@rulvar/core 1.226.0 → 1.228.0

package/dist/index.js

@@ -8745,6 +8745,94 @@ function lastRunSettle(entries) {
 		}
 	}
 }
+/**
+* The scope of every field the engine writes onto a terminal (RV2510),
+* as one exported table rather than as sentences scattered through
+* field docs.
+*
+* The twenty-fifth comparison run was killed and resumed, and its two
+* terminals mixed both kinds with nothing marking which was which: the
+* money was cumulative, the wake count and the replay figures were not,
+* and reconciling them into one honest account of the logical run was
+* hand work over a joined journal. Keys are field paths as a consumer
+* reads them off `RunOutcome` (`cost.orchestrator.wakes`); the
+* doctrine test holds this table against the keys a real outcome
+* carries, so a new terminal field cannot ship without declaring what
+* it counts.
+*/
+const TERMINAL_TELEMETRY_SCOPE = Object.freeze({
+	status: "terminal",
+	value: "terminal",
+	error: "terminal",
+	envelope: "terminal",
+	completion: "terminal",
+	childStatusCounts: "cumulative",
+	degradedReasons: "cumulative",
+	salvagedPartialChildren: "cumulative",
+	salvagedTerminalOutputChildren: "cumulative",
+	belowFloorOkChildren: "cumulative",
+	acceptanceChildren: "cumulative",
+	semanticPasses: "terminal",
+	claimConsistencyMeta: "terminal",
+	synthesisSkipped: "terminal",
+	deliverableAccepted: "terminal",
+	resultAvailable: "terminal",
+	acceptedArtifactRef: "terminal",
+	rejectedFinishCandidates: "cumulative",
+	dropped: "cumulative",
+	pending: "terminal",
+	usage: "cumulative",
+	cost: "cumulative",
+	"cost.totalUsd": "cumulative",
+	"cost.grossUsd": "cumulative",
+	"cost.wireRequests": "cumulative",
+	"cost.orchestrator.spentUsd": "cumulative",
+	"cost.orchestrator.wakes": "segment",
+	"cost.orchestrator.forcedFinish": "segment",
+	"cost.orchestrator.reserveUsedUsd": "segment",
+	transportRetries: "segment",
+	schemaRejectedFinishExchanges: "segment",
+	schemaRecoveredFinishExchanges: "segment"
+});
+/**
+* Folds a run's journal into the logical run's telemetry (RV2510): how
+* many segments ran, how each settled, and how much durable work each
+* one did, from entries the journal already holds. No new field, so it
+* reads journals written by every prior version exactly as well as
+* today's.
+*
+* The replay dedup is the design. Cumulative figures are deliberately
+* NOT here: money and usage fold from the WHOLE journal through
+* `costReportFromJournal` and the usage ledger, and re-summing them per
+* segment would count every replayed operation once per segment that
+* replayed it, which is exactly the reconciliation this fold exists to
+* make unnecessary. What it reports instead is a PARTITION of the
+* journal by settle boundary, so no entry is counted twice by
+* construction, and the segment-scoped figures a terminal carries
+* ({@link TERMINAL_TELEMETRY_SCOPE} names them) can be read against the
+* segment that produced them.
+*/
+function logicalRunTelemetry(entries) {
+	const statuses = [];
+	const entriesPerSegment = [];
+	let sinceLastSettle = 0;
+	for (const entry of entries) {
+		sinceLastSettle += 1;
+		if (entry.kind !== "decision") continue;
+		const value = entry.value;
+		if (value?.decisionType !== "run_settle" || typeof value.runStatus !== "string" || !RUN_STATUSES.has(value.runStatus)) continue;
+		statuses.push(value.runStatus);
+		entriesPerSegment.push(sinceLastSettle);
+		sinceLastSettle = 0;
+	}
+	return {
+		segments: statuses.length,
+		statuses,
+		entriesPerSegment,
+		entries: entries.length,
+		entriesAfterLastSettle: sinceLastSettle
+	};
+}
 function structure(entries) {
 	const referenced = /* @__PURE__ */ new Set();
 	for (const entry of entries) if (entry.ref !== void 0) referenced.add(entry.ref);
@@ -10926,11 +11014,16 @@ function applyOutputBudget(req, target, budget) {
 	const floor = outputFloorOf(target);
 	if (req.maxOutputTokens !== void 0 && req.maxOutputTokens < floor) throw new ConfigError(`the per-turn output cap ${String(req.maxOutputTokens)} is below the ${String(floor)} token output floor of ${target.resolved.ref}; the provider would reject every dispatch, so raise limits.maxOutputTokensPerTurn to at least the floor`);
 	const hook = budget?.maxAffordableOutputTokens;
-	if (hook === void 0) return req;
-	const affordable = hook(target.resolved.ref, estimateInputTokens(req.messages));
+	const exposureHook = budget?.maxExposureOutputTokens;
+	if (hook === void 0 && exposureHook === void 0) return req;
+	const estimatedInput = estimateInputTokens(req.messages);
+	const budgetAffordable = hook?.(target.resolved.ref, estimatedInput);
+	const exposureAffordable = exposureHook?.(target.resolved.ref, estimatedInput);
+	const usableExposure = exposureAffordable !== void 0 && exposureAffordable >= floor ? exposureAffordable : void 0;
+	const affordable = budgetAffordable === void 0 ? usableExposure : usableExposure === void 0 ? budgetAffordable : Math.min(budgetAffordable, usableExposure);
 	if (affordable === void 0) return req;
 	if (affordable < floor) {
-		const zeroInputAffordable = hook(target.resolved.ref, 0);
+		const zeroInputAffordable = hook?.(target.resolved.ref, 0);
 		if (zeroInputAffordable !== void 0 && zeroInputAffordable < floor) throw new BudgetExhaustedError(floor === 1 ? `the remaining budget cannot afford one output token from ${target.resolved.ref}; the turn was not dispatched` : `the remaining budget cannot afford the ${String(floor)} token output floor of ${target.resolved.ref}; the turn was not dispatched`, { data: { reason: "output-floor" } });
 		return {
 			...req,
@@ -13572,7 +13665,12 @@ async function runAgent(options) {
 * model, and a turn that cannot afford one output token is denied before
 * dispatch. Layer 3: the AbortSignal ceiling severing live streams, with
 * partial usage written usageApprox.
-* B0 is immutable after start: no API tops it up.
+* B0 is immutable WITHIN a segment: no API tops up a live run's ceiling
+* (RV2511 corrects the older "immutable after start", which RV2208 made
+* false). The one thing that can change it is `ResumeOptions.run`, an
+* explicit host decision journaled as its own decision entry, and it
+* takes effect only by opening a NEW segment: a live run can never
+* raise the bound it is already being measured against.
 *
 * The account tree: the run root plus one
 * sub-account per admitted child workflow (and, from M7, the orchestrator
@@ -13677,6 +13775,8 @@ var RunBudget = class {
 	* reservation surface is inert and reserveTurnExposure never binds.
 	*/
 	maxInFlightExposureUsd;
+	/** The opt-in lone-dispatch clamp (RV2503); see maxExposureOutputTokens. */
+	clampTurnToExposure = false;
 	lifetimeSpawnCap;
 	events;
 	priceUsd;
@@ -13745,6 +13845,7 @@ var RunBudget = class {
 			requireValidCeiling(options.maxInFlightExposureUsd, "maxInFlightExposureUsd");
 			this.maxInFlightExposureUsd = options.maxInFlightExposureUsd;
 		}
+		this.clampTurnToExposure = options.clampTurnToExposure === true;
 		this.lifetimeSpawnCap = options.lifetimeSpawnCap ?? 500;
 		if (options.events !== void 0) this.events = options.events;
 		if (options.priceUsd !== void 0) this.priceUsd = options.priceUsd;
@@ -14327,6 +14428,59 @@ var RunBudget = class {
 		return affordableOutputTokens(pricing, remainingUsd, estimatedInputTokens);
 	}
 	/**
+	* The same layer-2b question asked of the IN-FLIGHT EXPOSURE ceiling
+	* (RV2503): the output tokens `cap - spent - live estimates` still
+	* affords from `servedBy` for an estimated prompt, priced by the
+	* settlement function like every other estimate here.
+	*
+	* The clamp above has always existed for the budget ceiling while
+	* {@link reserveTurnExposure} only ever answered yes or no, so a
+	* turn whose FULL planned output overshot the exposure line was
+	* refused outright even when a shorter one fit and the budget could
+	* pay for it. The 1.226.0 comparison run died exactly there: it held
+	* 0.8642 USD of budget, the exposure ceiling had 0.5642 USD of room,
+	* the mandatory repair turn was estimated at 0.7066 USD against an
+	* 18000 token output plan, and the dispatch was refused before any
+	* provider call. The same turn, re-issued after the operator raised
+	* the ceiling, wrote 12840 output tokens and cost 0.4788 USD: it fit
+	* the ceiling that refused it, and a clamp to the ~13253 tokens the
+	* room afforded would have let it run.
+	*
+	* Answered ONLY for a dispatch that is alone in flight, which is the
+	* whole difference between a refusal that means something and one
+	* that means nothing. With siblings live the refusal is TRANSIENT:
+	* RV1902 parks on it and the turn runs at its full planned length
+	* the moment one of them releases, so shortening it would trade a
+	* complete answer for a truncated one and buy nothing. With nothing
+	* live the refusal is PERMANENT (RV2003's sweep wakes such a waiter
+	* 'drained' precisely because no hold will ever return), and the
+	* only choices left are a shorter turn or no turn at all. The
+	* concurrent-wave bound of RV711 is therefore untouched.
+	*
+	* Opt-in through `RunOptions.clampTurnToExposure`, so the drained
+	* refusal terminals RV1902, RV2002 and RV2003 built out of live
+	* parity deaths keep their shapes until a host asks for this one.
+	*
+	* Undefined when the clamp is not armed, when the cap is not
+	* configured, when anything is in flight, or when the model has no
+	* price row, so a run that declares nothing keeps every byte of its
+	* historical path. Zero or
+	* negative when the room cannot even pay for the prompt, the same
+	* convention {@link maxAffordableOutputTokens} inherits from
+	* `affordableOutputTokens`; the caller decides what a sub-floor
+	* answer means, and the loop deliberately ignores one so a true
+	* exposure exhaustion still refuses through
+	* {@link reserveTurnExposure} with its own typed reason instead of
+	* an output-floor verdict.
+	*/
+	maxExposureOutputTokens(servedBy, estimatedInputTokens) {
+		const cap = this.maxInFlightExposureUsd;
+		if (!this.clampTurnToExposure || cap === void 0 || this.inFlightExposureUsd > 0) return;
+		const pricing = this.pricingOf?.(servedBy);
+		if (pricing === void 0) return;
+		return affordableOutputTokens(pricing, Math.max(0, cap - this.root.spentUsd), estimatedInputTokens);
+	}
+	/**
 	* Live accounting; spend propagates from `accountScope` to every
 	* ancestor. Crossing a ceiling severs the crossing account's subtree
 	* via its layer-3 AbortSignal (overshoot bounded by one turn per
@@ -18132,6 +18286,7 @@ function createCtx(internals, rootWorkflow) {
 				remainingUsd: () => internals.budget.remainingUsd(budgetAccount),
 				...internals.budget.strictPricing === void 0 ? {} : { assertPricedDispatch: (servedBy) => internals.budget.assertPricedDispatch(servedBy) },
 				...internals.budget.maxInFlightExposureUsd === void 0 ? {} : {
+					maxExposureOutputTokens: (servedBy, estimatedInputTokens) => internals.budget.maxExposureOutputTokens(servedBy, estimatedInputTokens),
 					admitTurnExposure: (servedBy, estimatedInputTokens, plannedOutputTokens) => internals.budget.reserveTurnExposure(servedBy, estimatedInputTokens, plannedOutputTokens, `agent:${running.seq}`),
 					awaitExposureRelease: (signal) => internals.budget.awaitExposureRelease(signal),
 					liveExposureUsd: () => internals.budget.liveExposureUsd
@@ -19954,6 +20109,29 @@ const MAX_LISTED_CITATIONS = 20;
 */
 const MAX_NAMED_OFFENDING_SENTENCES = 5;
 const MAX_OFFENDING_SENTENCE_CHARS = 240;
+/**
+* The shortest run id {@link evidenceGradeValidator} will accept as an
+* artifact (RV2501). The floor mirrors the id half of
+* {@link DEFAULT_ARTIFACT_PATTERN}: a two character id would satisfy
+* nearly every sentence by accident, which is the fail-open the empty
+* pattern guard exists to prevent. The id is additionally matched as a
+* whole identifier, so it cannot be credited from inside a longer
+* word, and only inside the sentence making the claim.
+*/
+const MIN_RUN_ID_ARTIFACT_CHARS = 6;
+/**
+* True when `value` occurs in `haystack` as a whole IDENTIFIER
+* (RV2501). Deliberately not {@link containsToken}: that boundary
+* class carries the dot, so an id written at the end of a sentence is
+* followed by the sentence period and would never be credited, which
+* is the most natural place to write one. Word characters alone bound
+* an id, so `x<id>y` is refused while `` `<id>` `` and `<id>.` are
+* credited. The value is matched literally (metacharacters escaped).
+*/
+function containsIdentifier(haystack, value) {
+	const escaped = value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+	return new RegExp(`(?<!\\w)${escaped}(?!\\w)`, "u").test(haystack);
+}
 function listCitations(values) {
 	return values.length <= MAX_LISTED_CITATIONS ? values.join(", ") : `${values.slice(0, MAX_LISTED_CITATIONS).join(", ")} and ${String(values.length - MAX_LISTED_CITATIONS)} more`;
 }
@@ -20228,7 +20406,22 @@ const DEFAULT_ARTIFACT_PATTERN = "(?:run[ -]?[0-9A-HJKMNP-TV-Z]{6,26}|[\\w./-]+\
 * paragraphs away no longer satisfies the grade. Purely textual: what
 * the referenced artifact contains is
 * {@link citedValueValidator}'s question, and whether it exists on
-* disk is the host's. Default name 'evidence-grade'.
+* disk is the host's.
+*
+* The run's OWN id is an artifact (RV2501). `DEFAULT_ARTIFACT_PATTERN`
+* only ever matched the literal word `run` followed by a ULID, so the
+* escape the verdict advertised was unreachable for every run whose id
+* the engine did not mint in that exact shape: the comparison run's
+* `comparison-rulvar-v12260-aug09-...` matched nothing, its synthesis
+* had no artifact it could name, and a document that told the truth
+* about the run it was part of could not be written at all. When
+* {@link FinishValidationInput.runId} is supplied (the orchestrator
+* runtime always supplies it), a sentence carrying that id verbatim as
+* a whole token satisfies the grade, and the verdict names the id so
+* the repair instruction is executable rather than aspirational. An id
+* shorter than `MIN_RUN_ID_ARTIFACT_CHARS` (six) is ignored, and
+* without an id the verdict is byte identical to the historical one.
+* Default name 'evidence-grade'.
 */
 function evidenceGradeValidator(options) {
 	const phrases = options?.phrases === void 0 ? [...DEFAULT_EVIDENCE_GRADE_PHRASES] : requireNonEmptyStrings(options.phrases, "evidenceGradeValidator phrases");
@@ -20246,10 +20439,11 @@ function evidenceGradeValidator(options) {
 		validate: (input) => {
 			const unsupported = [];
 			const offenders = [];
+			const runId = typeof input.runId === "string" && input.runId.trim().length >= MIN_RUN_ID_ARTIFACT_CHARS ? input.runId.trim() : void 0;
 			for (const sentence of sentencesOf(input.text)) {
 				const haystack = sentence.toLowerCase();
 				const found = lowered.filter((phrase) => haystack.includes(phrase));
-				if (found.length === 0 || new RegExp(artifactPattern, "").test(sentence)) continue;
+				if (found.length === 0 || new RegExp(artifactPattern, "").test(sentence) || runId !== void 0 && containsIdentifier(sentence, runId)) continue;
 				offenders.push(sentence);
 				for (const phrase of found) if (!unsupported.includes(phrase)) unsupported.push(phrase);
 			}
@@ -20262,7 +20456,7 @@ function evidenceGradeValidator(options) {
 			return {
 				ok: false,
 				reasons: [
-					`evidence-grade claims cite no run or repro artifact in their own sentence: ${listCitations(unsupported)}; give each such claim a file:line citation in its own sentence, or state its run id in a SEPARATE sentence carrying no source citation (a run id written beside a path:line citation is not in the cited window and trades this failure for a cited-value one)`,
+					runId === void 0 ? `evidence-grade claims cite no run or repro artifact in their own sentence: ${listCitations(unsupported)}; give each such claim a file:line citation in its own sentence, or state its run id in a SEPARATE sentence carrying no source citation (a run id written beside a path:line citation is not in the cited window and trades this failure for a cited-value one)` : `evidence-grade claims cite no run or repro artifact in their own sentence: ${listCitations(unsupported)}; write this run's id ${runId} inside each such sentence, or give the claim a file:line citation instead (the id may share a sentence with a source citation: cited-value reads a run id as identity, not as a value asserted about the cited line)`,
 					...named,
 					...overflow > 0 ? [`and ${String(overflow)} more offending sentences`] : []
 				]
@@ -20273,6 +20467,15 @@ function evidenceGradeValidator(options) {
 /** Splits a citation into its path and line halves at the LAST colon. */
 const CITATION_TAIL$1 = /^(.*):(\d+)$/u;
 /**
+* A commit sha span (RV2502). Twelve hex characters is the floor: real
+* abbreviations run 7 to 12 and full shas 40, while shorter hex words
+* (`deadbeef`) are ordinary literals a document may legitimately assert
+* about a cited line, so they stay judged.
+*/
+const COMMIT_SHA_SPAN = /^[0-9a-f]{12,64}$/u;
+/** A release version span (RV2502), with an optional tail. */
+const VERSION_SPAN = /^v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z][0-9A-Za-z.-]*)?$/u;
+/**
 * True when `value` occurs in `haystack` as a WHOLE token (RV1402, the
 * seventeenth comparison experiment P0-1). Substring matching credited
 * an asserted `3` against a line that says `30`, so the validator
@@ -20308,6 +20511,27 @@ function containsToken(haystack, value) {
 * ({@link citationTargetsValidator} judges every citation with no such
 * precondition).
 *
+* One span class is IDENTITY, not assertion (RV2502, the 1.226.0
+* comparison run): a span naming the artefact under review says which
+* commit, run, or release the document is about, and asserts nothing
+* about any cited line. That run's synthesis wrote its frozen commit
+* sha beside source citations and the validator demanded the sha appear
+* in the cited source, an impossible repair, in the same verdict that
+* demanded three real value fixes; two granted repairs burned and the
+* finish was rejected. Three shapes are structural and always excluded:
+* a commit sha (12 to 64 hex characters, long enough that ordinary hex
+* literals stay judged), a release version (`1.2.3`, `v1.2.3`, with an
+* optional prerelease or build tail), and the run's own id when the
+* runtime supplies `runId`. Host vocabulary is declared: `notValues`
+* lists spans this document writes as identity, verdict words like
+* `conditionally ready` among them.
+*
+* The run-id exclusion is what makes the bundle self consistent
+* (RV2501, RV2202): the evidence grade instructs a failing model to
+* write this run's id inside the offending sentence, and before RV2502
+* doing so beside a citation traded an evidence-grade failure for a
+* cited-value one. The two repair instructions now compose.
+*
 * `resolve` is host code and must be PURE over a snapshot the host
 * froze before the run, exactly like every other finish validator: a
 * resolver that reads the filesystem live would make a verdict depend
@@ -20318,6 +20542,9 @@ function containsToken(haystack, value) {
 */
 function citedValueValidator(options) {
 	if (typeof options.resolve !== "function") throw new ConfigError("citedValueValidator resolve must be a function");
+	if (options.notValues !== void 0) {
+		if (!Array.isArray(options.notValues) || options.notValues.some((value) => typeof value !== "string" || value.length === 0)) throw new ConfigError("citedValueValidator notValues must be an array of non empty strings");
+	}
 	const window = options.window ?? 0;
 	if (!Number.isInteger(window) || window < 0) throw new ConfigError(`citedValueValidator window must be a non negative integer; got ${String(window)}`);
 	const pattern = options.pattern ?? "[\\w./-]+\\.\\w+:\\d+";
@@ -20326,10 +20553,17 @@ function citedValueValidator(options) {
 	} catch (thrown) {
 		throw new ConfigError(`citedValueValidator pattern does not compile: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
 	}
+	const declaredNotValues = new Set(options.notValues ?? []);
 	return {
 		name: options.name ?? "cited-value",
 		validate: (input) => {
 			const reasons = [];
+			const runId = typeof input.runId === "string" && input.runId.trim().length >= MIN_RUN_ID_ARTIFACT_CHARS ? input.runId.trim() : void 0;
+			/**
+			* True when the span NAMES the artefact under review instead of
+			* asserting something about a cited line (RV2502).
+			*/
+			const isIdentity = (span) => declaredNotValues.has(span) || span === runId || COMMIT_SHA_SPAN.test(span) || VERSION_SPAN.test(span);
 			for (const sentence of sentencesOf(input.text)) {
 				const spans = [...sentence.matchAll(/`([^`]+)`/gu)].map((match) => match[1]);
 				const citations = [];
@@ -20341,7 +20575,7 @@ function citedValueValidator(options) {
 						path: parsed[1],
 						line
 					});
-					else values.push(span);
+					else if (!isIdentity(span)) values.push(span);
 				}
 				if (citations.length === 0 || values.length === 0) continue;
 				for (const citation of citations) {
@@ -20917,8 +21151,10 @@ function pairRunFactClaims(draftText, sheet, options) {
 /** Derives the {@link ClaimCoverageGrade} of a claim-consistency meta. */
 function claimCoverageOf(meta) {
 	if (meta.judgeFailed === true) return "judge-failed";
+	if (meta.judgeDeclined === true) return "judge-declined";
 	if ((meta.criticalUncoveredTotal ?? 0) > 0) return "critical-uncovered";
 	if (meta.truncated || meta.runFactPairsTruncated === true || meta.coveredCitingSentences < meta.draftCitingSentences) return "partial";
+	if (meta.draftCitingSentences === 0) return "vacuous";
 	return "full";
 }
 //#endregion
@@ -21481,6 +21717,8 @@ function validateOrchestrateOptions(opts) {
 		}
 		if (fv.maxRepairs !== void 0) requireNonNegativeInteger(fv.maxRepairs, "orchestrate finishValidation.maxRepairs");
 		if (fv.repairTurnReserve !== void 0) requireNonNegativeInteger(fv.repairTurnReserve, "orchestrate finishValidation.repairTurnReserve");
+		const retain = fv.retainRejectedCandidates;
+		if (retain !== void 0 && typeof retain !== "boolean") throw new ConfigError("orchestrate finishValidation.retainRejectedCandidates must be a boolean");
 		const draftPolicy = fv.draftPolicy;
 		if (draftPolicy !== void 0) {
 			if (draftPolicy !== "contract" && (typeof draftPolicy !== "object" || draftPolicy === null)) throw new ConfigError("orchestrate finishValidation.draftPolicy must be an object or the sentinel 'contract'");
@@ -21545,6 +21783,11 @@ function validateOrchestrateOptions(opts) {
 			if (typeof conditional.carryDraftGaps !== "boolean") throw new ConfigError("orchestrate synthesis.carryDraftGaps must be a boolean; got " + typeof conditional.carryDraftGaps);
 			if (conditional.carryDraftGaps && conditional.skipWhenDraftValid !== true) throw new ConfigError("orchestrate synthesis.carryDraftGaps requires skipWhenDraftValid: the gaps ARE the failed pre-pass verdict, and without the pre-pass there is nothing to carry");
 		}
+		const floor = synthesis.fallbackToValidDraft;
+		if (floor !== void 0) {
+			if (typeof floor !== "boolean") throw new ConfigError("orchestrate synthesis.fallbackToValidDraft must be a boolean; got " + typeof floor);
+			if (floor && opts.finishValidation === void 0) throw new ConfigError("orchestrate synthesis.fallbackToValidDraft requires finishValidation: without a declared finish contract there is nothing to judge the draft valid by");
+		}
 		if (symmetry.context !== void 0 && symmetry.context !== "digests" && symmetry.context !== "full") throw new ConfigError("orchestrate synthesis.context must be 'digests' or 'full'; got " + JSON.stringify(symmetry.context));
 		const index = synthesis.evidenceIndex;
 		if (index !== void 0) {
@@ -21610,6 +21853,9 @@ function validateOrchestrateOptions(opts) {
 			if (opts.synthesis === void 0) throw new ConfigError("orchestrate claimConsistency.onFound 'carry' requires synthesis: without the post-fan-in invocation there is no prompt to carry the findings into; use 'report' or 'fail'");
 			if (opts.synthesis.mode === "incremental") throw new ConfigError("orchestrate claimConsistency.onFound 'carry' needs a 'single' synthesis: the deterministic 'incremental' reconciliation has no prompt for the findings to ride");
 		}
+		const stage = consistency.stage ?? "draft";
+		if (stage !== "draft" && stage !== "final" && stage !== "both") throw new ConfigError("orchestrate claimConsistency.stage must be 'draft', 'final' or 'both'; got " + JSON.stringify(consistency.stage));
+		if (stage !== "draft" && opts.synthesis === void 0) throw new ConfigError(`orchestrate claimConsistency.stage '${stage}' requires synthesis: without the post-fan-in invocation the coordination draft IS the final artifact, and the default 'draft' already judges it`);
 		if (consistency.pattern !== void 0) {
 			if (typeof consistency.pattern !== "string") throw new ConfigError(`orchestrate claimConsistency.pattern must be a string; got ${typeof consistency.pattern}`);
 			let probe;
@@ -22900,7 +23146,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 				const input = {
 					result,
 					text: typeof result === "string" ? result : JSON.stringify(result),
-					children: validationChildren()
+					children: validationChildren(),
+					runId: internals.runId
 				};
 				const failed = [];
 				for (const validator of validationSpec.validators) {
@@ -22921,6 +23168,25 @@ function makeOrchestratorWorkflow(goal, opts) {
 					});
 				}
 				const repairsUsed = known.filter((candidate) => candidate.verdict !== "accepted" && contractGenerationCurrent(candidate)).length;
+				const rejectedCandidate = failed.length > 0;
+				let candidateRef;
+				if (rejectedCandidate && validationSpec.retainRejectedCandidates === true) {
+					const ref = `${internals.runId}/finish-rejected/${call.id}`;
+					try {
+						await internals.transcripts.put(ref, new TextEncoder().encode(input.text), internals.lease);
+						candidateRef = ref;
+					} catch (writeFailed) {
+						internals.events.emit({
+							type: "log",
+							level: "warn",
+							msg: "orchestrator rejected finish candidate not retained",
+							data: {
+								ref,
+								reason: (writeFailed instanceof Error ? writeFailed.message : String(writeFailed)).slice(0, 200)
+							}
+						}, callingState.spanId);
+					}
+				}
 				decision = {
 					decisionType: "orchestrator_finish_validation",
 					callId: call.id,
@@ -22928,7 +23194,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 					failed,
 					repairsUsed,
 					maxRepairs,
-					...validationSpec.contract === void 0 ? {} : { contractHash: validationSpec.contract.hash }
+					...validationSpec.contract === void 0 ? {} : { contractHash: validationSpec.contract.hash },
+					...rejectedCandidate ? {
+						candidateHash: createHash("sha256").update(jcsSerialize(result), "utf8").digest("hex"),
+						candidateChars: input.text.length,
+						...candidateRef === void 0 ? {} : { candidateRef }
+					} : {}
 				};
 				await internals.replayer.appendSinglePhase({
 					scope: callingState.scope,
@@ -23013,7 +23284,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 				const input = {
 					result,
 					text,
-					children: validationChildren()
+					children: validationChildren(),
+					runId: internals.runId
 				};
 				for (const validator of validationSpec?.validators ?? []) {
 					let verdict;
@@ -23395,6 +23667,14 @@ function makeOrchestratorWorkflow(goal, opts) {
 		*/
 		let synthesisSkippedByValidDraft = false;
 		/**
+		* The journal seq of the skip decision that carried the RV510 gate
+		* (RV2506): the addressable provenance of the artifact a skipped
+		* run settles on, since a skipped synthesis leaves no accepted
+		* finish-validation decision behind and the draft's acceptance
+		* lives in the skip entry instead.
+		*/
+		let synthesisSkipDecisionRef;
+		/**
 		* The bounded contradiction pass's findings (RV1302), set exactly
 		* when the pass is configured: an EMPTY array is a fact (the pass
 		* ran and the pool agreed) and `undefined` is a different fact
@@ -23414,6 +23694,18 @@ function makeOrchestratorWorkflow(goal, opts) {
 		/** Set whenever the pass ran, findings or not (the RV1404 pairing). */
 		let claimConsistencyMeta;
 		/**
+		* Which document the claim-consistency pass judges (RV2509),
+		* default `'draft'`: the historical ordering, byte for byte.
+		*/
+		const claimStage = opts?.claimConsistency?.stage ?? "draft";
+		/**
+		* Under `stage: 'both'` the pre-synthesis verdict, kept beside the
+		* final one (RV2509): `claimConsistencyMeta` reports the SHIPPED
+		* document because that is what a consumer gates on, and the draft
+		* verdict is the record of the gate that let the synthesis run.
+		*/
+		let claimConsistencyDraftMeta;
+		/**
 		* The salvage arms the acceptance decision counted (RV1403), set on
 		* the accepted path AFTER the decision, fresh or rolled forward
 		* from the journal, so live and resume read the same lists; a
@@ -23511,7 +23803,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 		* entry, so a resume replays the verdict with zero paid calls and
 		* this pass journals nothing of its own.
 		*/
-		const runClaimConsistencyPass = async (draft, snapshot) => {
+		const runClaimConsistencyPass = async (draft, snapshot, stage = "draft") => {
 			const spec = opts?.claimConsistency;
 			if (spec === void 0) return;
 			await recoveryDone;
@@ -23607,7 +23899,9 @@ function makeOrchestratorWorkflow(goal, opts) {
 				};
 				return {
 					...bare,
-					coverage: claimCoverageOf(bare)
+					coverage: claimCoverageOf(bare),
+					judgedStage: stage,
+					judgedHash: createHash("sha256").update(jcsSerialize(draft ?? null), "utf8").digest("hex")
 				};
 			};
 			if (spec.onLowCoverage === "fail" && metaBase.lowCoverage !== void 0) {
@@ -23666,7 +23960,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const judgeOpts = {
 				role: "synthesize",
 				result: "full",
-				label: CLAIM_JUDGE_LABEL,
+				label: stage === "draft" ? CLAIM_JUDGE_LABEL : `${CLAIM_JUDGE_LABEL}-final`,
 				schema: CLAIM_JUDGE_SCHEMA,
 				limits: spec.judge?.limits ?? { maxTurns: 3 },
 				...spec.judge?.model === void 0 ? {} : { model: spec.judge.model },
@@ -23682,7 +23976,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 					judgeInvoked: false,
 					judgeDeclined: true
 				});
-				const declineKey = deriverV2.deriveKey({ kind: "orchestrator-claim-judge-declined" });
+				const declineKey = deriverV2.deriveKey({ kind: stage === "draft" ? "orchestrator-claim-judge-declined" : "orchestrator-claim-judge-declined-final" });
 				if (!internals.replayer.snapshot().some((entry) => entry.kind === "decision" && entry.key === declineKey)) await internals.replayer.appendSinglePhase({
 					scope: callingState.scope,
 					key: declineKey,
@@ -23801,6 +24095,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				const prior = internals.replayer.snapshot().filter((entry) => entry.kind === "decision" && entry.scope === callingState.scope && entry.key === skipKey).at(-1);
 				if (prior !== void 0 && applies(prior.value)) {
 					synthesisSkippedByValidDraft = true;
+					synthesisSkipDecisionRef = prior.seq;
 					announceSkip(prior.seq);
 					return draft;
 				}
@@ -23848,7 +24143,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 					const input = {
 						result: draftValue,
 						text: typeof draftValue === "string" ? draftValue : JSON.stringify(draftValue),
-						children: validationChildren()
+						children: validationChildren(),
+						runId: internals.runId
 					};
 					const failed = [];
 					for (const validator of validationSpec.validators) {
@@ -23914,6 +24210,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 						});
 						if (orchestratorAccount !== void 0 && (opts?.budget?.synthesisReserveUsd ?? 0) > 0) internals.budget.releaseSynthesisReserve(orchestratorAccount);
 						synthesisSkippedByValidDraft = true;
+						synthesisSkipDecisionRef = skipEntry.seq;
 						announceSkip(skipEntry.seq);
 						return draft;
 					}
@@ -24036,13 +24333,14 @@ function makeOrchestratorWorkflow(goal, opts) {
 					}
 					return `RUN FACTS: ${JSON.stringify({
 						scope: "settled-children-only",
+						runId: internals.runId,
 						children: settledEntries.length,
 						byStatus: Object.fromEntries(Object.keys(byStatus).sort().map((status) => [status, byStatus[status]])),
 						wireRequests,
 						wireIdsMissing,
 						inputTokens,
 						outputTokens
-					})} (live-observed by this run's own harness; production evidence it is not; the settled children ONLY, excluding this orchestrator, judges, and synthesis; the whole run's totals are the terminal envelope and invoice)`;
+					})} (live-observed by run ${internals.runId}, this run's own harness; production evidence it is not; the settled children ONLY, excluding this orchestrator, judges, and synthesis; the whole run's totals are the terminal envelope and invoice)`;
 				})()] : [],
 				`GOAL: ${goal}`,
 				`DRAFT: ${draftJson}`,
@@ -24403,14 +24701,160 @@ function makeOrchestratorWorkflow(goal, opts) {
 			} : { ran: true },
 			synthesis
 		});
+		/**
+		* The no-regression fallback verdict (RV2505), set only when the
+		* floor actually caught a failing synthesis: the truncated failure
+		* message and the journal seq of the decision that recorded it.
+		*/
+		let synthesisRegressed;
+		/**
+		* The no-regression floor under the synthesis (RV2505, the 1.226.0
+		* comparison run): a synthesis that fails terminally must not throw
+		* away a coordination draft the SAME declared contract accepts.
+		* Judges the draft with the validator bundle, journals what it
+		* found either way, and answers whether the caller should settle on
+		* the draft instead of rethrowing. Pure: the verdict is a function
+		* of the draft and the validators, so a resume that re-fails the
+		* synthesis re-derives the identical answer, and the journaled
+		* decision is reused rather than duplicated.
+		*/
+		const draftFallbackOnRegression = async (draft, thrown) => {
+			if (!(opts?.synthesis?.fallbackToValidDraft === true) || validationSpec === void 0) return { used: false };
+			if (thrown instanceof ConfigError) return { used: false };
+			const draftValue = draft ?? null;
+			const draftHash = createHash("sha256").update(jcsSerialize(draftValue), "utf8").digest("hex");
+			const validatorNames = validationSpec.validators.map((validator) => validator.name);
+			const input = {
+				result: draftValue,
+				text: typeof draftValue === "string" ? draftValue : JSON.stringify(draftValue),
+				children: validationChildren()
+			};
+			const failed = [];
+			for (const validator of validationSpec.validators) {
+				let verdict;
+				try {
+					verdict = validator.validate(input);
+				} catch (validatorThrew) {
+					throw new ConfigError(`finish validator '${validator.name}' threw instead of returning a verdict during the fallbackToValidDraft judgement: ` + (validatorThrew instanceof Error ? validatorThrew.message : String(validatorThrew)));
+				}
+				if (!verdict.ok) failed.push({
+					name: validator.name,
+					reasons: verdict.reasons
+				});
+			}
+			const regressed = failed.length === 0;
+			const reason = (thrown instanceof Error ? thrown.message : String(thrown)).slice(0, 300);
+			const key = deriverV2.deriveKey({ kind: regressed ? "orchestrator-synthesis-regressed" : "orchestrator-synthesis-fallback-declined" });
+			const entryRef = internals.replayer.snapshot().find((entry) => entry.kind === "decision" && entry.key === key)?.seq ?? (await internals.replayer.appendSinglePhase({
+				scope: callingState.scope,
+				key,
+				kind: "decision",
+				status: "ok",
+				spanId: internals.spans.mint(callingState.spanId),
+				site: "orchestrator-synthesis-fallback",
+				value: {
+					decisionType: regressed ? "orchestrator_synthesis_regressed" : "orchestrator_synthesis_fallback_declined",
+					reason,
+					validators: validatorNames,
+					...regressed ? {} : { failed },
+					...validationSpec.contract === void 0 ? {} : { contractHash: validationSpec.contract.hash },
+					draftHash
+				}
+			})).seq;
+			internals.events.emit({
+				type: "log",
+				level: "warn",
+				msg: regressed ? "orchestrator synthesis regressed" : "orchestrator synthesis fallback declined",
+				data: {
+					reason,
+					decisionRef: entryRef,
+					...regressed ? {} : { draftFailed: failed.map((row) => row.name) }
+				}
+			}, callingState.spanId);
+			if (!regressed) return { used: false };
+			synthesisRegressed = {
+				reason,
+				decisionRef: entryRef
+			};
+			return { used: true };
+		};
+		/**
+		* The explicit deliverable verdict (RV2506, the 1.226.0 comparison
+		* run): whether the artifact THIS terminal carries was accepted by
+		* the declared finish contract, whether there is an artifact to
+		* read at all, and where its acceptance is journaled. The harness
+		* that scored the comparison could not answer the first question
+		* from the terminal: it read `status: 'ok'`, and the run had in
+		* fact accepted its children, failed its synthesis three times,
+		* and settled carrying nothing the contract ever accepted. Every
+		* input is a fact the run already journaled, so the verdict is
+		* derived, never remembered, and a resume re-derives the same one.
+		*
+		* `deliverableAccepted` is ABSENT (never false) when no
+		* `finishValidation` was declared: nothing judged anything, and
+		* the RV1209 provenance doctrine says absence means NOT RECORDED.
+		* `acceptedArtifactRef` names the decision entry that holds the
+		* acceptance, which is the finish-validation decision on the
+		* ordinary path, the RV510 skip decision when the gate skipped the
+		* synthesis, and the RV2505 regression decision when a failing
+		* synthesis handed the run back to its draft: three different
+		* entries, one question, one field.
+		*/
+		const deliverableVerdict = (artifact) => {
+			const resultAvailable = artifact !== void 0 && artifact !== null;
+			if (validationSpec === void 0) return { resultAvailable };
+			if (synthesisRegressed !== void 0) return {
+				resultAvailable,
+				deliverableAccepted: true,
+				acceptedArtifactRef: synthesisRegressed.decisionRef
+			};
+			if (synthesisSkipDecisionRef !== void 0) return {
+				resultAvailable,
+				deliverableAccepted: true,
+				acceptedArtifactRef: synthesisSkipDecisionRef
+			};
+			const accepted = internals.replayer.snapshot().filter((entry) => {
+				if (entry.kind !== "decision" || entry.scope !== callingState.scope) return false;
+				const value = entry.value;
+				return value?.decisionType === "orchestrator_finish_validation" && value.verdict === "accepted" && contractGenerationCurrent(value);
+			}).at(-1);
+			return accepted === void 0 ? {
+				resultAvailable,
+				deliverableAccepted: false
+			} : {
+				resultAvailable,
+				deliverableAccepted: true,
+				acceptedArtifactRef: accepted.seq
+			};
+		};
+		/**
+		* The rejected candidates of the CURRENT contract generation, in
+		* judgement order (RV2507): a pure fold over decisions the journal
+		* already holds, so a resume re-derives the identical list without
+		* re-running a validator. A superseded generation's rejections stay
+		* in the journal as the history they are and drop out here, exactly
+		* as they drop out of the repair budget.
+		*/
+		const rejectedFinishCandidates = () => validationDecisions().filter((decision) => decision.verdict !== "accepted" && contractGenerationCurrent(decision) && decision.candidateHash !== void 0).map((decision) => ({
+			callId: decision.callId,
+			verdict: decision.verdict,
+			hash: decision.candidateHash ?? "",
+			chars: decision.candidateChars ?? 0,
+			failed: decision.failed,
+			...decision.candidateRef === void 0 ? {} : { ref: decision.candidateRef }
+		}));
 		const enrichSynthesisFailure = (thrown, snapshot) => {
 			const passTruth = {
 				...claimConsistencyMeta === void 0 ? {} : { claimConsistencyMeta },
 				semanticPasses: semanticPassesSummary({
 					ran: false,
 					reason: "synthesis-failed"
-				})
+				}),
+				resultAvailable: false,
+				...validationSpec === void 0 ? {} : { deliverableAccepted: false }
 			};
+			const rejected = rejectedFinishCandidates();
+			if (rejected.length > 0) passTruth.rejectedFinishCandidates = rejected;
 			if (thrown instanceof BudgetExhaustedError) throw new BudgetExhaustedError(thrown.message, { data: {
 				...thrown.data ?? {},
 				...snapshot ?? {},
@@ -24440,13 +24884,17 @@ function makeOrchestratorWorkflow(goal, opts) {
 		if (result.status !== "ok") throw new ConfigError(`the orchestrator agent terminated with status '${result.status}'` + (result.errorMessage === void 0 ? "" : `: ${result.errorMessage}`));
 		if (opts?.acceptance === void 0) {
 			await runContradictionPass();
-			await runClaimConsistencyPass(result.output);
+			if (claimStage !== "final") await runClaimConsistencyPass(result.output);
+			let bare;
 			try {
-				return await runSynthesis(result.output);
+				bare = await runSynthesis(result.output);
 			} catch (thrown) {
 				await journalSynthesisAdmissionDecline(thrown);
-				return enrichSynthesisFailure(thrown);
+				if ((await draftFallbackOnRegression(result.output, thrown)).used) bare = result.output;
+				else return enrichSynthesisFailure(thrown);
 			}
+			if (claimStage !== "draft") await runClaimConsistencyPass(bare, void 0, "final");
+			return bare;
 		}
 		const acceptanceKey = "acceptance";
 		const priorAcceptance = internals.replayer.snapshot().find((entry) => entry.kind === "decision" && entry.scope === callingState.scope && entry.key === acceptanceKey);
@@ -24640,19 +25088,21 @@ function makeOrchestratorWorkflow(goal, opts) {
 			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
 			...decision.salvagedTerminalOutputChildren === void 0 ? {} : { salvagedTerminalOutputChildren: decision.salvagedTerminalOutputChildren }
 		});
-		await runClaimConsistencyPass(result.output, {
+		const acceptanceSnapshot = {
 			completion: decision.completion,
 			childStatusCounts: decision.childStatusCounts,
 			degradedReasons: decision.degradedReasons,
 			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
 			...decision.salvagedTerminalOutputChildren === void 0 ? {} : { salvagedTerminalOutputChildren: decision.salvagedTerminalOutputChildren }
-		});
+		};
+		if (claimStage !== "final") await runClaimConsistencyPass(result.output, acceptanceSnapshot);
 		let synthesizedFinal;
 		try {
 			synthesizedFinal = await runSynthesis(result.output);
 		} catch (thrown) {
 			await journalSynthesisAdmissionDecline(thrown);
-			enrichSynthesisFailure(thrown, {
+			if ((await draftFallbackOnRegression(result.output, thrown)).used) synthesizedFinal = result.output;
+			else enrichSynthesisFailure(thrown, {
 				completion: decision.completion,
 				childStatusCounts: decision.childStatusCounts,
 				degradedReasons: decision.degradedReasons,
@@ -24662,10 +25112,31 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...decision.children === void 0 ? {} : { acceptanceChildren: decision.children }
 			});
 		}
+		if (claimStage !== "draft") {
+			claimConsistencyDraftMeta = claimStage === "both" ? claimConsistencyMeta : void 0;
+			await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+		}
 		const envelopeSchemaRecovered = (result.schemaRecoveredTerminalExchanges ?? 0) + synthesisSchemaRecoveredExchanges;
+		const deliverable = deliverableVerdict(synthesizedFinal);
+		const draftToFinal = opts?.synthesis === void 0 ? void 0 : (() => {
+			const hashOf = (value) => createHash("sha256").update(jcsSerialize(value ?? null), "utf8").digest("hex");
+			const draftHash = hashOf(result.output);
+			const finalHash = hashOf(synthesizedFinal);
+			return {
+				draftHash,
+				finalHash,
+				rewritten: draftHash !== finalHash,
+				...claimConsistencyMeta === void 0 ? {} : { claimsJudgedOn: claimStage }
+			};
+		})();
+		const envelopeRejectedCandidates = rejectedFinishCandidates();
 		return {
 			result: synthesizedFinal,
 			completion: decision.completion,
+			resultAvailable: deliverable.resultAvailable,
+			...deliverable.deliverableAccepted === void 0 ? {} : { deliverableAccepted: deliverable.deliverableAccepted },
+			...deliverable.acceptedArtifactRef === void 0 ? {} : { acceptedArtifactRef: deliverable.acceptedArtifactRef },
+			...envelopeRejectedCandidates.length === 0 ? {} : { rejectedFinishCandidates: envelopeRejectedCandidates },
 			childStatusCounts: decision.childStatusCounts,
 			degradedReasons: decision.degradedReasons,
 			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
@@ -24676,6 +25147,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			...envelopeSchemaRecovered === 0 ? {} : { schemaRecoveredFinishExchanges: envelopeSchemaRecovered },
 			...synthesisReserveLifecycle === void 0 ? {} : { synthesisReserve: synthesisReserveLifecycle },
 			...synthesisSkippedByValidDraft ? { synthesisSkipped: "synthesis_skipped_by_valid_draft" } : {},
+			...synthesisRegressed === void 0 ? {} : { synthesisRegressed },
 			...contradictionsFound === void 0 ? {} : {
 				contradictions: contradictionsFound,
 				contradictionsMeta
@@ -24684,6 +25156,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...claimFindingsFound === void 0 ? {} : { claimContradictions: claimFindingsFound },
 				claimConsistencyMeta
 			},
+			...claimConsistencyDraftMeta === void 0 ? {} : { claimConsistencyDraftMeta },
+			...draftToFinal === void 0 ? {} : { draftToFinal },
 			semanticPasses: semanticPassesSummary(opts?.synthesis === void 0 ? {
 				ran: false,
 				reason: "not-configured"
@@ -25337,12 +25811,18 @@ function preflightEstimate(input) {
 							cacheReadTokens: 0,
 							cacheWriteTokens: 0
 						});
-						const repairTurns = finishRepairReserve > 0 ? 1 : 0;
-						const requiredUsd = compositionUsd * (1 + repairTurns);
-						if (declared < requiredUsd) say({
-							severity: "warning",
+						const grantedRepairs = input.finishValidation === void 0 ? 0 : input.finishValidation.maxRepairs ?? 1;
+						const tailTurns = 1 + grantedRepairs;
+						const requiredUsd = compositionUsd * tailTurns;
+						const exposureCapUsd = input.run?.maxInFlightExposureUsd;
+						const reserveLineUsd = ceilingUsd === void 0 ? void 0 : ceilingUsd - declared;
+						const exposureRoomUsd = exposureCapUsd === void 0 || reserveLineUsd === void 0 ? void 0 : exposureCapUsd - reserveLineUsd;
+						const reserveShort = declared < requiredUsd;
+						const exposureShort = exposureRoomUsd !== void 0 && exposureRoomUsd < requiredUsd;
+						if (reserveShort || exposureShort) say({
+							severity: reserveShort && exposureShort ? "error" : "warning",
 							code: "synthesis-reserve-below-cap-composition",
-							message: `a synthesis turn writing to its ${String(outputBound)} token output allowance over the declared ${String(synthesis.estInputTokens ?? 0)} input floor prices about ${compositionUsd.toFixed(4)} USD at the rates of '${servedBy}'` + (repairTurns > 0 ? `, and the declared repair reserve prices one more such turn (about ${requiredUsd.toFixed(4)} USD total)` : "") + `; the committed synthesis reserve holds only ${declared.toFixed(4)} USD, so a composition cut at the allowance can fail its validators with no money left for the granted repair; hold the reserve at the cap arithmetic or lower maxOutputTokensPerTurn`,
+							message: `the mandatory synthesis tail is ${String(tailTurns)} turn(s) (one composition ` + (grantedRepairs === 0 ? "and no granted repair" : `plus the ${String(grantedRepairs)} granted repair(s)`) + `), each writing to its ${String(outputBound)} token output allowance over the declared ${String(synthesis.estInputTokens ?? 0)} input floor: ${String(tailTurns)} x ${compositionUsd.toFixed(4)} = ${requiredUsd.toFixed(4)} USD at the rates of '${servedBy}'` + (reserveShort ? `; the committed synthesis reserve holds only ${declared.toFixed(4)} USD` : `; the committed ${declared.toFixed(4)} USD reserve covers it`) + (exposureRoomUsd === void 0 ? "" : exposureShort ? `, and maxInFlightExposureUsd ${(exposureCapUsd ?? 0).toFixed(4)} leaves only ${exposureRoomUsd.toFixed(4)} USD above the reserve line ${(reserveLineUsd ?? 0).toFixed(4)} USD` : `, and the exposure ceiling leaves ${exposureRoomUsd.toFixed(4)} USD above the reserve line`) + ": a composition cut at the allowance can fail its validators with no room left for the repairs the runtime will grant; hold the reserve at the tail arithmetic, raise maxInFlightExposureUsd toward the ceiling, lower maxOutputTokensPerTurn, or grant fewer repairs",
 							spawn: "synthesis"
 						});
 					}
@@ -26336,6 +26816,21 @@ function liftRunCompletion(candidate) {
 	if (typeof metaCandidate === "object" && metaCandidate !== null && !Array.isArray(metaCandidate)) lifted.claimConsistencyMeta = { ...metaCandidate };
 	const skippedCandidate = candidate.synthesisSkipped;
 	if (typeof skippedCandidate === "boolean" || typeof skippedCandidate === "string") lifted.synthesisSkipped = skippedCandidate;
+	const acceptedCandidate = candidate.deliverableAccepted;
+	if (typeof acceptedCandidate === "boolean") lifted.deliverableAccepted = acceptedCandidate;
+	const availableCandidate = candidate.resultAvailable;
+	if (typeof availableCandidate === "boolean") lifted.resultAvailable = availableCandidate;
+	const artifactRefCandidate = candidate.acceptedArtifactRef;
+	if (typeof artifactRefCandidate === "number" && Number.isSafeInteger(artifactRefCandidate) && artifactRefCandidate >= 0) lifted.acceptedArtifactRef = artifactRefCandidate;
+	const rejectedCandidates = candidate.rejectedFinishCandidates;
+	if (Array.isArray(rejectedCandidates)) {
+		const validRow = (row) => {
+			if (typeof row !== "object" || row === null) return false;
+			const { callId, verdict, hash, chars, failed, ref } = row;
+			return typeof callId === "string" && (verdict === "repair" || verdict === "rejected") && typeof hash === "string" && typeof chars === "number" && Number.isSafeInteger(chars) && chars >= 0 && (ref === void 0 || typeof ref === "string") && Array.isArray(failed) && failed.every((entry) => typeof entry === "object" && entry !== null && typeof entry.name === "string" && Array.isArray(entry.reasons) && entry.reasons.every((reason) => typeof reason === "string"));
+		};
+		if (rejectedCandidates.every(validRow)) lifted.rejectedFinishCandidates = rejectedCandidates.map((row) => ({ ...row }));
+	}
 	return lifted;
 }
 /**
@@ -26513,6 +27008,7 @@ function createEngine(options) {
 		if (wf.kind !== "workflow" && wf.kind !== "compiled-workflow") throw new ConfigError("engine.run accepts in-process Workflow values or compileScript CompiledWorkflow values");
 		if (opts?.budgetUsd !== void 0) requireNonNegativeNumber(opts.budgetUsd, "RunOptions.budgetUsd");
 		if (opts?.maxInFlightExposureUsd !== void 0) requireNonNegativeNumber(opts.maxInFlightExposureUsd, "RunOptions.maxInFlightExposureUsd");
+		if (opts?.clampTurnToExposure !== void 0 && typeof opts.clampTurnToExposure !== "boolean") throw new ConfigError("RunOptions.clampTurnToExposure must be a boolean; got " + JSON.stringify(opts.clampTurnToExposure));
 		if (opts?.strictPricing !== void 0 && typeof opts.strictPricing !== "boolean" && (typeof opts.strictPricing !== "object" || opts.strictPricing === null || Array.isArray(opts.strictPricing))) throw new ConfigError("RunOptions.strictPricing must be a boolean or an options object; got " + JSON.stringify(opts.strictPricing));
 		if (opts?.limits !== void 0) validateUsageLimits(opts.limits, "RunOptions.limits");
 		const deadlineAtMs = opts?.deadlineAt === void 0 ? void 0 : parseDeadlineAt(opts.deadlineAt);
@@ -26550,6 +27046,7 @@ function createEngine(options) {
 		const makeBudget = () => new RunBudget({
 			...ceilingUsd === void 0 ? {} : { ceilingUsd },
 			...exposureCapUsd === void 0 ? {} : { maxInFlightExposureUsd: exposureCapUsd },
+			...opts?.clampTurnToExposure === true ? { clampTurnToExposure: true } : {},
 			...strictPricing === void 0 ? {} : {
 				strictPricing,
 				now: realNow
@@ -26929,6 +27426,10 @@ function createEngine(options) {
 				if (lifted.semanticPasses !== void 0) outcomeFacts.semanticPasses = lifted.semanticPasses;
 				if (lifted.claimConsistencyMeta !== void 0) outcomeFacts.claimConsistencyMeta = lifted.claimConsistencyMeta;
 				if (lifted.synthesisSkipped !== void 0) outcomeFacts.synthesisSkipped = lifted.synthesisSkipped;
+				if (lifted.deliverableAccepted !== void 0) outcomeFacts.deliverableAccepted = lifted.deliverableAccepted;
+				if (lifted.resultAvailable !== void 0) outcomeFacts.resultAvailable = lifted.resultAvailable;
+				if (lifted.acceptedArtifactRef !== void 0) outcomeFacts.acceptedArtifactRef = lifted.acceptedArtifactRef;
+				if (lifted.rejectedFinishCandidates !== void 0) outcomeFacts.rejectedFinishCandidates = lifted.rejectedFinishCandidates;
 			}
 			let settlementFailure;
 			let supersededBy;
@@ -27590,4 +28091,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, invoiceFromJournal, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, sectionCitationsValidator, sectionPatternCountValidator, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, invoiceFromJournal, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, sectionCitationsValidator, sectionPatternCountValidator, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };