@rulvar/core 1.243.0 → 1.244.0

package/dist/index.d.ts

@@ -1194,14 +1194,27 @@ type RunMeta = {
   workflowHash?: string; /** TranscriptStore ref of the persisted CompiledWorkflow source. */
   workflowSourceRef?: string;
   /**
-  * The run's immutable USD ceiling (RunOptions.budgetUsd), recorded so
-  * resume restores the original invocation's bound. Absent when the
-  * run started without a ceiling. Stores must round-trip the field
-  * (the conformance kit checks); a store that drops it degrades a
-  * resumed run to uncapped.
+  * The run's segment-immutable USD ceiling (RunOptions.budgetUsd),
+  * recorded so resume restores the original invocation's bound (only
+  * the explicit, journaled ResumeOptions.run override changes it,
+  * RV2208, by rewriting this field for the run's remaining life).
+  * Absent when the run started without a ceiling. Stores must
+  * round-trip the field (the conformance kit checks); a store that
+  * drops it degrades a resumed run to uncapped.
   */
   budgetUsd?: number;
   /**
+  * The ceiling-override posture (RunOptions.budgetPolicy, RV3902),
+  * recorded at genesis only when 'immutable-lifetime': under it a
+  * resume carrying any ResumeOptions.run override refuses typed
+  * before ownership. Absent means 'segment', the historical
+  * behavior. Stores must round-trip the field (the conformance kit
+  * checks); a store that drops it degrades the run to the 'segment'
+  * posture (the override door works again), never to an invented
+  * refusal.
+  */
+  budgetPolicy?: "immutable-lifetime";
+  /**
   * The opt-in in-flight exposure cap
   * (RunOptions.maxInFlightExposureUsd), recorded at genesis so resume
   * restores the original invocation's cap (RV1504): the option used
@@ -1746,6 +1759,37 @@ interface TerminalEnvelope {
   */
   provenance?: "journal";
 }
+/**
+* The runtime gate over the terminal envelope contract (RV3903, the
+* fourth comparison experiment). `terminalEnvelopeOf` is the ONE
+* producer, but a producer is a compile-time promise, and the envelope
+* crosses trust boundaries the type system never sees: a journal read
+* back after a restart, a plain JS caller, an HTTP body a pipeline
+* gates on. The experiment probed the built dist and the typed copy
+* accepted `status: 'green'`, NaN dollars, and negative counts without
+* a sound; a finance or compliance consumer downstream would have
+* gated a run on fiction.
+*
+* The gate validates the CONTRACT fields and refuses with a typed
+* {@link ConfigError} naming the field and the defect: enum `status`
+* and `completion`, finite nonnegative money (with `totalUsd <=
+* grossUsd`, gross being net plus abandoned by construction), usage
+* and counters, `settledReason` only beside `settled: false`, the
+* `costBasis` and `provenance` literals, boolean `usageApprox`, and
+* the `WireError` shape when an error rides along. Unknown top-level
+* fields pass through untouched: the contract evolves additively, and
+* a parser that refused tomorrow's field would turn every additive
+* release into a wire break. On success the SAME reference comes back,
+* typed: the gate is a boundary check, never a normalizer.
+*
+* Wired where external bytes actually enter: `persistedTerminalEnvelope`
+* runs every journal-rebuilt envelope through it (and refuses typed as
+* `malformed-envelope`), which also covers the server's persisted
+* serving by construction. The live settlement chokepoint stays
+* unparsed on purpose: it is the one producer inside one process, and
+* gating it would add a throw site to settlement itself.
+*/
+declare function parseTerminalEnvelope(value: unknown): TerminalEnvelope;
 //#endregion
 //#region src/l0/spi/isolation.d.ts
 /**
@@ -6156,7 +6200,13 @@ interface TerminationLimits {
   maxDepth: number;
   /** Maximum declared ladder length per the profile-registry snapshot. */
   kMax: number;
-  /** B0; immutable after start, no API including HITL can top up. */
+  /**
+  * B0 as frozen at genesis; no API, HITL included, tops up a live
+  * run. The vector keeps the GENESIS ceiling even when a later
+  * segment's journaled ResumeOptions.run override (RV2208) moved the
+  * enforced bound: the frozen dollars are the termination account's
+  * record, the override decision entry is the budget's.
+  */
   runBudgetUsdCeiling: number;
   /**
   * The resolved orchestrator cap in absolute USD (DEF-7; XF-09),
@@ -6240,8 +6290,9 @@ declare function readTerminationInit(entry: JournalEntry): TerminationInitValue
 /**
 * Config-drift detection at resume: the journaled vector
 * always wins; every differing field is reported for the
-* `termination:config-drift` event. Dynamic budget top-up via restart is
-* excluded by construction.
+* `termination:config-drift` event. Ambient config can never top up a
+* budget through a restart; the one explicit, journaled door is
+* ResumeOptions.run (RV2208), which is a decision entry, not a drift.
 */
 declare function terminationConfigDrift(frozen: TerminationLimits, live: Partial<TerminationLimits>): Array<{
   field: keyof TerminationLimits;
@@ -6482,7 +6533,12 @@ interface BudgetExhaustionDiagnostics {
 * spawn-admission decision entries, M6).
 */
 declare class RunBudget {
-  /** B0; immutable after start. Undefined means no USD ceiling. */
+  /**
+  * B0; immutable within a segment (RV2511): only the explicit,
+  * journaled ResumeOptions.run override (RV2208) changes it, by
+  * opening a new segment, and budgetPolicy 'immutable-lifetime'
+  * (RV3902) refuses even that. Undefined means no USD ceiling.
+  */
   readonly ceilingUsd?: number;
   /**
   * The opt-in in-flight exposure cap (RV711). Undefined means the
@@ -7935,15 +7991,38 @@ interface RunOptions {
   */
   configFingerprint?: string;
   /**
-  * Run ceiling B0; immutable after start. Enforced by projected
-  * admission (a spawn whose reserve does not fit is denied before any
-  * dispatch), the per-turn guard with a budget-derived maxOutputTokens
-  * clamp, and live stream cuts on crossing; the residual
-  * provider-dependent overshoot is bounded by one in-flight turn per
-  * concurrent agent. Contract: https://docs.rulvar.com/guide/budgets.
+  * Run ceiling B0; immutable within a segment (RV2511): no API tops
+  * up a live run's ceiling, and the ONE explicit door after genesis
+  * is the validated, journaled `ResumeOptions.run` override (RV2208),
+  * which takes effect only by opening a new segment. Enforced by
+  * projected admission (a spawn whose reserve does not fit is denied
+  * before any dispatch), the per-turn guard with a budget-derived
+  * maxOutputTokens clamp, and live stream cuts on crossing; the
+  * residual provider-dependent overshoot is bounded by one in-flight
+  * turn per concurrent agent. Under {@link RunOptions.budgetPolicy}
+  * 'immutable-lifetime' even the override door refuses typed.
+  * Contract: https://docs.rulvar.com/guide/budgets.
   */
   budgetUsd?: number;
   /**
+  * The ceiling-override posture of the run's whole life (RV3902, the
+  * fourth comparison experiment). Default 'segment', today's behavior
+  * byte for byte: B0 and the exposure cap are immutable WITHIN a
+  * segment, and the explicit, validated, journaled
+  * `ResumeOptions.run` override (RV2208) may change them by opening a
+  * new segment. 'immutable-lifetime' welds that one door shut: the
+  * posture is recorded in RunMeta at genesis and restored on every
+  * resume, and a resume carrying ANY `ResumeOptions.run` value
+  * refuses with a typed ConfigError BEFORE ownership, meta writes, or
+  * any append, raise and lower alike; no journaled override exists in
+  * this mode, and the emergency lever for a run that must stop
+  * spending is cancel, not a ceiling edit. Degradation is honest: a
+  * store that drops the optional RunMeta field resumes as 'segment'
+  * (the override door works again), never as an invented refusal.
+  * Declared at genesis only; the policy itself has no override.
+  */
+  budgetPolicy?: "segment" | "immutable-lifetime";
+  /**
   * The opt-in in-flight exposure cap (RV711): bounds spent money plus
   * the summed worst-case estimates of live dispatches. The per-turn
   * guard checks money already SPENT, so under `budgetUsd` alone N
@@ -8128,7 +8207,11 @@ interface ResumeOptions {
   * meta, or any append: such a ceiling would exhaust the segment
   * before its first turn and read like a fresh money death. Absent
   * fields keep the recorded values; an absent object keeps the
-  * historical behavior byte for byte.
+  * historical behavior byte for byte. Under a recorded
+  * {@link RunOptions.budgetPolicy} 'immutable-lifetime' (RV3902) any
+  * applying override refuses typed before ownership, raise and lower
+  * alike: the door this field is exists only under the 'segment'
+  * posture.
   */
   run?: {
     budgetUsd?: number;
@@ -8153,7 +8236,9 @@ interface Engine {
   * whose source hash differs from the recorded one is a typed
   * ConfigError (M6-T02). ResumeOptions.run (RV2208) overrides the
   * recorded budget ceilings for the run's remaining life, with a
-  * journaled decision and a typed floor at the settled spend.
+  * journaled decision and a typed floor at the settled spend; under
+  * a recorded budgetPolicy 'immutable-lifetime' (RV3902) any applying
+  * override refuses typed before ownership instead.
   */
   resume<A, R>(runId: string, wf?: Workflow<A, R> | CompiledWorkflow, options?: ResumeOptions): ResumeHandle<R>;
   /**
@@ -10005,6 +10090,27 @@ interface OrchestratorBudgetSpec {
   */
   synthesisReserveUsd?: number;
   /**
+  * The admission posture of the acceptance path (RV3907, the fourth
+  * comparison experiment). Preflight has long PRICED the tail and
+  * warned (`reserve-line-headroom`, `orchestrator-working-room`), and
+  * the experiment's run started anyway, with the warnings on record
+  * and the acceptance machinery funded by luck. 'warn' (default)
+  * keeps exactly that: findings in preflight, nothing at runtime.
+  * 'require' turns the arithmetic into a boot refusal BEFORE the
+  * first wire: the effective cap must cover, at exact fill or
+  * better, the DECLARED acceptance tail (the held
+  * `synthesisReserveUsd`, the claim judge's `judge.estCost` times
+  * one plus the armed semantic repair round, the declared
+  * `finishValidation.estRepairCostUsd`, and the armed round's
+  * declared `synthesis.estCost` composition floor) plus one
+  * coordination turn floor of working room. Undeclared estimates
+  * contribute zero, so the gate binds exactly what the host
+  * declared; the refusal journals an `acceptance_reserve_refused`
+  * decision naming every term and throws the typed
+  * OrchestratorCapConfigError with the same arithmetic.
+  */
+  acceptanceReserve?: "warn" | "require";
+  /**
   * A positive integer, validated before any journal entry or dispatch:
   * the turn limit of the reserved final wake.
   */
@@ -10936,6 +11042,35 @@ interface OrchestrateClaimConsistencyMeta {
   * the synthesis rewrote what the judge cleared.
   */
   judgedHash: string;
+  /**
+  * How many judge passes this stage's verdict lineage ran (RV3904,
+  * the fourth comparison experiment): present exactly when the
+  * bounded claim repair round is armed (`onFound: 'repair'`), so a
+  * consumer reading `findings: 0` can tell a clean FIRST verdict
+  * (`passes: 1`) from a verdict earned through a repair
+  * (`passes: 2`, the meta above always describing the LAST pass).
+  * The experiment's terminal read findings 0 over a lineage whose
+  * first pass had caught a real contradiction, and only the journal
+  * could say so. Absent on journals and configs from before the
+  * field, and absent when no repair round is armed: NOT RECORDED,
+  * never a claim of a single pass.
+  */
+  passes?: number;
+  /**
+  * The findings count of the FIRST pass of this stage (RV3904),
+  * present exactly when `passes` exceeds 1: what the repair round
+  * consumed, so "zero findings after one round over one first-pass
+  * finding" reads off the envelope instead of the journal.
+  */
+  firstPassFindings?: number;
+  /**
+  * Bounded semantic repair rounds actually dispatched at this stage
+  * (RV3904); today 0 or 1, the evidence-grade precedent. Distinct
+  * from the finish validation's mechanical `repairsUsed`, which
+  * counts model repair turns INSIDE one invocation and keeps its
+  * byte contract untouched.
+  */
+  semanticRepairRounds?: number;
 }
 /**
 * How the shipped artifact relates to the draft the run composed it
@@ -10956,6 +11091,26 @@ interface OrchestrateDraftToFinal {
   claimsJudgedOn?: "draft" | "final" | "both";
 }
 /**
+* The deterministic-repair aggregate of the shipped run (RV3904, the
+* fourth comparison experiment): the patches themselves stay on the
+* journaled finish-validation decisions (RV3801, byte-exact with
+* before/after hashes per decision); the acceptance envelope carries
+* the aggregate, so "was the shipped document machine-patched, and
+* from what bytes" is an envelope read instead of a journal walk.
+* Present exactly when at least one ACCEPTED deterministic repair
+* exists; every other envelope stays byte identical.
+*/
+interface OrchestrateDeterministicPatches {
+  /** Finish decisions whose deterministic repair was accepted. */
+  decisions: number;
+  /** Total individual patches across those decisions. */
+  patches: number;
+  /** The LAST accepted repair's canonical pre-patch hash. */
+  lastBeforeHash: string;
+  /** The LAST accepted repair's canonical post-patch hash; the judge rules on these bytes. */
+  lastAfterHash: string;
+}
+/**
 * The synthesis invocation's own knobs (RV-211). Everything else about
 * the invocation is deterministic: the prompt derives from the journaled
 * draft and the settled child digest, the toolset is the single finish
@@ -11280,9 +11435,9 @@ declare function makeOrchestratorWorkflow(goal: string, opts?: OrchestrateOption
 * Top-level surface: creates a run. `runOptions` are the ordinary
 * engine {@link RunOptions} of the created run; in particular
 * `runOptions.budgetUsd` is the ROOT hard ceiling over the WHOLE tree
-* (the orchestrator and every child), immutable after start, while
-* `opts.budget` only shapes the orchestrator's own sub-account inside
-* that ceiling. The shortcut previously accepted no RunOptions at all,
+* (the orchestrator and every child), immutable within a segment,
+* while `opts.budget` only shapes the orchestrator's own sub-account
+* inside that ceiling. The shortcut previously accepted no RunOptions at all,
 * so the canonical entry point could not set a root ceiling without
 * dropping to `engine.run(makeOrchestratorWorkflow(...))` (v1.18.0
 * review P1-5).
@@ -12209,7 +12364,14 @@ interface CostReport {
   * phase, or an EMPTY phase, folds under the named 'unknown' bucket
   * (RV3604): a '' key is unaddressable in every downstream table,
   * and the third comparison run's report read `byPhase {"": 5.58}`
-  * for the whole run.
+  * for the whole run. In dynamic runs the orchestrator's own stages
+  * name their dispatches since RV3905 ('fan-out' children,
+  * 'coordination' loop turns and the forced-finish wake,
+  * 'composition' synthesis and incremental notes, 'judge' claim
+  * passes, 'repair' the bounded claim repair round), filling only
+  * the vacuum: an explicit host ctx.phase around the orchestration
+  * keeps its own bucket. The fourth comparison run's report read
+  * byPhase 100% 'unknown' over stages the journal held apart.
   */
   byPhase: Record<string, number>;
   /** Spawn agentType names; absent and empty fold under 'unknown' (RV3604). */
@@ -14258,6 +14420,25 @@ interface InvoiceRow {
   entrySeq: number;
   scope: string;
   key: string;
+  /**
+  * The spawn's agent type from the terminal's cost attribution
+  * (RV3906, the fourth comparison experiment): in dynamic runs the
+  * scope grammar nests every orchestrator spawn under one
+  * `agent:<seq>` bucket, so per-child money used to require a join
+  * through the journal; the row now names the profile directly.
+  * Additive and policy, never identity: absent on entries journaled
+  * before cost attribution shipped, on empty attributions, and on
+  * every pre-RV3906 export byte, so old journals and old consumers
+  * read exactly what they always read.
+  */
+  agentType?: string;
+  /**
+  * The dispatch label from the same attribution (RV2803 journaled
+  * it; RV3906 lifts it onto the row), what tells two spans of one
+  * role apart without a journal join. Absent on unlabelled
+  * dispatches, additive exactly like `agentType`.
+  */
+  label?: string;
   /** The call's dispatch ordinal within its invocation; remainder and slice rows continue past it. */
   ordinal: number;
   servedBy: ModelRef;
@@ -14816,9 +14997,15 @@ declare function statementRowsFromDelimited(text: string, options?: DelimitedSta
 * a stale settle), which is exactly the evidence `auditRun` derives a
 * non-terminal status from. `unknown-workflow`: nothing names the
 * workflow the terminal belongs to, and an envelope that invented one
-* would be a lie on its most-read field.
-*/
-type PersistedTerminalRefusal = "unsettled" | "not-terminal" | "unknown-workflow";
+* would be a lie on its most-read field. `malformed-envelope` (RV3903):
+* the rebuilt envelope failed the runtime contract gate
+* (`parseTerminalEnvelope`), which means the journal bytes this fold
+* read produced values the terminal contract forbids (NaN money, a
+* negative counter, an unknown status literal); the reconstruction is
+* withheld typed instead of served green, and the message names the
+* field and the defect.
+*/
+type PersistedTerminalRefusal = "unsettled" | "not-terminal" | "unknown-workflow" | "malformed-envelope";
 /** The reconstruction verdict: an envelope, or a typed refusal. */
 type PersistedTerminalResult = {
   available: true;
@@ -16165,4 +16352,4 @@ interface SandboxBridge {
 declare const SANDBOX_AGENT_OPT_KEYS: readonly string[];
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, AcceptanceChildSummary, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentProfileTemplateOptions, AgentResult, AgentResultMeta, AgentStatus, type AppliedPricingRow, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditCategory, AuditRecord, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BillingComponent, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CachePolicy, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildExecutionFacts, ChildIdentityInput, ChildResultPage, ChildrenAtFailure, CitationTarget, type ClaimClass, ClaimContradictionFinding, ClaimCoverageGrade, ClaimCoverageInput, type ClaimOp, ClaimPair, ClaimPairOptions, ClaimPairsFold, ClaimPoolReading, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ComponentDelta, ConfigError, Contradiction, ContradictionClaim, ContradictionOptions, ContradictionSource, type CoreEvents, CostAttribution, CostAttributionFacts, type CostBasis, CostReport, CreateEngineOptions, type CriticalPath, Ctx, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DataKeyProvider, DebitResult, DecisionChainRow, DeclaredLadder, DedupIndex, DedupNote, DedupedClaims, DelimitedStatementOptions, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DocumentedRates, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EngineQuotaConfig, EngineQuotaRuntime, EntryBillingFold, EntryBillingUnit, EntryKind, EntryRef, EntryStatus, EnvelopeEncryption, EnvelopeEncryptionOptions, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, EvidenceContract, type EvidenceRef, type ExecKeyDerivation, type ExecutorRegistry, type ExplorationSummary, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FencedCodeMode, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, type FinalizationWindowBudget, FinishContract, FinishContractCitations, FinishContractGoldenReject, FinishContractManifest, FinishContractSectionPattern, FinishInfo, FinishRepairHint, FinishSelfTestFailure, FinishSelfTestFixtures, FinishSelfTestReport, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, IncrementalSynthesisResult, InvalidResolutionError, InvocationRole, type InvocationTable, InvoiceCardinality, InvoiceExport, InvoicePricingProvenance, InvoiceReconciliation, InvoiceRow, type IsolatedExecContext, type IsolatedExecRequest, type IsolatedExecutorTag, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JOURNAL_ENVELOPE_MARKER, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, type JournalPricingSnapshot, JournalSealedError, JournalSerializationContext, JournalSerializationHook, type JournalStore, JournaledChild, JournaledChildRoster, JournaledCriticalPath, JournaledPostFanIn, JournaledSynthesisCandidate, JournaledSynthesisCandidateReport, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalRunTelemetry, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, MemoryQuotaLimiter, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateClaimConsistency, OrchestrateClaimConsistencyMeta, OrchestrateContradictions, OrchestrateContradictionsMeta, OrchestrateDraftToFinal, OrchestrateOptions, OrchestrateSynthesis, OrchestrateSynthesisSkipReason, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, OutputContractManifest, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PersistedTerminalRefusal, PersistedTerminalResult, type PhaseRow, PhaseTarget, PilotAgentProfileOptions, PilotAgentProfileResult, type PinnedPricingSegment, PipelineCollected, PipelineOpts, PlanInvariantError, type PostFanInBreakdown, PreflightAdmissionRow, PreflightFinding, PreflightInput, PreflightOrchestratorSpec, PreflightReport, PreflightSpawnReport, PreflightSpawnSpec, PreflightToolCeiling, PriceTable, PricedComponent, PricedComponents, PricedUsage, type Pricing, type PricingTier, ProgressReport, type ProviderAdapter, ProviderCallRecord, ProviderStatement, QUOTA_WINDOW_MS, QualityFloors, QuotaCounters, type QuotaDecision, type QuotaEstimate, type QuotaLimiter, type QuotaReservationRequest, QuotaRule, QuotaWindowSnapshot, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, RateLimitObservation, ReconcileOptions, ReconcileResult, ReconcileStatementOptions, RefEntryAppender, RefEntryClassification, RefusalInfo, RejectedFinishCandidate, RepeatedClaim, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, RepositoryResearchToolset, RepositoryResearchToolsetOptions, ResearchAgentProfileOptions, ResearchAgentProfileResult, ResearchEvidenceEntry, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, RunExport, RunFactPairOptions, RunFactPairsFold, RunFactsSheet, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, SecretMasker, SectionMatchMode, SectionPatternEntry, SectionalRoundPlan, SemanticPassSummary, SemanticPassesSummary, Semaphore, SerializationHook, Settled, SettlementError, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StatementCategoryRow, StatementColumnMap, StatementCoverage, StatementReconciliation, StatementRequestRow, StepIdentityInput, type StreamHooks, StructuredOutputTier, SupersededError, SuspendedAppend, SuspensionState, SynthesisCandidateFailure, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TelemetryScope, type TerminalEnvelope, TerminalOutcomeFacts, TerminalPatch, TerminalTelemetryScopes, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolAuthority, type ToolBudgetSummary, ToolCalibrationExclusion, ToolCalibrationReport, ToolCalibrationRow, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, type ToolExecutorProvider, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, ToolsetAttestation, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, AcceptanceChildSummary, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentProfileTemplateOptions, AgentResult, AgentResultMeta, AgentStatus, type AppliedPricingRow, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditCategory, AuditRecord, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BillingComponent, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CachePolicy, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildExecutionFacts, ChildIdentityInput, ChildResultPage, ChildrenAtFailure, CitationTarget, type ClaimClass, ClaimContradictionFinding, ClaimCoverageGrade, ClaimCoverageInput, type ClaimOp, ClaimPair, ClaimPairOptions, ClaimPairsFold, ClaimPoolReading, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ComponentDelta, ConfigError, Contradiction, ContradictionClaim, ContradictionOptions, ContradictionSource, type CoreEvents, CostAttribution, CostAttributionFacts, type CostBasis, CostReport, CreateEngineOptions, type CriticalPath, Ctx, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DataKeyProvider, DebitResult, DecisionChainRow, DeclaredLadder, DedupIndex, DedupNote, DedupedClaims, DelimitedStatementOptions, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DocumentedRates, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EngineQuotaConfig, EngineQuotaRuntime, EntryBillingFold, EntryBillingUnit, EntryKind, EntryRef, EntryStatus, EnvelopeEncryption, EnvelopeEncryptionOptions, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, EvidenceContract, type EvidenceRef, type ExecKeyDerivation, type ExecutorRegistry, type ExplorationSummary, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FencedCodeMode, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, type FinalizationWindowBudget, FinishContract, FinishContractCitations, FinishContractGoldenReject, FinishContractManifest, FinishContractSectionPattern, FinishInfo, FinishRepairHint, FinishSelfTestFailure, FinishSelfTestFixtures, FinishSelfTestReport, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, IncrementalSynthesisResult, InvalidResolutionError, InvocationRole, type InvocationTable, InvoiceCardinality, InvoiceExport, InvoicePricingProvenance, InvoiceReconciliation, InvoiceRow, type IsolatedExecContext, type IsolatedExecRequest, type IsolatedExecutorTag, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JOURNAL_ENVELOPE_MARKER, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, type JournalPricingSnapshot, JournalSealedError, JournalSerializationContext, JournalSerializationHook, type JournalStore, JournaledChild, JournaledChildRoster, JournaledCriticalPath, JournaledPostFanIn, JournaledSynthesisCandidate, JournaledSynthesisCandidateReport, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalRunTelemetry, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, MemoryQuotaLimiter, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateClaimConsistency, OrchestrateClaimConsistencyMeta, OrchestrateContradictions, OrchestrateContradictionsMeta, OrchestrateDeterministicPatches, OrchestrateDraftToFinal, OrchestrateOptions, OrchestrateSynthesis, OrchestrateSynthesisSkipReason, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, OutputContractManifest, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PersistedTerminalRefusal, PersistedTerminalResult, type PhaseRow, PhaseTarget, PilotAgentProfileOptions, PilotAgentProfileResult, type PinnedPricingSegment, PipelineCollected, PipelineOpts, PlanInvariantError, type PostFanInBreakdown, PreflightAdmissionRow, PreflightFinding, PreflightInput, PreflightOrchestratorSpec, PreflightReport, PreflightSpawnReport, PreflightSpawnSpec, PreflightToolCeiling, PriceTable, PricedComponent, PricedComponents, PricedUsage, type Pricing, type PricingTier, ProgressReport, type ProviderAdapter, ProviderCallRecord, ProviderStatement, QUOTA_WINDOW_MS, QualityFloors, QuotaCounters, type QuotaDecision, type QuotaEstimate, type QuotaLimiter, type QuotaReservationRequest, QuotaRule, QuotaWindowSnapshot, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, RateLimitObservation, ReconcileOptions, ReconcileResult, ReconcileStatementOptions, RefEntryAppender, RefEntryClassification, RefusalInfo, RejectedFinishCandidate, RepeatedClaim, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, RepositoryResearchToolset, RepositoryResearchToolsetOptions, ResearchAgentProfileOptions, ResearchAgentProfileResult, ResearchEvidenceEntry, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, RunExport, RunFactPairOptions, RunFactPairsFold, RunFactsSheet, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, SecretMasker, SectionMatchMode, SectionPatternEntry, SectionalRoundPlan, SemanticPassSummary, SemanticPassesSummary, Semaphore, SerializationHook, Settled, SettlementError, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StatementCategoryRow, StatementColumnMap, StatementCoverage, StatementReconciliation, StatementRequestRow, StepIdentityInput, type StreamHooks, StructuredOutputTier, SupersededError, SuspendedAppend, SuspensionState, SynthesisCandidateFailure, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TelemetryScope, type TerminalEnvelope, TerminalOutcomeFacts, TerminalPatch, TerminalTelemetryScopes, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolAuthority, type ToolBudgetSummary, ToolCalibrationExclusion, ToolCalibrationReport, ToolCalibrationRow, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, type ToolExecutorProvider, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, ToolsetAttestation, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, parseTerminalEnvelope, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/dist/index.js

@@ -1310,6 +1310,146 @@ function sanitizeTerminalText(text) {
 	return text.replace(ESC_STRING_SEQUENCE, "").replace(ESC_CSI_SEQUENCE, "").replace(CONTROL_RUN, " ");
 }
 //#endregion
+//#region src/l0/terminal-envelope.ts
+/**
+* The unified terminal envelope (RV1105, the P1-5 arc): ONE shape
+* carrying every fact of a run's terminal, assembled once at the
+* engine's settlement chokepoint and mirrored verbatim onto the
+* resolved outcome (`outcome.envelope`), the `run:end` event
+* (`event.envelope`), and through them the HTTP outcome response and
+* the OTel run attributes. An SDK consumer, an event-only consumer,
+* and an HTTP consumer read the SAME set of facts without assembling
+* pieces from surface-specific fields; nothing pre-existing was
+* renamed or removed, the envelope is an assembly over it.
+*
+* Doctrine notes:
+* - `status` is the computation's verdict; `settled` says whether
+*   anything durable records it (RV907). A resolved outcome always
+*   carries `settled: true`, because an unsettled terminal REJECTS
+*   `handle.result` typed instead of resolving; the `settled: false`
+*   envelopes exist only on the event stream, where `settledReason:
+*   'superseded'` distinguishes the fenced-out segment (RV1009) from
+*   a settlement write fault.
+* - `usageApprox` is normalized to a boolean here (the run:end field
+*   keeps its absent-means-exact byte contract): `true` means some
+*   priced usage was approximate, so `totalUsd` is a lower bound.
+* - `costByModel` is a detached copy of the settled fold's per-model
+*   split; mutating it never touches the cost report. Since RV1213
+*   `error` is detached the same way, `data` nesting included, so the
+*   whole envelope is a reading a consumer may annotate freely.
+*
+* Docs: https://docs.rulvar.com/guide/observability
+*/
+const ENVELOPE_STATUSES = /* @__PURE__ */ new Set([
+	"ok",
+	"error",
+	"cancelled",
+	"exhausted",
+	"suspended"
+]);
+const ENVELOPE_COMPLETIONS = /* @__PURE__ */ new Set([
+	"complete",
+	"partial",
+	"rejected"
+]);
+function refuseEnvelope(field, requirement, got) {
+	throw new ConfigError(`terminal envelope ${field} must be ${requirement}; got ${typeof got === "number" ? String(got) : JSON.stringify(got) ?? String(got)}`);
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireMoney(value, field) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) refuseEnvelope(field, "a finite nonnegative number", value);
+	return value;
+}
+function requireCount$1(value, field) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) refuseEnvelope(field, "a nonnegative integer", value);
+}
+function requireBoolean(value, field) {
+	if (typeof value !== "boolean") refuseEnvelope(field, "a boolean", value);
+}
+function requireNonEmptyString(value, field) {
+	if (typeof value !== "string" || value.length === 0) refuseEnvelope(field, "a non-empty string", value);
+}
+/** Every numeric leaf of the usage subtree: finite and nonnegative. */
+function requireUsageNumbers(node, path) {
+	if (typeof node === "number") {
+		if (!Number.isFinite(node) || node < 0) refuseEnvelope(path, "a finite nonnegative number", node);
+		return;
+	}
+	if (isPlainObject(node)) {
+		for (const [key, item] of Object.entries(node)) requireUsageNumbers(item, `${path}.${key}`);
+		return;
+	}
+	refuseEnvelope(path, "a number or a nested usage object", node);
+}
+/**
+* The runtime gate over the terminal envelope contract (RV3903, the
+* fourth comparison experiment). `terminalEnvelopeOf` is the ONE
+* producer, but a producer is a compile-time promise, and the envelope
+* crosses trust boundaries the type system never sees: a journal read
+* back after a restart, a plain JS caller, an HTTP body a pipeline
+* gates on. The experiment probed the built dist and the typed copy
+* accepted `status: 'green'`, NaN dollars, and negative counts without
+* a sound; a finance or compliance consumer downstream would have
+* gated a run on fiction.
+*
+* The gate validates the CONTRACT fields and refuses with a typed
+* {@link ConfigError} naming the field and the defect: enum `status`
+* and `completion`, finite nonnegative money (with `totalUsd <=
+* grossUsd`, gross being net plus abandoned by construction), usage
+* and counters, `settledReason` only beside `settled: false`, the
+* `costBasis` and `provenance` literals, boolean `usageApprox`, and
+* the `WireError` shape when an error rides along. Unknown top-level
+* fields pass through untouched: the contract evolves additively, and
+* a parser that refused tomorrow's field would turn every additive
+* release into a wire break. On success the SAME reference comes back,
+* typed: the gate is a boundary check, never a normalizer.
+*
+* Wired where external bytes actually enter: `persistedTerminalEnvelope`
+* runs every journal-rebuilt envelope through it (and refuses typed as
+* `malformed-envelope`), which also covers the server's persisted
+* serving by construction. The live settlement chokepoint stays
+* unparsed on purpose: it is the one producer inside one process, and
+* gating it would add a throw site to settlement itself.
+*/
+function parseTerminalEnvelope(value) {
+	if (!isPlainObject(value)) refuseEnvelope("value", "an object", value);
+	requireNonEmptyString(value.runId, "runId");
+	requireNonEmptyString(value.workflow, "workflow");
+	if (typeof value.status !== "string" || !ENVELOPE_STATUSES.has(value.status)) refuseEnvelope("status", "one of 'ok' | 'error' | 'cancelled' | 'exhausted' | 'suspended'", value.status);
+	requireBoolean(value.settled, "settled");
+	if (value.settledReason !== void 0) {
+		if (value.settledReason !== "superseded") refuseEnvelope("settledReason", "the literal 'superseded' when present", value.settledReason);
+		if (value.settled !== false) refuseEnvelope("settledReason", "present only beside settled: false (a settled terminal has no supersession to explain)", value.settledReason);
+	}
+	const totalUsd = requireMoney(value.totalUsd, "totalUsd");
+	const grossUsd = requireMoney(value.grossUsd, "grossUsd");
+	if (totalUsd > grossUsd) refuseEnvelope("totalUsd", `at most grossUsd (${String(grossUsd)}): gross is the net fold plus abandoned spend`, totalUsd);
+	if (value.costBasis !== "locally-estimated") refuseEnvelope("costBasis", "the literal 'locally-estimated'", value.costBasis);
+	if (!isPlainObject(value.costByModel)) refuseEnvelope("costByModel", "an object of per-model dollars", value.costByModel);
+	for (const [model, usd] of Object.entries(value.costByModel)) requireMoney(usd, `costByModel['${model}']`);
+	if (value.wireRequests !== void 0) requireCount$1(value.wireRequests, "wireRequests");
+	if (!isPlainObject(value.usage)) refuseEnvelope("usage", "a usage object", value.usage);
+	requireUsageNumbers(value.usage, "usage");
+	requireBoolean(value.usageApprox, "usageApprox");
+	requireCount$1(value.agentsSpawned, "agentsSpawned");
+	if (value.completion !== void 0 && (typeof value.completion !== "string" || !ENVELOPE_COMPLETIONS.has(value.completion))) refuseEnvelope("completion", "one of 'complete' | 'partial' | 'rejected' when present", value.completion);
+	if (value.error !== void 0) {
+		if (!isPlainObject(value.error)) refuseEnvelope("error", "a typed wire error object when present", value.error);
+		requireNonEmptyString(value.error.code, "error.code");
+		if (typeof value.error.message !== "string") refuseEnvelope("error.message", "a string", value.error.message);
+		requireBoolean(value.error.retryable, "error.retryable");
+	}
+	if (value.deliverableAccepted !== void 0) requireBoolean(value.deliverableAccepted, "deliverableAccepted");
+	if (value.resultAvailable !== void 0) requireBoolean(value.resultAvailable, "resultAvailable");
+	if (value.acceptedArtifactRef !== void 0) requireCount$1(value.acceptedArtifactRef, "acceptedArtifactRef");
+	if (value.claimConsistencyMeta !== void 0 && !isPlainObject(value.claimConsistencyMeta)) refuseEnvelope("claimConsistencyMeta", "an object when present", value.claimConsistencyMeta);
+	if (value.configFingerprint !== void 0) requireNonEmptyString(value.configFingerprint, "configFingerprint");
+	if (value.provenance !== void 0 && value.provenance !== "journal") refuseEnvelope("provenance", "the literal 'journal' when present", value.provenance);
+	return value;
+}
+//#endregion
 //#region src/engine/terminal-envelope.ts
 /**
 * A total copy of one typed error (RV1213). `data` is `Json` by the
@@ -6198,8 +6338,12 @@ var LineageIndex = class {
 * exclusively DEBIT-ONLY API and a limits vector frozen at start in the
 * `termination.init` entry, plus the variant function Phi. No credit
 * operation exists anywhere by construction; no journal entry kind
-* carries credit; B0 is immutable after start and no API, including
-* HITL, can top it up. Every debit is atomic with the append of its
+* carries credit; B0 is immutable within a segment and no API,
+* including HITL, tops up a live run (the one explicit door is the
+* journaled ResumeOptions.run override at resume, RV2208, refused
+* outright under budgetPolicy 'immutable-lifetime', RV3902; the
+* frozen vector below keeps the GENESIS ceiling either way). Every
+* debit is atomic with the append of its
 * carrying decision entry and embeds the balance-after; an underflow
 * writes `termination.denied` strictly BEFORE the typed error surfaces.
 *
@@ -6303,8 +6447,9 @@ function readTerminationInit(entry) {
 /**
 * Config-drift detection at resume: the journaled vector
 * always wins; every differing field is reported for the
-* `termination:config-drift` event. Dynamic budget top-up via restart is
-* excluded by construction.
+* `termination:config-drift` event. Ambient config can never top up a
+* budget through a restart; the one explicit, journaled door is
+* ResumeOptions.run (RV2208), which is a decision entry, not a drift.
 */
 function terminationConfigDrift(frozen, live) {
 	const drift = [];
@@ -14207,7 +14352,17 @@ async function runAgent(options) {
 			output = outcome.turn.text;
 			break;
 		}
-		if (separateExtract) break;
+		if (separateExtract) {
+			const rideAlong = extractCandidate(outcome.turn, rideTierFor(servedTarget));
+			if (rideAlong !== void 0) {
+				const validation = await validateSchemaSpec(options.schema, rideAlong.raw);
+				if (validation.valid) {
+					output = validation.value;
+					break;
+				}
+			}
+			break;
+		}
 		const candidate = extractCandidate(outcome.turn, rideTierFor(servedTarget));
 		const issues = [];
 		if (candidate !== void 0) {
@@ -14496,7 +14651,7 @@ async function runAgent(options) {
 		}
 		endPhase(finalizePhase, phaseOutcome(), finalizeServed);
 	}
-	if (status === "ok" && !finishedViaTool && separateExtract && options.extract !== void 0 && options.schema !== void 0) {
+	if (status === "ok" && !finishedViaTool && separateExtract && output === null && options.extract !== void 0 && options.schema !== void 0) {
 		const extractResolved = options.extract.resolved;
 		const extractPhase = beginPhase("extract", extractResolved.ref);
 		let extractServed;
@@ -14541,6 +14696,7 @@ async function runAgent(options) {
 							toolChoice: "none"
 						};
 						req = applyStructuredOutputTier(req, targetTier, options.canonicalSchema ?? {});
+						req = applyCachePolicy(req, target, options.cache);
 						return applyOutputBudget(req, target, options.budget);
 					},
 					streamOptionsFor: (target) => {
@@ -14723,7 +14879,10 @@ async function runAgent(options) {
 * false). The one thing that can change it is `ResumeOptions.run`, an
 * explicit host decision journaled as its own decision entry, and it
 * takes effect only by opening a NEW segment: a live run can never
-* raise the bound it is already being measured against.
+* raise the bound it is already being measured against. Under
+* RunOptions.budgetPolicy 'immutable-lifetime' (RV3902) even that door
+* refuses typed before ownership, and the recorded ceilings hold for
+* the run's whole life.
 *
 * The account tree: the run root plus one
 * sub-account per admitted child workflow (and, from M7, the orchestrator
@@ -14821,7 +14980,12 @@ function admissionReserveUsd(options) {
 * spawn-admission decision entries, M6).
 */
 var RunBudget = class {
-	/** B0; immutable after start. Undefined means no USD ceiling. */
+	/**
+	* B0; immutable within a segment (RV2511): only the explicit,
+	* journaled ResumeOptions.run override (RV2208) changes it, by
+	* opening a new segment, and budgetPolicy 'immutable-lifetime'
+	* (RV3902) refuses even that. Undefined means no USD ceiling.
+	*/
 	ceilingUsd;
 	/**
 	* The opt-in in-flight exposure cap (RV711). Undefined means the
@@ -16215,10 +16379,13 @@ function invoiceFromJournal(entries, priceUsd, options) {
 		const billing = priceEntryBilling(entry, priceUsd);
 		if (!billing.fullyAttributed) everyEntryFullyAttributed = false;
 		const abandoned = entry.kind !== "resolution" && entry.kind !== "abandon" && abandonFold.isAbandoned(entry.ref ?? entry.seq);
+		const attribution = entry.costAttribution;
 		const base = {
 			entrySeq: entry.seq,
 			scope: entry.scope,
-			key: entry.key
+			key: entry.key,
+			...attribution?.agentType === void 0 || attribution.agentType === "" ? {} : { agentType: attribution.agentType },
+			...attribution?.label === void 0 ? {} : { label: attribution.label }
 		};
 		const mark = abandoned ? { abandoned: true } : {};
 		const records = entry.providerCalls ?? [];
@@ -16956,7 +17123,8 @@ function statementRowsFromDelimited(text, options) {
 const REFUSAL_MESSAGES = {
 	unsettled: "no run settle is journaled for this run: nothing durable records a terminal",
 	"not-terminal": "the journaled run settle records a running segment, not a terminal",
-	"unknown-workflow": "no stored metadata names the workflow this run belongs to"
+	"unknown-workflow": "no stored metadata names the workflow this run belongs to",
+	"malformed-envelope": "the rebuilt envelope failed the runtime terminal contract gate: the journal bytes produced values the contract forbids"
 };
 /** Every envelope status; a settle may also record the non-terminal 'running'. */
 const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
@@ -16988,10 +17156,18 @@ function persistedTerminalEnvelope(input) {
 	if (tail > 0) return refuse("not-terminal", `the journal continued ${String(tail)} entr${tail === 1 ? "y" : "ies"} past the settle at seq ${String(settle.seq)}: the latest segment is not settled`);
 	const workflow = input.meta?.workflowName;
 	if (workflow === void 0) return refuse("unknown-workflow");
+	try {
+		return assemble(input, workflow, settle);
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		return refuse("malformed-envelope", `${REFUSAL_MESSAGES["malformed-envelope"]}: ${detail}`);
+	}
+}
+function assemble(input, workflow, settle) {
 	const ledger = foldLedger(input.entries, buildAbandonFold(input.entries));
 	return {
 		available: true,
-		envelope: terminalEnvelopeOf({
+		envelope: parseTerminalEnvelope(terminalEnvelopeOf({
 			runId: input.runId,
 			workflow,
 			outcome: {
@@ -17007,7 +17183,7 @@ function persistedTerminalEnvelope(input) {
 			agentsSpawned: ledger.agentsSpawned,
 			...input.meta?.configFingerprint === void 0 ? {} : { configFingerprint: input.meta.configFingerprint },
 			provenance: "journal"
-		})
+		}))
 	};
 }
 //#endregion
@@ -23337,6 +23513,7 @@ function validateOrchestrateOptions(opts) {
 		if (opts.synthesis.mode === "incremental") throw new ConfigError("orchestrate budget.synthesisReserveUsd is incompatible with synthesis.mode 'incremental': the reserve protects the single post-fan-in invocation");
 	}
 	if (spec.finalizeTurns !== void 0) requirePositiveInteger$2(spec.finalizeTurns, "orchestrate budget.finalizeTurns");
+	if (spec.acceptanceReserve !== void 0 && spec.acceptanceReserve !== "warn" && spec.acceptanceReserve !== "require") throw new ConfigError(`orchestrate budget.acceptanceReserve must be 'warn' or 'require'; got ${String(spec.acceptanceReserve)}`);
 	if (spec.atCap !== void 0 && spec.atCap !== "finish-with-partial" && spec.atCap !== "fail-run") throw new ConfigError(`orchestrate budget.atCap must be 'finish-with-partial' or 'fail-run'; got ${String(spec.atCap)}`);
 }
 function orchestratorPrompt(goal, maxSpawns, extensionLines) {
@@ -23534,6 +23711,42 @@ function makeOrchestratorWorkflow(goal, opts) {
 				};
 			}
 		}
+		if (opts?.budget?.acceptanceReserve === "require") {
+			const synthesisHoldUsd = opts.budget.synthesisReserveUsd ?? 0;
+			const judgeEstUsd = opts?.claimConsistency?.judge?.estCost ?? 0;
+			const bootClaimStage = opts?.claimConsistency?.stage ?? "draft";
+			const roundArmed = (opts?.claimConsistency?.onFound ?? "report") === "repair" && bootClaimStage !== "draft";
+			const judgePasses = 1 + (roundArmed ? 1 : 0);
+			const judgeTailUsd = judgeEstUsd * judgePasses;
+			const mechanicalRepairUsd = opts?.finishValidation?.estRepairCostUsd ?? 0;
+			const roundCompositionUsd = roundArmed ? opts?.synthesis?.estCost ?? 0 : 0;
+			const workingRoomUsd = capState?.turnEstimateUsd ?? internals.flatReserveUsd ?? .5;
+			const requiredUsd = synthesisHoldUsd + judgeTailUsd + mechanicalRepairUsd + roundCompositionUsd + workingRoomUsd;
+			const capUsd = capState?.effectiveCapUsd;
+			if (capUsd === void 0 || capUsd < requiredUsd) {
+				const terms = `synthesisReserveUsd ${synthesisHoldUsd.toFixed(4)} + judge ${judgeEstUsd.toFixed(4)} x ${String(judgePasses)} pass(es) + estRepairCostUsd ${mechanicalRepairUsd.toFixed(4)} + round composition ${roundCompositionUsd.toFixed(4)} + working room ${workingRoomUsd.toFixed(4)} = ${requiredUsd.toFixed(4)} USD`;
+				await internals.replayer.appendSinglePhase({
+					scope: callingState.scope,
+					key: deriverV2.deriveKey({ kind: "acceptance-reserve-refused" }),
+					kind: "decision",
+					status: "ok",
+					spanId: internals.spans.mint(callingState.spanId),
+					site: "orchestrator-budget",
+					value: {
+						decisionType: "acceptance_reserve_refused",
+						requiredUsd,
+						effectiveCapUsd: capUsd ?? null,
+						synthesisReserveUsd: synthesisHoldUsd,
+						judgeEstUsd,
+						judgePasses,
+						estRepairCostUsd: mechanicalRepairUsd,
+						roundCompositionUsd,
+						workingRoomUsd
+					}
+				});
+				throw new OrchestratorCapConfigError(capUsd === void 0 ? `budget.acceptanceReserve 'require' needs a resolved effective cap to hold the declared acceptance tail against (${terms}); declare budget.capUsd or a run ceiling` : `budget.acceptanceReserve 'require': the declared acceptance tail does not fit the effective cap ${capUsd.toFixed(4)} USD (${terms}); raise the cap or lower the declared tail`);
+			}
+		}
 		const records = /* @__PURE__ */ new Map();
 		const byOrdinal = /* @__PURE__ */ new Map();
 		const rejectedByOrdinal = /* @__PURE__ */ new Map();
@@ -23684,6 +23897,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const childState = {
 				scope,
 				spanId: internals.spans.mint(callingState.spanId),
+				phase: callingState.phase ?? "fan-out",
 				signal: upstream === void 0 ? controller.signal : AbortSignal.any([upstream, controller.signal]),
 				budgetScope: placement?.ownAccount === true ? scope : callingState.budgetScope ?? "run"
 			};
@@ -25071,6 +25285,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 		};
 		const orchestratorState = { ...callingState };
 		if (orchestratorAccount !== void 0) orchestratorState.budgetScope = orchestratorAccount;
+		orchestratorState.phase = orchestratorState.phase ?? "coordination";
 		const loopBreakSignal = validationSpec === void 0 ? forcedFinishController.signal : AbortSignal.any([forcedFinishController.signal, validationAbort.signal]);
 		orchestratorState.signal = callingState.signal === void 0 ? loopBreakSignal : AbortSignal.any([callingState.signal, loopBreakSignal]);
 		/**
@@ -25126,6 +25341,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				if (orchestratorAccount !== void 0) internals.budget.releaseFinalizeReserve(orchestratorAccount);
 				const finalState = { ...callingState };
 				if (orchestratorAccount !== void 0) finalState.budgetScope = orchestratorAccount;
+				finalState.phase = finalState.phase ?? "coordination";
 				const digest = buildDigest(wakeOrdinal);
 				const reserveBaseline = orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.spentUsd ?? 0;
 				const dispatched = await runtime.runInScope(finalState, () => ctx.agent([
@@ -25199,6 +25415,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			].join("\n");
 			const noteState = { ...callingState };
 			if (orchestratorAccount !== void 0) noteState.budgetScope = orchestratorAccount;
+			noteState.phase = noteState.phase ?? "composition";
 			const noteOpts = {
 				role: "synthesize",
 				result: "full",
@@ -25693,6 +25910,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			].join("\n");
 			const judgeState = { ...callingState };
 			if (orchestratorAccount !== void 0) judgeState.budgetScope = orchestratorAccount;
+			judgeState.phase = judgeState.phase ?? "judge";
 			const judgeOpts = {
 				role: "synthesize",
 				result: "full",
@@ -25788,7 +26006,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...snapshot ?? {}
 			} });
 		};
-		const runSynthesis = async (draft) => {
+		const runSynthesis = async (draft, stagePhase = "composition") => {
 			const spec = opts?.synthesis;
 			if (spec === void 0) return draft;
 			await recoveryDone;
@@ -26040,7 +26258,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...opts?.contradictions?.onFound !== "carry" || contradictionsFound === void 0 || contradictionsFound.length === 0 ? [] : ["CHILD CONTRADICTIONS: the settled children read these cited locations differently; resolve each one EXPLICITLY in the final result (say which reading holds and why it does) instead of silently picking one. " + JSON.stringify(contradictionsFound)],
 				...opts?.claimConsistency?.onFound !== "carry" && opts?.claimConsistency?.onFound !== "repair" || claimFindingsFound === void 0 || claimFindingsFound.length === 0 ? [] : ["CLAIM CONTRADICTIONS: the composed draft contradicts the settled child pool at these cited locations; resolve each one EXPLICITLY in the final result (say which reading holds and why) instead of keeping the inverted claim. " + JSON.stringify(claimFindingsFound)],
 				...opts?.claimConsistency?.onFound !== "carry" && opts?.claimConsistency?.onFound !== "repair" || claimFindingsFound === void 0 || claimFindingsFound.length === 0 ? [] : hostValidationLessons(),
-				...sectionalRoundContext === void 0 ? [] : [`RETAINED FINAL: ${JSON.stringify(sectionalRoundContext.base)}`, "SECTIONAL ROUND: the accepted document above is RETAINED; repair ONLY the sections owning the contradicted claims by calling finish({ sections: { \"<marker>\": \"<new section body>\" } }). Unchanged sections are spliced from the retained document byte for byte and the spliced whole is validated and judged. Target sections: " + JSON.stringify(sectionalRoundContext.targets) + ". Declared markers: " + JSON.stringify(sectionalRoundContext.sections) + ". Resubmit the full document as result only when a targeted repair is impossible."],
+				...sectionalRoundContext === void 0 ? [] : [
+					`RETAINED FINAL: ${JSON.stringify(sectionalRoundContext.base)}`,
+					"SECTIONAL ROUND: the accepted document above is RETAINED; repair ONLY the sections owning the contradicted claims by calling finish({ sections: { \"<marker>\": \"<new section body>\" } }). Unchanged sections are spliced from the retained document byte for byte and the spliced whole is validated and judged. Target sections: " + JSON.stringify(sectionalRoundContext.targets) + ". Declared markers: " + JSON.stringify(sectionalRoundContext.sections) + ". Resubmit the full document as result only when a targeted repair is impossible.",
+					"Rewritten sections must keep the retained evidence discipline: a sentence making a verified or confirmed grade claim carries the run id or a file:line citation INSIDE the sentence, exactly like the retained sections do; a rewritten sentence that drops it fails the finish contract mechanically."
+				],
 				...spec.policyFacts === true ? [(() => {
 					const byStatus = {};
 					let extensionsGranted = 0;
@@ -26141,6 +26363,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const configuredReserveUsd = opts?.budget?.synthesisReserveUsd ?? 0;
 			const heldReserveUsd = orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.synthesisReserveUsd ?? 0;
 			const synthesisState = { ...callingState };
+			synthesisState.phase = synthesisState.phase ?? stagePhase;
 			if (orchestratorAccount !== void 0) {
 				synthesisState.budgetScope = orchestratorAccount;
 				internals.budget.releaseSynthesisReserve(orchestratorAccount);
@@ -26888,6 +27111,10 @@ function makeOrchestratorWorkflow(goal, opts) {
 		if (claimStage !== "draft") {
 			claimConsistencyDraftMeta = claimStage === "both" ? claimConsistencyMeta : void 0;
 			await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+			if ((opts?.claimConsistency?.onFound ?? "report") === "repair" && claimConsistencyMeta !== void 0) {
+				claimConsistencyMeta.passes = 1;
+				claimConsistencyMeta.semanticRepairRounds = 0;
+			}
 			if ((opts?.claimConsistency?.onFound ?? "report") === "repair" && claimFindingsFound !== void 0 && claimFindingsFound.length > 0) {
 				const hashOfDocument = (value) => createHash("sha256").update(jcsSerialize(value ?? null), "utf8").digest("hex");
 				const preRepairHash = hashOfDocument(synthesizedFinal);
@@ -26920,7 +27147,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 					}, callingState.spanId);
 				}
 				try {
-					synthesizedFinal = await runSynthesis(result.output);
+					synthesizedFinal = await runSynthesis(result.output, "repair");
 				} catch (thrown) {
 					await journalSynthesisAdmissionDecline(thrown);
 					const hostRejection = thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) && thrown.data.source === "orchestrator_finish_validation" ? thrown.data : void 0;
@@ -26958,6 +27185,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 				}
 				try {
 					await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+					if (claimConsistencyMeta !== void 0) {
+						claimConsistencyMeta.passes = 2;
+						claimConsistencyMeta.firstPassFindings = carried.length;
+						claimConsistencyMeta.semanticRepairRounds = 1;
+					}
 				} catch (thrown) {
 					if (thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) && thrown.data.source === "orchestrator_claim_consistency") throw new FailRunError(thrown.message, { data: {
 						...thrown.data,
@@ -26993,6 +27225,14 @@ function makeOrchestratorWorkflow(goal, opts) {
 			};
 		})();
 		const envelopeRejectedCandidates = rejectedFinishCandidates();
+		const acceptedRepairs = validationDecisions().map((verdict) => verdict.deterministicRepair).filter((repair) => repair !== void 0 && repair.outcome === "accepted");
+		const lastAcceptedRepair = acceptedRepairs.at(-1);
+		const deterministicPatches = lastAcceptedRepair === void 0 ? void 0 : {
+			decisions: acceptedRepairs.length,
+			patches: acceptedRepairs.reduce((sum, repair) => sum + repair.patches.length, 0),
+			lastBeforeHash: lastAcceptedRepair.beforeHash,
+			lastAfterHash: lastAcceptedRepair.afterHash
+		};
 		return {
 			result: synthesizedFinal,
 			completion: decision.completion,
@@ -27000,6 +27240,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			...deliverable.deliverableAccepted === void 0 ? {} : { deliverableAccepted: deliverable.deliverableAccepted },
 			...deliverable.acceptedArtifactRef === void 0 ? {} : { acceptedArtifactRef: deliverable.acceptedArtifactRef },
 			...envelopeRejectedCandidates.length === 0 ? {} : { rejectedFinishCandidates: envelopeRejectedCandidates },
+			...deterministicPatches === void 0 ? {} : { deterministicPatches },
 			childStatusCounts: decision.childStatusCounts,
 			degradedReasons: decision.degradedReasons,
 			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
@@ -27053,9 +27294,9 @@ function makeOrchestratorWorkflow(goal, opts) {
 * Top-level surface: creates a run. `runOptions` are the ordinary
 * engine {@link RunOptions} of the created run; in particular
 * `runOptions.budgetUsd` is the ROOT hard ceiling over the WHOLE tree
-* (the orchestrator and every child), immutable after start, while
-* `opts.budget` only shapes the orchestrator's own sub-account inside
-* that ceiling. The shortcut previously accepted no RunOptions at all,
+* (the orchestrator and every child), immutable within a segment,
+* while `opts.budget` only shapes the orchestrator's own sub-account
+* inside that ceiling. The shortcut previously accepted no RunOptions at all,
 * so the canonical entry point could not set a root ceiling without
 * dropping to `engine.run(makeOrchestratorWorkflow(...))` (v1.18.0
 * review P1-5).
@@ -28986,6 +29227,7 @@ function createEngine(options) {
 		if (opts?.configFingerprint !== void 0) requireConfigFingerprint(opts.configFingerprint, "RunOptions.configFingerprint");
 		if (opts?.clampTurnToExposure !== void 0 && typeof opts.clampTurnToExposure !== "boolean") throw new ConfigError("RunOptions.clampTurnToExposure must be a boolean; got " + JSON.stringify(opts.clampTurnToExposure));
 		if (opts?.strictPricing !== void 0 && typeof opts.strictPricing !== "boolean" && (typeof opts.strictPricing !== "object" || opts.strictPricing === null || Array.isArray(opts.strictPricing))) throw new ConfigError("RunOptions.strictPricing must be a boolean or an options object; got " + JSON.stringify(opts.strictPricing));
+		if (opts?.budgetPolicy !== void 0 && opts.budgetPolicy !== "segment" && opts.budgetPolicy !== "immutable-lifetime") throw new ConfigError("RunOptions.budgetPolicy must be 'segment' or 'immutable-lifetime'; got " + JSON.stringify(opts.budgetPolicy));
 		if (opts?.limits !== void 0) validateUsageLimits(opts.limits, "RunOptions.limits");
 		const deadlineAtMs = opts?.deadlineAt === void 0 ? void 0 : parseDeadlineAt(opts.deadlineAt);
 		const compiled = wf.kind === "compiled-workflow" ? wf : void 0;
@@ -29020,6 +29262,7 @@ function createEngine(options) {
 			...opts.strictPricing.allowUnpriced === void 0 ? {} : { allowUnpriced: [...opts.strictPricing.allowUnpriced] }
 		};
 		const configFingerprint = opts?.configFingerprint ?? resumeCtx?.configFingerprint;
+		const budgetPolicy = opts?.budgetPolicy ?? resumeCtx?.budgetPolicy;
 		const makeBudget = () => new RunBudget({
 			...ceilingUsd === void 0 ? {} : { ceilingUsd },
 			...exposureCapUsd === void 0 ? {} : { maxInFlightExposureUsd: exposureCapUsd },
@@ -29202,6 +29445,7 @@ function createEngine(options) {
 			...ceilingUsd === void 0 ? {} : { budgetUsd: ceilingUsd },
 			...exposureCapUsd === void 0 ? {} : { maxInFlightExposureUsd: exposureCapUsd },
 			...strictPricing === void 0 ? {} : { strictPricing },
+			...budgetPolicy === "immutable-lifetime" ? { budgetPolicy } : {},
 			...configFingerprint === void 0 ? {} : { configFingerprint },
 			...argsBinding.argsProvided === void 0 ? {} : { argsProvided: argsBinding.argsProvided },
 			...argsBinding.argsHash === void 0 ? {} : { argsHash: argsBinding.argsHash },
@@ -29629,6 +29873,7 @@ function createEngine(options) {
 				...runOverride.budgetUsd === void 0 ? {} : { budgetUsd: runOverride.budgetUsd },
 				...runOverride.maxInFlightExposureUsd === void 0 ? {} : { maxInFlightExposureUsd: runOverride.maxInFlightExposureUsd }
 			};
+			if (budgetOverride !== void 0 && meta?.budgetPolicy === "immutable-lifetime") throw new ConfigError(`run '${runId}' was started with budgetPolicy 'immutable-lifetime': the recorded ceilings are immutable for the whole life of the run and ResumeOptions.run is refused, raising and lowering alike; cancel the run (or start a new one) instead of editing its ceilings`);
 			return run(bound, resumeOptions?.args, void 0, {
 				runId,
 				priorEntries,
@@ -29639,6 +29884,7 @@ function createEngine(options) {
 				...typeof meta?.budgetUsd === "number" ? { budgetUsd: meta.budgetUsd } : {},
 				...typeof meta?.maxInFlightExposureUsd === "number" ? { maxInFlightExposureUsd: meta.maxInFlightExposureUsd } : {},
 				...typeof meta?.strictPricing === "object" && meta.strictPricing !== null ? { strictPricing: meta.strictPricing } : {},
+				...meta?.budgetPolicy === "immutable-lifetime" ? { budgetPolicy: meta.budgetPolicy } : {},
 				segmentsBefore: typeof meta?.segments === "number" && meta.segments > 0 ? Math.floor(meta.segments) : 1,
 				...typeof meta?.argsProvided === "boolean" ? { argsProvided: meta.argsProvided } : {},
 				...typeof meta?.argsHash === "string" ? { argsHash: meta.argsHash } : {},
@@ -30115,4 +30361,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, parseTerminalEnvelope, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.243.0",
+  "version": "1.244.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",