@rulvar/core 1.6.0 → 1.8.0

package/dist/index.d.ts

@@ -608,6 +608,23 @@ interface UsageSlice {
   usage: Usage;
 }
 /**
+* Cost-attribution facts a live run knows at settlement and a pure
+* journal fold cannot re-derive: the innermost phase name at the call
+* site, the agent profile, the primary invocation role, the budget
+* account the call debited, and whether the dispatch spent the
+* orchestrator finalize reserve. Policy, never identity, exactly like
+* usageByModel: none of it enters the content key, and entries written
+* before the field shipped fold under the documented fallback buckets
+* (empty phase, 'unknown' agent type, role 'loop').
+*/
+interface CostAttributionFacts {
+  phase?: string;
+  agentType?: string;
+  role?: InvocationRole;
+  budgetAccount?: string;
+  finalizeReserve?: boolean;
+}
+/**
 * The per-model slices of a terminal entry: the recorded split when the
 * call spanned several models, else the whole usage attributed to
 * `servedBy`. The fallback is what makes every journal written before the
@@ -669,6 +686,13 @@ type JournalEntry = {
   * Policy, never identity: it does not enter the content key.
   */
   usageByModel?: UsageSlice[];
+  /**
+  * Terminal usage-bearing entries: the attribution facts behind the
+  * CostReport breakdowns, so a pure journal fold reproduces the live
+  * report byte for byte on replay. Policy, never identity, exactly
+  * like usageByModel.
+  */
+  costAttribution?: CostAttributionFacts;
   transcriptRef?: string;
   checkpointRef?: string;
   /**
@@ -1776,7 +1800,16 @@ interface ResumeReport {
   misses: number;
   skipped: number;
   reruns: number;
-  /** Journaled operations never consumed by any live call (deleted calls). */
+  /**
+  * Effect roots that genuinely need recovery under the entry-type
+  * pairing rules: dangling dispatches (status 'running' with no
+  * terminal) and suspensions with no resolution, neither consumed by a
+  * live call nor covered by abandon. Complete operations are NEVER
+  * listed: settled roots, single-entry kinds (decisions, facts, plan
+  * and termination entries), and resolved suspensions are whole by
+  * construction. A call deleted from the code is silently skipped and
+  * never re-paid; it appears here only while its effect is dangling.
+  */
   orphaned: number[];
 }
 /**
@@ -1789,6 +1822,8 @@ declare class JournalMatcher {
   private readonly byScope;
   private readonly all;
   private readonly consumed;
+  /** Suspension seqs holding at least one resolution ref-entry. */
+  private readonly resolvedRefs;
   private readonly keyRing;
   private disposition;
   private aliasDisposition?;
@@ -2083,6 +2118,8 @@ interface TerminalPatch {
   servedBy?: ModelRef;
   /** Set only when the call spanned several serving models; see JournalEntry. */
   usageByModel?: UsageSlice[];
+  /** Attribution facts behind the CostReport breakdowns; see JournalEntry. */
+  costAttribution?: CostAttributionFacts;
   transcriptRef?: string;
   checkpointRef?: string;
   /** Terminal agent entries: Artifact list. */
@@ -3088,9 +3125,14 @@ interface TerminationLimits {
   kMax: number;
   /** B0; immutable after start, no API including HITL can top up. */
   runBudgetUsdCeiling: number;
-  /** From the orchestrator budget (DEF-7; XF-09). */
+  /**
+  * The resolved orchestrator cap in absolute USD (DEF-7; XF-09),
+  * frozen with the counters. Journals recorded before v1.8 store 0
+  * ("not yet resolved"); for them the orchestrator_budget_reserve
+  * decision is the authority and is recovered on resume.
+  */
   orchestratorCapUsd: number;
-  /** From the orchestrator budget (DEF-7; XF-09). */
+  /** The finalize reserve carved out of the cap; 0 in pre-v1.8 journals. */
   finalizeReserveUsd: number;
 }
 /** Appendix A committed defaults for the countable resources. */
@@ -3348,6 +3390,26 @@ interface BudgetAccountView {
   parentScope?: string;
 }
 /**
+* Why a ceiling error ended the work: the first closed account walking
+* from the debited scope toward the root, plus the root state, so the
+* outward message can name WHICH ceiling actually crossed instead of
+* blaming the run ceiling for every crossing.
+*/
+interface BudgetExhaustionDiagnostics {
+  crossed?: {
+    scope: string;
+    source: "root" | "orchestrator-cap" | "child-account";
+    ceilingUsd: number;
+    spentUsd: number;
+    committedReserveUsd: number;
+    finalizeReserveUsd: number;
+  };
+  root: {
+    ceilingUsd?: number;
+    spentUsd: number;
+  };
+}
+/**
 * The per-run budget account tree. All spend accounting is per instance;
 * the journal remains the durable source (the root is seeded by the
 * ledger fold on resume, M2; sub-account reserves are recovered from
@@ -3395,7 +3457,20 @@ declare class RunBudget {
     parentScope?: string;
     ceilingUsd?: number;
     finalizeReserveUsd?: number;
+    kind?: "orchestrator-cap" | "child-allowance";
   }): void;
+  /**
+  * The diagnostic projection behind a ceiling error: the first CLOSED
+  * account (projected commitments included, exactly the layer-1
+  * closure test) walking from `scope` toward the root, plus the root
+  * state. 'run budget ceiling reached' under a healthy root misled the
+  * v1.6.0 follow-up review's live probe when only a 0.18 USD
+  * orchestrator cap had crossed under a 0.90 USD root; the message can
+  * now name the account that actually ended the work. An unknown scope
+  * degrades to root-only diagnostics instead of throwing: this runs on
+  * the error path.
+  */
+  exhaustionDiagnostics(scope: string): BudgetExhaustionDiagnostics;
   accountView(scope: string): BudgetAccountView | undefined;
   /**
   * The admission remainder of one account: ceiling minus spend minus
@@ -3403,6 +3478,18 @@ declare class RunBudget {
   * fractions never eat finalization money). Undefined when uncapped.
   */
   remainderOf(scope: string): number | undefined;
+  /**
+  * The tightest allowance headroom on the chain of `scope`: the minimum
+  * remainder across 'child-allowance' accounts. An allowance ceiling
+  * bounds the child's LIFETIME spend, so projected admission must never
+  * hold more than this against the chain (the layer-2 mirror lives in
+  * the orchestrator admission's childCeiling clamp): a reserve above
+  * the allowance would deny work that the allowance itself already
+  * bounds. Undefined when no allowance account is on the chain; the
+  * clamp never applies to the run root or an orchestrator cap, whose
+  * headroom is shared money that projected admission must protect.
+  */
+  allowanceHeadroomOf(scope: string): number | undefined;
   /** Layer 3 ceiling signal of the run root; live streams sever through it. */
   get signal(): AbortSignal;
   /** The layer-3 signal of one sub-account's subtree, when it exists. */
@@ -3691,6 +3778,23 @@ type AdmitRejectReason = {
   code: "osc_guard";
   spawnKey: SpawnKey;
   oscillationCount: number;
+} | {
+  /**
+  * The declared estimate cannot fit the child's own ceiling: the
+  * host said the work costs more than the budget buys, so the op
+  * is bounced with the actionable correction BEFORE it changes
+  * plan state or consumes a spawn unit (the v1.7.0 follow-up
+  * review's P1). Heuristic reserves never produce this code; they
+  * clamp to the allowance instead.
+  */
+  code: "reserve_exceeds_budget";
+  agentType: string;
+  childAccount: string;
+  estCostUsd: number;
+  resolvedReserveUsd: number;
+  childCeilingUsd: number;
+  minimumBudgetUsd: number;
+  message: string;
 };
 /** Every spawn origin routed through the single admission point. */
 type SpawnOrigin = "ctx.workflow" | "ctx.orchestrate" | "spawn_agent" | "parallel_agents" | "escalation-decomposition" | "rung-respawn" | "reuse-link";
@@ -3708,6 +3812,13 @@ interface AdmitSpec {
   /** Reserve hint; falls back to the flat engine default. */
   estCostUsd?: number;
   /**
+  * Same-batch reserves already admitted read-only but not yet
+  * committed (a multi-op plan revision): the read-only branch adds
+  * them to this spawn's reserve so every embedded admit of one batch
+  * is dispatchable under the same snapshot, not just the first.
+  */
+  pendingReserveUsd?: number;
+  /**
   * Lineage continuation (DEF-3); absence mints a fresh lineage root. A
   * continuation demands a causeRef: the seq of the entry that caused the
   * rebirth.
@@ -3858,6 +3969,17 @@ declare class AdmissionController {
   * journaled by the caller so replay re-delivers it without
   * re-evaluation.
   */
+  /**
+  * The reserve the DISPATCH layer will actually commit for this spec:
+  * the estimate (or the flat default) clamped by the explicit child
+  * budget when one exists, because only an explicit budget opens a
+  * child-allowance account at dispatch; the childBudgetFraction cap
+  * never materializes as an account and must not shrink the
+  * projection. The token-count-priced estimate of ctx.agent is
+  * unreachable here (async); a divergence there lands as a journaled
+  * dispatch rejection instead of a strand.
+  */
+  projectedDispatchReserveUsd(spec: Pick<AdmitSpec, "estCostUsd" | "budgetUsd">): number;
   admit(spec: AdmitSpec, options?: {
     commitReserve?: boolean;
   }): AdmissionDecision;
@@ -4146,9 +4268,14 @@ type WorkflowEvent = {
 /** Folds the per-run attribution buckets into the normative CostReport. */
 declare function buildCostReport(attribution: CostAttribution, totalUsd: number): CostReport;
 /**
-* The pure journal fold: byModel and totals from terminal entries, the
-* same summation the kernel ledger uses (terminal usage exactly once,
-* priced per servedBy, abandoned subtrees contribute zero).
+* The pure journal fold: the complete CostReport from terminal entries,
+* the same summation the kernel ledger uses (terminal usage exactly
+* once, priced per servedBy slice, abandoned subtrees contribute zero).
+* The orchestrator block folds too: spend attributed to the
+* orchestrator sub-account, the reserve-funded share of it, the armed
+* wake count, and the at-cap freeze flag from the journaled cap
+* decision, so a replay-only resume reproduces the block instead of
+* reading this process's live accounts (which a replay never charges).
 */
 declare function costReportFromJournal(entries: readonly JournalEntry[], priceUsd: (servedBy: ModelRef, usage: Usage) => number | undefined): CostReport;
 //#endregion
@@ -4171,7 +4298,15 @@ interface CostReport {
   byPhase: Record<string, number>;
   byAgentType: Record<string, number>;
   byRole: Record<InvocationRole, number>;
-  /** All-zero with forcedFinish false in runs without a dynamic orchestrator. */
+  /**
+  * All-zero with forcedFinish false in runs without a dynamic
+  * orchestrator (or when no cap resolved, so no sub-account opened).
+  * Folded purely from the journal: spentUsd is the priced usage of
+  * entries debited to the orchestrator sub-account, reserveUsedUsd its
+  * reserve-funded forced-finish share, wakes the ARMED (journaled)
+  * wake suspensions (a wait satisfied synchronously never suspends and
+  * is not counted), and forcedFinish the journaled at-cap decision.
+  */
   orchestrator: {
     spentUsd: number; /** spentUsd / max(totalUsd, 0.01): the epsilon-floored H-OrchShare input. */
     share: number;
@@ -4746,6 +4881,16 @@ interface OrchestratorExtensionIO {
   readonly gates: Record<string, unknown>;
   /** The run USD ceiling (B0), when one exists. */
   readonly runCeilingUsd?: number;
+  /**
+  * The resolved orchestrator cap in absolute USD (DEF-7; XF-09):
+  * min(budget.capUsd, capFraction x B0) on a fresh run, the frozen
+  * orchestrator_budget_reserve dollars on resume. Resolved strictly
+  * before boot so an extension can freeze it into termination.init;
+  * always present under PlanRunner (an unresolvable cap refuses boot).
+  */
+  readonly orchestratorCapUsd?: number;
+  /** The finalize reserve carved out of the cap, resolved with it. */
+  readonly finalizeReserveUsd?: number;
   /** ULID minting for engine-owned identifiers (NodeIds). */
   mintId(): string;
   /**
@@ -4852,6 +4997,13 @@ interface OrchestratorExtension {
 * machinery (reserves, freeze) completes in M7 (DEF-7).
 */
 interface OrchestratorBudgetSpec {
+  /**
+  * Absolute bound in USD. It never REPLACES the fraction bound:
+  * effectiveCap = min(capUsd, (capFraction ?? 0.2) * ceiling), so an
+  * explicit capUsd larger than the default fraction of the run ceiling
+  * is still cut to that fraction (and a warn log says so). Pass
+  * capFraction: 1.0 to make capUsd the sole bound.
+  */
   capUsd?: number;
   /** default 0.2; effectiveCap = min of the given bounds */
   capFraction?: number;
@@ -6181,4 +6333,4 @@ interface SandboxBridge {
 }
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, BUDGET_ABORT_REASON, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildIdentityInput, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINISH_SCHEMA, FINISH_TOOL_NAME, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_DEPTH_CEILING, MatchResult, McpConfig, MechanicalGateProfile, MechanicalGateVerdict, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RandIdentityInput, RandPayload, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStatus, RuntimeEventSink, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateSchemaSpec, validateTerminationLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, AgentOpts, AgentProfile, AgentProfilePermissions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, BUDGET_ABORT_REASON, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildIdentityInput, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DerivedKey, DeriverRegistry, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINISH_SCHEMA, FINISH_TOOL_NAME, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, InvocationRole, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_DEPTH_CEILING, MatchResult, McpConfig, MechanicalGateProfile, MechanicalGateVerdict, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateOptions, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, type ProviderAdapter, QualityFloors, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RandIdentityInput, RandPayload, RefEntryAppender, RefEntryClassification, RefusalInfo, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStatus, RuntimeEventSink, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, atCompactionThreshold, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hashWorkflowBody, hashWorkflowSource, identityJcs, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, mergeUsageLimits, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, readTerminationInit, registryKeyRing, remeasureQueue, replayDisposition, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, validateEditorialCommit, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateSchemaSpec, validateTerminationLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/dist/index.js

@@ -5054,6 +5054,8 @@ var JournalMatcher = class {
 	byScope = /* @__PURE__ */ new Map();
 	all = [];
 	consumed = /* @__PURE__ */ new Set();
+	/** Suspension seqs holding at least one resolution ref-entry. */
+	resolvedRefs = /* @__PURE__ */ new Set();
 	keyRing;
 	disposition;
 	aliasDisposition;
@@ -5069,7 +5071,10 @@ var JournalMatcher = class {
 		this.disposition = options?.disposition ?? roundOneDisposition;
 		const terminalsByRef = /* @__PURE__ */ new Map();
 		for (const entry of entries) {
-			if (REF_ENTRY_KINDS.has(entry.kind)) continue;
+			if (REF_ENTRY_KINDS.has(entry.kind)) {
+				if (entry.kind === "resolution" && entry.ref !== void 0) this.resolvedRefs.add(entry.ref);
+				continue;
+			}
 			if (entry.ref !== void 0) terminalsByRef.set(entry.ref, entry);
 		}
 		for (const entry of entries) {
@@ -5246,7 +5251,12 @@ var JournalMatcher = class {
 			misses: this.missesInternal,
 			skipped: this.skippedInternal,
 			reruns: this.rerunsInternal,
-			orphaned: this.all.filter((op) => !this.consumed.has(op.running.seq)).map((op) => op.running.seq)
+			orphaned: this.all.filter((op) => {
+				if (this.consumed.has(op.running.seq) || op.terminal !== void 0) return false;
+				if (op.running.status === "running") return true;
+				if (op.running.status === "suspended") return !this.resolvedRefs.has(op.running.seq);
+				return false;
+			}).map((op) => op.running.seq)
 		};
 	}
 };
@@ -5484,6 +5494,7 @@ var Replayer = class {
 			if (patch.usageApprox !== void 0) entry.usageApprox = patch.usageApprox;
 			if (patch.servedBy !== void 0) entry.servedBy = patch.servedBy;
 			if (patch.usageByModel !== void 0) entry.usageByModel = patch.usageByModel;
+			if (patch.costAttribution !== void 0) entry.costAttribution = patch.costAttribution;
 			if (patch.transcriptRef !== void 0) entry.transcriptRef = patch.transcriptRef;
 			if (patch.checkpointRef !== void 0) entry.checkpointRef = patch.checkpointRef;
 			if (patch.artifacts !== void 0) entry.artifacts = toJournalValue(patch.artifacts, "terminal artifacts");
@@ -6147,19 +6158,28 @@ var FileTranscriptStore = class {
 //#endregion
 //#region src/engine/cost-report.ts
 /**
-* CostReport builders (M5-T03). Two
-* sources, one shape:
+* CostReport builders (M5-T03; follow-up: one pure fold).
+*
+* `costReportFromJournal` is THE report: a pure fold over terminal
+* entries that both the engine's settle path and stored-run inspection
+* (shells, `rulvar inspect`) use, so a replayed run reports the same
+* numbers byte for byte. Terminal entries carry their attribution facts
+* (`costAttribution`: phase, agent type, primary role, budget account,
+* finalize-reserve flag) exactly so this fold can reproduce every
+* breakdown without live state; entries written before the facts
+* shipped fold under the documented fallbacks (empty phase, 'unknown'
+* agent type, role 'loop').
 *
-* - `buildCostReport` folds the LIVE per-run attribution buckets (ctx
-*   accumulates byModel/byPhase/byAgentType/byRole per call) around the
-*   ledger-fold total, so report totals equal the budget ledger fold
-*   totals exactly at settle.
-* - `costReportFromJournal` is the pure journal fold for STORED runs
-*   (shells, `rulvar inspect`): terminal usage priced per servedBy with
-*   abandoned subtrees contributing zero, exactly like the kernel's
-*   ledger fold. Phase, agentType, and role attribution are live-run
-*   facts that entries do not carry, so those buckets are empty here;
-*   byRole and the orchestrator block complete in M7 (DEF-7).
+* Inclusion policy, applied to the total and EVERY breakdown alike:
+* terminal usage exactly once, priced per serving slice, entries under
+* abandoned subtrees contribute zero (their spend is tracked separately
+* in the abandoned-spend ledger the orchestrator sees). Attempts that
+* were paid but never abandoned (a cancelled root attempt, a dangling
+* child) are real spend and stay included everywhere.
+*
+* `buildCostReport` folds the LIVE per-run attribution buckets around
+* the ledger total; it remains for hosts that accumulated their own
+* `CostAttribution`, but the engine no longer builds outcomes from it.
 *
 * Unpriced models surface in `unpriced`, never as a silent zero.
 */
@@ -6174,14 +6194,9 @@ const ROLES = [
 function emptyByRole() {
 	return Object.fromEntries(ROLES.map((role) => [role, 0]));
 }
-function zeroOrchestrator() {
-	return {
-		spentUsd: 0,
-		share: 0,
-		wakes: 0,
-		forcedFinish: false,
-		reserveUsedUsd: 0
-	};
+/** The orchestrator sub-account naming rule of makeOrchestratorWorkflow. */
+function isOrchestratorAccount(scope) {
+	return scope === "orchestrator" || scope.endsWith("/orchestrator");
 }
 /** Folds the per-run attribution buckets into the normative CostReport. */
 function buildCostReport(attribution, totalUsd) {
@@ -6207,16 +6222,30 @@ function buildCostReport(attribution, totalUsd) {
 	};
 }
 /**
-* The pure journal fold: byModel and totals from terminal entries, the
-* same summation the kernel ledger uses (terminal usage exactly once,
-* priced per servedBy, abandoned subtrees contribute zero).
+* The pure journal fold: the complete CostReport from terminal entries,
+* the same summation the kernel ledger uses (terminal usage exactly
+* once, priced per servedBy slice, abandoned subtrees contribute zero).
+* The orchestrator block folds too: spend attributed to the
+* orchestrator sub-account, the reserve-funded share of it, the armed
+* wake count, and the at-cap freeze flag from the journaled cap
+* decision, so a replay-only resume reproduces the block instead of
+* reading this process's live accounts (which a replay never charges).
 */
 function costReportFromJournal(entries, priceUsd) {
 	const abandonFold = buildAbandonFold(entries);
 	const byModel = {};
+	const byPhase = {};
+	const byAgentType = {};
+	const byRole = emptyByRole();
 	const unpriced = [];
 	let totalUsd = 0;
+	let orchestratorSpentUsd = 0;
+	let reserveUsedUsd = 0;
+	let wakes = 0;
+	let forcedFinish = false;
 	for (const entry of entries) {
+		if (entry.kind === "decision" && entry.value?.decisionType === "orchestrator_budget_cap") forcedFinish = true;
+		if (entry.kind === "external" && entry.status === "suspended" && typeof entry.value?.key === "string" && (entry.value.key.startsWith("wake:") || entry.value.key.includes(":wake:"))) wakes += 1;
 		if (entry.kind !== "resolution" && entry.kind !== "abandon" && abandonFold.isAbandoned(entry.ref ?? entry.seq)) continue;
 		if (entry.status === "running" || entry.usage === void 0) continue;
 		const priced = priceEntryUsage(entry, priceUsd);
@@ -6226,14 +6255,30 @@ function costReportFromJournal(entries, priceUsd) {
 		});
 		for (const slice of priced.priced) byModel[slice.servedBy] = (byModel[slice.servedBy] ?? 0) + slice.usd;
 		totalUsd += priced.usd;
+		const facts = entry.costAttribution;
+		const phase = facts?.phase ?? "";
+		byPhase[phase] = (byPhase[phase] ?? 0) + priced.usd;
+		const agentType = facts?.agentType ?? "unknown";
+		byAgentType[agentType] = (byAgentType[agentType] ?? 0) + priced.usd;
+		byRole[facts?.role ?? "loop"] += priced.usd;
+		if (facts?.budgetAccount !== void 0 && isOrchestratorAccount(facts.budgetAccount)) {
+			orchestratorSpentUsd += priced.usd;
+			if (facts.finalizeReserve === true) reserveUsedUsd += priced.usd;
+		}
 	}
 	return {
 		totalUsd,
 		byModel,
-		byPhase: {},
-		byAgentType: {},
-		byRole: emptyByRole(),
-		orchestrator: zeroOrchestrator(),
+		byPhase,
+		byAgentType,
+		byRole,
+		orchestrator: {
+			spentUsd: orchestratorSpentUsd,
+			share: orchestratorSpentUsd / Math.max(totalUsd, .01),
+			wakes,
+			forcedFinish,
+			reserveUsedUsd
+		},
 		unpriced
 	};
 }
@@ -7250,7 +7295,7 @@ var NoProgressDetector = class {
 		return this.streakInternal >= this.threshold;
 	}
 	describe() {
-		return `no-progress abort after ${this.streakInternal} consecutive turns without tool calls or artifact deltas (threshold ${this.threshold}; docs/06 Appendix A)`;
+		return `no-progress abort after ${this.streakInternal} consecutive turns without tool calls or artifact deltas (threshold ${this.threshold}; https://docs.rulvar.com/guide/agents#the-agent-loop-and-turns)`;
 	}
 };
 //#endregion
@@ -8510,6 +8555,28 @@ async function runAgent(options) {
 			await saveBoundary();
 			continue loop;
 		}
+		if (options.terminalTool !== void 0) {
+			noProgress.recordTurn({ toolCalls: 0 });
+			if (noProgress.tripped) {
+				status = "limit";
+				abortClass = "no-progress";
+				agentError = {
+					kind: "terminal",
+					retryable: false
+				};
+				errorMessage = noProgress.describe();
+				break;
+			}
+			messages.push({
+				role: "user",
+				parts: [{
+					type: "text",
+					text: outcome.finish?.reason === "max-tokens" ? `The turn was cut at the output token limit before any tool call. Be brief and call the '${options.terminalTool.name}' tool now; plain text is not a valid completion.` : `The turn ended without a tool call. Call the '${options.terminalTool.name}' tool to complete; plain text is not a valid completion.`
+				}]
+			});
+			await saveBoundary();
+			continue loop;
+		}
 		if (options.schema === void 0) {
 			output = outcome.turn.text;
 			break;
@@ -8942,8 +9009,43 @@ var RunBudget = class {
 			controller: new AbortController()
 		};
 		if (options.ceilingUsd !== void 0) account.ceilingUsd = options.ceilingUsd;
+		if (options.kind !== void 0) account.kind = options.kind;
 		this.accounts.set(scope, account);
 	}
+	/**
+	* The diagnostic projection behind a ceiling error: the first CLOSED
+	* account (projected commitments included, exactly the layer-1
+	* closure test) walking from `scope` toward the root, plus the root
+	* state. 'run budget ceiling reached' under a healthy root misled the
+	* v1.6.0 follow-up review's live probe when only a 0.18 USD
+	* orchestrator cap had crossed under a 0.90 USD root; the message can
+	* now name the account that actually ended the work. An unknown scope
+	* degrades to root-only diagnostics instead of throwing: this runs on
+	* the error path.
+	*/
+	exhaustionDiagnostics(scope) {
+		let chain;
+		try {
+			chain = this.chainOf(scope);
+		} catch {
+			chain = [this.root];
+		}
+		const crossed = chain.find((account) => account.ceilingUsd !== void 0 && account.spentUsd + account.committedReserveUsd + account.finalizeReserveUsd >= account.ceilingUsd);
+		const root = this.root;
+		const diagnostics = { root: {
+			spentUsd: root.spentUsd,
+			...root.ceilingUsd === void 0 ? {} : { ceilingUsd: root.ceilingUsd }
+		} };
+		if (crossed?.ceilingUsd !== void 0) diagnostics.crossed = {
+			scope: crossed.scope,
+			source: crossed.scope === "run" ? "root" : crossed.kind === "orchestrator-cap" ? "orchestrator-cap" : "child-account",
+			ceilingUsd: crossed.ceilingUsd,
+			spentUsd: crossed.spentUsd,
+			committedReserveUsd: crossed.committedReserveUsd,
+			finalizeReserveUsd: crossed.finalizeReserveUsd
+		};
+		return diagnostics;
+	}
 	accountView(scope) {
 		const account = this.accounts.get(scope);
 		if (account === void 0) return;
@@ -8967,6 +9069,26 @@ var RunBudget = class {
 		if (account?.ceilingUsd === void 0) return;
 		return Math.max(0, account.ceilingUsd - account.spentUsd - account.committedReserveUsd - account.finalizeReserveUsd);
 	}
+	/**
+	* The tightest allowance headroom on the chain of `scope`: the minimum
+	* remainder across 'child-allowance' accounts. An allowance ceiling
+	* bounds the child's LIFETIME spend, so projected admission must never
+	* hold more than this against the chain (the layer-2 mirror lives in
+	* the orchestrator admission's childCeiling clamp): a reserve above
+	* the allowance would deny work that the allowance itself already
+	* bounds. Undefined when no allowance account is on the chain; the
+	* clamp never applies to the run root or an orchestrator cap, whose
+	* headroom is shared money that projected admission must protect.
+	*/
+	allowanceHeadroomOf(scope) {
+		let headroom;
+		for (const account of this.chainOf(scope)) {
+			if (account.kind !== "child-allowance" || account.ceilingUsd === void 0) continue;
+			const remainder = Math.max(0, account.ceilingUsd - account.spentUsd - account.committedReserveUsd - account.finalizeReserveUsd);
+			headroom = headroom === void 0 ? remainder : Math.min(headroom, remainder);
+		}
+		return headroom;
+	}
 	/** Layer 3 ceiling signal of the run root; live streams sever through it. */
 	get signal() {
 		return this.root.controller.signal;
@@ -9324,6 +9446,20 @@ var AdmissionController = class {
 	* journaled by the caller so replay re-delivers it without
 	* re-evaluation.
 	*/
+	/**
+	* The reserve the DISPATCH layer will actually commit for this spec:
+	* the estimate (or the flat default) clamped by the explicit child
+	* budget when one exists, because only an explicit budget opens a
+	* child-allowance account at dispatch; the childBudgetFraction cap
+	* never materializes as an account and must not shrink the
+	* projection. The token-count-priced estimate of ctx.agent is
+	* unreachable here (async); a divergence there lands as a journaled
+	* dispatch rejection instead of a strand.
+	*/
+	projectedDispatchReserveUsd(spec) {
+		const base = spec.estCostUsd ?? this.flatReserveUsd;
+		return spec.budgetUsd === void 0 ? base : Math.min(base, spec.budgetUsd);
+	}
 	admit(spec, options) {
 		const commitReserve = options?.commitReserve ?? true;
 		const nodeKey = spec.nodeKey ?? spec.parentAccountScope;
@@ -9410,7 +9546,8 @@ var AdmissionController = class {
 		}
 		else {
 			const remainder = this.budget.remainderOf(spec.parentAccountScope);
-			if (remainder !== void 0 && remainder <= 0) return {
+			const projection = this.projectedDispatchReserveUsd(spec);
+			if (remainder !== void 0 && (remainder <= 0 || remainder < projection + (spec.pendingReserveUsd ?? 0))) return {
 				verdict: {
 					kind: "reject",
 					reason: { code: "budget" }
@@ -9791,6 +9928,13 @@ const kTerminalTool = Symbol("rulvar.terminalTool");
 * graft boot). Dangling redispatch checkpoints take precedence.
 */
 const kBootCheckpoint = Symbol("rulvar.bootCheckpoint");
+/**
+* Internal AgentOpts channel: marks the orchestrator forced-finish
+* dispatch, whose spend draws from the released finalize reserve
+* (DEF-7). Settlement stamps the flag into the terminal's cost
+* attribution so the journal fold reproduces reserveUsedUsd.
+*/
+const kFinalizeReserve = Symbol("rulvar.finalizeReserve");
 /** Typed accessor used by the in-package consumers. */
 function runtimeOf(ctx) {
 	const runtime = ctxRuntimes.get(ctx);
@@ -10386,7 +10530,8 @@ function createCtx(internals, rootWorkflow) {
 		if (internals.flatReserveUsd !== void 0) reserveOptions.flatReserveUsd = internals.flatReserveUsd;
 		const reserve = internals.pricingOf !== void 0 && internals.pricingOf(loopResolved.ref) === void 0 && opts.estCost === void 0 && profile?.estCost === void 0 ? 0 : admissionReserveUsd(reserveOptions);
 		const budgetAccount = state.budgetScope ?? "run";
-		internals.budget.admitSpawn(reserve, budgetAccount);
+		const allowanceHeadroomUsd = internals.budget.allowanceHeadroomOf(budgetAccount);
+		internals.budget.admitSpawn(allowanceHeadroomUsd === void 0 ? reserve : Math.min(reserve, allowanceHeadroomUsd), budgetAccount);
 		let acquired;
 		if (typeof isolation === "object" && isolation.kind === "worktree") {
 			const acquireInput = {
@@ -10653,6 +10798,13 @@ function createCtx(internals, rootWorkflow) {
 			usage: result.usage,
 			servedBy: result.servedBy,
 			...result.usageByModel === void 0 ? {} : { usageByModel: result.usageByModel },
+			costAttribution: {
+				...state.phase === void 0 ? {} : { phase: state.phase },
+				agentType,
+				role: primaryRole,
+				budgetAccount: state.budgetScope ?? "run",
+				...opts[kFinalizeReserve] === true ? { finalizeReserve: true } : {}
+			},
 			transcriptRef: result.transcriptRef
 		};
 		if (result.status === "escalated" && result.escalation !== void 0) terminalPatch.escalation = result.escalation;
@@ -10720,10 +10872,25 @@ function createCtx(internals, rootWorkflow) {
 		bump(internals.cost.byPhase, state.phase ?? "", usd);
 		bump(internals.cost.byAgentType, agentType, usd);
 		internals.cost.byRole.set(primaryRole, (internals.cost.byRole.get(primaryRole) ?? 0) + usd);
-		if (result.error?.kind === "budget" || internals.budget.exhausted && result.status !== "ok") throw new BudgetExhaustedError("run budget ceiling reached during agent execution", { data: {
-			scope: state.scope,
-			entryRef: terminal.seq
-		} });
+		if (result.error?.kind === "budget" || internals.budget.exhausted && result.status !== "ok") {
+			const diagnostics = internals.budget.exhaustionDiagnostics(state.budgetScope ?? "run");
+			const crossed = diagnostics.crossed;
+			const rootSuffix = `run root: spent ${diagnostics.root.spentUsd.toFixed(4)}` + (diagnostics.root.ceilingUsd === void 0 ? " USD, no ceiling" : ` of ${diagnostics.root.ceilingUsd.toFixed(4)} USD`);
+			throw new BudgetExhaustedError(crossed === void 0 || crossed.source === "root" ? "run budget ceiling reached during agent execution" : (crossed.source === "orchestrator-cap" ? "orchestrator budget cap reached during agent execution" : "budget sub-account ceiling reached during agent execution") + ` (account '${crossed.scope}': spent ${crossed.spentUsd.toFixed(4)}` + (crossed.committedReserveUsd + crossed.finalizeReserveUsd > 0 ? ` plus ${(crossed.committedReserveUsd + crossed.finalizeReserveUsd).toFixed(4)} reserved` : "") + ` of ${crossed.ceilingUsd.toFixed(4)} USD; ${rootSuffix})`, { data: {
+				scope: state.scope,
+				entryRef: terminal.seq,
+				source: crossed?.source ?? "root",
+				rootSpentUsd: diagnostics.root.spentUsd,
+				...diagnostics.root.ceilingUsd === void 0 ? {} : { rootCeilingUsd: diagnostics.root.ceilingUsd },
+				...crossed === void 0 ? {} : {
+					crossedScope: crossed.scope,
+					crossedCeilingUsd: crossed.ceilingUsd,
+					crossedSpentUsd: crossed.spentUsd,
+					crossedCommittedReserveUsd: crossed.committedReserveUsd,
+					crossedFinalizeReserveUsd: crossed.finalizeReserveUsd
+				}
+			} });
+		}
 		if (opts.fallback !== void 0) {
 			const trigger = fallbackTriggerOf(result);
 			if (trigger !== void 0 && opts.fallback.on.includes(trigger)) return runFallbackAttempt(running.seq, trigger, spanId);
@@ -11008,7 +11175,10 @@ function createCtx(internals, rootWorkflow) {
 		if (verdict.kind !== "admit") throw new ConfigError(`admission verdict '${verdict.kind}' has no producer before M7 (DEF-5)`);
 		const reserve = verdict.reserve;
 		const openOptions = { parentScope: budgetAccount };
-		if (reserve.childCeilingUsd !== void 0) openOptions.ceilingUsd = reserve.childCeilingUsd;
+		if (reserve.childCeilingUsd !== void 0) {
+			openOptions.ceilingUsd = reserve.childCeilingUsd;
+			openOptions.kind = "child-allowance";
+		}
 		internals.budget.openAccount(childScope, openOptions);
 		const running = danglingRunning ?? await internals.replayer.appendRunning({
 			scope: state.scope,
@@ -11298,6 +11468,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 		const cardText = declaredLadderNames.length === 0 ? profileCard(advertisedProfiles) : `${profileCard(spawnableProfiles)}\nDeclared ladders (tier context for the knowledge card; NOT agentType values, never spawn them): ${declaredLadderNames.join(", ")}.`;
 		const extension = opts?.extension;
 		let orchestratorAccount;
+		/** DEF-2 cap drift found in the sync prologue; emitted after boot. */
+		const pendingCapDrifts = [];
 		let capState;
 		{
 			const runCeiling = internals.budget.accountView(callingState.budgetScope ?? "run")?.ceilingUsd;
@@ -11306,17 +11478,56 @@ function makeOrchestratorWorkflow(goal, opts) {
 			if (fraction > 1) throw new OrchestratorCapConfigError(`capFraction ${String(fraction)} exceeds 1.0 (opting out of the cap is explicit only, up to 1.0 inclusive)`);
 			const fromFraction = runCeiling === void 0 ? void 0 : fraction * runCeiling;
 			const bounds = [spec?.capUsd, fromFraction].filter((bound) => bound !== void 0);
-			if (extension !== void 0 && bounds.length === 0) throw new OrchestratorCapConfigError("the orchestrator cap is unresolvable: the run has no USD ceiling and no explicit budget.capUsd; PlanRunner requires a resolved effectiveCap");
-			if (bounds.length > 0) {
+			const priorReserveDecision = internals.replayer.snapshot().find((entry) => {
+				if (entry.kind !== "decision" || entry.scope !== callingState.scope) return false;
+				return entry.value?.decisionType === "orchestrator_budget_reserve";
+			});
+			if (priorReserveDecision !== void 0) {
+				const frozen = priorReserveDecision.value;
+				const turnEstimateUsd = internals.flatReserveUsd ?? .5;
+				const liveFinalizeReserveUsd = spec?.finalizeReserveUsd ?? (spec?.finalizeTurns ?? 2) * turnEstimateUsd;
+				pendingCapDrifts.push(...bounds.length > 0 && Math.min(...bounds) !== frozen.capUsd ? [{
+					field: "orchestratorCapUsd",
+					frozenValue: frozen.capUsd,
+					liveValue: Math.min(...bounds)
+				}] : [], ...liveFinalizeReserveUsd !== frozen.finalizeReserveUsd ? [{
+					field: "finalizeReserveUsd",
+					frozenValue: frozen.finalizeReserveUsd,
+					liveValue: liveFinalizeReserveUsd
+				}] : []);
+				orchestratorAccount = callingState.scope === "" ? "orchestrator" : `${callingState.scope}/orchestrator`;
+				internals.budget.openAccount(orchestratorAccount, {
+					parentScope: callingState.budgetScope ?? "run",
+					ceilingUsd: frozen.capUsd,
+					kind: "orchestrator-cap"
+				});
+				if (extension !== void 0) internals.budget.commitFinalizeReserve(orchestratorAccount, frozen.finalizeReserveUsd);
+				capState = {
+					effectiveCapUsd: frozen.capUsd,
+					finalizeReserveUsd: frozen.finalizeReserveUsd,
+					finalizeTurns: frozen.finalizeTurns,
+					turnEstimateUsd,
+					atCap: spec?.atCap ?? "finish-with-partial",
+					source: frozen.source
+				};
+			}
+			if (capState === void 0 && extension !== void 0 && bounds.length === 0) throw new OrchestratorCapConfigError("the orchestrator cap is unresolvable: the run has no USD ceiling and no explicit budget.capUsd; PlanRunner requires a resolved effectiveCap");
+			if (capState === void 0 && bounds.length > 0) {
 				const effectiveCapUsd = Math.min(...bounds);
 				const turnEstimateUsd = internals.flatReserveUsd ?? .5;
 				const finalizeTurns = spec?.finalizeTurns ?? 2;
 				const finalizeReserveUsd = spec?.finalizeReserveUsd ?? finalizeTurns * turnEstimateUsd;
 				if (extension !== void 0 && effectiveCapUsd < finalizeReserveUsd) throw new OrchestratorCapConfigError(`effectiveCap ${effectiveCapUsd.toFixed(4)} USD is below the finalize reserve ${finalizeReserveUsd.toFixed(4)} USD`);
+				if (spec?.capUsd !== void 0 && spec.capFraction === void 0 && effectiveCapUsd < spec.capUsd) internals.events.emit({
+					type: "log",
+					level: "warn",
+					msg: `orchestrator budget.capUsd ${spec.capUsd.toFixed(4)} USD is bounded to ${effectiveCapUsd.toFixed(4)} USD by the default capFraction 0.2 of the run ceiling (effectiveCap = min(capUsd, capFraction * ceiling)); pass capFraction: 1.0 to make capUsd the sole bound`
+				}, callingState.spanId);
 				orchestratorAccount = callingState.scope === "" ? "orchestrator" : `${callingState.scope}/orchestrator`;
 				internals.budget.openAccount(orchestratorAccount, {
 					parentScope: callingState.budgetScope ?? "run",
-					ceilingUsd: effectiveCapUsd
+					ceilingUsd: effectiveCapUsd,
+					kind: "orchestrator-cap"
 				});
 				if (extension !== void 0) internals.budget.commitFinalizeReserve(orchestratorAccount, finalizeReserveUsd);
 				capState = {
@@ -11332,6 +11543,15 @@ function makeOrchestratorWorkflow(goal, opts) {
 		const records = /* @__PURE__ */ new Map();
 		const byOrdinal = /* @__PURE__ */ new Map();
 		const rejectedByOrdinal = /* @__PURE__ */ new Map();
+		/**
+		* The journaled spec behind each recovered ordinal: the idempotent
+		* re-execution guard compares it against the incoming call, because
+		* after a cross-attempt resume a REGENERATED turn (the boundary
+		* checkpoint predates the lost turn) may decide differently, and
+		* handing it the prior ordinal's handle would bind the transcript
+		* to a stranger's child.
+		*/
+		const recoveredSpecByOrdinal = /* @__PURE__ */ new Map();
 		let nextOrdinal = 0;
 		let orchSeq;
 		const deliveredNodeIds = /* @__PURE__ */ new Set();
@@ -11367,15 +11587,18 @@ function makeOrchestratorWorkflow(goal, opts) {
 			const controller = new AbortController();
 			const upstream = callingState.signal ?? internals.runSignal;
 			const scope = placement?.childScope ?? childScopeOf();
-			if (placement !== void 0) internals.budget.openAccount(scope, {
+			if (placement?.ownAccount === true) internals.budget.openAccount(scope, {
 				parentScope: callingState.budgetScope ?? "run",
-				...placement.childCeilingUsd === void 0 ? {} : { ceilingUsd: placement.childCeilingUsd }
+				...placement.childCeilingUsd === void 0 ? {} : {
+					ceilingUsd: placement.childCeilingUsd,
+					kind: "child-allowance"
+				}
 			});
 			const childState = {
 				scope,
 				spanId: internals.spans.mint(callingState.spanId),
 				signal: upstream === void 0 ? controller.signal : AbortSignal.any([upstream, controller.signal]),
-				budgetScope: placement !== void 0 ? scope : callingState.budgetScope ?? "run"
+				budgetScope: placement?.ownAccount === true ? scope : callingState.budgetScope ?? "run"
 			};
 			let resolveHandle = () => void 0;
 			const handlePromise = new Promise((resolve) => {
@@ -11438,6 +11661,10 @@ function makeOrchestratorWorkflow(goal, opts) {
 			profiles: advertisedProfiles,
 			gates: internals.defaults.gates ?? {},
 			...internals.budget.ceilingUsd === void 0 ? {} : { runCeilingUsd: internals.budget.ceilingUsd },
+			...capState === void 0 ? {} : {
+				orchestratorCapUsd: capState.effectiveCapUsd,
+				finalizeReserveUsd: capState.finalizeReserveUsd
+			},
 			mintId: createCanonicalIdMinter(),
 			random: (key) => runtime.runInScope(callingState, () => Promise.resolve(ctx.random(key))),
 			append: (input) => internals.replayer.appendSinglePhase({
@@ -11457,6 +11684,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 				nextOrdinal += 1;
 				return { handle: (await dispatchChild(spec, spawnOrdinal, identity, {
 					childScope,
+					ownAccount: true,
 					...spec.budgetUsd === void 0 ? {} : { childCeilingUsd: spec.budgetUsd }
 				})).handle };
 			},
@@ -11487,33 +11715,61 @@ function makeOrchestratorWorkflow(goal, opts) {
 				handle
 			};
 		};
-		/** Rebuilds spawn records from the journal (the crash-resume contract). */
+		/**
+		* True when `scope` is a root-attempt scope of THIS orchestration:
+		* agentScope(callingState.scope, n) for some dispatch seq n. Nested
+		* orchestrations live under their own wf: child scopes and never
+		* match a foreign calling scope.
+		*/
+		const scopeOfThisOrchestration = (scope) => {
+			const prefix = callingState.scope === "" ? "" : `${callingState.scope}/`;
+			return scope.startsWith(prefix) && /^agent:\d+$/.test(scope.slice(prefix.length));
+		};
+		/**
+		* Rebuilds spawn records from the journal (the crash-resume
+		* contract). Recovery is ORCHESTRATION-scoped, not attempt-scoped:
+		* decisions journal at the orchestrate call's own scope, which is
+		* stable across root attempts, so a rerun after a cancelled root
+		* (the budget-abort shape the v1.6.0 follow-up review resumed) sees
+		* every prior decision instead of re-deciding and re-paying.
+		* Recovered children re-dispatch PINNED to their journaled child
+		* scope: settled ones forward-match and replay for free, a dangling
+		* one redispatches live (at-least-once), and a decision without a
+		* dispatch entry rolls forward to a fresh dispatch.
+		*/
 		const recover = async () => {
-			const scope = childScopeOf();
+			const currentScope = childScopeOf();
 			const admissions = internals.replayer.snapshot().filter((entry) => {
-				if (entry.kind !== "decision") return false;
+				if (entry.kind !== "decision" || entry.scope !== callingState.scope) return false;
 				const value = entry.value;
-				return value?.decisionType === "spawn-admission" && (value.origin === "spawn_agent" || value.origin === "parallel_agents") && value.orchestratorScope === scope;
+				return value?.decisionType === "spawn-admission" && (value.origin === "spawn_agent" || value.origin === "parallel_agents");
 			}).map((entry) => entry.value).sort((a, b) => a.spawnOrdinal - b.spawnOrdinal);
 			for (const value of admissions) {
 				nextOrdinal = Math.max(nextOrdinal, value.spawnOrdinal + 1);
 				const decision = value.decision;
+				recoveredSpecByOrdinal.set(value.spawnOrdinal, value.spec);
 				if (decision.verdict.kind !== "admit") {
 					rejectedByOrdinal.set(value.spawnOrdinal, decision);
 					continue;
 				}
-				admission.recoverChild(scope);
-				await dispatchChild(value.spec, value.spawnOrdinal, {
+				admission.recoverChild(currentScope);
+				const childScope = value.childScope ?? value.orchestratorScope;
+				const record = await dispatchChild(value.spec, value.spawnOrdinal, {
 					nodeId: decision.nodeId ?? "unknown",
 					logicalTaskId: decision.verdict.lineage.logicalTaskId
-				});
+				}, { childScope });
+				const dispatched = internals.replayer.snapshot().find((entry) => entry.seq === record.handle);
+				if (dispatched !== void 0) {
+					for (const prior of internals.replayer.snapshot()) if (prior.kind === "agent" && prior.status === "running" && prior.seq !== record.handle && prior.scope === dispatched.scope && prior.key === dispatched.key && prior.ordinal === dispatched.ordinal && !records.has(prior.seq)) records.set(prior.seq, record);
+				}
 			}
-			const wakePrefix = `wake:${String(orchSeq ?? -1)}:`;
 			for (const entry of internals.replayer.snapshot()) {
 				if (entry.status !== "suspended" || entry.kind !== "external") continue;
+				if (!scopeOfThisOrchestration(entry.scope)) continue;
 				const payload = entry.value;
-				if (typeof payload?.key !== "string" || !payload.key.startsWith(wakePrefix)) continue;
-				wakeOrdinal = Math.max(wakeOrdinal, Number(payload.key.slice(wakePrefix.length)) + 1);
+				const match = typeof payload?.key === "string" ? /^wake:\d+:(\d+)$/.exec(payload.key) : null;
+				if (match === null) continue;
+				wakeOrdinal = Math.max(wakeOrdinal, Number(match[1]) + 1);
 				const suspension = internals.replayer.suspensionState(entry.seq);
 				if (suspension.state === "resolved") markDelivered(suspension.value);
 			}
@@ -11641,10 +11897,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 				await recoveryDone;
 				const spawnOrdinal = nextOrdinal;
 				nextOrdinal += 1;
+				const priorSpec = recoveredSpecByOrdinal.get(spawnOrdinal);
+				const specMatches = priorSpec === void 0 || priorSpec.agentType === params.agentType && priorSpec.prompt === params.prompt;
 				const recovered = byOrdinal.get(spawnOrdinal);
-				if (recovered !== void 0) return { handle: recovered.handle };
+				if (recovered !== void 0 && specMatches) return { handle: recovered.handle };
 				const recoveredRejection = rejectedByOrdinal.get(spawnOrdinal);
-				if (recoveredRejection !== void 0) throw new AdmissionRejectedError(`admission rejected spawn ordinal ${String(spawnOrdinal)} (recovered verdict)`, { data: { decision: recoveredRejection } });
+				if (recoveredRejection !== void 0 && specMatches) throw new AdmissionRejectedError(`admission rejected spawn ordinal ${String(spawnOrdinal)} (recovered verdict)`, { data: { decision: recoveredRejection } });
 				if (opts?.maxSpawns !== void 0 && spawnOrdinal >= opts.maxSpawns) {
 					internals.events.emit({
 						type: "spawn:rejected",
@@ -11664,6 +11922,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 					parentAccountScope: callingState.budgetScope ?? "run",
 					nodeKey: scope,
 					...params.budgetUsd === void 0 ? {} : { budgetUsd: params.budgetUsd },
+					...profile?.estCost === void 0 ? {} : { estCostUsd: profile.estCost },
 					...params.lineage === void 0 ? {} : { lineage: {
 						continues: params.lineage.continues,
 						causeRef: params.lineage.causeRef,
@@ -11827,6 +12086,12 @@ function makeOrchestratorWorkflow(goal, opts) {
 			}
 		};
 		if (extension?.boot !== void 0) await extension.boot(io);
+		for (const drift of pendingCapDrifts) internals.events.emit({
+			type: "termination:config-drift",
+			field: drift.field,
+			frozenValue: drift.frozenValue,
+			liveValue: drift.liveValue
+		}, callingState.spanId);
 		let kbCardText;
 		const appendKbPin = async (decisionType, key) => {
 			const handle = internals.knowledge;
@@ -11870,7 +12135,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 		}
 		const fullCardText = kbCardText === void 0 ? cardText : `${cardText}\n${kbCardText}`;
 		const reserveKey = deriverV2.deriveKey({ kind: "orchestrator-budget-reserve" });
-		if (extension !== void 0 && capState !== void 0 && !internals.replayer.snapshot().some((entry) => entry.kind === "decision" && entry.key === reserveKey)) {
+		if (extension !== void 0 && capState !== void 0 && !internals.replayer.snapshot().some((entry) => entry.kind === "decision" && entry.scope === callingState.scope && entry.key === reserveKey)) {
 			const initRef = internals.replayer.snapshot().find((entry) => entry.kind === "termination.init")?.seq;
 			await internals.replayer.appendSinglePhase({
 				scope: callingState.scope,
@@ -11902,7 +12167,11 @@ function makeOrchestratorWorkflow(goal, opts) {
 				orchSeq = seq;
 				recover().then(releaseRecovery, releaseRecovery);
 			},
-			[kTerminalTool]: { name: FINISH_TOOL_NAME }
+			[kTerminalTool]: { name: FINISH_TOOL_NAME },
+			...(() => {
+				const priorCancelledRoot = internals.replayer.snapshot().filter((entry) => entry.kind === "agent" && entry.scope === callingState.scope && entry.status === "cancelled" && entry.checkpointRef !== void 0).at(-1);
+				return priorCancelledRoot?.checkpointRef === void 0 ? {} : { [kBootCheckpoint]: priorCancelledRoot.checkpointRef };
+			})()
 		};
 		const orchestratorState = { ...callingState };
 		if (orchestratorAccount !== void 0) orchestratorState.budgetScope = orchestratorAccount;
@@ -11928,7 +12197,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 				limits: { maxTurns: capState?.finalizeTurns ?? 2 },
 				...capState === void 0 ? {} : { estCost: capState.finalizeReserveUsd },
 				...opts?.model === void 0 ? {} : { model: opts.model },
-				[kTerminalTool]: { name: FINISH_TOOL_NAME }
+				[kTerminalTool]: { name: FINISH_TOOL_NAME },
+				[kFinalizeReserve]: true
 			};
 			const finalState = { ...callingState };
 			if (orchestratorAccount !== void 0) finalState.budgetScope = orchestratorAccount;
@@ -12109,14 +12379,20 @@ const detection = new AsyncLocalStorage();
 let globalsPatched = false;
 /**
 * Stack line 0 names the Error, line 1 this helper, line 2 the patched
-* global, line 3 the caller whose provenance decides. Library code (a
-* provider SDK, any installed dependency, rulvar's own published dist)
-* lives under node_modules and is exempt: the guard exists for workflow
-* code, which imports from node_modules but does not live there.
+* global, line 3 the caller whose provenance decides (the layout is
+* pinned by construction: this helper is only ever called by the two
+* patched globals). Two origins are exempt: installed dependencies (a
+* provider SDK, any transitive package, rulvar's own published dist),
+* which live under node_modules, and Node's own machinery (the undici
+* transport behind fetch, timers, stream internals), whose frames carry
+* `node:` specifiers and inherit the run's async context. The guard
+* exists for workflow code, which imports from both but lives in
+* neither.
 */
 function libraryCaller() {
 	const caller = (/* @__PURE__ */ new Error()).stack?.split("\n")[3];
-	return caller !== void 0 && caller.includes("node_modules");
+	if (caller === void 0) return false;
+	return caller.includes("node_modules") || /[(\s]node:/.test(caller);
 }
 /**
 * Patches Date.now and Math.random ONCE per process and never restores:
@@ -12468,7 +12744,7 @@ function createEngine(options) {
 				dropped: internals.dropped,
 				pending,
 				usage: ledger.usage,
-				cost: buildCostReport(internals.cost, ledger.usd)
+				cost: costReportFromJournal(replayer.snapshot(), priceUsd)
 			};
 			if (value !== void 0 && (status === "ok" || status === "exhausted")) outcome.value = value;
 			if (wireError !== void 0) outcome.error = wireError;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",