@rulvar/core 1.229.0 → 1.231.0

package/dist/index.js

@@ -8708,6 +8708,12 @@ function assertFencedWrites(stores) {
 //#region src/stores/reconcile.ts
 /** The decisionType of the journaled run settle entry. */
 const RUN_SETTLE_DECISION_TYPE = "run_settle";
+/**
+* The decisionType of the journaled spawn admission (RV2702): the
+* entry that names every child an orchestration judged, which is what
+* makes an offline roster a read rather than a guess.
+*/
+const SPAWN_ADMISSION_DECISION_TYPE = "spawn-admission";
 const RUN_STATUSES = /* @__PURE__ */ new Set([
 	"ok",
 	"error",
@@ -8788,13 +8794,25 @@ function readRejectedFinishCandidates(raw) {
 *
 * The twenty-fifth comparison run was killed and resumed, and its two
 * terminals mixed both kinds with nothing marking which was which: the
-* money was cumulative, the wake count and the replay figures were not,
+* money was cumulative, the live-only counters were not,
 * and reconciling them into one honest account of the logical run was
 * hand work over a joined journal. Keys are field paths as a consumer
-* reads them off `RunOutcome` (`cost.orchestrator.wakes`); the
-* doctrine test holds this table against the keys a real outcome
-* carries, so a new terminal field cannot ship without declaring what
-* it counts.
+* reads them off `RunOutcome` (`cost.orchestrator.wakes`): the type
+* requires every field of the outcome, and the `satisfies` below
+* requires every counted leaf under `cost` (RV2801), because an index
+* signature admits nested paths and demands none, so the five that were
+* declared were declared by hand and by luck while four
+* (`cost.usageApprox`, `cost.abandoned.usd`, `cost.abandoned.usageApprox`,
+* `cost.orchestrator.share`) were simply missing. That is the RV2701
+* blindness one level down: a gate whose subject is nested figures
+* cannot stop at the top level.
+*
+* What neither can decide is whether a declared scope is TRUE, and a
+* wrong scope is worse than a missing one: a missing one is noticed, a
+* wrong one is believed. The doctrine test suspends a real run, resumes
+* it, and holds every declared figure against its own claim (RV2801),
+* which is how three `cost.orchestrator.*` paths were found calling
+* themselves `'segment'` while the terminal folded them cumulatively.
 */
 const TERMINAL_TELEMETRY_SCOPE = Object.freeze({
 	status: "terminal",
@@ -8808,6 +8826,7 @@ const TERMINAL_TELEMETRY_SCOPE = Object.freeze({
 	salvagedTerminalOutputChildren: "cumulative",
 	belowFloorOkChildren: "cumulative",
 	acceptanceChildren: "cumulative",
+	childrenAtFailure: "cumulative",
 	semanticPasses: "terminal",
 	claimConsistencyMeta: "terminal",
 	synthesisSkipped: "terminal",
@@ -8822,10 +8841,14 @@ const TERMINAL_TELEMETRY_SCOPE = Object.freeze({
 	"cost.totalUsd": "cumulative",
 	"cost.grossUsd": "cumulative",
 	"cost.wireRequests": "cumulative",
+	"cost.usageApprox": "cumulative",
+	"cost.abandoned.usd": "cumulative",
+	"cost.abandoned.usageApprox": "cumulative",
 	"cost.orchestrator.spentUsd": "cumulative",
-	"cost.orchestrator.wakes": "segment",
-	"cost.orchestrator.forcedFinish": "segment",
-	"cost.orchestrator.reserveUsedUsd": "segment",
+	"cost.orchestrator.share": "cumulative",
+	"cost.orchestrator.wakes": "cumulative",
+	"cost.orchestrator.forcedFinish": "cumulative",
+	"cost.orchestrator.reserveUsedUsd": "cumulative",
 	transportRetries: "segment",
 	schemaRejectedFinishExchanges: "segment",
 	schemaRecoveredFinishExchanges: "segment"
@@ -8869,6 +8892,91 @@ function logicalRunTelemetry(entries) {
 		entriesAfterLastSettle: sinceLastSettle
 	};
 }
+/**
+* Every orchestration's children, folded from a run's journal (RV2702).
+*
+* `childrenAtFailure` (RV2602) answers this for a LIVE consumer, and it
+* dies with the process that held it: the settle persists the
+* completion lift and nothing else, so a post-mortem over a journal,
+* which is all a paid run leaves behind, had no way to ask what the
+* children produced. Every ingredient was already written down. This
+* is the fold.
+*
+* It reads what resume reads. A `spawn-admission` decision names every
+* child the controller judged, with its ordinal, its profile, its
+* verdict, and the scope its dispatch pins to; the dispatch and
+* terminal `agent` entries under that scope are the child itself, and
+* the RV806 evidence verdict rides the terminal. Nothing is
+* re-derived and no validator runs again, so a journal written by any
+* prior version reads exactly as well as today's, which is the point:
+* the runs worth a post-mortem are the ones already in the archive.
+*
+* Two things it deliberately does NOT claim. It is not the live
+* roster: this reading happens after the RV1903 exit barrier settled
+* the stragglers, so a child the live field would have called
+* unsettled usually has a terminal here, and `status` is absent only
+* where the journal truly ends mid-flight. And it names children by
+* their dispatch seq rather than by nodeId, because the seq is the
+* handle the orchestrator's own turns used and the one a reader can
+* follow into the transcript.
+*/
+function childRostersFromJournal(entries) {
+	const rosters = /* @__PURE__ */ new Map();
+	const ordered = [...entries].sort((a, b) => a.seq - b.seq);
+	const abandoned = buildAbandonFold(ordered);
+	const dispatchesByScope = /* @__PURE__ */ new Map();
+	const terminalsByScopeKey = /* @__PURE__ */ new Map();
+	for (const entry of ordered) {
+		if (entry.kind !== "agent") continue;
+		if (entry.status === "running") {
+			const rows = dispatchesByScope.get(entry.scope);
+			if (rows === void 0) dispatchesByScope.set(entry.scope, [entry]);
+			else rows.push(entry);
+			continue;
+		}
+		const key = JSON.stringify([entry.scope, entry.key]);
+		const rows = terminalsByScopeKey.get(key);
+		if (rows === void 0) terminalsByScopeKey.set(key, [entry]);
+		else rows.push(entry);
+	}
+	const cursors = /* @__PURE__ */ new Map();
+	for (const entry of ordered) {
+		if (entry.kind !== "decision") continue;
+		const value = entry.value;
+		if (value?.decisionType !== "spawn-admission" || value.origin !== "spawn_agent" && value.origin !== "parallel_agents") continue;
+		const childScope = typeof value.childScope === "string" ? value.childScope : entry.scope;
+		let roster = rosters.get(childScope);
+		if (roster === void 0) {
+			roster = {
+				childScope,
+				admitted: 0,
+				rejected: 0,
+				children: []
+			};
+			rosters.set(childScope, roster);
+		}
+		if (value.decision?.verdict?.kind !== "admit") {
+			roster.rejected += 1;
+			continue;
+		}
+		roster.admitted += 1;
+		const rows = dispatchesByScope.get(childScope) ?? [];
+		let cursor = cursors.get(childScope) ?? 0;
+		while (cursor < rows.length && (rows[cursor]?.seq ?? 0) <= entry.seq) cursor += 1;
+		const dispatch = rows[cursor];
+		cursors.set(childScope, cursor + 1);
+		if (dispatch === void 0) continue;
+		const terminal = terminalsByScopeKey.get(JSON.stringify([childScope, dispatch.key]))?.find((candidate) => candidate.seq > dispatch.seq);
+		roster.children.push({
+			handle: dispatch.seq,
+			...abandoned.isAbandoned(dispatch.seq) ? { abandoned: true } : {},
+			...terminal?.costAttribution?.agentType === void 0 ? {} : { agentType: terminal.costAttribution.agentType },
+			...terminal === void 0 ? {} : { status: terminal.status },
+			...terminal?.evidence === void 0 ? {} : { evidence: { ...terminal.evidence } }
+		});
+	}
+	return [...rosters.values()];
+}
 function structure(entries) {
 	const referenced = /* @__PURE__ */ new Set();
 	for (const entry of entries) if (entry.ref !== void 0) referenced.add(entry.ref);
@@ -8983,472 +9091,834 @@ async function reconcileRunMeta(store, runId, opts) {
 	};
 }
 //#endregion
-//#region src/stores/jsonl.ts
-/**
-* JsonlFileStore (M2-T01): the durable file store. One JSON entry per
-* line per run; the journal doubles as an event log. Meta records live
-* beside the journal and are replaced atomically, so listRuns never
-* parses payloads.
-*
-* Contract (DEF-4 tightening):
-* - A1 atomicity: a torn trailing line (crash mid-append) is never
-*   visible in load; the incomplete fragment is dropped and overwritten
-*   by the next append. Whole records on that line are data, never
-*   fragment (RV701): a crash that persisted every JSON byte but not
-*   the '\n' leaves a parseable tail that load serves and append
-*   terminates before writing, and repair salvages complete records a
-*   glued line carries instead of discarding the line, so an entry a
-*   load has served can never be un-served by a later repair.
-* - A2 total per-run order: load returns append order, stable across
-*   calls (the kernel's per-run queue serializes appends).
-* - A3 read-your-writes: append resolves after the line is written.
-* - A4 opaque payload: entries round-trip byte-for-byte as JSON; unknown
-*   kinds and fields pass through untouched.
-*
-* Leasing is NOT implemented here: LeasableStore ships with
-* @rulvar/store-sqlite (M5); JsonlFileStore is single-writer by
-* convention.
-*/
-const JOURNAL_SUFFIX = ".jsonl";
-const META_SUFFIX = ".meta.json";
-function safeName(runId) {
-	if (!/^[A-Za-z0-9._-]+$/.test(runId)) throw new JournalOrderViolation(`JsonlFileStore: runId '${runId}' is not filesystem-safe ([A-Za-z0-9._-] only)`);
-	return runId;
-}
+//#region src/l0/telemetry-reduce.ts
+const ZERO = {
+	inputTokens: 0,
+	outputTokens: 0,
+	cacheReadTokens: 0,
+	cacheWriteTokens: 0
+};
 /**
-* Whole JSON values glued on one line, split apart without parser
-* ambiguity (RV701): depth is tracked outside string literals only, and
-* every candidate must still round-trip JSON.parse. A line that is not a
-* clean concatenation from its first byte salvages its whole prefix
-* values and returns everything after them as the torn fragment, so the
-* caller keeps accepted records and drops exactly the unacknowledged
-* tail a crash tore.
+* Reduces one run's event stream (or any slice of it) to the invocation
+* table. Feed it the events in emission order; both a live stream and a
+* replayed one produce the same usage and cost columns.
 */
-function splitConcatenatedJson(line) {
-	const whole = [];
-	let start = 0;
-	let depth = 0;
-	let inString = false;
-	let escaped = false;
-	for (let i = 0; i < line.length; i += 1) {
-		const ch = line[i];
-		if (inString) {
-			if (escaped) escaped = false;
-			else if (ch === "\\") escaped = true;
-			else if (ch === "\"") inString = false;
-			continue;
-		}
-		if (ch === "\"") {
-			inString = true;
-			continue;
+function reduceInvocationTable(events) {
+	const rows = /* @__PURE__ */ new Map();
+	const order = [];
+	const openPhases = /* @__PURE__ */ new Map();
+	const byRole = {};
+	let totalCostUsd = 0;
+	const rowFor = (event) => {
+		let row = rows.get(event.spanId);
+		if (row === void 0) {
+			row = {
+				spanId: event.spanId,
+				agentType: event.agentType,
+				...event.label === void 0 ? {} : { label: event.label },
+				usage: ZERO,
+				costUsd: 0,
+				costBasis: "aggregate-estimate",
+				usageApprox: false,
+				retryCount: 0,
+				replayed: event.replayed === true,
+				open: true,
+				phases: []
+			};
+			rows.set(event.spanId, row);
+			order.push(row);
 		}
-		if (ch === "{" || ch === "[") {
-			depth += 1;
-			continue;
+		return row;
+	};
+	for (const event of events) switch (event.type) {
+		case "agent:start": {
+			const row = rowFor(event);
+			row.role = event.role;
+			break;
 		}
-		if (ch === "}" || ch === "]") {
-			depth -= 1;
-			if (depth < 0) return {
-				whole,
-				fragment: line.slice(start)
+		case "agent:phase:start": {
+			const row = rowFor(event);
+			const phase = {
+				invocation: event.invocation,
+				role: event.role,
+				model: event.model,
+				durationMs: 0,
+				usage: ZERO,
+				costUsd: 0,
+				costBasis: "aggregate-estimate",
+				retries: 0,
+				replayed: event.replayed === true,
+				open: true
 			};
-			if (depth === 0) {
-				const candidate = line.slice(start, i + 1);
-				try {
-					whole.push(JSON.parse(candidate));
-				} catch {
-					return {
-						whole,
-						fragment: line.slice(start)
-					};
-				}
-				start = i + 1;
+			row.phases.push(phase);
+			openPhases.set(`${event.spanId}#${event.invocation}`, phase);
+			break;
+		}
+		case "agent:phase:end": {
+			const key = `${event.spanId}#${event.invocation}`;
+			let phase = openPhases.get(key);
+			if (phase === void 0) {
+				phase = {
+					invocation: event.invocation,
+					role: event.role,
+					model: event.model,
+					durationMs: 0,
+					usage: ZERO,
+					costUsd: 0,
+					costBasis: "aggregate-estimate",
+					retries: 0,
+					replayed: event.replayed === true,
+					open: true
+				};
+				rowFor(event).phases.push(phase);
 			}
+			openPhases.delete(key);
+			phase.open = false;
+			phase.role = event.role;
+			phase.model = event.model;
+			phase.durationMs = event.durationMs;
+			phase.usage = event.usage;
+			phase.costUsd = event.costUsd;
+			phase.costBasis = event.costBasis ?? "aggregate-estimate";
+			phase.outcome = event.outcome;
+			phase.retries = event.retries ?? 0;
+			const bucket = byRole[event.role] ??= {
+				usage: ZERO,
+				costUsd: 0,
+				costBasis: "per-call"
+			};
+			bucket.usage = sumUsage(bucket.usage, event.usage);
+			bucket.costUsd += event.costUsd;
+			if (phase.costBasis === "aggregate-estimate") bucket.costBasis = "aggregate-estimate";
+			break;
+		}
+		case "agent:end": {
+			const row = rowFor(event);
+			row.open = false;
+			row.status = event.status;
+			row.usage = event.usage;
+			row.costUsd = event.costUsd;
+			row.costBasis = event.costBasis ?? "aggregate-estimate";
+			row.usageApprox = event.usageApprox === true;
+			row.retryCount = event.retryCount ?? 0;
+			if (event.toolBudget !== void 0) row.toolBudget = event.toolBudget;
+			totalCostUsd += event.costUsd;
+			break;
 		}
+		default: break;
 	}
 	return {
-		whole,
-		fragment: line.slice(start)
+		agents: order,
+		byRole,
+		totalCostUsd
 	};
 }
-var JsonlFileStore = class {
-	dir;
-	/**
-	* The stored tail seq per run, lazily initialized from the file on the
-	* first append this instance performs (obligation A5). Per instance by
-	* design: cross-process writers are the lease seam's job.
-	*/
-	lastSeq = /* @__PURE__ */ new Map();
-	/**
-	* The verify-only load switch (RV1512): with `repairOnLoad: false`,
-	* `load` serves the salvageable records WITHOUT rewriting the file,
-	* so an auditor's "verification" read never destroys the evidence
-	* of a tear it found. The default keeps the owner semantics byte
-	* for byte: a torn tail repairs on load exactly as documented in
-	* the A1 model above. Mutations (`append`, `putMeta`, `delete`)
-	* are unaffected by the flag; an auditor that must not write simply
-	* does not call them.
-	*/
-	repairOnLoad;
-	constructor(options) {
-		this.dir = options.dir;
-		this.repairOnLoad = options.repairOnLoad !== false;
-		mkdirSync(this.dir, { recursive: true });
-	}
-	journalPath(runId) {
-		return join(this.dir, `${safeName(runId)}${JOURNAL_SUFFIX}`);
-	}
-	metaPath(runId) {
-		return join(this.dir, `${safeName(runId)}${META_SUFFIX}`);
-	}
-	async append(runId, e) {
-		let tail = this.lastSeq.get(runId);
-		if (tail === void 0) {
-			const existing = await this.load(runId);
-			this.terminateUnterminatedTail(runId);
-			const last = existing[existing.length - 1];
-			tail = last !== void 0 && Number.isFinite(last.seq) ? last.seq : Number.NEGATIVE_INFINITY;
-			this.lastSeq.set(runId, tail);
-		}
-		if (Number.isFinite(e.seq) && e.seq <= tail) throw new JournalOrderViolation(`JsonlFileStore: append of seq ${e.seq} to run '${runId}' is not after the stored tail seq ${tail}; a concurrent writer raced this journal from a stale tail`);
-		appendFileSync(this.journalPath(runId), `${JSON.stringify(e)}\n`, "utf8");
-		if (Number.isFinite(e.seq)) this.lastSeq.set(runId, e.seq);
-	}
-	async load(runId) {
-		let raw;
-		try {
-			raw = readFileSync(this.journalPath(runId), "utf8");
-		} catch (thrown) {
-			if (thrown.code === "ENOENT") return [];
-			throw thrown;
-		}
-		const lines = raw.split("\n");
-		const entries = [];
-		for (let i = 0; i < lines.length; i += 1) {
-			const line = lines[i] ?? "";
-			if (line === "") continue;
-			try {
-				entries.push(JSON.parse(line));
-			} catch (thrown) {
-				if (lines.slice(i + 1).every((rest) => rest === "")) {
-					for (const value of splitConcatenatedJson(line).whole) entries.push(value);
-					if (this.repairOnLoad) this.repairTornTail(runId, entries);
-					break;
+/**
+* The label the claim-consistency judge invocation dispatches under
+* (RV1502; named here since RV1604 so the critical-path reducer and the
+* orchestrator share one constant): the judge rides role 'synthesize',
+* and this label is what tells its wall apart from a real final
+* composition in {@link reduceCriticalPath}.
+*/
+const CLAIM_JUDGE_LABEL = "claim-consistency-judge";
+/** Total length of the union of possibly overlapping intervals. */
+function unionLength(intervals) {
+	const positive = intervals.filter((interval) => interval.to > interval.from);
+	if (positive.length === 0) return 0;
+	const sorted = [...positive].sort((a, b) => a.from - b.from);
+	let total = 0;
+	let from = sorted[0]?.from ?? 0;
+	let to = sorted[0]?.to ?? 0;
+	for (const interval of sorted.slice(1)) if (interval.from > to) {
+		total += to - from;
+		from = interval.from;
+		to = interval.to;
+	} else if (interval.to > to) to = interval.to;
+	return total + (to - from);
+}
+function reduceCriticalPath(events) {
+	let runStart;
+	let runEnd;
+	const startBySpan = /* @__PURE__ */ new Map();
+	let lastWorkerEnd;
+	let workerSpans = 0;
+	let synthesisMs = 0;
+	let finalCompositionMs = 0;
+	let semanticJudgeMs = 0;
+	const coordinationModel = [];
+	const coordinationTools = [];
+	const synthesisSpans = [];
+	const spanOf = (durationMs) => Number.isFinite(durationMs) && durationMs > 0 ? durationMs : 0;
+	for (const event of events) {
+		const at = Date.parse(event.ts);
+		if (!Number.isFinite(at)) continue;
+		switch (event.type) {
+			case "run:start":
+				runStart ??= at;
+				break;
+			case "run:end":
+				runEnd = at;
+				break;
+			case "agent:start":
+				startBySpan.set(event.spanId, {
+					role: event.role,
+					at,
+					...event.label === void 0 ? {} : { label: event.label }
+				});
+				break;
+			case "agent:phase:end":
+				if (startBySpan.get(event.spanId)?.role === "orchestrate") coordinationModel.push({
+					phase: event.role,
+					from: at - spanOf(event.durationMs),
+					to: at
+				});
+				break;
+			case "tool:end":
+				if (startBySpan.get(event.spanId)?.role === "orchestrate") coordinationTools.push({
+					name: event.toolName,
+					from: at - spanOf(event.durationMs),
+					to: at
+				});
+				break;
+			case "agent:end": {
+				const started = startBySpan.get(event.spanId);
+				if (started === void 0) break;
+				if (started.role === "synthesize") {
+					const wall = Math.max(0, at - started.at);
+					const judge = started.label === CLAIM_JUDGE_LABEL;
+					synthesisMs += wall;
+					if (judge) semanticJudgeMs += wall;
+					else finalCompositionMs += wall;
+					synthesisSpans.push({
+						from: started.at,
+						to: at,
+						judge
+					});
+				} else if (started.role !== "orchestrate") {
+					workerSpans += 1;
+					lastWorkerEnd = lastWorkerEnd === void 0 ? at : Math.max(lastWorkerEnd, at);
 				}
-				throw new JournalOrderViolation(`JsonlFileStore: corrupt journal line ${i + 1} of run '${runId}' (not the trailing line, so this is not a torn append)`, { cause: thrown });
+				break;
 			}
+			default: break;
 		}
-		return entries;
 	}
-	/**
-	* Restores the trailing '\n' of a parseable-but-unterminated tail
-	* (RV701). One byte appended in place terminates the record exactly
-	* where the crash left it; the file's bytes before it stay untouched.
-	* No-op on a missing, empty, or already-terminated journal.
-	*/
-	terminateUnterminatedTail(runId) {
-		const path = this.journalPath(runId);
-		let fd;
-		try {
-			fd = openSync(path, "r");
-		} catch (thrown) {
-			if (thrown.code === "ENOENT") return;
-			throw thrown;
-		}
-		let needsNewline = false;
-		try {
-			const size = fstatSync(fd).size;
-			if (size > 0) {
-				const lastByte = /* @__PURE__ */ new Uint8Array(1);
-				readSync(fd, lastByte, 0, 1, size - 1);
-				needsNewline = lastByte[0] !== 10;
-			}
-		} finally {
-			closeSync(fd);
+	const path = {
+		synthesisMs,
+		finalCompositionMs,
+		semanticJudgeMs,
+		workerSpans
+	};
+	if (runStart !== void 0 && runEnd !== void 0) path.runWallMs = Math.max(0, runEnd - runStart);
+	if (runEnd !== void 0 && lastWorkerEnd !== void 0) {
+		path.postFanInMs = Math.max(0, runEnd - lastWorkerEnd);
+		const windowFrom = Math.min(lastWorkerEnd, runEnd);
+		const windowTo = runEnd;
+		const clip = (interval) => {
+			if (interval.to < windowFrom || interval.from > windowTo) return;
+			return {
+				from: Math.max(interval.from, windowFrom),
+				to: Math.min(interval.to, windowTo)
+			};
+		};
+		const byPhase = {};
+		const modelClipped = [];
+		for (const interval of coordinationModel) {
+			const clipped = clip(interval);
+			if (clipped === void 0) continue;
+			byPhase[interval.phase] = (byPhase[interval.phase] ?? 0) + (clipped.to - clipped.from);
+			modelClipped.push(clipped);
 		}
-		if (needsNewline) appendFileSync(path, "\n", "utf8");
-	}
-	repairTornTail(runId, whole) {
-		const path = this.journalPath(runId);
-		const temp = `${path}.tmp`;
-		writeFileSync(temp, whole.map((entry) => JSON.stringify(entry)).join("\n") + (whole.length > 0 ? "\n" : ""), "utf8");
-		renameSync(temp, path);
-	}
-	async putMeta(m) {
-		const path = this.metaPath(m.runId);
-		const temp = `${path}.tmp`;
-		writeFileSync(temp, JSON.stringify(m, null, 2), "utf8");
-		renameSync(temp, path);
-	}
-	async getMeta(runId) {
-		try {
-			return JSON.parse(readFileSync(this.metaPath(runId), "utf8"));
-		} catch {
-			return;
+		const synthesisClipped = [];
+		let judgeClippedMs = 0;
+		let compositionClippedMs = 0;
+		for (const span of synthesisSpans) {
+			const clipped = clip(span);
+			if (clipped === void 0) continue;
+			synthesisClipped.push(clipped);
+			if (span.judge) judgeClippedMs += clipped.to - clipped.from;
+			else compositionClippedMs += clipped.to - clipped.from;
 		}
-	}
-	async listRuns(f) {
-		const metas = [];
-		for (const file of readdirSync(this.dir)) {
-			if (!file.endsWith(META_SUFFIX)) continue;
-			try {
-				metas.push(JSON.parse(readFileSync(join(this.dir, file), "utf8")));
-			} catch {}
+		const byName = {};
+		const callsByName = {};
+		const toolsClipped = [];
+		for (const interval of coordinationTools) {
+			const clipped = clip(interval);
+			if (clipped === void 0) continue;
+			byName[interval.name] = (byName[interval.name] ?? 0) + (clipped.to - clipped.from);
+			callsByName[interval.name] = (callsByName[interval.name] ?? 0) + 1;
+			toolsClipped.push(clipped);
 		}
-		return metas.filter((meta) => metaMatchesFilter(meta, f));
+		const lengthOf = (intervals) => intervals.reduce((sum, interval) => sum + (interval.to - interval.from), 0);
+		const coveredMs = unionLength([
+			...modelClipped,
+			...toolsClipped,
+			...synthesisClipped
+		]);
+		const modelOnlyMs = unionLength([...modelClipped, ...toolsClipped]) - unionLength(toolsClipped);
+		const breakdown = {
+			coordinationModelMs: lengthOf(modelClipped),
+			coordinationModelMsByPhase: byPhase,
+			coordinationModelOnlyMs: modelOnlyMs,
+			coordinationToolMs: lengthOf(toolsClipped),
+			coordinationToolMsByName: byName,
+			coordinationToolCallsByName: callsByName,
+			synthesisMs: lengthOf(synthesisClipped),
+			finalCompositionMs: compositionClippedMs,
+			semanticJudgeMs: judgeClippedMs,
+			coveredMs,
+			residueMs: Math.max(0, path.postFanInMs - coveredMs)
+		};
+		if (path.postFanInMs > 0) breakdown.residueShare = breakdown.residueMs / path.postFanInMs;
+		path.postFanIn = breakdown;
 	}
-	async delete(runId) {
-		rmSync(this.journalPath(runId), { force: true });
-		rmSync(this.metaPath(runId), { force: true });
-		this.lastSeq.delete(runId);
+	if (path.runWallMs !== void 0 && path.runWallMs > 0) {
+		if (path.postFanInMs !== void 0) path.postFanInShare = path.postFanInMs / path.runWallMs;
+		path.synthesisShare = synthesisMs / path.runWallMs;
 	}
+	return path;
+}
+//#endregion
+//#region src/stores/critical-path.ts
+const parse = (at) => {
+	if (at === void 0) return;
+	const ms = Date.parse(at);
+	return Number.isFinite(ms) ? ms : void 0;
 };
-const TRANSCRIPT_SUFFIX = ".bin";
 /**
-* File-backed TranscriptStore (M6-T02): blobs (transcripts, checkpoints,
-* persisted CompiledWorkflow sources) as one file per ref under `dir`,
-* so compiled runs resume across processes. Refs follow the
-* `<runId>/<name>` convention; nested segments become directories.
+* Fold a run's critical path out of its journal.
 *
-* Every ref is contained under `dir` (v1.36.0 review SEC-P1): each
-* segment must match `[A-Za-z0-9._-]` and be neither empty, '.', nor
-* '..', and the resolved path must stay under the resolved root. A '..'
-* segment used to pass the per-segment alphabet (dots are in it) and, via
-* `join`, escape the root; a caller passing an untrusted ref (or an
-* untrusted runId, which prefixes checkpoint and workflow-source refs)
-* could read, write, or delete `.bin` files outside `dir`.
+* @param entries the journal of one run, in any order
 */
-var FileTranscriptStore = class {
-	dir;
-	constructor(options) {
-		this.dir = options.dir;
-		mkdirSync(this.dir, { recursive: true });
-	}
-	blobPath(ref) {
-		const segments = ref.split("/");
-		for (const segment of segments) if (segment === "" || segment === "." || segment === ".." || !/^[A-Za-z0-9._-]+$/.test(segment)) throw new JournalOrderViolation(`FileTranscriptStore: ref segment '${segment}' is not filesystem-safe`);
-		const name = segments.pop() ?? "";
-		const path = join(this.dir, ...segments, `${name}${TRANSCRIPT_SUFFIX}`);
-		const root = resolve(this.dir);
-		const resolved = resolve(path);
-		if (resolved !== root && !resolved.startsWith(`${root}${sep}`)) throw new JournalOrderViolation(`FileTranscriptStore: ref '${ref}' resolves outside the configured root`);
-		return path;
-	}
-	async put(ref, blob) {
-		const path = this.blobPath(ref);
-		mkdirSync(dirname(path), { recursive: true });
-		const temp = `${path}.tmp`;
-		writeFileSync(temp, blob);
-		renameSync(temp, path);
-	}
-	async get(ref) {
-		try {
-			return new Uint8Array(readFileSync(this.blobPath(ref)));
-		} catch (error) {
-			if (error.code === "ENOENT") return null;
-			throw error;
-		}
-	}
-	async list(runId) {
-		if (runId === "." || runId === "..") throw new JournalOrderViolation(`FileTranscriptStore: runId '${runId}' is not filesystem-safe`);
-		const root = join(this.dir, safeName(runId));
-		const refs = [];
-		const walk = (dir, prefix) => {
-			let names;
-			try {
-				names = readdirSync(dir);
-			} catch {
-				return;
-			}
-			for (const name of names) {
-				const path = join(dir, name);
-				if (statSync(path).isDirectory()) walk(path, `${prefix}${name}/`);
-				else if (name.endsWith(TRANSCRIPT_SUFFIX)) refs.push(`${prefix}${name.slice(0, -4)}`);
-			}
-		};
-		walk(root, `${runId}/`);
-		return refs.sort();
-	}
-	async delete(ref) {
-		try {
-			rmSync(this.blobPath(ref));
-		} catch (error) {
-			if (error.code !== "ENOENT") throw error;
+function criticalPathFromJournal(entries) {
+	const ordered = [...entries].sort((a, b) => a.seq - b.seq);
+	let runStart;
+	let runEnd;
+	let lastWorkerEnd;
+	let workerSpans = 0;
+	let unclassifiedSpans = 0;
+	let synthesisMs = 0;
+	let finalCompositionMs = 0;
+	let semanticJudgeMs = 0;
+	let labelledSynthesis = false;
+	let unlabelledSynthesis = false;
+	for (const entry of ordered) {
+		const startedAt = parse(entry.startedAt);
+		const endedAt = parse(entry.endedAt);
+		if (startedAt !== void 0) runStart = runStart === void 0 ? startedAt : Math.min(runStart, startedAt);
+		const last = endedAt ?? startedAt;
+		if (last !== void 0) runEnd = runEnd === void 0 ? last : Math.max(runEnd, last);
+		if (entry.kind !== "agent" || entry.status === "running" || entry.status === "suspended") continue;
+		const role = entry.costAttribution?.role;
+		if (role === void 0) {
+			unclassifiedSpans += 1;
+			continue;
 		}
-	}
-};
-//#endregion
-//#region src/model/pricing.ts
-/**
-* Resolves the pricing for a model: the versioned table wins; the
-* adapter-reported caps.pricing is the fallback; undefined means
-* unpriced (the CostReport surfaces it, never a silent zero).
-*/
-function resolvePricing(ref, table, capsPricing) {
-	return table?.models[ref] ?? capsPricing;
-}
-/** The tier a full prompt lands in: the highest threshold strictly below it. */
-function tierFor(pricing, inputTokens) {
-	let tier;
-	for (const candidate of pricing.tiers ?? []) if (inputTokens > candidate.aboveInputTokens && (tier === void 0 || candidate.aboveInputTokens > tier.aboveInputTokens)) tier = candidate;
-	return tier;
-}
-/**
-* Decomposes one usage against one pricing row into the four billing
-* components. Under the Usage invariant inputTokens is the FULL prompt
-* including cache reads and writes, so the input rate bills only the
-* uncached remainder and cache tokens bill at their own rates, never
-* twice; a row that omits a cache rate bills those tokens at the plain
-* input rate rather than silently for free. A row may carry
-* long-context tiers: the highest threshold strictly below the full
-* prompt re-prices the ENTIRE request (input-side rates scale by
-* inputMultiplier, the output rate by outputMultiplier). Cache writes
-* price at the 5m premium rate by default; when the usage carries the
-* TTL split (RV810: `cacheWrite5mTokens` and `cacheWrite1hTokens`,
-* filled by adapters whose provider distinguishes write TTLs), the 1h
-* share prices at `cacheWrite1hUsdPerMTok` (falling back to the plain
-* write rate when the row lacks it) and everything the 1h share does
-* not claim, the 5m share plus any unattributed remainder an upstream
-* invariant violation left, bills at the write rate, never silently
-* for free. The component's `tokens` stays the WHOLE
-* `cacheWriteTokens` either way, so statement reconciliation keys are
-* unchanged.
-*/
-function priceComponentsOf(pricing, usage) {
-	const tier = tierFor(pricing, usage.inputTokens);
-	const inputMul = tier?.inputMultiplier ?? 1;
-	const outputMul = tier?.outputMultiplier ?? 1;
-	const uncachedInputTokens = Math.max(0, usage.inputTokens - usage.cacheReadTokens - usage.cacheWriteTokens);
-	const writeRate = pricing.cacheWriteUsdPerMTok ?? pricing.inputUsdPerMTok;
-	const write1hRate = pricing.cacheWrite1hUsdPerMTok ?? writeRate;
-	const write1hTokens = usage.cacheWrite5mTokens !== void 0 || usage.cacheWrite1hTokens !== void 0 ? usage.cacheWrite1hTokens ?? 0 : 0;
-	const writeDefaultTokens = Math.max(0, usage.cacheWriteTokens - write1hTokens);
-	return {
-		input: {
-			tokens: uncachedInputTokens,
-			usd: uncachedInputTokens / 1e6 * pricing.inputUsdPerMTok * inputMul
-		},
-		output: {
-			tokens: usage.outputTokens,
-			usd: usage.outputTokens / 1e6 * pricing.outputUsdPerMTok * outputMul
-		},
-		cachedInput: {
-			tokens: usage.cacheReadTokens,
-			usd: usage.cacheReadTokens / 1e6 * (pricing.cacheReadUsdPerMTok ?? pricing.inputUsdPerMTok) * inputMul
-		},
-		cacheWrite: {
-			tokens: usage.cacheWriteTokens,
-			usd: (writeDefaultTokens / 1e6 * writeRate + write1hTokens / 1e6 * write1hRate) * inputMul
+		if (role === "orchestrate") continue;
+		if (role !== "synthesize") {
+			workerSpans += 1;
+			if (endedAt !== void 0) lastWorkerEnd = lastWorkerEnd === void 0 ? endedAt : Math.max(lastWorkerEnd, endedAt);
+			continue;
 		}
-	};
-}
-/**
-* Dollars from normalized usage against one pricing row: the sum of the
-* {@link priceComponentsOf} terms in their declared order, byte for
-* byte the historical expression (uncached input, output, cached input,
-* cache writes).
-*/
-function priceUsdOf(pricing, usage) {
-	const parts = priceComponentsOf(pricing, usage);
-	return parts.input.usd + parts.output.usd + parts.cachedInput.usd + parts.cacheWrite.usd;
-}
-/**
-* The output tokens `remainingUsd` still buys from one pricing row after
-* paying for an estimated prompt of `estimatedInputTokens`, priced with
-* the same tier rules as settlement (the tier is selected by the
-* estimated prompt). Floored to whole tokens; zero or negative means not
-* even one output token fits, so the turn must not be dispatched.
-* Undefined when the row prices output at zero (a free model needs no
-* output bound).
-*/
-function affordableOutputTokens(pricing, remainingUsd, estimatedInputTokens) {
-	const tier = tierFor(pricing, estimatedInputTokens);
-	const outputRate = pricing.outputUsdPerMTok * (tier?.outputMultiplier ?? 1);
-	if (outputRate <= 0) return;
-	const inputUsd = priceUsdOf(pricing, {
-		inputTokens: estimatedInputTokens,
-		outputTokens: 0,
-		cacheReadTokens: 0,
-		cacheWriteTokens: 0
-	});
-	return Math.floor((remainingUsd - inputUsd) / outputRate * 1e6);
-}
-const RATE_FIELDS = [
-	"inputUsdPerMTok",
-	"outputUsdPerMTok",
-	"cacheReadUsdPerMTok",
-	"cacheWriteUsdPerMTok",
-	"cacheWrite1hUsdPerMTok"
-];
-const TIER_FIELDS = [
-	"aboveInputTokens",
-	"inputMultiplier",
-	"outputMultiplier"
-];
-/**
-* Compares a pricing seed against rates extracted from the provider's
-* documented pricing page, in BOTH directions (RV902): a seed rate the
-* page moved or dropped is a finding, and so is a documented billable
-* rate the seed never declared, because a billable column missing from
-* the seed is a silent underpricing channel (the 1h cache-write premium
-* hid exactly there). Declared long-context tiers compare field by
-* field. Returns human-readable findings, empty when the sides agree;
-* the weekly rates audit (scripts/rates-audit.mjs) runs this exact
-* comparator over the live pages, and the fault-injection kit drives it
-* as a permanent gate (RV909). It verifies DOCUMENTATION, not billing:
-* only a statement reconciliation over saved exports settles what the
-* provider's meter actually charges.
-*/
-function compareRates(seed, page) {
-	const findings = [];
-	for (const field of RATE_FIELDS) {
-		const seedValue = seed[field];
-		const pageValue = page[field];
-		if (seedValue === void 0) {
-			if (pageValue !== void 0) findings.push(`${field}: the page shows ${String(pageValue)} but the seed declares no such rate`);
+		if (startedAt === void 0 || endedAt === void 0) continue;
+		const wall = Math.max(0, endedAt - startedAt);
+		synthesisMs += wall;
+		const label = entry.costAttribution?.label;
+		if (label === void 0) {
+			unlabelledSynthesis = true;
 			continue;
 		}
-		if (pageValue === void 0) findings.push(`${field}: seed ${String(seedValue)} but the page shows no such rate`);
-		else if (!(Math.abs(seedValue - pageValue) <= 1e-9)) findings.push(`${field}: seed ${String(seedValue)} vs page ${String(pageValue)}`);
+		labelledSynthesis = true;
+		if (label === "claim-consistency-judge" || label.startsWith(`claim-consistency-judge-`)) semanticJudgeMs += wall;
+		else finalCompositionMs += wall;
 	}
-	const seedTiers = seed.tiers;
-	const pageTiers = page.tiers;
-	if (!Array.isArray(seedTiers)) {
-		if (Array.isArray(pageTiers) && pageTiers.length > 0) findings.push(`tiers: the page shows ${String(pageTiers.length)} but the seed declares none`);
-	} else if (!Array.isArray(pageTiers) || pageTiers.length !== seedTiers.length) findings.push(`tiers: seed declares ${String(seedTiers.length)}, page shows ${Array.isArray(pageTiers) ? String(pageTiers.length) : "none"}`);
-	else for (let i = 0; i < seedTiers.length; i += 1) for (const field of TIER_FIELDS) {
-		const seedValue = seedTiers[i]?.[field] ?? NaN;
-		const pageValue = pageTiers[i]?.[field] ?? NaN;
-		if (!(Math.abs(seedValue - pageValue) <= 1e-9)) findings.push(`tiers[${String(i)}].${field}: seed ${String(seedValue)} vs page ${String(pageValue)}`);
+	const segments = logicalRunTelemetry(ordered).segments;
+	const path = {
+		workerSpans,
+		synthesisMs,
+		unclassifiedSpans,
+		segments
+	};
+	if (labelledSynthesis && !unlabelledSynthesis) {
+		path.finalCompositionMs = finalCompositionMs;
+		path.semanticJudgeMs = semanticJudgeMs;
+	}
+	if (segments > 1 || runStart === void 0 || runEnd === void 0) return path;
+	path.runWallMs = Math.max(0, runEnd - runStart);
+	if (lastWorkerEnd !== void 0) path.postFanInMs = Math.max(0, runEnd - lastWorkerEnd);
+	if (path.runWallMs > 0) {
+		if (path.postFanInMs !== void 0) path.postFanInShare = path.postFanInMs / path.runWallMs;
+		path.synthesisShare = synthesisMs / path.runWallMs;
 	}
-	return findings;
+	return path;
 }
 //#endregion
-//#region src/model/quota.ts
+//#region src/stores/jsonl.ts
 /**
-* Quota rules and the in-process reference QuotaLimiter (RV-215).
-* The rule model is shared by every reference implementation
-* (memoryQuotaLimiter here, SqliteQuotaLimiter in
-* @rulvar/store-sqlite): fixed one-minute windows aligned to the
-* epoch, admission at reservation time, reconciliation to actual
-* usage inside the same window. The hard guarantee is on
-* `requestsPerMinute` (every wire attempt is exactly one request);
-* `tokensPerMinute` admits on the heuristic estimate and settles to
-* actual usage, so token windows are approximate at admission and
-* exact at settlement.
+* JsonlFileStore (M2-T01): the durable file store. One JSON entry per
+* line per run; the journal doubles as an event log. Meta records live
+* beside the journal and are replaced atomically, so listRuns never
+* parses payloads.
 *
-* Docs: https://docs.rulvar.com/guide/model-routing
+* Contract (DEF-4 tightening):
+* - A1 atomicity: a torn trailing line (crash mid-append) is never
+*   visible in load; the incomplete fragment is dropped and overwritten
+*   by the next append. Whole records on that line are data, never
+*   fragment (RV701): a crash that persisted every JSON byte but not
+*   the '\n' leaves a parseable tail that load serves and append
+*   terminates before writing, and repair salvages complete records a
+*   glued line carries instead of discarding the line, so an entry a
+*   load has served can never be un-served by a later repair.
+* - A2 total per-run order: load returns append order, stable across
+*   calls (the kernel's per-run queue serializes appends).
+* - A3 read-your-writes: append resolves after the line is written.
+* - A4 opaque payload: entries round-trip byte-for-byte as JSON; unknown
+*   kinds and fields pass through untouched.
+*
+* Leasing is NOT implemented here: LeasableStore ships with
+* @rulvar/store-sqlite (M5); JsonlFileStore is single-writer by
+* convention.
 */
+const JOURNAL_SUFFIX = ".jsonl";
+const META_SUFFIX = ".meta.json";
+function safeName(runId) {
+	if (!/^[A-Za-z0-9._-]+$/.test(runId)) throw new JournalOrderViolation(`JsonlFileStore: runId '${runId}' is not filesystem-safe ([A-Za-z0-9._-] only)`);
+	return runId;
+}
 /**
-* Captured at module load, before the InProcessRunner's
-* nondeterminism guard can patch the global: the limiter's clock is
-* engine infrastructure on the live-only dispatch path and must never
-* be blamed on workflow code.
+* Whole JSON values glued on one line, split apart without parser
+* ambiguity (RV701): depth is tracked outside string literals only, and
+* every candidate must still round-trip JSON.parse. A line that is not a
+* clean concatenation from its first byte salvages its whole prefix
+* values and returns everything after them as the torn fragment, so the
+* caller keeps accepted records and drops exactly the unacknowledged
+* tail a crash tore.
 */
-const nativeNow = Date.now;
-/** The fixed accounting window every PerMinute cap counts over. */
-const QUOTA_WINDOW_MS = 6e4;
-/**
+function splitConcatenatedJson(line) {
+	const whole = [];
+	let start = 0;
+	let depth = 0;
+	let inString = false;
+	let escaped = false;
+	for (let i = 0; i < line.length; i += 1) {
+		const ch = line[i];
+		if (inString) {
+			if (escaped) escaped = false;
+			else if (ch === "\\") escaped = true;
+			else if (ch === "\"") inString = false;
+			continue;
+		}
+		if (ch === "\"") {
+			inString = true;
+			continue;
+		}
+		if (ch === "{" || ch === "[") {
+			depth += 1;
+			continue;
+		}
+		if (ch === "}" || ch === "]") {
+			depth -= 1;
+			if (depth < 0) return {
+				whole,
+				fragment: line.slice(start)
+			};
+			if (depth === 0) {
+				const candidate = line.slice(start, i + 1);
+				try {
+					whole.push(JSON.parse(candidate));
+				} catch {
+					return {
+						whole,
+						fragment: line.slice(start)
+					};
+				}
+				start = i + 1;
+			}
+		}
+	}
+	return {
+		whole,
+		fragment: line.slice(start)
+	};
+}
+var JsonlFileStore = class {
+	dir;
+	/**
+	* The stored tail seq per run, lazily initialized from the file on the
+	* first append this instance performs (obligation A5). Per instance by
+	* design: cross-process writers are the lease seam's job.
+	*/
+	lastSeq = /* @__PURE__ */ new Map();
+	/**
+	* The verify-only load switch (RV1512): with `repairOnLoad: false`,
+	* `load` serves the salvageable records WITHOUT rewriting the file,
+	* so an auditor's "verification" read never destroys the evidence
+	* of a tear it found. The default keeps the owner semantics byte
+	* for byte: a torn tail repairs on load exactly as documented in
+	* the A1 model above. Mutations (`append`, `putMeta`, `delete`)
+	* are unaffected by the flag; an auditor that must not write simply
+	* does not call them.
+	*/
+	repairOnLoad;
+	constructor(options) {
+		this.dir = options.dir;
+		this.repairOnLoad = options.repairOnLoad !== false;
+		mkdirSync(this.dir, { recursive: true });
+	}
+	journalPath(runId) {
+		return join(this.dir, `${safeName(runId)}${JOURNAL_SUFFIX}`);
+	}
+	metaPath(runId) {
+		return join(this.dir, `${safeName(runId)}${META_SUFFIX}`);
+	}
+	async append(runId, e) {
+		let tail = this.lastSeq.get(runId);
+		if (tail === void 0) {
+			const existing = await this.load(runId);
+			this.terminateUnterminatedTail(runId);
+			const last = existing[existing.length - 1];
+			tail = last !== void 0 && Number.isFinite(last.seq) ? last.seq : Number.NEGATIVE_INFINITY;
+			this.lastSeq.set(runId, tail);
+		}
+		if (Number.isFinite(e.seq) && e.seq <= tail) throw new JournalOrderViolation(`JsonlFileStore: append of seq ${e.seq} to run '${runId}' is not after the stored tail seq ${tail}; a concurrent writer raced this journal from a stale tail`);
+		appendFileSync(this.journalPath(runId), `${JSON.stringify(e)}\n`, "utf8");
+		if (Number.isFinite(e.seq)) this.lastSeq.set(runId, e.seq);
+	}
+	async load(runId) {
+		let raw;
+		try {
+			raw = readFileSync(this.journalPath(runId), "utf8");
+		} catch (thrown) {
+			if (thrown.code === "ENOENT") return [];
+			throw thrown;
+		}
+		const lines = raw.split("\n");
+		const entries = [];
+		for (let i = 0; i < lines.length; i += 1) {
+			const line = lines[i] ?? "";
+			if (line === "") continue;
+			try {
+				entries.push(JSON.parse(line));
+			} catch (thrown) {
+				if (lines.slice(i + 1).every((rest) => rest === "")) {
+					for (const value of splitConcatenatedJson(line).whole) entries.push(value);
+					if (this.repairOnLoad) this.repairTornTail(runId, entries);
+					break;
+				}
+				throw new JournalOrderViolation(`JsonlFileStore: corrupt journal line ${i + 1} of run '${runId}' (not the trailing line, so this is not a torn append)`, { cause: thrown });
+			}
+		}
+		return entries;
+	}
+	/**
+	* Restores the trailing '\n' of a parseable-but-unterminated tail
+	* (RV701). One byte appended in place terminates the record exactly
+	* where the crash left it; the file's bytes before it stay untouched.
+	* No-op on a missing, empty, or already-terminated journal.
+	*/
+	terminateUnterminatedTail(runId) {
+		const path = this.journalPath(runId);
+		let fd;
+		try {
+			fd = openSync(path, "r");
+		} catch (thrown) {
+			if (thrown.code === "ENOENT") return;
+			throw thrown;
+		}
+		let needsNewline = false;
+		try {
+			const size = fstatSync(fd).size;
+			if (size > 0) {
+				const lastByte = /* @__PURE__ */ new Uint8Array(1);
+				readSync(fd, lastByte, 0, 1, size - 1);
+				needsNewline = lastByte[0] !== 10;
+			}
+		} finally {
+			closeSync(fd);
+		}
+		if (needsNewline) appendFileSync(path, "\n", "utf8");
+	}
+	repairTornTail(runId, whole) {
+		const path = this.journalPath(runId);
+		const temp = `${path}.tmp`;
+		writeFileSync(temp, whole.map((entry) => JSON.stringify(entry)).join("\n") + (whole.length > 0 ? "\n" : ""), "utf8");
+		renameSync(temp, path);
+	}
+	async putMeta(m) {
+		const path = this.metaPath(m.runId);
+		const temp = `${path}.tmp`;
+		writeFileSync(temp, JSON.stringify(m, null, 2), "utf8");
+		renameSync(temp, path);
+	}
+	async getMeta(runId) {
+		try {
+			return JSON.parse(readFileSync(this.metaPath(runId), "utf8"));
+		} catch {
+			return;
+		}
+	}
+	async listRuns(f) {
+		const metas = [];
+		for (const file of readdirSync(this.dir)) {
+			if (!file.endsWith(META_SUFFIX)) continue;
+			try {
+				metas.push(JSON.parse(readFileSync(join(this.dir, file), "utf8")));
+			} catch {}
+		}
+		return metas.filter((meta) => metaMatchesFilter(meta, f));
+	}
+	async delete(runId) {
+		rmSync(this.journalPath(runId), { force: true });
+		rmSync(this.metaPath(runId), { force: true });
+		this.lastSeq.delete(runId);
+	}
+};
+const TRANSCRIPT_SUFFIX = ".bin";
+/**
+* File-backed TranscriptStore (M6-T02): blobs (transcripts, checkpoints,
+* persisted CompiledWorkflow sources) as one file per ref under `dir`,
+* so compiled runs resume across processes. Refs follow the
+* `<runId>/<name>` convention; nested segments become directories.
+*
+* Every ref is contained under `dir` (v1.36.0 review SEC-P1): each
+* segment must match `[A-Za-z0-9._-]` and be neither empty, '.', nor
+* '..', and the resolved path must stay under the resolved root. A '..'
+* segment used to pass the per-segment alphabet (dots are in it) and, via
+* `join`, escape the root; a caller passing an untrusted ref (or an
+* untrusted runId, which prefixes checkpoint and workflow-source refs)
+* could read, write, or delete `.bin` files outside `dir`.
+*/
+var FileTranscriptStore = class {
+	dir;
+	constructor(options) {
+		this.dir = options.dir;
+		mkdirSync(this.dir, { recursive: true });
+	}
+	blobPath(ref) {
+		const segments = ref.split("/");
+		for (const segment of segments) if (segment === "" || segment === "." || segment === ".." || !/^[A-Za-z0-9._-]+$/.test(segment)) throw new JournalOrderViolation(`FileTranscriptStore: ref segment '${segment}' is not filesystem-safe`);
+		const name = segments.pop() ?? "";
+		const path = join(this.dir, ...segments, `${name}${TRANSCRIPT_SUFFIX}`);
+		const root = resolve(this.dir);
+		const resolved = resolve(path);
+		if (resolved !== root && !resolved.startsWith(`${root}${sep}`)) throw new JournalOrderViolation(`FileTranscriptStore: ref '${ref}' resolves outside the configured root`);
+		return path;
+	}
+	async put(ref, blob) {
+		const path = this.blobPath(ref);
+		mkdirSync(dirname(path), { recursive: true });
+		const temp = `${path}.tmp`;
+		writeFileSync(temp, blob);
+		renameSync(temp, path);
+	}
+	async get(ref) {
+		try {
+			return new Uint8Array(readFileSync(this.blobPath(ref)));
+		} catch (error) {
+			if (error.code === "ENOENT") return null;
+			throw error;
+		}
+	}
+	async list(runId) {
+		if (runId === "." || runId === "..") throw new JournalOrderViolation(`FileTranscriptStore: runId '${runId}' is not filesystem-safe`);
+		const root = join(this.dir, safeName(runId));
+		const refs = [];
+		const walk = (dir, prefix) => {
+			let names;
+			try {
+				names = readdirSync(dir);
+			} catch {
+				return;
+			}
+			for (const name of names) {
+				const path = join(dir, name);
+				if (statSync(path).isDirectory()) walk(path, `${prefix}${name}/`);
+				else if (name.endsWith(TRANSCRIPT_SUFFIX)) refs.push(`${prefix}${name.slice(0, -4)}`);
+			}
+		};
+		walk(root, `${runId}/`);
+		return refs.sort();
+	}
+	async delete(ref) {
+		try {
+			rmSync(this.blobPath(ref));
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+	}
+};
+//#endregion
+//#region src/model/pricing.ts
+/**
+* Resolves the pricing for a model: the versioned table wins; the
+* adapter-reported caps.pricing is the fallback; undefined means
+* unpriced (the CostReport surfaces it, never a silent zero).
+*/
+function resolvePricing(ref, table, capsPricing) {
+	return table?.models[ref] ?? capsPricing;
+}
+/** The tier a full prompt lands in: the highest threshold strictly below it. */
+function tierFor(pricing, inputTokens) {
+	let tier;
+	for (const candidate of pricing.tiers ?? []) if (inputTokens > candidate.aboveInputTokens && (tier === void 0 || candidate.aboveInputTokens > tier.aboveInputTokens)) tier = candidate;
+	return tier;
+}
+/**
+* Decomposes one usage against one pricing row into the four billing
+* components. Under the Usage invariant inputTokens is the FULL prompt
+* including cache reads and writes, so the input rate bills only the
+* uncached remainder and cache tokens bill at their own rates, never
+* twice; a row that omits a cache rate bills those tokens at the plain
+* input rate rather than silently for free. A row may carry
+* long-context tiers: the highest threshold strictly below the full
+* prompt re-prices the ENTIRE request (input-side rates scale by
+* inputMultiplier, the output rate by outputMultiplier). Cache writes
+* price at the 5m premium rate by default; when the usage carries the
+* TTL split (RV810: `cacheWrite5mTokens` and `cacheWrite1hTokens`,
+* filled by adapters whose provider distinguishes write TTLs), the 1h
+* share prices at `cacheWrite1hUsdPerMTok` (falling back to the plain
+* write rate when the row lacks it) and everything the 1h share does
+* not claim, the 5m share plus any unattributed remainder an upstream
+* invariant violation left, bills at the write rate, never silently
+* for free. The component's `tokens` stays the WHOLE
+* `cacheWriteTokens` either way, so statement reconciliation keys are
+* unchanged.
+*/
+function priceComponentsOf(pricing, usage) {
+	const tier = tierFor(pricing, usage.inputTokens);
+	const inputMul = tier?.inputMultiplier ?? 1;
+	const outputMul = tier?.outputMultiplier ?? 1;
+	const uncachedInputTokens = Math.max(0, usage.inputTokens - usage.cacheReadTokens - usage.cacheWriteTokens);
+	const writeRate = pricing.cacheWriteUsdPerMTok ?? pricing.inputUsdPerMTok;
+	const write1hRate = pricing.cacheWrite1hUsdPerMTok ?? writeRate;
+	const write1hTokens = usage.cacheWrite5mTokens !== void 0 || usage.cacheWrite1hTokens !== void 0 ? usage.cacheWrite1hTokens ?? 0 : 0;
+	const writeDefaultTokens = Math.max(0, usage.cacheWriteTokens - write1hTokens);
+	return {
+		input: {
+			tokens: uncachedInputTokens,
+			usd: uncachedInputTokens / 1e6 * pricing.inputUsdPerMTok * inputMul
+		},
+		output: {
+			tokens: usage.outputTokens,
+			usd: usage.outputTokens / 1e6 * pricing.outputUsdPerMTok * outputMul
+		},
+		cachedInput: {
+			tokens: usage.cacheReadTokens,
+			usd: usage.cacheReadTokens / 1e6 * (pricing.cacheReadUsdPerMTok ?? pricing.inputUsdPerMTok) * inputMul
+		},
+		cacheWrite: {
+			tokens: usage.cacheWriteTokens,
+			usd: (writeDefaultTokens / 1e6 * writeRate + write1hTokens / 1e6 * write1hRate) * inputMul
+		}
+	};
+}
+/**
+* Dollars from normalized usage against one pricing row: the sum of the
+* {@link priceComponentsOf} terms in their declared order, byte for
+* byte the historical expression (uncached input, output, cached input,
+* cache writes).
+*/
+function priceUsdOf(pricing, usage) {
+	const parts = priceComponentsOf(pricing, usage);
+	return parts.input.usd + parts.output.usd + parts.cachedInput.usd + parts.cacheWrite.usd;
+}
+/**
+* The output tokens `remainingUsd` still buys from one pricing row after
+* paying for an estimated prompt of `estimatedInputTokens`, priced with
+* the same tier rules as settlement (the tier is selected by the
+* estimated prompt). Floored to whole tokens; zero or negative means not
+* even one output token fits, so the turn must not be dispatched.
+* Undefined when the row prices output at zero (a free model needs no
+* output bound).
+*/
+function affordableOutputTokens(pricing, remainingUsd, estimatedInputTokens) {
+	const tier = tierFor(pricing, estimatedInputTokens);
+	const outputRate = pricing.outputUsdPerMTok * (tier?.outputMultiplier ?? 1);
+	if (outputRate <= 0) return;
+	const inputUsd = priceUsdOf(pricing, {
+		inputTokens: estimatedInputTokens,
+		outputTokens: 0,
+		cacheReadTokens: 0,
+		cacheWriteTokens: 0
+	});
+	return Math.floor((remainingUsd - inputUsd) / outputRate * 1e6);
+}
+const RATE_FIELDS = [
+	"inputUsdPerMTok",
+	"outputUsdPerMTok",
+	"cacheReadUsdPerMTok",
+	"cacheWriteUsdPerMTok",
+	"cacheWrite1hUsdPerMTok"
+];
+const TIER_FIELDS = [
+	"aboveInputTokens",
+	"inputMultiplier",
+	"outputMultiplier"
+];
+/**
+* Compares a pricing seed against rates extracted from the provider's
+* documented pricing page, in BOTH directions (RV902): a seed rate the
+* page moved or dropped is a finding, and so is a documented billable
+* rate the seed never declared, because a billable column missing from
+* the seed is a silent underpricing channel (the 1h cache-write premium
+* hid exactly there). Declared long-context tiers compare field by
+* field. Returns human-readable findings, empty when the sides agree;
+* the weekly rates audit (scripts/rates-audit.mjs) runs this exact
+* comparator over the live pages, and the fault-injection kit drives it
+* as a permanent gate (RV909). It verifies DOCUMENTATION, not billing:
+* only a statement reconciliation over saved exports settles what the
+* provider's meter actually charges.
+*/
+function compareRates(seed, page) {
+	const findings = [];
+	for (const field of RATE_FIELDS) {
+		const seedValue = seed[field];
+		const pageValue = page[field];
+		if (seedValue === void 0) {
+			if (pageValue !== void 0) findings.push(`${field}: the page shows ${String(pageValue)} but the seed declares no such rate`);
+			continue;
+		}
+		if (pageValue === void 0) findings.push(`${field}: seed ${String(seedValue)} but the page shows no such rate`);
+		else if (!(Math.abs(seedValue - pageValue) <= 1e-9)) findings.push(`${field}: seed ${String(seedValue)} vs page ${String(pageValue)}`);
+	}
+	const seedTiers = seed.tiers;
+	const pageTiers = page.tiers;
+	if (!Array.isArray(seedTiers)) {
+		if (Array.isArray(pageTiers) && pageTiers.length > 0) findings.push(`tiers: the page shows ${String(pageTiers.length)} but the seed declares none`);
+	} else if (!Array.isArray(pageTiers) || pageTiers.length !== seedTiers.length) findings.push(`tiers: seed declares ${String(seedTiers.length)}, page shows ${Array.isArray(pageTiers) ? String(pageTiers.length) : "none"}`);
+	else for (let i = 0; i < seedTiers.length; i += 1) for (const field of TIER_FIELDS) {
+		const seedValue = seedTiers[i]?.[field] ?? NaN;
+		const pageValue = pageTiers[i]?.[field] ?? NaN;
+		if (!(Math.abs(seedValue - pageValue) <= 1e-9)) findings.push(`tiers[${String(i)}].${field}: seed ${String(seedValue)} vs page ${String(pageValue)}`);
+	}
+	return findings;
+}
+//#endregion
+//#region src/model/quota.ts
+/**
+* Quota rules and the in-process reference QuotaLimiter (RV-215).
+* The rule model is shared by every reference implementation
+* (memoryQuotaLimiter here, SqliteQuotaLimiter in
+* @rulvar/store-sqlite): fixed one-minute windows aligned to the
+* epoch, admission at reservation time, reconciliation to actual
+* usage inside the same window. The hard guarantee is on
+* `requestsPerMinute` (every wire attempt is exactly one request);
+* `tokensPerMinute` admits on the heuristic estimate and settles to
+* actual usage, so token windows are approximate at admission and
+* exact at settlement.
+*
+* Docs: https://docs.rulvar.com/guide/model-routing
+*/
+/**
+* Captured at module load, before the InProcessRunner's
+* nondeterminism guard can patch the global: the limiter's clock is
+* engine infrastructure on the live-only dispatch path and must never
+* be blamed on workflow code.
+*/
+const nativeNow = Date.now;
+/** The fixed accounting window every PerMinute cap counts over. */
+const QUOTA_WINDOW_MS = 6e4;
+/**
 * Validates a quota rule set as a typed ConfigError before any
 * limiter can admit under it: a non-array or empty set, a rule
 * without a cap, a malformed dimension, or a malformed cap all fail
@@ -16364,520 +16834,232 @@ var AdmissionController = class {
 		this.lineageIndex?.noteAdmitted(logicalTaskId);
 	}
 	/**
-	* Evaluates one spawn live, strictly BEFORE its decision entry is
-	* appended. On admit the reserve is committed on the whole ancestor
-	* account chain atomically with the evaluation; the caller journals the
-	* returned decision and only then produces effects (child account,
-	* dispatch). On reject nothing is committed and the reject verdict is
-	* journaled by the caller so replay re-delivers it without
-	* re-evaluation.
-	*/
-	/**
-	* The reserve the DISPATCH layer will actually commit for this spec:
-	* the estimate (or the flat default) clamped by the explicit child
-	* budget when one exists, because only an explicit budget opens a
-	* child-allowance account at dispatch; the childBudgetFraction cap
-	* never materializes as an account and must not shrink the
-	* projection. The token-count-priced estimate of ctx.agent is
-	* unreachable here (async); a divergence there lands as a journaled
-	* dispatch rejection instead of a strand. Delegates to the exported
-	* {@link dispatchProjectionReserveUsd} so the live gate and
-	* preflightEstimate share ONE formula (the 1.63.0 experiment review,
-	* P0.3).
-	*/
-	projectedDispatchReserveUsd(spec) {
-		return dispatchProjectionReserveUsd(spec, this.flatReserveUsd);
-	}
-	admit(spec, options) {
-		const commitReserve = options?.commitReserve ?? true;
-		const nodeKey = spec.nodeKey ?? spec.parentAccountScope;
-		const depth = spawnDepthOf(spec.childScope);
-		const childrenBefore = this.childrenOf.get(nodeKey) ?? 0;
-		const evaluated = this.evaluateLineage(spec);
-		const statsBefore = {
-			spawnsBefore: this.budget.spent().agentsSpawned,
-			childrenOfParentBefore: childrenBefore,
-			depth,
-			...evaluated.statsBefore === void 0 ? {} : { lineage: evaluated.statsBefore }
-		};
-		if (evaluated.decision.kind === "reject") return {
-			verdict: {
-				kind: "reject",
-				reason: evaluated.decision.reason
-			},
-			statsBefore
-		};
-		if (this.terminationAccount !== void 0) {
-			if ((spec.ladderLength ?? 1) > this.terminationAccount.limits.kMax) return {
-				verdict: {
-					kind: "reject",
-					reason: { code: "ladder_exceeds_frozen" }
-				},
-				statsBefore
-			};
-			if (this.terminationAccount.spawnUnitsExhausted) return {
-				verdict: {
-					kind: "reject",
-					reason: { code: "termination_exhausted" }
-				},
-				statsBefore
-			};
-		}
-		if (depth > this.maxDepth) return {
-			verdict: {
-				kind: "reject",
-				reason: { code: "depth" }
-			},
-			statsBefore
-		};
-		if (childrenBefore >= this.maxChildrenPerNode) return {
-			verdict: {
-				kind: "reject",
-				reason: { code: "quota" }
-			},
-			statsBefore
-		};
-		if (this.maxTotalSpawns !== void 0 && this.admittedTotal >= this.maxTotalSpawns) return {
-			verdict: {
-				kind: "reject",
-				reason: { code: "lifetime" }
-			},
-			statsBefore
-		};
-		if (spec.roster !== void 0) {
-			const seatsRemaining = spec.roster.floor - spec.roster.admittedChildren;
-			if (seatsRemaining > 0) {
-				const perSeatProjectionUsd = this.projectedDispatchReserveUsd(spec);
-				const remainder = this.budget.remainderOf(spec.parentAccountScope);
-				if (remainder !== void 0 && remainder < seatsRemaining * perSeatProjectionUsd + spec.roster.liveExposureUsd) return {
-					verdict: {
-						kind: "reject",
-						reason: {
-							code: "roster_floor",
-							floor: spec.roster.floor,
-							admittedChildren: spec.roster.admittedChildren,
-							seatsRemaining,
-							perSeatProjectionUsd,
-							liveExposureUsd: spec.roster.liveExposureUsd,
-							remainderUsd: remainder
-						}
-					},
-					statsBefore
-				};
-			}
-		}
-		const spawnToolOrigin = spec.origin === "spawn_agent" || spec.origin === "parallel_agents";
-		let childCeilingUsd;
-		const parentRemainder = this.budget.remainderOf(spec.parentAccountScope);
-		if (spawnToolOrigin) {
-			if (spec.budgetUsd !== void 0) childCeilingUsd = spec.budgetUsd;
-		} else if (parentRemainder !== void 0) {
-			const fractionCap = this.childBudgetFraction * parentRemainder;
-			childCeilingUsd = spec.budgetUsd === void 0 ? fractionCap : Math.min(spec.budgetUsd, fractionCap);
-		} else if (spec.budgetUsd !== void 0) childCeilingUsd = spec.budgetUsd;
-		let reserveUsd = spec.estCostUsd ?? this.flatReserveUsd;
-		const source = spec.estCostUsd === void 0 ? "default" : "estCost";
-		let clampedBy;
-		if (childCeilingUsd !== void 0 && reserveUsd > childCeilingUsd) {
-			clampedBy = spec.budgetUsd !== void 0 && childCeilingUsd === spec.budgetUsd ? "explicit-budget" : "fraction-ceiling";
-			reserveUsd = childCeilingUsd;
-		}
-		const reserve = {
-			reserveUsd,
-			source
-		};
-		if (clampedBy !== void 0) reserve.clampedBy = clampedBy;
-		if (childCeilingUsd !== void 0) reserve.childCeilingUsd = childCeilingUsd;
-		if (this.budget.spawnHeadroom <= 0) return {
-			verdict: {
-				kind: "reject",
-				reason: { code: "lifetime" }
-			},
-			statsBefore
-		};
-		if (commitReserve) try {
-			this.budget.admitSpawn(reserveUsd, spec.parentAccountScope);
-		} catch {
-			return {
-				verdict: {
-					kind: "reject",
-					reason: { code: "budget" }
-				},
-				statsBefore
-			};
-		}
-		else {
-			const remainder = this.budget.remainderOf(spec.parentAccountScope);
-			const projection = this.projectedDispatchReserveUsd(spec);
-			if (remainder !== void 0 && (remainder <= 0 || remainder < projection + (spec.pendingReserveUsd ?? 0))) return {
-				verdict: {
-					kind: "reject",
-					reason: { code: "budget" }
-				},
-				statsBefore
-			};
-		}
-		this.childrenOf.set(nodeKey, childrenBefore + 1);
-		this.admittedTotal += 1;
-		const lineage = evaluated.decision.lineage;
-		this.registerLineageAdmit(lineage.logicalTaskId);
-		let spawnUnitsAfter = this.budget.spawnHeadroom;
-		if (this.terminationAccount !== void 0) {
-			const debited = this.terminationAccount.debitSpawn({
-				logicalTaskId: lineage.logicalTaskId,
-				isNew: spec.lineage === void 0,
-				ladderLength: spec.ladderLength ?? 1
-			});
-			if (!debited.ok) return {
-				verdict: {
-					kind: "reject",
-					reason: { code: "termination_exhausted" }
-				},
-				statsBefore
-			};
-			spawnUnitsAfter = debited.spawnUnitsAfter;
-		}
-		return {
-			verdict: {
-				kind: "admit",
-				reserve,
-				spawnUnitsAfter,
-				lineage: {
-					logicalTaskId: lineage.logicalTaskId,
-					isNew: spec.lineage === void 0,
-					depth
-				}
-			},
-			statsBefore,
-			nodeId: this.mintId(),
-			lineage,
-			...this.terminationAccount === void 0 ? {} : { ladderLength: spec.ladderLength ?? 1 }
-		};
-	}
-	/**
-	* Resume roll-forward for an orchestrator child (M6-T07): restores the
-	* children-quota counter only. The budget seed already counts settled
-	* agent dispatches, and an in-flight child re-commits its reserve
-	* through the ctx.agent dispatch path.
-	*/
-	recoverChild(nodeKey) {
-		this.childrenOf.set(nodeKey, (this.childrenOf.get(nodeKey) ?? 0) + 1);
-		this.admittedTotal += 1;
-	}
-	/**
-	* Resume roll-forward for a child that already SETTLED before the
-	* resume: re-registers the counters (maxChildrenPerNode, the lifetime
-	* cap, statsBefore fidelity) without committing any reserve; the spend
-	* itself sits in the root ledger seed.
+	* Evaluates one spawn live, strictly BEFORE its decision entry is
+	* appended. On admit the reserve is committed on the whole ancestor
+	* account chain atomically with the evaluation; the caller journals the
+	* returned decision and only then produces effects (child account,
+	* dispatch). On reject nothing is committed and the reject verdict is
+	* journaled by the caller so replay re-delivers it without
+	* re-evaluation.
 	*/
-	recoverSettled(parentAccountScope) {
-		this.budget.admitRecovered(0, parentAccountScope);
-		this.childrenOf.set(parentAccountScope, (this.childrenOf.get(parentAccountScope) ?? 0) + 1);
-		this.admittedTotal += 1;
-	}
 	/**
-	* Resume roll-forward for an admission whose decision entry exists but
-	* whose child has NOT settled: re-applies the recorded reserve and
-	* counters without re-evaluating any limit (replay never
-	* re-evaluates admission; reserves are recovered, never
-	* re-estimated).
+	* The reserve the DISPATCH layer will actually commit for this spec:
+	* the estimate (or the flat default) clamped by the explicit child
+	* budget when one exists, because only an explicit budget opens a
+	* child-allowance account at dispatch; the childBudgetFraction cap
+	* never materializes as an account and must not shrink the
+	* projection. The token-count-priced estimate of ctx.agent is
+	* unreachable here (async); a divergence there lands as a journaled
+	* dispatch rejection instead of a strand. Delegates to the exported
+	* {@link dispatchProjectionReserveUsd} so the live gate and
+	* preflightEstimate share ONE formula (the 1.63.0 experiment review,
+	* P0.3).
 	*/
-	recoverInFlight(parentAccountScope, verdict) {
-		if (verdict.kind === "reject") return;
-		const reserveUsd = verdict.kind === "reuse_full" ? 0 : verdict.reserve.reserveUsd;
-		this.budget.admitRecovered(reserveUsd, parentAccountScope);
-		this.childrenOf.set(parentAccountScope, (this.childrenOf.get(parentAccountScope) ?? 0) + 1);
-		this.admittedTotal += 1;
-	}
-};
-//#endregion
-//#region src/l0/telemetry-reduce.ts
-const ZERO = {
-	inputTokens: 0,
-	outputTokens: 0,
-	cacheReadTokens: 0,
-	cacheWriteTokens: 0
-};
-/**
-* Reduces one run's event stream (or any slice of it) to the invocation
-* table. Feed it the events in emission order; both a live stream and a
-* replayed one produce the same usage and cost columns.
-*/
-function reduceInvocationTable(events) {
-	const rows = /* @__PURE__ */ new Map();
-	const order = [];
-	const openPhases = /* @__PURE__ */ new Map();
-	const byRole = {};
-	let totalCostUsd = 0;
-	const rowFor = (event) => {
-		let row = rows.get(event.spanId);
-		if (row === void 0) {
-			row = {
-				spanId: event.spanId,
-				agentType: event.agentType,
-				...event.label === void 0 ? {} : { label: event.label },
-				usage: ZERO,
-				costUsd: 0,
-				costBasis: "aggregate-estimate",
-				usageApprox: false,
-				retryCount: 0,
-				replayed: event.replayed === true,
-				open: true,
-				phases: []
-			};
-			rows.set(event.spanId, row);
-			order.push(row);
-		}
-		return row;
-	};
-	for (const event of events) switch (event.type) {
-		case "agent:start": {
-			const row = rowFor(event);
-			row.role = event.role;
-			break;
-		}
-		case "agent:phase:start": {
-			const row = rowFor(event);
-			const phase = {
-				invocation: event.invocation,
-				role: event.role,
-				model: event.model,
-				durationMs: 0,
-				usage: ZERO,
-				costUsd: 0,
-				costBasis: "aggregate-estimate",
-				retries: 0,
-				replayed: event.replayed === true,
-				open: true
-			};
-			row.phases.push(phase);
-			openPhases.set(`${event.spanId}#${event.invocation}`, phase);
-			break;
-		}
-		case "agent:phase:end": {
-			const key = `${event.spanId}#${event.invocation}`;
-			let phase = openPhases.get(key);
-			if (phase === void 0) {
-				phase = {
-					invocation: event.invocation,
-					role: event.role,
-					model: event.model,
-					durationMs: 0,
-					usage: ZERO,
-					costUsd: 0,
-					costBasis: "aggregate-estimate",
-					retries: 0,
-					replayed: event.replayed === true,
-					open: true
-				};
-				rowFor(event).phases.push(phase);
-			}
-			openPhases.delete(key);
-			phase.open = false;
-			phase.role = event.role;
-			phase.model = event.model;
-			phase.durationMs = event.durationMs;
-			phase.usage = event.usage;
-			phase.costUsd = event.costUsd;
-			phase.costBasis = event.costBasis ?? "aggregate-estimate";
-			phase.outcome = event.outcome;
-			phase.retries = event.retries ?? 0;
-			const bucket = byRole[event.role] ??= {
-				usage: ZERO,
-				costUsd: 0,
-				costBasis: "per-call"
-			};
-			bucket.usage = sumUsage(bucket.usage, event.usage);
-			bucket.costUsd += event.costUsd;
-			if (phase.costBasis === "aggregate-estimate") bucket.costBasis = "aggregate-estimate";
-			break;
-		}
-		case "agent:end": {
-			const row = rowFor(event);
-			row.open = false;
-			row.status = event.status;
-			row.usage = event.usage;
-			row.costUsd = event.costUsd;
-			row.costBasis = event.costBasis ?? "aggregate-estimate";
-			row.usageApprox = event.usageApprox === true;
-			row.retryCount = event.retryCount ?? 0;
-			if (event.toolBudget !== void 0) row.toolBudget = event.toolBudget;
-			totalCostUsd += event.costUsd;
-			break;
-		}
-		default: break;
+	projectedDispatchReserveUsd(spec) {
+		return dispatchProjectionReserveUsd(spec, this.flatReserveUsd);
 	}
-	return {
-		agents: order,
-		byRole,
-		totalCostUsd
-	};
-}
-/**
-* The label the claim-consistency judge invocation dispatches under
-* (RV1502; named here since RV1604 so the critical-path reducer and the
-* orchestrator share one constant): the judge rides role 'synthesize',
-* and this label is what tells its wall apart from a real final
-* composition in {@link reduceCriticalPath}.
-*/
-const CLAIM_JUDGE_LABEL = "claim-consistency-judge";
-/** Total length of the union of possibly overlapping intervals. */
-function unionLength(intervals) {
-	const positive = intervals.filter((interval) => interval.to > interval.from);
-	if (positive.length === 0) return 0;
-	const sorted = [...positive].sort((a, b) => a.from - b.from);
-	let total = 0;
-	let from = sorted[0]?.from ?? 0;
-	let to = sorted[0]?.to ?? 0;
-	for (const interval of sorted.slice(1)) if (interval.from > to) {
-		total += to - from;
-		from = interval.from;
-		to = interval.to;
-	} else if (interval.to > to) to = interval.to;
-	return total + (to - from);
-}
-function reduceCriticalPath(events) {
-	let runStart;
-	let runEnd;
-	const startBySpan = /* @__PURE__ */ new Map();
-	let lastWorkerEnd;
-	let workerSpans = 0;
-	let synthesisMs = 0;
-	let finalCompositionMs = 0;
-	let semanticJudgeMs = 0;
-	const coordinationModel = [];
-	const coordinationTools = [];
-	const synthesisSpans = [];
-	const spanOf = (durationMs) => Number.isFinite(durationMs) && durationMs > 0 ? durationMs : 0;
-	for (const event of events) {
-		const at = Date.parse(event.ts);
-		if (!Number.isFinite(at)) continue;
-		switch (event.type) {
-			case "run:start":
-				runStart ??= at;
-				break;
-			case "run:end":
-				runEnd = at;
-				break;
-			case "agent:start":
-				startBySpan.set(event.spanId, {
-					role: event.role,
-					at,
-					...event.label === void 0 ? {} : { label: event.label }
-				});
-				break;
-			case "agent:phase:end":
-				if (startBySpan.get(event.spanId)?.role === "orchestrate") coordinationModel.push({
-					phase: event.role,
-					from: at - spanOf(event.durationMs),
-					to: at
-				});
-				break;
-			case "tool:end":
-				if (startBySpan.get(event.spanId)?.role === "orchestrate") coordinationTools.push({
-					name: event.toolName,
-					from: at - spanOf(event.durationMs),
-					to: at
-				});
-				break;
-			case "agent:end": {
-				const started = startBySpan.get(event.spanId);
-				if (started === void 0) break;
-				if (started.role === "synthesize") {
-					const wall = Math.max(0, at - started.at);
-					const judge = started.label === CLAIM_JUDGE_LABEL;
-					synthesisMs += wall;
-					if (judge) semanticJudgeMs += wall;
-					else finalCompositionMs += wall;
-					synthesisSpans.push({
-						from: started.at,
-						to: at,
-						judge
-					});
-				} else if (started.role !== "orchestrate") {
-					workerSpans += 1;
-					lastWorkerEnd = lastWorkerEnd === void 0 ? at : Math.max(lastWorkerEnd, at);
-				}
-				break;
+	admit(spec, options) {
+		const commitReserve = options?.commitReserve ?? true;
+		const nodeKey = spec.nodeKey ?? spec.parentAccountScope;
+		const depth = spawnDepthOf(spec.childScope);
+		const childrenBefore = this.childrenOf.get(nodeKey) ?? 0;
+		const evaluated = this.evaluateLineage(spec);
+		const statsBefore = {
+			spawnsBefore: this.budget.spent().agentsSpawned,
+			childrenOfParentBefore: childrenBefore,
+			depth,
+			...evaluated.statsBefore === void 0 ? {} : { lineage: evaluated.statsBefore }
+		};
+		if (evaluated.decision.kind === "reject") return {
+			verdict: {
+				kind: "reject",
+				reason: evaluated.decision.reason
+			},
+			statsBefore
+		};
+		if (this.terminationAccount !== void 0) {
+			if ((spec.ladderLength ?? 1) > this.terminationAccount.limits.kMax) return {
+				verdict: {
+					kind: "reject",
+					reason: { code: "ladder_exceeds_frozen" }
+				},
+				statsBefore
+			};
+			if (this.terminationAccount.spawnUnitsExhausted) return {
+				verdict: {
+					kind: "reject",
+					reason: { code: "termination_exhausted" }
+				},
+				statsBefore
+			};
+		}
+		if (depth > this.maxDepth) return {
+			verdict: {
+				kind: "reject",
+				reason: { code: "depth" }
+			},
+			statsBefore
+		};
+		if (childrenBefore >= this.maxChildrenPerNode) return {
+			verdict: {
+				kind: "reject",
+				reason: { code: "quota" }
+			},
+			statsBefore
+		};
+		if (this.maxTotalSpawns !== void 0 && this.admittedTotal >= this.maxTotalSpawns) return {
+			verdict: {
+				kind: "reject",
+				reason: { code: "lifetime" }
+			},
+			statsBefore
+		};
+		if (spec.roster !== void 0) {
+			const seatsRemaining = spec.roster.floor - spec.roster.admittedChildren;
+			if (seatsRemaining > 0) {
+				const perSeatProjectionUsd = this.projectedDispatchReserveUsd(spec);
+				const remainder = this.budget.remainderOf(spec.parentAccountScope);
+				if (remainder !== void 0 && remainder < seatsRemaining * perSeatProjectionUsd + spec.roster.liveExposureUsd) return {
+					verdict: {
+						kind: "reject",
+						reason: {
+							code: "roster_floor",
+							floor: spec.roster.floor,
+							admittedChildren: spec.roster.admittedChildren,
+							seatsRemaining,
+							perSeatProjectionUsd,
+							liveExposureUsd: spec.roster.liveExposureUsd,
+							remainderUsd: remainder
+						}
+					},
+					statsBefore
+				};
 			}
-			default: break;
 		}
-	}
-	const path = {
-		synthesisMs,
-		finalCompositionMs,
-		semanticJudgeMs,
-		workerSpans
-	};
-	if (runStart !== void 0 && runEnd !== void 0) path.runWallMs = Math.max(0, runEnd - runStart);
-	if (runEnd !== void 0 && lastWorkerEnd !== void 0) {
-		path.postFanInMs = Math.max(0, runEnd - lastWorkerEnd);
-		const windowFrom = Math.min(lastWorkerEnd, runEnd);
-		const windowTo = runEnd;
-		const clip = (interval) => {
-			if (interval.to < windowFrom || interval.from > windowTo) return;
+		const spawnToolOrigin = spec.origin === "spawn_agent" || spec.origin === "parallel_agents";
+		let childCeilingUsd;
+		const parentRemainder = this.budget.remainderOf(spec.parentAccountScope);
+		if (spawnToolOrigin) {
+			if (spec.budgetUsd !== void 0) childCeilingUsd = spec.budgetUsd;
+		} else if (parentRemainder !== void 0) {
+			const fractionCap = this.childBudgetFraction * parentRemainder;
+			childCeilingUsd = spec.budgetUsd === void 0 ? fractionCap : Math.min(spec.budgetUsd, fractionCap);
+		} else if (spec.budgetUsd !== void 0) childCeilingUsd = spec.budgetUsd;
+		let reserveUsd = spec.estCostUsd ?? this.flatReserveUsd;
+		const source = spec.estCostUsd === void 0 ? "default" : "estCost";
+		let clampedBy;
+		if (childCeilingUsd !== void 0 && reserveUsd > childCeilingUsd) {
+			clampedBy = spec.budgetUsd !== void 0 && childCeilingUsd === spec.budgetUsd ? "explicit-budget" : "fraction-ceiling";
+			reserveUsd = childCeilingUsd;
+		}
+		const reserve = {
+			reserveUsd,
+			source
+		};
+		if (clampedBy !== void 0) reserve.clampedBy = clampedBy;
+		if (childCeilingUsd !== void 0) reserve.childCeilingUsd = childCeilingUsd;
+		if (this.budget.spawnHeadroom <= 0) return {
+			verdict: {
+				kind: "reject",
+				reason: { code: "lifetime" }
+			},
+			statsBefore
+		};
+		if (commitReserve) try {
+			this.budget.admitSpawn(reserveUsd, spec.parentAccountScope);
+		} catch {
 			return {
-				from: Math.max(interval.from, windowFrom),
-				to: Math.min(interval.to, windowTo)
+				verdict: {
+					kind: "reject",
+					reason: { code: "budget" }
+				},
+				statsBefore
 			};
-		};
-		const byPhase = {};
-		const modelClipped = [];
-		for (const interval of coordinationModel) {
-			const clipped = clip(interval);
-			if (clipped === void 0) continue;
-			byPhase[interval.phase] = (byPhase[interval.phase] ?? 0) + (clipped.to - clipped.from);
-			modelClipped.push(clipped);
 		}
-		const synthesisClipped = [];
-		let judgeClippedMs = 0;
-		let compositionClippedMs = 0;
-		for (const span of synthesisSpans) {
-			const clipped = clip(span);
-			if (clipped === void 0) continue;
-			synthesisClipped.push(clipped);
-			if (span.judge) judgeClippedMs += clipped.to - clipped.from;
-			else compositionClippedMs += clipped.to - clipped.from;
+		else {
+			const remainder = this.budget.remainderOf(spec.parentAccountScope);
+			const projection = this.projectedDispatchReserveUsd(spec);
+			if (remainder !== void 0 && (remainder <= 0 || remainder < projection + (spec.pendingReserveUsd ?? 0))) return {
+				verdict: {
+					kind: "reject",
+					reason: { code: "budget" }
+				},
+				statsBefore
+			};
 		}
-		const byName = {};
-		const callsByName = {};
-		const toolsClipped = [];
-		for (const interval of coordinationTools) {
-			const clipped = clip(interval);
-			if (clipped === void 0) continue;
-			byName[interval.name] = (byName[interval.name] ?? 0) + (clipped.to - clipped.from);
-			callsByName[interval.name] = (callsByName[interval.name] ?? 0) + 1;
-			toolsClipped.push(clipped);
+		this.childrenOf.set(nodeKey, childrenBefore + 1);
+		this.admittedTotal += 1;
+		const lineage = evaluated.decision.lineage;
+		this.registerLineageAdmit(lineage.logicalTaskId);
+		let spawnUnitsAfter = this.budget.spawnHeadroom;
+		if (this.terminationAccount !== void 0) {
+			const debited = this.terminationAccount.debitSpawn({
+				logicalTaskId: lineage.logicalTaskId,
+				isNew: spec.lineage === void 0,
+				ladderLength: spec.ladderLength ?? 1
+			});
+			if (!debited.ok) return {
+				verdict: {
+					kind: "reject",
+					reason: { code: "termination_exhausted" }
+				},
+				statsBefore
+			};
+			spawnUnitsAfter = debited.spawnUnitsAfter;
 		}
-		const lengthOf = (intervals) => intervals.reduce((sum, interval) => sum + (interval.to - interval.from), 0);
-		const coveredMs = unionLength([
-			...modelClipped,
-			...toolsClipped,
-			...synthesisClipped
-		]);
-		const modelOnlyMs = unionLength([...modelClipped, ...toolsClipped]) - unionLength(toolsClipped);
-		const breakdown = {
-			coordinationModelMs: lengthOf(modelClipped),
-			coordinationModelMsByPhase: byPhase,
-			coordinationModelOnlyMs: modelOnlyMs,
-			coordinationToolMs: lengthOf(toolsClipped),
-			coordinationToolMsByName: byName,
-			coordinationToolCallsByName: callsByName,
-			synthesisMs: lengthOf(synthesisClipped),
-			finalCompositionMs: compositionClippedMs,
-			semanticJudgeMs: judgeClippedMs,
-			coveredMs,
-			residueMs: Math.max(0, path.postFanInMs - coveredMs)
+		return {
+			verdict: {
+				kind: "admit",
+				reserve,
+				spawnUnitsAfter,
+				lineage: {
+					logicalTaskId: lineage.logicalTaskId,
+					isNew: spec.lineage === void 0,
+					depth
+				}
+			},
+			statsBefore,
+			nodeId: this.mintId(),
+			lineage,
+			...this.terminationAccount === void 0 ? {} : { ladderLength: spec.ladderLength ?? 1 }
 		};
-		if (path.postFanInMs > 0) breakdown.residueShare = breakdown.residueMs / path.postFanInMs;
-		path.postFanIn = breakdown;
 	}
-	if (path.runWallMs !== void 0 && path.runWallMs > 0) {
-		if (path.postFanInMs !== void 0) path.postFanInShare = path.postFanInMs / path.runWallMs;
-		path.synthesisShare = synthesisMs / path.runWallMs;
+	/**
+	* Resume roll-forward for an orchestrator child (M6-T07): restores the
+	* children-quota counter only. The budget seed already counts settled
+	* agent dispatches, and an in-flight child re-commits its reserve
+	* through the ctx.agent dispatch path.
+	*/
+	recoverChild(nodeKey) {
+		this.childrenOf.set(nodeKey, (this.childrenOf.get(nodeKey) ?? 0) + 1);
+		this.admittedTotal += 1;
 	}
-	return path;
-}
+	/**
+	* Resume roll-forward for a child that already SETTLED before the
+	* resume: re-registers the counters (maxChildrenPerNode, the lifetime
+	* cap, statsBefore fidelity) without committing any reserve; the spend
+	* itself sits in the root ledger seed.
+	*/
+	recoverSettled(parentAccountScope) {
+		this.budget.admitRecovered(0, parentAccountScope);
+		this.childrenOf.set(parentAccountScope, (this.childrenOf.get(parentAccountScope) ?? 0) + 1);
+		this.admittedTotal += 1;
+	}
+	/**
+	* Resume roll-forward for an admission whose decision entry exists but
+	* whose child has NOT settled: re-applies the recorded reserve and
+	* counters without re-evaluating any limit (replay never
+	* re-evaluates admission; reserves are recovered, never
+	* re-estimated).
+	*/
+	recoverInFlight(parentAccountScope, verdict) {
+		if (verdict.kind === "reject") return;
+		const reserveUsd = verdict.kind === "reuse_full" ? 0 : verdict.reserve.reserveUsd;
+		this.budget.admitRecovered(reserveUsd, parentAccountScope);
+		this.childrenOf.set(parentAccountScope, (this.childrenOf.get(parentAccountScope) ?? 0) + 1);
+		this.admittedTotal += 1;
+	}
+};
 //#endregion
 //#region src/model/profile-card.ts
 function toolNamesOf(profile) {
@@ -18620,6 +18802,7 @@ function createCtx(internals, rootWorkflow) {
 				agentType,
 				role: primaryRole,
 				budgetAccount: state.budgetScope ?? "run",
+				...opts.label === void 0 ? {} : { label: opts.label },
 				...opts[kFinalizeReserve] === true ? { finalizeReserve: true } : {}
 			},
 			transcriptRef: result.transcriptRef
@@ -28228,4 +28411,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, invoiceFromJournal, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, sectionCitationsValidator, sectionPatternCountValidator, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, invoiceFromJournal, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, sectionCitationsValidator, sectionPatternCountValidator, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };