@rulvar/core 1.242.0 → 1.244.0

package/dist/index.js

@@ -1310,6 +1310,146 @@ function sanitizeTerminalText(text) {
 	return text.replace(ESC_STRING_SEQUENCE, "").replace(ESC_CSI_SEQUENCE, "").replace(CONTROL_RUN, " ");
 }
 //#endregion
+//#region src/l0/terminal-envelope.ts
+/**
+* The unified terminal envelope (RV1105, the P1-5 arc): ONE shape
+* carrying every fact of a run's terminal, assembled once at the
+* engine's settlement chokepoint and mirrored verbatim onto the
+* resolved outcome (`outcome.envelope`), the `run:end` event
+* (`event.envelope`), and through them the HTTP outcome response and
+* the OTel run attributes. An SDK consumer, an event-only consumer,
+* and an HTTP consumer read the SAME set of facts without assembling
+* pieces from surface-specific fields; nothing pre-existing was
+* renamed or removed, the envelope is an assembly over it.
+*
+* Doctrine notes:
+* - `status` is the computation's verdict; `settled` says whether
+*   anything durable records it (RV907). A resolved outcome always
+*   carries `settled: true`, because an unsettled terminal REJECTS
+*   `handle.result` typed instead of resolving; the `settled: false`
+*   envelopes exist only on the event stream, where `settledReason:
+*   'superseded'` distinguishes the fenced-out segment (RV1009) from
+*   a settlement write fault.
+* - `usageApprox` is normalized to a boolean here (the run:end field
+*   keeps its absent-means-exact byte contract): `true` means some
+*   priced usage was approximate, so `totalUsd` is a lower bound.
+* - `costByModel` is a detached copy of the settled fold's per-model
+*   split; mutating it never touches the cost report. Since RV1213
+*   `error` is detached the same way, `data` nesting included, so the
+*   whole envelope is a reading a consumer may annotate freely.
+*
+* Docs: https://docs.rulvar.com/guide/observability
+*/
+const ENVELOPE_STATUSES = /* @__PURE__ */ new Set([
+	"ok",
+	"error",
+	"cancelled",
+	"exhausted",
+	"suspended"
+]);
+const ENVELOPE_COMPLETIONS = /* @__PURE__ */ new Set([
+	"complete",
+	"partial",
+	"rejected"
+]);
+function refuseEnvelope(field, requirement, got) {
+	throw new ConfigError(`terminal envelope ${field} must be ${requirement}; got ${typeof got === "number" ? String(got) : JSON.stringify(got) ?? String(got)}`);
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireMoney(value, field) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) refuseEnvelope(field, "a finite nonnegative number", value);
+	return value;
+}
+function requireCount$1(value, field) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) refuseEnvelope(field, "a nonnegative integer", value);
+}
+function requireBoolean(value, field) {
+	if (typeof value !== "boolean") refuseEnvelope(field, "a boolean", value);
+}
+function requireNonEmptyString(value, field) {
+	if (typeof value !== "string" || value.length === 0) refuseEnvelope(field, "a non-empty string", value);
+}
+/** Every numeric leaf of the usage subtree: finite and nonnegative. */
+function requireUsageNumbers(node, path) {
+	if (typeof node === "number") {
+		if (!Number.isFinite(node) || node < 0) refuseEnvelope(path, "a finite nonnegative number", node);
+		return;
+	}
+	if (isPlainObject(node)) {
+		for (const [key, item] of Object.entries(node)) requireUsageNumbers(item, `${path}.${key}`);
+		return;
+	}
+	refuseEnvelope(path, "a number or a nested usage object", node);
+}
+/**
+* The runtime gate over the terminal envelope contract (RV3903, the
+* fourth comparison experiment). `terminalEnvelopeOf` is the ONE
+* producer, but a producer is a compile-time promise, and the envelope
+* crosses trust boundaries the type system never sees: a journal read
+* back after a restart, a plain JS caller, an HTTP body a pipeline
+* gates on. The experiment probed the built dist and the typed copy
+* accepted `status: 'green'`, NaN dollars, and negative counts without
+* a sound; a finance or compliance consumer downstream would have
+* gated a run on fiction.
+*
+* The gate validates the CONTRACT fields and refuses with a typed
+* {@link ConfigError} naming the field and the defect: enum `status`
+* and `completion`, finite nonnegative money (with `totalUsd <=
+* grossUsd`, gross being net plus abandoned by construction), usage
+* and counters, `settledReason` only beside `settled: false`, the
+* `costBasis` and `provenance` literals, boolean `usageApprox`, and
+* the `WireError` shape when an error rides along. Unknown top-level
+* fields pass through untouched: the contract evolves additively, and
+* a parser that refused tomorrow's field would turn every additive
+* release into a wire break. On success the SAME reference comes back,
+* typed: the gate is a boundary check, never a normalizer.
+*
+* Wired where external bytes actually enter: `persistedTerminalEnvelope`
+* runs every journal-rebuilt envelope through it (and refuses typed as
+* `malformed-envelope`), which also covers the server's persisted
+* serving by construction. The live settlement chokepoint stays
+* unparsed on purpose: it is the one producer inside one process, and
+* gating it would add a throw site to settlement itself.
+*/
+function parseTerminalEnvelope(value) {
+	if (!isPlainObject(value)) refuseEnvelope("value", "an object", value);
+	requireNonEmptyString(value.runId, "runId");
+	requireNonEmptyString(value.workflow, "workflow");
+	if (typeof value.status !== "string" || !ENVELOPE_STATUSES.has(value.status)) refuseEnvelope("status", "one of 'ok' | 'error' | 'cancelled' | 'exhausted' | 'suspended'", value.status);
+	requireBoolean(value.settled, "settled");
+	if (value.settledReason !== void 0) {
+		if (value.settledReason !== "superseded") refuseEnvelope("settledReason", "the literal 'superseded' when present", value.settledReason);
+		if (value.settled !== false) refuseEnvelope("settledReason", "present only beside settled: false (a settled terminal has no supersession to explain)", value.settledReason);
+	}
+	const totalUsd = requireMoney(value.totalUsd, "totalUsd");
+	const grossUsd = requireMoney(value.grossUsd, "grossUsd");
+	if (totalUsd > grossUsd) refuseEnvelope("totalUsd", `at most grossUsd (${String(grossUsd)}): gross is the net fold plus abandoned spend`, totalUsd);
+	if (value.costBasis !== "locally-estimated") refuseEnvelope("costBasis", "the literal 'locally-estimated'", value.costBasis);
+	if (!isPlainObject(value.costByModel)) refuseEnvelope("costByModel", "an object of per-model dollars", value.costByModel);
+	for (const [model, usd] of Object.entries(value.costByModel)) requireMoney(usd, `costByModel['${model}']`);
+	if (value.wireRequests !== void 0) requireCount$1(value.wireRequests, "wireRequests");
+	if (!isPlainObject(value.usage)) refuseEnvelope("usage", "a usage object", value.usage);
+	requireUsageNumbers(value.usage, "usage");
+	requireBoolean(value.usageApprox, "usageApprox");
+	requireCount$1(value.agentsSpawned, "agentsSpawned");
+	if (value.completion !== void 0 && (typeof value.completion !== "string" || !ENVELOPE_COMPLETIONS.has(value.completion))) refuseEnvelope("completion", "one of 'complete' | 'partial' | 'rejected' when present", value.completion);
+	if (value.error !== void 0) {
+		if (!isPlainObject(value.error)) refuseEnvelope("error", "a typed wire error object when present", value.error);
+		requireNonEmptyString(value.error.code, "error.code");
+		if (typeof value.error.message !== "string") refuseEnvelope("error.message", "a string", value.error.message);
+		requireBoolean(value.error.retryable, "error.retryable");
+	}
+	if (value.deliverableAccepted !== void 0) requireBoolean(value.deliverableAccepted, "deliverableAccepted");
+	if (value.resultAvailable !== void 0) requireBoolean(value.resultAvailable, "resultAvailable");
+	if (value.acceptedArtifactRef !== void 0) requireCount$1(value.acceptedArtifactRef, "acceptedArtifactRef");
+	if (value.claimConsistencyMeta !== void 0 && !isPlainObject(value.claimConsistencyMeta)) refuseEnvelope("claimConsistencyMeta", "an object when present", value.claimConsistencyMeta);
+	if (value.configFingerprint !== void 0) requireNonEmptyString(value.configFingerprint, "configFingerprint");
+	if (value.provenance !== void 0 && value.provenance !== "journal") refuseEnvelope("provenance", "the literal 'journal' when present", value.provenance);
+	return value;
+}
+//#endregion
 //#region src/engine/terminal-envelope.ts
 /**
 * A total copy of one typed error (RV1213). `data` is `Json` by the
@@ -6198,8 +6338,12 @@ var LineageIndex = class {
 * exclusively DEBIT-ONLY API and a limits vector frozen at start in the
 * `termination.init` entry, plus the variant function Phi. No credit
 * operation exists anywhere by construction; no journal entry kind
-* carries credit; B0 is immutable after start and no API, including
-* HITL, can top it up. Every debit is atomic with the append of its
+* carries credit; B0 is immutable within a segment and no API,
+* including HITL, tops up a live run (the one explicit door is the
+* journaled ResumeOptions.run override at resume, RV2208, refused
+* outright under budgetPolicy 'immutable-lifetime', RV3902; the
+* frozen vector below keeps the GENESIS ceiling either way). Every
+* debit is atomic with the append of its
 * carrying decision entry and embeds the balance-after; an underflow
 * writes `termination.denied` strictly BEFORE the typed error surfaces.
 *
@@ -6303,8 +6447,9 @@ function readTerminationInit(entry) {
 /**
 * Config-drift detection at resume: the journaled vector
 * always wins; every differing field is reported for the
-* `termination:config-drift` event. Dynamic budget top-up via restart is
-* excluded by construction.
+* `termination:config-drift` event. Ambient config can never top up a
+* budget through a restart; the one explicit, journaled door is
+* ResumeOptions.run (RV2208), which is a decision entry, not a drift.
 */
 function terminationConfigDrift(frozen, live) {
 	const drift = [];
@@ -9878,7 +10023,8 @@ function synthesisCandidatesFromJournal(entries, priceUsd) {
 				name: failure.name,
 				reasons: Array.isArray(failure.reasons) ? failure.reasons.filter((reason) => typeof reason === "string") : []
 			})) : [],
-			...span.label === void 0 ? {} : { spanLabel: span.label }
+			...span.label === void 0 ? {} : { spanLabel: span.label },
+			spanSeq: span.runningSeq
 		};
 		if (boundary.at !== void 0 && verdictAtMs !== void 0) candidate.windowMs = Math.max(0, verdictAtMs - boundary.at);
 		if (attributable.has(span)) {
@@ -9911,6 +10057,29 @@ function synthesisCandidatesFromJournal(entries, priceUsd) {
 		tailWires
 	};
 }
+/**
+* The observed price of the run's LAST mechanical repair turn
+* (RV3802): the window of the candidate that FOLLOWED a 'repair'
+* verdict inside the same settled synthesize span, priced by the same
+* per-call fold every candidate window uses. This is the fallback the
+* repair round's mechanical money leg sizes itself from when the host
+* declared no estimate: by the time the round is admitted the initial
+* composition has settled, so a mechanical repair it performed is a
+* priced window in the journal. Fail closed under RV1209: no such
+* pairing, an unattributed span, or an unpriceable window all return
+* undefined (never a guessed number), and the caller treats undefined
+* as an inert zero-size leg.
+*/
+function lastMechanicalRepairCostUsd(entries, priceUsd) {
+	const { candidates } = synthesisCandidatesFromJournal(entries, priceUsd);
+	let observed;
+	for (let index = 1; index < candidates.length; index += 1) {
+		const previous = candidates[index - 1];
+		const row = candidates[index];
+		if (previous?.verdict === "repair" && row?.spanSeq !== void 0 && row.spanSeq === previous.spanSeq && row.costUsd !== void 0) observed = row.costUsd;
+	}
+	return observed;
+}
 //#endregion
 //#region src/stores/tool-calibration.ts
 /**
@@ -14183,7 +14352,17 @@ async function runAgent(options) {
 			output = outcome.turn.text;
 			break;
 		}
-		if (separateExtract) break;
+		if (separateExtract) {
+			const rideAlong = extractCandidate(outcome.turn, rideTierFor(servedTarget));
+			if (rideAlong !== void 0) {
+				const validation = await validateSchemaSpec(options.schema, rideAlong.raw);
+				if (validation.valid) {
+					output = validation.value;
+					break;
+				}
+			}
+			break;
+		}
 		const candidate = extractCandidate(outcome.turn, rideTierFor(servedTarget));
 		const issues = [];
 		if (candidate !== void 0) {
@@ -14472,7 +14651,7 @@ async function runAgent(options) {
 		}
 		endPhase(finalizePhase, phaseOutcome(), finalizeServed);
 	}
-	if (status === "ok" && !finishedViaTool && separateExtract && options.extract !== void 0 && options.schema !== void 0) {
+	if (status === "ok" && !finishedViaTool && separateExtract && output === null && options.extract !== void 0 && options.schema !== void 0) {
 		const extractResolved = options.extract.resolved;
 		const extractPhase = beginPhase("extract", extractResolved.ref);
 		let extractServed;
@@ -14517,6 +14696,7 @@ async function runAgent(options) {
 							toolChoice: "none"
 						};
 						req = applyStructuredOutputTier(req, targetTier, options.canonicalSchema ?? {});
+						req = applyCachePolicy(req, target, options.cache);
 						return applyOutputBudget(req, target, options.budget);
 					},
 					streamOptionsFor: (target) => {
@@ -14699,7 +14879,10 @@ async function runAgent(options) {
 * false). The one thing that can change it is `ResumeOptions.run`, an
 * explicit host decision journaled as its own decision entry, and it
 * takes effect only by opening a NEW segment: a live run can never
-* raise the bound it is already being measured against.
+* raise the bound it is already being measured against. Under
+* RunOptions.budgetPolicy 'immutable-lifetime' (RV3902) even that door
+* refuses typed before ownership, and the recorded ceilings hold for
+* the run's whole life.
 *
 * The account tree: the run root plus one
 * sub-account per admitted child workflow (and, from M7, the orchestrator
@@ -14797,7 +14980,12 @@ function admissionReserveUsd(options) {
 * spawn-admission decision entries, M6).
 */
 var RunBudget = class {
-	/** B0; immutable after start. Undefined means no USD ceiling. */
+	/**
+	* B0; immutable within a segment (RV2511): only the explicit,
+	* journaled ResumeOptions.run override (RV2208) changes it, by
+	* opening a new segment, and budgetPolicy 'immutable-lifetime'
+	* (RV3902) refuses even that. Undefined means no USD ceiling.
+	*/
 	ceilingUsd;
 	/**
 	* The opt-in in-flight exposure cap (RV711). Undefined means the
@@ -14898,6 +15086,7 @@ var RunBudget = class {
 			finalizeReserveUsd: 0,
 			synthesisReserveUsd: 0,
 			convergenceReserveUsd: 0,
+			repairReserveUsd: 0,
 			controller: new AbortController()
 		};
 		if (options.ceilingUsd !== void 0) root.ceilingUsd = options.ceilingUsd;
@@ -14949,6 +15138,7 @@ var RunBudget = class {
 			finalizeReserveUsd: options.finalizeReserveUsd ?? 0,
 			synthesisReserveUsd: 0,
 			convergenceReserveUsd: 0,
+			repairReserveUsd: 0,
 			parentScope,
 			controller: new AbortController()
 		};
@@ -15050,7 +15240,8 @@ var RunBudget = class {
 			committedReserveUsd: account.committedReserveUsd,
 			finalizeReserveUsd: account.finalizeReserveUsd,
 			synthesisReserveUsd: account.synthesisReserveUsd,
-			convergenceReserveUsd: account.convergenceReserveUsd
+			convergenceReserveUsd: account.convergenceReserveUsd,
+			repairReserveUsd: account.repairReserveUsd
 		};
 		if (account.ceilingUsd !== void 0) view.ceilingUsd = account.ceilingUsd;
 		if (account.parentScope !== void 0) view.parentScope = account.parentScope;
@@ -15064,7 +15255,7 @@ var RunBudget = class {
 	remainderOf(scope) {
 		const account = this.accounts.get(scope);
 		if (account?.ceilingUsd === void 0) return;
-		return Math.max(0, account.ceilingUsd - account.spentUsd - account.committedReserveUsd - account.finalizeReserveUsd - account.synthesisReserveUsd - account.convergenceReserveUsd);
+		return Math.max(0, account.ceilingUsd - account.spentUsd - account.committedReserveUsd - account.finalizeReserveUsd - account.synthesisReserveUsd - account.convergenceReserveUsd - account.repairReserveUsd);
 	}
 	/**
 	* The tightest allowance headroom on the chain of `scope`: the minimum
@@ -15144,16 +15335,17 @@ var RunBudget = class {
 		}
 		for (const account of this.chainOf(accountScope)) {
 			if (account.ceilingUsd === void 0) continue;
-			const committed = account.spentUsd + account.committedReserveUsd + account.finalizeReserveUsd + account.synthesisReserveUsd + account.convergenceReserveUsd;
+			const committed = account.spentUsd + account.committedReserveUsd + account.finalizeReserveUsd + account.synthesisReserveUsd + account.convergenceReserveUsd + account.repairReserveUsd;
 			if (committed >= account.ceilingUsd || committed + reserveUsd > account.ceilingUsd) {
 				if (account.scope === "run") this.exhaustedInternal = true;
-				throw new BudgetExhaustedError(`budget ceiling reached on account '${account.scope}': spent ${account.spentUsd.toFixed(4)} USD plus committed reserves ${(account.committedReserveUsd + account.finalizeReserveUsd).toFixed(4)} USD ` + (account.synthesisReserveUsd > 0 ? `plus the held synthesis reserve ${account.synthesisReserveUsd.toFixed(4)} USD ` : "") + (account.convergenceReserveUsd > 0 ? `plus the held convergence reserve ${account.convergenceReserveUsd.toFixed(4)} USD ` : "") + `plus the proposed reserve ${reserveUsd.toFixed(4)} USD does not fit the ceiling ${account.ceilingUsd.toFixed(4)} USD`, { data: {
+				throw new BudgetExhaustedError(`budget ceiling reached on account '${account.scope}': spent ${account.spentUsd.toFixed(4)} USD plus committed reserves ${(account.committedReserveUsd + account.finalizeReserveUsd).toFixed(4)} USD ` + (account.synthesisReserveUsd > 0 ? `plus the held synthesis reserve ${account.synthesisReserveUsd.toFixed(4)} USD ` : "") + (account.convergenceReserveUsd > 0 ? `plus the held convergence reserve ${account.convergenceReserveUsd.toFixed(4)} USD ` : "") + (account.repairReserveUsd > 0 ? `plus the held repair reserve ${account.repairReserveUsd.toFixed(4)} USD ` : "") + `plus the proposed reserve ${reserveUsd.toFixed(4)} USD does not fit the ceiling ${account.ceilingUsd.toFixed(4)} USD`, { data: {
 					account: account.scope,
 					spentUsd: account.spentUsd,
 					committedReserveUsd: account.committedReserveUsd,
 					finalizeReserveUsd: account.finalizeReserveUsd,
 					synthesisReserveUsd: account.synthesisReserveUsd,
 					convergenceReserveUsd: account.convergenceReserveUsd,
+					repairReserveUsd: account.repairReserveUsd,
 					proposedReserveUsd: reserveUsd,
 					ceilingUsd: account.ceilingUsd
 				} });
@@ -15280,6 +15472,39 @@ var RunBudget = class {
 		account.convergenceReserveUsd = 0;
 		this.emitUpdate();
 	}
+	/**
+	* Registers the repair round's MECHANICAL leg (RV3802), the money
+	* twin of the RV3602 per-invocation pool: the round's finish
+	* contract can grant one bounded mechanical repair turn, and the
+	* third comparison run's round entered exactly that turn's price
+	* short of certainty (the repair existed by pool and by contract,
+	* but nothing guaranteed the money would still be there when the
+	* candidate materialized). Held beside the verdict leg from the
+	* moment the round is admitted; released EARLY, to the round's own
+	* finish loop, at its first journaled verdict (a 'repair' verdict is
+	* about to spend the freed money on the granted turn, an 'accepted'
+	* one never needed it), where the verdict leg lives until the judge
+	* dispatch. Exactly the convergence reserve mechanics otherwise:
+	* joins the projected admission sum and both remainders, named in
+	* the refusal clause, never joined to the severing check, idempotent
+	* per account with the root adjusted by the delta.
+	*/
+	commitRepairReserve(scope, reserveUsd) {
+		const account = this.accounts.get(scope);
+		if (account === void 0) throw new ConfigError(`unknown budget account '${scope}' for the repair reserve`);
+		const previous = account.repairReserveUsd;
+		account.repairReserveUsd = reserveUsd;
+		if (account.scope !== "run") this.root.repairReserveUsd = Math.max(0, this.root.repairReserveUsd + reserveUsd - previous);
+		this.emitUpdate();
+	}
+	/** The round's finish loop consumes its leg; see commitRepairReserve. */
+	releaseRepairReserve(scope) {
+		const account = this.accounts.get(scope);
+		if (account === void 0 || account.repairReserveUsd === 0) return;
+		if (account.scope !== "run") this.root.repairReserveUsd = Math.max(0, this.root.repairReserveUsd - account.repairReserveUsd);
+		account.repairReserveUsd = 0;
+		this.emitUpdate();
+	}
 	/** The reserve is replaced by real spend when the spawn settles. */
 	releaseReserve(reserveUsd, accountScope = "run") {
 		for (const account of this.chainOf(accountScope)) account.committedReserveUsd = Math.max(0, account.committedReserveUsd - reserveUsd);
@@ -15487,7 +15712,7 @@ var RunBudget = class {
 		let remaining;
 		for (const account of this.chainOf(accountScope)) {
 			if (account.ceilingUsd === void 0) continue;
-			const headroom = account.ceilingUsd - account.spentUsd - account.synthesisReserveUsd - account.convergenceReserveUsd;
+			const headroom = account.ceilingUsd - account.spentUsd - account.synthesisReserveUsd - account.convergenceReserveUsd - account.repairReserveUsd;
 			remaining = remaining === void 0 ? headroom : Math.min(remaining, headroom);
 		}
 		return remaining === void 0 ? void 0 : Math.max(0, remaining);
@@ -15730,6 +15955,27 @@ function foldBuckets(source) {
 	return folded;
 }
 /**
+* The scope key rule of the byScope rollup (RV3805). The root's OWN
+* scope is the empty string BY CONSTRUCTION: present data whose string
+* happens to be empty, not an absence, so it folds under the
+* addressable name 'root' instead of the RV3604 'unknown' fallback,
+* which stays reserved for a scope that is truly missing. Children
+* keep their scope strings verbatim. One rule for both builders, so
+* the live report and the journal fold cannot disagree on the key.
+*/
+function scopeBucket(scope) {
+	return scope === void 0 ? "unknown" : scope === "" ? "root" : scope;
+}
+/** {@link scopeBucket} over a whole live map, merging folded keys. */
+function foldScopeBuckets(source) {
+	const folded = {};
+	for (const [key, usd] of source) {
+		const bucket = scopeBucket(key);
+		folded[bucket] = (folded[bucket] ?? 0) + usd;
+	}
+	return folded;
+}
+/**
 * Folds the per-run attribution buckets into the normative CostReport.
 * Live attribution buckets never see abandoned subtrees, so a host
 * that tracked abandoned spend itself passes it as `abandoned`;
@@ -15760,6 +16006,7 @@ function buildCostReport(attribution, totalUsd, abandoned = {
 		byPhase: foldBuckets(attribution.byPhase),
 		byAgentType: foldBuckets(attribution.byAgentType),
 		byRole,
+		byScope: foldScopeBuckets(attribution.byScope),
 		orchestrator: {
 			...orchestrator,
 			share: orchestrator.spentUsd / Math.max(totalUsd, .01)
@@ -15785,6 +16032,7 @@ function costReportFromJournal(entries, priceUsd) {
 	const byModel = {};
 	const byPhase = {};
 	const byAgentType = {};
+	const byScope = {};
 	const byRole = emptyByRole();
 	const unpriced = [];
 	let totalUsd = 0;
@@ -15827,6 +16075,8 @@ function costReportFromJournal(entries, priceUsd) {
 		byPhase[phase] = (byPhase[phase] ?? 0) + priced.usd;
 		const agentType = attributionBucket(facts?.agentType);
 		byAgentType[agentType] = (byAgentType[agentType] ?? 0) + priced.usd;
+		const scope = scopeBucket(entry.scope);
+		byScope[scope] = (byScope[scope] ?? 0) + priced.usd;
 		const primaryRole = facts?.role ?? "loop";
 		for (const unit of priced.units) byRole[unit.role ?? primaryRole] += unit.usd;
 		if (facts?.budgetAccount !== void 0 && isOrchestratorAccount(facts.budgetAccount)) {
@@ -15848,6 +16098,7 @@ function costReportFromJournal(entries, priceUsd) {
 		byPhase,
 		byAgentType,
 		byRole,
+		byScope,
 		orchestrator: {
 			spentUsd: orchestratorSpentUsd,
 			share: orchestratorSpentUsd / Math.max(totalUsd, .01),
@@ -16128,10 +16379,13 @@ function invoiceFromJournal(entries, priceUsd, options) {
 		const billing = priceEntryBilling(entry, priceUsd);
 		if (!billing.fullyAttributed) everyEntryFullyAttributed = false;
 		const abandoned = entry.kind !== "resolution" && entry.kind !== "abandon" && abandonFold.isAbandoned(entry.ref ?? entry.seq);
+		const attribution = entry.costAttribution;
 		const base = {
 			entrySeq: entry.seq,
 			scope: entry.scope,
-			key: entry.key
+			key: entry.key,
+			...attribution?.agentType === void 0 || attribution.agentType === "" ? {} : { agentType: attribution.agentType },
+			...attribution?.label === void 0 ? {} : { label: attribution.label }
 		};
 		const mark = abandoned ? { abandoned: true } : {};
 		const records = entry.providerCalls ?? [];
@@ -16869,7 +17123,8 @@ function statementRowsFromDelimited(text, options) {
 const REFUSAL_MESSAGES = {
 	unsettled: "no run settle is journaled for this run: nothing durable records a terminal",
 	"not-terminal": "the journaled run settle records a running segment, not a terminal",
-	"unknown-workflow": "no stored metadata names the workflow this run belongs to"
+	"unknown-workflow": "no stored metadata names the workflow this run belongs to",
+	"malformed-envelope": "the rebuilt envelope failed the runtime terminal contract gate: the journal bytes produced values the contract forbids"
 };
 /** Every envelope status; a settle may also record the non-terminal 'running'. */
 const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
@@ -16901,10 +17156,18 @@ function persistedTerminalEnvelope(input) {
 	if (tail > 0) return refuse("not-terminal", `the journal continued ${String(tail)} entr${tail === 1 ? "y" : "ies"} past the settle at seq ${String(settle.seq)}: the latest segment is not settled`);
 	const workflow = input.meta?.workflowName;
 	if (workflow === void 0) return refuse("unknown-workflow");
+	try {
+		return assemble(input, workflow, settle);
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		return refuse("malformed-envelope", `${REFUSAL_MESSAGES["malformed-envelope"]}: ${detail}`);
+	}
+}
+function assemble(input, workflow, settle) {
 	const ledger = foldLedger(input.entries, buildAbandonFold(input.entries));
 	return {
 		available: true,
-		envelope: terminalEnvelopeOf({
+		envelope: parseTerminalEnvelope(terminalEnvelopeOf({
 			runId: input.runId,
 			workflow,
 			outcome: {
@@ -16920,7 +17183,7 @@ function persistedTerminalEnvelope(input) {
 			agentsSpawned: ledger.agentsSpawned,
 			...input.meta?.configFingerprint === void 0 ? {} : { configFingerprint: input.meta.configFingerprint },
 			provenance: "journal"
-		})
+		}))
 	};
 }
 //#endregion
@@ -18953,6 +19216,7 @@ function createCtx(internals, rootWorkflow) {
 			});
 			bump(internals.cost.byPhase, state.phase ?? "", costUsd);
 			bump(internals.cost.byAgentType, agentType, costUsd);
+			bump(internals.cost.byScope, state.scope, costUsd);
 			internals.cost.byRole.set(primaryRole, (internals.cost.byRole.get(primaryRole) ?? 0) + costUsd);
 			if (result.status === "escalated" && result.escalation !== void 0) {
 				if (internals.replayer.snapshot().find((entry) => entry.kind === "decision" && entry.value?.targetRef === matched.running.seq) === void 0 && opts.result !== "full" && internals.onEscalation !== void 0) {
@@ -19728,6 +19992,7 @@ function createCtx(internals, rootWorkflow) {
 		}
 		bump(internals.cost.byPhase, state.phase ?? "", usd);
 		bump(internals.cost.byAgentType, agentType, usd);
+		bump(internals.cost.byScope, state.scope, usd);
 		if (result.error?.kind === "budget" || internals.budget.exhausted && result.status !== "ok") {
 			if (!internals.budget.exhausted && result.errorMessage !== void 0 && result.errorMessage.startsWith("in flight exposure cap reached")) throw new BudgetExhaustedError(result.errorMessage, { data: {
 				scope: state.scope,
@@ -21166,6 +21431,50 @@ const MAX_LISTED_CITATIONS = 20;
 const MAX_NAMED_OFFENDING_SENTENCES = 5;
 const MAX_OFFENDING_SENTENCE_CHARS = 240;
 /**
+* The most offending sentences a verdict will hint (RV3801). A
+* document broken in more places than this needs a model repair
+* anyway, and an unbounded hint set would carry unbounded sentence
+* bytes through the live verdict.
+*/
+const MAX_REPAIR_HINTS = 20;
+/**
+* The deterministic edit behind the `insert-run-id` mechanism
+* (RV3801): the id lands INSIDE the sentence, before its trailing
+* terminator run (a `.`, `!`, or `?` with any closing quotes,
+* brackets, or markdown emphasis after it), or at the very end when
+* the sentence carries no terminator. Inside matters: appended AFTER
+* the terminator the id would belong to the NEXT sentence under the
+* shared `sentencesOf` segmentation and the re-validation would fail
+* the same sentence again. Exported so tests and hosts can reproduce
+* the loop's exact bytes.
+*/
+function insertRunIdIntoSentence(sentence, insert) {
+	const at = /[.!?]['")\]*_`]*\s*$/u.exec(sentence)?.index ?? sentence.length;
+	return `${sentence.slice(0, at)} (run ${insert})${sentence.slice(at)}`;
+}
+/**
+* Applies `insert-run-id` repair hints to a judged text (RV3801): each
+* `[start, end)` window is replaced by
+* {@link insertRunIdIntoSentence}(window, insert), right to left so
+* earlier offsets stay valid, every other byte identical. Fail closed:
+* `undefined` (never a partial patch) when the set is empty, any
+* window is out of bounds or empty, or two windows overlap; the caller
+* treats a refused patch exactly like an absent one and proceeds to
+* the model repair pool.
+*/
+function applyFinishRepairHints(text, hints) {
+	if (hints.length === 0) return;
+	const ordered = [...hints].sort((a, b) => a.start - b.start);
+	let previousEnd = 0;
+	for (const hint of ordered) {
+		if (!Number.isInteger(hint.start) || !Number.isInteger(hint.end) || hint.start < previousEnd || hint.end <= hint.start || hint.end > text.length) return;
+		previousEnd = hint.end;
+	}
+	let patched = text;
+	for (const hint of [...ordered].reverse()) patched = patched.slice(0, hint.start) + insertRunIdIntoSentence(patched.slice(hint.start, hint.end), hint.insert) + patched.slice(hint.end);
+	return patched;
+}
+/**
 * The shortest run id {@link evidenceGradeValidator} will accept as an
 * artifact (RV2501). The floor mirrors the id half of
 * {@link DEFAULT_ARTIFACT_PATTERN}: a two character id would satisfy
@@ -21477,6 +21786,13 @@ const DEFAULT_ARTIFACT_PATTERN = "(?:run[ -]?[0-9A-HJKMNP-TV-Z]{6,26}|[\\w./-]+\
 * the repair instruction is executable rather than aspirational. An id
 * shorter than `MIN_RUN_ID_ARTIFACT_CHARS` (six) is ignored, and
 * without an id the verdict is byte identical to the historical one.
+*
+* With the id in hand the failure also carries {@link FinishRepairHint}
+* rows (RV3801), one per offending sentence, so the finish loop can
+* perform the verdict's own prescription host side without spending a
+* provider wire; the reasons stay byte identical either way, and the
+* hints are bounded (at most `MAX_REPAIR_HINTS` offenders) and fail
+* closed (an id whose bytes could split a sentence is never hinted).
 * Default name 'evidence-grade'.
 */
 function evidenceGradeValidator(options) {
@@ -21496,18 +21812,32 @@ function evidenceGradeValidator(options) {
 			const unsupported = [];
 			const offenders = [];
 			const runId = typeof input.runId === "string" && input.runId.trim().length >= MIN_RUN_ID_ARTIFACT_CHARS ? input.runId.trim() : void 0;
+			let cursor = 0;
 			for (const sentence of sentencesOf(input.text)) {
+				const start = input.text.indexOf(sentence, cursor);
+				cursor = start + sentence.length;
 				const haystack = sentence.toLowerCase();
 				const found = lowered.filter((phrase) => haystack.includes(phrase));
 				if (found.length === 0 || new RegExp(artifactPattern, "").test(sentence) || runId !== void 0 && containsIdentifier(sentence, runId)) continue;
-				offenders.push(sentence);
+				offenders.push({
+					sentence,
+					start,
+					end: start + sentence.length
+				});
 				for (const phrase of found) if (!unsupported.includes(phrase)) unsupported.push(phrase);
 			}
 			if (unsupported.length === 0) return ok;
-			const named = offenders.slice(0, MAX_NAMED_OFFENDING_SENTENCES).map((sentence) => {
+			const named = offenders.slice(0, MAX_NAMED_OFFENDING_SENTENCES).map(({ sentence }) => {
 				const flat = sentence.replace(/\s+/gu, " ").trim();
 				return `offending sentence: "${flat.length <= MAX_OFFENDING_SENTENCE_CHARS ? flat : `${flat.slice(0, MAX_OFFENDING_SENTENCE_CHARS)}...`}"`;
 			});
+			const hints = runId !== void 0 && offenders.length <= MAX_REPAIR_HINTS && !/[.!?]\s|[\r\n]/u.test(runId) && offenders.every((offender) => offender.start >= 0) ? offenders.map(({ sentence, start, end }) => ({
+				mechanism: "insert-run-id",
+				start,
+				end,
+				sentence,
+				insert: runId
+			})) : void 0;
 			const overflow = offenders.length - named.length;
 			return {
 				ok: false,
@@ -21515,7 +21845,8 @@ function evidenceGradeValidator(options) {
 					runId === void 0 ? `evidence-grade claims cite no run or repro artifact in their own sentence: ${listCitations(unsupported)}; give each such claim a file:line citation in its own sentence, or state its run id in a SEPARATE sentence carrying no source citation (a run id written beside a path:line citation is not in the cited window and trades this failure for a cited-value one)` : `evidence-grade claims cite no run or repro artifact in their own sentence: ${listCitations(unsupported)}; write this run's id ${runId} inside each such sentence, or give the claim a file:line citation instead (the id may share a sentence with a source citation: cited-value reads a run id as identity, not as a value asserted about the cited line)`,
 					...named,
 					...overflow > 0 ? [`and ${String(overflow)} more offending sentences`] : []
-				]
+				],
+				...hints === void 0 ? {} : { repairHints: hints }
 			};
 		}
 	};
@@ -22763,6 +23094,72 @@ function selfTestFinishValidation(options) {
 /** How many rejected finishes are repaired by default: the plan's repair once. */
 const DEFAULT_FINISH_MAX_REPAIRS = 1;
 /**
+* The most hinted edits one deterministic repair attempt will apply
+* (RV3801): a validator caps its own hints well below this, so the
+* bound only guards against a custom validator flooding the journal
+* with patch rows; past it the candidate goes to the model pool.
+*/
+const MAX_DETERMINISTIC_PATCHES = 64;
+/**
+* Plans the sectional claim repair round (RV3803): which H2 sections
+* of the accepted pre-repair document own the judged findings. The
+* third comparison run's round regenerated the WHOLE 43k character
+* document to consume findings that lived in a handful of sentences,
+* and the tail after fan-in was 80.1 percent of the run's wall. Each
+* finding's `draftExcerpt` (whitespace collapsed by the pairing fold)
+* is located in the document through a collapse-aware scan, and its
+* owning section is the nearest H2 line above it. Fail closed to the
+* FULL regeneration (undefined, the historical round byte for byte)
+* whenever the plan cannot be exact: no excerpts, a document without
+* H2 headings, duplicated markers (the splice grammar needs unique
+* lines), or any excerpt the scan cannot locate.
+*/
+function sectionalRoundPlan(document, excerpts) {
+	if (excerpts.length === 0) return;
+	const markers = [];
+	let offset = 0;
+	for (const line of document.split("\n")) {
+		if (line.trim().startsWith("## ")) markers.push({
+			marker: line.trim(),
+			start: offset
+		});
+		offset += line.length + 1;
+	}
+	if (markers.length === 0 || new Set(markers.map((m) => m.marker)).size !== markers.length) return;
+	const collapsed = [];
+	const rawAt = [];
+	let pendingSpace = false;
+	for (let index = 0; index < document.length; index += 1) {
+		const char = document[index] ?? "";
+		if (/\s/u.test(char)) {
+			pendingSpace = collapsed.length > 0;
+			continue;
+		}
+		if (pendingSpace) {
+			collapsed.push(" ");
+			rawAt.push(index);
+			pendingSpace = false;
+		}
+		collapsed.push(char);
+		rawAt.push(index);
+	}
+	const haystack = collapsed.join("");
+	const targets = [];
+	for (const excerpt of excerpts) {
+		const at = haystack.indexOf(excerpt.trim());
+		if (at < 0) return;
+		const raw = rawAt[at] ?? -1;
+		const owner = [...markers].reverse().find((m) => m.start <= raw);
+		if (owner === void 0) return;
+		if (!targets.includes(owner.marker)) targets.push(owner.marker);
+	}
+	targets.sort((a, b) => markers.findIndex((m) => m.marker === a) - markers.findIndex((m) => m.marker === b));
+	return {
+		sections: markers.map((m) => m.marker),
+		targets
+	};
+}
+/**
 * Character cap of the HOST VALIDATION LESSONS prompt block (RV3603):
 * the bounded repair round's prompt folds the run's journaled finish
 * validation failures so the round does not relearn a lesson the run
@@ -22895,6 +23292,8 @@ function validateOrchestrateOptions(opts) {
 		}
 		if (fv.maxRepairs !== void 0) requireNonNegativeInteger(fv.maxRepairs, "orchestrate finishValidation.maxRepairs");
 		if (fv.repairTurnReserve !== void 0) requireNonNegativeInteger(fv.repairTurnReserve, "orchestrate finishValidation.repairTurnReserve");
+		const estRepair = fv.estRepairCostUsd;
+		if (estRepair !== void 0 && (typeof estRepair !== "number" || !Number.isFinite(estRepair) || estRepair < 0)) throw new ConfigError(`orchestrate finishValidation.estRepairCostUsd must be a nonnegative finite number; got ${JSON.stringify(estRepair)}`);
 		const retain = fv.retainRejectedCandidates;
 		if (retain !== void 0 && typeof retain !== "boolean") throw new ConfigError("orchestrate finishValidation.retainRejectedCandidates must be a boolean");
 		const draftPolicy = fv.draftPolicy;
@@ -23114,6 +23513,7 @@ function validateOrchestrateOptions(opts) {
 		if (opts.synthesis.mode === "incremental") throw new ConfigError("orchestrate budget.synthesisReserveUsd is incompatible with synthesis.mode 'incremental': the reserve protects the single post-fan-in invocation");
 	}
 	if (spec.finalizeTurns !== void 0) requirePositiveInteger$2(spec.finalizeTurns, "orchestrate budget.finalizeTurns");
+	if (spec.acceptanceReserve !== void 0 && spec.acceptanceReserve !== "warn" && spec.acceptanceReserve !== "require") throw new ConfigError(`orchestrate budget.acceptanceReserve must be 'warn' or 'require'; got ${String(spec.acceptanceReserve)}`);
 	if (spec.atCap !== void 0 && spec.atCap !== "finish-with-partial" && spec.atCap !== "fail-run") throw new ConfigError(`orchestrate budget.atCap must be 'finish-with-partial' or 'fail-run'; got ${String(spec.atCap)}`);
 }
 function orchestratorPrompt(goal, maxSpawns, extensionLines) {
@@ -23311,6 +23711,42 @@ function makeOrchestratorWorkflow(goal, opts) {
 				};
 			}
 		}
+		if (opts?.budget?.acceptanceReserve === "require") {
+			const synthesisHoldUsd = opts.budget.synthesisReserveUsd ?? 0;
+			const judgeEstUsd = opts?.claimConsistency?.judge?.estCost ?? 0;
+			const bootClaimStage = opts?.claimConsistency?.stage ?? "draft";
+			const roundArmed = (opts?.claimConsistency?.onFound ?? "report") === "repair" && bootClaimStage !== "draft";
+			const judgePasses = 1 + (roundArmed ? 1 : 0);
+			const judgeTailUsd = judgeEstUsd * judgePasses;
+			const mechanicalRepairUsd = opts?.finishValidation?.estRepairCostUsd ?? 0;
+			const roundCompositionUsd = roundArmed ? opts?.synthesis?.estCost ?? 0 : 0;
+			const workingRoomUsd = capState?.turnEstimateUsd ?? internals.flatReserveUsd ?? .5;
+			const requiredUsd = synthesisHoldUsd + judgeTailUsd + mechanicalRepairUsd + roundCompositionUsd + workingRoomUsd;
+			const capUsd = capState?.effectiveCapUsd;
+			if (capUsd === void 0 || capUsd < requiredUsd) {
+				const terms = `synthesisReserveUsd ${synthesisHoldUsd.toFixed(4)} + judge ${judgeEstUsd.toFixed(4)} x ${String(judgePasses)} pass(es) + estRepairCostUsd ${mechanicalRepairUsd.toFixed(4)} + round composition ${roundCompositionUsd.toFixed(4)} + working room ${workingRoomUsd.toFixed(4)} = ${requiredUsd.toFixed(4)} USD`;
+				await internals.replayer.appendSinglePhase({
+					scope: callingState.scope,
+					key: deriverV2.deriveKey({ kind: "acceptance-reserve-refused" }),
+					kind: "decision",
+					status: "ok",
+					spanId: internals.spans.mint(callingState.spanId),
+					site: "orchestrator-budget",
+					value: {
+						decisionType: "acceptance_reserve_refused",
+						requiredUsd,
+						effectiveCapUsd: capUsd ?? null,
+						synthesisReserveUsd: synthesisHoldUsd,
+						judgeEstUsd,
+						judgePasses,
+						estRepairCostUsd: mechanicalRepairUsd,
+						roundCompositionUsd,
+						workingRoomUsd
+					}
+				});
+				throw new OrchestratorCapConfigError(capUsd === void 0 ? `budget.acceptanceReserve 'require' needs a resolved effective cap to hold the declared acceptance tail against (${terms}); declare budget.capUsd or a run ceiling` : `budget.acceptanceReserve 'require': the declared acceptance tail does not fit the effective cap ${capUsd.toFixed(4)} USD (${terms}); raise the cap or lower the declared tail`);
+			}
+		}
 		const records = /* @__PURE__ */ new Map();
 		const byOrdinal = /* @__PURE__ */ new Map();
 		const rejectedByOrdinal = /* @__PURE__ */ new Map();
@@ -23461,6 +23897,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const childState = {
 				scope,
 				spanId: internals.spans.mint(callingState.spanId),
+				phase: callingState.phase ?? "fan-out",
 				signal: upstream === void 0 ? controller.signal : AbortSignal.any([upstream, controller.signal]),
 				budgetScope: placement?.ownAccount === true ? scope : callingState.budgetScope ?? "run"
 			};
@@ -24263,6 +24700,31 @@ function makeOrchestratorWorkflow(goal, opts) {
 		*/
 		let validationInvocationStart = 0;
 		/**
+		* The staged release of the round's mechanical money leg (RV3802),
+		* armed by the bounded claim repair round right before its
+		* composition dispatches and fired at the round invocation's FIRST
+		* journaled finish verdict: a 'repair' verdict is about to spend
+		* the freed money on the granted turn, an 'accepted' one never
+		* needed it, and a 'rejected' one dies into the round's own
+		* finally, which releases whatever is still armed. Live-only state
+		* on the RV808b doctrine: the hold itself is re-committed by the
+		* re-executed round code on a resume, and full replay never runs
+		* validateFinish at all.
+		*/
+		let releaseRepairLeg;
+		/**
+		* The sectional round context (RV3803), armed by the bounded claim
+		* repair round exactly when {@link sectionalRoundPlan} is exact
+		* over the accepted pre-repair document and the judged findings:
+		* the retained base, its full H2 marker roster, and the target
+		* sections owning the findings. Live state cleared in the round's
+		* finally; a resume re-derives it from replayed material (the
+		* judged findings and the accepted document both replay verbatim),
+		* so the round's prompt bytes stay identical without journaling
+		* anything new.
+		*/
+		let sectionalRoundContext;
+		/**
 		* The contract generation membership test (cycle 73). Without a
 		* contract there are no generations and every decision is current
 		* (the pre 1.77 behavior, byte identical). With one, a decision
@@ -24295,8 +24757,9 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const rows = [];
 			const seen = /* @__PURE__ */ new Set();
 			for (const decision of validationDecisions()) {
-				if (decision.failed.length === 0 || !contractGenerationCurrent(decision)) continue;
-				for (const failure of decision.failed) {
+				const taught = [...decision.failed, ...decision.deterministicRepair?.healed ?? []];
+				if (taught.length === 0 || !contractGenerationCurrent(decision)) continue;
+				for (const failure of taught) {
 					const key = JSON.stringify([failure.name, failure.reasons]);
 					if (seen.has(key)) continue;
 					seen.add(key);
@@ -24435,7 +24898,45 @@ function makeOrchestratorWorkflow(goal, opts) {
 			if (validationSpec === void 0) return { ok: true };
 			let effective = call.result ?? null;
 			let spliced = false;
-			if (finishSectional !== void 0) {
+			if (sectionalRoundContext !== void 0) {
+				const round = sectionalRoundContext;
+				const args = call.args ?? {};
+				const hasSections = Object.hasOwn(args, "sections");
+				const hasResult = Object.hasOwn(args, "result");
+				const guidance = () => ({
+					declaredSections: round.sections,
+					targetSections: round.targets,
+					instruction: "repair ONLY the target sections: call finish({ sections: { \"<marker>\": \"<new section body>\" } }); unchanged sections are spliced from the retained accepted document byte for byte and the spliced whole is validated and judged. Resubmit the full document as result only when a targeted repair is impossible."
+				});
+				if (hasSections && hasResult) return {
+					ok: false,
+					feedback: {
+						error: "pass either result (the full document) or sections (a sectional repair of the retained accepted document), never both",
+						...guidance()
+					}
+				};
+				if (hasSections) {
+					const patch = args.sections;
+					const markers = Object.keys(patch);
+					if (markers.length === 0) return {
+						ok: false,
+						feedback: {
+							error: "sections must name at least one declared section marker",
+							...guidance()
+						}
+					};
+					const unknown = markers.filter((marker) => !round.sections.includes(marker));
+					if (unknown.length > 0) return {
+						ok: false,
+						feedback: {
+							error: `sections names an undeclared section ${unknown.map((marker) => `'${marker}'`).join(", ")}; only the retained document's own markers splice`,
+							...guidance()
+						}
+					};
+					effective = spliceSections(round.base, round.sections, patch);
+					spliced = true;
+				}
+			} else if (finishSectional !== void 0) {
 				const resolution = finishSectional.resolve(call);
 				if (resolution.kind === "refused") return {
 					ok: false,
@@ -24446,6 +24947,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			}
 			const maxRepairs = validationSpec.maxRepairs ?? 1;
 			const known = validationDecisions();
+			let patchedResult;
 			let decision = known.find((candidate) => candidate.callId === call.id);
 			if (decision === void 0) {
 				const result = effective;
@@ -24456,6 +24958,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 					runId: internals.runId
 				};
 				const failed = [];
+				const failureHints = [];
 				for (const validator of validationSpec.validators) {
 					let verdict;
 					try {
@@ -24468,13 +24971,66 @@ function makeOrchestratorWorkflow(goal, opts) {
 							feedback: { error: `finish validator '${validator.name}' is defective; the run fails` }
 						};
 					}
-					if (!verdict.ok) failed.push({
-						name: validator.name,
-						reasons: verdict.reasons
-					});
+					if (!verdict.ok) {
+						failed.push({
+							name: validator.name,
+							reasons: verdict.reasons
+						});
+						failureHints.push(verdict.repairHints);
+					}
+				}
+				let deterministicRepair;
+				if (failed.length > 0 && typeof result === "string" && failureHints.every((hints) => hints !== void 0 && hints.length > 0)) {
+					const merged = [];
+					const seenHints = /* @__PURE__ */ new Set();
+					for (const hints of failureHints) for (const hint of hints ?? []) {
+						const key = `${String(hint.start)}:${String(hint.end)}:${hint.insert}`;
+						if (!seenHints.has(key)) {
+							seenHints.add(key);
+							merged.push(hint);
+						}
+					}
+					const patched = merged.length <= MAX_DETERMINISTIC_PATCHES && merged.every((hint) => hint.mechanism === "insert-run-id" && result.slice(hint.start, hint.end) === hint.sentence) ? applyFinishRepairHints(result, merged) : void 0;
+					if (patched !== void 0) {
+						const patchedInput = {
+							result: patched,
+							text: patched,
+							children: input.children,
+							runId: internals.runId
+						};
+						const residual = [];
+						for (const validator of validationSpec.validators) {
+							let verdict;
+							try {
+								verdict = validator.validate(patchedInput);
+							} catch (thrown) {
+								validationTermination = new ConfigError(`finish validator '${validator.name}' threw instead of returning a verdict: ` + (thrown instanceof Error ? thrown.message : String(thrown)));
+								validationAbort.abort("rulvar:finish-validation-defect");
+								return {
+									ok: false,
+									feedback: { error: `finish validator '${validator.name}' is defective; the run fails` }
+								};
+							}
+							if (!verdict.ok) residual.push(validator.name);
+						}
+						const patchSurvived = residual.length === 0;
+						deterministicRepair = {
+							mechanism: "insert-run-id",
+							patches: merged.map(({ start, end, insert }) => ({
+								start,
+								end,
+								insert
+							})),
+							beforeHash: createHash("sha256").update(jcsSerialize(result), "utf8").digest("hex"),
+							afterHash: createHash("sha256").update(jcsSerialize(patched), "utf8").digest("hex"),
+							outcome: patchSurvived ? "accepted" : "failed",
+							...patchSurvived ? { healed: failed } : { residual }
+						};
+						if (patchSurvived) patchedResult = patched;
+					}
 				}
 				const repairsUsed = known.filter((candidate, index) => index >= validationInvocationStart && candidate.verdict !== "accepted" && contractGenerationCurrent(candidate)).length;
-				const rejectedCandidate = failed.length > 0;
+				const rejectedCandidate = failed.length > 0 && deterministicRepair?.outcome !== "accepted";
 				let candidateRef;
 				if (rejectedCandidate && validationSpec.retainRejectedCandidates === true) {
 					const ref = `${internals.runId}/finish-rejected/${call.id}`;
@@ -24496,10 +25052,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 				decision = {
 					decisionType: "orchestrator_finish_validation",
 					callId: call.id,
-					verdict: failed.length === 0 ? "accepted" : repairsUsed < maxRepairs ? "repair" : "rejected",
-					failed,
+					verdict: failed.length === 0 || deterministicRepair?.outcome === "accepted" ? "accepted" : repairsUsed < maxRepairs ? "repair" : "rejected",
+					failed: deterministicRepair?.outcome === "accepted" ? [] : failed,
 					repairsUsed,
 					maxRepairs,
+					...deterministicRepair === void 0 ? {} : { deterministicRepair },
 					...validationSpec.contract === void 0 ? {} : { contractHash: validationSpec.contract.hash },
 					...rejectedCandidate ? {
 						candidateHash: createHash("sha256").update(jcsSerialize(result), "utf8").digest("hex"),
@@ -24516,11 +25073,18 @@ function makeOrchestratorWorkflow(goal, opts) {
 					site: "orchestrator-finish-validation",
 					value: decision
 				});
+				releaseRepairLeg?.();
+			}
+			if (decision.verdict === "accepted") {
+				if (patchedResult !== void 0) return {
+					ok: true,
+					resolved: { result: patchedResult }
+				};
+				return spliced ? {
+					ok: true,
+					resolved: { result: effective }
+				} : { ok: true };
 			}
-			if (decision.verdict === "accepted") return spliced ? {
-				ok: true,
-				resolved: { result: effective }
-			} : { ok: true };
 			finishSectional?.retain(effective);
 			if (decision.verdict === "rejected") {
 				if (contractGenerationCurrent(decision)) {
@@ -24541,7 +25105,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 					error: "the finish result failed host validation; repair the result and call finish again",
 					failed: decision.failed,
 					repairsRemaining: decision.maxRepairs - decision.repairsUsed - 1,
-					...finishSectional === void 0 ? {} : { sectionalRepair: finishSectional.guidance() }
+					...sectionalRoundContext !== void 0 ? { sectionalRepair: {
+						declaredSections: sectionalRoundContext.sections,
+						targetSections: sectionalRoundContext.targets,
+						instruction: "repair ONLY the target sections: call finish({ sections: { \"<marker>\": \"<new section body>\" } }); unchanged sections are spliced from the retained accepted document byte for byte and the spliced whole is validated and judged. Resubmit the full document as result only when a targeted repair is impossible."
+					} } : finishSectional === void 0 ? {} : { sectionalRepair: finishSectional.guidance() }
 				}
 			};
 		};
@@ -24717,6 +25285,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 		};
 		const orchestratorState = { ...callingState };
 		if (orchestratorAccount !== void 0) orchestratorState.budgetScope = orchestratorAccount;
+		orchestratorState.phase = orchestratorState.phase ?? "coordination";
 		const loopBreakSignal = validationSpec === void 0 ? forcedFinishController.signal : AbortSignal.any([forcedFinishController.signal, validationAbort.signal]);
 		orchestratorState.signal = callingState.signal === void 0 ? loopBreakSignal : AbortSignal.any([callingState.signal, loopBreakSignal]);
 		/**
@@ -24772,6 +25341,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				if (orchestratorAccount !== void 0) internals.budget.releaseFinalizeReserve(orchestratorAccount);
 				const finalState = { ...callingState };
 				if (orchestratorAccount !== void 0) finalState.budgetScope = orchestratorAccount;
+				finalState.phase = finalState.phase ?? "coordination";
 				const digest = buildDigest(wakeOrdinal);
 				const reserveBaseline = orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.spentUsd ?? 0;
 				const dispatched = await runtime.runInScope(finalState, () => ctx.agent([
@@ -24845,6 +25415,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			].join("\n");
 			const noteState = { ...callingState };
 			if (orchestratorAccount !== void 0) noteState.budgetScope = orchestratorAccount;
+			noteState.phase = noteState.phase ?? "composition";
 			const noteOpts = {
 				role: "synthesize",
 				result: "full",
@@ -25339,6 +25910,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			].join("\n");
 			const judgeState = { ...callingState };
 			if (orchestratorAccount !== void 0) judgeState.budgetScope = orchestratorAccount;
+			judgeState.phase = judgeState.phase ?? "judge";
 			const judgeOpts = {
 				role: "synthesize",
 				result: "full",
@@ -25434,7 +26006,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...snapshot ?? {}
 			} });
 		};
-		const runSynthesis = async (draft) => {
+		const runSynthesis = async (draft, stagePhase = "composition") => {
 			const spec = opts?.synthesis;
 			if (spec === void 0) return draft;
 			await recoveryDone;
@@ -25608,7 +26180,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const synthesisToolNames = /* @__PURE__ */ new Set([FINISH_TOOL_NAME, ...exposeTools ? [GET_CHILD_RESULT_TOOL_NAME, READ_CHILD_ARTIFACT_TOOL_NAME] : []]);
 			const synthesisTools = buildOrchestratorTools(orchestratorRuntime, fullCardText, {
 				childResultTools: exposeTools,
-				sectionalFinish: synthSectionalFinish
+				sectionalFinish: synthSectionalFinish || sectionalRoundContext !== void 0
 			}).filter((tool) => synthesisToolNames.has(tool.name));
 			if (finishSectional !== void 0 && synthSectionalFinish) finishSectional.retain(draft);
 			const settledEntries = [...byOrdinal.values()].filter((record) => record.settled !== void 0).sort((a, b) => a.spawnOrdinal - b.spawnOrdinal).map((record) => [record.handle, record]);
@@ -25686,6 +26258,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...opts?.contradictions?.onFound !== "carry" || contradictionsFound === void 0 || contradictionsFound.length === 0 ? [] : ["CHILD CONTRADICTIONS: the settled children read these cited locations differently; resolve each one EXPLICITLY in the final result (say which reading holds and why it does) instead of silently picking one. " + JSON.stringify(contradictionsFound)],
 				...opts?.claimConsistency?.onFound !== "carry" && opts?.claimConsistency?.onFound !== "repair" || claimFindingsFound === void 0 || claimFindingsFound.length === 0 ? [] : ["CLAIM CONTRADICTIONS: the composed draft contradicts the settled child pool at these cited locations; resolve each one EXPLICITLY in the final result (say which reading holds and why) instead of keeping the inverted claim. " + JSON.stringify(claimFindingsFound)],
 				...opts?.claimConsistency?.onFound !== "carry" && opts?.claimConsistency?.onFound !== "repair" || claimFindingsFound === void 0 || claimFindingsFound.length === 0 ? [] : hostValidationLessons(),
+				...sectionalRoundContext === void 0 ? [] : [
+					`RETAINED FINAL: ${JSON.stringify(sectionalRoundContext.base)}`,
+					"SECTIONAL ROUND: the accepted document above is RETAINED; repair ONLY the sections owning the contradicted claims by calling finish({ sections: { \"<marker>\": \"<new section body>\" } }). Unchanged sections are spliced from the retained document byte for byte and the spliced whole is validated and judged. Target sections: " + JSON.stringify(sectionalRoundContext.targets) + ". Declared markers: " + JSON.stringify(sectionalRoundContext.sections) + ". Resubmit the full document as result only when a targeted repair is impossible.",
+					"Rewritten sections must keep the retained evidence discipline: a sentence making a verified or confirmed grade claim carries the run id or a file:line citation INSIDE the sentence, exactly like the retained sections do; a rewritten sentence that drops it fails the finish contract mechanically."
+				],
 				...spec.policyFacts === true ? [(() => {
 					const byStatus = {};
 					let extensionsGranted = 0;
@@ -25786,6 +26363,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const configuredReserveUsd = opts?.budget?.synthesisReserveUsd ?? 0;
 			const heldReserveUsd = orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.synthesisReserveUsd ?? 0;
 			const synthesisState = { ...callingState };
+			synthesisState.phase = synthesisState.phase ?? stagePhase;
 			if (orchestratorAccount !== void 0) {
 				synthesisState.budgetScope = orchestratorAccount;
 				internals.budget.releaseSynthesisReserve(orchestratorAccount);
@@ -26533,6 +27111,10 @@ function makeOrchestratorWorkflow(goal, opts) {
 		if (claimStage !== "draft") {
 			claimConsistencyDraftMeta = claimStage === "both" ? claimConsistencyMeta : void 0;
 			await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+			if ((opts?.claimConsistency?.onFound ?? "report") === "repair" && claimConsistencyMeta !== void 0) {
+				claimConsistencyMeta.passes = 1;
+				claimConsistencyMeta.semanticRepairRounds = 0;
+			}
 			if ((opts?.claimConsistency?.onFound ?? "report") === "repair" && claimFindingsFound !== void 0 && claimFindingsFound.length > 0) {
 				const hashOfDocument = (value) => createHash("sha256").update(jcsSerialize(value ?? null), "utf8").digest("hex");
 				const preRepairHash = hashOfDocument(synthesizedFinal);
@@ -26540,8 +27122,32 @@ function makeOrchestratorWorkflow(goal, opts) {
 				const convergenceHoldUsd = opts?.claimConsistency?.judge?.estCost ?? observedFinalJudgeCostUsd ?? 0;
 				const convergenceScope = orchestratorAccount ?? "run";
 				if (convergenceHoldUsd > 0) internals.budget.commitConvergenceReserve(convergenceScope, convergenceHoldUsd);
+				const repairHoldUsd = validationSpec === void 0 ? 0 : validationSpec.estRepairCostUsd ?? lastMechanicalRepairCostUsd(internals.replayer.snapshot(), (servedBy, usage) => internals.priceUsd(servedBy, usage)) ?? 0;
+				if (repairHoldUsd > 0) {
+					internals.budget.commitRepairReserve(convergenceScope, repairHoldUsd);
+					releaseRepairLeg = () => {
+						releaseRepairLeg = void 0;
+						internals.budget.releaseRepairReserve(convergenceScope);
+					};
+				}
+				const roundPlan = validationSpec !== void 0 && typeof synthesizedFinal === "string" ? sectionalRoundPlan(synthesizedFinal, carried.map((finding) => finding.draftExcerpt)) : void 0;
+				if (roundPlan !== void 0) {
+					sectionalRoundContext = {
+						base: synthesizedFinal,
+						...roundPlan
+					};
+					internals.events.emit({
+						type: "log",
+						level: "debug",
+						msg: "orchestrator sectional round armed",
+						data: {
+							targets: roundPlan.targets,
+							sections: roundPlan.sections.length
+						}
+					}, callingState.spanId);
+				}
 				try {
-					synthesizedFinal = await runSynthesis(result.output);
+					synthesizedFinal = await runSynthesis(result.output, "repair");
 				} catch (thrown) {
 					await journalSynthesisAdmissionDecline(thrown);
 					const hostRejection = thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) && thrown.data.source === "orchestrator_finish_validation" ? thrown.data : void 0;
@@ -26572,10 +27178,18 @@ function makeOrchestratorWorkflow(goal, opts) {
 						...acceptanceSnapshot
 					} });
 				} finally {
+					sectionalRoundContext = void 0;
+					releaseRepairLeg = void 0;
+					if (repairHoldUsd > 0) internals.budget.releaseRepairReserve(convergenceScope);
 					if (convergenceHoldUsd > 0) internals.budget.releaseConvergenceReserve(convergenceScope);
 				}
 				try {
 					await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+					if (claimConsistencyMeta !== void 0) {
+						claimConsistencyMeta.passes = 2;
+						claimConsistencyMeta.firstPassFindings = carried.length;
+						claimConsistencyMeta.semanticRepairRounds = 1;
+					}
 				} catch (thrown) {
 					if (thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) && thrown.data.source === "orchestrator_claim_consistency") throw new FailRunError(thrown.message, { data: {
 						...thrown.data,
@@ -26611,6 +27225,14 @@ function makeOrchestratorWorkflow(goal, opts) {
 			};
 		})();
 		const envelopeRejectedCandidates = rejectedFinishCandidates();
+		const acceptedRepairs = validationDecisions().map((verdict) => verdict.deterministicRepair).filter((repair) => repair !== void 0 && repair.outcome === "accepted");
+		const lastAcceptedRepair = acceptedRepairs.at(-1);
+		const deterministicPatches = lastAcceptedRepair === void 0 ? void 0 : {
+			decisions: acceptedRepairs.length,
+			patches: acceptedRepairs.reduce((sum, repair) => sum + repair.patches.length, 0),
+			lastBeforeHash: lastAcceptedRepair.beforeHash,
+			lastAfterHash: lastAcceptedRepair.afterHash
+		};
 		return {
 			result: synthesizedFinal,
 			completion: decision.completion,
@@ -26618,6 +27240,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			...deliverable.deliverableAccepted === void 0 ? {} : { deliverableAccepted: deliverable.deliverableAccepted },
 			...deliverable.acceptedArtifactRef === void 0 ? {} : { acceptedArtifactRef: deliverable.acceptedArtifactRef },
 			...envelopeRejectedCandidates.length === 0 ? {} : { rejectedFinishCandidates: envelopeRejectedCandidates },
+			...deterministicPatches === void 0 ? {} : { deterministicPatches },
 			childStatusCounts: decision.childStatusCounts,
 			degradedReasons: decision.degradedReasons,
 			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
@@ -26671,9 +27294,9 @@ function makeOrchestratorWorkflow(goal, opts) {
 * Top-level surface: creates a run. `runOptions` are the ordinary
 * engine {@link RunOptions} of the created run; in particular
 * `runOptions.budgetUsd` is the ROOT hard ceiling over the WHOLE tree
-* (the orchestrator and every child), immutable after start, while
-* `opts.budget` only shapes the orchestrator's own sub-account inside
-* that ceiling. The shortcut previously accepted no RunOptions at all,
+* (the orchestrator and every child), immutable within a segment,
+* while `opts.budget` only shapes the orchestrator's own sub-account
+* inside that ceiling. The shortcut previously accepted no RunOptions at all,
 * so the canonical entry point could not set a root ceiling without
 * dropping to `engine.run(makeOrchestratorWorkflow(...))` (v1.18.0
 * review P1-5).
@@ -28604,6 +29227,7 @@ function createEngine(options) {
 		if (opts?.configFingerprint !== void 0) requireConfigFingerprint(opts.configFingerprint, "RunOptions.configFingerprint");
 		if (opts?.clampTurnToExposure !== void 0 && typeof opts.clampTurnToExposure !== "boolean") throw new ConfigError("RunOptions.clampTurnToExposure must be a boolean; got " + JSON.stringify(opts.clampTurnToExposure));
 		if (opts?.strictPricing !== void 0 && typeof opts.strictPricing !== "boolean" && (typeof opts.strictPricing !== "object" || opts.strictPricing === null || Array.isArray(opts.strictPricing))) throw new ConfigError("RunOptions.strictPricing must be a boolean or an options object; got " + JSON.stringify(opts.strictPricing));
+		if (opts?.budgetPolicy !== void 0 && opts.budgetPolicy !== "segment" && opts.budgetPolicy !== "immutable-lifetime") throw new ConfigError("RunOptions.budgetPolicy must be 'segment' or 'immutable-lifetime'; got " + JSON.stringify(opts.budgetPolicy));
 		if (opts?.limits !== void 0) validateUsageLimits(opts.limits, "RunOptions.limits");
 		const deadlineAtMs = opts?.deadlineAt === void 0 ? void 0 : parseDeadlineAt(opts.deadlineAt);
 		const compiled = wf.kind === "compiled-workflow" ? wf : void 0;
@@ -28638,6 +29262,7 @@ function createEngine(options) {
 			...opts.strictPricing.allowUnpriced === void 0 ? {} : { allowUnpriced: [...opts.strictPricing.allowUnpriced] }
 		};
 		const configFingerprint = opts?.configFingerprint ?? resumeCtx?.configFingerprint;
+		const budgetPolicy = opts?.budgetPolicy ?? resumeCtx?.budgetPolicy;
 		const makeBudget = () => new RunBudget({
 			...ceilingUsd === void 0 ? {} : { ceilingUsd },
 			...exposureCapUsd === void 0 ? {} : { maxInFlightExposureUsd: exposureCapUsd },
@@ -28775,6 +29400,7 @@ function createEngine(options) {
 				byModel: /* @__PURE__ */ new Map(),
 				byPhase: /* @__PURE__ */ new Map(),
 				byAgentType: /* @__PURE__ */ new Map(),
+				byScope: /* @__PURE__ */ new Map(),
 				byRole: /* @__PURE__ */ new Map(),
 				unpriced: [],
 				orchestrator: {
@@ -28819,6 +29445,7 @@ function createEngine(options) {
 			...ceilingUsd === void 0 ? {} : { budgetUsd: ceilingUsd },
 			...exposureCapUsd === void 0 ? {} : { maxInFlightExposureUsd: exposureCapUsd },
 			...strictPricing === void 0 ? {} : { strictPricing },
+			...budgetPolicy === "immutable-lifetime" ? { budgetPolicy } : {},
 			...configFingerprint === void 0 ? {} : { configFingerprint },
 			...argsBinding.argsProvided === void 0 ? {} : { argsProvided: argsBinding.argsProvided },
 			...argsBinding.argsHash === void 0 ? {} : { argsHash: argsBinding.argsHash },
@@ -29246,6 +29873,7 @@ function createEngine(options) {
 				...runOverride.budgetUsd === void 0 ? {} : { budgetUsd: runOverride.budgetUsd },
 				...runOverride.maxInFlightExposureUsd === void 0 ? {} : { maxInFlightExposureUsd: runOverride.maxInFlightExposureUsd }
 			};
+			if (budgetOverride !== void 0 && meta?.budgetPolicy === "immutable-lifetime") throw new ConfigError(`run '${runId}' was started with budgetPolicy 'immutable-lifetime': the recorded ceilings are immutable for the whole life of the run and ResumeOptions.run is refused, raising and lowering alike; cancel the run (or start a new one) instead of editing its ceilings`);
 			return run(bound, resumeOptions?.args, void 0, {
 				runId,
 				priorEntries,
@@ -29256,6 +29884,7 @@ function createEngine(options) {
 				...typeof meta?.budgetUsd === "number" ? { budgetUsd: meta.budgetUsd } : {},
 				...typeof meta?.maxInFlightExposureUsd === "number" ? { maxInFlightExposureUsd: meta.maxInFlightExposureUsd } : {},
 				...typeof meta?.strictPricing === "object" && meta.strictPricing !== null ? { strictPricing: meta.strictPricing } : {},
+				...meta?.budgetPolicy === "immutable-lifetime" ? { budgetPolicy: meta.budgetPolicy } : {},
 				segmentsBefore: typeof meta?.segments === "number" && meta.segments > 0 ? Math.floor(meta.segments) : 1,
 				...typeof meta?.argsProvided === "boolean" ? { argsProvided: meta.argsProvided } : {},
 				...typeof meta?.argsHash === "string" ? { argsHash: meta.argsHash } : {},
@@ -29732,4 +30361,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, sectionCitationsValidator, sectionPatternCountValidator, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, parseTerminalEnvelope, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };