@rulvar/core 1.6.0 → 1.7.0

package/dist/index.d.ts

@@ -608,6 +608,23 @@ interface UsageSlice {
   usage: Usage;
 }
 /**
+* Cost-attribution facts a live run knows at settlement and a pure
+* journal fold cannot re-derive: the innermost phase name at the call
+* site, the agent profile, the primary invocation role, the budget
+* account the call debited, and whether the dispatch spent the
+* orchestrator finalize reserve. Policy, never identity, exactly like
+* usageByModel: none of it enters the content key, and entries written
+* before the field shipped fold under the documented fallback buckets
+* (empty phase, 'unknown' agent type, role 'loop').
+*/
+interface CostAttributionFacts {
+  phase?: string;
+  agentType?: string;
+  role?: InvocationRole;
+  budgetAccount?: string;
+  finalizeReserve?: boolean;
+}
+/**
 * The per-model slices of a terminal entry: the recorded split when the
 * call spanned several models, else the whole usage attributed to
 * `servedBy`. The fallback is what makes every journal written before the
@@ -669,6 +686,13 @@ type JournalEntry = {
   * Policy, never identity: it does not enter the content key.
   */
   usageByModel?: UsageSlice[];
+  /**
+  * Terminal usage-bearing entries: the attribution facts behind the
+  * CostReport breakdowns, so a pure journal fold reproduces the live
+  * report byte for byte on replay. Policy, never identity, exactly
+  * like usageByModel.
+  */
+  costAttribution?: CostAttributionFacts;
   transcriptRef?: string;
   checkpointRef?: string;
   /**
@@ -2083,6 +2107,8 @@ interface TerminalPatch {
   servedBy?: ModelRef;
   /** Set only when the call spanned several serving models; see JournalEntry. */
   usageByModel?: UsageSlice[];
+  /** Attribution facts behind the CostReport breakdowns; see JournalEntry. */
+  costAttribution?: CostAttributionFacts;
   transcriptRef?: string;
   checkpointRef?: string;
   /** Terminal agent entries: Artifact list. */
@@ -3348,6 +3374,26 @@ interface BudgetAccountView {
   parentScope?: string;
 }
 /**
+* Why a ceiling error ended the work: the first closed account walking
+* from the debited scope toward the root, plus the root state, so the
+* outward message can name WHICH ceiling actually crossed instead of
+* blaming the run ceiling for every crossing.
+*/
+interface BudgetExhaustionDiagnostics {
+  crossed?: {
+    scope: string;
+    source: "root" | "orchestrator-cap" | "child-account";
+    ceilingUsd: number;
+    spentUsd: number;
+    committedReserveUsd: number;
+    finalizeReserveUsd: number;
+  };
+  root: {
+    ceilingUsd?: number;
+    spentUsd: number;
+  };
+}
+/**
 * The per-run budget account tree. All spend accounting is per instance;
 * the journal remains the durable source (the root is seeded by the
 * ledger fold on resume, M2; sub-account reserves are recovered from
@@ -3395,7 +3441,20 @@ declare class RunBudget {
     parentScope?: string;
     ceilingUsd?: number;
     finalizeReserveUsd?: number;
+    kind?: "orchestrator-cap";
   }): void;
+  /**
+  * The diagnostic projection behind a ceiling error: the first CLOSED
+  * account (projected commitments included, exactly the layer-1
+  * closure test) walking from `scope` toward the root, plus the root
+  * state. 'run budget ceiling reached' under a healthy root misled the
+  * v1.6.0 follow-up review's live probe when only a 0.18 USD
+  * orchestrator cap had crossed under a 0.90 USD root; the message can
+  * now name the account that actually ended the work. An unknown scope
+  * degrades to root-only diagnostics instead of throwing: this runs on
+  * the error path.
+  */
+  exhaustionDiagnostics(scope: string): BudgetExhaustionDiagnostics;
   accountView(scope: string): BudgetAccountView | undefined;
   /**
   * The admission remainder of one account: ceiling minus spend minus
@@ -4146,9 +4205,14 @@ type WorkflowEvent = {
 /** Folds the per-run attribution buckets into the normative CostReport. */
 declare function buildCostReport(attribution: CostAttribution, totalUsd: number): CostReport;
 /**
-* The pure journal fold: byModel and totals from terminal entries, the
-* same summation the kernel ledger uses (terminal usage exactly once,
-* priced per servedBy, abandoned subtrees contribute zero).
+* The pure journal fold: the complete CostReport from terminal entries,
+* the same summation the kernel ledger uses (terminal usage exactly
+* once, priced per servedBy slice, abandoned subtrees contribute zero).
+* The orchestrator block folds too: spend attributed to the
+* orchestrator sub-account, the reserve-funded share of it, the armed
+* wake count, and the at-cap freeze flag from the journaled cap
+* decision, so a replay-only resume reproduces the block instead of
+* reading this process's live accounts (which a replay never charges).
 */
 declare function costReportFromJournal(entries: readonly JournalEntry[], priceUsd: (servedBy: ModelRef, usage: Usage) => number | undefined): CostReport;
 //#endregion
@@ -4171,7 +4235,15 @@ interface CostReport {
   byPhase: Record<string, number>;
   byAgentType: Record<string, number>;
   byRole: Record<InvocationRole, number>;
-  /** All-zero with forcedFinish false in runs without a dynamic orchestrator. */
+  /**
+  * All-zero with forcedFinish false in runs without a dynamic
+  * orchestrator (or when no cap resolved, so no sub-account opened).
+  * Folded purely from the journal: spentUsd is the priced usage of
+  * entries debited to the orchestrator sub-account, reserveUsedUsd its
+  * reserve-funded forced-finish share, wakes the ARMED (journaled)
+  * wake suspensions (a wait satisfied synchronously never suspends and
+  * is not counted), and forcedFinish the journaled at-cap decision.
+  */
   orchestrator: {
     spentUsd: number; /** spentUsd / max(totalUsd, 0.01): the epsilon-floored H-OrchShare input. */
     share: number;
@@ -4852,6 +4924,13 @@ interface OrchestratorExtension {
 * machinery (reserves, freeze) completes in M7 (DEF-7).
 */
 interface OrchestratorBudgetSpec {
+  /**
+  * Absolute bound in USD. It never REPLACES the fraction bound:
+  * effectiveCap = min(capUsd, (capFraction ?? 0.2) * ceiling), so an
+  * explicit capUsd larger than the default fraction of the run ceiling
+  * is still cut to that fraction (and a warn log says so). Pass
+  * capFraction: 1.0 to make capUsd the sole bound.
+  */
   capUsd?: number;
   /** default 0.2; effectiveCap = min of the given bounds */
   capFraction?: number;
@@ -6181,4 +6260,4 @@ interface SandboxBridge {
 }
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, BUDGET_ABORT_REASON, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildIdentityInput, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINISH_SCHEMA, FINISH_TOOL_NAME, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_DEPTH_CEILING, MatchResult, McpConfig, MechanicalGateProfile, MechanicalGateVerdict, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RandIdentityInput, RandPayload, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStatus, RuntimeEventSink, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateSchemaSpec, validateTerminationLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, BUDGET_ABORT_REASON, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildIdentityInput, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINISH_SCHEMA, FINISH_TOOL_NAME, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_DEPTH_CEILING, MatchResult, McpConfig, MechanicalGateProfile, MechanicalGateVerdict, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RandIdentityInput, RandPayload, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStatus, RuntimeEventSink, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateSchemaSpec, validateTerminationLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/dist/index.js

@@ -5484,6 +5484,7 @@ var Replayer = class {
 			if (patch.usageApprox !== void 0) entry.usageApprox = patch.usageApprox;
 			if (patch.servedBy !== void 0) entry.servedBy = patch.servedBy;
 			if (patch.usageByModel !== void 0) entry.usageByModel = patch.usageByModel;
+			if (patch.costAttribution !== void 0) entry.costAttribution = patch.costAttribution;
 			if (patch.transcriptRef !== void 0) entry.transcriptRef = patch.transcriptRef;
 			if (patch.checkpointRef !== void 0) entry.checkpointRef = patch.checkpointRef;
 			if (patch.artifacts !== void 0) entry.artifacts = toJournalValue(patch.artifacts, "terminal artifacts");
@@ -6147,19 +6148,28 @@ var FileTranscriptStore = class {
 //#endregion
 //#region src/engine/cost-report.ts
 /**
-* CostReport builders (M5-T03). Two
-* sources, one shape:
+* CostReport builders (M5-T03; follow-up: one pure fold).
 *
-* - `buildCostReport` folds the LIVE per-run attribution buckets (ctx
-*   accumulates byModel/byPhase/byAgentType/byRole per call) around the
-*   ledger-fold total, so report totals equal the budget ledger fold
-*   totals exactly at settle.
-* - `costReportFromJournal` is the pure journal fold for STORED runs
-*   (shells, `rulvar inspect`): terminal usage priced per servedBy with
-*   abandoned subtrees contributing zero, exactly like the kernel's
-*   ledger fold. Phase, agentType, and role attribution are live-run
-*   facts that entries do not carry, so those buckets are empty here;
-*   byRole and the orchestrator block complete in M7 (DEF-7).
+* `costReportFromJournal` is THE report: a pure fold over terminal
+* entries that both the engine's settle path and stored-run inspection
+* (shells, `rulvar inspect`) use, so a replayed run reports the same
+* numbers byte for byte. Terminal entries carry their attribution facts
+* (`costAttribution`: phase, agent type, primary role, budget account,
+* finalize-reserve flag) exactly so this fold can reproduce every
+* breakdown without live state; entries written before the facts
+* shipped fold under the documented fallbacks (empty phase, 'unknown'
+* agent type, role 'loop').
+*
+* Inclusion policy, applied to the total and EVERY breakdown alike:
+* terminal usage exactly once, priced per serving slice, entries under
+* abandoned subtrees contribute zero (their spend is tracked separately
+* in the abandoned-spend ledger the orchestrator sees). Attempts that
+* were paid but never abandoned (a cancelled root attempt, a dangling
+* child) are real spend and stay included everywhere.
+*
+* `buildCostReport` folds the LIVE per-run attribution buckets around
+* the ledger total; it remains for hosts that accumulated their own
+* `CostAttribution`, but the engine no longer builds outcomes from it.
 *
 * Unpriced models surface in `unpriced`, never as a silent zero.
 */
@@ -6174,14 +6184,9 @@ const ROLES = [
 function emptyByRole() {
 	return Object.fromEntries(ROLES.map((role) => [role, 0]));
 }
-function zeroOrchestrator() {
-	return {
-		spentUsd: 0,
-		share: 0,
-		wakes: 0,
-		forcedFinish: false,
-		reserveUsedUsd: 0
-	};
+/** The orchestrator sub-account naming rule of makeOrchestratorWorkflow. */
+function isOrchestratorAccount(scope) {
+	return scope === "orchestrator" || scope.endsWith("/orchestrator");
 }
 /** Folds the per-run attribution buckets into the normative CostReport. */
 function buildCostReport(attribution, totalUsd) {
@@ -6207,16 +6212,30 @@ function buildCostReport(attribution, totalUsd) {
 	};
 }
 /**
-* The pure journal fold: byModel and totals from terminal entries, the
-* same summation the kernel ledger uses (terminal usage exactly once,
-* priced per servedBy, abandoned subtrees contribute zero).
+* The pure journal fold: the complete CostReport from terminal entries,
+* the same summation the kernel ledger uses (terminal usage exactly
+* once, priced per servedBy slice, abandoned subtrees contribute zero).
+* The orchestrator block folds too: spend attributed to the
+* orchestrator sub-account, the reserve-funded share of it, the armed
+* wake count, and the at-cap freeze flag from the journaled cap
+* decision, so a replay-only resume reproduces the block instead of
+* reading this process's live accounts (which a replay never charges).
 */
 function costReportFromJournal(entries, priceUsd) {
 	const abandonFold = buildAbandonFold(entries);
 	const byModel = {};
+	const byPhase = {};
+	const byAgentType = {};
+	const byRole = emptyByRole();
 	const unpriced = [];
 	let totalUsd = 0;
+	let orchestratorSpentUsd = 0;
+	let reserveUsedUsd = 0;
+	let wakes = 0;
+	let forcedFinish = false;
 	for (const entry of entries) {
+		if (entry.kind === "decision" && entry.value?.decisionType === "orchestrator_budget_cap") forcedFinish = true;
+		if (entry.kind === "external" && entry.status === "suspended" && typeof entry.value?.key === "string" && (entry.value.key.startsWith("wake:") || entry.value.key.includes(":wake:"))) wakes += 1;
 		if (entry.kind !== "resolution" && entry.kind !== "abandon" && abandonFold.isAbandoned(entry.ref ?? entry.seq)) continue;
 		if (entry.status === "running" || entry.usage === void 0) continue;
 		const priced = priceEntryUsage(entry, priceUsd);
@@ -6226,14 +6245,30 @@ function costReportFromJournal(entries, priceUsd) {
 		});
 		for (const slice of priced.priced) byModel[slice.servedBy] = (byModel[slice.servedBy] ?? 0) + slice.usd;
 		totalUsd += priced.usd;
+		const facts = entry.costAttribution;
+		const phase = facts?.phase ?? "";
+		byPhase[phase] = (byPhase[phase] ?? 0) + priced.usd;
+		const agentType = facts?.agentType ?? "unknown";
+		byAgentType[agentType] = (byAgentType[agentType] ?? 0) + priced.usd;
+		byRole[facts?.role ?? "loop"] += priced.usd;
+		if (facts?.budgetAccount !== void 0 && isOrchestratorAccount(facts.budgetAccount)) {
+			orchestratorSpentUsd += priced.usd;
+			if (facts.finalizeReserve === true) reserveUsedUsd += priced.usd;
+		}
 	}
 	return {
 		totalUsd,
 		byModel,
-		byPhase: {},
-		byAgentType: {},
-		byRole: emptyByRole(),
-		orchestrator: zeroOrchestrator(),
+		byPhase,
+		byAgentType,
+		byRole,
+		orchestrator: {
+			spentUsd: orchestratorSpentUsd,
+			share: orchestratorSpentUsd / Math.max(totalUsd, .01),
+			wakes,
+			forcedFinish,
+			reserveUsedUsd
+		},
 		unpriced
 	};
 }
@@ -8510,6 +8545,28 @@ async function runAgent(options) {
 			await saveBoundary();
 			continue loop;
 		}
+		if (options.terminalTool !== void 0) {
+			noProgress.recordTurn({ toolCalls: 0 });
+			if (noProgress.tripped) {
+				status = "limit";
+				abortClass = "no-progress";
+				agentError = {
+					kind: "terminal",
+					retryable: false
+				};
+				errorMessage = noProgress.describe();
+				break;
+			}
+			messages.push({
+				role: "user",
+				parts: [{
+					type: "text",
+					text: outcome.finish?.reason === "max-tokens" ? `The turn was cut at the output token limit before any tool call. Be brief and call the '${options.terminalTool.name}' tool now; plain text is not a valid completion.` : `The turn ended without a tool call. Call the '${options.terminalTool.name}' tool to complete; plain text is not a valid completion.`
+				}]
+			});
+			await saveBoundary();
+			continue loop;
+		}
 		if (options.schema === void 0) {
 			output = outcome.turn.text;
 			break;
@@ -8942,8 +8999,43 @@ var RunBudget = class {
 			controller: new AbortController()
 		};
 		if (options.ceilingUsd !== void 0) account.ceilingUsd = options.ceilingUsd;
+		if (options.kind !== void 0) account.kind = options.kind;
 		this.accounts.set(scope, account);
 	}
+	/**
+	* The diagnostic projection behind a ceiling error: the first CLOSED
+	* account (projected commitments included, exactly the layer-1
+	* closure test) walking from `scope` toward the root, plus the root
+	* state. 'run budget ceiling reached' under a healthy root misled the
+	* v1.6.0 follow-up review's live probe when only a 0.18 USD
+	* orchestrator cap had crossed under a 0.90 USD root; the message can
+	* now name the account that actually ended the work. An unknown scope
+	* degrades to root-only diagnostics instead of throwing: this runs on
+	* the error path.
+	*/
+	exhaustionDiagnostics(scope) {
+		let chain;
+		try {
+			chain = this.chainOf(scope);
+		} catch {
+			chain = [this.root];
+		}
+		const crossed = chain.find((account) => account.ceilingUsd !== void 0 && account.spentUsd + account.committedReserveUsd + account.finalizeReserveUsd >= account.ceilingUsd);
+		const root = this.root;
+		const diagnostics = { root: {
+			spentUsd: root.spentUsd,
+			...root.ceilingUsd === void 0 ? {} : { ceilingUsd: root.ceilingUsd }
+		} };
+		if (crossed?.ceilingUsd !== void 0) diagnostics.crossed = {
+			scope: crossed.scope,
+			source: crossed.scope === "run" ? "root" : crossed.kind === "orchestrator-cap" ? "orchestrator-cap" : "child-account",
+			ceilingUsd: crossed.ceilingUsd,
+			spentUsd: crossed.spentUsd,
+			committedReserveUsd: crossed.committedReserveUsd,
+			finalizeReserveUsd: crossed.finalizeReserveUsd
+		};
+		return diagnostics;
+	}
 	accountView(scope) {
 		const account = this.accounts.get(scope);
 		if (account === void 0) return;
@@ -9791,6 +9883,13 @@ const kTerminalTool = Symbol("rulvar.terminalTool");
 * graft boot). Dangling redispatch checkpoints take precedence.
 */
 const kBootCheckpoint = Symbol("rulvar.bootCheckpoint");
+/**
+* Internal AgentOpts channel: marks the orchestrator forced-finish
+* dispatch, whose spend draws from the released finalize reserve
+* (DEF-7). Settlement stamps the flag into the terminal's cost
+* attribution so the journal fold reproduces reserveUsedUsd.
+*/
+const kFinalizeReserve = Symbol("rulvar.finalizeReserve");
 /** Typed accessor used by the in-package consumers. */
 function runtimeOf(ctx) {
 	const runtime = ctxRuntimes.get(ctx);
@@ -10653,6 +10752,13 @@ function createCtx(internals, rootWorkflow) {
 			usage: result.usage,
 			servedBy: result.servedBy,
 			...result.usageByModel === void 0 ? {} : { usageByModel: result.usageByModel },
+			costAttribution: {
+				...state.phase === void 0 ? {} : { phase: state.phase },
+				agentType,
+				role: primaryRole,
+				budgetAccount: state.budgetScope ?? "run",
+				...opts[kFinalizeReserve] === true ? { finalizeReserve: true } : {}
+			},
 			transcriptRef: result.transcriptRef
 		};
 		if (result.status === "escalated" && result.escalation !== void 0) terminalPatch.escalation = result.escalation;
@@ -10720,10 +10826,25 @@ function createCtx(internals, rootWorkflow) {
 		bump(internals.cost.byPhase, state.phase ?? "", usd);
 		bump(internals.cost.byAgentType, agentType, usd);
 		internals.cost.byRole.set(primaryRole, (internals.cost.byRole.get(primaryRole) ?? 0) + usd);
-		if (result.error?.kind === "budget" || internals.budget.exhausted && result.status !== "ok") throw new BudgetExhaustedError("run budget ceiling reached during agent execution", { data: {
-			scope: state.scope,
-			entryRef: terminal.seq
-		} });
+		if (result.error?.kind === "budget" || internals.budget.exhausted && result.status !== "ok") {
+			const diagnostics = internals.budget.exhaustionDiagnostics(state.budgetScope ?? "run");
+			const crossed = diagnostics.crossed;
+			const rootSuffix = `run root: spent ${diagnostics.root.spentUsd.toFixed(4)}` + (diagnostics.root.ceilingUsd === void 0 ? " USD, no ceiling" : ` of ${diagnostics.root.ceilingUsd.toFixed(4)} USD`);
+			throw new BudgetExhaustedError(crossed === void 0 || crossed.source === "root" ? "run budget ceiling reached during agent execution" : (crossed.source === "orchestrator-cap" ? "orchestrator budget cap reached during agent execution" : "budget sub-account ceiling reached during agent execution") + ` (account '${crossed.scope}': spent ${crossed.spentUsd.toFixed(4)}` + (crossed.committedReserveUsd + crossed.finalizeReserveUsd > 0 ? ` plus ${(crossed.committedReserveUsd + crossed.finalizeReserveUsd).toFixed(4)} reserved` : "") + ` of ${crossed.ceilingUsd.toFixed(4)} USD; ${rootSuffix})`, { data: {
+				scope: state.scope,
+				entryRef: terminal.seq,
+				source: crossed?.source ?? "root",
+				rootSpentUsd: diagnostics.root.spentUsd,
+				...diagnostics.root.ceilingUsd === void 0 ? {} : { rootCeilingUsd: diagnostics.root.ceilingUsd },
+				...crossed === void 0 ? {} : {
+					crossedScope: crossed.scope,
+					crossedCeilingUsd: crossed.ceilingUsd,
+					crossedSpentUsd: crossed.spentUsd,
+					crossedCommittedReserveUsd: crossed.committedReserveUsd,
+					crossedFinalizeReserveUsd: crossed.finalizeReserveUsd
+				}
+			} });
+		}
 		if (opts.fallback !== void 0) {
 			const trigger = fallbackTriggerOf(result);
 			if (trigger !== void 0 && opts.fallback.on.includes(trigger)) return runFallbackAttempt(running.seq, trigger, spanId);
@@ -11313,10 +11434,16 @@ function makeOrchestratorWorkflow(goal, opts) {
 				const finalizeTurns = spec?.finalizeTurns ?? 2;
 				const finalizeReserveUsd = spec?.finalizeReserveUsd ?? finalizeTurns * turnEstimateUsd;
 				if (extension !== void 0 && effectiveCapUsd < finalizeReserveUsd) throw new OrchestratorCapConfigError(`effectiveCap ${effectiveCapUsd.toFixed(4)} USD is below the finalize reserve ${finalizeReserveUsd.toFixed(4)} USD`);
+				if (spec?.capUsd !== void 0 && spec.capFraction === void 0 && effectiveCapUsd < spec.capUsd) internals.events.emit({
+					type: "log",
+					level: "warn",
+					msg: `orchestrator budget.capUsd ${spec.capUsd.toFixed(4)} USD is bounded to ${effectiveCapUsd.toFixed(4)} USD by the default capFraction 0.2 of the run ceiling (effectiveCap = min(capUsd, capFraction * ceiling)); pass capFraction: 1.0 to make capUsd the sole bound`
+				}, callingState.spanId);
 				orchestratorAccount = callingState.scope === "" ? "orchestrator" : `${callingState.scope}/orchestrator`;
 				internals.budget.openAccount(orchestratorAccount, {
 					parentScope: callingState.budgetScope ?? "run",
-					ceilingUsd: effectiveCapUsd
+					ceilingUsd: effectiveCapUsd,
+					kind: "orchestrator-cap"
 				});
 				if (extension !== void 0) internals.budget.commitFinalizeReserve(orchestratorAccount, finalizeReserveUsd);
 				capState = {
@@ -11332,6 +11459,15 @@ function makeOrchestratorWorkflow(goal, opts) {
 		const records = /* @__PURE__ */ new Map();
 		const byOrdinal = /* @__PURE__ */ new Map();
 		const rejectedByOrdinal = /* @__PURE__ */ new Map();
+		/**
+		* The journaled spec behind each recovered ordinal: the idempotent
+		* re-execution guard compares it against the incoming call, because
+		* after a cross-attempt resume a REGENERATED turn (the boundary
+		* checkpoint predates the lost turn) may decide differently, and
+		* handing it the prior ordinal's handle would bind the transcript
+		* to a stranger's child.
+		*/
+		const recoveredSpecByOrdinal = /* @__PURE__ */ new Map();
 		let nextOrdinal = 0;
 		let orchSeq;
 		const deliveredNodeIds = /* @__PURE__ */ new Set();
@@ -11367,7 +11503,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const controller = new AbortController();
 			const upstream = callingState.signal ?? internals.runSignal;
 			const scope = placement?.childScope ?? childScopeOf();
-			if (placement !== void 0) internals.budget.openAccount(scope, {
+			if (placement?.ownAccount === true) internals.budget.openAccount(scope, {
 				parentScope: callingState.budgetScope ?? "run",
 				...placement.childCeilingUsd === void 0 ? {} : { ceilingUsd: placement.childCeilingUsd }
 			});
@@ -11375,7 +11511,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				scope,
 				spanId: internals.spans.mint(callingState.spanId),
 				signal: upstream === void 0 ? controller.signal : AbortSignal.any([upstream, controller.signal]),
-				budgetScope: placement !== void 0 ? scope : callingState.budgetScope ?? "run"
+				budgetScope: placement?.ownAccount === true ? scope : callingState.budgetScope ?? "run"
 			};
 			let resolveHandle = () => void 0;
 			const handlePromise = new Promise((resolve) => {
@@ -11457,6 +11593,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				nextOrdinal += 1;
 				return { handle: (await dispatchChild(spec, spawnOrdinal, identity, {
 					childScope,
+					ownAccount: true,
 					...spec.budgetUsd === void 0 ? {} : { childCeilingUsd: spec.budgetUsd }
 				})).handle };
 			},
@@ -11487,33 +11624,61 @@ function makeOrchestratorWorkflow(goal, opts) {
 				handle
 			};
 		};
-		/** Rebuilds spawn records from the journal (the crash-resume contract). */
+		/**
+		* True when `scope` is a root-attempt scope of THIS orchestration:
+		* agentScope(callingState.scope, n) for some dispatch seq n. Nested
+		* orchestrations live under their own wf: child scopes and never
+		* match a foreign calling scope.
+		*/
+		const scopeOfThisOrchestration = (scope) => {
+			const prefix = callingState.scope === "" ? "" : `${callingState.scope}/`;
+			return scope.startsWith(prefix) && /^agent:\d+$/.test(scope.slice(prefix.length));
+		};
+		/**
+		* Rebuilds spawn records from the journal (the crash-resume
+		* contract). Recovery is ORCHESTRATION-scoped, not attempt-scoped:
+		* decisions journal at the orchestrate call's own scope, which is
+		* stable across root attempts, so a rerun after a cancelled root
+		* (the budget-abort shape the v1.6.0 follow-up review resumed) sees
+		* every prior decision instead of re-deciding and re-paying.
+		* Recovered children re-dispatch PINNED to their journaled child
+		* scope: settled ones forward-match and replay for free, a dangling
+		* one redispatches live (at-least-once), and a decision without a
+		* dispatch entry rolls forward to a fresh dispatch.
+		*/
 		const recover = async () => {
-			const scope = childScopeOf();
+			const currentScope = childScopeOf();
 			const admissions = internals.replayer.snapshot().filter((entry) => {
-				if (entry.kind !== "decision") return false;
+				if (entry.kind !== "decision" || entry.scope !== callingState.scope) return false;
 				const value = entry.value;
-				return value?.decisionType === "spawn-admission" && (value.origin === "spawn_agent" || value.origin === "parallel_agents") && value.orchestratorScope === scope;
+				return value?.decisionType === "spawn-admission" && (value.origin === "spawn_agent" || value.origin === "parallel_agents");
 			}).map((entry) => entry.value).sort((a, b) => a.spawnOrdinal - b.spawnOrdinal);
 			for (const value of admissions) {
 				nextOrdinal = Math.max(nextOrdinal, value.spawnOrdinal + 1);
 				const decision = value.decision;
+				recoveredSpecByOrdinal.set(value.spawnOrdinal, value.spec);
 				if (decision.verdict.kind !== "admit") {
 					rejectedByOrdinal.set(value.spawnOrdinal, decision);
 					continue;
 				}
-				admission.recoverChild(scope);
-				await dispatchChild(value.spec, value.spawnOrdinal, {
+				admission.recoverChild(currentScope);
+				const childScope = value.childScope ?? value.orchestratorScope;
+				const record = await dispatchChild(value.spec, value.spawnOrdinal, {
 					nodeId: decision.nodeId ?? "unknown",
 					logicalTaskId: decision.verdict.lineage.logicalTaskId
-				});
+				}, { childScope });
+				const dispatched = internals.replayer.snapshot().find((entry) => entry.seq === record.handle);
+				if (dispatched !== void 0) {
+					for (const prior of internals.replayer.snapshot()) if (prior.kind === "agent" && prior.status === "running" && prior.seq !== record.handle && prior.scope === dispatched.scope && prior.key === dispatched.key && prior.ordinal === dispatched.ordinal && !records.has(prior.seq)) records.set(prior.seq, record);
+				}
 			}
-			const wakePrefix = `wake:${String(orchSeq ?? -1)}:`;
 			for (const entry of internals.replayer.snapshot()) {
 				if (entry.status !== "suspended" || entry.kind !== "external") continue;
+				if (!scopeOfThisOrchestration(entry.scope)) continue;
 				const payload = entry.value;
-				if (typeof payload?.key !== "string" || !payload.key.startsWith(wakePrefix)) continue;
-				wakeOrdinal = Math.max(wakeOrdinal, Number(payload.key.slice(wakePrefix.length)) + 1);
+				const match = typeof payload?.key === "string" ? /^wake:\d+:(\d+)$/.exec(payload.key) : null;
+				if (match === null) continue;
+				wakeOrdinal = Math.max(wakeOrdinal, Number(match[1]) + 1);
 				const suspension = internals.replayer.suspensionState(entry.seq);
 				if (suspension.state === "resolved") markDelivered(suspension.value);
 			}
@@ -11641,10 +11806,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 				await recoveryDone;
 				const spawnOrdinal = nextOrdinal;
 				nextOrdinal += 1;
+				const priorSpec = recoveredSpecByOrdinal.get(spawnOrdinal);
+				const specMatches = priorSpec === void 0 || priorSpec.agentType === params.agentType && priorSpec.prompt === params.prompt;
 				const recovered = byOrdinal.get(spawnOrdinal);
-				if (recovered !== void 0) return { handle: recovered.handle };
+				if (recovered !== void 0 && specMatches) return { handle: recovered.handle };
 				const recoveredRejection = rejectedByOrdinal.get(spawnOrdinal);
-				if (recoveredRejection !== void 0) throw new AdmissionRejectedError(`admission rejected spawn ordinal ${String(spawnOrdinal)} (recovered verdict)`, { data: { decision: recoveredRejection } });
+				if (recoveredRejection !== void 0 && specMatches) throw new AdmissionRejectedError(`admission rejected spawn ordinal ${String(spawnOrdinal)} (recovered verdict)`, { data: { decision: recoveredRejection } });
 				if (opts?.maxSpawns !== void 0 && spawnOrdinal >= opts.maxSpawns) {
 					internals.events.emit({
 						type: "spawn:rejected",
@@ -11902,7 +12069,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 				orchSeq = seq;
 				recover().then(releaseRecovery, releaseRecovery);
 			},
-			[kTerminalTool]: { name: FINISH_TOOL_NAME }
+			[kTerminalTool]: { name: FINISH_TOOL_NAME },
+			...(() => {
+				const priorCancelledRoot = internals.replayer.snapshot().filter((entry) => entry.kind === "agent" && entry.scope === callingState.scope && entry.status === "cancelled" && entry.checkpointRef !== void 0).at(-1);
+				return priorCancelledRoot?.checkpointRef === void 0 ? {} : { [kBootCheckpoint]: priorCancelledRoot.checkpointRef };
+			})()
 		};
 		const orchestratorState = { ...callingState };
 		if (orchestratorAccount !== void 0) orchestratorState.budgetScope = orchestratorAccount;
@@ -11928,7 +12099,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 				limits: { maxTurns: capState?.finalizeTurns ?? 2 },
 				...capState === void 0 ? {} : { estCost: capState.finalizeReserveUsd },
 				...opts?.model === void 0 ? {} : { model: opts.model },
-				[kTerminalTool]: { name: FINISH_TOOL_NAME }
+				[kTerminalTool]: { name: FINISH_TOOL_NAME },
+				[kFinalizeReserve]: true
 			};
 			const finalState = { ...callingState };
 			if (orchestratorAccount !== void 0) finalState.budgetScope = orchestratorAccount;
@@ -12109,14 +12281,20 @@ const detection = new AsyncLocalStorage();
 let globalsPatched = false;
 /**
 * Stack line 0 names the Error, line 1 this helper, line 2 the patched
-* global, line 3 the caller whose provenance decides. Library code (a
-* provider SDK, any installed dependency, rulvar's own published dist)
-* lives under node_modules and is exempt: the guard exists for workflow
-* code, which imports from node_modules but does not live there.
+* global, line 3 the caller whose provenance decides (the layout is
+* pinned by construction: this helper is only ever called by the two
+* patched globals). Two origins are exempt: installed dependencies (a
+* provider SDK, any transitive package, rulvar's own published dist),
+* which live under node_modules, and Node's own machinery (the undici
+* transport behind fetch, timers, stream internals), whose frames carry
+* `node:` specifiers and inherit the run's async context. The guard
+* exists for workflow code, which imports from both but lives in
+* neither.
 */
 function libraryCaller() {
 	const caller = (/* @__PURE__ */ new Error()).stack?.split("\n")[3];
-	return caller !== void 0 && caller.includes("node_modules");
+	if (caller === void 0) return false;
+	return caller.includes("node_modules") || /[(\s]node:/.test(caller);
 }
 /**
 * Patches Date.now and Math.random ONCE per process and never restores:
@@ -12468,7 +12646,7 @@ function createEngine(options) {
 				dropped: internals.dropped,
 				pending,
 				usage: ledger.usage,
-				cost: buildCostReport(internals.cost, ledger.usd)
+				cost: costReportFromJournal(replayer.snapshot(), priceUsd)
 			};
 			if (value !== void 0 && (status === "ok" || status === "exhausted")) outcome.value = value;
 			if (wireError !== void 0) outcome.error = wireError;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",