@rulvar/core 1.35.0 → 1.37.0

package/dist/index.d.ts

@@ -28,7 +28,7 @@ type WireError = {
 * 'agent' is carried by the AgentError value projection, not by a
 * RulvarError subclass.
 */
-type ErrorCode = "agent" | "config" | "non_serializable_value" | "script_rejected" | "journal_compat" | "invalid_resolution" | "journal_order_violation" | "plan_invariant" | "replay_plan_hash_mismatch" | "orchestrator_cap_config" | "journal_miss" | "budget_exhausted" | "admission_rejected" | "sandbox_limit" | "lease_held" | "knowledge_cas";
+type ErrorCode = "agent" | "config" | "non_serializable_value" | "script_rejected" | "journal_compat" | "invalid_resolution" | "journal_order_violation" | "plan_invariant" | "replay_plan_hash_mismatch" | "orchestrator_cap_config" | "journal_miss" | "budget_exhausted" | "fail_run" | "admission_rejected" | "sandbox_limit" | "lease_held" | "knowledge_cas";
 /** An alias for the registry type; both names are public. */
 type RulvarErrorCode = ErrorCode;
 /**
@@ -191,6 +191,23 @@ declare class BudgetExhaustedError extends RulvarError {
   });
 }
 /**
+* A declared fail-run policy engaged and closed the run as a failure
+* (v1.35.0 review P2-1): `budget.atCap: 'fail-run'` after the journaled
+* orchestrator cap decision, or `guards.fallback: 'fail-run'` after the
+* journaled guard verdict. The run outcome is 'error' with this code;
+* `data.source` names the policy ('orchestrator_budget_cap' or
+* 'plan_guards') and `data` carries the decision entry reference, so the
+* outcome is a pure roll forward of the journal on resume: no second
+* decision, no model call, no spend.
+*/
+declare class FailRunError extends RulvarError {
+  readonly code = "fail_run";
+  constructor(message: string, opts?: {
+    data?: Json;
+    cause?: unknown;
+  });
+}
+/**
 * A structural admission rejection (maxDepth, maxChildrenPerNode,
 * maxTotalSpawns) from the AdmissionController (M6-T06). The rejection verdict is embedded in
 * the carrying spawn-admission decision entry and replays identically;
@@ -893,6 +910,14 @@ interface LeasableStore extends JournalStore {
   acquire(runId: string, owner: string): Promise<Lease>;
   renew(l: Lease): Promise<void>;
   release(l: Lease): Promise<void>;
+  /**
+  * Optional TTL introspection (v1.35.0 review P2-4): the configured
+  * lease ttl in milliseconds. A store exposing it lets createWorker
+  * VERIFY at construction that the worker's renew cadence matches the
+  * store's expiry instead of trusting two config sources to agree;
+  * stores without it are accepted with the worker's own ttl.
+  */
+  readonly leaseTtlMs?: number;
 }
 //#endregion
 //#region src/l0/spi/transcript.d.ts
@@ -1667,7 +1692,13 @@ declare function applyClaimOps(claims: readonly ModelClaim[], ops: readonly Clai
 interface FileModelKnowledgeStoreOptions {
   /** Default './rulvar.models.json'. */
   path?: string;
-  /** Active claims per (model, taskClass); default 8. */
+  /**
+  * Active claims per (model, taskClass); default 8. A nonnegative
+  * integer (zero refuses every active claim), validated at
+  * construction: the enforcement compares `count > cap`, and every
+  * comparison with NaN is false, so an unvalidated NaN or Infinity
+  * silently disabled the cap (v1.35.0 review P2-5).
+  */
   activeClaimsCap?: number;
 }
 declare class FileModelKnowledgeStore implements ModelKnowledgeStore {
@@ -2792,7 +2823,11 @@ interface EscalationOptions {
   deadlineMs?: number;
   /** Applied by the timeout resolution (by: 'timeout'); default accept. */
   defaultDecision?: EscalationDecision;
-  /** In-run minimum spend before scope_bigger; default 0 (M3-T09). */
+  /**
+  * In-run minimum spend before scope_bigger; default 0 (M3-T09). A
+  * finite number >= 0, validated before any LLM call: the gate
+  * compares spend against it, and a NaN would silently disable it.
+  */
   minSpendUsd?: number;
 }
 /** The model-facing request: the report minus the runtime-filled fields. */
@@ -5244,6 +5279,18 @@ interface OrchestratorExtensionIO {
     */
     replayed?: boolean;
   }): void;
+  /**
+  * A deterministic run failure declared by the extension (v1.35.0 review P2-1):
+  * the first call stores the error and aborts the orchestrator loop;
+  * the orchestrate settle boundary rethrows it, so the run fails with
+  * the given typed error instead of asking the model to finish. Later
+  * calls do nothing. The intended producer is a journaled
+  * policy verdict (the PlanRunner guards fallback 'fail-run'): boot
+  * terminates again from the journal on resume, so the failure rolls
+  * forward without another decision or model call. Optional so
+  * IO implementations built before v1.36 keep compiling.
+  */
+  terminate?(error: Error): void;
 }
 /**
 * The extension contract. PlanRunner implements it in @rulvar/plan; the
@@ -5290,17 +5337,43 @@ interface OrchestratorExtension {
 */
 interface OrchestratorBudgetSpec {
   /**
-  * Absolute bound in USD. It never REPLACES the fraction bound:
+  * Absolute bound in USD: a finite number >= 0, validated before any
+  * journal entry or dispatch (a malformed value is a ConfigError). It
+  * never REPLACES the fraction bound:
   * effectiveCap = min(capUsd, (capFraction ?? 0.2) * ceiling), so an
   * explicit capUsd larger than the default fraction of the run ceiling
   * is still cut to that fraction (and a warn log says so). Pass
   * capFraction: 1.0 to make capUsd the sole bound.
   */
   capUsd?: number;
-  /** default 0.2; effectiveCap = min of the given bounds */
+  /**
+  * A fraction in (0, 1], default 0.2; effectiveCap = min of the given
+  * bounds. Zero does not lift the cap (it would make every turn
+  * unpayable): anything outside (0, 1] is a ConfigError before any
+  * journal entry or dispatch.
+  */
   capFraction?: number;
+  /**
+  * A finite number >= 0, validated before any journal entry or
+  * dispatch. The reserve is SUBTRACTED from the soft boundary, so a
+  * negative value would widen the cap instead of reserving.
+  */
   finalizeReserveUsd?: number;
+  /**
+  * A positive integer, validated before any journal entry or dispatch:
+  * the turn limit of the reserved final wake.
+  */
   finalizeTurns?: number;
+  /**
+  * The policy at the cap, validated as exactly one of the two literals
+  * even at a plain JS/JSON boundary. 'finish-with-partial' (default)
+  * runs the reserved finalizer and returns its partial result with run
+  * outcome 'ok'. 'fail-run' skips the finalizer entirely: the run
+  * fails with outcome 'error' carrying FailRunError (code 'fail_run',
+  * data.source 'orchestrator_budget_cap', data.capDecisionRef); resume
+  * rolls the same failure forward from the journaled cap decision
+  * without another model call.
+  */
   atCap?: "finish-with-partial" | "fail-run";
 }
 /** Options for orchestrate(engine, goal, o?). */
@@ -5308,13 +5381,19 @@ interface OrchestrateOptions {
   model?: ModelSpec;
   /** Registered profile names to advertise; default: every profile. */
   profiles?: string[];
-  /** Per-orchestrate spawn cap; the engine lifetime cap applies regardless. */
+  /**
+  * Per-orchestrate spawn cap: a nonnegative integer (zero admits no
+  * spawns), validated before any journal entry or dispatch. The engine
+  * lifetime cap applies regardless.
+  */
   maxSpawns?: number;
   /** The orchestrator's own budget sub-account (cap enforcement layers only in M6). */
   budget?: OrchestratorBudgetSpec;
   /**
-  * Deterministic digest render bound: each
-  * TaskDigest outputSummary is clamped to this many CHARACTERS (the
+  * Deterministic digest render bound: a nonnegative integer, validated
+  * before any journal entry or dispatch. Each TaskDigest outputSummary
+  * is truncated to AT MOST this many CHARACTERS, the truncation marker
+  * included (a budget below 3 keeps the bound with a bare slice; the
   * model-independent measure; OQ-04 closed at M10 entry). Default
   * WAKE_SUMMARY_RENDER_BUDGET_CHARS.
   */
@@ -5384,6 +5463,20 @@ declare class Semaphore {
 }
 //#endregion
 //#region src/engine/external.d.ts
+/**
+* The rejection carrier of an aborted flavor B decision wait (v1.35.0
+* review P1): the parked `awaitDecision` observes the branch/run
+* AbortSignal, releases its held activity, removes its waiter, and
+* rejects with this class so cancel, host abort, the run deadline, and
+* failed sibling aborts all settle the run in bounded time.
+* Deliberately not a RulvarError: the abort is cancellation intent, not
+* a registry failure class; the suspension entry stays OPEN, so a later
+* resume parks the decision again and the durable deadline still applies.
+*/
+declare class EscalationDecisionAbortedError extends Error {
+  readonly entryRef: number;
+  constructor(message: string, entryRef: number);
+}
 /** The resolution value shape of a tool-approval suspension (M3-T03). */
 interface ApprovalDecision {
   decision: "allow" | "deny";
@@ -5484,6 +5577,13 @@ declare class ExternalRegistry {
     toolName: string;
     input: Json;
     deadlineAt: string;
+    /**
+    * The branch/run signal: an abort while parked releases the held
+    * activity, removes the waiter, and rejects with
+    * EscalationDecisionAbortedError (v1.35.0 review P1). The suspension
+    * entry stays open for resume.
+    */
+    signal?: AbortSignal;
     onPending?: (entry: JournalEntry, replayed: boolean) => void;
   }): Promise<{
     value: Json;
@@ -5548,7 +5648,8 @@ interface AgentProfile {
   /**
   * Per-profile compaction threshold; default 0.8 of the loop model's
   * contextWindow (M4-T03). Compaction is ON by
-  * default; history-processor plumbing stays engine-internal.
+  * default; history-processor plumbing stays engine-internal. The
+  * threshold is a fraction in (0, 1], validated at createEngine.
   */
   compaction?: {
     threshold?: number;
@@ -5987,8 +6088,12 @@ declare function compileVerifiedLayer(claims: readonly ModelClaim[], ladders: re
 /**
 * The deterministic card render. Pure: same filtered
 * claims and ladders give byte-identical text. The render budget is
-* 4096 chars; over it, the OLDEST-observed notes
-* withhold first behind an explicit marker.
+* 4096 chars by default; over it, the OLDEST-observed notes withhold
+* first behind an explicit marker, and the budget is a HARD upper bound
+* of the returned string: a card whose mandatory sections alone exceed
+* it is truncated with the shared marker (v1.35.0 review P2-5: a budget
+* of 32 used to return the full 136-char header form). budgetChars is a
+* nonnegative integer, validated as a ConfigError.
 */
 declare function modelKnowledgeCard(claims: readonly ModelClaim[], ladders: readonly DeclaredLadder[], options?: {
   budgetChars?: number;
@@ -6166,7 +6271,14 @@ interface GitWorktreeProviderOptions {
   * requests keep on dispose. Default false.
   */
   keepOnError?: boolean;
-  /** Pin cap shared by park/unpark and retainWorktree (default 4). */
+  /**
+  * Pin cap shared by park/unpark and retainWorktree (default 4). A
+  * nonnegative integer (zero retains nothing), validated at
+  * construction: the retention compares `pinned.size < cap`, and every
+  * comparison with NaN is false, so an unvalidated NaN performed the
+  * acquire effects and then dropped every tree as "cap reached"
+  * (v1.35.0 review P2-5).
+  */
   maxPinnedWorktrees?: number;
   /** Warning sink (cap overflow); defaults to process.emitWarning. */
   onWarn?: (msg: string) => void;
@@ -6357,9 +6469,16 @@ declare class JsonlFileStore implements MetaLookupStore {
 /**
 * File-backed TranscriptStore (M6-T02): blobs (transcripts, checkpoints,
 * persisted CompiledWorkflow sources) as one file per ref under `dir`,
-* so compiled runs resume across processes. Refs follow
-* the `<runId>/<name>` convention; each path segment is checked
-* filesystem-safe and nested segments become directories.
+* so compiled runs resume across processes. Refs follow the
+* `<runId>/<name>` convention; nested segments become directories.
+*
+* Every ref is contained under `dir` (v1.36.0 review SEC-P1): each
+* segment must match `[A-Za-z0-9._-]` and be neither empty, '.', nor
+* '..', and the resolved path must stay under the resolved root. A '..'
+* segment used to pass the per-segment alphabet (dots are in it) and, via
+* `join`, escape the root; a caller passing an untrusted ref (or an
+* untrusted runId, which prefixes checkpoint and workflow-source refs)
+* could read, write, or delete `.bin` files outside `dir`.
 */
 declare class FileTranscriptStore implements TranscriptStore {
   private readonly dir;
@@ -6779,4 +6898,4 @@ interface SandboxBridge {
 declare const SANDBOX_AGENT_OPT_KEYS: readonly string[];
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildIdentityInput, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RandIdentityInput, RandPayload, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasMetaLookup, hashRunArgs, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildIdentityInput, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RandIdentityInput, RandPayload, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasMetaLookup, hashRunArgs, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/dist/index.js

@@ -1,6 +1,6 @@
 import { createHash, getRandomValues, randomUUID } from "node:crypto";
 import { appendFileSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join, resolve, sep } from "node:path";
 import { Client } from "@modelcontextprotocol/sdk/client";
 import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
@@ -206,6 +206,25 @@ var BudgetExhaustedError = class extends RulvarError {
 	}
 };
 /**
+* A declared fail-run policy engaged and closed the run as a failure
+* (v1.35.0 review P2-1): `budget.atCap: 'fail-run'` after the journaled
+* orchestrator cap decision, or `guards.fallback: 'fail-run'` after the
+* journaled guard verdict. The run outcome is 'error' with this code;
+* `data.source` names the policy ('orchestrator_budget_cap' or
+* 'plan_guards') and `data` carries the decision entry reference, so the
+* outcome is a pure roll forward of the journal on resume: no second
+* decision, no model call, no spend.
+*/
+var FailRunError = class extends RulvarError {
+	code = "fail_run";
+	constructor(message, opts) {
+		super(message, {
+			retryable: false,
+			...opts
+		});
+	}
+};
+/**
 * A structural admission rejection (maxDepth, maxChildrenPerNode,
 * maxTotalSpawns) from the AdmissionController (M6-T06). The rejection verdict is embedded in
 * the carrying spawn-admission decision entry and replays identically;
@@ -2179,6 +2198,51 @@ function modelEpochOf(inputs) {
 	return Object.keys(epoch).length === 0 ? void 0 : epoch;
 }
 //#endregion
+//#region src/l0/validate-numbers.ts
+/**
+* Shared numeric option validators (v1.34.0 review P2-3). Every public
+* numeric knob that shapes admission, limits, concurrency, or timers is
+* validated with these helpers at its intake boundary, so a malformed
+* value (NaN, Infinity, a negative, a fraction where an integer is
+* required) fails as a typed ConfigError before any journal entry,
+* worker, or provider dispatch. NaN needs dedicated handling because
+* every comparison with it is false: a hand-written range check in the
+* rejecting polarity (`value < min || value > max`) silently admits it.
+*/
+/**
+* The Node timer ceiling: setTimeout clamps any longer delay to 1 ms, so
+* a naive far-future timer fires immediately (v1.34.0 review P2-2).
+* Relative timer options are validated against this bound; absolute
+* deadlines use the sliced timer in long-timer.ts instead.
+*/
+const MAX_TIMER_DELAY_MS = 2147483647;
+function refuse(site, requirement, value) {
+	throw new ConfigError(`${site} must be ${requirement}; got ${String(value)}`);
+}
+/** An integer >= 1 (counts, caps, and depths). */
+function requirePositiveInteger(value, site) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1) refuse(site, "a positive integer", value);
+}
+/** An integer >= 0 (caps where zero means "none allowed"). */
+function requireNonNegativeInteger(value, site) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) refuse(site, "a nonnegative integer", value);
+}
+/** A finite number >= 0 (USD amounts and reserves). */
+function requireNonNegativeNumber(value, site) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) refuse(site, "a finite nonnegative number", value);
+}
+/** A finite fraction in (0, 1]. */
+function requireFraction(value, site) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > 1) refuse(site, "a fraction in (0, 1]", value);
+}
+/**
+* A relative delay handed to setTimeout as-is: an integer within the
+* Node timer maximum, mirroring validateRetryPolicy's bound.
+*/
+function requireTimerDelayMs(value, site) {
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 2147483647) refuse(site, "an integer between 1 and 2147483647 ms (the Node timer maximum)", value);
+}
+//#endregion
 //#region src/knowledge/file-store.ts
 /**
 * FileModelKnowledgeStore (M10-T01): the default ModelKnowledgeStore, a
@@ -2238,6 +2302,79 @@ function applyClaimOps(claims, ops) {
 	}
 	return next;
 }
+/** A lowercase sha256 digest: 64 hex characters. */
+const HASH_PATTERN = /^[0-9a-f]{64}$/;
+const CLAIM_STATUSES = /* @__PURE__ */ new Set([
+	"active",
+	"stale",
+	"superseded",
+	"archived"
+]);
+/**
+* Structural issues of one PERSISTED claim (empty = sound). Distinct from
+* the editorial commit validator (claims.ts): a persisted snapshot
+* legitimately holds non-active statuses (stale, superseded, archived) and
+* carries no gate, so only shape and vocabulary are checked here. This is
+* the boundary that keeps a null or partial claim from reaching the card
+* render, where `claim.status` would throw an untyped TypeError (v1.36.0
+* review P2-6).
+*/
+function persistedClaimIssues(value, path) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return [`${path}: expected a claim object`];
+	const claim = value;
+	const issues = [];
+	if (typeof claim.id !== "string" || claim.id.length === 0) issues.push(`${path}.id: expected a non-empty string`);
+	const subject = claim.subject;
+	if (subject === null || typeof subject !== "object") issues.push(`${path}.subject: expected an object`);
+	else if (typeof subject.model !== "string" || !subject.model.includes(":")) issues.push(`${path}.subject.model: expected a 'provider:model' string`);
+	if (typeof claim.taskClass !== "string" || claim.taskClass.length === 0) issues.push(`${path}.taskClass: expected a non-empty string`);
+	if (claim.polarity !== "strength" && claim.polarity !== "weakness") issues.push(`${path}.polarity: expected 'strength' or 'weakness'`);
+	if (typeof claim.statement !== "string" || claim.statement.length === 0) issues.push(`${path}.statement: expected a non-empty string`);
+	if (claim.class !== "eval-measured" && claim.class !== "human-editorial") issues.push(`${path}.class: expected 'eval-measured' or 'human-editorial'`);
+	if (typeof claim.status !== "string" || !CLAIM_STATUSES.has(claim.status)) issues.push(`${path}.status: expected active, stale, superseded, or archived`);
+	if (!Array.isArray(claim.evidence) || claim.evidence.length === 0) issues.push(`${path}.evidence: expected a non-empty array`);
+	if (claim.confidence !== "high" && claim.confidence !== "medium" && claim.confidence !== "low") issues.push(`${path}.confidence: expected 'high', 'medium', or 'low'`);
+	if (typeof claim.observedAt !== "string" || Number.isNaN(Date.parse(claim.observedAt))) issues.push(`${path}.observedAt: expected an ISO date`);
+	if (typeof claim.expiresAt !== "string" || Number.isNaN(Date.parse(claim.expiresAt))) issues.push(`${path}.expiresAt: expected an ISO date`);
+	const author = claim.author;
+	if (author === null || typeof author !== "object") issues.push(`${path}.author: expected an object`);
+	else {
+		if (author.kind !== "eval-pipeline" && author.kind !== "human") issues.push(`${path}.author.kind: expected 'eval-pipeline' or 'human'`);
+		if (typeof author.id !== "string" || author.id.length === 0) issues.push(`${path}.author.id: expected a non-empty string`);
+	}
+	return issues;
+}
+/**
+* The single read boundary of the store (v1.36.0 review P2-6). A persisted
+* snapshot must hold a nonnegative integer version, a lowercase sha256
+* hash, structurally sound claims, and a hash that MATCHES its claims: the
+* KnowledgeSnapshot contract promises the hash is the deterministic
+* content hash of the claims, so a file edited without rehashing (a forged
+* version or hash, a torn write) is refused with a typed ConfigError
+* instead of flowing on to forge the audit trail or crash the render.
+*/
+function validateKnowledgeSnapshot(parsed, path) {
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new ConfigError(`knowledge store file does not hold a KnowledgeSnapshot: ${path}`);
+	const snapshot = parsed;
+	const issues = [];
+	const version = snapshot.version;
+	if (typeof version !== "number" || !Number.isInteger(version) || version < 0) issues.push(`version: expected a nonnegative integer; got ${String(version)}`);
+	const hash = snapshot.hash;
+	if (typeof hash !== "string" || !HASH_PATTERN.test(hash)) issues.push("hash: expected a lowercase sha256 digest of 64 hex characters");
+	if (!Array.isArray(snapshot.claims)) issues.push("claims: expected an array");
+	else snapshot.claims.forEach((claim, index) => {
+		issues.push(...persistedClaimIssues(claim, `claims[${String(index)}]`));
+	});
+	if (issues.length > 0) throw new ConfigError(`knowledge store file is not a valid KnowledgeSnapshot (${path}):\n- ${issues.join("\n- ")}`);
+	const claims = snapshot.claims;
+	const recomputed = knowledgeHash(claims);
+	if (hash !== recomputed) throw new ConfigError(`knowledge store hash does not match its claims (${path}): stored ${String(hash)}, computed ${recomputed}; the file was edited without rehashing`);
+	return {
+		version,
+		hash,
+		claims
+	};
+}
 var FileModelKnowledgeStore = class {
 	path;
 	activeClaimsCap;
@@ -2245,6 +2382,7 @@ var FileModelKnowledgeStore = class {
 	queue = Promise.resolve();
 	constructor(options) {
 		this.path = resolve(options?.path ?? "./rulvar.models.json");
+		if (options?.activeClaimsCap !== void 0) requireNonNegativeInteger(options.activeClaimsCap, "FileModelKnowledgeStore activeClaimsCap");
 		this.activeClaimsCap = options?.activeClaimsCap;
 	}
 	read() {
@@ -2265,13 +2403,7 @@ var FileModelKnowledgeStore = class {
 		} catch (cause) {
 			throw new ConfigError(`knowledge store file is not valid JSON: ${this.path}`, { cause });
 		}
-		const snapshot = parsed;
-		if (snapshot === null || typeof snapshot.version !== "number" || typeof snapshot.hash !== "string" || !Array.isArray(snapshot.claims)) throw new ConfigError(`knowledge store file does not hold a KnowledgeSnapshot: ${this.path}`);
-		return {
-			version: snapshot.version,
-			hash: snapshot.hash,
-			claims: snapshot.claims
-		};
+		return validateKnowledgeSnapshot(parsed, this.path);
 	}
 	async current() {
 		return this.read();
@@ -2301,6 +2433,19 @@ var FileModelKnowledgeStore = class {
 		return result;
 	}
 };
+/**
+* Truncates `raw` to at most `budgetChars` characters. A string within
+* the budget returns unchanged; a longer one is cut to
+* `budgetChars - 3` characters plus the marker, and budgets below the
+* marker length fall back to a bare slice so the bound still holds.
+* The measure is deterministic characters (UTF-16 units): identical
+* live and on replay, no tokenizer dependence.
+*/
+function truncateToBudget(raw, budgetChars) {
+	if (raw.length <= budgetChars) return raw;
+	if (budgetChars < 3) return raw.slice(0, Math.max(0, budgetChars));
+	return `${raw.slice(0, budgetChars - 3)}...`;
+}
 //#endregion
 //#region src/model/floors.ts
 /**
@@ -2442,10 +2587,15 @@ function compileVerifiedLayer(claims, ladders) {
 /**
 * The deterministic card render. Pure: same filtered
 * claims and ladders give byte-identical text. The render budget is
-* 4096 chars; over it, the OLDEST-observed notes
-* withhold first behind an explicit marker.
+* 4096 chars by default; over it, the OLDEST-observed notes withhold
+* first behind an explicit marker, and the budget is a HARD upper bound
+* of the returned string: a card whose mandatory sections alone exceed
+* it is truncated with the shared marker (v1.35.0 review P2-5: a budget
+* of 32 used to return the full 136-char header form). budgetChars is a
+* nonnegative integer, validated as a ConfigError.
 */
 function modelKnowledgeCard(claims, ladders, options) {
+	if (options?.budgetChars !== void 0) requireNonNegativeInteger(options.budgetChars, "modelKnowledgeCard budgetChars");
 	const budget = options?.budgetChars ?? 4096;
 	const lines = ["Model knowledge card (tier-relative; advisory within declared ladders and hard floors)."];
 	const verified = compileVerifiedLayer(claims, ladders);
@@ -2494,7 +2644,7 @@ function modelKnowledgeCard(claims, ladders, options) {
 		shown -= 1;
 		text = render(shown);
 	}
-	return text;
+	return truncateToBudget(text, budget);
 }
 //#endregion
 //#region src/tools/presets.ts
@@ -3047,6 +3197,7 @@ var GitWorktreeProvider = class {
 	constructor(options) {
 		this.repoRoot = options?.repoRoot ?? process.cwd();
 		this.keepOnError = options?.keepOnError ?? false;
+		if (options?.maxPinnedWorktrees !== void 0) requireNonNegativeInteger(options.maxPinnedWorktrees, "GitWorktreeProvider maxPinnedWorktrees");
 		this.maxPinned = options?.maxPinnedWorktrees ?? 4;
 		this.onWarn = options?.onWarn ?? ((msg) => process.emitWarning(msg, {
 			code: "RULVAR_WORKTREE",
@@ -5836,6 +5987,24 @@ var Replayer = class {
 * Full contract: https://docs.rulvar.com/guide/durability
 */
 /**
+* The rejection carrier of an aborted flavor B decision wait (v1.35.0
+* review P1): the parked `awaitDecision` observes the branch/run
+* AbortSignal, releases its held activity, removes its waiter, and
+* rejects with this class so cancel, host abort, the run deadline, and
+* failed sibling aborts all settle the run in bounded time.
+* Deliberately not a RulvarError: the abort is cancellation intent, not
+* a registry failure class; the suspension entry stays OPEN, so a later
+* resume parks the decision again and the durable deadline still applies.
+*/
+var EscalationDecisionAbortedError = class extends Error {
+	entryRef;
+	constructor(message, entryRef) {
+		super(message);
+		this.name = "EscalationDecisionAbortedError";
+		this.entryRef = entryRef;
+	}
+};
+/**
 * Normalizes a resolution value into an ApprovalDecision. Anything that
 * is not an explicit allow is a deny: an approval never fails open.
 */
@@ -6112,8 +6281,33 @@ var ExternalRegistry = class ExternalRegistry {
 			},
 			deadlineAt: options.deadlineAt
 		});
-		return new Promise((resolve) => {
+		return new Promise((resolve, reject) => {
+			const signal = options.signal;
+			const abortError = () => {
+				const reason = signal?.reason;
+				const detail = reason instanceof Error ? reason.message : typeof reason === "string" ? reason : "aborted";
+				return new EscalationDecisionAbortedError(`flavor B escalation decision wait aborted (entry ${String(entry.seq)}): ${detail}`, entry.seq);
+			};
+			if (signal?.aborted === true) {
+				reject(abortError());
+				return;
+			}
 			const exitActivity = this.enter();
+			let settled = false;
+			let detachAbort;
+			/** Exactly one terminal: activity exits once, the listener detaches once. */
+			const settle = () => {
+				if (settled) return false;
+				settled = true;
+				exitActivity();
+				detachAbort?.();
+				return true;
+			};
+			const onAbort = () => {
+				if (!settle()) return;
+				this.waiters.delete(entry.seq);
+				if (!this.closedFlag) reject(abortError());
+			};
 			const waiter = {
 				kind: "decision",
 				key: ExternalRegistry.approvalKey(entry.seq),
@@ -6121,7 +6315,7 @@ var ExternalRegistry = class ExternalRegistry {
 				entryRef: entry.seq,
 				prompt: `decide escalation of '${options.toolName}'`,
 				resolve: (value) => {
-					exitActivity();
+					if (!settle()) return;
 					resolve({
 						value,
 						entryRef: entry.seq
@@ -6129,6 +6323,12 @@ var ExternalRegistry = class ExternalRegistry {
 				}
 			};
 			this.waiters.set(entry.seq, waiter);
+			if (signal !== void 0) {
+				signal.addEventListener("abort", onAbort, { once: true });
+				detachAbort = () => {
+					signal.removeEventListener("abort", onAbort);
+				};
+			}
 			options.onPending?.(entry, replayed);
 		});
 	}
@@ -6445,9 +6645,16 @@ const TRANSCRIPT_SUFFIX = ".bin";
 /**
 * File-backed TranscriptStore (M6-T02): blobs (transcripts, checkpoints,
 * persisted CompiledWorkflow sources) as one file per ref under `dir`,
-* so compiled runs resume across processes. Refs follow
-* the `<runId>/<name>` convention; each path segment is checked
-* filesystem-safe and nested segments become directories.
+* so compiled runs resume across processes. Refs follow the
+* `<runId>/<name>` convention; nested segments become directories.
+*
+* Every ref is contained under `dir` (v1.36.0 review SEC-P1): each
+* segment must match `[A-Za-z0-9._-]` and be neither empty, '.', nor
+* '..', and the resolved path must stay under the resolved root. A '..'
+* segment used to pass the per-segment alphabet (dots are in it) and, via
+* `join`, escape the root; a caller passing an untrusted ref (or an
+* untrusted runId, which prefixes checkpoint and workflow-source refs)
+* could read, write, or delete `.bin` files outside `dir`.
 */
 var FileTranscriptStore = class {
 	dir;
@@ -6457,9 +6664,13 @@ var FileTranscriptStore = class {
 	}
 	blobPath(ref) {
 		const segments = ref.split("/");
-		for (const segment of segments) if (!/^[A-Za-z0-9._-]+$/.test(segment)) throw new JournalOrderViolation(`FileTranscriptStore: ref segment '${segment}' is not filesystem-safe`);
+		for (const segment of segments) if (segment === "" || segment === "." || segment === ".." || !/^[A-Za-z0-9._-]+$/.test(segment)) throw new JournalOrderViolation(`FileTranscriptStore: ref segment '${segment}' is not filesystem-safe`);
 		const name = segments.pop() ?? "";
-		return join(this.dir, ...segments, `${name}${TRANSCRIPT_SUFFIX}`);
+		const path = join(this.dir, ...segments, `${name}${TRANSCRIPT_SUFFIX}`);
+		const root = resolve(this.dir);
+		const resolved = resolve(path);
+		if (resolved !== root && !resolved.startsWith(`${root}${sep}`)) throw new JournalOrderViolation(`FileTranscriptStore: ref '${ref}' resolves outside the configured root`);
+		return path;
 	}
 	async put(ref, blob) {
 		const path = this.blobPath(ref);
@@ -6477,6 +6688,7 @@ var FileTranscriptStore = class {
 		}
 	}
 	async list(runId) {
+		if (runId === "." || runId === "..") throw new JournalOrderViolation(`FileTranscriptStore: runId '${runId}' is not filesystem-safe`);
 		const root = join(this.dir, safeName(runId));
 		const refs = [];
 		const walk = (dir, prefix) => {
@@ -6758,51 +6970,6 @@ function tierWithinCaps(tier, caps) {
 	return TIER_ORDER[tier] <= TIER_ORDER[caps.structuredOutput];
 }
 //#endregion
-//#region src/l0/validate-numbers.ts
-/**
-* Shared numeric option validators (v1.34.0 review P2-3). Every public
-* numeric knob that shapes admission, limits, concurrency, or timers is
-* validated with these helpers at its intake boundary, so a malformed
-* value (NaN, Infinity, a negative, a fraction where an integer is
-* required) fails as a typed ConfigError before any journal entry,
-* worker, or provider dispatch. NaN needs dedicated handling because
-* every comparison with it is false: a hand-written range check in the
-* rejecting polarity (`value < min || value > max`) silently admits it.
-*/
-/**
-* The Node timer ceiling: setTimeout clamps any longer delay to 1 ms, so
-* a naive far-future timer fires immediately (v1.34.0 review P2-2).
-* Relative timer options are validated against this bound; absolute
-* deadlines use the sliced timer in long-timer.ts instead.
-*/
-const MAX_TIMER_DELAY_MS = 2147483647;
-function refuse(site, requirement, value) {
-	throw new ConfigError(`${site} must be ${requirement}; got ${String(value)}`);
-}
-/** An integer >= 1 (counts, caps, and depths). */
-function requirePositiveInteger(value, site) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 1) refuse(site, "a positive integer", value);
-}
-/** An integer >= 0 (caps where zero means "none allowed"). */
-function requireNonNegativeInteger(value, site) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) refuse(site, "a nonnegative integer", value);
-}
-/** A finite number >= 0 (USD amounts and reserves). */
-function requireNonNegativeNumber(value, site) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) refuse(site, "a finite nonnegative number", value);
-}
-/** A finite fraction in (0, 1]. */
-function requireFraction(value, site) {
-	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0 || value > 1) refuse(site, "a fraction in (0, 1]", value);
-}
-/**
-* A relative delay handed to setTimeout as-is: an integer within the
-* Node timer maximum, mirroring validateRetryPolicy's bound.
-*/
-function requireTimerDelayMs(value, site) {
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 1 || value > 2147483647) refuse(site, "an integer between 1 and 2147483647 ms (the Node timer maximum)", value);
-}
-//#endregion
 //#region src/engine/scheduler.ts
 /**
 * Scheduler and concurrency (M1-T08): the per-run semaphore with a FIFO
@@ -10413,8 +10580,7 @@ const WAKE_SUMMARY_RENDER_BUDGET_CHARS = 400;
 * spawn ordinal; the LLM distillation upgrade is M7 territory).
 */
 function summarizeOutput(result) {
-	const raw = result.status === "ok" ? typeof result.output === "string" ? result.output : JSON.stringify(result.output ?? null) : result.errorMessage ?? `terminal status ${result.status}`;
-	return raw.length <= 400 ? raw : `${raw.slice(0, 400)}...`;
+	return truncateToBudget(result.status === "ok" ? typeof result.output === "string" ? result.output : JSON.stringify(result.output ?? null) : result.errorMessage ?? `terminal status ${result.status}`, 400);
 }
 /** Folds one settled child into its digest (spawn-ordinal ordering is the caller's). */
 function digestOf(record, result) {
@@ -11034,6 +11200,7 @@ function createCtx(internals, rootWorkflow) {
 		if (escalation !== void 0) {
 			if (escalation.flavor === "B" && escalation.deadlineMs === void 0) throw new ConfigError("flavor 'B' escalation requires an explicit deadlineMs: the suspension deadline has no engine default");
 			if (escalation.deadlineMs !== void 0) requirePositiveInteger(escalation.deadlineMs, "escalation.deadlineMs");
+			if (escalation.minSpendUsd !== void 0) requireNonNegativeNumber(escalation.minSpendUsd, "escalation.minSpendUsd");
 			if (opts.result !== "full" && internals.onEscalation === void 0) throw new ConfigError("a spawn that opts into escalation from a plain value-form call needs an onEscalation hook (or use result: 'full')");
 			if (escalation.flavor === "B" && escalation.deadlineMs === void 0) throw new ConfigError("escalation flavor 'B' requires an explicit deadlineMs");
 		}
@@ -11589,50 +11756,8 @@ function createCtx(internals, rootWorkflow) {
 			exitActivity?.();
 		}
 		internals.budget.releaseReserve(reserve, budgetAccount);
-		let flavorBDecision;
-		if (result.status === "escalated" && escalation?.flavor === "B" && result.escalationRequest !== void 0) {
-			if (internals.external === void 0) throw new ConfigError("flavor B escalation requires the engine run context");
-			const request = result.escalationRequest;
-			const deadlineMs = escalation.deadlineMs;
-			if (deadlineMs === void 0) throw new ConfigError("flavor 'B' escalation requires an explicit deadlineMs");
-			const defaultDecision = escalation.defaultDecision ?? { kind: "accept" };
-			let timer;
-			const decisionOutcome = await internals.external.awaitDecision({
-				scope: agentScope(state.scope, running.seq),
-				spanId: internals.spans.mint(spanId),
-				toolName: "escalate",
-				input: request,
-				deadlineAt: new Date(internals.now() + deadlineMs).toISOString(),
-				onPending: (entry, replayed) => {
-					internals.events.emit({
-						type: "approval:pending",
-						toolName: "escalate",
-						entryRef: entry.seq
-					}, spanId, replayed);
-					const registry = internals.external;
-					timer = setLongTimeout(() => {
-						registry?.submitResolution(entry.seq, {
-							by: "timeout",
-							value: defaultDecision
-						}).catch(() => void 0);
-					}, Date.parse(entry.deadlineAt ?? "") || internals.now(), () => internals.now());
-					if (internals.onEscalation !== void 0) {
-						const preview = buildEscalationReport(request, result, void 0);
-						const previewResult = {
-							...result,
-							escalation: preview
-						};
-						Promise.resolve(internals.onEscalation(previewResult)).then((decision) => registry?.submitResolution(entry.seq, {
-							by: "external",
-							value: decision
-						})).catch(() => void 0);
-					}
-				}
-			});
-			if (timer !== void 0) timer.cancel();
-			flavorBDecision = decisionOutcome.value;
-		}
-		if (acquired !== void 0) {
+		const collectAndDisposeWorktree = async () => {
+			if (acquired === void 0) return;
 			try {
 				const { files, patch } = await acquired.collect();
 				const patchRef = internals.mintTranscriptRef();
@@ -11652,7 +11777,62 @@ function createCtx(internals, rootWorkflow) {
 				}, spanId);
 			}
 			await acquired.dispose(result.status !== "ok" && result.status !== "escalated");
+		};
+		let flavorBDecision;
+		if (result.status === "escalated" && escalation?.flavor === "B" && result.escalationRequest !== void 0) {
+			if (internals.external === void 0) throw new ConfigError("flavor B escalation requires the engine run context");
+			const request = result.escalationRequest;
+			const deadlineMs = escalation.deadlineMs;
+			if (deadlineMs === void 0) throw new ConfigError("flavor 'B' escalation requires an explicit deadlineMs");
+			const defaultDecision = escalation.defaultDecision ?? { kind: "accept" };
+			let timer;
+			let decisionOutcome;
+			try {
+				decisionOutcome = await internals.external.awaitDecision({
+					scope: agentScope(state.scope, running.seq),
+					spanId: internals.spans.mint(spanId),
+					toolName: "escalate",
+					input: request,
+					deadlineAt: new Date(internals.now() + deadlineMs).toISOString(),
+					signal: branchOrRunSignal,
+					onPending: (entry, replayed) => {
+						internals.events.emit({
+							type: "approval:pending",
+							toolName: "escalate",
+							entryRef: entry.seq
+						}, spanId, replayed);
+						const registry = internals.external;
+						timer = setLongTimeout(() => {
+							registry?.submitResolution(entry.seq, {
+								by: "timeout",
+								value: defaultDecision
+							}).catch(() => void 0);
+						}, Date.parse(entry.deadlineAt ?? "") || internals.now(), () => internals.now());
+						if (internals.onEscalation !== void 0) {
+							const preview = buildEscalationReport(request, result, void 0);
+							const previewResult = {
+								...result,
+								escalation: preview
+							};
+							Promise.resolve(internals.onEscalation(previewResult)).then((decision) => registry?.submitResolution(entry.seq, {
+								by: "external",
+								value: decision
+							})).catch(() => void 0);
+						}
+					}
+				});
+			} catch (thrown) {
+				if (thrown instanceof EscalationDecisionAbortedError) {
+					await collectAndDisposeWorktree();
+					throw new AgentCallError(thrown.message, result, state.scope, running.seq);
+				}
+				throw thrown;
+			} finally {
+				if (timer !== void 0) timer.cancel();
+			}
+			flavorBDecision = decisionOutcome.value;
 		}
+		if (acquired !== void 0) await collectAndDisposeWorktree();
 		if (result.status === "escalated" && result.escalationRequest !== void 0) {
 			const patchRef = result.artifacts?.find((artifact) => artifact.kind === "patch")?.ref;
 			const report = buildEscalationReport(result.escalationRequest, result, patchRef);
@@ -12290,6 +12470,28 @@ async function executeWorkflow(internals, wf, args) {
 * written; escalated children simply settle into their digests.
 */
 const ORCHESTRATE_WORKFLOW_NAME = "rulvar-orchestrate";
+/**
+* The orchestrate intake gate (v1.35.0 review P2-2): every numeric
+* option and the atCap literal validate SYNCHRONOUSLY at workflow
+* construction, shared by both surfaces (the top level orchestrate() throws
+* before a run exists; ctx.orchestrate throws before any journal entry,
+* provider call, or child dispatch). A NaN here previously disabled the
+* spawn cap (`spawnOrdinal >= NaN` is false forever) and the digest
+* render bound, and a negative finalize reserve WIDENED the soft cap
+* boundary instead of reserving from it.
+*/
+function validateOrchestrateOptions(opts) {
+	if (opts === void 0) return;
+	if (opts.maxSpawns !== void 0) requireNonNegativeInteger(opts.maxSpawns, "orchestrate maxSpawns");
+	if (opts.renderBudgetChars !== void 0) requireNonNegativeInteger(opts.renderBudgetChars, "orchestrate renderBudgetChars");
+	const spec = opts.budget;
+	if (spec === void 0) return;
+	if (spec.capUsd !== void 0) requireNonNegativeNumber(spec.capUsd, "orchestrate budget.capUsd");
+	if (spec.capFraction !== void 0) requireFraction(spec.capFraction, "orchestrate budget.capFraction");
+	if (spec.finalizeReserveUsd !== void 0) requireNonNegativeNumber(spec.finalizeReserveUsd, "orchestrate budget.finalizeReserveUsd");
+	if (spec.finalizeTurns !== void 0) requirePositiveInteger(spec.finalizeTurns, "orchestrate budget.finalizeTurns");
+	if (spec.atCap !== void 0 && spec.atCap !== "finish-with-partial" && spec.atCap !== "fail-run") throw new ConfigError(`orchestrate budget.atCap must be 'finish-with-partial' or 'fail-run'; got ${String(spec.atCap)}`);
+}
 function orchestratorPrompt(goal, maxSpawns, extensionLines) {
 	return [
 		"You are the orchestrator of a multi-agent run.",
@@ -12344,6 +12546,7 @@ function filterProfiles(registered, names) {
 * orchestrator agent with the finish terminal tool.
 */
 function makeOrchestratorWorkflow(goal, opts) {
+	validateOrchestrateOptions(opts);
 	return defineWorkflow({ name: ORCHESTRATE_WORKFLOW_NAME }, async (ctx) => {
 		const runtime = runtimeOf(ctx);
 		const { internals } = runtime;
@@ -12369,7 +12572,6 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const runCeiling = internals.budget.accountView(callingState.budgetScope ?? "run")?.ceilingUsd;
 			const spec = opts?.budget;
 			const fraction = spec?.capFraction ?? .2;
-			if (fraction > 1) throw new OrchestratorCapConfigError(`capFraction ${String(fraction)} exceeds 1.0 (opting out of the cap is explicit only, up to 1.0 inclusive)`);
 			const fromFraction = runCeiling === void 0 ? void 0 : fraction * runCeiling;
 			const bounds = [spec?.capUsd, fromFraction].filter((bound) => bound !== void 0);
 			const priorReserveDecision = internals.replayer.snapshot().find((entry) => {
@@ -12552,6 +12754,15 @@ function makeOrchestratorWorkflow(goal, opts) {
 			byOrdinal.set(spawnOrdinal, record);
 			return record;
 		};
+		/**
+		* The declared fail-run terminal (v1.35.0 review P2-1): the first
+		* extension terminate() call stores its failure and aborts the
+		* orchestrator loop; the settle boundary rethrows it deterministically
+		* (boot terminates again from the journaled verdict on resume, so the
+		* same failure rolls forward without a model call).
+		*/
+		let extensionTermination;
+		const forcedFinishController = new AbortController();
 		const io = {
 			runId: internals.runId,
 			baseScope: callingState.scope,
@@ -12597,7 +12808,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 			},
 			registerAlias: (donorScope, targetScope) => internals.replayer.registerAlias(donorScope, targetScope),
 			priceUsd: (servedBy, usage) => servedBy === void 0 ? void 0 : internals.priceUsd(servedBy, usage),
-			emit: (event, options) => internals.events.emit(event, callingState.spanId, options?.replayed)
+			emit: (event, options) => internals.events.emit(event, callingState.spanId, options?.replayed),
+			terminate: (error) => {
+				if (extensionTermination !== void 0) return;
+				extensionTermination = error;
+				forcedFinishController.abort("rulvar:extension-terminate");
+			}
 		};
 		const cancelByHandle = async (handle, _reason) => {
 			const record = records.get(handle);
@@ -12690,7 +12906,6 @@ function makeOrchestratorWorkflow(goal, opts) {
 			await runExtensionActivity();
 		};
 		let capDecisionRef = internals.replayer.snapshot().find((entry) => entry.kind === "decision" && entry.value?.decisionType === "orchestrator_budget_cap")?.seq;
-		const forcedFinishController = new AbortController();
 		let capInFlight = false;
 		/**
 		* The at-cap freeze: EXACTLY one decision entry
@@ -12772,11 +12987,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 				completedDigests: undelivered.map((record) => {
 					const row = digestOf(record, record.settled);
 					const budgetChars = opts?.renderBudgetChars ?? 400;
-					if (row.outputSummary.length > budgetChars) return {
+					const outputSummary = truncateToBudget(row.outputSummary, budgetChars);
+					return outputSummary === row.outputSummary ? row : {
 						...row,
-						outputSummary: `${row.outputSummary.slice(0, budgetChars)}...`
+						outputSummary
 					};
-					return row;
 				}),
 				escalations
 			};
@@ -13168,9 +13383,32 @@ function makeOrchestratorWorkflow(goal, opts) {
 				completed: [...records.values()].filter((record) => record.settled !== void 0).sort((a, b) => a.spawnOrdinal - b.spawnOrdinal).map((record) => digestOf(record, record.settled))
 			};
 		};
-		if (capDecisionRef !== void 0) return await runForcedFinish();
+		/**
+		* The settle at the cap: the JOURNALED cap decision drives the policy
+		* branch (its `fallback` field froze budget.atCap when the cap
+		* tripped), so a crash between the decision and its effect rolls the
+		* SAME outcome forward on resume, immune to drift of the live options.
+		* 'finish-with-partial' runs the reserved finalizer;
+		* 'fail-run' skips it and fails the run typed (v1.35.0 review P2-1:
+		* the policy used to be journaled and then ignored).
+		*/
+		const settleCapOutcome = async () => {
+			const capValue = internals.replayer.snapshot().find((entry) => entry.seq === capDecisionRef)?.value;
+			if (capValue?.fallback === "fail-run") throw new FailRunError(`the orchestrator budget cap was reached (decision entry ${String(capDecisionRef ?? -1)}) and budget.atCap is 'fail-run': the reserved finalizer is skipped and the run fails instead of returning a partial result`, { data: {
+				source: "orchestrator_budget_cap",
+				capDecisionRef: capDecisionRef ?? -1,
+				spentUsd: capValue.spentUsd ?? 0,
+				capUsd: capValue.capUsd ?? 0
+			} });
+			return await runForcedFinish();
+		};
+		const bootTermination = extensionTermination;
+		if (bootTermination !== void 0) throw bootTermination;
+		if (capDecisionRef !== void 0) return await settleCapOutcome();
 		const result = await runtime.runInScope(orchestratorState, () => ctx.agent(orchestratorPrompt(goal, opts?.maxSpawns, extension?.promptLines?.()), agentOpts));
-		if (capDecisionRef !== void 0) return await runForcedFinish();
+		const liveTermination = extensionTermination;
+		if (liveTermination !== void 0) throw liveTermination;
+		if (capDecisionRef !== void 0) return await settleCapOutcome();
 		if (orchestratorAccount !== void 0) internals.cost.orchestrator.spentUsd = internals.budget.accountView(orchestratorAccount)?.spentUsd ?? 0;
 		if (result.status !== "ok") throw new ConfigError(`the orchestrator agent terminated with status '${result.status}'` + (result.errorMessage === void 0 ? "" : `: ${result.errorMessage}`));
 		return result.output;
@@ -13366,6 +13604,29 @@ var EventBus = class {
 	}
 };
 //#endregion
+//#region src/l0/run-id.ts
+/**
+* Run id containment (v1.36.0 review SEC-P1). A runId becomes both a
+* journal path component (JsonlFileStore.safeName) and the PREFIX of every
+* transcript ref (checkpointRefFor, workflowSourceRef append `/...`). The
+* journal's whole-token regex rejects a separator, but a bare '.' or '..'
+* slips through as a single component there and, once a '/suffix' is
+* appended, becomes a real traversal segment at the transcript store. The
+* engine validates the runId at its boundary, before the first transcript
+* write, so an untrusted runId is refused with a typed ConfigError instead
+* of escaping the configured transcript root.
+*/
+/** Filesystem-safe token: the journal store's own alphabet. */
+const SAFE_RUN_ID = /^[A-Za-z0-9._-]+$/;
+/**
+* Throws a ConfigError unless runId is a filesystem-safe token: a
+* non-empty string over [A-Za-z0-9._-] that is neither '.' nor '..'. The
+* dot pair passes the alphabet on its own, so it is refused explicitly.
+*/
+function assertSafeRunId(runId, context) {
+	if (typeof runId !== "string" || runId === "" || runId === "." || runId === ".." || !SAFE_RUN_ID.test(runId)) throw new ConfigError(`${context}: runId ${JSON.stringify(runId)} is not filesystem-safe (allowed: [A-Za-z0-9._-], and neither "." nor "..")`);
+}
+//#endregion
 //#region src/runner/inprocess.ts
 /**
 * ScriptRunner SPI and InProcessRunner (M1-T11).
@@ -13565,6 +13826,7 @@ function createEngine(options) {
 		if (profile.limits !== void 0) validateUsageLimits(profile.limits, `createEngine defaults.profiles['${name}'].limits`);
 		if (profile.estCost !== void 0) requireNonNegativeNumber(profile.estCost, `createEngine defaults.profiles['${name}'].estCost`);
 		if (profile.escalation?.deadlineMs !== void 0) requirePositiveInteger(profile.escalation.deadlineMs, `createEngine defaults.profiles['${name}'].escalation.deadlineMs`);
+		if (profile.escalation?.minSpendUsd !== void 0) requireNonNegativeNumber(profile.escalation.minSpendUsd, `createEngine defaults.profiles['${name}'].escalation.minSpendUsd`);
 		if (profile.compaction?.threshold !== void 0) requireFraction(profile.compaction.threshold, `createEngine defaults.profiles['${name}'].compaction.threshold`);
 	}
 	const knowledgeStore = options.stores?.modelKnowledge;
@@ -13591,6 +13853,7 @@ function createEngine(options) {
 		const compiled = wf.kind === "compiled-workflow" ? wf : void 0;
 		if (compiled !== void 0 && options.runners?.sandbox === void 0) throw new ConfigError("running a CompiledWorkflow requires a sandbox runner: pass createEngine({ runners: { sandbox: new WorkerSandboxRunner() } }) from @rulvar/planner ");
 		const runId = resumeCtx?.runId ?? opts?.runId ?? mintRunId();
+		assertSafeRunId(runId, "engine.run");
 		const registry = buildDeriverRegistry(options.extraDerivers);
 		const segmentsBefore = resumeCtx?.segmentsBefore ?? 0;
 		const telemetryBase = segmentsBefore * EVENT_SEGMENT_STRIDE;
@@ -14319,4 +14582,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DedupIndex, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FileModelKnowledgeStore, FileTranscriptStore, GitWorktreeProvider, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, PlanInvariantError, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasMetaLookup, hashRunArgs, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DedupIndex, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GitWorktreeProvider, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, PlanInvariantError, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasMetaLookup, hashRunArgs, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.35.0",
+  "version": "1.37.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",