@krapht/ork 1.0.0-alpha.13 → 1.0.0-alpha.14

package/dist/{src-BeR6f70A.mjs → src-tsuZRu0H.mjs}

@@ -495,6 +495,8 @@ const forEachFields = { forEach: z.union([z.strictObject({
 	maxItems: z.number().int().positive().describe("Most items allowed. A longer list asks whether to stop, run this many, or run all."),
 	...pacingFields
 })]).optional().describe("Run this node once per item of a list, with no model turn to fan out or gather. Items are `<id>.0`, `<id>.1`, ….") };
+/** The nodes that run one thing may name a lock (RFC-016). */
+const lockFields = { lock: z.string().regex(/\S/u, "a lock needs a name").describe("The lock this node holds, e.g. `branch:{{inputs.branch}}`. Held from the first node that names it to the last, or the run's end; one run at a time holds it, the others wait. One name per node.").optional() };
 // ../schema/src/settings.ts
 /**
 * @file The settings the workflow format shares between nodes, agents, defaults
@@ -562,9 +564,12 @@ const IsolationSchema = z.enum([
 	"readonly"
 ]);
 const BudgetSchema = z.number().positive();
+/** A cap in tokens: input, output and cache-write; cache reads don't count. */
+const TokenBudgetSchema = z.number().int().positive();
 /** Caps across runs (RFC-007), in Claude Code's estimated dollars. */
 const QuotasSchema = z.strictObject({
 	dayUsd: BudgetSchema.optional().describe("Most to spend in a calendar day."),
+	dayTokens: TokenBudgetSchema.optional().describe("Most tokens (input, output, cache-write) to use in a calendar day."),
 	weekUsd: BudgetSchema.optional().describe("Most to spend in a calendar week, from Monday."),
 	monthUsd: BudgetSchema.optional().describe("Most to spend in a calendar month.")
 });
@@ -651,6 +656,7 @@ const McpCallNodeSchema = z.strictObject({
 	timeout: TimeoutSchema.optional().describe("How long the call may take, e.g. 5m; then the node fails. With watch:, how long one look may take."),
 	watch: WatchSchema.optional().describe("Call the tool again and again until a condition holds, with no model turn."),
 	...notifyFields,
+	...lockFields,
 	...forEachFields
 });
 // ../schema/src/steps.ts
@@ -698,6 +704,7 @@ const toolFields = {
 	once: onceField,
 	...toolProgramFields,
 	...notifyFields,
+	...lockFields,
 	...forEachFields
 };
 /** What every tool node has: `tool.<id>`, its command, allow list and cwd. */
@@ -727,7 +734,6 @@ const TOOL_NODE_SCHEMAS = INTEGRATIONS.map((i) => toolNodeSchema(i));
 * @file The node types of the workflow format (Claude, tool, control and gate
 *   nodes) as Zod schemas.
 */
-const base = nodeBaseFields;
 /** A Claude node's output field that is not a list: a rule or JSON Schema. */
 const NotListSchema = z.unknown().refine((value) => typeof value !== "object" || value === null || !("list" in value), { message: LIST_RULE_HINT });
 const NODE_EFFORT_HINT = "expected low, medium, high, xhigh or max, or {{item.<field>}}";
@@ -749,6 +755,7 @@ const agentSettings = {
 	context: z.array(z.string()).optional().describe("Node-layer context files."),
 	isolation: IsolationSchema.optional(),
 	budgetUsd: BudgetSchema.optional(),
+	budgetTokens: TokenBudgetSchema.optional(),
 	maxTurns: TurnsSchema.optional(),
 	timeout: TimeoutSchema.optional().describe("How long the node may work, e.g. 30m; time waiting on the user does not count."),
 	practices: PracticesSchema.optional(),
@@ -768,6 +775,7 @@ const AGENT_SETTING_KEYS = [
 	"context",
 	"isolation",
 	"budgetUsd",
+	"budgetTokens",
 	"maxTurns",
 	"timeout",
 	"practices",
@@ -776,7 +784,7 @@ const AGENT_SETTING_KEYS = [
 	"output"
 ];
 const claudeFields = {
-	...base,
+	...nodeBaseFields,
 	agent: AgentNameSchema.optional().describe("The agent that fills this node; its settings apply where the node sets none, and the prompt is its task."),
 	prompt: z.string().optional().describe("Task brief. Supports {{inputs.*}} and {{nodes.<id>.output.*}} templates."),
 	instructions: z.string().optional().describe("Node-layer instructions appended to the system prompt."),
@@ -796,6 +804,7 @@ const ClaudeWorkerNodeSchema = z.strictObject({
 	...claudeFields,
 	mcp: McpNamesSchema,
 	...notifyFields,
+	...lockFields,
 	...forEachFields,
 	...stepFields
 });
@@ -807,11 +816,11 @@ const ClaudeSubagentNodeSchema = z.strictObject({
 });
 const SplitNodeSchema = z.strictObject({
 	type: z.literal("control.split"),
-	...base
+	...nodeBaseFields
 });
 const JoinNodeSchema = z.strictObject({
 	type: z.literal("control.join"),
-	...base,
+	...nodeBaseFields,
 	mode: z.enum([
 		"all",
 		"any",
@@ -821,7 +830,7 @@ const JoinNodeSchema = z.strictObject({
 });
 const RouterNodeSchema = z.strictObject({
 	type: z.literal("control.router"),
-	...base,
+	...nodeBaseFields,
 	mode: z.enum(["first", "all"]).optional().describe("Follow the first matching edge (default), or every match.")
 });
 const DecisionOptionSchema = z.union([z.string(), z.strictObject({
@@ -831,7 +840,7 @@ const DecisionOptionSchema = z.union([z.string(), z.strictObject({
 })]);
 const HumanGateNodeSchema = z.strictObject({
 	type: z.literal("human.gate"),
-	...base,
+	...nodeBaseFields,
 	...notifyFields,
 	question: z.string(),
 	document: z.string().optional(),
@@ -842,7 +851,7 @@ const HumanGateNodeSchema = z.strictObject({
 });
 const WorkflowCallNodeSchema = z.strictObject({
 	type: z.literal("workflow.call"),
-	...base,
+	...nodeBaseFields,
 	...notifyFields,
 	...forEachFields,
 	workflow: z.string().describe("The workflow's name, as in its project's workflows folder."),
@@ -871,12 +880,7 @@ const NodeSchema = z.discriminatedUnion("type", [
 	McpCallNodeSchema
 ]);
 const isToolNode = (node) => node.type.startsWith(TOOL_PREFIX);
-const CLAUDE_NODE_TYPES = [
-	"agent.leader",
-	"agent.worker",
-	"agent.subagent"
-];
-const isClaudeNode = (node) => CLAUDE_NODE_TYPES.includes(node.type);
+const isClaudeNode = (node) => node.type.startsWith("agent.");
 // ../schema/src/agents.ts
 /**
 * @file Agents: who fills a Claude node. An agent is a portable `<name>.md`
@@ -1066,6 +1070,7 @@ const DefaultsSchema = z.strictObject({
 	effort: EffortSchema.optional(),
 	isolation: IsolationSchema.optional(),
 	budgetUsd: BudgetSchema.optional(),
+	budgetTokens: TokenBudgetSchema.optional(),
 	maxTurns: TurnsSchema.optional(),
 	timeout: TimeoutSchema.optional().describe("For tool and Claude nodes that set none; a gate's own timeout is separate."),
 	practices: PracticesSchema.optional(),
@@ -1180,6 +1185,7 @@ const WorkflowSchema = z.strictObject({
 	agents: z.record(AgentNameSchema, AgentSchema).optional().describe("Agents defined in this workflow; they win over the project's and the user's of the same name."),
 	limits: z.strictObject({
 		budgetUsd: BudgetSchema.optional().describe("Hard cap for the whole run."),
+		budgetTokens: TokenBudgetSchema.optional().describe("Hard cap for the whole run in tokens (input, output, cache-write)."),
 		concurrency: z.number().int().positive().optional().describe("Max sessions running at once."),
 		timeout: TimeoutSchema.optional().describe("How long the whole run may work, e.g. 2h; time waiting on the user does not count.")
 	}).optional(),
@@ -1648,7 +1654,7 @@ const sharedAnchors = (doc) => {
 const refuseShared = (doc, node, path) => {
 	if (isAlias(node) || isNode(node) && "anchor" in node && typeof node.anchor === "string" && sharedAnchors(doc).has(node.anchor)) throw new EditRefused(`${shownPath$1(path)} is shared through a YAML anchor, so changing it here would change another node too. Replace the anchor in the file first.`);
 };
-const keyOf = (pair) => isScalar(pair.key) ? pair.key.value : pair.key;
+const keyOf$1 = (pair) => isScalar(pair.key) ? pair.key.value : pair.key;
 /** The value of a map's or list's child, as a node. */
 const childNode = (parent, key) => isMap(parent) || isSeq(parent) ? parent.get(key, true) : void 0;
 /** A key added to a map, before the first existing key that follows it. */
@@ -1657,7 +1663,7 @@ const insertPair = (doc, map, key, value, schema) => {
 	const order = keysOf(schema, map.toJS(doc));
 	const rank = order.indexOf(key);
 	const next = rank === -1 ? -1 : map.items.findIndex((pair) => {
-		return order.indexOf(String(keyOf(pair))) > rank;
+		return order.indexOf(String(keyOf$1(pair))) > rank;
 	});
 	const pair = doc.createPair(key, value);
 	if (next === -1) map.items.push(pair);
@@ -1693,9 +1699,9 @@ const updated = (doc, old, value, schema, path) => {
 const updateMap = (doc, map, entries, schema, path) => {
 	const keys = new Set(entries.map(([key]) => key));
 	const whole = map.toJS(doc);
-	map.items = map.items.filter((pair) => keys.has(String(keyOf(pair))));
+	map.items = map.items.filter((pair) => keys.has(String(keyOf$1(pair))));
 	for (const [key, value] of entries) {
-		const pair = map.items.find((p) => String(keyOf(p)) === key);
+		const pair = map.items.find((p) => String(keyOf$1(p)) === key);
 		const child = childOf(schema, key, whole);
 		if (pair === void 0) insertPair(doc, map, key, value, schema);
 		else pair.value = updated(doc, pair.value, value, child, [...path, key]);
@@ -1729,7 +1735,7 @@ const emptyFor = (next) => typeof next === "number" ? new YAMLSeq() : new YAMLMa
 /** Sets a child that may not exist yet in its map or list. */
 const setChild = (doc, parent, key, value, schema, path) => {
 	if (isMap(parent) && typeof key === "string") {
-		const pair = parent.items.find((p) => String(keyOf(p)) === key);
+		const pair = parent.items.find((p) => String(keyOf$1(p)) === key);
 		if (pair === void 0) insertPair(doc, parent, key, value, schema);
 		else pair.value = value;
 		return;
@@ -3412,7 +3418,7 @@ const lstatOrUndefined = (target) => {
 		return;
 	}
 };
-const stateOf$1 = (root, relative, origin) => {
+const stateOf$2 = (root, relative, origin) => {
 	const at = path.join(root, relative);
 	const stat = lstatOrUndefined(at);
 	if (stat === void 0) return { state: "missing" };
@@ -3442,7 +3448,7 @@ const toolLinks = (projectRoot, tools = linkableTools()) => tools.flatMap((id) =
 			kind,
 			path: folder,
 			origin,
-			...stateOf$1(projectRoot, folder, origin)
+			...stateOf$2(projectRoot, folder, origin)
 		}];
 	});
 });
@@ -3942,8 +3948,8 @@ const socketRoom = (home = homedir(), platform = process.platform) => ({
 	max: SOCKET_PATH_MAX[platform]
 });
 /** For errors another handler already settles. */
-const ignore$1 = () => {};
-const messageOf$2 = (line) => {
+const ignore$2 = () => {};
+const messageOf$3 = (line) => {
 	try {
 		const value = JSON.parse(line);
 		if (value === null || typeof value !== "object" || !("type" in value)) return;
@@ -3970,9 +3976,9 @@ const serveRun = async (options) => {
 			followers.delete(socket);
 		});
 		const lines = createInterface({ input: socket });
-		lines.on("error", ignore$1);
+		lines.on("error", ignore$2);
 		lines.on("line", (line) => {
-			const message = messageOf$2(line);
+			const message = messageOf$3(line);
 			if (message?.type === "wake") options.onWake();
 			if (message?.type === "follow") {
 				for (const stored of options.backlog(message.after)) socket.write(`${JSON.stringify(stored)}\n`);
@@ -4031,7 +4037,7 @@ const followSocket = (file, after, onEvent, signal) => {
 		})}\n`);
 	});
 	const lines = createInterface({ input: socket });
-	lines.on("error", ignore$1);
+	lines.on("error", ignore$2);
 	lines.on("line", (line) => {
 		try {
 			onEvent(JSON.parse(line));
@@ -4954,7 +4960,7 @@ const END_KINDS = {
 	no_report: info("No report", "agent", () => "ended without handing in a report", "Check that its brief says what to report; its session is in the Logs panel."),
 	invalid_report: info("Invalid report", "agent", (f) => `handed in a report that breaks its declared output${colon(f.reason)}`, "Check that its brief asks for every field its `output.schema` declares."),
 	turn_limit: info("Turn limit", "workflow", (f) => `reached its turn limit${paren(f.maxTurns === void 0 ? void 0 : String(f.maxTurns))}`, "Raise its `maxTurns`, or give it a smaller task."),
-	budget_limit: info("Budget limit", "workflow", (f) => `reached its budget${paren(f.budgetUsd === void 0 ? void 0 : usd$1(f.budgetUsd))}`, "Raise `budgetUsd` on the node or `limits.budgetUsd` on the workflow, then `ork resume`."),
+	budget_limit: info("Budget limit", "workflow", (f) => `reached its budget${paren([...f.budgetUsd === void 0 ? [] : [usd$1(f.budgetUsd)], ...f.budgetTokens === void 0 ? [] : [`${String(f.budgetTokens)} tokens`]].join(", ") || void 0)}`, "Raise `budgetUsd` or `budgetTokens` on the node, or the same in the workflow's `limits`, then `ork resume`."),
 	timed_out: info("Timed out", "workflow", (f) => `reached its timeout${paren(f.timeout)}`, "Raise its `timeout`, or give it a smaller task."),
 	context_too_long: info("Context too long", "workflow", () => "outgrew its model's context", "Give it a smaller task or less context, or a model with a larger context."),
 	plan_limit: info("Plan limit", "account", (f) => `ran into a usage limit${paren(f.window?.replaceAll("_", " "))}`, `Wait until the limit resets. ${RETRY}`, {
@@ -7160,7 +7166,8 @@ const TEMPLATE_FIELDS = [
 	"document",
 	"workflow",
 	"project",
-	"ref"
+	"ref",
+	"lock"
 ];
 /**
 * The templates of a node that may read `{{item}}`, beside `inputs`,
@@ -7207,6 +7214,14 @@ const checkReferences = (workflow, edges, rules = /* @__PURE__ */ new Map()) =>
 	}))));
 	const fromMcp = Object.entries(workflow.nodes).flatMap(([id, node]) => node.type === "mcp.call" ? stringsIn(node.arguments ?? {}, ["arguments"]).flatMap(({ at, text }) => checkTemplate(id, at, text, context, itemOf(id))) : []);
 	const fromSteps = Object.entries(workflow.nodes).flatMap(([id, node]) => isToolNode(node) ? [] : programsOf(node).flatMap(({ at, program }) => program.command === void 0 ? [] : checkTemplate(id, [...at, "command"], program.command, context)));
+	const fromLocks = Object.entries(workflow.nodes).flatMap(([id, node]) => {
+		const parsed = "lock" in node ? parseTemplate(node.lock ?? "") : void 0;
+		return parsed?.ok === true ? parsed.parts.flatMap((part) => typeof part === "string" ? [] : collectPaths(part.expr).filter(([root]) => root === "nodes").map((segments) => error("lock.scope", `\`${describePath(segments)}\`: a lock's name reads only \`inputs\`, since it is taken before the node runs`, [
+			"nodes",
+			id,
+			"lock"
+		]))) : [];
+	});
 	const fromOutputs = Object.entries(workflow.outputs ?? {}).flatMap(([name, value]) => {
 		const parsed = parseTemplate(value);
 		const path = ["outputs", name];
@@ -7220,6 +7235,7 @@ const checkReferences = (workflow, edges, rules = /* @__PURE__ */ new Map()) =>
 		...fromEnv,
 		...fromSteps,
 		...fromMcp,
+		...fromLocks,
 		...checkToolEnv(workflow),
 		...fromOutputs,
 		...checkConditionRefs(workflow, edges, rules, context)
@@ -7566,780 +7582,940 @@ const slotClock = (base, machine) => {
 		}
 	};
 };
-// ../core/src/project/calls.ts
+// ../core/src/run/declared.ts
 /**
-* @file `ork validate`'s check of `workflow.call` nodes against what they call
-*   (RFC-004): the project, the workflow, the node and the required inputs. A
-*   project not registered here is only a warning, since it may be on another
-*   machine; a run refuses it. A name with a template is left to the run.
+* @file Holding a node to what it declares of its output (RFC-010): a missing
+*   field, the wrong type or a value outside the list is a problem to fail the
+*   node on, so a condition never quietly matches nothing. A declared list
+*   (RFC-013) is held to being a list, and each item to its shape. It reads the
+*   format's own shape; a field written out as JSON Schema stays the driver's
+*   to enforce. A list a resume hands back keeps the file's real values when it
+*   only differs by masking.
 */
-const hasTemplate = (text) => text.includes("{{");
-/** A workflow's file: a folder of that name is no workflow. */
-const fileState = (file) => {
-	try {
-		return statSync(file, { throwIfNoEntry: false })?.isFile() === true ? "file" : "none";
-	} catch {
-		return "unreadable";
-	}
+const TYPE_NAMES = {
+	string: "text",
+	number: "a number",
+	integer: "a whole number",
+	boolean: "true or false"
 };
-/** A workflow from its file, or `null` when it cannot be read or is not valid. */
-const readWorkflow = (file) => {
-	try {
-		const parsed = parseWorkflow(readFileSync(file, "utf8"));
-		return parsed.ok ? parsed.workflow : null;
-	} catch {
-		return null;
-	}
+const FITS = {
+	string: (value) => typeof value === "string",
+	number: (value) => typeof value === "number",
+	integer: (value) => Number.isInteger(value),
+	boolean: (value) => typeof value === "boolean"
+};
+const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const listed = (values) => {
+	const names = values.map((value) => markValue(String(value)));
+	const last = names.pop();
+	return names.length === 0 ? String(last) : `${names.join(", ")} or ${String(last)}`;
+};
+const shown = (value) => {
+	const text = typeof value === "string" ? value : JSON.stringify(value) ?? String(value);
+	return markValue(text.length > 80 ? `${text.slice(0, 80)}…` : text);
+};
+/** What's wrong with one field, if it's a shape this can read. */
+const fieldProblem = (name, rule, value) => {
+	const shape = listShape(rule);
+	if (shape !== void 0) return listProblem(name, shape, value);
+	const expected = Array.isArray(rule) ? listed(rule) : typeof rule === "string" ? TYPE_NAMES[rule] : void 0;
+	if (expected === void 0) return null;
+	if (value === void 0) return `${name} is missing, expected ${expected}`;
+	return (Array.isArray(rule) ? rule.some((item) => item === value) : FITS[String(rule)]?.(value)) === true ? null : `${name} is ${shown(value)}, expected ${expected}`;
+};
+const fieldProblems = (declared, value, prefix) => Object.entries(declared).flatMap(([name, rule]) => {
+	const problem = fieldProblem(`${prefix}${name}`, rule, value[name]);
+	return problem === null ? [] : [problem];
+});
+/** What's wrong with one item; `name` says which, as `tasks[2]`. */
+const itemProblems = (name, shape, item) => {
+	if (Object.keys(shape).length === 0) return [];
+	return isRecord$2(item) ? fieldProblems(shape, item, `${name}.`) : [`${name} is ${shown(item)}, expected an object`];
+};
+/** Only the first bad item is named, so a long list can't flood the reason. */
+const listProblem = (name, shape, value) => {
+	if (value === void 0) return `${name} is missing, expected a list`;
+	if (!Array.isArray(value)) return `${name} is ${shown(value)}, expected a list`;
+	const bad = value.map((item, index) => itemProblems(`${name}[${index}]`, shape, item)).find((problems) => problems.length > 0);
+	return bad === void 0 ? null : bad.join("; ");
 };
 /**
-* The workflows a workflow calls by a literal name, and those they call. One
-* that cannot be read is left out: `ork validate` and the call report it. A
-* call of one `node:` runs only that session, so its tool nodes do not count
-* unless `everyCall`, and nor does a call among `finished`. `unreadable` hears
-* of one that is there but could not be read.
+* What's wrong with `value` by this declaration, or `null`. With nothing
+* declared, nothing can be.
 */
-const calledWorkflows = (workflow, own, registered, options = {}) => {
-	const seen = /* @__PURE__ */ new Set();
-	const found = [];
-	const walk = (from, place) => {
-		for (const [id, node] of Object.entries(from.nodes)) {
-			if (node.type !== "workflow.call") continue;
-			if (hasTemplate(node.workflow) || hasTemplate(node.project ?? "")) continue;
-			if (options.everyCall !== true && node.node !== void 0) continue;
-			if (from === workflow && options.finished?.has(id) === true) continue;
-			const target = node.project === void 0 ? place : registered.find((other) => other.id === node.project);
-			if (target === void 0) continue;
-			const file = path.join(placeFiles(target).workflows, `${path.basename(node.workflow)}.ork.yaml`);
-			if (seen.has(file)) continue;
-			seen.add(file);
-			const state = fileState(file);
-			if (state === "none") continue;
-			const called = state === "file" ? readWorkflow(file) : null;
-			if (called === null) {
-				options.unreadable?.(node.workflow);
-				continue;
-			}
-			found.push(called);
-			walk(called, target);
-		}
-	};
-	walk(workflow, own);
-	return found;
+const declaredProblem = (declared, value) => {
+	if (declared === void 0 || Object.keys(declared).length === 0) return null;
+	if (!isRecord$2(value)) return `the result isn't a JSON object`;
+	const problems = fieldProblems(declared, value, "");
+	return problems.length === 0 ? null : problems.join("; ");
 };
-const checkCallTargets = (workflow, own, registered) => Object.entries(workflow.nodes).flatMap(([id, node]) => {
-	if (node.type !== "workflow.call") return [];
-	const at = ["nodes", id];
-	if (hasTemplate(node.workflow) || hasTemplate(node.project ?? "")) return [];
-	if (/[/\\]/u.test(node.workflow) || node.workflow === "..") return [error("call.workflow", `call \`${id}\`: \`${node.workflow}\` is not a workflow's name`, [...at, "workflow"])];
-	const target = node.project === void 0 ? own : registered.find((place) => place.id === node.project);
-	if (target === void 0) return [warning("call.project", `call \`${id}\`: project \`${String(node.project)}\` is not registered here, so a run will refuse it; register it with \`ork register\``, [...at, "project"])];
-	const file = path.join(placeFiles(target).workflows, `${node.workflow}.ork.yaml`);
-	const state = fileState(file);
-	if (state === "none") return [error("call.workflow", `call \`${id}\`: no workflow \`${node.workflow}\` in ${target.root}`, [...at, "workflow"])];
-	const called = state === "file" ? readWorkflow(file) : null;
-	if (called === null) return [error("call.workflow", `call \`${id}\`: the workflow \`${node.workflow}\` cannot be read or is not valid; run \`ork validate\` on it`, [...at, "workflow"])];
-	const found = [];
-	if (node.node !== void 0) {
-		const type = called.nodes[node.node]?.type;
-		if (type !== "agent.leader" && type !== "agent.worker") found.push(error("call.node", `call \`${id}\`: \`${node.node}\` is not a leader or worker of \`${node.workflow}\``, [...at, "node"]));
-	}
-	for (const [name, input] of Object.entries(called.inputs ?? {})) if (input.required === true && input.default === void 0 && node.inputs?.[name] === void 0) found.push(error("call.input", `call \`${id}\`: \`${node.workflow}\` requires the input \`${name}\``, [...at, "inputs"]));
-	return found;
+/**
+* The list a resume hands back. Events are stored masked, so a static list that
+* still masks to the record is the file's, with its real values.
+*/
+const unmasked = (forEach, recorded) => "items" in forEach && JSON.stringify(forEach.items, maskReplacer) === JSON.stringify(recorded) ? [...forEach.items] : recorded;
+// ../core/src/run/ended.ts
+/**
+* @file A node's result as it ended (specs/runtime/session-ends.md): one place
+*   that sets `end`, makes a failure's `error` its message and marks a
+*   transient kind, and that the engine's modules build ends through.
+*/
+/**
+* The result as it ended: a failure's `error` is the end's message (what the
+* run summary lists), and a transient kind marks it `transient`.
+*/
+const endedWith = (result, end) => ({
+	...result,
+	end,
+	...result.ok ? {} : { error: end.message },
+	...END_KINDS[end.kind].transient ? { transient: true } : {}
 });
-// ../core/src/run/routing.ts
+/** The reason a run's signal is aborted with when `timeout` passed. */
+const runTimedOut = (timeout) => timeout === void 0 ? { kind: "timed_out" } : {
+	kind: "timed_out",
+	timeout
+};
+const isTimedOut = (reason) => typeof reason === "object" && reason !== null && "kind" in reason && reason.kind === "timed_out";
 /**
-* @file Where a finished node's output goes: which outgoing edges are taken,
-*   and what each arrival does at its target (activate it, skip it, or wait,
-*   for a join). Pure: the scheduler owns time, sessions and loop counters.
+* The end of a node its run's signal stopped: `timed_out` when the run's
+* timeout aborted it, `interrupted` otherwise.
 */
-/** A `maxRounds` edge. Removing them leaves a DAG (the compiler checks it). */
-const isLoopEdge = (edge) => edge.maxRounds !== void 0;
-const keys = /* @__PURE__ */ new WeakMap();
-const edgeKey = (edge) => {
-	let key = keys.get(edge);
-	if (key === void 0) {
-		key = `${String(edge.source)}:${edge.from}->${edge.to}`;
-		keys.set(edge, key);
-	}
-	return key;
+const stoppedEnd = (signal, detail) => {
+	const reason = signal.reason;
+	if (!isTimedOut(reason)) return endFor("interrupted", {}, detail);
+	const facts = reason.timeout === void 0 ? {} : { timeout: reason.timeout };
+	return endFor("timed_out", facts, detail);
 };
+/** A failure that ended as `end`, its message the output's summary. */
+const failedWith = (end, output) => endedWith({
+	ok: false,
+	output: output ?? {
+		status: "fail",
+		summary: end.message
+	}
+}, end);
 /**
-* Decides every outgoing edge of a finished node. An edge with `when:` is taken
-* when its condition holds for the node's output; one without is taken when the
-* node succeeded. A `control.router` in `first` mode takes only its first
-* matching edge.
+* The result with its end's detail scrubbed with the feedback redactor (the
+* run's `roots` and the home folder), as a session's is
+* (specs/runtime/session-ends.md), whichever node type set it.
 */
-const decideEdges = (graph, id, result, scope) => {
-	const compiled = graph.nodes.get(id);
-	if (compiled === void 0) return [];
-	const { node } = compiled;
-	const firstOnly = node.type === "control.router" && (node.mode ?? "first") === "first";
-	let matched = false;
-	return compiled.outgoing.map((edge) => {
-		const taken = (edge.condition === void 0 ? result.ok : truthy(evaluate(edge.condition, {
-			...scope,
-			output: {
-				ok: result.ok,
-				...result.output
-			}
-		}))) && !(firstOnly && matched);
-		if (taken) matched = true;
-		return {
-			edge,
-			taken
-		};
+const scrubbedEnd = (result, roots) => {
+	const { end } = result;
+	if (end?.detail === void 0) return result;
+	const detail = redact(end.detail, {
+		roots,
+		home: homedir()
 	});
-};
-const joinOutput = (edges, resolved) => {
-	const ran = edges.filter((e) => resolved.get(edgeKey(e))?.taken === true);
-	const results = {};
-	for (const edge of ran) results[edge.from] = resolved.get(edgeKey(edge))?.output ?? {};
 	return {
-		statuses: ran.map((e) => results[e.from]?.["status"]),
-		results,
-		count: ran.length
+		...result,
+		end: {
+			...end,
+			detail
+		}
 	};
 };
-/** How a reason for a run that was left waiting starts: a bug in Ork. */
-const STUCK_REASON = "ork engine error:";
+// ../core/src/run/slots.ts
 /**
-* Why a run that was left waiting fails: a node neither ran nor was skipped
-* while an edge could still reach it. The scheduler resolves every edge whose
-* source can't run any more, so only a bug in Ork leaves one.
+* @file Session slots: at most `limits.concurrency` Claude sessions run at
+*   once. Queued activations take a free slot when the scheduler pumps;
+*   delegated children and leaders returning from `delegate` wait for one and
+*   are served first, so a leader waiting on its children never holds a slot
+*   they need.
 */
-const stuckReason = (waiting) => `${STUCK_REASON} ${waiting.map(({ id, waitingOn }) => `${id} was still waiting on ${waitingOn.join(", ")}`).join("; ")} with nothing left to run; this is a bug in Ork, not in the workflow`;
-/** Each node's place along the non-loop edges, sources first. */
-const orderOf = (graph) => {
-	const order = /* @__PURE__ */ new Map();
-	const left = /* @__PURE__ */ new Map();
-	for (const [id, compiled] of graph.nodes) left.set(id, compiled.incoming.filter((e) => !isLoopEdge(e)).length);
-	const ready = [...left].filter(([, count]) => count === 0).map(([id]) => id);
-	for (let id = ready.shift(); id !== void 0; id = ready.shift()) {
-		order.set(id, order.size);
-		for (const edge of graph.nodes.get(id)?.outgoing ?? []) {
-			if (isLoopEdge(edge)) continue;
-			const count = (left.get(edge.to) ?? 0) - 1;
-			left.set(edge.to, count);
-			if (count === 0) ready.push(edge.to);
-		}
-	}
-	return order;
-};
-/**
-* Tracks, per target, which incoming non-loop edges have resolved in its
-* current round: since every one last resolved.
-*
-* - A node runs each time an incoming edge is taken, and is skipped once every
-*   incoming non-loop edge has resolved as not taken (dead-path elimination),
-*   so nothing downstream waits on a branch that will never run.
-* - A `control.join` waits: `all` until every input resolved, `any` for the first
-*   that ran, `n` for `n` that ran. A join none of whose required inputs ran is
-*   skipped.
-* - An edge whose source can't run any more counts as not taken (`stranded`): in
-*   a later round, a branch the loop doesn't go back to never runs again.
-*/
-const createInbox = (graph) => {
-	const resolved = /* @__PURE__ */ new Map();
-	/** Targets that ran, or joins that fired, in their current round. */
-	const fired = /* @__PURE__ */ new Set();
-	let order;
-	const forwards = /* @__PURE__ */ new Map();
-	const forwardIn = (id) => {
-		let edges = forwards.get(id);
-		if (edges === void 0) {
-			edges = (graph.nodes.get(id)?.incoming ?? []).filter((e) => !isLoopEdge(e));
-			forwards.set(id, edges);
-		}
-		return edges;
-	};
-	const reset = (id) => {
-		resolved.delete(id);
-		fired.delete(id);
-	};
-	const arriveAtJoin = (id, seen) => {
-		const node = graph.nodes.get(id)?.node;
-		if (node?.type !== "control.join") return { kind: "wait" };
-		const inputs = forwardIn(id);
-		const ran = inputs.filter((e) => seen.get(edgeKey(e))?.taken === true);
-		const complete = inputs.every((e) => seen.has(edgeKey(e)));
-		const mode = node.mode ?? "all";
-		const needed = mode === "any" ? 1 : node.n ?? inputs.length;
-		if (mode === "all") {
-			if (!complete) return { kind: "wait" };
-			reset(id);
-			return ran.length > 0 ? {
-				kind: "activate",
-				input: joinOutput(inputs, seen)
-			} : { kind: "skip" };
-		}
-		if (!fired.has(id) && ran.length >= needed) {
-			const input = joinOutput(inputs, seen);
-			if (complete) reset(id);
-			else fired.add(id);
-			return {
-				kind: "activate",
-				input
-			};
+/** Only a Claude session takes a slot; tools and gates are not limited. */
+const needsSlot = (node) => isClaudeNode(node);
+/** A call spends through its run, so it needs budget as a session does. */
+const spendsBudget = (node) => needsSlot(node) || node.type === "workflow.call";
+const createSlots = (limit, onFree) => {
+	let used = 0;
+	const waiting = [];
+	return {
+		limit,
+		tryTake: () => {
+			if (used >= limit || waiting.length > 0) return false;
+			used += 1;
+			return true;
+		},
+		take: () => {
+			if (used < limit && waiting.length === 0) {
+				used += 1;
+				return Promise.resolve();
+			}
+			const { promise, resolve } = Promise.withResolvers();
+			waiting.push(resolve);
+			return promise;
+		},
+		release: () => {
+			const next = waiting.shift();
+			if (next === void 0) {
+				used -= 1;
+				onFree();
+			} else next();
 		}
-		if (!complete) return { kind: "wait" };
-		const wasFired = fired.has(id);
-		reset(id);
-		return wasFired ? { kind: "wait" } : { kind: "skip" };
 	};
-	/** Records that `edge` resolved, and says what happens at its target. */
-	const arrive = (edge, taken, output) => {
-		const id = edge.to;
-		const seen = resolved.get(id) ?? /* @__PURE__ */ new Map();
-		resolved.set(id, seen);
-		seen.set(edgeKey(edge), {
-			taken,
-			output
-		});
-		if (graph.nodes.get(id)?.node.type === "control.join") return arriveAtJoin(id, seen);
-		const complete = forwardIn(id).every((e) => seen.has(edgeKey(e)));
-		const ran = taken || fired.has(id);
-		if (complete) reset(id);
-		else if (taken) fired.add(id);
-		if (taken) return {
-			kind: "activate",
-			input: output
-		};
-		return complete && !ran ? { kind: "skip" } : { kind: "wait" };
+};
+// ../core/src/run/fan-out.ts
+/** The node's `forEach`, whatever its type; `undefined` when it has none. */
+const forEachOf = (node) => node !== void 0 && "forEach" in node ? node.forEach : void 0;
+/** The list a node runs over, or why there isn't one. */
+const listOf = (forEach, scope) => {
+	if ("items" in forEach) return {
+		ok: true,
+		list: forEach.items
 	};
-	/** The edges a target still waits on. */
-	const missingOf = (id, seen) => forwardIn(id).filter((e) => !seen.has(edgeKey(e)));
-	/**
-	* The first target, in graph order, whose every edge still to resolve comes
-	* from a node that can't run any more: neither `active` (queued or running)
-	* nor after one along the non-loop edges. A loop's edge starts a new round,
-	* so it doesn't count. Its edges count as not taken; the caller delivers
-	* them, and asks again, as that can start something.
-	*/
-	const stranded = (active) => {
-		const candidates = [...resolved].map(([id, seen]) => ({
-			id,
-			missing: missingOf(id, seen)
-		})).filter(({ missing }) => !missing.some((e) => active(e.from)));
-		if (candidates.length === 0) return [];
-		/** Nodes known to be unable to run, in this call. */
-		const dead = /* @__PURE__ */ new Set();
-		const canRun = (from) => {
-			const visited = /* @__PURE__ */ new Set([from]);
-			const stack = [from];
-			for (let id = stack.pop(); id !== void 0; id = stack.pop()) {
-				if (active(id)) return true;
-				for (const edge of forwardIn(id)) {
-					if (visited.has(edge.from) || dead.has(edge.from)) continue;
-					visited.add(edge.from);
-					stack.push(edge.from);
-				}
-			}
-			for (const id of visited) dead.add(id);
-			return false;
-		};
-		order ??= orderOf(graph);
-		const known = order;
-		const place = (id) => known.get(id) ?? Infinity;
-		return candidates.filter(({ missing }) => !missing.some((e) => canRun(e.from))).toSorted((a, b) => place(a.id) - place(b.id))[0]?.missing ?? [];
+	const read = templateValue(forEach.from, scope);
+	if (!read.ok) return read;
+	const { value } = read;
+	if (Array.isArray(value)) return {
+		ok: true,
+		list: value
 	};
-	/** Targets an edge reached that still wait on others. */
-	const waiting = () => [...resolved].map(([id, seen]) => ({
-		id,
-		waitingOn: [...new Set(missingOf(id, seen).map((e) => e.from))]
-	}));
+	const name = String(templatePath(forEach.from)?.at(-1) ?? forEach.from);
 	return {
-		arrive,
-		stranded,
-		waiting
+		ok: false,
+		error: declaredProblem({ [name]: { list: {} } }, { [name]: value }) ?? `${name} is not a list`
 	};
 };
-// ../core/src/run/escalation.ts
-const LOOP_CHOICES = {
-	stop: "stop",
-	again: "again",
-	onward: "onward"
-};
-/** What a list over its `maxItems` can be answered with (RFC-013). */
-const EACH_CHOICES = {
-	stop: "stop",
-	first: "first",
-	all: "all"
+/** The output a `from` list comes from, whose freshness resume asks about. */
+const sourceOf = (forEach, scope) => {
+	if (!("from" in forEach)) return void 0;
+	const [root, id] = templatePath(forEach.from) ?? [];
+	return root === "nodes" ? scope.nodes[String(id)]?.output : void 0;
 };
-/** The question about a list over its cap; the recommended choice stops. */
-const eachQuestion = (node, count, maxItems, round = 1) => ({
-	question: `The list of ${node}${round > 1 ? ` (round ${String(round)})` : ""} has ${String(count)} items, more than its maxItems of ${String(maxItems)}. What now?`,
-	options: [
-		{
-			id: EACH_CHOICES.stop,
-			description: "Stop the run"
-		},
-		{
-			id: EACH_CHOICES.first,
-			description: `Run the first ${String(maxItems)}`
-		},
-		{
-			id: EACH_CHOICES.all,
-			description: `Run all ${String(count)}`
-		}
-	],
-	recommended: EACH_CHOICES.stop,
-	context: `${node} runs at most ${String(maxItems)} items unless someone says otherwise.`
-});
-/** The question about a loop out of rounds; the recommended choice stops. */
-const loopQuestion = (edge) => ({
-	question: `The loop ${edge.from} -> ${edge.to} used all ${String(edge.maxRounds ?? 0)} of its rounds. What now?`,
-	options: [
-		{
-			id: LOOP_CHOICES.stop,
-			description: "Stop the run"
-		},
-		{
-			id: LOOP_CHOICES.again,
-			description: "Allow one more round"
-		},
-		{
-			id: LOOP_CHOICES.onward,
-			description: "Go on along the other edges"
-		}
-	],
-	recommended: LOOP_CHOICES.stop,
-	context: `${edge.from} still wants another round${edge.when === void 0 ? "" : ` (${edge.when.trim()})`}.`
-});
+const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 /**
-* Asks the owner of `edge.from` while its session is live (the node runs in the
-* flow, so its owner is not waiting on it), and the human otherwise or when the
-* owner's session ends first.
+* What `results` keeps of an item: its declared fields (a program's are under
+* `json`), its summary, Ork's own branch and worktree, and how a program
+* failed. The full output stays in the item's own `node.finished`.
 */
-const askAboutLoop = async (human, edge, bus) => {
-	const question = loopQuestion(edge);
-	return await bus?.askOwner(edge.from, question) ?? await bus?.askOwner(edge.to, question) ?? human.ask({
-		nodeId: edge.from,
-		...question
-	});
-};
-/** Counts each loop edge's rounds; `take` is false once one is out of them. */
-const createLoops = (options) => {
-	const taken = /* @__PURE__ */ new Map();
-	const extra = /* @__PURE__ */ new Map();
-	const take = async (edge, output) => {
-		const key = edgeKey(edge);
-		const count = taken.get(key) ?? 0;
-		if (count < (edge.maxRounds ?? 0) + (extra.get(key) ?? 0)) {
-			taken.set(key, count + 1);
-			options.activate(edge.to, output);
+const entryOf = (declared, { ok, output, error }) => {
+	const json = isRecord$1(output["json"]) ? output["json"] : {};
+	const fields = Object.keys(declared ?? {}).map((field) => [field, Object.hasOwn(json, field) ? json[field] : output[field]]);
+	const own = [
+		"summary",
+		"branch",
+		"worktree",
+		"merge"
+	].map((field) => [field, output[field]]);
+	const failed = !ok && typeof output["exitCode"] === "number" ? [["exitCode", output["exitCode"]], ["error", error]] : [];
+	return Object.fromEntries([
+		...fields,
+		...own,
+		...failed
+	].filter(([, value]) => value !== void 0));
+};
+/** Whether an item passed but its work could not reach its owner. */
+const mergeFailed = ({ output }) => isRecord$1(output["merge"]) && output["merge"]["ok"] === false;
+const statusOf$2 = (result) => {
+	if (mergeFailed(result)) return "fail";
+	const { ok, output } = result;
+	const status = output["status"];
+	if (typeof status === "string") return status;
+	return ok ? "pass" : "fail";
+};
+/** Why a fan-out did not succeed, naming the first item that failed. */
+const whyNot = (count, failures, skipped) => {
+	const parts = [`${String(failures.length)} of ${String(count)} items failed`];
+	const [first] = failures;
+	if (first !== void 0) parts[0] = `${parts[0] ?? ""}; first, ${first}`;
+	if (skipped > 0) parts.push(`${String(skipped)} not started`);
+	return parts.join("; ");
+};
+/**
+* Waits until the item may start: not while it is held, and without keeping a
+* session slot through a pause, which would stop other nodes.
+*/
+const awaitTurn = async (hold, slots, signal) => {
+	for (;;) {
+		await hold.wait("start", signal);
+		if (slots === null) return;
+		await slots.take();
+		if (!hold.held() || signal.aborted) return;
+		slots.release();
+	}
+};
+const createFanOut = (deps) => {
+	const { holds, slots, stops, nodeOf, perform, options } = deps;
+	return async (activation, forEach, round) => {
+		const { id, input } = activation;
+		const scope = deps.scope();
+		const recorded = options.replay?.listed?.(id, round, sourceOf(forEach, scope)) ?? null;
+		const listed = recorded === null ? listOf(forEach, scope) : {
+			ok: true,
+			list: unmasked(forEach, recorded)
+		};
+		if (!listed.ok) return failedWith(endFor("invalid_node", { reason: listed.error }));
+		let { list } = listed;
+		const recordList = () => {
 			options.onEvent({
-				type: "edge.taken",
-				from: edge.from,
-				to: edge.to
+				type: "each.listed",
+				node: id,
+				round,
+				count: list.length,
+				list,
+				...recorded === null && options.replay !== void 0 ? { anew: true } : {}
 			});
-			return true;
+		};
+		recordList();
+		const signal = stops.signalFor(id);
+		if ("maxItems" in forEach && list.length > forEach.maxItems) {
+			options.onEvent({
+				type: "each.exceeded",
+				node: id,
+				round,
+				count: list.length,
+				maxItems: forEach.maxItems
+			});
+			const chosen = await deps.loops.overList(id, list, forEach.maxItems, round, signal);
+			if (chosen === null) {
+				const reason = `the list of ${id} has ${String(list.length)} items, over maxItems ${String(forEach.maxItems)}`;
+				return stops.ended(id, {
+					...failedWith(endFor("invalid_node", { reason }), {
+						status: "fail",
+						summary: reason
+					}),
+					limited: reason,
+					stopsAs: "failed"
+				});
+			}
+			const narrowed = chosen.length !== list.length;
+			list = chosen;
+			if (narrowed) recordList();
 		}
-		options.onEvent({
-			type: "loop.exhausted",
-			from: edge.from,
-			to: edge.to,
-			maxRounds: edge.maxRounds ?? 0
-		});
-		const choice = await askAboutLoop(options.human, edge, options.bus);
-		if (choice === LOOP_CHOICES.again) {
-			extra.set(key, (extra.get(key) ?? 0) + 1);
-			return take(edge, output);
+		const node = nodeOf(activation);
+		const session = node !== void 0 && needsSlot(node);
+		const spends = node !== void 0 && spendsBudget(node);
+		const declared = node === void 0 ? void 0 : declaredOutputOf(node);
+		const results = list.map(() => ({}));
+		const statuses = list.map(() => "skipped");
+		const failures = [];
+		/** How the first item that failed ended: the fanned node's own end. */
+		let firstEnd;
+		const mayStart = () => !signal.aborted && !deps.isStopped() && (forEach.onFailure !== "stop" || failures.length === 0);
+		const runItem = async (index) => {
+			const itemId = `${id}.${String(index)}`;
+			const hold = holds.forNode(itemId, id);
+			await awaitTurn(hold, session ? slots : null, signal);
+			try {
+				if (!mayStart() || spends && deps.budgetSpent()) return;
+				const result = await perform({
+					id: itemId,
+					input,
+					template: id,
+					item: {
+						of: id,
+						index,
+						value: list[index]
+					},
+					round
+				});
+				results[index] = entryOf(declared, result);
+				statuses[index] = statusOf$2(result);
+				if (!result.ok) {
+					firstEnd ??= endOf(result);
+					failures.push(`${itemId}: ${result.error ?? "failed"}`);
+				} else if (mergeFailed(result)) failures.push(`${itemId}: its work could not be merged`);
+			} finally {
+				if (session) slots.release();
+			}
+		};
+		let next = 0;
+		const worker = async () => {
+			while (next < list.length && mayStart()) {
+				const index = next;
+				next += 1;
+				await runItem(index);
+			}
+		};
+		const lanes = Math.min(forEach.maxParallel ?? slots.limit, list.length);
+		await Promise.all(Array.from({ length: lanes }, () => worker()));
+		const skipped = statuses.filter((status) => status === "skipped").length;
+		const ok = failures.length === 0 && skipped === 0;
+		const gathered = {
+			ok,
+			output: {
+				items: list,
+				results,
+				statuses,
+				count: list.length
+			},
+			...ok ? {} : { error: whyNot(list.length, failures, skipped) },
+			...ok || firstEnd === void 0 ? {} : { end: firstEnd },
+			...!ok && deps.isStopped() ? { limited: deps.reasons[0] ?? "the run stopped" } : {}
+		};
+		return {
+			...stops.ended(id, gathered),
+			output: gathered.output
+		};
+	};
+};
+// ../core/src/run/locks.ts
+/**
+* @file A run's locks (RFC-016): a node that names a lock takes it from the
+*   machine's ledger before it runs, or joins the run's hold when the run has
+*   it already. The hold spans nodes: it goes when a node naming it ends and no
+*   node the graph can still reach from there names it, and on every end of the
+*   run. A fanned node's items each take and release it (unless the run already
+*   holds it). A wait is never silent: `lock.waiting` names the holders, and
+*   the node's, its owners' and the run's clocks stand still meanwhile.
+*/
+/** A wait for a lock, as `ork ps`, `ork logs`, `ork tree` and the UI say it. */
+const lockWaitLine = (lock, holders) => holders.length === 0 ? `waiting for ${lock}` : `waiting for ${lock}, held by ${holders.join(", ")}`;
+/** The node an activation is of: an item's or a worker's declared node. */
+const declaredOf = (activation) => activation.item?.of ?? activation.template ?? activation.id;
+const createRunLocks = (deps) => {
+	const { graph, ledgers, onEvent, runId } = deps;
+	/** The run's holds across nodes, by lock name. */
+	const spans = /* @__PURE__ */ new Map();
+	/** Each activation running under a lock; an item's own release with it. */
+	const entered = /* @__PURE__ */ new Map();
+	let ended = false;
+	const nameOf = (id, item) => {
+		const node = graph.nodes.get(id)?.node;
+		const lock = node !== void 0 && "lock" in node ? node.lock : void 0;
+		if (lock === void 0) return void 0;
+		const parsed = parseTemplate(lock);
+		return parsed.ok ? renderTemplate(parsed.parts, deps.scope(item)) : lock;
+	};
+	/** Whether a node the graph can reach from `from` names `lock` itself. */
+	const laterNamed = (from, lock) => {
+		const seen = /* @__PURE__ */ new Set();
+		const next = [from];
+		for (let id = next.pop(); id !== void 0; id = next.pop()) for (const { to } of graph.nodes.get(id)?.outgoing ?? []) {
+			if (seen.has(to)) continue;
+			seen.add(to);
+			if (!(forEachOf(graph.nodes.get(to)?.node) !== void 0) && nameOf(to) === lock) return true;
+			next.push(to);
 		}
-		if (choice !== LOOP_CHOICES.onward) options.fail(`the loop ${edge.from} -> ${edge.to} ran out of rounds`);
 		return false;
 	};
-	/**
-	* What a list over its cap runs: asked of a live owner, then the human. All
-	* of it, the first `maxItems`, or `null` to stop. A stop (`signal`) ends the
-	* wait and withdraws the question; the list comes back whole, and nothing of
-	* it starts because the stop also bars its items.
-	*/
-	const overList = async (node, list, maxItems, round, signal) => {
-		const question = eachQuestion(node, list.length, maxItems, round);
-		const asking = async () => await options.bus?.askOwner(node, question) ?? (signal.aborted ? null : options.human.ask({
-			nodeId: node,
-			...question,
-			signal
+	const take = async (id, lock, ledger, signal) => {
+		const slots = await ledger.of(lock);
+		const release = await deps.waitFor(id, () => slots.take({
+			run: runId,
+			node: id,
+			pid: process.pid
+		}, {
+			signal,
+			onWait: (holders) => {
+				onEvent({
+					type: "lock.waiting",
+					id,
+					lock,
+					holders: holders.map((held) => `${held.run}/${held.node}`)
+				});
+			}
 		}));
-		const stopped = Promise.withResolvers();
-		signal.addEventListener("abort", () => {
-			stopped.resolve(null);
-		}, { once: true });
-		const choice = await Promise.race([asking(), stopped.promise]);
-		if (signal.aborted) return list;
-		if (choice === EACH_CHOICES.first) return list.slice(0, maxItems);
-		return choice === EACH_CHOICES.all ? list : null;
+		if (release !== null && ended) {
+			release();
+			return null;
+		}
+		return release;
+	};
+	/** Joins the run's hold of `lock`, taking it first when nobody has. */
+	const join = async (id, lock, ledger, signal) => {
+		for (;;) {
+			let span = spans.get(lock);
+			if (span === void 0) {
+				span = {
+					taking: take(id, lock, ledger, signal),
+					users: /* @__PURE__ */ new Set(),
+					last: id
+				};
+				spans.set(lock, span);
+			}
+			span.users.add(id);
+			span.last = id;
+			let release;
+			try {
+				release = await span.taking;
+			} catch (error) {
+				if (spans.get(lock) === span) spans.delete(lock);
+				throw error;
+			}
+			if (release !== null) {
+				span.release = release;
+				return true;
+			}
+			span.users.delete(id);
+			if (spans.get(lock) === span) spans.delete(lock);
+			if (signal.aborted || ended) return false;
+		}
+	};
+	const released = (id, lock, end) => {
+		onEvent({
+			type: "lock.released",
+			id,
+			lock,
+			end
+		});
 	};
 	return {
-		take,
-		overList
+		enter: async (activation, signal) => {
+			const { id, item } = activation;
+			const lock = nameOf(declaredOf(activation), item);
+			if (lock === void 0 || ledgers === void 0) return true;
+			if (item === void 0 || spans.has(lock)) {
+				if (!await join(id, lock, ledgers, signal)) return false;
+				entered.set(id, { lock });
+			} else {
+				const release = await take(id, lock, ledgers, signal);
+				if (release === null) return false;
+				entered.set(id, {
+					lock,
+					release
+				});
+			}
+			onEvent({
+				type: "lock.taken",
+				id,
+				lock
+			});
+			return true;
+		},
+		leave: (activation) => {
+			const { id } = activation;
+			const held = entered.get(id);
+			if (held === void 0) return;
+			entered.delete(id);
+			const { lock, release } = held;
+			if (release !== void 0) {
+				release();
+				released(id, lock, "span");
+				return;
+			}
+			const span = spans.get(lock);
+			if (span === void 0) return;
+			span.users.delete(id);
+			if (span.users.size > 0 || laterNamed(declaredOf(activation), lock)) return;
+			spans.delete(lock);
+			span.release?.();
+			released(id, lock, "span");
+		},
+		end: () => {
+			ended = true;
+			for (const [id, { lock, release }] of entered) {
+				if (release === void 0) continue;
+				release();
+				released(id, lock, "run");
+			}
+			entered.clear();
+			for (const [lock, span] of spans) {
+				if (span.release === void 0) continue;
+				span.release();
+				released(span.last, lock, "run");
+			}
+			spans.clear();
+		}
 	};
 };
-// ../core/src/run/ended.ts
-/**
-* @file A node's result as it ended (specs/runtime/session-ends.md): one place
-*   that sets `end`, makes a failure's `error` its message and marks a
-*   transient kind, and that the engine's modules build ends through.
-*/
+// ../core/src/project/calls.ts
 /**
-* The result as it ended: a failure's `error` is the end's message (what the
-* run summary lists), and a transient kind marks it `transient`.
+* @file `ork validate`'s check of `workflow.call` nodes against what they call
+*   (RFC-004): the project, the workflow, the node and the required inputs. A
+*   project not registered here is only a warning, since it may be on another
+*   machine; a run refuses it. A name with a template is left to the run.
 */
-const endedWith = (result, end) => ({
-	...result,
-	end,
-	...result.ok ? {} : { error: end.message },
-	...END_KINDS[end.kind].transient ? { transient: true } : {}
-});
-/** The reason a run's signal is aborted with when `timeout` passed. */
-const runTimedOut = (timeout) => timeout === void 0 ? { kind: "timed_out" } : {
-	kind: "timed_out",
-	timeout
-};
-const isTimedOut = (reason) => typeof reason === "object" && reason !== null && "kind" in reason && reason.kind === "timed_out";
-/**
-* The end of a node its run's signal stopped: `timed_out` when the run's
-* timeout aborted it, `interrupted` otherwise.
-*/
-const stoppedEnd = (signal, detail) => {
-	const reason = signal.reason;
-	if (!isTimedOut(reason)) return endFor("interrupted", {}, detail);
-	const facts = reason.timeout === void 0 ? {} : { timeout: reason.timeout };
-	return endFor("timed_out", facts, detail);
+const hasTemplate = (text) => text.includes("{{");
+/** A workflow's file: a folder of that name is no workflow. */
+const fileState = (file) => {
+	try {
+		return statSync(file, { throwIfNoEntry: false })?.isFile() === true ? "file" : "none";
+	} catch {
+		return "unreadable";
+	}
 };
-/** A failure that ended as `end`, its message the output's summary. */
-const failedWith = (end, output) => endedWith({
-	ok: false,
-	output: output ?? {
-		status: "fail",
-		summary: end.message
+/** A workflow from its file, or `null` when it cannot be read or is not valid. */
+const readWorkflow = (file) => {
+	try {
+		const parsed = parseWorkflow(readFileSync(file, "utf8"));
+		return parsed.ok ? parsed.workflow : null;
+	} catch {
+		return null;
 	}
-}, end);
+};
 /**
-* The result with its end's detail scrubbed with the feedback redactor (the
-* run's `roots` and the home folder), as a session's is
-* (specs/runtime/session-ends.md), whichever node type set it.
+* The workflows a workflow calls by a literal name, and those they call. One
+* that cannot be read is left out: `ork validate` and the call report it. A
+* call of one `node:` runs only that session, so its tool nodes do not count
+* unless `everyCall`, and nor does a call among `finished`. `unreadable` hears
+* of one that is there but could not be read.
 */
-const scrubbedEnd = (result, roots) => {
-	const { end } = result;
-	if (end?.detail === void 0) return result;
-	const detail = redact(end.detail, {
-		roots,
-		home: homedir()
-	});
-	return {
-		...result,
-		end: {
-			...end,
-			detail
+const calledWorkflows = (workflow, own, registered, options = {}) => {
+	const seen = /* @__PURE__ */ new Set();
+	const found = [];
+	const walk = (from, place) => {
+		for (const [id, node] of Object.entries(from.nodes)) {
+			if (node.type !== "workflow.call") continue;
+			if (hasTemplate(node.workflow) || hasTemplate(node.project ?? "")) continue;
+			if (options.everyCall !== true && node.node !== void 0) continue;
+			if (from === workflow && options.finished?.has(id) === true) continue;
+			const target = node.project === void 0 ? place : registered.find((other) => other.id === node.project);
+			if (target === void 0) continue;
+			const file = path.join(placeFiles(target).workflows, `${path.basename(node.workflow)}.ork.yaml`);
+			if (seen.has(file)) continue;
+			seen.add(file);
+			const state = fileState(file);
+			if (state === "none") continue;
+			const called = state === "file" ? readWorkflow(file) : null;
+			if (called === null) {
+				options.unreadable?.(node.workflow);
+				continue;
+			}
+			found.push(called);
+			walk(called, target);
 		}
 	};
+	walk(workflow, own);
+	return found;
 };
-// ../core/src/run/declared.ts
+const checkCallTargets = (workflow, own, registered) => Object.entries(workflow.nodes).flatMap(([id, node]) => {
+	if (node.type !== "workflow.call") return [];
+	const at = ["nodes", id];
+	if (hasTemplate(node.workflow) || hasTemplate(node.project ?? "")) return [];
+	if (/[/\\]/u.test(node.workflow) || node.workflow === "..") return [error("call.workflow", `call \`${id}\`: \`${node.workflow}\` is not a workflow's name`, [...at, "workflow"])];
+	const target = node.project === void 0 ? own : registered.find((place) => place.id === node.project);
+	if (target === void 0) return [warning("call.project", `call \`${id}\`: project \`${String(node.project)}\` is not registered here, so a run will refuse it; register it with \`ork register\``, [...at, "project"])];
+	const file = path.join(placeFiles(target).workflows, `${node.workflow}.ork.yaml`);
+	const state = fileState(file);
+	if (state === "none") return [error("call.workflow", `call \`${id}\`: no workflow \`${node.workflow}\` in ${target.root}`, [...at, "workflow"])];
+	const called = state === "file" ? readWorkflow(file) : null;
+	if (called === null) return [error("call.workflow", `call \`${id}\`: the workflow \`${node.workflow}\` cannot be read or is not valid; run \`ork validate\` on it`, [...at, "workflow"])];
+	const found = [];
+	if (node.node !== void 0) {
+		const type = called.nodes[node.node]?.type;
+		if (type !== "agent.leader" && type !== "agent.worker") found.push(error("call.node", `call \`${id}\`: \`${node.node}\` is not a leader or worker of \`${node.workflow}\``, [...at, "node"]));
+	}
+	for (const [name, input] of Object.entries(called.inputs ?? {})) if (input.required === true && input.default === void 0 && node.inputs?.[name] === void 0) found.push(error("call.input", `call \`${id}\`: \`${node.workflow}\` requires the input \`${name}\``, [...at, "inputs"]));
+	return found;
+});
+// ../core/src/run/routing.ts
 /**
-* @file Holding a node to what it declares of its output (RFC-010): a missing
-*   field, the wrong type or a value outside the list is a problem to fail the
-*   node on, so a condition never quietly matches nothing. A declared list
-*   (RFC-013) is held to being a list, and each item to its shape. It reads the
-*   format's own shape; a field written out as JSON Schema stays the driver's
-*   to enforce. A list a resume hands back keeps the file's real values when it
-*   only differs by masking.
+* @file Where a finished node's output goes: which outgoing edges are taken,
+*   and what each arrival does at its target (activate it, skip it, or wait,
+*   for a join). Pure: the scheduler owns time, sessions and loop counters.
 */
-const TYPE_NAMES = {
-	string: "text",
-	number: "a number",
-	integer: "a whole number",
-	boolean: "true or false"
-};
-const FITS = {
-	string: (value) => typeof value === "string",
-	number: (value) => typeof value === "number",
-	integer: (value) => Number.isInteger(value),
-	boolean: (value) => typeof value === "boolean"
-};
-const isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const listed = (values) => {
-	const names = values.map((value) => markValue(String(value)));
-	const last = names.pop();
-	return names.length === 0 ? String(last) : `${names.join(", ")} or ${String(last)}`;
-};
-const shown = (value) => {
-	const text = typeof value === "string" ? value : JSON.stringify(value) ?? String(value);
-	return markValue(text.length > 80 ? `${text.slice(0, 80)}…` : text);
-};
-/** What's wrong with one field, if it's a shape this can read. */
-const fieldProblem = (name, rule, value) => {
-	const shape = listShape(rule);
-	if (shape !== void 0) return listProblem(name, shape, value);
-	const expected = Array.isArray(rule) ? listed(rule) : typeof rule === "string" ? TYPE_NAMES[rule] : void 0;
-	if (expected === void 0) return null;
-	if (value === void 0) return `${name} is missing, expected ${expected}`;
-	return (Array.isArray(rule) ? rule.some((item) => item === value) : FITS[String(rule)]?.(value)) === true ? null : `${name} is ${shown(value)}, expected ${expected}`;
+/** A `maxRounds` edge. Removing them leaves a DAG (the compiler checks it). */
+const isLoopEdge = (edge) => edge.maxRounds !== void 0;
+const keys = /* @__PURE__ */ new WeakMap();
+const edgeKey = (edge) => {
+	let key = keys.get(edge);
+	if (key === void 0) {
+		key = `${String(edge.source)}:${edge.from}->${edge.to}`;
+		keys.set(edge, key);
+	}
+	return key;
 };
-const fieldProblems = (declared, value, prefix) => Object.entries(declared).flatMap(([name, rule]) => {
-	const problem = fieldProblem(`${prefix}${name}`, rule, value[name]);
-	return problem === null ? [] : [problem];
-});
-/** What's wrong with one item; `name` says which, as `tasks[2]`. */
-const itemProblems = (name, shape, item) => {
-	if (Object.keys(shape).length === 0) return [];
-	return isRecord$2(item) ? fieldProblems(shape, item, `${name}.`) : [`${name} is ${shown(item)}, expected an object`];
+/**
+* Decides every outgoing edge of a finished node. An edge with `when:` is taken
+* when its condition holds for the node's output; one without is taken when the
+* node succeeded. A `control.router` in `first` mode takes only its first
+* matching edge.
+*/
+const decideEdges = (graph, id, result, scope) => {
+	const compiled = graph.nodes.get(id);
+	if (compiled === void 0) return [];
+	const { node } = compiled;
+	const firstOnly = node.type === "control.router" && (node.mode ?? "first") === "first";
+	let matched = false;
+	return compiled.outgoing.map((edge) => {
+		const taken = (edge.condition === void 0 ? result.ok : truthy(evaluate(edge.condition, {
+			...scope,
+			output: {
+				ok: result.ok,
+				...result.output
+			}
+		}))) && !(firstOnly && matched);
+		if (taken) matched = true;
+		return {
+			edge,
+			taken
+		};
+	});
 };
-/** Only the first bad item is named, so a long list can't flood the reason. */
-const listProblem = (name, shape, value) => {
-	if (value === void 0) return `${name} is missing, expected a list`;
-	if (!Array.isArray(value)) return `${name} is ${shown(value)}, expected a list`;
-	const bad = value.map((item, index) => itemProblems(`${name}[${index}]`, shape, item)).find((problems) => problems.length > 0);
-	return bad === void 0 ? null : bad.join("; ");
+const joinOutput = (edges, resolved) => {
+	const ran = edges.filter((e) => resolved.get(edgeKey(e))?.taken === true);
+	const results = {};
+	for (const edge of ran) results[edge.from] = resolved.get(edgeKey(edge))?.output ?? {};
+	return {
+		statuses: ran.map((e) => results[e.from]?.["status"]),
+		results,
+		count: ran.length
+	};
 };
+/** How a reason for a run that was left waiting starts: a bug in Ork. */
+const STUCK_REASON = "ork engine error:";
 /**
-* What's wrong with `value` by this declaration, or `null`. With nothing
-* declared, nothing can be.
+* Why a run that was left waiting fails: a node neither ran nor was skipped
+* while an edge could still reach it. The scheduler resolves every edge whose
+* source can't run any more, so only a bug in Ork leaves one.
 */
-const declaredProblem = (declared, value) => {
-	if (declared === void 0 || Object.keys(declared).length === 0) return null;
-	if (!isRecord$2(value)) return `the result isn't a JSON object`;
-	const problems = fieldProblems(declared, value, "");
-	return problems.length === 0 ? null : problems.join("; ");
+const stuckReason = (waiting) => `${STUCK_REASON} ${waiting.map(({ id, waitingOn }) => `${id} was still waiting on ${waitingOn.join(", ")}`).join("; ")} with nothing left to run; this is a bug in Ork, not in the workflow`;
+/** Each node's place along the non-loop edges, sources first. */
+const orderOf = (graph) => {
+	const order = /* @__PURE__ */ new Map();
+	const left = /* @__PURE__ */ new Map();
+	for (const [id, compiled] of graph.nodes) left.set(id, compiled.incoming.filter((e) => !isLoopEdge(e)).length);
+	const ready = [...left].filter(([, count]) => count === 0).map(([id]) => id);
+	for (let id = ready.shift(); id !== void 0; id = ready.shift()) {
+		order.set(id, order.size);
+		for (const edge of graph.nodes.get(id)?.outgoing ?? []) {
+			if (isLoopEdge(edge)) continue;
+			const count = (left.get(edge.to) ?? 0) - 1;
+			left.set(edge.to, count);
+			if (count === 0) ready.push(edge.to);
+		}
+	}
+	return order;
 };
 /**
-* The list a resume hands back. Events are stored masked, so a static list that
-* still masks to the record is the file's, with its real values.
+* Tracks, per target, which incoming non-loop edges have resolved in its
+* current round: since every one last resolved.
+*
+* - A node runs each time an incoming edge is taken, and is skipped once every
+*   incoming non-loop edge has resolved as not taken (dead-path elimination),
+*   so nothing downstream waits on a branch that will never run.
+* - A `control.join` waits: `all` until every input resolved, `any` for the first
+*   that ran, `n` for `n` that ran. A join none of whose required inputs ran is
+*   skipped.
+* - An edge whose source can't run any more counts as not taken (`stranded`): in
+*   a later round, a branch the loop doesn't go back to never runs again.
 */
-const unmasked = (forEach, recorded) => "items" in forEach && JSON.stringify(forEach.items, maskReplacer) === JSON.stringify(recorded) ? [...forEach.items] : recorded;
-// ../core/src/run/slots.ts
-/**
-* @file Session slots: at most `limits.concurrency` Claude sessions run at
-*   once. Queued activations take a free slot when the scheduler pumps;
-*   delegated children and leaders returning from `delegate` wait for one and
-*   are served first, so a leader waiting on its children never holds a slot
-*   they need.
-*/
-/** Only a Claude session takes a slot; tools and gates are not limited. */
-const needsSlot = (node) => isClaudeNode(node);
-/** A call spends through its run, so it needs budget as a session does. */
-const spendsBudget = (node) => needsSlot(node) || node.type === "workflow.call";
-const createSlots = (limit, onFree) => {
-	let used = 0;
-	const waiting = [];
-	return {
-		limit,
-		tryTake: () => {
-			if (used >= limit || waiting.length > 0) return false;
-			used += 1;
-			return true;
-		},
-		take: () => {
-			if (used < limit && waiting.length === 0) {
-				used += 1;
-				return Promise.resolve();
-			}
-			const { promise, resolve } = Promise.withResolvers();
-			waiting.push(resolve);
-			return promise;
-		},
-		release: () => {
-			const next = waiting.shift();
-			if (next === void 0) {
-				used -= 1;
-				onFree();
-			} else next();
+const createInbox = (graph) => {
+	const resolved = /* @__PURE__ */ new Map();
+	/** Targets that ran, or joins that fired, in their current round. */
+	const fired = /* @__PURE__ */ new Set();
+	let order;
+	const forwards = /* @__PURE__ */ new Map();
+	const forwardIn = (id) => {
+		let edges = forwards.get(id);
+		if (edges === void 0) {
+			edges = (graph.nodes.get(id)?.incoming ?? []).filter((e) => !isLoopEdge(e));
+			forwards.set(id, edges);
 		}
+		return edges;
 	};
-};
-// ../core/src/run/fan-out.ts
-/** The node's `forEach`, whatever its type; `undefined` when it has none. */
-const forEachOf = (node) => node !== void 0 && "forEach" in node ? node.forEach : void 0;
-/** The list a node runs over, or why there isn't one. */
-const listOf = (forEach, scope) => {
-	if ("items" in forEach) return {
-		ok: true,
-		list: forEach.items
+	const reset = (id) => {
+		resolved.delete(id);
+		fired.delete(id);
 	};
-	const read = templateValue(forEach.from, scope);
-	if (!read.ok) return read;
-	const { value } = read;
-	if (Array.isArray(value)) return {
-		ok: true,
-		list: value
+	const arriveAtJoin = (id, seen) => {
+		const node = graph.nodes.get(id)?.node;
+		if (node?.type !== "control.join") return { kind: "wait" };
+		const inputs = forwardIn(id);
+		const ran = inputs.filter((e) => seen.get(edgeKey(e))?.taken === true);
+		const complete = inputs.every((e) => seen.has(edgeKey(e)));
+		const mode = node.mode ?? "all";
+		const needed = mode === "any" ? 1 : node.n ?? inputs.length;
+		if (mode === "all") {
+			if (!complete) return { kind: "wait" };
+			reset(id);
+			return ran.length > 0 ? {
+				kind: "activate",
+				input: joinOutput(inputs, seen)
+			} : { kind: "skip" };
+		}
+		if (!fired.has(id) && ran.length >= needed) {
+			const input = joinOutput(inputs, seen);
+			if (complete) reset(id);
+			else fired.add(id);
+			return {
+				kind: "activate",
+				input
+			};
+		}
+		if (!complete) return { kind: "wait" };
+		const wasFired = fired.has(id);
+		reset(id);
+		return wasFired ? { kind: "wait" } : { kind: "skip" };
 	};
-	const name = String(templatePath(forEach.from)?.at(-1) ?? forEach.from);
+	/** Records that `edge` resolved, and says what happens at its target. */
+	const arrive = (edge, taken, output) => {
+		const id = edge.to;
+		const seen = resolved.get(id) ?? /* @__PURE__ */ new Map();
+		resolved.set(id, seen);
+		seen.set(edgeKey(edge), {
+			taken,
+			output
+		});
+		if (graph.nodes.get(id)?.node.type === "control.join") return arriveAtJoin(id, seen);
+		const complete = forwardIn(id).every((e) => seen.has(edgeKey(e)));
+		const ran = taken || fired.has(id);
+		if (complete) reset(id);
+		else if (taken) fired.add(id);
+		if (taken) return {
+			kind: "activate",
+			input: output
+		};
+		return complete && !ran ? { kind: "skip" } : { kind: "wait" };
+	};
+	/** The edges a target still waits on. */
+	const missingOf = (id, seen) => forwardIn(id).filter((e) => !seen.has(edgeKey(e)));
+	/**
+	* The first target, in graph order, whose every edge still to resolve comes
+	* from a node that can't run any more: neither `active` (queued or running)
+	* nor after one along the non-loop edges. A loop's edge starts a new round,
+	* so it doesn't count. Its edges count as not taken; the caller delivers
+	* them, and asks again, as that can start something.
+	*/
+	const stranded = (active) => {
+		const candidates = [...resolved].map(([id, seen]) => ({
+			id,
+			missing: missingOf(id, seen)
+		})).filter(({ missing }) => !missing.some((e) => active(e.from)));
+		if (candidates.length === 0) return [];
+		/** Nodes known to be unable to run, in this call. */
+		const dead = /* @__PURE__ */ new Set();
+		const canRun = (from) => {
+			const visited = /* @__PURE__ */ new Set([from]);
+			const stack = [from];
+			for (let id = stack.pop(); id !== void 0; id = stack.pop()) {
+				if (active(id)) return true;
+				for (const edge of forwardIn(id)) {
+					if (visited.has(edge.from) || dead.has(edge.from)) continue;
+					visited.add(edge.from);
+					stack.push(edge.from);
+				}
+			}
+			for (const id of visited) dead.add(id);
+			return false;
+		};
+		order ??= orderOf(graph);
+		const known = order;
+		const place = (id) => known.get(id) ?? Infinity;
+		return candidates.filter(({ missing }) => !missing.some((e) => canRun(e.from))).toSorted((a, b) => place(a.id) - place(b.id))[0]?.missing ?? [];
+	};
+	/** Targets an edge reached that still wait on others. */
+	const waiting = () => [...resolved].map(([id, seen]) => ({
+		id,
+		waitingOn: [...new Set(missingOf(id, seen).map((e) => e.from))]
+	}));
 	return {
-		ok: false,
-		error: declaredProblem({ [name]: { list: {} } }, { [name]: value }) ?? `${name} is not a list`
+		arrive,
+		stranded,
+		waiting
 	};
 };
-/** The output a `from` list comes from, whose freshness resume asks about. */
-const sourceOf = (forEach, scope) => {
-	if (!("from" in forEach)) return void 0;
-	const [root, id] = templatePath(forEach.from) ?? [];
-	return root === "nodes" ? scope.nodes[String(id)]?.output : void 0;
-};
-const isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/**
-* What `results` keeps of an item: its declared fields (a program's are under
-* `json`), its summary, Ork's own branch and worktree, and how a program
-* failed. The full output stays in the item's own `node.finished`.
-*/
-const entryOf = (declared, { ok, output, error }) => {
-	const json = isRecord$1(output["json"]) ? output["json"] : {};
-	const fields = Object.keys(declared ?? {}).map((field) => [field, Object.hasOwn(json, field) ? json[field] : output[field]]);
-	const own = [
-		"summary",
-		"branch",
-		"worktree",
-		"merge"
-	].map((field) => [field, output[field]]);
-	const failed = !ok && typeof output["exitCode"] === "number" ? [["exitCode", output["exitCode"]], ["error", error]] : [];
-	return Object.fromEntries([
-		...fields,
-		...own,
-		...failed
-	].filter(([, value]) => value !== void 0));
-};
-/** Whether an item passed but its work could not reach its owner. */
-const mergeFailed = ({ output }) => isRecord$1(output["merge"]) && output["merge"]["ok"] === false;
-const statusOf$2 = (result) => {
-	if (mergeFailed(result)) return "fail";
-	const { ok, output } = result;
-	const status = output["status"];
-	if (typeof status === "string") return status;
-	return ok ? "pass" : "fail";
+// ../core/src/run/escalation.ts
+const LOOP_CHOICES = {
+	stop: "stop",
+	again: "again",
+	onward: "onward"
 };
-/** Why a fan-out did not succeed, naming the first item that failed. */
-const whyNot = (count, failures, skipped) => {
-	const parts = [`${String(failures.length)} of ${String(count)} items failed`];
-	const [first] = failures;
-	if (first !== void 0) parts[0] = `${parts[0] ?? ""}; first, ${first}`;
-	if (skipped > 0) parts.push(`${String(skipped)} not started`);
-	return parts.join("; ");
+/** What a list over its `maxItems` can be answered with (RFC-013). */
+const EACH_CHOICES = {
+	stop: "stop",
+	first: "first",
+	all: "all"
 };
+/** The question about a list over its cap; the recommended choice stops. */
+const eachQuestion = (node, count, maxItems, round = 1) => ({
+	question: `The list of ${node}${round > 1 ? ` (round ${String(round)})` : ""} has ${String(count)} items, more than its maxItems of ${String(maxItems)}. What now?`,
+	options: [
+		{
+			id: EACH_CHOICES.stop,
+			description: "Stop the run"
+		},
+		{
+			id: EACH_CHOICES.first,
+			description: `Run the first ${String(maxItems)}`
+		},
+		{
+			id: EACH_CHOICES.all,
+			description: `Run all ${String(count)}`
+		}
+	],
+	recommended: EACH_CHOICES.stop,
+	context: `${node} runs at most ${String(maxItems)} items unless someone says otherwise.`
+});
+/** The question about a loop out of rounds; the recommended choice stops. */
+const loopQuestion = (edge) => ({
+	question: `The loop ${edge.from} -> ${edge.to} used all ${String(edge.maxRounds ?? 0)} of its rounds. What now?`,
+	options: [
+		{
+			id: LOOP_CHOICES.stop,
+			description: "Stop the run"
+		},
+		{
+			id: LOOP_CHOICES.again,
+			description: "Allow one more round"
+		},
+		{
+			id: LOOP_CHOICES.onward,
+			description: "Go on along the other edges"
+		}
+	],
+	recommended: LOOP_CHOICES.stop,
+	context: `${edge.from} still wants another round${edge.when === void 0 ? "" : ` (${edge.when.trim()})`}.`
+});
 /**
-* Waits until the item may start: not while it is held, and without keeping a
-* session slot through a pause, which would stop other nodes.
+* Asks the owner of `edge.from` while its session is live (the node runs in the
+* flow, so its owner is not waiting on it), and the human otherwise or when the
+* owner's session ends first.
 */
-const awaitTurn = async (hold, slots, signal) => {
-	for (;;) {
-		await hold.wait("start", signal);
-		if (slots === null) return;
-		await slots.take();
-		if (!hold.held() || signal.aborted) return;
-		slots.release();
-	}
+const askAboutLoop = async (human, edge, bus) => {
+	const question = loopQuestion(edge);
+	return await bus?.askOwner(edge.from, question) ?? await bus?.askOwner(edge.to, question) ?? human.ask({
+		nodeId: edge.from,
+		...question
+	});
 };
-const createFanOut = (deps) => {
-	const { holds, slots, stops, nodeOf, perform, options } = deps;
-	return async (activation, forEach, round) => {
-		const { id, input } = activation;
-		const scope = deps.scope();
-		const recorded = options.replay?.listed?.(id, round, sourceOf(forEach, scope)) ?? null;
-		const listed = recorded === null ? listOf(forEach, scope) : {
-			ok: true,
-			list: unmasked(forEach, recorded)
-		};
-		if (!listed.ok) return failedWith(endFor("invalid_node", { reason: listed.error }));
-		let { list } = listed;
-		const recordList = () => {
-			options.onEvent({
-				type: "each.listed",
-				node: id,
-				round,
-				count: list.length,
-				list,
-				...recorded === null && options.replay !== void 0 ? { anew: true } : {}
-			});
-		};
-		recordList();
-		const signal = stops.signalFor(id);
-		if ("maxItems" in forEach && list.length > forEach.maxItems) {
-			options.onEvent({
-				type: "each.exceeded",
-				node: id,
-				round,
-				count: list.length,
-				maxItems: forEach.maxItems
-			});
-			const chosen = await deps.loops.overList(id, list, forEach.maxItems, round, signal);
-			if (chosen === null) {
-				const reason = `the list of ${id} has ${String(list.length)} items, over maxItems ${String(forEach.maxItems)}`;
-				return stops.ended(id, {
-					...failedWith(endFor("invalid_node", { reason }), {
-						status: "fail",
-						summary: reason
-					}),
-					limited: reason,
-					stopsAs: "failed"
-				});
-			}
-			const narrowed = chosen.length !== list.length;
-			list = chosen;
-			if (narrowed) recordList();
-		}
-		const node = nodeOf(activation);
-		const session = node !== void 0 && needsSlot(node);
-		const spends = node !== void 0 && spendsBudget(node);
-		const declared = node === void 0 ? void 0 : declaredOutputOf(node);
-		const results = list.map(() => ({}));
-		const statuses = list.map(() => "skipped");
-		const failures = [];
-		/** How the first item that failed ended: the fanned node's own end. */
-		let firstEnd;
-		const mayStart = () => !signal.aborted && !deps.isStopped() && (forEach.onFailure !== "stop" || failures.length === 0);
-		const runItem = async (index) => {
-			const itemId = `${id}.${String(index)}`;
-			const hold = holds.forNode(itemId, id);
-			await awaitTurn(hold, session ? slots : null, signal);
-			try {
-				if (!mayStart() || spends && deps.budgetSpent()) return;
-				const result = await perform({
-					id: itemId,
-					input,
-					template: id,
-					item: {
-						of: id,
-						index,
-						value: list[index]
-					},
-					round
-				});
-				results[index] = entryOf(declared, result);
-				statuses[index] = statusOf$2(result);
-				if (!result.ok) {
-					firstEnd ??= endOf(result);
-					failures.push(`${itemId}: ${result.error ?? "failed"}`);
-				} else if (mergeFailed(result)) failures.push(`${itemId}: its work could not be merged`);
-			} finally {
-				if (session) slots.release();
-			}
-		};
-		let next = 0;
-		const worker = async () => {
-			while (next < list.length && mayStart()) {
-				const index = next;
-				next += 1;
-				await runItem(index);
-			}
-		};
-		const lanes = Math.min(forEach.maxParallel ?? slots.limit, list.length);
-		await Promise.all(Array.from({ length: lanes }, () => worker()));
-		const skipped = statuses.filter((status) => status === "skipped").length;
-		const ok = failures.length === 0 && skipped === 0;
-		const gathered = {
-			ok,
-			output: {
-				items: list,
-				results,
-				statuses,
-				count: list.length
-			},
-			...ok ? {} : { error: whyNot(list.length, failures, skipped) },
-			...ok || firstEnd === void 0 ? {} : { end: firstEnd },
-			...!ok && deps.isStopped() ? { limited: deps.reasons[0] ?? "the run stopped" } : {}
-		};
-		return {
-			...stops.ended(id, gathered),
-			output: gathered.output
-		};
+/** Counts each loop edge's rounds; `take` is false once one is out of them. */
+const createLoops = (options) => {
+	const taken = /* @__PURE__ */ new Map();
+	const extra = /* @__PURE__ */ new Map();
+	const take = async (edge, output) => {
+		const key = edgeKey(edge);
+		const count = taken.get(key) ?? 0;
+		if (count < (edge.maxRounds ?? 0) + (extra.get(key) ?? 0)) {
+			taken.set(key, count + 1);
+			options.activate(edge.to, output);
+			options.onEvent({
+				type: "edge.taken",
+				from: edge.from,
+				to: edge.to
+			});
+			return true;
+		}
+		options.onEvent({
+			type: "loop.exhausted",
+			from: edge.from,
+			to: edge.to,
+			maxRounds: edge.maxRounds ?? 0
+		});
+		const choice = await askAboutLoop(options.human, edge, options.bus);
+		if (choice === LOOP_CHOICES.again) {
+			extra.set(key, (extra.get(key) ?? 0) + 1);
+			return take(edge, output);
+		}
+		if (choice !== LOOP_CHOICES.onward) options.fail(`the loop ${edge.from} -> ${edge.to} ran out of rounds`);
+		return false;
+	};
+	/**
+	* What a list over its cap runs: asked of a live owner, then the human. All
+	* of it, the first `maxItems`, or `null` to stop. A stop (`signal`) ends the
+	* wait and withdraws the question; the list comes back whole, and nothing of
+	* it starts because the stop also bars its items.
+	*/
+	const overList = async (node, list, maxItems, round, signal) => {
+		const question = eachQuestion(node, list.length, maxItems, round);
+		const asking = async () => await options.bus?.askOwner(node, question) ?? (signal.aborted ? null : options.human.ask({
+			nodeId: node,
+			...question,
+			signal
+		}));
+		const stopped = Promise.withResolvers();
+		signal.addEventListener("abort", () => {
+			stopped.resolve(null);
+		}, { once: true });
+		const choice = await Promise.race([asking(), stopped.promise]);
+		if (signal.aborted) return list;
+		if (choice === EACH_CHOICES.first) return list.slice(0, maxItems);
+		return choice === EACH_CHOICES.all ? list : null;
+	};
+	return {
+		take,
+		overList
 	};
 };
 // ../core/src/run/delegation.ts
@@ -8543,6 +8719,10 @@ const nodeContext = (deps, activation, cwd, round, clock) => {
 		reserveBudget: (usd) => {
 			deps.spend.reserve(id, usd, deps.nodeOf(activation)?.type !== "agent.leader");
 		},
+		tokensLeftNow: deps.spend.tokensLeft,
+		reserveTokens: (tokens) => {
+			deps.spend.reserve(id, tokens, deps.nodeOf(activation)?.type !== "agent.leader", "tokens");
+		},
 		budgetFreed: (signal) => deps.spend.freed(id, signal),
 		quota: deps.spend.quota,
 		ownSpend: (sessionId, total) => deps.spend.ownOf(id, sessionId, total),
@@ -8552,9 +8732,10 @@ const nodeContext = (deps, activation, cwd, round, clock) => {
 		...options.calls === void 0 ? {} : { calls: options.calls },
 		emit: (event) => {
 			deps.ports.owners.seen(id, event, cwd);
+			if (event.type === "session.started") deps.spend.started(event.driver);
 			if (event.type === "session.finished" && event.fork !== true) {
 				const { sessionId, usage } = event.outcome;
-				deps.spend.report(id, sessionId, usage.costUsd);
+				deps.spend.reported(id, sessionId, usage);
 			}
 			options.onEvent({
 				type: "node.event",
@@ -8663,6 +8844,22 @@ const scriptContactsOf = (id, nodes, channels) => {
 /** Whether a program in a tool node may write to the session `id`. */
 const hearsFromScripts = (id, nodes, channels) => nodes.some((node) => isTool(node) && scriptContactsOf(node.id, nodes, channels).includes(id));
 // ../core/src/usage/spend.ts
+/**
+* @file What a session spent, from what it reported (ADR-046). Claude Code
+*   reports a resumed session's cost as its total so far, carried over from its
+*   transcript when that has one, and a crash's result may carry zero. The
+*   ledger and the scheduler both read a session's reports through `ownSpend`;
+*   `earlierSpend` is what a resumed run starts from.
+*/
+/**
+* The tokens a token budget or quota counts (RFC-015): input, output and cache
+* writes. Cache reads never count. The ledger's `tokensSince` sums the same.
+*/
+const countedTokens = (usage) => usage.inputTokens + usage.outputTokens + usage.cacheWriteTokens;
+/** The drivers that report no dollars: a dollar total can't see their sessions. */
+const UNPRICED_DRIVERS = AGENT_DRIVERS.filter((driver) => !driver.capabilities.price).map((driver) => driver.id);
+/** Whether a session on `driver` spends dollars no total can see. */
+const unpriced = (driver) => driver !== void 0 && UNPRICED_DRIVERS.includes(driver);
 /** What a report would add to the session's earlier ones, counting nothing. */
 const unreported = (reported, key, total) => {
 	if (total <= 0) return 0;
@@ -8692,18 +8889,23 @@ const earlierSpend = (events) => {
 	const open = /* @__PURE__ */ new Map();
 	const forks = /* @__PURE__ */ new Map();
 	let total = 0;
+	let tokens = 0;
+	let partial = false;
 	for (const event of events) if (event.type === "node.started") open.set(event.id, null);
 	else if (event.type === "node.finished") {
 		total += event.usage?.costUsd ?? 0;
+		tokens += event.usage === void 0 ? 0 : countedTokens(event.usage);
 		const last = open.get(event.id);
 		if (last !== null && last !== void 0) ownSpend(reported, last.key, last.cost);
 		open.delete(event.id);
-	} else if (event.type === "node.event" && event.event.type === "session.finished") {
+	} else if (event.type === "node.event" && event.event.type === "session.started") partial ||= unpriced(event.event.driver);
+	else if (event.type === "node.event" && event.event.type === "session.finished") {
 		const { sessionId, usage } = event.event.outcome;
 		const key = `${event.id}/${sessionId}`;
 		if (event.event.fork === true) {
 			const own = ownSpend(reported, key, usage.costUsd);
 			total += own;
+			tokens += countedTokens(usage);
 			forks.set(event.id, (forks.get(event.id) ?? 0) + own);
 		} else if (open.has(event.id)) open.set(event.id, {
 			key,
@@ -8713,6 +8915,8 @@ const earlierSpend = (events) => {
 	}
 	return {
 		total,
+		tokens,
+		partial,
 		reported,
 		forks
 	};
@@ -8727,20 +8931,27 @@ const createReserves = () => {
 		for (const resolve of woken) resolve();
 	};
 	return {
-		/** All that is set aside now. */
-		total: () => [...held.values()].reduce((sum, reserve) => sum + reserve.usd, 0),
+		/** All that is set aside now, in `unit`. */
+		total: (unit = "usd") => [...held.values()].reduce((sum, reserve) => sum + reserve[unit], 0),
 		/**
-		* `id` sets aside `usd` (nothing, or 0, lets it go). `waitable` is false
-		* for a leader, whose children must never wait on it.
+		* `id` sets aside `amount` of `unit` (nothing, or 0, lets it go).
+		* `waitable` is false for a leader, whose children must never wait on it.
 		*/
-		reserve: (id, usd, waitable) => {
-			const before = held.get(id)?.usd ?? 0;
-			if (usd === void 0 || usd <= 0) held.delete(id);
-			else held.set(id, {
-				usd,
+		reserve: (id, amount, waitable, unit = "usd") => {
+			const now = held.get(id) ?? {
+				usd: 0,
+				tokens: 0,
 				waitable
-			});
-			if ((usd ?? 0) < before) wake();
+			};
+			const before = now[unit];
+			const next = {
+				...now,
+				waitable,
+				[unit]: Math.max(amount ?? 0, 0)
+			};
+			if (next.usd === 0 && next.tokens === 0) held.delete(id);
+			else held.set(id, next);
+			if ((amount ?? 0) < before) wake();
 		},
 		/** The node ended: whatever it still held is let go. */
 		drop: (id) => {
@@ -8788,40 +8999,77 @@ const withOwnSpend = (id, result, reported) => {
 		} : result.output
 	};
 };
-/** A run's spending so far; a resumed run starts from what it had spent. */
-const createSpend = (budgetUsd, earlier, limits) => {
+const sum = (values) => [...values].reduce((total, value) => total + value, 0);
+/** The least of the limits that are set; `undefined` with none. */
+const least = (...limits) => {
+	const known = limits.filter((limit) => limit !== void 0);
+	return known.length === 0 ? void 0 : Math.min(...known);
+};
+/**
+* A run's spending so far; a resumed run starts from what it had spent.
+* `budgetTokens` caps its counted tokens as `budgetUsd` caps its dollars.
+*/
+const createSpend = (budgetUsd, earlier, limits, budgetTokens) => {
 	const reported = new Map(earlier?.reported);
 	let spent = earlier?.total ?? 0;
+	let tokens = earlier?.tokens ?? 0;
+	let partial = earlier?.partial ?? false;
 	/** What running sessions last reported, not yet in `spent`, by `node/session`. */
 	const inFlight = /* @__PURE__ */ new Map();
-	const committed = () => spent + [...inFlight.values()].reduce((sum, cost) => sum + cost, 0);
+	/** Their counted tokens: each process's own, so a session's add up. */
+	const tokensInFlight = /* @__PURE__ */ new Map();
+	const committed = () => spent + sum(inFlight.values());
+	const committedTokens = () => tokens + sum(tokensInFlight.values());
 	/** Caps running sessions were given (ADR-077): out of what is offered. */
 	const reserves = createReserves();
 	const budgetLeft = () => budgetUsd === void 0 ? void 0 : budgetUsd - committed() - reserves.total();
+	const tokensLeft = () => budgetTokens === void 0 ? void 0 : budgetTokens - committedTokens() - reserves.total("tokens");
+	/**
+	* A running session said what it has spent so far, and the counted tokens of
+	* the process that just ended.
+	*/
+	const report = (id, sessionId, total, counted = 0) => {
+		const key = `${id}/${sessionId}`;
+		inFlight.set(key, unreported(reported, key, total));
+		tokensInFlight.set(key, (tokensInFlight.get(key) ?? 0) + counted);
+	};
 	return {
 		total: () => spent,
+		/** The counted tokens of what `total` counts. */
+		tokens: () => tokens,
+		/** A session ran on a driver that reports no dollars: `total` is partial. */
+		partial: () => partial,
+		/** What the run's result says it spent. */
+		sums: () => ({
+			costUsd: spent,
+			tokens,
+			partial
+		}),
+		/** A session ran on `driver`. */
+		started: (driver) => {
+			partial ||= unpriced(driver);
+		},
 		/** A node sets aside its session's cap; nothing or 0 lets it go. */
 		reserve: reserves.reserve,
+		/** A session finished with `usage`: `report` with its counted tokens. */
+		reported: (id, sessionId, usage) => {
+			report(id, sessionId, usage.costUsd, countedTokens(usage));
+		},
 		/** Waits until another node's reserve frees; `false` when none can. */
 		freed: reserves.freed,
 		/** What a session has spent in this activation, from its total so far. */
 		ownOf: (id, sessionId, total) => unreported(reported, `${id}/${sessionId}`, total),
-		/** A running session said what it has spent so far. */
-		report: (id, sessionId, total) => {
-			const key = `${id}/${sessionId}`;
-			inFlight.set(key, unreported(reported, key, total));
-		},
+		report,
 		/** The node ended: `count` has what its sessions last reported. */
 		settled: (id) => {
-			for (const key of inFlight.keys()) if (key.startsWith(`${id}/`)) inFlight.delete(key);
+			for (const map of [inFlight, tokensInFlight]) for (const key of map.keys()) if (key.startsWith(`${id}/`)) map.delete(key);
 			reserves.drop(id);
 		},
 		/** What a session may spend: the least of the budget and any quota. */
-		left: () => {
-			const known = [budgetLeft(), limits?.().leftUsd].filter((left) => left !== void 0);
-			return known.length === 0 ? void 0 : Math.min(...known);
-		},
+		left: () => least(budgetLeft(), limits?.().leftUsd),
 		budgetLeft,
+		/** What is left of the run's `budgetTokens`, its reserves out. */
+		tokensLeft,
 		/** What the limits across runs allow now. */
 		quota: () => limits?.() ?? {},
 		/**
@@ -8834,9 +9082,13 @@ const createSpend = (budgetUsd, earlier, limits) => {
 				status: "quota_exhausted",
 				reason: blocked
 			};
-			return budgetUsd !== void 0 && committed() >= budgetUsd ? {
+			if (budgetUsd !== void 0 && committed() >= budgetUsd) return {
 				status: "budget_exhausted",
 				reason: `the run's budget of $${String(budgetUsd)} is spent`
+			};
+			return budgetTokens !== void 0 && committedTokens() >= budgetTokens ? {
+				status: "budget_exhausted",
+				reason: `the run's budget of ${String(budgetTokens)} tokens is spent`
 			} : null;
 		},
 		/**
@@ -8847,12 +9099,13 @@ const createSpend = (budgetUsd, earlier, limits) => {
 			if (replayed) return result;
 			const own = withOwnSpend(id, result, reported);
 			spent += own.usage?.costUsd ?? 0;
+			tokens += own.usage === void 0 ? 0 : countedTokens(own.usage);
 			return own;
 		}
 	};
 };
 /** A run's spending, from what the scheduler is given. */
-const spendOf = (budgetUsd, options) => createSpend(budgetUsd, options.replay?.earlier, options.limits);
+const spendOf = (budgetUsd, options, budgetTokens) => createSpend(budgetUsd, options.replay?.earlier, options.limits, budgetTokens);
 // ../core/src/run/gather.ts
 const asList = (value) => Array.isArray(value) ? value : [];
 /** `before` then `now`, leaving out an entry already there. */
@@ -9015,6 +9268,8 @@ const runResult = (run) => ({
 	runId: run.runId,
 	status: run.stopped ?? (run.reasons.length > 0 ? "failed" : "succeeded"),
 	costUsd: run.costUsd,
+	...run.tokens === void 0 || run.tokens === 0 ? {} : { tokens: run.tokens },
+	...run.partial === true ? { partial: true } : {},
 	nodes: run.nodes,
 	reasons: run.reasons,
 	worktrees: run.worktrees,
@@ -9291,6 +9546,8 @@ const runTree = (events) => {
 		node.costUsd += event.usage?.costUsd ?? 0;
 		node.inputTokens += event.usage?.inputTokens ?? 0;
 		node.outputTokens += event.usage?.outputTokens ?? 0;
+		const written = event.usage?.cacheWriteTokens ?? 0;
+		if (written > 0) node.cacheWriteTokens = (node.cacheWriteTokens ?? 0) + written;
 	} else if (event.type === "node.skipped") {
 		const node = nodes.get(event.id);
 		if (node !== void 0) node.state = "skipped";
@@ -9306,7 +9563,10 @@ const runTree = (events) => {
 		if (node !== void 0) node.calledRun = event.run;
 	} else if (event.type === "node.event" && event.event.type === "session.started") {
 		const node = nodes.get(event.id);
-		if (node !== void 0) node.model = event.event.model;
+		if (node !== void 0) {
+			node.model = event.event.model;
+			if (unpriced(event.event.driver)) node.unpriced = true;
+		}
 	}
 	const roots = [];
 	for (const node of nodes.values()) {
@@ -9323,6 +9583,19 @@ const slotWaitsOf = (events) => {
 	else if (event.type === "slot.taken" || event.type === "node.finished") waiting.delete(event.id);
 	return [...waiting];
 };
+/** The nodes of a run waiting for a lock now (RFC-016). */
+const lockWaitsOf = (events) => {
+	const waiting = /* @__PURE__ */ new Map();
+	for (const event of events) if (event.type === "lock.waiting") {
+		const { id, lock, holders } = event;
+		waiting.set(id, {
+			id,
+			lock,
+			holders
+		});
+	} else if (event.type === "lock.taken" || event.type === "node.finished") waiting.delete(event.id);
+	return [...waiting.values()];
+};
 /** Folds a run's `ork pause` and `ork continue` commands (ADR-041). */
 const pausedOf = (events) => {
 	let run = false;
@@ -9526,7 +9799,7 @@ const createStops = (run) => {
 /** A promise that never settles: the losing side of a race. */
 const NEVER = new Promise(() => {});
 /** For a rejection no one is left to hear. */
-const ignore = () => {};
+const ignore$1 = () => {};
 /** The timeout that applies to a node; a gate's own means something else. */
 const timeoutOf = (node, workflow) => (isToolNode(node) || isClaudeNode(node) || node.type === "workflow.call" || node.type === "mcp.call") && node.type !== "agent.subagent" ? node.timeout ?? workflow.defaults?.timeout : void 0;
 const createClock = (options) => {
@@ -9641,7 +9914,7 @@ const withTimeout = async (bound) => {
 		}, graceMs);
 		return promise;
 	});
-	running.catch(ignore);
+	running.catch(ignore$1);
 	try {
 		const result = await Promise.race([running, leftBehind]);
 		return expired || result === null ? timedOut(timeout, result) : result;
@@ -9837,8 +10110,7 @@ const runWatch = async (options) => {
 };
 /** Whether an event only repeats a look's call, once it's been recorded. */
 const repeatsCall = (event) => event.type === "tool.called" || event.type === "tool.result";
-// ../core/src/run/execute.ts
-/** Runs an activation; control nodes pass their input through. */
+// ../core/src/run/execute-placed.ts
 const saidBy = (error) => error instanceof Error ? error.message : String(error);
 /**
 * A thrown error's end: a failed git or missing program by its text, else
@@ -9853,10 +10125,70 @@ const thrown = (error, fallback) => {
 	});
 	return failedWith(read.kind === "unknown" ? endFor(fallback, { reason: text }, text) : read);
 };
-/** Runs an activation, its end's detail scrubbed of the run's paths. */
-const createExecute = (deps) => async (activation, round) => scrubbedEnd(await executeOne(deps, activation, round), [deps.options.cwd, deps.options.projectRoot ?? ""]);
-const executeOne = async (deps, activation, round) => {
-	const { options, contextDeps, clock, graceMs, nodeOf } = deps;
+/** Runs an activation in its checkout, under its timeout. */
+const executePlaced = async (deps, activation, round, node, executor) => {
+	const { options, contextDeps, clock, graceMs } = deps;
+	const { workspace } = options;
+	const place = await (workspace?.prepare(activation.id, activation.template) ?? Promise.resolve({ cwd: options.cwd })).catch((error) => thrown(error, "invalid_node"));
+	if ("ok" in place) return place;
+	const context = nodeContext(contextDeps, activation, place.cwd, round, clock);
+	const once = (signal, emit) => withTimeout({
+		timeout: timeoutOf(node, options.graph.workflow),
+		clock: clock.forNode(activation.id),
+		signal,
+		graceMs,
+		start: (inner) => executor({
+			...context,
+			emit,
+			signal: inner,
+			node,
+			...place.checkout === void 0 ? {} : { checkout: place.checkout }
+		})
+	});
+	const watch = "watch" in node ? node.watch : void 0;
+	const result = watch === void 0 ? await once(context.signal, context.emit) : await runWatch({
+		id: activation.id,
+		watch,
+		declared: "output" in node ? node.output?.schema : void 0,
+		look: (signal, quiet) => once(signal, (event) => {
+			if (!quiet || !repeatsCall(event)) context.emit(event);
+		}),
+		scope: () => runScope(options.inputs, contextDeps.outputs, contextDeps.runId),
+		hold: context.hold,
+		signal: context.signal,
+		graceMs,
+		onEvent: options.onEvent,
+		resting: (on) => {
+			clock.resting(activation.id, on);
+		},
+		everyMs: options.watchEveryMs
+	});
+	const ended = result.ok || !context.signal.aborted ? result : endedWith(result, stoppedEnd(context.signal));
+	return await workspace?.finish(activation.id, ended) ?? ended;
+};
+// ../core/src/run/execute.ts
+/**
+* Runs activations, each end's detail scrubbed of the run's paths; and the
+* run's locks, which the run lets go when it ends.
+*/
+const createExecute = (deps) => {
+	const { options, contextDeps, clock } = deps;
+	const { runId, outputs } = contextDeps;
+	const locks = createRunLocks({
+		graph: options.graph,
+		ledgers: options.locks,
+		runId,
+		scope: (item) => runScope(options.inputs, outputs, runId, item),
+		onEvent: options.onEvent,
+		waitFor: clock.waitFor
+	});
+	return {
+		execute: async (activation, round) => scrubbedEnd(await executeOne(deps, locks, activation, round), [options.cwd, options.projectRoot ?? ""]),
+		locks
+	};
+};
+const executeOne = async (deps, locks, activation, round) => {
+	const { options, contextDeps, nodeOf } = deps;
 	const node = nodeOf(activation);
 	if (node === void 0) return failedWith(endFor("unknown", {}, `unknown node ${activation.id}`));
 	if (node.type.startsWith("control.")) return passThrough(activation.input);
@@ -9865,43 +10197,14 @@ const executeOne = async (deps, activation, round) => {
 	try {
 		const forEach = activation.item === void 0 ? forEachOf(node) : void 0;
 		if (forEach !== void 0) return await deps.fanOut(activation, forEach, round);
-		const { workspace } = options;
-		const place = await (workspace?.prepare(activation.id, activation.template) ?? Promise.resolve({ cwd: options.cwd })).catch((error) => thrown(error, "invalid_node"));
-		if ("ok" in place) return place;
-		const context = nodeContext(contextDeps, activation, place.cwd, round, clock);
-		const once = (signal, emit) => withTimeout({
-			timeout: timeoutOf(node, options.graph.workflow),
-			clock: clock.forNode(activation.id),
-			signal,
-			graceMs,
-			start: (inner) => executor({
-				...context,
-				emit,
-				signal: inner,
-				node,
-				...place.checkout === void 0 ? {} : { checkout: place.checkout }
-			})
-		});
-		const watch = "watch" in node ? node.watch : void 0;
-		const result = watch === void 0 ? await once(context.signal, context.emit) : await runWatch({
-			id: activation.id,
-			watch,
-			declared: "output" in node ? node.output?.schema : void 0,
-			look: (signal, quiet) => once(signal, (event) => {
-				if (!quiet || !repeatsCall(event)) context.emit(event);
-			}),
-			scope: () => runScope(options.inputs, contextDeps.outputs, contextDeps.runId),
-			hold: context.hold,
-			signal: context.signal,
-			graceMs,
-			onEvent: options.onEvent,
-			resting: (on) => {
-				clock.resting(activation.id, on);
-			},
-			everyMs: options.watchEveryMs
-		});
-		const ended = result.ok || !context.signal.aborted ? result : endedWith(result, stoppedEnd(context.signal));
-		return await workspace?.finish(activation.id, ended) ?? ended;
+		if (!("lock" in node) || node.lock === void 0) return await executePlaced(deps, activation, round, node, executor);
+		const signal = contextDeps.stops.signalFor(activation.id, activation.template);
+		if (!await locks.enter(activation, signal)) return failedWith(stoppedEnd(signal));
+		try {
+			return await executePlaced(deps, activation, round, node, executor);
+		} finally {
+			locks.leave(activation);
+		}
 	} catch (error) {
 		return thrown(error, "unknown");
 	}
@@ -10620,7 +10923,7 @@ const startRun = (options) => {
 	const outputs = {};
 	const rounds = /* @__PURE__ */ new Map();
 	const sessionIds = /* @__PURE__ */ new Map();
-	const spend = spendOf(limits.budgetUsd, options);
+	const spend = spendOf(limits.budgetUsd, options, limits.budgetTokens);
 	const running = /* @__PURE__ */ new Set();
 	const { summaries, summary } = createSummaries(options.replay?.earlier);
 	const queue = [];
@@ -10705,12 +11008,13 @@ const startRun = (options) => {
 	});
 	const close = async () => {
 		cancelTimeout();
+		locks.end();
 		const worktrees = await closeWorkspace(options.workspace, reasons);
 		await options.beforeFinish?.();
 		const result = runResult({
 			runId,
 			stopped,
-			costUsd: spend.total(),
+			...spend.sums(),
 			nodes: [...summaries.values()],
 			reasons,
 			worktrees,
@@ -10763,7 +11067,7 @@ const startRun = (options) => {
 		spend,
 		summary
 	};
-	const execute = createExecute({
+	const { execute, locks } = createExecute({
 		options,
 		contextDeps,
 		clock,
@@ -12153,6 +12457,9 @@ const planNodeSession = (workflow, id, options) => {
 	if (maxTurns !== void 0) spec.maxTurns = maxTurns;
 	const budgets = [node.budgetUsd ?? defaults.budgetUsd, options.budgetLeftUsd].filter((b) => b !== void 0);
 	if (budgets.length > 0) spec.budgetUsd = Math.min(...budgets);
+	const own = node.budgetTokens ?? defaults.budgetTokens;
+	const left = options.budgetLeftTokens ?? own;
+	if (left !== void 0) spec.budgetTokens = Math.min(left, own ?? left);
 	const plugin = options.pluginDir === void 0 ? null : writePlugin(context, options.pluginDir, `Skills Ork compiled for ${id}`);
 	if (plugin !== null) spec.plugins = [plugin];
 	const settings = sessionSettings(context, options.cwd);
@@ -12363,6 +12670,9 @@ const FIELDS = {
 	week: "weekUsd",
 	month: "monthUsd"
 };
+/** The windows a quota in counted tokens (RFC-015) has, and their fields. */
+const TOKEN_FIELDS = { day: "dayTokens" };
+const inTokens = (cap) => "capTokens" in cap;
 /** Where a window began and when the next begins, in local time. */
 const windowOf = (window, now) => {
 	const [year, month, day] = [
@@ -12384,33 +12694,50 @@ const windowOf = (window, now) => {
 		until: new Date(year, month, monday + 7)
 	};
 };
-/** The caps that apply: the user's on everything, and the project's on itself. */
-const capsOf = (user, project, root) => WINDOWS.flatMap((window) => {
-	const field = FIELDS[window];
-	const everywhere = user?.[field];
-	const here = project?.[field];
-	const caps = [];
-	if (everywhere !== void 0) caps.push({
-		window,
-		capUsd: everywhere
-	});
-	if (here !== void 0 && root !== void 0) caps.push({
+/**
+* The caps that apply: the user's on everything, and the project's on itself;
+* those in dollars, then those in tokens.
+*/
+const capsOf = (user, project, root) => {
+	const whose = (field, cap) => {
+		const everywhere = user?.[field];
+		const here = project?.[field];
+		return [...everywhere === void 0 ? [] : [cap(everywhere)], ...here === void 0 || root === void 0 ? [] : [Object.assign(cap(here), { project: root })]];
+	};
+	return [...WINDOWS.flatMap((window) => whose(FIELDS[window], (capUsd) => ({
 		window,
-		capUsd: here,
-		project: root
-	});
-	return caps;
-});
-/** Each cap with what has been spent against it. */
-const standingOf = (store, caps, now) => caps.map((cap) => {
+		capUsd
+	}))), ...WINDOWS.flatMap((window) => {
+		const field = TOKEN_FIELDS[window];
+		return field === void 0 ? [] : whose(field, (capTokens) => ({
+			window,
+			capTokens
+		}));
+	})];
+};
+/** Each cap in dollars with what has been spent against it. */
+const standingOf = (store, caps, now) => caps.flatMap((cap) => {
+	if (inTokens(cap)) return [];
 	const { since, until } = windowOf(cap.window, now);
 	const spentUsd = store.spentSince(since.toISOString(), cap.project);
-	return {
+	return [{
 		...cap,
 		spentUsd,
 		leftUsd: cap.capUsd - spentUsd,
 		resetsAt: until.toISOString()
-	};
+	}];
+});
+/** Each cap in tokens with the counted tokens used against it. */
+const tokenStandingOf = (store, caps, now) => caps.flatMap((cap) => {
+	if (!inTokens(cap)) return [];
+	const { since, until } = windowOf(cap.window, now);
+	const spentTokens = store.spentSince(since.toISOString(), cap.project, "tokens");
+	return [{
+		...cap,
+		spentTokens,
+		leftTokens: cap.capTokens - spentTokens,
+		resetsAt: until.toISOString()
+	}];
 });
 /** Dollars: cents, or more digits for an amount under a dollar. */
 const usd = (amount) => `$${amount.toFixed(amount > 0 && amount < 1 ? 4 : 2)}`;
@@ -12418,7 +12745,10 @@ const at = (iso) => new Date(iso).toLocaleString(void 0, {
 	dateStyle: "medium",
 	timeStyle: "short"
 });
-const capReason = (spent) => `${spent.project === void 0 ? "your" : "this project's"} ${spent.window} quota of ${usd(spent.capUsd)} is spent (${usd(spent.spentUsd)}); it lifts on ${at(spent.resetsAt)}, or raise it in ${spent.project === void 0 ? "~/.ork/settings.yaml" : ".ork/project.yaml"}`;
+const capReason = (spent) => {
+	const [cap, used] = "capTokens" in spent ? [`${String(spent.capTokens)} tokens`, String(spent.spentTokens)] : [usd(spent.capUsd), usd(spent.spentUsd)];
+	return `${spent.project === void 0 ? "your" : "this project's"} ${spent.window} quota of ${cap} is spent (${used}); it lifts on ${at(spent.resetsAt)}, or raise it in ${spent.project === void 0 ? "~/.ork/settings.yaml" : ".ork/project.yaml"}`;
+};
 /** What a run or a call refused at its start says first, for its caller to read. */
 const NOT_STARTED = "Not started: ";
 /** Why a plan limit stops a run. */
@@ -12441,11 +12771,13 @@ const SHOWN_MS = 864e5;
 /** What the caps and the plan allow a run now. */
 const limitsNow = (store, caps, now) => {
 	const standing = standingOf(store, caps, now);
+	const tokens = tokenStandingOf(store, caps, now);
 	const [plan] = refusing(store.planLimits(), now);
-	const spent = standing.find((cap) => cap.leftUsd <= 0);
+	const spent = standing.find((cap) => cap.leftUsd <= 0) ?? tokens.find((cap) => cap.leftTokens <= 0);
 	const blocked = plan === void 0 ? spent === void 0 ? void 0 : capReason(spent) : planReason(plan);
 	return {
 		...standing.length === 0 ? {} : { leftUsd: Math.min(...standing.map((cap) => cap.leftUsd)) },
+		...tokens.length === 0 ? {} : { leftTokens: Math.min(...tokens.map((cap) => cap.leftTokens)) },
 		...blocked === void 0 ? {} : { blocked }
 	};
 };
@@ -12453,6 +12785,7 @@ const limitsNow = (store, caps, now) => {
 const limitsReport = (store, { caps, problems }, now) => ({
 	problems,
 	caps: standingOf(store, caps, now),
+	tokenCaps: tokenStandingOf(store, caps, now),
 	plan: store.planLimits().filter((limit) => {
 		if (limit.status === "allowed") return false;
 		return (limit.resetsAt === void 0 ? Date.parse(limit.at) + SHOWN_MS : Date.parse(limit.resetsAt)) > now.getTime();
@@ -12783,7 +13116,9 @@ const mailOf = (events) => {
 *   more than once reads as one history: a later result replaces the earlier
 *   one at its place. Also: the run's inputs and settings, its worktrees, the
 *   answers to its loops, and a fanned node's lists and its items' results by
-*   round (RFC-013). `replay.ts` hands them back.
+*   round (RFC-013). A lock the run ended holding (RFC-016) hands back nothing
+*   its nodes did under it, so they run again under the lock. `replay.ts` hands
+*   them back.
 */
 const listKey = (node, round) => `${node}/${String(round)}`;
 /** How a run ended that cut its working nodes off, rather than failing them. */
@@ -12818,6 +13153,11 @@ const resumeState = (events) => {
 	/** Nodes whose last activation did not finish well, and its session. */
 	const unfinished = /* @__PURE__ */ new Map();
 	const places = /* @__PURE__ */ new Map();
+	/**
+	* Locks held at the end so far, each node that ran under it and how many of
+	* its results came before (RFC-016).
+	*/
+	const spans = /* @__PURE__ */ new Map();
 	/** A new run of `id`'s `round` replaces what is recorded there and after. */
 	const supersede = (id, round) => {
 		fanOuts.items.get(id)?.delete(round);
@@ -12883,6 +13223,18 @@ const resumeState = (events) => {
 			} else history.set(event.id, [...history.get(event.id) ?? [], result]);
 			continue;
 		}
+		if (event.type === "lock.taken") {
+			if (open.get(event.id)?.item === true) continue;
+			const span = spans.get(event.lock) ?? /* @__PURE__ */ new Map();
+			if (!span.has(event.id)) span.set(event.id, history.get(event.id)?.length ?? 0);
+			spans.set(event.lock, span);
+			continue;
+		}
+		if (event.type === "lock.released") {
+			if (open.get(event.id)?.item === true) continue;
+			if (event.end === "span") spans.delete(event.lock);
+			continue;
+		}
 		if (event.type === "worktree") {
 			const known = worktrees.get(event.id);
 			if (event.action === "created" || known === void 0) worktrees.set(event.id, {
@@ -12934,6 +13286,11 @@ const resumeState = (events) => {
 			continue;
 		}
 	}
+	for (const span of spans.values()) for (const [id, kept] of span) {
+		const results = history.get(id)?.slice(0, kept) ?? [];
+		if (results.length === 0) history.delete(id);
+		else history.set(id, results);
+	}
 	for (const [id, current] of open) {
 		closed.add(id);
 		if (current.sessionId !== void 0) unfinished.set(id, current.sessionId);
@@ -13161,6 +13518,63 @@ const inTransaction = (db, work) => {
 		throw error;
 	}
 };
+/**
+* A run's row, with its nodes' counted tokens and whether a session ran on a
+* driver that reports no dollars (RFC-015), from the usage ledger.
+*/
+const RUN_COLUMNS = `runs.*,
+  (SELECT COALESCE(SUM(input_tokens + output_tokens + cache_write_tokens), 0)
+    FROM usage WHERE usage.run_id = runs.id AND kind = 'node') AS tokens,
+  EXISTS (SELECT 1 FROM usage WHERE usage.run_id = runs.id
+    AND driver IN (${UNPRICED_DRIVERS.map((id) => [
+	"'",
+	id,
+	"'"
+].join("")).join(", ") || "NULL"})) AS partial`;
+/** A run row's `tokens` and `partial`, as `RUN_COLUMNS` reads them. */
+const spendOfRow = (row) => {
+	const tokens = Number(row?.["tokens"] ?? 0);
+	return {
+		...tokens > 0 ? { tokens } : {},
+		...Number(row?.["partial"] ?? 0) === 1 ? { partial: true } : {}
+	};
+};
+const STATUSES$1 = [
+	"running",
+	"succeeded",
+	"failed",
+	"budget_exhausted",
+	"quota_exhausted",
+	"timed_out",
+	"interrupted"
+];
+const statusOf$1 = (value) => STATUSES$1.find((s) => s === value) ?? "failed";
+/** A run's record from its row, read with `RUN_COLUMNS`. */
+const recordOf$3 = (row) => {
+	const record = {
+		id: text(row, "id"),
+		workflow: text(row, "workflow"),
+		file: text(row, "file"),
+		project: text(row, "project"),
+		status: statusOf$1(text(row, "status")),
+		pid: Number(row?.["pid"]),
+		startedAt: text(row, "started_at"),
+		costUsd: Number(row?.["cost_usd"]),
+		depth: Number(row?.["depth"] ?? 0),
+		...spendOfRow(row)
+	};
+	const processStart = text(row, "process_start");
+	if (processStart !== "") record.processStart = processStart;
+	const parent = text(row, "parent");
+	if (parent !== "") record.parent = parent;
+	const finished = text(row, "finished_at");
+	if (finished !== "") record.finishedAt = finished;
+	const skipped = row?.["skipped"];
+	if (typeof skipped === "number") record.skipped = skipped;
+	const handled = row?.["failures_handled"];
+	if (typeof handled === "number") record.failuresHandled = handled;
+	return record;
+};
 // ../core/src/store/usage.ts
 /** Folds a run's events into its sessions' rows, oldest first. */
 const usageRowsOf = (run, events) => {
@@ -13289,8 +13703,14 @@ const alive = (row) => {
 /** The ledger's queries; `recordUsage` is the store's own, called on append. */
 const usageQueries = (db) => {
 	const insert = db.prepare(INSERT$1);
-	const spentAll = db.prepare("SELECT COALESCE(SUM(cost_usd), 0) AS spent FROM usage WHERE at >= ?");
-	const spentHere = db.prepare("SELECT COALESCE(SUM(cost_usd), 0) AS spent FROM usage WHERE at >= ? AND project = ?");
+	const spentOf = (column) => ({
+		all: db.prepare(`SELECT COALESCE(SUM(${column}), 0) AS spent FROM usage WHERE at >= ?`),
+		here: db.prepare(`SELECT COALESCE(SUM(${column}), 0) AS spent FROM usage WHERE at >= ? AND project = ?`)
+	});
+	const spent = {
+		usd: spentOf("cost_usd"),
+		tokens: spentOf("input_tokens + output_tokens + cache_write_tokens")
+	};
 	const runById = db.prepare("SELECT id, project, workflow FROM runs WHERE id = ?");
 	const lastEvent = db.prepare("SELECT at FROM events WHERE run_id = ? ORDER BY seq DESC LIMIT 1");
 	const liveOne = db.prepare("SELECT pid, process_start FROM runs WHERE id = ? AND status = 'running'");
@@ -13313,7 +13733,7 @@ const usageQueries = (db) => {
 			});
 			for (const row of rows) writeRow(insert, row);
 		},
-		spentSince: (since, project) => Number((project === void 0 ? spentAll.get(since) : spentHere.get(since, project))?.["spent"] ?? 0),
+		spentSince: (since, project, unit = "usd") => Number((project === void 0 ? spent[unit].all.get(since) : spent[unit].here.get(since, project))?.["spent"] ?? 0),
 		usage: (filter = {}) => {
 			const { sql, values } = whereOf(filter);
 			return db.prepare(`SELECT * FROM usage ${sql} ORDER BY at, run_id, seq`).all(...values).map((r) => rowOf$1(r));
@@ -13369,7 +13789,7 @@ const oneNode = (run, cannot) => run.id.startsWith("node-") ? `Run ${run.id} run
 /** Every node of a run's tree, spawned instances included. */
 const flattenTree = (nodes) => nodes.flatMap((node) => [node, ...flattenTree(node.children)]);
 /** What a run's stored events say about it now. */
-const stateOf = (store, run) => {
+const stateOf$1 = (store, run) => {
 	const events = store.events(run.id).map((stored) => stored.event);
 	return {
 		paused: pausedOf(events),
@@ -13393,14 +13813,14 @@ const stopRefusal = (store, run, node) => {
 	if (refused !== null || node === void 0) return refused;
 	const single = oneNode(run, "stop by name");
 	if (single !== null) return single;
-	const named = stateOf(store, run).nodes.filter((n) => n.id === node || n.template === node);
+	const named = stateOf$1(store, run).nodes.filter((n) => n.id === node || n.template === node);
 	if (named.length === 0) return `${node} is not a node of run ${run.id}.`;
 	return named.some((n) => n.state === "running") ? null : `${node} is not running in run ${run.id}.`;
 };
 const pauseRefusal = (store, run, node) => {
 	const refused = notRunning(run) ?? oneNode(run, "pause or continue");
 	if (refused !== null) return refused;
-	const { paused, nodes } = stateOf(store, run);
+	const { paused, nodes } = stateOf$1(store, run);
 	if (paused.run) return `Run ${run.id} is already paused.`;
 	if (node === void 0) return null;
 	if (!nodes.some((n) => n.id === node)) return `${node} is not a node of run ${run.id}.`;
@@ -13409,7 +13829,7 @@ const pauseRefusal = (store, run, node) => {
 const continueRefusal = (store, run, node) => {
 	const refused = notRunning(run) ?? oneNode(run, "pause or continue");
 	if (refused !== null) return refused;
-	const { paused } = stateOf(store, run);
+	const { paused } = stateOf$1(store, run);
 	if (node === void 0) return paused.run || paused.nodes.length > 0 ? null : `Run ${run.id} is not paused.`;
 	if (paused.nodes.includes(node)) return null;
 	return paused.run ? `Run ${run.id} is paused as a whole; continue the run, not ${node}.` : `${node} is not paused in run ${run.id}.`;
@@ -13800,17 +14220,282 @@ const createCalls = (options) => {
 			done();
 		}
 	};
-	return {
-		invoke: (request, signal) => {
-			if (request.node === void 0) return callOnce(request, signal);
-			const turn = (queues.get(request.callId) ?? Promise.resolve()).catch(() => null).then(() => converse(request, signal));
-			queues.set(request.callId, turn);
-			return turn;
-		},
-		stopAll: () => {
-			for (const id of started) stop(id);
-		}
+	return {
+		invoke: (request, signal) => {
+			if (request.node === void 0) return callOnce(request, signal);
+			const turn = (queues.get(request.callId) ?? Promise.resolve()).catch(() => null).then(() => converse(request, signal));
+			queues.set(request.callId, turn);
+			return turn;
+		},
+		stopAll: () => {
+			for (const id of started) stop(id);
+		}
+	};
+};
+// ../core/src/remote/decide.ts
+/**
+* @file The open decisions of live runs, and answering one from another process
+*   (`ork decide`, the local server), with the person's note if they gave one.
+*   An answer goes to the store (the first one wins), then the run is woken on
+*   its socket so it picks the answer up at once (specs/messaging.md).
+*/
+/** Open decisions whose run is still live, oldest first, ANDing the filter. */
+const pendingDecisions = (store, filter) => {
+	const live = /* @__PURE__ */ new Map();
+	return store.decisions({
+		...filter,
+		status: "open"
+	}).filter((decision) => {
+		if (!live.has(decision.runId)) {
+			const [run] = store.lookup(decision.runId);
+			live.set(decision.runId, run !== void 0 && liveStatus(run) === "running" && (filter.workflow === void 0 || run.workflow === filter.workflow));
+		}
+		return live.get(decision.runId) === true;
+	});
+};
+/**
+* Answers an open decision with one of its options, and wakes its run. `home`
+* is `~`, where the sockets are (tests pass a folder); `by` says who answered;
+* `note` is what they said with it, if anything (blank is nothing).
+*/
+const answerDecision = async (store, id, choice, home, by = "decide", note) => {
+	const decision = store.decision(id);
+	if (decision === void 0) return {
+		ok: false,
+		error: `No decision \`${id}\`.`
+	};
+	if (!decision.options.some((o) => o.id === choice)) return {
+		ok: false,
+		error: `\`${choice}\` is not an option of \`${id}\`: \`${decision.options.map((o) => o.id).join("`, `")}\``
+	};
+	if (!store.answerDecision(id, choice, by, note)) {
+		const now = store.decision(id);
+		return {
+			ok: false,
+			error: now?.status === "answered" ? `${id} was already answered: ${now.answer ?? ""} (${now.answeredBy ?? ""})` : `${id} was withdrawn`
+		};
+	}
+	return {
+		ok: true,
+		woke: await wakeRun(socketPath(decision.runId, home))
+	};
+};
+// ../core/src/remote/follow-tree.ts
+/**
+* Calls `onEvent` for each event of `root` and of the runs it called, once
+* each. A called run's stored events come right after the `call.started` that
+* started it; live events as they arrive. Ends when the root ends or `signal`
+* aborts.
+*/
+const followRunTree = async (store, root, onEvent, options = {}) => {
+	/** Every run followed, with its call path, in the order found. */
+	const paths = /* @__PURE__ */ new Map([[root, []]]);
+	/** Each run's last event seen, for the catch-up once the root ends. */
+	const seqs = /* @__PURE__ */ new Map();
+	const followers = [];
+	/** Ends the called runs' following once the root's has ended. */
+	const halt = new AbortController();
+	const signal = options.signal === void 0 ? halt.signal : AbortSignal.any([options.signal, halt.signal]);
+	const handle = (run, path) => (stored) => {
+		seqs.set(run, stored.seq);
+		onEvent({
+			run,
+			path,
+			stored
+		});
+		const { event } = stored;
+		if (event.type === "call.started" && !paths.has(event.run)) follow(event.run, [...path, event.node]);
+	};
+	const follow = (run, path) => {
+		paths.set(run, path);
+		followers.push(followEvents(store, run, handle(run, path), {
+			...options,
+			follow: true,
+			after: seqs.get(run) ?? 0,
+			signal
+		}));
+	};
+	/** Waits for every follower, including those started while waiting. */
+	const settle = async () => {
+		while (followers.length > 0) await Promise.all(followers.splice(0));
+	};
+	const end = await followEvents(store, root, handle(root, []), {
+		...options,
+		follow: true
+	});
+	halt.abort();
+	await settle();
+	if (end !== "aborted") {
+		for (const [run, path] of [...paths].slice(1)) followers.push(followEvents(store, run, handle(run, path), {
+			follow: false,
+			after: seqs.get(run) ?? 0
+		}));
+		await settle();
+	}
+	return {
+		end,
+		stillRunning: [...paths.keys()].slice(1).filter((id) => {
+			const [run] = store.lookup(id);
+			return run !== void 0 && liveStatus(run) === "running";
+		})
+	};
+};
+// ../core/src/remote/relay.ts
+/**
+* @file A run's side of the relay (RFC-003): its nodes' links, read from the
+*   store, and sending to a node of another run. A message is a row in the
+*   store and a wake on that run's socket, so no process has to stay up for it,
+*   and the store has it if the socket is gone. Reaching a link's limit asks
+*   the user whether to go on, as a loop out of rounds does.
+*/
+/** For a refused or abandoned question: a stopped run has nothing to do. */
+const ignore = () => {};
+const createRelay = (options) => {
+	const { store, runId, home, human } = options;
+	/** Links with the question about their limit open. */
+	const asking = /* @__PURE__ */ new Set();
+	const askToGoOn = async (link, node) => {
+		if (asking.has(link.id)) return;
+		asking.add(link.id);
+		try {
+			if (await human.ask({
+				nodeId: node,
+				question: `${addressOf(link.a)} and ${addressOf(link.b)} have used all ${String(link.maxMessages)} messages of their link. Let them go on?`,
+				options: [{
+					id: "extend",
+					description: `${String(link.maxMessages)} more`
+				}, {
+					id: "end",
+					description: "End the link"
+				}],
+				recommended: "end"
+			}) === "extend") {
+				store.extendLink(link.id, link.maxMessages);
+				await Promise.all([link.a, link.b].map((end) => tellNode(store, end, "[ork] The user let this link go on; you can send again.", home)));
+			} else await endLink(store, link, "the user ended it", home);
+		} finally {
+			asking.delete(link.id);
+		}
+	};
+	/** Why `peer`'s run cannot take a message now, or null. */
+	const closed = (peer) => {
+		const [run] = store.lookup(peer.run);
+		if (run === void 0) return `run ${peer.run} is gone`;
+		const status = liveStatus(run);
+		return status === "running" ? null : `its run has finished (${status}). A finished run's session is not resumed by another agent; the user can resume it with \`ork chat\``;
+	};
+	const isRunning = (peer) => {
+		const events = store.events(peer.run).map((stored) => stored.event);
+		return flattenTree(runTree(events)).some((n) => n.id === peer.node && n.state === "running");
+	};
+	return {
+		peers: (node) => store.links({
+			run: runId,
+			live: true
+		}).flatMap((link) => {
+			const peer = peerOf(link, runId, node);
+			return peer === void 0 ? [] : [addressOf(peer)];
+		}),
+		send: (node, to, body) => {
+			const link = store.links({
+				run: runId,
+				live: true
+			}).find((candidate) => {
+				const peer = peerOf(candidate, runId, node);
+				return peer !== void 0 && addressOf(peer) === to;
+			});
+			const peer = link && peerOf(link, runId, node);
+			if (link === void 0 || peer === void 0) return {
+				ok: false,
+				error: `you have no live link to ${to}`
+			};
+			const why = closed(peer);
+			if (why !== null) {
+				endLink(store, link, why, home);
+				return {
+					ok: false,
+					error: `${to} cannot take it: ${why}`
+				};
+			}
+			if (link.messages >= link.maxMessages) {
+				askToGoOn(link, node).catch(ignore);
+				return {
+					ok: false,
+					error: `this link has used all ${String(link.maxMessages)} of its messages, and the user has been asked whether to go on`
+				};
+			}
+			store.countMessage(link.id);
+			store.command(peer.run, {
+				kind: "relay",
+				node: peer.node,
+				from: `${runId}/${node}`,
+				body
+			});
+			wakeRun(socketPath(peer.run, home));
+			return {
+				ok: true,
+				delivered: isRunning(peer) ? "now" : "queued"
+			};
+		}
+	};
+};
+// ../core/src/remote/send.ts
+/**
+* @file `ork send` (RFC-005): a program in a tool node writes to a session on
+*   its run's bus. The check is on the sender's side, as a refusal must be an
+*   exit code a script can act on; then a row in the store and a wake, as for a
+*   message between linked runs. `ORK_RUN` and `ORK_NODE` say who it is, and
+*   they are attribution, not proof: the check stops mistakes, not a program
+*   running as the same user.
+*/
+/** A first value, as for links; real use will show whether it is the right one. */
+const DEFAULT_SCRIPT_MESSAGES = 100;
+/**
+* Why this sender may not write to this node; `null` when it may. The body is
+* not needed, so a program is told before it pipes a whole message in.
+*/
+const scriptRefusal = (store, send) => {
+	const { run: runId, node, to } = send;
+	if (runId === void 0 || node === void 0) return "`ork send` runs inside a tool node of a run: `ORK_RUN` and `ORK_NODE` are not set.";
+	if (runId.startsWith("node-")) return `Run ${runId} runs one node, which has no message bus; run the whole workflow.`;
+	const run = store.lookup(runId).find((found) => found.id === runId);
+	if (run === void 0) return `There is no run ${runId}.`;
+	const status = liveStatus(run);
+	if (status !== "running") return `Run ${runId} is not running (${status}).`;
+	const started = store.events(runId).map((stored) => stored.event).findLast((event) => event.type === "run.started");
+	if (started === void 0) return `Run ${runId} has not started yet.`;
+	const own = started.nodes.find((found) => found.id === node);
+	if (own === void 0 || !own.type.startsWith("tool.")) return `${node} is not a tool node of run ${runId}.`;
+	const contacts = scriptContactsOf(node, started.nodes, started.channels ?? []);
+	if (contacts.includes(to)) return null;
+	return contacts.length === 0 ? `\`${node}\` has no one to write to: give it an owner, or a channel under \`messages:\`.` : `\`${to}\` is not a contact of \`${node}\`, which can write to \`${contacts.join("`, `")}\` (its owner and its channels).`;
+};
+/** Reading all of it would cost as much as sending it. */
+const TOO_LONG = "The message is over 64 KiB. Write it to a file and send the file's path.";
+/** Checks the message, writes it for the run, and wakes it. */
+const sendFromScript = async (store, send, home) => {
+	const refused = scriptRefusal(store, send);
+	if (refused !== null) return {
+		ok: false,
+		error: refused
 	};
+	if (Buffer.byteLength(send.body) > 65536) return {
+		ok: false,
+		error: TOO_LONG
+	};
+	const run = String(send.run);
+	const node = String(send.node);
+	if (!store.scriptCommand(run, {
+		kind: "script",
+		node: send.to,
+		from: node,
+		body: send.body
+	}, DEFAULT_SCRIPT_MESSAGES)) return {
+		ok: false,
+		error: `\`${node}\` has sent ${String(DEFAULT_SCRIPT_MESSAGES)} messages in this run, which is the most it may.`
+	};
+	await wakeRun(socketPath(run, home));
+	return { ok: true };
 };
 // ../core/src/run/driver-queues.ts
 const isSession = (node) => node.type === "agent.leader" || node.type === "agent.worker";
@@ -13878,7 +14563,7 @@ const checkoutContention = (workflow, include) => {
 	}
 	return found;
 };
-const messageOf$1 = (driver, found) => {
+const messageOf$2 = (driver, found) => {
 	const names = found.nodes.map((n) => `\`${n}\``).join(", ");
 	const where = found.checkout === void 0 ? "the project checkout" : `the worktree of \`${found.checkout}\``;
 	return found.owner === void 0 ? `driver \`${driver}\` runs one session per checkout, but ${names} work in ${where} and could run at once: one session waits for the other. Give them separate worktrees (\`isolation: worktree\`), or run them on another driver.` : `node \`${found.owner}\` runs on driver \`${driver}\`, which runs one session per checkout, but ${names} work in ${where} and one owns another: the owner's session holds the checkout while the nodes it owns wait for it, so the run would never finish. Give each owned node its own worktree (\`isolation: worktree\`), or run them on another driver.`;
@@ -13893,16 +14578,17 @@ const driverQueues = (workflow, drivers, choice) => drivers.filter((driver) => d
 	return node !== void 0 && nodeDriver(node, workflow, choice) === driver.id;
 }).map((found) => Object.assign({}, found, {
 	driver: driver.id,
-	message: messageOf$1(driver.id, found)
+	message: messageOf$2(driver.id, found)
 })));
 // ../core/src/run/driver-needs.ts
 const SESSION_TYPES = /* @__PURE__ */ new Set(["agent.leader", "agent.worker"]);
-/** The node's turn limit and dollar budget, its own or the workflow's default. */
+/** The node's turn limit and budgets, its own or the workflow's default. */
 const limitsOf = (node, workflow) => {
 	const own = isClaudeNode(node) ? node : void 0;
 	return {
 		maxTurns: own?.maxTurns ?? workflow.defaults?.maxTurns,
-		budgetUsd: own?.budgetUsd ?? workflow.defaults?.budgetUsd
+		budgetUsd: own?.budgetUsd ?? workflow.defaults?.budgetUsd,
+		budgetTokens: own?.budgetTokens ?? workflow.defaults?.budgetTokens
 	};
 };
 /**
@@ -13932,7 +14618,7 @@ const subagentRefusals = (id, workflow, driver) => Object.entries(workflow.nodes
 * rendered names the driver.
 */
 const sessionRefusals = (id, node, workflow, driver) => {
-	const { maxTurns, budgetUsd } = limitsOf(node, workflow);
+	const { maxTurns } = limitsOf(node, workflow);
 	const refuse = (message) => ({
 		node: id,
 		message: `node \`${id}\` ${message}`
@@ -13940,14 +14626,37 @@ const sessionRefusals = (id, node, workflow, driver) => {
 	const refusals = [];
 	if (!driver.proven) refusals.push(refuse(`runs on driver \`${driver.id}\`, which is not yet proven on a real session`));
 	if (maxTurns !== void 0 && !driver.capabilities.turnLimit) refusals.push(refuse(`sets maxTurns, but driver \`${driver.id}\` has no turn limit`));
-	if (budgetUsd !== void 0 && !driver.capabilities.price) refusals.push(refuse(`sets budgetUsd, but driver \`${driver.id}\` does not report cost in dollars (a token budget comes with RFC-015)`));
-	else if (workflow.limits?.budgetUsd !== void 0 && !driver.capabilities.price) refusals.push(refuse(`runs under the workflow's limits.budgetUsd, but driver \`${driver.id}\` does not report cost in dollars, so the budget can't be kept (a token budget comes with RFC-015)`));
 	if ((("mcp" in node ? node.mcp : void 0) ?? workflow.defaults?.mcp ?? []).length > 0 && !driver.capabilities.mcpServers) refusals.push(refuse(`names MCP servers (\`mcp\`), but driver \`${driver.id}\` does not load a node's own MCP servers`));
 	const ask = askOfTools(id, node, workflow);
 	if (ask !== void 0 && !driver.capabilities.questions) refusals.push(refuse(`${ask}, but driver \`${driver.id}\` does not reach Ork's tools (ask_user, delegate, messages)`));
 	return [...refusals, ...subagentRefusals(id, workflow, driver)];
 };
 /**
+* What a dollar budget can't see on `driver`, which reports no dollars
+* (RFC-015): the node's own `budgetUsd` with no `budgetTokens` beside it, or
+* the run's `limits.budgetUsd`, which this node's sessions spend unseen.
+*/
+const sessionBudgetWarnings = (id, node, workflow, driver) => {
+	if (driver.capabilities.price) return [];
+	const { budgetUsd, budgetTokens } = limitsOf(node, workflow);
+	const warn = (message) => ({
+		node: id,
+		message: `node \`${id}\` ${message}`
+	});
+	return [...budgetUsd !== void 0 && budgetTokens === void 0 ? [warn(`sets only budgetUsd, but driver \`${driver.id}\` reports no dollars: only budgetTokens applies on ${driver.id}`)] : [], ...workflow.limits?.budgetUsd === void 0 ? [] : [warn(`runs under the workflow's limits.budgetUsd, but driver \`${driver.id}\` reports no dollars, so that limit can't see its sessions`)]];
+};
+/**
+* The warnings `sessionBudgetWarnings` gives each session node (or only
+* `only`), on the driver it takes as for `driverRefusals`. Never a refusal.
+*/
+const budgetWarnings = (workflow, drivers, choice) => Object.entries(workflow.nodes).flatMap(([id, node]) => {
+	if (!SESSION_TYPES.has(node.type)) return [];
+	if (choice.only !== void 0 && choice.only !== id) return [];
+	const driverId = nodeDriver(node, workflow, choice);
+	const driver = drivers.find((d) => d.id === driverId);
+	return driver === void 0 ? [] : sessionBudgetWarnings(id, node, workflow, driver);
+});
+/**
 * What stops each session node (or only `only`) from running on its driver: its
 * model's prefix, else `override` (`--driver`), else what the workflow names,
 * else `ready`. A node with no driver to check is left out; the run refuses
@@ -14023,6 +14732,89 @@ const parseInputPairs = (pairs) => {
 		raw
 	};
 };
+// ../core/src/run/replay.ts
+const NO_FAN_OUTS = {
+	lists: /* @__PURE__ */ new Map(),
+	items: /* @__PURE__ */ new Map()
+};
+/** Whether an activation's input carries a result this run made anew. */
+const carries = (fresh, input) => {
+	if (input === void 0) return false;
+	if (fresh.has(input)) return true;
+	const results = input["results"];
+	if (results === null || typeof results !== "object") return false;
+	return Object.values(results).some((value) => value !== null && typeof value === "object" && fresh.has(value));
+};
+/**
+* Hands each node's recorded results back in order, until the node runs anew
+* once (it failed or never finished last time, or its input is new); from then
+* on it always runs. A node cut off mid-session continues that session, once.
+*/
+const createReplay = (history, cutOff = /* @__PURE__ */ new Map(), mail, earlier, fanOuts = NO_FAN_OUTS) => {
+	const sessions = new Map(cutOff);
+	const used = /* @__PURE__ */ new Map();
+	const anew = /* @__PURE__ */ new Set();
+	const fresh = /* @__PURE__ */ new WeakSet();
+	/** Fanned nodes whose list was resolved anew: their items can't be replayed. */
+	const renewed = /* @__PURE__ */ new Set();
+	const takeItem = (activation, of) => {
+		const recorded = fanOuts.items.get(activation.id)?.get(activation.round ?? 0);
+		if (recorded !== void 0 && !renewed.has(of) && !carries(fresh, activation.input)) return recorded;
+		anew.add(activation.id);
+		return null;
+	};
+	return {
+		take: (activation) => {
+			const { id } = activation;
+			if (activation.brief !== void 0 || anew.has(id)) return null;
+			if (activation.item !== void 0) return takeItem(activation, activation.item.of);
+			const index = used.get(id) ?? 0;
+			const recorded = history.get(id)?.[index];
+			if (recorded === void 0 || carries(fresh, activation.input)) {
+				anew.add(id);
+				return null;
+			}
+			used.set(id, index + 1);
+			return recorded;
+		},
+		ran: (result) => {
+			fresh.add(result.output);
+		},
+		cutOff: (activation) => {
+			const session = activation.brief === void 0 && (activation.item === void 0 || !renewed.has(activation.item.of)) ? sessions.get(activation.id) : void 0;
+			sessions.delete(activation.id);
+			return session;
+		},
+		listed: (id, round, source) => {
+			const list = fanOuts.lists.get(listKey(id, round));
+			const ranAnew = typeof source === "object" && source !== null && fresh.has(source);
+			if (list !== void 0 && !ranAnew) return list;
+			renewed.add(id);
+			return null;
+		},
+		previousSession: ({ id, item, round = 0 }) => item === void 0 || renewed.has(item.of) ? void 0 : [...fanOuts.items.get(id) ?? []].findLast(([before]) => before < round)?.[1].sessionId,
+		lastOutput: (id) => history.get(id)?.at(-1)?.output,
+		kept: () => [...history.keys(), ...fanOuts.items.keys()],
+		...mail === void 0 ? {} : { mail },
+		...earlier === void 0 ? {} : { earlier }
+	};
+};
+/**
+* The run's `HumanChannel`, answering questions about loops out of rounds as
+* they were answered last time, in order; anything else goes to `human`.
+*/
+const replayLoopAnswers = (human, answers) => {
+	const left = [...answers];
+	return {
+		permit: (request) => human.permit(request),
+		...human.settled === void 0 ? {} : { settled: human.settled },
+		ask: (question) => {
+			const index = left.findIndex((a) => a.question === question.question);
+			const [given] = index === -1 ? [] : left.splice(index, 1);
+			return given === void 0 ? human.ask(question) : Promise.resolve(given.answer);
+		}
+	};
+};
 // ../core/src/store/drafts.ts
 const rowOf = (row) => {
 	const baseHash = text(row, "base_hash");
@@ -14053,15 +14845,6 @@ const draftQueries = (db) => {
 		}
 	};
 };
-// ../core/src/worktree/manager.ts
-/**
-* @file Ork's git worktrees: one per `worktree` node, beside the clone, by
-*   default in `../<clone>-worktrees/ork-<run>-<node>` on branch
-*   `ork/<run>/<node>` (ADR-020; a project's git rules rename them, ADR-032).
-*   Ork only creates, commits, merges and removes what its runs created; it
-*   never pushes.
-*/
-const BRANCH_PREFIX = "ork/";
 /** Gitignored files a session needs as much in a worktree as in the clone. */
 const LOCAL_AGENT_FILES = ["CLAUDE.local.md", ".claude/settings.local.json"];
 /** Where the project's instructions, skills and agents live. */
@@ -14205,11 +14988,27 @@ const createWorktree = async (options) => {
 };
 /** Copies files that exist in `from` and are missing in the worktree. */
 const carryFiles = (from, worktree, files) => copyInto(from, worktree, files.filter((f) => !path.isAbsolute(f) && !f.split(/[\\/]/u).includes("..")));
+/** What git keeps in a worktree's git dir while a rebase, merge or pick runs. */
+const UNDERWAY = [
+	"rebase-merge",
+	"rebase-apply",
+	"MERGE_HEAD",
+	"CHERRY_PICK_HEAD",
+	"REVERT_HEAD"
+];
+/** Whether a rebase, merge, cherry-pick or revert is underway in `worktree`. */
+const gitOperationUnderway = async (worktree) => {
+	const paths = await gitOk(worktree, ["rev-parse", ...UNDERWAY.flatMap((name) => ["--git-path", name])]);
+	return lines(paths).some((file) => existsSync(path.resolve(worktree, file)));
+};
 /**
 * Commits what a session left uncommitted. The repo's hooks run; when they
-* refuse, the error says why and the worktree keeps the changes.
+* refuse, the error says why and the worktree keeps the changes. A worktree
+* mid-rebase (or merge, cherry-pick, revert) is left exactly as it is: its
+* changes are the operation's to finish, as a conflict resolver's are.
 */
 const commitLeftovers = async (worktree, message) => {
+	if (await gitOperationUnderway(worktree)) return false;
 	const status = await gitOk(worktree, ["status", "--porcelain"]);
 	if (lines(status).length === 0) return false;
 	await gitOk(worktree, ["add", "-A"]);
@@ -14264,6 +15063,245 @@ const removeWorktree = async (root, worktree, force = false) => {
 		worktree
 	]);
 };
+// ../core/src/worktree/list.ts
+/**
+* @file What `ork worktrees` shows: every worktree and branch Ork's runs
+*   recorded creating, whatever the project's git rules named them, and any
+*   `ork/*` branch besides, with their state read from git itself. What clean
+*   and remove do with them is clean.ts.
+*/
+/**
+* The worktrees the project's runs recorded creating, oldest run first; one
+* entry per branch or folder, from the latest run that created it.
+*/
+const createdWorktrees = (store, project) => {
+	const byName = /* @__PURE__ */ new Map();
+	for (const run of store.runs({ project }).toReversed()) for (const { event } of store.events(run.id)) {
+		if (event.type !== "worktree" || event.action !== "created") continue;
+		byName.set(event.branch ?? event.path, {
+			runId: run.id,
+			nodeId: event.id,
+			path: event.path,
+			...event.branch === void 0 ? {} : { branch: event.branch }
+		});
+	}
+	return [...byName.values()];
+};
+const parsePorcelain = (text) => text.split("\n\n").map((block) => lines(block)).map((fields) => {
+	const value = (key) => fields.find((f) => f.startsWith(`${key} `))?.slice(key.length + 1);
+	return {
+		path: value("worktree") ?? "",
+		branch: (value("branch") ?? "").replace(/^refs\/heads\//u, ""),
+		prunable: fields.some((f) => f.startsWith("prunable"))
+	};
+}).filter((entry) => entry.path !== "");
+/**
+* The `ork/<run>/<node>` branches of runs that recorded nothing; with no path
+* recorded, the worktree is whichever has the branch checked out.
+*/
+const prefixed = (branch) => {
+	const [, runId = "", ...rest] = branch.split("/");
+	return {
+		runId,
+		nodeId: rest.join("/"),
+		path: "",
+		branch
+	};
+};
+/** How many commits a detached worktree holds that no branch, tag or remote has. */
+const onNoBranch = async (entry) => entry === void 0 ? "0" : (await git(entry.path, [
+	"rev-list",
+	"--count",
+	"HEAD",
+	"--not",
+	"--branches",
+	"--tags",
+	"--remotes"
+])).stdout;
+/** One created worktree or branch, with its state read from git. */
+const stateOf = async (root, entries, item, recorded) => {
+	const { branch } = item;
+	const entry = branch === void 0 || item.path !== "" ? entries.find((e) => e.path === item.path) : entries.find((e) => e.branch === branch);
+	const holder = branch === void 0 ? void 0 : entries.find((e) => e.branch === branch && e.path !== entry?.path);
+	const missing = entry !== void 0 && (entry.prunable || !existsSync(entry.path));
+	const status = entry === void 0 || missing ? "" : (await git(entry.path, ["status", "--porcelain"])).stdout;
+	const checkedOut = branch === void 0 && entry !== void 0 && entry.branch !== "" ? entry.branch : void 0;
+	const on = branch ?? checkedOut;
+	const counted = on === void 0 ? await onNoBranch(entry === void 0 || missing ? void 0 : entry) : (await git(root, [
+		"rev-list",
+		"--count",
+		`HEAD..${on}`
+	])).stdout;
+	const ahead = Number(counted);
+	const changes = lines(status).length;
+	return {
+		...branch === void 0 ? {} : { branch },
+		...checkedOut === void 0 ? {} : { checkedOut },
+		runId: item.runId,
+		nodeId: item.nodeId,
+		recorded,
+		path: entry?.path ?? null,
+		missing,
+		dirty: changes > 0,
+		changes,
+		ahead: Number.isNaN(ahead) ? 0 : ahead,
+		merged: on !== void 0 && ahead === 0,
+		inMainCheckout: entry?.path === root || holder?.path === root,
+		...holder === void 0 || holder.path === root ? {} : { heldBy: holder.path }
+	};
+};
+/**
+* Every worktree and branch Ork's runs created in the repository at `root`,
+* with its state: those the runs recorded (`created`, whatever the project's
+* git rules named them), and any `ork/` branch besides. A recorded one that git
+* no longer has is left out.
+*/
+const listOrkWorktrees = async (root, created = []) => {
+	const entries = parsePorcelain(await gitOk(root, [
+		"worktree",
+		"list",
+		"--porcelain"
+	]));
+	const branches = lines(await gitOk(root, [
+		"for-each-ref",
+		"--format=%(refname:short)",
+		"refs/heads/"
+	]));
+	const recordedBranches = new Set(created.flatMap((c) => c.branch ?? []));
+	const items = [...created.filter((c) => c.branch === void 0 ? entries.some((e) => e.path === c.path) : branches.includes(c.branch)).map((item) => ({
+		item,
+		recorded: true
+	})), ...branches.filter((b) => b.startsWith("ork/") && !recordedBranches.has(b)).map((b) => ({
+		item: prefixed(b),
+		recorded: false
+	}))];
+	return Promise.all(items.map(({ item, recorded }) => stateOf(root, entries, item, recorded)));
+};
+// ../core/src/store/prune.ts
+/**
+* @file `ork prune` (ADR-046): which runs may lose their transcript, and doing
+*   it. A run goes with the runs it called or was called by, or not at all, and
+*   not while it is live, is linked, or has a worktree or branch left: those
+*   read the run's events. The usage ledger and feedback records stay.
+*/
+const messageOf$1 = (error) => error instanceof Error ? error.message : String(error);
+/**
+* The runs in a project that still have a worktree or branch. With its folder
+* gone, or no longer a repository, there is nothing left to clean up; any other
+* failure says nothing about them, so it rejects.
+*/
+const runsWithWorktrees = (store) => async (root) => {
+	if (!existsSync(root)) return /* @__PURE__ */ new Set();
+	try {
+		const found = await listOrkWorktrees(root, createdWorktrees(store, root));
+		return new Set(found.map((w) => w.runId));
+	} catch (error) {
+		if (/not a git repository/iu.test(messageOf$1(error))) return /* @__PURE__ */ new Set();
+		throw error;
+	}
+};
+/** The run at the top of a run's chain of calls. */
+const callRootOf = (run, byId) => {
+	let top = run;
+	const seen = /* @__PURE__ */ new Set([run.id]);
+	while (top.parent !== void 0) {
+		const parent = byId.get(top.parent);
+		if (parent === void 0 || seen.has(parent.id)) break;
+		seen.add(parent.id);
+		top = parent;
+	}
+	return top.id;
+};
+/** Sorts the runs before the cutoff into those to remove and those to keep. */
+const planPrune = async (store, filter, worktreesOf = runsWithWorktrees(store)) => {
+	const all = store.runs();
+	const byId = new Map(all.map((run) => [run.id, run]));
+	const inScope = (run) => filter.project === void 0 || run.project === filter.project;
+	const old = (run) => (store.lastEventAt(run.id) ?? run.finishedAt ?? run.startedAt) < filter.before;
+	const trees = /* @__PURE__ */ new Map();
+	for (const run of all) {
+		const root = callRootOf(run, byId);
+		trees.set(root, [...trees.get(root) ?? [], run]);
+	}
+	const projects = [...new Set(all.filter((r) => old(r) && inScope(r)).map((r) => r.project))];
+	const withWorktrees = new Map(await Promise.all(projects.map(async (project) => {
+		try {
+			return [project, await worktreesOf(project)];
+		} catch (error) {
+			return [project, messageOf$1(error)];
+		}
+	})));
+	/** Why this run itself cannot go, or `null` when it can. */
+	const blocker = (run) => {
+		if (liveStatus(run) === "running") return "it is still running";
+		const worktrees = withWorktrees.get(run.project);
+		if (typeof worktrees === "string") return `cannot tell whether it has a worktree left: ${worktrees}`;
+		if (worktrees?.has(run.id) === true) return "it has a worktree or branch left (ork worktrees clean)";
+		if (store.links({
+			run: run.id,
+			live: true
+		}).length > 0) return "it has a live link";
+		return null;
+	};
+	const plan = {
+		remove: [],
+		keep: []
+	};
+	for (const tree of trees.values()) {
+		const held = tree.map((run) => {
+			if (!inScope(run)) return `run ${run.id} of its call is in another project (--all)`;
+			if (!old(run)) return `run ${run.id} of its call is newer`;
+			const why = blocker(run);
+			return why === null ? null : `run ${run.id} of its call stays: ${why}`;
+		}).find((why) => why !== null);
+		for (const run of tree) {
+			if (!inScope(run) || !old(run)) continue;
+			if (held === void 0) plan.remove.push(run);
+			else plan.keep.push({
+				run,
+				reason: blocker(run) ?? held
+			});
+		}
+	}
+	return plan;
+};
+const SAFE_ID = /^[\w-]+$/u;
+/** Forgets the plan's runs and removes their folders. */
+const applyPrune = (store, plan) => {
+	const outcome = {
+		removed: 0,
+		folders: 0,
+		failed: []
+	};
+	const places = store.projects();
+	for (const run of plan.remove) {
+		if (!store.deleteRun(run.id)) {
+			outcome.failed.push({
+				run: run.id,
+				reason: "it is running again"
+			});
+			continue;
+		}
+		outcome.removed += 1;
+		if (!SAFE_ID.test(run.id)) continue;
+		const place = places.find((p) => p.root === run.project) ?? placeFor(run.project, places);
+		const folder = runDirOf(place, run.id);
+		if (!existsSync(folder)) continue;
+		try {
+			rmSync(folder, {
+				recursive: true,
+				force: true
+			});
+			outcome.folders += 1;
+		} catch (error) {
+			outcome.failed.push({
+				run: run.id,
+				reason: `its folder stays, at ${folder}: ${messageOf$1(error)}`
+			});
+		}
+	}
+	return outcome;
+};
 // ../core/src/store/decisions.ts
 const choicesOf = (json) => {
 	const parsed = JSON.parse(json);
@@ -14284,7 +15322,7 @@ const noteOf = (note) => {
 	return trimmed === "" ? null : maskSecrets(trimmed);
 };
 const kindOf = (value) => value === "permission" ? "permission" : "question";
-const statusOf$1 = (value) => value === "answered" || value === "withdrawn" ? value : "open";
+const statusOf = (value) => value === "answered" || value === "withdrawn" ? value : "open";
 const decisionOf = (row) => {
 	const record = {
 		id: text(row, "id"),
@@ -14294,7 +15332,7 @@ const decisionOf = (row) => {
 		question: text(row, "question"),
 		options: choicesOf(text(row, "options") || "[]"),
 		openedAt: text(row, "opened_at"),
-		status: statusOf$1(text(row, "status"))
+		status: statusOf(text(row, "status"))
 	};
 	const optional = {
 		recommended: text(row, "recommended"),
@@ -14391,7 +15429,7 @@ const decisionQueries = (db) => {
 	};
 };
 // ../core/src/store/feedback.ts
-const STATUSES$1 = [
+const STATUSES = [
 	"new",
 	"triaged",
 	"accepted",
@@ -14419,7 +15457,7 @@ const ORIGIN_COLUMNS = [
 	["driver", "driver"],
 	["version", "version"]
 ];
-const recordOf$3 = (row) => {
+const recordOf$2 = (row) => {
 	const origin = {};
 	for (const [key, column] of ORIGIN_COLUMNS) {
 		const value = key === "driver" ? currentDriver(text(row, column)) : text(row, column);
@@ -14455,7 +15493,7 @@ const itemOf = (row) => {
 	return {
 		id,
 		merged: strings(row, "fingerprints").filter((f) => f !== id),
-		status: oneOf(STATUSES$1, text(row, "status"), "new"),
+		status: oneOf(STATUSES, text(row, "status"), "new"),
 		title: text(row, "title"),
 		target: oneOf(FEEDBACK_TARGETS, text(row, "target"), "workflow"),
 		kind: oneOf(FEEDBACK_KINDS, text(row, "kind"), "idea"),
@@ -14520,7 +15558,7 @@ const feedbackQueries = (db) => {
 		insertFeedback: insertRecord,
 		feedbackItems: (filter = {}) => (filter.all === true ? every : shown).all().map((r) => itemOf(r)),
 		findFeedback: (prefix) => byPrefix.all(prefix.length, prefix).map((r) => itemOf(r)),
-		feedbackRecords: (fingerprint) => records.all(fingerprint, fingerprint).map((r) => recordOf$3(r)),
+		feedbackRecords: (fingerprint) => records.all(fingerprint, fingerprint).map((r) => recordOf$2(r)),
 		setFeedbackStatus: (fingerprint, status) => Number(setStatus.run(status, (/* @__PURE__ */ new Date()).toISOString(), fingerprint).changes) > 0,
 		mergeFeedback: (into, from) => {
 			const root = text(rootOf.get(into), "root");
@@ -14529,7 +15567,7 @@ const feedbackQueries = (db) => {
 			return inTransaction(db, () => from.filter((fingerprint) => fingerprint !== root).reduce((moved, fingerprint) => moved + Number(mergeInto.run(root, at, fingerprint, fingerprint, root).changes), 0));
 		},
 		splitFeedback: (fingerprint) => Number(split.run((/* @__PURE__ */ new Date()).toISOString(), fingerprint).changes),
-		exportFeedback: (filter = {}) => exported.all(filter.all === true ? 1 : 0).map((r) => recordOf$3(r)),
+		exportFeedback: (filter = {}) => exported.all(filter.all === true ? 1 : 0).map((r) => recordOf$2(r)),
 		importFeedback: (record) => {
 			if (known.get(record.runId, record.seq) !== void 0) return false;
 			insertRecord(record.runId, record.seq, record.at, record.node, record.feedback);
@@ -14618,7 +15656,7 @@ const planLimitQueries = (db) => {
 *   `~/.ork/projects/<id>/` when attached), and moving it from one to the other
 *   (`ork migrate`) with its runs' workflow files.
 */
-const recordOf$2 = (row) => ({
+const recordOf$1 = (row) => ({
 	id: text(row, "id"),
 	root: text(row, "root"),
 	mode: PROJECT_MODES.find((m) => m === text(row, "mode")) ?? "in-repo",
@@ -14639,7 +15677,7 @@ const projectQueries = (db) => {
 	const refile = db.prepare(`UPDATE runs SET file = ? || substr(file, ?)
      WHERE project = ? AND substr(file, 1, ?) = ?`);
 	return {
-		projects: () => all.all().map((r) => recordOf$2(r)),
+		projects: () => all.all().map((r) => recordOf$1(r)),
 		addProject: (project) => {
 			const record = {
 				...project,
@@ -14655,7 +15693,7 @@ const projectQueries = (db) => {
 			return Number(remove.run(id).changes) > 0;
 		},
 		moveProject: (id, place) => {
-			const before = all.all().map((r) => recordOf$2(r)).find((p) => p.id === id);
+			const before = all.all().map((r) => recordOf$1(r)).find((p) => p.id === id);
 			if (before === void 0) return false;
 			const from = `${before.dir}${path.sep}`;
 			const root = place.root ?? before.root;
@@ -14751,7 +15789,7 @@ const toolCpuQueries = (db) => ({
 	}
 });
 // ../core/src/store/triggers.ts
-const recordOf$1 = (row) => {
+const recordOf = (row) => {
 	const acceptedHash = text(row, "accepted_hash");
 	const lookedAt = text(row, "looked_at");
 	const error = text(row, "error");
@@ -14793,7 +15831,7 @@ const triggerQueries = (db) => {
      ON CONFLICT (id) DO UPDATE SET pid = excluded.pid, at = excluded.at`);
 	const letGo = db.prepare("DELETE FROM watch_lock WHERE pid = ?");
 	return {
-		triggerRecords: (project) => (project === void 0 ? all.all() : ofProject.all(project)).map((row) => recordOf$1(row)),
+		triggerRecords: (project) => (project === void 0 ? all.all() : ofProject.all(project)).map((row) => recordOf(row)),
 		acceptTrigger: (project, trigger, hash) => {
 			accept.run(project, trigger, hash);
 		},
@@ -15091,40 +16129,6 @@ const migrate = (db, migrations = MIGRATIONS) => {
 */
 /** `~/.ork/state.db`; `home` is `~` (tests pass a folder). */
 const storePath = (home = homedir()) => path.join(home, ".ork", "state.db");
-const STATUSES = [
-	"running",
-	"succeeded",
-	"failed",
-	"budget_exhausted",
-	"quota_exhausted",
-	"timed_out",
-	"interrupted"
-];
-const statusOf = (value) => STATUSES.find((s) => s === value) ?? "failed";
-const recordOf = (row) => {
-	const record = {
-		id: text(row, "id"),
-		workflow: text(row, "workflow"),
-		file: text(row, "file"),
-		project: text(row, "project"),
-		status: statusOf(text(row, "status")),
-		pid: Number(row?.["pid"]),
-		startedAt: text(row, "started_at"),
-		costUsd: Number(row?.["cost_usd"]),
-		depth: Number(row?.["depth"] ?? 0)
-	};
-	const processStart = text(row, "process_start");
-	if (processStart !== "") record.processStart = processStart;
-	const parent = text(row, "parent");
-	if (parent !== "") record.parent = parent;
-	const finished = text(row, "finished_at");
-	if (finished !== "") record.finishedAt = finished;
-	const skipped = row?.["skipped"];
-	if (typeof skipped === "number") record.skipped = skipped;
-	const handled = row?.["failures_handled"];
-	if (typeof handled === "number") record.failuresHandled = handled;
-	return record;
-};
 /** The node an event is about, for filtering. */
 const nodeOf = (event) => {
 	if ("id" in event && typeof event.id === "string") return event.id;
@@ -15177,10 +16181,10 @@ const openStore = (file = storePath(), options = {}) => {
 	const finishRun = db.prepare("UPDATE runs SET status = ?, finished_at = ?, cost_usd = ?, skipped = ?, failures_handled = ? WHERE id = ?");
 	const reopenRun = db.prepare("UPDATE runs SET status = 'running', pid = ?, process_start = ?, finished_at = NULL, skipped = NULL, failures_handled = NULL WHERE id = ?");
 	const addCost = db.prepare("UPDATE runs SET cost_usd = cost_usd + ? WHERE id = ?");
-	const byId = db.prepare("SELECT * FROM runs WHERE id = ?");
-	const byPrefix = db.prepare("SELECT * FROM runs WHERE substr(id, 1, ?) = ? ORDER BY started_at DESC, rowid DESC");
-	const allRuns = db.prepare("SELECT * FROM runs ORDER BY started_at DESC, rowid DESC LIMIT ?");
-	const projectRuns = db.prepare("SELECT * FROM runs WHERE project = ? ORDER BY started_at DESC, rowid DESC LIMIT ?");
+	const byId = db.prepare(`SELECT ${RUN_COLUMNS} FROM runs WHERE id = ?`);
+	const byPrefix = db.prepare(`SELECT ${RUN_COLUMNS} FROM runs WHERE substr(id, 1, ?) = ? ORDER BY started_at DESC, rowid DESC`);
+	const allRuns = db.prepare(`SELECT ${RUN_COLUMNS} FROM runs ORDER BY started_at DESC, rowid DESC LIMIT ?`);
+	const projectRuns = db.prepare(`SELECT ${RUN_COLUMNS} FROM runs WHERE project = ? ORDER BY started_at DESC, rowid DESC LIMIT ?`);
 	const eventsAfter = db.prepare("SELECT seq, at, data FROM events WHERE run_id = ? AND seq > ? ORDER BY seq");
 	const controlEvents = db.prepare("SELECT seq, at, data FROM events WHERE run_id = ? AND type IN ('run.command', 'run.started', 'run.finished') ORDER BY seq");
 	const runNodes = db.prepare("SELECT node FROM events WHERE run_id = ? AND node IS NOT NULL GROUP BY node ORDER BY MIN(seq)");
@@ -15227,12 +16231,12 @@ const openStore = (file = storePath(), options = {}) => {
 		}),
 		runs: (filter = {}) => {
 			const limit = filter.limit ?? -1;
-			return (filter.project === void 0 ? allRuns.all(limit) : projectRuns.all(filter.project, limit)).map((r) => recordOf(r));
+			return (filter.project === void 0 ? allRuns.all(limit) : projectRuns.all(filter.project, limit)).map((r) => recordOf$3(r));
 		},
 		lookup: (prefix) => {
 			const exact = byId.get(prefix);
-			if (exact !== void 0) return [recordOf(exact)];
-			return byPrefix.all(prefix.length, prefix).map((r) => recordOf(r));
+			if (exact !== void 0) return [recordOf$3(exact)];
+			return byPrefix.all(prefix.length, prefix).map((r) => recordOf$3(r));
 		},
 		events: (runId, after = 0) => eventsAfter.all(runId, after).map((r) => ({
 			runId,
@@ -15306,6 +16310,8 @@ const runActivity = (stored) => {
 		if (event.event.type === "tool.called") of(event.id).now = toolLine(event.event);
 	} else if (event.type === "slot.waiting") of(event.id).now = oneLine(slotWaitLine(event.holders));
 	else if (event.type === "slot.taken") delete of(event.id).now;
+	else if (event.type === "lock.waiting") of(event.id).now = oneLine(lockWaitLine(event.lock, event.holders));
+	else if (event.type === "lock.taken") delete of(event.id).now;
 	else if (event.type === "decision.opened") of(event.node).now = oneLine(`Asked: ${event.question}`);
 	else if (event.type === "decision.answered") of(event.node).now = oneLine(`Answered: ${event.answer}`);
 	else if (event.type === "decision.withdrawn") delete of(event.node).now;
@@ -16017,6 +17023,238 @@ const capsHere = (home, place) => {
 		};
 	}
 };
+// ../core/src/usage/report.ts
+const USAGE_DIMENSIONS = [
+	"day",
+	"week",
+	"month",
+	"workflow",
+	"node",
+	"model",
+	"driver",
+	"project"
+];
+const pad = (value) => String(value).padStart(2, "0");
+/** `2026-11-03`, in the machine's own time zone. */
+const dayOf = (date) => `${String(date.getFullYear())}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}`;
+/** The Monday of a time's week. */
+const weekOf = (date) => {
+	const monday = new Date(date);
+	monday.setDate(date.getDate() - (date.getDay() + 6) % 7);
+	return dayOf(monday);
+};
+const KEYS = {
+	day: (row) => dayOf(new Date(row.at)),
+	week: (row) => weekOf(new Date(row.at)),
+	month: (row) => dayOf(new Date(row.at)).slice(0, 7),
+	workflow: (row) => row.workflow,
+	node: (row) => `${row.workflow}/${row.template ?? row.node}`,
+	model: (row) => row.model ?? "unknown",
+	driver: (row) => row.driver ?? "unknown",
+	project: (row) => row.project
+};
+const TIMES = /* @__PURE__ */ new Set([
+	"day",
+	"week",
+	"month"
+]);
+/** Dimensions a tool command has no value in. */
+const SESSION_ONLY = /* @__PURE__ */ new Set(["model", "driver"]);
+const totalsOf = (rows, cpu) => {
+	const totals = {
+		costUsd: 0,
+		tokens: 0,
+		partial: false,
+		inputTokens: 0,
+		outputTokens: 0,
+		cacheReadTokens: 0,
+		cacheWriteTokens: 0,
+		turns: 0,
+		durationMs: 0,
+		sessions: rows.length,
+		runs: new Set(rows.map((row) => row.runId)).size,
+		failedUsd: 0,
+		reworkUsd: 0,
+		chatUsd: 0,
+		cacheHitRate: 0,
+		cpuMs: cpu.reduce((sum, row) => sum + row.userMs + row.systemMs, 0)
+	};
+	for (const row of rows) {
+		totals.costUsd += row.costUsd;
+		totals.tokens += countedTokens(row);
+		totals.partial ||= unpriced(row.driver);
+		totals.inputTokens += row.inputTokens;
+		totals.outputTokens += row.outputTokens;
+		totals.cacheReadTokens += row.cacheReadTokens;
+		totals.cacheWriteTokens += row.cacheWriteTokens;
+		totals.turns += row.turns;
+		totals.durationMs += row.durationMs;
+		if (row.failed) totals.failedUsd += row.costUsd;
+		if (row.kind === "chat") totals.chatUsd += row.costUsd;
+		else if (row.round > 1) totals.reworkUsd += row.costUsd;
+	}
+	const read = totals.inputTokens + totals.cacheReadTokens + totals.cacheWriteTokens;
+	totals.cacheHitRate = read === 0 ? 0 : totals.cacheReadTokens / read;
+	return totals;
+};
+const groupBy = (rows, cpu, dimension) => {
+	const buckets = /* @__PURE__ */ new Map();
+	const bucketOf = (row) => {
+		const key = KEYS[dimension](row);
+		const found = buckets.get(key);
+		if (found !== void 0) return found;
+		const fresh = {
+			rows: [],
+			cpu: []
+		};
+		buckets.set(key, fresh);
+		return fresh;
+	};
+	for (const row of rows) bucketOf(row).rows.push(row);
+	if (!SESSION_ONLY.has(dimension)) for (const row of cpu) bucketOf(row).cpu.push(row);
+	const groups = [...buckets].map(([key, bucket]) => Object.assign(totalsOf(bucket.rows, bucket.cpu), { key }));
+	return TIMES.has(dimension) ? groups.toSorted((a, b) => a.key.localeCompare(b.key)) : groups.toSorted((a, b) => b.costUsd - a.costUsd);
+};
+/** Below this, a percentage says nothing worth acting on. */
+const MIN_SPEND_USD = .5;
+const REWORK_SHARE = .2;
+const FAILED_SHARE = .1;
+const CONCENTRATED_SHARE = .5;
+const LOW_CACHE_RATE = .5;
+const MIN_CACHE_TOKENS = 1e5;
+const percent = (share) => `${String(Math.round(share * 100))}%`;
+const hintsOf = (totals, nodes) => {
+	const spend = totals.costUsd;
+	if (spend < MIN_SPEND_USD) return [];
+	const hints = [];
+	if (totals.reworkUsd / spend >= REWORK_SHARE) hints.push({
+		code: "rework",
+		message: `${percent(totals.reworkUsd / spend)} of the spend went to loop rounds after the first. Sharper briefs or an earlier check can stop work coming back.`
+	});
+	if (totals.failedUsd / spend >= FAILED_SHARE) hints.push({
+		code: "failed",
+		message: `${percent(totals.failedUsd / spend)} of the spend went to sessions that failed. A cheap check before them, or a lower budget per session, can stop them sooner.`
+	});
+	const top = nodes[0];
+	if (top !== void 0 && nodes.length > 1 && top.costUsd / spend >= CONCENTRATED_SHARE) hints.push({
+		code: "concentrated",
+		message: `${top.key} took ${percent(top.costUsd / spend)} of the spend. It is the first place to try a smaller model, a lower effort or a tighter brief.`
+	});
+	if (totals.inputTokens + totals.cacheReadTokens + totals.cacheWriteTokens >= MIN_CACHE_TOKENS && totals.cacheHitRate < LOW_CACHE_RATE) hints.push({
+		code: "cache",
+		message: `Only ${percent(totals.cacheHitRate)} of input tokens came from the prompt cache. Long runs of fresh sessions cost more than resumed ones.`
+	});
+	return hints;
+};
+/** Everything a report shows, from the ledger's rows and tool commands' CPU. */
+const usageReport = (rows, cpu = []) => {
+	const totals = totalsOf(rows, cpu);
+	const by = (dimension) => groupBy(rows, cpu, dimension);
+	const groups = {
+		day: by("day"),
+		week: by("week"),
+		month: by("month"),
+		workflow: by("workflow"),
+		node: by("node"),
+		model: by("model"),
+		driver: by("driver"),
+		project: by("project")
+	};
+	return {
+		totals,
+		groups,
+		hints: hintsOf(totals, groups.node)
+	};
+};
+// ../core/src/worktree/clean.ts
+/**
+* @file What `ork worktrees clean` and `ork worktrees remove` do with what
+*   list.ts reads: the plan (what goes, what's kept and why), by one rule for
+*   every caller, and carrying it out. The CLI and the Worktrees panel both
+*   plan here, so neither removes what the other would keep.
+*/
+/** What names an item for `remove`: its branch, or its worktree's path. */
+const keyOf = (item) => item.branch ?? item.path ?? `${item.runId}/${item.nodeId}`;
+/** The reasons no `force` overrides: removing would break something. */
+const MAIN_CHECKOUT = "checked out in the main checkout";
+const RUN_GOING = "its run is still going";
+const NOT_ORKS = "not created by Ork";
+const kept = (item, skip) => ({
+	item,
+	removeWorktree: false,
+	deleteBranch: false,
+	skip
+});
+/** What clean does with one item. */
+const cleanStep = (item, options) => {
+	if (!item.recorded) return kept(item, NOT_ORKS);
+	if (item.inMainCheckout) return kept(item, MAIN_CHECKOUT);
+	if (item.heldBy !== void 0) return kept(item, `checked out in ${item.heldBy}`);
+	if (options.live?.has(item.runId) === true) return kept(item, RUN_GOING);
+	if (item.dirty && !options.force) return kept(item, "uncommitted changes");
+	if (item.branch === void 0 && item.checkedOut === void 0 && item.ahead > 0 && !options.force) return kept(item, "commits on no branch");
+	const removable = item.path !== null && !item.missing;
+	if (options.branches && item.branch !== void 0 && !item.merged && !options.force) return {
+		item,
+		removeWorktree: removable,
+		deleteBranch: false,
+		skip: "branch not merged"
+	};
+	return {
+		item,
+		removeWorktree: removable,
+		deleteBranch: options.branches && item.branch !== void 0
+	};
+};
+/** Whether a step drops a worktree whose folder is gone, by its own path. */
+const stepPrunes = (step) => step.item.missing && step.item.path !== null && step.skip === void 0;
+/** Whether a step does anything. */
+const stepActs = (step) => step.removeWorktree || step.deleteBranch || stepPrunes(step);
+/**
+* What `ork worktrees clean` would do. A worktree with uncommitted changes, an
+* unmerged branch, or a detached worktree holding commits no branch has, is
+* kept unless `force`; one checked out in the main checkout or in a worktree
+* Ork didn't create, whose run is still going, or an `ork/` branch no run
+* recorded creating, is kept even then.
+*/
+const planClean = (items, filter, options) => items.filter((item) => filter.runId === void 0 || item.runId === filter.runId).filter((item) => filter.key === void 0 || keyOf(item) === filter.key).filter((item) => !filter.merged || item.merged).map((item) => cleanStep(item, options));
+/**
+* Carries out one step; what it did goes into `done` as it goes. It touches
+* only its own item: a missing worktree is dropped by its own path (`git
+* worktree remove`), never by `git worktree prune`, which would drop every
+* missing worktree in the repository, the user's own included.
+*/
+const applyStep = async (root, step, force, done) => {
+	const { item } = step;
+	if (stepPrunes(step) && !step.removeWorktree && item.path !== null) {
+		await gitOk(root, [
+			"worktree",
+			"remove",
+			item.path
+		]);
+		done.push(`pruned ${item.path}`);
+	}
+	if (step.removeWorktree && item.path !== null) {
+		await removeWorktree(root, item.path, force);
+		done.push(`removed ${item.path}`);
+	}
+	if (step.deleteBranch && item.branch !== void 0) {
+		await gitOk(root, [
+			"branch",
+			force ? "-D" : "-d",
+			item.branch
+		]);
+		done.push(`deleted ${item.branch}`);
+	}
+};
+/**
+* Carries out a clean plan, step by step. What it did goes into `done` as it
+* goes, so a caller still has it when git fails halfway.
+*/
+const applyClean = async (root, steps, force, done = []) => {
+	for (const step of steps) await applyStep(root, step, force, done);
+	return done;
+};
 // ../core/src/worktree/names.ts
 /**
 * @file The names Ork gives a node's worktree and branch, from the project's
@@ -16147,6 +17385,203 @@ const syncFrom = async (worktree, from) => {
 	if (!applied.ok) throw new Error(`could not take ${from}'s changes: ${applied.error}`);
 	return snapshot(worktree);
 };
+// ../core/src/worktree/words.ts
+/**
+* @file The plain words for what `ork worktrees` shows, in one place, so the
+*   CLI and the Worktrees panel say the same thing: an item's name, its merge
+*   state, its state as parts (each marked when it's work that removing would
+*   lose), a plan's line, and why an item can't be removed. The CLI colors
+*   them; the panel lays them out.
+*/
+/** An item's name: its branch, or its run and node when created detached. */
+const labelOf = (item) => item.branch ?? `${item.runId}/${item.nodeId}`;
+/** Merged into the current branch, not, or detached on no branch at all. */
+const mergeStateOf = (item) => {
+	if (item.branch === void 0 && item.checkedOut === void 0) return "detached";
+	return item.merged ? "merged" : "unmerged";
+};
+/** `3 commits`, `1 commit`. */
+const counted = (count, noun) => `${String(count)} ${noun}${count === 1 ? "" : "s"}`;
+/**
+* An item's state, in order: where its worktree is when it isn't plain, the
+* workflow's own branch, uncommitted changes, unmerged or unreachable commits,
+* and the main checkout or another worktree holding the branch. `into` names
+* the branch "not merged" is measured against, when the words should say it.
+*/
+const stateParts = (item, into) => {
+	const parts = [];
+	const part = (text, risk = false) => {
+		parts.push({
+			text,
+			risk
+		});
+	};
+	if (item.path === null) part("no worktree");
+	else if (item.missing) part("missing (prunable)");
+	if (item.checkedOut !== void 0) part(`on the workflow's branch ${item.checkedOut}`);
+	if (item.dirty) part("uncommitted changes", true);
+	const state = mergeStateOf(item);
+	if (state === "unmerged") {
+		const where = into === void 0 ? "" : ` into ${into}`;
+		part(`${counted(item.ahead, "commit")} not merged${where}`);
+	}
+	if (state === "detached") {
+		if (item.ahead > 0) part(`${counted(item.ahead, "commit")} on no branch`, true);
+		else if (item.path !== null && !item.missing) part("nothing committed");
+	}
+	if (!item.recorded) part("not created by Ork");
+	if (item.inMainCheckout) part("checked out in the main checkout");
+	if (item.heldBy !== void 0) part(`checked out in ${item.heldBy}`);
+	return parts;
+};
+/** What a step does, as a plan says it. */
+const planWhat = (step) => {
+	const actions = [
+		...step.removeWorktree ? ["remove worktree"] : [],
+		...stepPrunes(step) && !step.removeWorktree ? ["prune worktree"] : [],
+		...step.deleteBranch ? ["delete branch"] : []
+	];
+	return actions.length > 0 ? actions.join(" + ") : "keep";
+};
+/** `ork/r1/lead: remove worktree`, `r1/check (detached): keep (…)`. */
+const planLine = (step) => {
+	const { item } = step;
+	return {
+		text: `${item.branch === void 0 && item.checkedOut === void 0 ? `${labelOf(item)} (detached)` : labelOf(item)}: ${planWhat(step)}`,
+		...step.skip === void 0 ? {} : { reason: step.skip }
+	};
+};
+/**
+* Why an item can't be removed at all, even forced, if it can't: no run
+* recorded creating it, the main checkout or a worktree Ork didn't create holds
+* it, or its run is still going.
+*/
+const removeRefusal = (item, live) => {
+	if (!item.recorded) return "not created by Ork (no run recorded it); delete it with git if it's yours to delete";
+	if (item.inMainCheckout) return "checked out in the main checkout; switch it to another branch first";
+	if (item.heldBy !== void 0) return `checked out in ${item.heldBy}, a worktree Ork didn't create; switch it to another branch first`;
+	return live ? `run ${item.runId} is still going; stop it first` : void 0;
+};
+// ../core/src/worktree/remove.ts
+/** The ids of the project's runs whose process is still going. */
+const liveRunIds = (store, root) => new Set(store.runs({ project: root }).filter((run) => liveStatus(run) === "running").map((run) => run.id));
+/**
+* Whether `root` is a repository with a commit, and the branch checked out
+* there, which "merged" means merged into (null when its HEAD is detached).
+*/
+const projectHead = async (root) => {
+	if ((await git(root, [
+		"rev-parse",
+		"--verify",
+		"--quiet",
+		"HEAD"
+	])).code !== 0) return { ok: false };
+	const answer = await git(root, [
+		"symbolic-ref",
+		"--short",
+		"-q",
+		"HEAD"
+	]);
+	return {
+		ok: true,
+		branch: answer.code === 0 ? answer.stdout.trim() : null
+	};
+};
+/** The top of the repository `cwd` is in, even one with no commit yet. */
+const repoRoot = async (cwd) => {
+	const top = await git(cwd, ["rev-parse", "--show-toplevel"]);
+	return top.code === 0 ? top.stdout.trim() : null;
+};
+/** What Ork created in the repo at `root`, from its runs' records and git. */
+const readWorktrees = async (store, root) => ({
+	items: await listOrkWorktrees(root, createdWorktrees(store, root)),
+	live: liveRunIds(store, root)
+});
+/**
+* The plan to remove one item, named by `keyOf`. A branch with no worktree is
+* removed by deleting it, so `deleteBranch` is implied there.
+*/
+const planRemove = ({ items, live }, key, deleteBranch) => {
+	const item = items.find((i) => keyOf(i) === key);
+	if (item === void 0) return {
+		ok: false,
+		error: `No Ork worktree or branch ${key}.`,
+		gone: true
+	};
+	const refusal = removeRefusal(item, live.has(item.runId));
+	if (refusal !== void 0) return {
+		ok: false,
+		error: `Can't remove ${labelOf(item)}: ${refusal}.`,
+		gone: false
+	};
+	const branches = item.branch !== void 0 && (deleteBranch || item.path === null);
+	const careful = cleanStep(item, {
+		branches,
+		force: false,
+		live
+	});
+	if (careful.skip === void 0) return {
+		ok: true,
+		plan: {
+			step: careful,
+			force: false
+		}
+	};
+	return {
+		ok: true,
+		plan: {
+			step: cleanStep(item, {
+				branches,
+				force: true,
+				live
+			}),
+			force: true
+		}
+	};
+};
+const out = async (cwd, args) => lines((await git(cwd, args)).stdout);
+/** What carrying out `plan` would lose, read from git. */
+const lostWork = async (root, { step }) => {
+	const { item } = step;
+	const inside = item.path !== null && !item.missing ? item.path : null;
+	const changes = inside !== null && item.dirty && step.removeWorktree ? await out(inside, ["status", "--porcelain"]) : [];
+	if (step.deleteBranch && item.branch !== void 0 && !item.merged) return {
+		changes,
+		commits: await out(root, [
+			"log",
+			"--oneline",
+			`HEAD..${item.branch}`
+		]),
+		commitsOn: "unmerged"
+	};
+	if (item.branch === void 0 && item.checkedOut === void 0 && inside !== null && item.ahead > 0 && step.removeWorktree) return {
+		changes,
+		commits: await out(inside, [
+			"log",
+			"--oneline",
+			"HEAD",
+			"--not",
+			"--branches",
+			"--tags",
+			"--remotes"
+		]),
+		commitsOn: "no branch"
+	};
+	return {
+		changes,
+		commits: [],
+		commitsOn: null
+	};
+};
+/**
+* Carries out a remove plan; what it did goes into `done` as it goes. The
+* caller has checked that a plan needing `force` was asked to force. It touches
+* only its own item, as each of clean's steps does.
+*/
+const applyRemove = async (root, { step, force }, done = []) => {
+	await applyStep(root, step, force, done);
+	return done;
+};
 // ../core/src/worktree/resumed.ts
 /**
 * @file What a resumed run's workspace starts from: the worktrees the run left
@@ -16619,4 +18054,4 @@ const createWorkspace = (options) => {
 		close
 	};
 };
-export { followEvents as $, plainPathInside as $n, serversIn as $t, resolveInputs as A, applySteps as An, readyDriver as Ar, endedWith as At, tellNode as B, inRepoPlace as Bn, lines as Bt, isNodeEvent as C, socketPath as Cn, retiredDriverHint as Cr, processAlive as Ct, inspectProject as D, maskReplacer as Dn, integrationFor as Dr, scriptContactsOf as Dt, BRANCH_PREFIX as E, MASK as En, TOOL_PREFIX as Er, nestItems as Et, addressOf as F, createAgent as Fn, firstLine as Fr, slotWaitLine as Ft, requestStop as G, runDirOf as Gn, nodeSays as Gt, flattenTree as H, placeFiles as Hn, envReadsOf as Ht, endLink as I, deleteAgent as In, EXPERIMENTS as Ir, lowerChild as It, detachResume as J, inside as Jn, gitRulesOf as Jt, tellLiveRun as K, shownPath as Kn, declaredOutputOf as Kt, endLinksOf as L, catalogAgent as Ln, experimentsOn as Lr, startAt as Lt, sessionRefusals as M, linkTools as Mn, ORK_LAYOUT as Mr, stoppedEnd as Mt, driverQueues as N, toolLinks as Nn, AGENT_DRIVERS as Nr, calledWorkflows as Nt, removeWorktree as O, maskSecrets as On, PREFERRED_DRIVER as Or, runScope as Ot, createCalls as P, toolsInUse as Pn, DRIVER_IDS as Pr, slotClock as Pt, detachRun as Q, guardedBase as Qn, mcpNotText as Qt, linkNodes as R, loadAgents as Rn, knownExperiments as Rr, git as Rt, activeTree as S, serveRun as Sn, NodeIdSchema as Sr, templateOf as St, storePath as T, wakeRun as Tn, INTEGRATIONS as Tr, isItem as Tt, requestContinue as U, placeFor as Un, namingNoDriver as Ut, unlinkNodes as V, newProjectId as Vn, clearGitLocalEnv as Vt, requestPause as W, projectsHome as Wn, sessionDriver as Wt, listKey as X, LESSON_CAP_TOKENS as Xn, machineRulesOf as Xt, resumable as Y, projectRootOf as Yn, loadProject as Yt, DETACHED_ENV as Z, estimateTokens as Zn, MCP_FILE as Zt, declaredTriggers as _, targetOf as _n, settingsOf as _r, liveStatus as _t, planUpgrade as a, endFor as an, readDocument as ar, explainWorkflowText as at, takeWatchLock as b, renderTemplate as bn, isToolNode as br, runTree as bt, runningScript as c, FEEDBACK_TARGETS as cn, programsRunBy as cr, parseReport as ct, isNewer as d, runGh as dn, serializeWorkflow as dr, walkChecks as dt, createSignals as en, writePlainFile as er, NOT_STARTED as et, parseVersion as f, sendPost as fn, markValue as fr, walkSummary as ft, triggerStanding as g, normalizeTitle as gn, expandEdge as gr, heldTimeout as gt, createWatcher as h, fingerprint as hn, CheckReportSchema as hr, userMessageText as ht, capsHere as i, END_KINDS as in, newWorkflowText as ir, usd as it, driverRefusals as j, planMoveInto as jn, AGENT_TOOL_LAYOUTS as jr, failedWith as jt, parseInputPairs as k, planAgentMigration as kn, driverChecks as kr, declaredProblem as kt, detectInstaller as l, DISCUSSIONS as ln, renderJsonSchema as lr, reportSchemaFor as lt, triggersReport as m, createFeedback as mn, WorkflowSchema as mr, MESSAGE_LIMIT as mt, resumedOptions as n, outcomeEnd as nn, WorkflowEditSchema as nr, limitsReport as nt, releaseNotes as o, FEEDBACK_KINDS as on, renameNodeTypes as or, explainSession as ot, lateTriggers as p, publishPost as pn, EdgeInputSchema as pr, startRun as pt, adoptedCalls as q, workflowDirOf as qn, PROJECT_FILE as qt, resolveBase as r, END_DETAIL_LIMIT as rn, applyEdits as rr, planReason as rt, runningRunIds as s, FEEDBACK_SEVERITIES as sn, beforeOf as sr, planNodeSession as st, createWorkspace as t, endOf as tn, skillsIn as tr, limitsNow as tt, compareVersions as u, planPost as un, parseWorkflow as ur, checkWorkflowText as ut, readProjectTriggers as v, evaluate as vn, NodeSchema as vr, pausedOf as vt, openStore as w, socketRoom as wn, timeoutMs as wr, stillTheSameProcess as wt, watchingPid as x, readCondition as xn, DriverSchema as xr, slotWaitsOf as xt, workflowTextHash as y, parseTemplate as yn, isClaudeNode as yr, runStatus as yt, peerOf as z, hasInRepoFiles as zn, gitOk as zt };
+export { resolveInputs as $, maskSecrets as $n, PREFERRED_DRIVER as $r, countedTokens as $t, isNewer as A, END_KINDS as An, readDocument as Ar, usd as At, watchingPid as B, createFeedback as Bn, CheckReportSchema as Br, MESSAGE_LIMIT as Bt, capsHere as C, MCP_FILE as Cn, guardedBase as Cr, DETACHED_ENV as Ct, runningScript as D, endOf as Dn, WorkflowEditSchema as Dr, limitsNow as Dt, runningRunIds as E, createSignals as En, skillsIn as Er, NOT_STARTED as Et, triggerStanding as F, DISCUSSIONS as Fn, parseWorkflow as Fr, reportSchemaFor as Ft, applyPrune as G, parseTemplate as Gn, isToolNode as Gr, pausedOf as Gt, isNodeEvent as H, normalizeTitle as Hn, settingsOf as Hr, heldTimeout as Ht, declaredTriggers as I, planPost as In, serializeWorkflow as Ir, checkWorkflowText as It, listOrkWorktrees as J, serveRun as Jn, retiredDriverHint as Jr, templateOf as Jt, planPrune as K, renderTemplate as Kn, DriverSchema as Kr, runStatus as Kt, readProjectTriggers as L, runGh as Ln, markValue as Lr, walkChecks as Lt, lateTriggers as M, FEEDBACK_KINDS as Mn, beforeOf as Mr, explainSession as Mt, triggersReport as N, FEEDBACK_SEVERITIES as Nn, programsRunBy as Nr, planNodeSession as Nt, detectInstaller as O, outcomeEnd as On, applyEdits as Or, limitsReport as Ot, createWatcher as P, FEEDBACK_TARGETS as Pn, renderJsonSchema as Pr, parseReport as Pt, parseInputPairs as Q, maskReplacer as Qn, integrationFor as Qr, nestItems as Qt, workflowTextHash as R, sendPost as Rn, EdgeInputSchema as Rr, walkSummary as Rt, usageReport as S, machineRulesOf as Sn, estimateTokens as Sr, resumable as St, releaseNotes as T, serversIn as Tn, writePlainFile as Tr, followEvents as Tt, openStore as U, targetOf as Un, NodeSchema as Ur, liveStatus as Ut, activeTree as V, fingerprint as Vn, expandEdge as Vr, userMessageText as Vt, storePath as W, evaluate as Wn, isClaudeNode as Wr, lockWaitsOf as Wt, createReplay as X, socketRoom as Xn, INTEGRATIONS as Xr, stillTheSameProcess as Xt, inspectProject as Y, socketPath as Yn, timeoutMs as Yr, processAlive as Yt, replayLoopAnswers as Z, MASK as Zn, TOOL_PREFIX as Zr, isItem as Zt, keyOf as _, nodeSays as _n, shownPath as _r, requestPause as _t, planRemove as a, DRIVER_IDS as ai, stoppedEnd as an, toolsInUse as ar, scriptRefusal as at, stepPrunes as b, gitRulesOf as bn, projectRootOf as br, adoptedCalls as bt, repoRoot as c, experimentsOn as ci, slotWaitLine as cn, catalogAgent as cr, followRunTree as ct, planLine as d, git as dn, inRepoPlace as dr, createCalls as dt, driverChecks as ei, runScope as en, planAgentMigration as er, budgetWarnings as et, removeRefusal as f, gitOk as fn, newProjectId as fr, addressOf as ft, cleanStep as g, sessionDriver as gn, runDirOf as gr, requestContinue as gt, applyClean as h, namingNoDriver as hn, projectsHome as hr, unlinkNodes as ht, lostWork as i, AGENT_DRIVERS as ii, failedWith as in, toolLinks as ir, TOO_LONG as it, parseVersion as j, endFor as jn, renameNodeTypes as jr, explainWorkflowText as jt, compareVersions as k, END_DETAIL_LIMIT as kn, newWorkflowText as kr, planReason as kt, labelOf as l, knownExperiments as li, lowerChild as ln, loadAgents as lr, answerDecision as lt, resolveBase as m, envReadsOf as mn, placeFor as mr, linkNodes as mt, resumedOptions as n, AGENT_TOOL_LAYOUTS as ni, lockWaitLine as nn, planMoveInto as nr, sessionRefusals as nt, projectHead as o, firstLine as oi, declaredProblem as on, createAgent as or, sendFromScript as ot, stateParts as p, clearGitLocalEnv as pn, placeFiles as pr, endLinksOf as pt, createdWorktrees as q, readCondition as qn, NodeIdSchema as qr, slotWaitsOf as qt, applyRemove as r, ORK_LAYOUT as ri, endedWith as rn, linkTools as rr, driverQueues as rt, readWorktrees as s, EXPERIMENTS as si, slotClock as sn, deleteAgent as sr, createRelay as st, createWorkspace as t, readyDriver as ti, calledWorkflows as tn, applySteps as tr, driverRefusals as tt, mergeStateOf as u, startAt as un, hasInRepoFiles as ur, pendingDecisions as ut, planClean as v, declaredOutputOf as vn, workflowDirOf as vr, requestStop as vt, planUpgrade as w, mcpNotText as wn, plainPathInside as wr, detachRun as wt, USAGE_DIMENSIONS as x, loadProject as xn, LESSON_CAP_TOKENS as xr, detachResume as xt, stepActs as y, PROJECT_FILE as yn, inside as yr, tellLiveRun as yt, takeWatchLock as z, publishPost as zn, WorkflowSchema as zr, startRun as zt };