@rulvar/core 1.241.0 → 1.242.0

package/dist/index.d.ts

@@ -1122,6 +1122,16 @@ type JournalEntry = {
     cap?: number;
   };
   /**
+  * Terminal agent entries whose invocation was aborted by the host's
+  * finish rejection (RV3702): the declared finish contract rejected
+  * the candidate past its repair bound, so the span died by host
+  * hand with its wires fine. Stamped at settle from the typed abort
+  * reason; never on a defective (throwing) validator, whose abort
+  * carries its own reason, because a host defect is not a verdict on
+  * the candidate. Policy, never identity, exactly like usageByModel.
+  */
+  hostRejected?: boolean;
+  /**
   * Terminal escalated entries ONLY: the schema-validated
   * EscalationReport with runtime-filled costToDate and salvage; replay
   * synthesizes the byte-identical report from here (DEF-1).
@@ -2599,6 +2609,15 @@ type AgentEvents = {
   */
   retryCount?: number;
   /**
+  * Present and true when the invocation was aborted by the host's
+  * finish rejection (RV3702): the declared finish contract
+  * rejected the candidate past its repair bound. Journaled on the
+  * terminal agent entry (unlike retryCount), so a replayed
+  * agent:end carries it too and both surfaces of the RV3404 cut
+  * read the same count.
+  */
+  hostRejected?: boolean;
+  /**
   * The exploration guard counters (RV-210). Present live whenever
   * any exploration guard limit was configured for the invocation;
   * on replay present only when the guard abort journaled it in the
@@ -3826,6 +3845,8 @@ interface TerminalPatch {
     used: number;
     cap?: number;
   };
+  /** Terminal agent entries: the host finish rejection stamp (RV3702); see JournalEntry. */
+  hostRejected?: boolean;
   /** Terminal escalated entries: the validated EscalationReport. */
   escalation?: unknown;
   /**
@@ -6428,6 +6449,8 @@ interface BudgetAccountView {
   finalizeReserveUsd: number;
   /** The synthesis payload hold (cycle 76); zero when none is committed. */
   synthesisReserveUsd: number;
+  /** The repair round's verdict hold (RV3701); zero when none is committed. */
+  convergenceReserveUsd: number;
   parentScope?: string;
 }
 /**
@@ -6727,6 +6750,28 @@ declare class RunBudget {
   commitSynthesisReserve(scope: string, reserveUsd: number): void;
   /** The synthesis dispatch consumes its reserve; see commitSynthesisReserve. */
   releaseSynthesisReserve(scope: string): void;
+  /**
+  * Registers the repair round's verdict reserve (RV3701, the third
+  * comparison experiment's arc): absolute dollars held on the
+  * orchestrator account AND the run root for the verdict pass (the
+  * round's second judge invocation) that must follow a DISPATCHED
+  * claim repair round. The third comparison run
+  * proved the round's two invocation tail is only as convergent as
+  * the money left when the candidate materializes; with the verdict
+  * money held from the moment the round is admitted, the round's own
+  * repair turns (the layer-2b clamp prices output from a remainder
+  * this hold shrinks) and any concurrent admission (the hold joins
+  * the projected admission sum) cannot eat it, so a round the budget
+  * can only START is refused before any wire call instead of being
+  * paid for and left unjudgeable. Exactly the synthesis reserve
+  * mechanics: released to the invocation it was held FOR (the
+  * verdict pass dispatch), never joined to the severing check.
+  * Idempotent per account: registering again adjusts the root by the
+  * delta.
+  */
+  commitConvergenceReserve(scope: string, reserveUsd: number): void;
+  /** The verdict pass dispatch consumes its reserve; see commitConvergenceReserve. */
+  releaseConvergenceReserve(scope: string): void;
   /** The reserve is replaced by real spend when the spawn settles. */
   releaseReserve(reserveUsd: number, accountScope?: string): void;
   /**
@@ -13641,6 +13686,15 @@ interface JournaledCriticalPath {
   */
   lastCandidateMs?: number;
   /**
+  * Settled agent spans whose invocation was aborted by the host's
+  * finish rejection (RV3702): the journaled `hostRejected` stamps
+  * counted. Unconditional (the stamp is self contained: no label, no
+  * segment condition) and zero when none, exactly the live reading
+  * of the same run: the layer split (wires fine, document refused by
+  * host) stays readable years after the process exited.
+  */
+  hostRejectedSpans: number;
+  /**
   * The window itemization a journal CAN answer (RV3404); present
   * exactly when `postFanInMs` is.
   */
@@ -13925,6 +13979,28 @@ interface PinnedPricingSegment {
   pricingVersion?: string;
   /** The applied rows THIS settle pinned. */
   rows: AppliedPricingRow[];
+  /**
+  * sha256 over the canonical JSON of THIS pin's rows (RV3703): the
+  * version string is a label the table author chose, and the third
+  * experiment's arc found a price defect that a label cannot expose;
+  * the hash is the content. Two tables sharing a version string but
+  * disagreeing on rates are distinguishable, and two folds of one
+  * journal always derive the same hex. Computed at read time from
+  * the pinned bytes: the journal is unchanged and every existing pin
+  * gains it.
+  */
+  rowsHash: string;
+  /**
+  * The freshness range of THIS pin's dated rows (RV3703): the oldest
+  * and newest `ratesVerifiedAt` among rows carrying a parsable one,
+  * the machine-readable age of the table that priced the segment.
+  * Absent when no row is dated: freshness is then unattested, never
+  * guessed.
+  */
+  ratesVerifiedAt?: {
+    oldest: string;
+    newest: string;
+  };
 }
 /** What `journalPricingSnapshot` rebuilds from a pinned run settle. */
 interface JournalPricingSnapshot {
@@ -13932,6 +14008,16 @@ interface JournalPricingSnapshot {
   pricingVersion?: string;
   /** The last pin's rows: the union covering the whole settled journal. */
   rows: AppliedPricingRow[];
+  /** The last pin's content hash (RV3703); see PinnedPricingSegment.rowsHash. */
+  rowsHash: string;
+  /**
+  * The last pin's freshness range (RV3703); see the per-segment
+  * field. Absent when no row of the last pin is dated.
+  */
+  ratesVerifiedAt?: {
+    oldest: string;
+    newest: string;
+  };
   /**
   * The seq of the last pinning settle: rows at or past it belong to a
   * segment no pin covers yet, so a caller composing with a live table
@@ -14738,7 +14824,13 @@ interface PreflightOrchestratorSpec {
     * before the first wire, not the journal after the last. Pairings
     * orchestrate() refuses at intake (repair at the draft stage,
     * repair without a synthesis, carry at the final stage, RV3301)
-    * surface as error findings: the run would refuse to start.
+    * surface as error findings: the run would refuse to start. This
+    * static arithmetic has a runtime twin (RV3701): at the moment a
+    * round actually dispatches, the engine holds the money of the round's second judge pass
+    * (this same `judge.estCost` first, else the run's own observed
+    * post draft judge price) until that pass admits, so the
+    * declared estimate is not only judged before the run but enforced
+    * inside it.
     */
     onFound?: "report" | "carry" | "fail" | "repair";
     /**
@@ -15559,6 +15651,14 @@ interface AgentInvocationRow {
   replayed: boolean;
   /** True when the span's agent:end never arrived. */
   open: boolean;
+  /**
+  * Present and true when the invocation was aborted by the host's
+  * finish rejection (RV3702): the declared finish contract rejected
+  * the candidate past its repair bound, so the span died by host
+  * hand with its wires fine. From the agent:end stamp; absent
+  * everywhere else.
+  */
+  hostRejected?: boolean;
   phases: PhaseRow[];
 }
 /** The reduced table plus the per-role aggregate across every span. */
@@ -15669,6 +15769,15 @@ interface CriticalPath {
   synthesisShare?: number;
   /** Settled non-coordination agent spans that anchored the fan-in. */
   workerSpans: number;
+  /**
+  * Settled spans whose invocation was aborted by the host's finish
+  * rejection (RV3702): the `hostRejected` stamps counted. The count
+  * is unconditional (the stamp is self contained, no labelling
+  * condition applies) and zero when none: on the third comparison
+  * run's shape it reads 1, the round's composition, telling the host
+  * rejection apart from a provider death at the cut level.
+  */
+  hostRejectedSpans: number;
   /** The RV710 decomposition of the window; present with postFanInMs. */
   postFanIn?: PostFanInBreakdown;
 }

package/dist/index.js

@@ -7972,6 +7972,7 @@ var Replayer = class {
 			if (patch.evidence !== void 0) entry.evidence = patch.evidence;
 			if (patch.evidenceEntries !== void 0) entry.evidenceEntries = patch.evidenceEntries;
 			if (patch.toolBudget !== void 0) entry.toolBudget = patch.toolBudget;
+			if (patch.hostRejected !== void 0) entry.hostRejected = patch.hostRejected;
 			if (patch.artifacts !== void 0) entry.artifacts = toJournalValue(patch.artifacts, "terminal artifacts");
 			if (patch.escalation !== void 0) entry.escalation = toJournalValue(patch.escalation, "escalation report");
 			if (patch.memoizeOutcome !== void 0) entry.memoizeOutcome = patch.memoizeOutcome;
@@ -9311,6 +9312,7 @@ function reduceInvocationTable(events) {
 			row.usageApprox = event.usageApprox === true;
 			row.retryCount = event.retryCount ?? 0;
 			if (event.toolBudget !== void 0) row.toolBudget = event.toolBudget;
+			if (event.hostRejected === true) row.hostRejected = true;
 			totalCostUsd += event.costUsd;
 			break;
 		}
@@ -9331,6 +9333,20 @@ function reduceInvocationTable(events) {
 */
 const CLAIM_JUDGE_LABEL = "claim-consistency-judge";
 /**
+* The live abort reason of a finish rejection (RV3702): the value
+* `orchestrate()` aborts a composition invocation's signal with when
+* the declared finish contract rejects its candidate past the repair
+* bound, and ONLY then; a defective (throwing) validator aborts with
+* its own distinct reason, because a host defect is not a verdict on
+* the candidate. The settle layer reads the reason back and stamps
+* `hostRejected` onto the terminal agent entry and the live
+* `agent:end` event, so both span surfaces can tell a host rejection
+* (wires fine, document refused) from a provider failure without a
+* journal dig; the third comparison run's reader had exactly that
+* span (two successful wires, span cancelled) and nothing to name it.
+*/
+const FINISH_REJECTION_ABORT_REASON = "rulvar:finish-validation";
+/**
 * Whether a synthesize span's label names a claim-consistency judge
 * invocation: the exact {@link CLAIM_JUDGE_LABEL}, or a suffixed
 * variant of it (the final pass dispatches under
@@ -9413,6 +9429,7 @@ function reduceCriticalPath(events) {
 	let finalJudgeMs = 0;
 	let compositionSpans = 0;
 	let judgeSpans = 0;
+	let hostRejectedSpans = 0;
 	let firstCompositionEnd;
 	let lastCompositionEnd;
 	const coordinationModel = [];
@@ -9453,6 +9470,7 @@ function reduceCriticalPath(events) {
 			case "agent:end": {
 				const started = startBySpan.get(event.spanId);
 				if (started === void 0) break;
+				if (event.hostRejected === true) hostRejectedSpans += 1;
 				if (started.role === "synthesize") {
 					const wall = Math.max(0, at - started.at);
 					const stage = claimJudgeStageOf(started.label);
@@ -9491,7 +9509,8 @@ function reduceCriticalPath(events) {
 		finalJudgeMs,
 		compositionSpans,
 		judgeSpans,
-		workerSpans
+		workerSpans,
+		hostRejectedSpans
 	};
 	if (runStart !== void 0 && runEnd !== void 0) path.runWallMs = Math.max(0, runEnd - runStart);
 	if (runStart !== void 0 && firstCompositionEnd !== void 0) path.firstCandidateMs = Math.max(0, firstCompositionEnd - runStart);
@@ -9583,6 +9602,7 @@ function criticalPathFromJournal(entries) {
 	let lastWorkerEnd;
 	let workerSpans = 0;
 	let unclassifiedSpans = 0;
+	let hostRejectedSpans = 0;
 	let synthesisMs = 0;
 	let finalCompositionMs = 0;
 	let semanticJudgeMs = 0;
@@ -9602,6 +9622,7 @@ function criticalPathFromJournal(entries) {
 		const last = endedAt ?? startedAt;
 		if (last !== void 0) runEnd = runEnd === void 0 ? last : Math.max(runEnd, last);
 		if (entry.kind !== "agent" || entry.status === "running" || entry.status === "suspended") continue;
+		if (entry.hostRejected === true) hostRejectedSpans += 1;
 		const role = entry.costAttribution?.role;
 		if (role === void 0) {
 			unclassifiedSpans += 1;
@@ -9649,7 +9670,8 @@ function criticalPathFromJournal(entries) {
 		workerSpans,
 		synthesisMs,
 		unclassifiedSpans,
-		segments
+		segments,
+		hostRejectedSpans
 	};
 	const splitLegible = labelledSynthesis && !unlabelledSynthesis;
 	if (splitLegible) {
@@ -14875,6 +14897,7 @@ var RunBudget = class {
 			committedReserveUsd: 0,
 			finalizeReserveUsd: 0,
 			synthesisReserveUsd: 0,
+			convergenceReserveUsd: 0,
 			controller: new AbortController()
 		};
 		if (options.ceilingUsd !== void 0) root.ceilingUsd = options.ceilingUsd;
@@ -14925,6 +14948,7 @@ var RunBudget = class {
 			committedReserveUsd: 0,
 			finalizeReserveUsd: options.finalizeReserveUsd ?? 0,
 			synthesisReserveUsd: 0,
+			convergenceReserveUsd: 0,
 			parentScope,
 			controller: new AbortController()
 		};
@@ -15025,7 +15049,8 @@ var RunBudget = class {
 			spentUsd: account.spentUsd,
 			committedReserveUsd: account.committedReserveUsd,
 			finalizeReserveUsd: account.finalizeReserveUsd,
-			synthesisReserveUsd: account.synthesisReserveUsd
+			synthesisReserveUsd: account.synthesisReserveUsd,
+			convergenceReserveUsd: account.convergenceReserveUsd
 		};
 		if (account.ceilingUsd !== void 0) view.ceilingUsd = account.ceilingUsd;
 		if (account.parentScope !== void 0) view.parentScope = account.parentScope;
@@ -15039,7 +15064,7 @@ var RunBudget = class {
 	remainderOf(scope) {
 		const account = this.accounts.get(scope);
 		if (account?.ceilingUsd === void 0) return;
-		return Math.max(0, account.ceilingUsd - account.spentUsd - account.committedReserveUsd - account.finalizeReserveUsd - account.synthesisReserveUsd);
+		return Math.max(0, account.ceilingUsd - account.spentUsd - account.committedReserveUsd - account.finalizeReserveUsd - account.synthesisReserveUsd - account.convergenceReserveUsd);
 	}
 	/**
 	* The tightest allowance headroom on the chain of `scope`: the minimum
@@ -15119,15 +15144,16 @@ var RunBudget = class {
 		}
 		for (const account of this.chainOf(accountScope)) {
 			if (account.ceilingUsd === void 0) continue;
-			const committed = account.spentUsd + account.committedReserveUsd + account.finalizeReserveUsd + account.synthesisReserveUsd;
+			const committed = account.spentUsd + account.committedReserveUsd + account.finalizeReserveUsd + account.synthesisReserveUsd + account.convergenceReserveUsd;
 			if (committed >= account.ceilingUsd || committed + reserveUsd > account.ceilingUsd) {
 				if (account.scope === "run") this.exhaustedInternal = true;
-				throw new BudgetExhaustedError(`budget ceiling reached on account '${account.scope}': spent ${account.spentUsd.toFixed(4)} USD plus committed reserves ${(account.committedReserveUsd + account.finalizeReserveUsd).toFixed(4)} USD ` + (account.synthesisReserveUsd > 0 ? `plus the held synthesis reserve ${account.synthesisReserveUsd.toFixed(4)} USD ` : "") + `plus the proposed reserve ${reserveUsd.toFixed(4)} USD does not fit the ceiling ${account.ceilingUsd.toFixed(4)} USD`, { data: {
+				throw new BudgetExhaustedError(`budget ceiling reached on account '${account.scope}': spent ${account.spentUsd.toFixed(4)} USD plus committed reserves ${(account.committedReserveUsd + account.finalizeReserveUsd).toFixed(4)} USD ` + (account.synthesisReserveUsd > 0 ? `plus the held synthesis reserve ${account.synthesisReserveUsd.toFixed(4)} USD ` : "") + (account.convergenceReserveUsd > 0 ? `plus the held convergence reserve ${account.convergenceReserveUsd.toFixed(4)} USD ` : "") + `plus the proposed reserve ${reserveUsd.toFixed(4)} USD does not fit the ceiling ${account.ceilingUsd.toFixed(4)} USD`, { data: {
 					account: account.scope,
 					spentUsd: account.spentUsd,
 					committedReserveUsd: account.committedReserveUsd,
 					finalizeReserveUsd: account.finalizeReserveUsd,
 					synthesisReserveUsd: account.synthesisReserveUsd,
+					convergenceReserveUsd: account.convergenceReserveUsd,
 					proposedReserveUsd: reserveUsd,
 					ceilingUsd: account.ceilingUsd
 				} });
@@ -15219,6 +15245,41 @@ var RunBudget = class {
 		account.synthesisReserveUsd = 0;
 		this.emitUpdate();
 	}
+	/**
+	* Registers the repair round's verdict reserve (RV3701, the third
+	* comparison experiment's arc): absolute dollars held on the
+	* orchestrator account AND the run root for the verdict pass (the
+	* round's second judge invocation) that must follow a DISPATCHED
+	* claim repair round. The third comparison run
+	* proved the round's two invocation tail is only as convergent as
+	* the money left when the candidate materializes; with the verdict
+	* money held from the moment the round is admitted, the round's own
+	* repair turns (the layer-2b clamp prices output from a remainder
+	* this hold shrinks) and any concurrent admission (the hold joins
+	* the projected admission sum) cannot eat it, so a round the budget
+	* can only START is refused before any wire call instead of being
+	* paid for and left unjudgeable. Exactly the synthesis reserve
+	* mechanics: released to the invocation it was held FOR (the
+	* verdict pass dispatch), never joined to the severing check.
+	* Idempotent per account: registering again adjusts the root by the
+	* delta.
+	*/
+	commitConvergenceReserve(scope, reserveUsd) {
+		const account = this.accounts.get(scope);
+		if (account === void 0) throw new ConfigError(`unknown budget account '${scope}' for the convergence reserve`);
+		const previous = account.convergenceReserveUsd;
+		account.convergenceReserveUsd = reserveUsd;
+		if (account.scope !== "run") this.root.convergenceReserveUsd = Math.max(0, this.root.convergenceReserveUsd + reserveUsd - previous);
+		this.emitUpdate();
+	}
+	/** The verdict pass dispatch consumes its reserve; see commitConvergenceReserve. */
+	releaseConvergenceReserve(scope) {
+		const account = this.accounts.get(scope);
+		if (account === void 0 || account.convergenceReserveUsd === 0) return;
+		if (account.scope !== "run") this.root.convergenceReserveUsd = Math.max(0, this.root.convergenceReserveUsd - account.convergenceReserveUsd);
+		account.convergenceReserveUsd = 0;
+		this.emitUpdate();
+	}
 	/** The reserve is replaced by real spend when the spawn settles. */
 	releaseReserve(reserveUsd, accountScope = "run") {
 		for (const account of this.chainOf(accountScope)) account.committedReserveUsd = Math.max(0, account.committedReserveUsd - reserveUsd);
@@ -15426,7 +15487,7 @@ var RunBudget = class {
 		let remaining;
 		for (const account of this.chainOf(accountScope)) {
 			if (account.ceilingUsd === void 0) continue;
-			const headroom = account.ceilingUsd - account.spentUsd - account.synthesisReserveUsd;
+			const headroom = account.ceilingUsd - account.spentUsd - account.synthesisReserveUsd - account.convergenceReserveUsd;
 			remaining = remaining === void 0 ? headroom : Math.min(remaining, headroom);
 		}
 		return remaining === void 0 ? void 0 : Math.max(0, remaining);
@@ -16865,6 +16926,33 @@ function persistedTerminalEnvelope(input) {
 //#endregion
 //#region src/engine/pricing-snapshot.ts
 /**
+* The applied-pricing snapshot (RV407, the eighth-experiment review).
+* `invoiceFromJournal` and `costReportFromJournal` price at fold time
+* from the table the caller passes, so a live price-table update used
+* to silently re-price HISTORY: the same journal folded to different
+* invoices before and after the change. When `createEngine({ pricing })`
+* is configured, the settling segment now pins what it actually
+* applied: the resolved pricing row of every model the journal used
+* (table rows plus the caps-fallback rows of models the table misses),
+* and the table's version, additively inside the existing run-settle
+* decision value (the `outputHash` precedent; no journal shape change).
+* The gate is deliberate: caps-fallback pricing arrives ambiently from
+* adapters, and a setting the user never enabled must not change the
+* journal, so table-less runs settle byte for byte as before.
+* `journalPricingSnapshot` reads the pin back and
+* rebuilds a `priceUsd` from the pinned rows, so a repeated fold after
+* the live table changed reproduces the original numbers exactly.
+*
+* The snapshot governs REPORTING folds (the CLI invoice and inspect
+* cost views, and any host that opts in by passing the rebuilt
+* priceUsd; since RV611 those consumers pass `composedPriceUsd`, the
+* same pin-plus-current-table composition the engine's outcome mirror
+* applies, so a stored fold and the settled outcome can never
+* disagree). The engine's own live pricing, budget admission, and the
+* journaled spend debits are untouched: they were always priced at
+* write time and never re-priced by a fold.
+*/
+/**
 * A pinnable row: every present rate is a finite non-negative number.
 * The fold already treats a broken rate as unpriced (a NaN or negative
 * price never poisons the CostReport), so the pin mirrors exactly that
@@ -16902,6 +16990,42 @@ function snapshotJournalPricing(entries, pricingOf) {
 	}
 	return rows.length === 0 ? void 0 : rows;
 }
+/**
+* The pin's content hash (RV3703): sha256 over the canonical JSON of
+* the rows, so the derivation is byte-stable across folds, engines and
+* platforms; JCS fixes the key order, and the row order is the pin's
+* own (sorted at write, preserved at read).
+*/
+function rowsHashOf(rows) {
+	return createHash("sha256").update(jcsSerialize(rows), "utf8").digest("hex");
+}
+/**
+* The freshness range of a pin's dated rows (RV3703): oldest and
+* newest parsable `ratesVerifiedAt`, original strings preserved.
+* Undefined when no row carries a parsable date.
+*/
+function ratesVerifiedRangeOf(rows) {
+	let oldest;
+	let newest;
+	for (const row of rows) {
+		const raw = row.rates.ratesVerifiedAt;
+		if (raw === void 0) continue;
+		const at = Date.parse(raw);
+		if (!Number.isFinite(at)) continue;
+		if (oldest === void 0 || at < oldest.at) oldest = {
+			at,
+			raw
+		};
+		if (newest === void 0 || at > newest.at) newest = {
+			at,
+			raw
+		};
+	}
+	return oldest === void 0 || newest === void 0 ? void 0 : {
+		oldest: oldest.raw,
+		newest: newest.raw
+	};
+}
 function pinnedRows(value) {
 	const candidate = value?.pricing;
 	if (!Array.isArray(candidate) || candidate.length === 0) return;
@@ -16953,16 +17077,24 @@ function journalPricingSnapshot(entries) {
 		const rates = ratesFor(servedBy, seq);
 		return rates === void 0 ? void 0 : priceUsdOf(rates, usage);
 	};
+	const lastRange = ratesVerifiedRangeOf(last.rows);
 	return {
 		...last.pricingVersion === void 0 ? {} : { pricingVersion: last.pricingVersion },
 		rows: last.rows,
+		rowsHash: rowsHashOf(last.rows),
+		...lastRange === void 0 ? {} : { ratesVerifiedAt: lastRange },
 		pinnedThroughSeq,
-		segments: pins.map((pin, index) => ({
-			fromSeq: index === 0 ? 0 : pins[index - 1]?.seq ?? 0,
-			settleSeq: pin.seq,
-			...pin.pricingVersion === void 0 ? {} : { pricingVersion: pin.pricingVersion },
-			rows: pin.rows
-		})),
+		segments: pins.map((pin, index) => {
+			const range = ratesVerifiedRangeOf(pin.rows);
+			return {
+				fromSeq: index === 0 ? 0 : pins[index - 1]?.seq ?? 0,
+				settleSeq: pin.seq,
+				...pin.pricingVersion === void 0 ? {} : { pricingVersion: pin.pricingVersion },
+				rows: pin.rows,
+				rowsHash: rowsHashOf(pin.rows),
+				...range === void 0 ? {} : { ratesVerifiedAt: range }
+			};
+		}),
 		priceUsd,
 		composedPriceUsd: (current) => (servedBy, usage, seq) => seq !== void 0 && seq < pinnedThroughSeq ? priceUsd(servedBy, usage, seq) ?? current(servedBy, usage) : current(servedBy, usage)
 	};
@@ -18810,6 +18942,7 @@ function createCtx(internals, rootWorkflow) {
 				costBasis: replayBasis,
 				entryRef: terminal?.seq ?? matched.running.seq,
 				...terminal?.usageApprox === true ? { usageApprox: true } : {},
+				...terminal?.hostRejected === true ? { hostRejected: true } : {},
 				...result.exploration === void 0 ? {} : { exploration: result.exploration },
 				...result.toolBudget === void 0 ? {} : { toolBudget: result.toolBudget }
 			}, spanId, true);
@@ -19538,6 +19671,8 @@ function createCtx(internals, rootWorkflow) {
 				}
 			};
 		}
+		const settleSignal = state.signal ?? internals.runSignal;
+		if (result.status !== "ok" && settleSignal?.aborted === true && settleSignal.reason === "rulvar:finish-validation") terminalPatch.hostRejected = true;
 		if (checkpointWritten) terminalPatch.checkpointRef = ckptRef;
 		const terminal = await internals.replayer.appendTerminal(running.seq, terminalPatch);
 		internals.events.emit({
@@ -19551,6 +19686,7 @@ function createCtx(internals, rootWorkflow) {
 			entryRef: terminal.seq,
 			...resultUsageApprox ? { usageApprox: true } : {},
 			...result.transportRetries !== void 0 && result.transportRetries > 0 ? { retryCount: result.transportRetries } : {},
+			...terminalPatch.hostRejected === true ? { hostRejected: true } : {},
 			...result.quotaDenials === void 0 ? {} : { quotaDenials: result.quotaDenials },
 			...result.exploration === void 0 ? {} : { exploration: result.exploration },
 			...result.toolBudget === void 0 ? {} : { toolBudget: result.toolBudget }
@@ -24326,7 +24462,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 						verdict = validator.validate(input);
 					} catch (thrown) {
 						validationTermination = new ConfigError(`finish validator '${validator.name}' threw instead of returning a verdict: ` + (thrown instanceof Error ? thrown.message : String(thrown)));
-						validationAbort.abort("rulvar:finish-validation");
+						validationAbort.abort("rulvar:finish-validation-defect");
 						return {
 							ok: false,
 							feedback: { error: `finish validator '${validator.name}' is defective; the run fails` }
@@ -24389,7 +24525,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			if (decision.verdict === "rejected") {
 				if (contractGenerationCurrent(decision)) {
 					validationTermination = finishValidationError(decision);
-					validationAbort.abort("rulvar:finish-validation");
+					validationAbort.abort(FINISH_REJECTION_ABORT_REASON);
 				}
 				return {
 					ok: false,
@@ -24924,6 +25060,15 @@ function makeOrchestratorWorkflow(goal, opts) {
 		* not settle ok, because an empty list would claim the pool agreed.
 		*/
 		let claimFindingsFound;
+		/**
+		* The observed price of this run's own latest post draft claim
+		* judge pass (RV3701): the fallback sizing of the repair round's
+		* convergence hold when the host declared no `judge.estCost`. By
+		* the time the bounded round can dispatch, a post draft pass has
+		* always settled (the round's findings came from it), so the
+		* fallback is this run's own money, never an invented constant.
+		*/
+		let observedFinalJudgeCostUsd;
 		/** Set whenever the pass ran, findings or not (the RV1404 pairing). */
 		let claimConsistencyMeta;
 		/**
@@ -25208,6 +25353,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			try {
 				judged = await runtime.runInScope(judgeState, () => ctx.agent(judgePrompt, judgeOpts));
 				noteInternalSettle(judged);
+				if (stage !== "draft" && typeof judged.costUsd === "number") observedFinalJudgeCostUsd = judged.costUsd;
 			} catch (declined) {
 				if (!(declined instanceof BudgetExhaustedError)) throw declined;
 				claimConsistencyMeta = finishMeta({
@@ -26391,6 +26537,9 @@ function makeOrchestratorWorkflow(goal, opts) {
 				const hashOfDocument = (value) => createHash("sha256").update(jcsSerialize(value ?? null), "utf8").digest("hex");
 				const preRepairHash = hashOfDocument(synthesizedFinal);
 				const carried = claimFindingsFound;
+				const convergenceHoldUsd = opts?.claimConsistency?.judge?.estCost ?? observedFinalJudgeCostUsd ?? 0;
+				const convergenceScope = orchestratorAccount ?? "run";
+				if (convergenceHoldUsd > 0) internals.budget.commitConvergenceReserve(convergenceScope, convergenceHoldUsd);
 				try {
 					synthesizedFinal = await runSynthesis(result.output);
 				} catch (thrown) {
@@ -26422,8 +26571,21 @@ function makeOrchestratorWorkflow(goal, opts) {
 						preRepairHash,
 						...acceptanceSnapshot
 					} });
+				} finally {
+					if (convergenceHoldUsd > 0) internals.budget.releaseConvergenceReserve(convergenceScope);
+				}
+				try {
+					await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+				} catch (thrown) {
+					if (thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) && thrown.data.source === "orchestrator_claim_consistency") throw new FailRunError(thrown.message, { data: {
+						...thrown.data,
+						...thrown.data.claimContradictions === void 0 ? { claimContradictions: carried } : {},
+						roundDispatched: true,
+						repairsUsed: 1,
+						preRepairHash
+					} });
+					throw thrown;
 				}
-				await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
 				if (claimFindingsFound !== void 0 && claimFindingsFound.length > 0) throw new FailRunError(`the claim-consistency judge still found ${String(claimFindingsFound.length)} contradiction${claimFindingsFound.length === 1 ? "" : "s"} after the bounded repair round: the repaired composition keeps contradicting the settled pool`, { data: {
 					source: "orchestrator_claim_consistency",
 					claimContradictions: claimFindingsFound,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.241.0",
+  "version": "1.242.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",