@iowarp/clio-coder 0.4.4 → 0.4.6

package/src/domains/dispatch/extension.ts

@@ -71,10 +71,11 @@ import {
 	resolveAgentToolCompatibility,
 } from "../agents/spec.js";
 import type { ConfigContract } from "../config/contract.js";
-import type { ContextContract, ProjectStructuredContext } from "../context/contract.js";
+import type { ContextContract, ProjectPromptContext, ProjectStructuredContext } from "../context/contract.js";
 import type { MiddlewareContract } from "../middleware/contract.js";
 import { workerSafetyOneLiner } from "../prompts/compiler.js";
 import type { PromptsContract } from "../prompts/contract.js";
+import { selectProjectPreload } from "../prompts/preload.js";
 import { type EffectivePricing, resolveEffectivePricing } from "../providers/catalog.js";
 import {
 	type CapabilityFlags,
@@ -153,7 +154,7 @@ import {
 import { type BatchState, createBatch, onRunComplete, snapshotBatch } from "./batch-tracker.js";
 import { type RunToolBudgetEnvelope, resolveToolBudgetEnvelope } from "./budget-envelope.js";
 import { assessCapabilityMismatch, type CapabilityMismatch } from "./capability-match.js";
-import { capacityLeaseUsage, createNodeLeaseUsageReader } from "./capacity-lease.js";
+import { capacityLeaseUsage, capacityLeaseUsageAsync, createNodeLeaseUsageReader } from "./capacity-lease.js";
 import { acquireCheckoutWriterLease, type CheckoutWriterLease } from "./checkout-writer-lease.js";
 import type {
 	DispatchAdmissionObserver,
@@ -163,9 +164,9 @@ import type {
 	DispatchRequest,
 	DispatchSnapshot,
 } from "./contract.js";
-import { createWorkerOutputCapture, startDispatchEventPump } from "./event-pump.js";
+import { createWorkerOutputCapture, startDispatchEventPump, workerOutputCaptureBytes } from "./event-pump.js";
 import type { ExecutionHandoff } from "./execution-handoff.js";
-import { appliesRecipeResultContract, routeCorrelationFactsForRun, withAttemptRole } from "./execution-role.js";
+import { dispatchResultContract, routeCorrelationFactsForRun, withAttemptRole } from "./execution-role.js";
 import {
 	affectsTargetBreaker,
 	classifyFailure,
@@ -231,7 +232,6 @@ import {
 	rebindDispatchReservationMember,
 	releaseDispatchReservation,
 	releaseDispatchReservationMember,
-	reservedBudgetUsd,
 	reservedPlanPeakSlots,
 	rollbackDispatchReservation,
 	rollbackUnconsumedDispatchReservation,
@@ -364,7 +364,9 @@ interface ActiveRun {
 	stallKilled: boolean;
 	/** ACP event-inactivity window; null for native runs (heartbeat spec governs those). */
 	stallTimeoutMs: number | null;
+	/** Internal logical assignment/retry lineage, independent of published host ancestry. */
 	lineage: RunLineage;
+	hostRun?: DispatchPreparationOptions["hostRun"];
 	heartbeatAt: HeartbeatStamp | null;
 	heartbeatStatus: HeartbeatStatus;
 	meter: RunTokenMeter;
@@ -777,6 +779,11 @@ function workerDiagnosticsText(result: SpawnedWorkerResult, maxChars: number): s
 	if (malformedStdoutLines > 0) {
 		parts.push(`malformed stdout lines: ${malformedStdoutLines}`);
 	}
+	if (result.signal) {
+		// Keep the observed close signal beside contract failures, and at the
+		// tail so bounded stderr diagnostics cannot truncate it away.
+		parts.push(`worker process signal: ${result.signal}`);
+	}
 	if (parts.length === 0) return null;
 	return truncateDiagnosticText(parts.join("; "), maxChars);
 }
@@ -1107,6 +1114,12 @@ export interface WorkerDynamicContext {
 	autonomy?: AutonomyLevel | null;
 	/** Effective approval routing; defaults to deny for legacy direct callers. */
 	onPermission?: WorkerPermissionMode | null;
+	/** Captured authored handbooks; preferred over the legacy structured projection. */
+	projectPrompt?: ProjectPromptContext | null;
+	/** Admitted native read capability; null for an unknown external inventory. */
+	projectReadTools?: boolean | null;
+	/** External runtimes do not promise the native read schema. */
+	projectExternalReadTools?: boolean;
 	/** Structured CLIO-CODER.md fields; null when CLIO-CODER.md is absent or malformed. */
 	project?: ProjectStructuredContext | null;
 	/** The run's own working directory and top-level layout; sent at every tier. */
@@ -1160,10 +1173,10 @@ function renderWorkerProjectContext(
 
 /** True when the rendered project message body includes the verification block. */
 function workerProjectContextIncludesVerification(body: string): boolean {
-	return body.includes("\nVerification expectations:\n");
+	return body.startsWith("# Project Context\n") && body.includes("\nVerification expectations:\n");
 }
 
-function buildDynamicPromptMessages(
+export function buildDynamicPromptMessages(
 	req: DispatchRequest,
 	dynamicContext: WorkerDynamicContext = {},
 ): WorkerPromptMessage[] {
@@ -1172,10 +1185,22 @@ function buildDynamicPromptMessages(
 		const body = renderWorkerWorkspaceContext(dynamicContext.workspace);
 		messages.push({ id: "dispatch-workspace", body, contentHash: sha256(body) });
 	}
-	if (dynamicContext.project && dynamicContext.projectContextTier === "bounded") {
-		const body = renderWorkerProjectContext(dynamicContext.project, {
-			includeVerification: dynamicContext.capabilityClass === "verification",
-		});
+	if (dynamicContext.projectContextTier === "bounded") {
+		const authored = dynamicContext.projectPrompt;
+		// Authored instructions remain verbatim, including test guidance. Never
+		// duplicate them with a second projection of conventions or verification.
+		const body = authored
+			? authored.handbookSources.length > 0
+				? selectProjectPreload(authored, dynamicContext.projectReadTools ?? null, {
+						maxChars: WORKER_PROJECT_CONTEXT_MAX_CHARS,
+						externalReadTools: dynamicContext.projectExternalReadTools === true,
+					}).text
+				: ""
+			: dynamicContext.project
+				? renderWorkerProjectContext(dynamicContext.project, {
+						includeVerification: dynamicContext.capabilityClass === "verification",
+					})
+				: "";
 		if (body.length > 0) {
 			messages.push({ id: "dispatch-project-context", body, contentHash: sha256(body) });
 		}
@@ -1454,7 +1479,7 @@ function runtimeLimitations(runtimeKind: RunKind, runtimeId: string): string[] {
 	if (runtimeKind === "subprocess" && runtimeId === "antigravity-code") {
 		return [
 			"Antigravity CLI owns its internal tools, network activity, prompts, and approvals; Clio observes only structured stream output and does not provide per-tool mediation or complete tool telemetry",
-			"Antigravity conversation ids are recorded only as opaque provider observations; Clio does not resume them",
+			"Antigravity resumes a conversation only when the caller supplies its id explicitly",
 			"Antigravity runs are one-shot and never retried automatically",
 		];
 	}
@@ -1626,22 +1651,6 @@ function workerToolCallHardCap(settings: EffectiveSettings): number {
 	return settings?.fleet.limits.toolCallsPerRun ?? GUARDRAIL_DEFAULTS.workerToolCallCap;
 }
 
-/**
- * Only a runtime that declares its external agent loop may accept a declared
- * per-tool budget: Clio records that budget as unobserved rather than enforced.
- * Any other subprocess runtime cannot mediate tool calls, so a declared budget
- * would be a claim nobody enforces.
- */
-export function assertWorkerBudgetEnforceable(
-	runtime: Pick<RuntimeDescriptor, "id" | "kind" | "externalAgentLoop">,
-	hasDeclaredBudget: boolean,
-): void {
-	if (!hasDeclaredBudget || runtime.kind !== "subprocess" || runtime.externalAgentLoop !== undefined) return;
-	throw new Error(
-		`dispatch: runtime '${runtime.id}' cannot enforce an explicit dispatch budget because subprocess workers do not expose per-tool mediation; choose a native or claude-sdk worker`,
-	);
-}
-
 /** Per-tool budget enforcement is real only where Clio observes each tool call. */
 export function budgetEnforcementForRuntime(
 	runtime: Pick<RuntimeDescriptor, "kind">,
@@ -1657,7 +1666,6 @@ function resolveEffectiveWorkerBudget(input: {
 	settings: EffectiveSettings;
 	runtime: RuntimeDescriptor;
 }): RunToolBudgetEnvelope {
-	assertWorkerBudgetEnforceable(input.runtime, input.declared !== null || input.req.budget !== undefined);
 	const hardCap = workerToolCallHardCap(input.settings);
 	const declared = input.declared ?? {
 		toolCalls: hardCap,
@@ -1737,15 +1745,6 @@ function assertPlannedNodeIdentity(req: DispatchRequest, actual: RunNodeIdentity
 	);
 }
 
-function assertApprovedCostCeiling(req: DispatchRequest, liveCeilingUsd: number): void {
-	const approved = req.plan?.costCeilingUsd;
-	if (approved === undefined) return;
-	if (Object.is(approved, liveCeilingUsd)) return;
-	throw new Error(
-		`dispatch: scheduling cost ceiling drifted after plan approval (approved $${approved.toFixed(4)}, current $${liveCeilingUsd.toFixed(4)}); re-plan before launch`,
-	);
-}
-
 /** Fail closed until another runtime has an explicitly tested JSON-schema wire contract. */
 function assertResponseSchemaEnforceable(
 	runtime: RuntimeDescriptor,
@@ -1929,10 +1928,9 @@ function buildDispatchWorkerSpec(input: DispatchWorkerSpecInput, config?: Config
 	// Requiring a recipe contract here meant a caller-supplied override against a
 	// recipe with none was sealed but never sent, so the worker spent no repair
 	// round on a contract it was never told about and the run failed on a shape
-	// nothing had asked it for.
-	const workerResultContract = appliesRecipeResultContract(input.req.gate?.role)
-		? (input.req.resultContractOverride ?? input.recipe?.resultContract)
-		: undefined;
+	// nothing had asked it for. A caller's summary allowance is folded in by
+	// the same resolver the seal uses, so the two never disagree.
+	const workerResultContract = dispatchResultContract(input.req, input.recipe);
 	if (workerResultContract) spec.resultContract = workerResultContract;
 	const product = input.req.product ?? input.recipe?.product;
 	if (product) spec.product = product;
@@ -2586,10 +2584,17 @@ export function createDispatchBundle(
 		return configuredEndpointCapacities()[endpoint.key] ?? endpoint;
 	}
 
-	function reservationCapacitySnapshot(settings: EffectiveSettings): ReservationCapacitySnapshot {
+	/** Initial plan preparation has a synchronous host contract. */
+	function reservationCapacitySnapshotSync(settings: EffectiveSettings): ReservationCapacitySnapshot {
+		return reservationCapacitySnapshot(settings, capacityLeaseUsage());
+	}
+
+	function reservationCapacitySnapshot(
+		settings: EffectiveSettings,
+		usage: ReturnType<typeof capacityLeaseUsage>,
+	): ReservationCapacitySnapshot {
+		// Read budget after the capacity lock wait too; concurrent callbacks may spend.
 		const preflight = scheduling.preflight();
-		// Reservation planning compares against a fresh read, never the display cache.
-		const usage = capacityLeaseUsage();
 		const nodes: Record<string, { active: number; limit: number }> = {
 			local: { active: usage.nodes.local ?? 0, limit: configuredGlobalCapacity(settings) },
 		};
@@ -2624,7 +2629,7 @@ export function createDispatchBundle(
 				...(task.resolution.endpoint !== undefined ? { endpointKey: task.resolution.endpoint.key } : {}),
 				costUpperBoundUsd: task.resolution.routeApproval?.totalCostUpperBoundUsd ?? task.resolution.costUpperBoundUsd,
 			})),
-			capacity: reservationCapacitySnapshot(getEffectiveSettings()),
+			capacity: reservationCapacitySnapshotSync(getEffectiveSettings()),
 			nowMs: now(),
 		});
 		ownedReservations.add(record.ownerId);
@@ -2655,20 +2660,10 @@ export function createDispatchBundle(
 	}
 
 	function assertBudgetAdmitsRoute(req: DispatchRequest, pricing: EffectivePricing, settings: EffectiveSettings): void {
-		const preflight = scheduling.preflight();
-		assertApprovedCostCeiling(req, preflight.ceilingUsd);
-		if (preflight.verdict === "over" || preflight.verdict === "at") {
-			denyDispatchForBudget(preflight, req.agentId);
-		}
 		const estimateUsd = conservativeRouteAdmissionEstimateUsd(pricing, admissionMaxOutputTokens(settings));
 		const intentCeiling = req.routingIntent?.maxCostUsd;
 		if (intentCeiling !== null && intentCeiling !== undefined && estimateUsd > intentCeiling)
 			denyDispatchForBudget({ currentUsd: estimateUsd, ceilingUsd: intentCeiling }, req.agentId, estimateUsd);
-		const heldUsd = reservedBudgetUsd();
-		const projectedUsd = preflight.currentUsd + heldUsd + (req.reservation === undefined ? estimateUsd : 0);
-		if (scheduling.checkCeiling(projectedUsd) !== "under") {
-			denyDispatchForBudget({ currentUsd: projectedUsd, ceilingUsd: preflight.ceilingUsd }, req.agentId, estimateUsd);
-		}
 	}
 
 	function configuredGlobalCapacity(settings: EffectiveSettings): number {
@@ -2716,7 +2711,12 @@ export function createDispatchBundle(
 		const assignmentId =
 			req.lineage?.rootRunId ?? req.runIdHint ?? `pending-${queuedAt.toString(36)}-${randomBytes(6).toString("hex")}`;
 		const requestedAt = Date.parse(timing.requestedAt ?? timing.queuedAt);
-		const deadlineAt = req.assignmentDeadlineAt ?? requestedAt + (req.routingIntent?.deadlineMs ?? 60_000);
+		const deadlineAt =
+			req.assignmentDeadlineAt ??
+			(req.routingIntent?.deadlineMs === undefined || req.routingIntent.deadlineMs === null
+				? undefined
+				: requestedAt + req.routingIntent.deadlineMs);
+		if (deadlineAt !== undefined) req.assignmentDeadlineAt = deadlineAt;
 		if (req.lineage === undefined) await registerAssignment(assignmentId);
 		// A plan's queued members keep their wave order and their reserved peak.
 		const plan =
@@ -2735,7 +2735,7 @@ export function createDispatchBundle(
 				assignmentId,
 				nodeId,
 				...(endpoint !== null && endpoint !== undefined ? { endpointKey: endpoint.key } : {}),
-				deadlineAt,
+				...(deadlineAt === undefined ? {} : { deadlineAt }),
 				...plan,
 				// A fleet's first attempt carries lineage and still owns the held
 				// reservation member that admission must transfer into its lease.
@@ -2767,7 +2767,8 @@ export function createDispatchBundle(
 		settings: EffectiveSettings,
 	): Promise<void> {
 		if (req.reservation === undefined || req.lineage === undefined) return;
-		const capacity = reservationCapacitySnapshot(settings);
+		// Retries can await fresh capacity; the advisory display cache is never admission data.
+		const capacity = reservationCapacitySnapshot(settings, await capacityLeaseUsageAsync());
 		const rebind = {
 			...req.reservation,
 			nodeId,
@@ -2795,6 +2796,7 @@ export function createDispatchBundle(
 	const retryQueue = new Map<string, RetryQueueEntry>();
 	const retryBackoff = new Map<string, BackoffState>();
 	const retryReasons = new Map<string, string>();
+	const assignmentRootsByAttempt = new Map<string, string>();
 	const assignments = new AssignmentRegistry({
 		onStreamError: (error) => reportDispatchDiagnostic("assignment event stream", error),
 	});
@@ -2824,8 +2826,19 @@ export function createDispatchBundle(
 	}
 
 	function lineageFor(req: DispatchRequest, runId: string): RunLineage {
-		if (req.lineage) return { ...req.lineage };
-		return { parentRunId: null, rootRunId: runId, attempt: 0, depth: 0 };
+		const lineage = req.lineage ? { ...req.lineage } : { parentRunId: null, rootRunId: runId, attempt: 0, depth: 0 };
+		assignmentRootsByAttempt.set(runId, lineage.rootRunId);
+		return lineage;
+	}
+
+	function publishedLineage(lineage: RunLineage, hostRun: DispatchPreparationOptions["hostRun"]): RunLineage {
+		if (hostRun === undefined) return { ...lineage };
+		return {
+			parentRunId: lineage.attempt === 0 ? hostRun.runId : lineage.parentRunId,
+			rootRunId: hostRun.lineage.rootRunId,
+			depth: hostRun.lineage.depth + 1,
+			attempt: lineage.attempt,
+		};
 	}
 
 	function accumulateFinalizedTotals(receipt: RunReceipt): void {
@@ -3144,7 +3157,7 @@ export function createDispatchBundle(
 				if (decision.excludedRouteParts.includes("model")) delete retryReq.model;
 				if (decision.excludedRouteParts.includes("runtime")) delete retryReq.workerRuntime;
 			}
-			const handle = await dispatch(retryReq);
+			const handle = await dispatch(retryReq, undefined, run.hostRun === undefined ? undefined : { hostRun: run.hostRun });
 			// The assignment folds every attempt into one stream with a reset marker.
 			const marker: AssignmentAttemptStartEvent = {
 				type: "attempt_start",
@@ -3330,6 +3343,27 @@ export function createDispatchBundle(
 		}
 	}
 
+	/** Explicit deadlines outlive queue admission and use the ordinary truthful abort path. */
+	function watchAssignmentDeadline(run: ActiveRun, callerDeadlineAt?: number): void {
+		const deadlineAt = run.req.assignmentDeadlineAt;
+		if (deadlineAt === undefined || (callerDeadlineAt !== undefined && deadlineAt >= callerDeadlineAt)) return;
+		let timer: ReturnType<typeof setTimeout> | undefined;
+		let settled = false;
+		const check = (): void => {
+			if (settled || run.aborted || run.stallKilled) return;
+			const remaining = deadlineAt - now();
+			if (remaining <= 0) {
+				contract.abort(run.runId, { cause: "timeout", detail: "timed out: explicit assignment deadline reached" });
+			} else timer = setTimeout(check, Math.min(2_147_483_647, remaining));
+		};
+		const close = (): void => {
+			settled = true;
+			clearTimeout(timer);
+		};
+		void run.promise.then(close, close);
+		check();
+	}
+
 	function startHeartbeatWatchdog(): void {
 		if (heartbeatTimer || heartbeatIntervalMs <= 0) return;
 		heartbeatTimer = setInterval(checkActiveHeartbeats, heartbeatIntervalMs);
@@ -3491,6 +3525,9 @@ export function createDispatchBundle(
 		if (!recipe) {
 			throw new Error(`dispatch: unknown agent recipe: ${req.agentId}`);
 		}
+		// Resolve the applied contract once here so a caller's summary allowance
+		// on a recipe that carries no summary fails before any model boots.
+		dispatchResultContract(req, recipe);
 		const spec = normalizeAgentSpec(recipe);
 		if (req.requestOrigin === "user" && !isUserVisibleAgent(spec)) {
 			throw new Error(
@@ -3593,17 +3630,24 @@ export function createDispatchBundle(
 			settings,
 			runtime: target.runtime,
 		});
-		// Fetch structured project context only for tiers that receive it, so
+		// Fetch captured project context only for tiers that receive it, so
 		// read-only scouts never pay the CLIO-CODER.md read. The tier is spec policy
 		// (capability-class default, recipe frontmatter override).
 		const tier = spec.projectContextTier;
-		const project = projectContext && tier === "bounded" ? projectContext.projectStructuredContext(cwd) : null;
+		const projectPrompt = projectContext && tier === "bounded" ? projectContext.renderPromptContext(cwd) : null;
 		const dynamicPromptMessages = buildDynamicPromptMessages(req, {
 			capabilityClass: spec.capabilityClass,
 			projectContextTier: tier,
 			autonomy: effectiveAutonomy,
 			onPermission: settings?.fleet.permissions.mode ?? "deny",
-			project,
+			projectPrompt,
+			projectReadTools:
+				target.runtime.kind === "subprocess"
+					? null
+					: effectiveTools.includes(ToolNames.Read)
+						? targetToolCapability(target)
+						: false,
+			projectExternalReadTools: target.runtime.kind === "subprocess",
 			workspace: readWorkspaceRootFacts(cwd),
 		});
 		const projectContextProvenance = projectContextProvenanceFor(tier, dynamicPromptMessages);
@@ -3676,6 +3720,9 @@ export function createDispatchBundle(
 					`dispatch: shadow or internal agent '${req.agentId}' cannot run on external ACP agent '${agentId}'`,
 				);
 			}
+			// A summary allowance on a recipe with no summary field fails here,
+			// before the external agent is started.
+			dispatchResultContract(req, spec);
 		}
 		if (!settings) throw new Error("dispatch: effective settings required for ACP delegation");
 		const configured = settings.integrations.externalAgents.entries.find((entry) => entry.id === agentId);
@@ -3703,14 +3750,17 @@ export function createDispatchBundle(
 		// ACP delegation defaults to no project context: repo conventions and
 		// invariants never leave the machine unless this agent's config opts in
 		// with projectContext: "bounded". No recipe means no capability class,
-		// so the verification section can never ride along. The safety posture
+		// so no derived verification supplement is added. Authored test guidance
+		// stays intact within the opted-in source budget. The safety posture
 		// line still rides along for every worker run.
 		const tier: AgentProjectContextTier = configured.projectContext ?? "none";
-		const project = projectContext && tier === "bounded" ? projectContext.projectStructuredContext(cwd) : null;
+		const projectPrompt = projectContext && tier === "bounded" ? projectContext.renderPromptContext(cwd) : null;
 		const dynamicPromptMessages = buildDynamicPromptMessages(req, {
 			projectContextTier: tier,
 			autonomy,
-			project,
+			projectPrompt,
+			projectReadTools: null,
+			projectExternalReadTools: true,
 			workspace: readWorkspaceRootFacts(cwd),
 		});
 		const projectContextProvenance = projectContextProvenanceFor(tier, dynamicPromptMessages);
@@ -3753,12 +3803,25 @@ export function createDispatchBundle(
 		timing: RunPhaseMarks,
 		routeDecision: RouteDecisionV1,
 		observer?: DispatchAdmissionObserver,
+		callerDeadlineAt?: number,
+		hostRun?: DispatchPreparationOptions["hostRun"],
 	): Promise<{
 		runId: string;
 		events: AsyncIterableIterator<unknown>;
 		finalPromise: Promise<RunReceipt>;
 	}> {
 		const lifecycle = resolveAcpDelegationLifecycle(req, settings);
+		const estimate = workerToolCallHardCap(settings);
+		const budgetEnvelope = resolveToolBudgetEnvelope({
+			recipeId: req.agentId,
+			policy: { toolCalls: estimate, readReserve: 0, synthesis: true },
+			...(req.budget === undefined ? {} : { request: req.budget }),
+			hardCap: estimate,
+			hasReadTool: false,
+			retry: (req.lineage?.attempt ?? 0) > 0,
+			revision: false,
+			enforcement: "external-one-shot",
+		});
 		publishDispatchPathScope(req, lifecycle.pathScope);
 		timing.decisionCompletedAt = new Date(now()).toISOString();
 		const targetId = `delegation:${lifecycle.agentConfig.id}`;
@@ -3840,7 +3903,11 @@ export function createDispatchBundle(
 		let outcomeCode: RunOutcomeCode | null = null;
 		let reportedSpoofedOutcome = false;
 		let runIdForPermissionAudit: string | null = null;
-		const outputCapture = createWorkerOutputCapture();
+		const outputCapture = createWorkerOutputCapture({
+			maxBytes: workerOutputCaptureBytes(
+				dispatchResultContract(req, req.agentId && maybeAgents ? maybeAgents.getSpec(req.agentId) : null),
+			),
+		});
 		const markObservedPhase = (field: "firstModelTokenAt" | "firstToolAt"): void => {
 			if (timing[field] !== undefined) return;
 			timing[field] = new Date(now()).toISOString();
@@ -4008,10 +4075,11 @@ export function createDispatchBundle(
 			}
 			identity = detectRunIdentity();
 			ledgerRef.update(envelope.id, {
+				budget: budgetEnvelope,
 				status: "running",
 				pid: acp.pid,
 				heartbeatAt: heartbeatIso(acp.heartbeatAt),
-				lineage,
+				lineage: publishedLineage(lineage, hostRun),
 				identity,
 				node: LOCAL_RUN_NODE,
 				...(lifecycle.pipeline ? { pipeline: lifecycle.pipeline } : {}),
@@ -4043,6 +4111,7 @@ export function createDispatchBundle(
 				});
 			}
 			context.bus.emit(BusChannels.DispatchStarted, {
+				budget: budgetEnvelope,
 				runId: envelope.id,
 				agentId: req.agentId,
 				task: req.task,
@@ -4100,6 +4169,7 @@ export function createDispatchBundle(
 			rejectFinal = rej;
 		});
 		const activeRun: ActiveRun = {
+			budget: budgetEnvelope,
 			runId: envelope.id,
 			req,
 			abort: acp.abort,
@@ -4125,6 +4195,7 @@ export function createDispatchBundle(
 			stallKilled: false,
 			stallTimeoutMs: lifecycle.agentConfig.stallTimeoutMs ?? DEFAULT_ACP_STALL_TIMEOUT_MS,
 			lineage,
+			...(hostRun === undefined ? {} : { hostRun }),
 			heartbeatAt: acp.heartbeatAt,
 			heartbeatStatus: "alive",
 			meter: tokenMeter,
@@ -4145,8 +4216,7 @@ export function createDispatchBundle(
 			// the same messages, so adding both would double-count. Event-metered
 			// values survive only when the adapter reported nothing.
 			const usage = result.usage;
-			const adapterReportedUsage =
-				usage.inputTokens + usage.outputTokens + usage.cacheReadTokens + usage.cacheWriteTokens + usage.reasoningTokens > 0;
+			const adapterReportedUsage = usage.tokensReported;
 			if (adapterReportedUsage) {
 				tokenMeter.inputTokens = usage.inputTokens;
 				tokenMeter.outputTokens = usage.outputTokens;
@@ -4154,8 +4224,9 @@ export function createDispatchBundle(
 				tokenMeter.cacheWriteTokens = usage.cacheWriteTokens;
 				tokenMeter.reasoningTokens = usage.reasoningTokens;
 			}
-			const tokenCount =
-				tokenMeter.inputTokens + tokenMeter.outputTokens + tokenMeter.cacheReadTokens + tokenMeter.cacheWriteTokens;
+			const tokenCount = adapterReportedUsage
+				? usage.totalTokens
+				: tokenMeter.inputTokens + tokenMeter.outputTokens + tokenMeter.cacheReadTokens + tokenMeter.cacheWriteTokens;
 			const safetyMetadata = safety.policy?.metadata() ?? null;
 			const init = result.delegation.initialize;
 			const agentInfo = init?.agentInfo;
@@ -4178,7 +4249,7 @@ export function createDispatchBundle(
 				outcome,
 				outcomeCode,
 				outcomeDetail,
-				lineage,
+				lineage: publishedLineage(lineage, hostRun),
 				identity,
 				// An ACP peer is spawned by this process, so the run's node is this host.
 				node: LOCAL_RUN_NODE,
@@ -4189,6 +4260,7 @@ export function createDispatchBundle(
 				...(req.plan !== undefined ? { plan: req.plan } : {}),
 				...(lifecycle.personaOverride ? { personaOverride: lifecycle.personaOverride } : {}),
 				...(lifecycle.decisionRefs ? { decisionRefs: lifecycle.decisionRefs } : {}),
+				budget: budgetEnvelope,
 				projectContext: lifecycle.projectContext,
 				rulesApplied: lifecycle.rulesApplied,
 				operatorProfileApplied: lifecycle.operatorProfileApplied,
@@ -4207,8 +4279,8 @@ export function createDispatchBundle(
 				reasoningTokenCount: tokenMeter.reasoningTokens,
 				...(upstreamResponses.length > 0 ? { upstreamResponses: [...upstreamResponses] } : {}),
 				...(capturedOutput !== undefined ? { output: capturedOutput } : {}),
-				costUsd: 0,
-				costProvenance: "unknown",
+				costUsd: usage.costUsd,
+				costProvenance: usage.costProvenance ?? "unknown",
 				compiledPromptHash: lifecycle.compiledPromptHash,
 				staticCompositionHash: lifecycle.staticCompositionHash,
 				staticShellHash: lifecycle.staticCompositionHash,
@@ -4284,7 +4356,7 @@ export function createDispatchBundle(
 				outcome,
 				outcomeCode: receipt.outcomeCode ?? null,
 				outcomeDetail: receipt.outcomeDetail ?? null,
-				lineage,
+				lineage: publishedLineage(lineage, hostRun),
 				tokenCount: receipt.tokenCount,
 				inputTokenCount: receipt.inputTokenCount ?? 0,
 				outputTokenCount: receipt.outputTokenCount ?? 0,
@@ -4463,7 +4535,7 @@ export function createDispatchBundle(
 					outcome: "failed" satisfies RunOutcome,
 					outcomeDetail: detail,
 					reason: "failed",
-					lineage,
+					lineage: publishedLineage(lineage, hostRun),
 					exitCode: 1,
 				});
 				throw error;
@@ -4472,6 +4544,7 @@ export function createDispatchBundle(
 			}
 		})().then(resolveFinal, rejectFinal);
 		active.set(envelope.id, activeRun);
+		watchAssignmentDeadline(activeRun, callerDeadlineAt);
 
 		return {
 			runId: envelope.id,
@@ -4491,6 +4564,7 @@ export function createDispatchBundle(
 		finalPromise: Promise<RunReceipt>;
 		effectiveRequest: DispatchRequest;
 	}> {
+		const hostRun = preparation?.hostRun;
 		const requestedAt = new Date(now()).toISOString();
 		const timing: RunPhaseMarks = { requestedAt, decisionStartedAt: requestedAt };
 		const settings = getEffectiveSettings();
@@ -4536,11 +4610,13 @@ export function createDispatchBundle(
 					const phases = envelope ? deriveEnvelopePhaseDurations(envelope) : undefined;
 					if (envelope === null || envelope === undefined) return;
 					const outcome = receipt.outcome ?? (receipt.exitCode === 0 ? "succeeded" : "failed");
+					const assignmentId = assignmentRootFor(receipt.runId);
 					const quality = reduceRouteQuality({
-						subject: { receipt, envelope },
+						subject: { receipt, envelope, assignmentId },
 						receipts: [{ receipt, envelope }],
 					});
 					routeObserver.recordOutcome(observation.id, {
+						assignmentId,
 						route: observation.decision.executedRoute,
 						outcome,
 						qualityLabel: quality.label,
@@ -4558,11 +4634,6 @@ export function createDispatchBundle(
 			return handle;
 		};
 		if (req.delegationAgentId) {
-			if (req.budget !== undefined) {
-				throw new Error(
-					"dispatch: budget envelopes cannot be enforced on an ACP delegation target; dispatch to a native or claude-sdk worker",
-				);
-			}
 			assertPlannedNodeIdentity(req, { id: "local", kind: "local" });
 			assertProtectedArtifactsEnforceable("acp-delegation", false, protectedArtifactState);
 			if (req.responseSchema !== undefined) {
@@ -4580,7 +4651,15 @@ export function createDispatchBundle(
 			}
 			await rebindReservationSlot(req, "local", null, UNKNOWN_PRICING_ADMISSION_ESTIMATE_USD, settings);
 			routeObservation = observeShadowRoute(req, undefined, settings);
-			const delegated = await dispatchAcpDelegation(req, settings, timing, routeObservation.decision, observer);
+			const delegated = await dispatchAcpDelegation(
+				req,
+				settings,
+				timing,
+				routeObservation.decision,
+				observer,
+				preparation?.deadlineAt,
+				hostRun,
+			);
 			// An ACP member never runs host verification, so it can only ever leave
 			// the barrier. It still edits the checkout, so the barrier has to wait
 			// for it; dispatch() releases it when its finalPromise settles.
@@ -4835,7 +4914,11 @@ export function createDispatchBundle(
 			lifecycle.runtimeKind === "http" ||
 			(lifecycle.runtimeKind === "sdk" && lifecycle.target.runtime.id === "claude-sdk");
 		let workerPolicyPermissionCounter = 0;
-		const outputCapture = createWorkerOutputCapture();
+		// The bound the receipt can seal follows the contract this run will be
+		// validated against; a conforming result never arrives clipped.
+		const outputCapture = createWorkerOutputCapture({
+			maxBytes: workerOutputCaptureBytes(dispatchResultContract(req, lifecycle.recipe)),
+		});
 		const markObservedPhase = (field: "firstModelTokenAt" | "firstToolAt"): void => {
 			if (timing[field] !== undefined) return;
 			timing[field] = new Date(now()).toISOString();
@@ -5114,7 +5197,7 @@ export function createDispatchBundle(
 			ledgerRef.update(envelope.id, {
 				status: "running",
 				pid,
-				lineage,
+				lineage: publishedLineage(lineage, hostRun),
 				identity,
 				node: placement?.node ?? LOCAL_RUN_NODE,
 				...(placement?.reroutes !== undefined && placement.reroutes.length > 0
@@ -5267,6 +5350,7 @@ export function createDispatchBundle(
 			stallKilled: false,
 			stallTimeoutMs: null,
 			lineage,
+			...(hostRun === undefined ? {} : { hostRun }),
 			heartbeatAt,
 			heartbeatStatus: "alive",
 			meter: tokenMeter,
@@ -5350,7 +5434,7 @@ export function createDispatchBundle(
 				runtimeKind: lifecycle.runtimeKind,
 				outcome,
 				outcomeCode,
-				lineage,
+				lineage: publishedLineage(lineage, hostRun),
 				...(req.intent !== undefined ? { intent: structuredClone(req.intent) } : {}),
 				pathScope: structuredClone(lifecycle.pathScope.provenance),
 				identity,
@@ -5481,7 +5565,7 @@ export function createDispatchBundle(
 				outcome,
 				outcomeCode: receipt.outcomeCode ?? null,
 				outcomeDetail: receipt.outcomeDetail ?? null,
-				lineage,
+				lineage: publishedLineage(lineage, hostRun),
 				tokenCount: receipt.tokenCount,
 				inputTokenCount: receipt.inputTokenCount ?? 0,
 				outputTokenCount: receipt.outputTokenCount ?? 0,
@@ -5601,13 +5685,12 @@ export function createDispatchBundle(
 				const steering = snapshotSteeringProvenance();
 				const capturedOutput = outputCapture.snapshot();
 				const observedRunEffects = runEffects.snapshot();
-				const appliedResultContract = appliesRecipeResultContract(req.gate?.role)
-					? (req.resultContractOverride ?? lifecycle.recipe?.resultContract ?? null)
-					: null;
+				const appliedResultContract = dispatchResultContract(req, lifecycle.recipe) ?? null;
 				const resultContract = validateRecipeResult({
 					contract: appliedResultContract,
 					reachedTerminalResult: resultContractWasDue(finalOutcome, outcomeCode),
 					output: capturedOutput?.state === "final" ? capturedOutput.text : null,
+					outputTruncated: capturedOutput?.truncated === true,
 					cwd: lifecycle.cwd,
 					networkAllowed:
 						lifecycle.admission.allowedTools.includes(ToolNames.WebFetch) ||
@@ -5657,8 +5740,7 @@ export function createDispatchBundle(
 					finalDetail = [finalDetail, describeUngroundedValidations(validationGrounding)].filter(Boolean).join("; ");
 				}
 				const hasTerminalArtifact =
-					(req.resultContractOverride ?? lifecycle.recipe?.resultContract)?.kind === "architect-plan" &&
-					resultValidation?.conformance === "pass";
+					appliedResultContract?.kind === "architect-plan" && resultValidation?.conformance === "pass";
 				if (finalOutcome === "succeeded" && !hasDurableFinalOutput(capturedOutput) && !hasTerminalArtifact) {
 					finalOutcome = "failed";
 					outcomeCode = "worker_final_output_missing";
@@ -5848,7 +5930,7 @@ export function createDispatchBundle(
 					outcome: "failed" satisfies RunOutcome,
 					outcomeDetail: detail,
 					reason: "failed",
-					lineage,
+					lineage: publishedLineage(lineage, hostRun),
 					exitCode: 1,
 				});
 				throw error;
@@ -5859,6 +5941,7 @@ export function createDispatchBundle(
 		})().then(resolveFinal, rejectFinal);
 
 		active.set(envelope.id, activeRun);
+		watchAssignmentDeadline(activeRun, preparation?.deadlineAt);
 
 		return attachRouteObservation({
 			runId: envelope.id,
@@ -5985,11 +6068,6 @@ export function createDispatchBundle(
 		req = validation.restore(validated.spec);
 
 		if (req.delegationAgentId) {
-			if (req.budget !== undefined) {
-				throw new Error(
-					"dispatch: budget envelopes cannot be enforced on an ACP delegation target; dispatch to a native or claude-sdk worker",
-				);
-			}
 			const protectedArtifactState = getProtectedArtifactState();
 			assertProtectedArtifactsEnforceable("acp-delegation", false, protectedArtifactState);
 			if (req.responseSchema !== undefined) {
@@ -6405,6 +6483,7 @@ export function createDispatchBundle(
 			exitCode: 0,
 			gate,
 			council,
+			...(input.template.lineage !== undefined ? { lineage: { ...input.template.lineage } } : {}),
 			...(input.template.plan !== undefined ? { plan: input.template.plan } : {}),
 		});
 		const receipt = l.recordReceipt(runId, {
@@ -6446,6 +6525,7 @@ export function createDispatchBundle(
 			sessionId: input.template.sessionId,
 			gate,
 			council,
+			...(input.template.lineage !== undefined ? { lineage: { ...input.template.lineage } } : {}),
 			...(input.template.plan !== undefined ? { plan: input.template.plan } : {}),
 		});
 		await l.persist();
@@ -6651,7 +6731,7 @@ export function createDispatchBundle(
 				runtimeKind: run.runtimeKind,
 				outcomePhase: run.stallKilled ? "terminating" : run.aborted ? "aborting" : "running",
 				heartbeat,
-				lineage: { ...run.lineage },
+				lineage: publishedLineage(run.lineage, run.hostRun),
 				startedAt: run.startedAt,
 				elapsedMs,
 				timing,
@@ -6739,7 +6819,12 @@ export function createDispatchBundle(
 		if (assignments.get(id) !== null) return id;
 		const live = active.get(id);
 		if (live) return live.lineage.rootRunId;
-		return ledger?.get(id)?.lineage?.rootRunId ?? id;
+		const local = assignmentRootsByAttempt.get(id);
+		if (local !== undefined) return local;
+		// After restart the immutable attempt history identifies the logical
+		// assignment; a receipt's root may instead name its main host run.
+		const stored = listStoredAssignments().find((record) => record.assignmentId === id || record.attempts.includes(id));
+		return stored?.assignmentId ?? ledger?.get(id)?.lineage?.rootRunId ?? id;
 	}
 
 	function currentAssignmentRun(id: string): ActiveRun | null {
@@ -6794,8 +6879,8 @@ export function createDispatchBundle(
 			};
 		},
 		assignments: {
-			get: (id) => assignments.get(id),
-			getStored: (id) => getStoredAssignment(id),
+			get: (id) => assignments.get(assignmentRootFor(id)),
+			getStored: (id) => getStoredAssignment(assignmentRootFor(id)),
 			flushWrites: async () => {
 				await Promise.allSettled([...assignmentWrites]);
 			},