@rulvar/core 1.244.0 → 1.246.0

package/dist/index.js

@@ -3252,7 +3252,7 @@ const MAX_TIMER_DELAY_MS = 2147483647;
 * century-long suspension journals as a perfectly valid date.
 */
 const MAX_DEADLINE_MS = 315576e7;
-function refuse$1(site, requirement, value) {
+function refuse$2(site, requirement, value) {
 	throw new ConfigError(`${site} must be ${requirement}; got ${String(value)}`);
 }
 /**
@@ -3269,26 +3269,26 @@ function requireDeadlineMs(value, site) {
 }
 /** An integer >= 1 (counts, caps, and depths). */
 function requirePositiveInteger$2(value, site) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 1) refuse$1(site, "a positive integer", value);
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1) refuse$2(site, "a positive integer", value);
 }
 /** An integer >= 0 (caps where zero means "none allowed"). */
 function requireNonNegativeInteger(value, site) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) refuse$1(site, "a nonnegative integer", value);
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) refuse$2(site, "a nonnegative integer", value);
 }
 /** A finite number >= 0 (USD amounts and reserves). */
 function requireNonNegativeNumber(value, site) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) refuse$1(site, "a finite nonnegative number", value);
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) refuse$2(site, "a finite nonnegative number", value);
 }
 /** A finite fraction in (0, 1]. */
 function requireFraction(value, site) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > 1) refuse$1(site, "a fraction in (0, 1]", value);
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > 1) refuse$2(site, "a fraction in (0, 1]", value);
 }
 /**
 * A relative delay handed to setTimeout as-is: an integer within the
 * Node timer maximum, mirroring validateRetryPolicy's bound.
 */
 function requireTimerDelayMs(value, site) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 2147483647) refuse$1(site, "an integer between 1 and 2147483647 ms (the Node timer maximum)", value);
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 2147483647) refuse$2(site, "an integer between 1 and 2147483647 ms (the Node timer maximum)", value);
 }
 /**
 * A declared evidence contract (RV303, enforcement RV507): minEntries
@@ -4483,6 +4483,19 @@ function mcp(cfg) {
 	};
 	return {
 		id: sourceIdOf(cfg),
+		describeRegulatedPosture: () => ({
+			regulatedPosture: 1,
+			kind: "mcp-source",
+			name: sourceIdOf(cfg),
+			drift: cfg.drift ?? "rekey",
+			bounds: {
+				declared: cfg.maxTools !== void 0 && cfg.maxPages !== void 0 && cfg.maxSchemaBytes !== void 0 && cfg.timeouts?.discoveryMs !== void 0,
+				...cfg.maxTools === void 0 ? {} : { maxTools: cfg.maxTools },
+				...cfg.maxPages === void 0 ? {} : { maxPages: cfg.maxPages },
+				...cfg.maxSchemaBytes === void 0 ? {} : { maxSchemaBytes: cfg.maxSchemaBytes },
+				...cfg.timeouts?.discoveryMs === void 0 ? {} : { discoveryMs: cfg.timeouts.discoveryMs }
+			}
+		}),
 		tools: async () => {
 			if (poisoned) throw new ConfigError(`mcp: the tool list of '${sourceIdOf(cfg)}' changed after import (listChanged) and drift policy 'refuse' holds the source closed; close() and re-create the source (and re-record any toolset attestation) to import the changed list deliberately`);
 			if (cache !== void 0) return cache;
@@ -8313,11 +8326,13 @@ var EscalationDecisionAbortedError = class extends Error {
 * Normalizes a resolution value into an ApprovalDecision. Anything that
 * is not an explicit allow is a deny: an approval never fails open.
 */
-function toApprovalDecision(value) {
+function toApprovalDecision(value, entryRef) {
 	const record = value ?? {};
 	return {
 		decision: record.decision === "allow" ? "allow" : "deny",
-		...typeof record.reason === "string" ? { reason: record.reason } : {}
+		...typeof record.reason === "string" ? { reason: record.reason } : {},
+		...typeof record.expiresAt === "string" ? { expiresAt: record.expiresAt } : {},
+		...entryRef === void 0 ? {} : { entryRef }
 	};
 }
 /**
@@ -8352,7 +8367,9 @@ function detachedApprovalFlavor(entry) {
 async function validatePayloadArms(kind, key, value, schemaSpec) {
 	if (kind === "approval") {
 		const decision = value?.decision;
-		if (decision !== "allow" && decision !== "deny") throw new InvalidResolutionError(`approval '${key}' resolves with { decision: 'allow' | 'deny', reason? }`);
+		if (decision !== "allow" && decision !== "deny") throw new InvalidResolutionError(`approval '${key}' resolves with { decision: 'allow' | 'deny', reason?, expiresAt? }`);
+		const expiresAt = value?.expiresAt;
+		if (expiresAt !== void 0 && (typeof expiresAt !== "string" || Number.isNaN(Date.parse(expiresAt)))) throw new InvalidResolutionError(`approval '${key}' expiresAt must be an ISO 8601 date string; got ` + JSON.stringify(expiresAt));
 	}
 	if (kind === "decision") {
 		const decisionKind = value?.kind;
@@ -8572,7 +8589,7 @@ var ExternalRegistry = class ExternalRegistry {
 			entry = matched.running;
 			replayed = true;
 			const state = this.replayer.suspensionState(entry.seq);
-			if (state.state === "resolved") return toApprovalDecision(state.value);
+			if (state.state === "resolved") return toApprovalDecision(state.value, entry.seq);
 			if (state.state === "abandoned") {
 				this.suspendActivity();
 				return new Promise(() => void 0);
@@ -8604,7 +8621,7 @@ var ExternalRegistry = class ExternalRegistry {
 				prompt: `approve tool '${options.toolName}'`,
 				resolve: (value) => {
 					resumeActivity();
-					resolve(toApprovalDecision(value));
+					resolve(toApprovalDecision(value, entry.seq));
 				}
 			};
 			if (entry.deadlineAt !== void 0) waiter.timer = setLongTimeout(() => {
@@ -8792,6 +8809,62 @@ var ExternalRegistry = class ExternalRegistry {
 	* resolvable this way only once the segment settled (closed registry),
 	* with the exact live-path validation and no wake.
 	*/
+	/**
+	* Revokes a tool approval (RV4008). A still-open approval is denied
+	* through the ordinary first-closing-wins arbitration (a race with
+	* a live allow stays deterministic by the journal). A RECORDED
+	* allow cannot be unwritten (history is immutable): the revocation
+	* appends an `approval_revoked` decision that beats the allow at
+	* the consumption recheck, so an allow granted, crashed over, and
+	* revoked never dispatches its tool on resume. A denied or
+	* abandoned approval has nothing to revoke.
+	*/
+	async revokeApproval(key, options) {
+		if (typeof options.principal !== "string" || options.principal.length === 0) throw new InvalidResolutionError("revokeApproval principal must be a non empty string");
+		if (typeof options.reason !== "string" || options.reason.length === 0) throw new InvalidResolutionError("revokeApproval reason must be a non empty string");
+		const candidates = this.replayer.snapshot().filter((entry) => ExternalRegistry.suspensionKeyOf(entry) === key && entry.kind === "approval");
+		const target = candidates[candidates.length - 1];
+		if (target === void 0) throw new InvalidResolutionError(`no approval suspension with key '${key}' in this run`);
+		const state = this.replayer.suspensionState(target.seq);
+		if (state.state === "suspended") {
+			await this.resolveExternal(key, {
+				decision: "deny",
+				reason: `revoked by ${options.principal}: ${options.reason}`
+			});
+			return {
+				state: "denied-pending",
+				entryRef: target.seq
+			};
+		}
+		if (state.state === "resolved" && state.value?.decision === "allow") {
+			if (this.replayer.snapshot().some((entry) => entry.kind === "decision" && entry.value?.decisionType === "approval_revoked" && entry.value.targetRef === target.seq)) return {
+				state: "already-revoked",
+				entryRef: target.seq
+			};
+			await this.replayer.appendSinglePhase({
+				scope: target.scope,
+				key: `approval-revoked:${String(target.seq)}`,
+				kind: "decision",
+				status: "ok",
+				spanId: target.spanId ?? "",
+				site: "approval-revocation",
+				value: {
+					decisionType: "approval_revoked",
+					targetRef: target.seq,
+					principal: options.principal,
+					reason: options.reason
+				}
+			});
+			return {
+				state: "revoked-allow",
+				entryRef: target.seq
+			};
+		}
+		return {
+			state: "already-closed",
+			entryRef: target.seq
+		};
+	}
 	async resolveDetached(key, value) {
 		const candidates = this.replayer.snapshot().filter((entry) => ExternalRegistry.suspensionKeyOf(entry) === key);
 		const open = candidates.find((entry) => this.replayer.suspensionState(entry.seq).state === "suspended");
@@ -9870,6 +9943,141 @@ function criticalPathFromJournal(entries) {
 	return path;
 }
 //#endregion
+//#region src/stores/repair-ledger.ts
+const failedNamesOf = (failed) => {
+	if (!Array.isArray(failed)) return [];
+	return failed.map((row) => typeof row.name === "string" ? String(row.name) : void 0).filter((name) => name !== void 0);
+};
+const sectionsOf = (sections) => {
+	if (!Array.isArray(sections) || sections.length === 0) return;
+	const markers = sections.filter((marker) => typeof marker === "string");
+	return markers.length === 0 ? void 0 : markers;
+};
+/**
+* Folds the workflow-wide repair ledger from a journal (RV4002). Pure
+* over the entries, so the acceptance envelope's live aggregate
+* (computed from the run's own snapshot at assembly) and a post-hoc
+* fold over the persisted journal agree by construction on every
+* count and row identity; `wireRef`/`costUsd` enrich rows exactly when
+* the asynchronous billing lane covered them.
+*/
+function repairLedgerFromJournal(entries, priceUsd) {
+	const ordered = [...entries].sort((a, b) => a.seq - b.seq);
+	const rounds = [];
+	const rowScopes = /* @__PURE__ */ new Map();
+	let draft = 0;
+	let composition = 0;
+	let semantic = 0;
+	let unstagedVerdicts = 0;
+	/** Sectional acceptances by scope, to pair sections onto the rejection they healed. */
+	const draftAccepts = [];
+	const wireRows = [];
+	for (const entry of ordered) {
+		if (entry.kind === "agent" && entry.status !== "running" && entry.status !== "suspended") {
+			if (entry.costAttribution?.label === "final-composition" && entry.costAttribution.phase === "repair") {
+				semantic += 1;
+				const trigger = entry.costAttribution.repairTrigger;
+				const semanticRow = {
+					stage: "semantic",
+					seq: entry.seq,
+					failedValidators: [],
+					...trigger === "claim" || trigger === "citation" ? { trigger } : {}
+				};
+				rounds.push(semanticRow);
+				rowScopes.set(semanticRow, entry.scope);
+			}
+			continue;
+		}
+		if (entry.kind !== "decision") continue;
+		const value = entry.value;
+		if (value === void 0) continue;
+		if (value.decisionType === "provider-call") {
+			const row = entry.value;
+			if (row.record?.phase === "repair") wireRows.push({
+				seq: entry.seq,
+				scope: entry.scope,
+				record: row.record
+			});
+			continue;
+		}
+		if (value.decisionType === "orchestrator_draft_gate") {
+			if (value.verdict === "rejected") {
+				draft += 1;
+				const row = {
+					stage: "draft",
+					seq: entry.seq,
+					...typeof value.callId === "string" ? { callId: value.callId } : {},
+					failedValidators: failedNamesOf(value.failed)
+				};
+				rounds.push(row);
+				rowScopes.set(row, entry.scope);
+			} else if (value.verdict === "accepted" && value.spliced === true) {
+				const sections = sectionsOf(value.sections);
+				if (sections !== void 0) draftAccepts.push({
+					seq: entry.seq,
+					scope: entry.scope,
+					sections
+				});
+			}
+			continue;
+		}
+		if (value.decisionType === "orchestrator_finish_validation" && value.verdict === "repair") {
+			if (value.stage !== "composition" && value.stage !== "round") {
+				unstagedVerdicts += 1;
+				continue;
+			}
+			composition += 1;
+			const sections = sectionsOf(value.sections);
+			const row = {
+				stage: value.stage,
+				seq: entry.seq,
+				...typeof value.callId === "string" ? { callId: value.callId } : {},
+				failedValidators: failedNamesOf(value.failed),
+				...sections === void 0 ? {} : { sections }
+			};
+			rounds.push(row);
+			rowScopes.set(row, entry.scope);
+			continue;
+		}
+		if (value.decisionType === "orchestrator_finish_validation" && value.verdict === "accepted" && value.spliced === true) {
+			const sections = sectionsOf(value.sections);
+			if (sections !== void 0) draftAccepts.push({
+				seq: entry.seq,
+				scope: entry.scope,
+				sections
+			});
+		}
+	}
+	for (const accept of draftAccepts) for (let index = rounds.length - 1; index >= 0; index -= 1) {
+		const row = rounds[index];
+		if (row === void 0 || row.seq >= accept.seq || row.sections !== void 0 || rowScopes.get(row) !== accept.scope) continue;
+		row.sections = accept.sections;
+		break;
+	}
+	for (const wire of wireRows) {
+		let nearest;
+		for (const row of rounds) {
+			if (row.seq >= wire.seq || rowScopes.get(row) !== wire.scope) continue;
+			nearest = row;
+		}
+		if (nearest === void 0 || nearest.wireRef !== void 0) continue;
+		nearest.wireRef = wire.seq;
+		if (priceUsd !== void 0 && wire.record.servedBy !== void 0) {
+			const usd = priceUsd(wire.record.servedBy, wire.record.usage);
+			if (usd !== void 0 && Number.isFinite(usd) && usd >= 0) nearest.costUsd = usd;
+		}
+	}
+	rounds.sort((a, b) => a.seq - b.seq);
+	return {
+		draft,
+		composition,
+		semantic,
+		total: draft + composition + semantic,
+		rounds,
+		unstagedVerdicts
+	};
+}
+//#endregion
 //#region src/stores/synthesis-candidates.ts
 const parse = (at) => {
 	if (at === void 0) return;
@@ -10098,9 +10306,17 @@ function toolCalibrationFromJournal(entries) {
 	const budgetOnly = [];
 	let dispatches = 0;
 	let unobserved = 0;
+	let coordinationDispatches = 0;
+	let coordinationToolCalls = 0;
 	for (const entry of ordered) {
 		if (entry.kind !== "agent" || entry.ref === void 0 || entry.status === "running") continue;
 		dispatches += 1;
+		const role = entry.costAttribution?.role;
+		if ((role === "orchestrate" || role === "synthesize") && entry.toolBudget !== void 0 && entry.evidence === void 0) {
+			coordinationDispatches += 1;
+			coordinationToolCalls += entry.toolBudget.used;
+			continue;
+		}
 		const named = {
 			scope: entry.scope,
 			handle: entry.ref,
@@ -10123,7 +10339,11 @@ function toolCalibrationFromJournal(entries) {
 		observed,
 		evidenceOnly,
 		budgetOnly,
-		unobserved
+		unobserved,
+		...coordinationDispatches > 0 ? { coordination: {
+			dispatches: coordinationDispatches,
+			toolCallsUsed: coordinationToolCalls
+		} } : {}
 	};
 	if (observed.length > 0) {
 		const toolCallsUsed = observed.reduce((sum, row) => sum + row.toolCallsUsed, 0);
@@ -10939,6 +11159,19 @@ function fallbackTriggerOf(outcome) {
 }
 //#endregion
 //#region src/model/projector.ts
+/**
+* The RETENTION identity of an adapter (RV4007): the provider family,
+* composed with the adapter's declared `scopeKey` when one exists, so
+* two adapters of one family serving different accounts stop sharing
+* provider-raw blocks (cache handles, thinking blocks: provider-side
+* identifiers minted under one account are not portable to another).
+* Adapters without a scopeKey keep the family alone, byte for byte
+* the historical sharing.
+*/
+function retentionKeyOf(adapter) {
+	const family = providerOf(adapter);
+	return adapter.scopeKey === void 0 ? family : `${family}#${adapter.scopeKey}`;
+}
 /** The provider family of an adapter: `provider` when set, else `id`. */
 function providerOf(adapter) {
 	return adapter.provider ?? adapter.id;
@@ -10975,7 +11208,7 @@ function liftRetainedParts(providerMetadata, adapter) {
 	const retained = namespace.retainedParts;
 	if (!Array.isArray(retained)) return [];
 	const blocks = retained;
-	const provider = providerOf(adapter);
+	const provider = retentionKeyOf(adapter);
 	return blocks.map((block) => ({
 		type: "provider-raw",
 		provider,
@@ -13632,6 +13865,13 @@ async function runAgent(options) {
 					reservationId = decision.reservationId;
 					const abandoned = await abortedAfterReserve(quota, decision.reservationId);
 					if (abandoned !== void 0) return abandoned;
+					if (options.billing?.onProviderIntent !== void 0) await options.billing.onProviderIntent({
+						ordinal: providerCalls.length + 1,
+						role: site.role,
+						servedBy: target.resolved.ref,
+						attempt: tries + 1,
+						request: req
+					});
 					if (quota.reserveContinuations !== true) return streamTurn(target.adapter, req, meteredOptionsFor(target));
 					const hooks = { onContinuationSegment: async () => {
 						let segmentDecision;
@@ -13688,6 +13928,14 @@ async function runAgent(options) {
 					if (options.quota === void 0) {
 						const req = site.requestFor(target);
 						admitExposure(req);
+						const intentHook = options.billing?.onProviderIntent;
+						if (intentHook !== void 0) return Promise.resolve(intentHook({
+							ordinal: providerCalls.length + 1,
+							role: site.role,
+							servedBy: target.resolved.ref,
+							attempt: tries + 1,
+							request: req
+						})).then(() => streamTurn(target.adapter, req, meteredOptionsFor(target)));
 						return streamTurn(target.adapter, req, meteredOptionsFor(target));
 					}
 					return dispatchWithQuota(options.quota);
@@ -13781,6 +14029,7 @@ async function runAgent(options) {
 						outcome: outcome.aborted !== void 0 ? "aborted" : outcome.wireError !== void 0 ? "error" : "ok",
 						usage: accounted
 					};
+					if (site.phase !== void 0) record.phase = site.phase;
 					if (typeof namespace?.responseId === "string") record.responseId = namespace.responseId;
 					else if (typeof namespace?.response?.id === "string") record.responseId = namespace.response.id;
 					const wire = namespace?.wireRequests;
@@ -13936,7 +14185,7 @@ async function runAgent(options) {
 				chain: loopChain,
 				cursor: loopCursor,
 				requestFor: (target) => {
-					let req = buildRequest(target.resolved, projectHistory(drainMessages, providerOf(target.adapter)), limits, toolsRide ? allowedTools : void 0);
+					let req = buildRequest(target.resolved, projectHistory(drainMessages, retentionKeyOf(target.adapter)), limits, toolsRide ? allowedTools : void 0);
 					const reserveMax = limits.finalizationReserve?.maxOutputTokens;
 					if (reserveMax !== void 0) req = {
 						...req,
@@ -14015,16 +14264,19 @@ async function runAgent(options) {
 			break;
 		}
 		turns += 1;
+		const lastWindowMessage = messages[messages.length - 1];
+		const repairTurnWire = options.terminalTool !== void 0 && lastWindowMessage !== void 0 && lastWindowMessage.parts.some((part) => part.type === "tool-result" && part.name === options.terminalTool?.name && part.isError === true);
 		const signals = [];
 		if (options.signal !== void 0) signals.push(options.signal);
 		let loopDispatch;
 		try {
 			loopDispatch = await dispatchPhase({
 				role: primaryRole,
+				...repairTurnWire ? { phase: "repair" } : {},
 				chain: loopChain,
 				cursor: loopCursor,
 				requestFor: (target) => {
-					let req = buildRequest(target.resolved, projectHistory(messages, providerOf(target.adapter)), limits, options.tools?.contracts);
+					let req = buildRequest(target.resolved, projectHistory(messages, retentionKeyOf(target.adapter)), limits, options.tools?.contracts);
 					if (options.schema !== void 0 && options.canonicalSchema !== void 0 && !separateExtract) req = applyStructuredOutputTier(req, rideTierFor(target), options.canonicalSchema);
 					req = applyCachePolicy(req, target, options.cache);
 					return applyOutputBudget(req, target, options.budget);
@@ -14248,7 +14500,7 @@ async function runAgent(options) {
 						}, ...options.summarize.fallbacks ?? []],
 						cursor: { index: 0 },
 						requestFor: (target) => {
-							let req = buildRequest(target.resolved, [...projectHistory(messages, providerOf(target.adapter)), summarizeInstruction()], limits, options.tools?.contracts);
+							let req = buildRequest(target.resolved, [...projectHistory(messages, retentionKeyOf(target.adapter)), summarizeInstruction()], limits, options.tools?.contracts);
 							if (req.tools !== void 0) req = {
 								...req,
 								toolChoice: "none"
@@ -14435,7 +14687,7 @@ async function runAgent(options) {
 					chain: loopChain,
 					cursor: loopCursor,
 					requestFor: (target) => {
-						let req = buildRequest(target.resolved, projectHistory(reserveMessages, providerOf(target.adapter)), limits, options.tools?.contracts);
+						let req = buildRequest(target.resolved, projectHistory(reserveMessages, retentionKeyOf(target.adapter)), limits, options.tools?.contracts);
 						if (options.schema !== void 0 && options.canonicalSchema !== void 0 && !separateExtract) req = applyStructuredOutputTier(req, rideTierFor(target), options.canonicalSchema);
 						if (req.tools !== void 0) req = {
 							...req,
@@ -14571,7 +14823,7 @@ async function runAgent(options) {
 					}, ...options.finalize.fallbacks ?? []],
 					cursor: { index: 0 },
 					requestFor: (target) => applyOutputBudget({
-						...buildRequest(target.resolved, projectHistory(synthesisMessages, providerOf(target.adapter)), limits, options.tools?.contracts),
+						...buildRequest(target.resolved, projectHistory(synthesisMessages, retentionKeyOf(target.adapter)), limits, options.tools?.contracts),
 						toolChoice: "none"
 					}, target, options.budget),
 					streamOptionsFor: (target) => {
@@ -14690,7 +14942,7 @@ async function runAgent(options) {
 					cursor: extractCursor,
 					requestFor: (target) => {
 						const targetTier = extractTierFor(target);
-						let req = buildRequest(target.resolved, projectHistory(extractMessages, providerOf(target.adapter)), limits, options.tools?.contracts);
+						let req = buildRequest(target.resolved, projectHistory(extractMessages, retentionKeyOf(target.adapter)), limits, options.tools?.contracts);
 						if (req.tools !== void 0 && targetTier !== "forced-tool") req = {
 							...req,
 							toolChoice: "none"
@@ -16072,7 +16324,12 @@ function costReportFromJournal(entries, priceUsd) {
 		if (entry.usageApprox === true) usageApprox = true;
 		const facts = entry.costAttribution;
 		const phase = attributionBucket(facts?.phase);
-		byPhase[phase] = (byPhase[phase] ?? 0) + priced.usd;
+		let phaseUsd = priced.usd;
+		for (const unit of priced.units) if (unit.source === "call" && unit.record?.phase === "repair") {
+			byPhase.repair = (byPhase.repair ?? 0) + unit.usd;
+			phaseUsd -= unit.usd;
+		}
+		byPhase[phase] = (byPhase[phase] ?? 0) + phaseUsd;
 		const agentType = attributionBucket(facts?.agentType);
 		byAgentType[agentType] = (byAgentType[agentType] ?? 0) + priced.usd;
 		const scope = scopeBucket(entry.scope);
@@ -16361,6 +16618,48 @@ function rowUsd(priceUsd, servedBy, usage, seq) {
 	return usd !== void 0 && Number.isFinite(usd) && usd >= 0 ? usd : void 0;
 }
 /**
+* The open provider wire intents of a journal (RV4006): every
+* `provider-intent` decision with neither a `provider-call` receipt
+* row nor a settled terminal record covering its (agentRef, ordinal,
+* attempt). ONE pairing rule, shared by the invoice's `openIntents`
+* lane and the resume refusal, the dispatchProjectionReserveUsd
+* precedent: the linter and the gate cannot drift.
+*/
+function openWireIntentsOf(entries) {
+	const terminals = /* @__PURE__ */ new Map();
+	const receipts = /* @__PURE__ */ new Set();
+	const intents = [];
+	for (const entry of entries) {
+		if (entry.kind === "agent" && entry.status !== "running" && typeof entry.ref === "number") {
+			terminals.set(entry.ref, entry);
+			continue;
+		}
+		if (entry.kind !== "decision") continue;
+		const value = entry.value;
+		if (value?.decisionType === "provider-call" && typeof value.agentRef === "number") {
+			const ordinal = value.record?.ordinal;
+			const attempt = typeof value.record?.attempt === "number" ? value.record.attempt : 1;
+			if (typeof ordinal === "number") receipts.add(`${String(value.agentRef)}:${String(ordinal)}:${String(attempt)}`);
+			continue;
+		}
+		if (value?.decisionType === "provider-intent" && typeof value.agentRef === "number" && typeof value.ordinal === "number" && typeof value.attempt === "number" && typeof value.servedBy === "string") intents.push({
+			seq: entry.seq,
+			scope: entry.scope,
+			agentRef: value.agentRef,
+			ordinal: value.ordinal,
+			attempt: value.attempt,
+			servedBy: value.servedBy,
+			...typeof value.requestFingerprint === "string" ? { requestFingerprint: value.requestFingerprint } : {}
+		});
+	}
+	return intents.filter((intent) => {
+		if (receipts.has(`${String(intent.agentRef)}:${String(intent.ordinal)}:${String(intent.attempt)}`)) return false;
+		const terminal = terminals.get(intent.agentRef);
+		if (terminal === void 0) return true;
+		return !(terminal.providerCalls ?? []).some((call) => call.ordinal === intent.ordinal && call.attempt === intent.attempt);
+	});
+}
+/**
 * The pure invoice fold. Pass the same entries and price table you
 * would pass `costReportFromJournal`; the totals are that report's
 * gross/net split verbatim. To make the export historically stable
@@ -16526,6 +16825,21 @@ function invoiceFromJournal(entries, priceUsd, options) {
 		cardinality: cardinalityOf(rows),
 		...unsettled === void 0 ? {} : { unsettled },
 		...orphanedReceipts === void 0 ? {} : { orphanedReceipts },
+		...(() => {
+			for (const entry of entries) {
+				if (entry.kind !== "decision") continue;
+				const value = entry.value;
+				if (value?.decisionType === "execution_scope" && typeof value.scope === "object") return { executionScope: value.scope };
+			}
+			return {};
+		})(),
+		...(() => {
+			const open = openWireIntentsOf(entries);
+			return open.length === 0 ? {} : { openIntents: {
+				count: open.length,
+				rows: open
+			} };
+		})(),
 		...(() => {
 			const count = rows.filter((row) => row.usageUnknown === true).length;
 			return count === 0 ? {} : { usageUnknownRows: count };
@@ -17134,7 +17448,7 @@ const TERMINAL_STATUSES = /* @__PURE__ */ new Set([
 	"exhausted",
 	"suspended"
 ]);
-function refuse(reason, message = REFUSAL_MESSAGES[reason]) {
+function refuse$1(reason, message = REFUSAL_MESSAGES[reason]) {
 	return {
 		available: false,
 		reason,
@@ -17150,17 +17464,17 @@ function refuse(reason, message = REFUSAL_MESSAGES[reason]) {
 */
 function persistedTerminalEnvelope(input) {
 	const settle = lastRunSettle(input.entries);
-	if (settle === void 0) return refuse("unsettled");
-	if (!TERMINAL_STATUSES.has(settle.runStatus)) return refuse("not-terminal");
+	if (settle === void 0) return refuse$1("unsettled");
+	if (!TERMINAL_STATUSES.has(settle.runStatus)) return refuse$1("not-terminal");
 	const tail = input.entries.filter((entry) => entry.seq > settle.seq).length;
-	if (tail > 0) return refuse("not-terminal", `the journal continued ${String(tail)} entr${tail === 1 ? "y" : "ies"} past the settle at seq ${String(settle.seq)}: the latest segment is not settled`);
+	if (tail > 0) return refuse$1("not-terminal", `the journal continued ${String(tail)} entr${tail === 1 ? "y" : "ies"} past the settle at seq ${String(settle.seq)}: the latest segment is not settled`);
 	const workflow = input.meta?.workflowName;
-	if (workflow === void 0) return refuse("unknown-workflow");
+	if (workflow === void 0) return refuse$1("unknown-workflow");
 	try {
 		return assemble(input, workflow, settle);
 	} catch (error) {
 		const detail = error instanceof Error ? error.message : String(error);
-		return refuse("malformed-envelope", `${REFUSAL_MESSAGES["malformed-envelope"]}: ${detail}`);
+		return refuse$1("malformed-envelope", `${REFUSAL_MESSAGES["malformed-envelope"]}: ${detail}`);
 	}
 }
 function assemble(input, workflow, settle) {
@@ -17784,6 +18098,117 @@ function dispatchProjectionReserveUsd(spec, flatReserveUsd) {
 	const base = spec.estCostUsd ?? flatReserveUsd;
 	return spec.budgetUsd === void 0 ? base : Math.min(base, spec.budgetUsd);
 }
+/**
+* Worst-case claim judge dispatches of a declared posture
+* (RV3402/RV4001): `'both'` dispatches the judge at the draft AND the
+* final, and an armed repair round (`onFound: 'repair'`, which intake
+* refuses at stage 'draft') rejudges the repaired composition once
+* more. Absent declarations read as the historical one pass.
+*/
+function acceptanceJudgePasses(stage, onFound) {
+	const resolvedStage = stage ?? "draft";
+	return (resolvedStage === "both" ? 2 : 1) + ((onFound ?? "report") === "repair" && resolvedStage !== "draft" ? 1 : 0);
+}
+/**
+* The ONE acceptance-tail formula (RV4001, the fifth comparison
+* experiment): what the effective cap must cover, at exact fill or
+* better, so the acceptance machinery the host declared is funded and
+* not started on luck. The RV3907 runtime gate landed WITHOUT a
+* preflight twin: preflight kept its own advisory arithmetic on
+* different terms, passed the experiment's plan green at a $4.54 cap,
+* and the runtime then refused the same plan typed at $4.82 before the
+* first wire; worse, the runtime undercounted the judge passes of
+* `stage: 'both'` (one where the worst case dispatches two) while
+* preflight counted them right, so the two calculators disagreed in
+* BOTH directions. The gate and the preflight `acceptanceReserve`
+* report block now both call this function, exactly the
+* {@link dispatchProjectionReserveUsd} precedent: one formula, so the
+* linter and the runtime cannot drift. Undeclared estimates contribute
+* zero: the tail binds exactly what the host declared. The armed
+* repair round (`onFound: 'repair'`, never at stage 'draft', which
+* intake refuses) adds one judge pass and one composition priced at
+* the declared `synthesis.estCost`.
+*/
+function acceptanceTailRequiredUsd(spec) {
+	const stage = spec.claimStage ?? "draft";
+	const onFound = spec.claimOnFound ?? "report";
+	const citationDeclared = spec.citationJudgeEstCostUsd !== void 0 || spec.citationOnFound !== void 0;
+	const citationRoundArmed = spec.citationOnFound === "repair";
+	const roundArmed = onFound === "repair" && stage !== "draft" || citationRoundArmed;
+	const judgePasses = acceptanceJudgePasses(spec.claimStage, spec.claimOnFound) + (citationRoundArmed && spec.claimConfigured === true && stage !== "draft" ? 1 : 0);
+	const citationJudgePasses = citationDeclared ? 1 + (citationRoundArmed ? 1 : 0) : 0;
+	const citationJudgeEstUsd = spec.citationJudgeEstCostUsd ?? 0;
+	const terms = {
+		synthesisReserveUsd: spec.synthesisReserveUsd ?? 0,
+		judgeEstUsd: spec.claimJudgeEstCostUsd ?? 0,
+		judgePasses,
+		estRepairCostUsd: spec.finishEstRepairCostUsd ?? 0,
+		roundCompositionUsd: roundArmed ? spec.synthesisEstCostUsd ?? 0 : 0,
+		...citationDeclared ? {
+			citationJudgeEstUsd,
+			citationJudgePasses
+		} : {},
+		workingRoomUsd: spec.workingRoomUsd
+	};
+	return {
+		requiredUsd: terms.synthesisReserveUsd + terms.judgeEstUsd * terms.judgePasses + terms.estRepairCostUsd + terms.roundCompositionUsd + citationJudgeEstUsd * citationJudgePasses + terms.workingRoomUsd,
+		terms
+	};
+}
+/**
+* The one rendering of the tail arithmetic (RV4001): the runtime
+* refusal message and the preflight finding print this same string, so
+* an operator can diff them by eye and a test can assert them equal.
+*/
+function formatAcceptanceTailTerms(terms) {
+	const citationUsd = (terms.citationJudgeEstUsd ?? 0) * (terms.citationJudgePasses ?? 0);
+	const requiredUsd = terms.synthesisReserveUsd + terms.judgeEstUsd * terms.judgePasses + terms.estRepairCostUsd + terms.roundCompositionUsd + citationUsd + terms.workingRoomUsd;
+	return `synthesisReserveUsd ${terms.synthesisReserveUsd.toFixed(4)} + judge ${terms.judgeEstUsd.toFixed(4)} x ${String(terms.judgePasses)} pass(es) + estRepairCostUsd ${terms.estRepairCostUsd.toFixed(4)} + round composition ${terms.roundCompositionUsd.toFixed(4)} + ` + (terms.citationJudgePasses === void 0 || terms.citationJudgePasses === 0 ? "" : `citation judge ${(terms.citationJudgeEstUsd ?? 0).toFixed(4)} x ${String(terms.citationJudgePasses)} pass(es) + `) + `working room ${terms.workingRoomUsd.toFixed(4)} = ${requiredUsd.toFixed(4)} USD`;
+}
+/**
+* The wire capacity of a declared orchestration plan (RV4005, the
+* fifth comparison experiment): base wires by declaration, the armed
+* repair round's delta, and the round's overhead share, from ONE
+* exported function so an answer about the runtime's own economics
+* has a source instead of an improvisation. The experiment's terminal
+* answer wrote "34 wires without repair, 35 with" and multiplied
+* retry share as `1 + r`: the round is TWO wires (its composition
+* plus the rejudge, `orchestrate.ts`'s own doctrine), so 34 becomes
+* 36 at 5.88 percent overhead, and r retries over a base of B
+* multiply wires by `1 + r/B` ({@link retryWireMultiplier}), not by
+* `1 + r`.
+*/
+function wireCapacityEstimate(spec) {
+	requireNonNegativeNumber(spec.childWires, "wireCapacityEstimate childWires");
+	const coordinationWires = spec.coordinationWires ?? 0;
+	const synthesisWires = spec.synthesisWires ?? 0;
+	const judgeWires = spec.judgeWires ?? 0;
+	const extractWires = spec.extractWires ?? 0;
+	requireNonNegativeNumber(coordinationWires, "wireCapacityEstimate coordinationWires");
+	requireNonNegativeNumber(synthesisWires, "wireCapacityEstimate synthesisWires");
+	requireNonNegativeNumber(judgeWires, "wireCapacityEstimate judgeWires");
+	requireNonNegativeNumber(extractWires, "wireCapacityEstimate extractWires");
+	const baseWires = spec.childWires + coordinationWires + synthesisWires + judgeWires + extractWires;
+	const repairRoundDeltaWires = 2;
+	return {
+		baseWires,
+		repairRoundDeltaWires,
+		mechanicalRepairDeltaWires: 1,
+		wiresWithRound: baseWires + repairRoundDeltaWires,
+		roundOverheadShare: baseWires === 0 ? 0 : repairRoundDeltaWires / baseWires
+	};
+}
+/**
+* The retry share of a wire plan (RV4005): r retries over a base of B
+* wires re-dispatch r of the B, so totals scale by `1 + r/B`. The
+* fifth comparison run's answer multiplied by `1 + r`, reading every
+* retry as a whole extra plan.
+*/
+function retryWireMultiplier(baseWires, retries) {
+	requireNonNegativeNumber(retries, "retryWireMultiplier retries");
+	if (!Number.isFinite(baseWires) || baseWires <= 0) throw new ConfigError(`retryWireMultiplier baseWires must be a positive finite number; got ${String(baseWires)}`);
+	return 1 + retries / baseWires;
+}
 /** Nesting depth of a child scope: its workflow, agent, and plan-node segments. */
 function spawnDepthOf(childScope) {
 	return parseScopePath(childScope).filter((segment) => segment.kind === "workflow" || segment.kind === "agent" || segment.kind === "plan-node").length;
@@ -19214,7 +19639,12 @@ function createCtx(internals, rootWorkflow) {
 				model: slice.servedBy,
 				usage: slice.usage
 			});
-			bump(internals.cost.byPhase, state.phase ?? "", costUsd);
+			let replayPhaseUsd = costUsd;
+			for (const unit of replayPriced?.units ?? []) if (unit.source === "call" && unit.record?.phase === "repair") {
+				bump(internals.cost.byPhase, "repair", unit.usd);
+				replayPhaseUsd -= unit.usd;
+			}
+			bump(internals.cost.byPhase, state.phase ?? "", replayPhaseUsd);
 			bump(internals.cost.byAgentType, agentType, costUsd);
 			bump(internals.cost.byScope, state.scope, costUsd);
 			internals.cost.byRole.set(primaryRole, (internals.cost.byRole.get(primaryRole) ?? 0) + costUsd);
@@ -19528,7 +19958,7 @@ function createCtx(internals, rootWorkflow) {
 						suspend: async () => {
 							if (internals.external === void 0) throw new ConfigError("tool approvals require the engine run context (createEngine)");
 							const approvalDeadlineMs = chain.approvalDeadlineMs;
-							return internals.external.awaitApproval({
+							const decision = await internals.external.awaitApproval({
 								scope: agentScope(state.scope, running.seq),
 								spanId: internals.spans.mint(spanId),
 								toolName: call.name,
@@ -19541,6 +19971,22 @@ function createCtx(internals, rootWorkflow) {
 									entryRef: entry.seq
 								}, spanId, replayed)
 							});
+							if (decision.decision !== "allow") return decision;
+							if (decision.entryRef !== void 0) {
+								const revocation = internals.replayer.snapshot().find((entry) => entry.kind === "decision" && entry.value?.decisionType === "approval_revoked" && entry.value.targetRef === decision.entryRef);
+								if (revocation !== void 0) {
+									const why = revocation.value ?? {};
+									return {
+										decision: "deny",
+										reason: `the recorded allow was revoked by ${typeof why.principal === "string" ? why.principal : "unknown"}: ${typeof why.reason === "string" ? why.reason : "no reason recorded"}`
+									};
+								}
+							}
+							if (decision.expiresAt !== void 0 && !(Date.parse(decision.expiresAt) >= internals.now())) return {
+								decision: "deny",
+								reason: `the recorded allow expired at ${decision.expiresAt}`
+							};
+							return decision;
 						}
 					};
 				}
@@ -19628,28 +20074,47 @@ function createCtx(internals, rootWorkflow) {
 			const cachePolicy = opts.cache ?? profile?.cache ?? internals.defaults.cache;
 			if (cachePolicy !== void 0) runAgentOptions.cache = cachePolicy;
 		}
-		runAgentOptions.billing = { onProviderCall: (record) => {
-			const append = internals.replayer.appendSinglePhase({
+		runAgentOptions.billing = {
+			onProviderCall: (record) => {
+				const append = internals.replayer.appendSinglePhase({
+					scope: state.scope,
+					key: `pc:${String(running.seq)}:${String(record.ordinal)}`,
+					kind: "decision",
+					status: "ok",
+					spanId,
+					site: "provider-call",
+					value: {
+						decisionType: "provider-call",
+						agentRef: running.seq,
+						record
+					}
+				}).then(() => void 0).catch((thrown) => {
+					internals.events.emit({
+						type: "log",
+						level: "warn",
+						msg: `incremental billing row failed to append; the terminal entry remains the canonical record (${thrown instanceof Error ? thrown.message : String(thrown)})`
+					}, spanId);
+				});
+				if (internals.defaults.billingReceipts === "awaited" || internals.defaults.billingReceipts === "intent") return append;
+			},
+			...internals.defaults.billingReceipts === "intent" ? { onProviderIntent: (intent) => internals.replayer.appendSinglePhase({
 				scope: state.scope,
-				key: `pc:${String(running.seq)}:${String(record.ordinal)}`,
+				key: `pi:${String(running.seq)}:${String(intent.ordinal)}:${String(intent.attempt)}`,
 				kind: "decision",
 				status: "ok",
 				spanId,
-				site: "provider-call",
+				site: "provider-intent",
 				value: {
-					decisionType: "provider-call",
+					decisionType: "provider-intent",
 					agentRef: running.seq,
-					record
+					ordinal: intent.ordinal,
+					role: intent.role,
+					servedBy: intent.servedBy,
+					attempt: intent.attempt,
+					requestFingerprint: createHash("sha256").update(jcsSerialize(intent.request.messages), "utf8").digest("hex")
 				}
-			}).then(() => void 0).catch((thrown) => {
-				internals.events.emit({
-					type: "log",
-					level: "warn",
-					msg: `incremental billing row failed to append; the terminal entry remains the canonical record (${thrown instanceof Error ? thrown.message : String(thrown)})`
-				}, spanId);
-			});
-			if (internals.defaults.billingReceipts === "awaited") return append;
-		} };
+			}).then(() => void 0) } : {}
+		};
 		runAgentOptions.summarize = summarize;
 		if (profile?.compaction !== void 0) runAgentOptions.compaction = profile.compaction;
 		if (profile?.evidenceContract !== void 0) runAgentOptions.evidenceContract = profile.evidenceContract;
@@ -19888,6 +20353,7 @@ function createCtx(internals, rootWorkflow) {
 			...result.providerCalls === void 0 ? {} : { providerCalls: result.providerCalls },
 			costAttribution: {
 				...state.phase === void 0 ? {} : { phase: state.phase },
+				...state.repairTrigger === void 0 ? {} : { repairTrigger: state.repairTrigger },
 				agentType,
 				role: primaryRole,
 				budgetAccount: state.budgetScope ?? "run",
@@ -19990,7 +20456,15 @@ function createCtx(internals, rootWorkflow) {
 			const sliceRole = slice.role ?? primaryRole;
 			internals.cost.byRole.set(sliceRole, (internals.cost.byRole.get(sliceRole) ?? 0) + priced);
 		}
-		bump(internals.cost.byPhase, state.phase ?? "", usd);
+		let livePhaseUsd = usd;
+		for (const record of result.providerCalls ?? []) {
+			if (record.phase !== "repair") continue;
+			const recordUsd = internals.priceUsd(record.servedBy, record.usage);
+			if (recordUsd === void 0 || !Number.isFinite(recordUsd) || recordUsd < 0) continue;
+			bump(internals.cost.byPhase, "repair", recordUsd);
+			livePhaseUsd -= recordUsd;
+		}
+		bump(internals.cost.byPhase, state.phase ?? "", livePhaseUsd);
 		bump(internals.cost.byAgentType, agentType, usd);
 		bump(internals.cost.byScope, state.scope, usd);
 		if (result.error?.kind === "budget" || internals.budget.exhausted && result.status !== "ok") {
@@ -22223,6 +22697,212 @@ function renderContractRequirements(manifest) {
 	return lines.join("\n");
 }
 //#endregion
+//#region src/orchestrator/citation-audit.ts
+const DEFAULT_CITATION_SAMPLE_PER_SECTION = 2;
+const DEFAULT_CITATION_MAX_SAMPLED = 24;
+const DEFAULT_CITATION_EXCERPT_WINDOW = 3;
+/** Excerpt bounds, the claim-pass excerpt discipline. */
+const MAX_CITATION_EXCERPT_LINES = 12;
+const MAX_CITATION_EXCERPT_CHARS = 800;
+/** A citation with an optional `-end` range tail on the line half. */
+const citationWithRange = (pattern) => new RegExp(pattern, "gu");
+const RANGE_TAIL = /^(.*):(\d+)(?:-(\d+))?$/u;
+/**
+* Validates the declared plan numbers; returns the resolved bounds.
+* Garbage throws like every malformed intake.
+*/
+function resolveCitationAuditPlan(options) {
+	const samplePerSection = options.samplePerSection ?? 2;
+	if (!Number.isInteger(samplePerSection) || samplePerSection < 1) throw new ConfigError(`citationAudit.samplePerSection must be a positive integer; got ${String(options.samplePerSection)}`);
+	const maxSampled = options.maxSampled ?? 24;
+	if (!Number.isInteger(maxSampled) || maxSampled < 1) throw new ConfigError(`citationAudit.maxSampled must be a positive integer; got ${String(options.maxSampled)}`);
+	const window = options.window ?? 3;
+	if (!Number.isInteger(window) || window < 0) throw new ConfigError(`citationAudit.window must be a non negative integer; got ${String(options.window)}`);
+	const pattern = options.pattern ?? "[\\w./-]+\\.\\w+:\\d+";
+	let probe;
+	try {
+		probe = new RegExp(pattern, "gu");
+	} catch (thrown) {
+		throw new ConfigError(`citationAudit.pattern does not compile: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
+	}
+	if (probe.test("")) throw new ConfigError("citationAudit.pattern matches the empty string: it would flood the sample instead of anchoring it");
+	return {
+		pattern,
+		samplePerSection,
+		maxSampled,
+		window
+	};
+}
+/** Splits a document into (section marker, body) runs in order. */
+function sectionsOfDocument(document) {
+	const lines = document.split("\n");
+	const runs = [{
+		marker: "",
+		body: []
+	}];
+	for (const line of lines) {
+		if (/^##\s+\S/u.test(line) && !line.startsWith("###")) {
+			runs.push({
+				marker: line.trim(),
+				body: []
+			});
+			continue;
+		}
+		runs.at(-1)?.body.push(line);
+	}
+	return runs.map((run) => ({
+		marker: run.marker,
+		body: run.body.join("\n")
+	})).filter((run) => run.body.trim().length > 0);
+}
+/** The deterministic per-section pick: seeded index selection without replacement. */
+function pickIndexes(count, k, seedInput) {
+	const indexes = Array.from({ length: count }, (_, index) => index);
+	const picked = [];
+	for (let round = 0; round < Math.min(k, count); round += 1) {
+		const index = createHash("sha256").update(`${seedInput}:${String(round)}`).digest().readUInt32BE(0) % indexes.length;
+		const chosen = indexes.splice(index, 1)[0];
+		if (chosen !== void 0) picked.push(chosen);
+	}
+	return picked.sort((a, b) => a - b);
+}
+/**
+* The deterministic stratified sample (RV4004): per H2 section, up to
+* `samplePerSection` citing sentences, selected by a hash chain seeded
+* from the audited document's own hash, so the same candidate always
+* yields the same sample (replay-stable, no clock, no randomness) and
+* a repaired candidate re-samples afresh from its new hash. The whole
+* sample is capped at `maxSampled` by pick rank across sections (every
+* section's first pick seats before any section's second), so a
+* many-section document degrades to one citation per section instead
+* of auditing the first sections only.
+*/
+function sampleCitationRows(document, plan, seed) {
+	const perSection = [];
+	for (const { marker, body } of sectionsOfDocument(document)) {
+		const candidates = [];
+		for (const sentence of sentencesOf(body)) {
+			const match = citationWithRange(plan.pattern).exec(sentence);
+			if (match === null) continue;
+			const anchorText = new RegExp(`${match[0].replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}(?:-(\\d+))?`, "u").exec(sentence)?.[0] ?? match[0];
+			const parsed = RANGE_TAIL.exec(anchorText);
+			if (parsed === null) continue;
+			const path = parsed[1] ?? "";
+			const line = Number(parsed[2]);
+			const endLine = parsed[3] === void 0 ? void 0 : Number(parsed[3]);
+			if (path === "" || !Number.isInteger(line) || line < 1) continue;
+			candidates.push({
+				sentence,
+				anchor: anchorText,
+				path,
+				line,
+				...endLine !== void 0 && Number.isInteger(endLine) && endLine >= line ? { endLine } : {}
+			});
+		}
+		if (candidates.length === 0) continue;
+		const picks = pickIndexes(candidates.length, plan.samplePerSection, `${seed}:${marker}`).map((index) => candidates[index]).filter((candidate) => candidate !== void 0);
+		perSection.push({
+			section: marker,
+			picks
+		});
+	}
+	const rows = [];
+	for (let rank = 0; rows.length < plan.maxSampled; rank += 1) {
+		let any = false;
+		for (const bucket of perSection) {
+			const pick = bucket.picks[rank];
+			if (pick === void 0) continue;
+			any = true;
+			if (rows.length >= plan.maxSampled) break;
+			rows.push({
+				row: rows.length,
+				section: bucket.section,
+				...pick
+			});
+		}
+		if (!any) break;
+	}
+	return rows;
+}
+/**
+* Resolves one sampled citation's excerpt through the host's pure
+* snapshot resolver. The FIRST cited line failing to resolve returns
+* undefined (an unsupported citation by doctrine); later lines simply
+* end the excerpt (a range past the file's end reads as far as the
+* snapshot goes).
+*/
+function citationExcerptOf(resolve, row, window) {
+	const last = Math.min(row.endLine ?? row.line + window, row.line + 12 - 1);
+	const lines = [];
+	for (let line = row.line; line <= last; line += 1) {
+		const text = resolve({
+			path: row.path,
+			line
+		});
+		if (text === void 0) {
+			if (line === row.line) return;
+			break;
+		}
+		lines.push(`L${String(line)}: ${text}`);
+	}
+	const excerpt = lines.join("\n");
+	return excerpt.length > 800 ? `${excerpt.slice(0, 800)}…` : excerpt;
+}
+/** The audit judge's structured verdict schema (mirrors the claim judge). */
+const CITATION_JUDGE_SCHEMA = {
+	type: "object",
+	properties: { verdicts: {
+		type: "array",
+		items: {
+			type: "object",
+			properties: {
+				row: { type: "integer" },
+				verdict: {
+					type: "string",
+					enum: [
+						"supported",
+						"partial",
+						"unsupported"
+					]
+				},
+				reason: { type: "string" }
+			},
+			required: [
+				"row",
+				"verdict",
+				"reason"
+			],
+			additionalProperties: false
+		}
+	} },
+	required: ["verdicts"],
+	additionalProperties: false
+};
+/**
+* Parses the judge output strictly: one verdict per judged row, no
+* duplicates, verdicts from the closed vocabulary. Anything else returns
+* undefined and the caller treats the invocation as a failed judge
+* (nothing was judged; partial verdicts over a partial parse would
+* claim more than the judge said).
+*/
+function parseCitationVerdicts(output, rowIndexes) {
+	const shaped = output;
+	if (shaped === null || shaped === void 0 || !Array.isArray(shaped.verdicts)) return;
+	const parsed = /* @__PURE__ */ new Map();
+	for (const entry of shaped.verdicts) {
+		const row = entry.row;
+		const verdict = entry.verdict;
+		const reason = entry.reason;
+		if (typeof row !== "number" || verdict !== "supported" && verdict !== "partial" && verdict !== "unsupported" || typeof reason !== "string" || parsed.has(row)) return;
+		parsed.set(row, {
+			verdict,
+			reason
+		});
+	}
+	for (const index of rowIndexes) if (!parsed.has(index)) return;
+	return parsed;
+}
+//#endregion
 //#region src/orchestrator/contradictions.ts
 /**
 * The bounded contradiction pass, pure half (RV1301, the sixteenth
@@ -23487,6 +24167,18 @@ function validateOrchestrateOptions(opts) {
 		if (consistency.runFactCoverageRatio !== void 0 && consistency.runFacts !== true) throw new ConfigError("orchestrate claimConsistency.runFactCoverageRatio rides the runFacts pass; set claimConsistency.runFacts true");
 		if (consistency.onLowCoverage !== void 0 && consistency.onLowCoverage !== "report" && consistency.onLowCoverage !== "fail") throw new ConfigError("orchestrate claimConsistency.onLowCoverage must be 'report' or 'fail'; got " + JSON.stringify(consistency.onLowCoverage));
 		if (consistency.onLowCoverage !== void 0 && consistency.minimumCoverageRatio === void 0 && consistency.runFactCoverageRatio === void 0 && consistency.coverageTarget === void 0) throw new ConfigError("orchestrate claimConsistency.onLowCoverage needs a declared floor; set minimumCoverageRatio, runFactCoverageRatio, or coverageTarget");
+		const coveragePolicy = consistency.coveragePolicy;
+		if (coveragePolicy !== void 0 && coveragePolicy !== "observed" && coveragePolicy !== "strict-final") throw new ConfigError(`orchestrate claimConsistency.coveragePolicy must be 'observed' or 'strict-final'; got ${JSON.stringify(coveragePolicy)}`);
+		if (coveragePolicy === "strict-final" && stage === "draft") throw new ConfigError("orchestrate claimConsistency.coveragePolicy 'strict-final' needs stage 'final' or 'both': a draft-only pass grades no final document, so the policy would gate on nothing");
+		const waiver = consistency.waiver;
+		if (waiver !== void 0) {
+			if (coveragePolicy !== "strict-final") throw new ConfigError("orchestrate claimConsistency.waiver requires coveragePolicy 'strict-final': a waiver over an unenforced grade is a signature over nothing");
+			if (typeof waiver !== "object" || waiver === null || Array.isArray(waiver)) throw new ConfigError(`orchestrate claimConsistency.waiver must be an object; got ${JSON.stringify(waiver)}`);
+			const shaped = waiver;
+			if (typeof shaped.principal !== "string" || shaped.principal.length === 0) throw new ConfigError("orchestrate claimConsistency.waiver.principal must be a non empty string; got " + JSON.stringify(shaped.principal));
+			if (typeof shaped.reason !== "string" || shaped.reason.length === 0) throw new ConfigError("orchestrate claimConsistency.waiver.reason must be a non empty string; got " + JSON.stringify(shaped.reason));
+			if (shaped.expiresAt !== void 0 && (typeof shaped.expiresAt !== "string" || Number.isNaN(Date.parse(shaped.expiresAt)))) throw new ConfigError(`orchestrate claimConsistency.waiver.expiresAt must be an ISO 8601 date string; got ${JSON.stringify(shaped.expiresAt)}`);
+		}
 		if (consistency.judge !== void 0) {
 			const judge = consistency.judge;
 			if (typeof judge !== "object" || judge === null || Array.isArray(judge)) throw new ConfigError(`orchestrate claimConsistency.judge must be an object; got ${JSON.stringify(consistency.judge)}`);
@@ -23502,6 +24194,18 @@ function validateOrchestrateOptions(opts) {
 		}
 	}
 	if (opts.executionFacts !== void 0 && typeof opts.executionFacts !== "boolean") throw new ConfigError(`orchestrate executionFacts must be a boolean; got ${typeof opts.executionFacts}`);
+	const audit = opts?.citationAudit;
+	if (audit !== void 0) {
+		if (typeof audit !== "object" || audit === null || Array.isArray(audit)) throw new ConfigError(`orchestrate citationAudit must be an object; got ${JSON.stringify(audit)}`);
+		if (typeof audit.resolve !== "function") throw new ConfigError("orchestrate citationAudit.resolve must be a function: the pure host snapshot reader is the whole evidence channel of the audit");
+		resolveCitationAuditPlan(audit);
+		if (audit.onFound !== void 0 && audit.onFound !== "report" && audit.onFound !== "repair" && audit.onFound !== "fail") throw new ConfigError(`orchestrate citationAudit.onFound must be 'report', 'repair' or 'fail'; got ${String(audit.onFound)}`);
+		if (audit.judge?.estCost !== void 0) requireNonNegativeNumber(audit.judge.estCost, "orchestrate citationAudit.judge.estCost");
+		if (audit.onFound === "repair") {
+			if (opts?.synthesis === void 0) throw new ConfigError("orchestrate citationAudit.onFound 'repair' requires synthesis: the bounded round is one more composition, and without one there is nothing to repair with");
+			if (opts?.claimConsistency?.onFound === "repair") throw new ConfigError("orchestrate citationAudit.onFound 'repair' cannot pair with claimConsistency.onFound 'repair': the run grants ONE bounded repair round (RV3307), so arm one consumer and give the other 'report' or 'fail'");
+		}
+	}
 	const spec = opts.budget;
 	if (spec === void 0) return;
 	if (spec.capUsd !== void 0) requireNonNegativeNumber(spec.capUsd, "orchestrate budget.capUsd");
@@ -23712,19 +24416,21 @@ function makeOrchestratorWorkflow(goal, opts) {
 			}
 		}
 		if (opts?.budget?.acceptanceReserve === "require") {
-			const synthesisHoldUsd = opts.budget.synthesisReserveUsd ?? 0;
-			const judgeEstUsd = opts?.claimConsistency?.judge?.estCost ?? 0;
-			const bootClaimStage = opts?.claimConsistency?.stage ?? "draft";
-			const roundArmed = (opts?.claimConsistency?.onFound ?? "report") === "repair" && bootClaimStage !== "draft";
-			const judgePasses = 1 + (roundArmed ? 1 : 0);
-			const judgeTailUsd = judgeEstUsd * judgePasses;
-			const mechanicalRepairUsd = opts?.finishValidation?.estRepairCostUsd ?? 0;
-			const roundCompositionUsd = roundArmed ? opts?.synthesis?.estCost ?? 0 : 0;
-			const workingRoomUsd = capState?.turnEstimateUsd ?? internals.flatReserveUsd ?? .5;
-			const requiredUsd = synthesisHoldUsd + judgeTailUsd + mechanicalRepairUsd + roundCompositionUsd + workingRoomUsd;
+			const { requiredUsd, terms } = acceptanceTailRequiredUsd({
+				...opts.budget.synthesisReserveUsd === void 0 ? {} : { synthesisReserveUsd: opts.budget.synthesisReserveUsd },
+				...opts?.claimConsistency?.stage === void 0 ? {} : { claimStage: opts.claimConsistency.stage },
+				...opts?.claimConsistency?.onFound === void 0 ? {} : { claimOnFound: opts.claimConsistency.onFound },
+				...opts?.claimConsistency?.judge?.estCost === void 0 ? {} : { claimJudgeEstCostUsd: opts.claimConsistency.judge.estCost },
+				...opts?.finishValidation?.estRepairCostUsd === void 0 ? {} : { finishEstRepairCostUsd: opts.finishValidation.estRepairCostUsd },
+				...opts?.synthesis?.estCost === void 0 ? {} : { synthesisEstCostUsd: opts.synthesis.estCost },
+				...opts?.citationAudit?.judge?.estCost === void 0 ? {} : { citationJudgeEstCostUsd: opts.citationAudit.judge.estCost },
+				...opts?.citationAudit?.onFound === void 0 ? {} : { citationOnFound: opts.citationAudit.onFound },
+				...opts?.claimConsistency === void 0 ? {} : { claimConfigured: true },
+				workingRoomUsd: capState?.turnEstimateUsd ?? internals.flatReserveUsd ?? .5
+			});
 			const capUsd = capState?.effectiveCapUsd;
 			if (capUsd === void 0 || capUsd < requiredUsd) {
-				const terms = `synthesisReserveUsd ${synthesisHoldUsd.toFixed(4)} + judge ${judgeEstUsd.toFixed(4)} x ${String(judgePasses)} pass(es) + estRepairCostUsd ${mechanicalRepairUsd.toFixed(4)} + round composition ${roundCompositionUsd.toFixed(4)} + working room ${workingRoomUsd.toFixed(4)} = ${requiredUsd.toFixed(4)} USD`;
+				const termsLine = formatAcceptanceTailTerms(terms);
 				await internals.replayer.appendSinglePhase({
 					scope: callingState.scope,
 					key: deriverV2.deriveKey({ kind: "acceptance-reserve-refused" }),
@@ -23736,15 +24442,19 @@ function makeOrchestratorWorkflow(goal, opts) {
 						decisionType: "acceptance_reserve_refused",
 						requiredUsd,
 						effectiveCapUsd: capUsd ?? null,
-						synthesisReserveUsd: synthesisHoldUsd,
-						judgeEstUsd,
-						judgePasses,
-						estRepairCostUsd: mechanicalRepairUsd,
-						roundCompositionUsd,
-						workingRoomUsd
+						synthesisReserveUsd: terms.synthesisReserveUsd,
+						judgeEstUsd: terms.judgeEstUsd,
+						judgePasses: terms.judgePasses,
+						estRepairCostUsd: terms.estRepairCostUsd,
+						roundCompositionUsd: terms.roundCompositionUsd,
+						...terms.citationJudgePasses === void 0 ? {} : {
+							citationJudgeEstUsd: terms.citationJudgeEstUsd ?? 0,
+							citationJudgePasses: terms.citationJudgePasses
+						},
+						workingRoomUsd: terms.workingRoomUsd
 					}
 				});
-				throw new OrchestratorCapConfigError(capUsd === void 0 ? `budget.acceptanceReserve 'require' needs a resolved effective cap to hold the declared acceptance tail against (${terms}); declare budget.capUsd or a run ceiling` : `budget.acceptanceReserve 'require': the declared acceptance tail does not fit the effective cap ${capUsd.toFixed(4)} USD (${terms}); raise the cap or lower the declared tail`);
+				throw new OrchestratorCapConfigError(capUsd === void 0 ? `budget.acceptanceReserve 'require' needs a resolved effective cap to hold the declared acceptance tail against (${termsLine}); declare budget.capUsd or a run ceiling` : `budget.acceptanceReserve 'require': the declared acceptance tail does not fit the effective cap ${capUsd.toFixed(4)} USD (${termsLine}); raise the cap or lower the declared tail`);
 			}
 		}
 		const records = /* @__PURE__ */ new Map();
@@ -24700,6 +25410,20 @@ function makeOrchestratorWorkflow(goal, opts) {
 		*/
 		let validationInvocationStart = 0;
 		/**
+		* The stage a finish-validation verdict is rendered under (RV4002,
+		* the fifth comparison experiment): 'composition' for the initial
+		* composition invocation, the no-synthesis coordination finish,
+		* and the reserved finalizer wake; 'round' from the moment the
+		* RV3307 claim repair round's own composition dispatches. Written
+		* onto every `orchestrator_finish_validation` decision so the
+		* workflow-wide repair ledger is a pure journal fold instead of a
+		* positional reconstruction (the experiment's judge rebuilt the
+		* one draft repair from the raw transcript). Live state on the
+		* RV808b doctrine: replay re-delivers the journaled decisions and
+		* never re-runs validateFinish.
+		*/
+		let finishValidationStage = "composition";
+		/**
 		* The staged release of the round's mechanical money leg (RV3802),
 		* armed by the bounded claim repair round right before its
 		* composition dispatches and fired at the round invocation's FIRST
@@ -24887,7 +25611,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 					};
 					return {
 						kind: "spliced",
-						result: spliceSections(retained, declared, patch)
+						result: spliceSections(retained, declared, patch),
+						markers
 					};
 				}
 			};
@@ -24898,6 +25623,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			if (validationSpec === void 0) return { ok: true };
 			let effective = call.result ?? null;
 			let spliced = false;
+			let splicedMarkers;
 			if (sectionalRoundContext !== void 0) {
 				const round = sectionalRoundContext;
 				const args = call.args ?? {};
@@ -24935,6 +25661,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 					};
 					effective = spliceSections(round.base, round.sections, patch);
 					spliced = true;
+					splicedMarkers = markers;
 				}
 			} else if (finishSectional !== void 0) {
 				const resolution = finishSectional.resolve(call);
@@ -24944,6 +25671,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				};
 				effective = resolution.result ?? null;
 				spliced = resolution.kind === "spliced";
+				if (resolution.kind === "spliced") splicedMarkers = resolution.markers;
 			}
 			const maxRepairs = validationSpec.maxRepairs ?? 1;
 			const known = validationDecisions();
@@ -25053,6 +25781,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 					decisionType: "orchestrator_finish_validation",
 					callId: call.id,
 					verdict: failed.length === 0 || deterministicRepair?.outcome === "accepted" ? "accepted" : repairsUsed < maxRepairs ? "repair" : "rejected",
+					stage: finishValidationStage,
+					...spliced && splicedMarkers !== void 0 ? {
+						spliced: true,
+						sections: [...splicedMarkers]
+					} : {},
 					failed: deterministicRepair?.outcome === "accepted" ? [] : failed,
 					repairsUsed,
 					maxRepairs,
@@ -25128,6 +25861,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			if (policy === void 0) return Promise.resolve({ ok: true });
 			let effective = call.result ?? null;
 			let spliced = false;
+			let splicedMarkers;
 			if (draftSectional !== void 0) {
 				const resolution = draftSectional.resolve(call);
 				if (resolution.kind === "refused") return Promise.resolve({
@@ -25136,22 +25870,54 @@ function makeOrchestratorWorkflow(goal, opts) {
 				});
 				effective = resolution.result ?? null;
 				spliced = resolution.kind === "spliced";
+				if (resolution.kind === "spliced") splicedMarkers = resolution.markers;
 			}
 			const result = effective;
 			const text = typeof result === "string" ? result : JSON.stringify(result);
-			const accept = () => Promise.resolve(spliced ? {
-				ok: true,
-				resolved: { result }
-			} : { ok: true });
-			const reject = (feedback) => {
+			const accept = async () => {
+				if (spliced && splicedMarkers !== void 0) await internals.replayer.appendSinglePhase({
+					scope: callingState.scope,
+					key: `draft-gate-accept:${call.id}`,
+					kind: "decision",
+					status: "ok",
+					spanId: internals.spans.mint(callingState.spanId),
+					site: "orchestrator-draft-gate",
+					value: {
+						decisionType: "orchestrator_draft_gate",
+						callId: call.id,
+						verdict: "accepted",
+						spliced: true,
+						sections: [...splicedMarkers]
+					}
+				});
+				return spliced ? {
+					ok: true,
+					resolved: { result }
+				} : { ok: true };
+			};
+			const reject = async (feedback, failed) => {
 				draftSectional?.retain(result);
-				return Promise.resolve({
+				await internals.replayer.appendSinglePhase({
+					scope: callingState.scope,
+					key: `draft-gate:${call.id}`,
+					kind: "decision",
+					status: "ok",
+					spanId: internals.spans.mint(callingState.spanId),
+					site: "orchestrator-draft-gate",
+					value: {
+						decisionType: "orchestrator_draft_gate",
+						callId: call.id,
+						verdict: "rejected",
+						failed
+					}
+				});
+				return {
 					ok: false,
 					feedback: {
 						...feedback,
 						...draftSectional === void 0 ? {} : { sectionalRepair: draftSectional.guidance() }
 					}
-				});
+				};
 			};
 			if (policy === "contract") {
 				const failed = [];
@@ -25177,7 +25943,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				return reject({
 					error: "the coordination draft failed the declared finish contract; repair the draft and call finish again: a contract-valid draft skips the synthesis invocation entirely, and every gap left here is paid for again downstream",
 					failed
-				});
+				}, failed);
 			}
 			const reasons = [];
 			if (policy.minWords !== void 0) {
@@ -25190,7 +25956,10 @@ function makeOrchestratorWorkflow(goal, opts) {
 			return reject({
 				error: "the coordination draft failed the draft policy; repair the draft and call finish again: the synthesis invocation composes the FINAL result from this draft, and a collapsed draft starves it of the evidence the validators demand",
 				reasons
-			});
+			}, [{
+				name: "draft-policy",
+				reasons
+			}]);
 		};
 		/**
 		* The extension finish gate (RV3202, the 2026-08-11 experiment's
@@ -25632,6 +26401,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 		*/
 		let claimFindingsFound;
 		/**
+		* The citation findings riding the armed audit round's prompt
+		* (RV4004): set exactly while that round's composition dispatches,
+		* so every other synthesis prompt keeps its bytes.
+		*/
+		let carriedCitationFindings;
+		/**
 		* The observed price of this run's own latest post draft claim
 		* judge pass (RV3701): the fallback sizing of the repair round's
 		* convergence hold when the host declared no `judge.estCost`. By
@@ -26006,7 +26781,204 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...snapshot ?? {}
 			} });
 		};
-		const runSynthesis = async (draft, stagePhase = "composition") => {
+		/**
+		* The citation entailment audit's terminal state (RV4004):
+		* undefined until the pass ran (or when it is not configured),
+		* the meta plus the findings once it did. `citationFindingsFound`
+		* carries every non-supported sampled citation (mechanically
+		* unresolved rows included); `[]` is the judge's claim that every
+		* sampled citation is supported.
+		*/
+		let citationAuditMeta;
+		let citationFindingsFound;
+		/**
+		* The citation entailment audit (RV4004): a deterministic
+		* stratified sample of the document's citing sentences, excerpts
+		* through the host's pure snapshot resolver, one bounded judge
+		* invocation. Mirrors the claim judge's dispatch discipline
+		* (declined admissions degrade typed and journaled, dead judges
+		* stamp the meta, armed postures refuse to pass silently); the
+		* POSTURE consequences of findings ('fail', the RV3307 round)
+		* belong to the call site.
+		*/
+		const runCitationAudit = async (document, pass) => {
+			const auditSpec = opts?.citationAudit;
+			if (auditSpec === void 0) return;
+			const plan = resolveCitationAuditPlan(auditSpec);
+			const auditedHash = createHash("sha256").update(jcsSerialize(document ?? null), "utf8").digest("hex");
+			const rows = sampleCitationRows(typeof document === "string" ? document : JSON.stringify(document ?? null), plan, auditedHash).map((row) => {
+				const excerpt = citationExcerptOf(auditSpec.resolve, row, plan.window);
+				return excerpt === void 0 ? row : {
+					...row,
+					excerpt
+				};
+			});
+			const perSection = {};
+			const bucketOf = (section) => perSection[section] ??= {
+				sampled: 0,
+				supported: 0,
+				partial: 0,
+				unsupported: 0
+			};
+			for (const row of rows) bucketOf(row.section).sampled += 1;
+			const mechanical = rows.filter((row) => row.excerpt === void 0).map((row) => ({
+				row: row.row,
+				section: row.section,
+				sentence: row.sentence,
+				anchor: row.anchor,
+				verdict: "unsupported",
+				reason: "the cited location does not resolve in the host snapshot"
+			}));
+			for (const finding of mechanical) bucketOf(finding.section).unsupported += 1;
+			const judgeRows = rows.filter((row) => row.excerpt !== void 0);
+			const metaBase = {
+				sampled: rows.length,
+				supported: 0,
+				partial: 0,
+				unsupported: mechanical.length,
+				unresolved: mechanical.length,
+				perSection,
+				auditedHash,
+				samplePerSection: plan.samplePerSection,
+				maxSampled: plan.maxSampled
+			};
+			const onFound = auditSpec.onFound ?? "report";
+			if (judgeRows.length === 0) {
+				citationAuditMeta = {
+					...metaBase,
+					judgeInvoked: false
+				};
+				citationFindingsFound = mechanical;
+				return;
+			}
+			const judgePrompt = ["You audit CITATIONS for entailment. Each row below carries one sentence from a composed document, the source location it cites, and the resolved text of the cited lines. Judge whether the cited text ENTAILS what the sentence claims about it: 'supported' when the lines carry the claimed meaning, 'partial' when they carry some of it but not the load-bearing part, 'unsupported' when they are about something else entirely, however plausible the sentence reads. Judge the MEANING, not the mechanics: the location resolving, or sharing words with the sentence, is not entailment. Answer with { verdicts: [{ row, verdict, reason }] }, one verdict per row, reason one short sentence.", `ROWS: ${JSON.stringify(judgeRows.map((row) => ({
+				row: row.row,
+				section: row.section,
+				sentence: row.sentence,
+				anchor: row.anchor,
+				excerpt: row.excerpt
+			})))}`].join("\n");
+			const auditJudgeState = { ...callingState };
+			if (orchestratorAccount !== void 0) auditJudgeState.budgetScope = orchestratorAccount;
+			auditJudgeState.phase = auditJudgeState.phase ?? "judge";
+			const judgeOpts = {
+				role: "synthesize",
+				result: "full",
+				label: pass === "round" ? "citation-entailment-judge-round" : "citation-entailment-judge",
+				schema: CITATION_JUDGE_SCHEMA,
+				limits: auditSpec.judge?.limits ?? { maxTurns: 3 },
+				...auditSpec.judge?.model === void 0 ? {} : { model: auditSpec.judge.model },
+				...auditSpec.judge?.effort === void 0 ? {} : { effort: auditSpec.judge.effort },
+				...auditSpec.judge?.estCost === void 0 ? {} : { estCost: auditSpec.judge.estCost }
+			};
+			let judged;
+			try {
+				judged = await runtime.runInScope(auditJudgeState, () => ctx.agent(judgePrompt, judgeOpts));
+				noteInternalSettle(judged);
+			} catch (declined) {
+				if (!(declined instanceof BudgetExhaustedError)) throw declined;
+				citationAuditMeta = {
+					...metaBase,
+					judgeInvoked: false,
+					judgeDeclined: true
+				};
+				citationFindingsFound = void 0;
+				const declineKey = deriverV2.deriveKey({ kind: pass === "round" ? "orchestrator-citation-judge-declined-round" : "orchestrator-citation-judge-declined" });
+				if (!internals.replayer.snapshot().some((entry) => entry.kind === "decision" && entry.key === declineKey)) await internals.replayer.appendSinglePhase({
+					scope: callingState.scope,
+					key: declineKey,
+					kind: "decision",
+					status: "ok",
+					spanId: internals.spans.mint(callingState.spanId),
+					site: "orchestrator-budget",
+					value: {
+						decisionType: "orchestrator_citation_judge_declined",
+						reason: declined.message.slice(0, 300),
+						remainingUsd: internals.budget.remainingUsd(orchestratorAccount ?? "run") ?? null
+					}
+				});
+				internals.events.emit({
+					type: "log",
+					level: "warn",
+					msg: "orchestrator citation audit judge declined by admission",
+					data: { reason: declined.message.slice(0, 300) }
+				}, callingState.spanId);
+				if (onFound === "fail" || onFound === "repair") throw new FailRunError(`the citation audit judge could not be admitted within the orchestrator account, so the armed ${onFound} posture cannot pass the document: ` + declined.message.slice(0, 300), { data: {
+					source: "orchestrator_citation_audit",
+					citationAuditMeta
+				} });
+				return;
+			}
+			const verdicts = judged.status === "ok" ? parseCitationVerdicts(judged.output, judgeRows.map((row) => row.row)) : void 0;
+			if (verdicts === void 0) {
+				citationAuditMeta = {
+					...metaBase,
+					judgeInvoked: true,
+					judgeFailed: true
+				};
+				citationFindingsFound = void 0;
+				internals.events.emit({
+					type: "log",
+					level: "warn",
+					msg: "orchestrator citation audit judge failed",
+					data: { status: judged.status }
+				}, callingState.spanId);
+				if (onFound === "fail" || onFound === "repair") throw new FailRunError(`the citation audit judge did not produce a usable verdict, so the armed ${onFound} posture cannot pass the document`, { data: {
+					source: "orchestrator_citation_audit",
+					citationAuditMeta
+				} });
+				return;
+			}
+			const findings = [...mechanical];
+			let supported = 0;
+			let partial = 0;
+			let unsupported = mechanical.length;
+			for (const row of judgeRows) {
+				const verdict = verdicts.get(row.row);
+				if (verdict === void 0) continue;
+				if (verdict.verdict === "supported") {
+					supported += 1;
+					bucketOf(row.section).supported += 1;
+					continue;
+				}
+				if (verdict.verdict === "partial") {
+					partial += 1;
+					bucketOf(row.section).partial += 1;
+				} else {
+					unsupported += 1;
+					bucketOf(row.section).unsupported += 1;
+				}
+				findings.push({
+					row: row.row,
+					section: row.section,
+					sentence: row.sentence,
+					anchor: row.anchor,
+					verdict: verdict.verdict,
+					reason: verdict.reason
+				});
+			}
+			citationAuditMeta = {
+				...metaBase,
+				supported,
+				partial,
+				unsupported,
+				judgeInvoked: true
+			};
+			citationFindingsFound = findings;
+			internals.events.emit({
+				type: "log",
+				level: findings.length === 0 ? "debug" : "info",
+				msg: "orchestrator citation entailment audit",
+				data: {
+					sampled: rows.length,
+					supported,
+					partial,
+					unsupported,
+					pass
+				}
+			}, callingState.spanId);
+		};
+		const runSynthesis = async (draft, stagePhase = "composition", repairTrigger) => {
 			const spec = opts?.synthesis;
 			if (spec === void 0) return draft;
 			await recoveryDone;
@@ -26258,6 +27230,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...opts?.contradictions?.onFound !== "carry" || contradictionsFound === void 0 || contradictionsFound.length === 0 ? [] : ["CHILD CONTRADICTIONS: the settled children read these cited locations differently; resolve each one EXPLICITLY in the final result (say which reading holds and why it does) instead of silently picking one. " + JSON.stringify(contradictionsFound)],
 				...opts?.claimConsistency?.onFound !== "carry" && opts?.claimConsistency?.onFound !== "repair" || claimFindingsFound === void 0 || claimFindingsFound.length === 0 ? [] : ["CLAIM CONTRADICTIONS: the composed draft contradicts the settled child pool at these cited locations; resolve each one EXPLICITLY in the final result (say which reading holds and why) instead of keeping the inverted claim. " + JSON.stringify(claimFindingsFound)],
 				...opts?.claimConsistency?.onFound !== "carry" && opts?.claimConsistency?.onFound !== "repair" || claimFindingsFound === void 0 || claimFindingsFound.length === 0 ? [] : hostValidationLessons(),
+				...carriedCitationFindings === void 0 || carriedCitationFindings.length === 0 ? [] : ["CITATION AUDIT FINDINGS: these sampled citations were judged NOT entailed by their cited lines; for each, either fix the citation to the lines that actually carry the claim or rewrite the sentence to claim what the cited lines say, and keep every other sentence byte identical. " + JSON.stringify(carriedCitationFindings)],
 				...sectionalRoundContext === void 0 ? [] : [
 					`RETAINED FINAL: ${JSON.stringify(sectionalRoundContext.base)}`,
 					"SECTIONAL ROUND: the accepted document above is RETAINED; repair ONLY the sections owning the contradicted claims by calling finish({ sections: { \"<marker>\": \"<new section body>\" } }). Unchanged sections are spliced from the retained document byte for byte and the spliced whole is validated and judged. Target sections: " + JSON.stringify(sectionalRoundContext.targets) + ". Declared markers: " + JSON.stringify(sectionalRoundContext.sections) + ". Resubmit the full document as result only when a targeted repair is impossible.",
@@ -26364,6 +27337,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const heldReserveUsd = orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.synthesisReserveUsd ?? 0;
 			const synthesisState = { ...callingState };
 			synthesisState.phase = synthesisState.phase ?? stagePhase;
+			if (repairTrigger !== void 0) synthesisState.repairTrigger = repairTrigger;
 			if (orchestratorAccount !== void 0) {
 				synthesisState.budgetScope = orchestratorAccount;
 				internals.budget.releaseSynthesisReserve(orchestratorAccount);
@@ -26390,6 +27364,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				}
 			};
 			validationInvocationStart = validationDecisions().length;
+			finishValidationStage = stagePhase === "repair" ? "round" : "composition";
 			const synthesized = await runtime.runInScope(synthesisState, () => ctx.agent(prompt, synthesisOpts));
 			noteInternalSettle(synthesized);
 			synthesisSchemaRejectedExchanges = synthesized.schemaRejectedTerminalExchanges ?? 0;
@@ -27147,7 +28122,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 					}, callingState.spanId);
 				}
 				try {
-					synthesizedFinal = await runSynthesis(result.output, "repair");
+					synthesizedFinal = await runSynthesis(result.output, "repair", "claim");
 				} catch (thrown) {
 					await journalSynthesisAdmissionDecline(thrown);
 					const hostRejection = thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) && thrown.data.source === "orchestrator_finish_validation" ? thrown.data : void 0;
@@ -27211,6 +28186,93 @@ function makeOrchestratorWorkflow(goal, opts) {
 				} });
 			}
 		}
+		if (opts?.citationAudit !== void 0) {
+			const hashOfDocument = (value) => createHash("sha256").update(jcsSerialize(value ?? null), "utf8").digest("hex");
+			await runCitationAudit(synthesizedFinal, "first");
+			const auditOnFound = opts.citationAudit.onFound ?? "report";
+			const unsupportedOf = () => (citationFindingsFound ?? []).filter((finding) => finding.verdict === "unsupported");
+			const firstUnsupported = unsupportedOf();
+			if (auditOnFound === "fail" && firstUnsupported.length > 0) throw new FailRunError(`the citation audit judged ${String(firstUnsupported.length)} sampled citation${firstUnsupported.length === 1 ? "" : "s"} UNSUPPORTED by the cited lines, and the armed fail posture cannot pass the document`, { data: {
+				source: "orchestrator_citation_audit",
+				citationFindings: citationFindingsFound,
+				citationAuditMeta,
+				...acceptanceSnapshot
+			} });
+			if (auditOnFound === "repair" && citationAuditMeta !== void 0) {
+				citationAuditMeta.passes = 1;
+				citationAuditMeta.citationRepairRounds = 0;
+			}
+			if (auditOnFound === "repair" && firstUnsupported.length > 0) {
+				const preRepairHash = hashOfDocument(synthesizedFinal);
+				const carried = firstUnsupported;
+				const auditConvergenceHoldUsd = opts.citationAudit.judge?.estCost ?? 0;
+				const auditHoldScope = orchestratorAccount ?? "run";
+				if (auditConvergenceHoldUsd > 0) internals.budget.commitConvergenceReserve(auditHoldScope, auditConvergenceHoldUsd);
+				const auditRepairHoldUsd = validationSpec === void 0 ? 0 : validationSpec.estRepairCostUsd ?? lastMechanicalRepairCostUsd(internals.replayer.snapshot(), (servedBy, usage) => internals.priceUsd(servedBy, usage)) ?? 0;
+				if (auditRepairHoldUsd > 0) {
+					internals.budget.commitRepairReserve(auditHoldScope, auditRepairHoldUsd);
+					releaseRepairLeg = () => {
+						releaseRepairLeg = void 0;
+						internals.budget.releaseRepairReserve(auditHoldScope);
+					};
+				}
+				const auditRoundPlan = validationSpec !== void 0 && typeof synthesizedFinal === "string" ? sectionalRoundPlan(synthesizedFinal, carried.map((finding) => finding.sentence)) : void 0;
+				if (auditRoundPlan !== void 0) {
+					sectionalRoundContext = {
+						base: synthesizedFinal,
+						...auditRoundPlan
+					};
+					internals.events.emit({
+						type: "log",
+						level: "debug",
+						msg: "orchestrator sectional round armed",
+						data: {
+							targets: auditRoundPlan.targets,
+							sections: auditRoundPlan.sections.length
+						}
+					}, callingState.spanId);
+				}
+				carriedCitationFindings = carried;
+				try {
+					synthesizedFinal = await runSynthesis(result.output, "repair", "citation");
+				} catch (thrown) {
+					await journalSynthesisAdmissionDecline(thrown);
+					const auditHostRejection = (thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) ? thrown.data.source : void 0) === "orchestrator_finish_validation" ? thrown.data : void 0;
+					throw new FailRunError(auditHostRejection !== void 0 ? `the citation audit repair round dispatched and its repaired candidate failed host validation (${thrown instanceof Error ? thrown.message.slice(0, 300) : String(thrown)}); ${String(carried.length)} unsupported citation${carried.length === 1 ? "" : "s"} stand unconsumed and a gate armed to repair must not pass silently` : `the citation audit repair round could not dispatch (${thrown instanceof Error ? thrown.message.slice(0, 300) : String(thrown)}); ${String(carried.length)} unsupported citation${carried.length === 1 ? "" : "s"} stand unconsumed and a gate armed to repair must not pass silently`, { data: {
+						source: "orchestrator_citation_audit",
+						citationFindings: carried,
+						citationAuditMeta,
+						repairsUsed: auditHostRejection !== void 0 ? 1 : 0,
+						roundDispatched: auditHostRejection !== void 0,
+						preRepairHash,
+						...acceptanceSnapshot
+					} });
+				} finally {
+					carriedCitationFindings = void 0;
+					sectionalRoundContext = void 0;
+					releaseRepairLeg = void 0;
+					if (auditRepairHoldUsd > 0) internals.budget.releaseRepairReserve(auditHoldScope);
+					if (auditConvergenceHoldUsd > 0) internals.budget.releaseConvergenceReserve(auditHoldScope);
+				}
+				await runCitationAudit(synthesizedFinal, "round");
+				if (citationAuditMeta !== void 0) {
+					citationAuditMeta.passes = 2;
+					citationAuditMeta.firstPassFindings = carried.length;
+					citationAuditMeta.citationRepairRounds = 1;
+				}
+				if (opts?.claimConsistency !== void 0 && claimStage !== "draft") await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+				const survivors = unsupportedOf();
+				if (survivors.length > 0) throw new FailRunError(`the citation audit still judged ${String(survivors.length)} sampled citation${survivors.length === 1 ? "" : "s"} UNSUPPORTED after the bounded repair round: the repaired document keeps citing lines that do not carry its claims`, { data: {
+					source: "orchestrator_citation_audit",
+					citationFindings: citationFindingsFound,
+					citationAuditMeta,
+					repairsUsed: 1,
+					preRepairHash,
+					repairedHash: hashOfDocument(synthesizedFinal),
+					...acceptanceSnapshot
+				} });
+			}
+		}
 		const envelopeSchemaRecovered = (result.schemaRecoveredTerminalExchanges ?? 0) + synthesisSchemaRecoveredExchanges;
 		const deliverable = deliverableVerdict(synthesizedFinal);
 		const draftToFinal = opts?.synthesis === void 0 ? void 0 : (() => {
@@ -27233,6 +28295,56 @@ function makeOrchestratorWorkflow(goal, opts) {
 			lastBeforeHash: lastAcceptedRepair.beforeHash,
 			lastAfterHash: lastAcceptedRepair.afterHash
 		};
+		const repairLedger = validationSpec !== void 0 || (opts?.claimConsistency?.onFound ?? "report") === "repair" || opts?.citationAudit?.onFound === "repair" ? repairLedgerFromJournal(internals.replayer.snapshot(), (servedBy, usage) => internals.priceUsd(servedBy, usage)) : void 0;
+		let claimCoverageWaiver;
+		if (opts?.claimConsistency?.coveragePolicy === "strict-final") {
+			const grade = claimConsistencyMeta?.coverage ?? "not-judged";
+			if (grade !== "full") {
+				const priorWaiveDecision = internals.replayer.snapshot().find((entry) => {
+					if (entry.kind !== "decision" || entry.scope !== callingState.scope) return false;
+					const value = entry.value;
+					return value?.decisionType === "claim_coverage_waived" && (value.judgedHash === void 0 || value.judgedHash === claimConsistencyMeta?.judgedHash);
+				});
+				if (priorWaiveDecision !== void 0) {
+					const frozen = priorWaiveDecision.value;
+					claimCoverageWaiver = {
+						principal: frozen.principal,
+						reason: frozen.reason,
+						...frozen.expiresAt === void 0 ? {} : { expiresAt: frozen.expiresAt },
+						coverage: frozen.coverage
+					};
+				} else {
+					const waiverSpec = opts.claimConsistency.waiver;
+					const expired = waiverSpec?.expiresAt !== void 0 && Date.parse(waiverSpec.expiresAt) < internals.now();
+					if (waiverSpec === void 0 || expired) throw new FailRunError(`claimConsistency.coveragePolicy 'strict-final': the final coverage grade is '${grade}', not 'full', and ` + (waiverSpec === void 0 ? "no waiver is declared" : `the declared waiver expired at ${String(waiverSpec.expiresAt)}`) + "; raise the coverage (pairs, targets, critical anchors) or record a waiver naming who accepts the gap and why", { data: {
+						source: "orchestrator_claim_consistency",
+						coveragePolicy: "strict-final",
+						coverage: grade,
+						...waiverSpec === void 0 ? {} : { waiverExpiredAt: waiverSpec.expiresAt ?? null },
+						...claimConsistencyMeta === void 0 ? {} : { claimConsistencyMeta }
+					} });
+					claimCoverageWaiver = {
+						principal: waiverSpec.principal,
+						reason: waiverSpec.reason,
+						...waiverSpec.expiresAt === void 0 ? {} : { expiresAt: waiverSpec.expiresAt },
+						coverage: grade
+					};
+					await internals.replayer.appendSinglePhase({
+						scope: callingState.scope,
+						key: deriverV2.deriveKey({ kind: "claim-coverage-waived" }),
+						kind: "decision",
+						status: "ok",
+						spanId: internals.spans.mint(callingState.spanId),
+						site: "orchestrator-claim-coverage",
+						value: {
+							decisionType: "claim_coverage_waived",
+							...claimCoverageWaiver,
+							...claimConsistencyMeta?.judgedHash === void 0 ? {} : { judgedHash: claimConsistencyMeta.judgedHash }
+						}
+					});
+				}
+			}
+		}
 		return {
 			result: synthesizedFinal,
 			completion: decision.completion,
@@ -27241,6 +28353,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 			...deliverable.acceptedArtifactRef === void 0 ? {} : { acceptedArtifactRef: deliverable.acceptedArtifactRef },
 			...envelopeRejectedCandidates.length === 0 ? {} : { rejectedFinishCandidates: envelopeRejectedCandidates },
 			...deterministicPatches === void 0 ? {} : { deterministicPatches },
+			...repairLedger === void 0 ? {} : { repairs: repairLedger },
+			...claimCoverageWaiver === void 0 ? {} : { claimCoverageWaiver },
+			...citationAuditMeta === void 0 ? {} : {
+				...citationFindingsFound === void 0 ? {} : { citationFindings: citationFindingsFound },
+				citationAuditMeta
+			},
 			childStatusCounts: decision.childStatusCounts,
 			degradedReasons: decision.degradedReasons,
 			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
@@ -27515,6 +28633,15 @@ function preflightEstimate(input) {
 			});
 		}
 		const spec = input.orchestrator.budget;
+		if (spec?.acceptanceReserve !== void 0 && spec.acceptanceReserve !== "warn" && spec.acceptanceReserve !== "require") throw new ConfigError("preflight.orchestrator.budget.acceptanceReserve must be 'warn' or 'require'; got " + JSON.stringify(spec.acceptanceReserve));
+		if (input.orchestrator.synthesis?.estCost !== void 0) requireNonNegativeNumber(input.orchestrator.synthesis.estCost, "preflight.orchestrator.synthesis.estCost");
+		if (input.finishValidation?.estRepairCostUsd !== void 0) requireNonNegativeNumber(input.finishValidation.estRepairCostUsd, "preflight.finishValidation.estRepairCostUsd");
+		if (input.orchestrator.citationAudit?.judge?.estCost !== void 0) requireNonNegativeNumber(input.orchestrator.citationAudit.judge.estCost, "preflight.orchestrator.citationAudit.judge.estCost");
+		if (input.orchestrator.citationAudit?.onFound !== void 0 && ![
+			"report",
+			"repair",
+			"fail"
+		].includes(input.orchestrator.citationAudit.onFound)) throw new ConfigError(`preflight.orchestrator.citationAudit.onFound must be 'report', 'repair' or 'fail'; got ${JSON.stringify(input.orchestrator.citationAudit.onFound)}`);
 		const fraction = spec?.capFraction ?? .2;
 		const fromFraction = ceilingUsd === void 0 ? void 0 : fraction * ceilingUsd;
 		const bounds = [spec?.capUsd, fromFraction].filter((bound) => bound !== void 0);
@@ -27542,6 +28669,36 @@ function preflightEstimate(input) {
 			code: "orchestrator-cap-below-finalize-reserve",
 			message: `effectiveCap ${effectiveCapUsd.toFixed(4)} USD is below the finalize reserve ${finalizeReserveUsd.toFixed(4)} USD: the run would refuse to start`
 		});
+		if (spec?.acceptanceReserve !== void 0) {
+			const { requiredUsd, terms } = acceptanceTailRequiredUsd({
+				...spec.synthesisReserveUsd === void 0 ? {} : { synthesisReserveUsd: spec.synthesisReserveUsd },
+				...input.orchestrator.claimConsistency?.stage === void 0 ? {} : { claimStage: input.orchestrator.claimConsistency.stage },
+				...input.orchestrator.claimConsistency?.onFound === void 0 ? {} : { claimOnFound: input.orchestrator.claimConsistency.onFound },
+				...input.orchestrator.claimConsistency?.judge?.estCost === void 0 ? {} : { claimJudgeEstCostUsd: input.orchestrator.claimConsistency.judge.estCost },
+				...input.finishValidation?.estRepairCostUsd === void 0 ? {} : { finishEstRepairCostUsd: input.finishValidation.estRepairCostUsd },
+				...input.orchestrator.synthesis?.estCost === void 0 ? {} : { synthesisEstCostUsd: input.orchestrator.synthesis.estCost },
+				...input.orchestrator.citationAudit?.judge?.estCost === void 0 ? {} : { citationJudgeEstCostUsd: input.orchestrator.citationAudit.judge.estCost },
+				...input.orchestrator.citationAudit?.onFound === void 0 ? {} : { citationOnFound: input.orchestrator.citationAudit.onFound },
+				...input.orchestrator.claimConsistency === void 0 ? {} : { claimConfigured: true },
+				workingRoomUsd: flatReserveUsd
+			});
+			const fits = effectiveCapUsd !== void 0 && effectiveCapUsd >= requiredUsd;
+			orchestratorEcho.acceptanceReserve = {
+				declared: spec.acceptanceReserve,
+				requiredUsd,
+				...effectiveCapUsd === void 0 ? {} : { effectiveCapUsd },
+				fits,
+				terms
+			};
+			if (!fits) {
+				const termsLine = formatAcceptanceTailTerms(terms);
+				say({
+					severity: spec.acceptanceReserve === "require" ? "error" : "warning",
+					code: "acceptance-reserve-unfit",
+					message: (effectiveCapUsd === void 0 ? `budget.acceptanceReserve '${spec.acceptanceReserve}': no effective cap resolves to hold the declared acceptance tail against (${termsLine})` : `budget.acceptanceReserve '${spec.acceptanceReserve}': the declared acceptance tail does not fit the effective cap ${effectiveCapUsd.toFixed(4)} USD (${termsLine})`) + (spec.acceptanceReserve === "require" ? "; the run would refuse to start before its first wire (RV3907): raise the cap or lower the declared tail" : "; the run would start with its acceptance machinery funded by luck: raise the cap, lower the declared tail, or declare 'require' to refuse instead")
+				});
+			}
+		}
 	}
 	const spawnSpecs = input.spawns ?? [];
 	spawnSpecs.forEach(validateSpawnSpec);
@@ -28085,8 +29242,8 @@ function preflightEstimate(input) {
 		message: `the ceiling headroom is ${(ceilingHeadroomShare * 100).toFixed(2)} percent of the ceiling (${(ceilingHeadroomUsd ?? 0).toFixed(4)} USD over the required minimum ${(requiredMinimumCeilingUsd ?? 0).toFixed(4)} USD), below the declared ${(minCeilingHeadroomShare * 100).toFixed(2)} percent floor: a small pricing or context drift refuses the whole wave at admission; raise the ceiling or slim the wave`
 	});
 	const claimPosture = input.orchestrator?.claimConsistency;
-	const repairArmed = claimPosture?.onFound === "repair";
-	const worstJudgePasses = ((claimPosture?.stage ?? "draft") === "both" ? 2 : 1) + (repairArmed ? 1 : 0);
+	const repairArmed = claimPosture?.onFound === "repair" && (claimPosture?.stage ?? "draft") !== "draft";
+	const worstJudgePasses = acceptanceJudgePasses(claimPosture?.stage, claimPosture?.onFound);
 	{
 		const judgeEstUsd = input.orchestrator?.claimConsistency?.judge?.estCost;
 		if (judgeEstUsd !== void 0 && effectiveCapUsd !== void 0 && synthesisHoldUsd > 0) {
@@ -28911,6 +30068,34 @@ function parseDeadlineAt(value) {
 	if (month < 1 || month > 12 || day < 1 || day > daysInMonth) refuse();
 	return parsed;
 }
+const SCOPE_FIELDS = [
+	"tenant",
+	"account",
+	"project"
+];
+/**
+* Validates and copies a declared scope (RV4007): own properties only
+* (the RV1205 doctrine: a prototype member must never resolve),
+* non-empty strings of at most 256 chars, at least one field, and the
+* copy is what gets recorded, so later host mutation of the passed
+* object cannot move the recorded identity.
+*/
+function normalizeExecutionScope(value, site) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new ConfigError(`${site} must be an object; got ${JSON.stringify(value)}`);
+	const copy = {};
+	for (const field of SCOPE_FIELDS) {
+		if (!Object.hasOwn(value, field)) continue;
+		const declared = value[field];
+		if (typeof declared !== "string" || declared.length === 0 || declared.length > 256) throw new ConfigError(`${site}.${field} must be a non-empty string of at most 256 characters; got ` + JSON.stringify(declared));
+		copy[field] = declared;
+	}
+	if (Object.keys(copy).length === 0) throw new ConfigError(`${site} must declare at least one of tenant, account, project; an empty scope records nothing and asserts nothing`);
+	return copy;
+}
+/** The canonical identity string of a scope (RV4007): JCS bytes, total and deterministic. */
+function executionScopeKey(scope) {
+	return jcsSerialize(scope);
+}
 /** Validates a declared config fingerprint (RV3210): a non-empty string of at most 512 chars. */
 function requireConfigFingerprint(value, site) {
 	if (typeof value !== "string" || value.length === 0 || value.length > 512) throw new ConfigError(`${site} must be a non-empty string of at most 512 characters; got ` + (typeof value === "string" ? `${String(value.length)} characters` : JSON.stringify(value)));
@@ -29190,7 +30375,11 @@ function createEngine(options) {
 		if (profile.countTokens !== void 0 && !["allow", "deny"].includes(profile.countTokens)) throw new ConfigError(`createEngine defaults.profiles['${name}'].countTokens must be 'allow' or 'deny'`);
 	}
 	if (options.defaults?.countTokens !== void 0 && !["allow", "deny"].includes(options.defaults.countTokens)) throw new ConfigError("createEngine defaults.countTokens must be 'allow' or 'deny'");
-	if (options.defaults?.billingReceipts !== void 0 && !["async", "awaited"].includes(options.defaults.billingReceipts)) throw new ConfigError("createEngine defaults.billingReceipts must be 'async' or 'awaited'");
+	if (options.defaults?.billingReceipts !== void 0 && ![
+		"async",
+		"awaited",
+		"intent"
+	].includes(options.defaults.billingReceipts)) throw new ConfigError("createEngine defaults.billingReceipts must be 'async', 'awaited' or 'intent'");
 	if (options.telemetry?.quotaDeniedAgentError !== void 0 && typeof options.telemetry.quotaDeniedAgentError !== "boolean") throw new ConfigError("createEngine telemetry.quotaDeniedAgentError must be a boolean");
 	validateDeterminismConfig(options.determinism);
 	validateEngineQuotaConfig(options.quota);
@@ -29228,6 +30417,7 @@ function createEngine(options) {
 		if (opts?.clampTurnToExposure !== void 0 && typeof opts.clampTurnToExposure !== "boolean") throw new ConfigError("RunOptions.clampTurnToExposure must be a boolean; got " + JSON.stringify(opts.clampTurnToExposure));
 		if (opts?.strictPricing !== void 0 && typeof opts.strictPricing !== "boolean" && (typeof opts.strictPricing !== "object" || opts.strictPricing === null || Array.isArray(opts.strictPricing))) throw new ConfigError("RunOptions.strictPricing must be a boolean or an options object; got " + JSON.stringify(opts.strictPricing));
 		if (opts?.budgetPolicy !== void 0 && opts.budgetPolicy !== "segment" && opts.budgetPolicy !== "immutable-lifetime") throw new ConfigError("RunOptions.budgetPolicy must be 'segment' or 'immutable-lifetime'; got " + JSON.stringify(opts.budgetPolicy));
+		const declaredScope = opts?.scope === void 0 ? void 0 : normalizeExecutionScope(opts.scope, "RunOptions.scope");
 		if (opts?.limits !== void 0) validateUsageLimits(opts.limits, "RunOptions.limits");
 		const deadlineAtMs = opts?.deadlineAt === void 0 ? void 0 : parseDeadlineAt(opts.deadlineAt);
 		const compiled = wf.kind === "compiled-workflow" ? wf : void 0;
@@ -29263,6 +30453,7 @@ function createEngine(options) {
 		};
 		const configFingerprint = opts?.configFingerprint ?? resumeCtx?.configFingerprint;
 		const budgetPolicy = opts?.budgetPolicy ?? resumeCtx?.budgetPolicy;
+		const executionScope = declaredScope ?? resumeCtx?.scope;
 		const makeBudget = () => new RunBudget({
 			...ceilingUsd === void 0 ? {} : { ceilingUsd },
 			...exposureCapUsd === void 0 ? {} : { maxInFlightExposureUsd: exposureCapUsd },
@@ -29447,6 +30638,7 @@ function createEngine(options) {
 			...strictPricing === void 0 ? {} : { strictPricing },
 			...budgetPolicy === "immutable-lifetime" ? { budgetPolicy } : {},
 			...configFingerprint === void 0 ? {} : { configFingerprint },
+			...executionScope === void 0 ? {} : { scope: executionScope },
 			...argsBinding.argsProvided === void 0 ? {} : { argsProvided: argsBinding.argsProvided },
 			...argsBinding.argsHash === void 0 ? {} : { argsHash: argsBinding.argsHash },
 			...genesis === void 0 ? {} : { genesis },
@@ -29538,6 +30730,34 @@ function createEngine(options) {
 					}
 				});
 			}
+			if (executionScope !== void 0 && resumeCtx === void 0) await replayer.appendSinglePhase({
+				scope: "",
+				key: deriverV2.deriveKey({ kind: "execution-scope" }),
+				kind: "decision",
+				status: "ok",
+				spanId: rootSpanId,
+				site: "execution-scope",
+				value: {
+					decisionType: "execution_scope",
+					scope: executionScope
+				}
+			});
+			if (resumeCtx?.acknowledgedOpenWireIntents !== void 0 && resumeCtx.acknowledgedOpenWireIntents > 0 && resumeCtx.strict !== true) await replayer.appendSinglePhase({
+				scope: "",
+				key: deriverV2.deriveKey({
+					kind: "open-wire-intents-acknowledged",
+					segment: segmentsBefore + 1
+				}),
+				kind: "decision",
+				status: "ok",
+				spanId: rootSpanId,
+				site: "resume-acknowledgment",
+				value: {
+					decisionType: "open_wire_intents_acknowledged",
+					segment: segmentsBefore + 1,
+					count: resumeCtx.acknowledgedOpenWireIntents
+				}
+			});
 			await putMeta("running");
 			bus.emit({
 				type: "run:start",
@@ -29795,6 +31015,7 @@ function createEngine(options) {
 			events: bus.iterate(),
 			on: (type, cb) => bus.on(type, cb),
 			resolveExternal: (key, value) => external.resolveExternal(key, value),
+			revokeApproval: (key, options) => external.revokeApproval(key, options),
 			cancel: async (reason) => {
 				requestCancel(reason ?? "cancelled by host");
 				await result.then(() => void 0, () => void 0);
@@ -29862,6 +31083,15 @@ function createEngine(options) {
 					type: "RulvarWarning"
 				});
 			}
+			{
+				const supplied = resumeOptions?.scope === void 0 ? void 0 : normalizeExecutionScope(resumeOptions.scope, "ResumeOptions.scope");
+				const recorded = typeof meta?.scope === "object" && meta.scope !== null ? meta.scope : void 0;
+				if (supplied !== void 0 && recorded !== void 0 && executionScopeKey(supplied) !== executionScopeKey(recorded)) throw new ConfigError(`resume: the supplied scope does not match the one run '${runId}' recorded at genesis; the execution scope is immutable for the life of the run, and the host declared exactly this check`);
+				if (supplied !== void 0 && recorded === void 0) process.emitWarning(`resume: a scope was supplied but run '${runId}' never recorded one; the assertion cannot be verified (absence means NOT RECORDED)`, {
+					code: "RULVAR_RESUME_SCOPE_UNRECORDED",
+					type: "RulvarWarning"
+				});
+			}
 			const priorEntries = (await journal.load(runId)).map((entry) => normalizeEntry(entry));
 			scanJournalCompatibility(runId, priorEntries, buildDeriverRegistry(options.extraDerivers));
 			if (priorEntries.some((entry) => entry.usageSemantics === void 0 && (entry.servedBy?.startsWith("openai:") === true && (entry.usage?.cacheWriteTokens ?? 0) > 0 || (entry.usageByModel?.some((slice) => slice.servedBy.startsWith("openai:") && slice.usage.cacheWriteTokens > 0) ?? false)))) process.emitWarning(`resume: run '${runId}' contains OpenAI cache-write usage recorded without a usage-semantics stamp. Entries written by rulvar v1.19.0 double-counted cache writes into inputTokens, so their recorded cost and budget debits are OVERSTATED; unstamped entries from v1.20.0 are correct. Resuming keeps the recorded debits. Audit procedure: https://docs.rulvar.com/guide/providers#openai-legacy-cache-journals`, {
@@ -29874,7 +31104,13 @@ function createEngine(options) {
 				...runOverride.maxInFlightExposureUsd === void 0 ? {} : { maxInFlightExposureUsd: runOverride.maxInFlightExposureUsd }
 			};
 			if (budgetOverride !== void 0 && meta?.budgetPolicy === "immutable-lifetime") throw new ConfigError(`run '${runId}' was started with budgetPolicy 'immutable-lifetime': the recorded ceilings are immutable for the whole life of the run and ResumeOptions.run is refused, raising and lowering alike; cancel the run (or start a new one) instead of editing its ceilings`);
+			const openIntents = openWireIntentsOf(priorEntries);
+			if (openIntents.length > 0 && resumeOptions?.acknowledgeOpenWireIntents !== true) {
+				const preview = openIntents.slice(0, 3).map((intent) => `agent ${String(intent.agentRef)} ordinal ${String(intent.ordinal)} attempt ${String(intent.attempt)} (${intent.servedBy})`).join("; ");
+				throw new ConfigError(`resume: run '${runId}' holds ${String(openIntents.length)} provider wire intent(s) with unknown outcome (${preview}${openIntents.length > 3 ? "; …" : ""}): an intent was journaled before dispatch and neither a receipt nor a terminal record covers it, so the provider may have billed a wire this process never heard back from, and a blind retry could pay twice. Reconcile the invoice's openIntents lane (cost-audit prints it) against the provider statement, then resume with ResumeOptions.acknowledgeOpenWireIntents: true; the acknowledgment is journaled`);
+			}
 			return run(bound, resumeOptions?.args, void 0, {
+				...openIntents.length > 0 && resumeOptions?.acknowledgeOpenWireIntents === true ? { acknowledgedOpenWireIntents: openIntents.length } : {},
 				runId,
 				priorEntries,
 				strict: resumeOptions?.dryRun ?? false,
@@ -29884,6 +31120,7 @@ function createEngine(options) {
 				...typeof meta?.budgetUsd === "number" ? { budgetUsd: meta.budgetUsd } : {},
 				...typeof meta?.maxInFlightExposureUsd === "number" ? { maxInFlightExposureUsd: meta.maxInFlightExposureUsd } : {},
 				...typeof meta?.strictPricing === "object" && meta.strictPricing !== null ? { strictPricing: meta.strictPricing } : {},
+				...typeof meta?.scope === "object" && meta.scope !== null ? { scope: meta.scope } : {},
 				...meta?.budgetPolicy === "immutable-lifetime" ? { budgetPolicy: meta.budgetPolicy } : {},
 				segmentsBefore: typeof meta?.segments === "number" && meta.segments > 0 ? Math.floor(meta.segments) : 1,
 				...typeof meta?.argsProvided === "boolean" ? { argsProvided: meta.argsProvided } : {},
@@ -29914,6 +31151,9 @@ function createEngine(options) {
 			resolveExternal: async (key, value) => {
 				return (await handlePromise).resolveExternal(key, value);
 			},
+			revokeApproval: async (key, options) => {
+				return (await handlePromise).revokeApproval(key, options);
+			},
 			cancel: async (reason) => {
 				await (await handlePromise).cancel(reason);
 			},
@@ -30072,6 +31312,231 @@ function createEngine(options) {
 	};
 }
 //#endregion
+//#region src/engine/regulated-profile.ts
+/**
+* The regulated run profile (RV4009, the fifth comparison experiment;
+* previously gated behind its own word and confirmed with plan 40).
+*
+* Every assurance posture this codebase grew across the comparison
+* arcs is an OPT-IN knob, which is correct for a library and lethal
+* for an unreviewed config: the 2026-08-12 run armed every gate to
+* observe, and the fifth run's harness gated on error findings alone.
+* `compileRegulatedProfile` is the one-call composition: it takes the
+* host's ordinary options, REFUSES any field that loosens the
+* regulated floor (typed, naming the field), fills what is absent,
+* and returns the compiled options plus a profile hash over the
+* enforced posture. The hash rides RunOptions.configFingerprint, so
+* the existing genesis recording and resume assertion machinery
+* (RV3210) pin it with zero new meta surface.
+*
+* DATA, not engine semantics (the M5-T07 doctrine): the engine gains
+* no strategy enum and no behavioral branch; a host that wants the
+* posture applies the compiled options like any others. The floor
+* binds what flows through CreateEngineOptions / RunOptions /
+* OrchestrateOptions, and since RV4101 it also walks the
+* CONSTRUCTIONS those options reach (adapters, tool sources in named
+* toolsets and profiles). A construction exposing
+* `describeRegulatedPosture()` has its posture judged by field name
+* (an MCP source's drift must be 'refuse' with every discovery bound
+* declared; the AI SDK bridge must keep providerExecutedTools
+* 'deny'), the sorted descriptors enter the hashed map under
+* `construction`, and constructions exposing nothing are COUNTED
+* there as `unrecognized`, so the hash names its own blind spot
+* instead of implying totality (the RV4009 rule "a hash must not
+* imply what it cannot verify", now with the verifiable part
+* verified). The between-compile-and-use window is held as well
+* (RV4102): the compiled options carry re-asserting wrappers whose
+* risk seams re-judge the descriptor on every use, and the
+* cross-process half was always held by the RV3210 fingerprint
+* assertion.
+*/
+const REGULATED_VERSION = 2;
+function refuse(field, requirement) {
+	throw new ConfigError(`compileRegulatedProfile: ${field} ${requirement}; the regulated floor is non-loosenable, so drop the field to inherit the floor or meet it explicitly`);
+}
+/**
+* Judges one construction's descriptor against the floor (RV4101) and
+* returns the normalized shape that enters the hashed posture map.
+* Shared by the compile walk and the use-time re-assertion (RV4102),
+* so a posture that loosens AFTER compile refuses with the same
+* field-named error it would have refused with at compile time.
+*/
+function judgeDescriptor(raw) {
+	const descriptor = raw;
+	if (descriptor === null || typeof descriptor !== "object" || descriptor.regulatedPosture !== 1 || typeof descriptor.name !== "string" || descriptor.name === "") refuse("construction", "exposes describeRegulatedPosture() with an unrecognized shape (need regulatedPosture: 1, a non-empty string name, and a known kind)");
+	if (descriptor.kind === "mcp-source") {
+		const mcpPosture = descriptor;
+		if (mcpPosture.drift !== "refuse") refuse(`construction['${descriptor.name}'].drift`, "must be 'refuse' (RV1516): under a rekey posture a listChanged notification imports a changed tool list beneath the regulated run");
+		const bounds = mcpPosture.bounds;
+		if (bounds === void 0 || bounds.declared !== true) refuse(`construction['${descriptor.name}'].bounds`, "must declare every discovery bound (maxTools, maxPages, maxSchemaBytes, timeouts.discoveryMs; RV1808): an unbounded sweep against a remote registry is an availability decision someone should have made on purpose");
+		return {
+			regulatedPosture: 1,
+			kind: "mcp-source",
+			name: descriptor.name,
+			drift: "refuse",
+			bounds: {
+				declared: true,
+				...typeof bounds.maxTools === "number" ? { maxTools: bounds.maxTools } : {},
+				...typeof bounds.maxPages === "number" ? { maxPages: bounds.maxPages } : {},
+				...typeof bounds.maxSchemaBytes === "number" ? { maxSchemaBytes: bounds.maxSchemaBytes } : {},
+				...typeof bounds.discoveryMs === "number" ? { discoveryMs: bounds.discoveryMs } : {}
+			}
+		};
+	}
+	if (descriptor.kind === "ai-sdk-bridge") {
+		if (descriptor.providerExecutedTools !== "deny") refuse(`construction['${descriptor.name}'].providerExecutedTools`, "must be 'deny': a provider-executed tool runs outside the permission chain and the journal");
+		return {
+			regulatedPosture: 1,
+			kind: "ai-sdk-bridge",
+			name: descriptor.name,
+			providerExecutedTools: "deny"
+		};
+	}
+	refuse(`construction['${descriptor.name}']`, `attests an unrecognized kind '${String(descriptor.kind)}'; this floor can judge 'mcp-source' and 'ai-sdk-bridge'`);
+}
+/**
+* The use-time re-assertion (RV4102, the RV1608 template). The
+* descriptor is a snapshot, and the window between compile and use is
+* where a construction mutated in-process could walk a moved posture
+* beneath the hash. The compiled options therefore carry this proxy
+* in the original's place: every use of the risk seam (`tools` on a
+* source, `stream` on an adapter) re-reads and re-judges the
+* descriptor first. A loosening refuses with the compile-time
+* field-named error; any other movement (a rename, a bound change, a
+* vanished descriptor) refuses naming the drift. Everything else
+* passes through untouched, so `close()`, `caps()`, and identity
+* fields behave exactly as before. The cross-process half of the
+* window needs no proxy: a mutated construction compiles to a
+* different profile hash, and the RV3210 resume assertion refuses it.
+*/
+function wrapReasserting(construction, frozen) {
+	const guard = (seam, original) => (...args) => {
+		const probe = construction.describeRegulatedPosture;
+		const fresh = typeof probe === "function" ? jcsSerialize(judgeDescriptor(probe.call(construction))) : void 0;
+		if (fresh !== frozen) throw new ConfigError(`compileRegulatedProfile: the construction posture moved between compile time and ${seam}() (RV4102): the compiled profile licensed ${frozen}, the construction now reports ${fresh ?? "no describeRegulatedPosture() at all"}. Recompile the profile deliberately instead of mutating a construction beneath it.`);
+		return original.apply(construction, args);
+	};
+	return new Proxy(construction, { get(target, prop) {
+		const value = Reflect.get(target, prop, target);
+		if ((prop === "tools" || prop === "stream") && typeof value === "function") return guard(String(prop), value);
+		return value;
+	} });
+}
+function compileRegulatedProfile(input) {
+	const engine = {
+		...input.engine,
+		defaults: { ...input.engine.defaults }
+	};
+	const run = { ...input.run };
+	const orchestrate = input.orchestrate === void 0 ? void 0 : { ...input.orchestrate };
+	const defaults = engine.defaults ?? {};
+	const permissions = { ...defaults.permissions ?? {} };
+	if (permissions.strictApprovals === false) refuse("defaults.permissions.strictApprovals", "must not be false (RV1507 monotonic mode)");
+	permissions.strictApprovals = true;
+	defaults.permissions = permissions;
+	if (defaults.billingReceipts !== void 0 && defaults.billingReceipts !== "intent") refuse("defaults.billingReceipts", "must be 'intent' (RV4006 pre-wire intents)");
+	defaults.billingReceipts = "intent";
+	engine.defaults = defaults;
+	const determinism = { ...engine.determinism ?? {} };
+	if (determinism.mode !== void 0 && determinism.mode !== "error") refuse("determinism.mode", "must be 'error'");
+	determinism.mode = "error";
+	engine.determinism = determinism;
+	for (const [name, profile] of Object.entries(defaults.profiles ?? {})) {
+		if (profile.permissions?.strictApprovals === false) refuse(`defaults.profiles.${name}.permissions.strictApprovals`, "must not be false");
+		if (profile.tools !== void 0 && profile.toolsetAttestation === void 0) refuse(`defaults.profiles.${name}`, "declares tools without a toolsetAttestation (pin the resolved hashes)");
+	}
+	const walked = /* @__PURE__ */ new Set();
+	const attested = [];
+	const reasserted = /* @__PURE__ */ new Map();
+	let unrecognized = 0;
+	const visit = (construction) => {
+		if (construction === null || typeof construction !== "object" || walked.has(construction)) return;
+		walked.add(construction);
+		const probe = construction.describeRegulatedPosture;
+		if (typeof probe !== "function") {
+			unrecognized += 1;
+			return;
+		}
+		const judged = judgeDescriptor(probe.call(construction));
+		attested.push(judged);
+		reasserted.set(construction, wrapReasserting(construction, jcsSerialize(judged)));
+	};
+	for (const adapter of engine.adapters ?? []) visit(adapter);
+	const visitTools = (tools) => {
+		for (const entry of tools ?? []) {
+			if (typeof entry === "string" || entry.kind === "tool") continue;
+			visit(entry);
+		}
+	};
+	for (const toolset of Object.values(defaults.toolsets ?? {})) visitTools(toolset);
+	for (const profile of Object.values(defaults.profiles ?? {})) visitTools(profile.tools);
+	const swap = (value) => typeof value === "object" && value !== null && reasserted.has(value) ? reasserted.get(value) : value;
+	if (reasserted.size > 0) {
+		if (engine.adapters !== void 0) engine.adapters = engine.adapters.map(swap);
+		if (defaults.toolsets !== void 0) defaults.toolsets = Object.fromEntries(Object.entries(defaults.toolsets).map(([name, tools]) => [name, tools.map(swap)]));
+		if (defaults.profiles !== void 0) defaults.profiles = Object.fromEntries(Object.entries(defaults.profiles).map(([name, profile]) => [name, profile.tools === void 0 ? profile : {
+			...profile,
+			tools: profile.tools.map(swap)
+		}]));
+	}
+	const postureKeyOf = (entry) => `${entry.kind} ${entry.name}`;
+	attested.sort((a, b) => postureKeyOf(a) < postureKeyOf(b) ? -1 : postureKeyOf(a) > postureKeyOf(b) ? 1 : 0);
+	if (typeof run.budgetUsd !== "number" || !Number.isFinite(run.budgetUsd) || run.budgetUsd <= 0) refuse("run.budgetUsd", "must declare a positive finite USD ceiling (RV4107): NaN and Infinity are not ceilings, and a non-positive one is a run that cannot pay for its own floor");
+	if (run.strictPricing === false) refuse("run.strictPricing", "must not be false");
+	run.strictPricing = run.strictPricing ?? true;
+	if (run.budgetPolicy !== void 0 && run.budgetPolicy !== "immutable-lifetime") refuse("run.budgetPolicy", "must be 'immutable-lifetime' (RV3902)");
+	run.budgetPolicy = "immutable-lifetime";
+	if (run.scope === void 0) refuse("run.scope", "must name the execution scope (RV4007): a regulated run has an owner");
+	run.scope = normalizeExecutionScope(run.scope, "compileRegulatedProfile run.scope");
+	if (orchestrate !== void 0) {
+		const budget = { ...orchestrate.budget ?? {} };
+		if (budget.acceptanceReserve !== void 0 && budget.acceptanceReserve !== "require") refuse("orchestrate.budget.acceptanceReserve", "must be 'require' (RV3907/RV4001)");
+		budget.acceptanceReserve = "require";
+		orchestrate.budget = budget;
+		if (orchestrate.citationAudit === void 0) refuse("orchestrate.citationAudit", "must be declared with the host snapshot resolver (RV4004): entailment is the regulated posture, not an option");
+		if (typeof orchestrate.citationAudit.resolve !== "function") refuse("orchestrate.citationAudit.resolve", "must be the host snapshot resolver function (RV4004/RV4107)");
+		if (orchestrate.claimConsistency === void 0) refuse("orchestrate.claimConsistency", "must be declared with stage 'final' or 'both' (RV4103): the claim machinery is the regulated posture, and omitting it entirely is the deepest loosening");
+		if (orchestrate.claimConsistency !== void 0) {
+			const claim = { ...orchestrate.claimConsistency };
+			if (claim.coveragePolicy !== void 0 && claim.coveragePolicy !== "strict-final") refuse("orchestrate.claimConsistency.coveragePolicy", "must be 'strict-final' (RV4003)");
+			if ((claim.stage ?? "draft") === "draft") refuse("orchestrate.claimConsistency.stage", "must be 'final' or 'both': the shipped document is what the pass must grade");
+			claim.coveragePolicy = "strict-final";
+			orchestrate.claimConsistency = claim;
+		}
+	}
+	const posture = {
+		regulated: REGULATED_VERSION,
+		strictApprovals: true,
+		billingReceipts: "intent",
+		determinism: "error",
+		construction: {
+			attested,
+			unrecognized
+		},
+		strictPricing: run.strictPricing === true ? true : run.strictPricing,
+		budgetPolicy: "immutable-lifetime",
+		budgetUsd: run.budgetUsd,
+		scope: run.scope,
+		...orchestrate === void 0 ? {} : {
+			acceptanceReserve: "require",
+			citationAudit: true,
+			...orchestrate.claimConsistency === void 0 ? {} : {
+				coveragePolicy: "strict-final",
+				claimStage: orchestrate.claimConsistency.stage
+			}
+		},
+		...run.configFingerprint === void 0 ? {} : { hostFingerprint: run.configFingerprint }
+	};
+	const profileHash = createHash("sha256").update(jcsSerialize(posture), "utf8").digest("hex");
+	run.configFingerprint = `regulated:${String(REGULATED_VERSION)}:${profileHash}`;
+	return {
+		engine,
+		run,
+		...orchestrate === void 0 ? {} : { orchestrate },
+		profileHash
+	};
+}
+//#endregion
 //#region src/runner/sandbox-bridge.ts
 /**
 * The host half of the worker sandbox contract (M6-T02).
@@ -30361,4 +31826,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseModelRef, parseScopePath, parseTerminalEnvelope, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CITATION_JUDGE_SCHEMA, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_EXCERPT_WINDOW, DEFAULT_CITATION_MAX_SAMPLED, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CITATION_SAMPLE_PER_SECTION, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CITATION_EXCERPT_CHARS, MAX_CITATION_EXCERPT_LINES, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, acceptanceJudgePasses, acceptanceTailRequiredUsd, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationExcerptOf, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileRegulatedProfile, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, executionScopeKey, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatAcceptanceTailTerms, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeExecutionScope, normalizeFallbacks, openWireIntentsOf, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseCitationVerdicts, parseModelRef, parseScopePath, parseTerminalEnvelope, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, repairLedgerFromJournal, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveCitationAuditPlan, resolveModelInvocation, resolvePricing, resolveToolset, retentionKeyOf, retryClassOf, retryDelayMs, retryWireMultiplier, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sampleCitationRows, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wireCapacityEstimate, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };