@rulvar/core 1.243.0 → 1.245.0

package/dist/index.js

@@ -1310,6 +1310,146 @@ function sanitizeTerminalText(text) {
 	return text.replace(ESC_STRING_SEQUENCE, "").replace(ESC_CSI_SEQUENCE, "").replace(CONTROL_RUN, " ");
 }
 //#endregion
+//#region src/l0/terminal-envelope.ts
+/**
+* The unified terminal envelope (RV1105, the P1-5 arc): ONE shape
+* carrying every fact of a run's terminal, assembled once at the
+* engine's settlement chokepoint and mirrored verbatim onto the
+* resolved outcome (`outcome.envelope`), the `run:end` event
+* (`event.envelope`), and through them the HTTP outcome response and
+* the OTel run attributes. An SDK consumer, an event-only consumer,
+* and an HTTP consumer read the SAME set of facts without assembling
+* pieces from surface-specific fields; nothing pre-existing was
+* renamed or removed, the envelope is an assembly over it.
+*
+* Doctrine notes:
+* - `status` is the computation's verdict; `settled` says whether
+*   anything durable records it (RV907). A resolved outcome always
+*   carries `settled: true`, because an unsettled terminal REJECTS
+*   `handle.result` typed instead of resolving; the `settled: false`
+*   envelopes exist only on the event stream, where `settledReason:
+*   'superseded'` distinguishes the fenced-out segment (RV1009) from
+*   a settlement write fault.
+* - `usageApprox` is normalized to a boolean here (the run:end field
+*   keeps its absent-means-exact byte contract): `true` means some
+*   priced usage was approximate, so `totalUsd` is a lower bound.
+* - `costByModel` is a detached copy of the settled fold's per-model
+*   split; mutating it never touches the cost report. Since RV1213
+*   `error` is detached the same way, `data` nesting included, so the
+*   whole envelope is a reading a consumer may annotate freely.
+*
+* Docs: https://docs.rulvar.com/guide/observability
+*/
+const ENVELOPE_STATUSES = /* @__PURE__ */ new Set([
+	"ok",
+	"error",
+	"cancelled",
+	"exhausted",
+	"suspended"
+]);
+const ENVELOPE_COMPLETIONS = /* @__PURE__ */ new Set([
+	"complete",
+	"partial",
+	"rejected"
+]);
+function refuseEnvelope(field, requirement, got) {
+	throw new ConfigError(`terminal envelope ${field} must be ${requirement}; got ${typeof got === "number" ? String(got) : JSON.stringify(got) ?? String(got)}`);
+}
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function requireMoney(value, field) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) refuseEnvelope(field, "a finite nonnegative number", value);
+	return value;
+}
+function requireCount$1(value, field) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) refuseEnvelope(field, "a nonnegative integer", value);
+}
+function requireBoolean(value, field) {
+	if (typeof value !== "boolean") refuseEnvelope(field, "a boolean", value);
+}
+function requireNonEmptyString(value, field) {
+	if (typeof value !== "string" || value.length === 0) refuseEnvelope(field, "a non-empty string", value);
+}
+/** Every numeric leaf of the usage subtree: finite and nonnegative. */
+function requireUsageNumbers(node, path) {
+	if (typeof node === "number") {
+		if (!Number.isFinite(node) || node < 0) refuseEnvelope(path, "a finite nonnegative number", node);
+		return;
+	}
+	if (isPlainObject(node)) {
+		for (const [key, item] of Object.entries(node)) requireUsageNumbers(item, `${path}.${key}`);
+		return;
+	}
+	refuseEnvelope(path, "a number or a nested usage object", node);
+}
+/**
+* The runtime gate over the terminal envelope contract (RV3903, the
+* fourth comparison experiment). `terminalEnvelopeOf` is the ONE
+* producer, but a producer is a compile-time promise, and the envelope
+* crosses trust boundaries the type system never sees: a journal read
+* back after a restart, a plain JS caller, an HTTP body a pipeline
+* gates on. The experiment probed the built dist and the typed copy
+* accepted `status: 'green'`, NaN dollars, and negative counts without
+* a sound; a finance or compliance consumer downstream would have
+* gated a run on fiction.
+*
+* The gate validates the CONTRACT fields and refuses with a typed
+* {@link ConfigError} naming the field and the defect: enum `status`
+* and `completion`, finite nonnegative money (with `totalUsd <=
+* grossUsd`, gross being net plus abandoned by construction), usage
+* and counters, `settledReason` only beside `settled: false`, the
+* `costBasis` and `provenance` literals, boolean `usageApprox`, and
+* the `WireError` shape when an error rides along. Unknown top-level
+* fields pass through untouched: the contract evolves additively, and
+* a parser that refused tomorrow's field would turn every additive
+* release into a wire break. On success the SAME reference comes back,
+* typed: the gate is a boundary check, never a normalizer.
+*
+* Wired where external bytes actually enter: `persistedTerminalEnvelope`
+* runs every journal-rebuilt envelope through it (and refuses typed as
+* `malformed-envelope`), which also covers the server's persisted
+* serving by construction. The live settlement chokepoint stays
+* unparsed on purpose: it is the one producer inside one process, and
+* gating it would add a throw site to settlement itself.
+*/
+function parseTerminalEnvelope(value) {
+	if (!isPlainObject(value)) refuseEnvelope("value", "an object", value);
+	requireNonEmptyString(value.runId, "runId");
+	requireNonEmptyString(value.workflow, "workflow");
+	if (typeof value.status !== "string" || !ENVELOPE_STATUSES.has(value.status)) refuseEnvelope("status", "one of 'ok' | 'error' | 'cancelled' | 'exhausted' | 'suspended'", value.status);
+	requireBoolean(value.settled, "settled");
+	if (value.settledReason !== void 0) {
+		if (value.settledReason !== "superseded") refuseEnvelope("settledReason", "the literal 'superseded' when present", value.settledReason);
+		if (value.settled !== false) refuseEnvelope("settledReason", "present only beside settled: false (a settled terminal has no supersession to explain)", value.settledReason);
+	}
+	const totalUsd = requireMoney(value.totalUsd, "totalUsd");
+	const grossUsd = requireMoney(value.grossUsd, "grossUsd");
+	if (totalUsd > grossUsd) refuseEnvelope("totalUsd", `at most grossUsd (${String(grossUsd)}): gross is the net fold plus abandoned spend`, totalUsd);
+	if (value.costBasis !== "locally-estimated") refuseEnvelope("costBasis", "the literal 'locally-estimated'", value.costBasis);
+	if (!isPlainObject(value.costByModel)) refuseEnvelope("costByModel", "an object of per-model dollars", value.costByModel);
+	for (const [model, usd] of Object.entries(value.costByModel)) requireMoney(usd, `costByModel['${model}']`);
+	if (value.wireRequests !== void 0) requireCount$1(value.wireRequests, "wireRequests");
+	if (!isPlainObject(value.usage)) refuseEnvelope("usage", "a usage object", value.usage);
+	requireUsageNumbers(value.usage, "usage");
+	requireBoolean(value.usageApprox, "usageApprox");
+	requireCount$1(value.agentsSpawned, "agentsSpawned");
+	if (value.completion !== void 0 && (typeof value.completion !== "string" || !ENVELOPE_COMPLETIONS.has(value.completion))) refuseEnvelope("completion", "one of 'complete' | 'partial' | 'rejected' when present", value.completion);
+	if (value.error !== void 0) {
+		if (!isPlainObject(value.error)) refuseEnvelope("error", "a typed wire error object when present", value.error);
+		requireNonEmptyString(value.error.code, "error.code");
+		if (typeof value.error.message !== "string") refuseEnvelope("error.message", "a string", value.error.message);
+		requireBoolean(value.error.retryable, "error.retryable");
+	}
+	if (value.deliverableAccepted !== void 0) requireBoolean(value.deliverableAccepted, "deliverableAccepted");
+	if (value.resultAvailable !== void 0) requireBoolean(value.resultAvailable, "resultAvailable");
+	if (value.acceptedArtifactRef !== void 0) requireCount$1(value.acceptedArtifactRef, "acceptedArtifactRef");
+	if (value.claimConsistencyMeta !== void 0 && !isPlainObject(value.claimConsistencyMeta)) refuseEnvelope("claimConsistencyMeta", "an object when present", value.claimConsistencyMeta);
+	if (value.configFingerprint !== void 0) requireNonEmptyString(value.configFingerprint, "configFingerprint");
+	if (value.provenance !== void 0 && value.provenance !== "journal") refuseEnvelope("provenance", "the literal 'journal' when present", value.provenance);
+	return value;
+}
+//#endregion
 //#region src/engine/terminal-envelope.ts
 /**
 * A total copy of one typed error (RV1213). `data` is `Json` by the
@@ -3112,7 +3252,7 @@ const MAX_TIMER_DELAY_MS = 2147483647;
 * century-long suspension journals as a perfectly valid date.
 */
 const MAX_DEADLINE_MS = 315576e7;
-function refuse$1(site, requirement, value) {
+function refuse$2(site, requirement, value) {
 	throw new ConfigError(`${site} must be ${requirement}; got ${String(value)}`);
 }
 /**
@@ -3129,26 +3269,26 @@ function requireDeadlineMs(value, site) {
 }
 /** An integer >= 1 (counts, caps, and depths). */
 function requirePositiveInteger$2(value, site) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 1) refuse$1(site, "a positive integer", value);
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1) refuse$2(site, "a positive integer", value);
 }
 /** An integer >= 0 (caps where zero means "none allowed"). */
 function requireNonNegativeInteger(value, site) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) refuse$1(site, "a nonnegative integer", value);
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) refuse$2(site, "a nonnegative integer", value);
 }
 /** A finite number >= 0 (USD amounts and reserves). */
 function requireNonNegativeNumber(value, site) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) refuse$1(site, "a finite nonnegative number", value);
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) refuse$2(site, "a finite nonnegative number", value);
 }
 /** A finite fraction in (0, 1]. */
 function requireFraction(value, site) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > 1) refuse$1(site, "a fraction in (0, 1]", value);
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > 1) refuse$2(site, "a fraction in (0, 1]", value);
 }
 /**
 * A relative delay handed to setTimeout as-is: an integer within the
 * Node timer maximum, mirroring validateRetryPolicy's bound.
 */
 function requireTimerDelayMs(value, site) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 2147483647) refuse$1(site, "an integer between 1 and 2147483647 ms (the Node timer maximum)", value);
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 2147483647) refuse$2(site, "an integer between 1 and 2147483647 ms (the Node timer maximum)", value);
 }
 /**
 * A declared evidence contract (RV303, enforcement RV507): minEntries
@@ -6198,8 +6338,12 @@ var LineageIndex = class {
 * exclusively DEBIT-ONLY API and a limits vector frozen at start in the
 * `termination.init` entry, plus the variant function Phi. No credit
 * operation exists anywhere by construction; no journal entry kind
-* carries credit; B0 is immutable after start and no API, including
-* HITL, can top it up. Every debit is atomic with the append of its
+* carries credit; B0 is immutable within a segment and no API,
+* including HITL, tops up a live run (the one explicit door is the
+* journaled ResumeOptions.run override at resume, RV2208, refused
+* outright under budgetPolicy 'immutable-lifetime', RV3902; the
+* frozen vector below keeps the GENESIS ceiling either way). Every
+* debit is atomic with the append of its
 * carrying decision entry and embeds the balance-after; an underflow
 * writes `termination.denied` strictly BEFORE the typed error surfaces.
 *
@@ -6303,8 +6447,9 @@ function readTerminationInit(entry) {
 /**
 * Config-drift detection at resume: the journaled vector
 * always wins; every differing field is reported for the
-* `termination:config-drift` event. Dynamic budget top-up via restart is
-* excluded by construction.
+* `termination:config-drift` event. Ambient config can never top up a
+* budget through a restart; the one explicit, journaled door is
+* ResumeOptions.run (RV2208), which is a decision entry, not a drift.
 */
 function terminationConfigDrift(frozen, live) {
 	const drift = [];
@@ -8168,11 +8313,13 @@ var EscalationDecisionAbortedError = class extends Error {
 * Normalizes a resolution value into an ApprovalDecision. Anything that
 * is not an explicit allow is a deny: an approval never fails open.
 */
-function toApprovalDecision(value) {
+function toApprovalDecision(value, entryRef) {
 	const record = value ?? {};
 	return {
 		decision: record.decision === "allow" ? "allow" : "deny",
-		...typeof record.reason === "string" ? { reason: record.reason } : {}
+		...typeof record.reason === "string" ? { reason: record.reason } : {},
+		...typeof record.expiresAt === "string" ? { expiresAt: record.expiresAt } : {},
+		...entryRef === void 0 ? {} : { entryRef }
 	};
 }
 /**
@@ -8207,7 +8354,9 @@ function detachedApprovalFlavor(entry) {
 async function validatePayloadArms(kind, key, value, schemaSpec) {
 	if (kind === "approval") {
 		const decision = value?.decision;
-		if (decision !== "allow" && decision !== "deny") throw new InvalidResolutionError(`approval '${key}' resolves with { decision: 'allow' | 'deny', reason? }`);
+		if (decision !== "allow" && decision !== "deny") throw new InvalidResolutionError(`approval '${key}' resolves with { decision: 'allow' | 'deny', reason?, expiresAt? }`);
+		const expiresAt = value?.expiresAt;
+		if (expiresAt !== void 0 && (typeof expiresAt !== "string" || Number.isNaN(Date.parse(expiresAt)))) throw new InvalidResolutionError(`approval '${key}' expiresAt must be an ISO 8601 date string; got ` + JSON.stringify(expiresAt));
 	}
 	if (kind === "decision") {
 		const decisionKind = value?.kind;
@@ -8427,7 +8576,7 @@ var ExternalRegistry = class ExternalRegistry {
 			entry = matched.running;
 			replayed = true;
 			const state = this.replayer.suspensionState(entry.seq);
-			if (state.state === "resolved") return toApprovalDecision(state.value);
+			if (state.state === "resolved") return toApprovalDecision(state.value, entry.seq);
 			if (state.state === "abandoned") {
 				this.suspendActivity();
 				return new Promise(() => void 0);
@@ -8459,7 +8608,7 @@ var ExternalRegistry = class ExternalRegistry {
 				prompt: `approve tool '${options.toolName}'`,
 				resolve: (value) => {
 					resumeActivity();
-					resolve(toApprovalDecision(value));
+					resolve(toApprovalDecision(value, entry.seq));
 				}
 			};
 			if (entry.deadlineAt !== void 0) waiter.timer = setLongTimeout(() => {
@@ -8647,6 +8796,62 @@ var ExternalRegistry = class ExternalRegistry {
 	* resolvable this way only once the segment settled (closed registry),
 	* with the exact live-path validation and no wake.
 	*/
+	/**
+	* Revokes a tool approval (RV4008). A still-open approval is denied
+	* through the ordinary first-closing-wins arbitration (a race with
+	* a live allow stays deterministic by the journal). A RECORDED
+	* allow cannot be unwritten (history is immutable): the revocation
+	* appends an `approval_revoked` decision that beats the allow at
+	* the consumption recheck, so an allow granted, crashed over, and
+	* revoked never dispatches its tool on resume. A denied or
+	* abandoned approval has nothing to revoke.
+	*/
+	async revokeApproval(key, options) {
+		if (typeof options.principal !== "string" || options.principal.length === 0) throw new InvalidResolutionError("revokeApproval principal must be a non empty string");
+		if (typeof options.reason !== "string" || options.reason.length === 0) throw new InvalidResolutionError("revokeApproval reason must be a non empty string");
+		const candidates = this.replayer.snapshot().filter((entry) => ExternalRegistry.suspensionKeyOf(entry) === key && entry.kind === "approval");
+		const target = candidates[candidates.length - 1];
+		if (target === void 0) throw new InvalidResolutionError(`no approval suspension with key '${key}' in this run`);
+		const state = this.replayer.suspensionState(target.seq);
+		if (state.state === "suspended") {
+			await this.resolveExternal(key, {
+				decision: "deny",
+				reason: `revoked by ${options.principal}: ${options.reason}`
+			});
+			return {
+				state: "denied-pending",
+				entryRef: target.seq
+			};
+		}
+		if (state.state === "resolved" && state.value?.decision === "allow") {
+			if (this.replayer.snapshot().some((entry) => entry.kind === "decision" && entry.value?.decisionType === "approval_revoked" && entry.value.targetRef === target.seq)) return {
+				state: "already-revoked",
+				entryRef: target.seq
+			};
+			await this.replayer.appendSinglePhase({
+				scope: target.scope,
+				key: `approval-revoked:${String(target.seq)}`,
+				kind: "decision",
+				status: "ok",
+				spanId: target.spanId ?? "",
+				site: "approval-revocation",
+				value: {
+					decisionType: "approval_revoked",
+					targetRef: target.seq,
+					principal: options.principal,
+					reason: options.reason
+				}
+			});
+			return {
+				state: "revoked-allow",
+				entryRef: target.seq
+			};
+		}
+		return {
+			state: "already-closed",
+			entryRef: target.seq
+		};
+	}
 	async resolveDetached(key, value) {
 		const candidates = this.replayer.snapshot().filter((entry) => ExternalRegistry.suspensionKeyOf(entry) === key);
 		const open = candidates.find((entry) => this.replayer.suspensionState(entry.seq).state === "suspended");
@@ -9725,6 +9930,130 @@ function criticalPathFromJournal(entries) {
 	return path;
 }
 //#endregion
+//#region src/stores/repair-ledger.ts
+const failedNamesOf = (failed) => {
+	if (!Array.isArray(failed)) return [];
+	return failed.map((row) => typeof row.name === "string" ? String(row.name) : void 0).filter((name) => name !== void 0);
+};
+const sectionsOf = (sections) => {
+	if (!Array.isArray(sections) || sections.length === 0) return;
+	const markers = sections.filter((marker) => typeof marker === "string");
+	return markers.length === 0 ? void 0 : markers;
+};
+/**
+* Folds the workflow-wide repair ledger from a journal (RV4002). Pure
+* over the entries, so the acceptance envelope's live aggregate
+* (computed from the run's own snapshot at assembly) and a post-hoc
+* fold over the persisted journal agree by construction on every
+* count and row identity; `wireRef`/`costUsd` enrich rows exactly when
+* the asynchronous billing lane covered them.
+*/
+function repairLedgerFromJournal(entries, priceUsd) {
+	const ordered = [...entries].sort((a, b) => a.seq - b.seq);
+	const rounds = [];
+	const rowScopes = /* @__PURE__ */ new Map();
+	let draft = 0;
+	let composition = 0;
+	let semantic = 0;
+	let unstagedVerdicts = 0;
+	/** Sectional acceptances by scope, to pair sections onto the rejection they healed. */
+	const draftAccepts = [];
+	const wireRows = [];
+	for (const entry of ordered) {
+		if (entry.kind === "agent" && entry.status !== "running" && entry.status !== "suspended") {
+			if (entry.costAttribution?.label === "final-composition" && entry.costAttribution.phase === "repair") semantic += 1;
+			continue;
+		}
+		if (entry.kind !== "decision") continue;
+		const value = entry.value;
+		if (value === void 0) continue;
+		if (value.decisionType === "provider-call") {
+			const row = entry.value;
+			if (row.record?.phase === "repair") wireRows.push({
+				seq: entry.seq,
+				scope: entry.scope,
+				record: row.record
+			});
+			continue;
+		}
+		if (value.decisionType === "orchestrator_draft_gate") {
+			if (value.verdict === "rejected") {
+				draft += 1;
+				const row = {
+					stage: "draft",
+					seq: entry.seq,
+					...typeof value.callId === "string" ? { callId: value.callId } : {},
+					failedValidators: failedNamesOf(value.failed)
+				};
+				rounds.push(row);
+				rowScopes.set(row, entry.scope);
+			} else if (value.verdict === "accepted" && value.spliced === true) {
+				const sections = sectionsOf(value.sections);
+				if (sections !== void 0) draftAccepts.push({
+					seq: entry.seq,
+					scope: entry.scope,
+					sections
+				});
+			}
+			continue;
+		}
+		if (value.decisionType === "orchestrator_finish_validation" && value.verdict === "repair") {
+			if (value.stage !== "composition" && value.stage !== "round") {
+				unstagedVerdicts += 1;
+				continue;
+			}
+			composition += 1;
+			const sections = sectionsOf(value.sections);
+			const row = {
+				stage: value.stage,
+				seq: entry.seq,
+				...typeof value.callId === "string" ? { callId: value.callId } : {},
+				failedValidators: failedNamesOf(value.failed),
+				...sections === void 0 ? {} : { sections }
+			};
+			rounds.push(row);
+			rowScopes.set(row, entry.scope);
+			continue;
+		}
+		if (value.decisionType === "orchestrator_finish_validation" && value.verdict === "accepted" && value.spliced === true) {
+			const sections = sectionsOf(value.sections);
+			if (sections !== void 0) draftAccepts.push({
+				seq: entry.seq,
+				scope: entry.scope,
+				sections
+			});
+		}
+	}
+	for (const accept of draftAccepts) for (let index = rounds.length - 1; index >= 0; index -= 1) {
+		const row = rounds[index];
+		if (row === void 0 || row.seq >= accept.seq || row.sections !== void 0 || rowScopes.get(row) !== accept.scope) continue;
+		row.sections = accept.sections;
+		break;
+	}
+	for (const wire of wireRows) {
+		let target;
+		for (const row of rounds) {
+			if (row.seq >= wire.seq || row.wireRef !== void 0 || rowScopes.get(row) !== wire.scope) continue;
+			target = row;
+		}
+		if (target === void 0) continue;
+		target.wireRef = wire.seq;
+		if (priceUsd !== void 0 && wire.record.servedBy !== void 0) {
+			const usd = priceUsd(wire.record.servedBy, wire.record.usage);
+			if (usd !== void 0 && Number.isFinite(usd) && usd >= 0) target.costUsd = usd;
+		}
+	}
+	rounds.sort((a, b) => a.seq - b.seq);
+	return {
+		draft,
+		composition,
+		semantic,
+		total: draft + composition + semantic,
+		rounds,
+		unstagedVerdicts
+	};
+}
+//#endregion
 //#region src/stores/synthesis-candidates.ts
 const parse = (at) => {
 	if (at === void 0) return;
@@ -9953,9 +10282,17 @@ function toolCalibrationFromJournal(entries) {
 	const budgetOnly = [];
 	let dispatches = 0;
 	let unobserved = 0;
+	let coordinationDispatches = 0;
+	let coordinationToolCalls = 0;
 	for (const entry of ordered) {
 		if (entry.kind !== "agent" || entry.ref === void 0 || entry.status === "running") continue;
 		dispatches += 1;
+		const role = entry.costAttribution?.role;
+		if ((role === "orchestrate" || role === "synthesize") && entry.toolBudget !== void 0) {
+			coordinationDispatches += 1;
+			coordinationToolCalls += entry.toolBudget.used;
+			continue;
+		}
 		const named = {
 			scope: entry.scope,
 			handle: entry.ref,
@@ -9978,7 +10315,11 @@ function toolCalibrationFromJournal(entries) {
 		observed,
 		evidenceOnly,
 		budgetOnly,
-		unobserved
+		unobserved,
+		...coordinationDispatches > 0 ? { coordination: {
+			dispatches: coordinationDispatches,
+			toolCallsUsed: coordinationToolCalls
+		} } : {}
 	};
 	if (observed.length > 0) {
 		const toolCallsUsed = observed.reduce((sum, row) => sum + row.toolCallsUsed, 0);
@@ -10794,6 +11135,19 @@ function fallbackTriggerOf(outcome) {
 }
 //#endregion
 //#region src/model/projector.ts
+/**
+* The RETENTION identity of an adapter (RV4007): the provider family,
+* composed with the adapter's declared `scopeKey` when one exists, so
+* two adapters of one family serving different accounts stop sharing
+* provider-raw blocks (cache handles, thinking blocks: provider-side
+* identifiers minted under one account are not portable to another).
+* Adapters without a scopeKey keep the family alone, byte for byte
+* the historical sharing.
+*/
+function retentionKeyOf(adapter) {
+	const family = providerOf(adapter);
+	return adapter.scopeKey === void 0 ? family : `${family}#${adapter.scopeKey}`;
+}
 /** The provider family of an adapter: `provider` when set, else `id`. */
 function providerOf(adapter) {
 	return adapter.provider ?? adapter.id;
@@ -10830,7 +11184,7 @@ function liftRetainedParts(providerMetadata, adapter) {
 	const retained = namespace.retainedParts;
 	if (!Array.isArray(retained)) return [];
 	const blocks = retained;
-	const provider = providerOf(adapter);
+	const provider = retentionKeyOf(adapter);
 	return blocks.map((block) => ({
 		type: "provider-raw",
 		provider,
@@ -13487,6 +13841,13 @@ async function runAgent(options) {
 					reservationId = decision.reservationId;
 					const abandoned = await abortedAfterReserve(quota, decision.reservationId);
 					if (abandoned !== void 0) return abandoned;
+					if (options.billing?.onProviderIntent !== void 0) await options.billing.onProviderIntent({
+						ordinal: providerCalls.length + 1,
+						role: site.role,
+						servedBy: target.resolved.ref,
+						attempt: tries + 1,
+						request: req
+					});
 					if (quota.reserveContinuations !== true) return streamTurn(target.adapter, req, meteredOptionsFor(target));
 					const hooks = { onContinuationSegment: async () => {
 						let segmentDecision;
@@ -13543,6 +13904,14 @@ async function runAgent(options) {
 					if (options.quota === void 0) {
 						const req = site.requestFor(target);
 						admitExposure(req);
+						const intentHook = options.billing?.onProviderIntent;
+						if (intentHook !== void 0) return Promise.resolve(intentHook({
+							ordinal: providerCalls.length + 1,
+							role: site.role,
+							servedBy: target.resolved.ref,
+							attempt: tries + 1,
+							request: req
+						})).then(() => streamTurn(target.adapter, req, meteredOptionsFor(target)));
 						return streamTurn(target.adapter, req, meteredOptionsFor(target));
 					}
 					return dispatchWithQuota(options.quota);
@@ -13636,6 +14005,7 @@ async function runAgent(options) {
 						outcome: outcome.aborted !== void 0 ? "aborted" : outcome.wireError !== void 0 ? "error" : "ok",
 						usage: accounted
 					};
+					if (site.phase !== void 0) record.phase = site.phase;
 					if (typeof namespace?.responseId === "string") record.responseId = namespace.responseId;
 					else if (typeof namespace?.response?.id === "string") record.responseId = namespace.response.id;
 					const wire = namespace?.wireRequests;
@@ -13791,7 +14161,7 @@ async function runAgent(options) {
 				chain: loopChain,
 				cursor: loopCursor,
 				requestFor: (target) => {
-					let req = buildRequest(target.resolved, projectHistory(drainMessages, providerOf(target.adapter)), limits, toolsRide ? allowedTools : void 0);
+					let req = buildRequest(target.resolved, projectHistory(drainMessages, retentionKeyOf(target.adapter)), limits, toolsRide ? allowedTools : void 0);
 					const reserveMax = limits.finalizationReserve?.maxOutputTokens;
 					if (reserveMax !== void 0) req = {
 						...req,
@@ -13870,16 +14240,19 @@ async function runAgent(options) {
 			break;
 		}
 		turns += 1;
+		const lastWindowMessage = messages[messages.length - 1];
+		const repairTurnWire = options.terminalTool !== void 0 && lastWindowMessage !== void 0 && lastWindowMessage.parts.some((part) => part.type === "tool-result" && part.name === options.terminalTool?.name && part.isError === true);
 		const signals = [];
 		if (options.signal !== void 0) signals.push(options.signal);
 		let loopDispatch;
 		try {
 			loopDispatch = await dispatchPhase({
 				role: primaryRole,
+				...repairTurnWire ? { phase: "repair" } : {},
 				chain: loopChain,
 				cursor: loopCursor,
 				requestFor: (target) => {
-					let req = buildRequest(target.resolved, projectHistory(messages, providerOf(target.adapter)), limits, options.tools?.contracts);
+					let req = buildRequest(target.resolved, projectHistory(messages, retentionKeyOf(target.adapter)), limits, options.tools?.contracts);
 					if (options.schema !== void 0 && options.canonicalSchema !== void 0 && !separateExtract) req = applyStructuredOutputTier(req, rideTierFor(target), options.canonicalSchema);
 					req = applyCachePolicy(req, target, options.cache);
 					return applyOutputBudget(req, target, options.budget);
@@ -14103,7 +14476,7 @@ async function runAgent(options) {
 						}, ...options.summarize.fallbacks ?? []],
 						cursor: { index: 0 },
 						requestFor: (target) => {
-							let req = buildRequest(target.resolved, [...projectHistory(messages, providerOf(target.adapter)), summarizeInstruction()], limits, options.tools?.contracts);
+							let req = buildRequest(target.resolved, [...projectHistory(messages, retentionKeyOf(target.adapter)), summarizeInstruction()], limits, options.tools?.contracts);
 							if (req.tools !== void 0) req = {
 								...req,
 								toolChoice: "none"
@@ -14207,7 +14580,17 @@ async function runAgent(options) {
 			output = outcome.turn.text;
 			break;
 		}
-		if (separateExtract) break;
+		if (separateExtract) {
+			const rideAlong = extractCandidate(outcome.turn, rideTierFor(servedTarget));
+			if (rideAlong !== void 0) {
+				const validation = await validateSchemaSpec(options.schema, rideAlong.raw);
+				if (validation.valid) {
+					output = validation.value;
+					break;
+				}
+			}
+			break;
+		}
 		const candidate = extractCandidate(outcome.turn, rideTierFor(servedTarget));
 		const issues = [];
 		if (candidate !== void 0) {
@@ -14280,7 +14663,7 @@ async function runAgent(options) {
 					chain: loopChain,
 					cursor: loopCursor,
 					requestFor: (target) => {
-						let req = buildRequest(target.resolved, projectHistory(reserveMessages, providerOf(target.adapter)), limits, options.tools?.contracts);
+						let req = buildRequest(target.resolved, projectHistory(reserveMessages, retentionKeyOf(target.adapter)), limits, options.tools?.contracts);
 						if (options.schema !== void 0 && options.canonicalSchema !== void 0 && !separateExtract) req = applyStructuredOutputTier(req, rideTierFor(target), options.canonicalSchema);
 						if (req.tools !== void 0) req = {
 							...req,
@@ -14416,7 +14799,7 @@ async function runAgent(options) {
 					}, ...options.finalize.fallbacks ?? []],
 					cursor: { index: 0 },
 					requestFor: (target) => applyOutputBudget({
-						...buildRequest(target.resolved, projectHistory(synthesisMessages, providerOf(target.adapter)), limits, options.tools?.contracts),
+						...buildRequest(target.resolved, projectHistory(synthesisMessages, retentionKeyOf(target.adapter)), limits, options.tools?.contracts),
 						toolChoice: "none"
 					}, target, options.budget),
 					streamOptionsFor: (target) => {
@@ -14496,7 +14879,7 @@ async function runAgent(options) {
 		}
 		endPhase(finalizePhase, phaseOutcome(), finalizeServed);
 	}
-	if (status === "ok" && !finishedViaTool && separateExtract && options.extract !== void 0 && options.schema !== void 0) {
+	if (status === "ok" && !finishedViaTool && separateExtract && output === null && options.extract !== void 0 && options.schema !== void 0) {
 		const extractResolved = options.extract.resolved;
 		const extractPhase = beginPhase("extract", extractResolved.ref);
 		let extractServed;
@@ -14535,12 +14918,13 @@ async function runAgent(options) {
 					cursor: extractCursor,
 					requestFor: (target) => {
 						const targetTier = extractTierFor(target);
-						let req = buildRequest(target.resolved, projectHistory(extractMessages, providerOf(target.adapter)), limits, options.tools?.contracts);
+						let req = buildRequest(target.resolved, projectHistory(extractMessages, retentionKeyOf(target.adapter)), limits, options.tools?.contracts);
 						if (req.tools !== void 0 && targetTier !== "forced-tool") req = {
 							...req,
 							toolChoice: "none"
 						};
 						req = applyStructuredOutputTier(req, targetTier, options.canonicalSchema ?? {});
+						req = applyCachePolicy(req, target, options.cache);
 						return applyOutputBudget(req, target, options.budget);
 					},
 					streamOptionsFor: (target) => {
@@ -14723,7 +15107,10 @@ async function runAgent(options) {
 * false). The one thing that can change it is `ResumeOptions.run`, an
 * explicit host decision journaled as its own decision entry, and it
 * takes effect only by opening a NEW segment: a live run can never
-* raise the bound it is already being measured against.
+* raise the bound it is already being measured against. Under
+* RunOptions.budgetPolicy 'immutable-lifetime' (RV3902) even that door
+* refuses typed before ownership, and the recorded ceilings hold for
+* the run's whole life.
 *
 * The account tree: the run root plus one
 * sub-account per admitted child workflow (and, from M7, the orchestrator
@@ -14821,7 +15208,12 @@ function admissionReserveUsd(options) {
 * spawn-admission decision entries, M6).
 */
 var RunBudget = class {
-	/** B0; immutable after start. Undefined means no USD ceiling. */
+	/**
+	* B0; immutable within a segment (RV2511): only the explicit,
+	* journaled ResumeOptions.run override (RV2208) changes it, by
+	* opening a new segment, and budgetPolicy 'immutable-lifetime'
+	* (RV3902) refuses even that. Undefined means no USD ceiling.
+	*/
 	ceilingUsd;
 	/**
 	* The opt-in in-flight exposure cap (RV711). Undefined means the
@@ -15908,7 +16300,12 @@ function costReportFromJournal(entries, priceUsd) {
 		if (entry.usageApprox === true) usageApprox = true;
 		const facts = entry.costAttribution;
 		const phase = attributionBucket(facts?.phase);
-		byPhase[phase] = (byPhase[phase] ?? 0) + priced.usd;
+		let phaseUsd = priced.usd;
+		for (const unit of priced.units) if (unit.source === "call" && unit.record?.phase === "repair") {
+			byPhase.repair = (byPhase.repair ?? 0) + unit.usd;
+			phaseUsd -= unit.usd;
+		}
+		byPhase[phase] = (byPhase[phase] ?? 0) + phaseUsd;
 		const agentType = attributionBucket(facts?.agentType);
 		byAgentType[agentType] = (byAgentType[agentType] ?? 0) + priced.usd;
 		const scope = scopeBucket(entry.scope);
@@ -16197,6 +16594,48 @@ function rowUsd(priceUsd, servedBy, usage, seq) {
 	return usd !== void 0 && Number.isFinite(usd) && usd >= 0 ? usd : void 0;
 }
 /**
+* The open provider wire intents of a journal (RV4006): every
+* `provider-intent` decision with neither a `provider-call` receipt
+* row nor a settled terminal record covering its (agentRef, ordinal,
+* attempt). ONE pairing rule, shared by the invoice's `openIntents`
+* lane and the resume refusal, the dispatchProjectionReserveUsd
+* precedent: the linter and the gate cannot drift.
+*/
+function openWireIntentsOf(entries) {
+	const terminals = /* @__PURE__ */ new Map();
+	const receipts = /* @__PURE__ */ new Set();
+	const intents = [];
+	for (const entry of entries) {
+		if (entry.kind === "agent" && entry.status !== "running" && typeof entry.ref === "number") {
+			terminals.set(entry.ref, entry);
+			continue;
+		}
+		if (entry.kind !== "decision") continue;
+		const value = entry.value;
+		if (value?.decisionType === "provider-call" && typeof value.agentRef === "number") {
+			const ordinal = value.record?.ordinal;
+			const attempt = typeof value.record?.attempt === "number" ? value.record.attempt : 1;
+			if (typeof ordinal === "number") receipts.add(`${String(value.agentRef)}:${String(ordinal)}:${String(attempt)}`);
+			continue;
+		}
+		if (value?.decisionType === "provider-intent" && typeof value.agentRef === "number" && typeof value.ordinal === "number" && typeof value.attempt === "number" && typeof value.servedBy === "string") intents.push({
+			seq: entry.seq,
+			scope: entry.scope,
+			agentRef: value.agentRef,
+			ordinal: value.ordinal,
+			attempt: value.attempt,
+			servedBy: value.servedBy,
+			...typeof value.requestFingerprint === "string" ? { requestFingerprint: value.requestFingerprint } : {}
+		});
+	}
+	return intents.filter((intent) => {
+		if (receipts.has(`${String(intent.agentRef)}:${String(intent.ordinal)}:${String(intent.attempt)}`)) return false;
+		const terminal = terminals.get(intent.agentRef);
+		if (terminal === void 0) return true;
+		return !(terminal.providerCalls ?? []).some((call) => call.ordinal === intent.ordinal && call.attempt === intent.attempt);
+	});
+}
+/**
 * The pure invoice fold. Pass the same entries and price table you
 * would pass `costReportFromJournal`; the totals are that report's
 * gross/net split verbatim. To make the export historically stable
@@ -16215,10 +16654,13 @@ function invoiceFromJournal(entries, priceUsd, options) {
 		const billing = priceEntryBilling(entry, priceUsd);
 		if (!billing.fullyAttributed) everyEntryFullyAttributed = false;
 		const abandoned = entry.kind !== "resolution" && entry.kind !== "abandon" && abandonFold.isAbandoned(entry.ref ?? entry.seq);
+		const attribution = entry.costAttribution;
 		const base = {
 			entrySeq: entry.seq,
 			scope: entry.scope,
-			key: entry.key
+			key: entry.key,
+			...attribution?.agentType === void 0 || attribution.agentType === "" ? {} : { agentType: attribution.agentType },
+			...attribution?.label === void 0 ? {} : { label: attribution.label }
 		};
 		const mark = abandoned ? { abandoned: true } : {};
 		const records = entry.providerCalls ?? [];
@@ -16359,6 +16801,21 @@ function invoiceFromJournal(entries, priceUsd, options) {
 		cardinality: cardinalityOf(rows),
 		...unsettled === void 0 ? {} : { unsettled },
 		...orphanedReceipts === void 0 ? {} : { orphanedReceipts },
+		...(() => {
+			for (const entry of entries) {
+				if (entry.kind !== "decision") continue;
+				const value = entry.value;
+				if (value?.decisionType === "execution_scope" && typeof value.scope === "object") return { executionScope: value.scope };
+			}
+			return {};
+		})(),
+		...(() => {
+			const open = openWireIntentsOf(entries);
+			return open.length === 0 ? {} : { openIntents: {
+				count: open.length,
+				rows: open
+			} };
+		})(),
 		...(() => {
 			const count = rows.filter((row) => row.usageUnknown === true).length;
 			return count === 0 ? {} : { usageUnknownRows: count };
@@ -16956,7 +17413,8 @@ function statementRowsFromDelimited(text, options) {
 const REFUSAL_MESSAGES = {
 	unsettled: "no run settle is journaled for this run: nothing durable records a terminal",
 	"not-terminal": "the journaled run settle records a running segment, not a terminal",
-	"unknown-workflow": "no stored metadata names the workflow this run belongs to"
+	"unknown-workflow": "no stored metadata names the workflow this run belongs to",
+	"malformed-envelope": "the rebuilt envelope failed the runtime terminal contract gate: the journal bytes produced values the contract forbids"
 };
 /** Every envelope status; a settle may also record the non-terminal 'running'. */
 const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
@@ -16966,7 +17424,7 @@ const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
 	"exhausted",
 	"suspended"
 ]);
-function refuse(reason, message = REFUSAL_MESSAGES[reason]) {
+function refuse$1(reason, message = REFUSAL_MESSAGES[reason]) {
 	return {
 		available: false,
 		reason,
@@ -16982,16 +17440,24 @@ function refuse(reason, message = REFUSAL_MESSAGES[reason]) {
 */
 function persistedTerminalEnvelope(input) {
 	const settle = lastRunSettle(input.entries);
-	if (settle === void 0) return refuse("unsettled");
-	if (!TERMINAL_STATUSES.has(settle.runStatus)) return refuse("not-terminal");
+	if (settle === void 0) return refuse$1("unsettled");
+	if (!TERMINAL_STATUSES.has(settle.runStatus)) return refuse$1("not-terminal");
 	const tail = input.entries.filter((entry) => entry.seq > settle.seq).length;
-	if (tail > 0) return refuse("not-terminal", `the journal continued ${String(tail)} entr${tail === 1 ? "y" : "ies"} past the settle at seq ${String(settle.seq)}: the latest segment is not settled`);
+	if (tail > 0) return refuse$1("not-terminal", `the journal continued ${String(tail)} entr${tail === 1 ? "y" : "ies"} past the settle at seq ${String(settle.seq)}: the latest segment is not settled`);
 	const workflow = input.meta?.workflowName;
-	if (workflow === void 0) return refuse("unknown-workflow");
+	if (workflow === void 0) return refuse$1("unknown-workflow");
+	try {
+		return assemble(input, workflow, settle);
+	} catch (error) {
+		const detail = error instanceof Error ? error.message : String(error);
+		return refuse$1("malformed-envelope", `${REFUSAL_MESSAGES["malformed-envelope"]}: ${detail}`);
+	}
+}
+function assemble(input, workflow, settle) {
 	const ledger = foldLedger(input.entries, buildAbandonFold(input.entries));
 	return {
 		available: true,
-		envelope: terminalEnvelopeOf({
+		envelope: parseTerminalEnvelope(terminalEnvelopeOf({
 			runId: input.runId,
 			workflow,
 			outcome: {
@@ -17007,7 +17473,7 @@ function persistedTerminalEnvelope(input) {
 			agentsSpawned: ledger.agentsSpawned,
 			...input.meta?.configFingerprint === void 0 ? {} : { configFingerprint: input.meta.configFingerprint },
 			provenance: "journal"
-		})
+		}))
 	};
 }
 //#endregion
@@ -17608,6 +18074,117 @@ function dispatchProjectionReserveUsd(spec, flatReserveUsd) {
 	const base = spec.estCostUsd ?? flatReserveUsd;
 	return spec.budgetUsd === void 0 ? base : Math.min(base, spec.budgetUsd);
 }
+/**
+* Worst-case claim judge dispatches of a declared posture
+* (RV3402/RV4001): `'both'` dispatches the judge at the draft AND the
+* final, and an armed repair round (`onFound: 'repair'`, which intake
+* refuses at stage 'draft') rejudges the repaired composition once
+* more. Absent declarations read as the historical one pass.
+*/
+function acceptanceJudgePasses(stage, onFound) {
+	const resolvedStage = stage ?? "draft";
+	return (resolvedStage === "both" ? 2 : 1) + ((onFound ?? "report") === "repair" && resolvedStage !== "draft" ? 1 : 0);
+}
+/**
+* The ONE acceptance-tail formula (RV4001, the fifth comparison
+* experiment): what the effective cap must cover, at exact fill or
+* better, so the acceptance machinery the host declared is funded and
+* not started on luck. The RV3907 runtime gate landed WITHOUT a
+* preflight twin: preflight kept its own advisory arithmetic on
+* different terms, passed the experiment's plan green at a $4.54 cap,
+* and the runtime then refused the same plan typed at $4.82 before the
+* first wire; worse, the runtime undercounted the judge passes of
+* `stage: 'both'` (one where the worst case dispatches two) while
+* preflight counted them right, so the two calculators disagreed in
+* BOTH directions. The gate and the preflight `acceptanceReserve`
+* report block now both call this function, exactly the
+* {@link dispatchProjectionReserveUsd} precedent: one formula, so the
+* linter and the runtime cannot drift. Undeclared estimates contribute
+* zero: the tail binds exactly what the host declared. The armed
+* repair round (`onFound: 'repair'`, never at stage 'draft', which
+* intake refuses) adds one judge pass and one composition priced at
+* the declared `synthesis.estCost`.
+*/
+function acceptanceTailRequiredUsd(spec) {
+	const stage = spec.claimStage ?? "draft";
+	const onFound = spec.claimOnFound ?? "report";
+	const citationDeclared = spec.citationJudgeEstCostUsd !== void 0 || spec.citationOnFound !== void 0;
+	const citationRoundArmed = spec.citationOnFound === "repair";
+	const roundArmed = onFound === "repair" && stage !== "draft" || citationRoundArmed;
+	const judgePasses = acceptanceJudgePasses(spec.claimStage, spec.claimOnFound) + (citationRoundArmed && spec.claimConfigured === true && stage !== "draft" ? 1 : 0);
+	const citationJudgePasses = citationDeclared ? 1 + (citationRoundArmed ? 1 : 0) : 0;
+	const citationJudgeEstUsd = spec.citationJudgeEstCostUsd ?? 0;
+	const terms = {
+		synthesisReserveUsd: spec.synthesisReserveUsd ?? 0,
+		judgeEstUsd: spec.claimJudgeEstCostUsd ?? 0,
+		judgePasses,
+		estRepairCostUsd: spec.finishEstRepairCostUsd ?? 0,
+		roundCompositionUsd: roundArmed ? spec.synthesisEstCostUsd ?? 0 : 0,
+		...citationDeclared ? {
+			citationJudgeEstUsd,
+			citationJudgePasses
+		} : {},
+		workingRoomUsd: spec.workingRoomUsd
+	};
+	return {
+		requiredUsd: terms.synthesisReserveUsd + terms.judgeEstUsd * terms.judgePasses + terms.estRepairCostUsd + terms.roundCompositionUsd + citationJudgeEstUsd * citationJudgePasses + terms.workingRoomUsd,
+		terms
+	};
+}
+/**
+* The one rendering of the tail arithmetic (RV4001): the runtime
+* refusal message and the preflight finding print this same string, so
+* an operator can diff them by eye and a test can assert them equal.
+*/
+function formatAcceptanceTailTerms(terms) {
+	const citationUsd = (terms.citationJudgeEstUsd ?? 0) * (terms.citationJudgePasses ?? 0);
+	const requiredUsd = terms.synthesisReserveUsd + terms.judgeEstUsd * terms.judgePasses + terms.estRepairCostUsd + terms.roundCompositionUsd + citationUsd + terms.workingRoomUsd;
+	return `synthesisReserveUsd ${terms.synthesisReserveUsd.toFixed(4)} + judge ${terms.judgeEstUsd.toFixed(4)} x ${String(terms.judgePasses)} pass(es) + estRepairCostUsd ${terms.estRepairCostUsd.toFixed(4)} + round composition ${terms.roundCompositionUsd.toFixed(4)} + ` + (terms.citationJudgePasses === void 0 || terms.citationJudgePasses === 0 ? "" : `citation judge ${(terms.citationJudgeEstUsd ?? 0).toFixed(4)} x ${String(terms.citationJudgePasses)} pass(es) + `) + `working room ${terms.workingRoomUsd.toFixed(4)} = ${requiredUsd.toFixed(4)} USD`;
+}
+/**
+* The wire capacity of a declared orchestration plan (RV4005, the
+* fifth comparison experiment): base wires by declaration, the armed
+* repair round's delta, and the round's overhead share, from ONE
+* exported function so an answer about the runtime's own economics
+* has a source instead of an improvisation. The experiment's terminal
+* answer wrote "34 wires without repair, 35 with" and multiplied
+* retry share as `1 + r`: the round is TWO wires (its composition
+* plus the rejudge, `orchestrate.ts`'s own doctrine), so 34 becomes
+* 36 at 5.88 percent overhead, and r retries over a base of B
+* multiply wires by `1 + r/B` ({@link retryWireMultiplier}), not by
+* `1 + r`.
+*/
+function wireCapacityEstimate(spec) {
+	requireNonNegativeNumber(spec.childWires, "wireCapacityEstimate childWires");
+	const coordinationWires = spec.coordinationWires ?? 0;
+	const synthesisWires = spec.synthesisWires ?? 0;
+	const judgeWires = spec.judgeWires ?? 0;
+	const extractWires = spec.extractWires ?? 0;
+	requireNonNegativeNumber(coordinationWires, "wireCapacityEstimate coordinationWires");
+	requireNonNegativeNumber(synthesisWires, "wireCapacityEstimate synthesisWires");
+	requireNonNegativeNumber(judgeWires, "wireCapacityEstimate judgeWires");
+	requireNonNegativeNumber(extractWires, "wireCapacityEstimate extractWires");
+	const baseWires = spec.childWires + coordinationWires + synthesisWires + judgeWires + extractWires;
+	const repairRoundDeltaWires = 2;
+	return {
+		baseWires,
+		repairRoundDeltaWires,
+		mechanicalRepairDeltaWires: 1,
+		wiresWithRound: baseWires + repairRoundDeltaWires,
+		roundOverheadShare: baseWires === 0 ? 0 : repairRoundDeltaWires / baseWires
+	};
+}
+/**
+* The retry share of a wire plan (RV4005): r retries over a base of B
+* wires re-dispatch r of the B, so totals scale by `1 + r/B`. The
+* fifth comparison run's answer multiplied by `1 + r`, reading every
+* retry as a whole extra plan.
+*/
+function retryWireMultiplier(baseWires, retries) {
+	requireNonNegativeNumber(retries, "retryWireMultiplier retries");
+	if (!Number.isFinite(baseWires) || baseWires <= 0) throw new ConfigError(`retryWireMultiplier baseWires must be a positive finite number; got ${String(baseWires)}`);
+	return 1 + retries / baseWires;
+}
 /** Nesting depth of a child scope: its workflow, agent, and plan-node segments. */
 function spawnDepthOf(childScope) {
 	return parseScopePath(childScope).filter((segment) => segment.kind === "workflow" || segment.kind === "agent" || segment.kind === "plan-node").length;
@@ -19038,7 +19615,12 @@ function createCtx(internals, rootWorkflow) {
 				model: slice.servedBy,
 				usage: slice.usage
 			});
-			bump(internals.cost.byPhase, state.phase ?? "", costUsd);
+			let replayPhaseUsd = costUsd;
+			for (const unit of replayPriced?.units ?? []) if (unit.source === "call" && unit.record?.phase === "repair") {
+				bump(internals.cost.byPhase, "repair", unit.usd);
+				replayPhaseUsd -= unit.usd;
+			}
+			bump(internals.cost.byPhase, state.phase ?? "", replayPhaseUsd);
 			bump(internals.cost.byAgentType, agentType, costUsd);
 			bump(internals.cost.byScope, state.scope, costUsd);
 			internals.cost.byRole.set(primaryRole, (internals.cost.byRole.get(primaryRole) ?? 0) + costUsd);
@@ -19352,7 +19934,7 @@ function createCtx(internals, rootWorkflow) {
 						suspend: async () => {
 							if (internals.external === void 0) throw new ConfigError("tool approvals require the engine run context (createEngine)");
 							const approvalDeadlineMs = chain.approvalDeadlineMs;
-							return internals.external.awaitApproval({
+							const decision = await internals.external.awaitApproval({
 								scope: agentScope(state.scope, running.seq),
 								spanId: internals.spans.mint(spanId),
 								toolName: call.name,
@@ -19365,6 +19947,22 @@ function createCtx(internals, rootWorkflow) {
 									entryRef: entry.seq
 								}, spanId, replayed)
 							});
+							if (decision.decision !== "allow") return decision;
+							if (decision.entryRef !== void 0) {
+								const revocation = internals.replayer.snapshot().find((entry) => entry.kind === "decision" && entry.value?.decisionType === "approval_revoked" && entry.value.targetRef === decision.entryRef);
+								if (revocation !== void 0) {
+									const why = revocation.value ?? {};
+									return {
+										decision: "deny",
+										reason: `the recorded allow was revoked by ${typeof why.principal === "string" ? why.principal : "unknown"}: ${typeof why.reason === "string" ? why.reason : "no reason recorded"}`
+									};
+								}
+							}
+							if (decision.expiresAt !== void 0 && !(Date.parse(decision.expiresAt) >= internals.now())) return {
+								decision: "deny",
+								reason: `the recorded allow expired at ${decision.expiresAt}`
+							};
+							return decision;
 						}
 					};
 				}
@@ -19452,28 +20050,47 @@ function createCtx(internals, rootWorkflow) {
 			const cachePolicy = opts.cache ?? profile?.cache ?? internals.defaults.cache;
 			if (cachePolicy !== void 0) runAgentOptions.cache = cachePolicy;
 		}
-		runAgentOptions.billing = { onProviderCall: (record) => {
-			const append = internals.replayer.appendSinglePhase({
+		runAgentOptions.billing = {
+			onProviderCall: (record) => {
+				const append = internals.replayer.appendSinglePhase({
+					scope: state.scope,
+					key: `pc:${String(running.seq)}:${String(record.ordinal)}`,
+					kind: "decision",
+					status: "ok",
+					spanId,
+					site: "provider-call",
+					value: {
+						decisionType: "provider-call",
+						agentRef: running.seq,
+						record
+					}
+				}).then(() => void 0).catch((thrown) => {
+					internals.events.emit({
+						type: "log",
+						level: "warn",
+						msg: `incremental billing row failed to append; the terminal entry remains the canonical record (${thrown instanceof Error ? thrown.message : String(thrown)})`
+					}, spanId);
+				});
+				if (internals.defaults.billingReceipts === "awaited" || internals.defaults.billingReceipts === "intent") return append;
+			},
+			...internals.defaults.billingReceipts === "intent" ? { onProviderIntent: (intent) => internals.replayer.appendSinglePhase({
 				scope: state.scope,
-				key: `pc:${String(running.seq)}:${String(record.ordinal)}`,
+				key: `pi:${String(running.seq)}:${String(intent.ordinal)}:${String(intent.attempt)}`,
 				kind: "decision",
 				status: "ok",
 				spanId,
-				site: "provider-call",
+				site: "provider-intent",
 				value: {
-					decisionType: "provider-call",
+					decisionType: "provider-intent",
 					agentRef: running.seq,
-					record
+					ordinal: intent.ordinal,
+					role: intent.role,
+					servedBy: intent.servedBy,
+					attempt: intent.attempt,
+					requestFingerprint: createHash("sha256").update(jcsSerialize(intent.request.messages), "utf8").digest("hex")
 				}
-			}).then(() => void 0).catch((thrown) => {
-				internals.events.emit({
-					type: "log",
-					level: "warn",
-					msg: `incremental billing row failed to append; the terminal entry remains the canonical record (${thrown instanceof Error ? thrown.message : String(thrown)})`
-				}, spanId);
-			});
-			if (internals.defaults.billingReceipts === "awaited") return append;
-		} };
+			}).then(() => void 0) } : {}
+		};
 		runAgentOptions.summarize = summarize;
 		if (profile?.compaction !== void 0) runAgentOptions.compaction = profile.compaction;
 		if (profile?.evidenceContract !== void 0) runAgentOptions.evidenceContract = profile.evidenceContract;
@@ -19814,7 +20431,15 @@ function createCtx(internals, rootWorkflow) {
 			const sliceRole = slice.role ?? primaryRole;
 			internals.cost.byRole.set(sliceRole, (internals.cost.byRole.get(sliceRole) ?? 0) + priced);
 		}
-		bump(internals.cost.byPhase, state.phase ?? "", usd);
+		let livePhaseUsd = usd;
+		for (const record of result.providerCalls ?? []) {
+			if (record.phase !== "repair") continue;
+			const recordUsd = internals.priceUsd(record.servedBy, record.usage);
+			if (recordUsd === void 0 || !Number.isFinite(recordUsd) || recordUsd < 0) continue;
+			bump(internals.cost.byPhase, "repair", recordUsd);
+			livePhaseUsd -= recordUsd;
+		}
+		bump(internals.cost.byPhase, state.phase ?? "", livePhaseUsd);
 		bump(internals.cost.byAgentType, agentType, usd);
 		bump(internals.cost.byScope, state.scope, usd);
 		if (result.error?.kind === "budget" || internals.budget.exhausted && result.status !== "ok") {
@@ -22047,6 +22672,212 @@ function renderContractRequirements(manifest) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/orchestrator/citation-audit.ts
+const DEFAULT_CITATION_SAMPLE_PER_SECTION = 2;
+const DEFAULT_CITATION_MAX_SAMPLED = 24;
+const DEFAULT_CITATION_EXCERPT_WINDOW = 3;
+/** Excerpt bounds, the claim-pass excerpt discipline. */
+const MAX_CITATION_EXCERPT_LINES = 12;
+const MAX_CITATION_EXCERPT_CHARS = 800;
+/** A citation with an optional `-end` range tail on the line half. */
+const citationWithRange = (pattern) => new RegExp(pattern, "gu");
+const RANGE_TAIL = /^(.*):(\d+)(?:-(\d+))?$/u;
+/**
+* Validates the declared plan numbers; returns the resolved bounds.
+* Garbage throws like every malformed intake.
+*/
+function resolveCitationAuditPlan(options) {
+	const samplePerSection = options.samplePerSection ?? 2;
+	if (!Number.isInteger(samplePerSection) || samplePerSection < 1) throw new ConfigError(`citationAudit.samplePerSection must be a positive integer; got ${String(options.samplePerSection)}`);
+	const maxSampled = options.maxSampled ?? 24;
+	if (!Number.isInteger(maxSampled) || maxSampled < 1) throw new ConfigError(`citationAudit.maxSampled must be a positive integer; got ${String(options.maxSampled)}`);
+	const window = options.window ?? 3;
+	if (!Number.isInteger(window) || window < 0) throw new ConfigError(`citationAudit.window must be a non negative integer; got ${String(options.window)}`);
+	const pattern = options.pattern ?? "[\\w./-]+\\.\\w+:\\d+";
+	let probe;
+	try {
+		probe = new RegExp(pattern, "gu");
+	} catch (thrown) {
+		throw new ConfigError(`citationAudit.pattern does not compile: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
+	}
+	if (probe.test("")) throw new ConfigError("citationAudit.pattern matches the empty string: it would flood the sample instead of anchoring it");
+	return {
+		pattern,
+		samplePerSection,
+		maxSampled,
+		window
+	};
+}
+/** Splits a document into (section marker, body) runs in order. */
+function sectionsOfDocument(document) {
+	const lines = document.split("\n");
+	const runs = [{
+		marker: "",
+		body: []
+	}];
+	for (const line of lines) {
+		if (/^##\s+\S/u.test(line) && !line.startsWith("###")) {
+			runs.push({
+				marker: line.trim(),
+				body: []
+			});
+			continue;
+		}
+		runs.at(-1)?.body.push(line);
+	}
+	return runs.map((run) => ({
+		marker: run.marker,
+		body: run.body.join("\n")
+	})).filter((run) => run.body.trim().length > 0);
+}
+/** The deterministic per-section pick: seeded index selection without replacement. */
+function pickIndexes(count, k, seedInput) {
+	const indexes = Array.from({ length: count }, (_, index) => index);
+	const picked = [];
+	for (let round = 0; round < Math.min(k, count); round += 1) {
+		const index = createHash("sha256").update(`${seedInput}:${String(round)}`).digest().readUInt32BE(0) % indexes.length;
+		const chosen = indexes.splice(index, 1)[0];
+		if (chosen !== void 0) picked.push(chosen);
+	}
+	return picked.sort((a, b) => a - b);
+}
+/**
+* The deterministic stratified sample (RV4004): per H2 section, up to
+* `samplePerSection` citing sentences, selected by a hash chain seeded
+* from the audited document's own hash, so the same candidate always
+* yields the same sample (replay-stable, no clock, no randomness) and
+* a repaired candidate re-samples afresh from its new hash. The whole
+* sample is capped at `maxSampled` by pick rank across sections (every
+* section's first pick seats before any section's second), so a
+* many-section document degrades to one citation per section instead
+* of auditing the first sections only.
+*/
+function sampleCitationRows(document, plan, seed) {
+	const perSection = [];
+	for (const { marker, body } of sectionsOfDocument(document)) {
+		const candidates = [];
+		for (const sentence of sentencesOf(body)) {
+			const match = citationWithRange(plan.pattern).exec(sentence);
+			if (match === null) continue;
+			const anchorText = new RegExp(`${match[0].replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}(?:-(\\d+))?`, "u").exec(sentence)?.[0] ?? match[0];
+			const parsed = RANGE_TAIL.exec(anchorText);
+			if (parsed === null) continue;
+			const path = parsed[1] ?? "";
+			const line = Number(parsed[2]);
+			const endLine = parsed[3] === void 0 ? void 0 : Number(parsed[3]);
+			if (path === "" || !Number.isInteger(line) || line < 1) continue;
+			candidates.push({
+				sentence,
+				anchor: anchorText,
+				path,
+				line,
+				...endLine !== void 0 && Number.isInteger(endLine) && endLine >= line ? { endLine } : {}
+			});
+		}
+		if (candidates.length === 0) continue;
+		const picks = pickIndexes(candidates.length, plan.samplePerSection, `${seed}:${marker}`).map((index) => candidates[index]).filter((candidate) => candidate !== void 0);
+		perSection.push({
+			section: marker,
+			picks
+		});
+	}
+	const rows = [];
+	for (let rank = 0; rows.length < plan.maxSampled; rank += 1) {
+		let any = false;
+		for (const bucket of perSection) {
+			const pick = bucket.picks[rank];
+			if (pick === void 0) continue;
+			any = true;
+			if (rows.length >= plan.maxSampled) break;
+			rows.push({
+				row: rows.length,
+				section: bucket.section,
+				...pick
+			});
+		}
+		if (!any) break;
+	}
+	return rows;
+}
+/**
+* Resolves one sampled citation's excerpt through the host's pure
+* snapshot resolver. The FIRST cited line failing to resolve returns
+* undefined (an unsupported citation by doctrine); later lines simply
+* end the excerpt (a range past the file's end reads as far as the
+* snapshot goes).
+*/
+function citationExcerptOf(resolve, row, window) {
+	const last = Math.min(row.endLine ?? row.line + window, row.line + 12 - 1);
+	const lines = [];
+	for (let line = row.line; line <= last; line += 1) {
+		const text = resolve({
+			path: row.path,
+			line
+		});
+		if (text === void 0) {
+			if (line === row.line) return;
+			break;
+		}
+		lines.push(`L${String(line)}: ${text}`);
+	}
+	const excerpt = lines.join("\n");
+	return excerpt.length > 800 ? `${excerpt.slice(0, 800)}…` : excerpt;
+}
+/** The audit judge's structured verdict schema (mirrors the claim judge). */
+const CITATION_JUDGE_SCHEMA = {
+	type: "object",
+	properties: { verdicts: {
+		type: "array",
+		items: {
+			type: "object",
+			properties: {
+				row: { type: "integer" },
+				verdict: {
+					type: "string",
+					enum: [
+						"supported",
+						"partial",
+						"unsupported"
+					]
+				},
+				reason: { type: "string" }
+			},
+			required: [
+				"row",
+				"verdict",
+				"reason"
+			],
+			additionalProperties: false
+		}
+	} },
+	required: ["verdicts"],
+	additionalProperties: false
+};
+/**
+* Parses the judge output strictly: one verdict per judged row, no
+* duplicates, verdicts from the closed vocabulary. Anything else returns
+* undefined and the caller treats the invocation as a failed judge
+* (nothing was judged; partial verdicts over a partial parse would
+* claim more than the judge said).
+*/
+function parseCitationVerdicts(output, rowIndexes) {
+	const shaped = output;
+	if (shaped === null || shaped === void 0 || !Array.isArray(shaped.verdicts)) return;
+	const parsed = /* @__PURE__ */ new Map();
+	for (const entry of shaped.verdicts) {
+		const row = entry.row;
+		const verdict = entry.verdict;
+		const reason = entry.reason;
+		if (typeof row !== "number" || verdict !== "supported" && verdict !== "partial" && verdict !== "unsupported" || typeof reason !== "string" || parsed.has(row)) return;
+		parsed.set(row, {
+			verdict,
+			reason
+		});
+	}
+	for (const index of rowIndexes) if (!parsed.has(index)) return;
+	return parsed;
+}
+//#endregion
 //#region src/orchestrator/contradictions.ts
 /**
 * The bounded contradiction pass, pure half (RV1301, the sixteenth
@@ -23311,6 +24142,18 @@ function validateOrchestrateOptions(opts) {
 		if (consistency.runFactCoverageRatio !== void 0 && consistency.runFacts !== true) throw new ConfigError("orchestrate claimConsistency.runFactCoverageRatio rides the runFacts pass; set claimConsistency.runFacts true");
 		if (consistency.onLowCoverage !== void 0 && consistency.onLowCoverage !== "report" && consistency.onLowCoverage !== "fail") throw new ConfigError("orchestrate claimConsistency.onLowCoverage must be 'report' or 'fail'; got " + JSON.stringify(consistency.onLowCoverage));
 		if (consistency.onLowCoverage !== void 0 && consistency.minimumCoverageRatio === void 0 && consistency.runFactCoverageRatio === void 0 && consistency.coverageTarget === void 0) throw new ConfigError("orchestrate claimConsistency.onLowCoverage needs a declared floor; set minimumCoverageRatio, runFactCoverageRatio, or coverageTarget");
+		const coveragePolicy = consistency.coveragePolicy;
+		if (coveragePolicy !== void 0 && coveragePolicy !== "observed" && coveragePolicy !== "strict-final") throw new ConfigError(`orchestrate claimConsistency.coveragePolicy must be 'observed' or 'strict-final'; got ${JSON.stringify(coveragePolicy)}`);
+		if (coveragePolicy === "strict-final" && stage === "draft") throw new ConfigError("orchestrate claimConsistency.coveragePolicy 'strict-final' needs stage 'final' or 'both': a draft-only pass grades no final document, so the policy would gate on nothing");
+		const waiver = consistency.waiver;
+		if (waiver !== void 0) {
+			if (coveragePolicy !== "strict-final") throw new ConfigError("orchestrate claimConsistency.waiver requires coveragePolicy 'strict-final': a waiver over an unenforced grade is a signature over nothing");
+			if (typeof waiver !== "object" || waiver === null || Array.isArray(waiver)) throw new ConfigError(`orchestrate claimConsistency.waiver must be an object; got ${JSON.stringify(waiver)}`);
+			const shaped = waiver;
+			if (typeof shaped.principal !== "string" || shaped.principal.length === 0) throw new ConfigError("orchestrate claimConsistency.waiver.principal must be a non empty string; got " + JSON.stringify(shaped.principal));
+			if (typeof shaped.reason !== "string" || shaped.reason.length === 0) throw new ConfigError("orchestrate claimConsistency.waiver.reason must be a non empty string; got " + JSON.stringify(shaped.reason));
+			if (shaped.expiresAt !== void 0 && (typeof shaped.expiresAt !== "string" || Number.isNaN(Date.parse(shaped.expiresAt)))) throw new ConfigError(`orchestrate claimConsistency.waiver.expiresAt must be an ISO 8601 date string; got ${JSON.stringify(shaped.expiresAt)}`);
+		}
 		if (consistency.judge !== void 0) {
 			const judge = consistency.judge;
 			if (typeof judge !== "object" || judge === null || Array.isArray(judge)) throw new ConfigError(`orchestrate claimConsistency.judge must be an object; got ${JSON.stringify(consistency.judge)}`);
@@ -23326,6 +24169,18 @@ function validateOrchestrateOptions(opts) {
 		}
 	}
 	if (opts.executionFacts !== void 0 && typeof opts.executionFacts !== "boolean") throw new ConfigError(`orchestrate executionFacts must be a boolean; got ${typeof opts.executionFacts}`);
+	const audit = opts?.citationAudit;
+	if (audit !== void 0) {
+		if (typeof audit !== "object" || audit === null || Array.isArray(audit)) throw new ConfigError(`orchestrate citationAudit must be an object; got ${JSON.stringify(audit)}`);
+		if (typeof audit.resolve !== "function") throw new ConfigError("orchestrate citationAudit.resolve must be a function: the pure host snapshot reader is the whole evidence channel of the audit");
+		resolveCitationAuditPlan(audit);
+		if (audit.onFound !== void 0 && audit.onFound !== "report" && audit.onFound !== "repair" && audit.onFound !== "fail") throw new ConfigError(`orchestrate citationAudit.onFound must be 'report', 'repair' or 'fail'; got ${String(audit.onFound)}`);
+		if (audit.judge?.estCost !== void 0) requireNonNegativeNumber(audit.judge.estCost, "orchestrate citationAudit.judge.estCost");
+		if (audit.onFound === "repair") {
+			if (opts?.synthesis === void 0) throw new ConfigError("orchestrate citationAudit.onFound 'repair' requires synthesis: the bounded round is one more composition, and without one there is nothing to repair with");
+			if (opts?.claimConsistency?.onFound === "repair") throw new ConfigError("orchestrate citationAudit.onFound 'repair' cannot pair with claimConsistency.onFound 'repair': the run grants ONE bounded repair round (RV3307), so arm one consumer and give the other 'report' or 'fail'");
+		}
+	}
 	const spec = opts.budget;
 	if (spec === void 0) return;
 	if (spec.capUsd !== void 0) requireNonNegativeNumber(spec.capUsd, "orchestrate budget.capUsd");
@@ -23337,6 +24192,7 @@ function validateOrchestrateOptions(opts) {
 		if (opts.synthesis.mode === "incremental") throw new ConfigError("orchestrate budget.synthesisReserveUsd is incompatible with synthesis.mode 'incremental': the reserve protects the single post-fan-in invocation");
 	}
 	if (spec.finalizeTurns !== void 0) requirePositiveInteger$2(spec.finalizeTurns, "orchestrate budget.finalizeTurns");
+	if (spec.acceptanceReserve !== void 0 && spec.acceptanceReserve !== "warn" && spec.acceptanceReserve !== "require") throw new ConfigError(`orchestrate budget.acceptanceReserve must be 'warn' or 'require'; got ${String(spec.acceptanceReserve)}`);
 	if (spec.atCap !== void 0 && spec.atCap !== "finish-with-partial" && spec.atCap !== "fail-run") throw new ConfigError(`orchestrate budget.atCap must be 'finish-with-partial' or 'fail-run'; got ${String(spec.atCap)}`);
 }
 function orchestratorPrompt(goal, maxSpawns, extensionLines) {
@@ -23534,6 +24390,48 @@ function makeOrchestratorWorkflow(goal, opts) {
 				};
 			}
 		}
+		if (opts?.budget?.acceptanceReserve === "require") {
+			const { requiredUsd, terms } = acceptanceTailRequiredUsd({
+				...opts.budget.synthesisReserveUsd === void 0 ? {} : { synthesisReserveUsd: opts.budget.synthesisReserveUsd },
+				...opts?.claimConsistency?.stage === void 0 ? {} : { claimStage: opts.claimConsistency.stage },
+				...opts?.claimConsistency?.onFound === void 0 ? {} : { claimOnFound: opts.claimConsistency.onFound },
+				...opts?.claimConsistency?.judge?.estCost === void 0 ? {} : { claimJudgeEstCostUsd: opts.claimConsistency.judge.estCost },
+				...opts?.finishValidation?.estRepairCostUsd === void 0 ? {} : { finishEstRepairCostUsd: opts.finishValidation.estRepairCostUsd },
+				...opts?.synthesis?.estCost === void 0 ? {} : { synthesisEstCostUsd: opts.synthesis.estCost },
+				...opts?.citationAudit?.judge?.estCost === void 0 ? {} : { citationJudgeEstCostUsd: opts.citationAudit.judge.estCost },
+				...opts?.citationAudit?.onFound === void 0 ? {} : { citationOnFound: opts.citationAudit.onFound },
+				...opts?.claimConsistency === void 0 ? {} : { claimConfigured: true },
+				workingRoomUsd: capState?.turnEstimateUsd ?? internals.flatReserveUsd ?? .5
+			});
+			const capUsd = capState?.effectiveCapUsd;
+			if (capUsd === void 0 || capUsd < requiredUsd) {
+				const termsLine = formatAcceptanceTailTerms(terms);
+				await internals.replayer.appendSinglePhase({
+					scope: callingState.scope,
+					key: deriverV2.deriveKey({ kind: "acceptance-reserve-refused" }),
+					kind: "decision",
+					status: "ok",
+					spanId: internals.spans.mint(callingState.spanId),
+					site: "orchestrator-budget",
+					value: {
+						decisionType: "acceptance_reserve_refused",
+						requiredUsd,
+						effectiveCapUsd: capUsd ?? null,
+						synthesisReserveUsd: terms.synthesisReserveUsd,
+						judgeEstUsd: terms.judgeEstUsd,
+						judgePasses: terms.judgePasses,
+						estRepairCostUsd: terms.estRepairCostUsd,
+						roundCompositionUsd: terms.roundCompositionUsd,
+						...terms.citationJudgePasses === void 0 ? {} : {
+							citationJudgeEstUsd: terms.citationJudgeEstUsd ?? 0,
+							citationJudgePasses: terms.citationJudgePasses
+						},
+						workingRoomUsd: terms.workingRoomUsd
+					}
+				});
+				throw new OrchestratorCapConfigError(capUsd === void 0 ? `budget.acceptanceReserve 'require' needs a resolved effective cap to hold the declared acceptance tail against (${termsLine}); declare budget.capUsd or a run ceiling` : `budget.acceptanceReserve 'require': the declared acceptance tail does not fit the effective cap ${capUsd.toFixed(4)} USD (${termsLine}); raise the cap or lower the declared tail`);
+			}
+		}
 		const records = /* @__PURE__ */ new Map();
 		const byOrdinal = /* @__PURE__ */ new Map();
 		const rejectedByOrdinal = /* @__PURE__ */ new Map();
@@ -23684,6 +24582,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const childState = {
 				scope,
 				spanId: internals.spans.mint(callingState.spanId),
+				phase: callingState.phase ?? "fan-out",
 				signal: upstream === void 0 ? controller.signal : AbortSignal.any([upstream, controller.signal]),
 				budgetScope: placement?.ownAccount === true ? scope : callingState.budgetScope ?? "run"
 			};
@@ -24486,6 +25385,20 @@ function makeOrchestratorWorkflow(goal, opts) {
 		*/
 		let validationInvocationStart = 0;
 		/**
+		* The stage a finish-validation verdict is rendered under (RV4002,
+		* the fifth comparison experiment): 'composition' for the initial
+		* composition invocation, the no-synthesis coordination finish,
+		* and the reserved finalizer wake; 'round' from the moment the
+		* RV3307 claim repair round's own composition dispatches. Written
+		* onto every `orchestrator_finish_validation` decision so the
+		* workflow-wide repair ledger is a pure journal fold instead of a
+		* positional reconstruction (the experiment's judge rebuilt the
+		* one draft repair from the raw transcript). Live state on the
+		* RV808b doctrine: replay re-delivers the journaled decisions and
+		* never re-runs validateFinish.
+		*/
+		let finishValidationStage = "composition";
+		/**
 		* The staged release of the round's mechanical money leg (RV3802),
 		* armed by the bounded claim repair round right before its
 		* composition dispatches and fired at the round invocation's FIRST
@@ -24673,7 +25586,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 					};
 					return {
 						kind: "spliced",
-						result: spliceSections(retained, declared, patch)
+						result: spliceSections(retained, declared, patch),
+						markers
 					};
 				}
 			};
@@ -24684,6 +25598,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			if (validationSpec === void 0) return { ok: true };
 			let effective = call.result ?? null;
 			let spliced = false;
+			let splicedMarkers;
 			if (sectionalRoundContext !== void 0) {
 				const round = sectionalRoundContext;
 				const args = call.args ?? {};
@@ -24721,6 +25636,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 					};
 					effective = spliceSections(round.base, round.sections, patch);
 					spliced = true;
+					splicedMarkers = markers;
 				}
 			} else if (finishSectional !== void 0) {
 				const resolution = finishSectional.resolve(call);
@@ -24730,6 +25646,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				};
 				effective = resolution.result ?? null;
 				spliced = resolution.kind === "spliced";
+				if (resolution.kind === "spliced") splicedMarkers = resolution.markers;
 			}
 			const maxRepairs = validationSpec.maxRepairs ?? 1;
 			const known = validationDecisions();
@@ -24839,6 +25756,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 					decisionType: "orchestrator_finish_validation",
 					callId: call.id,
 					verdict: failed.length === 0 || deterministicRepair?.outcome === "accepted" ? "accepted" : repairsUsed < maxRepairs ? "repair" : "rejected",
+					stage: finishValidationStage,
+					...spliced && splicedMarkers !== void 0 ? {
+						spliced: true,
+						sections: [...splicedMarkers]
+					} : {},
 					failed: deterministicRepair?.outcome === "accepted" ? [] : failed,
 					repairsUsed,
 					maxRepairs,
@@ -24914,6 +25836,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			if (policy === void 0) return Promise.resolve({ ok: true });
 			let effective = call.result ?? null;
 			let spliced = false;
+			let splicedMarkers;
 			if (draftSectional !== void 0) {
 				const resolution = draftSectional.resolve(call);
 				if (resolution.kind === "refused") return Promise.resolve({
@@ -24922,22 +25845,54 @@ function makeOrchestratorWorkflow(goal, opts) {
 				});
 				effective = resolution.result ?? null;
 				spliced = resolution.kind === "spliced";
+				if (resolution.kind === "spliced") splicedMarkers = resolution.markers;
 			}
 			const result = effective;
 			const text = typeof result === "string" ? result : JSON.stringify(result);
-			const accept = () => Promise.resolve(spliced ? {
-				ok: true,
-				resolved: { result }
-			} : { ok: true });
-			const reject = (feedback) => {
+			const accept = async () => {
+				if (spliced && splicedMarkers !== void 0) await internals.replayer.appendSinglePhase({
+					scope: callingState.scope,
+					key: `draft-gate-accept:${call.id}`,
+					kind: "decision",
+					status: "ok",
+					spanId: internals.spans.mint(callingState.spanId),
+					site: "orchestrator-draft-gate",
+					value: {
+						decisionType: "orchestrator_draft_gate",
+						callId: call.id,
+						verdict: "accepted",
+						spliced: true,
+						sections: [...splicedMarkers]
+					}
+				});
+				return spliced ? {
+					ok: true,
+					resolved: { result }
+				} : { ok: true };
+			};
+			const reject = async (feedback, failed) => {
 				draftSectional?.retain(result);
-				return Promise.resolve({
+				await internals.replayer.appendSinglePhase({
+					scope: callingState.scope,
+					key: `draft-gate:${call.id}`,
+					kind: "decision",
+					status: "ok",
+					spanId: internals.spans.mint(callingState.spanId),
+					site: "orchestrator-draft-gate",
+					value: {
+						decisionType: "orchestrator_draft_gate",
+						callId: call.id,
+						verdict: "rejected",
+						failed
+					}
+				});
+				return {
 					ok: false,
 					feedback: {
 						...feedback,
 						...draftSectional === void 0 ? {} : { sectionalRepair: draftSectional.guidance() }
 					}
-				});
+				};
 			};
 			if (policy === "contract") {
 				const failed = [];
@@ -24963,7 +25918,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				return reject({
 					error: "the coordination draft failed the declared finish contract; repair the draft and call finish again: a contract-valid draft skips the synthesis invocation entirely, and every gap left here is paid for again downstream",
 					failed
-				});
+				}, failed);
 			}
 			const reasons = [];
 			if (policy.minWords !== void 0) {
@@ -24976,7 +25931,10 @@ function makeOrchestratorWorkflow(goal, opts) {
 			return reject({
 				error: "the coordination draft failed the draft policy; repair the draft and call finish again: the synthesis invocation composes the FINAL result from this draft, and a collapsed draft starves it of the evidence the validators demand",
 				reasons
-			});
+			}, [{
+				name: "draft-policy",
+				reasons
+			}]);
 		};
 		/**
 		* The extension finish gate (RV3202, the 2026-08-11 experiment's
@@ -25071,6 +26029,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 		};
 		const orchestratorState = { ...callingState };
 		if (orchestratorAccount !== void 0) orchestratorState.budgetScope = orchestratorAccount;
+		orchestratorState.phase = orchestratorState.phase ?? "coordination";
 		const loopBreakSignal = validationSpec === void 0 ? forcedFinishController.signal : AbortSignal.any([forcedFinishController.signal, validationAbort.signal]);
 		orchestratorState.signal = callingState.signal === void 0 ? loopBreakSignal : AbortSignal.any([callingState.signal, loopBreakSignal]);
 		/**
@@ -25126,6 +26085,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				if (orchestratorAccount !== void 0) internals.budget.releaseFinalizeReserve(orchestratorAccount);
 				const finalState = { ...callingState };
 				if (orchestratorAccount !== void 0) finalState.budgetScope = orchestratorAccount;
+				finalState.phase = finalState.phase ?? "coordination";
 				const digest = buildDigest(wakeOrdinal);
 				const reserveBaseline = orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.spentUsd ?? 0;
 				const dispatched = await runtime.runInScope(finalState, () => ctx.agent([
@@ -25199,6 +26159,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			].join("\n");
 			const noteState = { ...callingState };
 			if (orchestratorAccount !== void 0) noteState.budgetScope = orchestratorAccount;
+			noteState.phase = noteState.phase ?? "composition";
 			const noteOpts = {
 				role: "synthesize",
 				result: "full",
@@ -25415,6 +26376,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 		*/
 		let claimFindingsFound;
 		/**
+		* The citation findings riding the armed audit round's prompt
+		* (RV4004): set exactly while that round's composition dispatches,
+		* so every other synthesis prompt keeps its bytes.
+		*/
+		let carriedCitationFindings;
+		/**
 		* The observed price of this run's own latest post draft claim
 		* judge pass (RV3701): the fallback sizing of the repair round's
 		* convergence hold when the host declared no `judge.estCost`. By
@@ -25693,6 +26660,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			].join("\n");
 			const judgeState = { ...callingState };
 			if (orchestratorAccount !== void 0) judgeState.budgetScope = orchestratorAccount;
+			judgeState.phase = judgeState.phase ?? "judge";
 			const judgeOpts = {
 				role: "synthesize",
 				result: "full",
@@ -25788,7 +26756,204 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...snapshot ?? {}
 			} });
 		};
-		const runSynthesis = async (draft) => {
+		/**
+		* The citation entailment audit's terminal state (RV4004):
+		* undefined until the pass ran (or when it is not configured),
+		* the meta plus the findings once it did. `citationFindingsFound`
+		* carries every non-supported sampled citation (mechanically
+		* unresolved rows included); `[]` is the judge's claim that every
+		* sampled citation is supported.
+		*/
+		let citationAuditMeta;
+		let citationFindingsFound;
+		/**
+		* The citation entailment audit (RV4004): a deterministic
+		* stratified sample of the document's citing sentences, excerpts
+		* through the host's pure snapshot resolver, one bounded judge
+		* invocation. Mirrors the claim judge's dispatch discipline
+		* (declined admissions degrade typed and journaled, dead judges
+		* stamp the meta, armed postures refuse to pass silently); the
+		* POSTURE consequences of findings ('fail', the RV3307 round)
+		* belong to the call site.
+		*/
+		const runCitationAudit = async (document, pass) => {
+			const auditSpec = opts?.citationAudit;
+			if (auditSpec === void 0) return;
+			const plan = resolveCitationAuditPlan(auditSpec);
+			const auditedHash = createHash("sha256").update(jcsSerialize(document ?? null), "utf8").digest("hex");
+			const rows = sampleCitationRows(typeof document === "string" ? document : JSON.stringify(document ?? null), plan, auditedHash).map((row) => {
+				const excerpt = citationExcerptOf(auditSpec.resolve, row, plan.window);
+				return excerpt === void 0 ? row : {
+					...row,
+					excerpt
+				};
+			});
+			const perSection = {};
+			const bucketOf = (section) => perSection[section] ??= {
+				sampled: 0,
+				supported: 0,
+				partial: 0,
+				unsupported: 0
+			};
+			for (const row of rows) bucketOf(row.section).sampled += 1;
+			const mechanical = rows.filter((row) => row.excerpt === void 0).map((row) => ({
+				row: row.row,
+				section: row.section,
+				sentence: row.sentence,
+				anchor: row.anchor,
+				verdict: "unsupported",
+				reason: "the cited location does not resolve in the host snapshot"
+			}));
+			for (const finding of mechanical) bucketOf(finding.section).unsupported += 1;
+			const judgeRows = rows.filter((row) => row.excerpt !== void 0);
+			const metaBase = {
+				sampled: rows.length,
+				supported: 0,
+				partial: 0,
+				unsupported: mechanical.length,
+				unresolved: mechanical.length,
+				perSection,
+				auditedHash,
+				samplePerSection: plan.samplePerSection,
+				maxSampled: plan.maxSampled
+			};
+			const onFound = auditSpec.onFound ?? "report";
+			if (judgeRows.length === 0) {
+				citationAuditMeta = {
+					...metaBase,
+					judgeInvoked: false
+				};
+				citationFindingsFound = mechanical;
+				return;
+			}
+			const judgePrompt = ["You audit CITATIONS for entailment. Each row below carries one sentence from a composed document, the source location it cites, and the resolved text of the cited lines. Judge whether the cited text ENTAILS what the sentence claims about it: 'supported' when the lines carry the claimed meaning, 'partial' when they carry some of it but not the load-bearing part, 'unsupported' when they are about something else entirely, however plausible the sentence reads. Judge the MEANING, not the mechanics: the location resolving, or sharing words with the sentence, is not entailment. Answer with { verdicts: [{ row, verdict, reason }] }, one verdict per row, reason one short sentence.", `ROWS: ${JSON.stringify(judgeRows.map((row) => ({
+				row: row.row,
+				section: row.section,
+				sentence: row.sentence,
+				anchor: row.anchor,
+				excerpt: row.excerpt
+			})))}`].join("\n");
+			const auditJudgeState = { ...callingState };
+			if (orchestratorAccount !== void 0) auditJudgeState.budgetScope = orchestratorAccount;
+			auditJudgeState.phase = auditJudgeState.phase ?? "judge";
+			const judgeOpts = {
+				role: "synthesize",
+				result: "full",
+				label: pass === "round" ? "citation-entailment-judge-round" : "citation-entailment-judge",
+				schema: CITATION_JUDGE_SCHEMA,
+				limits: auditSpec.judge?.limits ?? { maxTurns: 3 },
+				...auditSpec.judge?.model === void 0 ? {} : { model: auditSpec.judge.model },
+				...auditSpec.judge?.effort === void 0 ? {} : { effort: auditSpec.judge.effort },
+				...auditSpec.judge?.estCost === void 0 ? {} : { estCost: auditSpec.judge.estCost }
+			};
+			let judged;
+			try {
+				judged = await runtime.runInScope(auditJudgeState, () => ctx.agent(judgePrompt, judgeOpts));
+				noteInternalSettle(judged);
+			} catch (declined) {
+				if (!(declined instanceof BudgetExhaustedError)) throw declined;
+				citationAuditMeta = {
+					...metaBase,
+					judgeInvoked: false,
+					judgeDeclined: true
+				};
+				citationFindingsFound = void 0;
+				const declineKey = deriverV2.deriveKey({ kind: pass === "round" ? "orchestrator-citation-judge-declined-round" : "orchestrator-citation-judge-declined" });
+				if (!internals.replayer.snapshot().some((entry) => entry.kind === "decision" && entry.key === declineKey)) await internals.replayer.appendSinglePhase({
+					scope: callingState.scope,
+					key: declineKey,
+					kind: "decision",
+					status: "ok",
+					spanId: internals.spans.mint(callingState.spanId),
+					site: "orchestrator-budget",
+					value: {
+						decisionType: "orchestrator_citation_judge_declined",
+						reason: declined.message.slice(0, 300),
+						remainingUsd: internals.budget.remainingUsd(orchestratorAccount ?? "run") ?? null
+					}
+				});
+				internals.events.emit({
+					type: "log",
+					level: "warn",
+					msg: "orchestrator citation audit judge declined by admission",
+					data: { reason: declined.message.slice(0, 300) }
+				}, callingState.spanId);
+				if (onFound === "fail" || onFound === "repair") throw new FailRunError(`the citation audit judge could not be admitted within the orchestrator account, so the armed ${onFound} posture cannot pass the document: ` + declined.message.slice(0, 300), { data: {
+					source: "orchestrator_citation_audit",
+					citationAuditMeta
+				} });
+				return;
+			}
+			const verdicts = judged.status === "ok" ? parseCitationVerdicts(judged.output, judgeRows.map((row) => row.row)) : void 0;
+			if (verdicts === void 0) {
+				citationAuditMeta = {
+					...metaBase,
+					judgeInvoked: true,
+					judgeFailed: true
+				};
+				citationFindingsFound = void 0;
+				internals.events.emit({
+					type: "log",
+					level: "warn",
+					msg: "orchestrator citation audit judge failed",
+					data: { status: judged.status }
+				}, callingState.spanId);
+				if (onFound === "fail" || onFound === "repair") throw new FailRunError(`the citation audit judge did not produce a usable verdict, so the armed ${onFound} posture cannot pass the document`, { data: {
+					source: "orchestrator_citation_audit",
+					citationAuditMeta
+				} });
+				return;
+			}
+			const findings = [...mechanical];
+			let supported = 0;
+			let partial = 0;
+			let unsupported = mechanical.length;
+			for (const row of judgeRows) {
+				const verdict = verdicts.get(row.row);
+				if (verdict === void 0) continue;
+				if (verdict.verdict === "supported") {
+					supported += 1;
+					bucketOf(row.section).supported += 1;
+					continue;
+				}
+				if (verdict.verdict === "partial") {
+					partial += 1;
+					bucketOf(row.section).partial += 1;
+				} else {
+					unsupported += 1;
+					bucketOf(row.section).unsupported += 1;
+				}
+				findings.push({
+					row: row.row,
+					section: row.section,
+					sentence: row.sentence,
+					anchor: row.anchor,
+					verdict: verdict.verdict,
+					reason: verdict.reason
+				});
+			}
+			citationAuditMeta = {
+				...metaBase,
+				supported,
+				partial,
+				unsupported,
+				judgeInvoked: true
+			};
+			citationFindingsFound = findings;
+			internals.events.emit({
+				type: "log",
+				level: findings.length === 0 ? "debug" : "info",
+				msg: "orchestrator citation entailment audit",
+				data: {
+					sampled: rows.length,
+					supported,
+					partial,
+					unsupported,
+					pass
+				}
+			}, callingState.spanId);
+		};
+		const runSynthesis = async (draft, stagePhase = "composition") => {
 			const spec = opts?.synthesis;
 			if (spec === void 0) return draft;
 			await recoveryDone;
@@ -26040,7 +27205,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...opts?.contradictions?.onFound !== "carry" || contradictionsFound === void 0 || contradictionsFound.length === 0 ? [] : ["CHILD CONTRADICTIONS: the settled children read these cited locations differently; resolve each one EXPLICITLY in the final result (say which reading holds and why it does) instead of silently picking one. " + JSON.stringify(contradictionsFound)],
 				...opts?.claimConsistency?.onFound !== "carry" && opts?.claimConsistency?.onFound !== "repair" || claimFindingsFound === void 0 || claimFindingsFound.length === 0 ? [] : ["CLAIM CONTRADICTIONS: the composed draft contradicts the settled child pool at these cited locations; resolve each one EXPLICITLY in the final result (say which reading holds and why) instead of keeping the inverted claim. " + JSON.stringify(claimFindingsFound)],
 				...opts?.claimConsistency?.onFound !== "carry" && opts?.claimConsistency?.onFound !== "repair" || claimFindingsFound === void 0 || claimFindingsFound.length === 0 ? [] : hostValidationLessons(),
-				...sectionalRoundContext === void 0 ? [] : [`RETAINED FINAL: ${JSON.stringify(sectionalRoundContext.base)}`, "SECTIONAL ROUND: the accepted document above is RETAINED; repair ONLY the sections owning the contradicted claims by calling finish({ sections: { \"<marker>\": \"<new section body>\" } }). Unchanged sections are spliced from the retained document byte for byte and the spliced whole is validated and judged. Target sections: " + JSON.stringify(sectionalRoundContext.targets) + ". Declared markers: " + JSON.stringify(sectionalRoundContext.sections) + ". Resubmit the full document as result only when a targeted repair is impossible."],
+				...carriedCitationFindings === void 0 || carriedCitationFindings.length === 0 ? [] : ["CITATION AUDIT FINDINGS: these sampled citations were judged NOT entailed by their cited lines; for each, either fix the citation to the lines that actually carry the claim or rewrite the sentence to claim what the cited lines say, and keep every other sentence byte identical. " + JSON.stringify(carriedCitationFindings)],
+				...sectionalRoundContext === void 0 ? [] : [
+					`RETAINED FINAL: ${JSON.stringify(sectionalRoundContext.base)}`,
+					"SECTIONAL ROUND: the accepted document above is RETAINED; repair ONLY the sections owning the contradicted claims by calling finish({ sections: { \"<marker>\": \"<new section body>\" } }). Unchanged sections are spliced from the retained document byte for byte and the spliced whole is validated and judged. Target sections: " + JSON.stringify(sectionalRoundContext.targets) + ". Declared markers: " + JSON.stringify(sectionalRoundContext.sections) + ". Resubmit the full document as result only when a targeted repair is impossible.",
+					"Rewritten sections must keep the retained evidence discipline: a sentence making a verified or confirmed grade claim carries the run id or a file:line citation INSIDE the sentence, exactly like the retained sections do; a rewritten sentence that drops it fails the finish contract mechanically."
+				],
 				...spec.policyFacts === true ? [(() => {
 					const byStatus = {};
 					let extensionsGranted = 0;
@@ -26141,6 +27311,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const configuredReserveUsd = opts?.budget?.synthesisReserveUsd ?? 0;
 			const heldReserveUsd = orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.synthesisReserveUsd ?? 0;
 			const synthesisState = { ...callingState };
+			synthesisState.phase = synthesisState.phase ?? stagePhase;
 			if (orchestratorAccount !== void 0) {
 				synthesisState.budgetScope = orchestratorAccount;
 				internals.budget.releaseSynthesisReserve(orchestratorAccount);
@@ -26167,6 +27338,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				}
 			};
 			validationInvocationStart = validationDecisions().length;
+			finishValidationStage = stagePhase === "repair" ? "round" : "composition";
 			const synthesized = await runtime.runInScope(synthesisState, () => ctx.agent(prompt, synthesisOpts));
 			noteInternalSettle(synthesized);
 			synthesisSchemaRejectedExchanges = synthesized.schemaRejectedTerminalExchanges ?? 0;
@@ -26888,6 +28060,10 @@ function makeOrchestratorWorkflow(goal, opts) {
 		if (claimStage !== "draft") {
 			claimConsistencyDraftMeta = claimStage === "both" ? claimConsistencyMeta : void 0;
 			await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+			if ((opts?.claimConsistency?.onFound ?? "report") === "repair" && claimConsistencyMeta !== void 0) {
+				claimConsistencyMeta.passes = 1;
+				claimConsistencyMeta.semanticRepairRounds = 0;
+			}
 			if ((opts?.claimConsistency?.onFound ?? "report") === "repair" && claimFindingsFound !== void 0 && claimFindingsFound.length > 0) {
 				const hashOfDocument = (value) => createHash("sha256").update(jcsSerialize(value ?? null), "utf8").digest("hex");
 				const preRepairHash = hashOfDocument(synthesizedFinal);
@@ -26920,7 +28096,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 					}, callingState.spanId);
 				}
 				try {
-					synthesizedFinal = await runSynthesis(result.output);
+					synthesizedFinal = await runSynthesis(result.output, "repair");
 				} catch (thrown) {
 					await journalSynthesisAdmissionDecline(thrown);
 					const hostRejection = thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) && thrown.data.source === "orchestrator_finish_validation" ? thrown.data : void 0;
@@ -26958,6 +28134,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 				}
 				try {
 					await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+					if (claimConsistencyMeta !== void 0) {
+						claimConsistencyMeta.passes = 2;
+						claimConsistencyMeta.firstPassFindings = carried.length;
+						claimConsistencyMeta.semanticRepairRounds = 1;
+					}
 				} catch (thrown) {
 					if (thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) && thrown.data.source === "orchestrator_claim_consistency") throw new FailRunError(thrown.message, { data: {
 						...thrown.data,
@@ -26979,6 +28160,93 @@ function makeOrchestratorWorkflow(goal, opts) {
 				} });
 			}
 		}
+		if (opts?.citationAudit !== void 0) {
+			const hashOfDocument = (value) => createHash("sha256").update(jcsSerialize(value ?? null), "utf8").digest("hex");
+			await runCitationAudit(synthesizedFinal, "first");
+			const auditOnFound = opts.citationAudit.onFound ?? "report";
+			const unsupportedOf = () => (citationFindingsFound ?? []).filter((finding) => finding.verdict === "unsupported");
+			const firstUnsupported = unsupportedOf();
+			if (auditOnFound === "fail" && firstUnsupported.length > 0) throw new FailRunError(`the citation audit judged ${String(firstUnsupported.length)} sampled citation${firstUnsupported.length === 1 ? "" : "s"} UNSUPPORTED by the cited lines, and the armed fail posture cannot pass the document`, { data: {
+				source: "orchestrator_citation_audit",
+				citationFindings: citationFindingsFound,
+				citationAuditMeta,
+				...acceptanceSnapshot
+			} });
+			if (auditOnFound === "repair" && citationAuditMeta !== void 0) {
+				citationAuditMeta.passes = 1;
+				citationAuditMeta.citationRepairRounds = 0;
+			}
+			if (auditOnFound === "repair" && firstUnsupported.length > 0) {
+				const preRepairHash = hashOfDocument(synthesizedFinal);
+				const carried = firstUnsupported;
+				const auditConvergenceHoldUsd = opts.citationAudit.judge?.estCost ?? 0;
+				const auditHoldScope = orchestratorAccount ?? "run";
+				if (auditConvergenceHoldUsd > 0) internals.budget.commitConvergenceReserve(auditHoldScope, auditConvergenceHoldUsd);
+				const auditRepairHoldUsd = validationSpec === void 0 ? 0 : validationSpec.estRepairCostUsd ?? lastMechanicalRepairCostUsd(internals.replayer.snapshot(), (servedBy, usage) => internals.priceUsd(servedBy, usage)) ?? 0;
+				if (auditRepairHoldUsd > 0) {
+					internals.budget.commitRepairReserve(auditHoldScope, auditRepairHoldUsd);
+					releaseRepairLeg = () => {
+						releaseRepairLeg = void 0;
+						internals.budget.releaseRepairReserve(auditHoldScope);
+					};
+				}
+				const auditRoundPlan = validationSpec !== void 0 && typeof synthesizedFinal === "string" ? sectionalRoundPlan(synthesizedFinal, carried.map((finding) => finding.sentence)) : void 0;
+				if (auditRoundPlan !== void 0) {
+					sectionalRoundContext = {
+						base: synthesizedFinal,
+						...auditRoundPlan
+					};
+					internals.events.emit({
+						type: "log",
+						level: "debug",
+						msg: "orchestrator sectional round armed",
+						data: {
+							targets: auditRoundPlan.targets,
+							sections: auditRoundPlan.sections.length
+						}
+					}, callingState.spanId);
+				}
+				carriedCitationFindings = carried;
+				try {
+					synthesizedFinal = await runSynthesis(result.output, "repair");
+				} catch (thrown) {
+					await journalSynthesisAdmissionDecline(thrown);
+					const auditHostRejection = (thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) ? thrown.data.source : void 0) === "orchestrator_finish_validation" ? thrown.data : void 0;
+					throw new FailRunError(auditHostRejection !== void 0 ? `the citation audit repair round dispatched and its repaired candidate failed host validation (${thrown instanceof Error ? thrown.message.slice(0, 300) : String(thrown)}); ${String(carried.length)} unsupported citation${carried.length === 1 ? "" : "s"} stand unconsumed and a gate armed to repair must not pass silently` : `the citation audit repair round could not dispatch (${thrown instanceof Error ? thrown.message.slice(0, 300) : String(thrown)}); ${String(carried.length)} unsupported citation${carried.length === 1 ? "" : "s"} stand unconsumed and a gate armed to repair must not pass silently`, { data: {
+						source: "orchestrator_citation_audit",
+						citationFindings: carried,
+						citationAuditMeta,
+						repairsUsed: auditHostRejection !== void 0 ? 1 : 0,
+						roundDispatched: auditHostRejection !== void 0,
+						preRepairHash,
+						...acceptanceSnapshot
+					} });
+				} finally {
+					carriedCitationFindings = void 0;
+					sectionalRoundContext = void 0;
+					releaseRepairLeg = void 0;
+					if (auditRepairHoldUsd > 0) internals.budget.releaseRepairReserve(auditHoldScope);
+					if (auditConvergenceHoldUsd > 0) internals.budget.releaseConvergenceReserve(auditHoldScope);
+				}
+				await runCitationAudit(synthesizedFinal, "round");
+				if (citationAuditMeta !== void 0) {
+					citationAuditMeta.passes = 2;
+					citationAuditMeta.firstPassFindings = carried.length;
+					citationAuditMeta.citationRepairRounds = 1;
+				}
+				if (opts?.claimConsistency !== void 0 && claimStage !== "draft") await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+				const survivors = unsupportedOf();
+				if (survivors.length > 0) throw new FailRunError(`the citation audit still judged ${String(survivors.length)} sampled citation${survivors.length === 1 ? "" : "s"} UNSUPPORTED after the bounded repair round: the repaired document keeps citing lines that do not carry its claims`, { data: {
+					source: "orchestrator_citation_audit",
+					citationFindings: citationFindingsFound,
+					citationAuditMeta,
+					repairsUsed: 1,
+					preRepairHash,
+					repairedHash: hashOfDocument(synthesizedFinal),
+					...acceptanceSnapshot
+				} });
+			}
+		}
 		const envelopeSchemaRecovered = (result.schemaRecoveredTerminalExchanges ?? 0) + synthesisSchemaRecoveredExchanges;
 		const deliverable = deliverableVerdict(synthesizedFinal);
 		const draftToFinal = opts?.synthesis === void 0 ? void 0 : (() => {
@@ -26993,6 +28261,49 @@ function makeOrchestratorWorkflow(goal, opts) {
 			};
 		})();
 		const envelopeRejectedCandidates = rejectedFinishCandidates();
+		const acceptedRepairs = validationDecisions().map((verdict) => verdict.deterministicRepair).filter((repair) => repair !== void 0 && repair.outcome === "accepted");
+		const lastAcceptedRepair = acceptedRepairs.at(-1);
+		const deterministicPatches = lastAcceptedRepair === void 0 ? void 0 : {
+			decisions: acceptedRepairs.length,
+			patches: acceptedRepairs.reduce((sum, repair) => sum + repair.patches.length, 0),
+			lastBeforeHash: lastAcceptedRepair.beforeHash,
+			lastAfterHash: lastAcceptedRepair.afterHash
+		};
+		const repairLedger = validationSpec !== void 0 || (opts?.claimConsistency?.onFound ?? "report") === "repair" || opts?.citationAudit?.onFound === "repair" ? repairLedgerFromJournal(internals.replayer.snapshot(), (servedBy, usage) => internals.priceUsd(servedBy, usage)) : void 0;
+		let claimCoverageWaiver;
+		if (opts?.claimConsistency?.coveragePolicy === "strict-final") {
+			const grade = claimConsistencyMeta?.coverage ?? "not-judged";
+			if (grade !== "full") {
+				const waiverSpec = opts.claimConsistency.waiver;
+				const expired = waiverSpec?.expiresAt !== void 0 && Date.parse(waiverSpec.expiresAt) < internals.now();
+				if (waiverSpec === void 0 || expired) throw new FailRunError(`claimConsistency.coveragePolicy 'strict-final': the final coverage grade is '${grade}', not 'full', and ` + (waiverSpec === void 0 ? "no waiver is declared" : `the declared waiver expired at ${String(waiverSpec.expiresAt)}`) + "; raise the coverage (pairs, targets, critical anchors) or record a waiver naming who accepts the gap and why", { data: {
+					source: "orchestrator_claim_consistency",
+					coveragePolicy: "strict-final",
+					coverage: grade,
+					...waiverSpec === void 0 ? {} : { waiverExpiredAt: waiverSpec.expiresAt ?? null },
+					...claimConsistencyMeta === void 0 ? {} : { claimConsistencyMeta }
+				} });
+				claimCoverageWaiver = {
+					principal: waiverSpec.principal,
+					reason: waiverSpec.reason,
+					...waiverSpec.expiresAt === void 0 ? {} : { expiresAt: waiverSpec.expiresAt },
+					coverage: grade
+				};
+				await internals.replayer.appendSinglePhase({
+					scope: callingState.scope,
+					key: deriverV2.deriveKey({ kind: "claim-coverage-waived" }),
+					kind: "decision",
+					status: "ok",
+					spanId: internals.spans.mint(callingState.spanId),
+					site: "orchestrator-claim-coverage",
+					value: {
+						decisionType: "claim_coverage_waived",
+						...claimCoverageWaiver,
+						...claimConsistencyMeta?.judgedHash === void 0 ? {} : { judgedHash: claimConsistencyMeta.judgedHash }
+					}
+				});
+			}
+		}
 		return {
 			result: synthesizedFinal,
 			completion: decision.completion,
@@ -27000,6 +28311,13 @@ function makeOrchestratorWorkflow(goal, opts) {
 			...deliverable.deliverableAccepted === void 0 ? {} : { deliverableAccepted: deliverable.deliverableAccepted },
 			...deliverable.acceptedArtifactRef === void 0 ? {} : { acceptedArtifactRef: deliverable.acceptedArtifactRef },
 			...envelopeRejectedCandidates.length === 0 ? {} : { rejectedFinishCandidates: envelopeRejectedCandidates },
+			...deterministicPatches === void 0 ? {} : { deterministicPatches },
+			...repairLedger === void 0 ? {} : { repairs: repairLedger },
+			...claimCoverageWaiver === void 0 ? {} : { claimCoverageWaiver },
+			...citationAuditMeta === void 0 ? {} : {
+				...citationFindingsFound === void 0 ? {} : { citationFindings: citationFindingsFound },
+				citationAuditMeta
+			},
 			childStatusCounts: decision.childStatusCounts,
 			degradedReasons: decision.degradedReasons,
 			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
@@ -27053,9 +28371,9 @@ function makeOrchestratorWorkflow(goal, opts) {
 * Top-level surface: creates a run. `runOptions` are the ordinary
 * engine {@link RunOptions} of the created run; in particular
 * `runOptions.budgetUsd` is the ROOT hard ceiling over the WHOLE tree
-* (the orchestrator and every child), immutable after start, while
-* `opts.budget` only shapes the orchestrator's own sub-account inside
-* that ceiling. The shortcut previously accepted no RunOptions at all,
+* (the orchestrator and every child), immutable within a segment,
+* while `opts.budget` only shapes the orchestrator's own sub-account
+* inside that ceiling. The shortcut previously accepted no RunOptions at all,
 * so the canonical entry point could not set a root ceiling without
 * dropping to `engine.run(makeOrchestratorWorkflow(...))` (v1.18.0
 * review P1-5).
@@ -27274,6 +28592,15 @@ function preflightEstimate(input) {
 			});
 		}
 		const spec = input.orchestrator.budget;
+		if (spec?.acceptanceReserve !== void 0 && spec.acceptanceReserve !== "warn" && spec.acceptanceReserve !== "require") throw new ConfigError("preflight.orchestrator.budget.acceptanceReserve must be 'warn' or 'require'; got " + JSON.stringify(spec.acceptanceReserve));
+		if (input.orchestrator.synthesis?.estCost !== void 0) requireNonNegativeNumber(input.orchestrator.synthesis.estCost, "preflight.orchestrator.synthesis.estCost");
+		if (input.finishValidation?.estRepairCostUsd !== void 0) requireNonNegativeNumber(input.finishValidation.estRepairCostUsd, "preflight.finishValidation.estRepairCostUsd");
+		if (input.orchestrator.citationAudit?.judge?.estCost !== void 0) requireNonNegativeNumber(input.orchestrator.citationAudit.judge.estCost, "preflight.orchestrator.citationAudit.judge.estCost");
+		if (input.orchestrator.citationAudit?.onFound !== void 0 && ![
+			"report",
+			"repair",
+			"fail"
+		].includes(input.orchestrator.citationAudit.onFound)) throw new ConfigError(`preflight.orchestrator.citationAudit.onFound must be 'report', 'repair' or 'fail'; got ${JSON.stringify(input.orchestrator.citationAudit.onFound)}`);
 		const fraction = spec?.capFraction ?? .2;
 		const fromFraction = ceilingUsd === void 0 ? void 0 : fraction * ceilingUsd;
 		const bounds = [spec?.capUsd, fromFraction].filter((bound) => bound !== void 0);
@@ -27301,6 +28628,36 @@ function preflightEstimate(input) {
 			code: "orchestrator-cap-below-finalize-reserve",
 			message: `effectiveCap ${effectiveCapUsd.toFixed(4)} USD is below the finalize reserve ${finalizeReserveUsd.toFixed(4)} USD: the run would refuse to start`
 		});
+		if (spec?.acceptanceReserve !== void 0) {
+			const { requiredUsd, terms } = acceptanceTailRequiredUsd({
+				...spec.synthesisReserveUsd === void 0 ? {} : { synthesisReserveUsd: spec.synthesisReserveUsd },
+				...input.orchestrator.claimConsistency?.stage === void 0 ? {} : { claimStage: input.orchestrator.claimConsistency.stage },
+				...input.orchestrator.claimConsistency?.onFound === void 0 ? {} : { claimOnFound: input.orchestrator.claimConsistency.onFound },
+				...input.orchestrator.claimConsistency?.judge?.estCost === void 0 ? {} : { claimJudgeEstCostUsd: input.orchestrator.claimConsistency.judge.estCost },
+				...input.finishValidation?.estRepairCostUsd === void 0 ? {} : { finishEstRepairCostUsd: input.finishValidation.estRepairCostUsd },
+				...input.orchestrator.synthesis?.estCost === void 0 ? {} : { synthesisEstCostUsd: input.orchestrator.synthesis.estCost },
+				...input.orchestrator.citationAudit?.judge?.estCost === void 0 ? {} : { citationJudgeEstCostUsd: input.orchestrator.citationAudit.judge.estCost },
+				...input.orchestrator.citationAudit?.onFound === void 0 ? {} : { citationOnFound: input.orchestrator.citationAudit.onFound },
+				...input.orchestrator.claimConsistency === void 0 ? {} : { claimConfigured: true },
+				workingRoomUsd: flatReserveUsd
+			});
+			const fits = effectiveCapUsd !== void 0 && effectiveCapUsd >= requiredUsd;
+			orchestratorEcho.acceptanceReserve = {
+				declared: spec.acceptanceReserve,
+				requiredUsd,
+				...effectiveCapUsd === void 0 ? {} : { effectiveCapUsd },
+				fits,
+				terms
+			};
+			if (!fits) {
+				const termsLine = formatAcceptanceTailTerms(terms);
+				say({
+					severity: spec.acceptanceReserve === "require" ? "error" : "warning",
+					code: "acceptance-reserve-unfit",
+					message: (effectiveCapUsd === void 0 ? `budget.acceptanceReserve '${spec.acceptanceReserve}': no effective cap resolves to hold the declared acceptance tail against (${termsLine})` : `budget.acceptanceReserve '${spec.acceptanceReserve}': the declared acceptance tail does not fit the effective cap ${effectiveCapUsd.toFixed(4)} USD (${termsLine})`) + (spec.acceptanceReserve === "require" ? "; the run would refuse to start before its first wire (RV3907): raise the cap or lower the declared tail" : "; the run would start with its acceptance machinery funded by luck: raise the cap, lower the declared tail, or declare 'require' to refuse instead")
+				});
+			}
+		}
 	}
 	const spawnSpecs = input.spawns ?? [];
 	spawnSpecs.forEach(validateSpawnSpec);
@@ -27844,8 +29201,8 @@ function preflightEstimate(input) {
 		message: `the ceiling headroom is ${(ceilingHeadroomShare * 100).toFixed(2)} percent of the ceiling (${(ceilingHeadroomUsd ?? 0).toFixed(4)} USD over the required minimum ${(requiredMinimumCeilingUsd ?? 0).toFixed(4)} USD), below the declared ${(minCeilingHeadroomShare * 100).toFixed(2)} percent floor: a small pricing or context drift refuses the whole wave at admission; raise the ceiling or slim the wave`
 	});
 	const claimPosture = input.orchestrator?.claimConsistency;
-	const repairArmed = claimPosture?.onFound === "repair";
-	const worstJudgePasses = ((claimPosture?.stage ?? "draft") === "both" ? 2 : 1) + (repairArmed ? 1 : 0);
+	const repairArmed = claimPosture?.onFound === "repair" && (claimPosture?.stage ?? "draft") !== "draft";
+	const worstJudgePasses = acceptanceJudgePasses(claimPosture?.stage, claimPosture?.onFound);
 	{
 		const judgeEstUsd = input.orchestrator?.claimConsistency?.judge?.estCost;
 		if (judgeEstUsd !== void 0 && effectiveCapUsd !== void 0 && synthesisHoldUsd > 0) {
@@ -28670,6 +30027,34 @@ function parseDeadlineAt(value) {
 	if (month < 1 || month > 12 || day < 1 || day > daysInMonth) refuse();
 	return parsed;
 }
+const SCOPE_FIELDS = [
+	"tenant",
+	"account",
+	"project"
+];
+/**
+* Validates and copies a declared scope (RV4007): own properties only
+* (the RV1205 doctrine: a prototype member must never resolve),
+* non-empty strings of at most 256 chars, at least one field, and the
+* copy is what gets recorded, so later host mutation of the passed
+* object cannot move the recorded identity.
+*/
+function normalizeExecutionScope(value, site) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new ConfigError(`${site} must be an object; got ${JSON.stringify(value)}`);
+	const copy = {};
+	for (const field of SCOPE_FIELDS) {
+		if (!Object.hasOwn(value, field)) continue;
+		const declared = value[field];
+		if (typeof declared !== "string" || declared.length === 0 || declared.length > 256) throw new ConfigError(`${site}.${field} must be a non-empty string of at most 256 characters; got ` + JSON.stringify(declared));
+		copy[field] = declared;
+	}
+	if (Object.keys(copy).length === 0) throw new ConfigError(`${site} must declare at least one of tenant, account, project; an empty scope records nothing and asserts nothing`);
+	return copy;
+}
+/** The canonical identity string of a scope (RV4007): JCS bytes, total and deterministic. */
+function executionScopeKey(scope) {
+	return jcsSerialize(scope);
+}
 /** Validates a declared config fingerprint (RV3210): a non-empty string of at most 512 chars. */
 function requireConfigFingerprint(value, site) {
 	if (typeof value !== "string" || value.length === 0 || value.length > 512) throw new ConfigError(`${site} must be a non-empty string of at most 512 characters; got ` + (typeof value === "string" ? `${String(value.length)} characters` : JSON.stringify(value)));
@@ -28949,7 +30334,11 @@ function createEngine(options) {
 		if (profile.countTokens !== void 0 && !["allow", "deny"].includes(profile.countTokens)) throw new ConfigError(`createEngine defaults.profiles['${name}'].countTokens must be 'allow' or 'deny'`);
 	}
 	if (options.defaults?.countTokens !== void 0 && !["allow", "deny"].includes(options.defaults.countTokens)) throw new ConfigError("createEngine defaults.countTokens must be 'allow' or 'deny'");
-	if (options.defaults?.billingReceipts !== void 0 && !["async", "awaited"].includes(options.defaults.billingReceipts)) throw new ConfigError("createEngine defaults.billingReceipts must be 'async' or 'awaited'");
+	if (options.defaults?.billingReceipts !== void 0 && ![
+		"async",
+		"awaited",
+		"intent"
+	].includes(options.defaults.billingReceipts)) throw new ConfigError("createEngine defaults.billingReceipts must be 'async', 'awaited' or 'intent'");
 	if (options.telemetry?.quotaDeniedAgentError !== void 0 && typeof options.telemetry.quotaDeniedAgentError !== "boolean") throw new ConfigError("createEngine telemetry.quotaDeniedAgentError must be a boolean");
 	validateDeterminismConfig(options.determinism);
 	validateEngineQuotaConfig(options.quota);
@@ -28986,6 +30375,8 @@ function createEngine(options) {
 		if (opts?.configFingerprint !== void 0) requireConfigFingerprint(opts.configFingerprint, "RunOptions.configFingerprint");
 		if (opts?.clampTurnToExposure !== void 0 && typeof opts.clampTurnToExposure !== "boolean") throw new ConfigError("RunOptions.clampTurnToExposure must be a boolean; got " + JSON.stringify(opts.clampTurnToExposure));
 		if (opts?.strictPricing !== void 0 && typeof opts.strictPricing !== "boolean" && (typeof opts.strictPricing !== "object" || opts.strictPricing === null || Array.isArray(opts.strictPricing))) throw new ConfigError("RunOptions.strictPricing must be a boolean or an options object; got " + JSON.stringify(opts.strictPricing));
+		if (opts?.budgetPolicy !== void 0 && opts.budgetPolicy !== "segment" && opts.budgetPolicy !== "immutable-lifetime") throw new ConfigError("RunOptions.budgetPolicy must be 'segment' or 'immutable-lifetime'; got " + JSON.stringify(opts.budgetPolicy));
+		const declaredScope = opts?.scope === void 0 ? void 0 : normalizeExecutionScope(opts.scope, "RunOptions.scope");
 		if (opts?.limits !== void 0) validateUsageLimits(opts.limits, "RunOptions.limits");
 		const deadlineAtMs = opts?.deadlineAt === void 0 ? void 0 : parseDeadlineAt(opts.deadlineAt);
 		const compiled = wf.kind === "compiled-workflow" ? wf : void 0;
@@ -29020,6 +30411,8 @@ function createEngine(options) {
 			...opts.strictPricing.allowUnpriced === void 0 ? {} : { allowUnpriced: [...opts.strictPricing.allowUnpriced] }
 		};
 		const configFingerprint = opts?.configFingerprint ?? resumeCtx?.configFingerprint;
+		const budgetPolicy = opts?.budgetPolicy ?? resumeCtx?.budgetPolicy;
+		const executionScope = declaredScope ?? resumeCtx?.scope;
 		const makeBudget = () => new RunBudget({
 			...ceilingUsd === void 0 ? {} : { ceilingUsd },
 			...exposureCapUsd === void 0 ? {} : { maxInFlightExposureUsd: exposureCapUsd },
@@ -29202,7 +30595,9 @@ function createEngine(options) {
 			...ceilingUsd === void 0 ? {} : { budgetUsd: ceilingUsd },
 			...exposureCapUsd === void 0 ? {} : { maxInFlightExposureUsd: exposureCapUsd },
 			...strictPricing === void 0 ? {} : { strictPricing },
+			...budgetPolicy === "immutable-lifetime" ? { budgetPolicy } : {},
 			...configFingerprint === void 0 ? {} : { configFingerprint },
+			...executionScope === void 0 ? {} : { scope: executionScope },
 			...argsBinding.argsProvided === void 0 ? {} : { argsProvided: argsBinding.argsProvided },
 			...argsBinding.argsHash === void 0 ? {} : { argsHash: argsBinding.argsHash },
 			...genesis === void 0 ? {} : { genesis },
@@ -29294,6 +30689,34 @@ function createEngine(options) {
 					}
 				});
 			}
+			if (executionScope !== void 0 && resumeCtx === void 0) await replayer.appendSinglePhase({
+				scope: "",
+				key: deriverV2.deriveKey({ kind: "execution-scope" }),
+				kind: "decision",
+				status: "ok",
+				spanId: rootSpanId,
+				site: "execution-scope",
+				value: {
+					decisionType: "execution_scope",
+					scope: executionScope
+				}
+			});
+			if (resumeCtx?.acknowledgedOpenWireIntents !== void 0 && resumeCtx.acknowledgedOpenWireIntents > 0 && resumeCtx.strict !== true) await replayer.appendSinglePhase({
+				scope: "",
+				key: deriverV2.deriveKey({
+					kind: "open-wire-intents-acknowledged",
+					segment: segmentsBefore + 1
+				}),
+				kind: "decision",
+				status: "ok",
+				spanId: rootSpanId,
+				site: "resume-acknowledgment",
+				value: {
+					decisionType: "open_wire_intents_acknowledged",
+					segment: segmentsBefore + 1,
+					count: resumeCtx.acknowledgedOpenWireIntents
+				}
+			});
 			await putMeta("running");
 			bus.emit({
 				type: "run:start",
@@ -29551,6 +30974,7 @@ function createEngine(options) {
 			events: bus.iterate(),
 			on: (type, cb) => bus.on(type, cb),
 			resolveExternal: (key, value) => external.resolveExternal(key, value),
+			revokeApproval: (key, options) => external.revokeApproval(key, options),
 			cancel: async (reason) => {
 				requestCancel(reason ?? "cancelled by host");
 				await result.then(() => void 0, () => void 0);
@@ -29618,6 +31042,15 @@ function createEngine(options) {
 					type: "RulvarWarning"
 				});
 			}
+			{
+				const supplied = resumeOptions?.scope === void 0 ? void 0 : normalizeExecutionScope(resumeOptions.scope, "ResumeOptions.scope");
+				const recorded = typeof meta?.scope === "object" && meta.scope !== null ? meta.scope : void 0;
+				if (supplied !== void 0 && recorded !== void 0 && executionScopeKey(supplied) !== executionScopeKey(recorded)) throw new ConfigError(`resume: the supplied scope does not match the one run '${runId}' recorded at genesis; the execution scope is immutable for the life of the run, and the host declared exactly this check`);
+				if (supplied !== void 0 && recorded === void 0) process.emitWarning(`resume: a scope was supplied but run '${runId}' never recorded one; the assertion cannot be verified (absence means NOT RECORDED)`, {
+					code: "RULVAR_RESUME_SCOPE_UNRECORDED",
+					type: "RulvarWarning"
+				});
+			}
 			const priorEntries = (await journal.load(runId)).map((entry) => normalizeEntry(entry));
 			scanJournalCompatibility(runId, priorEntries, buildDeriverRegistry(options.extraDerivers));
 			if (priorEntries.some((entry) => entry.usageSemantics === void 0 && (entry.servedBy?.startsWith("openai:") === true && (entry.usage?.cacheWriteTokens ?? 0) > 0 || (entry.usageByModel?.some((slice) => slice.servedBy.startsWith("openai:") && slice.usage.cacheWriteTokens > 0) ?? false)))) process.emitWarning(`resume: run '${runId}' contains OpenAI cache-write usage recorded without a usage-semantics stamp. Entries written by rulvar v1.19.0 double-counted cache writes into inputTokens, so their recorded cost and budget debits are OVERSTATED; unstamped entries from v1.20.0 are correct. Resuming keeps the recorded debits. Audit procedure: https://docs.rulvar.com/guide/providers#openai-legacy-cache-journals`, {
@@ -29629,7 +31062,14 @@ function createEngine(options) {
 				...runOverride.budgetUsd === void 0 ? {} : { budgetUsd: runOverride.budgetUsd },
 				...runOverride.maxInFlightExposureUsd === void 0 ? {} : { maxInFlightExposureUsd: runOverride.maxInFlightExposureUsd }
 			};
+			if (budgetOverride !== void 0 && meta?.budgetPolicy === "immutable-lifetime") throw new ConfigError(`run '${runId}' was started with budgetPolicy 'immutable-lifetime': the recorded ceilings are immutable for the whole life of the run and ResumeOptions.run is refused, raising and lowering alike; cancel the run (or start a new one) instead of editing its ceilings`);
+			const openIntents = openWireIntentsOf(priorEntries);
+			if (openIntents.length > 0 && resumeOptions?.acknowledgeOpenWireIntents !== true) {
+				const preview = openIntents.slice(0, 3).map((intent) => `agent ${String(intent.agentRef)} ordinal ${String(intent.ordinal)} attempt ${String(intent.attempt)} (${intent.servedBy})`).join("; ");
+				throw new ConfigError(`resume: run '${runId}' holds ${String(openIntents.length)} provider wire intent(s) with unknown outcome (${preview}${openIntents.length > 3 ? "; …" : ""}): an intent was journaled before dispatch and neither a receipt nor a terminal record covers it, so the provider may have billed a wire this process never heard back from, and a blind retry could pay twice. Reconcile the invoice's openIntents lane (cost-audit prints it) against the provider statement, then resume with ResumeOptions.acknowledgeOpenWireIntents: true; the acknowledgment is journaled`);
+			}
 			return run(bound, resumeOptions?.args, void 0, {
+				...openIntents.length > 0 && resumeOptions?.acknowledgeOpenWireIntents === true ? { acknowledgedOpenWireIntents: openIntents.length } : {},
 				runId,
 				priorEntries,
 				strict: resumeOptions?.dryRun ?? false,
@@ -29639,6 +31079,8 @@ function createEngine(options) {
 				...typeof meta?.budgetUsd === "number" ? { budgetUsd: meta.budgetUsd } : {},
 				...typeof meta?.maxInFlightExposureUsd === "number" ? { maxInFlightExposureUsd: meta.maxInFlightExposureUsd } : {},
 				...typeof meta?.strictPricing === "object" && meta.strictPricing !== null ? { strictPricing: meta.strictPricing } : {},
+				...typeof meta?.scope === "object" && meta.scope !== null ? { scope: meta.scope } : {},
+				...meta?.budgetPolicy === "immutable-lifetime" ? { budgetPolicy: meta.budgetPolicy } : {},
 				segmentsBefore: typeof meta?.segments === "number" && meta.segments > 0 ? Math.floor(meta.segments) : 1,
 				...typeof meta?.argsProvided === "boolean" ? { argsProvided: meta.argsProvided } : {},
 				...typeof meta?.argsHash === "string" ? { argsHash: meta.argsHash } : {},
@@ -29668,6 +31110,9 @@ function createEngine(options) {
 			resolveExternal: async (key, value) => {
 				return (await handlePromise).resolveExternal(key, value);
 			},
+			revokeApproval: async (key, options) => {
+				return (await handlePromise).revokeApproval(key, options);
+			},
 			cancel: async (reason) => {
 				await (await handlePromise).cancel(reason);
 			},
@@ -29826,6 +31271,109 @@ function createEngine(options) {
 	};
 }
 //#endregion
+//#region src/engine/regulated-profile.ts
+/**
+* The regulated run profile (RV4009, the fifth comparison experiment;
+* previously gated behind its own word and confirmed with plan 40).
+*
+* Every assurance posture this codebase grew across the comparison
+* arcs is an OPT-IN knob, which is correct for a library and lethal
+* for an unreviewed config: the 2026-08-12 run armed every gate to
+* observe, and the fifth run's harness gated on error findings alone.
+* `compileRegulatedProfile` is the one-call composition: it takes the
+* host's ordinary options, REFUSES any field that loosens the
+* regulated floor (typed, naming the field), fills what is absent,
+* and returns the compiled options plus a profile hash over the
+* enforced posture. The hash rides RunOptions.configFingerprint, so
+* the existing genesis recording and resume assertion machinery
+* (RV3210) pin it with zero new meta surface.
+*
+* DATA, not engine semantics (the M5-T07 doctrine): the engine gains
+* no strategy enum and no behavioral branch; a host that wants the
+* posture applies the compiled options like any others. The floor
+* binds what flows through CreateEngineOptions / RunOptions /
+* OrchestrateOptions; construction-side postures the options cannot
+* see (MCP source `drift: 'refuse'` and bounds, the AI SDK bridge's
+* `providerExecutedTools: 'deny'`) are named in the docs checklist
+* beside this function, because a hash must not imply what it cannot
+* verify.
+*/
+const REGULATED_VERSION = 1;
+function refuse(field, requirement) {
+	throw new ConfigError(`compileRegulatedProfile: ${field} ${requirement}; the regulated floor is non-loosenable, so drop the field to inherit the floor or meet it explicitly`);
+}
+function compileRegulatedProfile(input) {
+	const engine = {
+		...input.engine,
+		defaults: { ...input.engine.defaults }
+	};
+	const run = { ...input.run };
+	const orchestrate = input.orchestrate === void 0 ? void 0 : { ...input.orchestrate };
+	const defaults = engine.defaults ?? {};
+	const permissions = { ...defaults.permissions ?? {} };
+	if (permissions.strictApprovals === false) refuse("defaults.permissions.strictApprovals", "must not be false (RV1507 monotonic mode)");
+	permissions.strictApprovals = true;
+	defaults.permissions = permissions;
+	if (defaults.billingReceipts !== void 0 && defaults.billingReceipts !== "intent") refuse("defaults.billingReceipts", "must be 'intent' (RV4006 pre-wire intents)");
+	defaults.billingReceipts = "intent";
+	engine.defaults = defaults;
+	const determinism = { ...engine.determinism ?? {} };
+	if (determinism.mode !== void 0 && determinism.mode !== "error") refuse("determinism.mode", "must be 'error'");
+	determinism.mode = "error";
+	engine.determinism = determinism;
+	for (const [name, profile] of Object.entries(defaults.profiles ?? {})) {
+		if (profile.permissions?.strictApprovals === false) refuse(`defaults.profiles.${name}.permissions.strictApprovals`, "must not be false");
+		if (profile.tools !== void 0 && profile.toolsetAttestation === void 0) refuse(`defaults.profiles.${name}`, "declares tools without a toolsetAttestation (pin the resolved hashes)");
+	}
+	if (typeof run.budgetUsd !== "number") refuse("run.budgetUsd", "must declare a USD ceiling");
+	if (run.strictPricing === false) refuse("run.strictPricing", "must not be false");
+	run.strictPricing = run.strictPricing ?? true;
+	if (run.budgetPolicy !== void 0 && run.budgetPolicy !== "immutable-lifetime") refuse("run.budgetPolicy", "must be 'immutable-lifetime' (RV3902)");
+	run.budgetPolicy = "immutable-lifetime";
+	if (run.scope === void 0) refuse("run.scope", "must name the execution scope (RV4007): a regulated run has an owner");
+	if (orchestrate !== void 0) {
+		const budget = { ...orchestrate.budget ?? {} };
+		if (budget.acceptanceReserve !== void 0 && budget.acceptanceReserve !== "require") refuse("orchestrate.budget.acceptanceReserve", "must be 'require' (RV3907/RV4001)");
+		budget.acceptanceReserve = "require";
+		orchestrate.budget = budget;
+		if (orchestrate.citationAudit === void 0) refuse("orchestrate.citationAudit", "must be declared with the host snapshot resolver (RV4004): entailment is the regulated posture, not an option");
+		if (orchestrate.claimConsistency !== void 0) {
+			const claim = { ...orchestrate.claimConsistency };
+			if (claim.coveragePolicy !== void 0 && claim.coveragePolicy !== "strict-final") refuse("orchestrate.claimConsistency.coveragePolicy", "must be 'strict-final' (RV4003)");
+			if ((claim.stage ?? "draft") === "draft") refuse("orchestrate.claimConsistency.stage", "must be 'final' or 'both': the shipped document is what the pass must grade");
+			claim.coveragePolicy = "strict-final";
+			orchestrate.claimConsistency = claim;
+		}
+	}
+	const posture = {
+		regulated: REGULATED_VERSION,
+		strictApprovals: true,
+		billingReceipts: "intent",
+		determinism: "error",
+		strictPricing: run.strictPricing === true ? true : run.strictPricing,
+		budgetPolicy: "immutable-lifetime",
+		budgetUsd: run.budgetUsd,
+		scope: run.scope,
+		...orchestrate === void 0 ? {} : {
+			acceptanceReserve: "require",
+			citationAudit: true,
+			...orchestrate.claimConsistency === void 0 ? {} : {
+				coveragePolicy: "strict-final",
+				claimStage: orchestrate.claimConsistency.stage
+			}
+		},
+		...run.configFingerprint === void 0 ? {} : { hostFingerprint: run.configFingerprint }
+	};
+	const profileHash = createHash("sha256").update(jcsSerialize(posture), "utf8").digest("hex");
+	run.configFingerprint = `regulated:${String(REGULATED_VERSION)}:${profileHash}`;
+	return {
+		engine,
+		run,
+		...orchestrate === void 0 ? {} : { orchestrate },
+		profileHash
+	};
+}
+//#endregion
 //#region src/runner/sandbox-bridge.ts
 /**
 * The host half of the worker sandbox contract (M6-T02).
@@ -30115,4 +31663,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CITATION_JUDGE_SCHEMA, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_EXCERPT_WINDOW, DEFAULT_CITATION_MAX_SAMPLED, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CITATION_SAMPLE_PER_SECTION, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CITATION_EXCERPT_CHARS, MAX_CITATION_EXCERPT_LINES, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, acceptanceJudgePasses, acceptanceTailRequiredUsd, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationExcerptOf, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileRegulatedProfile, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, executionScopeKey, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatAcceptanceTailTerms, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeExecutionScope, normalizeFallbacks, openWireIntentsOf, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseCitationVerdicts, parseModelRef, parseScopePath, parseTerminalEnvelope, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, repairLedgerFromJournal, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveCitationAuditPlan, resolveModelInvocation, resolvePricing, resolveToolset, retentionKeyOf, retryClassOf, retryDelayMs, retryWireMultiplier, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sampleCitationRows, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wireCapacityEstimate, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };