@rulvar/core 1.245.0 → 1.247.0

package/dist/index.js

@@ -1445,6 +1445,7 @@ function parseTerminalEnvelope(value) {
 	if (value.resultAvailable !== void 0) requireBoolean(value.resultAvailable, "resultAvailable");
 	if (value.acceptedArtifactRef !== void 0) requireCount$1(value.acceptedArtifactRef, "acceptedArtifactRef");
 	if (value.claimConsistencyMeta !== void 0 && !isPlainObject(value.claimConsistencyMeta)) refuseEnvelope("claimConsistencyMeta", "an object when present", value.claimConsistencyMeta);
+	if (value.semanticTerminalVerdict !== void 0 && !isPlainObject(value.semanticTerminalVerdict)) refuseEnvelope("semanticTerminalVerdict", "an object when present", value.semanticTerminalVerdict);
 	if (value.configFingerprint !== void 0) requireNonEmptyString(value.configFingerprint, "configFingerprint");
 	if (value.provenance !== void 0 && value.provenance !== "journal") refuseEnvelope("provenance", "the literal 'journal' when present", value.provenance);
 	return value;
@@ -1514,6 +1515,7 @@ function terminalEnvelopeOf(input) {
 	if (outcome.resultAvailable !== void 0) envelope.resultAvailable = outcome.resultAvailable;
 	if (outcome.acceptedArtifactRef !== void 0) envelope.acceptedArtifactRef = outcome.acceptedArtifactRef;
 	if (outcome.claimConsistencyMeta !== void 0) envelope.claimConsistencyMeta = detachedMeta(outcome.claimConsistencyMeta);
+	if (outcome.semanticTerminalVerdict !== void 0) envelope.semanticTerminalVerdict = detachedMeta(outcome.semanticTerminalVerdict);
 	if (input.configFingerprint !== void 0) envelope.configFingerprint = input.configFingerprint;
 	if (outcome.cost.wireRequests !== void 0) envelope.wireRequests = outcome.cost.wireRequests;
 	if (input.settlement?.settledReason !== void 0) envelope.settledReason = input.settlement.settledReason;
@@ -4483,6 +4485,19 @@ function mcp(cfg) {
 	};
 	return {
 		id: sourceIdOf(cfg),
+		describeRegulatedPosture: () => ({
+			regulatedPosture: 1,
+			kind: "mcp-source",
+			name: sourceIdOf(cfg),
+			drift: cfg.drift ?? "rekey",
+			bounds: {
+				declared: cfg.maxTools !== void 0 && cfg.maxPages !== void 0 && cfg.maxSchemaBytes !== void 0 && cfg.timeouts?.discoveryMs !== void 0,
+				...cfg.maxTools === void 0 ? {} : { maxTools: cfg.maxTools },
+				...cfg.maxPages === void 0 ? {} : { maxPages: cfg.maxPages },
+				...cfg.maxSchemaBytes === void 0 ? {} : { maxSchemaBytes: cfg.maxSchemaBytes },
+				...cfg.timeouts?.discoveryMs === void 0 ? {} : { discoveryMs: cfg.timeouts.discoveryMs }
+			}
+		}),
 		tools: async () => {
 			if (poisoned) throw new ConfigError(`mcp: the tool list of '${sourceIdOf(cfg)}' changed after import (listChanged) and drift policy 'refuse' holds the source closed; close() and re-create the source (and re-record any toolset attestation) to import the changed list deliberately`);
 			if (cache !== void 0) return cache;
@@ -9142,6 +9157,7 @@ const TERMINAL_TELEMETRY_SCOPE = Object.freeze({
 	childrenAtFailure: "cumulative",
 	semanticPasses: "terminal",
 	claimConsistencyMeta: "terminal",
+	semanticTerminalVerdict: "terminal",
 	claimContradictions: "terminal",
 	synthesisSkipped: "terminal",
 	deliverableAccepted: "terminal",
@@ -9581,6 +9597,57 @@ function claimJudgeStageOf(label) {
 	return label?.startsWith(`claim-consistency-judge-`) ?? false ? "final" : void 0;
 }
 /**
+* The label the citation entailment audit judge dispatches under
+* (RV4004; named here since RV4206 so the reducers and the
+* orchestrator share one constant, the CLAIM_JUDGE_LABEL precedent):
+* the audit judge rides role 'synthesize' exactly like the claim
+* judge, and until RV4206 no reducer knew its name, so its wall
+* folded into final composition on both surfaces.
+*/
+const CITATION_JUDGE_LABEL = "citation-entailment-judge";
+/**
+* Which audit pass a citation judge label names (RV4206): the exact
+* {@link CITATION_JUDGE_LABEL} is the first pass over the shipped
+* document, and every suffixed variant is a post round re-audit
+* (today `citation-entailment-judge-round`, the RV4004 round and the
+* RV4202 merged round both dispatch it). `undefined` for every other
+* label; one classifier for both reducers, the RV3302 doctrine.
+*/
+function citationJudgePassOf(label) {
+	if (label === "citation-entailment-judge") return "first";
+	return label?.startsWith(`citation-entailment-judge-`) ?? false ? "round" : void 0;
+}
+/**
+* The ONE synthesize-span classifier both reducers fold through
+* (RV4206, the RV3302 doctrine extended from a judge predicate to the
+* whole vocabulary): the sixth comparison experiment's citation judge
+* (label {@link CITATION_JUDGE_LABEL}, role 'synthesize') was
+* recognized by neither reducer and fell into `finalCompositionMs` on
+* both, so the run's 368889 ms "composition" was half verdict, its
+* `compositionSpans: 2` faked a repair round's signature on a clean
+* run, and `lastCandidateMs` overshot the candidate by 154 seconds.
+*
+* - 'claim-judge': {@link claimJudgeStageOf} recognizes the label.
+* - 'citation-judge': {@link citationJudgePassOf} recognizes it.
+* - 'composition': the engine's own composition labels
+*   ({@link FINAL_COMPOSITION_LABEL}, {@link SYNTHESIS_NOTE_LABEL},
+*   suffixed variants included) and every UNLABELLED span: streams
+*   recorded before RV2901 carry no labels, and composition was the
+*   only unlabelled engine dispatch, so absence keeps its historical
+*   reading.
+* - 'unclassified': any OTHER label. A present label this classifier
+*   does not know is a NEW vocabulary member, and folding it silently
+*   into composition is exactly the failure this function exists to
+*   end; the reducers bucket it under `unclassifiedSynthesisMs` with
+*   its own nonzero span counter.
+*/
+function synthesizeSpanClassOf(label) {
+	if (claimJudgeStageOf(label) !== void 0) return "claim-judge";
+	if (citationJudgePassOf(label) !== void 0) return "citation-judge";
+	if (label === void 0 || label === "final-composition" || label.startsWith(`final-composition-`) || label === "synthesis-note" || label.startsWith(`synthesis-note-`)) return "composition";
+	return "unclassified";
+}
+/**
 * Total length of the union of possibly overlapping intervals, exported
 * (RV3404) so the journal fold computes its window coverage through the
 * SAME arithmetic the live RV710 decomposition uses, never a sibling
@@ -9632,6 +9699,10 @@ function reduceCriticalPath(events) {
 	let semanticJudgeMs = 0;
 	let draftJudgeMs = 0;
 	let finalJudgeMs = 0;
+	let citationJudgeMs = 0;
+	let citationJudgeSpans = 0;
+	let unclassifiedSynthesisMs = 0;
+	let unclassifiedSynthesisSpans = 0;
 	let compositionSpans = 0;
 	let judgeSpans = 0;
 	let hostRejectedSpans = 0;
@@ -9678,14 +9749,20 @@ function reduceCriticalPath(events) {
 				if (event.hostRejected === true) hostRejectedSpans += 1;
 				if (started.role === "synthesize") {
 					const wall = Math.max(0, at - started.at);
-					const stage = claimJudgeStageOf(started.label);
-					const judge = stage !== void 0;
+					const cls = synthesizeSpanClassOf(started.label);
 					synthesisMs += wall;
-					if (judge) {
+					if (cls === "claim-judge") {
+						const stage = claimJudgeStageOf(started.label);
 						semanticJudgeMs += wall;
 						judgeSpans += 1;
 						if (stage === "draft") draftJudgeMs += wall;
 						else finalJudgeMs += wall;
+					} else if (cls === "citation-judge") {
+						citationJudgeMs += wall;
+						citationJudgeSpans += 1;
+					} else if (cls === "unclassified") {
+						unclassifiedSynthesisMs += wall;
+						unclassifiedSynthesisSpans += 1;
 					} else {
 						finalCompositionMs += wall;
 						compositionSpans += 1;
@@ -9695,7 +9772,7 @@ function reduceCriticalPath(events) {
 					synthesisSpans.push({
 						from: started.at,
 						to: at,
-						judge
+						cls
 					});
 				} else if (started.role !== "orchestrate") {
 					workerSpans += 1;
@@ -9712,6 +9789,10 @@ function reduceCriticalPath(events) {
 		semanticJudgeMs,
 		draftJudgeMs,
 		finalJudgeMs,
+		citationJudgeMs,
+		citationJudgeSpans,
+		unclassifiedSynthesisMs,
+		unclassifiedSynthesisSpans,
 		compositionSpans,
 		judgeSpans,
 		workerSpans,
@@ -9741,13 +9822,18 @@ function reduceCriticalPath(events) {
 		}
 		const synthesisClipped = [];
 		let judgeClippedMs = 0;
+		let citationJudgeClippedMs = 0;
+		let unclassifiedClippedMs = 0;
 		let compositionClippedMs = 0;
 		for (const span of synthesisSpans) {
 			const clipped = clip(span);
 			if (clipped === void 0) continue;
 			synthesisClipped.push(clipped);
-			if (span.judge) judgeClippedMs += clipped.to - clipped.from;
-			else compositionClippedMs += clipped.to - clipped.from;
+			const clippedMs = clipped.to - clipped.from;
+			if (span.cls === "claim-judge") judgeClippedMs += clippedMs;
+			else if (span.cls === "citation-judge") citationJudgeClippedMs += clippedMs;
+			else if (span.cls === "unclassified") unclassifiedClippedMs += clippedMs;
+			else compositionClippedMs += clippedMs;
 		}
 		const byName = {};
 		const callsByName = {};
@@ -9776,6 +9862,8 @@ function reduceCriticalPath(events) {
 			synthesisMs: lengthOf(synthesisClipped),
 			finalCompositionMs: compositionClippedMs,
 			semanticJudgeMs: judgeClippedMs,
+			citationJudgeMs: citationJudgeClippedMs,
+			unclassifiedSynthesisMs: unclassifiedClippedMs,
 			coveredMs,
 			residueMs: Math.max(0, path.postFanInMs - coveredMs)
 		};
@@ -9813,6 +9901,10 @@ function criticalPathFromJournal(entries) {
 	let semanticJudgeMs = 0;
 	let draftJudgeMs = 0;
 	let finalJudgeMs = 0;
+	let citationJudgeMs = 0;
+	let citationJudgeSpans = 0;
+	let unclassifiedSynthesisMs = 0;
+	let unclassifiedSynthesisSpans = 0;
 	let compositionSpans = 0;
 	let judgeSpans = 0;
 	let firstCompositionEnd;
@@ -9852,12 +9944,19 @@ function criticalPathFromJournal(entries) {
 			continue;
 		}
 		labelledSynthesis = true;
-		const stage = claimJudgeStageOf(label);
-		if (stage !== void 0) {
+		const cls = synthesizeSpanClassOf(label);
+		if (cls === "claim-judge") {
+			const stage = claimJudgeStageOf(label);
 			semanticJudgeMs += wall;
 			judgeSpans += 1;
 			if (stage === "draft") draftJudgeMs += wall;
 			else finalJudgeMs += wall;
+		} else if (cls === "citation-judge") {
+			citationJudgeMs += wall;
+			citationJudgeSpans += 1;
+		} else if (cls === "unclassified") {
+			unclassifiedSynthesisMs += wall;
+			unclassifiedSynthesisSpans += 1;
 		} else {
 			finalCompositionMs += wall;
 			compositionSpans += 1;
@@ -9867,7 +9966,7 @@ function criticalPathFromJournal(entries) {
 		synthSpans.push({
 			from: startedAt,
 			to: endedAt,
-			judge: stage !== void 0
+			cls
 		});
 	}
 	const segments = logicalRunTelemetry(ordered).segments;
@@ -9884,6 +9983,10 @@ function criticalPathFromJournal(entries) {
 		path.semanticJudgeMs = semanticJudgeMs;
 		path.draftJudgeMs = draftJudgeMs;
 		path.finalJudgeMs = finalJudgeMs;
+		path.citationJudgeMs = citationJudgeMs;
+		path.citationJudgeSpans = citationJudgeSpans;
+		path.unclassifiedSynthesisMs = unclassifiedSynthesisMs;
+		path.unclassifiedSynthesisSpans = unclassifiedSynthesisSpans;
 		path.compositionSpans = compositionSpans;
 		path.judgeSpans = judgeSpans;
 	}
@@ -9901,7 +10004,7 @@ function criticalPathFromJournal(entries) {
 			clipped.push({
 				from: Math.max(span.from, windowFrom),
 				to: Math.min(span.to, windowTo),
-				...span.judge === void 0 ? {} : { judge: span.judge }
+				...span.cls === void 0 ? {} : { cls: span.cls }
 			});
 		}
 		const synthesisCoveredMs = unionOfIntervalsMs(clipped);
@@ -9911,14 +10014,20 @@ function criticalPathFromJournal(entries) {
 		};
 		if (splitLegible) {
 			let judgeClippedMs = 0;
+			let citationJudgeClippedMs = 0;
+			let unclassifiedClippedMs = 0;
 			let compositionClippedMs = 0;
 			for (const span of clipped) {
 				const wall = span.to - span.from;
-				if (span.judge === true) judgeClippedMs += wall;
+				if (span.cls === "claim-judge") judgeClippedMs += wall;
+				else if (span.cls === "citation-judge") citationJudgeClippedMs += wall;
+				else if (span.cls === "unclassified") unclassifiedClippedMs += wall;
 				else compositionClippedMs += wall;
 			}
 			block.finalCompositionMs = compositionClippedMs;
 			block.semanticJudgeMs = judgeClippedMs;
+			block.citationJudgeMs = citationJudgeClippedMs;
+			block.unclassifiedSynthesisMs = unclassifiedClippedMs;
 		}
 		if (path.postFanInMs > 0) block.unaccountedShare = block.unaccountedMs / path.postFanInMs;
 		path.postFanIn = block;
@@ -9961,7 +10070,18 @@ function repairLedgerFromJournal(entries, priceUsd) {
 	const wireRows = [];
 	for (const entry of ordered) {
 		if (entry.kind === "agent" && entry.status !== "running" && entry.status !== "suspended") {
-			if (entry.costAttribution?.label === "final-composition" && entry.costAttribution.phase === "repair") semantic += 1;
+			if (entry.costAttribution?.label === "final-composition" && entry.costAttribution.phase === "repair") {
+				semantic += 1;
+				const trigger = entry.costAttribution.repairTrigger;
+				const semanticRow = {
+					stage: "semantic",
+					seq: entry.seq,
+					failedValidators: [],
+					...trigger === "claim" || trigger === "citation" || trigger === "coverage" || trigger === "combined" ? { trigger } : {}
+				};
+				rounds.push(semanticRow);
+				rowScopes.set(semanticRow, entry.scope);
+			}
 			continue;
 		}
 		if (entry.kind !== "decision") continue;
@@ -10031,16 +10151,16 @@ function repairLedgerFromJournal(entries, priceUsd) {
 		break;
 	}
 	for (const wire of wireRows) {
-		let target;
+		let nearest;
 		for (const row of rounds) {
-			if (row.seq >= wire.seq || row.wireRef !== void 0 || rowScopes.get(row) !== wire.scope) continue;
-			target = row;
+			if (row.seq >= wire.seq || rowScopes.get(row) !== wire.scope) continue;
+			nearest = row;
 		}
-		if (target === void 0) continue;
-		target.wireRef = wire.seq;
+		if (nearest === void 0 || nearest.wireRef !== void 0) continue;
+		nearest.wireRef = wire.seq;
 		if (priceUsd !== void 0 && wire.record.servedBy !== void 0) {
 			const usd = priceUsd(wire.record.servedBy, wire.record.usage);
-			if (usd !== void 0 && Number.isFinite(usd) && usd >= 0) target.costUsd = usd;
+			if (usd !== void 0 && Number.isFinite(usd) && usd >= 0) nearest.costUsd = usd;
 		}
 	}
 	rounds.sort((a, b) => a.seq - b.seq);
@@ -10055,6 +10175,43 @@ function repairLedgerFromJournal(entries, priceUsd) {
 }
 //#endregion
 //#region src/stores/synthesis-candidates.ts
+/**
+* THE candidate hash recipe (RV4207), written down where the fold that
+* reads it lives: sha256 (hex) over the JCS canonical serialization of
+* the candidate VALUE, `null` for an absent one. This is the recipe
+* behind every `candidateHash` a finish-validation decision journals,
+* the claim judge's `judgedHash`, the citation audit's `auditedHash`,
+* and `draftToFinal`'s pair, so one function answers "which document"
+* across every surface. Two facts an auditor needs spelled out: a
+* STRING document hashes as its JSON encoding (the quotes and escapes
+* included), not as raw text bytes; and exporting the text to a file
+* with a trailing newline changes the FILE's sha256 while this hash is
+* unchanged, verify against the exact value, never the file. The sixth
+* comparison experiment's auditor re-derived all of this from source
+* because no exported function said it.
+*/
+function candidateHashOf(candidate) {
+	return createHash("sha256").update(jcsSerialize(candidate ?? null), "utf8").digest("hex");
+}
+/**
+* Verifies retained candidate bytes against a journaled candidateHash
+* (RV4207). The retained blob holds the candidate's TEXT verbatim (the
+* document itself for a string result, its JSON serialization
+* otherwise), while the hash covers the canonical VALUE, so the check
+* tries the value both ways: as the string document, then as parsed
+* JSON. Returns false on any mismatch or unparsable bytes, never
+* throws: the caller is an audit path, and a corrupt blob is a finding
+* there, not a crash.
+*/
+function verifyCandidateBytes(bytes, hash) {
+	const text = typeof bytes === "string" ? bytes : new TextDecoder().decode(bytes);
+	if (candidateHashOf(text) === hash) return true;
+	try {
+		return candidateHashOf(JSON.parse(text)) === hash;
+	} catch {
+		return false;
+	}
+}
 const parse = (at) => {
 	if (at === void 0) return;
 	const ms = Date.parse(at);
@@ -10203,6 +10360,7 @@ function synthesisCandidatesFromJournal(entries, priceUsd) {
 			...typeof value.candidateHash === "string" ? { candidateHash: value.candidateHash } : {},
 			...typeof value.candidateChars === "number" ? { candidateChars: value.candidateChars } : {},
 			...typeof value.candidateRef === "string" ? { candidateRef: value.candidateRef } : {},
+			...typeof value.bytesUnavailableReason === "string" ? { bytesUnavailableReason: value.bytesUnavailableReason } : {},
 			failed: Array.isArray(value.failed) ? value.failed.filter((failure) => typeof failure.name === "string").map((failure) => ({
 				name: failure.name,
 				reasons: Array.isArray(failure.reasons) ? failure.reasons.filter((reason) => typeof reason === "string") : []
@@ -10288,7 +10446,7 @@ function toolCalibrationFromJournal(entries) {
 		if (entry.kind !== "agent" || entry.ref === void 0 || entry.status === "running") continue;
 		dispatches += 1;
 		const role = entry.costAttribution?.role;
-		if ((role === "orchestrate" || role === "synthesize") && entry.toolBudget !== void 0) {
+		if ((role === "orchestrate" || role === "synthesize") && entry.toolBudget !== void 0 && entry.evidence === void 0) {
 			coordinationDispatches += 1;
 			coordinationToolCalls += entry.toolBudget.used;
 			continue;
@@ -10798,6 +10956,14 @@ function compareRates(seed, page) {
 const nativeNow = Date.now;
 /** The fixed accounting window every PerMinute cap counts over. */
 const QUOTA_WINDOW_MS = 6e4;
+/** The scope-dimension keys a QuotaRule can pin (RV4205). */
+const RULE_SCOPE_DIMENSIONS = [
+	"account",
+	"project",
+	"legalDomain",
+	"region",
+	"providerAccount"
+];
 /**
 * Validates a quota rule set as a typed ConfigError before any
 * limiter can admit under it: a non-array or empty set, a rule
@@ -10815,7 +10981,8 @@ function validateQuotaRules(rules, site = "quota rules") {
 		for (const dimension of [
 			"provider",
 			"model",
-			"tenant"
+			"tenant",
+			...RULE_SCOPE_DIMENSIONS
 		]) {
 			const value = rule[dimension];
 			if (value !== void 0 && (typeof value !== "string" || value === "")) throw new ConfigError(`${at}.${dimension} must be a nonempty string when given`);
@@ -10838,6 +11005,11 @@ function quotaRuleKey(rule) {
 		provider: rule.provider ?? null,
 		model: rule.model ?? null,
 		tenant: rule.tenant ?? null,
+		...rule.account === void 0 ? {} : { account: rule.account },
+		...rule.project === void 0 ? {} : { project: rule.project },
+		...rule.legalDomain === void 0 ? {} : { legalDomain: rule.legalDomain },
+		...rule.region === void 0 ? {} : { region: rule.region },
+		...rule.providerAccount === void 0 ? {} : { providerAccount: rule.providerAccount },
 		requestsPerMinute: rule.requestsPerMinute ?? null,
 		tokensPerMinute: rule.tokensPerMinute ?? null
 	});
@@ -10873,13 +11045,18 @@ function snapshotQuotaRules(rules, site = "quota rules") {
 		...rule.provider === void 0 ? {} : { provider: rule.provider },
 		...rule.model === void 0 ? {} : { model: rule.model },
 		...rule.tenant === void 0 ? {} : { tenant: rule.tenant },
+		...rule.account === void 0 ? {} : { account: rule.account },
+		...rule.project === void 0 ? {} : { project: rule.project },
+		...rule.legalDomain === void 0 ? {} : { legalDomain: rule.legalDomain },
+		...rule.region === void 0 ? {} : { region: rule.region },
+		...rule.providerAccount === void 0 ? {} : { providerAccount: rule.providerAccount },
 		...rule.requestsPerMinute === void 0 ? {} : { requestsPerMinute: rule.requestsPerMinute },
 		...rule.tokensPerMinute === void 0 ? {} : { tokensPerMinute: rule.tokensPerMinute }
 	})));
 }
 /** True when every dimension the rule pins matches the request. */
 function quotaRuleMatches(rule, request) {
-	return (rule.provider === void 0 || rule.provider === request.provider) && (rule.model === void 0 || rule.model === request.model) && (rule.tenant === void 0 || rule.tenant === request.tenant);
+	return (rule.provider === void 0 || rule.provider === request.provider) && (rule.model === void 0 || rule.model === request.model) && (rule.tenant === void 0 || rule.tenant === request.tenant) && (rule.account === void 0 || rule.account === request.scope?.account) && (rule.project === void 0 || rule.project === request.scope?.project) && (rule.legalDomain === void 0 || rule.legalDomain === request.scope?.legalDomain) && (rule.region === void 0 || rule.region === request.scope?.region) && (rule.providerAccount === void 0 || rule.providerAccount === request.scope?.providerAccount);
 }
 /** The tokens a reservation is admitted under: input estimate plus the output cap. */
 function quotaEstimateTokens(request) {
@@ -11088,6 +11265,8 @@ function validateEngineQuotaConfig(config, site = "createEngine quota") {
 	const limiter = candidate.limiter;
 	if (typeof limiter !== "object" || limiter === null || typeof limiter.reserve !== "function" || typeof limiter.reconcile !== "function") throw new ConfigError(`${site}.limiter must implement QuotaLimiter (reserve and reconcile functions)`);
 	if (candidate.tenant !== void 0 && (typeof candidate.tenant !== "string" || candidate.tenant === "")) throw new ConfigError(`${site}.tenant must be a nonempty string when given`);
+	const tenantFrom = candidate.tenantFrom;
+	if (tenantFrom !== void 0 && tenantFrom !== "engine" && tenantFrom !== "scope") throw new ConfigError(`${site}.tenantFrom must be 'engine' or 'scope' when given`);
 	if (candidate.onLimiterError !== void 0 && candidate.onLimiterError !== "deny" && candidate.onLimiterError !== "allow") throw new ConfigError(`${site}.onLimiterError must be 'deny' or 'allow' when given`);
 	const reserveContinuations = candidate.reserveContinuations;
 	if (reserveContinuations !== void 0 && typeof reserveContinuations !== "boolean") throw new ConfigError(`${site}.reserveContinuations must be a boolean when given`);
@@ -16173,6 +16352,35 @@ function isOrchestratorAccount(scope) {
 function attributionBucket(value) {
 	return value === void 0 || value === "" ? "unknown" : value;
 }
+/**
+* The byAgentType bucket of one attributed slice (RV4206, the RV3905
+* vacuum-fill precedent carried to the agent-type table). A declared
+* agentType always wins, verbatim. The vacuum, an absent or empty
+* agentType, is FILLED from facts the journal already records instead
+* of stamping new bytes: role 'orchestrate' names the bucket
+* 'orchestrator' (the coordination loop and the forced-finish wake),
+* and role 'synthesize' names it by the dispatch label through the
+* ONE {@link synthesizeSpanClassOf} classifier: 'synthesizer' for
+* compositions and notes, 'claim-judge' and 'citation-judge' for the
+* two judges, with an unknown label keeping the honest 'unknown'.
+* Because the derivation reads only recorded facts, the live report,
+* the journal fold, and every ARCHIVED journal report the same named
+* buckets: the sixth comparison run's report read byAgentType 100%
+* 'unknown' over a run whose every dispatch had a nameable stage, and
+* that same journal now folds to named rows retroactively. Both
+* accumulation sites and the journal fold call this one function, the
+* RV3302 no-drift doctrine.
+*/
+function agentTypeBucket(agentType, role, label) {
+	if (agentType !== void 0 && agentType !== "") return agentType;
+	if (role === "orchestrate") return "orchestrator";
+	if (role === "synthesize") {
+		const cls = synthesizeSpanClassOf(label);
+		if (cls === "composition") return "synthesizer";
+		return cls === "unclassified" ? "unknown" : cls;
+	}
+	return "unknown";
+}
 /** {@link attributionBucket} over a whole live map, merging folded keys. */
 function foldBuckets(source) {
 	const folded = {};
@@ -16306,7 +16514,7 @@ function costReportFromJournal(entries, priceUsd) {
 			phaseUsd -= unit.usd;
 		}
 		byPhase[phase] = (byPhase[phase] ?? 0) + phaseUsd;
-		const agentType = attributionBucket(facts?.agentType);
+		const agentType = agentTypeBucket(facts?.agentType, facts?.role, facts?.label);
 		byAgentType[agentType] = (byAgentType[agentType] ?? 0) + priced.usd;
 		const scope = scopeBucket(entry.scope);
 		byScope[scope] = (byScope[scope] ?? 0) + priced.usd;
@@ -16805,7 +17013,10 @@ function invoiceFromJournal(entries, priceUsd, options) {
 			for (const entry of entries) {
 				if (entry.kind !== "decision") continue;
 				const value = entry.value;
-				if (value?.decisionType === "execution_scope" && typeof value.scope === "object") return { executionScope: value.scope };
+				if (value?.decisionType === "execution_scope" && typeof value.scope === "object") return {
+					executionScope: value.scope,
+					...typeof value.scopeDigest === "string" ? { executionScopeDigest: value.scopeDigest } : {}
+				};
 			}
 			return {};
 		})(),
@@ -18110,8 +18321,9 @@ function acceptanceTailRequiredUsd(spec) {
 	const onFound = spec.claimOnFound ?? "report";
 	const citationDeclared = spec.citationJudgeEstCostUsd !== void 0 || spec.citationOnFound !== void 0;
 	const citationRoundArmed = spec.citationOnFound === "repair";
-	const roundArmed = onFound === "repair" && stage !== "draft" || citationRoundArmed;
-	const judgePasses = acceptanceJudgePasses(spec.claimStage, spec.claimOnFound) + (citationRoundArmed && spec.claimConfigured === true && stage !== "draft" ? 1 : 0);
+	const claimRoundArmed = onFound === "repair" && stage !== "draft";
+	const roundArmed = claimRoundArmed || citationRoundArmed;
+	const judgePasses = acceptanceJudgePasses(spec.claimStage, spec.claimOnFound) + (citationRoundArmed && !claimRoundArmed && spec.claimConfigured === true && stage !== "draft" ? 1 : 0);
 	const citationJudgePasses = citationDeclared ? 1 + (citationRoundArmed ? 1 : 0) : 0;
 	const citationJudgeEstUsd = spec.citationJudgeEstCostUsd ?? 0;
 	const terms = {
@@ -18155,18 +18367,43 @@ function formatAcceptanceTailTerms(terms) {
 * `1 + r`.
 */
 function wireCapacityEstimate(spec) {
-	requireNonNegativeNumber(spec.childWires, "wireCapacityEstimate childWires");
+	const known = [
+		"childWires",
+		"children",
+		"turnsPerChild",
+		"coordinationWires",
+		"synthesisWires",
+		"judgeWires",
+		"citationJudgeWires",
+		"extractWires"
+	];
+	for (const key of Object.keys(spec)) if (!known.includes(key)) throw new ConfigError(`wireCapacityEstimate does not know the key '${key}'; the declared vocabulary is ${known.join(", ")}. A repair round is priced by the estimate itself (repairRoundDeltaWires), and retries by retryWireMultiplier; neither is an input.`);
+	const structural = spec.children !== void 0 || spec.turnsPerChild !== void 0;
+	if (structural) {
+		if (spec.children === void 0 || spec.turnsPerChild === void 0) throw new ConfigError("wireCapacityEstimate children and turnsPerChild come as a pair: declare both, or declare the childWires total alone");
+		requireNonNegativeNumber(spec.children, "wireCapacityEstimate children");
+		requireNonNegativeNumber(spec.turnsPerChild, "wireCapacityEstimate turnsPerChild");
+	} else if (spec.childWires === void 0) throw new ConfigError("wireCapacityEstimate needs the fan-out declared: childWires (children times their turns), or the structural pair children and turnsPerChild");
+	if (spec.childWires !== void 0) requireNonNegativeNumber(spec.childWires, "wireCapacityEstimate childWires");
+	if (structural && spec.childWires !== void 0) {
+		const product = (spec.children ?? 0) * (spec.turnsPerChild ?? 0);
+		if (spec.childWires !== product) throw new ConfigError(`wireCapacityEstimate childWires ${String(spec.childWires)} contradicts children ${String(spec.children)} x turnsPerChild ${String(spec.turnsPerChild)} = ${String(product)}: childWires is the fan-out wire TOTAL, not the child count; declare one form, or make them agree`);
+	}
+	const childWires = spec.childWires ?? (spec.children ?? 0) * (spec.turnsPerChild ?? 0);
 	const coordinationWires = spec.coordinationWires ?? 0;
 	const synthesisWires = spec.synthesisWires ?? 0;
 	const judgeWires = spec.judgeWires ?? 0;
+	const citationJudgeWires = spec.citationJudgeWires ?? 0;
 	const extractWires = spec.extractWires ?? 0;
 	requireNonNegativeNumber(coordinationWires, "wireCapacityEstimate coordinationWires");
 	requireNonNegativeNumber(synthesisWires, "wireCapacityEstimate synthesisWires");
 	requireNonNegativeNumber(judgeWires, "wireCapacityEstimate judgeWires");
+	requireNonNegativeNumber(citationJudgeWires, "wireCapacityEstimate citationJudgeWires");
 	requireNonNegativeNumber(extractWires, "wireCapacityEstimate extractWires");
-	const baseWires = spec.childWires + coordinationWires + synthesisWires + judgeWires + extractWires;
+	const baseWires = childWires + coordinationWires + synthesisWires + judgeWires + citationJudgeWires + extractWires;
 	const repairRoundDeltaWires = 2;
 	return {
+		basis: "declared-estimate",
 		baseWires,
 		repairRoundDeltaWires,
 		mechanicalRepairDeltaWires: 1,
@@ -18658,6 +18895,78 @@ function emitSpawnRejected(events, input) {
 	}, input.spanId, input.replayed);
 }
 //#endregion
+//#region src/orchestrator/semantic-verdict.ts
+const countOf = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
+/**
+* Folds the one semantic verdict out of envelope facts (RV4209).
+* Returns undefined when NO semantic meta is present: nothing was
+* configured, nothing judged anything, and absence must keep meaning
+* NOT RECORDED rather than a fabricated verdict. Never throws on
+* malformed shapes: an untyped field reads as absent, and the verdict
+* degrades toward 'not-judged', the fail-closed direction.
+*/
+function semanticTerminalVerdictOf(input) {
+	const claim = input.claimConsistencyMeta;
+	const audit = input.citationAuditMeta;
+	if (claim === void 0 && audit === void 0) return;
+	const judgeFailures = [];
+	if (claim?.judgeFailed === true) judgeFailures.push("claim-judge-failed");
+	if (claim?.judgeDeclined === true) judgeFailures.push("claim-judge-declined");
+	if (audit?.judgeFailed === true) judgeFailures.push("citation-judge-failed");
+	if (audit?.judgeDeclined === true) judgeFailures.push("citation-judge-declined");
+	if (claim?.judgedStage === "draft" && input.draftToFinal?.rewritten === true) judgeFailures.push("draft-rewritten-unjudged");
+	const coverage = typeof claim?.coverage === "string" ? claim.coverage : void 0;
+	if (coverage === "judge-failed" && !judgeFailures.includes("claim-judge-failed")) judgeFailures.push("claim-judge-failed");
+	if (coverage === "judge-declined" && !judgeFailures.includes("claim-judge-declined")) judgeFailures.push("claim-judge-declined");
+	const contradictions = countOf(claim?.findings);
+	const unsupportedCitations = countOf(audit?.unsupported);
+	const partialCitations = countOf(audit?.partial);
+	const semanticRepairRounds = Math.max(countOf(claim?.semanticRepairRounds), countOf(audit?.citationRepairRounds));
+	const waiverCandidate = input.claimCoverageWaiver;
+	const waiver = waiverCandidate !== void 0 && typeof waiverCandidate.principal === "string" && typeof waiverCandidate.reason === "string" && typeof waiverCandidate.coverage === "string" ? {
+		principal: waiverCandidate.principal,
+		reason: waiverCandidate.reason,
+		...typeof waiverCandidate.expiresAt === "string" ? { expiresAt: waiverCandidate.expiresAt } : {},
+		coverage: waiverCandidate.coverage
+	} : void 0;
+	const finalHash = typeof claim?.judgedHash === "string" ? claim.judgedHash : typeof audit?.auditedHash === "string" ? audit.auditedHash : void 0;
+	return {
+		verdict: judgeFailures.length > 0 ? "not-judged" : contradictions > 0 || unsupportedCitations > 0 ? "findings" : waiver !== void 0 ? "waived" : coverage === "partial" || coverage === "critical-uncovered" ? "partial" : coverage === "vacuous" ? "vacuous" : "clean",
+		...finalHash === void 0 ? {} : { finalHash },
+		...coverage === void 0 ? {} : { coverage },
+		contradictions,
+		unsupportedCitations,
+		partialCitations,
+		semanticRepairRounds,
+		...waiver === void 0 ? {} : { waiver },
+		judgeFailures
+	};
+}
+/**
+* The production acceptance predicate (RV4209): the one boolean a
+* production consumer gates on, with the stable reason when it
+* refuses. A verdict is production-acceptable exactly when it exists
+* and reads 'clean': 'partial' and 'vacuous' are legal diagnostics
+* (strict keeps exit 0 on them by documented design), 'waived' is a
+* human exception a machine gate must surface rather than inherit,
+* and an ABSENT verdict means nothing judged anything, which a
+* production gate reads fail closed. Exported so the CLI's
+* `--acceptance-policy production`, a server consumer, and a host
+* pipeline apply the SAME rule instead of three re-derivations.
+*/
+function productionAcceptable(verdict) {
+	if (verdict === void 0) return {
+		ok: false,
+		reason: "not-judged: the terminal carries no semantic verdict (no claim or citation machinery was configured, or the run predates it)"
+	};
+	if (verdict.verdict === "clean") return { ok: true };
+	const detail = verdict.verdict === "findings" ? `${String(verdict.contradictions)} contradiction(s), ${String(verdict.unsupportedCitations)} unsupported citation(s)` : verdict.verdict === "waived" ? `waived by ${verdict.waiver?.principal ?? "unknown"} over coverage '${verdict.waiver?.coverage ?? "unknown"}'` : verdict.verdict === "not-judged" ? verdict.judgeFailures.join(", ") : `coverage '${verdict.coverage ?? "unknown"}'`;
+	return {
+		ok: false,
+		reason: `${verdict.verdict}: ${detail}`
+	};
+}
+//#endregion
 //#region src/runtime/permission-chain.ts
 /**
 * The layered permission chain (M3-T03): the single approval surface for
@@ -19335,6 +19644,7 @@ function createCtx(internals, rootWorkflow) {
 		const declaredTools = opts.tools ?? profile?.tools ?? [];
 		const toolset = await resolveToolset(escalation === void 0 ? declaredTools : [...declaredTools, escalateTool()], { runId: internals.runId }, internals.defaults.toolsets, internals.executors === void 0 ? void 0 : new Set(Object.keys(internals.executors)));
 		if (profile?.toolsetAttestation !== void 0) enforceToolsetAttestation(agentType, profile.toolsetAttestation, toolset);
+		else if (internals.defaults.requireToolsetAttestation === true && toolset.contracts.length > 0) throw new ConfigError(`agentType '${agentType}' resolves ${String(toolset.contracts.length)} tool(s) with no toolsetAttestation binding them (requireToolsetAttestation): a regulated spawn executes only pinned toolsets; record the pin with attestToolset() on the profile, or drop the tools`);
 		const layers = [
 			callLayer,
 			profileLayer,
@@ -19621,7 +19931,7 @@ function createCtx(internals, rootWorkflow) {
 				replayPhaseUsd -= unit.usd;
 			}
 			bump(internals.cost.byPhase, state.phase ?? "", replayPhaseUsd);
-			bump(internals.cost.byAgentType, agentType, costUsd);
+			bump(internals.cost.byAgentType, agentTypeBucket(agentType, primaryRole, opts.label), costUsd);
 			bump(internals.cost.byScope, state.scope, costUsd);
 			internals.cost.byRole.set(primaryRole, (internals.cost.byRole.get(primaryRole) ?? 0) + costUsd);
 			if (result.status === "escalated" && result.escalation !== void 0) {
@@ -20136,11 +20446,14 @@ function createCtx(internals, rootWorkflow) {
 		if (retryPolicy !== void 0) runAgentOptions.retry = { policy: retryPolicy };
 		if (internals.quota !== void 0) {
 			const quota = internals.quota;
+			const reservationTenant = quota.tenantFrom === "scope" ? internals.executionScope?.tenant : quota.tenant;
+			const reservationScope = internals.executionScope;
 			runAgentOptions.quota = {
 				reserve: (request) => quota.limiter.reserve({
 					...request,
 					runId: internals.runId,
-					...quota.tenant === void 0 ? {} : { tenant: quota.tenant }
+					...reservationTenant === void 0 ? {} : { tenant: reservationTenant },
+					...reservationScope === void 0 ? {} : { scope: reservationScope }
 				}),
 				reconcile: (reservationId, usage, actual) => quota.limiter.reconcile(reservationId, usage, actual),
 				onLimiterError: quota.onLimiterError,
@@ -20177,10 +20490,12 @@ function createCtx(internals, rootWorkflow) {
 		internals.budget.releaseReserve(reserve, budgetAccount);
 		const declaredRules = internals.quota?.declaredRules;
 		if (declaredRules !== void 0 && result.rateLimitObservations !== void 0) for (const observation of result.rateLimitObservations) {
+			const probeTenant = internals.quota?.tenantFrom === "scope" ? internals.executionScope?.tenant : internals.quota?.tenant;
 			const probe = {
 				provider: observation.provider,
 				model: observation.model,
-				...internals.quota?.tenant === void 0 ? {} : { tenant: internals.quota.tenant },
+				...probeTenant === void 0 ? {} : { tenant: probeTenant },
+				...internals.executionScope === void 0 ? {} : { scope: internals.executionScope },
 				estimate: {
 					requests: 1,
 					inputTokens: 0
@@ -20329,6 +20644,7 @@ function createCtx(internals, rootWorkflow) {
 			...result.providerCalls === void 0 ? {} : { providerCalls: result.providerCalls },
 			costAttribution: {
 				...state.phase === void 0 ? {} : { phase: state.phase },
+				...state.repairTrigger === void 0 ? {} : { repairTrigger: state.repairTrigger },
 				agentType,
 				role: primaryRole,
 				budgetAccount: state.budgetScope ?? "run",
@@ -20440,7 +20756,7 @@ function createCtx(internals, rootWorkflow) {
 			livePhaseUsd -= recordUsd;
 		}
 		bump(internals.cost.byPhase, state.phase ?? "", livePhaseUsd);
-		bump(internals.cost.byAgentType, agentType, usd);
+		bump(internals.cost.byAgentType, agentTypeBucket(agentType, primaryRole, opts.label), usd);
 		bump(internals.cost.byScope, state.scope, usd);
 		if (result.error?.kind === "budget" || internals.budget.exhausted && result.status !== "ok") {
 			if (!internals.budget.exhausted && result.errorMessage !== void 0 && result.errorMessage.startsWith("in flight exposure cap reached")) throw new BudgetExhaustedError(result.errorMessage, { data: {
@@ -22687,6 +23003,8 @@ const RANGE_TAIL = /^(.*):(\d+)(?:-(\d+))?$/u;
 * Garbage throws like every malformed intake.
 */
 function resolveCitationAuditPlan(options) {
+	const resolver = options.resolver ?? 1;
+	if (resolver !== 1 && resolver !== 2) throw new ConfigError(`citationAudit.resolver must be 1 or 2; got ${JSON.stringify(options.resolver)}`);
 	const samplePerSection = options.samplePerSection ?? 2;
 	if (!Number.isInteger(samplePerSection) || samplePerSection < 1) throw new ConfigError(`citationAudit.samplePerSection must be a positive integer; got ${String(options.samplePerSection)}`);
 	const maxSampled = options.maxSampled ?? 24;
@@ -22705,7 +23023,8 @@ function resolveCitationAuditPlan(options) {
 		pattern,
 		samplePerSection,
 		maxSampled,
-		window
+		window,
+		resolver
 	};
 }
 /** Splits a document into (section marker, body) runs in order. */
@@ -22753,26 +23072,36 @@ function pickIndexes(count, k, seedInput) {
 * of auditing the first sections only.
 */
 function sampleCitationRows(document, plan, seed) {
+	const allAnchors = plan.resolver === 2;
 	const perSection = [];
 	for (const { marker, body } of sectionsOfDocument(document)) {
 		const candidates = [];
 		for (const sentence of sentencesOf(body)) {
-			const match = citationWithRange(plan.pattern).exec(sentence);
-			if (match === null) continue;
-			const anchorText = new RegExp(`${match[0].replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}(?:-(\\d+))?`, "u").exec(sentence)?.[0] ?? match[0];
-			const parsed = RANGE_TAIL.exec(anchorText);
-			if (parsed === null) continue;
-			const path = parsed[1] ?? "";
-			const line = Number(parsed[2]);
-			const endLine = parsed[3] === void 0 ? void 0 : Number(parsed[3]);
-			if (path === "" || !Number.isInteger(line) || line < 1) continue;
-			candidates.push({
-				sentence,
-				anchor: anchorText,
-				path,
-				line,
-				...endLine !== void 0 && Number.isInteger(endLine) && endLine >= line ? { endLine } : {}
-			});
+			const probe = citationWithRange(plan.pattern);
+			const anchors = [];
+			for (let match = probe.exec(sentence); match !== null; match = probe.exec(sentence)) {
+				const tail = /^-(\d+)/u.exec(sentence.slice(match.index + match[0].length));
+				const anchorText = tail === null ? match[0] : `${match[0]}${tail[0]}`;
+				const parsed = RANGE_TAIL.exec(anchorText);
+				if (parsed === null) continue;
+				const path = parsed[1] ?? "";
+				const line = Number(parsed[2]);
+				const endLine = parsed[3] === void 0 ? void 0 : Number(parsed[3]);
+				if (path === "" || !Number.isInteger(line) || line < 1) continue;
+				anchors.push({
+					sentence,
+					anchor: anchorText,
+					path,
+					line,
+					...endLine !== void 0 && Number.isInteger(endLine) && endLine >= line ? { endLine } : {},
+					...allAnchors ? {
+						anchorOrdinal: anchors.length,
+						clause: clauseAround(sentence, match.index)
+					} : {}
+				});
+				if (!allAnchors) break;
+			}
+			if (anchors.length > 0) candidates.push(anchors);
 		}
 		if (candidates.length === 0) continue;
 		const picks = pickIndexes(candidates.length, plan.samplePerSection, `${seed}:${marker}`).map((index) => candidates[index]).filter((candidate) => candidate !== void 0);
@@ -22788,18 +23117,36 @@ function sampleCitationRows(document, plan, seed) {
 			const pick = bucket.picks[rank];
 			if (pick === void 0) continue;
 			any = true;
-			if (rows.length >= plan.maxSampled) break;
-			rows.push({
-				row: rows.length,
-				section: bucket.section,
-				...pick
-			});
+			for (const anchor of pick) {
+				if (rows.length >= plan.maxSampled) break;
+				rows.push({
+					row: rows.length,
+					section: bucket.section,
+					...anchor
+				});
+			}
 		}
 		if (!any) break;
 	}
 	return rows;
 }
 /**
+* The claim clause nearest an anchor (RV4208): the sentence segment,
+* cut at clause boundaries (';' or ',' followed by whitespace), that
+* contains the anchor position. Pure text arithmetic, no NLP: the
+* point is to hand the judge the claim half the anchor was cited FOR
+* instead of the whole compound sentence.
+*/
+function clauseAround(sentence, anchorIndex) {
+	let start = 0;
+	const cuts = /[;,]\s/gu;
+	for (let cut = cuts.exec(sentence); cut !== null; cut = cuts.exec(sentence)) {
+		if (cut.index >= anchorIndex) return sentence.slice(start, cut.index + 1).trim();
+		start = cut.index + 1;
+	}
+	return sentence.slice(start).trim();
+}
+/**
 * Resolves one sampled citation's excerpt through the host's pure
 * snapshot resolver. The FIRST cited line failing to resolve returns
 * undefined (an unsupported citation by doctrine); later lines simply
@@ -22823,6 +23170,107 @@ function citationExcerptOf(resolve, row, window) {
 	const excerpt = lines.join("\n");
 	return excerpt.length > 800 ? `${excerpt.slice(0, 800)}…` : excerpt;
 }
+const HEADING = /^#{1,6}\s+\S/u;
+const LIST_ITEM = /^(\s*)(?:[-*+]|\d+[.)])\s+\S/u;
+const TABLE_ROW = /^\s*\|/u;
+const CODE_COMMENT = /^\s*(?:\/\/|#(?!#)|\*|\/\*|--)\s?/u;
+/**
+* Resolver v2's excerpt: the bounded LOGICAL UNIT the cited line
+* belongs to (RV4208), through the same pure line resolver v1 reads.
+* The v1 window is a fixed downward slice, and the sixth comparison
+* experiment's confirmed false negative was structural: a section
+* heading cited as the anchor with its support three lines below the
+* window. The unit rules, all bounded by {@link
+* MAX_CITATION_EXCERPT_LINES} and {@link MAX_CITATION_EXCERPT_CHARS}
+* with a `truncated` flag when clipped:
+*
+* - heading: the SECTION, the heading plus following lines to the
+*   next heading;
+* - table row: the row, with the header pair above it when adjacent;
+* - list item: the marker line plus its more-indented continuation
+*   lines;
+* - code comment: the comment BLOCK (expanded upward to its start)
+*   plus the declaration lines it documents, to the first blank line;
+* - anything else: the paragraph, expanded upward and downward to the
+*   nearest blank or heading line.
+*
+* An explicit `path:start-end` range keeps range semantics (the host
+* cited exact lines; second-guessing them would audit a different
+* citation): the ranged lines, clipped by the caps. The FIRST cited
+* line failing to resolve returns undefined, the unsupported-by-
+* doctrine verdict v1 renders.
+*/
+function citationUnitExcerptOf(resolve, row) {
+	const lineAt = (line) => line < 1 ? void 0 : resolve({
+		path: row.path,
+		line
+	});
+	const anchor = lineAt(row.line);
+	if (anchor === void 0) return;
+	const collect = (type, firstLine, include) => {
+		const lines = [];
+		let truncated = false;
+		for (let line = firstLine;; line += 1) {
+			if (lines.length >= 12) {
+				truncated = true;
+				break;
+			}
+			const text = line === row.line ? anchor : lineAt(line);
+			if (text === void 0) break;
+			if (line !== firstLine && line !== row.line && !include(text, line)) break;
+			lines.push(`L${String(line)}: ${text}`);
+		}
+		let excerpt = lines.join("\n");
+		if (excerpt.length > 800) {
+			excerpt = `${excerpt.slice(0, 800)}…`;
+			truncated = true;
+		}
+		return {
+			excerpt,
+			unit: {
+				type,
+				lines: lines.length,
+				...truncated ? { truncated: true } : {}
+			}
+		};
+	};
+	if (row.endLine !== void 0) {
+		const last = row.endLine;
+		return collect("paragraph", row.line, (_text, line) => line <= last);
+	}
+	if (HEADING.test(anchor)) return collect("section", row.line, (text) => !HEADING.test(text));
+	if (TABLE_ROW.test(anchor)) {
+		const above = lineAt(row.line - 1);
+		const headerTop = lineAt(row.line - 2);
+		return collect("table-row", above !== void 0 && headerTop !== void 0 && /^\s*\|[\s:|-]+\|?\s*$/u.test(above) && TABLE_ROW.test(headerTop) ? row.line - 2 : row.line, (text, line) => line <= row.line && TABLE_ROW.test(text));
+	}
+	const listMatch = LIST_ITEM.exec(anchor);
+	if (listMatch !== null) {
+		const markerIndent = (listMatch[1] ?? "").length;
+		return collect("list-item", row.line, (text) => {
+			if (text.trim() === "" || HEADING.test(text) || LIST_ITEM.test(text)) return false;
+			return (/^(\s*)/u.exec(text)?.[1]?.length ?? 0) > markerIndent;
+		});
+	}
+	if (CODE_COMMENT.test(anchor)) {
+		let first = row.line;
+		for (let line = row.line - 1; line >= 1 && row.line - line < 6; line -= 1) {
+			const text = lineAt(line);
+			if (text === void 0 || !CODE_COMMENT.test(text)) break;
+			first = line;
+		}
+		return collect("comment-declaration", first, (text) => text.trim() !== "");
+	}
+	return collect("paragraph", (() => {
+		let first = row.line;
+		for (let line = row.line - 1; line >= 1 && row.line - line < 6; line -= 1) {
+			const text = lineAt(line);
+			if (text === void 0 || text.trim() === "" || HEADING.test(text)) break;
+			first = line;
+		}
+		return first;
+	})(), (text) => text.trim() !== "" && !HEADING.test(text));
+}
 /** The audit judge's structured verdict schema (mirrors the claim judge). */
 const CITATION_JUDGE_SCHEMA = {
 	type: "object",
@@ -23050,6 +23498,8 @@ const DEFAULT_MAX_POOL_PER_PAIR = 3;
 const DEFAULT_MAX_PAIR_EXCERPT_CHARS = 400;
 /** Bound on the reported uncovered-critical anchor list (RV1603). */
 const MAX_CRITICAL_UNCOVERED = 32;
+/** Bound on the reported uncovered citing-sentence list (RV4202). */
+const MAX_UNCOVERED_SENTENCES = 24;
 /** Splits an anchor into path, start, and optional end at the LAST colon. */
 const ANCHOR_TAIL = /^(.*):(\d+)(?:-(\d+))?$/u;
 function requirePositiveInteger(value, what) {
@@ -23157,11 +23607,17 @@ function pairDraftClaims(draftText, rows, options) {
 	let draftCitingSentences = 0;
 	const criticalDraftAnchors = [];
 	const seenCriticalAnchors = /* @__PURE__ */ new Set();
+	const citingSentences = [];
+	const seenCitingSentences = /* @__PURE__ */ new Set();
 	for (const sentence of sentencesOf(draftText)) {
 		const anchors = anchorsOf(sentence, pattern);
 		if (anchors.length === 0) continue;
 		draftCitingSentences += 1;
 		const full = collapse(sentence);
+		if (options?.reportUncovered === true && !seenCitingSentences.has(full)) {
+			seenCitingSentences.add(full);
+			citingSentences.push(full);
+		}
 		const draftExcerpt = full.slice(0, maxExcerptChars);
 		for (const anchor of anchors) {
 			const anchorCritical = critical !== void 0 && isCritical(anchor);
@@ -23237,6 +23693,11 @@ function pairDraftClaims(draftText, rows, options) {
 		fold.criticalUncovered = uncovered.slice(0, 32);
 		fold.criticalUncoveredTotal = uncovered.length;
 	}
+	if (options?.reportUncovered === true) {
+		const uncovered = citingSentences.filter((sentence) => !coveredSentences.has(sentence));
+		fold.uncoveredSentences = uncovered.slice(0, 24).map((sentence) => sentence.slice(0, maxExcerptChars));
+		fold.uncoveredSentencesTotal = uncovered.length;
+	}
 	return fold;
 }
 /** The synthetic anchor and nodeId of run-facts pairs (RV1603). */
@@ -23749,6 +24210,15 @@ function selfTestFinishValidation(options) {
 /** How many rejected finishes are repaired by default: the plan's repair once. */
 const DEFAULT_FINISH_MAX_REPAIRS = 1;
 /**
+* The word ceiling of a 'digest' coordination draft (RV4210): the
+* digest is a structural evidence map the composing invocation writes
+* prose FROM, and the ceiling is the teeth that keep it from decaying
+* back into the full prose draft it exists to replace. The sixth
+* comparison run's contract-policy draft cost 344.8 seconds of model
+* output and was then rewritten whole by the composition.
+*/
+const DIGEST_DRAFT_MAX_WORDS = 400;
+/**
 * The most hinted edits one deterministic repair attempt will apply
 * (RV3801): a validator caps its own hints well below this, so the
 * bound only guards against a custom validator flooding the journal
@@ -23951,11 +24421,21 @@ function validateOrchestrateOptions(opts) {
 		if (estRepair !== void 0 && (typeof estRepair !== "number" || !Number.isFinite(estRepair) || estRepair < 0)) throw new ConfigError(`orchestrate finishValidation.estRepairCostUsd must be a nonnegative finite number; got ${JSON.stringify(estRepair)}`);
 		const retain = fv.retainRejectedCandidates;
 		if (retain !== void 0 && typeof retain !== "boolean") throw new ConfigError("orchestrate finishValidation.retainRejectedCandidates must be a boolean");
+		const persistence = fv.candidatePersistence;
+		if (persistence !== void 0) {
+			if (persistence !== "transcript" && persistence !== "hash-only") throw new ConfigError(`orchestrate finishValidation.candidatePersistence must be 'transcript' or 'hash-only'; got ${JSON.stringify(persistence)}`);
+			if (retain !== void 0) throw new ConfigError("orchestrate finishValidation.candidatePersistence supersedes retainRejectedCandidates: declare one, not both");
+		}
 		const draftPolicy = fv.draftPolicy;
 		if (draftPolicy !== void 0) {
-			if (draftPolicy !== "contract" && (typeof draftPolicy !== "object" || draftPolicy === null)) throw new ConfigError("orchestrate finishValidation.draftPolicy must be an object or the sentinel 'contract'");
+			if (draftPolicy !== "contract" && draftPolicy !== "digest" && (typeof draftPolicy !== "object" || draftPolicy === null)) throw new ConfigError("orchestrate finishValidation.draftPolicy must be an object or one of the sentinels 'contract' | 'digest'");
 			if (opts.synthesis === void 0) throw new ConfigError("orchestrate finishValidation.draftPolicy requires synthesis: without a synthesis invocation the validators bind the coordination finish itself and there is no unvalidated draft to gate");
-			const policy = draftPolicy === "contract" ? void 0 : draftPolicy;
+			if (draftPolicy === "digest") {
+				const synthesisShape = opts.synthesis;
+				if (synthesisShape.skipWhenDraftValid === true) throw new ConfigError("orchestrate finishValidation.draftPolicy 'digest' refuses synthesis.skipWhenDraftValid: a digest is a structural evidence map, never a shippable draft, and the skip gate exists to settle on one");
+				if (synthesisShape.fallbackToValidDraft === true) throw new ConfigError("orchestrate finishValidation.draftPolicy 'digest' refuses synthesis.fallbackToValidDraft: the regression floor ships the draft, and a digest must never ship");
+			}
+			const policy = draftPolicy === "contract" || draftPolicy === "digest" ? void 0 : draftPolicy;
 			if (policy !== void 0) {
 				if (policy.minWords === void 0 && policy.requireSections === void 0) throw new ConfigError("orchestrate finishValidation.draftPolicy must declare minWords, requireSections, or both");
 				if (policy.minWords !== void 0) {
@@ -24154,6 +24634,10 @@ function validateOrchestrateOptions(opts) {
 			if (typeof shaped.reason !== "string" || shaped.reason.length === 0) throw new ConfigError("orchestrate claimConsistency.waiver.reason must be a non empty string; got " + JSON.stringify(shaped.reason));
 			if (shaped.expiresAt !== void 0 && (typeof shaped.expiresAt !== "string" || Number.isNaN(Date.parse(shaped.expiresAt)))) throw new ConfigError(`orchestrate claimConsistency.waiver.expiresAt must be an ISO 8601 date string; got ${JSON.stringify(shaped.expiresAt)}`);
 		}
+		const coverageRepair = consistency.coverageRepair;
+		if (coverageRepair !== void 0 && typeof coverageRepair !== "boolean") throw new ConfigError(`orchestrate claimConsistency.coverageRepair must be a boolean; got ${typeof coverageRepair}`);
+		if (coverageRepair === true && onFound !== "repair") throw new ConfigError("orchestrate claimConsistency.coverageRepair requires onFound 'repair': the bounded repair round is the machinery of that posture, and coverage can only join a round that exists");
+		if (coverageRepair === true && coveragePolicy !== "strict-final") throw new ConfigError("orchestrate claimConsistency.coverageRepair requires coveragePolicy 'strict-final': the round averts exactly the refusal of that gate, and repairing an unenforced grade would spend a composition on nothing");
 		if (consistency.judge !== void 0) {
 			const judge = consistency.judge;
 			if (typeof judge !== "object" || judge === null || Array.isArray(judge)) throw new ConfigError(`orchestrate claimConsistency.judge must be an object; got ${JSON.stringify(consistency.judge)}`);
@@ -24178,9 +24662,46 @@ function validateOrchestrateOptions(opts) {
 		if (audit.judge?.estCost !== void 0) requireNonNegativeNumber(audit.judge.estCost, "orchestrate citationAudit.judge.estCost");
 		if (audit.onFound === "repair") {
 			if (opts?.synthesis === void 0) throw new ConfigError("orchestrate citationAudit.onFound 'repair' requires synthesis: the bounded round is one more composition, and without one there is nothing to repair with");
-			if (opts?.claimConsistency?.onFound === "repair") throw new ConfigError("orchestrate citationAudit.onFound 'repair' cannot pair with claimConsistency.onFound 'repair': the run grants ONE bounded repair round (RV3307), so arm one consumer and give the other 'report' or 'fail'");
 		}
 	}
+	const acceptance = opts.semanticAcceptance;
+	if (acceptance !== void 0) {
+		if (typeof acceptance !== "object" || acceptance === null || Array.isArray(acceptance)) throw new ConfigError(`orchestrate semanticAcceptance must be an object; got ${JSON.stringify(acceptance)}`);
+		const knownKeys = [
+			"judgedStage",
+			"claimCoverage",
+			"contradictions",
+			"citations",
+			"unresolved",
+			"waiver"
+		];
+		for (const key of Object.keys(acceptance)) if (!knownKeys.includes(key)) throw new ConfigError(`orchestrate semanticAcceptance carries unknown key '${key}'; the signature holds exactly judgedStage, claimCoverage, contradictions, citations, unresolved and waiver`);
+		const shaped = acceptance;
+		if (shaped.judgedStage !== "final") throw new ConfigError("orchestrate semanticAcceptance.judgedStage must be the literal 'final'; got " + JSON.stringify(shaped.judgedStage));
+		if (shaped.claimCoverage !== "full") throw new ConfigError("orchestrate semanticAcceptance.claimCoverage must be the literal 'full'; got " + JSON.stringify(shaped.claimCoverage));
+		if (shaped.contradictions !== "repair-once-then-fail" && shaped.contradictions !== "fail") throw new ConfigError(`orchestrate semanticAcceptance.contradictions must be 'repair-once-then-fail' or 'fail'; got ${JSON.stringify(shaped.contradictions)}`);
+		if (shaped.citations !== "repair-once-then-fail" && shaped.citations !== "fail") throw new ConfigError(`orchestrate semanticAcceptance.citations must be 'repair-once-then-fail' or 'fail'; got ${JSON.stringify(shaped.citations)}`);
+		if (shaped.unresolved !== "fail") throw new ConfigError("orchestrate semanticAcceptance.unresolved must be the literal 'fail'; got " + JSON.stringify(shaped.unresolved));
+		const pinnedWaiver = typeof shaped.waiver === "object" && shaped.waiver !== null && !Array.isArray(shaped.waiver) ? shaped.waiver : void 0;
+		if (shaped.waiver !== "forbid" && pinnedWaiver === void 0) throw new ConfigError("orchestrate semanticAcceptance.waiver must be 'forbid' or { judgedHash }; got " + JSON.stringify(shaped.waiver));
+		if (pinnedWaiver !== void 0) {
+			for (const key of Object.keys(pinnedWaiver)) if (key !== "judgedHash") throw new ConfigError(`orchestrate semanticAcceptance.waiver carries unknown key '${key}'; the pinned form holds exactly judgedHash`);
+			if (typeof pinnedWaiver.judgedHash !== "string" || !/^[0-9a-f]{64}$/u.test(pinnedWaiver.judgedHash)) throw new ConfigError("orchestrate semanticAcceptance.waiver.judgedHash must be 64 lowercase hex chars (the claim meta judgedHash of the reviewed document); got " + JSON.stringify(pinnedWaiver.judgedHash));
+		}
+		const boundClaim = opts.claimConsistency;
+		if (boundClaim === void 0) throw new ConfigError("orchestrate semanticAcceptance requires claimConsistency: the declaration binds that machinery, and omitting the pass entirely is the deepest loosening (RV4103)");
+		if (audit === void 0) throw new ConfigError("orchestrate semanticAcceptance requires citationAudit: the declaration binds the entailment machinery, and omitting the audit entirely is the loosening the sixth experiment shipped five unsupported citations through");
+		if (boundClaim.stage !== "final" && boundClaim.stage !== "both") throw new ConfigError("orchestrate semanticAcceptance requires claimConsistency.stage 'final' or 'both', declared: the signature judges the shipped document, and the default 'draft' judges the one the synthesis replaces; got " + JSON.stringify(boundClaim.stage));
+		if (boundClaim.coveragePolicy !== "strict-final") throw new ConfigError("orchestrate semanticAcceptance requires claimConsistency.coveragePolicy 'strict-final', declared; got " + JSON.stringify(boundClaim.coveragePolicy));
+		if (boundClaim.coverageTarget !== void 0 && boundClaim.coverageTarget !== 1) throw new ConfigError(`orchestrate semanticAcceptance.claimCoverage 'full' refuses coverageTarget ${JSON.stringify(boundClaim.coverageTarget)}: a pass sized to cover less than everything can never grade 'full' on a citing document, so the declaration would be unsatisfiable by construction; raise the target to 1 or drop it`);
+		const wantClaimOnFound = shaped.contradictions === "fail" ? "fail" : "repair";
+		if (boundClaim.onFound !== wantClaimOnFound) throw new ConfigError(`orchestrate semanticAcceptance.contradictions '${String(shaped.contradictions)}' requires claimConsistency.onFound '${wantClaimOnFound}', declared; got ` + JSON.stringify(boundClaim.onFound));
+		if (shaped.contradictions === "repair-once-then-fail" && boundClaim.coverageRepair !== true) throw new ConfigError("orchestrate semanticAcceptance.contradictions 'repair-once-then-fail' requires claimConsistency.coverageRepair: true: the one bounded round serves every armed defect class, coverage included, and a declaration that repairs findings while refusing coverage the same chance is not the posture it reads as");
+		const wantCitationOnFound = shaped.citations === "fail" ? "fail" : "repair";
+		if (audit.onFound !== wantCitationOnFound) throw new ConfigError(`orchestrate semanticAcceptance.citations '${String(shaped.citations)}' requires citationAudit.onFound '${wantCitationOnFound}', declared; got ` + JSON.stringify(audit.onFound));
+		if (shaped.waiver === "forbid" && boundClaim.waiver !== void 0) throw new ConfigError("orchestrate semanticAcceptance.waiver 'forbid' refuses a declared claimConsistency.waiver: a standing exception cannot ride a declaration that forbids exceptions");
+		if (pinnedWaiver !== void 0 && boundClaim.waiver === void 0) throw new ConfigError("orchestrate semanticAcceptance.waiver pins a hash but claimConsistency.waiver is absent: the pin licenses a DECLARED waiver (principal and reason), so declare the waiver it pins");
+	}
 	const spec = opts.budget;
 	if (spec === void 0) return;
 	if (spec.capUsd !== void 0) requireNonNegativeNumber(spec.capUsd, "orchestrate budget.capUsd");
@@ -25734,13 +26255,16 @@ function makeOrchestratorWorkflow(goal, opts) {
 				}
 				const repairsUsed = known.filter((candidate, index) => index >= validationInvocationStart && candidate.verdict !== "accepted" && contractGenerationCurrent(candidate)).length;
 				const rejectedCandidate = failed.length > 0 && deterministicRepair?.outcome !== "accepted";
+				const persistence = validationSpec.candidatePersistence;
 				let candidateRef;
-				if (rejectedCandidate && validationSpec.retainRejectedCandidates === true) {
+				let bytesUnavailableReason;
+				if (rejectedCandidate && (validationSpec.retainRejectedCandidates === true || persistence === "transcript")) {
 					const ref = `${internals.runId}/finish-rejected/${call.id}`;
 					try {
 						await internals.transcripts.put(ref, new TextEncoder().encode(input.text), internals.lease);
 						candidateRef = ref;
 					} catch (writeFailed) {
+						if (persistence === "transcript") bytesUnavailableReason = "store-write-failed";
 						internals.events.emit({
 							type: "log",
 							level: "warn",
@@ -25751,7 +26275,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 							}
 						}, callingState.spanId);
 					}
-				}
+				} else if (rejectedCandidate && persistence === "hash-only") bytesUnavailableReason = "hash-only-persistence";
 				decision = {
 					decisionType: "orchestrator_finish_validation",
 					callId: call.id,
@@ -25769,8 +26293,17 @@ function makeOrchestratorWorkflow(goal, opts) {
 					...rejectedCandidate ? {
 						candidateHash: createHash("sha256").update(jcsSerialize(result), "utf8").digest("hex"),
 						candidateChars: input.text.length,
-						...candidateRef === void 0 ? {} : { candidateRef }
-					} : {}
+						...candidateRef === void 0 ? {} : { candidateRef },
+						...bytesUnavailableReason === void 0 ? {} : { bytesUnavailableReason }
+					} : {},
+					...persistence !== void 0 && !rejectedCandidate ? (() => {
+						const acceptedDoc = deterministicRepair?.outcome === "accepted" && patchedResult !== void 0 ? patchedResult : result;
+						const acceptedText = typeof acceptedDoc === "string" ? acceptedDoc : JSON.stringify(acceptedDoc);
+						return {
+							candidateHash: candidateHashOf(acceptedDoc),
+							candidateChars: acceptedText.length
+						};
+					})() : {}
 				};
 				await internals.replayer.appendSinglePhase({
 					scope: callingState.scope,
@@ -25920,6 +26453,21 @@ function makeOrchestratorWorkflow(goal, opts) {
 					failed
 				}, failed);
 			}
+			if (policy === "digest") {
+				const digestReasons = [];
+				const trimmed = text.trim();
+				const words = trimmed === "" ? 0 : trimmed.split(/\s+/).length;
+				if (text.split("\n").filter((line) => /^\s*(?:[-*+]|\d+[.)])\s+\S/u.test(line)).length === 0) digestReasons.push("the digest carries no evidence rows: use one list row per planned section, naming its claims and the evidence behind them");
+				if (words > 400) digestReasons.push(`the digest carries ${String(words)} words, over the ${String(400)} word ceiling: compress to the structural map; the composing invocation writes the prose`);
+				if (digestReasons.length === 0) return accept();
+				return reject({
+					error: "the coordination draft failed the digest policy; repair the draft and call finish again: the digest is the structural evidence map the composing invocation writes prose from",
+					reasons: digestReasons
+				}, [{
+					name: "digest-policy",
+					reasons: digestReasons
+				}]);
+			}
 			const reasons = [];
 			if (policy.minWords !== void 0) {
 				const trimmed = text.trim();
@@ -26382,6 +26930,27 @@ function makeOrchestratorWorkflow(goal, opts) {
 		*/
 		let carriedCitationFindings;
 		/**
+		* The uncovered citing sentences riding a coverage-armed round's
+		* prompt (RV4202): set exactly while such a round's composition
+		* dispatches, mirroring `carriedCitationFindings`, so every other
+		* synthesis prompt keeps its bytes.
+		*/
+		let carriedUncoveredSentences;
+		/**
+		* The last FINAL pass's uncovered citing sentences (RV4202),
+		* captured only under `coverageRepair` (the fold collects them
+		* only then): what the coverage-armed round carries, beside the
+		* uncapped count for the round's own log line.
+		*/
+		let lastFinalUncovered;
+		/**
+		* The one semantic round's dispatch facts (RV4202), set when a
+		* coverage-armed or merged round actually dispatched: the
+		* strict-final refusal past a spent round names the round it
+		* already consumed instead of implying none existed.
+		*/
+		let semanticRoundSpent;
+		/**
 		* The observed price of this run's own latest post draft claim
 		* judge pass (RV3701): the fallback sizing of the repair round's
 		* convergence hold when the host declared no `judge.estCost`. By
@@ -26546,8 +27115,13 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...spec.maxPoolPerPair === void 0 ? {} : { maxPoolPerPair: spec.maxPoolPerPair },
 				...spec.maxExcerptChars === void 0 ? {} : { maxExcerptChars: spec.maxExcerptChars },
 				...spec.critical === void 0 ? {} : { critical: spec.critical },
-				...spec.coverageTarget === void 0 ? {} : { targetCoverageShare: spec.coverageTarget }
+				...spec.coverageTarget === void 0 ? {} : { targetCoverageShare: spec.coverageTarget },
+				...spec.coverageRepair === true ? { reportUncovered: true } : {}
 			});
+			if (stage === "final" && spec.coverageRepair === true) lastFinalUncovered = {
+				sentences: fold.uncoveredSentences ?? [],
+				total: fold.uncoveredSentencesTotal ?? 0
+			};
 			const runFold = spec.runFacts === true ? pairRunFactClaims(draftText, {
 				text: `The run ${internals.runId} made ${String(factWires)} provider wire requests across ${String(poolChildren)} accepted children, with token totals ${String(factInput)} input and ${String(factOutput)} output (the run's own recorded execution facts; harness-observed, not production evidence). ${factRows.join(" ")}`,
 				ids: factIds,
@@ -26782,6 +27356,14 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const plan = resolveCitationAuditPlan(auditSpec);
 			const auditedHash = createHash("sha256").update(jcsSerialize(document ?? null), "utf8").digest("hex");
 			const rows = sampleCitationRows(typeof document === "string" ? document : JSON.stringify(document ?? null), plan, auditedHash).map((row) => {
+				if (plan.resolver === 2) {
+					const resolved = citationUnitExcerptOf(auditSpec.resolve, row);
+					return resolved === void 0 ? row : {
+						...row,
+						excerpt: resolved.excerpt,
+						unit: resolved.unit
+					};
+				}
 				const excerpt = citationExcerptOf(auditSpec.resolve, row, plan.window);
 				return excerpt === void 0 ? row : {
 					...row,
@@ -26815,7 +27397,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 				perSection,
 				auditedHash,
 				samplePerSection: plan.samplePerSection,
-				maxSampled: plan.maxSampled
+				maxSampled: plan.maxSampled,
+				...plan.resolver === 2 ? { resolverVersion: 2 } : {}
 			};
 			const onFound = auditSpec.onFound ?? "report";
 			if (judgeRows.length === 0) {
@@ -26826,20 +27409,26 @@ function makeOrchestratorWorkflow(goal, opts) {
 				citationFindingsFound = mechanical;
 				return;
 			}
-			const judgePrompt = ["You audit CITATIONS for entailment. Each row below carries one sentence from a composed document, the source location it cites, and the resolved text of the cited lines. Judge whether the cited text ENTAILS what the sentence claims about it: 'supported' when the lines carry the claimed meaning, 'partial' when they carry some of it but not the load-bearing part, 'unsupported' when they are about something else entirely, however plausible the sentence reads. Judge the MEANING, not the mechanics: the location resolving, or sharing words with the sentence, is not entailment. Answer with { verdicts: [{ row, verdict, reason }] }, one verdict per row, reason one short sentence.", `ROWS: ${JSON.stringify(judgeRows.map((row) => ({
-				row: row.row,
-				section: row.section,
-				sentence: row.sentence,
-				anchor: row.anchor,
-				excerpt: row.excerpt
-			})))}`].join("\n");
+			const judgePrompt = [
+				"You audit CITATIONS for entailment. Each row below carries one sentence from a composed document, the source location it cites, and the resolved text of the cited lines. Judge whether the cited text ENTAILS what the sentence claims about it: 'supported' when the lines carry the claimed meaning, 'partial' when they carry some of it but not the load-bearing part, 'unsupported' when they are about something else entirely, however plausible the sentence reads. Judge the MEANING, not the mechanics: the location resolving, or sharing words with the sentence, is not entailment. Answer with { verdicts: [{ row, verdict, reason }] }, one verdict per row, reason one short sentence.",
+				...plan.resolver === 2 ? ["Rows carrying a `clause` audit ONE anchor of a compound sentence: judge the excerpt against that clause, the claim this anchor was cited for, not against the sentence's other claims. The `unit` names the logical unit the excerpt covers; a truncated unit may end mid-thought, so judge what the lines DO carry."] : [],
+				`ROWS: ${JSON.stringify(judgeRows.map((row) => ({
+					row: row.row,
+					section: row.section,
+					sentence: row.sentence,
+					anchor: row.anchor,
+					...row.clause === void 0 ? {} : { clause: row.clause },
+					excerpt: row.excerpt,
+					...row.unit === void 0 ? {} : { unit: row.unit }
+				})))}`
+			].join("\n");
 			const auditJudgeState = { ...callingState };
 			if (orchestratorAccount !== void 0) auditJudgeState.budgetScope = orchestratorAccount;
 			auditJudgeState.phase = auditJudgeState.phase ?? "judge";
 			const judgeOpts = {
 				role: "synthesize",
 				result: "full",
-				label: pass === "round" ? "citation-entailment-judge-round" : "citation-entailment-judge",
+				label: pass === "round" ? `${CITATION_JUDGE_LABEL}-round` : CITATION_JUDGE_LABEL,
 				schema: CITATION_JUDGE_SCHEMA,
 				limits: auditSpec.judge?.limits ?? { maxTurns: 3 },
 				...auditSpec.judge?.model === void 0 ? {} : { model: auditSpec.judge.model },
@@ -26953,7 +27542,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				}
 			}, callingState.spanId);
 		};
-		const runSynthesis = async (draft, stagePhase = "composition") => {
+		const runSynthesis = async (draft, stagePhase = "composition", repairTrigger) => {
 			const spec = opts?.synthesis;
 			if (spec === void 0) return draft;
 			await recoveryDone;
@@ -27206,6 +27795,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...opts?.claimConsistency?.onFound !== "carry" && opts?.claimConsistency?.onFound !== "repair" || claimFindingsFound === void 0 || claimFindingsFound.length === 0 ? [] : ["CLAIM CONTRADICTIONS: the composed draft contradicts the settled child pool at these cited locations; resolve each one EXPLICITLY in the final result (say which reading holds and why) instead of keeping the inverted claim. " + JSON.stringify(claimFindingsFound)],
 				...opts?.claimConsistency?.onFound !== "carry" && opts?.claimConsistency?.onFound !== "repair" || claimFindingsFound === void 0 || claimFindingsFound.length === 0 ? [] : hostValidationLessons(),
 				...carriedCitationFindings === void 0 || carriedCitationFindings.length === 0 ? [] : ["CITATION AUDIT FINDINGS: these sampled citations were judged NOT entailed by their cited lines; for each, either fix the citation to the lines that actually carry the claim or rewrite the sentence to claim what the cited lines say, and keep every other sentence byte identical. " + JSON.stringify(carriedCitationFindings)],
+				...carriedUncoveredSentences === void 0 || carriedUncoveredSentences.length === 0 ? [] : ["UNCOVERED CLAIMS: these citing sentences could not be verified against the settled child pool (no pool reading covers their cited spans, or the only readings restate them verbatim); for each, either ground the claim in material the pool actually read (cite spans the children cited), or drop the unverifiable citation and state only what the pool carries, and keep every other sentence byte identical. " + JSON.stringify(carriedUncoveredSentences)],
 				...sectionalRoundContext === void 0 ? [] : [
 					`RETAINED FINAL: ${JSON.stringify(sectionalRoundContext.base)}`,
 					"SECTIONAL ROUND: the accepted document above is RETAINED; repair ONLY the sections owning the contradicted claims by calling finish({ sections: { \"<marker>\": \"<new section body>\" } }). Unchanged sections are spliced from the retained document byte for byte and the spliced whole is validated and judged. Target sections: " + JSON.stringify(sectionalRoundContext.targets) + ". Declared markers: " + JSON.stringify(sectionalRoundContext.sections) + ". Resubmit the full document as result only when a targeted repair is impossible.",
@@ -27312,6 +27902,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const heldReserveUsd = orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.synthesisReserveUsd ?? 0;
 			const synthesisState = { ...callingState };
 			synthesisState.phase = synthesisState.phase ?? stagePhase;
+			if (repairTrigger !== void 0) synthesisState.repairTrigger = repairTrigger;
 			if (orchestratorAccount !== void 0) {
 				synthesisState.budgetScope = orchestratorAccount;
 				internals.budget.releaseSynthesisReserve(orchestratorAccount);
@@ -27463,6 +28054,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 				"handles you waited on. Read those with ONE get_settled_child_results call;",
 				"never probe a handle with get_child_result to discover whether it settled."
 			] : [],
+			...validationSpec?.draftPolicy === "digest" ? [
+				"Your finish({ result }) draft is a DIGEST, not prose: a compact structural map",
+				"of the planned deliverable. One list row per planned section, each naming the",
+				"claims it will carry and the evidence behind them (citations, child findings).",
+				`Stay under ${String(400)} words; the composing invocation writes the prose from this map.`
+			] : [],
 			...finishValidationPromptLines(validationSpec, coordSectionalFinish ? "rejected-attempt" : void 0),
 			...acceptancePromptLines(opts?.acceptance)
 		];
@@ -27785,7 +28382,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 			hash: decision.candidateHash ?? "",
 			chars: decision.candidateChars ?? 0,
 			failed: decision.failed,
-			...decision.candidateRef === void 0 ? {} : { ref: decision.candidateRef }
+			...decision.candidateRef === void 0 ? {} : { ref: decision.candidateRef },
+			...decision.bytesUnavailableReason === void 0 ? {} : { bytesUnavailableReason: decision.bytesUnavailableReason }
 		}));
 		const enrichSynthesisFailure = (thrown, snapshot) => {
 			const passTruth = {
@@ -28057,14 +28655,141 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...decision.children === void 0 ? {} : { acceptanceChildren: decision.children }
 			});
 		}
+		const claimRepairArmed = (opts?.claimConsistency?.onFound ?? "report") === "repair";
+		const coverageRoundArmed = opts?.claimConsistency?.coverageRepair === true;
+		const mergedRoundArmed = claimRepairArmed && opts?.citationAudit?.onFound === "repair";
+		const jcsHashOf = (value) => createHash("sha256").update(jcsSerialize(value ?? null), "utf8").digest("hex");
+		/** One line naming what a round carried, for its death messages. */
+		const describeCarried = (round) => {
+			const parts = [];
+			if (round.carriedClaims.length > 0) parts.push(`${String(round.carriedClaims.length)} judged contradiction${round.carriedClaims.length === 1 ? "" : "s"}`);
+			if (round.carriedCitations.length > 0) parts.push(`${String(round.carriedCitations.length)} unsupported citation${round.carriedCitations.length === 1 ? "" : "s"}`);
+			if (round.uncovered.length > 0) parts.push(`${String(round.uncovered.length)} uncovered citing sentence${round.uncovered.length === 1 ? "" : "s"}`);
+			return parts.join(" and ");
+		};
+		/**
+		* The ONE bounded semantic round, shared (RV4202): dispatches the
+		* repair composition carrying whatever defect classes armed it
+		* (the judged claim contradictions fold from the live findings,
+		* the unsupported citations and the uncovered sentences ride the
+		* carried state), under the same two-leg budget bargain as the
+		* RV3307 round (the convergence hold funds the re-judging passes,
+		* the mechanical leg funds the round's own repair turn) and the
+		* same dispatch deaths, each naming everything it carried. Returns
+		* the repaired candidate; the CALL SITE re-runs the judges and
+		* rules on survivors, because which judges must re-rule differs by
+		* mode. The historical single-armed rounds keep their own blocks
+		* byte for byte.
+		*/
+		const dispatchSemanticRound = async (round) => {
+			const preRepairHash = jcsHashOf(synthesizedFinal);
+			const holdScope = orchestratorAccount ?? "run";
+			if (round.rejudgeHoldUsd > 0) internals.budget.commitConvergenceReserve(holdScope, round.rejudgeHoldUsd);
+			const mechanicalHoldUsd = validationSpec === void 0 ? 0 : validationSpec.estRepairCostUsd ?? lastMechanicalRepairCostUsd(internals.replayer.snapshot(), (servedBy, usage) => internals.priceUsd(servedBy, usage)) ?? 0;
+			if (mechanicalHoldUsd > 0) {
+				internals.budget.commitRepairReserve(holdScope, mechanicalHoldUsd);
+				releaseRepairLeg = () => {
+					releaseRepairLeg = void 0;
+					internals.budget.releaseRepairReserve(holdScope);
+				};
+			}
+			const roundPlan = validationSpec !== void 0 && typeof synthesizedFinal === "string" ? sectionalRoundPlan(synthesizedFinal, [
+				...round.carriedClaims.map((finding) => finding.draftExcerpt),
+				...round.carriedCitations.map((finding) => finding.sentence),
+				...round.uncovered
+			]) : void 0;
+			if (roundPlan !== void 0) {
+				sectionalRoundContext = {
+					base: synthesizedFinal,
+					...roundPlan
+				};
+				internals.events.emit({
+					type: "log",
+					level: "debug",
+					msg: "orchestrator sectional round armed",
+					data: {
+						targets: roundPlan.targets,
+						sections: roundPlan.sections.length
+					}
+				}, callingState.spanId);
+			}
+			if (round.carriedCitations.length > 0) carriedCitationFindings = round.carriedCitations;
+			if (round.uncovered.length > 0) carriedUncoveredSentences = round.uncovered;
+			try {
+				const repaired = await runSynthesis(result.output, "repair", round.trigger);
+				semanticRoundSpent = {
+					trigger: round.trigger,
+					preRepairHash
+				};
+				return repaired;
+			} catch (thrown) {
+				await journalSynthesisAdmissionDecline(thrown);
+				const hostRejection = (thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) ? thrown.data.source : void 0) === "orchestrator_finish_validation" ? thrown.data : void 0;
+				const carriedLine = describeCarried(round);
+				throw new FailRunError((hostRejection !== void 0 ? "the semantic repair round dispatched and its repaired candidate failed host validation " : "the semantic repair round could not dispatch ") + `(${thrown instanceof Error ? thrown.message.slice(0, 300) : String(thrown)}); ${carriedLine} stand unconsumed and a gate armed to repair must not pass silently`, { data: {
+					source: round.source,
+					...round.carriedClaims.length === 0 ? {} : { claimContradictions: round.carriedClaims },
+					...round.carriedCitations.length === 0 ? {} : { citationFindings: round.carriedCitations },
+					...round.uncovered.length === 0 ? {} : { uncoveredSentences: round.uncovered },
+					...claimConsistencyMeta === void 0 ? {} : { claimConsistencyMeta },
+					...citationAuditMeta === void 0 ? {} : { citationAuditMeta },
+					repairsUsed: hostRejection !== void 0 ? 1 : 0,
+					roundDispatched: hostRejection !== void 0,
+					preRepairHash,
+					...hostRejection === void 0 ? {} : { finishValidation: {
+						...hostRejection.callId === void 0 ? {} : { callId: hostRejection.callId },
+						...hostRejection.failed === void 0 ? {} : { failed: hostRejection.failed },
+						...hostRejection.repairsUsed === void 0 ? {} : { repairsUsed: hostRejection.repairsUsed },
+						...hostRejection.maxRepairs === void 0 ? {} : { maxRepairs: hostRejection.maxRepairs },
+						...hostRejection.candidateHash === void 0 ? {} : { candidateHash: hostRejection.candidateHash },
+						...hostRejection.candidateChars === void 0 ? {} : { candidateChars: hostRejection.candidateChars }
+					} },
+					...acceptanceSnapshot
+				} });
+			} finally {
+				carriedCitationFindings = void 0;
+				carriedUncoveredSentences = void 0;
+				sectionalRoundContext = void 0;
+				releaseRepairLeg = void 0;
+				if (mechanicalHoldUsd > 0) internals.budget.releaseRepairReserve(holdScope);
+				if (round.rejudgeHoldUsd > 0) internals.budget.releaseConvergenceReserve(holdScope);
+			}
+		};
+		/**
+		* The re-judging claim pass after a shared round (RV4202): the
+		* typed claim throws below the judge cannot know they fired inside
+		* the round, so the round context rides the same data, exactly the
+		* RV3701 wrap of the single-armed block.
+		*/
+		const rejudgeClaimsAfterRound = async (carried) => {
+			try {
+				await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+			} catch (thrown) {
+				if (thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) && thrown.data.source === "orchestrator_claim_consistency") throw new FailRunError(thrown.message, { data: {
+					...thrown.data,
+					...thrown.data.claimContradictions === void 0 ? { claimContradictions: carried } : {},
+					roundDispatched: true,
+					repairsUsed: 1,
+					...semanticRoundSpent === void 0 ? {} : { preRepairHash: semanticRoundSpent.preRepairHash }
+				} });
+				throw thrown;
+			}
+		};
+		const parallelJudges = claimStage !== "draft" && opts?.claimConsistency !== void 0 && opts?.citationAudit !== void 0 && !claimRepairArmed && !coverageRoundArmed && (opts.citationAudit.onFound ?? "report") !== "repair";
+		let parallelAuditRan = false;
 		if (claimStage !== "draft") {
 			claimConsistencyDraftMeta = claimStage === "both" ? claimConsistencyMeta : void 0;
-			await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
+			if (parallelJudges) {
+				const [claimSettled, auditSettled] = await Promise.allSettled([runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final"), runCitationAudit(synthesizedFinal, "first")]);
+				parallelAuditRan = true;
+				if (claimSettled.status === "rejected") throw claimSettled.reason;
+				if (auditSettled.status === "rejected") throw auditSettled.reason;
+			} else await runClaimConsistencyPass(synthesizedFinal, acceptanceSnapshot, "final");
 			if ((opts?.claimConsistency?.onFound ?? "report") === "repair" && claimConsistencyMeta !== void 0) {
 				claimConsistencyMeta.passes = 1;
 				claimConsistencyMeta.semanticRepairRounds = 0;
 			}
-			if ((opts?.claimConsistency?.onFound ?? "report") === "repair" && claimFindingsFound !== void 0 && claimFindingsFound.length > 0) {
+			if (claimRepairArmed && !mergedRoundArmed && !coverageRoundArmed && claimFindingsFound !== void 0 && claimFindingsFound.length > 0) {
 				const hashOfDocument = (value) => createHash("sha256").update(jcsSerialize(value ?? null), "utf8").digest("hex");
 				const preRepairHash = hashOfDocument(synthesizedFinal);
 				const carried = claimFindingsFound;
@@ -28096,7 +28821,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 					}, callingState.spanId);
 				}
 				try {
-					synthesizedFinal = await runSynthesis(result.output, "repair");
+					synthesizedFinal = await runSynthesis(result.output, "repair", "claim");
 				} catch (thrown) {
 					await journalSynthesisAdmissionDecline(thrown);
 					const hostRejection = thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) && thrown.data.source === "orchestrator_finish_validation" ? thrown.data : void 0;
@@ -28159,10 +28884,41 @@ function makeOrchestratorWorkflow(goal, opts) {
 					...acceptanceSnapshot
 				} });
 			}
+			if (claimRepairArmed && !mergedRoundArmed && coverageRoundArmed) {
+				const carriedClaims = claimFindingsFound ?? [];
+				const firstGrade = claimConsistencyMeta?.coverage;
+				const coverageDefect = (firstGrade ?? "full") !== "full";
+				if (carriedClaims.length > 0 || coverageDefect) {
+					synthesizedFinal = await dispatchSemanticRound({
+						carriedClaims,
+						carriedCitations: [],
+						uncovered: coverageDefect ? lastFinalUncovered?.sentences ?? [] : [],
+						trigger: carriedClaims.length > 0 && coverageDefect ? "combined" : carriedClaims.length > 0 ? "claim" : "coverage",
+						rejudgeHoldUsd: opts?.claimConsistency?.judge?.estCost ?? observedFinalJudgeCostUsd ?? 0,
+						source: "orchestrator_claim_consistency"
+					});
+					await rejudgeClaimsAfterRound(carriedClaims);
+					if (claimConsistencyMeta !== void 0) {
+						claimConsistencyMeta.passes = 2;
+						claimConsistencyMeta.firstPassFindings = carriedClaims.length;
+						if (firstGrade !== void 0) claimConsistencyMeta.firstPassCoverage = firstGrade;
+						claimConsistencyMeta.semanticRepairRounds = 1;
+					}
+					if (claimFindingsFound !== void 0 && claimFindingsFound.length > 0) throw new FailRunError(`the claim-consistency judge still found ${String(claimFindingsFound.length)} contradiction${claimFindingsFound.length === 1 ? "" : "s"} after the bounded repair round: the repaired composition keeps contradicting the settled pool`, { data: {
+						source: "orchestrator_claim_consistency",
+						claimContradictions: claimFindingsFound,
+						claimConsistencyMeta,
+						repairsUsed: 1,
+						...semanticRoundSpent === void 0 ? {} : { preRepairHash: semanticRoundSpent.preRepairHash },
+						repairedHash: jcsHashOf(synthesizedFinal),
+						...acceptanceSnapshot
+					} });
+				}
+			}
 		}
 		if (opts?.citationAudit !== void 0) {
 			const hashOfDocument = (value) => createHash("sha256").update(jcsSerialize(value ?? null), "utf8").digest("hex");
-			await runCitationAudit(synthesizedFinal, "first");
+			if (!parallelAuditRan) await runCitationAudit(synthesizedFinal, "first");
 			const auditOnFound = opts.citationAudit.onFound ?? "report";
 			const unsupportedOf = () => (citationFindingsFound ?? []).filter((finding) => finding.verdict === "unsupported");
 			const firstUnsupported = unsupportedOf();
@@ -28176,7 +28932,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				citationAuditMeta.passes = 1;
 				citationAuditMeta.citationRepairRounds = 0;
 			}
-			if (auditOnFound === "repair" && firstUnsupported.length > 0) {
+			if (auditOnFound === "repair" && !mergedRoundArmed && firstUnsupported.length > 0) {
 				const preRepairHash = hashOfDocument(synthesizedFinal);
 				const carried = firstUnsupported;
 				const auditConvergenceHoldUsd = opts.citationAudit.judge?.estCost ?? 0;
@@ -28208,7 +28964,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				}
 				carriedCitationFindings = carried;
 				try {
-					synthesizedFinal = await runSynthesis(result.output, "repair");
+					synthesizedFinal = await runSynthesis(result.output, "repair", "citation");
 				} catch (thrown) {
 					await journalSynthesisAdmissionDecline(thrown);
 					const auditHostRejection = (thrown instanceof FailRunError && typeof thrown.data === "object" && thrown.data !== null && !Array.isArray(thrown.data) ? thrown.data.source : void 0) === "orchestrator_finish_validation" ? thrown.data : void 0;
@@ -28246,6 +29002,56 @@ function makeOrchestratorWorkflow(goal, opts) {
 					...acceptanceSnapshot
 				} });
 			}
+			if (mergedRoundArmed) {
+				const carriedClaims = claimFindingsFound ?? [];
+				const carriedCitations = firstUnsupported;
+				const firstGrade = claimConsistencyMeta?.coverage;
+				const coverageDefect = coverageRoundArmed && (firstGrade ?? "full") !== "full";
+				const defectClasses = (carriedClaims.length > 0 ? 1 : 0) + (carriedCitations.length > 0 ? 1 : 0) + (coverageDefect ? 1 : 0);
+				if (defectClasses > 0) {
+					synthesizedFinal = await dispatchSemanticRound({
+						carriedClaims,
+						carriedCitations,
+						uncovered: coverageDefect ? lastFinalUncovered?.sentences ?? [] : [],
+						trigger: defectClasses > 1 ? "combined" : carriedClaims.length > 0 ? "claim" : carriedCitations.length > 0 ? "citation" : "coverage",
+						rejudgeHoldUsd: (opts?.claimConsistency?.judge?.estCost ?? observedFinalJudgeCostUsd ?? 0) + (opts.citationAudit.judge?.estCost ?? 0),
+						source: carriedClaims.length > 0 || coverageDefect ? "orchestrator_claim_consistency" : "orchestrator_citation_audit"
+					});
+					await rejudgeClaimsAfterRound(carriedClaims);
+					if (claimConsistencyMeta !== void 0) {
+						claimConsistencyMeta.passes = 2;
+						claimConsistencyMeta.firstPassFindings = carriedClaims.length;
+						if (coverageRoundArmed && firstGrade !== void 0) claimConsistencyMeta.firstPassCoverage = firstGrade;
+						claimConsistencyMeta.semanticRepairRounds = 1;
+					}
+					await runCitationAudit(synthesizedFinal, "round");
+					if (citationAuditMeta !== void 0) {
+						citationAuditMeta.passes = 2;
+						citationAuditMeta.firstPassFindings = carriedCitations.length;
+						citationAuditMeta.citationRepairRounds = 1;
+					}
+					if (claimFindingsFound !== void 0 && claimFindingsFound.length > 0) throw new FailRunError(`the claim-consistency judge still found ${String(claimFindingsFound.length)} contradiction${claimFindingsFound.length === 1 ? "" : "s"} after the bounded repair round: the repaired composition keeps contradicting the settled pool`, { data: {
+						source: "orchestrator_claim_consistency",
+						claimContradictions: claimFindingsFound,
+						claimConsistencyMeta,
+						...citationAuditMeta === void 0 ? {} : { citationAuditMeta },
+						repairsUsed: 1,
+						...semanticRoundSpent === void 0 ? {} : { preRepairHash: semanticRoundSpent.preRepairHash },
+						repairedHash: hashOfDocument(synthesizedFinal),
+						...acceptanceSnapshot
+					} });
+					const mergedSurvivors = unsupportedOf();
+					if (mergedSurvivors.length > 0) throw new FailRunError(`the citation audit still judged ${String(mergedSurvivors.length)} sampled citation${mergedSurvivors.length === 1 ? "" : "s"} UNSUPPORTED after the bounded repair round: the repaired document keeps citing lines that do not carry its claims`, { data: {
+						source: "orchestrator_citation_audit",
+						citationFindings: citationFindingsFound,
+						citationAuditMeta,
+						repairsUsed: 1,
+						...semanticRoundSpent === void 0 ? {} : { preRepairHash: semanticRoundSpent.preRepairHash },
+						repairedHash: hashOfDocument(synthesizedFinal),
+						...acceptanceSnapshot
+					} });
+				}
+			}
 		}
 		const envelopeSchemaRecovered = (result.schemaRecoveredTerminalExchanges ?? 0) + synthesisSchemaRecoveredExchanges;
 		const deliverable = deliverableVerdict(synthesizedFinal);
@@ -28274,36 +29080,95 @@ function makeOrchestratorWorkflow(goal, opts) {
 		if (opts?.claimConsistency?.coveragePolicy === "strict-final") {
 			const grade = claimConsistencyMeta?.coverage ?? "not-judged";
 			if (grade !== "full") {
-				const waiverSpec = opts.claimConsistency.waiver;
-				const expired = waiverSpec?.expiresAt !== void 0 && Date.parse(waiverSpec.expiresAt) < internals.now();
-				if (waiverSpec === void 0 || expired) throw new FailRunError(`claimConsistency.coveragePolicy 'strict-final': the final coverage grade is '${grade}', not 'full', and ` + (waiverSpec === void 0 ? "no waiver is declared" : `the declared waiver expired at ${String(waiverSpec.expiresAt)}`) + "; raise the coverage (pairs, targets, critical anchors) or record a waiver naming who accepts the gap and why", { data: {
+				const acceptanceWaiver = opts?.semanticAcceptance?.waiver;
+				const pinnedJudgedHash = typeof acceptanceWaiver === "object" ? acceptanceWaiver.judgedHash : void 0;
+				const priorWaiveDecision = internals.replayer.snapshot().find((entry) => {
+					if (entry.kind !== "decision" || entry.scope !== callingState.scope) return false;
+					const value = entry.value;
+					if (value?.decisionType !== "claim_coverage_waived") return false;
+					if (pinnedJudgedHash !== void 0) return value.judgedHash === pinnedJudgedHash && value.judgedHash === claimConsistencyMeta?.judgedHash;
+					return value.judgedHash === void 0 || value.judgedHash === claimConsistencyMeta?.judgedHash;
+				});
+				if (acceptanceWaiver === "forbid") throw new FailRunError(`semanticAcceptance.waiver 'forbid': the final coverage grade is '${grade}', not 'full', and the declared acceptance admits no waiver` + (priorWaiveDecision === void 0 ? "" : `; a journaled claim_coverage_waived decision (seq ${String(priorWaiveDecision.seq)}) exists under a config that forbids waivers, which is a config/journal mismatch, not an authority`) + "; raise the coverage (pairs, targets, critical anchors) or ship a clean document", { data: {
 					source: "orchestrator_claim_consistency",
 					coveragePolicy: "strict-final",
 					coverage: grade,
-					...waiverSpec === void 0 ? {} : { waiverExpiredAt: waiverSpec.expiresAt ?? null },
+					semanticAcceptanceWaiver: "forbid",
+					...priorWaiveDecision === void 0 ? {} : { conflictingWaiveDecisionRef: priorWaiveDecision.seq },
+					...semanticRoundSpent === void 0 ? {} : {
+						repairsUsed: 1,
+						roundTrigger: semanticRoundSpent.trigger,
+						preRepairHash: semanticRoundSpent.preRepairHash
+					},
 					...claimConsistencyMeta === void 0 ? {} : { claimConsistencyMeta }
 				} });
-				claimCoverageWaiver = {
-					principal: waiverSpec.principal,
-					reason: waiverSpec.reason,
-					...waiverSpec.expiresAt === void 0 ? {} : { expiresAt: waiverSpec.expiresAt },
-					coverage: grade
-				};
-				await internals.replayer.appendSinglePhase({
-					scope: callingState.scope,
-					key: deriverV2.deriveKey({ kind: "claim-coverage-waived" }),
-					kind: "decision",
-					status: "ok",
-					spanId: internals.spans.mint(callingState.spanId),
-					site: "orchestrator-claim-coverage",
-					value: {
-						decisionType: "claim_coverage_waived",
-						...claimCoverageWaiver,
-						...claimConsistencyMeta?.judgedHash === void 0 ? {} : { judgedHash: claimConsistencyMeta.judgedHash }
-					}
-				});
+				if (priorWaiveDecision !== void 0) {
+					const frozen = priorWaiveDecision.value;
+					claimCoverageWaiver = {
+						principal: frozen.principal,
+						reason: frozen.reason,
+						...frozen.expiresAt === void 0 ? {} : { expiresAt: frozen.expiresAt },
+						coverage: frozen.coverage
+					};
+				} else {
+					const waiverSpec = opts.claimConsistency.waiver;
+					const expired = waiverSpec?.expiresAt !== void 0 && Date.parse(waiverSpec.expiresAt) < internals.now();
+					const pinMismatch = pinnedJudgedHash !== void 0 && claimConsistencyMeta?.judgedHash !== pinnedJudgedHash;
+					if (waiverSpec === void 0 || expired || pinMismatch) throw new FailRunError(`claimConsistency.coveragePolicy 'strict-final': the final coverage grade is '${grade}', not 'full', and ` + (waiverSpec === void 0 ? "no waiver is declared" : expired ? `the declared waiver expired at ${String(waiverSpec.expiresAt)}` : `the declared waiver is pinned to judgedHash ${String(pinnedJudgedHash)} and this run judged ${String(claimConsistencyMeta?.judgedHash)}, a different document`) + "; raise the coverage (pairs, targets, critical anchors) or record a waiver naming who accepts the gap and why", { data: {
+						source: "orchestrator_claim_consistency",
+						coveragePolicy: "strict-final",
+						coverage: grade,
+						...waiverSpec === void 0 || !expired ? {} : { waiverExpiredAt: waiverSpec.expiresAt ?? null },
+						...pinMismatch ? {
+							waiverPinnedHash: pinnedJudgedHash,
+							...claimConsistencyMeta?.judgedHash === void 0 ? {} : { judgedHash: claimConsistencyMeta.judgedHash }
+						} : {},
+						...semanticRoundSpent === void 0 ? {} : {
+							repairsUsed: 1,
+							roundTrigger: semanticRoundSpent.trigger,
+							preRepairHash: semanticRoundSpent.preRepairHash
+						},
+						...claimConsistencyMeta === void 0 ? {} : { claimConsistencyMeta }
+					} });
+					claimCoverageWaiver = {
+						principal: waiverSpec.principal,
+						reason: waiverSpec.reason,
+						...waiverSpec.expiresAt === void 0 ? {} : { expiresAt: waiverSpec.expiresAt },
+						coverage: grade
+					};
+					await internals.replayer.appendSinglePhase({
+						scope: callingState.scope,
+						key: deriverV2.deriveKey({ kind: "claim-coverage-waived" }),
+						kind: "decision",
+						status: "ok",
+						spanId: internals.spans.mint(callingState.spanId),
+						site: "orchestrator-claim-coverage",
+						value: {
+							decisionType: "claim_coverage_waived",
+							...claimCoverageWaiver,
+							...claimConsistencyMeta?.judgedHash === void 0 ? {} : { judgedHash: claimConsistencyMeta.judgedHash }
+						}
+					});
+				}
 			}
 		}
+		if (opts?.semanticAcceptance !== void 0) {
+			const shippedHash = draftToFinal?.finalHash ?? jcsHashOf(synthesizedFinal);
+			const staleClaim = claimConsistencyMeta !== void 0 && claimConsistencyMeta.judgedHash !== shippedHash;
+			const staleAudit = citationAuditMeta !== void 0 && citationAuditMeta.auditedHash !== shippedHash;
+			if (staleClaim || staleAudit) throw new FailRunError("semanticAcceptance invariant violated: a terminal verdict describes a document other than the one shipping (" + (staleClaim ? `claim judgedHash ${String(claimConsistencyMeta?.judgedHash)}` : `audit auditedHash ${String(citationAuditMeta?.auditedHash)}`) + ` against shipped ${shippedHash}); this is an engine invariant, not a host error`, { data: {
+				source: "orchestrator_claim_consistency",
+				shippedHash,
+				...claimConsistencyMeta === void 0 ? {} : { judgedHash: claimConsistencyMeta.judgedHash },
+				...citationAuditMeta === void 0 ? {} : { auditedHash: citationAuditMeta.auditedHash }
+			} });
+		}
+		const semanticTerminalVerdict = opts?.claimConsistency !== void 0 || opts?.citationAudit !== void 0 ? semanticTerminalVerdictOf({
+			...claimConsistencyMeta === void 0 ? {} : { claimConsistencyMeta },
+			...citationAuditMeta === void 0 ? {} : { citationAuditMeta },
+			...claimCoverageWaiver === void 0 ? {} : { claimCoverageWaiver },
+			...draftToFinal === void 0 ? {} : { draftToFinal }
+		}) : void 0;
 		return {
 			result: synthesizedFinal,
 			completion: decision.completion,
@@ -28318,6 +29183,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				...citationFindingsFound === void 0 ? {} : { citationFindings: citationFindingsFound },
 				citationAuditMeta
 			},
+			...semanticTerminalVerdict === void 0 ? {} : { semanticTerminalVerdict },
 			childStatusCounts: decision.childStatusCounts,
 			degradedReasons: decision.degradedReasons,
 			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
@@ -30030,17 +30896,25 @@ function parseDeadlineAt(value) {
 const SCOPE_FIELDS = [
 	"tenant",
 	"account",
-	"project"
+	"project",
+	"legalDomain",
+	"region",
+	"providerAccount"
 ];
 /**
 * Validates and copies a declared scope (RV4007): own properties only
 * (the RV1205 doctrine: a prototype member must never resolve),
 * non-empty strings of at most 256 chars, at least one field, and the
 * copy is what gets recorded, so later host mutation of the passed
-* object cannot move the recorded identity.
+* object cannot move the recorded identity. Under
+* `policy.unknown: 'reject'` (RV4205) an own enumerable field outside
+* the named dimensions refuses typed by name instead of dropping.
 */
-function normalizeExecutionScope(value, site) {
+function normalizeExecutionScope(value, site, policy) {
 	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new ConfigError(`${site} must be an object; got ${JSON.stringify(value)}`);
+	if (policy?.unknown === "reject") {
+		for (const key of Object.keys(value)) if (!SCOPE_FIELDS.includes(key)) throw new ConfigError(`${site}.${key} is not a scope dimension (scopePolicy.unknown 'reject'): the named dimensions are ${SCOPE_FIELDS.join(", ")}; a field the engine cannot record is a field nothing downstream can bind`);
+	}
 	const copy = {};
 	for (const field of SCOPE_FIELDS) {
 		if (!Object.hasOwn(value, field)) continue;
@@ -30048,13 +30922,23 @@ function normalizeExecutionScope(value, site) {
 		if (typeof declared !== "string" || declared.length === 0 || declared.length > 256) throw new ConfigError(`${site}.${field} must be a non-empty string of at most 256 characters; got ` + JSON.stringify(declared));
 		copy[field] = declared;
 	}
-	if (Object.keys(copy).length === 0) throw new ConfigError(`${site} must declare at least one of tenant, account, project; an empty scope records nothing and asserts nothing`);
+	if (Object.keys(copy).length === 0) throw new ConfigError(`${site} must declare at least one of ${SCOPE_FIELDS.join(", ")}; an empty scope records nothing and asserts nothing`);
 	return copy;
 }
 /** The canonical identity string of a scope (RV4007): JCS bytes, total and deterministic. */
 function executionScopeKey(scope) {
 	return jcsSerialize(scope);
 }
+/**
+* The canonical digest of a scope (RV4205): sha256 over the JCS bytes
+* of the NORMALIZED scope, a fixed-length identity for causal records
+* (the genesis decision, the invoice header) and external joins, so a
+* FinOps pipeline correlates runs by one column instead of comparing
+* structured objects field by field.
+*/
+function executionScopeDigest(scope) {
+	return createHash("sha256").update(executionScopeKey(scope), "utf8").digest("hex");
+}
 /** Validates a declared config fingerprint (RV3210): a non-empty string of at most 512 chars. */
 function requireConfigFingerprint(value, site) {
 	if (typeof value !== "string" || value.length === 0 || value.length > 512) throw new ConfigError(`${site} must be a non-empty string of at most 512 characters; got ` + (typeof value === "string" ? `${String(value.length)} characters` : JSON.stringify(value)));
@@ -30171,6 +31055,8 @@ function liftRunCompletion(candidate) {
 	}
 	const metaCandidate = candidate.claimConsistencyMeta;
 	if (typeof metaCandidate === "object" && metaCandidate !== null && !Array.isArray(metaCandidate)) lifted.claimConsistencyMeta = { ...metaCandidate };
+	const verdictCandidate = candidate.semanticTerminalVerdict;
+	if (typeof verdictCandidate === "object" && verdictCandidate !== null && !Array.isArray(verdictCandidate)) lifted.semanticTerminalVerdict = { ...verdictCandidate };
 	const findingsCandidate = candidate.claimContradictions;
 	if (Array.isArray(findingsCandidate) && findingsCandidate.every((row) => typeof row === "object" && row !== null && !Array.isArray(row) && typeof row.reason === "string")) lifted.claimContradictions = findingsCandidate.map((row) => ({ ...row }));
 	const skippedCandidate = candidate.synthesisSkipped;
@@ -30347,6 +31233,7 @@ function createEngine(options) {
 	const quotaRuntime = options.quota === void 0 ? void 0 : {
 		limiter: options.quota.limiter,
 		...options.quota.tenant === void 0 ? {} : { tenant: options.quota.tenant },
+		...options.quota.tenantFrom === void 0 ? {} : { tenantFrom: options.quota.tenantFrom },
 		onLimiterError: options.quota.onLimiterError ?? "deny",
 		reserveContinuations: options.quota.reserveContinuations ?? false,
 		maxDenials: options.quota.maxDenials ?? 8,
@@ -30376,7 +31263,8 @@ function createEngine(options) {
 		if (opts?.clampTurnToExposure !== void 0 && typeof opts.clampTurnToExposure !== "boolean") throw new ConfigError("RunOptions.clampTurnToExposure must be a boolean; got " + JSON.stringify(opts.clampTurnToExposure));
 		if (opts?.strictPricing !== void 0 && typeof opts.strictPricing !== "boolean" && (typeof opts.strictPricing !== "object" || opts.strictPricing === null || Array.isArray(opts.strictPricing))) throw new ConfigError("RunOptions.strictPricing must be a boolean or an options object; got " + JSON.stringify(opts.strictPricing));
 		if (opts?.budgetPolicy !== void 0 && opts.budgetPolicy !== "segment" && opts.budgetPolicy !== "immutable-lifetime") throw new ConfigError("RunOptions.budgetPolicy must be 'segment' or 'immutable-lifetime'; got " + JSON.stringify(opts.budgetPolicy));
-		const declaredScope = opts?.scope === void 0 ? void 0 : normalizeExecutionScope(opts.scope, "RunOptions.scope");
+		if (opts?.scopePolicy !== void 0 && opts.scopePolicy.unknown !== void 0 && opts.scopePolicy.unknown !== "drop" && opts.scopePolicy.unknown !== "reject") throw new ConfigError("RunOptions.scopePolicy.unknown must be 'drop' or 'reject'; got " + JSON.stringify(opts.scopePolicy.unknown));
+		const declaredScope = opts?.scope === void 0 ? void 0 : normalizeExecutionScope(opts.scope, "RunOptions.scope", opts.scopePolicy);
 		if (opts?.limits !== void 0) validateUsageLimits(opts.limits, "RunOptions.limits");
 		const deadlineAtMs = opts?.deadlineAt === void 0 ? void 0 : parseDeadlineAt(opts.deadlineAt);
 		const compiled = wf.kind === "compiled-workflow" ? wf : void 0;
@@ -30540,6 +31428,7 @@ function createEngine(options) {
 				...defaults.toolsets === void 0 ? {} : { toolsets: defaults.toolsets },
 				...defaults.gates === void 0 ? {} : { gates: defaults.gates },
 				...defaults.countTokens === void 0 ? {} : { countTokens: defaults.countTokens },
+				...defaults.requireToolsetAttestation === void 0 ? {} : { requireToolsetAttestation: defaults.requireToolsetAttestation },
 				...defaults.cache === void 0 ? {} : { cache: defaults.cache },
 				...defaults.billingReceipts === void 0 ? {} : { billingReceipts: defaults.billingReceipts }
 			},
@@ -30565,6 +31454,7 @@ function createEngine(options) {
 			runSignal: controller.signal,
 			...defaults.isolation === void 0 ? {} : { isolation: defaults.isolation },
 			...options.executors === void 0 ? {} : { executors: options.executors },
+			...executionScope === void 0 ? {} : { executionScope },
 			...execKey === void 0 ? {} : { execKey },
 			...options.onEscalation === void 0 ? {} : { onEscalation: options.onEscalation },
 			external,
@@ -30698,7 +31588,8 @@ function createEngine(options) {
 				site: "execution-scope",
 				value: {
 					decisionType: "execution_scope",
-					scope: executionScope
+					scope: executionScope,
+					scopeDigest: executionScopeDigest(executionScope)
 				}
 			});
 			if (resumeCtx?.acknowledgedOpenWireIntents !== void 0 && resumeCtx.acknowledgedOpenWireIntents > 0 && resumeCtx.strict !== true) await replayer.appendSinglePhase({
@@ -30848,6 +31739,7 @@ function createEngine(options) {
 				if (lifted.acceptanceChildren !== void 0) outcomeFacts.acceptanceChildren = lifted.acceptanceChildren;
 				if (lifted.semanticPasses !== void 0) outcomeFacts.semanticPasses = lifted.semanticPasses;
 				if (lifted.claimConsistencyMeta !== void 0) outcomeFacts.claimConsistencyMeta = lifted.claimConsistencyMeta;
+				if (lifted.semanticTerminalVerdict !== void 0) outcomeFacts.semanticTerminalVerdict = lifted.semanticTerminalVerdict;
 				if (lifted.claimContradictions !== void 0) outcomeFacts.claimContradictions = lifted.claimContradictions;
 				if (lifted.synthesisSkipped !== void 0) outcomeFacts.synthesisSkipped = lifted.synthesisSkipped;
 				if (lifted.deliverableAccepted !== void 0) outcomeFacts.deliverableAccepted = lifted.deliverableAccepted;
@@ -31292,16 +32184,139 @@ function createEngine(options) {
 * no strategy enum and no behavioral branch; a host that wants the
 * posture applies the compiled options like any others. The floor
 * binds what flows through CreateEngineOptions / RunOptions /
-* OrchestrateOptions; construction-side postures the options cannot
-* see (MCP source `drift: 'refuse'` and bounds, the AI SDK bridge's
-* `providerExecutedTools: 'deny'`) are named in the docs checklist
-* beside this function, because a hash must not imply what it cannot
-* verify.
-*/
-const REGULATED_VERSION = 1;
+* OrchestrateOptions, and since RV4101 it also walks the
+* CONSTRUCTIONS those options reach (adapters, tool sources in named
+* toolsets and profiles). A construction exposing
+* `describeRegulatedPosture()` has its posture judged by field name
+* (an MCP source's drift must be 'refuse' with every discovery bound
+* declared; the AI SDK bridge must keep providerExecutedTools
+* 'deny'), the sorted descriptors enter the hashed map under
+* `construction`, and constructions exposing nothing are COUNTED
+* there as `unrecognized`, so the hash names its own blind spot
+* instead of implying totality (the RV4009 rule "a hash must not
+* imply what it cannot verify", now with the verifiable part
+* verified). The between-compile-and-use window is held as well
+* (RV4102): the compiled options carry re-asserting wrappers whose
+* risk seams re-judge the descriptor on every use, and the
+* cross-process half was always held by the RV3210 fingerprint
+* assertion.
+*/
+const REGULATED_VERSION = 3;
 function refuse(field, requirement) {
 	throw new ConfigError(`compileRegulatedProfile: ${field} ${requirement}; the regulated floor is non-loosenable, so drop the field to inherit the floor or meet it explicitly`);
 }
+/**
+* Judges one construction's descriptor against the floor (RV4101) and
+* returns the normalized shape that enters the hashed posture map.
+* Shared by the compile walk and the use-time re-assertion (RV4102),
+* so a posture that loosens AFTER compile refuses with the same
+* field-named error it would have refused with at compile time.
+*/
+function judgeDescriptor(raw) {
+	const descriptor = raw;
+	if (descriptor === null || typeof descriptor !== "object" || descriptor.regulatedPosture !== 1 || typeof descriptor.name !== "string" || descriptor.name === "") refuse("construction", "exposes describeRegulatedPosture() with an unrecognized shape (need regulatedPosture: 1, a non-empty string name, and a known kind)");
+	if (descriptor.kind === "mcp-source") {
+		const mcpPosture = descriptor;
+		if (mcpPosture.drift !== "refuse") refuse(`construction['${descriptor.name}'].drift`, "must be 'refuse' (RV1516): under a rekey posture a listChanged notification imports a changed tool list beneath the regulated run");
+		const bounds = mcpPosture.bounds;
+		if (bounds === void 0 || bounds.declared !== true) refuse(`construction['${descriptor.name}'].bounds`, "must declare every discovery bound (maxTools, maxPages, maxSchemaBytes, timeouts.discoveryMs; RV1808): an unbounded sweep against a remote registry is an availability decision someone should have made on purpose");
+		return {
+			regulatedPosture: 1,
+			kind: "mcp-source",
+			name: descriptor.name,
+			drift: "refuse",
+			bounds: {
+				declared: true,
+				...typeof bounds.maxTools === "number" ? { maxTools: bounds.maxTools } : {},
+				...typeof bounds.maxPages === "number" ? { maxPages: bounds.maxPages } : {},
+				...typeof bounds.maxSchemaBytes === "number" ? { maxSchemaBytes: bounds.maxSchemaBytes } : {},
+				...typeof bounds.discoveryMs === "number" ? { discoveryMs: bounds.discoveryMs } : {}
+			}
+		};
+	}
+	if (descriptor.kind === "ai-sdk-bridge") {
+		if (descriptor.providerExecutedTools !== "deny") refuse(`construction['${descriptor.name}'].providerExecutedTools`, "must be 'deny': a provider-executed tool runs outside the permission chain and the journal");
+		return {
+			regulatedPosture: 1,
+			kind: "ai-sdk-bridge",
+			name: descriptor.name,
+			providerExecutedTools: "deny"
+		};
+	}
+	if (descriptor.kind === "model-adapter") {
+		const adapterPosture = descriptor;
+		if (adapterPosture.transport !== "official" && adapterPosture.transport !== "custom-base-url" && adapterPosture.transport !== "preconstructed-client") refuse(`construction['${descriptor.name}'].transport`, "must be 'official', 'custom-base-url' or 'preconstructed-client' (RV4204)");
+		if (adapterPosture.transport === "custom-base-url" && (typeof adapterPosture.baseUrlOrigin !== "string" || adapterPosture.baseUrlOrigin === "")) refuse(`construction['${descriptor.name}'].baseUrlOrigin`, "must name the override's origin under 'custom-base-url' (RV4204): an egress the hash cannot pin is an egress nobody attested");
+		return {
+			regulatedPosture: 1,
+			kind: "model-adapter",
+			name: descriptor.name,
+			transport: adapterPosture.transport,
+			...adapterPosture.transport === "custom-base-url" ? { baseUrlOrigin: adapterPosture.baseUrlOrigin } : {},
+			...adapterPosture.capsBound === void 0 ? {} : { capsBound: {
+				declared: adapterPosture.capsBound.declared === true,
+				...typeof adapterPosture.capsBound.maxPages === "number" ? { maxPages: adapterPosture.capsBound.maxPages } : {}
+			} }
+		};
+	}
+	if (descriptor.kind === "tool-executor") {
+		const executorPosture = descriptor;
+		if (executorPosture.ledger !== true) refuse(`construction['${descriptor.name}'].ledger`, "must be armed (RV4204): an effect no ledger records is an effect nobody can reconcile; construct the executor with a ToolEffectLedger");
+		const bounds = executorPosture.bounds;
+		if (bounds === void 0 || typeof bounds.timeoutMs !== "number" || typeof bounds.maxOutputBytes !== "number") refuse(`construction['${descriptor.name}'].bounds`, "must carry the resolved timeoutMs and maxOutputBytes ceilings (RV4204)");
+		const isolation = executorPosture.isolation;
+		if (isolation === void 0 || isolation.flavor !== "subprocess" && isolation.flavor !== "container") refuse(`construction['${descriptor.name}'].isolation`, "must name its flavor, 'subprocess' or 'container' (RV4204)");
+		const allowEnv = Array.isArray(executorPosture.allowEnv) ? executorPosture.allowEnv.filter((entry) => typeof entry === "string") : [];
+		return {
+			regulatedPosture: 1,
+			kind: "tool-executor",
+			name: descriptor.name,
+			ledger: true,
+			allowEnv,
+			bounds: {
+				timeoutMs: bounds.timeoutMs,
+				maxOutputBytes: bounds.maxOutputBytes
+			},
+			isolation: isolation.flavor === "subprocess" ? {
+				flavor: "subprocess",
+				sandboxed: isolation.sandboxed === true
+			} : {
+				flavor: "container",
+				network: String(isolation.network),
+				readOnlyRoot: isolation.readOnlyRoot === true
+			}
+		};
+	}
+	refuse(`construction['${descriptor.name}']`, `attests an unrecognized kind '${String(descriptor.kind)}'; this floor can judge 'mcp-source', 'ai-sdk-bridge', 'model-adapter' and 'tool-executor'`);
+}
+/**
+* The use-time re-assertion (RV4102, the RV1608 template). The
+* descriptor is a snapshot, and the window between compile and use is
+* where a construction mutated in-process could walk a moved posture
+* beneath the hash. The compiled options therefore carry this proxy
+* in the original's place: every use of the risk seam (`tools` on a
+* source, `stream` on an adapter) re-reads and re-judges the
+* descriptor first. A loosening refuses with the compile-time
+* field-named error; any other movement (a rename, a bound change, a
+* vanished descriptor) refuses naming the drift. Everything else
+* passes through untouched, so `close()`, `caps()`, and identity
+* fields behave exactly as before. The cross-process half of the
+* window needs no proxy: a mutated construction compiles to a
+* different profile hash, and the RV3210 resume assertion refuses it.
+*/
+function wrapReasserting(construction, frozen) {
+	const guard = (seam, original) => (...args) => {
+		const probe = construction.describeRegulatedPosture;
+		const fresh = typeof probe === "function" ? jcsSerialize(judgeDescriptor(probe.call(construction))) : void 0;
+		if (fresh !== frozen) throw new ConfigError(`compileRegulatedProfile: the construction posture moved between compile time and ${seam}() (RV4102): the compiled profile licensed ${frozen}, the construction now reports ${fresh ?? "no describeRegulatedPosture() at all"}. Recompile the profile deliberately instead of mutating a construction beneath it.`);
+		return original.apply(construction, args);
+	};
+	return new Proxy(construction, { get(target, prop) {
+		const value = Reflect.get(target, prop, target);
+		if ((prop === "tools" || prop === "stream" || prop === "run") && typeof value === "function") return guard(String(prop), value);
+		return value;
+	} });
+}
 function compileRegulatedProfile(input) {
 	const engine = {
 		...input.engine,
@@ -31324,44 +32339,164 @@ function compileRegulatedProfile(input) {
 	for (const [name, profile] of Object.entries(defaults.profiles ?? {})) {
 		if (profile.permissions?.strictApprovals === false) refuse(`defaults.profiles.${name}.permissions.strictApprovals`, "must not be false");
 		if (profile.tools !== void 0 && profile.toolsetAttestation === void 0) refuse(`defaults.profiles.${name}`, "declares tools without a toolsetAttestation (pin the resolved hashes)");
+		if (profile.toolsetAttestation !== void 0 && profile.toolsetAttestation.authorityHash === void 0) refuse(`defaults.profiles.${name}.toolsetAttestation`, "is a legacy contract-only pin (RV4204): authority drift (risk, needsApproval, executor, executorSpec) passes it silently; re-record the pin with attestToolset() so authorityHash rides it");
+	}
+	if (defaults.requireToolsetAttestation === false) refuse("defaults.requireToolsetAttestation", "must not be false (RV4204): a regulated spawn executes only pinned toolsets");
+	defaults.requireToolsetAttestation = true;
+	const walked = /* @__PURE__ */ new Set();
+	const attested = [];
+	const reasserted = /* @__PURE__ */ new Map();
+	let unrecognized = 0;
+	const unrecognizedNames = [];
+	const visit = (construction) => {
+		if (construction === null || typeof construction !== "object" || walked.has(construction)) return;
+		walked.add(construction);
+		const probe = construction.describeRegulatedPosture;
+		if (typeof probe !== "function") {
+			unrecognized += 1;
+			const id = construction.id;
+			unrecognizedNames.push(typeof id === "string" && id !== "" ? id : construction.constructor?.name ?? "anonymous");
+			return;
+		}
+		const judged = judgeDescriptor(probe.call(construction));
+		attested.push(judged);
+		reasserted.set(construction, wrapReasserting(construction, jcsSerialize(judged)));
+	};
+	for (const adapter of engine.adapters ?? []) visit(adapter);
+	const visitTools = (tools) => {
+		for (const entry of tools ?? []) {
+			if (typeof entry === "string" || entry.kind === "tool") continue;
+			visit(entry);
+		}
+	};
+	for (const toolset of Object.values(defaults.toolsets ?? {})) visitTools(toolset);
+	for (const profile of Object.values(defaults.profiles ?? {})) visitTools(profile.tools);
+	for (const executor of Object.values(engine.executors ?? {})) visit(executor);
+	visit(engine.runners?.sandbox);
+	if (input.construction === "require-recognized" && unrecognized > 0) refuse("construction", `must expose describeRegulatedPosture() on every construction under the 'require-recognized' floor (RV4204); ${String(unrecognized)} attested nothing: ` + unrecognizedNames.slice(0, 8).join(", "));
+	const swap = (value) => typeof value === "object" && value !== null && reasserted.has(value) ? reasserted.get(value) : value;
+	if (reasserted.size > 0) {
+		if (engine.adapters !== void 0) engine.adapters = engine.adapters.map(swap);
+		if (defaults.toolsets !== void 0) defaults.toolsets = Object.fromEntries(Object.entries(defaults.toolsets).map(([name, tools]) => [name, tools.map(swap)]));
+		if (defaults.profiles !== void 0) defaults.profiles = Object.fromEntries(Object.entries(defaults.profiles).map(([name, profile]) => [name, profile.tools === void 0 ? profile : {
+			...profile,
+			tools: profile.tools.map(swap)
+		}]));
+		if (engine.executors !== void 0) engine.executors = Object.fromEntries(Object.entries(engine.executors).map(([tag, executor]) => [tag, swap(executor)]));
+		if (engine.runners?.sandbox !== void 0) engine.runners = {
+			...engine.runners,
+			sandbox: swap(engine.runners.sandbox)
+		};
 	}
-	if (typeof run.budgetUsd !== "number") refuse("run.budgetUsd", "must declare a USD ceiling");
+	const postureKeyOf = (entry) => `${entry.kind} ${entry.name}`;
+	attested.sort((a, b) => postureKeyOf(a) < postureKeyOf(b) ? -1 : postureKeyOf(a) > postureKeyOf(b) ? 1 : 0);
+	if (typeof run.budgetUsd !== "number" || !Number.isFinite(run.budgetUsd) || run.budgetUsd <= 0) refuse("run.budgetUsd", "must declare a positive finite USD ceiling (RV4107): NaN and Infinity are not ceilings, and a non-positive one is a run that cannot pay for its own floor");
 	if (run.strictPricing === false) refuse("run.strictPricing", "must not be false");
 	run.strictPricing = run.strictPricing ?? true;
 	if (run.budgetPolicy !== void 0 && run.budgetPolicy !== "immutable-lifetime") refuse("run.budgetPolicy", "must be 'immutable-lifetime' (RV3902)");
 	run.budgetPolicy = "immutable-lifetime";
 	if (run.scope === void 0) refuse("run.scope", "must name the execution scope (RV4007): a regulated run has an owner");
+	if (run.scopePolicy?.unknown === "drop") refuse("run.scopePolicy.unknown", "must be 'reject' (RV4205): a silently dropped dimension is a dimension nothing downstream recorded or bound");
+	run.scopePolicy = { unknown: "reject" };
+	run.scope = normalizeExecutionScope(run.scope, "compileRegulatedProfile run.scope", run.scopePolicy);
 	if (orchestrate !== void 0) {
 		const budget = { ...orchestrate.budget ?? {} };
 		if (budget.acceptanceReserve !== void 0 && budget.acceptanceReserve !== "require") refuse("orchestrate.budget.acceptanceReserve", "must be 'require' (RV3907/RV4001)");
 		budget.acceptanceReserve = "require";
 		orchestrate.budget = budget;
 		if (orchestrate.citationAudit === void 0) refuse("orchestrate.citationAudit", "must be declared with the host snapshot resolver (RV4004): entailment is the regulated posture, not an option");
+		if (typeof orchestrate.citationAudit.resolve !== "function") refuse("orchestrate.citationAudit.resolve", "must be the host snapshot resolver function (RV4004/RV4107)");
+		if (orchestrate.claimConsistency === void 0) refuse("orchestrate.claimConsistency", "must be declared with stage 'final' or 'both' (RV4103): the claim machinery is the regulated posture, and omitting it entirely is the deepest loosening");
 		if (orchestrate.claimConsistency !== void 0) {
 			const claim = { ...orchestrate.claimConsistency };
 			if (claim.coveragePolicy !== void 0 && claim.coveragePolicy !== "strict-final") refuse("orchestrate.claimConsistency.coveragePolicy", "must be 'strict-final' (RV4003)");
 			if ((claim.stage ?? "draft") === "draft") refuse("orchestrate.claimConsistency.stage", "must be 'final' or 'both': the shipped document is what the pass must grade");
 			claim.coveragePolicy = "strict-final";
+			if (claim.onFound === "report" || claim.onFound === "carry") refuse("orchestrate.claimConsistency.onFound", "must be 'repair' or 'fail' (RV4201): the observing postures let a run settle accepted over what its own judge found");
+			claim.onFound = claim.onFound ?? "fail";
+			if (claim.coverageTarget !== void 0 && claim.coverageTarget !== 1) refuse("orchestrate.claimConsistency.coverageTarget", "must be 1 or absent (RV4201): the regulated acceptance requires the 'full' grade, and a pass sized to cover less than everything can never reach it");
+			if (claim.onFound === "repair") {
+				if (claim.coverageRepair === false) refuse("orchestrate.claimConsistency.coverageRepair", "must not be false beside onFound 'repair' (RV4201/RV4202): the one bounded round serves every armed defect class, coverage included");
+				claim.coverageRepair = true;
+			}
 			orchestrate.claimConsistency = claim;
+			const auditSpec = { ...orchestrate.citationAudit };
+			if (auditSpec.onFound === "report") refuse("orchestrate.citationAudit.onFound", "must be 'repair' or 'fail' (RV4201): 'report' let the sixth experiment settle accepted over five unsupported citations");
+			auditSpec.onFound = auditSpec.onFound ?? "fail";
+			orchestrate.citationAudit = auditSpec;
+			const declared = orchestrate.semanticAcceptance;
+			const declaredPin = declared !== void 0 && typeof declared.waiver === "object" ? declared.waiver.judgedHash : void 0;
+			if (claim.waiver !== void 0 && declaredPin === void 0) refuse("orchestrate.claimConsistency.waiver", "is a standing waiver (RV4201): regulated acceptance admits only the pinned-hash form; declare semanticAcceptance.waiver { judgedHash } naming the one reviewed document it licenses, or drop the waiver");
+			const wantContradictions = claim.onFound === "repair" ? "repair-once-then-fail" : "fail";
+			const wantCitations = auditSpec.onFound === "repair" ? "repair-once-then-fail" : "fail";
+			if (declared === void 0) orchestrate.semanticAcceptance = {
+				judgedStage: "final",
+				claimCoverage: "full",
+				contradictions: wantContradictions,
+				citations: wantCitations,
+				unresolved: "fail",
+				waiver: "forbid"
+			};
+			else {
+				if (declared.judgedStage !== "final" || declared.claimCoverage !== "full" || declared.unresolved !== "fail") refuse("orchestrate.semanticAcceptance", "must declare judgedStage 'final', claimCoverage 'full' and unresolved 'fail'");
+				if (declared.contradictions !== wantContradictions) refuse("orchestrate.semanticAcceptance.contradictions", `must be '${wantContradictions}' beside claimConsistency.onFound '${String(claim.onFound)}'`);
+				if (declared.citations !== wantCitations) refuse("orchestrate.semanticAcceptance.citations", `must be '${wantCitations}' beside citationAudit.onFound '${String(auditSpec.onFound)}'`);
+				if (declared.waiver !== "forbid" && declaredPin === void 0) refuse("orchestrate.semanticAcceptance.waiver", "must be 'forbid' or { judgedHash } (RV4201)");
+				if (declaredPin !== void 0 && claim.waiver === void 0) refuse("orchestrate.claimConsistency.waiver", "must be declared beside the pinned semanticAcceptance.waiver: the pin licenses a declared principal and reason");
+			}
 		}
 	}
+	const toolsetAttestations = Object.fromEntries(Object.entries(defaults.profiles ?? {}).flatMap(([name, profile]) => {
+		const pin = profile.toolsetAttestation;
+		if (pin === void 0) return [];
+		return [[name, {
+			hash: pin.hash,
+			...pin.authorityHash === void 0 ? {} : { authorityHash: pin.authorityHash }
+		}]];
+	}));
+	const semanticPosture = orchestrate === void 0 || orchestrate.claimConsistency === void 0 ? {} : {
+		acceptanceReserve: "require",
+		coveragePolicy: "strict-final",
+		claimStage: orchestrate.claimConsistency.stage,
+		claimOnFound: orchestrate.claimConsistency.onFound,
+		...orchestrate.claimConsistency.coverageRepair === true ? { claimCoverageRepair: true } : {},
+		...orchestrate.claimConsistency.coverageTarget === void 0 ? {} : { claimCoverageTarget: orchestrate.claimConsistency.coverageTarget },
+		...orchestrate.claimConsistency.judge === void 0 ? {} : { claimJudge: {
+			...orchestrate.claimConsistency.judge.model === void 0 ? {} : { model: orchestrate.claimConsistency.judge.model },
+			...orchestrate.claimConsistency.judge.effort === void 0 ? {} : { effort: orchestrate.claimConsistency.judge.effort }
+		} },
+		...orchestrate.claimConsistency.waiver === void 0 ? {} : { claimWaiver: orchestrate.claimConsistency.waiver },
+		...orchestrate.contradictions?.onFound === void 0 ? {} : { contradictionsOnFound: orchestrate.contradictions.onFound },
+		citationAudit: {
+			onFound: orchestrate.citationAudit?.onFound,
+			...orchestrate.citationAudit?.samplePerSection === void 0 ? {} : { samplePerSection: orchestrate.citationAudit.samplePerSection },
+			...orchestrate.citationAudit?.maxSampled === void 0 ? {} : { maxSampled: orchestrate.citationAudit.maxSampled },
+			...orchestrate.citationAudit?.window === void 0 ? {} : { window: orchestrate.citationAudit.window },
+			...orchestrate.citationAudit?.pattern === void 0 ? {} : { pattern: orchestrate.citationAudit.pattern },
+			...orchestrate.citationAudit?.judge === void 0 ? {} : { judge: {
+				...orchestrate.citationAudit.judge.model === void 0 ? {} : { model: orchestrate.citationAudit.judge.model },
+				...orchestrate.citationAudit.judge.effort === void 0 ? {} : { effort: orchestrate.citationAudit.judge.effort }
+			} }
+		},
+		semanticAcceptance: orchestrate.semanticAcceptance
+	};
 	const posture = {
 		regulated: REGULATED_VERSION,
 		strictApprovals: true,
 		billingReceipts: "intent",
 		determinism: "error",
+		construction: {
+			attested,
+			unrecognized,
+			...input.construction === void 0 ? {} : { floor: input.construction }
+		},
 		strictPricing: run.strictPricing === true ? true : run.strictPricing,
 		budgetPolicy: "immutable-lifetime",
 		budgetUsd: run.budgetUsd,
 		scope: run.scope,
-		...orchestrate === void 0 ? {} : {
-			acceptanceReserve: "require",
-			citationAudit: true,
-			...orchestrate.claimConsistency === void 0 ? {} : {
-				coveragePolicy: "strict-final",
-				claimStage: orchestrate.claimConsistency.stage
-			}
-		},
+		scopePolicy: "reject",
+		...Object.keys(toolsetAttestations).length === 0 ? {} : { toolsetAttestations },
+		...semanticPosture,
 		...run.configFingerprint === void 0 ? {} : { hostFingerprint: run.configFingerprint }
 	};
 	const profileHash = createHash("sha256").update(jcsSerialize(posture), "utf8").digest("hex");
@@ -31663,4 +32798,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CITATION_JUDGE_SCHEMA, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_EXCERPT_WINDOW, DEFAULT_CITATION_MAX_SAMPLED, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CITATION_SAMPLE_PER_SECTION, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CITATION_EXCERPT_CHARS, MAX_CITATION_EXCERPT_LINES, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, acceptanceJudgePasses, acceptanceTailRequiredUsd, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationExcerptOf, citationTargetsValidator, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileRegulatedProfile, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, executionScopeKey, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatAcceptanceTailTerms, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeExecutionScope, normalizeFallbacks, openWireIntentsOf, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseCitationVerdicts, parseModelRef, parseScopePath, parseTerminalEnvelope, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, repairLedgerFromJournal, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveCitationAuditPlan, resolveModelInvocation, resolvePricing, resolveToolset, retentionKeyOf, retryClassOf, retryDelayMs, retryWireMultiplier, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sampleCitationRows, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, wireCapacityEstimate, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CITATION_JUDGE_LABEL, CITATION_JUDGE_SCHEMA, CLAIM_JUDGE_LABEL, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DECISION_CHAIN_KINDS, DEFAULT_ANCHOR_PATTERN, DEFAULT_ARTIFACT_PATTERN, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_EXCERPT_WINDOW, DEFAULT_CITATION_MAX_SAMPLED, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_CITATION_SAMPLE_PER_SECTION, DEFAULT_CLAIM_JUDGE_MAX_TURNS, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_GRADE_PHRASES, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_CLAIM_PAIRS, DEFAULT_MAX_CONTRADICTIONS, DEFAULT_MAX_DEPTH, DEFAULT_MAX_EXCERPT_CHARS, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PAIR_EXCERPT_CHARS, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_POOL_PER_PAIR, DEFAULT_MAX_QUOTA_DENIALS, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_RUN_FACT_PAIRS, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DIGEST_DRAFT_MAX_WORDS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_AUTHORITY_HASH, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EXPOSURE_WAIT_SWEEP_MS, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINAL_COMPOSITION_LABEL, FINISH_LESSON_CAP_CHARS, FINISH_SCHEMA, FINISH_SECTIONAL_SCHEMA, FINISH_TOOL_NAME, FUTURE_RATES_TOLERANCE_MS, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GET_SETTLED_CHILD_RESULTS_SCHEMA, GET_SETTLED_CHILD_RESULTS_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IN_FLIGHT_EXPOSURE_REFUSAL_PREFIX, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalIntegrityError, JournalMatcher, JournalMissError, JournalOrderViolation, JournalSealedError, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_CITATION_EXCERPT_CHARS, MAX_CITATION_EXCERPT_LINES, MAX_CRITICAL_UNCOVERED, MAX_DEPTH_CEILING, MAX_RUN_FACTS_SHEET_CHARS, MAX_RUN_ID_LENGTH, MAX_TIMER_DELAY_MS, MAX_UNCOVERED_SENTENCES, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_FACTS_ANCHOR, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_ADMISSION_DECISION_TYPE, SPAWN_AGENT_SCHEMA, SYNTHESIS_NOTE_LABEL, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, SupersededError, TERMINAL_TELEMETRY_SCOPE, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, acceptanceJudgePasses, acceptanceTailRequiredUsd, accountSpendFromJournal, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, agentTypeBucket, applyClaimOps, applyFinishRepairHints, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, assertSafeRunId, atCompactionThreshold, attestToolset, attributionBucket, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, candidateHashOf, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, childRostersFromJournal, citationExcerptOf, citationJudgePassOf, citationTargetsValidator, citationUnitExcerptOf, citedValueValidator, claimCoverageOf, claimExpired, claimExpiry, claimIssues, claimJudgeStageOf, claimOpIssues, classifyAgentError, classifyAttemptOutcome, clauseAround, collectDeclaredLadders, compactMessages, compareRates, compilePermissionChain, compilePermissionPreset, compileRegulatedProfile, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, criticalPathFromJournal, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, enforceToolsetAttestation, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidenceGradeValidator, evidencePreservedValidator, executeWorkflow, executionFactsOf, executionScopeDigest, executionScopeKey, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, findContradictions, finishContract, foldLedger, foldTermination, formatAcceptanceTailTerms, formatCharacterValidator, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, insertRunIdIntoSentence, invoiceFromJournal, isClaimJudgeLabel, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastMechanicalRepairCostUsd, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, logicalRunTelemetry, makeOrchestratorWorkflow, manifestValidators, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeExecutionScope, normalizeFallbacks, openWireIntentsOf, orchestrate, orchestratorAdmissionEstCostUsd, pairDraftClaims, pairRunFactClaims, parallelScope, parseCitationVerdicts, parseModelRef, parseScopePath, parseTerminalEnvelope, persistedTerminalEnvelope, phiInitialOf, pilotAgentProfile, pipelineScope, planNodeScope, preflightEstimate, priceComponentsOf, priceEntryBilling, priceEntryUsage, priceUsdOf, productionAcceptable, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualRequestsDelta, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleKey, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reconcileStatement, reduceAuditTrail, reduceCriticalPath, reduceDecisionChain, reduceInvocationTable, registryKeyRing, remeasureQueue, renderContractRequirements, repairLedgerFromJournal, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredMentionsValidator, requiredSectionsValidator, researchAgentProfile, resolveCitationAuditPlan, resolveModelInvocation, resolvePricing, resolveToolset, retentionKeyOf, retryClassOf, retryDelayMs, retryWireMultiplier, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sampleCitationRows, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, scopeBucket, sectionCitationsValidator, sectionPatternCountValidator, sectionalRoundPlan, selectStructuredOutputTier, selfTestFinishValidation, semanticTerminalVerdictOf, shouldCompact, snapshotQuotaRules, snapshotUsage, spawnDepthOf, spliceSections, statementFromRows, statementRowsFromDelimited, stripFencedBlocks, sumUsage, summarizeInstruction, summarizeOutput, synthesisCandidatesFromJournal, synthesizeSpanClassOf, terminalEnvelopeOf, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolAuthority, toolCalibrationFromJournal, toolContract, toolContractHash, toolsetAuthorityHash, toolsetHash, ttlState, unionOfIntervalsMs, usageViolations, validateDetachedResolution, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateToolsetAttestation, validateUsageLimits, verifyCandidateBytes, wireCapacityEstimate, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };