@rulvar/core 1.1.0 → 1.3.0

package/dist/index.d.ts

@@ -3,9 +3,7 @@
 * L0 JSON value domain.
 *
 * Everything that enters the journal (entry values, error data, artifacts)
-* MUST be JSON-serializable (docs/03-journal-spec.md, section "Two-phase
-* entries, dispatch, and the budget ledger"); `Json` is the type-level face
-* of that rule.
+* MUST be JSON-serializable; `Json` is the type-level face of that rule.
 */
 type Json = null | boolean | number | string | Json[] | {
   [key: string]: Json;
@@ -26,16 +24,16 @@ type WireError = {
   data?: Json;
 };
 /**
-* The closed error-code registry (docs/02, section "Error taxonomy").
+* The closed error-code registry.
 * 'agent' is carried by the AgentError value projection, not by a
 * RulvarError subclass.
 */
 type ErrorCode = "agent" | "config" | "non_serializable_value" | "script_rejected" | "journal_compat" | "invalid_resolution" | "journal_order_violation" | "plan_invariant" | "replay_plan_hash_mismatch" | "orchestrator_cap_config" | "journal_miss" | "budget_exhausted" | "admission_rejected" | "sandbox_limit" | "lease_held" | "knowledge_cas";
-/** docs/02 names the registry type RulvarErrorCode; both names are public. */
+/** An alias for the registry type; both names are public. */
 type RulvarErrorCode = ErrorCode;
 /**
 * Base class for all engine-raised errors. "Retryable" means the engine's
-* own retry machinery (RetryPolicy under the journal, docs/04) MAY retry;
+* own retry machinery (RetryPolicy under the journal) MAY retry;
 * it never means a provider SDK autoretry, which is disabled.
 */
 declare abstract class RulvarError extends Error {
@@ -84,12 +82,12 @@ declare class ScriptRejected extends RulvarError {
     cause?: unknown;
   });
 }
-/** Sub-code detail of JournalCompatibilityError (docs/03, section "hashVersion"). */
+/** Sub-code detail of JournalCompatibilityError. */
 type JournalCompatSubCode = "HASH_VERSION_TOO_OLD" | "HASH_VERSION_TOO_NEW";
 /**
 * Refusal to open a journal whose hashVersion falls outside the engine's
-* support window (docs/03, section "hashVersion"; producers ship in M2).
-* The registry code is 'journal_compat'; the docs/03 sub-codes live on
+* support window (producers ship in M2).
+* The registry code is 'journal_compat'; the sub-codes live on
 * `subCode` and in `data`.
 */
 declare class JournalCompatibilityError extends RulvarError {
@@ -119,8 +117,7 @@ declare class JournalCompatibilityError extends RulvarError {
 }
 /**
 * A resolution attempt against an already-closed suspension, rejected under
-* the first-closing-wins fold; appends no entry (docs/03, section
-* "Suspension and resolutions"; producers ship in M2).
+* the first-closing-wins fold; appends no entry (producers ship in M2).
 */
 declare class InvalidResolutionError extends RulvarError {
   readonly code = "invalid_resolution";
@@ -131,7 +128,7 @@ declare class InvalidResolutionError extends RulvarError {
 }
 /**
 * A breach of the total per-run append order: an unfenced concurrent writer
-* or a store violating contract A2 (docs/03, section "Storage SPI").
+* or a store violating contract A2 (https://docs.rulvar.com/guide/stores).
 */
 declare class JournalOrderViolation extends RulvarError {
   readonly code = "journal_order_violation";
@@ -140,7 +137,7 @@ declare class JournalOrderViolation extends RulvarError {
     cause?: unknown;
   });
 }
-/** PlanRunner plan-invariant rejection (docs/07; producers ship in M7). */
+/** PlanRunner plan-invariant rejection (producers ship in M7). */
 declare class PlanInvariantError extends RulvarError {
   readonly code = "plan_invariant";
   constructor(message: string, opts?: {
@@ -150,7 +147,7 @@ declare class PlanInvariantError extends RulvarError {
 }
 /**
 * Raised at resume when the refolded plan state disagrees with the
-* journaled planHash chain (docs/07; producers ship in M7).
+* journaled planHash chain (producers ship in M7).
 */
 declare class ReplayPlanHashMismatch extends RulvarError {
   readonly code = "replay_plan_hash_mismatch";
@@ -161,8 +158,7 @@ declare class ReplayPlanHashMismatch extends RulvarError {
 }
 /**
 * Invalid orchestrator cap and finalize-reserve configuration, thrown
-* before the first LLM call (docs/06, section "Three-layer budget", DEF-7;
-* producers ship in M6/M7).
+* before the first LLM call (DEF-7; producers ship in M6/M7).
 */
 declare class OrchestratorCapConfigError extends RulvarError {
   readonly code = "orchestrator_cap_config";
@@ -185,8 +181,7 @@ declare class JournalMissError extends RulvarError {
 /**
 * The run budget ceiling blocked further work. The budget guard denial is
 * a decision entry; ctx primitives throw this as AgentError kind 'budget';
-* the run reports outcome 'exhausted', overriding 'error' (docs/06, section
-* "Three-layer budget").
+* the run reports outcome 'exhausted', overriding 'error'.
 */
 declare class BudgetExhaustedError extends RulvarError {
   readonly code = "budget_exhausted";
@@ -197,13 +192,12 @@ declare class BudgetExhaustedError extends RulvarError {
 }
 /**
 * A structural admission rejection (maxDepth, maxChildrenPerNode,
-* maxTotalSpawns) from the AdmissionController (docs/07, section
-* "AdmissionController"; M6-T06). The rejection verdict is embedded in
+* maxTotalSpawns) from the AdmissionController (M6-T06). The rejection verdict is embedded in
 * the carrying spawn-admission decision entry and replays identically;
 * the error surfaces the embedded AdmitRejectReason in `data` to the
 * caller (a typed tool error for orchestrators) and MUST NOT tear down
 * the run. Budget-code rejections throw BudgetExhaustedError instead,
-* keeping the docs/06 5.7 exhaustion semantics.
+* keeping the budget exhaustion semantics (https://docs.rulvar.com/guide/budgets).
 */
 declare class AdmissionRejectedError extends RulvarError {
   readonly code = "admission_rejected";
@@ -213,8 +207,8 @@ declare class AdmissionRejectedError extends RulvarError {
   });
 }
 /**
-* A WorkerSandboxRunner resource-limit breach (docs/06, section 8.2;
-* M6-T02): crossing timeoutMs or memoryMb terminates the worker and the
+* A WorkerSandboxRunner resource-limit breach (M6-T02): crossing
+* timeoutMs or memoryMb terminates the worker and the
 * run completes with outcome 'error' carrying this error's WireError
 * projection; `data` records { reason: 'timeout' | 'memory', limit }.
 * The class itself is never journaled as an entry of its own.
@@ -228,8 +222,7 @@ declare class SandboxError extends RulvarError {
 }
 /**
 * acquire() on a currently held lease. Retryable by contract: retry after
-* the lease ttl elapses or the holder releases (docs/03, section
-* "Storage SPI").
+* the lease ttl elapses or the holder releases.
 */
 declare class LeaseHeldError extends RulvarError {
   readonly code = "lease_held";
@@ -241,8 +234,7 @@ declare class LeaseHeldError extends RulvarError {
 /**
 * commit() on a ModelKnowledgeStore against a snapshot version that is
 * no longer current. Retryable by contract: re-read current(), rebase
-* the ops, commit again, mirroring the lease fencing discipline
-* (docs/05, section "Commit discipline").
+* the ops, commit again, mirroring the lease fencing discipline.
 */
 declare class KnowledgeCasError extends RulvarError {
   readonly code = "knowledge_cas";
@@ -252,8 +244,8 @@ declare class KnowledgeCasError extends RulvarError {
   });
 }
 /**
-* The vendored Standard Schema issue shape (docs/06, section "Canonical Ctx
-* interface"): validation issues carried on AgentError and surfaced to the
+* The vendored Standard Schema issue shape: validation issues carried
+* on AgentError and surfaced to the
 * model during bounded schema re-prompts.
 */
 type Issue$1 = {
@@ -264,8 +256,7 @@ type Issue$1 = {
 };
 /**
 * The structured error value carried on AgentResult.error and journaled
-* inside the agent terminal entry. Deliberately NOT a RulvarError subclass
-* (docs/02, section "Error taxonomy").
+* inside the agent terminal entry. Deliberately NOT a RulvarError subclass.
 */
 type AgentError = {
   kind: "transport" | "rate-limit" | "schema-mismatch" | "tool" | "budget" | "terminal";
@@ -275,8 +266,8 @@ type AgentError = {
 };
 /**
 * Projects an AgentError to its WireError form: code 'agent', with kind,
-* retryAfterMs, and issues carried in data (docs/02, section "Error
-* taxonomy"). Issue paths are flattened to JSON-safe segments.
+* retryAfterMs, and issues carried in data. Issue paths are flattened to
+* JSON-safe segments.
 */
 declare function agentErrorToWire(error: AgentError, message: string): WireError;
 /**
@@ -290,14 +281,12 @@ type Role = "system" | "user" | "assistant" | "tool";
 /**
 * Engine-minted ULID identifying a tool call across providers. The library,
 * not the provider, mints tool-call ids; each adapter keeps a bijective map
-* between canonical ids and wire ids (toolu_* / call_*) in both directions
-* (docs/04, section "Canonical tool-call ids").
+* between canonical ids and wire ids (toolu_* / call_*) in both directions.
 */
 type CanonicalId = string;
 /**
 * Returns a per-engine minter of CanonicalId values. Monotonic within the
-* factory instance; never a module-level singleton (docs/02, section
-* "Dependency rules": no module state).
+* factory instance; never a module-level singleton (no module state).
 */
 declare function createCanonicalIdMinter(options?: {
   now?: () => number;
@@ -312,8 +301,7 @@ interface Msg {
 * The canonical part union. provider-raw parts carry opaque provider blocks
 * that must survive round trips (thinking blocks with signatures, reasoning
 * items including encrypted_content). Retention is unconditional; dropping
-* happens only in projection, never in retention (docs/04, section
-* "Messages and parts").
+* happens only in projection, never in retention.
 */
 type Part = {
   type: "text";
@@ -340,16 +328,14 @@ type Part = {
 };
 /**
 * A JSON Schema document (draft 2020-12) as plain JSON data. Canonical
-* serialization and hashing rules live with the KeyDeriver (docs/03,
-* section "schemaHash and toolsetHash derivation").
+* serialization and hashing rules live with the KeyDeriver.
 */
 type JsonSchema = {
   [key: string]: unknown;
 };
 /**
 * The identity-bearing tool contract: exactly what the model sees and
-* exactly what toolsetHash hashes. Never contains execute or any closure
-* (docs/08, section "Tool definition and toolsetHash").
+* exactly what toolsetHash hashes. Never contains execute or any closure.
 */
 interface ToolContract {
   name: string;
@@ -364,7 +350,7 @@ type ToolChoice = "auto" | "none" | "required" | {
 };
 /**
 * Canonical effort: exactly five levels, a string-literal union, never a TS
-* enum (docs/04, section "Canonical effort"). OpenAI 'none' has no
+* enum. OpenAI 'none' has no
 * canonical equivalent and is reachable only via providerOptions.
 */
 type Effort = "low" | "medium" | "high" | "xhigh" | "max";
@@ -372,7 +358,7 @@ type CacheTtl = "5m" | "1h";
 /**
 * Provider-neutral declaration of intended prompt-cache boundaries.
 * Transport-level cost optimization only: MUST NOT enter IdentityInput and
-* MUST NOT change response semantics (docs/04, section "cacheHint").
+* MUST NOT change response semantics.
 */
 interface CacheHint {
   /** Desired cache boundaries, ordered from shallowest to deepest prefix. */
@@ -388,8 +374,7 @@ interface CacheHint {
 * top_p, top_k) are deliberately absent from the first-class surface: both
 * first-class providers reject them on current reasoning models; where a
 * target legitimately supports them they travel through the adapter's
-* providerOptions namespace, subject to caps scrubbing (docs/04, section
-* "ChatRequest").
+* providerOptions namespace, subject to caps scrubbing.
 */
 interface ChatRequest {
   /** Wire model id: the segment after 'adapterId:' in ModelRef. */
@@ -410,8 +395,7 @@ interface ChatRequest {
   * adapter MUST read only its own namespace and MUST ignore unknown
   * namespaces without error. Canonical fields always win where both
   * express the same thing; a namespaced option silently contradicting a
-  * canonical field is a typed ConfigError (docs/04, section
-  * "providerOptions and providerMetadata namespacing").
+  * canonical field is a typed ConfigError.
   */
   providerOptions?: Record<string, Record<string, unknown>>;
 }
@@ -419,7 +403,7 @@ interface ChatRequest {
 * Usage under the Usage invariant: inputTokens is the FULL prompt size
 * including cache reads and cache writes. Adapters MUST normalize
 * provider-reported usage to satisfy this invariant, and the core verifies
-* it at the adapter boundary (docs/04, section "Usage invariant").
+* it at the adapter boundary.
 */
 type Usage = {
   inputTokens: number;
@@ -441,7 +425,7 @@ interface RefusalInfo {
 /**
 * Typed finish outcomes. A refusal MUST surface as a typed finish outcome
 * carrying the provider stop details; it MUST NOT be projected to a null
-* output silently (docs/04, section "Finish outcomes and typed refusal").
+* output silently.
 */
 type FinishInfo = {
   reason: "stop";
@@ -458,7 +442,7 @@ type FinishInfo = {
 /**
 * The single canonical stream-event vocabulary yielded by
 * ProviderAdapter.stream. Adapters MUST emit exactly one terminal event per
-* stream (finish or error) (docs/04, section "ChatEvent stream").
+* stream (finish or error).
 */
 type ChatEvent = {
   type: "text-delta";
@@ -490,13 +474,12 @@ type ChatEvent = {
   type: "error";
   error: WireError;
 };
-/** Strictly 'adapterId:model', no query parameters (docs/04, section "Registry and ModelRef"). */
+/** Strictly 'adapterId:model', no query parameters. */
 type ModelRef = `${string}:${string}`;
 type InvocationRole = "orchestrate" | "plan" | "loop" | "finalize" | "extract" | "summarize";
 /**
 * What authors write wherever a model is configurable: a call override, an
-* agent profile, a workflow default, or an engine default (docs/04, section
-* "Router and resolution chain").
+* agent profile, a workflow default, or an engine default.
 */
 type ModelSpec = ModelRef | ModelChoice | {
   ladder: LadderSpec;
@@ -505,19 +488,18 @@ interface ModelChoice {
   model: ModelRef;
   /** Absent: resolved by the chain, including role effort defaults. */
   effort?: Effort;
-  /** Namespaced by adapter id (docs/04, section "providerOptions and providerMetadata namespacing"). */
+  /** Namespaced by adapter id. */
   providerOptions?: Record<string, Record<string, unknown>>;
-  /** Transport-failure failover list; never enters identity (docs/04, section "RetryPolicy and failover"). */
+  /** Transport-failure failover list; never enters identity. */
   fallbacks?: ModelRef[];
 }
 /**
 * Identity-facing canonical form of a RESOLVED model request; the value
-* that enters AgentIdentityInput.modelSpec (docs/03, section "Identity
-* model"). providerOptions and fallbacks NEVER enter this form: they are
+* that enters AgentIdentityInput.modelSpec.
+* providerOptions and fallbacks NEVER enter this form: they are
 * delivery options, excluded from identity exactly like label, phase,
 * onError, retry, and replay. `effort` is absent exactly when no layer of
-* the chain and no role effort default resolves one (docs/04, section
-* "Router and resolution chain").
+* the chain and no role effort default resolves one.
 */
 type CanonicalModelSpec = {
   kind: "model";
@@ -530,7 +512,7 @@ type CanonicalModelSpec = {
 type TriggerClass = "error" | "limit" | "schema-exhausted" | "verify-failed" | "no-progress";
 /**
 * Ladder acceptance gates. Spot-check sibling selection is strictly via
-* ctx.random, never Math.random (docs/04, section "ModelLadder summary").
+* ctx.random, never Math.random.
 */
 type Gate = {
   kind: "mechanical";
@@ -544,7 +526,7 @@ type Gate = {
 };
 /**
 * The author-facing ladder declaration. This is the SINGLE declaration of
-* the ladder family: docs/07 references it and never redeclares (runtime
+* the ladder family: other layers reference it and never redeclare (runtime
 * semantics land in M7).
 */
 interface LadderSpec {
@@ -570,7 +552,7 @@ interface CanonicalLadderSpec {
     maxCostUsd?: number;
     memoizeOutcome?: boolean;
   }>;
-  /** After clamping of any orchestrator model_hint (docs/07). */
+  /** After clamping of any orchestrator model_hint. */
   startTier: number;
   escalateOn: TriggerClass[];
   acceptance?: Gate[];
@@ -581,29 +563,27 @@ interface CanonicalLadderSpec {
 * Versions the ENTIRE identity and replay pipeline as one unit: canonical
 * JSON algorithm, identity field sets, hash function, schema/toolset hash
 * derivation, scope grammar and ordinal rules, replay predicate, fold
-* defaults, and the kind/status vocabularies (docs/03, section
-* "hashVersion").
+* defaults, and the kind/status vocabularies.
 */
 type HashVersion = number;
 /** 1 = round 1; 2 = current. */
 declare const CURRENT_HASH_VERSION: HashVersion;
 /**
-* The single kinds registry v2 (docs/03, section "Kinds registry v2").
+* The single kinds registry v2.
 * Readers MUST tolerate unknown kinds; stores pass them through
 * byte-for-byte (obligation A4).
 */
 type EntryKind = "agent" | "step" | "child" | "external" | "approval" | "rand" | "decision" | "plan.revision" | "plan.decision" | "ledger.op" | "resolution" | "abandon" | "node.link" | "termination.init" | "termination.denied";
 /**
 * The stored status vocabulary, exactly. 'skipped' is DELIBERATELY absent:
-* it is a derived fold status, never persisted (docs/03, section "Stored
-* status vocabulary").
+* it is a derived fold status, never persisted.
 */
 type EntryStatus = "running" | "ok" | "error" | "limit" | "suspended" | "cancelled" | "escalated";
-/** The canonical EntryRef between entries is seq (docs/03, section "Full entry identity"). */
+/** The canonical EntryRef between entries is seq. */
 type EntryRef = number;
-/** The journaled by-source of a resolution (docs/03, section 8.6 mapping table). */
+/** The journaled by-source of a resolution. */
 type ResolutionBy = "external" | "timeout" | "class_decision" | "operator" | "quiescence" | "engine_fallback";
-/** Payload of resolution ref-entries (docs/03, section 8.6; DEF-4). */
+/** Payload of resolution ref-entries (DEF-4). */
 type ResolutionPayload = {
   /** Duplicates ref for self-description. */target: number;
   by: ResolutionBy; /** awaitExternal resolution / EscalationDecision / WakeDigest. */
@@ -612,7 +592,7 @@ type ResolutionPayload = {
   logicalTaskId?: string; /** Only on escalation resolutions (DEF-3, M7). */
   countsAgainstLimit?: boolean;
 };
-/** Payload of abandon ref-entries (docs/03, section 8.6; DEF-4/DEF-5). */
+/** Payload of abandon ref-entries (DEF-4/DEF-5). */
 type AbandonPayload = {
   /** Seq of the abandoned branch's spawn entry. */target: number; /** Seq of the plan.revision or decision entry sanctioning it. */
   authorizedBy: number;
@@ -623,7 +603,7 @@ type AbandonPayload = {
   retainWorktree?: boolean;
 };
 /**
-* Final entry form (hashVersion 2; docs/03, section "JournalEntry form").
+* Final entry form (hashVersion 2).
 * All journaled values MUST be JSON-serializable; a violation raises a
 * typed NonSerializableValueError at the call site. append is serialized
 * by a per-run queue.
@@ -652,21 +632,20 @@ type JournalEntry = {
   /**
   * Terminal agent entries: the Artifact list (worktree patch refs and
   * inline values); rides the terminal payload so replay reconstructs
-  * AgentResult.artifacts without live calls (docs/06, section 2.1).
+  * AgentResult.artifacts without live calls.
   */
   artifacts?: Json;
   /**
   * Terminal escalated entries ONLY: the schema-validated
   * EscalationReport with runtime-filled costToDate and salvage; replay
-  * synthesizes the byte-identical report from here (docs/03, section
-  * 5.4; DEF-1).
+  * synthesizes the byte-identical report from here (DEF-1).
   */
   escalation?: Json; /** Only when kind === 'resolution'. */
   resolution?: ResolutionPayload; /** Only when kind === 'abandon'. */
   abandon?: AbandonPayload;
   /**
-  * Policy field on agent entries, fixed in the payload at dispatch time
-  * (docs/03, section "Normative payload schemas"): the M2 predicate reads
+  * Policy field on agent entries, fixed in the payload at dispatch
+  * time: the M2 predicate reads
   * the flag from the ENTRY, never from current code. Excluded from
   * identity like every policy field.
   */
@@ -676,7 +655,7 @@ type JournalEntry = {
   startedAt: string;
   endedAt?: string;
 };
-/** Rand-entry payload (docs/03, section "Normative payload schemas"). */
+/** Rand-entry payload. */
 type RandPayload = {
   subtype: "now";
   value: number;
@@ -691,8 +670,7 @@ type RandPayload = {
 /**
 * Round-1 normalization: hashVersion is taken from `hashVersion`, else
 * from the legacy `v` field, else 1. Stores are never rewritten;
-* normalization happens at read (docs/03, section "The single versioning
-* mechanism").
+* normalization happens at read.
 */
 declare function normalizeEntry(raw: unknown): JournalEntry;
 //#endregion
@@ -706,8 +684,7 @@ type Lease = {
 /**
 * Run-level metadata written by the ENGINE via putMeta as a separate
 * record, so listRuns never parses payloads. The hashVersion range fields
-* are advisory only; the journal is authoritative (docs/03, section
-* "RunMeta").
+* are advisory only; the journal is authoritative.
 */
 type RunMeta = {
   runId: string;
@@ -736,8 +713,7 @@ interface JournalStore {
 /**
 * Lease capability: acquire on a held lease MUST reject with a typed
 * LeaseHeldError; renew MUST run at an interval of at most ttl/3; an
-* append carrying a stale epoch MUST be rejected and never appear in load
-* (docs/03, section "LeasableStore").
+* append carrying a stale epoch MUST be rejected and never appear in load.
 */
 interface LeasableStore extends JournalStore {
   acquire(runId: string, owner: string): Promise<Lease>;
@@ -928,13 +904,12 @@ type SchemaPair<T = unknown> = {
 /**
 * The L0 schema contract with exactly three accepted forms: a Standard
 * Schema (Zod, ArkType, Valibot, ...), a { jsonSchema, validate } pair, or
-* a bare JSON Schema literal (docs/08, section "The three forms").
+* a bare JSON Schema literal.
 */
 type SchemaSpec<T = unknown> = StandardSchemaV1<unknown, T> | SchemaPair<T> | JsonSchema;
 /**
 * Inferred output type per form: the Standard Schema output type; the
-* type-guard target of validate(); unknown for a bare JSON Schema
-* (docs/08, section "Out<S> inference").
+* type-guard target of validate(); unknown for a bare JSON Schema.
 */
 type Out<S> = S extends StandardSchemaV1 ? StandardSchemaV1.InferOutput<S> : S extends {
   validate: (value: unknown) => value is infer T;
@@ -948,8 +923,7 @@ declare function isStandardSchemaSpec(spec: SchemaSpec): spec is StandardSchemaV
 /** Form-2 guard: an explicit { jsonSchema, validate } pair. */
 declare function isSchemaPairSpec(spec: SchemaSpec): spec is SchemaPair;
 /**
-* Derives the JSON Schema of a SchemaSpec (docs/08, section "JSON Schema
-* derivation and acceptance rules"). Form 1 projects via the
+* Derives the JSON Schema of a SchemaSpec. Form 1 projects via the
 * StandardJSONSchemaV1 input() converter, target draft 2020-12 with
 * draft-07 fallback; a library without the projection is a typed
 * ConfigError at definition time, never at first call. Transforming
@@ -958,8 +932,7 @@ declare function isSchemaPairSpec(spec: SchemaSpec): spec is SchemaPair;
 */
 declare function projectToJsonSchema(spec: SchemaSpec): JsonSchema;
 /**
-* Canonical schema derivation (docs/03, section "schemaHash and
-* toolsetHash derivation"): local fragment-only $ref inlined (recursion is
+* Canonical schema derivation: local fragment-only $ref inlined (recursion is
 * a ConfigError), remote and dynamic references forbidden, annotation
 * keywords stripped (format retained), reference infrastructure ($defs,
 * definitions, $anchor) removed once inlined. The result feeds JCS
@@ -968,8 +941,7 @@ declare function projectToJsonSchema(spec: SchemaSpec): JsonSchema;
 declare function canonicalizeSchema(schema: JsonSchema): JsonSchema;
 /**
 * The schemaHash used when no structured-output schema is declared: the
-* hash of the canonical `true` schema (docs/03, section "schemaHash and
-* toolsetHash derivation").
+* hash of the canonical `true` schema.
 */
 declare const EMPTY_SCHEMA_HASH: string;
 /** The toolsetHash of an empty toolset: the hash of the canonical empty contract array. */
@@ -986,8 +958,7 @@ declare function schemaHashOfSpec(spec: SchemaSpec | undefined): string;
 * contract tuples (name, description, canonical parameters, version)
 * sorted by name. Tool description IS part of the contract; schema
 * annotations inside parameters are not. An absent version participates as
-* absent (docs/03, section "schemaHash and toolsetHash derivation";
-* docs/08, section "toolsetHash contract").
+* absent.
 */
 declare function toolsetHash(contracts: ToolContract[]): string;
 /** Result of validating a value against a SchemaSpec. */
@@ -999,7 +970,7 @@ type SchemaValidationResult<T = unknown> = {
   issues: Issue$1[];
 };
 /**
-* Runtime validation per form (docs/08, section "Runtime validation"):
+* Runtime validation per form:
 * form 1 via the Standard Schema's own validate, form 2 via the pair's
 * type guard, form 3 via the vendored draft 2020-12 validator. The same
 * machinery backs the structured-output tiers of the Agent Runtime.
@@ -1008,8 +979,8 @@ declare function validateSchemaSpec<S extends SchemaSpec>(spec: S, value: unknow
 //#endregion
 //#region src/l0/spi/provider.d.ts
 /**
-* Per-model pricing in USD per million tokens (docs/04, section
-* "Pricing"). The registry's versioned price table wins over adapter-
+* Per-model pricing in USD per million tokens. The registry's
+* versioned price table wins over adapter-
 * reported caps.pricing, which is a fallback only.
 */
 interface Pricing {
@@ -1035,8 +1006,8 @@ interface ProviderAdapter {
   /** Stable adapter id; the left segment of ModelRef. */
   id: string;
   /**
-  * Provider family for provider-raw matching and retention (docs/04,
-  * section 2.3; committed during M4-T02). Two adapters of the same
+  * Provider family for provider-raw matching and retention (committed
+  * during M4-T02). Two adapters of the same
   * family share retained blocks and projections; default = id.
   */
   provider?: string;
@@ -1050,7 +1021,7 @@ interface ProviderAdapter {
 //#region src/l0/spi/isolation.d.ts
 /**
 * The canonical identity encoding of spawn isolation: this exact value
-* domain enters spawn identity (docs/03, section "Identity model").
+* domain enters spawn identity.
 * 'readonly' is a determinism and blast-radius declaration, not
 * containment.
 */
@@ -1076,19 +1047,18 @@ interface IsolationProvider {
 //#region src/l0/spi/toolsource.d.ts
 /**
 * Declarative risk metadata on the tool contract. Policy input, not
-* identity: it does NOT enter toolsetHash (docs/08, section "Risk
-* metadata and permission presets").
+* identity: it does NOT enter toolsetHash.
 */
 type ToolRisk = "read" | "write" | "network" | "execute" | "destructive";
 /**
 * The context handed to execute (and to permission hooks and canUseTool).
 * Deliberately exposes NO spawn primitives: tools are leaves of the
 * call-and-return tree (invariant I3); all spawning flows through Ctx
-* primitives (docs/08, section "ToolContext").
+* primitives.
 */
 interface ToolContext {
   runId: string;
-  /** Tool span in the run > phase > agent > tool hierarchy (docs/09). */
+  /** Tool span in the run > phase > agent > tool hierarchy. */
   spanId: string;
   agent: {
     agentType: string;
@@ -1106,23 +1076,21 @@ interface ToolContext {
 /**
 * Where execute runs. A declared capability consumed by dispatch and
 * policy; only 'inprocess' is enforced in v1, subprocess/container remain
-* declared capability until the executor spec closes (docs/08, section
-* "Executors"; OQ in docs/14).
+* declared capability while the executor design stays an open question.
 */
 type ToolExecutor = "inprocess" | "subprocess" | "container";
 /**
 * A defined tool. The identity projection is the ToolContract
 * { name, description, parameters, version }: exactly what the model sees
 * and exactly what toolsetHash hashes; execute and every other
-* non-contract field are excluded by construction (docs/08, section
-* "tool() definition and ToolDef").
+* non-contract field are excluded by construction.
 */
 interface ToolDef<S extends SchemaSpec = SchemaSpec> {
   readonly kind: "tool";
   readonly name: string;
   readonly description: string;
   readonly parameters: S;
-  /** Opaque contract version; part of toolsetHash (docs/08, section 1.2). */
+  /** Opaque contract version; part of toolsetHash. */
   readonly version?: string;
   /** Default 'inprocess'. */
   readonly executor: ToolExecutor;
@@ -1139,7 +1107,7 @@ interface ToolSourceSession {
 * The ToolSource seam: tools() yields the source's current ToolDefs. The
 * toolset snapshot for a given agent spawn is captured at spawn time and
 * hashed into the spawn's identity via toolsetHash; a mid-run change MUST
-* NOT mutate an in-flight agent's toolset (docs/08, section "MCP bus").
+* NOT mutate an in-flight agent's toolset.
 */
 interface ToolSource {
   id: string;
@@ -1149,7 +1117,7 @@ interface ToolSource {
 //#region src/l0/spi/knowledge.d.ts
 /**
 * Task-class vocabulary aligned with the role quality floors vocabulary
-* (docs/04, section "Role quality floors"). Scopeless global statements
+* (https://docs.rulvar.com/guide/model-routing). Scopeless global statements
 * are inexpressible: every claim binds a taskClass.
 */
 type TaskClass = "code-edit" | "investigation" | "synthesis" | "extraction" | "planning" | "judging" | (string & {});
@@ -1196,7 +1164,7 @@ interface ModelClaim {
   confidence: "high" | "medium" | "low";
   /** ISO date. */
   observedAt: string;
-  /** TTL by class and polarity (docs/05, section "Grounding and decay"). */
+  /** TTL by class and polarity (the grounding and decay rules). */
   expiresAt: string;
   /** Honestly best-effort drift signal. */
   modelEpoch?: {
@@ -1269,7 +1237,7 @@ type ClaimOp = {
   reason: "canary-drift";
 };
 /**
-* The SPI seam (docs/05, section "Data model"). commit performs CAS on
+* The SPI seam. commit performs CAS on
 * the monotonic snapshot version, mirroring the fencing-epoch
 * discipline of LeasableStore; concurrent maintenance commits serialize
 * through CAS rejection and rebase. commit is UNREACHABLE from the
@@ -1282,13 +1250,42 @@ interface ModelKnowledgeStore {
 /**
 * The runtime handle: with propose() deleted from the design and
 * commit absent from this shape, a run has no write path into the
-* cross-run medium at all (docs/05, section "Security", channel 3).
+* cross-run medium at all.
 */
 type ModelKnowledgeHandle = Pick<ModelKnowledgeStore, "current">;
+/** The closed trigger vocabulary of kb_propose (phase 3). */
+type KbProposalTrigger = "error" | "limit" | "schema-exhausted" | "verify-failed" | "no-progress" | "escalation";
+/**
+* One orchestrator model-knowledge proposal (phase 3). A proposal is a
+* run-ledger record, NOT a claim: it lives ONLY in the RunLedger
+* section modelObservations, is never rendered into any prompt of any
+* run before the human gate (absolute quarantine, the note included),
+* and reaches the gate exclusively through LedgerExport. The engine
+* assembles it from the tier-relative kb_propose payload: the subject
+* model is resolved by the engine from the referenced lineage's
+* declared ladder, never named by the orchestrator; evidence must
+* resolve into the proposing run's own decision entries.
+*/
+interface KbProposal {
+  subject: {
+    model: ModelRef;
+    effort?: Effort;
+  };
+  taskClass: TaskClass;
+  polarity: "strength" | "weakness";
+  trigger: KbProposalTrigger;
+  evidence: Array<{
+    kind: "journal";
+    runId: string;
+    entryRef: number;
+  }>;
+  /** <=200 chars; not rendered into any prompt before the gate. */
+  note?: string;
+}
 //#endregion
 //#region src/knowledge/decay.d.ts
 /**
-* The asymmetric TTL table (docs/05, section "Grounding and decay"):
+* The asymmetric TTL table:
 * a false negative is costlier through lock-in, so weaknesses expire
 * sooner than strengths.
 */
@@ -1304,37 +1301,45 @@ declare const CLAIM_TTL_DAYS: {
 };
 /** Inbox proposals expire after 14 days (reserved for M12 phase 3). */
 declare const INBOX_PROPOSAL_TTL_DAYS = 14;
-/** The docs/05 TTL applied to an observedAt ISO date. */
+/** The asymmetric TTL applied to an observedAt ISO date. */
 declare function claimExpiry(claimClass: ModelClaim["class"], polarity: ModelClaim["polarity"], observedAt: string): string;
-/** True when the claim steers nothing at `at` (docs/05, read-path filters). */
+/** True when the claim steers nothing at `at` (the read-path filter). */
 declare function claimExpired(claim: Pick<ModelClaim, "expiresAt">, at: string): boolean;
 /** The TTL state a maintenance view renders per claim. */
 type TtlState = "holds" | "expired";
 declare function ttlState(claim: Pick<ModelClaim, "expiresAt">, at: string): TtlState;
 /**
-* The re-measurement queue (docs/05, section "Grounding and decay"):
+* The re-measurement queue:
 * expired eval-measured claims that are still ACTIVE. Just a status
 * filter: the next sweep re-measures these subjects; nothing archives
 * them (archiving would empty the queue and hide the decay).
 */
 declare function remeasureQueue(claims: readonly ModelClaim[], at: string): ModelClaim[];
 /**
-* Deprecation maintenance (docs/05: "deprecations, which archive
-* claims, never delete them, so historical runs keep their audit
-* trail"): archive ops for every non-terminal claim of the deprecated
+* Deprecation maintenance (deprecations archive claims, never delete
+* them, so historical runs keep their audit trail): archive ops for
+* every non-terminal claim of the deprecated
 * models. The caller commits them under its own gate-free archive ops.
 */
 declare function archiveDeprecatedModelOps(claims: readonly ModelClaim[], deprecated: readonly ModelRef[]): ClaimOp[];
 //#endregion
 //#region src/knowledge/claims.d.ts
-/** docs/06, Appendix A: KB active-claims cap, default 8 per (model, taskClass). */
+/**
+* The typed statement template for a proposal-born claim (phase 3):
+* assembled over the closed enum vocabulary ONLY, so tool-output text
+* is unquotable into persistence, and model-free, because a claim
+* statement renders into the knowledge card's notes layer, which never
+* leaks model names to the orchestrator.
+*/
+declare function proposalStatement(proposal: Pick<KbProposal, "taskClass" | "polarity" | "trigger">): string;
+/** Appendix A: KB active-claims cap, default 8 per (model, taskClass). */
 declare const KB_ACTIVE_CLAIMS_CAP = 8;
-/** docs/05, section "Data model": statement <= 200 chars. */
+/** The committed data model bound: statement <= 200 chars. */
 declare const CLAIM_STATEMENT_MAX_CHARS = 200;
 interface ClaimValidationOptions {
   /**
-  * True on the eval-committer path (the eval-committer gate; docs/05,
-  * 5.4). Editorial validation leaves it false and both eval-measured
+  * True on the eval-committer path (the eval-committer gate).
+  * Editorial validation leaves it false and both eval-measured
   * claims and metrics reject. At the op level the GATE decides this
   * flag; the option exists for direct claim-level validation.
   */
@@ -1349,7 +1354,7 @@ declare function claimIssues(claim: ModelClaim, path: string, options?: ClaimVal
 */
 declare function claimOpIssues(op: ClaimOp, index: number): string[];
 /**
-* The commit-time cap (docs/06, Appendix A): active claims per
+* The commit-time cap (Appendix A): active claims per
 * (model, taskClass) after the batch applies. Supersede chains keep
 * only the head active by construction (applyClaimOps flips the prior
 * to 'superseded'), so a supersede never grows the count.
@@ -1393,9 +1398,9 @@ declare function knowledgeHash(claims: readonly ModelClaim[]): string;
 */
 declare function applyClaimOps(claims: readonly ModelClaim[], ops: readonly ClaimOp[]): ModelClaim[];
 interface FileModelKnowledgeStoreOptions {
-  /** Default './rulvar.models.json' (docs/05, section "Data model"). */
+  /** Default './rulvar.models.json'. */
   path?: string;
-  /** docs/06, Appendix A: active claims per (model, taskClass); default 8. */
+  /** Active claims per (model, taskClass); default 8. */
   activeClaimsCap?: number;
 }
 declare class FileModelKnowledgeStore implements ModelKnowledgeStore {
@@ -1414,9 +1419,9 @@ declare class FileModelKnowledgeStore implements ModelKnowledgeStore {
 type LogicalTaskId = string;
 /** The closed relation vocabulary of the minting and inheritance table. */
 type LineageRelation = "first" | "respawn" | "rung-retry" | "decompose-child" | "unpark-restart";
-/** approachSig/approachSigCoarse derivation version (docs/03, 10.7). */
+/** approachSig/approachSigCoarse derivation version. */
 declare const LINEAGE_SIG_VERSION: 1;
-/** Deterministic LTIDs canonized onto legacy journals (docs/03, 10.7). */
+/** Deterministic LTIDs canonized onto legacy journals. */
 declare const LEGACY_LTID_PREFIX = "legacy:";
 /** The computed lineage record of one spawn-authorizing decision entry. */
 interface LineageRef {
@@ -1434,14 +1439,14 @@ interface LineageRef {
 }
 /**
 * The value-part lineage block embedded in decision entries: the computed
-* LineageRef plus the normalized tag (docs/03, 10.6: the request part
+* LineageRef plus the normalized tag (the request part
 * holds the RAW proposal; the value part holds what was COMPUTED and is
 * reused byte-exact on replay).
 */
 interface SpawnLineage extends LineageRef {
   approachTag: string;
 }
-/** Attempt outcome classes entering LineageStats (docs/03, 10.3). */
+/** Attempt outcome classes entering LineageStats. */
 type AttemptOutcomeClass = "ok" | "escalated" | "task-error" | "transient-error" | "no-progress" | "verify-failed" | "limit" | "abandoned";
 /**
 * The pure lineage fold rendered in plan_view and WakeDigest, always
@@ -1484,13 +1489,13 @@ declare const DEFAULT_ESCALATION_LIMITS: EscalationLimits;
 */
 declare function validateEscalationLimits(raw?: Partial<EscalationLimits> | Record<string, unknown>): EscalationLimits;
 /**
-* Approach-tag normalization (docs/03, 10.2): NFC, lowercase, runs of
+* Approach-tag normalization: NFC, lowercase, runs of
 * non-alphanumerics collapse into a hyphen, truncate to 32 characters; an
 * empty value canonicalizes to 'default'. Prompt prose never enters any
 * signature: rephrasings collide by construction, not by heuristic.
 */
 declare function normalizeApproachTag(raw?: string): string;
-/** The isolation string entering approachSigCoarse (docs/03, 10.3). */
+/** The isolation string entering approachSigCoarse. */
 declare function canonicalIsolationTag(spec: IsolationSpec | undefined): string;
 /** The identity inputs of the coarse signature (prompt prose excluded). */
 interface ApproachSignatureInputs {
@@ -1502,7 +1507,7 @@ interface ApproachSignatureInputs {
 /**
 * approachSigCoarse = sha256(JCS({ sigVersion, agentType, toolsetHash,
 * schemaHash, isolation })). Feeds the stall detector and the oscillation
-* guard, which keys ACROSS LTID boundaries (docs/07, 3.8).
+* guard, which keys ACROSS LTID boundaries.
 */
 declare function approachSigCoarse(inputs: ApproachSignatureInputs): string;
 /** approachSig = sha256(JCS({ sigVersion, coarse, approachTag })); keys lessons. */
@@ -1511,7 +1516,7 @@ declare function approachSigOf(coarse: string, tag?: string): string;
 * The deterministic signature inputs assigned to legacy spawns (journals
 * written before lineage existed) and to attempts whose producers did not
 * record signature inputs: stable constants, never wall-clock, so replay
-* canonizes identically on every engine (docs/03, 10.7).
+* canonizes identically on every engine.
 */
 declare const LEGACY_SIGNATURE_INPUTS: ApproachSignatureInputs;
 /** Classifies one settled root terminal into its attempt outcome class. */
@@ -1520,8 +1525,7 @@ declare function classifyAttemptOutcome(terminal: JournalEntry): AttemptOutcomeC
 * The incremental lineage fold: attempts, escalation debits, stall
 * streaks, single-live-attempt, and legacy canonization, computed from
 * journal entries only. `absorb` is idempotent by seq cursor; every read
-* accepts an optional `uptoSeq` pin so renders stay snapshot-stable
-* (docs/03, 10.4; docs/07, 8.3).
+* accepts an optional `uptoSeq` pin so renders stay snapshot-stable.
 */
 declare class LineageIndex {
   private readonly attemptsByLtid;
@@ -1551,7 +1555,7 @@ declare class LineageIndex {
   * attempt whose bound key matches (an at-least-once redispatch of the
   * same slot after cancelled/error/limit); else a legacy attempt is
   * canonized with the deterministic 'legacy:' + contentHash LTID
-  * (docs/03, 10.7: random ULIDs on replay are forbidden).
+  * (random ULIDs on replay are forbidden).
   */
   private bindRoot;
   private recordEscalation;
@@ -1562,12 +1566,12 @@ declare class LineageIndex {
   * True while the LTID has an unsettled attempt (admitted, dispatched, or
   * redispatched without a terminal), including admits whose decision
   * entries have not landed yet. Backs the single-live-attempt invariant:
-  * a competing admit gets `lineage_busy` (docs/03, 10.5).
+  * a competing admit gets `lineage_busy`.
   */
   hasLiveAttempt(logicalTaskId: LogicalTaskId): boolean;
-  /** The stall streak per docs/03, 10.4 (pinnable to a snapshot seq). */
+  /** The stall streak (pinnable to a snapshot seq). */
   stallStreak(logicalTaskId: LogicalTaskId, uptoSeq?: number): number;
-  /** The pinned LineageStats render (docs/03, 10.3). */
+  /** The pinned LineageStats render. */
   statsOf(logicalTaskId: LogicalTaskId, uptoSeq?: number): LineageStats;
   /** Every LTID the fold has seen (diagnostics and renders). */
   knownLogicalTaskIds(): LogicalTaskId[];
@@ -1581,14 +1585,14 @@ interface AgentIdentityInput {
   /**
   * The REQUESTED model spec, including canonical effort where resolved;
   * for laddered spawns it embeds the declared ladder together with
-  * startTier (docs/04, section "Router and resolution chain").
+  * startTier.
   */
   modelSpec: CanonicalModelSpec;
   /** Replaced verbatim by opts.key when opts.key is set. */
   prompt: string;
   schemaHash: string;
   toolsetHash: string;
-  /** Canonical encoding per docs/08, section "IsolationSpec". */
+  /** The canonical IsolationSpec encoding (see https://docs.rulvar.com/guide/tools). */
   isolation: IsolationSpec;
 }
 /** Nested workflow spawns: ctx.workflow (kind 'child'). */
@@ -1630,8 +1634,8 @@ type IdentityInput = AgentIdentityInput | ChildIdentityInput | StepIdentityInput
 /**
 * The identity projection of a CanonicalModelSpec. For the plain-model
 * kind the projection is `{ model, effort? }` WITHOUT the kind
-* discriminant, exactly as fixed by the docs/03 section 1.5 worked
-* example; `effort` is omitted when unresolved. The ladder embedding lands
+* discriminant, exactly as frozen by the hashVersion 2 profile;
+* `effort` is omitted when unresolved. The ladder embedding lands
 * with ladder execution (M7).
 */
 declare function modelSpecIdentity(spec: CanonicalModelSpec): {
@@ -1651,7 +1655,7 @@ declare function projectIdentity(input: IdentityInput): Record<string, unknown>;
 /** The JCS form of an IdentityInput under the hashVersion 2 profile. */
 declare function identityJcs(input: IdentityInput): string;
 /**
-* key = sha256(JCS(IdentityInput)) (docs/03, section "Content key").
+* key = sha256(JCS(IdentityInput)).
 */
 declare function deriveContentKey(input: IdentityInput): string;
 //#endregion
@@ -1664,8 +1668,8 @@ interface JournalOperation {
 /**
 * Versioned key derivation for matching: the live call is compared
 * against every unconsumed entry with the key computed UNDER THAT ENTRY'S
-* VERSION; 'incomparable' is a guaranteed non-match (docs/03, section
-* 4.4). M2-T05 supplies the real registry; the default ring knows only
+* VERSION; 'incomparable' is a guaranteed non-match.
+* M2-T05 supplies the real registry; the default ring knows only
 * the current version.
 */
 /** A derived key, or the guaranteed non-match marker. */
@@ -1717,7 +1721,7 @@ declare class JournalMatcher {
   private readonly keyRing;
   private disposition;
   private aliasDisposition?;
-  /** Scope-prefix aliases (DEF-5, docs/03 9.5): donor prefix -> target prefix. */
+  /** Scope-prefix aliases (DEF-5): donor prefix -> target prefix. */
   private readonly aliases;
   private readonly keyCache;
   private hitsInternal;
@@ -1731,8 +1735,8 @@ declare class JournalMatcher {
   /** M2-T06 swaps in the full DEF-1 predicate after folds are built. */
   setDisposition(disposition: (op: JournalOperation) => OperationDisposition): void;
   /**
-  * The disposition applied to alias-sourced candidates (DEF-5, docs/03
-  * 9.5): the skipped overlay from abandon is bypassed ONLY through the
+  * The disposition applied to alias-sourced candidates (DEF-5): the
+  * skipped overlay from abandon is bypassed ONLY through the
   * alias, so entries regain their pre-abandon terminal status for
   * matching in the NEW scope; the standalone old scope stays skipped.
   */
@@ -1751,7 +1755,7 @@ declare class JournalMatcher {
   * Forward-matches one live call. A miss does not advance any cursor and
   * does not extinguish future hits: the scan always starts at the scope
   * head and skips consumed operations, so insertion stability holds by
-  * construction (docs/03, section 7.1).
+  * construction.
   */
   match(scope: string, identity: IdentityInput, mode: "scoped" | "cache" | "never"): MatchResult;
   /** Marks an operation consumed without matching (fold-driven paths). */
@@ -1764,8 +1768,8 @@ declare class JournalMatcher {
 type CanonicalIdentity = Record<string, unknown>;
 /**
 * Per-effective-status disposition rules; DATA on the profile, consumed
-* only by the single canonical replayDisposition function (docs/03,
-* section 4.2: there is NO replayAction method).
+* only by the single canonical replayDisposition function (there is NO
+* replayAction method).
 */
 type DispositionRule = "replay" | "rerun" | "memoize-limit" | "memoize-task-error";
 type DispositionTable = Readonly<Partial<Record<"ok" | "escalated" | "limit" | "error" | "cancelled" | "running", DispositionRule>>>;
@@ -1794,20 +1798,19 @@ declare const deriverV1: KeyDeriver;
 type DeriverRegistry = ReadonlyMap<HashVersion, KeyDeriver>;
 /**
 * Builds the per-engine deriver registry: the shipped v1/v2 profiles plus
-* EngineOptions.extraDerivers, the ONLY window extender (docs/03, section
-* 4.5). A malformed extra deriver is a ConfigError before any run effect.
+* EngineOptions.extraDerivers, the ONLY window extender. A malformed
+* extra deriver is a ConfigError before any run effect.
 */
 declare function buildDeriverRegistry(extraDerivers?: readonly unknown[]): DeriverRegistry;
 /**
 * The one compatibility scan: immediately after load, strictly BEFORE any
 * live call, any append, and any admission reserve; repeated at lease
-* acquire in queue mode (docs/03, section 4.5). Side-effect free.
+* acquire in queue mode. Side-effect free.
 */
 declare function scanJournalCompatibility(runId: string, entries: readonly JournalEntry[], registry: DeriverRegistry): void;
 /**
 * KeyRing over the registry: the live call is projected DOWN into the
-* profile of the stored entry; there is no upward canonization (docs/03,
-* section 4.7).
+* profile of the stored entry; there is no upward canonization.
 */
 declare function registryKeyRing(registry: DeriverRegistry): KeyRing;
 //#endregion
@@ -1820,12 +1823,12 @@ interface AbandonFold {
 type ErrorClass = "transport" | "task";
 /**
 * task-class: schema-mismatch, terminal, non-retryable tool. transport,
-* rate-limit, and budget are never memoized (docs/03, section 6.4).
+* rate-limit, and budget are never memoized.
 */
 declare function classifyAgentError(e: AgentError): ErrorClass;
 /**
 * The child scope-prefix an abandon over `target` covers transitively.
-* Agent spawns nest under agent:<seq> (docs/03, section 2.2); a child
+* Agent spawns nest under agent:<seq>; a child
 * workflow's subtree runs under the wf:<name>:<ordinal> scope recorded in
 * its dispatch payload (M6-T06). A child entry without the payload
 * (foreign journals) degrades to the agent:<seq> convention, which covers
@@ -1836,7 +1839,7 @@ declare function childCoveragePrefix(target: JournalEntry): string;
 * Builds the AbandonFold in ONE pass at load, in append order, pinned for
 * the entire resume (DEF-1 ordering rule 4). Coverage is the target seq
 * itself plus, transitively, every entry under the target's child
-* scope-prefix (docs/03, sections 6.2 and 8.4). Repeated abandons over an
+* scope-prefix. Repeated abandons over an
 * already-covered target fold to noop.
 */
 declare function buildAbandonFold(entries: readonly JournalEntry[]): AbandonFold;
@@ -1894,7 +1897,7 @@ type SuspensionState = {
   state: "abandoned";
   by: number;
 };
-/** Fold classification of one ref-entry; NEVER persisted (docs/03, section 8.4). */
+/** Fold classification of one ref-entry; NEVER persisted. */
 type RefEntryClassification = {
   classification: "applied";
 } | {
@@ -1913,7 +1916,7 @@ type RefEntryClassification = {
 * schema-invalid offline resolution classifies invalid and does NOT close
 * the target. Abandon coverage is the target seq plus the transitive
 * child scope-prefix; the AbandonFold consumed by the replay predicate is
-* a projection of THIS fold (docs/03, section 6.2: not a separate pass).
+* a projection of THIS fold (not a separate pass).
 */
 declare class ResolutionFold {
   private readonly targets;
@@ -1955,8 +1958,8 @@ interface RefEntryAppender {
   }): Promise<JournalEntry>;
 }
 /**
-* Per-run, per-target FIFO serializer of resolution/abandon attempts
-* (docs/03, section 8.5): classification against the in-memory fold ->
+* Per-run, per-target FIFO serializer of resolution/abandon attempts:
+* classification against the in-memory fold ->
 * durable append -> settle exactly once; losing attempts are ALSO
 * appended and become journaled noops by fold classification. Winner
 * effects run strictly after the critical section (the caller's job).
@@ -1974,7 +1977,7 @@ declare class ResolutionArbiter {
 //#endregion
 //#region src/journal/replayer.d.ts
 type ReplayMode = "scoped" | "cache" | "never";
-/** docs/06 Appendix A: large-value soft warn threshold (committed for M2). */
+/** Large-value soft warn threshold (committed for M2). */
 declare const LARGE_VALUE_WARN_BYTES = 262144;
 interface Ledger {
   usage: Usage;
@@ -2009,7 +2012,7 @@ interface TerminalPatch {
   servedBy?: ModelRef;
   transcriptRef?: string;
   checkpointRef?: string;
-  /** Terminal agent entries: Artifact list (docs/06, section 2.1). */
+  /** Terminal agent entries: Artifact list. */
   artifacts?: unknown;
   /** Terminal escalated entries: the validated EscalationReport. */
   escalation?: unknown;
@@ -2017,14 +2020,14 @@ interface TerminalPatch {
   * Engine-decided terminal abort classes (the no-progress abort) stamp
   * memoizeOutcome on the TERMINAL entry so the frozen memoize rules
   * replay them on every resume; the running entry keeps the user's
-  * policy verbatim (docs/03, section 6.6, M3 amendment).
+  * policy verbatim (M3 amendment).
   */
   memoizeOutcome?: boolean;
   site?: string;
 }
 /**
 * Per-run journal kernel front end. Everything is per instance: no module
-* state anywhere (docs/02, section "Dependency rules").
+* state anywhere.
 */
 declare class Replayer {
   private readonly runId;
@@ -2047,44 +2050,44 @@ declare class Replayer {
     runId: string;
     store: JournalStore;
     now?: () => number;
-    priceUsd?: (servedBy: ModelRef | undefined, usage: Usage) => number | undefined; /** Receives large-value soft warnings (docs/03: never an error). */
+    priceUsd?: (servedBy: ModelRef | undefined, usage: Usage) => number | undefined; /** Receives large-value soft warnings (never an error). */
     onWarn?: (msg: string) => void;
-    largeValueWarnBytes?: number; /** The loaded, normalized prior journal (resume; docs/03 section 7). */
+    largeValueWarnBytes?: number; /** The loaded, normalized prior journal (resume). */
     priorEntries?: readonly JournalEntry[];
     keyRing?: KeyRing;
     disposition?: (op: JournalOperation) => OperationDisposition; /** Replay-strict: any live-class match throws JournalMissError. */
     strict?: boolean;
     /**
     * Queue mode: every append carries this lease so a stale holder's
-    * writes are rejected by the fencing epoch (docs/03, section 12.3;
-    * M8 entry amendment). Absent means the single-writer precondition
+    * writes are rejected by the fencing epoch (M8 entry amendment).
+    * Absent means the single-writer precondition
     * is asserted instead of fenced (the embedded default).
     */
     lease?: Lease;
   });
   /**
-  * Forward-matches one live call against the prior journal (docs/03,
-  * section 7). Fresh runs always miss; the M2-T06 predicate is injected
+  * Forward-matches one live call against the prior journal. Fresh
+  * runs always miss; the M2-T06 predicate is injected
   * through setDisposition once folds are built.
   */
   match(scope: string, identity: IdentityInput, mode: ReplayMode): MatchResult;
   setDisposition(disposition: (op: JournalOperation) => OperationDisposition): void;
   /**
-  * The disposition for alias-sourced candidates (DEF-5, docs/03 9.5):
+  * The disposition for alias-sourced candidates (DEF-5):
   * bypasses the abandon overlay so donor entries regain their
   * pre-abandon terminal status when matched through the alias.
   */
   setAliasDisposition(disposition: (op: JournalOperation) => OperationDisposition): void;
   /**
-  * Registers a node.link scope-prefix rewrite (DEF-5, docs/03 9.5):
+  * Registers a node.link scope-prefix rewrite (DEF-5):
   * donorPrefix forward-matches into targetPrefix at every nested level.
   * Idempotent; the alias map is rebuilt by fold on resume.
   */
   registerAlias(donorPrefix: string, targetPrefix: string): void;
   /**
-  * invalidate/retry (docs/03, section 6.5): explicit unpinning of a
+  * invalidate/retry: explicit unpinning of a
   * memoized failure; the invalidated entry reruns on this resume. The
-  * safety boundary is an open question (docs/14).
+  * safety boundary is an open question.
   */
   invalidate(seq: number): void;
   get invalidatedSeqs(): ReadonlySet<number>;
@@ -2101,15 +2104,15 @@ declare class Replayer {
     abandon?: AbandonPayload;
   }): Promise<JournalEntry>;
   /**
-  * Submits a resolution attempt through the per-target FIFO arbiter
-  * (docs/03, section 8.7). Losing attempts are journaled noops.
+  * Submits a resolution attempt through the per-target FIFO arbiter.
+  * Losing attempts are journaled noops.
   */
   resolveSuspended(target: number, attempt: ResolutionAttempt): Promise<ResolutionOutcome>;
   abandonBranch(attempt: AbandonAttempt): Promise<ResolutionOutcome>;
-  /** Pure fold view, snapshot-pinned (docs/03, section 8.7). */
+  /** Pure fold view, snapshot-pinned. */
   suspensionState(target: number): SuspensionState;
   /**
-  * Value size policy (docs/03, section "Normative payload schemas"):
+  * Value size policy:
   * there is NO automatic offload in v1; oversized values warn and
   * proceed. Large artifacts belong in TranscriptStore by reference.
   */
@@ -2120,7 +2123,7 @@ declare class Replayer {
   * Two-phase dispatch: the running entry (kinds agent, step, child).
   * `value` is legal on child dispatches only: the child payload
   * `{ workflow, childScope }` lets the abandon fold compute the child's
-  * transitive scope coverage (docs/03, section 8.4; M6-T06). Values
+  * transitive scope coverage (M6-T06). Values
   * never enter identity.
   */
   appendRunning(input: BaseAppend & {
@@ -2137,8 +2140,7 @@ declare class Replayer {
   /** Suspended kinds (external, approval): appended once, closed by ref-entries (M2). */
   appendSuspended(input: SuspendedAppend): Promise<JournalEntry>;
   /**
-  * The budget ledger fold (docs/03, section "Budget ledger fold on
-  * resume"): usage sums over terminal entries exactly once; agentsSpawned
+  * The budget ledger fold: usage sums over terminal entries exactly once; agentsSpawned
   * counts agent dispatches.
   */
   ledger(): Ledger;
@@ -2174,9 +2176,8 @@ declare const DEFAULT_RETRY_POLICY: RetryPolicy;
 /**
 * Classifies a WireError for the retry engine. Task-class failures are
 * never retryable by construction: adapters mark them retryable: false
-* and this returns undefined. The kind travels in WireError.data.kind
-* (docs/04, section 4.9); anything retryable without a specific kind is
-* transport.
+* and this returns undefined. The kind travels in WireError.data.kind;
+* anything retryable without a specific kind is transport.
 */
 declare function retryClassOf(error: WireError): RetryClass | undefined;
 /**
@@ -2191,13 +2192,13 @@ declare function retryDelayMs(policy: RetryPolicy, retryIndex: number, retryAfte
 //#region src/model/failover.d.ts
 /** Transport-level failover triggers; budget is explicitly excluded. */
 type FailoverTrigger = "transport" | "rate-limit";
-/** One resolved failover target (docs/04, section 11.2 rich form). */
+/** One resolved failover target (rich form). */
 interface FailoverTarget {
   model: ModelRef;
   /** Triggers this target serves; absent = both. */
   on?: FailoverTrigger[];
 }
-/** Normalizes the author-facing ModelChoice.fallbacks list (docs/04, 8.1). */
+/** Normalizes the author-facing ModelChoice.fallbacks list. */
 declare function normalizeFallbacks(refs: ModelRef[] | undefined): FailoverTarget[];
 /**
 * Maps a retry class to its failover trigger once retries exhaust.
@@ -2211,7 +2212,7 @@ declare function failoverTriggerOf(retryClass: RetryClass | undefined): Failover
 * moves backwards (sticky failover).
 */
 declare function nextFailover(targets: Array<Pick<FailoverTarget, "on">>, trigger: FailoverTrigger, from: number): number | undefined;
-/** The degenerate fallback triggers (docs/04, section 11.3). */
+/** The degenerate fallback triggers. */
 type FallbackTrigger = "error" | "limit" | "schema-exhausted";
 /** The degenerate fallback field: one agent-level second attempt. */
 interface FallbackField {
@@ -2219,8 +2220,8 @@ interface FallbackField {
   on: FallbackTrigger[];
 }
 /**
-* Classifies a terminal agent outcome for the degenerate fallback
-* (docs/04, 11.3 as amended): schema-mismatch errors are
+* Classifies a terminal agent outcome for the degenerate fallback:
+* schema-mismatch errors are
 * 'schema-exhausted'; any other error is 'error'; limit terminals (the
 * no-progress abort included) are 'limit'; cancelled, escalated, and
 * skipped never trigger.
@@ -2325,8 +2326,7 @@ declare function decodeCheckpoint(blob: Uint8Array): CheckpointState | undefined
 //#region src/model/router.d.ts
 /**
 * Per-engine adapter registry: strictly per engine, no global mutable
-* registry exists. A duplicate adapterId is a typed ConfigError
-* (docs/04, section "Registry and ModelRef").
+* registry exists. A duplicate adapterId is a typed ConfigError.
 */
 declare function buildAdapterRegistry(adapters: ProviderAdapter[]): ReadonlyMap<string, ProviderAdapter>;
 /**
@@ -2339,12 +2339,10 @@ declare function parseModelRef(ref: ModelRef): {
   model: string;
 };
 /**
-* Role effort defaults (docs/04, section "Invocation roles and firing
-* protocol"): orchestrate and plan default to high; summarize and extract
+* Role effort defaults: orchestrate and plan default to high; summarize and extract
 * default to low. loop and finalize have NO role default: when the chain
 * resolves nothing, the wire omits effort and identity records the spec
-* with the effort member absent (docs/04, section "Router and resolution
-* chain", as amended).
+* with the effort member absent.
 */
 declare const ROLE_EFFORT_DEFAULTS: Partial<Record<InvocationRole, Effort>>;
 /** One layer's contribution to the resolution merge. */
@@ -2374,7 +2372,7 @@ interface ResolvedInvocation {
   requestedEffort?: Effort;
   providerOptions?: Record<string, Record<string, unknown>>;
   fallbacks?: ModelRef[];
-  /** Identity-facing canonical form (docs/04, section "Router and resolution chain"). */
+  /** Identity-facing canonical form. */
   canonical: CanonicalModelSpec;
   scrubs: ScrubNote[];
 }
@@ -2382,7 +2380,7 @@ interface ResolvedInvocation {
 * Resolution runs on every model invocation, not once per agent: a layered
 * merge of { model, effort, providerOptions, fallbacks } in the order call
 * override > agent profile > workflow defaults > engine defaults, with the
-* invocation role attached as a tag (docs/04, section "Resolution chain").
+* invocation role attached as a tag.
 * After resolution the router reads ModelCaps and scrubs illegal
 * parameters visibly: unsupported effort is removed from the wire but
 * kept in identity; sampling params rejected by the model are removed
@@ -2399,7 +2397,7 @@ declare function resolveModelInvocation(options: {
   taskClass?: string;
 }): ResolvedInvocation;
 /**
-* Canonicalizes a declared LadderSpec (docs/04, section 12): validates the
+* Canonicalizes a declared LadderSpec: validates the
 * shape once (FR-119 judge declaration included) and resolves every rung's
 * effort to an explicit value. `chainEffort` is the effort the resolution
 * chain would contribute at the declaring layer; a rung that resolves no
@@ -2412,16 +2410,16 @@ declare function canonicalizeLadder(spec: LadderSpec, options?: {
 /**
 * The concrete ModelChoice of one rung attempt: each attempt is an
 * ordinary agent scope whose CanonicalModelSpec is that rung's
-* `{ kind: 'model' }` form (docs/04, section 8.2).
+* `{ kind: 'model' }` form.
 */
 declare function ladderRungChoice(ladder: CanonicalLadderSpec, index: number): ModelChoice;
 //#endregion
 //#region src/runtime/escalation.d.ts
-/** Closed in v1 (docs/07, section 6.3). */
+/** Closed in v1. */
 type EscalationKind = "scope_bigger" | "scope_different" | "blocked_with_evidence";
 /**
 * Minimal TaskSpec stand-in: the full typed TaskSpec is owned by the
-* PlanRunner surface (docs/07, section 4.1) and ships with M7; script
+* PlanRunner surface and ships with M7; script
 * modes carry proposals opaquely until then.
 */
 type TaskSpec = Json;
@@ -2483,15 +2481,15 @@ interface EscalationRequest {
 }
 declare const ESCALATE_TOOL_NAME = "escalate";
 /**
-* The exact tool schema of docs/07, section 4.9. costToDate and salvage
+* The escalate tool's exact request schema. costToDate and salvage
 * MUST NOT appear here: additionalProperties false rejects model-authored
 * values for them at argument validation.
 */
 declare const ESCALATION_REQUEST_SCHEMA: JsonSchema;
-/** The full-report schema applied BEFORE append (docs/03, section 5.4). */
+/** The full-report schema applied BEFORE append. */
 declare const ESCALATION_REPORT_SCHEMA: JsonSchema;
 /**
-* The engine opt-in tool (docs/08, section 6.6): registered through the
+* The engine opt-in tool: registered through the
 * same path as any tool under escalation opt-in of EITHER flavor (the
 * worker's only authoring channel for a report), never available without
 * opt-in, and dispatched through the same permission chain. The loop
@@ -2501,7 +2499,7 @@ declare function escalateTool(): ToolDef;
 /** Validates the runtime-completed report BEFORE append; returns issues. */
 declare function validateEscalationReport(report: EscalationReport): Promise<Issue$1[]>;
 /**
-* countsAgainstLimit derivation (docs/07, section 6.3, XF-06): true iff
+* countsAgainstLimit derivation (XF-06): true iff
 * scope_bigger; scope_different and blocked_with_evidence are exempt and
 * never debit the escalation counter.
 */
@@ -2513,11 +2511,11 @@ declare function countsAgainstLimit(kind: EscalationKind): boolean;
 * journaled as a first-class terminal abort distinct from user
 * cancellation (a cancelled entry always reruns; a no-progress abort
 * must replay, or every resume would re-pay the stuck turns). The
-* interim heuristic is committed in docs/06 Appendix A: N consecutive
+* interim heuristic is committed: N consecutive
 * turns without tool calls or artifact deltas, N = 3; the broader
-* heuristic stays OQ-15 (docs/14), revisited on dogfood traces.
+* heuristic stays OQ-15, revisited on dogfood traces.
 *
-* Encoding (docs/03, sections 6.3 and 6.6): the abort is the agent's
+* Encoding: the abort is the agent's
 * terminal entry with status 'limit', an error payload carrying
 * abortClass 'no-progress', and memoizeOutcome stamped by the ENGINE on
 * the terminal entry, so the frozen memoize-limit rule replays it on
@@ -2525,7 +2523,7 @@ declare function countsAgainstLimit(kind: EscalationKind): boolean;
 * per-turn artifact channel, so the tool-call test subsumes artifact
 * deltas; per-turn artifact producers arrive with M4 compaction.
 */
-/** docs/06 Appendix A: the committed no-progress detector N. */
+/** The committed no-progress detector N. */
 declare const DEFAULT_NO_PROGRESS_TURNS = 3;
 /** The consumer-visible dedicated class marker (FR-424). */
 type AbortClass = "no-progress";
@@ -2553,8 +2551,7 @@ declare class NoProgressDetector {
 /**
 * UsageLimits (M1-T06): normative limit vocabulary and the per-spawn merge.
 *
-* Owning spec: docs/06-execution-spec.md, section "UsageLimits
-* (normative)"; defaults from Appendix A. Expiry of maxTurns, maxToolCalls,
+* Full contract: https://docs.rulvar.com/guide/agents. Expiry of maxTurns, maxToolCalls,
 * or timeoutMs produces the terminal status 'limit' (paid partial work);
 * streamIdleTimeoutMs expiry is a retryable transport-class AgentError,
 * never 'limit'. The run-level deadline is RunOptions.deadlineAt, not a
@@ -2572,7 +2569,7 @@ interface UsageLimits {
   /** Gap between stream events; default 120000. */
   streamIdleTimeoutMs?: number;
   /**
-  * The no-progress detector N (docs/06 Appendix A, committed at 3):
+  * The no-progress detector N (committed at 3):
   * consecutive turns without tool calls or artifact deltas before the
   * engine aborts with the dedicated class (M3-T08).
   */
@@ -2586,18 +2583,18 @@ interface EffectiveUsageLimits {
   maxOutputTokensPerTurn?: number;
   timeoutMs?: number;
   streamIdleTimeoutMs: number;
-  /** Default DEFAULT_NO_PROGRESS_TURNS (docs/06 Appendix A). */
+  /** Default DEFAULT_NO_PROGRESS_TURNS. */
   noProgressTurns?: number;
 }
 /**
 * Limits merge per spawn: AgentOpts.limits over profile limits over engine
-* defaults.limits (docs/06, section "UsageLimits").
+* defaults.limits.
 */
 declare function mergeUsageLimits(call?: UsageLimits, profile?: UsageLimits, engine?: UsageLimits): EffectiveUsageLimits;
 //#endregion
 //#region src/runtime/agent-loop.d.ts
 type AgentStatus = "ok" | "error" | "limit" | "cancelled" | "skipped" | "escalated";
-/** Artifact: the normative shape of AgentResult.artifacts entries (docs/06, section 2.1). */
+/** Artifact: the normative shape of AgentResult.artifacts entries. */
 interface Artifact {
   /** Stable within the result. */
   id: string;
@@ -2612,15 +2609,15 @@ interface Artifact {
   /** Inline JSON content for small values. */
   data?: Json;
 }
-/** The verdict of one mechanical acceptance gate evaluation (docs/07, section 10). */
+/** The verdict of one mechanical acceptance gate evaluation. */
 interface MechanicalGateVerdict {
   pass: boolean;
   detail?: string;
 }
 /**
 * A mechanical acceptance gate: an engine-registered NAMED pure function
-* over AgentResult.artifacts (docs/04, section 12; docs/07, section 10).
-* The registry is per engine like every other registry (docs/02); the
+* over AgentResult.artifacts.
+* The registry is per engine like every other registry; the
 * ladder driver journals each evaluation as a decision entry, so the
 * ladder fold consumes only journaled verdicts, never live re-evaluation.
 */
@@ -2641,8 +2638,8 @@ interface AgentResult<T> {
   error?: AgentError;
   /**
   * Human-readable detail behind `error` (provider message, first schema
-  * issue): feeds the journaled WireError message. Additive to the
-  * docs/06 sketch; never part of identity.
+  * issue): feeds the journaled WireError message. An additive
+  * field; never part of identity.
   */
   errorMessage?: string;
   /** Present if and only if status === 'escalated'. */
@@ -2671,7 +2668,7 @@ interface RuntimeEventSink {
     type: string;
   } & Record<string, unknown>): void;
 }
-/** Budget hooks bound by the three-layer budget (docs/06, section "Three-layer budget"). */
+/** Budget hooks bound by the three-layer budget. */
 interface BudgetHooks {
   /** Layer 2: before every turn; throws BudgetExhaustedError to block dispatch. */
   beforeTurn(): void;
@@ -2714,7 +2711,7 @@ type PermissionGate = ({
     reason?: string;
   }>;
 }) & {
-  /** Chain audit payload ridden into tool:end telemetry (docs/08, 4.5). */audit?: GateAudit;
+  /** Chain audit payload ridden into tool:end telemetry. */audit?: GateAudit;
 };
 /**
 * The spawn's frozen toolset plus the per-call context factory, prepared
@@ -2743,14 +2740,14 @@ interface RunAgentOptions<S extends SchemaSpec = JsonSchema> {
   adapter: ProviderAdapter;
   resolved: ResolvedInvocation;
   /**
-  * Transport failover chain for the loop phase (M4-T04; docs/04,
-  * section 11.2): resolved fallback targets tried in order on
+  * Transport failover chain for the loop phase (M4-T04):
+  * resolved fallback targets tried in order on
   * transport or rate-limit failures after retries exhaust. Failover is
   * sticky and changes only servedBy, never the content key.
   */
   fallbacks?: PhaseTarget[];
   /**
-  * Transport RetryPolicy (M4-T05; docs/04, section 11.1): lives UNDER
+  * Transport RetryPolicy (M4-T05): lives UNDER
   * the journal, wired around every adapter.stream dispatch. sleep and
   * random are injectable for tests; the core owns wall-clock.
   */
@@ -2764,14 +2761,14 @@ interface RunAgentOptions<S extends SchemaSpec = JsonSchema> {
   * under the serving adapter's key; absent = unlimited (Appendix A).
   */
   providerSlot?: <T>(key: string, fn: () => Promise<T>) => Promise<T>;
-  /** The resolved toolset; absent = no tools declared (docs/08). */
+  /** The resolved toolset; absent = no tools declared. */
   tools?: ToolRuntime;
   /**
   * Separate final extract invocation, present only when the role trigger
   * protocol demands one: schema set AND (routing directs extract to a
   * different model OR the loop model's caps cannot serve the required
   * tier OR finalize is routed). Otherwise the schema rides the last loop
-  * turn (docs/06, section "Agent runtime binding"; the necessity rule is
+  * turn (the necessity rule is
   * decided by the ctx layer via model/roles.ts).
   */
   extract?: PhaseTarget & {
@@ -2792,7 +2789,7 @@ interface RunAgentOptions<S extends SchemaSpec = JsonSchema> {
   /**
   * Summarize invocation target for compaction (M4-T03): resolved
   * through the chain with role 'summarize', falling back to the loop
-  * model when routing resolves nothing (docs/06, section 7). Compaction
+  * model when routing resolves nothing. Compaction
   * is ON by default; absence of this option disables it (direct
   * runAgent callers).
   */
@@ -2804,7 +2801,7 @@ interface RunAgentOptions<S extends SchemaSpec = JsonSchema> {
     threshold?: number;
   };
   /**
-  * Turn-boundary checkpointing (M3-T02; docs/03, section "Checkpoints").
+  * Turn-boundary checkpointing (M3-T02).
   * load() restores the last boundary on a dangling-dispatch resume;
   * save() persists each boundary where the loop continues. The separate
   * extract invocation is not checkpointed in v1: an extract-phase crash
@@ -2826,7 +2823,7 @@ interface RunAgentOptions<S extends SchemaSpec = JsonSchema> {
     put(ref: string, blob: Uint8Array): Promise<void>;
   };
   priceUsd?: (servedBy: ModelRef, usage: Usage) => number | undefined;
-  /** Bounded schema re-prompt attempts; default 2 (docs/06, Appendix A). */
+  /** Bounded schema re-prompt attempts; default 2 (Appendix A). */
   schemaRetryAttempts?: number;
   /** Bounded ModelRetry conversions per tool call chain; default 2 (Appendix A). */
   modelRetryAttempts?: number;
@@ -2834,7 +2831,7 @@ interface RunAgentOptions<S extends SchemaSpec = JsonSchema> {
   * Escalation opt-in (M3-T07): the loop intercepts accepted calls to
   * the escalate tool and terminates with status 'escalated'; the
   * in-run minSpend gate rejects early scope_bigger escalations with a
-  * "keep working" error tool result (M3-T09, docs/07 section 6.4).
+  * "keep working" error tool result (M3-T09).
   */
   escalation?: {
     minSpendUsd: number;
@@ -2842,8 +2839,8 @@ interface RunAgentOptions<S extends SchemaSpec = JsonSchema> {
   /**
   * Terminal-tool interception (M6-T07): an accepted call to the named
   * tool ends the loop with status ok; the call's validated `result`
-  * argument becomes the agent output (the orchestrator finish tool,
-  * docs/07 4.11). The tool's execute never runs, mirroring escalate.
+  * argument becomes the agent output (the orchestrator finish
+  * tool). The tool's execute never runs, mirroring escalate.
   */
   terminalTool?: {
     name: string;
@@ -2868,9 +2865,9 @@ type PermissionHook = (toolName: string, input: unknown, ctx: ToolContext) => Ho
 /**
 * Declarative rule tables (no closures). `'undeclared'` in risk
 * position matches every tool WITHOUT declared risk: presets treat the
-* undeclared state conservatively (docs/08, section 4.3). Argv rules
-* match through the real shell matcher (section 5); domain rules are
-* ADVISORY outside the first-party fetch tool (section 4.4): they never
+* undeclared state conservatively. Argv rules
+* match through the real shell matcher; domain rules are
+* ADVISORY outside the first-party fetch tool: they never
 * change a verdict in M5, and matches surface in audit events.
 */
 type RiskRuleValue = ToolRisk | "undeclared";
@@ -2898,7 +2895,7 @@ interface PermissionConfig {
   canUseTool?: CanUseTool;
 }
 /**
-* Profile-level permissions (docs/08, section "Subagent inheritance").
+* Profile-level permissions.
 * inheritPermissions governs SUBAGENT inheritance (mode c orchestrators,
 * M6+): children get their own config only unless explicitly opted in.
 * It is carried as data here and consumed by the spawning layers.
@@ -2931,7 +2928,7 @@ type PermissionVerdict = ({
   input: unknown;
 }) & {
   /**
-  * Advisory domain-rule matches (docs/08, 4.4): reported in audit
+  * Advisory domain-rule matches: reported in audit
   * events, never enforced outside the first-party fetch tool.
   */
   advisory?: PermissionRule[];
@@ -2939,7 +2936,7 @@ type PermissionVerdict = ({
 /**
 * Merges the engine-wide config and the profile config into one chain.
 * Layers concatenate engine-first; since rules only deny or ask, ordering
-* within a layer cannot change the verdict (docs/08, section 4.2). The
+* within a layer cannot change the verdict. The
 * profile's canUseTool wins over the engine's (a single slot by
 * construction). A declared preset compiles INTO the same layers, after
 * the host-authored rules, never as a fifth layer (M5-T05).
@@ -2947,19 +2944,19 @@ type PermissionVerdict = ({
 declare function compilePermissionChain(engine?: PermissionConfig, profile?: AgentProfilePermissions): CompiledPermissionChain;
 /**
 * Evaluates the chain for one dispatch, or OFFLINE against a
-* hypothetical call by tool name (the dry-run API of docs/08, section
-* 4.5: nothing executes; shells and tests read the verdict, the
+* hypothetical call by tool name (the dry-run API: nothing executes;
+* shells and tests read the verdict, the
 * deciding layer, and the matched rule). Hooks run in deterministic
 * registration order; { modifiedInput } substitutes the input and
 * continues; the first decisive verdict wins. The returned input is what
-* execute receives and what the approval identity hashes (docs/03,
-* section 1.2: post hook modification). Advisory domain-rule matches
-* ride every verdict for the audit payload (docs/08, 4.4).
+* execute receives and what the approval identity hashes (post hook
+* modification). Advisory domain-rule matches
+* ride every verdict for the audit payload.
 */
 declare function evaluatePermission(chain: CompiledPermissionChain, tool: string | Pick<ToolDef, "name" | "needsApproval" | "risk">, input: unknown, ctx?: ToolContext): Promise<PermissionVerdict>;
 //#endregion
 //#region src/tools/toolset-hash.d.ts
-/** The per-spawn tools option value domain (docs/06, section "ctx.agent and AgentOpts"). */
+/** The per-spawn tools option value domain. */
 type ToolsOption = ReadonlyArray<ToolDef | ToolSource | string>;
 /** The spawn's frozen toolset snapshot plus its identity hash. */
 interface ResolvedToolset {
@@ -2971,13 +2968,13 @@ interface ResolvedToolset {
 declare function emptyToolset(): ResolvedToolset;
 /**
 * Expands sources, validates every tool name and duplicate names across
-* the whole toolset (ConfigError at spawn time; docs/08 sections 1.1 and
-* 6.4), and computes the toolsetHash over contracts sorted by name.
+* the whole toolset (ConfigError at spawn time), and computes the
+* toolsetHash over contracts sorted by name.
 */
 declare function resolveToolset(specs: ToolsOption | undefined, session: ToolSourceSession): Promise<ResolvedToolset>;
 //#endregion
 //#region src/journal/termination.d.ts
-/** The frozen limits vector written into termination.init (docs/07, 11.2). */
+/** The frozen limits vector written into termination.init. */
 interface TerminationLimits {
   /** V0, default 32; absolute and non-replenishable. */
   maxRevisionsPerRun: number;
@@ -2999,7 +2996,7 @@ interface TerminationLimits {
 /** Appendix A committed defaults for the countable resources. */
 declare const DEFAULT_MAX_REVISIONS_PER_RUN = 32;
 declare const DEFAULT_MAX_TOTAL_SPAWNS = 128;
-/** The countable resource vocabulary (docs/07, 11.5). */
+/** The countable resource vocabulary. */
 type TerminationResource = "revisionUnits" | "spawnUnits" | "escalationUnits" | "rungs" | "depth";
 interface LineageCounters {
   escalationUnitsRemaining: number;
@@ -3009,7 +3006,7 @@ interface TerminationAccountSnapshot {
   revisionUnitsRemaining: number;
   spawnUnitsRemaining: number;
   perLineage: Record<LogicalTaskId, LineageCounters>;
-  /** The variant function, a pure fold over the journal (docs/07, 11.4). */
+  /** The variant function, a pure fold over the journal. */
   phi: number;
 }
 type DebitResult = {
@@ -3020,13 +3017,13 @@ type DebitResult = {
   deniedEntryRef: EntryRef;
   resource: TerminationResource;
 };
-/** The value payload of a termination.init entry (docs/07, 11.6). */
+/** The value payload of a termination.init entry. */
 interface TerminationInitValue {
   limits: TerminationLimits;
   profileRegistrySnapshotHash: string;
   phiInitial: number;
 }
-/** The value payload of a termination.denied entry (docs/07, 11.6). */
+/** The value payload of a termination.denied entry. */
 interface TerminationDeniedValue {
   resource: TerminationResource;
   logicalTaskId?: LogicalTaskId;
@@ -3038,7 +3035,7 @@ interface TerminationDeniedValue {
 /**
 * Reads the declared ladder length of one agent profile. Ladders are
 * declared through the profile's ModelSpec (`model: { ladder }`, or the
-* loop-role routing entry; docs/04, section 12). The reader is defensive
+* loop-role routing entry). The reader is defensive
 * so the snapshot is total over every registry shape (an undeclared
 * ladder has length 1: the single implicit rung).
 */
@@ -3048,7 +3045,7 @@ declare function kMaxOf(profiles: Record<string, unknown> | undefined): number;
 /**
 * The deterministic profile-registry snapshot hash frozen inside
 * termination.init: profile names mapped to their declared ladder
-* lengths, canonical JSON, sha256 (docs/07, 11.6).
+* lengths, canonical JSON, sha256.
 */
 declare function profileRegistrySnapshotHash(profiles: Record<string, unknown> | undefined): string;
 /**
@@ -3059,14 +3056,14 @@ declare function profileRegistrySnapshotHash(profiles: Record<string, unknown> |
 declare function validateTerminationLimits(raw: Partial<TerminationLimits> | Record<string, unknown>): TerminationLimits;
 /** C = E0 + kMax: the per-spawn weight of the variant function. */
 declare function lineageWeightOf(limits: TerminationLimits): number;
-/** Phi0 = V0 + C * S0, finite and fixed in termination.init (docs/07, 11.4). */
+/** Phi0 = V0 + C * S0, finite and fixed in termination.init. */
 declare function phiInitialOf(limits: TerminationLimits): number;
-/** Builds the termination.init value payload (docs/07, 11.6). */
+/** Builds the termination.init value payload. */
 declare function buildTerminationInitValue(limits: TerminationLimits, registrySnapshotHash: string): TerminationInitValue;
 /** Reads a termination.init entry's payload; undefined when malformed. */
 declare function readTerminationInit(entry: JournalEntry): TerminationInitValue | undefined;
 /**
-* Config-drift detection at resume (docs/07, 11.2): the journaled vector
+* Config-drift detection at resume: the journaled vector
 * always wins; every differing field is reported for the
 * `termination:config-drift` event. Dynamic budget top-up via restart is
 * excluded by construction.
@@ -3079,9 +3076,9 @@ declare function terminationConfigDrift(frozen: TerminationLimits, live: Partial
 /** Injected appender for termination.denied entries (engine-owned I/O). */
 type TerminationDeniedWriter = (denied: TerminationDeniedValue) => Promise<EntryRef>;
 /**
-* The single per-run TerminationAccount (docs/07, 11.5): debit ONLY. No
+* The single per-run TerminationAccount: debit ONLY. No
 * credit operation exists by construction; reclaim never replenishes
-* anything (DEF-5 interaction, docs/07 7.3). Live: the engine debits the
+* anything (DEF-5 interaction). Live: the engine debits the
 * in-memory account, writes the carrying entry with the balance-after,
 * then applies effects. Resume state is rebuilt by TerminationFold from
 * the journal, never from live config.
@@ -3103,7 +3100,7 @@ declare class TerminationAccount {
   */
   bindDeniedWriter(writer: TerminationDeniedWriter): void;
   snapshot(): TerminationAccountSnapshot;
-  /** Phi = V + C * S + sum over live lineages (E + R) (docs/07, 11.4). */
+  /** Phi = V + C * S + sum over live lineages (E + R). */
   phi(): number;
   /** The current rung index of a lineage (0 before any raise). */
   rungIndexOf(logicalTaskId: LogicalTaskId): number;
@@ -3111,7 +3108,7 @@ declare class TerminationAccount {
   get spawnUnitsExhausted(): boolean;
   get revisionUnitsRemaining(): number;
   /**
-  * The spawn-admission debit (docs/07, 11.3b): minus one spawnUnit for
+  * The spawn-admission debit: minus one spawnUnit for
   * an admitted spawn of ANY origin; a NEW lineage receives E0 escalation
   * units and (K_l - 1) rung transitions in the same atomic step, so the
   * lemma's per-spawn decrease is C - (E0 + K_l - 1) = kMax - K_l + 1,
@@ -3130,7 +3127,7 @@ declare class TerminationAccount {
     resource: "spawnUnits";
   };
   /**
-  * The plan_revise debit (docs/07, 11.3a and 11.7): minus one
+  * The plan_revise debit: minus one
   * revisionUnit on EVERY journaled plan.revision, regardless of the op
   * count, guard verdicts, or the auto-rebase outcome; conflict spam is
   * never a free retry.
@@ -3143,7 +3140,7 @@ declare class TerminationAccount {
     resource: "revisionUnits";
   };
   /**
-  * The escalation debit (docs/07, 11.3d): minus one escalationUnit of
+  * The escalation debit: minus one escalationUnit of
   * the affected lineage, including EACH lineage of a class-level
   * decision and timeout defaultDecisions. Conditioned on the
   * countsAgainstLimit flag embedded in the decision entry by the caller.
@@ -3156,7 +3153,7 @@ declare class TerminationAccount {
     resource: "escalationUnits";
   };
   /**
-  * The ladder-raise debit (docs/07, 11.3c): minus one rung of the
+  * The ladder-raise debit: minus one rung of the
   * lineage; rungIndex is strictly monotone, there are no demotions and
   * no runtime startTier promotion in v1.
   */
@@ -3169,7 +3166,7 @@ declare class TerminationAccount {
     resource: "rungs";
   };
   /**
-  * The docs/07 11.5 debit surface: attempts the named resource and, on
+  * The unified debit surface: attempts the named resource and, on
   * underflow, writes `termination.denied` strictly BEFORE resolving with
   * the typed failure (the caller surfaces the error only after this
   * settles). Requires a deniedWriter; pure-fold contexts use the
@@ -3195,10 +3192,10 @@ declare class TerminationAccount {
   private requireLineage;
   private requireLineageId;
 }
-/** The typed error code surfaced after a denied debit (docs/07, 11.3). */
+/** The typed error code surfaced after a denied debit. */
 declare function exhaustionCodeOf(resource: TerminationResource): string;
 /**
-* The replay fold (docs/07, 11.6): rebuilds the account from
+* The replay fold: rebuilds the account from
 * termination.init and the debiting decision entries, asserting every
 * embedded balance-after against the recomputation. A divergence raises
 * the typed journal-integrity error at exactly the diverging entry;
@@ -3220,13 +3217,12 @@ type Spend = {
   usage: Usage;
   agentsSpawned: number;
 };
-/** Last resort of the admission reserve formula (docs/06, Appendix A). */
+/** Last resort of the admission reserve formula. */
 declare const DEFAULT_FLAT_RESERVE_USD = .5;
-/** The run-root account scope (docs/06, section 5.4 scope vocabulary). */
+/** The run-root account scope. */
 declare const ROOT_ACCOUNT = "run";
 /**
-* The admission reserve for a spawn (docs/06, section "Layer 1: admission
-* before spawn"): opts.estCost, else profile.estCost, else
+* The admission reserve for a spawn: opts.estCost, else profile.estCost, else
 * price(countTokens(input) + caps.maxOutputTokens), else the engine flat
 * default.
 */
@@ -3237,7 +3233,7 @@ declare function admissionReserveUsd(options: {
   caps?: ModelCaps;
   flatReserveUsd?: number;
 }): number;
-/** Read-only projection of one account (docs/06, section 5.4). */
+/** Read-only projection of one account. */
 interface BudgetAccountView {
   scope: string;
   ceilingUsd?: number;
@@ -3268,7 +3264,7 @@ declare class RunBudget {
     events?: RuntimeEventSink;
     priceUsd?: (servedBy: ModelRef, usage: Usage) => number | undefined;
     /**
-    * The resume ledger fold (docs/03, section 13.3): spend is never
+    * The resume ledger fold: spend is never
     * reset and never double-counted; replayed entries are already inside
     * this seed and add no increments.
     */
@@ -3282,7 +3278,7 @@ declare class RunBudget {
   /** The account chain from `scope` up to and including the root. */
   private chainOf;
   /**
-  * Opens a child sub-account under `parentScope` (docs/06, section 5.4).
+  * Opens a child sub-account under `parentScope`.
   * Re-opening an existing scope is the resume roll-forward path: the
   * recorded ceiling wins once and the accumulated state is kept.
   */
@@ -3306,7 +3302,7 @@ declare class RunBudget {
   /**
   * Marks the run exhausted without a ceiling event: the orchestrator
   * finalize fallback maps to outcome 'exhausted' with the synthesized
-  * partial value (DEF-7, docs/07 12.4; exhaustion is never null).
+  * partial value (DEF-7; exhaustion is never null).
   */
   markExhausted(): void;
   get committedReserveUsd(): number;
@@ -3316,17 +3312,17 @@ declare class RunBudget {
   * Layer 1: admission before spawn. Blocks when spent + committedReserve
   * has reached the ceiling on ANY account in the ancestor chain of
   * `accountScope`, otherwise commits the reserve along the whole chain.
-  * Also enforces the engine lifetime spawn cap (docs/06, "Scheduler").
+  * Also enforces the engine lifetime spawn cap.
   */
   admitSpawn(reserveUsd: number, accountScope?: string): void;
   /**
   * Resume roll-forward: commits a reserve recovered from a journaled
   * spawn-admission decision entry without re-evaluating admission
-  * (docs/06, 5.1: reserves are recovered, never re-estimated).
+  * (reserves are recovered, never re-estimated).
   */
   admitRecovered(reserveUsd: number, accountScope?: string): void;
   /**
-  * Registers the orchestrator finalize reserve (DEF-7, docs/07 12.2):
+  * Registers the orchestrator finalize reserve (DEF-7):
   * absolute dollars set on the named account AND the run root, so
   * admission never lets any spawn eat the finalization money even
   * against whole-run exhaustion. Kept SEPARATE from committedReserveUsd
@@ -3355,17 +3351,17 @@ declare class RunBudget {
   */
   onUsage(usage: Usage, servedBy: ModelRef, accountScope?: string): void;
   spent(): Spend;
-  /** Null when the run has no USD ceiling (docs/06, section "Canonical Ctx interface"). */
+  /** Null when the run has no USD ceiling. */
   remaining(): Spend | null;
   private emitUpdate;
 }
 //#endregion
 //#region src/journal/reuse.d.ts
-/** Kernel contentHash of a spawn root entry (docs/03, 9.2). */
+/** Kernel contentHash of a spawn root entry. */
 type SpawnKey = string;
-/** Plan-node identity (docs/07, 3.1). */
+/** Plan-node identity. */
 type NodeId$1 = string;
-/** The rich donor descriptor embedded in reuse verdicts (docs/03, 9.9). */
+/** The rich donor descriptor embedded in reuse verdicts. */
 interface DonorRef {
   /** Head of the link chain. */
   nodeId: NodeId$1;
@@ -3374,12 +3370,12 @@ interface DonorRef {
   /** Transitive chain, oldest first. */
   chain: NodeId$1[];
   spawnKey: SpawnKey;
-  /** Lineage continues through the link (docs/03, 9.6; DEF-3). */
+  /** Lineage continues through the link (DEF-3). */
   logicalTaskId: LogicalTaskId;
   /** Paid under the chain at the verdict snapshot. */
   paidUsd: number;
 }
-/** Graft bootstrap payload (docs/03, 9.9). */
+/** Graft bootstrap payload. */
 interface GraftBoot {
   /** Retained by the abandon entry, when it was. */
   checkpointRef?: string;
@@ -3387,13 +3383,13 @@ interface GraftBoot {
   eligiblePaidUsd: number;
   worktreePinned: boolean;
 }
-/** Telemetry for a SpawnKey match admitted fresh (docs/03, 9.9). */
+/** Telemetry for a SpawnKey match admitted fresh. */
 interface DedupNote {
   spawnKey: SpawnKey;
   donorNodeId: NodeId$1;
   reason: "donor_failed" | "no_paid_entries" | "graft_unsafe" | "donor_active";
 }
-/** The reuse block of AdmissionConfig (docs/03, 9.9). */
+/** The reuse block of AdmissionConfig. */
 interface ReuseConfig {
   /** Default true. */
   enabled?: boolean;
@@ -3401,11 +3397,11 @@ interface ReuseConfig {
   allowGraft?: boolean;
   /** Default 2 (Appendix A). */
   maxOscillationsPerKey?: number;
-  /** Optional RevisionGuards trigger on netLostUsd (docs/07, 3.8). */
+  /** Optional RevisionGuards trigger on netLostUsd. */
   maxAbandonedNetUsdFraction?: number;
 }
 declare const DEFAULT_MAX_OSCILLATIONS_PER_KEY = 2;
-/** The consumer-facing reuse mark on results (docs/03, 9.9). */
+/** The consumer-facing reuse mark on results. */
 interface AgentResultMeta {
   reusedFrom?: {
     nodeId: NodeId$1;
@@ -3414,7 +3410,7 @@ interface AgentResultMeta {
     reclaimedUsd: number;
   };
 }
-/** The node.link entry value (docs/03, 9.5): an ordinary content-keyed effect entry. */
+/** The node.link entry value: an ordinary content-keyed effect entry. */
 interface NodeLinkValue {
   targetNodeId: NodeId$1;
   /** plan/NewNodeId. */
@@ -3426,19 +3422,19 @@ interface NodeLinkValue {
   spawnKey: SpawnKey;
   logicalTaskId: LogicalTaskId;
   mode: "full" | "graft";
-  /** full is shareable, graft is exclusive (docs/03, 9.5). */
+  /** full is shareable, graft is exclusive. */
   claim: "shared" | "exclusive";
   checkpointRef?: string;
   reclaimedUsdAtLink: number;
   donorRootRef: EntryRef;
 }
 /**
-* node.link identity (docs/03, 9.5): sha256 of {kind, spawnKey,
+* node.link identity: sha256 of {kind, spawnKey,
 * donorScope, targetNodeId}; targetNodeId is deterministic on replay
 * because NodeIds are assigned inside plan.revision.
 */
 declare function nodeLinkKey(spawnKey: SpawnKey, donorScope: string, targetNodeId: NodeId$1): string;
-/** The abandoned-spend ledger fold (docs/03, 9.7). */
+/** The abandoned-spend ledger fold. */
 interface AbandonedSpendView {
   abandonedUsd: number;
   reclaimedUsd: number;
@@ -3449,7 +3445,7 @@ interface AbandonedSpendView {
     reclaimedUsd: number;
   }>;
 }
-/** One donor candidate surfaced by the DedupIndex fold (docs/03, 9.3). */
+/** One donor candidate surfaced by the DedupIndex fold. */
 interface DonorCandidate {
   rootEntryRef: EntryRef;
   rootScope: string;
@@ -3471,7 +3467,7 @@ interface DonorCandidate {
   retainedCheckpoint: boolean;
   /** Seq of the exclusive node.link that captured this donor, if any. */
   claimedBy?: EntryRef;
-  /** Scope chain for transitive drainage, oldest first (docs/03, 9.6). */
+  /** Scope chain for transitive drainage, oldest first. */
   chain: string[];
 }
 /**
@@ -3493,13 +3489,13 @@ declare class DedupIndex {
   donorsOf(spawnKey: SpawnKey): DonorCandidate[];
   /** Every donor for a key including claimed ones (diagnostics). */
   allDonorsOf(spawnKey: SpawnKey): DonorCandidate[];
-  /** Link count per key: the oscillation counter (docs/03, 9.7). */
+  /** Link count per key: the oscillation counter. */
   oscillationCountOf(spawnKey: SpawnKey): number;
   abandonedSpend(): AbandonedSpendView;
 }
 /**
-* The four-outcome verdict evaluation on a SpawnKey match (docs/03,
-* 9.4), computed once live at the fold head and embedded into the
+* The four-outcome verdict evaluation on a SpawnKey match, computed
+* once live at the fold head and embedded into the
 * deciding entry; replay never re-evaluates.
 */
 declare function evaluateReuse(index: DedupIndex, spawnKey: SpawnKey, config?: ReuseConfig): {
@@ -3519,7 +3515,7 @@ declare function evaluateReuse(index: DedupIndex, spawnKey: SpawnKey, config?: R
 };
 //#endregion
 //#region src/orchestrator/admission.d.ts
-/** Plan-node identity; engine-minted ULID (docs/07, section 3.1). */
+/** Plan-node identity; engine-minted ULID. */
 type NodeId = string;
 /** Layer-1 reservation embedded in the carrying decision entry. */
 interface BudgetReserve {
@@ -3534,7 +3530,7 @@ interface AdmitLineage {
   depth: number;
 }
 /**
-* The unified admission verdict (docs/07, section 7.2; XF-11). One union,
+* The unified admission verdict (XF-11). One union,
 * closed now; every debit is atomic with its carrying decision entry and
 * embeds the balance-after (DEF-2).
 */
@@ -3562,7 +3558,7 @@ type AdmitVerdict = {
   kind: "reject";
   reason: AdmitRejectReason;
 };
-/** The merged reject-code set (docs/07, section 7.2). */
+/** The merged reject-code set. */
 type AdmitRejectReason = {
   code: "depth" | "quota" | "budget" | "lifetime" | "termination_exhausted" | "ladder_exceeds_frozen" | "lineage_exhausted" | "lineage_busy";
 } | {
@@ -3570,7 +3566,7 @@ type AdmitRejectReason = {
   spawnKey: SpawnKey;
   oscillationCount: number;
 };
-/** Every spawn origin routed through the single admission point (docs/07, 7.1). */
+/** Every spawn origin routed through the single admission point. */
 type SpawnOrigin = "ctx.workflow" | "ctx.orchestrate" | "spawn_agent" | "parallel_agents" | "escalation-decomposition" | "rung-respawn" | "reuse-link";
 /** What the admission point needs to know about one spawn. */
 interface AdmitSpec {
@@ -3581,24 +3577,24 @@ interface AdmitSpec {
   childScope: string;
   /** The nearest enclosing budget account of the spawner. */
   parentAccountScope: string;
-  /** Explicit child budget; clamped by childBudgetFraction (docs/07, 4.1). */
+  /** Explicit child budget; clamped by childBudgetFraction. */
   budgetUsd?: number;
-  /** Reserve hint; falls back to the flat engine default (docs/06, 5.1). */
+  /** Reserve hint; falls back to the flat engine default. */
   estCostUsd?: number;
   /**
   * Lineage continuation (DEF-3); absence mints a fresh lineage root. A
   * continuation demands a causeRef: the seq of the entry that caused the
-  * rebirth (docs/03, 10.1, rule 2).
+  * rebirth.
   */
   lineage?: SpawnLineageOpt;
-  /** Raw approach tag; normalized by the engine (docs/03, 10.2). */
+  /** Raw approach tag; normalized by the engine. */
   approach?: string;
   /** Decomposition parent-LTID chain (relation 'decompose-child' only). */
   ancestry?: LogicalTaskId[];
   /**
   * Coarse-signature identity inputs; unspecified fields canonize onto
   * the deterministic legacy constants so signatures stay byte-stable
-  * (docs/03, 10.2; the toolset/schema registries land in M7-T05).
+  * (the toolset/schema registries land in M7-T05).
   */
   signature?: Partial<ApproachSignatureInputs>;
   /**
@@ -3611,7 +3607,7 @@ interface AdmitSpec {
   /**
   * The children-quota key (maxChildrenPerNode); defaults to
   * parentAccountScope. Orchestrators pass their own scope so each node
-  * counts its own children (docs/07, 7.3).
+  * counts its own children.
   */
   nodeKey?: string;
 }
@@ -3627,11 +3623,11 @@ interface AdmissionStatsBefore {
 interface AdmissionDecision {
   verdict: AdmitVerdict;
   statsBefore: AdmissionStatsBefore;
-  /** Node identity minted inside the decision (docs/07, section 5); absent on reject. */
+  /** Node identity minted inside the decision; absent on reject. */
   nodeId?: NodeId;
   /**
   * The computed value-part lineage block (DEF-3): reused byte-exact on
-  * replay, never recomputed (docs/03, 10.6). Absent on reject.
+  * replay, never recomputed. Absent on reject.
   */
   lineage?: SpawnLineage;
   /**
@@ -3667,7 +3663,7 @@ declare class AdmissionController {
     maxDepth?: number;
     maxChildrenPerNode?: number;
     childBudgetFraction?: number;
-    flatReserveUsd?: number; /** Per-orchestrate spawn cap (docs/06, 9.3 maxSpawns); engine lifetime cap applies regardless. */
+    flatReserveUsd?: number; /** Per-orchestrate spawn cap (maxSpawns); engine lifetime cap applies regardless. */
     maxTotalSpawns?: number;
     mintId?: () => string;
     /**
@@ -3685,8 +3681,8 @@ declare class AdmissionController {
   /** The validated lineage limits this controller enforces (DEF-3). */
   get escalationLimits(): EscalationLimits;
   /**
-  * Binds the run's TerminationAccount (DEF-2; PlanRunner runs only,
-  * docs/07 section 1): from bind time on, every admitted spawn of any
+  * Binds the run's TerminationAccount (DEF-2; PlanRunner runs only):
+  * from bind time on, every admitted spawn of any
   * origin debits one spawnUnit atomically with its decision entry, and
   * a declared ladder longer than the frozen kMax rejects with
   * ladder_exceeds_frozen. Non-PlanRunner runs never bind an account and
@@ -3696,7 +3692,7 @@ declare class AdmissionController {
   /** The bound account, when this is a PlanRunner run (DEF-2). */
   get termination(): TerminationAccount | undefined;
   /**
-  * The lineage half of admission (DEF-3, docs/03 section 10.5): folds are
+  * The lineage half of admission (DEF-3): folds are
   * computed live STRICTLY BEFORE the carrying decision entry is appended;
   * the caller embeds the returned block in the entry and replay reads it
   * back byte-exact. Enforces the single-live-attempt invariant
@@ -3750,21 +3746,21 @@ declare class AdmissionController {
   * Resume roll-forward for a child that already SETTLED before the
   * resume: re-registers the counters (maxChildrenPerNode, the lifetime
   * cap, statsBefore fidelity) without committing any reserve; the spend
-  * itself sits in the root ledger seed (docs/03, 13.3).
+  * itself sits in the root ledger seed.
   */
   recoverSettled(parentAccountScope: string): void;
   /**
   * Resume roll-forward for an admission whose decision entry exists but
   * whose child has NOT settled: re-applies the recorded reserve and
-  * counters without re-evaluating any limit (docs/07, 7.1: replay never
-  * re-evaluates admission; docs/06, 5.1: reserves are recovered, never
+  * counters without re-evaluating any limit (replay never
+  * re-evaluates admission; reserves are recovered, never
   * re-estimated).
   */
   recoverInFlight(parentAccountScope: string, verdict: AdmitVerdict): void;
 }
 //#endregion
 //#region src/l0/events.d.ts
-/** docs/09 section 1.4, run lifecycle and core telemetry (M1 subset). */
+/** Run lifecycle and core telemetry (M1 subset). */
 type CoreEvents = {
   type: "run:start";
   workflow: string;
@@ -3807,7 +3803,7 @@ type CoreEvents = {
   scope: string;
   status: string;
 };
-/** docs/09 section 1.4, agent lifecycle. */
+/** Agent lifecycle. */
 type AgentEvents = {
   type: "agent:queued";
   agentType: string;
@@ -3841,7 +3837,7 @@ type AgentEvents = {
   type: "agent:stream";
   delta: string;
 };
-/** docs/09 section 1.4, tool lifecycle (emitters arrive with the tool system, M3). */
+/** Tool lifecycle (emitters arrive with the tool system, M3). */
 type ToolEvents = {
   type: "tool:start";
   toolName: string;
@@ -3852,7 +3848,7 @@ type ToolEvents = {
   outcome: "ok" | "error" | "denied";
   durationMs: number;
   /**
-  * Audit fields (docs/08, section 4.5; M5-T05): the chain verdict,
+  * Audit fields (M5-T05): the chain verdict,
   * the deciding layer, the matched rule, and advisory domain-rule
   * matches. Telemetry, never identity; ask verdicts additionally
   * journal as suspended approvals.
@@ -3863,9 +3859,10 @@ type ToolEvents = {
   advisory?: Json;
 };
 /**
-* docs/09 section 1.4, adaptive orchestration, resolutions, and
+* Adaptive orchestration, resolutions, and
 * accounting: emitted only by runs where the corresponding machinery is
-* active (applicability per mode: docs/07, section 1). The types land as
+* active (applicability per mode:
+* https://docs.rulvar.com/guide/adaptive-orchestration). The types land as
 * one closed catalog with M7-T03; emitters arrive with their tasks.
 */
 type AdaptiveEvents = {
@@ -3916,7 +3913,7 @@ type AdaptiveEvents = {
   countsAgainstLimit: boolean;
 } | {
   type: "spawn:admitted";
-  entryRef: number; /** The admitting arms of the unified AdmitVerdict union (docs/07, 7.2). */
+  entryRef: number; /** The admitting arms of the unified AdmitVerdict union. */
   verdict: "admit" | "reuse_full" | "admit_graft";
   agentType: string;
   logicalTaskId: string;
@@ -3981,12 +3978,12 @@ type AdaptiveEvents = {
 };
 type WorkflowEventBody = CoreEvents | AgentEvents | ToolEvents | AdaptiveEvents;
 /**
-* The envelope (docs/09 section 1.1): seq is an independent per-run
+* The envelope: seq is an independent per-run
 * telemetry counter, strictly increasing in emission order and DISTINCT
 * from JournalEntry.seq (never compare or join the two; entryRef fields
 * carry journal seqs explicitly). ts is wall clock, telemetry only.
-* replayed is true only on re-emitted journal-backed lifecycle events
-* (docs/09 section 1.5); stream deltas are never re-emitted.
+* replayed is true only on re-emitted journal-backed lifecycle events;
+* stream deltas are never re-emitted.
 */
 type WorkflowEvent = {
   runId: string;
@@ -4017,7 +4014,7 @@ interface PendingExternal {
   /** Approvals and Flavor B escalations only. */
   deadlineAt?: string;
 }
-/** docs/09, section "CostReport". */
+/** Full contract: https://docs.rulvar.com/guide/observability. */
 interface CostReport {
   totalUsd: number;
   /** Keyed by canonical ModelRef 'adapterId:model'. */
@@ -4049,7 +4046,7 @@ type RunOutcome<R> = {
   usage: Usage;
   cost: CostReport;
 };
-/** Adds 'running' for in-flight inspection (docs/06, section "Engine and ops API"). */
+/** Adds 'running' for in-flight inspection. */
 type RunStatus = RunOutcome<unknown>["status"] | "running";
 interface RunHandle<R> {
   runId: string;
@@ -4084,7 +4081,7 @@ interface CompiledWorkflow {
 interface ScriptRunner {
   execute<A, R>(wf: Workflow<A, R> | CompiledWorkflow, ctx: Ctx<never>, args: A): Promise<R>;
 }
-/** Escalation hook (docs/06, section 2.10): decides for value-form calls. */
+/** Escalation hook: decides for value-form calls. */
 type OnEscalation = (result: EscalatedResult<unknown>) => EscalationDecision | Promise<EscalationDecision>;
 /**
 * The mode (a) runner for human-authored closures. Determinism is enforced
@@ -4118,17 +4115,17 @@ interface PriceTable {
 */
 declare function resolvePricing(ref: ModelRef, table: PriceTable | undefined, capsPricing: Pricing | undefined): Pricing | undefined;
 /**
-* Dollars from normalized usage against one pricing row (docs/04,
-* section 1.6: the adapter normalized the usage; inputTokens is the
+* Dollars from normalized usage against one pricing row (the adapter
+* normalized the usage; inputTokens is the
 * full prompt). Cache writes price at the 5m premium rate; the 1h rate
 * applies where a provider distinguishes it in usage, which the
-* canonical Usage does not yet carry (docs/04, section 10).
+* canonical Usage does not yet carry.
 */
 declare function priceUsdOf(pricing: Pricing, usage: Usage): number;
 //#endregion
 //#region src/engine/engine.d.ts
 /**
-* The per-engine workflow registry (docs/06, section 10.4; M5-T01): an
+* The per-engine workflow registry (M5-T01): an
 * explicit, first-class value; no module-level registry exists. Shells
 * resolve by-name runs against it; ctx.workflow's string form (M6) and
 * the queue worker (M8) resolve against it too. CompiledWorkflow values
@@ -4140,24 +4137,23 @@ interface EngineDefaults {
   profiles?: Record<string, AgentProfile>;
   /** The workflow registry for shells and by-name resolution (10.4). */
   workflows?: WorkflowRegistry;
-  /** Registered SchemaSpec names for outputSchemaRef (docs/08; M7-T05). */
+  /** Registered SchemaSpec names for outputSchemaRef (M7-T05). */
   schemas?: Record<string, SchemaSpec>;
-  /** Registered tool profile names for toolsetRef (docs/08; M7-T05). */
+  /** Registered tool profile names for toolsetRef (M7-T05). */
   toolsets?: Record<string, ToolsOption>;
   /**
   * Registered mechanical gate profiles: named pure functions over
-  * AgentResult.artifacts for ladder acceptance gates (docs/02, section
-  * "Registries"; docs/07, section 10; M7-T10).
+  * AgentResult.artifacts for ladder acceptance gates (M7-T10).
   */
   gates?: Record<string, MechanicalGateProfile>;
   limits?: UsageLimits;
-  /** Engine-wide permission chain layers (docs/08, section 3). */
+  /** Engine-wide permission chain layers. */
   permissions?: PermissionConfig;
-  /** The worktree lifecycle provider (docs/08, section 8). */
+  /** The worktree lifecycle provider. */
   isolation?: IsolationProvider;
-  /** Engine-wide transport RetryPolicy (docs/04, 11.1; M4-T05). */
+  /** Engine-wide transport RetryPolicy (M4-T05). */
   retry?: RetryPolicy;
-  /** Hard per-role model constraints (docs/04, section 9; M4-T09). */
+  /** Hard per-role model constraints (M4-T09). */
   roleFloors?: QualityFloors;
 }
 interface BudgetDefaults {
@@ -4167,13 +4163,13 @@ interface BudgetDefaults {
   lifetimeSpawnCap?: number;
   /**
   * Fraction of the parent remainder (minus the parent finalize reserve)
-  * a child sub-account may take; default 0.3 (docs/06, 5.4; M6-T06).
+  * a child sub-account may take; default 0.3 (M6-T06).
   */
   childBudgetFraction?: number;
-  /** AdmissionController nesting depth; default 1, hard ceiling 4 (docs/07, 7.3). */
+  /** AdmissionController nesting depth; default 1, hard ceiling 4. */
   maxDepth?: number;
   /**
-  * Lineage limits (DEF-3, docs/03 section 10.5): maxEscalationsPerLogicalTask
+  * Lineage limits (DEF-3): maxEscalationsPerLogicalTask
   * (default 2) and maxAttemptsPerLogicalTask (default 8), monotonically
   * consumed. The validator rejects the pre-rename knob name
   * maxEscalationsPerNode with a migration hint (XF-10).
@@ -4186,7 +4182,7 @@ interface CreateEngineOptions {
     /** Default InMemoryStore (resume disabled, loud warning). */journal?: JournalStore;
     transcripts?: TranscriptStore;
     /**
-    * The ModelKnowledge claim store (docs/05; M10-T03). Optional and
+    * The ModelKnowledge claim store (M10-T03). Optional and
     * OFF by default: an engine without it writes no kb entries at
     * all. The runtime only ever receives the current()-only handle.
     */
@@ -4198,11 +4194,11 @@ interface CreateEngineOptions {
     perRun?: number; /** Per-adapter-id caps; unlimited unless configured (Appendix A; M4-T07). */
     perProvider?: Record<string, number>;
   };
-  /** Versioned price table; wins over caps.pricing (docs/04, section 10; M4-T06). */
+  /** Versioned price table; wins over caps.pricing (M4-T06). */
   pricing?: PriceTable;
   /**
-  * Runner registrations beyond the built-in InProcessRunner (docs/06,
-  * sections 8 and 10.1; M6-T02). `sandbox` executes CompiledWorkflow
+  * Runner registrations beyond the built-in InProcessRunner (M6-T02).
+  * `sandbox` executes CompiledWorkflow
   * values (WorkerSandboxRunner ships in @rulvar/planner); running or
   * resuming a compiled workflow without one is a typed ConfigError.
   */
@@ -4210,28 +4206,28 @@ interface CreateEngineOptions {
     sandbox?: ScriptRunner;
   };
   /**
-  * The InProcessRunner escalation hook (docs/06, sections 2.10 and 8.1):
+  * The InProcessRunner escalation hook:
   * receives escalated results when the call form cannot carry them; the
   * returned decision is journaled as the authoritative
   * escalation-decision entry.
   */
   onEscalation?: (result: EscalatedResult<unknown>) => EscalationDecision | Promise<EscalationDecision>;
   /**
-  * KeyDeriver registry extension (docs/03, section "hashVersion").
+  * KeyDeriver registry extension (see
+  * https://docs.rulvar.com/guide/journal-compatibility).
   * Plumbed now, consumed by the matching kernel from M2.
   */
   extraDerivers?: readonly unknown[];
   /**
   * Redact/encrypt at the append/put boundaries, symmetric on load/get
-  * (docs/03, section "Serialization hook"; M8-T04, OQ-22 executed).
+  * (M8-T04, OQ-22 executed).
   * Applied by wrapping the configured stores; Engine.stores exposes
   * the wrapped instances, so every reader passes one policy point.
   */
   serialization?: SerializationHook;
   /**
-  * The default key-masking policy at the telemetry boundary (docs/09,
-  * section "Redaction and sensitive data"; docs/06 Appendix A row
-  * "event secret masking"). Default ON: key-shaped strings in every
+  * The default key-masking policy at the telemetry boundary. Default
+  * ON: key-shaped strings in every
   * emitted WorkflowEvent are masked; never touches the journal.
   */
   redaction?: {
@@ -4252,7 +4248,7 @@ interface RunOptions {
   /** Host-initiated cancellation. */
   signal?: AbortSignal;
 }
-/** Resume-time hit/miss/orphan accounting (docs/03, section 11.3). */
+/** Resume-time hit/miss/orphan accounting. */
 interface ResumePreview extends ResumeReport {
   invalidResolutions: Array<{
     seq: number;
@@ -4262,23 +4258,23 @@ interface ResumePreview extends ResumeReport {
 interface ResumeOptions {
   /**
   * The run's original arguments: not journaled for in-process workflows
-  * in v1, so the host supplies them (resume binding residuals, docs/14).
+  * in v1, so the host supplies them (resume binding residuals).
   */
   args?: unknown;
   /**
   * Dry-run: replay-strict matching; the first would-be-live call throws
   * JournalMissError and the run settles with that typed error, zero live
-  * calls performed (docs/03, section 11.3).
+  * calls performed.
   */
   dryRun?: boolean;
-  /** invalidate/retry: entries to unpin before matching (docs/03, section 6.5). */
+  /** invalidate/retry: entries to unpin before matching. */
   invalidate?: number[];
   /**
   * Queue mode: the worker's lease. The engine carries it on EVERY
   * journal append of this resume (the kernel's single append site), so
   * a stale worker's writes are rejected by the fencing epoch and never
-  * become visible (docs/06 10.2 and docs/03 12.3, M8 entry amendment;
-  * DEF-6; FR-703). putMeta and transcript blobs stay advisory and
+  * become visible (M8 entry amendment; DEF-6; FR-703). putMeta and
+  * transcript blobs stay advisory and
   * unfenced.
   */
   lease?: Lease;
@@ -4290,44 +4286,43 @@ interface ResumeHandle<R> extends RunHandle<R> {
 interface Engine {
   run<A, R>(wf: Workflow<A, R> | CompiledWorkflow, args: A, opts?: RunOptions): RunHandle<R>;
   /**
-  * Rebinds a journal to a workflow definition and resumes (docs/06,
-  * section "Engine and ops API"). Requires wf for in-process workflows;
+  * Rebinds a journal to a workflow definition and resumes. Requires wf
+  * for in-process workflows;
   * a name mismatch is a typed ConfigError; a body-hash mismatch warns
   * loudly and proceeds (the journal decides replay per content keys).
   * A compiled run resumes WITHOUT wf: the engine rehydrates the
   * persisted source pinned by workflowHash; supplying a compiled wf
   * whose source hash differs from the recorded one is a typed
-  * ConfigError (docs/06, 10.2; M6-T02).
+  * ConfigError (M6-T02).
   */
   resume<A, R>(runId: string, wf?: Workflow<A, R> | CompiledWorkflow, options?: ResumeOptions): ResumeHandle<R>;
   /**
   * Renders the registered agent profiles into the shared vocabulary
-  * card (docs/06, 9.3), optionally filtered to `names`; the registry
-  * itself stays private to the engine (docs/06, 10.2; M6-T05
-  * amendment). Unknown names are ignored.
+  * card, optionally filtered to `names`; the registry itself stays
+  * private to the engine (M6-T05 amendment). Unknown names are ignored.
   */
   profileCard(names?: readonly string[]): string;
   /**
   * The engine's configured stores, exposed for shells and hosts
-  * (docs/06, 10.2, M8 entry amendment; docs/02, section "Shells
-  * overview": "the journal store comes from the engine"). Exactly the
+  * (M8 entry amendment: the journal store comes from the engine).
+  * Exactly the
   * instances createEngine received, or the defaults it built; no store
   * contract widens through this accessor. With a serialization hook
   * configured these are the HOOKED wrappers, so every reader passes
-  * the one policy point (docs/03, 12.8; M8-T04).
+  * the one policy point (M8-T04).
   */
   readonly stores: {
     journal: JournalStore;
     transcripts: TranscriptStore;
   };
   /**
-  * Retention (docs/06, 10.2; OQ-20 executed at M8-T04): deletes every
+  * Retention (OQ-20 executed at M8-T04): deletes every
   * blob transcripts.list(runId) returns, then the journal; no orphan
   * blobs survive. The caller owns the decision that the run is done.
   */
   deleteRun(runId: string): Promise<void>;
   /**
-  * Checkpoint pruning (docs/03, 12.4 note; OQ-20 executed at M8-T04):
+  * Checkpoint pruning (OQ-20 executed at M8-T04):
   * deletes checkpoint blobs of ok-terminal attempts that no other
   * entry references; returns the count. Parked, cancelled, escalated,
   * and hanging attempts keep theirs (park/unpark, DEF-5 retention, and
@@ -4335,16 +4330,16 @@ interface Engine {
   */
   pruneRun(runId: string): Promise<number>;
 }
-/** Content hash of an in-process workflow body (run-to-definition binding, docs/06 10.2). */
+/** Content hash of an in-process workflow body (run-to-definition binding). */
 declare function hashWorkflowBody(wf: Workflow<never, never> | Workflow<unknown, unknown>): string;
-/** Content hash of a compiled workflow source (run-to-definition binding, docs/06 10.2). */
+/** Content hash of a compiled workflow source (run-to-definition binding). */
 declare function hashWorkflowSource(source: string): string;
 /** TranscriptStore ref of the persisted CompiledWorkflow source blob. */
 declare function workflowSourceRef(runId: string): string;
 declare function createEngine(options: CreateEngineOptions): Engine;
 //#endregion
 //#region src/orchestrator/handles.d.ts
-/** docs/07 section 5: the per-child digest handed to the orchestrator. */
+/** The per-child digest handed to the orchestrator. */
 interface TaskDigest {
   nodeId: string;
   logicalTaskId: string;
@@ -4363,7 +4358,7 @@ interface SpawnRecord {
   result: Promise<AgentResult<unknown>>;
   settled?: AgentResult<unknown>;
   abort: () => void;
-  /** The spawn's escalation flavor, captured at dispatch (docs/07, 5). */
+  /** The spawn's escalation flavor, captured at dispatch. */
   escalationFlavor?: "A" | "B";
 }
 /** The engine seam the spawn tools close over (never on ToolContext). */
@@ -4393,11 +4388,11 @@ interface OrchestratorRuntime {
     cancelled: boolean;
     handle: number;
   }>;
-  /** docs/07 4.8: sleep until a coalesced WakeDigest (M6-T09). */
+  /** Sleep until a coalesced WakeDigest (M6-T09). */
   waitForEvents(triggers: unknown): Promise<unknown>;
 }
 /**
-* The committed WakeDigest render budget (docs/06, Appendix A: 400
+* The committed WakeDigest render budget (Appendix A: 400
 * chars per outputSummary row, the character measure; committed at M10
 * entry by adopting the implemented distillation cap unchanged, the
 * value frozen into every cassette since M6). One value serves both
@@ -4407,8 +4402,8 @@ interface OrchestratorRuntime {
 declare const WAKE_SUMMARY_RENDER_BUDGET_CHARS = 400;
 /**
 * The M6 outputSummary: a deterministic truncation of the child's
-* output (or error message), identical live and on replay (docs/07
-* section 2, clause 3: distillation lives with the child, ordered by
+* output (or error message), identical live and on replay (distillation
+* lives with the child, ordered by
 * spawn ordinal; the LLM distillation upgrade is M7 territory).
 */
 declare function summarizeOutput(result: AgentResult<unknown>): string;
@@ -4428,10 +4423,10 @@ interface SpawnAdmissionValue {
 }
 //#endregion
 //#region src/orchestrator/wake.d.ts
-/** docs/07 4.8: the wait_for_events parameter schema (normative). */
+/** The wait_for_events parameter schema (normative). */
 declare const WAIT_FOR_EVENTS_SCHEMA: SchemaSpec;
 declare const WAIT_FOR_EVENTS_TOOL_NAME = "wait_for_events";
-/** The closed v1 trigger vocabulary (docs/07 4.8). */
+/** The closed v1 trigger vocabulary. */
 type WakeTrigger = {
   kind: "quiescence";
 } | {
@@ -4443,7 +4438,7 @@ type WakeTrigger = {
   kind: "budget_threshold";
   percent: 50 | 80;
 };
-/** docs/07 section 5: the escalation block of a digest. */
+/** The escalation block of a digest. */
 interface EscalationDigest {
   nodeId: string;
   logicalTaskId: string;
@@ -4454,7 +4449,7 @@ interface EscalationDigest {
   /** Flavor B only. */
   deadlineAt?: string;
 }
-/** Passive budget visibility in every digest (DEF-7; docs/07, 12.5). */
+/** Passive budget visibility in every digest (DEF-7). */
 interface WakeBudgetBlock {
   runSpentUsd: number;
   runCeilingUsd: number;
@@ -4467,7 +4462,7 @@ interface WakeBudgetBlock {
   softWarning: boolean;
 }
 /**
-* The FINAL normative WakeDigest (docs/07 section 5): one coordinated
+* The FINAL normative WakeDigest: one coordinated
 * schema change inside the hashVersion-2 profile (XF-12). The digest
 * render enters the content key of orchestrator turns. In runs without
 * the PlanRunner extension the termination, budget, and reuse blocks are
@@ -4512,7 +4507,7 @@ declare function emptyDigestBlocks(): Pick<WakeDigest, "planHash" | "termination
 /** One append into an extension-owned sequential scope. */
 interface ExtensionAppendInput {
   scope: string;
-  /** The content key; extension kinds derive their own (docs/07, 3.3). */
+  /** The content key; extension kinds derive their own. */
   key: string;
   kind: EntryKind;
   value: Json;
@@ -4521,9 +4516,9 @@ interface ExtensionAppendInput {
 interface ExtensionDispatchSpec {
   agentType: string;
   prompt: string;
-  /** Resolved against defaults.schemas (docs/08); unknown names are typed errors. */
+  /** Resolved against defaults.schemas; unknown names are typed errors. */
   outputSchemaRef?: string;
-  /** Resolved against defaults.toolsets (docs/08); unknown names are typed errors. */
+  /** Resolved against defaults.toolsets; unknown names are typed errors. */
   toolsetRef?: string;
   isolation?: IsolationSpec;
   budgetUsd?: number;
@@ -4533,15 +4528,15 @@ interface ExtensionDispatchSpec {
   taskClass?: string;
   /**
   * A retained transcript checkpoint the dispatch boots from (park and
-  * unpark continuation, the DEF-5 graft boot; docs/03, sections 9.5 and
-  * 11.2). Dangling redispatch checkpoints take precedence.
+  * unpark continuation, the DEF-5 graft boot). Dangling redispatch
+  * checkpoints take precedence.
   */
   bootCheckpointRef?: string;
   /**
   * The CONCRETE model of this attempt: the ladder driver resolves each
   * rung to its `{ model, effort }` form and dispatches with it, so the
-  * attempt's identity hash includes the concrete ModelRef (docs/07,
-  * section 10). The orchestrator itself never names models; only the
+  * attempt's identity hash includes the concrete ModelRef. The
+  * orchestrator itself never names models; only the
   * engine-side driver populates this from the declared ladder.
   */
   model?: {
@@ -4549,7 +4544,7 @@ interface ExtensionDispatchSpec {
     effort?: Effort;
   };
   /**
-  * Rung/fallback opt-in (docs/04, section 12): a memoized terminal
+  * Rung/fallback opt-in: a memoized terminal
   * outcome replays by match instead of re-running live; the global
   * default errors-re-run-live is preserved (DEF-1).
   */
@@ -4557,7 +4552,7 @@ interface ExtensionDispatchSpec {
   /**
   * An INLINE SchemaSpec for engine-synthesized children (the ladder
   * judge verdict); user-authored plan specs use `outputSchemaRef`
-  * against the registry instead (docs/07, 4.2).
+  * against the registry instead.
   */
   schema?: unknown;
 }
@@ -4571,7 +4566,7 @@ interface OrchestratorExtensionIO {
   /** Registered agent profiles advertised to this orchestrate call. */
   readonly profiles: Record<string, unknown>;
   /**
-  * The per-engine mechanical gate registry (docs/07, section 10):
+  * The per-engine mechanical gate registry:
   * named pure functions over AgentResult.artifacts. Typed loose at the
   * seam exactly like `profiles`.
   */
@@ -4583,7 +4578,7 @@ interface OrchestratorExtensionIO {
   /**
   * A journaled random draw in [0, 1) under the orchestrate scope: the
   * ctx.random primitive, computed once live and replayed by match. The
-  * spot-check gate draws HERE, never Math.random (docs/04, section 12).
+  * spot-check gate draws HERE, never Math.random.
   */
   random(key?: string): Promise<number>;
   /** Total-order append; the extension owns its scopes' content keys. */
@@ -4592,7 +4587,7 @@ interface OrchestratorExtensionIO {
   snapshot(): readonly JournalEntry[];
   /** Flushes the serialized append queue before reading back. */
   flush(): Promise<void>;
-  /** The single admission point for all spawns (docs/07, 7.1). */
+  /** The single admission point for all spawns. */
   readonly admission: AdmissionController;
   /**
   * Dispatches one child agent under the EXPLICIT child scope through
@@ -4614,7 +4609,7 @@ interface OrchestratorExtensionIO {
   }>;
   /**
   * Appends the severing abandon ref-entry over a branch through the
-  * ResolutionArbiter (DEF-4/DEF-5; docs/03, sections 8.5 and 9.1).
+  * ResolutionArbiter (DEF-4/DEF-5).
   */
   abandonBranch(attempt: {
     target: number;
@@ -4630,10 +4625,10 @@ interface OrchestratorExtensionIO {
   }>;
   /**
   * Registers a node.link scope-prefix alias for forward matching
-  * (DEF-5; docs/03, 9.5). Idempotent; rebuilt by fold on resume.
+  * (DEF-5). Idempotent; rebuilt by fold on resume.
   */
   registerAlias(donorScope: string, targetScope: string): void;
-  /** The engine price fold (journal facts in, USD out; docs/04). */
+  /** The engine price fold (journal facts in, USD out). */
   priceUsd(servedBy: string | undefined, usage: Usage): number | undefined;
   /** Telemetry emission into the run event stream. */
   emit(event: {
@@ -4648,12 +4643,12 @@ interface OrchestratorExtensionIO {
 interface OrchestratorExtension {
   readonly name: string;
   /**
-  * Runs strictly BEFORE the orchestrator agent's first entry (docs/07,
-  * 11.6: termination.init precedes the first scheduling entry and the
+  * Runs strictly BEFORE the orchestrator agent's first entry
+  * (termination.init precedes the first scheduling entry and the
   * budget reserve). On resume it rebuilds state from the journal.
   */
   boot?(io: OrchestratorExtensionIO): Promise<void> | void;
-  /** Extension tools appended to the mode (c) toolset (docs/07, section 4). */
+  /** Extension tools appended to the mode (c) toolset. */
   tools(io: OrchestratorExtensionIO): ToolDef[];
   /** Extra orchestrator prompt lines describing the extension's protocol. */
   promptLines?(): string[];
@@ -4664,7 +4659,7 @@ interface OrchestratorExtension {
   */
   onActivity?(io: OrchestratorExtensionIO): Promise<void> | void;
   /**
-  * Quiescence participation (docs/07, 4.8): the mandatory trigger fires
+  * Quiescence participation: the mandatory trigger fires
   * only when every dispatched child settled AND the extension reports
   * nothing running and nothing ready.
   */
@@ -4679,7 +4674,10 @@ interface OrchestratorExtension {
 }
 //#endregion
 //#region src/orchestrator/orchestrate.d.ts
-/** docs/06 5.5; the cap machinery (reserves, freeze) completes in M7 (DEF-7). */
+/**
+* Budget contract: https://docs.rulvar.com/guide/budgets; the cap
+* machinery (reserves, freeze) completes in M7 (DEF-7).
+*/
 interface OrchestratorBudgetSpec {
   capUsd?: number;
   /** default 0.2; effectiveCap = min of the given bounds */
@@ -4688,7 +4686,7 @@ interface OrchestratorBudgetSpec {
   finalizeTurns?: number;
   atCap?: "finish-with-partial" | "fail-run";
 }
-/** docs/06 9.3: orchestrate(engine, goal, o?). */
+/** Options for orchestrate(engine, goal, o?). */
 interface OrchestrateOptions {
   model?: ModelSpec;
   /** Registered profile names to advertise; default: every profile. */
@@ -4698,17 +4696,17 @@ interface OrchestrateOptions {
   /** The orchestrator's own budget sub-account (cap enforcement layers only in M6). */
   budget?: OrchestratorBudgetSpec;
   /**
-  * Deterministic digest render bound (docs/07, section 5): each
+  * Deterministic digest render bound: each
   * TaskDigest outputSummary is clamped to this many CHARACTERS (the
   * model-independent measure; OQ-04 closed at M10 entry). Default
-  * WAKE_SUMMARY_RENDER_BUDGET_CHARS (docs/06, Appendix A).
+  * WAKE_SUMMARY_RENDER_BUDGET_CHARS.
   */
   renderBudgetChars?: number;
   /** UsageLimits of the orchestrator agent itself (maxTurns etc.). */
   limits?: UsageLimits;
   /**
   * The opt-in mode (c) extension seam (M7-T05): PlanRunner from
-  * @rulvar/plan attaches here (docs/07, section 1). The extension boots
+  * @rulvar/plan attaches here. The extension boots
   * strictly before the orchestrator's first agent entry, contributes
   * tools, schedules ready plan nodes on every settlement, and
   * participates in the mandatory quiescence trigger.
@@ -4723,7 +4721,7 @@ declare const ORCHESTRATE_WORKFLOW_NAME = "rulvar-orchestrate";
 * orchestrator agent with the finish terminal tool.
 */
 declare function makeOrchestratorWorkflow(goal: string, opts?: OrchestrateOptions): Workflow<undefined, unknown>;
-/** Top-level surface: creates a run (docs/06 9.3). */
+/** Top-level surface: creates a run. */
 declare function orchestrate(engine: Engine, goal: string, opts?: OrchestrateOptions): RunHandle<unknown>;
 //#endregion
 //#region src/engine/scheduler.d.ts
@@ -4731,10 +4729,10 @@ declare function orchestrate(engine: Engine, goal: string, opts?: OrchestrateOpt
 * Scheduler and concurrency (M1-T08): the per-run semaphore with a FIFO
 * queue (default 12 concurrent model calls). The engine lifetime spawn cap
 * is enforced by the budget layer at admission; parallel/pipeline
-* composition semantics live with ctx (docs/06, section "Scheduler").
+* composition semantics live with ctx.
 * Per-provider concurrency keys land with M4.
 */
-/** FIFO semaphore; default per-run width is 12 (docs/06, Appendix A). */
+/** FIFO semaphore; default per-run width is 12. */
 declare const DEFAULT_PER_RUN_CONCURRENCY = 12;
 declare class Semaphore {
   private readonly limit;
@@ -4766,7 +4764,7 @@ declare function toApprovalDecision(value: Json): ApprovalDecision;
 * Per-run registry of open external suspensions plus the run's activity
 * counter: when every in-flight branch is blocked on suspensions
 * (activity zero, waiters open), the run quiesces into outcome
-* 'suspended' (docs/06, section 2.7).
+* 'suspended'.
 */
 declare class ExternalRegistry {
   private readonly replayer;
@@ -4798,7 +4796,7 @@ declare class ExternalRegistry {
     prompt?: string;
   }): Promise<Json>;
   /**
-  * Tool-approval suspension (M3-T03; docs/08, section 3.6): journals (or
+  * Tool-approval suspension (M3-T03): journals (or
   * re-matches) the suspended approval entry keyed by (toolName, input)
   * in the agent's child scope and parks until a resolution closes it.
   * The ask verdict is journaled together with the turn checkpoint; on
@@ -4814,7 +4812,7 @@ declare class ExternalRegistry {
     onPending?: (entry: JournalEntry, replayed: boolean) => void;
   }): Promise<ApprovalDecision>;
   /**
-  * Flavor B escalation suspension (M3-T07; docs/07, section 6.2): the
+  * Flavor B escalation suspension (M3-T07): the
   * escalate tool suspends the agent on the SAME machinery as approvals
   * (kind 'approval', toolName 'escalate') with a journaled deadlineAt so
   * deadlines survive resume; the resolution VALUE is the raw
@@ -4843,7 +4841,7 @@ declare class ExternalRegistry {
   /**
   * RunHandle.resolveExternal: the live path validates BEFORE append and
   * throws InvalidResolutionError without journaling; a winning attempt
-  * settles the waiting promise in place (docs/03, section 8.7).
+  * settles the waiting promise in place.
   */
   resolveExternal(key: string, value: Json): Promise<ResolutionOutcome>;
 }
@@ -4851,9 +4849,9 @@ declare class ExternalRegistry {
 //#region src/engine/ctx.d.ts
 type ErrorPolicy = "strict" | "lenient";
 /**
-* The canonical, complete AgentProfile shape (docs/06, section
-* "AgentProfile"); M1 honors description, model, routing, effort, limits,
-* and estCost. A profile never carries a prompt or a schema.
+* The canonical, complete AgentProfile shape; M1 honors description,
+* model, routing, effort, limits, and estCost. A profile never carries
+* a prompt or a schema.
 */
 interface AgentProfile {
   description?: string;
@@ -4862,11 +4860,11 @@ interface AgentProfile {
   effort?: Effort;
   /** Toolset default; the resolved snapshot enters identity via toolsetHash. */
   tools?: ToolsOption;
-  /** Chain layers merged over engine defaults (docs/08, section 3.7). */
+  /** Chain layers merged over engine defaults. */
   permissions?: AgentProfilePermissions;
-  /** Isolation default; the RESOLVED value enters identity (docs/08). */
+  /** Isolation default; the RESOLVED value enters identity. */
   isolation?: IsolationSpec;
-  /** Flavor B opt-in lives here or on the call (docs/07, section 6). */
+  /** Flavor B opt-in lives here or on the call. */
   escalation?: EscalationOptions;
   limits?: UsageLimits;
   /** Transport RetryPolicy layer: call over profile over engine (M4-T05). */
@@ -4875,7 +4873,7 @@ interface AgentProfile {
   taskClass?: string;
   /**
   * Per-profile compaction threshold; default 0.8 of the loop model's
-  * contextWindow (docs/06, Appendix A; M4-T03). Compaction is ON by
+  * contextWindow (M4-T03). Compaction is ON by
   * default; history-processor plumbing stays engine-internal.
   */
   compaction?: {
@@ -4885,7 +4883,7 @@ interface AgentProfile {
   estCost?: number;
 }
 /**
-* Per-spawn options (docs/06, section "ctx.agent and AgentOpts"). The
+* Per-spawn options. The
 * identity split is normative: agentType, model/routing/effort (the
 * requested modelSpec), schema (schemaHash), and key enter the content
 * key; everything else is policy or telemetry and never re-keys entries.
@@ -4899,8 +4897,7 @@ interface AgentOpts<S extends SchemaSpec = SchemaSpec> {
   * 'loop'. The plan and orchestrate entry points set it so the
   * resolution chain, role effort defaults, quality floors, and cost
   * buckets see the right role; extract/finalize/summarize stay
-  * trigger-derived and are never settable here (docs/06, 2.1;
-  * M6-T05 amendment).
+  * trigger-derived and are never settable here (M6-T05 amendment).
   */
   role?: "loop" | "plan" | "orchestrate";
   /** Overrides all roles at once. */
@@ -4911,29 +4908,29 @@ interface AgentOpts<S extends SchemaSpec = SchemaSpec> {
   effort?: Effort;
   /** schemaHash enters identity. */
   schema?: S;
-  /** toolsetHash enters identity; wins over profile.tools (docs/08). */
+  /** toolsetHash enters identity; wins over profile.tools. */
   tools?: ToolsOption;
-  /** docs/08; the RESOLVED value enters identity; worktree needs defaults.isolation. */
+  /** The RESOLVED value enters identity; worktree needs defaults.isolation. */
   isolation?: IsolationSpec;
   /** Explicit discriminator; replaces the prompt in the content key. */
   key?: string;
   onError?: "throw" | "null";
-  /** Transport RetryPolicy under the journal (docs/04, 11.1; M4-T05). */
+  /** Transport RetryPolicy under the journal (M4-T05). */
   retry?: RetryPolicy;
   /**
-  * The degenerate fallback (docs/04, 11.3; M4-T04): an agent-level
+  * The degenerate fallback (M4-T04): an agent-level
   * second attempt on `model` when the terminal matches `on`; one
   * journaled decision entry; the fallback attempt is a NEW content key.
   */
   fallback?: FallbackField;
-  /** Per-call replay mode; default scoped forward-matching (docs/03, section 7.3). */
+  /** Per-call replay mode; default scoped forward-matching. */
   replay?: "cache" | "never";
   /** Journaled as a policy field from day one; consumed by the M2 predicate. */
   memoizeOutcome?: boolean;
-  /** Opt-in; without it 'escalated' is physically unproducible (docs/07 6.4). */
+  /** Opt-in; without it 'escalated' is physically unproducible. */
   escalation?: EscalationOptions;
   /**
-  * Lineage continuation (DEF-3, docs/03 section 10.3): declares this
+  * Lineage continuation (DEF-3): declares this
   * spawn a rebirth of an existing logical task; absence means a new
   * lineage root. Never enters the content key. Declaring lineage or
   * approach journals a spawn-admission decision entry BEFORE dispatch,
@@ -4944,7 +4941,7 @@ interface AgentOpts<S extends SchemaSpec = SchemaSpec> {
   approach?: string;
   /** Admission reserve hint (USD). */
   estCost?: number;
-  /** Merged over profile and engine limits (docs/06, section "UsageLimits"). */
+  /** Merged over profile and engine limits. */
   limits?: UsageLimits;
   result?: "value" | "full";
   /** Telemetry only. */
@@ -4952,7 +4949,7 @@ interface AgentOpts<S extends SchemaSpec = SchemaSpec> {
   /** Enables agent:stream delta events. */
   stream?: boolean;
 }
-/** docs/06, section "Error policy and dropped results". */
+/** One dropped result: its source, scope, entry ref, and wire error. */
 interface DroppedItem {
   source: "pipeline" | "agent-onerror-null" | "parallel-settled";
   /** Scope path of the failed call. */
@@ -4964,8 +4961,7 @@ interface DroppedItem {
 }
 /**
 * The discriminated union over AgentStatus carrying the underlying
-* AgentResult where one exists (docs/06, section "ctx.parallel and
-* Settled").
+* AgentResult where one exists.
 */
 type Settled<T> = {
   status: "ok";
@@ -4991,10 +4987,9 @@ type Settled<T> = {
 type Stage<I, O> = (item: I) => Promise<O>;
 /**
 * The rejection carrier of ctx.agent value-form calls: a real Error that
-* structurally satisfies the typed AgentError (docs/06, section "ctx.agent
-* and AgentOpts") and carries the full AgentResult for Settled mapping.
-* Deliberately not a RulvarError: AgentError is not in the closed code
-* registry (docs/02, section "Error taxonomy").
+* structurally satisfies the typed AgentError and carries the full
+* AgentResult for Settled mapping. Deliberately not a RulvarError:
+* AgentError is not in the closed code registry.
 */
 declare class AgentCallError extends Error implements AgentError {
   readonly kind: AgentError["kind"];
@@ -5011,7 +5006,7 @@ interface PipelineCollected<T> {
   results: T[];
   dropped: DroppedItem[];
 }
-/** The canonical Ctx interface, M1 members (docs/06, section "Canonical Ctx interface"). */
+/** The canonical Ctx interface, M1 members. */
 interface Ctx<P extends ErrorPolicy = "strict"> {
   agent(prompt: string): Promise<P extends "lenient" ? string | null : string>;
   agent<S extends SchemaSpec>(prompt: string, o: AgentOpts<S> & {
@@ -5045,33 +5040,33 @@ interface Ctx<P extends ErrorPolicy = "strict"> {
     key?: string;
   }): Promise<T>;
   /**
-  * Runs a child workflow under the AdmissionController (docs/06, section
-  * 2.5; M6-T06). The child gets a nested journal scope (registered name
+  * Runs a child workflow under the AdmissionController (M6-T06). The
+  * child gets a nested journal scope (registered name
   * plus ordinal) and a hierarchical budget sub-account whose spend
   * propagates to every ancestor. Structural limit violations throw the
   * typed AdmissionRejectedError and never tear the run down; budget
   * rejections throw BudgetExhaustedError. The string form resolves
-  * against the per-engine workflow registry (section 10.4) and is the
+  * against the per-engine workflow registry and is the
   * only form available inside the worker sandbox.
   */
   workflow<A, R>(wf: Workflow<A, R>, args: A, o?: WorkflowCallOpts): Promise<R>;
   workflow(name: string, args?: Json, o?: WorkflowCallOpts): Promise<unknown>;
   /**
-  * Nests a dynamic orchestrator under the AdmissionController (docs/06,
-  * section 2.6; M6-T07): one implementation with the top-level
+  * Nests a dynamic orchestrator under the AdmissionController (M6-T07):
+  * one implementation with the top-level
   * orchestrate(engine, goal, opts) surface, clamped by maxDepth and the
   * parent budget account through the ordinary ctx.workflow admission.
   */
   orchestrate(goal: string, opts?: OrchestrateOptions): Promise<unknown>;
   /**
   * A journaled summarize invocation for handing an inheritable brief to
-  * a child (docs/06, section 2.8; M6-T10): one agent-kind entry under
+  * a child (M6-T10): one agent-kind entry under
   * role 'summarize', therefore free on replay.
   */
   brief(o: BriefOpts): Promise<string>;
   /**
   * Suspends this position on a journaled entry until an external
-  * resolution arrives (docs/06, section 2.7). NO deadline in v1.
+  * resolution arrives. NO deadline in v1.
   */
   awaitExternal<T = Json>(key: string, o?: {
     schema?: SchemaSpec;
@@ -5093,7 +5088,7 @@ interface PipelineOpts {
 interface CollectOpts {
   onItemError: "collect";
 }
-/** Options of ctx.workflow; `key` replaces args in the child identity (docs/03, 1.2). */
+/** Options of ctx.workflow; `key` replaces args in the child identity. */
 interface WorkflowCallOpts {
   key?: string;
   /** Lineage continuation (DEF-3); embedded in the admission decision entry. */
@@ -5102,8 +5097,8 @@ interface WorkflowCallOpts {
   approach?: string;
 }
 /**
-* Options of ctx.brief (docs/06, 2.8; amended during M6-T10 with the
-* concrete shape): the content to distill plus an optional instruction;
+* Options of ctx.brief (concrete shape fixed in M6-T10): the content to
+* distill plus an optional instruction;
 * the invocation resolves role 'summarize', so it needs
 * defaults.routing.summarize, a profile, or the explicit model.
 */
@@ -5113,7 +5108,7 @@ interface BriefOpts {
   model?: ModelSpec;
   agentType?: string;
 }
-/** Closure-form workflow value; in-process only (docs/06, section "Execution model"). */
+/** Closure-form workflow value; in-process only. */
 interface Workflow<A = unknown, R = unknown> {
   readonly kind: "workflow";
   readonly name: string;
@@ -5163,7 +5158,7 @@ interface RunInternals {
   runId: string;
   replayer: Replayer;
   budget: RunBudget;
-  /** The single admission point for all spawns (docs/07, section 7; M6-T06). */
+  /** The single admission point for all spawns (M6-T06). */
   admission?: AdmissionController;
   semaphore: Semaphore;
   events: RunEventSink;
@@ -5175,38 +5170,38 @@ interface RunInternals {
   defaults: {
     routing?: Partial<Record<InvocationRole, ModelSpec>>;
     profiles?: Record<string, AgentProfile>;
-    limits?: UsageLimits; /** Engine-wide permission chain layers (docs/08, section 3). */
-    permissions?: PermissionConfig; /** Engine-wide transport RetryPolicy (docs/04, 11.1; M4-T05). */
-    retry?: RetryPolicy; /** The per-engine workflow registry (docs/06, 10.4; consumers: M6 ctx.workflow, M8 worker). */
-    workflows?: Record<string, unknown>; /** Registered SchemaSpec names for outputSchemaRef (docs/08; M7-T05). */
-    schemas?: Record<string, SchemaSpec>; /** Registered tool profile names for toolsetRef (docs/08; M7-T05). */
-    toolsets?: Record<string, ToolsOption>; /** Registered mechanical gate profiles (docs/07, section 10; M7-T10). */
+    limits?: UsageLimits; /** Engine-wide permission chain layers. */
+    permissions?: PermissionConfig; /** Engine-wide transport RetryPolicy (M4-T05). */
+    retry?: RetryPolicy; /** The per-engine workflow registry (consumers: M6 ctx.workflow, M8 worker). */
+    workflows?: Record<string, unknown>; /** Registered SchemaSpec names for outputSchemaRef (M7-T05). */
+    schemas?: Record<string, SchemaSpec>; /** Registered tool profile names for toolsetRef (M7-T05). */
+    toolsets?: Record<string, ToolsOption>; /** Registered mechanical gate profiles (M7-T10). */
     gates?: Record<string, MechanicalGateProfile>;
   };
-  /** Engine-scoped per-provider keyed limiter (docs/06, section 4; M4-T07). */
+  /** Engine-scoped per-provider keyed limiter (M4-T07). */
   providerLimiter?: KeyedLimiter;
   /** The configured price table's version; pinned in decision entries (M4-T06). */
   pricingVersion?: string;
-  /** budgetDefaults.flatReserveUsd; last resort of the reserve formula (docs/06, 5.1). */
+  /** budgetDefaults.flatReserveUsd; last resort of the reserve formula. */
   flatReserveUsd?: number;
-  /** Hard router constraints from engine config (docs/04, section 9; M4-T09). */
+  /** Hard router constraints from engine config (M4-T09). */
   floors?: QualityFloors;
   errorPolicy: ErrorPolicy;
   dropped: DroppedItem[];
   cost: CostAttribution;
   priceUsd: (servedBy: ModelRef, usage: Usage) => number | undefined;
   runSignal?: AbortSignal;
-  /** The worktree lifecycle provider (docs/08, section 8). */
+  /** The worktree lifecycle provider. */
   isolation?: IsolationProvider;
   /**
-  * The ModelKnowledge runtime handle (docs/05; M10-T03): current()
+  * The ModelKnowledge runtime handle (M10-T03): current()
   * only, commit physically absent. Present only when the engine was
   * given stores.modelKnowledge; absent means the feature is off and
   * no kb entries are ever written.
   */
   knowledge?: ModelKnowledgeHandle;
   /**
-  * The InProcessRunner escalation hook (docs/06, section 2.10): receives
+  * The InProcessRunner escalation hook: receives
   * escalated results when the call form cannot carry them; its decision
   * is journaled as the authoritative escalation-decision entry.
   */
@@ -5237,7 +5232,7 @@ declare function createCtx(internals: RunInternals): Ctx<ErrorPolicy>;
 declare function executeWorkflow<A, R>(internals: RunInternals, wf: Workflow<A, R>, args: A): Promise<R>;
 //#endregion
 //#region src/knowledge/card.d.ts
-/** docs/06, Appendix A: the KB card render budget (characters). */
+/** The KB card render budget (characters). */
 declare const KB_CARD_RENDER_BUDGET_CHARS = 4096;
 /** One declared ladder of the run, named by its agentType. */
 interface DeclaredLadder {
@@ -5250,12 +5245,12 @@ interface DeclaredLadder {
 }
 /**
 * The ladders a run declares: every advertised profile whose model
-* spec is a ladder (docs/04, section 12). The card is tier-relative to
+* spec is a ladder. The card is tier-relative to
 * exactly these.
 */
 declare function collectDeclaredLadders(profiles: Record<string, AgentProfile> | undefined): DeclaredLadder[];
 /**
-* The admission filter (docs/05, 4.1): status active, unexpired at
+* The admission filter: status active, unexpired at
 * `now`, and the subject reachable through the run's declared ladders
 * after the role-floor filter.
 */
@@ -5273,8 +5268,7 @@ interface VerifiedRecommendation {
   votes: number;
 }
 /**
-* The verified-layer compiler (M11-T06; docs/05, sections "Read path"
-* and "Composition with the model layer"): start-tier recommendations
+* The verified-layer compiler (M11-T06): start-tier recommendations
 * per (ladder, taskClass) compiled EXCLUSIVELY from eval-measured
 * claims. A strength on a rung below the default votes down (start
 * cheaper); a weakness on the default rung or below votes up. The net
@@ -5287,13 +5281,14 @@ interface VerifiedRecommendation {
 */
 declare function compileVerifiedLayer(claims: readonly ModelClaim[], ladders: readonly DeclaredLadder[]): VerifiedRecommendation[];
 /**
-* The deterministic card render (docs/05, 4.3). Pure: same filtered
+* The deterministic card render. Pure: same filtered
 * claims and ladders give byte-identical text. The render budget is
-* docs/06 Appendix A (4096 chars); over it, the OLDEST-observed notes
+* 4096 chars; over it, the OLDEST-observed notes
 * withhold first behind an explicit marker.
 */
 declare function modelKnowledgeCard(claims: readonly ModelClaim[], ladders: readonly DeclaredLadder[], options?: {
   budgetChars?: number;
+  profiles?: Record<string, AgentProfile>;
 }): string;
 //#endregion
 //#region src/tools/presets.d.ts
@@ -5305,7 +5300,7 @@ declare function compilePermissionPreset(preset: PermissionPreset): {
 //#endregion
 //#region src/tools/shell-matcher.d.ts
 /**
-* Argv-parsing shell matcher (M5-T06; docs/08, section 5): shell
+* Argv-parsing shell matcher (M5-T06): shell
 * allow/ask/deny is matched through a real argv parser, never a string
 * prefix. The composition rule is the entire point: for a compound
 * command the verdict is the strictest across segments, and any
@@ -5332,7 +5327,7 @@ interface ShellSegment {
   unmatchable: boolean;
 }
 /**
-* Lexes a command into segments per the docs/08 5.2 algorithm. Quotes
+* Lexes a command into segments per the matching algorithm above. Quotes
 * and escapes are honored; nothing is expanded; `$(`, backticks, `<(`,
 * `>(`, and `<<` (outside single quotes) poison their segment.
 */
@@ -5358,19 +5353,19 @@ interface ShellPatternRules {
 declare function matchShellCommand(command: string, rules: ShellPatternRules): ShellVerdict;
 //#endregion
 //#region src/tools/tool.d.ts
-/** First-party provider tool-name constraint intersection (docs/08, section 1.1). */
+/** First-party provider tool-name constraint intersection. */
 declare const TOOL_NAME_PATTERN: RegExp;
 interface ToolInit<S extends SchemaSpec> {
   name: string;
   description: string;
   parameters: S;
-  /** Contract version, part of toolsetHash (docs/08, section 1.2). */
+  /** Contract version, part of toolsetHash. */
   version?: string;
-  /** Default 'inprocess' (docs/08, section "Executors"). */
+  /** Default 'inprocess'. */
   executor?: ToolExecutor;
-  /** Default false (docs/08, section "Terminal default"). */
+  /** Default false. */
   needsApproval?: boolean;
-  /** Policy metadata; never identity (docs/08, section "ToolRisk"). */
+  /** Policy metadata; never identity. */
   risk?: ToolRisk;
   execute: (input: Out<S>, ctx: ToolContext) => Promise<unknown>;
 }
@@ -5378,13 +5373,12 @@ interface ToolInit<S extends SchemaSpec> {
 * Defines a tool. Definition-time failures are typed ConfigErrors, never
 * first-call surprises: an illegal name, a Standard Schema without the
 * JSON Schema projection, a recursive local $ref, or a remote/dynamic
-* reference all fail here (docs/08, sections 1.1 and 2.3).
+* reference all fail here.
 */
 declare function tool<S extends SchemaSpec>(init: ToolInit<S>): ToolDef<S>;
 /**
 * The identity projection: the contract tuple that enters toolsetHash.
-* parameters is the canonicalized derived JSON Schema (docs/03, section
-* "schemaHash and toolsetHash derivation").
+* parameters is the canonicalized derived JSON Schema.
 */
 declare function toolContract(def: ToolDef): ToolContract;
 //#endregion
@@ -5419,11 +5413,11 @@ interface McpConfig {
   allow?: string[];
   /** Deny wins over allow (pre-prefix names). */
   deny?: string[];
-  /** Namespaces imported names as `${prefix}_${name}` (docs/08 6.4). */
+  /** Namespaces imported names as `${prefix}_${name}`. */
   prefix?: string;
   /** true = every imported tool needsApproval; record form is per name. */
   approval?: boolean | Record<string, boolean>;
-  /** Host-supplied risk labels for imported tools (docs/08 6.2). */
+  /** Host-supplied risk labels for imported tools. */
   risk?: Record<string, ToolRisk>;
 }
 /**
@@ -5431,19 +5425,19 @@ interface McpConfig {
 * first tools() call; tools/list is fetched with cursor pagination until
 * exhaustion and cached per session; a listChanged notification
 * invalidates the cache, affecting subsequently spawned agents only (a
-* spawn's toolset snapshot is immutable by construction; docs/08 6.3).
+* spawn's toolset snapshot is immutable by construction).
 */
 declare function mcp(cfg: McpConfig): ToolSource;
 //#endregion
 //#region src/tools/isolation.d.ts
-/** docs/06 Appendix A: the shared pin cap (park/unpark and retainWorktree). */
+/** Appendix A: the shared pin cap (park/unpark and retainWorktree). */
 declare const DEFAULT_MAX_PINNED_WORKTREES = 4;
 interface GitWorktreeProviderOptions {
   /** Host repository root; default process.cwd(). */
   repoRoot?: string;
   /**
   * Retain the tree of a FAILED agent for inspection when the engine
-  * requests keep on dispose (docs/08, section 8.3). Default false.
+  * requests keep on dispose. Default false.
   */
   keepOnError?: boolean;
   /** Pin cap shared by park/unpark and retainWorktree (default 4). */
@@ -5453,7 +5447,7 @@ interface GitWorktreeProviderOptions {
 }
 /**
 * The shipped git worktree lifecycle. A non-git host is a typed
-* ConfigError at acquire (docs/08, section 8.3, rule 1).
+* ConfigError at acquire.
 */
 declare class GitWorktreeProvider implements IsolationProvider {
   private readonly repoRoot;
@@ -5484,7 +5478,7 @@ declare class GitWorktreeProvider implements IsolationProvider {
 * of wall-clock (invariant I3: structure comes from call-and-return only).
 * The grammar is part of the hashVersion 2 profile.
 *
-* Owning spec: docs/03-journal-spec.md, section "Scope-path grammar".
+* Full contract: https://docs.rulvar.com/guide/journal.
 *
 * Segment rules: a sequential body is ONE scope (sequential calls add no
 * segment; they are distinguished by key and ordinal only). ctx.phase is
@@ -5505,7 +5499,7 @@ declare function workflowScope(parent: string, name: string, ordinal: number): s
 declare function agentScope(parent: string, seq: number): string;
 /** PlanRunner node scopes: `plan/<NodeId>` (NodeIds are engine-minted ULIDs). */
 declare function planNodeScope(nodeId: string): string;
-/** A parsed scope-path segment (docs/03, section 2.1). */
+/** A parsed scope-path segment. */
 type ScopeSegment = {
   kind: "parallel";
   site: number;
@@ -5611,7 +5605,7 @@ declare class JsonlFileStore implements JournalStore {
 /**
 * File-backed TranscriptStore (M6-T02): blobs (transcripts, checkpoints,
 * persisted CompiledWorkflow sources) as one file per ref under `dir`,
-* so compiled runs resume across processes (docs/06, 10.2). Refs follow
+* so compiled runs resume across processes. Refs follow
 * the `<runId>/<name>` convention; each path segment is checked
 * filesystem-safe and nested segments become directories.
 */
@@ -5643,8 +5637,8 @@ interface RunProfile {
   maxDepth?: number;
 }
 /**
-* The shipped presets (docs/06, section 11: fast / standard / deep /
-* ultra "and similar"). Data only; a review-time assertion checks the
+* The shipped presets (fast / standard / deep / ultra "and similar").
+* Data only; a review-time assertion checks the
 * engine has zero behavioral branches keyed on these names.
 */
 declare const RUN_PROFILES: Record<string, RunProfile>;
@@ -5656,15 +5650,15 @@ type StructuredOutputTier = "native" | "forced-tool" | "prompt";
 /**
 * Strict-schema compatibility as both first-class providers define it:
 * every object node declares `additionalProperties: false` and lists every
-* property in `required` (docs/04, section 5.2). Boolean schemas and
+* property in `required`. Boolean schemas and
 * non-object shapes are trivially compatible.
 */
 declare function isStrictCompatibleSchema(schema: JsonSchema | boolean): boolean;
 /**
-* Tier selection (docs/04, section 8.4): the model's declared ceiling
+* Tier selection: the model's declared ceiling
 * bounds the tier; the native tier additionally requires a
-* strict-compatible canonical schema (docs/04, section 5.2: relying on
-* silent server-side fallback is forbidden), degrading to forced-tool.
+* strict-compatible canonical schema (relying on silent server-side
+* fallback is forbidden), degrading to forced-tool.
 * Prefill is not a tier.
 */
 declare function selectStructuredOutputTier(caps: ModelCaps, canonicalSchema: JsonSchema): StructuredOutputTier;
@@ -5692,7 +5686,7 @@ declare function providerOf(adapter: Pick<ProviderAdapter, "id" | "provider">):
 declare function projectHistory(messages: Msg[], targetProvider: string): Msg[];
 /**
 * Lifts the adapter-shipped retention payload of one finished turn into
-* provider-raw parts (docs/04, section 2.3 retention transport). Reads
+* provider-raw parts (the retention transport). Reads
 * providerMetadata[<adapter id>].retainedParts and tags each block with
 * the adapter's provider family. Returns [] when the adapter shipped
 * nothing.
@@ -5700,17 +5694,17 @@ declare function projectHistory(messages: Msg[], targetProvider: string): Msg[];
 declare function liftRetainedParts(providerMetadata: Record<string, unknown> | undefined, adapter: Pick<ProviderAdapter, "id" | "provider">): Part[];
 //#endregion
 //#region src/runtime/compaction.d.ts
-/** Appendix A: compaction threshold default, 0.8 of contextWindow. */
+/** Compaction threshold default, 0.8 of contextWindow. */
 declare const DEFAULT_COMPACTION_THRESHOLD = .8;
 /** Deterministic marker opening every compaction summary message. */
 declare const COMPACTION_SUMMARY_PREFIX = "Summary of the conversation so far:";
-/** Per-profile compaction config (docs/06, section 6, AgentProfile). */
+/** Per-profile compaction config (AgentProfile). */
 interface CompactionConfig {
   /** Fraction of the loop model's contextWindow; default 0.8. */
   threshold?: number;
 }
 /**
-* The threshold check (docs/06, M4-T03 committed semantics): the context
+* The threshold check (M4-T03 committed semantics): the context
 * estimate is the last loop turn's inputTokens + outputTokens; the Usage
 * invariant makes inputTokens the full prompt, and the turn's output
 * joins the next prompt.
@@ -5746,7 +5740,7 @@ declare function compactMessages(messages: Msg[], summaryText: string): Msg[];
 * agent with no tools every tier rides (the M1 behavior, unchanged).
 */
 declare function canRideLoopTurn(tier: StructuredOutputTier, toolsAvailable: boolean): boolean;
-/** The inputs of the extract-necessity rule (docs/04, section 8.3, extract row). */
+/** The inputs of the extract-necessity rule. */
 interface ExtractNecessityInput {
   /** A schema is set on the call; without one extract never fires. */
   schemaSet: boolean;
@@ -5754,7 +5748,7 @@ interface ExtractNecessityInput {
   loopRef: ModelRef;
   /** The extract-resolved model (same chain, role 'extract'). */
   extractRef: ModelRef;
-  /** The required tier for the schema on the LOOP model (docs/04, section 8.4). */
+  /** The required tier for the schema on the LOOP model. */
   loopTier: StructuredOutputTier;
   /** The agent's toolset is non-empty (escalate opt-in counts). */
   toolsAvailable: boolean;
@@ -5767,7 +5761,7 @@ interface ExtractNecessityInput {
 * to a different model OR the loop model's caps cannot serve the required
 * tier OR finalize is routed, in which case the schema never rides a loop
 * or synthesis turn). Otherwise the schema rides the last loop turn with
-* no extra call (docs/04, sections 8.3 and 8.4 as amended in M4-T01).
+* no extra call (as amended in M4-T01).
 */
 declare function needsSeparateExtract(input: ExtractNecessityInput): boolean;
 /**
@@ -5775,14 +5769,14 @@ declare function needsSeparateExtract(input: ExtractNecessityInput): boolean;
 * map. This is the finalize TRIGGER: firing is decided by the presence of
 * a routing entry at any layer; the model it fires ON still resolves
 * through the full chain (a higher layer's all-roles `model` may override
-* the routed choice per docs/04, section 8.2).
+* the routed choice).
 */
 declare function roleConfiguredInRouting(role: InvocationRole, layers: Array<ResolutionLayer | undefined>): boolean;
 /**
 * The finalize firing rule: only if configured in routing, and only after
 * tools stop, which presupposes a non-empty toolset. A no-tools agent's
-* single loop turn is already its synthesis (docs/04, section 8.4 as
-* amended in M4-T01). The caller additionally gates on the loop having
+* single loop turn is already its synthesis (as amended in M4-T01). The
+* caller additionally gates on the loop having
 * ended without an abort: a limit/error/cancelled/escalated loop never
 * reaches synthesis.
 */
@@ -5792,7 +5786,7 @@ declare function finalizeFires(options: {
 }): boolean;
 /**
 * The summarize trigger: the compaction threshold on the context window
-* (docs/06, Appendix A: default 0.8). Pure predicate; the compaction
+* (default 0.8). Pure predicate; the compaction
 * pipeline that acts on it is M4-T03.
 */
 declare function atCompactionThreshold(usedTokens: number, contextWindow: number, threshold: number): boolean;
@@ -5804,7 +5798,7 @@ declare class ModelRetry extends Error {
     data?: Json;
   });
 }
-/** Bounded semantic retries per tool call chain (docs/06, Appendix A). */
+/** Bounded semantic retries per tool call chain. */
 declare const DEFAULT_MODEL_RETRY_ATTEMPTS = 2;
 //#endregion
 //#region src/runtime/structured-output.d.ts
@@ -5838,18 +5832,18 @@ declare function extractCandidate(turn: CollectedTurn, tier: StructuredOutputTie
 declare function formatRePrompt(issues: Issue$1[], attempt: number, maxAttempts: number): Msg;
 //#endregion
 //#region src/orchestrator/spawn-tools.d.ts
-/** docs/07 4.2: the spawn_agent parameter schema (normative). */
+/** The spawn_agent parameter schema (normative). */
 declare const SPAWN_AGENT_SCHEMA: SchemaSpec;
-/** docs/07 4.3: parallel_agents wraps the spawn_agent params. */
+/** parallel_agents wraps the spawn_agent params. */
 declare const PARALLEL_AGENTS_SCHEMA: SchemaSpec;
-/** docs/07 4.4: await_any and await_all share one parameter shape. */
+/** await_any and await_all share one parameter shape. */
 declare const AWAIT_SCHEMA: SchemaSpec;
-/** docs/07 4.5: cancel_agent. */
+/** The cancel_agent parameter schema. */
 declare const CANCEL_AGENT_SCHEMA: SchemaSpec;
-/** docs/07 4.11: finish; result validates against the declared output schema. */
+/** finish; result validates against the declared output schema. */
 declare const FINISH_SCHEMA: SchemaSpec;
 declare const FINISH_TOOL_NAME = "finish";
-/** The spawn parameters as validated JSON (docs/07 4.1 TaskSpec subset). */
+/** The spawn parameters as validated JSON (a TaskSpec subset). */
 interface SpawnAgentParams {
   agentType: string;
   prompt: string;
@@ -5870,15 +5864,14 @@ interface SpawnAgentParams {
 /**
 * Builds the mode (c) toolset over the per-call runtime. profileCardText
 * rides the spawn tools' descriptions so both modes speak one agent
-* vocabulary (docs/06 9.3; M6-T04).
+* vocabulary (M6-T04).
 */
 declare function buildOrchestratorTools(runtime: OrchestratorRuntime, profileCardText: string): ToolDef[];
 //#endregion
 //#region src/engine/events.d.ts
 /**
 * Spans form a tree per run; spanId values are engine-minted opaque
-* strings, unique per run, pure telemetry, never identity (docs/09,
-* section "Span hierarchy").
+* strings, unique per run, pure telemetry, never identity.
 */
 declare class SpanRegistry {
   private readonly parents;
@@ -5905,8 +5898,7 @@ declare class EventBus {
     spans: SpanRegistry;
     now?: () => number;
     /**
-    * Default true (M8-T04; docs/09, section "Redaction and sensitive
-    * data"): key-shaped strings in every emitted body are masked.
+    * Default true (M8-T04): key-shaped strings in every emitted body are masked.
     * Telemetry only, never the journal: events are excluded from
     * identity by construction, so masking cannot perturb replay.
     */
@@ -5922,7 +5914,7 @@ declare class EventBus {
 }
 //#endregion
 //#region src/runner/sandbox-bridge.d.ts
-/** Methods a sandbox script may proxy to the host ctx (docs/06, 8.2). */
+/** Methods a sandbox script may proxy to the host ctx. */
 type SandboxMethod = "agent" | "step" | "workflow" | "awaitExternal" | "parallel" | "pipeline" | "phase" | "budget.spent" | "budget.remaining";
 /** Worker-to-host protocol messages (JSON only). */
 type SandboxWorkerToHost = {
@@ -5985,4 +5977,4 @@ interface SandboxBridge {
 }
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, BUDGET_ABORT_REASON, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildIdentityInput, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINISH_SCHEMA, FINISH_TOOL_NAME, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_DEPTH_CEILING, MatchResult, McpConfig, MechanicalGateProfile, MechanicalGateVerdict, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, type Pricing, type ProviderAdapter, QualityFloors, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RandIdentityInput, RandPayload, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStatus, RuntimeEventSink, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, agentErrorFromWire, agentErrorToWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, providerOf, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateSchemaSpec, validateTerminationLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, BUDGET_ABORT_REASON, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildIdentityInput, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINISH_SCHEMA, FINISH_TOOL_NAME, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_DEPTH_CEILING, MatchResult, McpConfig, MechanicalGateProfile, MechanicalGateVerdict, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, type Pricing, type ProviderAdapter, QualityFloors, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RandIdentityInput, RandPayload, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStatus, RuntimeEventSink, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, agentErrorFromWire, agentErrorToWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateSchemaSpec, validateTerminationLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };