@rulvar/core 1.48.0 → 1.50.0

package/dist/index.d.ts

@@ -28,7 +28,7 @@ type WireError = {
 * 'agent' is carried by the AgentError value projection, not by a
 * RulvarError subclass.
 */
-type ErrorCode = "agent" | "config" | "non_serializable_value" | "script_rejected" | "journal_compat" | "invalid_resolution" | "journal_order_violation" | "plan_invariant" | "replay_plan_hash_mismatch" | "orchestrator_cap_config" | "journal_miss" | "budget_exhausted" | "fail_run" | "admission_rejected" | "sandbox_limit" | "lease_held" | "knowledge_cas";
+type ErrorCode = "agent" | "config" | "non_serializable_value" | "script_rejected" | "journal_compat" | "invalid_resolution" | "journal_order_violation" | "plan_invariant" | "replay_plan_hash_mismatch" | "orchestrator_cap_config" | "journal_miss" | "budget_exhausted" | "fail_run" | "admission_rejected" | "sandbox_limit" | "lease_held" | "knowledge_cas" | "determinism";
 /** An alias for the registry type; both names are public. */
 type RulvarErrorCode = ErrorCode;
 /**
@@ -264,6 +264,25 @@ declare class KnowledgeCasError extends RulvarError {
   });
 }
 /**
+* A workflow-origin bare-nondeterminism violation under
+* `determinism.mode: 'error'` (RV-209): bare `Date.now()` or
+* `Math.random()` called from workflow code inside a run. Thrown at the
+* offending call site (and re-thrown at settle if the workflow swallowed
+* it), so the run rejects instead of recording a value replay cannot
+* reproduce. `data` carries the structured localization: `category`,
+* `frame`, and the parsed `file`/`line`/`column` when the frame names
+* one. Never journaled as its own entry; the run settles 'error' with
+* this wire error. Exempt provenances (installed dependencies, Node
+* runtime frames, allowlisted patterns) never raise it.
+*/
+declare class DeterminismError extends RulvarError {
+  readonly code = "determinism";
+  constructor(message: string, opts?: {
+    data?: Json;
+    cause?: unknown;
+  });
+}
+/**
 * The vendored Standard Schema issue shape: validation issues carried
 * on AgentError and surfaced to the
 * model during bounded schema re-prompts.
@@ -3088,6 +3107,13 @@ interface AgentResult<T> {
   * cancellation or ordinary cap hits.
   */
   abortClass?: AbortClass;
+  /**
+  * Transport retries across the span's phase activations, present only
+  * when greater than zero. Live telemetry only: the ctx layer surfaces
+  * it as `agent:end` retryCount; it is never journaled, so a replayed
+  * result omits it (absent means "zero or unknown").
+  */
+  transportRetries?: number;
 }
 type EscalatedResult<T> = AgentResult<T> & {
   status: "escalated";
@@ -4408,7 +4434,19 @@ type CoreEvents = {
   scope: string;
   status: string;
 };
-/** Agent lifecycle. */
+/**
+* Agent lifecycle. One logical agent dispatch emits EXACTLY ONE
+* `agent:start`/`agent:end` pair on its span (the start carries the
+* primary role), and each model invocation phase inside the span
+* (`loop`, then possibly `summarize` activations, `finalize`,
+* `extract`) emits its own `agent:phase:start`/`agent:phase:end` pair,
+* so durations, per-phase usage, and attempts are derivable without
+* heuristics (the RV-207 event-model contract; before it, every phase
+* emitted an unpaired extra `agent:start` and consumers pairing starts
+* with the single end computed the LAST phase's duration as the
+* agent's). `reduceInvocationTable` is the official reducer over this
+* vocabulary.
+*/
 type AgentEvents = {
   type: "agent:queued";
   agentType: string;
@@ -4419,6 +4457,39 @@ type AgentEvents = {
   label?: string;
   model: string;
   role: string;
+} | {
+  type: "agent:phase:start";
+  agentType: string;
+  label?: string; /** The invocation role this phase activation runs as. */
+  role: string; /** The model the activation resolved to (fallbacks may serve another; the end event reports the server). */
+  model: string;
+  /**
+  * 1-based activation ordinal within the span, unique per
+  * activation (a summarize that fires three times gets three
+  * pairs). Key phases by (spanId, invocation).
+  */
+  invocation: number;
+} | {
+  type: "agent:phase:end";
+  agentType: string;
+  label?: string;
+  role: string; /** The model that actually served the activation's last attempt. */
+  model: string;
+  invocation: number;
+  /**
+  * Wall-clock activation duration. Live telemetry only: replayed
+  * phase pairs (reconstructed from the terminal entry's usage
+  * slices) carry 0.
+  */
+  durationMs: number; /** The usage this activation added to its (role, model) slices. */
+  usage: Usage; /** That usage priced at each serving model's own rate. */
+  costUsd: number;
+  outcome: "ok" | "error";
+  /**
+  * Transport retries inside this activation. Present only when
+  * greater than zero; live telemetry only (absent on replay).
+  */
+  retries?: number;
 } | {
   type: "agent:end";
   agentType: string;
@@ -4435,6 +4506,13 @@ type AgentEvents = {
   * terminal journal entry's usageApprox.
   */
   usageApprox?: boolean;
+  /**
+  * Total transport retries across the span's activations. Present
+  * only when greater than zero; live telemetry only, never
+  * journaled, so a replayed agent:end omits it (absent means "zero
+  * or unknown").
+  */
+  retryCount?: number;
 } | {
   type: "agent:error";
   agentType: string;
@@ -4472,6 +4550,34 @@ type ToolEvents = {
   advisory?: Json;
 };
 /**
+* Bare-nondeterminism detection (RV-209). Emitted LIVE by the segment
+* that observed the call, at most once per (category, provenance) per
+* execution segment; never journaled and never re-emitted with the
+* `replayed` flag. Because replay re-executes the workflow body, a
+* violation that survives in the code fires again on every replay of
+* the run, so the event appears organically in both live and replayed
+* streams. Exempt provenances (installed dependencies under
+* node_modules and Node runtime frames) never emit: they are
+* classified and silenced, which is what keeps an SDK's internal
+* `Math.random()` from branding the run nondeterministic.
+*/
+type DeterminismEvents = {
+  type: "determinism:warning"; /** Which patched global fired. */
+  category: "bare-date-now" | "bare-math-random";
+  /**
+  * 'workflow': the caller is workflow-origin code (the violation the
+  * guard exists for; rejects the run under `determinism.mode:
+  * 'error'`). 'allowlisted': the caller matched a configured
+  * `determinism.allowlist` pattern and is exempt by explicit host
+  * decision; emitted for visibility, never rejects.
+  */
+  provenance: "workflow" | "allowlisted"; /** The calling stack frame, after the configured redaction hook. */
+  frame: string; /** Parsed location when the frame carries one, after redaction. */
+  file?: string;
+  line?: number;
+  column?: number;
+};
+/**
 * Adaptive orchestration, resolutions, and
 * accounting: emitted only by runs where the corresponding machinery is
 * active (applicability per mode:
@@ -4618,7 +4724,7 @@ type AdaptiveEvents = {
   found: number;
   window: [number, number];
 };
-type WorkflowEventBody = CoreEvents | AgentEvents | ToolEvents | AdaptiveEvents;
+type WorkflowEventBody = CoreEvents | AgentEvents | ToolEvents | DeterminismEvents | AdaptiveEvents;
 /**
 * The envelope: seq is an independent per-run
 * telemetry counter, strictly increasing in emission order and DISTINCT
@@ -4751,13 +4857,15 @@ type OnEscalation = (result: EscalatedResult<unknown>) => EscalationDecision | P
 /**
 * The mode (a) runner for human-authored closures. Determinism is enforced
 * by convention, lint, and the ctx shims, NOT by a VM: only the sequence
-* of keys must be stable. Dev mode (NODE_ENV !== 'production') detects
-* bare Date.now and Math.random and emits one warning per run pointing at
-* ctx.now()/ctx.random(). Detection is attributed by AsyncLocalStorage:
-* only code inside the workflow body's async context can trigger it, so
-* host code running concurrently, engine internals outside the body, and
-* other runs never produce a false warning, and nothing is ever restored,
-* so concurrent executes cannot race the patch state.
+* of keys must be stable. Bare-nondeterminism detection is ENGINE-owned
+* since RV-209: the engine wraps its `execute` call in
+* `withDeterminismDetection` (runner/determinism.ts), which classifies
+* bare Date.now/Math.random callers, emits the structured
+* `determinism:warning` event on the run's stream, and under
+* `determinism.mode: 'error'` rejects the run with a typed
+* DeterminismError. The runner itself is a pure executor, so the frozen
+* ScriptRunner seam carries no detection surface; a standalone execute
+* outside an engine runs without detection.
 */
 declare class InProcessRunner implements ScriptRunner {
   private readonly onEscalation?;
@@ -4769,6 +4877,39 @@ declare class InProcessRunner implements ScriptRunner {
   execute<A, R>(wf: Workflow<A, R> | CompiledWorkflow, ctx: Ctx<never>, args: A): Promise<R>;
 }
 //#endregion
+//#region src/runner/determinism.d.ts
+/**
+* Detection modes. 'off': never detect. 'warn' (the default, and the
+* pre-RV-209 behavior): detect outside production (NODE_ENV !==
+* 'production'), emit one `determinism:warning` event and one process
+* warning per category per segment, never reject. 'error': detect in
+* EVERY environment including production, and reject the run at the
+* first workflow-origin call with a typed DeterminismError (the strict
+* gate for replay-verified pipelines).
+*/
+type DeterminismMode = "off" | "warn" | "error";
+/** Host configuration for the guard (CreateEngineOptions.determinism). */
+interface DeterminismConfig {
+  mode?: DeterminismMode;
+  /**
+  * Caller frames matching any pattern are exempt by explicit host
+  * decision: classified 'allowlisted' in the emitted event, never a
+  * process warning, never a rejection. A string matches as a
+  * substring of the frame; a RegExp matches by test. Patterns match
+  * the RAW frame, before any redaction. Installed dependencies
+  * (node_modules) and Node runtime frames (`node:` specifiers) are
+  * exempt WITHOUT configuration and emit nothing at all.
+  */
+  allowlist?: ReadonlyArray<string | RegExp>;
+  /**
+  * Redaction hook for public telemetry: applied to the frame and the
+  * parsed file path before they leave in events, process warnings, and
+  * DeterminismError data, so absolute host paths need not reach an
+  * OTel backend. Default: identity.
+  */
+  redact?: (frame: string) => string;
+}
+//#endregion
 //#region src/model/pricing.d.ts
 interface PriceTable {
   /** Monotonic version string; recorded in decision entries. */
@@ -4916,6 +5057,18 @@ interface CreateEngineOptions {
   redaction?: {
     maskEvents?: boolean;
   };
+  /**
+  * Bare-nondeterminism detection over in-process workflow bodies
+  * (RV-209): mode 'off' | 'warn' (default; detects outside production)
+  * | 'error' (detects everywhere and rejects the run at the first
+  * workflow-origin bare Date.now/Math.random with a typed
+  * DeterminismError), plus the frame `allowlist` for confirmed-safe
+  * callers and the `redact` hook for public telemetry. Workflow-origin
+  * violations emit the structured `determinism:warning` event with the
+  * caller frame and parsed file/line; installed dependencies and Node
+  * runtime frames are classified exempt and stay silent.
+  */
+  determinism?: DeterminismConfig;
 }
 interface RunOptions {
   /** Explicit id; otherwise the engine mints a ULID. */
@@ -5065,6 +5218,19 @@ declare function workflowSourceRef(runId: string): string;
 * `argsHash` field docs).
 */
 declare function hashRunArgs(args: unknown): string | undefined;
+/**
+* sha256 hex over the JCS canonical serialization of a run's result
+* value: the digest the engine records as `outputHash` on the journaled
+* run-settle decision when the settling segment computed a value, and
+* the value `rulvar replay --compare-output-hash` compares a replayed
+* result against (RV-209). Best-effort by design: returns undefined for
+* undefined values and for values JCS cannot serialize (functions,
+* cycles, non-finite numbers), so an unhashable result records no
+* baseline rather than failing the settle. Like `hashRunArgs`, the
+* digest is deterministic and unsalted: treat it as sensitive-derived
+* metadata for low-entropy results.
+*/
+declare function hashRunOutput(value: unknown): string | undefined;
 declare function createEngine(options: CreateEngineOptions): Engine;
 //#endregion
 //#region src/orchestrator/finish-validators.d.ts
@@ -6845,10 +7011,16 @@ declare function assertFencedWrites(stores: {
 //#region src/stores/reconcile.d.ts
 /** The decisionType of the journaled run settle entry. */
 declare const RUN_SETTLE_DECISION_TYPE = "run_settle";
-/** The last journaled run settle of a journal, if any. */
+/**
+* The last journaled run settle of a journal, if any. `outputHash` is
+* present when that settle recorded the result digest (RV-209; settles
+* written before it, or over undefined/non-serializable results, carry
+* none).
+*/
 declare function lastRunSettle(entries: readonly JournalEntry[]): {
   runStatus: RunStatus;
   seq: number;
+  outputHash?: string;
 } | undefined;
 type RunAuditVerdict = "consistent" | "meta-behind" | "stranded" | "suspect";
 interface RunStateAudit {
@@ -7300,6 +7472,58 @@ declare class EventBus {
   iterate(): AsyncIterable<WorkflowEvent>;
 }
 //#endregion
+//#region src/l0/telemetry-reduce.d.ts
+/** One phase activation of one agent span. */
+interface PhaseRow {
+  invocation: number;
+  role: string;
+  model: string;
+  /** 0 until the end event arrives, and on replayed rows. */
+  durationMs: number;
+  usage: Usage;
+  costUsd: number;
+  outcome?: "ok" | "error";
+  retries: number;
+  replayed: boolean;
+  /** True when the phase's end event never arrived. */
+  open: boolean;
+}
+/** One logical agent span. */
+interface AgentInvocationRow {
+  spanId: string;
+  agentType: string;
+  label?: string;
+  /** The primary role from agent:start. */
+  role?: string;
+  /** From agent:end; absent while the span is open. */
+  status?: string;
+  usage: Usage;
+  costUsd: number;
+  usageApprox: boolean;
+  retryCount: number;
+  replayed: boolean;
+  /** True when the span's agent:end never arrived. */
+  open: boolean;
+  phases: PhaseRow[];
+}
+/** The reduced table plus the per-role aggregate across every span. */
+interface InvocationTable {
+  agents: AgentInvocationRow[];
+  /** Aggregated over COMPLETED phase pairs, keyed by role. */
+  byRole: Record<string, {
+    usage: Usage;
+    costUsd: number;
+  }>;
+  /** Sum of agent:end costUsd over settled spans. */
+  totalCostUsd: number;
+}
+/**
+* Reduces one run's event stream (or any slice of it) to the invocation
+* table. Feed it the events in emission order; both a live stream and a
+* replayed one produce the same usage and cost columns.
+*/
+declare function reduceInvocationTable(events: Iterable<WorkflowEvent>): InvocationTable;
+//#endregion
 //#region src/runner/sandbox-bridge.d.ts
 /** Methods a sandbox script may proxy to the host ctx. */
 type SandboxMethod = "agent" | "step" | "workflow" | "awaitExternal" | "parallel" | "pipeline" | "phase" | "budget.spent" | "budget.remaining";
@@ -7372,4 +7596,4 @@ interface SandboxBridge {
 declare const SANDBOX_AGENT_OPT_KEYS: readonly string[];
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, registryKeyRing, remeasureQueue, replayDisposition, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type InvocationTable, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/dist/index.js

@@ -289,6 +289,27 @@ var KnowledgeCasError = class extends RulvarError {
 	}
 };
 /**
+* A workflow-origin bare-nondeterminism violation under
+* `determinism.mode: 'error'` (RV-209): bare `Date.now()` or
+* `Math.random()` called from workflow code inside a run. Thrown at the
+* offending call site (and re-thrown at settle if the workflow swallowed
+* it), so the run rejects instead of recording a value replay cannot
+* reproduce. `data` carries the structured localization: `category`,
+* `frame`, and the parsed `file`/`line`/`column` when the frame names
+* one. Never journaled as its own entry; the run settles 'error' with
+* this wire error. Exempt provenances (installed dependencies, Node
+* runtime frames, allowlisted patterns) never raise it.
+*/
+var DeterminismError = class extends RulvarError {
+	code = "determinism";
+	constructor(message, opts) {
+		super(message, {
+			retryable: false,
+			...opts
+		});
+	}
+};
+/**
 * Projects an AgentError to its WireError form: code 'agent', with kind,
 * retryAfterMs, and issues carried in data. Issue paths are flattened to
 * JSON-safe segments.
@@ -6580,7 +6601,12 @@ const TERMINAL = /* @__PURE__ */ new Set([
 	"exhausted"
 ]);
 const wallClock = Date.now.bind(globalThis);
-/** The last journaled run settle of a journal, if any. */
+/**
+* The last journaled run settle of a journal, if any. `outputHash` is
+* present when that settle recorded the result digest (RV-209; settles
+* written before it, or over undefined/non-serializable results, carry
+* none).
+*/
 function lastRunSettle(entries) {
 	for (let i = entries.length - 1; i >= 0; i -= 1) {
 		const entry = entries[i];
@@ -6588,7 +6614,8 @@ function lastRunSettle(entries) {
 		const value = entry.value;
 		if (value?.decisionType === "run_settle" && typeof value.runStatus === "string" && RUN_STATUSES.has(value.runStatus)) return {
 			runStatus: value.runStatus,
-			seq: entry.seq
+			seq: entry.seq,
+			...typeof value.outputHash === "string" ? { outputHash: value.outputHash } : {}
 		};
 	}
 }
@@ -8515,7 +8542,7 @@ const ZERO_USAGE$1 = {
 	cacheReadTokens: 0,
 	cacheWriteTokens: 0
 };
-function addUsage(total, turn) {
+function addUsage$1(total, turn) {
 	const sum = {
 		inputTokens: total.inputTokens + turn.inputTokens,
 		outputTokens: total.outputTokens + turn.outputTokens,
@@ -8625,7 +8652,7 @@ async function streamTurn(adapter, req, options) {
 						cacheWriteTokens: cleaned.cacheWriteTokens ?? 0
 					};
 					if (cleaned.reasoningTokens !== void 0) delta.reasoningTokens = cleaned.reasoningTokens;
-					reported = addUsage(reported, delta);
+					reported = addUsage$1(reported, delta);
 					options.onUsage?.(delta);
 					break;
 				}
@@ -8872,9 +8899,73 @@ async function runAgent(options) {
 		usageByPhaseModel.set(key, {
 			role,
 			servedBy: ref,
-			usage: addUsage(prior?.usage ?? ZERO_USAGE$1, usage)
+			usage: addUsage$1(prior?.usage ?? ZERO_USAGE$1, usage)
+		});
+	};
+	let invocationCounter = 0;
+	let transportRetries = 0;
+	const roleUsageSnapshot = (role) => {
+		const snapshot = /* @__PURE__ */ new Map();
+		for (const [key, slice] of usageByPhaseModel) if (slice.role === role) snapshot.set(key, slice.usage);
+		return snapshot;
+	};
+	const usageDelta = (after, before) => {
+		const base = before ?? ZERO_USAGE$1;
+		const delta = {
+			inputTokens: Math.max(0, after.inputTokens - base.inputTokens),
+			outputTokens: Math.max(0, after.outputTokens - base.outputTokens),
+			cacheReadTokens: Math.max(0, after.cacheReadTokens - base.cacheReadTokens),
+			cacheWriteTokens: Math.max(0, after.cacheWriteTokens - base.cacheWriteTokens)
+		};
+		const reasoning = (after.reasoningTokens ?? 0) - (base.reasoningTokens ?? 0);
+		if (reasoning > 0) delta.reasoningTokens = reasoning;
+		return delta;
+	};
+	const beginPhase = (role, model) => {
+		invocationCounter += 1;
+		events?.emit({
+			type: "agent:phase:start",
+			agentType,
+			label: options.label,
+			role,
+			model,
+			invocation: invocationCounter
+		});
+		return {
+			invocation: invocationCounter,
+			role,
+			model,
+			before: roleUsageSnapshot(role),
+			startedAtMs: now(),
+			retriesBefore: transportRetries
+		};
+	};
+	const endPhase = (phase, outcome, servedModel) => {
+		let phaseUsage = ZERO_USAGE$1;
+		let phaseUsd = 0;
+		for (const [key, slice] of usageByPhaseModel) {
+			if (slice.role !== phase.role) continue;
+			const delta = usageDelta(slice.usage, phase.before.get(key));
+			phaseUsage = addUsage$1(phaseUsage, delta);
+			const priced = options.priceUsd?.(slice.servedBy, delta) ?? 0;
+			if (Number.isFinite(priced) && priced > 0) phaseUsd += priced;
+		}
+		const retries = transportRetries - phase.retriesBefore;
+		events?.emit({
+			type: "agent:phase:end",
+			agentType,
+			label: options.label,
+			role: phase.role,
+			model: servedModel ?? phase.model,
+			invocation: phase.invocation,
+			durationMs: Math.max(0, now() - phase.startedAtMs),
+			usage: phaseUsage,
+			costUsd: phaseUsd,
+			outcome,
+			...retries > 0 ? { retries } : {}
 		});
 	};
+	const phaseOutcome = () => status === "error" || status === "cancelled" ? "error" : "ok";
 	let turns = 0;
 	let schemaAttempts = 0;
 	let output = null;
@@ -9181,6 +9272,7 @@ async function runAgent(options) {
 		model: servedBy,
 		role: primaryRole
 	});
+	const loopPhase = beginPhase(primaryRole, servedBy);
 	let invariantViolation;
 	const recordUsage = (usage, reported, adapterId, ref, role, streamViolation) => {
 		if (streamViolation !== void 0) invariantViolation ??= `adapter '${adapterId}' violated the Usage invariant: ${streamViolation}`;
@@ -9188,7 +9280,7 @@ async function runAgent(options) {
 		const violation = usageInvariantViolation(snapshot, adapterId);
 		if (violation !== void 0) invariantViolation ??= violation;
 		const safe = violation === void 0 ? snapshot : sanitizeUsage(snapshot);
-		totalUsage = addUsage(totalUsage, safe);
+		totalUsage = addUsage$1(totalUsage, safe);
 		addPhaseUsage(role, ref, safe);
 		const remainder = {
 			inputTokens: Math.max(0, safe.inputTokens - reported.inputTokens),
@@ -9290,13 +9382,16 @@ async function runAgent(options) {
 						target
 					};
 					const retryAfter = (outcome.wireError?.data)?.retryAfterMs;
-					if (outcome.wireError !== void 0) events?.emit({
-						type: "agent:error",
-						agentType,
-						label: options.label,
-						error: outcome.wireError,
-						willRetry: true
-					});
+					if (outcome.wireError !== void 0) {
+						transportRetries += 1;
+						events?.emit({
+							type: "agent:error",
+							agentType,
+							label: options.label,
+							error: outcome.wireError,
+							willRetry: true
+						});
+					}
 					await backoffWait(retryDelayMs(retryPolicy, tries - 1, typeof retryAfter === "number" ? retryAfter : void 0, retryRandom));
 					const abortedAfter = abortKind();
 					if (abortedAfter !== void 0) return {
@@ -9528,13 +9623,7 @@ async function runAgent(options) {
 				...options.compaction?.threshold === void 0 ? {} : { threshold: options.compaction.threshold }
 			})) {
 				const summarizeResolved = options.summarize.resolved;
-				events?.emit({
-					type: "agent:start",
-					agentType,
-					label: options.label,
-					model: summarizeResolved.ref,
-					role: "summarize"
-				});
+				const summarizePhase = beginPhase("summarize", summarizeResolved.ref);
 				for (const scrub of summarizeResolved.scrubs) events?.emit({
 					type: "log",
 					level: "warn",
@@ -9548,6 +9637,7 @@ async function runAgent(options) {
 						kind: "budget",
 						retryable: false
 					};
+					endPhase(summarizePhase, "error");
 					break;
 				}
 				turns += 1;
@@ -9586,9 +9676,11 @@ async function runAgent(options) {
 						retryable: false
 					};
 					errorMessage = thrown.message;
+					endPhase(summarizePhase, "error");
 					break;
 				}
-				const { outcome: summary } = summaryDispatch;
+				const { outcome: summary, target: summarizeTarget } = summaryDispatch;
+				const summarizeServed = summarizeTarget.resolved.ref;
 				usageApprox = usageApprox || summary.usageApprox;
 				if (summary.aborted === "budget") {
 					status = "cancelled";
@@ -9596,10 +9688,12 @@ async function runAgent(options) {
 						kind: "budget",
 						retryable: false
 					};
+					endPhase(summarizePhase, "error", summarizeServed);
 					break;
 				}
 				if (summary.aborted === "external") {
 					status = "cancelled";
+					endPhase(summarizePhase, "error", summarizeServed);
 					break;
 				}
 				if (summary.wireError !== void 0 || summary.aborted === "idle" || summary.turn.text.trim() === "") {
@@ -9609,6 +9703,7 @@ async function runAgent(options) {
 						level: "warn",
 						msg: "compaction disabled for this run: the summarize invocation " + (summary.wireError !== void 0 ? `failed (${summary.wireError.message})` : summary.aborted === "idle" ? "timed out" : "returned an empty summary")
 					});
+					endPhase(summarizePhase, "error", summarizeServed);
 				} else {
 					const compacted = compactMessages(messages, summary.turn.text);
 					messages.length = 0;
@@ -9618,6 +9713,7 @@ async function runAgent(options) {
 						inputTokens: 0,
 						outputTokens: 0
 					};
+					endPhase(summarizePhase, "ok", summarizeServed);
 				}
 			}
 			await saveBoundary();
@@ -9702,15 +9798,11 @@ async function runAgent(options) {
 		await saveBoundary();
 		continue loop;
 	}
+	endPhase(loopPhase, phaseOutcome(), servedBy);
 	if (status === "ok" && !finishedViaTool && options.finalize !== void 0) {
 		const finalizeResolved = options.finalize.resolved;
-		events?.emit({
-			type: "agent:start",
-			agentType,
-			label: options.label,
-			model: finalizeResolved.ref,
-			role: "finalize"
-		});
+		const finalizePhase = beginPhase("finalize", finalizeResolved.ref);
+		let finalizeServed;
 		let proceed = true;
 		try {
 			options.budget?.beforeTurn();
@@ -9769,6 +9861,7 @@ async function runAgent(options) {
 			}
 			if (finalizeDispatch !== void 0) {
 				const { outcome, target: finalizeTarget } = finalizeDispatch;
+				finalizeServed = finalizeTarget.resolved.ref;
 				usageApprox = usageApprox || outcome.usageApprox;
 				messages.push(assistantMsg(outcome.turn, liftRetainedParts(outcome.providerMetadata, finalizeTarget.adapter)));
 				if (invariantViolation !== void 0) {
@@ -9818,16 +9911,12 @@ async function runAgent(options) {
 				}
 			}
 		}
+		endPhase(finalizePhase, phaseOutcome(), finalizeServed);
 	}
 	if (status === "ok" && !finishedViaTool && separateExtract && options.extract !== void 0 && options.schema !== void 0) {
 		const extractResolved = options.extract.resolved;
-		events?.emit({
-			type: "agent:start",
-			agentType,
-			label: options.label,
-			model: extractResolved.ref,
-			role: "extract"
-		});
+		const extractPhase = beginPhase("extract", extractResolved.ref);
+		let extractServed;
 		const extractTierFor = (target) => selectStructuredOutputTier(target.adapter.caps(target.resolved.model), options.canonicalSchema ?? {});
 		const extractChain = [{
 			adapter: options.extract.adapter,
@@ -9891,6 +9980,7 @@ async function runAgent(options) {
 				break;
 			}
 			const { outcome, target: extractTarget } = extractDispatch;
+			extractServed = extractTarget.resolved.ref;
 			usageApprox = usageApprox || outcome.usageApprox;
 			if (invariantViolation !== void 0) {
 				status = "error";
@@ -9944,6 +10034,7 @@ async function runAgent(options) {
 				}
 			}
 		}
+		endPhase(extractPhase, phaseOutcome(), extractServed);
 	}
 	let transcriptRef = "";
 	if (options.transcript !== void 0) {
@@ -9967,6 +10058,7 @@ async function runAgent(options) {
 	if (abortClass !== void 0) result.abortClass = abortClass;
 	if (errorMessage !== void 0) result.errorMessage = errorMessage;
 	if (usageApprox) result.usageApprox = true;
+	if (transportRetries > 0) result.transportRetries = transportRetries;
 	return result;
 }
 //#endregion
@@ -11833,6 +11925,29 @@ function createCtx(internals, rootWorkflow) {
 					durationMs: 0
 				}, spanId, true);
 			}
+			if (terminal !== void 0) entryUsageSlices(terminal).forEach((slice, index) => {
+				const priced = internals.priceUsd(slice.servedBy, slice.usage) ?? 0;
+				const sliceUsd = Number.isFinite(priced) && priced > 0 ? priced : 0;
+				const common = {
+					agentType,
+					label: opts.label,
+					role: slice.role ?? primaryRole,
+					model: slice.servedBy,
+					invocation: index + 1
+				};
+				internals.events.emit({
+					type: "agent:phase:start",
+					...common
+				}, spanId, true);
+				internals.events.emit({
+					type: "agent:phase:end",
+					...common,
+					durationMs: 0,
+					usage: slice.usage,
+					costUsd: sliceUsd,
+					outcome: terminal.status === "error" || terminal.status === "cancelled" ? "error" : "ok"
+				}, spanId, true);
+			});
 			internals.events.emit({
 				type: "agent:end",
 				agentType,
@@ -12323,7 +12438,8 @@ function createCtx(internals, rootWorkflow) {
 			usage: result.usage,
 			costUsd: result.costUsd,
 			entryRef: terminal.seq,
-			...resultUsageApprox ? { usageApprox: true } : {}
+			...resultUsageApprox ? { usageApprox: true } : {},
+			...result.transportRetries !== void 0 && result.transportRetries > 0 ? { retryCount: result.transportRetries } : {}
 		}, spanId);
 		if (result.status === "escalated" && result.escalation !== void 0) {
 			let decision = flavorBDecision;
@@ -14298,6 +14414,132 @@ var EventBus = class {
 	}
 };
 //#endregion
+//#region src/l0/telemetry-reduce.ts
+const ZERO = {
+	inputTokens: 0,
+	outputTokens: 0,
+	cacheReadTokens: 0,
+	cacheWriteTokens: 0
+};
+function addUsage(a, b) {
+	const sum = {
+		inputTokens: a.inputTokens + b.inputTokens,
+		outputTokens: a.outputTokens + b.outputTokens,
+		cacheReadTokens: a.cacheReadTokens + b.cacheReadTokens,
+		cacheWriteTokens: a.cacheWriteTokens + b.cacheWriteTokens
+	};
+	const reasoning = (a.reasoningTokens ?? 0) + (b.reasoningTokens ?? 0);
+	if (reasoning > 0) sum.reasoningTokens = reasoning;
+	return sum;
+}
+/**
+* Reduces one run's event stream (or any slice of it) to the invocation
+* table. Feed it the events in emission order; both a live stream and a
+* replayed one produce the same usage and cost columns.
+*/
+function reduceInvocationTable(events) {
+	const rows = /* @__PURE__ */ new Map();
+	const order = [];
+	const openPhases = /* @__PURE__ */ new Map();
+	const byRole = {};
+	let totalCostUsd = 0;
+	const rowFor = (event) => {
+		let row = rows.get(event.spanId);
+		if (row === void 0) {
+			row = {
+				spanId: event.spanId,
+				agentType: event.agentType,
+				...event.label === void 0 ? {} : { label: event.label },
+				usage: ZERO,
+				costUsd: 0,
+				usageApprox: false,
+				retryCount: 0,
+				replayed: event.replayed === true,
+				open: true,
+				phases: []
+			};
+			rows.set(event.spanId, row);
+			order.push(row);
+		}
+		return row;
+	};
+	for (const event of events) switch (event.type) {
+		case "agent:start": {
+			const row = rowFor(event);
+			row.role = event.role;
+			break;
+		}
+		case "agent:phase:start": {
+			const row = rowFor(event);
+			const phase = {
+				invocation: event.invocation,
+				role: event.role,
+				model: event.model,
+				durationMs: 0,
+				usage: ZERO,
+				costUsd: 0,
+				retries: 0,
+				replayed: event.replayed === true,
+				open: true
+			};
+			row.phases.push(phase);
+			openPhases.set(`${event.spanId}#${event.invocation}`, phase);
+			break;
+		}
+		case "agent:phase:end": {
+			const key = `${event.spanId}#${event.invocation}`;
+			let phase = openPhases.get(key);
+			if (phase === void 0) {
+				phase = {
+					invocation: event.invocation,
+					role: event.role,
+					model: event.model,
+					durationMs: 0,
+					usage: ZERO,
+					costUsd: 0,
+					retries: 0,
+					replayed: event.replayed === true,
+					open: true
+				};
+				rowFor(event).phases.push(phase);
+			}
+			openPhases.delete(key);
+			phase.open = false;
+			phase.role = event.role;
+			phase.model = event.model;
+			phase.durationMs = event.durationMs;
+			phase.usage = event.usage;
+			phase.costUsd = event.costUsd;
+			phase.outcome = event.outcome;
+			phase.retries = event.retries ?? 0;
+			const bucket = byRole[event.role] ??= {
+				usage: ZERO,
+				costUsd: 0
+			};
+			bucket.usage = addUsage(bucket.usage, event.usage);
+			bucket.costUsd += event.costUsd;
+			break;
+		}
+		case "agent:end": {
+			const row = rowFor(event);
+			row.open = false;
+			row.status = event.status;
+			row.usage = event.usage;
+			row.costUsd = event.costUsd;
+			row.usageApprox = event.usageApprox === true;
+			row.retryCount = event.retryCount ?? 0;
+			totalCostUsd += event.costUsd;
+			break;
+		}
+		default: break;
+	}
+	return {
+		agents: order,
+		byRole,
+		totalCostUsd
+	};
+}
+//#endregion
 //#region src/l0/run-id.ts
 /**
 * Run id containment (v1.36.0 review SEC-P1). A runId becomes both a
@@ -14323,46 +14565,172 @@ function assertSafeRunId(runId, context) {
 //#endregion
 //#region src/runner/inprocess.ts
 /**
-* ScriptRunner SPI and InProcessRunner (M1-T11).
+* The mode (a) runner for human-authored closures. Determinism is enforced
+* by convention, lint, and the ctx shims, NOT by a VM: only the sequence
+* of keys must be stable. Bare-nondeterminism detection is ENGINE-owned
+* since RV-209: the engine wraps its `execute` call in
+* `withDeterminismDetection` (runner/determinism.ts), which classifies
+* bare Date.now/Math.random callers, emits the structured
+* `determinism:warning` event on the run's stream, and under
+* `determinism.mode: 'error'` rejects the run with a typed
+* DeterminismError. The runner itself is a pure executor, so the frozen
+* ScriptRunner seam carries no detection surface; a standalone execute
+* outside an engine runs without detection.
+*/
+var InProcessRunner = class {
+	onEscalation;
+	constructor(o) {
+		if (o?.onEscalation !== void 0) this.onEscalation = o.onEscalation;
+	}
+	/** The hook is read by the escalation delivery path from M3 onward. */
+	get escalationHook() {
+		return this.onEscalation;
+	}
+	async execute(wf, ctx, args) {
+		if (wf.kind !== "workflow") throw new TypeError("InProcessRunner executes closure Workflow values only; CompiledWorkflow runs in the worker sandbox (@rulvar/planner, M6)");
+		return await wf.body(ctx, args);
+	}
+};
+//#endregion
+//#region src/runner/determinism.ts
+/**
+* Bare-nondeterminism detection (RV-209): the engine-owned guard that
+* classifies bare `Date.now()`/`Math.random()` calls observed inside a
+* run, localizes workflow-origin ones to a file and line, emits the
+* structured `determinism:warning` event, and under `mode: 'error'`
+* rejects the run with a typed DeterminismError instead of letting a
+* value replay cannot reproduce into the result.
 *
-* Script runner contract: https://docs.rulvar.com/guide/planner
-* Workflow (a closure value) runs in process only; CompiledWorkflow is the
-* only form admissible to the worker sandbox and first exists at M6
-* (compileScript in @rulvar/planner), so until then the engine accepts
-* only in-process Workflow values. The SPI's L0 listing refers
-* to its frozen-seam status; the declaration lives here with its types.
+* The machinery began life inside InProcessRunner (dev-mode process
+* warnings only); it lives here so the engine can thread the run's
+* event channel and the host's DeterminismConfig without touching the
+* frozen ScriptRunner seam: the engine wraps the in-process
+* `runner.execute(...)` call in `withDeterminismDetection`, and the
+* runner itself stays a pure executor.
+*
+* Attribution is by AsyncLocalStorage: only code inside the wrapped
+* execution inherits the detection store, so host code running
+* concurrently, engine internals outside the body, and other runs never
+* false-warn. The globals are patched ONCE per process and never
+* restored (outside a detection context the patch is a transparent
+* passthrough); the previous per-execute patch/restore pair could race
+* under concurrent runs (the false RULVAR_BARE_DATE_NOW class the 1.5.2
+* review reproduced). Rulvar's own internals never reach the check:
+* every internal real-time read binds the module-load clock
+* (l0/real-clock.ts and the ULID factory default), never the live
+* global (v1.18.0 review P2-6).
 */
 const detection = new AsyncLocalStorage();
 let globalsPatched = false;
+const MODES = /* @__PURE__ */ new Set([
+	"off",
+	"warn",
+	"error"
+]);
 /**
-* Stack line 0 names the Error, line 1 this helper, line 2 the patched
-* global, line 3 the caller whose provenance decides (the layout is
-* pinned by construction: this helper is only ever called by the two
-* patched globals). Two origins are exempt: installed dependencies (a
-* provider SDK, any transitive package, rulvar's own published dist),
-* which live under node_modules, and Node's own machinery (the undici
-* transport behind fetch, timers, stream internals), whose frames carry
-* `node:` specifiers and inherit the run's async context. The guard
-* exists for workflow code, which imports from both but lives in
-* neither. Rulvar's own internals never reach this check at all: every
-* internal real-time read binds the module-load clock (l0/real-clock.ts
-* and the ULID factory default), never the live global, so frames from
-* workspace dists or this repo's sources cannot false-warn (v1.18.0
-* review P2-6).
+* Fail-loud validation at engine construction: an invalid mode, a
+* non-function redact hook, or a malformed allowlist entry is a
+* ConfigError before any run can start under it.
+*/
+function validateDeterminismConfig(config) {
+	if (config === void 0) return;
+	if (config.mode !== void 0 && !MODES.has(config.mode)) throw new ConfigError(`determinism.mode must be 'off', 'warn', or 'error'; got '${String(config.mode)}'`);
+	if (config.allowlist !== void 0) {
+		for (const pattern of config.allowlist) if (typeof pattern !== "string" && !(pattern instanceof RegExp)) throw new ConfigError("determinism.allowlist entries must be strings (substring match) or RegExp values");
+	}
+	if (config.redact !== void 0 && typeof config.redact !== "function") throw new ConfigError("determinism.redact must be a function (frame: string) => string");
+}
+function resolveConfig(config) {
+	return {
+		mode: config?.mode ?? "warn",
+		allowlist: config?.allowlist ?? [],
+		redact: config?.redact ?? ((frame) => frame)
+	};
+}
+/**
+* The trailing `path:line:column` of a V8 stack frame, in both layouts:
+* `at fn (/abs/path.ts:12:5)` and `at file:///abs/path.ts:12:5`. Frames
+* without one (native frames, nested eval) yield undefined and the
+* event carries the frame string alone.
 */
-function libraryCaller() {
+const FRAME_LOCATION = /(?:\(|at\s)([^()]+):(\d+):(\d+)\)?\s*$/;
+function parseFrameLocation(frame) {
+	const match = FRAME_LOCATION.exec(frame);
+	if (match === null) return;
+	return {
+		file: match[1].replace(/\?.*$/, ""),
+		line: Number(match[2]),
+		column: Number(match[3])
+	};
+}
+function matchesAllowlist(frame, allowlist) {
+	return allowlist.some((pattern) => typeof pattern === "string" ? frame.includes(pattern) : pattern.test(frame));
+}
+/**
+* Stack line 0 names the Error, line 1 this observer, line 2 the patched
+* global, line 3 the caller whose provenance decides (the layout is
+* pinned by construction: the observer is only ever called by the two
+* patched globals). Two origins are exempt without configuration:
+* installed dependencies (a provider SDK, any transitive package,
+* rulvar's own published dist), which live under node_modules, and
+* Node's own machinery (the undici transport behind fetch, timers,
+* stream internals), whose frames carry `node:` specifiers and inherit
+* the run's async context. The guard exists for workflow code, which
+* imports from both but lives in neither.
+*/
+function observeBareCall(category) {
+	const state = detection.getStore();
+	if (state === void 0) return;
 	const caller = (/* @__PURE__ */ new Error()).stack?.split("\n")[3];
-	if (caller === void 0) return false;
-	return caller.includes("node_modules") || /[(\s]node:/.test(caller);
+	if (caller === void 0) return;
+	if (caller.includes("node_modules") || /[(\s]node:/.test(caller)) return;
+	const frame = caller.trim();
+	const provenance = matchesAllowlist(frame, state.config.allowlist) ? "allowlisted" : "workflow";
+	const location = parseFrameLocation(frame);
+	const redact = state.config.redact;
+	const redactedFile = location === void 0 ? void 0 : redact(location.file);
+	const dedupeKey = `${category}:${provenance}`;
+	if (!state.emitted.has(dedupeKey)) {
+		state.emitted.add(dedupeKey);
+		state.emit({
+			type: "determinism:warning",
+			category,
+			provenance,
+			frame: redact(frame),
+			...location === void 0 || redactedFile === void 0 ? {} : {
+				file: redactedFile,
+				line: location.line,
+				column: location.column
+			}
+		});
+		if (provenance === "workflow" && state.config.mode === "warn") {
+			const globalName = category === "bare-date-now" ? "Date.now()" : "Math.random()";
+			const shim = category === "bare-date-now" ? "ctx.now()" : "ctx.random()";
+			const at = location === void 0 ? "" : ` at ${redactedFile}:${location.line}:${location.column}`;
+			process.emitWarning(`bare ${globalName} called inside a rulvar run${at}; use ${shim} so the value is journaled and stable on replay`, {
+				code: category === "bare-date-now" ? "RULVAR_BARE_DATE_NOW" : "RULVAR_BARE_MATH_RANDOM",
+				type: "RulvarWarning"
+			});
+		}
+	}
+	if (provenance === "workflow" && state.config.mode === "error") {
+		const error = new DeterminismError(`bare ${category === "bare-date-now" ? "Date.now()" : "Math.random()"} called inside a rulvar run${location === void 0 ? "" : ` at ${redactedFile}:${location.line}:${location.column}`} under determinism.mode 'error'; use ${category === "bare-date-now" ? "ctx.now()" : "ctx.random()"} or allowlist the frame`, { data: {
+			category,
+			frame: redact(frame),
+			...location === void 0 || redactedFile === void 0 ? {} : {
+				file: redactedFile,
+				line: location.line,
+				column: location.column
+			}
+		} });
+		state.rejection ??= error;
+		throw error;
+	}
 }
 /**
 * Patches Date.now and Math.random ONCE per process and never restores:
-* outside a workflow's async context the store is absent and the patch is
-* a transparent passthrough. The previous per-execute patch/restore pair
-* could race under concurrent runs (one run's restore removed another's
-* patch, and the second restore re-installed a stale patched function
-* PERMANENTLY, which could then warn on host code outside any run: the
-* false RULVAR_BARE_DATE_NOW class the 1.5.2 review reproduced).
+* outside a detection context the store is absent and the patch is a
+* transparent passthrough.
 */
 function patchGlobalsOnce() {
 	if (globalsPatched) return;
@@ -14370,60 +14738,36 @@ function patchGlobalsOnce() {
 	const priorNow = Date.now;
 	const priorRandom = Math.random;
 	Date.now = function rulvarPatchedDateNow() {
-		const state = detection.getStore();
-		if (state !== void 0 && !state.warnedNow && !libraryCaller()) {
-			state.warnedNow = true;
-			process.emitWarning("bare Date.now() called inside a rulvar run; use ctx.now() so the value is journaled and stable on replay", {
-				code: "RULVAR_BARE_DATE_NOW",
-				type: "RulvarWarning"
-			});
-		}
+		observeBareCall("bare-date-now");
 		return priorNow();
 	};
 	Math.random = function rulvarPatchedMathRandom() {
-		const state = detection.getStore();
-		if (state !== void 0 && !state.warnedRandom && !libraryCaller()) {
-			state.warnedRandom = true;
-			process.emitWarning("bare Math.random() called inside a rulvar run; use ctx.random() so the value is journaled and stable on replay", {
-				code: "RULVAR_BARE_MATH_RANDOM",
-				type: "RulvarWarning"
-			});
-		}
+		observeBareCall("bare-math-random");
 		return priorRandom();
 	};
 }
 /**
-* The mode (a) runner for human-authored closures. Determinism is enforced
-* by convention, lint, and the ctx shims, NOT by a VM: only the sequence
-* of keys must be stable. Dev mode (NODE_ENV !== 'production') detects
-* bare Date.now and Math.random and emits one warning per run pointing at
-* ctx.now()/ctx.random(). Detection is attributed by AsyncLocalStorage:
-* only code inside the workflow body's async context can trigger it, so
-* host code running concurrently, engine internals outside the body, and
-* other runs never produce a false warning, and nothing is ever restored,
-* so concurrent executes cannot race the patch state.
+* Runs `fn` (the in-process execution of a workflow body) under
+* bare-nondeterminism detection. Detection is active for mode 'warn'
+* outside production and for mode 'error' everywhere; otherwise `fn`
+* runs untouched with zero overhead. In error mode, a workflow-origin
+* violation swallowed by the body is re-thrown after the body settles,
+* so the segment rejects either way.
 */
-var InProcessRunner = class {
-	onEscalation;
-	constructor(o) {
-		if (o?.onEscalation !== void 0) this.onEscalation = o.onEscalation;
-	}
-	/** The hook is read by the escalation delivery path from M3 onward. */
-	get escalationHook() {
-		return this.onEscalation;
-	}
-	async execute(wf, ctx, args) {
-		if (wf.kind !== "workflow") throw new TypeError("InProcessRunner executes closure Workflow values only; CompiledWorkflow runs in the worker sandbox (@rulvar/planner, M6)");
-		if (process.env.NODE_ENV !== "production") {
-			patchGlobalsOnce();
-			return detection.run({
-				warnedNow: false,
-				warnedRandom: false
-			}, () => wf.body(ctx, args));
-		}
-		return await wf.body(ctx, args);
-	}
-};
+function withDeterminismDetection(config, emit, fn) {
+	const resolved = resolveConfig(config);
+	if (!(resolved.mode === "error" || resolved.mode === "warn" && process.env.NODE_ENV !== "production")) return fn();
+	patchGlobalsOnce();
+	const state = {
+		config: resolved,
+		emit,
+		emitted: /* @__PURE__ */ new Set()
+	};
+	return detection.run(state, fn).then((result) => {
+		if (state.rejection !== void 0) throw state.rejection;
+		return result;
+	});
+}
 //#endregion
 //#region src/engine/engine.ts
 /**
@@ -14495,6 +14839,26 @@ function hashRunArgs(args) {
 	if (args === void 0) return;
 	return createHash("sha256").update(jcsSerialize(args), "utf8").digest("hex");
 }
+/**
+* sha256 hex over the JCS canonical serialization of a run's result
+* value: the digest the engine records as `outputHash` on the journaled
+* run-settle decision when the settling segment computed a value, and
+* the value `rulvar replay --compare-output-hash` compares a replayed
+* result against (RV-209). Best-effort by design: returns undefined for
+* undefined values and for values JCS cannot serialize (functions,
+* cycles, non-finite numbers), so an unhashable result records no
+* baseline rather than failing the settle. Like `hashRunArgs`, the
+* digest is deterministic and unsalted: treat it as sensitive-derived
+* metadata for low-entropy results.
+*/
+function hashRunOutput(value) {
+	if (value === void 0) return;
+	try {
+		return createHash("sha256").update(jcsSerialize(value), "utf8").digest("hex");
+	} catch {
+		return;
+	}
+}
 function createEngine(options) {
 	const adapters = buildAdapterRegistry(options.adapters);
 	const rawJournal = options.stores?.journal ?? new InMemoryStore();
@@ -14523,6 +14887,7 @@ function createEngine(options) {
 		if (profile.escalation?.minSpendUsd !== void 0) requireNonNegativeNumber(profile.escalation.minSpendUsd, `createEngine defaults.profiles['${name}'].escalation.minSpendUsd`);
 		if (profile.compaction?.threshold !== void 0) requireFraction(profile.compaction.threshold, `createEngine defaults.profiles['${name}'].compaction.threshold`);
 	}
+	validateDeterminismConfig(options.determinism);
 	const knowledgeStore = options.stores?.modelKnowledge;
 	const knowledge = knowledgeStore === void 0 ? void 0 : { current: () => knowledgeStore.current() };
 	const runner = new InProcessRunner(options.onEscalation === void 0 ? void 0 : { onEscalation: options.onEscalation });
@@ -14736,7 +15101,8 @@ function createEngine(options) {
 					if (!validation.valid) throw new ConfigError(`arguments for workflow '${wf.name}' do not validate: ` + validation.issues.map((issue) => issue.message).join("; "));
 				}
 				const ctx = createCtx(internals, wf.kind === "workflow" ? wf : void 0);
-				const bodyPromise = (compiled === void 0 ? runner : options.runners?.sandbox).execute(wf, ctx, args);
+				const selectedRunner = compiled === void 0 ? runner : options.runners?.sandbox;
+				const bodyPromise = compiled === void 0 ? withDeterminismDetection(options.determinism, (event) => bus.emit(event, rootSpanId), () => selectedRunner.execute(wf, ctx, args)) : selectedRunner.execute(wf, ctx, args);
 				const raced = await Promise.race([bodyPromise.then((result) => ({
 					kind: "done",
 					result
@@ -14805,19 +15171,23 @@ function createEngine(options) {
 				const priorCount = resumeCtx?.priorEntries.length ?? 0;
 				const appendedHere = replayer.snapshot().length - priorCount;
 				const recorded = lastRunSettle(replayer.snapshot());
-				if (appendedHere > 0 || recorded !== void 0 && recorded.runStatus !== status) await replayer.appendSinglePhase({
-					scope: "",
-					key: deriverV2.deriveKey({ kind: "run-settle" }),
-					kind: "decision",
-					status: "ok",
-					spanId: rootSpanId,
-					site: "run-settle",
-					value: {
-						decisionType: RUN_SETTLE_DECISION_TYPE,
-						runStatus: status,
-						segment: segmentsBefore + 1
-					}
-				}).catch(() => void 0);
+				if (appendedHere > 0 || recorded !== void 0 && recorded.runStatus !== status) {
+					const outputHash = hashRunOutput(outcome.value);
+					await replayer.appendSinglePhase({
+						scope: "",
+						key: deriverV2.deriveKey({ kind: "run-settle" }),
+						kind: "decision",
+						status: "ok",
+						spanId: rootSpanId,
+						site: "run-settle",
+						value: {
+							decisionType: RUN_SETTLE_DECISION_TYPE,
+							runStatus: status,
+							segment: segmentsBefore + 1,
+							...outputHash === void 0 ? {} : { outputHash }
+						}
+					}).catch(() => void 0);
+				}
 			}
 			await putMeta(status).catch(() => void 0);
 			bus.emit({
@@ -15296,4 +15666,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DedupIndex, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, PlanInvariantError, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, registryKeyRing, remeasureQueue, replayDisposition, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, PlanInvariantError, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.48.0",
+  "version": "1.50.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",