_write_ms: firstWriteMs,
+                context_tokens_at_first_write: contextAtFirstWrite,
                 promised_output_types: output_specs.map((s) => s.domain_type),
                 missing_output_types: missing,
                 ...(unresolvedShaFields.length > 0 ? { unresolved_sha_fields: unresolvedShaFields } : {}),
+                // #seat-effort (O5) — record the effort the seat ran at (a model chair only; a skill chair
+                // leaves it undefined and the field stays absent).
+                ...(resolvedEffort !== undefined ? { effort: resolvedEffort } : {}),
+                // contract-chair-session-continuity-v1 (O4) — record the seat's session id (the uuid derived
+                // from (gig_id, role)) and whether THIS invocation resumed it. A model chair only; a skill
+                // chair (no p.agent) runs no session, so both fields stay absent. Computed here from the same
+                // (gig_id, role) the invoker derives the spawn's --session-id from, so the record and the
+                // spawn name one session.
+                // contract-resumed-gig-session-v1 (O3) — `resumed` is true when THIS invocation continued its
+                // session: either an amend round (`p.resume`) OR a first open whose deterministic id collided and
+                // was resumed on the spot (`resumedOnCollision`). The second case is a first spawn, so `p.resume`
+                // is false and only the collision signal tells the truth of it.
+                ...(p.agent && sessionUuidFor(gig_id, chair.role) !== undefined
+                    ? { session_id: sessionUuidFor(gig_id, chair.role), resumed: p.resume === true || resumedOnCollision }
+                    : {}),
+                // contract-amend-resume-prompt-v1 (F1) — a resume that fell back cold is recorded (never silent),
+                // and only then, so a normal spawn's chair_complete is byte-identical to before.
+                ...(resumeFellBack ? { resume_fallback: true } : {}),
+                // contract-seat-primer-v1 (O3/O4) — a fork that warm-started names its primer and the stale paths.
+                ...(p.fork && !forkFellBack
+                    ? {
+                        forked_from: { id: p.fork.primer_id, session_id: p.fork.primer_session_id, commit: p.fork.primer_commit },
+                        primer_stale_paths: p.fork.stale_paths,
+                    }
+                    : {}),
+                // contract-seat-primer-v1 (F1/F2) — a fork that could not warm-start records why (never silent).
+                ...(forkFellBack ? { fork_fallback: forkFellBackReason } : p.fork_fallback !== undefined ? { fork_fallback: p.fork_fallback } : {}),
             });
             return written;
         }
@@ -2219,6 +2973,10 @@ export async function runGig(standard, gigInput, deps) {
             // invokers, or a run whose every invocation reported no usage payload). #235: an absent
             // usage block means "not captured", never "$0.00".
             ...(settledUsage ? { usage: settledUsage } : {}),
+            // contract-spend-survives-v1 (O4) — a RESUMED gig's row carries what the killed attempt spent,
+            // read from the checkpoint (resumedFrom.prior_usage) and kept BESIDE this run's own `usage`,
+            // never folded in (#235/#236). Absent on a cold run.
+            ...(resumedFrom?.prior_usage !== undefined ? { prior_usage: resumedFrom.prior_usage } : {}),
         });
         // Drain the gig HEADER to the sink (fire-and-forget, like every output before it) — the
         // stub row the drain service fabricated for FK integrity is replaced by the run's own record.
@@ -2236,12 +2994,13 @@ export async function runGig(standard, gigInput, deps) {
             if (process.env["COLTRANE_DRAIN_DEBUG"])
                 console.error(`[drain] gig header ${gig_id}: ${String(e)}`);
         });
-        // Cycle complete — when a budget was supplied, mark it `settled` and
-        // surface the final state in the manifest. `settled` mirrors the
-        // budget-state.json cycle terminal-state semantics for a closed cycle.
+        // Cycle complete — when a snapshot exists (a ceiling OR a pool), mark it `settled` and surface
+        // the final state in the manifest. Under a ceiling, the settled dollars are reconciled one last
+        // time; a pool-only snapshot carries no dollar figure.
         if (budget) {
             budget.agent_state = "settled";
-            budget.settled_usd = usage.total_cost_usd; // #233 — final reconciliation of REAL dollars
+            if (hasCeiling)
+                budget.spent_usd = usage.total_cost_usd;
         }
         // The gig finished, so there is nothing left to resume — drop its checkpoint. Without this
         // every gig a deployment ever runs leaves a file behind forever. Only the SUCCESS path clears