@rulvar/core 1.51.0 → 1.52.0

package/dist/index.d.ts

@@ -2934,853 +2934,1287 @@ declare function validateEscalationReport(report: EscalationReport): Promise<Iss
 */
 declare function countsAgainstLimit(kind: EscalationKind): boolean;
 //#endregion
-//#region src/runtime/no-progress.d.ts
-/**
-* The no-progress abort class (M3-T08): an engine-defined detector
-* journaled as a first-class terminal abort distinct from user
-* cancellation (a cancelled entry always reruns; a no-progress abort
-* must replay, or every resume would re-pay the stuck turns). The
-* interim heuristic is committed: N consecutive
-* turns without tool calls or artifact deltas, N = 3; the broader
-* heuristic stays OQ-15, revisited on dogfood traces.
-*
-* Encoding: the abort is the agent's
-* terminal entry with status 'limit', an error payload carrying
-* abortClass 'no-progress', and memoizeOutcome stamped by the ENGINE on
-* the terminal entry, so the frozen memoize-limit rule replays it on
-* every subsequent resume without a live rerun. In M3 the runtime has no
-* per-turn artifact channel, so the tool-call test subsumes artifact
-* deltas; per-turn artifact producers arrive with M4 compaction.
-*/
-/** The committed no-progress detector N. */
-declare const DEFAULT_NO_PROGRESS_TURNS = 3;
-/**
-* The consumer-visible engine-decided abort classes (FR-424).
-* 'no-progress' is the detector below; 'output-truncated' is a
-* schema-less turn that ended at its output token allowance
-* (finish reason 'max-tokens') without visible output (v1.9.0
-* follow-up review). Both stamp memoizeOutcome on the terminal:
-* the work is paid, so every resume replays the abort instead of
-* re-paying the same bounded failure.
-*/
-type AbortClass = "no-progress" | "output-truncated";
-/**
-* Counts consecutive progress-free turns. A turn with at least one tool
-* call (or, later, an artifact delta) resets the streak; a turn with
-* neither lengthens it; the detector trips when the streak reaches the
-* threshold AND the loop would otherwise continue.
-*/
-declare class NoProgressDetector {
-  private streakInternal;
-  private readonly threshold;
-  constructor(threshold?: number);
-  get streak(): number;
-  /** Records one completed model turn. */
-  recordTurn(progress: {
-    toolCalls: number;
-    artifactDeltas?: number;
-  }): void;
-  get tripped(): boolean;
-  describe(): string;
-}
-//#endregion
-//#region src/runtime/usage-limits.d.ts
-interface UsageLimits {
-  /** Default 32. */
-  maxTurns?: number;
-  /** Unlimited by default. */
-  maxToolCalls?: number;
-  /** Unlimited by default (model caps still apply). */
-  maxOutputTokensPerTurn?: number;
-  /** Per-agent wall clock; unlimited by default. */
-  timeoutMs?: number;
-  /** Gap between stream events; default 120000. */
-  streamIdleTimeoutMs?: number;
+//#region src/l0/events.d.ts
+/** Run lifecycle and core telemetry (M1 subset). */
+type CoreEvents = {
+  type: "run:start";
+  workflow: string;
+  resumed: boolean;
+} | {
+  type: "run:end";
+  status: "ok" | "error" | "cancelled" | "exhausted" | "suspended";
+  totalUsd: number;
   /**
-  * The no-progress detector N (committed at 3):
-  * consecutive turns without tool calls or artifact deltas before the
-  * engine aborts with the dedicated class (M3-T08).
+  * Present and true when any priced usage folded into totalUsd is
+  * approximate (a transport cut, a stream the ceiling severed, or an
+  * abort left a turn's usage estimated rather than reported by the
+  * provider), so totalUsd is a lower bound estimate, never an exact
+  * charge. Absent means every contributing turn reported exact usage.
   */
-  noProgressTurns?: number;
-}
-declare const DEFAULT_MAX_TURNS = 32;
-declare const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 12e4;
-interface EffectiveUsageLimits {
-  maxTurns: number;
-  maxToolCalls?: number;
-  maxOutputTokensPerTurn?: number;
-  timeoutMs?: number;
-  streamIdleTimeoutMs: number;
-  /** Default DEFAULT_NO_PROGRESS_TURNS. */
-  noProgressTurns?: number;
-}
-/**
-* Limits merge per spawn: AgentOpts.limits over profile limits over engine
-* defaults.limits.
-*/
-declare function mergeUsageLimits(call?: UsageLimits, profile?: UsageLimits, engine?: UsageLimits): EffectiveUsageLimits;
+  usageApprox?: boolean;
+} | {
+  type: "phase:start";
+  phase: string;
+} | {
+  type: "log";
+  level: "debug" | "info" | "warn" | "error";
+  msg: string;
+  data?: Json;
+} | {
+  type: "budget:update";
+  spentUsd: number;
+  remainingUsd: number | null;
+  committedReserveUsd: number;
+} | {
+  type: "external:waiting";
+  key: string;
+  entryRef: number;
+  prompt?: string;
+  deadlineAt?: string;
+} | {
+  type: "approval:pending";
+  toolName: string;
+  entryRef: number;
+  deadlineAt?: string;
+} | {
+  type: "child:start";
+  workflow: string;
+  scope: string;
+} | {
+  type: "child:end";
+  workflow: string;
+  scope: string;
+  status: string;
+};
 /**
-* Validates one UsageLimits layer at its intake boundary (v1.34.0
-* review P2-3): a malformed field (NaN, Infinity, a negative, a
-* fraction) is a typed ConfigError before the merge, before any journal
-* entry, and before any provider dispatch. `site` names the layer in the
-* error text (e.g. `RunOptions.limits`). Counts are positive integers
-* (maxToolCalls may be 0: a spawn that must not call tools).
-* streamIdleTimeoutMs is handed to setTimeout as-is, so it is bounded by
-* the Node timer maximum like RetryPolicy delays; timeoutMs is a
-* wall-clock comparison, so it has no upper bound. Every present field
-* is checked; absent fields keep their defaults.
+* The structured exploration summary (RV-210): the engine-side tool
+* exploration counters for one agent invocation. Attached to the full
+* AgentResult and to the live `agent:end` event whenever any exploration
+* guard limit is configured; journaled inside the terminal error payload
+* (and therefore restored on replay) only when the guard itself ended
+* the invocation (abortClass 'exploration').
 */
-declare function validateUsageLimits(limits: UsageLimits, site: string): void;
-//#endregion
-//#region src/runtime/agent-loop.d.ts
-type AgentStatus = "ok" | "error" | "limit" | "cancelled" | "skipped" | "escalated";
-/** Artifact: the normative shape of AgentResult.artifacts entries. */
-interface Artifact {
-  /** Stable within the result. */
-  id: string;
-  /** Closed in v1. */
-  kind: "file" | "patch" | "json" | "text";
-  /** Telemetry only. */
-  label?: string;
-  /** Changed-file list (kind 'patch': worktree collect()). */
-  files?: string[];
-  /** TranscriptStore blob ref for offloaded content. */
-  ref?: string;
-  /** Inline JSON content for small values. */
-  data?: Json;
-}
-/** The verdict of one mechanical acceptance gate evaluation. */
-interface MechanicalGateVerdict {
-  pass: boolean;
-  detail?: string;
+interface ExplorationSummary {
+  /** Tool executions dispatched by the loop (the loop's own counter). */
+  toolCallsUsed: number;
+  /** Distinct (tool name, canonical args) signatures executed. */
+  distinctSignatures: number;
+  /** Executions of a signature that had already executed before. */
+  repeatedCalls: number;
+  /** Successful executions whose result digest was already seen. */
+  duplicateResultCalls: number;
+  /** Calls denied by the repeated-signature guard (never dispatched). */
+  deniedRepeats: number;
+  /** Executions per tool name. */
+  byTool: Record<string, number>;
 }
 /**
-* A mechanical acceptance gate: an engine-registered NAMED pure function
-* over AgentResult.artifacts.
-* The registry is per engine like every other registry; the
-* ladder driver journals each evaluation as a decision entry, so the
-* ladder fold consumes only journaled verdicts, never live re-evaluation.
+* Agent lifecycle. One logical agent dispatch emits EXACTLY ONE
+* `agent:start`/`agent:end` pair on its span (the start carries the
+* primary role), and each model invocation phase inside the span
+* (`loop`, then possibly `summarize` activations, `finalize`,
+* `extract`) emits its own `agent:phase:start`/`agent:phase:end` pair,
+* so durations, per-phase usage, and attempts are derivable without
+* heuristics (the RV-207 event-model contract; before it, every phase
+* emitted an unpaired extra `agent:start` and consumers pairing starts
+* with the single end computed the LAST phase's duration as the
+* agent's). `reduceInvocationTable` is the official reducer over this
+* vocabulary.
 */
-type MechanicalGateProfile = (artifacts: readonly Artifact[]) => MechanicalGateVerdict;
-interface AgentResult<T> {
-  status: AgentStatus;
-  output: T | null;
-  usage: Usage;
-  costUsd: number;
-  turns: number;
+type AgentEvents = {
+  type: "agent:queued";
+  agentType: string;
+  label?: string;
+} | {
+  type: "agent:start";
+  agentType: string;
+  label?: string;
+  model: string;
+  role: string;
+} | {
+  type: "agent:phase:start";
+  agentType: string;
+  label?: string; /** The invocation role this phase activation runs as. */
+  role: string; /** The model the activation resolved to (fallbacks may serve another; the end event reports the server). */
+  model: string;
   /**
-  * The model that actually served the loop phase at the end (M4-T04):
-  * differs from the requested spec only under transport failover.
+  * 1-based activation ordinal within the span, unique per
+  * activation (a summarize that fires three times gets three
+  * pairs). Key phases by (spanId, invocation).
   */
-  servedBy: ModelRef;
+  invocation: number;
+} | {
+  type: "agent:phase:end";
+  agentType: string;
+  label?: string;
+  role: string; /** The model that actually served the activation's last attempt. */
+  model: string;
+  invocation: number;
   /**
-  * Present only when the call spanned MORE THAN ONE (invocation role,
-  * serving model) pair (the loop, extract, finalize, and summarize
-  * roles resolve independently): usage split per (role, model), so
-  * `costUsd` and every cost bucket price each slice at its own rate
-  * and `CostReport.byRole` attributes each phase to its own bucket
-  * (v1.19.0 review P1-2). Absent for a single-phase single-model call,
-  * which (usage, servedBy) already describes exactly.
+  * Wall-clock activation duration. Live telemetry only: replayed
+  * phase pairs (reconstructed from the terminal entry's usage
+  * slices) carry 0.
   */
-  usageByModel?: UsageSlice[];
-  transcriptRef: string;
-  artifacts?: Artifact[];
-  error?: AgentError;
+  durationMs: number; /** The usage this activation added to its (role, model) slices. */
+  usage: Usage; /** That usage priced at each serving model's own rate. */
+  costUsd: number;
+  outcome: "ok" | "error";
   /**
-  * Human-readable detail behind `error` (provider message, first schema
-  * issue): feeds the journaled WireError message. An additive
-  * field; never part of identity.
+  * Transport retries inside this activation. Present only when
+  * greater than zero; live telemetry only (absent on replay).
   */
-  errorMessage?: string;
-  /** Present if and only if status === 'escalated'. */
-  escalation?: EscalationReport;
+  retries?: number;
+} | {
+  type: "agent:end";
+  agentType: string;
+  label?: string;
+  status: string;
+  usage: Usage;
+  costUsd: number;
+  entryRef: number;
   /**
-  * Engine-internal: the accepted escalate request before the runtime
-  * fills costToDate and salvage into the full report. The ctx layer
-  * consumes and removes it; consumers read `escalation`.
+  * Present and true when this agent's usage is approximate rather
+  * than reported by the provider (the turn was cut by a transport
+  * failure, a ceiling that severed the stream, or an abort). Absent
+  * means the provider reported the usage exactly. Mirrors the
+  * terminal journal entry's usageApprox.
   */
-  escalationRequest?: EscalationRequest;
+  usageApprox?: boolean;
   /**
-  * The dedicated first-class abort class (M3-T08): present on the
-  * engine-decided no-progress abort (status 'limit'), never on user
-  * cancellation or ordinary cap hits.
+  * Total transport retries across the span's activations. Present
+  * only when greater than zero; live telemetry only, never
+  * journaled, so a replayed agent:end omits it (absent means "zero
+  * or unknown").
   */
-  abortClass?: AbortClass;
+  retryCount?: number;
   /**
-  * Transport retries across the span's phase activations, present only
-  * when greater than zero. Live telemetry only: the ctx layer surfaces
-  * it as `agent:end` retryCount; it is never journaled, so a replayed
-  * result omits it (absent means "zero or unknown").
+  * The exploration guard counters (RV-210). Present live whenever
+  * any exploration guard limit was configured for the invocation;
+  * on replay present only when the guard abort journaled it in the
+  * terminal error payload.
   */
-  transportRetries?: number;
-}
-type EscalatedResult<T> = AgentResult<T> & {
-  status: "escalated";
-  escalation: EscalationReport;
+  exploration?: ExplorationSummary;
+} | {
+  type: "agent:error";
+  agentType: string;
+  label?: string;
+  error: WireError;
+  willRetry: boolean;
+} | {
+  type: "agent:schema-retry";
+  agentType: string;
+  attempt: number;
+  maxAttempts: number;
+} | {
+  type: "agent:stream";
+  delta: string;
 };
-declare function isEscalated<T>(r: AgentResult<T>): r is EscalatedResult<T>;
-/** Minimal internal event sink; the typed WorkflowEvent envelope wraps it in M1-T10. */
-interface RuntimeEventSink {
-  emit(body: {
-    type: string;
-  } & Record<string, unknown>): void;
-}
-/** Budget hooks bound by the three-layer budget. */
-interface BudgetHooks {
-  /** Layer 2: before every turn; throws BudgetExhaustedError to block dispatch. */
-  beforeTurn(): void;
+/** Tool lifecycle (emitters arrive with the tool system, M3). */
+type ToolEvents = {
+  type: "tool:start";
+  toolName: string;
+  risk?: Json;
+} | {
+  type: "tool:end";
+  toolName: string;
+  outcome: "ok" | "error" | "denied";
+  durationMs: number;
   /**
-  * Layer 2b, the pre-dispatch output bound: the output tokens the
-  * remaining budget still affords from `servedBy` for a prompt of
-  * `estimatedInputTokens`. The dispatch clamps the request's
-  * maxOutputTokens to it and denies the turn entirely when not even one
-  * output token fits. Undefined = unbounded (no ceiling, no price row,
-  * or free output).
+  * Audit fields (M5-T05): the chain verdict,
+  * the deciding layer, the matched rule, and advisory domain-rule
+  * matches. Telemetry, never identity; ask verdicts additionally
+  * journal as suspended approvals.
   */
-  maxAffordableOutputTokens?: (servedBy: ModelRef, estimatedInputTokens: number) => number | undefined;
-  /** Live usage accounting; layer 3 may respond by aborting `signal`. */
-  onUsage(usage: Usage, servedBy: ModelRef): void;
-  /** Layer 3: the ceiling AbortSignal. */
-  signal?: AbortSignal;
-}
-/** Reason marker distinguishing a budget-ceiling abort from host cancellation. */
-declare const BUDGET_ABORT_REASON = "rulvar:budget-ceiling";
-/** One model-issued tool call as the loop dispatches it. */
-interface ToolCallRequest {
-  id: string;
-  name: string;
-  args: unknown;
-}
-/**
-* The ctx-side verdict for one dispatch, produced by the permission
-* chain (M3-T03). For 'ask' the loop writes the turn checkpoint with the
-* pending state FIRST, then suspend() journals the approval entry (or
-* re-matches an existing one) and parks until a resolution closes it.
-*/
-interface GateAudit {
-  verdict: "allow" | "deny" | "ask";
-  decidedBy: string;
+  verdict?: "allow" | "deny" | "ask";
+  decidedBy?: string;
   rule?: Json;
   advisory?: Json;
-}
-type PermissionGate = ({
-  kind: "allow";
-  input: unknown;
-} | {
-  kind: "deny";
-  reason: string;
-} | {
-  kind: "ask";
-  input: unknown;
-  suspend: () => Promise<{
-    decision: "allow" | "deny";
-    reason?: string;
-  }>;
-}) & {
-  /** Chain audit payload ridden into tool:end telemetry. */audit?: GateAudit;
+  /**
+  * Present when an exploration guard (RV-210), not the permission
+  * chain, denied the call: the outcome is 'denied' and the call was
+  * never dispatched.
+  */
+  guard?: "repeated-signature";
 };
 /**
-* The spawn's frozen toolset plus the per-call context factory, prepared
-* by the ctx layer (M3-T01). The contracts are the canonical identity
-* projection already hashed into the spawn's content key; the loop sends
-* exactly them to the model.
+* Bare-nondeterminism detection (RV-209). Emitted LIVE by the segment
+* that observed the call, at most once per (category, provenance) per
+* execution segment; never journaled and never re-emitted with the
+* `replayed` flag. Because replay re-executes the workflow body, a
+* violation that survives in the code fires again on every replay of
+* the run, so the event appears organically in both live and replayed
+* streams. Exempt provenances (installed dependencies under
+* node_modules and Node runtime frames) never emit: they are
+* classified and silenced, which is what keeps an SDK's internal
+* `Math.random()` from branding the run nondeterministic.
 */
-interface ToolRuntime {
-  defs: ToolDef[];
-  contracts: ToolContract[];
-  /** Mints a per-call ToolContext (fresh tool span under the agent span). */
-  contextFor(toolName: string): ToolContext;
-  /** Permission chain evaluation (M3-T03); absent = every call allowed. */
-  permission?: (call: ToolCallRequest) => Promise<PermissionGate>;
-}
-/** One serving target of a phase: the primary or a failover fallback. */
-interface PhaseTarget {
-  adapter: ProviderAdapter;
-  resolved: ResolvedInvocation;
-}
-interface RunAgentOptions<S extends SchemaSpec = JsonSchema> {
-  prompt: string;
-  schema?: S;
-  /** Canonicalized JSON Schema projection of `schema` (precomputed for identity). */
-  canonicalSchema?: JsonSchema;
-  adapter: ProviderAdapter;
-  resolved: ResolvedInvocation;
+type DeterminismEvents = {
+  type: "determinism:warning"; /** Which patched global fired. */
+  category: "bare-date-now" | "bare-math-random";
   /**
-  * Transport failover chain for the loop phase (M4-T04):
-  * resolved fallback targets tried in order on
-  * transport or rate-limit failures after retries exhaust. Failover is
-  * sticky and changes only servedBy, never the content key.
+  * 'workflow': the caller is workflow-origin code (the violation the
+  * guard exists for; rejects the run under `determinism.mode:
+  * 'error'`). 'allowlisted': the caller matched a configured
+  * `determinism.allowlist` pattern and is exempt by explicit host
+  * decision; emitted for visibility, never rejects.
   */
-  fallbacks?: PhaseTarget[];
+  provenance: "workflow" | "allowlisted"; /** The calling stack frame, after the configured redaction hook. */
+  frame: string; /** Parsed location when the frame carries one, after redaction. */
+  file?: string;
+  line?: number;
+  column?: number;
+};
+/**
+* Adaptive orchestration, resolutions, and
+* accounting: emitted only by runs where the corresponding machinery is
+* active (applicability per mode:
+* https://docs.rulvar.com/guide/adaptive-orchestration). The types land as
+* one closed catalog with M7-T03; emitters arrive with their tasks.
+*/
+type AdaptiveEvents = {
+  type: "plan:revised";
+  entryRef: number;
+  planHash: string;
+  applied: number;
+  dropped: number;
+  revisionUnitsRemaining: number;
+} | {
+  type: "node:parked";
+  nodeId: string;
+  logicalTaskId: string;
+} | {
+  type: "node:cancelled";
+  nodeId: string;
+  logicalTaskId: string;
+} | {
+  type: "node:linked";
+  nodeId: string;
+  logicalTaskId: string;
+  donorRef: number;
+  reclaimedUsd: number;
+} | {
+  type: "orchestrator:woke";
+  digestSeq: number;
+  planHash: string;
+  coversToOrdinal: number;
+  renderSize: number;
+} | {
   /**
-  * Transport RetryPolicy (M4-T05): lives UNDER
-  * the journal, wired around every adapter.stream dispatch. sleep and
-  * random are injectable for tests; the core owns wall-clock.
+  * Two emitted shapes share the discriminant: the cap-freeze form
+  * carries { atCap: true, spentUsd, capUsd, finalizeReserveUsd },
+  * and the per-wake digest form carries atCap plus the passive
+  * WakeBudgetBlock fields (runSpentUsd .. softWarning).
   */
-  retry?: {
-    policy?: RetryPolicy;
-    sleep?: (ms: number) => Promise<void>;
-    random?: () => number;
-  };
+  type: "orchestrator:budget";
+  atCap: boolean;
+  spentUsd?: number;
+  capUsd?: number;
+  finalizeReserveUsd?: number;
+  runSpentUsd?: number;
+  runCeilingUsd?: number;
+  orchestratorSpentUsd?: number;
+  orchestratorCapUsd?: number;
+  orchestratorShare?: number;
+  softWarning?: boolean;
+} | {
+  type: "escalation:raised";
+  entryRef: number;
+  kind: "scope_bigger" | "scope_different" | "blocked_with_evidence";
+  logicalTaskId: string;
+  costToDateUsd: number;
+} | {
+  type: "escalation:decided";
+  entryRef: number;
+  decision: "retry" | "decompose" | "cancel" | "accept";
+  by: ResolutionBy;
+  countsAgainstLimit: boolean;
+} | {
+  type: "spawn:admitted";
+  entryRef: number; /** The admitting arms of the unified AdmitVerdict union. */
+  verdict: "admit" | "reuse_full" | "admit_graft";
+  agentType: string;
+  logicalTaskId: string;
   /**
-  * Per-provider keyed limiter hook (M4-T07): wraps every wire dispatch
-  * under the serving adapter's key; absent = unlimited (Appendix A).
-  * `signal` is the agent-level abort: an aborted caller leaves the
-  * key's queue without a slot (v1.34.0 review P2-4).
+  * Spawn-unit balance after the budget-layer debit. Present on
+  * budget-layer admissions (the orchestrator spawn tools and
+  * ctx.workflow children); absent on lineage-layer admissions
+  * (ctx.agent roots), whose spawn-unit debit rides the dispatch
+  * itself (v1.22.0 review P2-5).
   */
-  providerSlot?: <T>(key: string, fn: () => Promise<T>, signal?: AbortSignal) => Promise<T>;
-  /** The resolved toolset; absent = no tools declared. */
-  tools?: ToolRuntime;
-  /**
-  * Separate final extract invocation, present only when the role trigger
-  * protocol demands one: schema set AND (routing directs extract to a
-  * different model OR the loop model's caps cannot serve the required
-  * tier OR finalize is routed). Otherwise the schema rides the last loop
-  * turn (the necessity rule is
-  * decided by the ctx layer via model/roles.ts).
+  spawnUnitsAfter?: number;
+} | {
+  type: "spawn:rejected";
+  /**
+  * The journaled admission decision entry; absent for the
+  * pre-admission config gates (orchestrate maxSpawns), which
+  * reject before anything is journaled.
   */
-  extract?: PhaseTarget & {
-    fallbacks?: PhaseTarget[];
-  };
+  entryRef?: number;
+  code: string;
+  agentType: string;
+  logicalTaskId?: string;
+} | {
+  type: "verify:failed";
+  entryRef: number;
+  logicalTaskId: string;
+  rung: number;
+  gate: "mechanical" | "judge" | "spot-check";
+} | {
+  type: "ledger:op";
+  entryRef: number;
+  op: "brief_set" | "fact_add" | "fact_supersede" | "lesson_add" | "observation_add";
+} | {
+  type: "stall:detected";
+  logicalTaskId: string;
+  stallStreak: number;
+} | {
+  type: "guard:oscillation";
+  spawnKeyHash: string;
+  oscillationCount: number;
+  limit: number;
+} | {
+  type: "resolution:applied";
+  targetRef: number;
+  entryRef: number;
+  by: ResolutionBy;
+} | {
+  type: "resolution:superseded";
+  targetRef: number;
+  entryRef: number;
+  supersededBy: number;
+  reason: "already_resolved" | "target_abandoned";
+} | {
+  type: "termination:debit";
+  entryRef: number;
+  counter: string;
+  remaining: number;
+  phi: number;
+} | {
+  type: "termination:denied";
+  entryRef: number;
+  counter: string;
+  code: string;
+} | {
+  type: "termination:config-drift";
+  field: string;
+  frozenValue: Json;
+  liveValue: Json;
+} | {
   /**
-  * Finalize synthesis invocation (M4-T01), present only when the role
-  * trigger protocol fires it: configured in routing AND the toolset is
-  * non-empty. Runs after tools stop with toolChoice 'none' over the
-  * full transcript plus a deterministic synthesis instruction appended
-  * to the REQUEST only (the durable transcript keeps the raw history);
-  * its text becomes the output for schema-less calls, a non-truncated
-  * empty synthesis falls back to the loop turn's text, and a
-  * schema-bearing call always pairs it with a separate extract
-  * (the ctx layer guarantees `extract` is present in that case). Like
-  * extract, the finalize invocation is not checkpointed in v1.
+  * Declared for hosts; not emitted today. The compatibility scan
+  * runs strictly before a run's event stream exists, so the
+  * refusal travels only as the typed JournalCompatibilityError
+  * (which carries the same fields).
   */
-  finalize?: PhaseTarget & {
-    fallbacks?: PhaseTarget[];
-  };
+  type: "journal:compat";
+  code: "HASH_VERSION_TOO_OLD" | "HASH_VERSION_TOO_NEW";
+  found: number;
+  window: [number, number];
+};
+type WorkflowEventBody = CoreEvents | AgentEvents | ToolEvents | DeterminismEvents | AdaptiveEvents;
+/**
+* The envelope: seq is an independent per-run
+* telemetry counter, strictly increasing in emission order and DISTINCT
+* from JournalEntry.seq (never compare or join the two; entryRef fields
+* carry journal seqs explicitly). ts is wall clock, telemetry only.
+* replayed is true only on re-emitted journal-backed lifecycle events;
+* stream deltas are never re-emitted.
+*/
+type WorkflowEvent = {
+  runId: string;
+  seq: number;
+  ts: string;
+  spanId: string;
+  parentSpanId?: string;
+  replayed?: boolean;
+} & WorkflowEventBody;
+//#endregion
+//#region src/runtime/no-progress.d.ts
+/**
+* The no-progress abort class (M3-T08): an engine-defined detector
+* journaled as a first-class terminal abort distinct from user
+* cancellation (a cancelled entry always reruns; a no-progress abort
+* must replay, or every resume would re-pay the stuck turns). The
+* interim heuristic is committed: N consecutive
+* turns without tool calls or artifact deltas, N = 3; the broader
+* heuristic stays OQ-15, revisited on dogfood traces.
+*
+* Encoding: the abort is the agent's
+* terminal entry with status 'limit', an error payload carrying
+* abortClass 'no-progress', and memoizeOutcome stamped by the ENGINE on
+* the terminal entry, so the frozen memoize-limit rule replays it on
+* every subsequent resume without a live rerun. In M3 the runtime has no
+* per-turn artifact channel, so the tool-call test subsumes artifact
+* deltas; per-turn artifact producers arrive with M4 compaction.
+*/
+/** The committed no-progress detector N. */
+declare const DEFAULT_NO_PROGRESS_TURNS = 3;
+/**
+* The consumer-visible engine-decided abort classes (FR-424).
+* 'no-progress' is the detector below; 'output-truncated' is a
+* schema-less turn that ended at its output token allowance
+* (finish reason 'max-tokens') without visible output (v1.9.0
+* follow-up review); 'exploration' is the tripped no-new-evidence
+* exploration guard (RV-210), carrying its structured summary in the
+* terminal error payload. All stamp memoizeOutcome on the terminal:
+* the work is paid, so every resume replays the abort instead of
+* re-paying the same bounded failure.
+*/
+type AbortClass = "no-progress" | "output-truncated" | "exploration";
+/**
+* Counts consecutive progress-free turns. A turn with at least one tool
+* call (or, later, an artifact delta) resets the streak; a turn with
+* neither lengthens it; the detector trips when the streak reaches the
+* threshold AND the loop would otherwise continue.
+*/
+declare class NoProgressDetector {
+  private streakInternal;
+  private readonly threshold;
+  constructor(threshold?: number);
+  get streak(): number;
+  /** Records one completed model turn. */
+  recordTurn(progress: {
+    toolCalls: number;
+    artifactDeltas?: number;
+  }): void;
+  get tripped(): boolean;
+  describe(): string;
+}
+//#endregion
+//#region src/runtime/usage-limits.d.ts
+interface UsageLimits {
+  /** Default 32. */
+  maxTurns?: number;
+  /** Unlimited by default. */
+  maxToolCalls?: number;
+  /** Unlimited by default (model caps still apply). */
+  maxOutputTokensPerTurn?: number;
+  /** Per-agent wall clock; unlimited by default. */
+  timeoutMs?: number;
+  /** Gap between stream events; default 120000. */
+  streamIdleTimeoutMs?: number;
   /**
-  * Summarize invocation target for compaction (M4-T03): resolved
-  * through the chain with role 'summarize', falling back to the loop
-  * model when routing resolves nothing. Compaction
-  * is ON by default; absence of this option disables it (direct
-  * runAgent callers).
+  * The no-progress detector N (committed at 3):
+  * consecutive turns without tool calls or artifact deltas before the
+  * engine aborts with the dedicated class (M3-T08).
   */
-  summarize?: PhaseTarget & {
-    fallbacks?: PhaseTarget[];
-  };
-  /** Per-profile compaction config; threshold default 0.8 (Appendix A). */
-  compaction?: {
-    threshold?: number;
-  };
+  noProgressTurns?: number;
   /**
-  * Turn-boundary checkpointing (M3-T02).
-  * load() restores the last boundary on a dangling-dispatch resume;
-  * save() persists each boundary where the loop continues. The separate
-  * extract invocation is not checkpointed in v1: an extract-phase crash
-  * re-pays from the last loop boundary.
+  * Soft 50%/80% thresholds over maxToolCalls (RV-210), surfaced to the
+  * model as a plain user message carrying the exact remaining count.
+  * Inert (with a loud log warning) when maxToolCalls is not set. Off by
+  * default: the notice enters the conversation, so enabling it changes
+  * recorded model requests.
   */
-  checkpoint?: {
-    load(): Promise<CheckpointState | undefined>;
-    save(state: CheckpointState): Promise<void>;
-  };
-  limits: EffectiveUsageLimits;
-  /** Emits agent:stream deltas when true (telemetry only). */
-  stream?: boolean;
-  /** Host or sibling cancellation. */
-  signal?: AbortSignal;
-  budget?: BudgetHooks;
-  events?: RuntimeEventSink;
-  transcript?: {
-    mintRef(): string;
-    put(ref: string, blob: Uint8Array): Promise<void>;
-  };
-  priceUsd?: (servedBy: ModelRef, usage: Usage) => number | undefined;
-  /** Bounded schema re-prompt attempts; default 2 (Appendix A). */
-  schemaRetryAttempts?: number;
-  /** Bounded ModelRetry conversions per tool call chain; default 2 (Appendix A). */
-  modelRetryAttempts?: number;
+  toolBudgetNotices?: boolean;
   /**
-  * Escalation opt-in (M3-T07): the loop intercepts accepted calls to
-  * the escalate tool and terminates with status 'escalated'; the
-  * in-run minSpend gate rejects early scope_bigger escalations with a
-  * "keep working" error tool result (M3-T09).
+  * How many times the SAME tool signature (name + canonical JCS args)
+  * may execute per invocation (RV-210). The call that would exceed it
+  * is denied with a typed error tool result instead of dispatched; the
+  * denial is visible to the model and does not consume maxToolCalls.
+  * Unlimited by default.
   */
-  escalation?: {
-    minSpendUsd: number;
-  };
+  maxRepeatedToolSignature?: number;
   /**
-  * Terminal-tool interception (M6-T07): an accepted call to the named
-  * tool ends the loop with status ok; the call's validated `result`
-  * argument becomes the agent output (the orchestrator finish
-  * tool). The tool's execute never runs, mirroring escalate.
-  * `validate` is the optional host judgment over a schema valid call
-  * (the RV-204 finish validators): ok finishes as before; a rejection
-  * becomes the call's error tool result and the turn continues, so the
-  * model can repair and call the terminal tool again. The hook owns
-  * bounding and journaling; the loop stays policy only and never
-  * throws.
+  * How many consecutive successful tool executions may return only
+  * already-seen result digests before the engine aborts the invocation
+  * as status 'limit' with abortClass 'exploration' (RV-210). The
+  * executed work is kept and the terminal memoizes. Unlimited by
+  * default.
   */
-  terminalTool?: {
-    name: string;
-    validate?: (call: {
-      id: string;
-      result: unknown;
-    }) => Promise<{
-      ok: true;
-    } | {
-      ok: false;
-      feedback: Record<string, unknown>;
-    }>;
-  };
-  agentType?: string;
-  /** The primary invocation role of the tool loop; default 'loop' (M6-T05). */
-  role?: "loop" | "plan" | "orchestrate";
-  label?: string;
-  now?: () => number;
+  maxNoNewEvidenceCalls?: number;
+}
+declare const DEFAULT_MAX_TURNS = 32;
+declare const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 12e4;
+interface EffectiveUsageLimits {
+  maxTurns: number;
+  maxToolCalls?: number;
+  maxOutputTokensPerTurn?: number;
+  timeoutMs?: number;
+  streamIdleTimeoutMs: number;
+  /** Default DEFAULT_NO_PROGRESS_TURNS. */
+  noProgressTurns?: number;
+  /** RV-210 exploration guards; absent = off. */
+  toolBudgetNotices?: boolean;
+  maxRepeatedToolSignature?: number;
+  maxNoNewEvidenceCalls?: number;
 }
 /**
-* The output-truncation abort message (v1.9.0 follow-up review). The
-* constraint is named neutrally as the turn's output token allowance:
-* the effective request cap can come from limits.maxOutputTokensPerTurn,
-* the budget clamp above, or the adapter's own default, and the provider
-* can also cut at its model maximum with no request cap at all.
-*/
-/**
-* The deterministic synthesis instruction appended (as a user message)
-* to the finalize REQUEST only, never to the durable transcript. A
-* transcript that simply ends at an assistant message reads to a real
-* model as a fresh conversation opening, so an uninstructed synthesis
-* call can replace the loop's correct answer with a greeting (v1.18.0
-* review P1-1); the extract arm has carried its own instruction since
-* M4, and this is its finalize twin. The wording is part of the wire
-* request: keep it stable.
+* Limits merge per spawn: AgentOpts.limits over profile limits over engine
+* defaults.limits.
 */
-declare const FINALIZE_SYNTHESIS_INSTRUCTION: string;
+declare function mergeUsageLimits(call?: UsageLimits, profile?: UsageLimits, engine?: UsageLimits): EffectiveUsageLimits;
 /**
-* Runs one agent to a typed AgentResult. Never throws past policy: every
-* failure mode becomes a typed status on the result.
+* Validates one UsageLimits layer at its intake boundary (v1.34.0
+* review P2-3): a malformed field (NaN, Infinity, a negative, a
+* fraction) is a typed ConfigError before the merge, before any journal
+* entry, and before any provider dispatch. `site` names the layer in the
+* error text (e.g. `RunOptions.limits`). Counts are positive integers
+* (maxToolCalls may be 0: a spawn that must not call tools).
+* streamIdleTimeoutMs is handed to setTimeout as-is, so it is bounded by
+* the Node timer maximum like RetryPolicy delays; timeoutMs is a
+* wall-clock comparison, so it has no upper bound. Every present field
+* is checked; absent fields keep their defaults.
 */
-declare function runAgent<S extends SchemaSpec>(options: RunAgentOptions<S>): Promise<AgentResult<Out<S>>>;
+declare function validateUsageLimits(limits: UsageLimits, site: string): void;
 //#endregion
-//#region src/runtime/permission-chain.d.ts
-type HookVerdict = "allow" | "deny" | "ask" | {
-  modifiedInput: unknown;
-} | undefined;
-type PermissionHook = (toolName: string, input: unknown, ctx: ToolContext) => HookVerdict | Promise<HookVerdict>;
+//#region src/runtime/agent-loop.d.ts
+type AgentStatus = "ok" | "error" | "limit" | "cancelled" | "skipped" | "escalated";
+/** Artifact: the normative shape of AgentResult.artifacts entries. */
+interface Artifact {
+  /** Stable within the result. */
+  id: string;
+  /** Closed in v1. */
+  kind: "file" | "patch" | "json" | "text";
+  /** Telemetry only. */
+  label?: string;
+  /** Changed-file list (kind 'patch': worktree collect()). */
+  files?: string[];
+  /** TranscriptStore blob ref for offloaded content. */
+  ref?: string;
+  /** Inline JSON content for small values. */
+  data?: Json;
+}
+/** The verdict of one mechanical acceptance gate evaluation. */
+interface MechanicalGateVerdict {
+  pass: boolean;
+  detail?: string;
+}
 /**
-* Declarative rule tables (no closures). `'undeclared'` in risk
-* position matches every tool WITHOUT declared risk: presets treat the
-* undeclared state conservatively. Argv rules
-* match through the real shell matcher; domain rules are
-* ADVISORY for every tool in the current release: they never
-* change a verdict, and matches surface in the tool:end audit
-* fields (enforcement will live in a first-party fetch tool
-* when one ships).
+* A mechanical acceptance gate: an engine-registered NAMED pure function
+* over AgentResult.artifacts.
+* The registry is per engine like every other registry; the
+* ladder driver journals each evaluation as a decision entry, so the
+* ladder fold consumes only journaled verdicts, never live re-evaluation.
 */
-type RiskRuleValue = ToolRisk | "undeclared";
-type PermissionRule = {
-  tool: string | string[];
-} | {
-  risk: RiskRuleValue | RiskRuleValue[];
-} | {
-  tool: string;
-  argv: string | string[];
-} | {
-  tool: string;
-  domains: string[];
+type MechanicalGateProfile = (artifacts: readonly Artifact[]) => MechanicalGateVerdict;
+interface AgentResult<T> {
+  status: AgentStatus;
+  output: T | null;
+  usage: Usage;
+  costUsd: number;
+  turns: number;
+  /**
+  * The model that actually served the loop phase at the end (M4-T04):
+  * differs from the requested spec only under transport failover.
+  */
+  servedBy: ModelRef;
+  /**
+  * Present only when the call spanned MORE THAN ONE (invocation role,
+  * serving model) pair (the loop, extract, finalize, and summarize
+  * roles resolve independently): usage split per (role, model), so
+  * `costUsd` and every cost bucket price each slice at its own rate
+  * and `CostReport.byRole` attributes each phase to its own bucket
+  * (v1.19.0 review P1-2). Absent for a single-phase single-model call,
+  * which (usage, servedBy) already describes exactly.
+  */
+  usageByModel?: UsageSlice[];
+  transcriptRef: string;
+  artifacts?: Artifact[];
+  error?: AgentError;
+  /**
+  * Human-readable detail behind `error` (provider message, first schema
+  * issue): feeds the journaled WireError message. An additive
+  * field; never part of identity.
+  */
+  errorMessage?: string;
+  /** Present if and only if status === 'escalated'. */
+  escalation?: EscalationReport;
+  /**
+  * Engine-internal: the accepted escalate request before the runtime
+  * fills costToDate and salvage into the full report. The ctx layer
+  * consumes and removes it; consumers read `escalation`.
+  */
+  escalationRequest?: EscalationRequest;
+  /**
+  * The dedicated first-class abort class (M3-T08): present on the
+  * engine-decided no-progress abort (status 'limit'), never on user
+  * cancellation or ordinary cap hits.
+  */
+  abortClass?: AbortClass;
+  /**
+  * Transport retries across the span's phase activations, present only
+  * when greater than zero. Live telemetry only: the ctx layer surfaces
+  * it as `agent:end` retryCount; it is never journaled, so a replayed
+  * result omits it (absent means "zero or unknown").
+  */
+  transportRetries?: number;
+  /**
+  * The exploration guard counters (RV-210): present whenever any of
+  * the exploration limits (toolBudgetNotices, maxRepeatedToolSignature,
+  * maxNoNewEvidenceCalls) was configured. Journaled inside the terminal
+  * error payload (and restored on replay) only for the guard's own
+  * abort (abortClass 'exploration'); otherwise live telemetry like
+  * transportRetries.
+  */
+  exploration?: ExplorationSummary;
+}
+type EscalatedResult<T> = AgentResult<T> & {
+  status: "escalated";
+  escalation: EscalationReport;
 };
-type CanUseTool = (toolName: string, input: unknown, ctx: ToolContext) => "allow" | "deny" | {
-  modifiedInput: unknown;
-} | Promise<"allow" | "deny" | {
-  modifiedInput: unknown;
-}>;
-/** Host-side permission configuration (engine defaults.permissions). */
-interface PermissionConfig {
-  hooks?: PermissionHook[];
-  deny?: PermissionRule[];
-  ask?: PermissionRule[];
-  canUseTool?: CanUseTool;
+declare function isEscalated<T>(r: AgentResult<T>): r is EscalatedResult<T>;
+/** Minimal internal event sink; the typed WorkflowEvent envelope wraps it in M1-T10. */
+interface RuntimeEventSink {
+  emit(body: {
+    type: string;
+  } & Record<string, unknown>): void;
+}
+/** Budget hooks bound by the three-layer budget. */
+interface BudgetHooks {
+  /** Layer 2: before every turn; throws BudgetExhaustedError to block dispatch. */
+  beforeTurn(): void;
+  /**
+  * Layer 2b, the pre-dispatch output bound: the output tokens the
+  * remaining budget still affords from `servedBy` for a prompt of
+  * `estimatedInputTokens`. The dispatch clamps the request's
+  * maxOutputTokens to it and denies the turn entirely when not even one
+  * output token fits. Undefined = unbounded (no ceiling, no price row,
+  * or free output).
+  */
+  maxAffordableOutputTokens?: (servedBy: ModelRef, estimatedInputTokens: number) => number | undefined;
+  /** Live usage accounting; layer 3 may respond by aborting `signal`. */
+  onUsage(usage: Usage, servedBy: ModelRef): void;
+  /** Layer 3: the ceiling AbortSignal. */
+  signal?: AbortSignal;
+}
+/** Reason marker distinguishing a budget-ceiling abort from host cancellation. */
+declare const BUDGET_ABORT_REASON = "rulvar:budget-ceiling";
+/** One model-issued tool call as the loop dispatches it. */
+interface ToolCallRequest {
+  id: string;
+  name: string;
+  args: unknown;
 }
 /**
-* Profile-level permissions.
-* inheritPermissions governs SUBAGENT inheritance (mode c orchestrators,
-* M6+): children get their own config only unless explicitly opted in.
-* It is carried as data here and consumed by the spawning layers.
+* The ctx-side verdict for one dispatch, produced by the permission
+* chain (M3-T03). For 'ask' the loop writes the turn checkpoint with the
+* pending state FIRST, then suspend() journals the approval entry (or
+* re-matches an existing one) and parks until a resolution closes it.
 */
-interface AgentProfilePermissions extends PermissionConfig {
-  /** Compiles into deny/ask rules; ships in M5. */
-  preset?: "strict" | "standard" | "open";
-  /** Default false. */
-  inheritPermissions?: boolean;
-}
-interface CompiledPermissionChain {
-  hooks: PermissionHook[];
-  deny: PermissionRule[];
-  ask: PermissionRule[];
-  canUseTool?: CanUseTool;
+interface GateAudit {
+  verdict: "allow" | "deny" | "ask";
+  decidedBy: string;
+  rule?: Json;
+  advisory?: Json;
 }
-type PermissionVerdict = ({
-  verdict: "allow";
-  decidedBy: "hook" | "canUseTool" | "default";
+type PermissionGate = ({
+  kind: "allow";
   input: unknown;
 } | {
-  verdict: "deny";
-  decidedBy: "hook" | "deny-rule" | "canUseTool";
-  rule?: PermissionRule;
-  input: unknown;
+  kind: "deny";
+  reason: string;
 } | {
-  verdict: "ask";
-  decidedBy: "hook" | "ask-rule" | "default";
-  rule?: PermissionRule;
+  kind: "ask";
   input: unknown;
+  suspend: () => Promise<{
+    decision: "allow" | "deny";
+    reason?: string;
+  }>;
 }) & {
-  /**
-  * Advisory domain-rule matches: reported in the tool:end
-  * audit fields, never enforced in the current release.
-  */
-  advisory?: PermissionRule[];
+  /** Chain audit payload ridden into tool:end telemetry. */audit?: GateAudit;
 };
 /**
-* Merges the engine-wide config and the profile config into one chain.
-* Layers concatenate engine-first; since rules only deny or ask, ordering
-* within a layer cannot change the verdict. The
-* profile's canUseTool wins over the engine's (a single slot by
-* construction). A declared preset compiles INTO the same layers, after
-* the host-authored rules, never as a fifth layer (M5-T05).
-*/
-declare function compilePermissionChain(engine?: PermissionConfig, profile?: AgentProfilePermissions): CompiledPermissionChain;
-/**
-* Evaluates the chain for one dispatch, or OFFLINE against a
-* hypothetical call by tool name (the dry-run API: nothing executes;
-* shells and tests read the verdict, the
-* deciding layer, and the matched rule). Hooks run in deterministic
-* registration order; { modifiedInput } substitutes the input and
-* continues; the first decisive verdict wins. The returned input is what
-* execute receives and what the approval identity hashes (post hook
-* modification). Advisory domain-rule matches
-* ride every verdict for the audit payload.
+* The spawn's frozen toolset plus the per-call context factory, prepared
+* by the ctx layer (M3-T01). The contracts are the canonical identity
+* projection already hashed into the spawn's content key; the loop sends
+* exactly them to the model.
 */
-declare function evaluatePermission(chain: CompiledPermissionChain, tool: string | Pick<ToolDef, "name" | "needsApproval" | "risk">, input: unknown, ctx?: ToolContext): Promise<PermissionVerdict>;
-//#endregion
-//#region src/tools/toolset-hash.d.ts
-/** The per-spawn tools option value domain. */
-type ToolsOption = ReadonlyArray<ToolDef | ToolSource | string>;
-/** The spawn's frozen toolset snapshot plus its identity hash. */
-interface ResolvedToolset {
-  tools: ToolDef[];
+interface ToolRuntime {
+  defs: ToolDef[];
   contracts: ToolContract[];
-  hash: string;
-}
-/** The empty toolset (no tools declared anywhere). */
-declare function emptyToolset(): ResolvedToolset;
-/**
-* Expands registered names and sources, validates every tool name and
-* duplicate names across the whole toolset (ConfigError at spawn time),
-* and computes the toolsetHash over contracts sorted by name. The
-* `toolsets` registry is the engine's `defaults.toolsets` snapshot;
-* without one, string entries fail with the same unknown-name error as
-* a miss, so nothing outside the declared registry is ever reachable.
-*/
-declare function resolveToolset(specs: ToolsOption | undefined, session: ToolSourceSession, toolsets?: Record<string, ToolsOption>): Promise<ResolvedToolset>;
-//#endregion
-//#region src/journal/termination.d.ts
-/** The frozen limits vector written into termination.init. */
-interface TerminationLimits {
-  /** V0, default 32; absolute and non-replenishable. */
-  maxRevisionsPerRun: number;
-  /** S0, default 128; debited on every admitted spawn of any origin. */
-  maxTotalSpawns: number;
-  /** E0, default 2, per lineage; the old name is rejected (XF-10). */
-  maxEscalationsPerLogicalTask: number;
-  /** D0, default 1, ceiling 4; static per-branch limit. */
-  maxDepth: number;
-  /** Maximum declared ladder length per the profile-registry snapshot. */
-  kMax: number;
-  /** B0; immutable after start, no API including HITL can top up. */
-  runBudgetUsdCeiling: number;
-  /**
-  * The resolved orchestrator cap in absolute USD (DEF-7; XF-09),
-  * frozen with the counters. Journals recorded before v1.8 store 0
-  * ("not yet resolved"); for them the orchestrator_budget_reserve
-  * decision is the authority and is recovered on resume.
-  */
-  orchestratorCapUsd: number;
-  /** The finalize reserve carved out of the cap; 0 in pre-v1.8 journals. */
-  finalizeReserveUsd: number;
-}
-/** Appendix A committed defaults for the countable resources. */
-declare const DEFAULT_MAX_REVISIONS_PER_RUN = 32;
-declare const DEFAULT_MAX_TOTAL_SPAWNS = 128;
-/** The countable resource vocabulary. */
-type TerminationResource = "revisionUnits" | "spawnUnits" | "escalationUnits" | "rungs" | "depth";
-interface LineageCounters {
-  escalationUnitsRemaining: number;
-  rungsRemaining: number;
-}
-interface TerminationAccountSnapshot {
-  revisionUnitsRemaining: number;
-  spawnUnitsRemaining: number;
-  perLineage: Record<LogicalTaskId, LineageCounters>;
-  /** The variant function, a pure fold over the journal. */
-  phi: number;
-}
-type DebitResult = {
-  ok: true;
-  balanceAfter: number;
-} | {
-  ok: false;
-  deniedEntryRef: EntryRef;
-  resource: TerminationResource;
-};
-/** The value payload of a termination.init entry. */
-interface TerminationInitValue {
-  limits: TerminationLimits;
-  profileRegistrySnapshotHash: string;
-  phiInitial: number;
+  /** Mints a per-call ToolContext (fresh tool span under the agent span). */
+  contextFor(toolName: string): ToolContext;
+  /** Permission chain evaluation (M3-T03); absent = every call allowed. */
+  permission?: (call: ToolCallRequest) => Promise<PermissionGate>;
 }
-/** The value payload of a termination.denied entry. */
-interface TerminationDeniedValue {
-  resource: TerminationResource;
-  logicalTaskId?: LogicalTaskId;
-  /** Seq of the calling tool-call or EscalationReport entry. */
-  requestedByRef?: EntryRef;
-  reasonCode: string;
-  snapshotAfter: TerminationAccountSnapshot;
+/** One serving target of a phase: the primary or a failover fallback. */
+interface PhaseTarget {
+  adapter: ProviderAdapter;
+  resolved: ResolvedInvocation;
 }
-/**
-* Reads the declared ladder length of one agent profile. Ladders are
-* declared through the profile's ModelSpec (`model: { ladder }`, or the
-* loop-role routing entry). The reader is defensive
-* so the snapshot is total over every registry shape (an undeclared
-* ladder has length 1: the single implicit rung).
-*/
-declare function ladderLengthOf(profile: unknown): number;
-/** kMax: the maximum declared ladder length across the registry snapshot. */
-declare function kMaxOf(profiles: Record<string, unknown> | undefined): number;
-/**
-* The deterministic profile-registry snapshot hash frozen inside
-* termination.init: profile names mapped to their declared ladder
-* lengths, canonical JSON, sha256.
-*/
-declare function profileRegistrySnapshotHash(profiles: Record<string, unknown> | undefined): string;
-/**
-* Validates a raw limits record into the frozen vector. The pre-rename
-* escalation knob is rejected with a migration hint (XF-10); counters
-* must be non-negative integers; kMax at least 1.
-*/
-declare function validateTerminationLimits(raw: Partial<TerminationLimits> | Record<string, unknown>): TerminationLimits;
-/** C = E0 + kMax: the per-spawn weight of the variant function. */
-declare function lineageWeightOf(limits: TerminationLimits): number;
-/** Phi0 = V0 + C * S0, finite and fixed in termination.init. */
-declare function phiInitialOf(limits: TerminationLimits): number;
-/** Builds the termination.init value payload. */
-declare function buildTerminationInitValue(limits: TerminationLimits, registrySnapshotHash: string): TerminationInitValue;
-/** Reads a termination.init entry's payload; undefined when malformed. */
-declare function readTerminationInit(entry: JournalEntry): TerminationInitValue | undefined;
-/**
-* Config-drift detection at resume: the journaled vector
-* always wins; every differing field is reported for the
-* `termination:config-drift` event. Dynamic budget top-up via restart is
-* excluded by construction.
-*/
-declare function terminationConfigDrift(frozen: TerminationLimits, live: Partial<TerminationLimits>): Array<{
-  field: keyof TerminationLimits;
-  frozenValue: Json;
-  liveValue: Json;
-}>;
-/** Injected appender for termination.denied entries (engine-owned I/O). */
-type TerminationDeniedWriter = (denied: TerminationDeniedValue) => Promise<EntryRef>;
-/**
-* The single per-run TerminationAccount: debit ONLY. No
-* credit operation exists by construction; reclaim never replenishes
-* anything (DEF-5 interaction). Live: the engine debits the
-* in-memory account, writes the carrying entry with the balance-after,
-* then applies effects. Resume state is rebuilt by TerminationFold from
-* the journal, never from live config.
-*/
-declare class TerminationAccount {
-  readonly limits: TerminationLimits;
-  private revisionUnits;
-  private spawnUnits;
-  private readonly lineages;
-  private deniedWriter?;
-  constructor(options: {
-    limits: TerminationLimits;
-    deniedWriter?: TerminationDeniedWriter;
-  });
+interface RunAgentOptions<S extends SchemaSpec = JsonSchema> {
+  prompt: string;
+  schema?: S;
+  /** Canonicalized JSON Schema projection of `schema` (precomputed for identity). */
+  canonicalSchema?: JsonSchema;
+  adapter: ProviderAdapter;
+  resolved: ResolvedInvocation;
   /**
-  * Binds the denied-entry appender onto an account rebuilt by the fold
-  * (resume path): the fold is pure and cannot own I/O. Never rebinds an
-  * existing writer.
+  * Transport failover chain for the loop phase (M4-T04):
+  * resolved fallback targets tried in order on
+  * transport or rate-limit failures after retries exhaust. Failover is
+  * sticky and changes only servedBy, never the content key.
   */
-  bindDeniedWriter(writer: TerminationDeniedWriter): void;
-  snapshot(): TerminationAccountSnapshot;
-  /** Phi = V + C * S + sum over live lineages (E + R). */
-  phi(): number;
-  /** The current rung index of a lineage (0 before any raise). */
-  rungIndexOf(logicalTaskId: LogicalTaskId): number;
-  /** True when a spawn-unit debit would underflow (pre-reserve check). */
-  get spawnUnitsExhausted(): boolean;
-  get revisionUnitsRemaining(): number;
+  fallbacks?: PhaseTarget[];
   /**
-  * The spawn-admission debit: minus one spawnUnit for
-  * an admitted spawn of ANY origin; a NEW lineage receives E0 escalation
-  * units and (K_l - 1) rung transitions in the same atomic step, so the
-  * lemma's per-spawn decrease is C - (E0 + K_l - 1) = kMax - K_l + 1,
-  * at least 1. Synchronous: the caller embeds spawnUnitsAfter in the
-  * decision entry it appends next.
+  * Transport RetryPolicy (M4-T05): lives UNDER
+  * the journal, wired around every adapter.stream dispatch. sleep and
+  * random are injectable for tests; the core owns wall-clock.
   */
-  debitSpawn(lineage?: {
-    logicalTaskId: LogicalTaskId;
-    isNew: boolean;
-    ladderLength?: number;
-  }): {
-    ok: true;
-    spawnUnitsAfter: number;
-  } | {
-    ok: false;
-    resource: "spawnUnits";
+  retry?: {
+    policy?: RetryPolicy;
+    sleep?: (ms: number) => Promise<void>;
+    random?: () => number;
   };
   /**
-  * The plan_revise debit: minus one
-  * revisionUnit on EVERY journaled plan.revision, regardless of the op
-  * count, guard verdicts, or the auto-rebase outcome; conflict spam is
-  * never a free retry.
+  * Per-provider keyed limiter hook (M4-T07): wraps every wire dispatch
+  * under the serving adapter's key; absent = unlimited (Appendix A).
+  * `signal` is the agent-level abort: an aborted caller leaves the
+  * key's queue without a slot (v1.34.0 review P2-4).
   */
-  debitRevision(): {
-    ok: true;
-    revisionUnitsAfter: number;
-  } | {
-    ok: false;
-    resource: "revisionUnits";
-  };
+  providerSlot?: <T>(key: string, fn: () => Promise<T>, signal?: AbortSignal) => Promise<T>;
+  /** The resolved toolset; absent = no tools declared. */
+  tools?: ToolRuntime;
   /**
-  * The escalation debit: minus one escalationUnit of
-  * the affected lineage, including EACH lineage of a class-level
-  * decision and timeout defaultDecisions. Conditioned on the
-  * countsAgainstLimit flag embedded in the decision entry by the caller.
+  * Separate final extract invocation, present only when the role trigger
+  * protocol demands one: schema set AND (routing directs extract to a
+  * different model OR the loop model's caps cannot serve the required
+  * tier OR finalize is routed). Otherwise the schema rides the last loop
+  * turn (the necessity rule is
+  * decided by the ctx layer via model/roles.ts).
   */
-  debitEscalation(logicalTaskId: LogicalTaskId): {
-    ok: true;
-    escalationUnitsAfter: number;
-  } | {
-    ok: false;
-    resource: "escalationUnits";
+  extract?: PhaseTarget & {
+    fallbacks?: PhaseTarget[];
   };
   /**
-  * The ladder-raise debit: minus one rung of the
-  * lineage; rungIndex is strictly monotone, there are no demotions and
-  * no runtime startTier promotion in v1.
+  * Finalize synthesis invocation (M4-T01), present only when the role
+  * trigger protocol fires it: configured in routing AND the toolset is
+  * non-empty. Runs after tools stop with toolChoice 'none' over the
+  * full transcript plus a deterministic synthesis instruction appended
+  * to the REQUEST only (the durable transcript keeps the raw history);
+  * its text becomes the output for schema-less calls, a non-truncated
+  * empty synthesis falls back to the loop turn's text, and a
+  * schema-bearing call always pairs it with a separate extract
+  * (the ctx layer guarantees `extract` is present in that case). Like
+  * extract, the finalize invocation is not checkpointed in v1.
   */
-  debitRung(logicalTaskId: LogicalTaskId): {
-    ok: true;
-    rungIndexAfter: number;
-    rungsRemainingAfter: number;
-  } | {
-    ok: false;
-    resource: "rungs";
+  finalize?: PhaseTarget & {
+    fallbacks?: PhaseTarget[];
   };
   /**
-  * The unified debit surface: attempts the named resource and, on
-  * underflow, writes `termination.denied` strictly BEFORE resolving with
-  * the typed failure (the caller surfaces the error only after this
-  * settles). Requires a deniedWriter; pure-fold contexts use the
-  * synchronous per-resource methods instead.
+  * Summarize invocation target for compaction (M4-T03): resolved
+  * through the chain with role 'summarize', falling back to the loop
+  * model when routing resolves nothing. Compaction
+  * is ON by default; absence of this option disables it (direct
+  * runAgent callers).
   */
-  debit(resource: Exclude<TerminationResource, "depth">, lineage?: LogicalTaskId, context?: {
-    requestedByRef?: EntryRef;
-    reasonCode?: string;
-  }): Promise<DebitResult>;
-  private tryDebit;
+  summarize?: PhaseTarget & {
+    fallbacks?: PhaseTarget[];
+  };
+  /** Per-profile compaction config; threshold default 0.8 (Appendix A). */
+  compaction?: {
+    threshold?: number;
+  };
   /**
-  * Restores one lineage's counters from journaled balances (fold use
-  * only): never a credit path, the fold consumes recorded balances.
+  * Turn-boundary checkpointing (M3-T02).
+  * load() restores the last boundary on a dangling-dispatch resume;
+  * save() persists each boundary where the loop continues. The separate
+  * extract invocation is not checkpointed in v1: an extract-phase crash
+  * re-pays from the last loop boundary.
   */
-  restoreLineage(logicalTaskId: LogicalTaskId, state: LineageCounters & {
-    rungIndex?: number;
-  }): void;
-  /** Fold use only: restores the run counters from journaled balances. */
-  restoreCounters(state: {
-    revisionUnitsRemaining?: number;
-    spawnUnitsRemaining?: number;
-  }): void;
-  private requireLineage;
-  private requireLineageId;
+  checkpoint?: {
+    load(): Promise<CheckpointState | undefined>;
+    save(state: CheckpointState): Promise<void>;
+  };
+  limits: EffectiveUsageLimits;
+  /** Emits agent:stream deltas when true (telemetry only). */
+  stream?: boolean;
+  /** Host or sibling cancellation. */
+  signal?: AbortSignal;
+  budget?: BudgetHooks;
+  events?: RuntimeEventSink;
+  transcript?: {
+    mintRef(): string;
+    put(ref: string, blob: Uint8Array): Promise<void>;
+  };
+  priceUsd?: (servedBy: ModelRef, usage: Usage) => number | undefined;
+  /** Bounded schema re-prompt attempts; default 2 (Appendix A). */
+  schemaRetryAttempts?: number;
+  /** Bounded ModelRetry conversions per tool call chain; default 2 (Appendix A). */
+  modelRetryAttempts?: number;
+  /**
+  * Escalation opt-in (M3-T07): the loop intercepts accepted calls to
+  * the escalate tool and terminates with status 'escalated'; the
+  * in-run minSpend gate rejects early scope_bigger escalations with a
+  * "keep working" error tool result (M3-T09).
+  */
+  escalation?: {
+    minSpendUsd: number;
+  };
+  /**
+  * Terminal-tool interception (M6-T07): an accepted call to the named
+  * tool ends the loop with status ok; the call's validated `result`
+  * argument becomes the agent output (the orchestrator finish
+  * tool). The tool's execute never runs, mirroring escalate.
+  * `validate` is the optional host judgment over a schema valid call
+  * (the RV-204 finish validators): ok finishes as before; a rejection
+  * becomes the call's error tool result and the turn continues, so the
+  * model can repair and call the terminal tool again. The hook owns
+  * bounding and journaling; the loop stays policy only and never
+  * throws.
+  */
+  terminalTool?: {
+    name: string;
+    validate?: (call: {
+      id: string;
+      result: unknown;
+    }) => Promise<{
+      ok: true;
+    } | {
+      ok: false;
+      feedback: Record<string, unknown>;
+    }>;
+  };
+  agentType?: string;
+  /** The primary invocation role of the tool loop; default 'loop' (M6-T05). */
+  role?: "loop" | "plan" | "orchestrate";
+  label?: string;
+  now?: () => number;
 }
-/** The typed error code surfaced after a denied debit. */
-declare function exhaustionCodeOf(resource: TerminationResource): string;
 /**
-* The replay fold: rebuilds the account from
-* termination.init and the debiting decision entries, asserting every
-* embedded balance-after against the recomputation. A divergence raises
-* the typed journal-integrity error at exactly the diverging entry;
-* denials are re-issued from termination.denied with zero live calls.
+* The output-truncation abort message (v1.9.0 follow-up review). The
+* constraint is named neutrally as the turn's output token allowance:
+* the effective request cap can come from limits.maxOutputTokensPerTurn,
+* the budget clamp above, or the adapter's own default, and the provider
+* can also cut at its model maximum with no request cap at all.
 */
-declare function foldTermination(entries: readonly JournalEntry[]): {
-  account: TerminationAccount;
-  initRef: EntryRef;
-  init: TerminationInitValue;
-  denials: Array<{
-    seq: EntryRef;
-    value: TerminationDeniedValue;
-  }>;
-} | undefined;
+/**
+* The deterministic synthesis instruction appended (as a user message)
+* to the finalize REQUEST only, never to the durable transcript. A
+* transcript that simply ends at an assistant message reads to a real
+* model as a fresh conversation opening, so an uninstructed synthesis
+* call can replace the loop's correct answer with a greeting (v1.18.0
+* review P1-1); the extract arm has carried its own instruction since
+* M4, and this is its finalize twin. The wording is part of the wire
+* request: keep it stable.
+*/
+declare const FINALIZE_SYNTHESIS_INSTRUCTION: string;
+/**
+* Runs one agent to a typed AgentResult. Never throws past policy: every
+* failure mode becomes a typed status on the result.
+*/
+declare function runAgent<S extends SchemaSpec>(options: RunAgentOptions<S>): Promise<AgentResult<Out<S>>>;
 //#endregion
-//#region src/engine/budget.d.ts
-type Spend = {
-  usd: number;
-  usage: Usage;
-  agentsSpawned: number;
-};
-/** Last resort of the admission reserve formula. */
-declare const DEFAULT_FLAT_RESERVE_USD = .5;
-/** The run-root account scope. */
-declare const ROOT_ACCOUNT = "run";
+//#region src/runtime/permission-chain.d.ts
+type HookVerdict = "allow" | "deny" | "ask" | {
+  modifiedInput: unknown;
+} | undefined;
+type PermissionHook = (toolName: string, input: unknown, ctx: ToolContext) => HookVerdict | Promise<HookVerdict>;
 /**
-* The admission reserve for a spawn: opts.estCost, else profile.estCost,
-* else price(countTokens(input) + one turn's worth of output), else the
-* engine flat default. The output term is caps.maxOutputTokens clamped to
-* limits.maxOutputTokensPerTurn when the spawn carries one, so a host can
-* bound reserves without hand-written estimates. The priced path uses the
-* SAME price function as settlement (priceUsdOf), so long-context tiers
-* apply to estimates too.
+* Declarative rule tables (no closures). `'undeclared'` in risk
+* position matches every tool WITHOUT declared risk: presets treat the
+* undeclared state conservatively. Argv rules
+* match through the real shell matcher; domain rules are
+* ADVISORY for every tool in the current release: they never
+* change a verdict, and matches surface in the tool:end audit
+* fields (enforcement will live in a first-party fetch tool
+* when one ships).
 */
-declare function admissionReserveUsd(options: {
-  estCost?: number;
-  profileEstCost?: number;
-  inputTokens?: number;
-  caps?: ModelCaps;
-  maxOutputTokensPerTurn?: number;
-  flatReserveUsd?: number;
-}): number;
-/** Read-only projection of one account. */
-interface BudgetAccountView {
-  scope: string;
-  ceilingUsd?: number;
-  spentUsd: number;
-  committedReserveUsd: number;
-  finalizeReserveUsd: number;
-  parentScope?: string;
+type RiskRuleValue = ToolRisk | "undeclared";
+type PermissionRule = {
+  tool: string | string[];
+} | {
+  risk: RiskRuleValue | RiskRuleValue[];
+} | {
+  tool: string;
+  argv: string | string[];
+} | {
+  tool: string;
+  domains: string[];
+};
+type CanUseTool = (toolName: string, input: unknown, ctx: ToolContext) => "allow" | "deny" | {
+  modifiedInput: unknown;
+} | Promise<"allow" | "deny" | {
+  modifiedInput: unknown;
+}>;
+/** Host-side permission configuration (engine defaults.permissions). */
+interface PermissionConfig {
+  hooks?: PermissionHook[];
+  deny?: PermissionRule[];
+  ask?: PermissionRule[];
+  canUseTool?: CanUseTool;
 }
 /**
-* Why a ceiling error ended the work: the first closed account walking
-* from the debited scope toward the root, plus the root state, so the
-* outward message can name WHICH ceiling actually crossed instead of
-* blaming the run ceiling for every crossing.
+* Profile-level permissions.
+* inheritPermissions governs SUBAGENT inheritance (mode c orchestrators,
+* M6+): children get their own config only unless explicitly opted in.
+* It is carried as data here and consumed by the spawning layers.
 */
-interface BudgetExhaustionDiagnostics {
-  crossed?: {
-    scope: string;
-    source: "root" | "orchestrator-cap" | "child-account";
-    ceilingUsd: number;
-    spentUsd: number;
-    committedReserveUsd: number;
-    finalizeReserveUsd: number;
-  };
-  root: {
-    ceilingUsd?: number;
-    spentUsd: number;
-  };
+interface AgentProfilePermissions extends PermissionConfig {
+  /** Compiles into deny/ask rules; ships in M5. */
+  preset?: "strict" | "standard" | "open";
+  /** Default false. */
+  inheritPermissions?: boolean;
+}
+interface CompiledPermissionChain {
+  hooks: PermissionHook[];
+  deny: PermissionRule[];
+  ask: PermissionRule[];
+  canUseTool?: CanUseTool;
+}
+type PermissionVerdict = ({
+  verdict: "allow";
+  decidedBy: "hook" | "canUseTool" | "default";
+  input: unknown;
+} | {
+  verdict: "deny";
+  decidedBy: "hook" | "deny-rule" | "canUseTool";
+  rule?: PermissionRule;
+  input: unknown;
+} | {
+  verdict: "ask";
+  decidedBy: "hook" | "ask-rule" | "default";
+  rule?: PermissionRule;
+  input: unknown;
+}) & {
+  /**
+  * Advisory domain-rule matches: reported in the tool:end
+  * audit fields, never enforced in the current release.
+  */
+  advisory?: PermissionRule[];
+};
+/**
+* Merges the engine-wide config and the profile config into one chain.
+* Layers concatenate engine-first; since rules only deny or ask, ordering
+* within a layer cannot change the verdict. The
+* profile's canUseTool wins over the engine's (a single slot by
+* construction). A declared preset compiles INTO the same layers, after
+* the host-authored rules, never as a fifth layer (M5-T05).
+*/
+declare function compilePermissionChain(engine?: PermissionConfig, profile?: AgentProfilePermissions): CompiledPermissionChain;
+/**
+* Evaluates the chain for one dispatch, or OFFLINE against a
+* hypothetical call by tool name (the dry-run API: nothing executes;
+* shells and tests read the verdict, the
+* deciding layer, and the matched rule). Hooks run in deterministic
+* registration order; { modifiedInput } substitutes the input and
+* continues; the first decisive verdict wins. The returned input is what
+* execute receives and what the approval identity hashes (post hook
+* modification). Advisory domain-rule matches
+* ride every verdict for the audit payload.
+*/
+declare function evaluatePermission(chain: CompiledPermissionChain, tool: string | Pick<ToolDef, "name" | "needsApproval" | "risk">, input: unknown, ctx?: ToolContext): Promise<PermissionVerdict>;
+//#endregion
+//#region src/tools/toolset-hash.d.ts
+/** The per-spawn tools option value domain. */
+type ToolsOption = ReadonlyArray<ToolDef | ToolSource | string>;
+/** The spawn's frozen toolset snapshot plus its identity hash. */
+interface ResolvedToolset {
+  tools: ToolDef[];
+  contracts: ToolContract[];
+  hash: string;
+}
+/** The empty toolset (no tools declared anywhere). */
+declare function emptyToolset(): ResolvedToolset;
+/**
+* Expands registered names and sources, validates every tool name and
+* duplicate names across the whole toolset (ConfigError at spawn time),
+* and computes the toolsetHash over contracts sorted by name. The
+* `toolsets` registry is the engine's `defaults.toolsets` snapshot;
+* without one, string entries fail with the same unknown-name error as
+* a miss, so nothing outside the declared registry is ever reachable.
+*/
+declare function resolveToolset(specs: ToolsOption | undefined, session: ToolSourceSession, toolsets?: Record<string, ToolsOption>): Promise<ResolvedToolset>;
+//#endregion
+//#region src/journal/termination.d.ts
+/** The frozen limits vector written into termination.init. */
+interface TerminationLimits {
+  /** V0, default 32; absolute and non-replenishable. */
+  maxRevisionsPerRun: number;
+  /** S0, default 128; debited on every admitted spawn of any origin. */
+  maxTotalSpawns: number;
+  /** E0, default 2, per lineage; the old name is rejected (XF-10). */
+  maxEscalationsPerLogicalTask: number;
+  /** D0, default 1, ceiling 4; static per-branch limit. */
+  maxDepth: number;
+  /** Maximum declared ladder length per the profile-registry snapshot. */
+  kMax: number;
+  /** B0; immutable after start, no API including HITL can top up. */
+  runBudgetUsdCeiling: number;
+  /**
+  * The resolved orchestrator cap in absolute USD (DEF-7; XF-09),
+  * frozen with the counters. Journals recorded before v1.8 store 0
+  * ("not yet resolved"); for them the orchestrator_budget_reserve
+  * decision is the authority and is recovered on resume.
+  */
+  orchestratorCapUsd: number;
+  /** The finalize reserve carved out of the cap; 0 in pre-v1.8 journals. */
+  finalizeReserveUsd: number;
+}
+/** Appendix A committed defaults for the countable resources. */
+declare const DEFAULT_MAX_REVISIONS_PER_RUN = 32;
+declare const DEFAULT_MAX_TOTAL_SPAWNS = 128;
+/** The countable resource vocabulary. */
+type TerminationResource = "revisionUnits" | "spawnUnits" | "escalationUnits" | "rungs" | "depth";
+interface LineageCounters {
+  escalationUnitsRemaining: number;
+  rungsRemaining: number;
+}
+interface TerminationAccountSnapshot {
+  revisionUnitsRemaining: number;
+  spawnUnitsRemaining: number;
+  perLineage: Record<LogicalTaskId, LineageCounters>;
+  /** The variant function, a pure fold over the journal. */
+  phi: number;
+}
+type DebitResult = {
+  ok: true;
+  balanceAfter: number;
+} | {
+  ok: false;
+  deniedEntryRef: EntryRef;
+  resource: TerminationResource;
+};
+/** The value payload of a termination.init entry. */
+interface TerminationInitValue {
+  limits: TerminationLimits;
+  profileRegistrySnapshotHash: string;
+  phiInitial: number;
+}
+/** The value payload of a termination.denied entry. */
+interface TerminationDeniedValue {
+  resource: TerminationResource;
+  logicalTaskId?: LogicalTaskId;
+  /** Seq of the calling tool-call or EscalationReport entry. */
+  requestedByRef?: EntryRef;
+  reasonCode: string;
+  snapshotAfter: TerminationAccountSnapshot;
+}
+/**
+* Reads the declared ladder length of one agent profile. Ladders are
+* declared through the profile's ModelSpec (`model: { ladder }`, or the
+* loop-role routing entry). The reader is defensive
+* so the snapshot is total over every registry shape (an undeclared
+* ladder has length 1: the single implicit rung).
+*/
+declare function ladderLengthOf(profile: unknown): number;
+/** kMax: the maximum declared ladder length across the registry snapshot. */
+declare function kMaxOf(profiles: Record<string, unknown> | undefined): number;
+/**
+* The deterministic profile-registry snapshot hash frozen inside
+* termination.init: profile names mapped to their declared ladder
+* lengths, canonical JSON, sha256.
+*/
+declare function profileRegistrySnapshotHash(profiles: Record<string, unknown> | undefined): string;
+/**
+* Validates a raw limits record into the frozen vector. The pre-rename
+* escalation knob is rejected with a migration hint (XF-10); counters
+* must be non-negative integers; kMax at least 1.
+*/
+declare function validateTerminationLimits(raw: Partial<TerminationLimits> | Record<string, unknown>): TerminationLimits;
+/** C = E0 + kMax: the per-spawn weight of the variant function. */
+declare function lineageWeightOf(limits: TerminationLimits): number;
+/** Phi0 = V0 + C * S0, finite and fixed in termination.init. */
+declare function phiInitialOf(limits: TerminationLimits): number;
+/** Builds the termination.init value payload. */
+declare function buildTerminationInitValue(limits: TerminationLimits, registrySnapshotHash: string): TerminationInitValue;
+/** Reads a termination.init entry's payload; undefined when malformed. */
+declare function readTerminationInit(entry: JournalEntry): TerminationInitValue | undefined;
+/**
+* Config-drift detection at resume: the journaled vector
+* always wins; every differing field is reported for the
+* `termination:config-drift` event. Dynamic budget top-up via restart is
+* excluded by construction.
+*/
+declare function terminationConfigDrift(frozen: TerminationLimits, live: Partial<TerminationLimits>): Array<{
+  field: keyof TerminationLimits;
+  frozenValue: Json;
+  liveValue: Json;
+}>;
+/** Injected appender for termination.denied entries (engine-owned I/O). */
+type TerminationDeniedWriter = (denied: TerminationDeniedValue) => Promise<EntryRef>;
+/**
+* The single per-run TerminationAccount: debit ONLY. No
+* credit operation exists by construction; reclaim never replenishes
+* anything (DEF-5 interaction). Live: the engine debits the
+* in-memory account, writes the carrying entry with the balance-after,
+* then applies effects. Resume state is rebuilt by TerminationFold from
+* the journal, never from live config.
+*/
+declare class TerminationAccount {
+  readonly limits: TerminationLimits;
+  private revisionUnits;
+  private spawnUnits;
+  private readonly lineages;
+  private deniedWriter?;
+  constructor(options: {
+    limits: TerminationLimits;
+    deniedWriter?: TerminationDeniedWriter;
+  });
+  /**
+  * Binds the denied-entry appender onto an account rebuilt by the fold
+  * (resume path): the fold is pure and cannot own I/O. Never rebinds an
+  * existing writer.
+  */
+  bindDeniedWriter(writer: TerminationDeniedWriter): void;
+  snapshot(): TerminationAccountSnapshot;
+  /** Phi = V + C * S + sum over live lineages (E + R). */
+  phi(): number;
+  /** The current rung index of a lineage (0 before any raise). */
+  rungIndexOf(logicalTaskId: LogicalTaskId): number;
+  /** True when a spawn-unit debit would underflow (pre-reserve check). */
+  get spawnUnitsExhausted(): boolean;
+  get revisionUnitsRemaining(): number;
+  /**
+  * The spawn-admission debit: minus one spawnUnit for
+  * an admitted spawn of ANY origin; a NEW lineage receives E0 escalation
+  * units and (K_l - 1) rung transitions in the same atomic step, so the
+  * lemma's per-spawn decrease is C - (E0 + K_l - 1) = kMax - K_l + 1,
+  * at least 1. Synchronous: the caller embeds spawnUnitsAfter in the
+  * decision entry it appends next.
+  */
+  debitSpawn(lineage?: {
+    logicalTaskId: LogicalTaskId;
+    isNew: boolean;
+    ladderLength?: number;
+  }): {
+    ok: true;
+    spawnUnitsAfter: number;
+  } | {
+    ok: false;
+    resource: "spawnUnits";
+  };
+  /**
+  * The plan_revise debit: minus one
+  * revisionUnit on EVERY journaled plan.revision, regardless of the op
+  * count, guard verdicts, or the auto-rebase outcome; conflict spam is
+  * never a free retry.
+  */
+  debitRevision(): {
+    ok: true;
+    revisionUnitsAfter: number;
+  } | {
+    ok: false;
+    resource: "revisionUnits";
+  };
+  /**
+  * The escalation debit: minus one escalationUnit of
+  * the affected lineage, including EACH lineage of a class-level
+  * decision and timeout defaultDecisions. Conditioned on the
+  * countsAgainstLimit flag embedded in the decision entry by the caller.
+  */
+  debitEscalation(logicalTaskId: LogicalTaskId): {
+    ok: true;
+    escalationUnitsAfter: number;
+  } | {
+    ok: false;
+    resource: "escalationUnits";
+  };
+  /**
+  * The ladder-raise debit: minus one rung of the
+  * lineage; rungIndex is strictly monotone, there are no demotions and
+  * no runtime startTier promotion in v1.
+  */
+  debitRung(logicalTaskId: LogicalTaskId): {
+    ok: true;
+    rungIndexAfter: number;
+    rungsRemainingAfter: number;
+  } | {
+    ok: false;
+    resource: "rungs";
+  };
+  /**
+  * The unified debit surface: attempts the named resource and, on
+  * underflow, writes `termination.denied` strictly BEFORE resolving with
+  * the typed failure (the caller surfaces the error only after this
+  * settles). Requires a deniedWriter; pure-fold contexts use the
+  * synchronous per-resource methods instead.
+  */
+  debit(resource: Exclude<TerminationResource, "depth">, lineage?: LogicalTaskId, context?: {
+    requestedByRef?: EntryRef;
+    reasonCode?: string;
+  }): Promise<DebitResult>;
+  private tryDebit;
+  /**
+  * Restores one lineage's counters from journaled balances (fold use
+  * only): never a credit path, the fold consumes recorded balances.
+  */
+  restoreLineage(logicalTaskId: LogicalTaskId, state: LineageCounters & {
+    rungIndex?: number;
+  }): void;
+  /** Fold use only: restores the run counters from journaled balances. */
+  restoreCounters(state: {
+    revisionUnitsRemaining?: number;
+    spawnUnitsRemaining?: number;
+  }): void;
+  private requireLineage;
+  private requireLineageId;
+}
+/** The typed error code surfaced after a denied debit. */
+declare function exhaustionCodeOf(resource: TerminationResource): string;
+/**
+* The replay fold: rebuilds the account from
+* termination.init and the debiting decision entries, asserting every
+* embedded balance-after against the recomputation. A divergence raises
+* the typed journal-integrity error at exactly the diverging entry;
+* denials are re-issued from termination.denied with zero live calls.
+*/
+declare function foldTermination(entries: readonly JournalEntry[]): {
+  account: TerminationAccount;
+  initRef: EntryRef;
+  init: TerminationInitValue;
+  denials: Array<{
+    seq: EntryRef;
+    value: TerminationDeniedValue;
+  }>;
+} | undefined;
+//#endregion
+//#region src/engine/budget.d.ts
+type Spend = {
+  usd: number;
+  usage: Usage;
+  agentsSpawned: number;
+};
+/** Last resort of the admission reserve formula. */
+declare const DEFAULT_FLAT_RESERVE_USD = .5;
+/** The run-root account scope. */
+declare const ROOT_ACCOUNT = "run";
+/**
+* The admission reserve for a spawn: opts.estCost, else profile.estCost,
+* else price(countTokens(input) + one turn's worth of output), else the
+* engine flat default. The output term is caps.maxOutputTokens clamped to
+* limits.maxOutputTokensPerTurn when the spawn carries one, so a host can
+* bound reserves without hand-written estimates. The priced path uses the
+* SAME price function as settlement (priceUsdOf), so long-context tiers
+* apply to estimates too.
+*/
+declare function admissionReserveUsd(options: {
+  estCost?: number;
+  profileEstCost?: number;
+  inputTokens?: number;
+  caps?: ModelCaps;
+  maxOutputTokensPerTurn?: number;
+  flatReserveUsd?: number;
+}): number;
+/** Read-only projection of one account. */
+interface BudgetAccountView {
+  scope: string;
+  ceilingUsd?: number;
+  spentUsd: number;
+  committedReserveUsd: number;
+  finalizeReserveUsd: number;
+  parentScope?: string;
+}
+/**
+* Why a ceiling error ended the work: the first closed account walking
+* from the debited scope toward the root, plus the root state, so the
+* outward message can name WHICH ceiling actually crossed instead of
+* blaming the run ceiling for every crossing.
+*/
+interface BudgetExhaustionDiagnostics {
+  crossed?: {
+    scope: string;
+    source: "root" | "orchestrator-cap" | "child-account";
+    ceilingUsd: number;
+    spentUsd: number;
+    committedReserveUsd: number;
+    finalizeReserveUsd: number;
+  };
+  root: {
+    ceilingUsd?: number;
+    spentUsd: number;
+  };
 }
 /**
 * The per-run budget account tree. All spend accounting is per instance;
@@ -4304,443 +4738,83 @@ declare class AdmissionController {
   /** The bound account, when this is a PlanRunner run (DEF-2). */
   get termination(): TerminationAccount | undefined;
   /**
-  * The lineage half of admission (DEF-3): folds are
-  * computed live STRICTLY BEFORE the carrying decision entry is appended;
-  * the caller embeds the returned block in the entry and replay reads it
-  * back byte-exact. Enforces the single-live-attempt invariant
-  * (`lineage_busy`) and monotonic attempt consumption
-  * (`lineage_exhausted`); never touches budget or structural limits.
-  */
-  evaluateLineage(spec: {
-    name: string;
-    lineage?: SpawnLineageOpt;
-    approach?: string;
-    ancestry?: LogicalTaskId[];
-    signature?: Partial<ApproachSignatureInputs>;
-  }): {
-    decision: {
-      kind: "ok";
-      lineage: SpawnLineage;
-    } | {
-      kind: "reject";
-      reason: {
-        code: "lineage_busy" | "lineage_exhausted";
-      };
-    };
-    statsBefore?: LineageStats;
-  };
-  /**
-  * Registers a live lineage admit the moment its caller commits to
-  * appending the decision entry, closing the single-live-attempt window
-  * until the journal absorbs the entry (DEF-3).
-  */
-  registerLineageAdmit(logicalTaskId: LogicalTaskId): void;
-  /**
-  * Evaluates one spawn live, strictly BEFORE its decision entry is
-  * appended. On admit the reserve is committed on the whole ancestor
-  * account chain atomically with the evaluation; the caller journals the
-  * returned decision and only then produces effects (child account,
-  * dispatch). On reject nothing is committed and the reject verdict is
-  * journaled by the caller so replay re-delivers it without
-  * re-evaluation.
-  */
-  /**
-  * The reserve the DISPATCH layer will actually commit for this spec:
-  * the estimate (or the flat default) clamped by the explicit child
-  * budget when one exists, because only an explicit budget opens a
-  * child-allowance account at dispatch; the childBudgetFraction cap
-  * never materializes as an account and must not shrink the
-  * projection. The token-count-priced estimate of ctx.agent is
-  * unreachable here (async); a divergence there lands as a journaled
-  * dispatch rejection instead of a strand.
-  */
-  projectedDispatchReserveUsd(spec: Pick<AdmitSpec, "estCostUsd" | "budgetUsd">): number;
-  admit(spec: AdmitSpec, options?: {
-    commitReserve?: boolean;
-  }): AdmissionDecision;
-  /**
-  * Resume roll-forward for an orchestrator child (M6-T07): restores the
-  * children-quota counter only. The budget seed already counts settled
-  * agent dispatches, and an in-flight child re-commits its reserve
-  * through the ctx.agent dispatch path.
-  */
-  recoverChild(nodeKey: string): void;
-  /**
-  * Resume roll-forward for a child that already SETTLED before the
-  * resume: re-registers the counters (maxChildrenPerNode, the lifetime
-  * cap, statsBefore fidelity) without committing any reserve; the spend
-  * itself sits in the root ledger seed.
-  */
-  recoverSettled(parentAccountScope: string): void;
-  /**
-  * Resume roll-forward for an admission whose decision entry exists but
-  * whose child has NOT settled: re-applies the recorded reserve and
-  * counters without re-evaluating any limit (replay never
-  * re-evaluates admission; reserves are recovered, never
-  * re-estimated).
-  */
-  recoverInFlight(parentAccountScope: string, verdict: AdmitVerdict): void;
-}
-//#endregion
-//#region src/l0/events.d.ts
-/** Run lifecycle and core telemetry (M1 subset). */
-type CoreEvents = {
-  type: "run:start";
-  workflow: string;
-  resumed: boolean;
-} | {
-  type: "run:end";
-  status: "ok" | "error" | "cancelled" | "exhausted" | "suspended";
-  totalUsd: number;
-  /**
-  * Present and true when any priced usage folded into totalUsd is
-  * approximate (a transport cut, a stream the ceiling severed, or an
-  * abort left a turn's usage estimated rather than reported by the
-  * provider), so totalUsd is a lower bound estimate, never an exact
-  * charge. Absent means every contributing turn reported exact usage.
-  */
-  usageApprox?: boolean;
-} | {
-  type: "phase:start";
-  phase: string;
-} | {
-  type: "log";
-  level: "debug" | "info" | "warn" | "error";
-  msg: string;
-  data?: Json;
-} | {
-  type: "budget:update";
-  spentUsd: number;
-  remainingUsd: number | null;
-  committedReserveUsd: number;
-} | {
-  type: "external:waiting";
-  key: string;
-  entryRef: number;
-  prompt?: string;
-  deadlineAt?: string;
-} | {
-  type: "approval:pending";
-  toolName: string;
-  entryRef: number;
-  deadlineAt?: string;
-} | {
-  type: "child:start";
-  workflow: string;
-  scope: string;
-} | {
-  type: "child:end";
-  workflow: string;
-  scope: string;
-  status: string;
-};
-/**
-* Agent lifecycle. One logical agent dispatch emits EXACTLY ONE
-* `agent:start`/`agent:end` pair on its span (the start carries the
-* primary role), and each model invocation phase inside the span
-* (`loop`, then possibly `summarize` activations, `finalize`,
-* `extract`) emits its own `agent:phase:start`/`agent:phase:end` pair,
-* so durations, per-phase usage, and attempts are derivable without
-* heuristics (the RV-207 event-model contract; before it, every phase
-* emitted an unpaired extra `agent:start` and consumers pairing starts
-* with the single end computed the LAST phase's duration as the
-* agent's). `reduceInvocationTable` is the official reducer over this
-* vocabulary.
-*/
-type AgentEvents = {
-  type: "agent:queued";
-  agentType: string;
-  label?: string;
-} | {
-  type: "agent:start";
-  agentType: string;
-  label?: string;
-  model: string;
-  role: string;
-} | {
-  type: "agent:phase:start";
-  agentType: string;
-  label?: string; /** The invocation role this phase activation runs as. */
-  role: string; /** The model the activation resolved to (fallbacks may serve another; the end event reports the server). */
-  model: string;
-  /**
-  * 1-based activation ordinal within the span, unique per
-  * activation (a summarize that fires three times gets three
-  * pairs). Key phases by (spanId, invocation).
-  */
-  invocation: number;
-} | {
-  type: "agent:phase:end";
-  agentType: string;
-  label?: string;
-  role: string; /** The model that actually served the activation's last attempt. */
-  model: string;
-  invocation: number;
-  /**
-  * Wall-clock activation duration. Live telemetry only: replayed
-  * phase pairs (reconstructed from the terminal entry's usage
-  * slices) carry 0.
-  */
-  durationMs: number; /** The usage this activation added to its (role, model) slices. */
-  usage: Usage; /** That usage priced at each serving model's own rate. */
-  costUsd: number;
-  outcome: "ok" | "error";
-  /**
-  * Transport retries inside this activation. Present only when
-  * greater than zero; live telemetry only (absent on replay).
-  */
-  retries?: number;
-} | {
-  type: "agent:end";
-  agentType: string;
-  label?: string;
-  status: string;
-  usage: Usage;
-  costUsd: number;
-  entryRef: number;
-  /**
-  * Present and true when this agent's usage is approximate rather
-  * than reported by the provider (the turn was cut by a transport
-  * failure, a ceiling that severed the stream, or an abort). Absent
-  * means the provider reported the usage exactly. Mirrors the
-  * terminal journal entry's usageApprox.
-  */
-  usageApprox?: boolean;
-  /**
-  * Total transport retries across the span's activations. Present
-  * only when greater than zero; live telemetry only, never
-  * journaled, so a replayed agent:end omits it (absent means "zero
-  * or unknown").
-  */
-  retryCount?: number;
-} | {
-  type: "agent:error";
-  agentType: string;
-  label?: string;
-  error: WireError;
-  willRetry: boolean;
-} | {
-  type: "agent:schema-retry";
-  agentType: string;
-  attempt: number;
-  maxAttempts: number;
-} | {
-  type: "agent:stream";
-  delta: string;
-};
-/** Tool lifecycle (emitters arrive with the tool system, M3). */
-type ToolEvents = {
-  type: "tool:start";
-  toolName: string;
-  risk?: Json;
-} | {
-  type: "tool:end";
-  toolName: string;
-  outcome: "ok" | "error" | "denied";
-  durationMs: number;
+  * The lineage half of admission (DEF-3): folds are
+  * computed live STRICTLY BEFORE the carrying decision entry is appended;
+  * the caller embeds the returned block in the entry and replay reads it
+  * back byte-exact. Enforces the single-live-attempt invariant
+  * (`lineage_busy`) and monotonic attempt consumption
+  * (`lineage_exhausted`); never touches budget or structural limits.
+  */
+  evaluateLineage(spec: {
+    name: string;
+    lineage?: SpawnLineageOpt;
+    approach?: string;
+    ancestry?: LogicalTaskId[];
+    signature?: Partial<ApproachSignatureInputs>;
+  }): {
+    decision: {
+      kind: "ok";
+      lineage: SpawnLineage;
+    } | {
+      kind: "reject";
+      reason: {
+        code: "lineage_busy" | "lineage_exhausted";
+      };
+    };
+    statsBefore?: LineageStats;
+  };
   /**
-  * Audit fields (M5-T05): the chain verdict,
-  * the deciding layer, the matched rule, and advisory domain-rule
-  * matches. Telemetry, never identity; ask verdicts additionally
-  * journal as suspended approvals.
+  * Registers a live lineage admit the moment its caller commits to
+  * appending the decision entry, closing the single-live-attempt window
+  * until the journal absorbs the entry (DEF-3).
   */
-  verdict?: "allow" | "deny" | "ask";
-  decidedBy?: string;
-  rule?: Json;
-  advisory?: Json;
-};
-/**
-* Bare-nondeterminism detection (RV-209). Emitted LIVE by the segment
-* that observed the call, at most once per (category, provenance) per
-* execution segment; never journaled and never re-emitted with the
-* `replayed` flag. Because replay re-executes the workflow body, a
-* violation that survives in the code fires again on every replay of
-* the run, so the event appears organically in both live and replayed
-* streams. Exempt provenances (installed dependencies under
-* node_modules and Node runtime frames) never emit: they are
-* classified and silenced, which is what keeps an SDK's internal
-* `Math.random()` from branding the run nondeterministic.
-*/
-type DeterminismEvents = {
-  type: "determinism:warning"; /** Which patched global fired. */
-  category: "bare-date-now" | "bare-math-random";
+  registerLineageAdmit(logicalTaskId: LogicalTaskId): void;
   /**
-  * 'workflow': the caller is workflow-origin code (the violation the
-  * guard exists for; rejects the run under `determinism.mode:
-  * 'error'`). 'allowlisted': the caller matched a configured
-  * `determinism.allowlist` pattern and is exempt by explicit host
-  * decision; emitted for visibility, never rejects.
+  * Evaluates one spawn live, strictly BEFORE its decision entry is
+  * appended. On admit the reserve is committed on the whole ancestor
+  * account chain atomically with the evaluation; the caller journals the
+  * returned decision and only then produces effects (child account,
+  * dispatch). On reject nothing is committed and the reject verdict is
+  * journaled by the caller so replay re-delivers it without
+  * re-evaluation.
   */
-  provenance: "workflow" | "allowlisted"; /** The calling stack frame, after the configured redaction hook. */
-  frame: string; /** Parsed location when the frame carries one, after redaction. */
-  file?: string;
-  line?: number;
-  column?: number;
-};
-/**
-* Adaptive orchestration, resolutions, and
-* accounting: emitted only by runs where the corresponding machinery is
-* active (applicability per mode:
-* https://docs.rulvar.com/guide/adaptive-orchestration). The types land as
-* one closed catalog with M7-T03; emitters arrive with their tasks.
-*/
-type AdaptiveEvents = {
-  type: "plan:revised";
-  entryRef: number;
-  planHash: string;
-  applied: number;
-  dropped: number;
-  revisionUnitsRemaining: number;
-} | {
-  type: "node:parked";
-  nodeId: string;
-  logicalTaskId: string;
-} | {
-  type: "node:cancelled";
-  nodeId: string;
-  logicalTaskId: string;
-} | {
-  type: "node:linked";
-  nodeId: string;
-  logicalTaskId: string;
-  donorRef: number;
-  reclaimedUsd: number;
-} | {
-  type: "orchestrator:woke";
-  digestSeq: number;
-  planHash: string;
-  coversToOrdinal: number;
-  renderSize: number;
-} | {
   /**
-  * Two emitted shapes share the discriminant: the cap-freeze form
-  * carries { atCap: true, spentUsd, capUsd, finalizeReserveUsd },
-  * and the per-wake digest form carries atCap plus the passive
-  * WakeBudgetBlock fields (runSpentUsd .. softWarning).
+  * The reserve the DISPATCH layer will actually commit for this spec:
+  * the estimate (or the flat default) clamped by the explicit child
+  * budget when one exists, because only an explicit budget opens a
+  * child-allowance account at dispatch; the childBudgetFraction cap
+  * never materializes as an account and must not shrink the
+  * projection. The token-count-priced estimate of ctx.agent is
+  * unreachable here (async); a divergence there lands as a journaled
+  * dispatch rejection instead of a strand.
   */
-  type: "orchestrator:budget";
-  atCap: boolean;
-  spentUsd?: number;
-  capUsd?: number;
-  finalizeReserveUsd?: number;
-  runSpentUsd?: number;
-  runCeilingUsd?: number;
-  orchestratorSpentUsd?: number;
-  orchestratorCapUsd?: number;
-  orchestratorShare?: number;
-  softWarning?: boolean;
-} | {
-  type: "escalation:raised";
-  entryRef: number;
-  kind: "scope_bigger" | "scope_different" | "blocked_with_evidence";
-  logicalTaskId: string;
-  costToDateUsd: number;
-} | {
-  type: "escalation:decided";
-  entryRef: number;
-  decision: "retry" | "decompose" | "cancel" | "accept";
-  by: ResolutionBy;
-  countsAgainstLimit: boolean;
-} | {
-  type: "spawn:admitted";
-  entryRef: number; /** The admitting arms of the unified AdmitVerdict union. */
-  verdict: "admit" | "reuse_full" | "admit_graft";
-  agentType: string;
-  logicalTaskId: string;
+  projectedDispatchReserveUsd(spec: Pick<AdmitSpec, "estCostUsd" | "budgetUsd">): number;
+  admit(spec: AdmitSpec, options?: {
+    commitReserve?: boolean;
+  }): AdmissionDecision;
   /**
-  * Spawn-unit balance after the budget-layer debit. Present on
-  * budget-layer admissions (the orchestrator spawn tools and
-  * ctx.workflow children); absent on lineage-layer admissions
-  * (ctx.agent roots), whose spawn-unit debit rides the dispatch
-  * itself (v1.22.0 review P2-5).
+  * Resume roll-forward for an orchestrator child (M6-T07): restores the
+  * children-quota counter only. The budget seed already counts settled
+  * agent dispatches, and an in-flight child re-commits its reserve
+  * through the ctx.agent dispatch path.
   */
-  spawnUnitsAfter?: number;
-} | {
-  type: "spawn:rejected";
+  recoverChild(nodeKey: string): void;
   /**
-  * The journaled admission decision entry; absent for the
-  * pre-admission config gates (orchestrate maxSpawns), which
-  * reject before anything is journaled.
+  * Resume roll-forward for a child that already SETTLED before the
+  * resume: re-registers the counters (maxChildrenPerNode, the lifetime
+  * cap, statsBefore fidelity) without committing any reserve; the spend
+  * itself sits in the root ledger seed.
   */
-  entryRef?: number;
-  code: string;
-  agentType: string;
-  logicalTaskId?: string;
-} | {
-  type: "verify:failed";
-  entryRef: number;
-  logicalTaskId: string;
-  rung: number;
-  gate: "mechanical" | "judge" | "spot-check";
-} | {
-  type: "ledger:op";
-  entryRef: number;
-  op: "brief_set" | "fact_add" | "fact_supersede" | "lesson_add" | "observation_add";
-} | {
-  type: "stall:detected";
-  logicalTaskId: string;
-  stallStreak: number;
-} | {
-  type: "guard:oscillation";
-  spawnKeyHash: string;
-  oscillationCount: number;
-  limit: number;
-} | {
-  type: "resolution:applied";
-  targetRef: number;
-  entryRef: number;
-  by: ResolutionBy;
-} | {
-  type: "resolution:superseded";
-  targetRef: number;
-  entryRef: number;
-  supersededBy: number;
-  reason: "already_resolved" | "target_abandoned";
-} | {
-  type: "termination:debit";
-  entryRef: number;
-  counter: string;
-  remaining: number;
-  phi: number;
-} | {
-  type: "termination:denied";
-  entryRef: number;
-  counter: string;
-  code: string;
-} | {
-  type: "termination:config-drift";
-  field: string;
-  frozenValue: Json;
-  liveValue: Json;
-} | {
+  recoverSettled(parentAccountScope: string): void;
   /**
-  * Declared for hosts; not emitted today. The compatibility scan
-  * runs strictly before a run's event stream exists, so the
-  * refusal travels only as the typed JournalCompatibilityError
-  * (which carries the same fields).
+  * Resume roll-forward for an admission whose decision entry exists but
+  * whose child has NOT settled: re-applies the recorded reserve and
+  * counters without re-evaluating any limit (replay never
+  * re-evaluates admission; reserves are recovered, never
+  * re-estimated).
   */
-  type: "journal:compat";
-  code: "HASH_VERSION_TOO_OLD" | "HASH_VERSION_TOO_NEW";
-  found: number;
-  window: [number, number];
-};
-type WorkflowEventBody = CoreEvents | AgentEvents | ToolEvents | DeterminismEvents | AdaptiveEvents;
-/**
-* The envelope: seq is an independent per-run
-* telemetry counter, strictly increasing in emission order and DISTINCT
-* from JournalEntry.seq (never compare or join the two; entryRef fields
-* carry journal seqs explicitly). ts is wall clock, telemetry only.
-* replayed is true only on re-emitted journal-backed lifecycle events;
-* stream deltas are never re-emitted.
-*/
-type WorkflowEvent = {
-  runId: string;
-  seq: number;
-  ts: string;
-  spanId: string;
-  parentSpanId?: string;
-  replayed?: boolean;
-} & WorkflowEventBody;
+  recoverInFlight(parentAccountScope: string, verdict: AdmitVerdict): void;
+}
 //#endregion
 //#region src/engine/cost-report.d.ts
 /** Folds the per-run attribution buckets into the normative CostReport. */
@@ -7596,4 +7670,4 @@ interface SandboxBridge {
 declare const SANDBOX_AGENT_OPT_KEYS: readonly string[];
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type InvocationTable, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, type ExplorationSummary, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type InvocationTable, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readRunMeta, readTerminationInit, reconcileRunMeta, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, requiredFieldsValidator, requiredSectionsValidator, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };