@rulvar/core 1.5.2 → 1.7.0

package/dist/index.js

@@ -5484,6 +5484,7 @@ var Replayer = class {
 			if (patch.usageApprox !== void 0) entry.usageApprox = patch.usageApprox;
 			if (patch.servedBy !== void 0) entry.servedBy = patch.servedBy;
 			if (patch.usageByModel !== void 0) entry.usageByModel = patch.usageByModel;
+			if (patch.costAttribution !== void 0) entry.costAttribution = patch.costAttribution;
 			if (patch.transcriptRef !== void 0) entry.transcriptRef = patch.transcriptRef;
 			if (patch.checkpointRef !== void 0) entry.checkpointRef = patch.checkpointRef;
 			if (patch.artifacts !== void 0) entry.artifacts = toJournalValue(patch.artifacts, "terminal artifacts");
@@ -6147,19 +6148,28 @@ var FileTranscriptStore = class {
 //#endregion
 //#region src/engine/cost-report.ts
 /**
-* CostReport builders (M5-T03). Two
-* sources, one shape:
+* CostReport builders (M5-T03; follow-up: one pure fold).
 *
-* - `buildCostReport` folds the LIVE per-run attribution buckets (ctx
-*   accumulates byModel/byPhase/byAgentType/byRole per call) around the
-*   ledger-fold total, so report totals equal the budget ledger fold
-*   totals exactly at settle.
-* - `costReportFromJournal` is the pure journal fold for STORED runs
-*   (shells, `rulvar inspect`): terminal usage priced per servedBy with
-*   abandoned subtrees contributing zero, exactly like the kernel's
-*   ledger fold. Phase, agentType, and role attribution are live-run
-*   facts that entries do not carry, so those buckets are empty here;
-*   byRole and the orchestrator block complete in M7 (DEF-7).
+* `costReportFromJournal` is THE report: a pure fold over terminal
+* entries that both the engine's settle path and stored-run inspection
+* (shells, `rulvar inspect`) use, so a replayed run reports the same
+* numbers byte for byte. Terminal entries carry their attribution facts
+* (`costAttribution`: phase, agent type, primary role, budget account,
+* finalize-reserve flag) exactly so this fold can reproduce every
+* breakdown without live state; entries written before the facts
+* shipped fold under the documented fallbacks (empty phase, 'unknown'
+* agent type, role 'loop').
+*
+* Inclusion policy, applied to the total and EVERY breakdown alike:
+* terminal usage exactly once, priced per serving slice, entries under
+* abandoned subtrees contribute zero (their spend is tracked separately
+* in the abandoned-spend ledger the orchestrator sees). Attempts that
+* were paid but never abandoned (a cancelled root attempt, a dangling
+* child) are real spend and stay included everywhere.
+*
+* `buildCostReport` folds the LIVE per-run attribution buckets around
+* the ledger total; it remains for hosts that accumulated their own
+* `CostAttribution`, but the engine no longer builds outcomes from it.
 *
 * Unpriced models surface in `unpriced`, never as a silent zero.
 */
@@ -6174,14 +6184,9 @@ const ROLES = [
 function emptyByRole() {
 	return Object.fromEntries(ROLES.map((role) => [role, 0]));
 }
-function zeroOrchestrator() {
-	return {
-		spentUsd: 0,
-		share: 0,
-		wakes: 0,
-		forcedFinish: false,
-		reserveUsedUsd: 0
-	};
+/** The orchestrator sub-account naming rule of makeOrchestratorWorkflow. */
+function isOrchestratorAccount(scope) {
+	return scope === "orchestrator" || scope.endsWith("/orchestrator");
 }
 /** Folds the per-run attribution buckets into the normative CostReport. */
 function buildCostReport(attribution, totalUsd) {
@@ -6207,16 +6212,30 @@ function buildCostReport(attribution, totalUsd) {
 	};
 }
 /**
-* The pure journal fold: byModel and totals from terminal entries, the
-* same summation the kernel ledger uses (terminal usage exactly once,
-* priced per servedBy, abandoned subtrees contribute zero).
+* The pure journal fold: the complete CostReport from terminal entries,
+* the same summation the kernel ledger uses (terminal usage exactly
+* once, priced per servedBy slice, abandoned subtrees contribute zero).
+* The orchestrator block folds too: spend attributed to the
+* orchestrator sub-account, the reserve-funded share of it, the armed
+* wake count, and the at-cap freeze flag from the journaled cap
+* decision, so a replay-only resume reproduces the block instead of
+* reading this process's live accounts (which a replay never charges).
 */
 function costReportFromJournal(entries, priceUsd) {
 	const abandonFold = buildAbandonFold(entries);
 	const byModel = {};
+	const byPhase = {};
+	const byAgentType = {};
+	const byRole = emptyByRole();
 	const unpriced = [];
 	let totalUsd = 0;
+	let orchestratorSpentUsd = 0;
+	let reserveUsedUsd = 0;
+	let wakes = 0;
+	let forcedFinish = false;
 	for (const entry of entries) {
+		if (entry.kind === "decision" && entry.value?.decisionType === "orchestrator_budget_cap") forcedFinish = true;
+		if (entry.kind === "external" && entry.status === "suspended" && typeof entry.value?.key === "string" && (entry.value.key.startsWith("wake:") || entry.value.key.includes(":wake:"))) wakes += 1;
 		if (entry.kind !== "resolution" && entry.kind !== "abandon" && abandonFold.isAbandoned(entry.ref ?? entry.seq)) continue;
 		if (entry.status === "running" || entry.usage === void 0) continue;
 		const priced = priceEntryUsage(entry, priceUsd);
@@ -6226,14 +6245,30 @@ function costReportFromJournal(entries, priceUsd) {
 		});
 		for (const slice of priced.priced) byModel[slice.servedBy] = (byModel[slice.servedBy] ?? 0) + slice.usd;
 		totalUsd += priced.usd;
+		const facts = entry.costAttribution;
+		const phase = facts?.phase ?? "";
+		byPhase[phase] = (byPhase[phase] ?? 0) + priced.usd;
+		const agentType = facts?.agentType ?? "unknown";
+		byAgentType[agentType] = (byAgentType[agentType] ?? 0) + priced.usd;
+		byRole[facts?.role ?? "loop"] += priced.usd;
+		if (facts?.budgetAccount !== void 0 && isOrchestratorAccount(facts.budgetAccount)) {
+			orchestratorSpentUsd += priced.usd;
+			if (facts.finalizeReserve === true) reserveUsedUsd += priced.usd;
+		}
 	}
 	return {
 		totalUsd,
 		byModel,
-		byPhase: {},
-		byAgentType: {},
-		byRole: emptyByRole(),
-		orchestrator: zeroOrchestrator(),
+		byPhase,
+		byAgentType,
+		byRole,
+		orchestrator: {
+			spentUsd: orchestratorSpentUsd,
+			share: orchestratorSpentUsd / Math.max(totalUsd, .01),
+			wakes,
+			forcedFinish,
+			reserveUsedUsd
+		},
 		unpriced
 	};
 }
@@ -6495,15 +6530,51 @@ function fallbackTriggerOf(outcome) {
 function resolvePricing(ref, table, capsPricing) {
 	return table?.models[ref] ?? capsPricing;
 }
-/**
-* Dollars from normalized usage against one pricing row (the adapter
-* normalized the usage; inputTokens is the
-* full prompt). Cache writes price at the 5m premium rate; the 1h rate
-* applies where a provider distinguishes it in usage, which the
+/** The tier a full prompt lands in: the highest threshold strictly below it. */
+function tierFor(pricing, inputTokens) {
+	let tier;
+	for (const candidate of pricing.tiers ?? []) if (inputTokens > candidate.aboveInputTokens && (tier === void 0 || candidate.aboveInputTokens > tier.aboveInputTokens)) tier = candidate;
+	return tier;
+}
+/**
+* Dollars from normalized usage against one pricing row. Under the Usage
+* invariant inputTokens is the FULL prompt including cache reads and
+* writes, so the input rate bills only the uncached remainder and cache
+* tokens bill at their own rates, never twice; a row that omits a cache
+* rate bills those tokens at the plain input rate rather than silently
+* for free. A row may carry long-context tiers: the highest threshold
+* strictly below the full prompt re-prices the ENTIRE request
+* (input-side rates scale by inputMultiplier, the output rate by
+* outputMultiplier). Cache writes price at the 5m premium rate; the 1h
+* rate applies where a provider distinguishes it in usage, which the
 * canonical Usage does not yet carry.
 */
 function priceUsdOf(pricing, usage) {
-	return usage.inputTokens / 1e6 * pricing.inputUsdPerMTok + usage.outputTokens / 1e6 * pricing.outputUsdPerMTok + usage.cacheReadTokens / 1e6 * (pricing.cacheReadUsdPerMTok ?? 0) + usage.cacheWriteTokens / 1e6 * (pricing.cacheWriteUsdPerMTok ?? 0);
+	const tier = tierFor(pricing, usage.inputTokens);
+	const inputMul = tier?.inputMultiplier ?? 1;
+	const outputMul = tier?.outputMultiplier ?? 1;
+	return Math.max(0, usage.inputTokens - usage.cacheReadTokens - usage.cacheWriteTokens) / 1e6 * pricing.inputUsdPerMTok * inputMul + usage.outputTokens / 1e6 * pricing.outputUsdPerMTok * outputMul + usage.cacheReadTokens / 1e6 * (pricing.cacheReadUsdPerMTok ?? pricing.inputUsdPerMTok) * inputMul + usage.cacheWriteTokens / 1e6 * (pricing.cacheWriteUsdPerMTok ?? pricing.inputUsdPerMTok) * inputMul;
+}
+/**
+* The output tokens `remainingUsd` still buys from one pricing row after
+* paying for an estimated prompt of `estimatedInputTokens`, priced with
+* the same tier rules as settlement (the tier is selected by the
+* estimated prompt). Floored to whole tokens; zero or negative means not
+* even one output token fits, so the turn must not be dispatched.
+* Undefined when the row prices output at zero (a free model needs no
+* output bound).
+*/
+function affordableOutputTokens(pricing, remainingUsd, estimatedInputTokens) {
+	const tier = tierFor(pricing, estimatedInputTokens);
+	const outputRate = pricing.outputUsdPerMTok * (tier?.outputMultiplier ?? 1);
+	if (outputRate <= 0) return;
+	const inputUsd = priceUsdOf(pricing, {
+		inputTokens: estimatedInputTokens,
+		outputTokens: 0,
+		cacheReadTokens: 0,
+		cacheWriteTokens: 0
+	});
+	return Math.floor((remainingUsd - inputUsd) / outputRate * 1e6);
 }
 //#endregion
 //#region src/model/profile-card.ts
@@ -7681,6 +7752,50 @@ function buildRequest(resolved, messages, limits, tools) {
 	return req;
 }
 /**
+* Cheap deterministic prompt-size estimate (about four serialized
+* characters per token) for the layer-2b output bound. Never used for
+* identity, accounting, or anything the journal records.
+*/
+function estimateInputTokens(messages) {
+	let chars = 0;
+	for (const msg of messages) chars += JSON.stringify(msg.parts).length;
+	return Math.ceil(chars / 4);
+}
+/**
+* Layer 2b at the wire boundary: clamps the outgoing request's
+* maxOutputTokens to what the remaining budget affords from the serving
+* model. The clamp uses the heuristic prompt estimate; the DENIAL does
+* not: a turn is refused (BudgetExhaustedError, never dispatched) only
+* when the remainder cannot buy even ONE output token at zero input,
+* which is exact. Denying on the estimate would kill turns the budget
+* still funds, including the DEF-7 forced finish paid from the released
+* finalize reserve; when the estimate says the prompt alone spends the
+* remainder, the turn dispatches with a one-token output floor and the
+* exact layers (2 and 3) settle the difference. A no-op without a hook
+* or when the hook reports no bound. The clamp touches only the wire
+* request, exactly like limits.maxOutputTokensPerTurn above it; identity
+* is computed at the ctx layer and never sees it.
+*/
+function applyOutputBudget(req, target, budget) {
+	const hook = budget?.maxAffordableOutputTokens;
+	if (hook === void 0) return req;
+	const affordable = hook(target.resolved.ref, estimateInputTokens(req.messages));
+	if (affordable === void 0) return req;
+	if (affordable < 1) {
+		const zeroInputAffordable = hook(target.resolved.ref, 0);
+		if (zeroInputAffordable !== void 0 && zeroInputAffordable < 1) throw new BudgetExhaustedError(`the remaining budget cannot afford one output token from ${target.resolved.ref}; the turn was not dispatched`);
+		return {
+			...req,
+			maxOutputTokens: 1
+		};
+	}
+	if (req.maxOutputTokens === void 0 || affordable < req.maxOutputTokens) return {
+		...req,
+		maxOutputTokens: affordable
+	};
+	return req;
+}
+/**
 * Builds the turn's canonical assistant message. Retained provider-raw
 * parts go at the HEAD: on both first-class providers the retained
 * blocks (thinking blocks, reasoning items) precede the turn's text and
@@ -8168,28 +8283,41 @@ async function runAgent(options) {
 		turns += 1;
 		const signals = [];
 		if (options.signal !== void 0) signals.push(options.signal);
-		const { outcome, target: servedTarget } = await dispatchPhase({
-			chain: loopChain,
-			cursor: loopCursor,
-			requestFor: (target) => {
-				let req = buildRequest(target.resolved, projectHistory(messages, providerOf(target.adapter)), limits, options.tools?.contracts);
-				if (options.schema !== void 0 && options.canonicalSchema !== void 0 && !separateExtract) req = applyStructuredOutputTier(req, rideTierFor(target), options.canonicalSchema);
-				return req;
-			},
-			streamOptionsFor: (target) => {
-				const streamTurnOptions = {
-					idleTimeoutMs: limits.streamIdleTimeoutMs,
-					signals,
-					onUsage: (delta) => options.budget?.onUsage(delta, target.resolved.ref)
-				};
-				if (options.budget?.signal !== void 0) streamTurnOptions.budgetSignal = options.budget.signal;
-				if (options.stream === true) streamTurnOptions.onDelta = (delta) => events?.emit({
-					type: "agent:stream",
-					delta
-				});
-				return streamTurnOptions;
-			}
-		});
+		let loopDispatch;
+		try {
+			loopDispatch = await dispatchPhase({
+				chain: loopChain,
+				cursor: loopCursor,
+				requestFor: (target) => {
+					let req = buildRequest(target.resolved, projectHistory(messages, providerOf(target.adapter)), limits, options.tools?.contracts);
+					if (options.schema !== void 0 && options.canonicalSchema !== void 0 && !separateExtract) req = applyStructuredOutputTier(req, rideTierFor(target), options.canonicalSchema);
+					return applyOutputBudget(req, target, options.budget);
+				},
+				streamOptionsFor: (target) => {
+					const streamTurnOptions = {
+						idleTimeoutMs: limits.streamIdleTimeoutMs,
+						signals,
+						onUsage: (delta) => options.budget?.onUsage(delta, target.resolved.ref)
+					};
+					if (options.budget?.signal !== void 0) streamTurnOptions.budgetSignal = options.budget.signal;
+					if (options.stream === true) streamTurnOptions.onDelta = (delta) => events?.emit({
+						type: "agent:stream",
+						delta
+					});
+					return streamTurnOptions;
+				}
+			});
+		} catch (thrown) {
+			if (!(thrown instanceof BudgetExhaustedError)) throw thrown;
+			status = "error";
+			agentError = {
+				kind: "budget",
+				retryable: false
+			};
+			errorMessage = thrown.message;
+			break;
+		}
+		const { outcome, target: servedTarget } = loopDispatch;
 		servedBy = servedTarget.resolved.ref;
 		usageApprox = usageApprox || outcome.usageApprox;
 		lastTurnUsage = {
@@ -8346,30 +8474,43 @@ async function runAgent(options) {
 					break;
 				}
 				turns += 1;
-				const { outcome: summary } = await dispatchPhase({
-					chain: [{
-						adapter: options.summarize.adapter,
-						resolved: options.summarize.resolved
-					}, ...options.summarize.fallbacks ?? []],
-					cursor: { index: 0 },
-					requestFor: (target) => {
-						let req = buildRequest(target.resolved, [...projectHistory(messages, providerOf(target.adapter)), summarizeInstruction()], limits, options.tools?.contracts);
-						if (req.tools !== void 0) req = {
-							...req,
-							toolChoice: "none"
-						};
-						return req;
-					},
-					streamOptionsFor: (target) => {
-						const summarizeStreamOptions = {
-							idleTimeoutMs: limits.streamIdleTimeoutMs,
-							signals: options.signal === void 0 ? [] : [options.signal],
-							onUsage: (delta) => options.budget?.onUsage(delta, target.resolved.ref)
-						};
-						if (options.budget?.signal !== void 0) summarizeStreamOptions.budgetSignal = options.budget.signal;
-						return summarizeStreamOptions;
-					}
-				});
+				let summaryDispatch;
+				try {
+					summaryDispatch = await dispatchPhase({
+						chain: [{
+							adapter: options.summarize.adapter,
+							resolved: options.summarize.resolved
+						}, ...options.summarize.fallbacks ?? []],
+						cursor: { index: 0 },
+						requestFor: (target) => {
+							let req = buildRequest(target.resolved, [...projectHistory(messages, providerOf(target.adapter)), summarizeInstruction()], limits, options.tools?.contracts);
+							if (req.tools !== void 0) req = {
+								...req,
+								toolChoice: "none"
+							};
+							return applyOutputBudget(req, target, options.budget);
+						},
+						streamOptionsFor: (target) => {
+							const summarizeStreamOptions = {
+								idleTimeoutMs: limits.streamIdleTimeoutMs,
+								signals: options.signal === void 0 ? [] : [options.signal],
+								onUsage: (delta) => options.budget?.onUsage(delta, target.resolved.ref)
+							};
+							if (options.budget?.signal !== void 0) summarizeStreamOptions.budgetSignal = options.budget.signal;
+							return summarizeStreamOptions;
+						}
+					});
+				} catch (thrown) {
+					if (!(thrown instanceof BudgetExhaustedError)) throw thrown;
+					status = "error";
+					agentError = {
+						kind: "budget",
+						retryable: false
+					};
+					errorMessage = thrown.message;
+					break;
+				}
+				const { outcome: summary } = summaryDispatch;
 				usageApprox = usageApprox || summary.usageApprox;
 				if (summary.aborted === "budget") {
 					status = "cancelled";
@@ -8404,6 +8545,28 @@ async function runAgent(options) {
 			await saveBoundary();
 			continue loop;
 		}
+		if (options.terminalTool !== void 0) {
+			noProgress.recordTurn({ toolCalls: 0 });
+			if (noProgress.tripped) {
+				status = "limit";
+				abortClass = "no-progress";
+				agentError = {
+					kind: "terminal",
+					retryable: false
+				};
+				errorMessage = noProgress.describe();
+				break;
+			}
+			messages.push({
+				role: "user",
+				parts: [{
+					type: "text",
+					text: outcome.finish?.reason === "max-tokens" ? `The turn was cut at the output token limit before any tool call. Be brief and call the '${options.terminalTool.name}' tool now; plain text is not a valid completion.` : `The turn ended without a tool call. Call the '${options.terminalTool.name}' tool to complete; plain text is not a valid completion.`
+				}]
+			});
+			await saveBoundary();
+			continue loop;
+		}
 		if (options.schema === void 0) {
 			output = outcome.turn.text;
 			break;
@@ -8473,66 +8636,80 @@ async function runAgent(options) {
 		}
 		if (proceed) {
 			turns += 1;
-			const { outcome, target: finalizeTarget } = await dispatchPhase({
-				chain: [{
-					adapter: options.finalize.adapter,
-					resolved: options.finalize.resolved
-				}, ...options.finalize.fallbacks ?? []],
-				cursor: { index: 0 },
-				requestFor: (target) => ({
-					...buildRequest(target.resolved, projectHistory(messages, providerOf(target.adapter)), limits, options.tools?.contracts),
-					toolChoice: "none"
-				}),
-				streamOptionsFor: (target) => {
-					const finalizeStreamOptions = {
-						idleTimeoutMs: limits.streamIdleTimeoutMs,
-						signals: options.signal === void 0 ? [] : [options.signal],
-						onUsage: (delta) => options.budget?.onUsage(delta, target.resolved.ref)
-					};
-					if (options.budget?.signal !== void 0) finalizeStreamOptions.budgetSignal = options.budget.signal;
-					if (options.stream === true) finalizeStreamOptions.onDelta = (delta) => events?.emit({
-						type: "agent:stream",
-						delta
-					});
-					return finalizeStreamOptions;
-				}
-			});
-			usageApprox = usageApprox || outcome.usageApprox;
-			messages.push(assistantMsg(outcome.turn, liftRetainedParts(outcome.providerMetadata, finalizeTarget.adapter)));
-			if (invariantViolation !== void 0) {
+			let finalizeDispatch;
+			try {
+				finalizeDispatch = await dispatchPhase({
+					chain: [{
+						adapter: options.finalize.adapter,
+						resolved: options.finalize.resolved
+					}, ...options.finalize.fallbacks ?? []],
+					cursor: { index: 0 },
+					requestFor: (target) => applyOutputBudget({
+						...buildRequest(target.resolved, projectHistory(messages, providerOf(target.adapter)), limits, options.tools?.contracts),
+						toolChoice: "none"
+					}, target, options.budget),
+					streamOptionsFor: (target) => {
+						const finalizeStreamOptions = {
+							idleTimeoutMs: limits.streamIdleTimeoutMs,
+							signals: options.signal === void 0 ? [] : [options.signal],
+							onUsage: (delta) => options.budget?.onUsage(delta, target.resolved.ref)
+						};
+						if (options.budget?.signal !== void 0) finalizeStreamOptions.budgetSignal = options.budget.signal;
+						if (options.stream === true) finalizeStreamOptions.onDelta = (delta) => events?.emit({
+							type: "agent:stream",
+							delta
+						});
+						return finalizeStreamOptions;
+					}
+				});
+			} catch (thrown) {
+				if (!(thrown instanceof BudgetExhaustedError)) throw thrown;
 				status = "error";
 				agentError = {
-					kind: "transport",
+					kind: "budget",
 					retryable: false
 				};
-				errorMessage = invariantViolation;
-			} else if (outcome.aborted !== void 0 || outcome.wireError !== void 0) {
-				status = outcome.aborted === "external" ? "cancelled" : "error";
-				if (outcome.wireError !== void 0) {
-					agentError = classifyWireError(outcome.wireError);
-					errorMessage = outcome.wireError.message;
-				} else if (outcome.aborted === "budget") {
-					status = "cancelled";
+				errorMessage = thrown.message;
+			}
+			if (finalizeDispatch !== void 0) {
+				const { outcome, target: finalizeTarget } = finalizeDispatch;
+				usageApprox = usageApprox || outcome.usageApprox;
+				messages.push(assistantMsg(outcome.turn, liftRetainedParts(outcome.providerMetadata, finalizeTarget.adapter)));
+				if (invariantViolation !== void 0) {
+					status = "error";
 					agentError = {
-						kind: "budget",
+						kind: "transport",
 						retryable: false
 					};
-				} else if (outcome.aborted === "idle") {
+					errorMessage = invariantViolation;
+				} else if (outcome.aborted !== void 0 || outcome.wireError !== void 0) {
+					status = outcome.aborted === "external" ? "cancelled" : "error";
+					if (outcome.wireError !== void 0) {
+						agentError = classifyWireError(outcome.wireError);
+						errorMessage = outcome.wireError.message;
+					} else if (outcome.aborted === "budget") {
+						status = "cancelled";
+						agentError = {
+							kind: "budget",
+							retryable: false
+						};
+					} else if (outcome.aborted === "idle") {
+						status = "error";
+						agentError = {
+							kind: "transport",
+							retryable: true
+						};
+						errorMessage = `stream idle for ${limits.streamIdleTimeoutMs}ms`;
+					}
+				} else if (outcome.finish?.reason === "refusal" || outcome.finish?.reason === "context-window-exceeded") {
 					status = "error";
 					agentError = {
-						kind: "transport",
-						retryable: true
+						kind: "terminal",
+						retryable: false
 					};
-					errorMessage = `stream idle for ${limits.streamIdleTimeoutMs}ms`;
-				}
-			} else if (outcome.finish?.reason === "refusal" || outcome.finish?.reason === "context-window-exceeded") {
-				status = "error";
-				agentError = {
-					kind: "terminal",
-					retryable: false
-				};
-				if (outcome.finish.reason === "refusal") errorMessage = `model refusal (${outcome.finish.refusal.provider})`;
-			} else if (options.schema === void 0) output = outcome.turn.text;
+					if (outcome.finish.reason === "refusal") errorMessage = `model refusal (${outcome.finish.refusal.provider})`;
+				} else if (options.schema === void 0) output = outcome.turn.text;
+			}
 		}
 	}
 	if (status === "ok" && !finishedViaTool && separateExtract && options.extract !== void 0 && options.schema !== void 0) {
@@ -8570,28 +8747,42 @@ async function runAgent(options) {
 				break;
 			}
 			turns += 1;
-			const { outcome, target: extractTarget } = await dispatchPhase({
-				chain: extractChain,
-				cursor: extractCursor,
-				requestFor: (target) => {
-					const targetTier = extractTierFor(target);
-					let req = buildRequest(target.resolved, projectHistory(extractMessages, providerOf(target.adapter)), limits, options.tools?.contracts);
-					if (req.tools !== void 0 && targetTier !== "forced-tool") req = {
-						...req,
-						toolChoice: "none"
-					};
-					return applyStructuredOutputTier(req, targetTier, options.canonicalSchema ?? {});
-				},
-				streamOptionsFor: (target) => {
-					const extractStreamOptions = {
-						idleTimeoutMs: limits.streamIdleTimeoutMs,
-						signals: options.signal === void 0 ? [] : [options.signal],
-						onUsage: (delta) => options.budget?.onUsage(delta, target.resolved.ref)
-					};
-					if (options.budget?.signal !== void 0) extractStreamOptions.budgetSignal = options.budget.signal;
-					return extractStreamOptions;
-				}
-			});
+			let extractDispatch;
+			try {
+				extractDispatch = await dispatchPhase({
+					chain: extractChain,
+					cursor: extractCursor,
+					requestFor: (target) => {
+						const targetTier = extractTierFor(target);
+						let req = buildRequest(target.resolved, projectHistory(extractMessages, providerOf(target.adapter)), limits, options.tools?.contracts);
+						if (req.tools !== void 0 && targetTier !== "forced-tool") req = {
+							...req,
+							toolChoice: "none"
+						};
+						req = applyStructuredOutputTier(req, targetTier, options.canonicalSchema ?? {});
+						return applyOutputBudget(req, target, options.budget);
+					},
+					streamOptionsFor: (target) => {
+						const extractStreamOptions = {
+							idleTimeoutMs: limits.streamIdleTimeoutMs,
+							signals: options.signal === void 0 ? [] : [options.signal],
+							onUsage: (delta) => options.budget?.onUsage(delta, target.resolved.ref)
+						};
+						if (options.budget?.signal !== void 0) extractStreamOptions.budgetSignal = options.budget.signal;
+						return extractStreamOptions;
+					}
+				});
+			} catch (thrown) {
+				if (!(thrown instanceof BudgetExhaustedError)) throw thrown;
+				status = "error";
+				agentError = {
+					kind: "budget",
+					retryable: false
+				};
+				errorMessage = thrown.message;
+				break;
+			}
+			const { outcome, target: extractTarget } = extractDispatch;
 			usageApprox = usageApprox || outcome.usageApprox;
 			if (invariantViolation !== void 0) {
 				status = "error";
@@ -8674,10 +8865,16 @@ async function runAgent(options) {
 //#region src/engine/budget.ts
 /**
 * Three-layer budget (M1-T09, hierarchical sub-accounts M6-T06;
-* invariant I4). Layer 1: admission before spawn (spent + committedReserve
-* >= ceiling blocks on ANY account in the ancestor chain). Layer 2: the
-* per-turn guard against the spawn's own chain. Layer 3: the AbortSignal
-* ceiling severing live streams, with partial usage written usageApprox.
+* invariant I4). Layer 1: PROJECTED admission before spawn: a spawn is
+* admitted only when spent + committedReserve + finalizeReserve + the
+* PROPOSED reserve fits the ceiling of EVERY account in the ancestor
+* chain (exact fill allowed), checked atomically before any commit.
+* Layer 2: the per-turn guard against the spawn's own chain, plus the
+* pre-dispatch output bound (layer 2b): every turn's maxOutputTokens is
+* clamped to what the remaining chain budget affords from the serving
+* model, and a turn that cannot afford one output token is denied before
+* dispatch. Layer 3: the AbortSignal ceiling severing live streams, with
+* partial usage written usageApprox.
 * B0 is immutable after start: no API tops it up.
 *
 * The account tree: the run root plus one
@@ -8702,15 +8899,27 @@ const ZERO_USAGE = {
 	cacheWriteTokens: 0
 };
 /**
-* The admission reserve for a spawn: opts.estCost, else profile.estCost, else
-* price(countTokens(input) + caps.maxOutputTokens), else the engine flat
-* default.
+* The admission reserve for a spawn: opts.estCost, else profile.estCost,
+* else price(countTokens(input) + one turn's worth of output), else the
+* engine flat default. The output term is caps.maxOutputTokens clamped to
+* limits.maxOutputTokensPerTurn when the spawn carries one, so a host can
+* bound reserves without hand-written estimates. The priced path uses the
+* SAME price function as settlement (priceUsdOf), so long-context tiers
+* apply to estimates too.
 */
 function admissionReserveUsd(options) {
 	if (options.estCost !== void 0) return options.estCost;
 	if (options.profileEstCost !== void 0) return options.profileEstCost;
 	const pricing = options.caps?.pricing;
-	if (options.inputTokens !== void 0 && pricing !== void 0 && options.caps !== void 0) return options.inputTokens / 1e6 * pricing.inputUsdPerMTok + options.caps.maxOutputTokens / 1e6 * pricing.outputUsdPerMTok;
+	if (options.inputTokens !== void 0 && pricing !== void 0 && options.caps !== void 0) {
+		const outputTokens = options.maxOutputTokensPerTurn === void 0 ? options.caps.maxOutputTokens : Math.min(options.caps.maxOutputTokens, options.maxOutputTokensPerTurn);
+		return priceUsdOf(pricing, {
+			inputTokens: options.inputTokens,
+			outputTokens,
+			cacheReadTokens: 0,
+			cacheWriteTokens: 0
+		});
+	}
 	return options.flatReserveUsd ?? .5;
 }
 /**
@@ -8725,6 +8934,7 @@ var RunBudget = class {
 	lifetimeSpawnCap;
 	events;
 	priceUsd;
+	pricingOf;
 	accounts = /* @__PURE__ */ new Map();
 	usageInternal = { ...ZERO_USAGE };
 	agentsSpawnedInternal = 0;
@@ -8736,6 +8946,7 @@ var RunBudget = class {
 		this.lifetimeSpawnCap = options.lifetimeSpawnCap ?? 500;
 		if (options.events !== void 0) this.events = options.events;
 		if (options.priceUsd !== void 0) this.priceUsd = options.priceUsd;
+		if (options.pricingOf !== void 0) this.pricingOf = options.pricingOf;
 		const root = {
 			scope: "run",
 			spentUsd: 0,
@@ -8788,8 +8999,43 @@ var RunBudget = class {
 			controller: new AbortController()
 		};
 		if (options.ceilingUsd !== void 0) account.ceilingUsd = options.ceilingUsd;
+		if (options.kind !== void 0) account.kind = options.kind;
 		this.accounts.set(scope, account);
 	}
+	/**
+	* The diagnostic projection behind a ceiling error: the first CLOSED
+	* account (projected commitments included, exactly the layer-1
+	* closure test) walking from `scope` toward the root, plus the root
+	* state. 'run budget ceiling reached' under a healthy root misled the
+	* v1.6.0 follow-up review's live probe when only a 0.18 USD
+	* orchestrator cap had crossed under a 0.90 USD root; the message can
+	* now name the account that actually ended the work. An unknown scope
+	* degrades to root-only diagnostics instead of throwing: this runs on
+	* the error path.
+	*/
+	exhaustionDiagnostics(scope) {
+		let chain;
+		try {
+			chain = this.chainOf(scope);
+		} catch {
+			chain = [this.root];
+		}
+		const crossed = chain.find((account) => account.ceilingUsd !== void 0 && account.spentUsd + account.committedReserveUsd + account.finalizeReserveUsd >= account.ceilingUsd);
+		const root = this.root;
+		const diagnostics = { root: {
+			spentUsd: root.spentUsd,
+			...root.ceilingUsd === void 0 ? {} : { ceilingUsd: root.ceilingUsd }
+		} };
+		if (crossed?.ceilingUsd !== void 0) diagnostics.crossed = {
+			scope: crossed.scope,
+			source: crossed.scope === "run" ? "root" : crossed.kind === "orchestrator-cap" ? "orchestrator-cap" : "child-account",
+			ceilingUsd: crossed.ceilingUsd,
+			spentUsd: crossed.spentUsd,
+			committedReserveUsd: crossed.committedReserveUsd,
+			finalizeReserveUsd: crossed.finalizeReserveUsd
+		};
+		return diagnostics;
+	}
 	accountView(scope) {
 		const account = this.accounts.get(scope);
 		if (account === void 0) return;
@@ -8841,9 +9087,15 @@ var RunBudget = class {
 		return Math.max(0, this.lifetimeSpawnCap - this.agentsSpawnedInternal);
 	}
 	/**
-	* Layer 1: admission before spawn. Blocks when spent + committedReserve
-	* has reached the ceiling on ANY account in the ancestor chain of
-	* `accountScope`, otherwise commits the reserve along the whole chain.
+	* Layer 1: PROJECTED admission before spawn. A spawn is admitted only
+	* when every account in the ancestor chain of `accountScope` still has
+	* admission headroom AND fits the PROPOSED reserve on top of spent +
+	* committedReserve + finalizeReserve (the finalize reserve is
+	* untouchable by admission, DEF-7). An exact fill is allowed; one
+	* dollar past the ceiling is not: a spawn is never admitted on the
+	* argument that the money it needs is merely not committed yet. The
+	* whole chain is checked before anything commits, so a rejection
+	* mutates no account, increments no counter, and journals nothing.
 	* Also enforces the engine lifetime spawn cap.
 	*/
 	admitSpawn(reserveUsd, accountScope = "run") {
@@ -8852,14 +9104,19 @@ var RunBudget = class {
 			throw new BudgetExhaustedError(`engine lifetime spawn cap reached (${this.lifetimeSpawnCap} spawns per run; budgetDefaults.lifetimeSpawnCap)`, { data: { cap: this.lifetimeSpawnCap } });
 		}
 		const chain = this.chainOf(accountScope);
-		for (const account of chain) if (account.ceilingUsd !== void 0 && account.spentUsd + account.committedReserveUsd + account.finalizeReserveUsd >= account.ceilingUsd) {
-			if (account.scope === "run") this.exhaustedInternal = true;
-			throw new BudgetExhaustedError(`budget ceiling reached on account '${account.scope}': spent ${account.spentUsd.toFixed(4)} USD plus committed reserve ${account.committedReserveUsd.toFixed(4)} USD is at the ceiling ${account.ceilingUsd.toFixed(4)} USD`, { data: {
-				account: account.scope,
-				spentUsd: account.spentUsd,
-				committedReserveUsd: account.committedReserveUsd,
-				ceilingUsd: account.ceilingUsd
-			} });
+		for (const account of chain) {
+			if (account.ceilingUsd === void 0) continue;
+			const committed = account.spentUsd + account.committedReserveUsd + account.finalizeReserveUsd;
+			if (committed >= account.ceilingUsd || committed + reserveUsd > account.ceilingUsd) {
+				if (account.scope === "run") this.exhaustedInternal = true;
+				throw new BudgetExhaustedError(`budget ceiling reached on account '${account.scope}': spent ${account.spentUsd.toFixed(4)} USD plus committed reserves ${(account.committedReserveUsd + account.finalizeReserveUsd).toFixed(4)} USD plus the proposed reserve ${reserveUsd.toFixed(4)} USD does not fit the ceiling ${account.ceilingUsd.toFixed(4)} USD`, { data: {
+					account: account.scope,
+					spentUsd: account.spentUsd,
+					committedReserveUsd: account.committedReserveUsd,
+					proposedReserveUsd: reserveUsd,
+					ceilingUsd: account.ceilingUsd
+				} });
+			}
 		}
 		this.agentsSpawnedInternal += 1;
 		for (const account of chain) account.committedReserveUsd += reserveUsd;
@@ -8921,6 +9178,28 @@ var RunBudget = class {
 		}
 	}
 	/**
+	* Layer 2b, the pre-dispatch output bound: the output tokens the
+	* remaining chain budget (min over capped ancestors of ceiling minus
+	* spend) still affords from `servedBy` for an estimated prompt, priced
+	* by the same function as settlement, long-context tiers included.
+	* Undefined when no account in the chain carries a USD ceiling, when
+	* the model has no price row (the once-per-model unpriced warning in
+	* onUsage covers that hole), or when output is free. Zero or negative
+	* means the turn cannot be dispatched within the budget.
+	*/
+	maxAffordableOutputTokens(servedBy, estimatedInputTokens, accountScope = "run") {
+		const pricing = this.pricingOf?.(servedBy);
+		if (pricing === void 0) return;
+		let remainingUsd;
+		for (const account of this.chainOf(accountScope)) {
+			if (account.ceilingUsd === void 0) continue;
+			const headroom = account.ceilingUsd - account.spentUsd;
+			remainingUsd = remainingUsd === void 0 ? headroom : Math.min(remainingUsd, headroom);
+		}
+		if (remainingUsd === void 0) return;
+		return affordableOutputTokens(pricing, Math.max(0, remainingUsd), estimatedInputTokens);
+	}
+	/**
 	* Live accounting; spend propagates from `accountScope` to every
 	* ancestor. Crossing a ceiling severs the crossing account's subtree
 	* via its layer-3 AbortSignal (overshoot bounded by one turn per
@@ -9193,13 +9472,16 @@ var AdmissionController = class {
 			},
 			statsBefore
 		};
-		const reserveUsd = spec.estCostUsd ?? this.flatReserveUsd;
-		const reserve = { reserveUsd };
+		let childCeilingUsd;
 		const parentRemainder = this.budget.remainderOf(spec.parentAccountScope);
 		if (parentRemainder !== void 0) {
 			const fractionCap = this.childBudgetFraction * parentRemainder;
-			reserve.childCeilingUsd = spec.budgetUsd === void 0 ? fractionCap : Math.min(spec.budgetUsd, fractionCap);
-		} else if (spec.budgetUsd !== void 0) reserve.childCeilingUsd = spec.budgetUsd;
+			childCeilingUsd = spec.budgetUsd === void 0 ? fractionCap : Math.min(spec.budgetUsd, fractionCap);
+		} else if (spec.budgetUsd !== void 0) childCeilingUsd = spec.budgetUsd;
+		let reserveUsd = spec.estCostUsd ?? this.flatReserveUsd;
+		if (childCeilingUsd !== void 0) reserveUsd = Math.min(reserveUsd, childCeilingUsd);
+		const reserve = { reserveUsd };
+		if (childCeilingUsd !== void 0) reserve.childCeilingUsd = childCeilingUsd;
 		if (this.budget.spawnHeadroom <= 0) return {
 			verdict: {
 				kind: "reject",
@@ -9601,6 +9883,13 @@ const kTerminalTool = Symbol("rulvar.terminalTool");
 * graft boot). Dangling redispatch checkpoints take precedence.
 */
 const kBootCheckpoint = Symbol("rulvar.bootCheckpoint");
+/**
+* Internal AgentOpts channel: marks the orchestrator forced-finish
+* dispatch, whose spend draws from the released finalize reserve
+* (DEF-7). Settlement stamps the flag into the terminal's cost
+* attribution so the journal fold reproduces reserveUsedUsd.
+*/
+const kFinalizeReserve = Symbol("rulvar.finalizeReserve");
 /** Typed accessor used by the in-package consumers. */
 function runtimeOf(ctx) {
 	const runtime = ctxRuntimes.get(ctx);
@@ -10172,6 +10461,7 @@ function createCtx(internals, rootWorkflow) {
 		}
 		const adapter = adapterOf(loopResolved);
 		const caps = adapter.caps(loopResolved.model);
+		const limits = mergeUsageLimits(opts.limits, profile?.limits, internals.defaults.limits);
 		let inputTokens;
 		if (opts.estCost === void 0 && profile?.estCost === void 0 && adapter.countTokens) try {
 			inputTokens = await adapter.countTokens({
@@ -10191,8 +10481,9 @@ function createCtx(internals, rootWorkflow) {
 		if (opts.estCost !== void 0) reserveOptions.estCost = opts.estCost;
 		if (profile?.estCost !== void 0) reserveOptions.profileEstCost = profile.estCost;
 		if (inputTokens !== void 0) reserveOptions.inputTokens = inputTokens;
+		if (limits.maxOutputTokensPerTurn !== void 0) reserveOptions.maxOutputTokensPerTurn = limits.maxOutputTokensPerTurn;
 		if (internals.flatReserveUsd !== void 0) reserveOptions.flatReserveUsd = internals.flatReserveUsd;
-		const reserve = admissionReserveUsd(reserveOptions);
+		const reserve = internals.pricingOf !== void 0 && internals.pricingOf(loopResolved.ref) === void 0 && opts.estCost === void 0 && profile?.estCost === void 0 ? 0 : admissionReserveUsd(reserveOptions);
 		const budgetAccount = state.budgetScope ?? "run";
 		internals.budget.admitSpawn(reserve, budgetAccount);
 		let acquired;
@@ -10222,7 +10513,6 @@ function createCtx(internals, rootWorkflow) {
 			running = await internals.replayer.appendRunning(runningInput);
 		}
 		opts[kOnRunning]?.(running.seq);
-		const limits = mergeUsageLimits(opts.limits, profile?.limits, internals.defaults.limits);
 		const agentSink = { emit: (body) => internals.events.emit(body, spanId) };
 		const ckptRef = checkpointRefFor(internals.runId, running.seq);
 		let checkpointWritten = false;
@@ -10338,6 +10628,7 @@ function createCtx(internals, rootWorkflow) {
 			},
 			budget: {
 				beforeTurn: () => internals.budget.beforeTurn(budgetAccount),
+				maxAffordableOutputTokens: (servedBy, estimatedInputTokens) => internals.budget.maxAffordableOutputTokens(servedBy, estimatedInputTokens, budgetAccount),
 				onUsage: (usage, servedBy) => internals.budget.onUsage(usage, servedBy, budgetAccount),
 				signal: budgetAccount === "run" ? internals.budget.signal : AbortSignal.any([internals.budget.signal, internals.budget.signalOf(budgetAccount)].filter((signal) => signal !== void 0))
 			},
@@ -10461,6 +10752,13 @@ function createCtx(internals, rootWorkflow) {
 			usage: result.usage,
 			servedBy: result.servedBy,
 			...result.usageByModel === void 0 ? {} : { usageByModel: result.usageByModel },
+			costAttribution: {
+				...state.phase === void 0 ? {} : { phase: state.phase },
+				agentType,
+				role: primaryRole,
+				budgetAccount: state.budgetScope ?? "run",
+				...opts[kFinalizeReserve] === true ? { finalizeReserve: true } : {}
+			},
 			transcriptRef: result.transcriptRef
 		};
 		if (result.status === "escalated" && result.escalation !== void 0) terminalPatch.escalation = result.escalation;
@@ -10528,10 +10826,25 @@ function createCtx(internals, rootWorkflow) {
 		bump(internals.cost.byPhase, state.phase ?? "", usd);
 		bump(internals.cost.byAgentType, agentType, usd);
 		internals.cost.byRole.set(primaryRole, (internals.cost.byRole.get(primaryRole) ?? 0) + usd);
-		if (result.error?.kind === "budget" || internals.budget.exhausted && result.status !== "ok") throw new BudgetExhaustedError("run budget ceiling reached during agent execution", { data: {
-			scope: state.scope,
-			entryRef: terminal.seq
-		} });
+		if (result.error?.kind === "budget" || internals.budget.exhausted && result.status !== "ok") {
+			const diagnostics = internals.budget.exhaustionDiagnostics(state.budgetScope ?? "run");
+			const crossed = diagnostics.crossed;
+			const rootSuffix = `run root: spent ${diagnostics.root.spentUsd.toFixed(4)}` + (diagnostics.root.ceilingUsd === void 0 ? " USD, no ceiling" : ` of ${diagnostics.root.ceilingUsd.toFixed(4)} USD`);
+			throw new BudgetExhaustedError(crossed === void 0 || crossed.source === "root" ? "run budget ceiling reached during agent execution" : (crossed.source === "orchestrator-cap" ? "orchestrator budget cap reached during agent execution" : "budget sub-account ceiling reached during agent execution") + ` (account '${crossed.scope}': spent ${crossed.spentUsd.toFixed(4)}` + (crossed.committedReserveUsd + crossed.finalizeReserveUsd > 0 ? ` plus ${(crossed.committedReserveUsd + crossed.finalizeReserveUsd).toFixed(4)} reserved` : "") + ` of ${crossed.ceilingUsd.toFixed(4)} USD; ${rootSuffix})`, { data: {
+				scope: state.scope,
+				entryRef: terminal.seq,
+				source: crossed?.source ?? "root",
+				rootSpentUsd: diagnostics.root.spentUsd,
+				...diagnostics.root.ceilingUsd === void 0 ? {} : { rootCeilingUsd: diagnostics.root.ceilingUsd },
+				...crossed === void 0 ? {} : {
+					crossedScope: crossed.scope,
+					crossedCeilingUsd: crossed.ceilingUsd,
+					crossedSpentUsd: crossed.spentUsd,
+					crossedCommittedReserveUsd: crossed.committedReserveUsd,
+					crossedFinalizeReserveUsd: crossed.finalizeReserveUsd
+				}
+			} });
+		}
 		if (opts.fallback !== void 0) {
 			const trigger = fallbackTriggerOf(result);
 			if (trigger !== void 0 && opts.fallback.on.includes(trigger)) return runFallbackAttempt(running.seq, trigger, spanId);
@@ -11121,10 +11434,16 @@ function makeOrchestratorWorkflow(goal, opts) {
 				const finalizeTurns = spec?.finalizeTurns ?? 2;
 				const finalizeReserveUsd = spec?.finalizeReserveUsd ?? finalizeTurns * turnEstimateUsd;
 				if (extension !== void 0 && effectiveCapUsd < finalizeReserveUsd) throw new OrchestratorCapConfigError(`effectiveCap ${effectiveCapUsd.toFixed(4)} USD is below the finalize reserve ${finalizeReserveUsd.toFixed(4)} USD`);
+				if (spec?.capUsd !== void 0 && spec.capFraction === void 0 && effectiveCapUsd < spec.capUsd) internals.events.emit({
+					type: "log",
+					level: "warn",
+					msg: `orchestrator budget.capUsd ${spec.capUsd.toFixed(4)} USD is bounded to ${effectiveCapUsd.toFixed(4)} USD by the default capFraction 0.2 of the run ceiling (effectiveCap = min(capUsd, capFraction * ceiling)); pass capFraction: 1.0 to make capUsd the sole bound`
+				}, callingState.spanId);
 				orchestratorAccount = callingState.scope === "" ? "orchestrator" : `${callingState.scope}/orchestrator`;
 				internals.budget.openAccount(orchestratorAccount, {
 					parentScope: callingState.budgetScope ?? "run",
-					ceilingUsd: effectiveCapUsd
+					ceilingUsd: effectiveCapUsd,
+					kind: "orchestrator-cap"
 				});
 				if (extension !== void 0) internals.budget.commitFinalizeReserve(orchestratorAccount, finalizeReserveUsd);
 				capState = {
@@ -11140,6 +11459,15 @@ function makeOrchestratorWorkflow(goal, opts) {
 		const records = /* @__PURE__ */ new Map();
 		const byOrdinal = /* @__PURE__ */ new Map();
 		const rejectedByOrdinal = /* @__PURE__ */ new Map();
+		/**
+		* The journaled spec behind each recovered ordinal: the idempotent
+		* re-execution guard compares it against the incoming call, because
+		* after a cross-attempt resume a REGENERATED turn (the boundary
+		* checkpoint predates the lost turn) may decide differently, and
+		* handing it the prior ordinal's handle would bind the transcript
+		* to a stranger's child.
+		*/
+		const recoveredSpecByOrdinal = /* @__PURE__ */ new Map();
 		let nextOrdinal = 0;
 		let orchSeq;
 		const deliveredNodeIds = /* @__PURE__ */ new Set();
@@ -11175,7 +11503,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const controller = new AbortController();
 			const upstream = callingState.signal ?? internals.runSignal;
 			const scope = placement?.childScope ?? childScopeOf();
-			if (placement !== void 0) internals.budget.openAccount(scope, {
+			if (placement?.ownAccount === true) internals.budget.openAccount(scope, {
 				parentScope: callingState.budgetScope ?? "run",
 				...placement.childCeilingUsd === void 0 ? {} : { ceilingUsd: placement.childCeilingUsd }
 			});
@@ -11183,7 +11511,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				scope,
 				spanId: internals.spans.mint(callingState.spanId),
 				signal: upstream === void 0 ? controller.signal : AbortSignal.any([upstream, controller.signal]),
-				budgetScope: placement !== void 0 ? scope : callingState.budgetScope ?? "run"
+				budgetScope: placement?.ownAccount === true ? scope : callingState.budgetScope ?? "run"
 			};
 			let resolveHandle = () => void 0;
 			const handlePromise = new Promise((resolve) => {
@@ -11265,6 +11593,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				nextOrdinal += 1;
 				return { handle: (await dispatchChild(spec, spawnOrdinal, identity, {
 					childScope,
+					ownAccount: true,
 					...spec.budgetUsd === void 0 ? {} : { childCeilingUsd: spec.budgetUsd }
 				})).handle };
 			},
@@ -11295,33 +11624,61 @@ function makeOrchestratorWorkflow(goal, opts) {
 				handle
 			};
 		};
-		/** Rebuilds spawn records from the journal (the crash-resume contract). */
+		/**
+		* True when `scope` is a root-attempt scope of THIS orchestration:
+		* agentScope(callingState.scope, n) for some dispatch seq n. Nested
+		* orchestrations live under their own wf: child scopes and never
+		* match a foreign calling scope.
+		*/
+		const scopeOfThisOrchestration = (scope) => {
+			const prefix = callingState.scope === "" ? "" : `${callingState.scope}/`;
+			return scope.startsWith(prefix) && /^agent:\d+$/.test(scope.slice(prefix.length));
+		};
+		/**
+		* Rebuilds spawn records from the journal (the crash-resume
+		* contract). Recovery is ORCHESTRATION-scoped, not attempt-scoped:
+		* decisions journal at the orchestrate call's own scope, which is
+		* stable across root attempts, so a rerun after a cancelled root
+		* (the budget-abort shape the v1.6.0 follow-up review resumed) sees
+		* every prior decision instead of re-deciding and re-paying.
+		* Recovered children re-dispatch PINNED to their journaled child
+		* scope: settled ones forward-match and replay for free, a dangling
+		* one redispatches live (at-least-once), and a decision without a
+		* dispatch entry rolls forward to a fresh dispatch.
+		*/
 		const recover = async () => {
-			const scope = childScopeOf();
+			const currentScope = childScopeOf();
 			const admissions = internals.replayer.snapshot().filter((entry) => {
-				if (entry.kind !== "decision") return false;
+				if (entry.kind !== "decision" || entry.scope !== callingState.scope) return false;
 				const value = entry.value;
-				return value?.decisionType === "spawn-admission" && (value.origin === "spawn_agent" || value.origin === "parallel_agents") && value.orchestratorScope === scope;
+				return value?.decisionType === "spawn-admission" && (value.origin === "spawn_agent" || value.origin === "parallel_agents");
 			}).map((entry) => entry.value).sort((a, b) => a.spawnOrdinal - b.spawnOrdinal);
 			for (const value of admissions) {
 				nextOrdinal = Math.max(nextOrdinal, value.spawnOrdinal + 1);
 				const decision = value.decision;
+				recoveredSpecByOrdinal.set(value.spawnOrdinal, value.spec);
 				if (decision.verdict.kind !== "admit") {
 					rejectedByOrdinal.set(value.spawnOrdinal, decision);
 					continue;
 				}
-				admission.recoverChild(scope);
-				await dispatchChild(value.spec, value.spawnOrdinal, {
+				admission.recoverChild(currentScope);
+				const childScope = value.childScope ?? value.orchestratorScope;
+				const record = await dispatchChild(value.spec, value.spawnOrdinal, {
 					nodeId: decision.nodeId ?? "unknown",
 					logicalTaskId: decision.verdict.lineage.logicalTaskId
-				});
+				}, { childScope });
+				const dispatched = internals.replayer.snapshot().find((entry) => entry.seq === record.handle);
+				if (dispatched !== void 0) {
+					for (const prior of internals.replayer.snapshot()) if (prior.kind === "agent" && prior.status === "running" && prior.seq !== record.handle && prior.scope === dispatched.scope && prior.key === dispatched.key && prior.ordinal === dispatched.ordinal && !records.has(prior.seq)) records.set(prior.seq, record);
+				}
 			}
-			const wakePrefix = `wake:${String(orchSeq ?? -1)}:`;
 			for (const entry of internals.replayer.snapshot()) {
 				if (entry.status !== "suspended" || entry.kind !== "external") continue;
+				if (!scopeOfThisOrchestration(entry.scope)) continue;
 				const payload = entry.value;
-				if (typeof payload?.key !== "string" || !payload.key.startsWith(wakePrefix)) continue;
-				wakeOrdinal = Math.max(wakeOrdinal, Number(payload.key.slice(wakePrefix.length)) + 1);
+				const match = typeof payload?.key === "string" ? /^wake:\d+:(\d+)$/.exec(payload.key) : null;
+				if (match === null) continue;
+				wakeOrdinal = Math.max(wakeOrdinal, Number(match[1]) + 1);
 				const suspension = internals.replayer.suspensionState(entry.seq);
 				if (suspension.state === "resolved") markDelivered(suspension.value);
 			}
@@ -11449,10 +11806,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 				await recoveryDone;
 				const spawnOrdinal = nextOrdinal;
 				nextOrdinal += 1;
+				const priorSpec = recoveredSpecByOrdinal.get(spawnOrdinal);
+				const specMatches = priorSpec === void 0 || priorSpec.agentType === params.agentType && priorSpec.prompt === params.prompt;
 				const recovered = byOrdinal.get(spawnOrdinal);
-				if (recovered !== void 0) return { handle: recovered.handle };
+				if (recovered !== void 0 && specMatches) return { handle: recovered.handle };
 				const recoveredRejection = rejectedByOrdinal.get(spawnOrdinal);
-				if (recoveredRejection !== void 0) throw new AdmissionRejectedError(`admission rejected spawn ordinal ${String(spawnOrdinal)} (recovered verdict)`, { data: { decision: recoveredRejection } });
+				if (recoveredRejection !== void 0 && specMatches) throw new AdmissionRejectedError(`admission rejected spawn ordinal ${String(spawnOrdinal)} (recovered verdict)`, { data: { decision: recoveredRejection } });
 				if (opts?.maxSpawns !== void 0 && spawnOrdinal >= opts.maxSpawns) {
 					internals.events.emit({
 						type: "spawn:rejected",
@@ -11702,7 +12061,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			role: "orchestrate",
 			result: "full",
 			tools: [...buildOrchestratorTools(orchestratorRuntime, fullCardText), ...extension?.tools(io) ?? []],
-			...capState === void 0 ? {} : { estCost: capState.effectiveCapUsd },
+			...capState === void 0 ? {} : { estCost: capState.effectiveCapUsd - (orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.finalizeReserveUsd ?? 0) },
 			...opts?.model === void 0 ? {} : { model: opts.model },
 			...opts?.limits === void 0 ? {} : { limits: opts.limits },
 			[kOnRunning]: (seq) => {
@@ -11710,7 +12069,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 				orchSeq = seq;
 				recover().then(releaseRecovery, releaseRecovery);
 			},
-			[kTerminalTool]: { name: FINISH_TOOL_NAME }
+			[kTerminalTool]: { name: FINISH_TOOL_NAME },
+			...(() => {
+				const priorCancelledRoot = internals.replayer.snapshot().filter((entry) => entry.kind === "agent" && entry.scope === callingState.scope && entry.status === "cancelled" && entry.checkpointRef !== void 0).at(-1);
+				return priorCancelledRoot?.checkpointRef === void 0 ? {} : { [kBootCheckpoint]: priorCancelledRoot.checkpointRef };
+			})()
 		};
 		const orchestratorState = { ...callingState };
 		if (orchestratorAccount !== void 0) orchestratorState.budgetScope = orchestratorAccount;
@@ -11736,7 +12099,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 				limits: { maxTurns: capState?.finalizeTurns ?? 2 },
 				...capState === void 0 ? {} : { estCost: capState.finalizeReserveUsd },
 				...opts?.model === void 0 ? {} : { model: opts.model },
-				[kTerminalTool]: { name: FINISH_TOOL_NAME }
+				[kTerminalTool]: { name: FINISH_TOOL_NAME },
+				[kFinalizeReserve]: true
 			};
 			const finalState = { ...callingState };
 			if (orchestratorAccount !== void 0) finalState.budgetScope = orchestratorAccount;
@@ -11904,13 +12268,81 @@ var EventBus = class {
 //#endregion
 //#region src/runner/inprocess.ts
 /**
+* ScriptRunner SPI and InProcessRunner (M1-T11).
+*
+* Script runner contract: https://docs.rulvar.com/guide/planner
+* Workflow (a closure value) runs in process only; CompiledWorkflow is the
+* only form admissible to the worker sandbox and first exists at M6
+* (compileScript in @rulvar/planner), so until then the engine accepts
+* only in-process Workflow values. The SPI's L0 listing refers
+* to its frozen-seam status; the declaration lives here with its types.
+*/
+const detection = new AsyncLocalStorage();
+let globalsPatched = false;
+/**
+* Stack line 0 names the Error, line 1 this helper, line 2 the patched
+* global, line 3 the caller whose provenance decides (the layout is
+* pinned by construction: this helper is only ever called by the two
+* patched globals). Two origins are exempt: installed dependencies (a
+* provider SDK, any transitive package, rulvar's own published dist),
+* which live under node_modules, and Node's own machinery (the undici
+* transport behind fetch, timers, stream internals), whose frames carry
+* `node:` specifiers and inherit the run's async context. The guard
+* exists for workflow code, which imports from both but lives in
+* neither.
+*/
+function libraryCaller() {
+	const caller = (/* @__PURE__ */ new Error()).stack?.split("\n")[3];
+	if (caller === void 0) return false;
+	return caller.includes("node_modules") || /[(\s]node:/.test(caller);
+}
+/**
+* Patches Date.now and Math.random ONCE per process and never restores:
+* outside a workflow's async context the store is absent and the patch is
+* a transparent passthrough. The previous per-execute patch/restore pair
+* could race under concurrent runs (one run's restore removed another's
+* patch, and the second restore re-installed a stale patched function
+* PERMANENTLY, which could then warn on host code outside any run: the
+* false RULVAR_BARE_DATE_NOW class the 1.5.2 review reproduced).
+*/
+function patchGlobalsOnce() {
+	if (globalsPatched) return;
+	globalsPatched = true;
+	const priorNow = Date.now;
+	const priorRandom = Math.random;
+	Date.now = function rulvarPatchedDateNow() {
+		const state = detection.getStore();
+		if (state !== void 0 && !state.warnedNow && !libraryCaller()) {
+			state.warnedNow = true;
+			process.emitWarning("bare Date.now() called inside a rulvar run; use ctx.now() so the value is journaled and stable on replay", {
+				code: "RULVAR_BARE_DATE_NOW",
+				type: "RulvarWarning"
+			});
+		}
+		return priorNow();
+	};
+	Math.random = function rulvarPatchedMathRandom() {
+		const state = detection.getStore();
+		if (state !== void 0 && !state.warnedRandom && !libraryCaller()) {
+			state.warnedRandom = true;
+			process.emitWarning("bare Math.random() called inside a rulvar run; use ctx.random() so the value is journaled and stable on replay", {
+				code: "RULVAR_BARE_MATH_RANDOM",
+				type: "RulvarWarning"
+			});
+		}
+		return priorRandom();
+	};
+}
+/**
 * The mode (a) runner for human-authored closures. Determinism is enforced
 * by convention, lint, and the ctx shims, NOT by a VM: only the sequence
-* of keys must be stable. Dev mode (NODE_ENV !== 'production') patches
-* Date.now and Math.random for the duration of execute to emit one warning
-* per run pointing at ctx.now()/ctx.random(); the patch preserves behavior
-* and restores the prior functions on exit (nesting-safe by capturing the
-* prior value; concurrent runs may lose the warning, never correctness).
+* of keys must be stable. Dev mode (NODE_ENV !== 'production') detects
+* bare Date.now and Math.random and emits one warning per run pointing at
+* ctx.now()/ctx.random(). Detection is attributed by AsyncLocalStorage:
+* only code inside the workflow body's async context can trigger it, so
+* host code running concurrently, engine internals outside the body, and
+* other runs never produce a false warning, and nothing is ever restored,
+* so concurrent executes cannot race the patch state.
 */
 var InProcessRunner = class {
 	onEscalation;
@@ -11923,47 +12355,14 @@ var InProcessRunner = class {
 	}
 	async execute(wf, ctx, args) {
 		if (wf.kind !== "workflow") throw new TypeError("InProcessRunner executes closure Workflow values only; CompiledWorkflow runs in the worker sandbox (@rulvar/planner, M6)");
-		const devMode = process.env.NODE_ENV !== "production";
-		let restore;
-		if (devMode) {
-			const priorNow = Date.now;
-			const priorRandom = Math.random;
-			let warnedNow = false;
-			let warnedRandom = false;
-			const libraryCaller = () => {
-				const caller = (/* @__PURE__ */ new Error()).stack?.split("\n")[3];
-				return caller !== void 0 && caller.includes("node_modules");
-			};
-			Date.now = function rulvarPatchedDateNow() {
-				if (!warnedNow && !libraryCaller()) {
-					warnedNow = true;
-					process.emitWarning("bare Date.now() called inside a rulvar run; use ctx.now() so the value is journaled and stable on replay", {
-						code: "RULVAR_BARE_DATE_NOW",
-						type: "RulvarWarning"
-					});
-				}
-				return priorNow();
-			};
-			Math.random = function rulvarPatchedMathRandom() {
-				if (!warnedRandom && !libraryCaller()) {
-					warnedRandom = true;
-					process.emitWarning("bare Math.random() called inside a rulvar run; use ctx.random() so the value is journaled and stable on replay", {
-						code: "RULVAR_BARE_MATH_RANDOM",
-						type: "RulvarWarning"
-					});
-				}
-				return priorRandom();
-			};
-			restore = () => {
-				Date.now = priorNow;
-				Math.random = priorRandom;
-			};
-		}
-		try {
-			return await wf.body(ctx, args);
-		} finally {
-			restore?.();
+		if (process.env.NODE_ENV !== "production") {
+			patchGlobalsOnce();
+			return detection.run({
+				warnedNow: false,
+				warnedRandom: false
+			}, () => wf.body(ctx, args));
 		}
+		return await wf.body(ctx, args);
 	}
 };
 //#endregion
@@ -12000,10 +12399,13 @@ function createEngine(options) {
 	const runner = new InProcessRunner(options.onEscalation === void 0 ? void 0 : { onEscalation: options.onEscalation });
 	const mintRunId = createCanonicalIdMinter();
 	const realNow = Date.now.bind(globalThis);
+	const pricingOf = (servedBy) => {
+		const { adapterId, model } = parseModelRef(servedBy);
+		return resolvePricing(servedBy, options.pricing, adapters.get(adapterId)?.caps(model).pricing);
+	};
 	const priceUsd = (servedBy, usage) => {
 		if (servedBy === void 0) return;
-		const { adapterId, model } = parseModelRef(servedBy);
-		const pricing = resolvePricing(servedBy, options.pricing, adapters.get(adapterId)?.caps(model).pricing);
+		const pricing = pricingOf(servedBy);
 		if (pricing === void 0) return;
 		return priceUsdOf(pricing, usage);
 	};
@@ -12029,6 +12431,7 @@ function createEngine(options) {
 			lifetimeSpawnCap: options.budgetDefaults?.lifetimeSpawnCap ?? 500,
 			events: { emit: (body) => bus.emit(body, rootSpanId) },
 			priceUsd,
+			pricingOf,
 			...budgetSeed === void 0 ? {} : { seed: budgetSeed }
 		});
 		const invalidated = new Set(resumeCtx?.invalidate ?? []);
@@ -12132,6 +12535,7 @@ function createEngine(options) {
 				}
 			},
 			priceUsd: (servedBy, usage) => priceUsd(servedBy, usage),
+			pricingOf,
 			runSignal: controller.signal,
 			...defaults.isolation === void 0 ? {} : { isolation: defaults.isolation },
 			...options.onEscalation === void 0 ? {} : { onEscalation: options.onEscalation },
@@ -12242,7 +12646,7 @@ function createEngine(options) {
 				dropped: internals.dropped,
 				pending,
 				usage: ledger.usage,
-				cost: buildCostReport(internals.cost, ledger.usd)
+				cost: costReportFromJournal(replayer.snapshot(), priceUsd)
 			};
 			if (value !== void 0 && (status === "ok" || status === "exhausted")) outcome.value = value;
 			if (wireError !== void 0) outcome.error = wireError;
@@ -12675,4 +13079,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DedupIndex, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EventBus, ExternalRegistry, FINISH_SCHEMA, FINISH_TOOL_NAME, FileModelKnowledgeStore, FileTranscriptStore, GitWorktreeProvider, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, PlanInvariantError, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, agentErrorFromWire, agentErrorToWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateSchemaSpec, validateTerminationLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DedupIndex, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EventBus, ExternalRegistry, FINISH_SCHEMA, FINISH_TOOL_NAME, FileModelKnowledgeStore, FileTranscriptStore, GitWorktreeProvider, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, PlanInvariantError, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateSchemaSpec, validateTerminationLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };