@rulvar/core 1.61.0 → 1.62.0

package/dist/index.js

@@ -8320,293 +8320,259 @@ function invoiceFromJournal(entries, priceUsd) {
 	};
 }
 //#endregion
-//#region src/engine/run-profiles.ts
+//#region src/model/router.ts
 /**
-* The shipped presets (fast / standard / deep / ultra "and similar").
-* Data only; a review-time assertion checks the
-* engine has zero behavioral branches keyed on these names.
+* Model router core (M1-T05): the per-engine adapter registry, ModelRef
+* parsing, the per-invocation resolution chain, canonicalization into
+* CanonicalModelSpec, and caps scrubbing with visible scrub notes.
+*
+* Public contract: https://docs.rulvar.com/guide/model-routing.
 */
-const RUN_PROFILES = {
-	fast: {
-		effortByRole: {
-			orchestrate: "low",
-			plan: "low",
-			summarize: "low",
-			extract: "low"
-		},
-		perRunConcurrency: 16,
-		permissionPreset: "standard",
-		lifetimeSpawnCap: 64,
-		maxDepth: 1
-	},
-	standard: {
-		effortByRole: {
-			orchestrate: "high",
-			plan: "high",
-			summarize: "low",
-			extract: "low"
-		},
-		perRunConcurrency: 12,
-		permissionPreset: "standard",
-		lifetimeSpawnCap: 500,
-		maxDepth: 1
-	},
-	deep: {
-		effortByRole: {
-			orchestrate: "high",
-			plan: "high",
-			summarize: "medium",
-			extract: "medium"
-		},
-		perRunConcurrency: 8,
-		permissionPreset: "standard",
-		lifetimeSpawnCap: 500,
-		maxDepth: 2
-	},
-	ultra: {
-		effortByRole: {
-			orchestrate: "max",
-			plan: "max",
-			summarize: "high",
-			extract: "high"
-		},
-		perRunConcurrency: 8,
-		permissionPreset: "strict",
-		lifetimeSpawnCap: 500,
-		maxDepth: 3
+/**
+* Per-engine adapter registry: strictly per engine, no global mutable
+* registry exists. A duplicate adapterId is a typed ConfigError.
+*/
+function buildAdapterRegistry(adapters) {
+	const registry = /* @__PURE__ */ new Map();
+	for (const adapter of adapters) {
+		if (registry.has(adapter.id)) throw new ConfigError(`duplicate adapterId '${adapter.id}' at createEngine`);
+		registry.set(adapter.id, adapter);
 	}
-};
-/** Looks up a shipped RunProfile by name; undefined for unknown names. */
-function runProfile(name) {
-	return RUN_PROFILES[name];
+	return registry;
 }
-//#endregion
-//#region src/model/caps.ts
-const TIER_ORDER = {
-	native: 2,
-	"forced-tool": 1,
-	prompt: 0
-};
 /**
-* Strict-schema compatibility as both first-class providers define it:
-* every object node declares `additionalProperties: false` and lists every
-* property in `required`. Boolean schemas and
-* non-object shapes are trivially compatible.
+* ModelRef is strictly 'adapterId:model', no query parameters. The wire
+* model id may itself contain colons (for example ollama tags), so only
+* the FIRST colon splits.
 */
-function isStrictCompatibleSchema(schema) {
-	if (typeof schema === "boolean") return true;
-	if (schema.type === "object" || schema.properties !== void 0 || schema.additionalProperties !== void 0) {
-		if (schema.additionalProperties !== false) return false;
-		const properties = typeof schema.properties === "object" && schema.properties !== null ? schema.properties : {};
-		const required = Array.isArray(schema.required) ? schema.required : [];
-		for (const name of Object.keys(properties)) if (!required.includes(name)) return false;
-		for (const value of Object.values(properties)) if (typeof value === "object" && value !== null || typeof value === "boolean") {
-			if (!isStrictCompatibleSchema(value)) return false;
-		}
-	}
-	for (const key of [
-		"items",
-		"additionalProperties",
-		"contains"
-	]) {
-		const value = schema[key];
-		if (typeof value === "object" && value !== null || typeof value === "boolean") {
-			if (!isStrictCompatibleSchema(value)) return false;
-		}
-	}
-	for (const key of [
-		"allOf",
-		"anyOf",
-		"oneOf",
-		"prefixItems"
-	]) {
-		const value = schema[key];
-		if (Array.isArray(value)) {
-			for (const element of value) if (typeof element === "object" && element !== null || typeof element === "boolean") {
-				if (!isStrictCompatibleSchema(element)) return false;
-			}
-		}
-	}
-	return true;
+function parseModelRef(ref) {
+	const colon = ref.indexOf(":");
+	if (colon <= 0 || colon === ref.length - 1) throw new ConfigError(`invalid ModelRef '${ref}': expected the strict 'adapterId:model' form`);
+	return {
+		adapterId: ref.slice(0, colon),
+		model: ref.slice(colon + 1)
+	};
 }
 /**
-* Tier selection: the model's declared ceiling
-* bounds the tier; the native tier additionally requires a
-* strict-compatible canonical schema (relying on silent server-side
-* fallback is forbidden), degrading to forced-tool.
-* Prefill is not a tier.
+* Role effort defaults: orchestrate and plan default to high; summarize and extract
+* default to low. loop and finalize have NO role default: when the chain
+* resolves nothing, the wire omits effort and identity records the spec
+* with the effort member absent.
 */
-function selectStructuredOutputTier(caps, canonicalSchema) {
-	const ceiling = caps.structuredOutput;
-	if (ceiling === "native" && !isStrictCompatibleSchema(canonicalSchema)) return "forced-tool";
-	return ceiling;
+const ROLE_EFFORT_DEFAULTS = {
+	orchestrate: "high",
+	plan: "high",
+	summarize: "low",
+	extract: "low"
+};
+function contribution(spec, _role) {
+	if (spec === void 0) return {};
+	if (typeof spec === "string") return { model: spec };
+	if ("ladder" in spec) return { ladder: spec.ladder };
+	const choice = spec;
+	const fields = { model: choice.model };
+	if (choice.effort !== void 0) fields.effort = choice.effort;
+	if (choice.providerOptions !== void 0) fields.providerOptions = choice.providerOptions;
+	if (choice.fallbacks !== void 0) fields.fallbacks = choice.fallbacks;
+	return fields;
 }
-/** True when `tier` is at or below the model's declared ceiling. */
-function tierWithinCaps(tier, caps) {
-	return TIER_ORDER[tier] <= TIER_ORDER[caps.structuredOutput];
+function layerFields(layer, role) {
+	if (layer === void 0) return {};
+	const fromModel = contribution(layer.model, role);
+	const fromRouting = contribution(layer.routing?.[role], role);
+	const merged = {
+		...fromModel,
+		...pruneUndefined(fromRouting)
+	};
+	if (layer.effort !== void 0) merged.effort = layer.effort;
+	return merged;
 }
-//#endregion
-//#region src/engine/scheduler.ts
+function pruneUndefined(value) {
+	const out = {};
+	for (const [key, member] of Object.entries(value)) if (member !== void 0) out[key] = member;
+	return out;
+}
+function mergeProviderOptions(lower, higher) {
+	if (lower === void 0) return higher;
+	if (higher === void 0) return lower;
+	const merged = { ...lower };
+	for (const [namespace, options] of Object.entries(higher)) merged[namespace] = {
+		...merged[namespace],
+		...options
+	};
+	return merged;
+}
+/** Sampling parameters both first-class providers reject on reasoning models. */
+const SAMPLING_KEYS = [
+	"temperature",
+	"top_p",
+	"top_k"
+];
 /**
-* Scheduler and concurrency (M1-T08): the per-run semaphore with a FIFO
-* queue (default 12 concurrent model calls). The engine lifetime spawn cap
-* is enforced by the budget layer at admission; parallel/pipeline
-* composition semantics live with ctx.
-* Per-provider concurrency keys land with M4.
+* Resolution runs on every model invocation, not once per agent: a layered
+* merge of { model, effort, providerOptions, fallbacks } in the order call
+* override > agent profile > workflow defaults > engine defaults, with the
+* invocation role attached as a tag.
+* After resolution the router reads ModelCaps and scrubs illegal
+* parameters visibly: unsupported effort is removed from the wire but
+* kept in identity; sampling params rejected by the model are removed
+* from the adapter's namespace, never silently sent.
 */
-/** FIFO semaphore; default per-run width is 12. */
-const DEFAULT_PER_RUN_CONCURRENCY = 12;
-var Semaphore = class {
-	limit;
-	active = 0;
-	waiters = [];
-	/**
-	* `limit` must be a positive integer: anything else (NaN included) is
-	* a typed ConfigError. Before this gate a NaN limit made
-	* `active < limit` permanently false, so the first acquire queued
-	* forever and the run could not settle, not even through cancel()
-	* (v1.34.0 review P2-4). Unlimited is expressed by not constructing a
-	* semaphore, never by a sentinel limit.
-	*/
-	constructor(limit) {
-		requirePositiveInteger(limit, "Semaphore limit");
-		this.limit = limit;
-	}
-	get pending() {
-		return this.waiters.length;
+function resolveModelInvocation(options) {
+	const { role } = options;
+	const layers = [
+		options.engine,
+		options.workflow,
+		options.profile,
+		options.call
+	];
+	let merged = {};
+	for (const layer of layers) {
+		const fields = layerFields(layer, role);
+		merged = {
+			...merged,
+			...pruneUndefined(fields),
+			providerOptions: mergeProviderOptions(merged.providerOptions, fields.providerOptions)
+		};
+		if (fields.ladder !== void 0) delete merged.model;
+		else if (fields.model !== void 0) delete merged.ladder;
 	}
-	/**
-	* Acquires a slot, resolving in FIFO order. `onQueued` fires only when
-	* the caller actually has to wait (feeds the agent:queued event).
-	* An aborted `signal` releases the caller from the queue without a
-	* slot: the returned release is a no-op, the remaining waiters keep
-	* their FIFO positions, and the caller proceeds to observe its own
-	* aborted signal (the model layers refuse dispatch under an aborted
-	* signal, so no provider call follows). Cancellation can therefore
-	* always drain a queued run (v1.34.0 review P2-4).
-	*/
-	async acquire(onQueued, signal) {
-		if (this.active < this.limit) {
-			this.active += 1;
-			return () => this.release();
-		}
-		if (signal?.aborted === true) return () => void 0;
-		onQueued?.();
-		const waiter = {
-			resolve: () => void 0,
-			aborted: false
-		};
-		const wait = new Promise((resolve) => {
-			waiter.resolve = resolve;
+	if (merged.ladder !== void 0) throw new ConfigError(`a ladder ModelSpec wins wire resolution for role '${role}': ladder execution is owned by the PlanRunner ladder driver, which resolves each rung attempt to a concrete model override; dispatch laddered profiles through orchestratePlanned or pass a plain ModelRef or ModelChoice`);
+	if (merged.model === void 0) throw new ConfigError(`no model resolves for role '${role}': set AgentOpts.model, a profile model, or engine defaults.routing`);
+	checkFloors({
+		ref: merged.model,
+		role,
+		...options.floors === void 0 ? {} : { floors: options.floors },
+		...options.taskClass === void 0 ? {} : { taskClass: options.taskClass }
+	});
+	const requestedEffort = merged.effort ?? ROLE_EFFORT_DEFAULTS[role];
+	const { adapterId, model } = parseModelRef(merged.model);
+	let caps;
+	try {
+		caps = options.capsOf(merged.model);
+	} catch (thrown) {
+		if (thrown instanceof ConfigError) throw new ConfigError(`role '${role}': ${thrown.message}`);
+		throw thrown;
+	}
+	const scrubs = [];
+	let wireEffort = requestedEffort;
+	if (wireEffort !== void 0 && !caps.reasoningEfforts.includes(wireEffort)) {
+		scrubs.push({
+			scrubbed: "effort",
+			model: merged.model,
+			detail: `effort '${wireEffort}' is not in caps.reasoningEfforts for ${merged.model}; the request proceeds without it (identity keeps the requested effort)`
 		});
-		this.waiters.push(waiter);
-		let onAbort;
-		if (signal !== void 0) {
-			onAbort = () => {
-				const index = this.waiters.indexOf(waiter);
-				if (index === -1) return;
-				this.waiters.splice(index, 1);
-				waiter.aborted = true;
-				waiter.resolve();
-			};
-			signal.addEventListener("abort", onAbort, { once: true });
-		}
-		try {
-			await wait;
-		} finally {
-			if (signal !== void 0 && onAbort !== void 0) signal.removeEventListener("abort", onAbort);
-		}
-		if (waiter.aborted) return () => void 0;
-		this.active += 1;
-		return () => this.release();
+		wireEffort = void 0;
 	}
-	async withSlot(fn, onQueued, signal) {
-		const release = await this.acquire(onQueued, signal);
-		try {
-			return await fn();
-		} finally {
-			release();
+	let providerOptions = merged.providerOptions;
+	if (providerOptions?.[adapterId] !== void 0 && !caps.supportsTemperature) {
+		const namespace = { ...providerOptions[adapterId] };
+		const removed = SAMPLING_KEYS.filter((key) => key in namespace);
+		if (removed.length > 0) {
+			for (const key of removed) delete namespace[key];
+			providerOptions = {
+				...providerOptions,
+				[adapterId]: namespace
+			};
+			scrubs.push({
+				scrubbed: "sampling",
+				model: merged.model,
+				detail: `sampling parameter(s) ${removed.join(", ")} removed for ${merged.model}: the model rejects them (caps.supportsTemperature is false); never silently sent`
+			});
 		}
 	}
-	release() {
-		this.active -= 1;
-		const next = this.waiters.shift();
-		if (next !== void 0) next.resolve();
-	}
-};
-//#endregion
-//#region src/model/concurrency.ts
-/**
-* Per-provider concurrency keys (M4-T07): a keyed limiter beside the
-* router, ENGINE-scoped (keys constrain calls
-* across a single engine per adapter). The Appendix A default is
-* unlimited: an embeddable library must not surprise-throttle hosts, so
-* the per-run semaphore stays the only default bound and provider 429s
-* ride RetryPolicy; hosts with known tier limits opt in per adapter id
-* via createEngine concurrency.perProvider.
-*
-* This keyed limiter bounds PARALLELISM inside one engine only. Two
-* processes sharing one API key coordinate through the QuotaLimiter
-* SPI instead (RV-215, createEngine `quota`): rate and volume live
-* there, in shared storage; in-flight slots live here.
-*/
-var KeyedLimiter = class {
-	semaphores = /* @__PURE__ */ new Map();
-	constructor(caps) {
-		for (const [key, limit] of Object.entries(caps ?? {})) this.semaphores.set(key, new Semaphore(limit));
-	}
-	/** Queue depth for one key (0 for unlimited keys); telemetry only. */
-	pending(key) {
-		return this.semaphores.get(key)?.pending ?? 0;
+	const canonical = requestedEffort === void 0 ? {
+		kind: "model",
+		model: merged.model
+	} : {
+		kind: "model",
+		model: merged.model,
+		effort: requestedEffort
+	};
+	const resolved = {
+		ref: merged.model,
+		adapterId,
+		model,
+		canonical,
+		scrubs
+	};
+	if (wireEffort !== void 0) resolved.wireEffort = wireEffort;
+	if (requestedEffort !== void 0) resolved.requestedEffort = requestedEffort;
+	if (providerOptions !== void 0) resolved.providerOptions = providerOptions;
+	if (merged.fallbacks !== void 0) resolved.fallbacks = merged.fallbacks;
+	return resolved;
+}
+/** The closed trigger vocabulary guard. */
+const TRIGGER_CLASSES = [
+	"error",
+	"limit",
+	"schema-exhausted",
+	"verify-failed",
+	"no-progress"
+];
+function validateGate(gate, rungCount, index) {
+	if (gate.kind === "mechanical") {
+		if (typeof gate.profile !== "string" || gate.profile === "") throw new ConfigError(`ladder acceptance gate ${String(index)}: a mechanical gate names a registered gate profile`);
+		return;
 	}
-	/**
-	* Runs `fn` under the key's semaphore; keys without a configured cap
-	* run unlimited (no queueing, no overhead). An aborted `signal` frees
-	* a queued caller without a slot (the Semaphore contract), so run
-	* cancellation drains provider queues too (v1.34.0 review P2-4).
-	*/
-	async withSlot(key, fn, onQueued, signal) {
-		const semaphore = this.semaphores.get(key);
-		if (semaphore === void 0) return fn();
-		return semaphore.withSlot(fn, onQueued, signal);
+	if (gate.kind === "judge") {
+		if (typeof gate.rung === "number") {
+			if (!Number.isInteger(gate.rung) || gate.rung < 0 || gate.rung >= rungCount) throw new ConfigError(`ladder acceptance gate ${String(index)}: judge rung ${String(gate.rung)} is not a declared rung of a ${String(rungCount)}-rung ladder (FR-119)`);
+			return;
+		}
+		parseModelRef(gate.rung);
+		return;
 	}
-};
-//#endregion
-//#region src/model/failover.ts
-/** Normalizes the author-facing ModelChoice.fallbacks list. */
-function normalizeFallbacks(refs) {
-	return (refs ?? []).map((model) => ({ model }));
-}
-/**
-* Maps a retry class to its failover trigger once retries exhaust.
-* Overloaded (529) is transport-class for failover purposes; a
-* non-retryable error never fails over.
-*/
-function failoverTriggerOf(retryClass) {
-	if (retryClass === void 0) return;
-	return retryClass === "rate-limit" ? "rate-limit" : "transport";
+	if (!(gate.fraction > 0 && gate.fraction <= 1)) throw new ConfigError(`ladder acceptance gate ${String(index)}: a spot-check fraction lies in (0, 1], got ${String(gate.fraction)}`);
 }
 /**
-* The next target index past `from` that serves `trigger`, or undefined
-* when the chain is exhausted. Index 0 is the primary; the chain never
-* moves backwards (sticky failover).
+* Canonicalizes a declared LadderSpec: validates the
+* shape once (FR-119 judge declaration included) and resolves every rung's
+* effort to an explicit value. `chainEffort` is the effort the resolution
+* chain would contribute at the declaring layer; a rung that resolves no
+* effort at all is a ConfigError (the canonical form has no absent-effort
+* member by declaration).
 */
-function nextFailover(targets, trigger, from) {
-	for (let index = from + 1; index < targets.length; index += 1) {
-		const on = targets[index]?.on;
-		if (on === void 0 || on.includes(trigger)) return index;
-	}
+function canonicalizeLadder(spec, options) {
+	if (!Array.isArray(spec.rungs) || spec.rungs.length === 0) throw new ConfigError("a ladder declares at least one rung");
+	if (!Number.isInteger(spec.startTier) || spec.startTier < 0 || spec.startTier >= spec.rungs.length) throw new ConfigError(`ladder startTier ${String(spec.startTier)} is not a declared rung index of a ${String(spec.rungs.length)}-rung ladder`);
+	for (const trigger of spec.escalateOn) if (!TRIGGER_CLASSES.includes(trigger)) throw new ConfigError(`unknown ladder trigger '${String(trigger)}': the vocabulary is closed to ${TRIGGER_CLASSES.join(", ")}`);
+	const rungs = spec.rungs.map((rung, index) => {
+		parseModelRef(rung.model);
+		if (!Number.isInteger(rung.maxTurns) || rung.maxTurns <= 0) throw new ConfigError(`ladder rung ${String(index)}: maxTurns is a positive integer`);
+		if (!Number.isInteger(rung.maxTokens) || rung.maxTokens <= 0) throw new ConfigError(`ladder rung ${String(index)}: maxTokens is a positive integer`);
+		if (rung.maxCostUsd !== void 0 && !(rung.maxCostUsd > 0)) throw new ConfigError(`ladder rung ${String(index)}: maxCostUsd is positive when present`);
+		const effort = rung.effort ?? options?.chainEffort;
+		if (effort === void 0) throw new ConfigError(`ladder rung ${String(index)} resolves no effort: the canonical ladder embeds explicit efforts; declare rung.effort or a chain effort`);
+		return {
+			model: rung.model,
+			effort,
+			maxTurns: rung.maxTurns,
+			maxTokens: rung.maxTokens,
+			...rung.maxCostUsd === void 0 ? {} : { maxCostUsd: rung.maxCostUsd },
+			...rung.memoizeOutcome === void 0 ? {} : { memoizeOutcome: rung.memoizeOutcome }
+		};
+	});
+	for (const [index, gate] of (spec.acceptance ?? []).entries()) validateGate(gate, spec.rungs.length, index);
+	return {
+		rungs,
+		startTier: spec.startTier,
+		escalateOn: [...spec.escalateOn],
+		...spec.acceptance === void 0 ? {} : { acceptance: spec.acceptance.map((gate) => gate) }
+	};
 }
 /**
-* Classifies a terminal agent outcome for the degenerate fallback:
-* schema-mismatch errors are
-* 'schema-exhausted'; any other error is 'error'; limit terminals (the
-* no-progress abort included) are 'limit'; cancelled, escalated, and
-* skipped never trigger.
+* The concrete ModelChoice of one rung attempt: each attempt is an
+* ordinary agent scope whose CanonicalModelSpec is that rung's
+* `{ kind: 'model' }` form.
 */
-function fallbackTriggerOf(outcome) {
-	if (outcome.status === "error") return outcome.error?.kind === "schema-mismatch" ? "schema-exhausted" : "error";
-	if (outcome.status === "limit") return "limit";
+function ladderRungChoice(ladder, index) {
+	const rung = ladder.rungs[index];
+	if (rung === void 0) throw new ConfigError(`rung ${String(index)} is not declared on a ${String(ladder.rungs.length)}-rung ladder`);
+	return {
+		model: rung.model,
+		effort: rung.effort
+	};
 }
 //#endregion
 //#region src/model/pricing.ts
@@ -8665,91 +8631,7 @@ function affordableOutputTokens(pricing, remainingUsd, estimatedInputTokens) {
 	return Math.floor((remainingUsd - inputUsd) / outputRate * 1e6);
 }
 //#endregion
-//#region src/model/profile-card.ts
-function toolNamesOf(profile) {
-	return (profile.tools ?? []).map((entry) => {
-		if (typeof entry === "string") return `${entry} (registered toolset)`;
-		if ("kind" in entry && entry.kind === "tool") return entry.name;
-		return `${entry.id}:* (tool source)`;
-	});
-}
-/**
-* Renders the registry into the shared agent vocabulary card. Sorted,
-* deterministic, byte-stable; an empty registry renders explicitly so
-* the planner never guesses at unregistered agentTypes. When the engine
-* registers toolsets, their names render as a closing line (v1.17.0
-* review P1-3): those are the ONLY values valid as string entries of a
-* tools option, so the planner never invents a registry name.
-*/
-function profileCard(profiles, toolsets) {
-	const toolsetNames = Object.keys(toolsets ?? {}).sort();
-	const toolsetsLine = toolsetNames.length === 0 ? void 0 : `Registered toolsets (valid string entries of a tools option): ${toolsetNames.join(", ")}.`;
-	const names = Object.keys(profiles ?? {}).sort();
-	if (profiles === void 0 || names.length === 0) {
-		const empty = "Agent profiles: none registered. Calls take no agentType.";
-		return toolsetsLine === void 0 ? empty : `${empty}\n${toolsetsLine}`;
-	}
-	const lines = ["Agent profiles (agentType values):"];
-	for (const name of names) {
-		const profile = profiles[name];
-		const description = profile.description ?? "no description";
-		lines.push(`- ${name}: ${description}`);
-		const toolNames = toolNamesOf(profile);
-		if (toolNames.length > 0) lines.push(`  tools: ${toolNames.join(", ")}`);
-		if (profile.taskClass !== void 0) lines.push(`  taskClass: ${profile.taskClass}`);
-		if (profile.estCost !== void 0) lines.push(`  estCost: ${profile.estCost.toFixed(2)} USD`);
-		if (profile.escalation !== void 0) lines.push(`  escalation: flavor ${profile.escalation.flavor ?? "A"} (opt-in)`);
-	}
-	if (toolsetsLine !== void 0) lines.push(toolsetsLine);
-	return lines.join("\n");
-}
-//#endregion
-//#region src/model/projector.ts
-/** The provider family of an adapter: `provider` when set, else `id`. */
-function providerOf(adapter) {
-	return adapter.provider ?? adapter.id;
-}
-/**
-* Projects the canonical history into the target provider's view:
-* provider-raw parts of a DIFFERENT provider are omitted; everything
-* else (text, images, tool calls, tool results, compaction content)
-* passes through untouched. Messages whose parts all belong to another
-* provider vanish entirely rather than ride as empty messages.
-*/
-function projectHistory(messages, targetProvider) {
-	const projected = [];
-	for (const msg of messages) {
-		const parts = msg.parts.filter((part) => part.type !== "provider-raw" || part.provider === targetProvider);
-		if (parts.length === 0 && msg.parts.length > 0) continue;
-		projected.push(parts.length === msg.parts.length ? msg : {
-			...msg,
-			parts
-		});
-	}
-	return projected;
-}
-/**
-* Lifts the adapter-shipped retention payload of one finished turn into
-* provider-raw parts (the retention transport). Reads
-* providerMetadata[<adapter id>].retainedParts and tags each block with
-* the adapter's provider family. Returns [] when the adapter shipped
-* nothing.
-*/
-function liftRetainedParts(providerMetadata, adapter) {
-	const namespace = providerMetadata?.[adapter.id];
-	if (typeof namespace !== "object" || namespace === null) return [];
-	const retained = namespace.retainedParts;
-	if (!Array.isArray(retained)) return [];
-	const blocks = retained;
-	const provider = providerOf(adapter);
-	return blocks.map((block) => ({
-		type: "provider-raw",
-		provider,
-		block
-	}));
-}
-//#endregion
-//#region src/model/quota.ts
+//#region src/model/quota.ts
 /**
 * Quota rules and the in-process reference QuotaLimiter (RV-215).
 * The rule model is shared by every reference implementation
@@ -8966,6 +8848,177 @@ function validateEngineQuotaConfig(config, site = "createEngine quota") {
 	if (candidate.onLimiterError !== void 0 && candidate.onLimiterError !== "deny" && candidate.onLimiterError !== "allow") throw new ConfigError(`${site}.onLimiterError must be 'deny' or 'allow' when given`);
 }
 //#endregion
+//#region src/runtime/usage-limits.ts
+/**
+* UsageLimits (M1-T06): normative limit vocabulary and the per-spawn merge.
+*
+* Full contract: https://docs.rulvar.com/guide/agents. Expiry of maxTurns, maxToolCalls,
+* or timeoutMs produces the terminal status 'limit' (paid partial work);
+* streamIdleTimeoutMs expiry is a retryable transport-class AgentError,
+* never 'limit'. The run-level deadline is RunOptions.deadlineAt, not a
+* UsageLimits field.
+*/
+const DEFAULT_MAX_TURNS = 32;
+const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 12e4;
+/**
+* Limits merge per spawn: AgentOpts.limits over profile limits over engine
+* defaults.limits.
+*/
+function mergeUsageLimits(call, profile, engine) {
+	const pick = (key) => call?.[key] ?? profile?.[key] ?? engine?.[key];
+	const merged = {
+		maxTurns: pick("maxTurns") ?? 32,
+		streamIdleTimeoutMs: pick("streamIdleTimeoutMs") ?? 12e4
+	};
+	const maxToolCalls = pick("maxToolCalls");
+	if (maxToolCalls !== void 0) merged.maxToolCalls = maxToolCalls;
+	const maxOutputTokensPerTurn = pick("maxOutputTokensPerTurn");
+	if (maxOutputTokensPerTurn !== void 0) merged.maxOutputTokensPerTurn = maxOutputTokensPerTurn;
+	const timeoutMs = pick("timeoutMs");
+	if (timeoutMs !== void 0) merged.timeoutMs = timeoutMs;
+	const noProgressTurns = pick("noProgressTurns");
+	if (noProgressTurns !== void 0) merged.noProgressTurns = noProgressTurns;
+	const toolBudgetNotices = pick("toolBudgetNotices");
+	if (toolBudgetNotices !== void 0) merged.toolBudgetNotices = toolBudgetNotices;
+	const maxRepeatedToolSignature = pick("maxRepeatedToolSignature");
+	if (maxRepeatedToolSignature !== void 0) merged.maxRepeatedToolSignature = maxRepeatedToolSignature;
+	const maxNoNewEvidenceCalls = pick("maxNoNewEvidenceCalls");
+	if (maxNoNewEvidenceCalls !== void 0) merged.maxNoNewEvidenceCalls = maxNoNewEvidenceCalls;
+	const maxCallsPerTool = pick("maxCallsPerTool");
+	if (maxCallsPerTool !== void 0) merged.maxCallsPerTool = maxCallsPerTool;
+	const toolUnits = pick("toolUnits");
+	if (toolUnits !== void 0) merged.toolUnits = toolUnits;
+	const finalizationReserve = pick("finalizationReserve");
+	if (finalizationReserve !== void 0) merged.finalizationReserve = finalizationReserve;
+	return merged;
+}
+/**
+* Validates one UsageLimits layer at its intake boundary (v1.34.0
+* review P2-3): a malformed field (NaN, Infinity, a negative, a
+* fraction) is a typed ConfigError before the merge, before any journal
+* entry, and before any provider dispatch. `site` names the layer in the
+* error text (e.g. `RunOptions.limits`). Counts are positive integers
+* (maxToolCalls may be 0: a spawn that must not call tools).
+* streamIdleTimeoutMs is handed to setTimeout as-is, so it is bounded by
+* the Node timer maximum like RetryPolicy delays; timeoutMs is a
+* wall-clock comparison, so it has no upper bound. Every present field
+* is checked; absent fields keep their defaults.
+*/
+function validateUsageLimits(limits, site) {
+	if (limits.maxTurns !== void 0) requirePositiveInteger(limits.maxTurns, `${site}.maxTurns`);
+	if (limits.maxToolCalls !== void 0) requireNonNegativeInteger(limits.maxToolCalls, `${site}.maxToolCalls`);
+	if (limits.maxOutputTokensPerTurn !== void 0) requirePositiveInteger(limits.maxOutputTokensPerTurn, `${site}.maxOutputTokensPerTurn`);
+	if (limits.timeoutMs !== void 0) requirePositiveInteger(limits.timeoutMs, `${site}.timeoutMs`);
+	if (limits.streamIdleTimeoutMs !== void 0) requireTimerDelayMs(limits.streamIdleTimeoutMs, `${site}.streamIdleTimeoutMs`);
+	if (limits.noProgressTurns !== void 0) requirePositiveInteger(limits.noProgressTurns, `${site}.noProgressTurns`);
+	if (limits.toolBudgetNotices !== void 0 && typeof limits.toolBudgetNotices !== "boolean") throw new ConfigError(`${site}.toolBudgetNotices must be a boolean; got ${typeof limits.toolBudgetNotices}`);
+	if (limits.maxRepeatedToolSignature !== void 0) requirePositiveInteger(limits.maxRepeatedToolSignature, `${site}.maxRepeatedToolSignature`);
+	if (limits.maxNoNewEvidenceCalls !== void 0) requirePositiveInteger(limits.maxNoNewEvidenceCalls, `${site}.maxNoNewEvidenceCalls`);
+	if (limits.maxCallsPerTool !== void 0) {
+		const caps = limits.maxCallsPerTool;
+		if (typeof caps !== "object" || caps === null || Array.isArray(caps)) throw new ConfigError(`${site}.maxCallsPerTool must be a record of per-tool caps`);
+		for (const [name, cap] of Object.entries(caps)) requireNonNegativeInteger(cap, `${site}.maxCallsPerTool['${name}']`);
+	}
+	if (limits.toolUnits !== void 0) {
+		const units = limits.toolUnits;
+		if (typeof units !== "object" || units === null || Array.isArray(units)) throw new ConfigError(`${site}.toolUnits must be { max, costs? }`);
+		const { max, costs } = units;
+		requirePositiveInteger(max, `${site}.toolUnits.max`);
+		if (costs !== void 0) {
+			if (typeof costs !== "object" || costs === null || Array.isArray(costs)) throw new ConfigError(`${site}.toolUnits.costs must be a record of per-tool costs`);
+			for (const [name, cost] of Object.entries(costs)) requireNonNegativeInteger(cost, `${site}.toolUnits.costs['${name}']`);
+		}
+	}
+	if (limits.finalizationReserve !== void 0) {
+		const reserve = limits.finalizationReserve;
+		if (typeof reserve !== "object" || reserve === null || Array.isArray(reserve)) throw new ConfigError(`${site}.finalizationReserve must be { maxOutputTokens? }`);
+		const { maxOutputTokens } = reserve;
+		if (maxOutputTokens !== void 0) requirePositiveInteger(maxOutputTokens, `${site}.finalizationReserve.maxOutputTokens`);
+	}
+}
+//#endregion
+//#region src/model/failover.ts
+/** Normalizes the author-facing ModelChoice.fallbacks list. */
+function normalizeFallbacks(refs) {
+	return (refs ?? []).map((model) => ({ model }));
+}
+/**
+* Maps a retry class to its failover trigger once retries exhaust.
+* Overloaded (529) is transport-class for failover purposes; a
+* non-retryable error never fails over.
+*/
+function failoverTriggerOf(retryClass) {
+	if (retryClass === void 0) return;
+	return retryClass === "rate-limit" ? "rate-limit" : "transport";
+}
+/**
+* The next target index past `from` that serves `trigger`, or undefined
+* when the chain is exhausted. Index 0 is the primary; the chain never
+* moves backwards (sticky failover).
+*/
+function nextFailover(targets, trigger, from) {
+	for (let index = from + 1; index < targets.length; index += 1) {
+		const on = targets[index]?.on;
+		if (on === void 0 || on.includes(trigger)) return index;
+	}
+}
+/**
+* Classifies a terminal agent outcome for the degenerate fallback:
+* schema-mismatch errors are
+* 'schema-exhausted'; any other error is 'error'; limit terminals (the
+* no-progress abort included) are 'limit'; cancelled, escalated, and
+* skipped never trigger.
+*/
+function fallbackTriggerOf(outcome) {
+	if (outcome.status === "error") return outcome.error?.kind === "schema-mismatch" ? "schema-exhausted" : "error";
+	if (outcome.status === "limit") return "limit";
+}
+//#endregion
+//#region src/model/projector.ts
+/** The provider family of an adapter: `provider` when set, else `id`. */
+function providerOf(adapter) {
+	return adapter.provider ?? adapter.id;
+}
+/**
+* Projects the canonical history into the target provider's view:
+* provider-raw parts of a DIFFERENT provider are omitted; everything
+* else (text, images, tool calls, tool results, compaction content)
+* passes through untouched. Messages whose parts all belong to another
+* provider vanish entirely rather than ride as empty messages.
+*/
+function projectHistory(messages, targetProvider) {
+	const projected = [];
+	for (const msg of messages) {
+		const parts = msg.parts.filter((part) => part.type !== "provider-raw" || part.provider === targetProvider);
+		if (parts.length === 0 && msg.parts.length > 0) continue;
+		projected.push(parts.length === msg.parts.length ? msg : {
+			...msg,
+			parts
+		});
+	}
+	return projected;
+}
+/**
+* Lifts the adapter-shipped retention payload of one finished turn into
+* provider-raw parts (the retention transport). Reads
+* providerMetadata[<adapter id>].retainedParts and tags each block with
+* the adapter's provider family. Returns [] when the adapter shipped
+* nothing.
+*/
+function liftRetainedParts(providerMetadata, adapter) {
+	const namespace = providerMetadata?.[adapter.id];
+	if (typeof namespace !== "object" || namespace === null) return [];
+	const retained = namespace.retainedParts;
+	if (!Array.isArray(retained)) return [];
+	const blocks = retained;
+	const provider = providerOf(adapter);
+	return blocks.map((block) => ({
+		type: "provider-raw",
+		provider,
+		block
+	}));
+}
+//#endregion
 //#region src/model/retry.ts
 /**
 * Transport RetryPolicy (M4-T05): retries live UNDER the journal. A
@@ -9100,21 +9153,234 @@ function retryDelayMs(policy, retryIndex, retryAfterMs, random = nativeRandom) {
 	return timerSafe(base / 2 + random() * (base / 2));
 }
 //#endregion
-//#region src/model/roles.ts
+//#region src/model/caps.ts
+const TIER_ORDER = {
+	native: 2,
+	"forced-tool": 1,
+	prompt: 0
+};
 /**
-* True when the given structured-output tier can ride the last loop turn.
-* `native` and `prompt` coexist with tool availability; `forced-tool`
-* pins toolChoice to the synthesized emit_result contract and therefore
-* cannot ride while the agent's tools must remain available. For an
-* agent with no tools every tier rides (the M1 behavior, unchanged).
+* Strict-schema compatibility as both first-class providers define it:
+* every object node declares `additionalProperties: false` and lists every
+* property in `required`. Boolean schemas and
+* non-object shapes are trivially compatible.
 */
-function canRideLoopTurn(tier, toolsAvailable) {
-	return tier !== "forced-tool" || !toolsAvailable;
-}
-/**
-* The completed extract-necessity rule: a separate final structured-output
-* invocation fires only when a schema is set AND (routing directs extract
-* to a different model OR the loop model's caps cannot serve the required
+function isStrictCompatibleSchema(schema) {
+	if (typeof schema === "boolean") return true;
+	if (schema.type === "object" || schema.properties !== void 0 || schema.additionalProperties !== void 0) {
+		if (schema.additionalProperties !== false) return false;
+		const properties = typeof schema.properties === "object" && schema.properties !== null ? schema.properties : {};
+		const required = Array.isArray(schema.required) ? schema.required : [];
+		for (const name of Object.keys(properties)) if (!required.includes(name)) return false;
+		for (const value of Object.values(properties)) if (typeof value === "object" && value !== null || typeof value === "boolean") {
+			if (!isStrictCompatibleSchema(value)) return false;
+		}
+	}
+	for (const key of [
+		"items",
+		"additionalProperties",
+		"contains"
+	]) {
+		const value = schema[key];
+		if (typeof value === "object" && value !== null || typeof value === "boolean") {
+			if (!isStrictCompatibleSchema(value)) return false;
+		}
+	}
+	for (const key of [
+		"allOf",
+		"anyOf",
+		"oneOf",
+		"prefixItems"
+	]) {
+		const value = schema[key];
+		if (Array.isArray(value)) {
+			for (const element of value) if (typeof element === "object" && element !== null || typeof element === "boolean") {
+				if (!isStrictCompatibleSchema(element)) return false;
+			}
+		}
+	}
+	return true;
+}
+/**
+* Tier selection: the model's declared ceiling
+* bounds the tier; the native tier additionally requires a
+* strict-compatible canonical schema (relying on silent server-side
+* fallback is forbidden), degrading to forced-tool.
+* Prefill is not a tier.
+*/
+function selectStructuredOutputTier(caps, canonicalSchema) {
+	const ceiling = caps.structuredOutput;
+	if (ceiling === "native" && !isStrictCompatibleSchema(canonicalSchema)) return "forced-tool";
+	return ceiling;
+}
+/** True when `tier` is at or below the model's declared ceiling. */
+function tierWithinCaps(tier, caps) {
+	return TIER_ORDER[tier] <= TIER_ORDER[caps.structuredOutput];
+}
+//#endregion
+//#region src/runtime/escalation.ts
+const ESCALATE_TOOL_NAME = "escalate";
+/**
+* The escalate tool's exact request schema. costToDate and salvage
+* MUST NOT appear here: additionalProperties false rejects model-authored
+* values for them at argument validation.
+*/
+const ESCALATION_REQUEST_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: [
+		"kind",
+		"scopeDelta",
+		"revisedEstimate"
+	],
+	properties: {
+		kind: { enum: [
+			"scope_bigger",
+			"scope_different",
+			"blocked_with_evidence"
+		] },
+		scopeDelta: { type: "string" },
+		revisedEstimate: {
+			type: "object",
+			additionalProperties: false,
+			required: ["usd", "turns"],
+			properties: {
+				usd: {
+					type: "number",
+					minimum: 0
+				},
+				turns: {
+					type: "integer",
+					minimum: 0
+				}
+			}
+		},
+		blockers: {
+			type: "array",
+			items: { type: "string" }
+		},
+		proposedDecomposition: {
+			type: "array",
+			items: { type: "object" }
+		}
+	}
+};
+/** The full-report schema applied BEFORE append. */
+const ESCALATION_REPORT_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: [
+		"kind",
+		"scopeDelta",
+		"revisedEstimate",
+		"blockers",
+		"proposedDecomposition",
+		"costToDate",
+		"salvage"
+	],
+	properties: {
+		kind: { enum: [
+			"scope_bigger",
+			"scope_different",
+			"blocked_with_evidence"
+		] },
+		scopeDelta: { type: "string" },
+		revisedEstimate: {
+			type: "object",
+			additionalProperties: false,
+			required: ["usd", "turns"],
+			properties: {
+				usd: {
+					type: "number",
+					minimum: 0
+				},
+				turns: {
+					type: "integer",
+					minimum: 0
+				}
+			}
+		},
+		blockers: {
+			type: "array",
+			items: { type: "string" }
+		},
+		proposedDecomposition: {
+			type: "array",
+			items: { type: "object" }
+		},
+		costToDate: {
+			type: "object",
+			additionalProperties: false,
+			required: ["usd", "turns"],
+			properties: {
+				usd: { type: "number" },
+				turns: {
+					type: "integer",
+					minimum: 0
+				}
+			}
+		},
+		salvage: {
+			type: "object",
+			additionalProperties: false,
+			required: ["transcriptRef", "artifacts"],
+			properties: {
+				transcriptRef: { type: "string" },
+				artifacts: {
+					type: "array",
+					items: { type: "string" }
+				},
+				worktreePatchRef: { type: "string" }
+			}
+		}
+	}
+};
+/**
+* The engine opt-in tool: registered through the
+* same path as any tool under escalation opt-in of EITHER flavor (the
+* worker's only authoring channel for a report), never available without
+* opt-in, and dispatched through the same permission chain. The loop
+* intercepts accepted calls; execute is unreachable by construction.
+*/
+function escalateTool() {
+	return tool({
+		name: ESCALATE_TOOL_NAME,
+		description: "Escalate to the owner of this task: the scope is bigger than estimated, materially different, or blocked with evidence. Escalating ends your turn loop; include everything the owner needs to decide.",
+		parameters: ESCALATION_REQUEST_SCHEMA,
+		execute: () => {
+			throw new Error("escalate is intercepted by the agent runtime, never executed");
+		}
+	});
+}
+/** Validates the runtime-completed report BEFORE append; returns issues. */
+async function validateEscalationReport(report) {
+	const validation = await validateSchemaSpec(ESCALATION_REPORT_SCHEMA, report);
+	return validation.valid ? [] : validation.issues;
+}
+/**
+* countsAgainstLimit derivation (XF-06): true iff
+* scope_bigger; scope_different and blocked_with_evidence are exempt and
+* never debit the escalation counter.
+*/
+function countsAgainstLimit(kind) {
+	return kind === "scope_bigger";
+}
+//#endregion
+//#region src/model/roles.ts
+/**
+* True when the given structured-output tier can ride the last loop turn.
+* `native` and `prompt` coexist with tool availability; `forced-tool`
+* pins toolChoice to the synthesized emit_result contract and therefore
+* cannot ride while the agent's tools must remain available. For an
+* agent with no tools every tier rides (the M1 behavior, unchanged).
+*/
+function canRideLoopTurn(tier, toolsAvailable) {
+	return tier !== "forced-tool" || !toolsAvailable;
+}
+/**
+* The completed extract-necessity rule: a separate final structured-output
+* invocation fires only when a schema is set AND (routing directs extract
+* to a different model OR the loop model's caps cannot serve the required
 * tier OR finalize is routed, in which case the schema never rides a loop
 * or synthesis turn). Otherwise the schema rides the last loop turn with
 * no extra call (as amended in M4-T01).
@@ -9200,1646 +9466,979 @@ function compactMessages(messages, summaryText) {
 	return head === void 0 ? [summary] : [head, summary];
 }
 //#endregion
-//#region src/model/router.ts
-/**
-* Model router core (M1-T05): the per-engine adapter registry, ModelRef
-* parsing, the per-invocation resolution chain, canonicalization into
-* CanonicalModelSpec, and caps scrubbing with visible scrub notes.
-*
-* Public contract: https://docs.rulvar.com/guide/model-routing.
-*/
-/**
-* Per-engine adapter registry: strictly per engine, no global mutable
-* registry exists. A duplicate adapterId is a typed ConfigError.
-*/
-function buildAdapterRegistry(adapters) {
-	const registry = /* @__PURE__ */ new Map();
-	for (const adapter of adapters) {
-		if (registry.has(adapter.id)) throw new ConfigError(`duplicate adapterId '${adapter.id}' at createEngine`);
-		registry.set(adapter.id, adapter);
+//#region src/runtime/model-retry.ts
+var ModelRetry = class extends Error {
+	data;
+	constructor(message, opts) {
+		super(message);
+		this.name = "ModelRetry";
+		if (opts?.data !== void 0) this.data = opts.data;
 	}
-	return registry;
-}
+};
+/** Bounded semantic retries per tool call chain. */
+const DEFAULT_MODEL_RETRY_ATTEMPTS = 2;
+//#endregion
+//#region src/runtime/exploration.ts
 /**
-* ModelRef is strictly 'adapterId:model', no query parameters. The wire
-* model id may itself contain colons (for example ollama tags), so only
-* the FIRST colon splits.
-*/
-function parseModelRef(ref) {
-	const colon = ref.indexOf(":");
-	if (colon <= 0 || colon === ref.length - 1) throw new ConfigError(`invalid ModelRef '${ref}': expected the strict 'adapterId:model' form`);
-	return {
-		adapterId: ref.slice(0, colon),
-		model: ref.slice(colon + 1)
-	};
-}
-/**
-* Role effort defaults: orchestrate and plan default to high; summarize and extract
-* default to low. loop and finalize have NO role default: when the chain
-* resolves nothing, the wire omits effort and identity records the spec
-* with the effort member absent.
+* Exploration guards (RV-210, first slice): the engine-side counters that
+* make an oscillating tool loop visible and boundable. The published gap:
+* an agent that repeats the byte-identical tool call, or keeps receiving
+* pages it has already seen, burns its whole tool budget with zero signal
+* and dies as a bare 'limit' terminal; the no-progress detector never
+* trips because tool calls reset it.
+*
+* Three opt-in UsageLimits fields drive this module:
+*
+* - `maxRepeatedToolSignature`: how many times the SAME signature (tool
+*   name + RFC 8785 canonical args) may execute per invocation. The call
+*   that would exceed it is not dispatched; the model receives a typed
+*   error tool result instead (visible, bounded, never terminal), and the
+*   denial does not consume the tool budget.
+* - `maxNoNewEvidenceCalls`: how many consecutive successful executions
+*   may return only already-seen result digests before the loop aborts as
+*   status 'limit' with abortClass 'exploration' (paid partial work; the
+*   executed results stand and the terminal memoizes like every
+*   engine-decided abort).
+* - `toolBudgetNotices`: soft 50%/80% thresholds over `maxToolCalls`,
+*   surfaced to the model as a plain user message with the exact
+*   remaining count, so pacing is possible before the hard cap.
+*
+* Determinism: signatures and digests derive from the canonical JCS
+* serialization; values JCS cannot serialize never match anything (a
+* unique signature; a fresh-evidence result), so the guards fail open,
+* never spuriously. On resume the guard state is rebuilt from the
+* restored checkpoint messages (successful executions only, and only the
+* window a compaction kept), which is the same source the model itself
+* sees; enforcement is engine-side and live-only, while a replayed
+* guard abort is re-stamped from the journaled terminal like every other
+* abort class.
 */
-const ROLE_EFFORT_DEFAULTS = {
-	orchestrate: "high",
-	plan: "high",
-	summarize: "low",
-	extract: "low"
-};
-function contribution(spec, _role) {
-	if (spec === void 0) return {};
-	if (typeof spec === "string") return { model: spec };
-	if ("ladder" in spec) return { ladder: spec.ladder };
-	const choice = spec;
-	const fields = { model: choice.model };
-	if (choice.effort !== void 0) fields.effort = choice.effort;
-	if (choice.providerOptions !== void 0) fields.providerOptions = choice.providerOptions;
-	if (choice.fallbacks !== void 0) fields.fallbacks = choice.fallbacks;
-	return fields;
-}
-function layerFields(layer, role) {
-	if (layer === void 0) return {};
-	const fromModel = contribution(layer.model, role);
-	const fromRouting = contribution(layer.routing?.[role], role);
-	const merged = {
-		...fromModel,
-		...pruneUndefined(fromRouting)
-	};
-	if (layer.effort !== void 0) merged.effort = layer.effort;
-	return merged;
-}
-function pruneUndefined(value) {
-	const out = {};
-	for (const [key, member] of Object.entries(value)) if (member !== void 0) out[key] = member;
-	return out;
-}
-function mergeProviderOptions(lower, higher) {
-	if (lower === void 0) return higher;
-	if (higher === void 0) return lower;
-	const merged = { ...lower };
-	for (const [namespace, options] of Object.entries(higher)) merged[namespace] = {
-		...merged[namespace],
-		...options
-	};
-	return merged;
+/** The docs anchor cited by guard denials and the guard abort. */
+const GUARD_DOCS_URL = "https://docs.rulvar.com/guide/agents#exploration-guards";
+/** True when any exploration guard field asks for tracking. */
+function explorationTrackingEnabled(limits) {
+	return limits.maxRepeatedToolSignature !== void 0 || limits.maxNoNewEvidenceCalls !== void 0 || limits.toolBudgetNotices === true || limits.maxCallsPerTool !== void 0 || limits.toolUnits !== void 0;
 }
-/** Sampling parameters both first-class providers reject on reasoning models. */
-const SAMPLING_KEYS = [
-	"temperature",
-	"top_p",
-	"top_k"
-];
-/**
-* Resolution runs on every model invocation, not once per agent: a layered
-* merge of { model, effort, providerOptions, fallbacks } in the order call
-* override > agent profile > workflow defaults > engine defaults, with the
-* invocation role attached as a tag.
-* After resolution the router reads ModelCaps and scrubs illegal
-* parameters visibly: unsupported effort is removed from the wire but
-* kept in identity; sampling params rejected by the model are removed
-* from the adapter's namespace, never silently sent.
-*/
-function resolveModelInvocation(options) {
-	const { role } = options;
-	const layers = [
-		options.engine,
-		options.workflow,
-		options.profile,
-		options.call
-	];
-	let merged = {};
-	for (const layer of layers) {
-		const fields = layerFields(layer, role);
-		merged = {
-			...merged,
-			...pruneUndefined(fields),
-			providerOptions: mergeProviderOptions(merged.providerOptions, fields.providerOptions)
-		};
-		if (fields.ladder !== void 0) delete merged.model;
-		else if (fields.model !== void 0) delete merged.ladder;
-	}
-	if (merged.ladder !== void 0) throw new ConfigError(`a ladder ModelSpec wins wire resolution for role '${role}': ladder execution is owned by the PlanRunner ladder driver, which resolves each rung attempt to a concrete model override; dispatch laddered profiles through orchestratePlanned or pass a plain ModelRef or ModelChoice`);
-	if (merged.model === void 0) throw new ConfigError(`no model resolves for role '${role}': set AgentOpts.model, a profile model, or engine defaults.routing`);
-	checkFloors({
-		ref: merged.model,
-		role,
-		...options.floors === void 0 ? {} : { floors: options.floors },
-		...options.taskClass === void 0 ? {} : { taskClass: options.taskClass }
-	});
-	const requestedEffort = merged.effort ?? ROLE_EFFORT_DEFAULTS[role];
-	const { adapterId, model } = parseModelRef(merged.model);
-	let caps;
+function digestOf$1(value) {
 	try {
-		caps = options.capsOf(merged.model);
-	} catch (thrown) {
-		if (thrown instanceof ConfigError) throw new ConfigError(`role '${role}': ${thrown.message}`);
-		throw thrown;
+		return createHash("sha256").update(jcsSerialize(value), "utf8").digest("hex");
+	} catch {
+		return;
 	}
-	const scrubs = [];
-	let wireEffort = requestedEffort;
-	if (wireEffort !== void 0 && !caps.reasoningEfforts.includes(wireEffort)) {
-		scrubs.push({
-			scrubbed: "effort",
-			model: merged.model,
-			detail: `effort '${wireEffort}' is not in caps.reasoningEfforts for ${merged.model}; the request proceeds without it (identity keeps the requested effort)`
-		});
-		wireEffort = void 0;
+}
+var ExplorationGuard = class {
+	config;
+	signatureExecutions = /* @__PURE__ */ new Map();
+	seenDigests = /* @__PURE__ */ new Set();
+	byTool = /* @__PURE__ */ new Map();
+	noNewEvidenceStreak = 0;
+	executed = 0;
+	repeated = 0;
+	duplicateResults = 0;
+	denied = 0;
+	deniedToolCap = 0;
+	unitsUsed = 0;
+	unserializableSeq = 0;
+	constructor(config) {
+		this.config = config;
 	}
-	let providerOptions = merged.providerOptions;
-	if (providerOptions?.[adapterId] !== void 0 && !caps.supportsTemperature) {
-		const namespace = { ...providerOptions[adapterId] };
-		const removed = SAMPLING_KEYS.filter((key) => key in namespace);
-		if (removed.length > 0) {
-			for (const key of removed) delete namespace[key];
-			providerOptions = {
-				...providerOptions,
-				[adapterId]: namespace
-			};
-			scrubs.push({
-				scrubbed: "sampling",
-				model: merged.model,
-				detail: `sampling parameter(s) ${removed.join(", ")} removed for ${merged.model}: the model rejects them (caps.supportsTemperature is false); never silently sent`
-			});
+	/**
+	* The canonical signature: tool name + JCS args. Args JCS cannot
+	* serialize get a unique per-occurrence signature, so they never
+	* repeat and the guard fails open.
+	*/
+	signatureOf(name, args) {
+		try {
+			return `${name}\u0000${jcsSerialize(args ?? null)}`;
+		} catch {
+			this.unserializableSeq += 1;
+			return `${name}\u0000<unserializable:${String(this.unserializableSeq)}>`;
 		}
 	}
-	const canonical = requestedEffort === void 0 ? {
-		kind: "model",
-		model: merged.model
-	} : {
-		kind: "model",
-		model: merged.model,
-		effort: requestedEffort
-	};
-	const resolved = {
-		ref: merged.model,
-		adapterId,
-		model,
-		canonical,
-		scrubs
-	};
-	if (wireEffort !== void 0) resolved.wireEffort = wireEffort;
-	if (requestedEffort !== void 0) resolved.requestedEffort = requestedEffort;
-	if (providerOptions !== void 0) resolved.providerOptions = providerOptions;
-	if (merged.fallbacks !== void 0) resolved.fallbacks = merged.fallbacks;
-	return resolved;
-}
-/** The closed trigger vocabulary guard. */
-const TRIGGER_CLASSES = [
-	"error",
-	"limit",
-	"schema-exhausted",
-	"verify-failed",
-	"no-progress"
-];
-function validateGate(gate, rungCount, index) {
-	if (gate.kind === "mechanical") {
-		if (typeof gate.profile !== "string" || gate.profile === "") throw new ConfigError(`ladder acceptance gate ${String(index)}: a mechanical gate names a registered gate profile`);
-		return;
-	}
-	if (gate.kind === "judge") {
-		if (typeof gate.rung === "number") {
-			if (!Number.isInteger(gate.rung) || gate.rung < 0 || gate.rung >= rungCount) throw new ConfigError(`ladder acceptance gate ${String(index)}: judge rung ${String(gate.rung)} is not a declared rung of a ${String(rungCount)}-rung ladder (FR-119)`);
-			return;
+	/**
+	* Rebuilds guard state from restored checkpoint messages: assistant
+	* tool-call parts paired with their successful tool results by id.
+	* Error results (denials, tool failures) are skipped, so a resume
+	* never over-counts; a compaction naturally narrows the window to
+	* what the model itself still sees.
+	*/
+	restore(messages) {
+		const callsById = /* @__PURE__ */ new Map();
+		for (const msg of messages) for (const part of msg.parts) if (part.type === "tool-call") callsById.set(part.id, {
+			name: part.name,
+			args: part.args
+		});
+		else if (part.type === "tool-result" && part.isError !== true) {
+			const call = callsById.get(part.id);
+			if (call === void 0) continue;
+			this.recordExecution(call.name, call.args, part.result, true);
 		}
-		parseModelRef(gate.rung);
-		return;
 	}
-	if (!(gate.fraction > 0 && gate.fraction <= 1)) throw new ConfigError(`ladder acceptance gate ${String(index)}: a spot-check fraction lies in (0, 1], got ${String(gate.fraction)}`);
-}
-/**
-* Canonicalizes a declared LadderSpec: validates the
-* shape once (FR-119 judge declaration included) and resolves every rung's
-* effort to an explicit value. `chainEffort` is the effort the resolution
-* chain would contribute at the declaring layer; a rung that resolves no
-* effort at all is a ConfigError (the canonical form has no absent-effort
-* member by declaration).
-*/
-function canonicalizeLadder(spec, options) {
-	if (!Array.isArray(spec.rungs) || spec.rungs.length === 0) throw new ConfigError("a ladder declares at least one rung");
-	if (!Number.isInteger(spec.startTier) || spec.startTier < 0 || spec.startTier >= spec.rungs.length) throw new ConfigError(`ladder startTier ${String(spec.startTier)} is not a declared rung index of a ${String(spec.rungs.length)}-rung ladder`);
-	for (const trigger of spec.escalateOn) if (!TRIGGER_CLASSES.includes(trigger)) throw new ConfigError(`unknown ladder trigger '${String(trigger)}': the vocabulary is closed to ${TRIGGER_CLASSES.join(", ")}`);
-	const rungs = spec.rungs.map((rung, index) => {
-		parseModelRef(rung.model);
-		if (!Number.isInteger(rung.maxTurns) || rung.maxTurns <= 0) throw new ConfigError(`ladder rung ${String(index)}: maxTurns is a positive integer`);
-		if (!Number.isInteger(rung.maxTokens) || rung.maxTokens <= 0) throw new ConfigError(`ladder rung ${String(index)}: maxTokens is a positive integer`);
-		if (rung.maxCostUsd !== void 0 && !(rung.maxCostUsd > 0)) throw new ConfigError(`ladder rung ${String(index)}: maxCostUsd is positive when present`);
-		const effort = rung.effort ?? options?.chainEffort;
-		if (effort === void 0) throw new ConfigError(`ladder rung ${String(index)} resolves no effort: the canonical ladder embeds explicit efforts; declare rung.effort or a chain effort`);
+	/**
+	* The pre-dispatch verdict: denies the call that would exceed its
+	* tool's maxCallsPerTool cap, then the call that would exceed
+	* maxRepeatedToolSignature executions of the same signature. A denial
+	* never consumes maxToolCalls or tool units.
+	*/
+	beforeExecute(name, args) {
+		const cap = this.config.maxCallsPerTool?.[name];
+		if (cap !== void 0) {
+			const executions = this.byTool.get(name) ?? 0;
+			if (executions >= cap) {
+				this.deniedToolCap += 1;
+				return {
+					deny: true,
+					guard: "per-tool-cap",
+					executions,
+					reason: `exploration guard: '${name}' already executed ${String(executions)} time(s) this invocation (maxCallsPerTool ${String(cap)}). Use what you have or a different tool (${GUARD_DOCS_URL}).`
+				};
+			}
+		}
+		const max = this.config.maxRepeatedToolSignature;
+		if (max === void 0) return { deny: false };
+		const executions = this.signatureExecutions.get(this.signatureOf(name, args)) ?? 0;
+		if (executions < max) return { deny: false };
+		this.denied += 1;
 		return {
-			model: rung.model,
-			effort,
-			maxTurns: rung.maxTurns,
-			maxTokens: rung.maxTokens,
-			...rung.maxCostUsd === void 0 ? {} : { maxCostUsd: rung.maxCostUsd },
-			...rung.memoizeOutcome === void 0 ? {} : { memoizeOutcome: rung.memoizeOutcome }
+			deny: true,
+			guard: "repeated-signature",
+			executions,
+			reason: `exploration guard: this exact '${name}' call already executed ${String(executions)} time(s) this invocation (maxRepeatedToolSignature ${String(max)}). Reuse the earlier result or change the arguments (${GUARD_DOCS_URL}).`
 		};
-	});
-	for (const [index, gate] of (spec.acceptance ?? []).entries()) validateGate(gate, spec.rungs.length, index);
-	return {
-		rungs,
-		startTier: spec.startTier,
-		escalateOn: [...spec.escalateOn],
-		...spec.acceptance === void 0 ? {} : { acceptance: spec.acceptance.map((gate) => gate) }
-	};
+	}
+	/**
+	* Records one dispatched execution and answers whether the
+	* no-new-evidence guard trips. Only successful results feed the
+	* evidence chain: an error result neither resets nor lengthens it
+	* (repeated failing calls are the signature guard's job), and a
+	* result JCS cannot digest counts as fresh evidence.
+	*/
+	afterExecute(name, args, result, isError) {
+		return this.recordExecution(name, args, result, !isError);
+	}
+	recordExecution(name, args, result, successful) {
+		this.executed += 1;
+		this.byTool.set(name, (this.byTool.get(name) ?? 0) + 1);
+		if (this.config.toolUnits !== void 0) this.unitsUsed += this.config.toolUnits.costs?.[name] ?? 1;
+		const signature = this.signatureOf(name, args);
+		const prior = this.signatureExecutions.get(signature) ?? 0;
+		if (prior > 0) this.repeated += 1;
+		this.signatureExecutions.set(signature, prior + 1);
+		if (!successful) return false;
+		const digest = digestOf$1(result);
+		if (digest === void 0 || !this.seenDigests.has(digest)) {
+			if (digest !== void 0) this.seenDigests.add(digest);
+			this.noNewEvidenceStreak = 0;
+			return false;
+		}
+		this.duplicateResults += 1;
+		this.noNewEvidenceStreak += 1;
+		const max = this.config.maxNoNewEvidenceCalls;
+		return max !== void 0 && this.noNewEvidenceStreak >= max;
+	}
+	/**
+	* True once the spent tool units reached the weighted budget: the
+	* loop's pre-dispatch check, mirroring maxToolCalls (terminal 'limit',
+	* paid partial work). Never true without toolUnits configured.
+	*/
+	unitsExhausted() {
+		return this.config.toolUnits !== void 0 && this.unitsUsed >= this.config.toolUnits.max;
+	}
+	/** The abort message for a tripped no-new-evidence guard. */
+	describeTrip() {
+		return `exploration guard: ${String(this.noNewEvidenceStreak)} consecutive tool calls returned no new evidence (maxNoNewEvidenceCalls ${String(this.config.maxNoNewEvidenceCalls ?? this.noNewEvidenceStreak)}; every result was already seen this invocation). The executed work is kept; narrow the scope, vary the queries, or raise the limit (${GUARD_DOCS_URL}).`;
+	}
+	/** The structured summary; `toolCallsUsed` is the loop's own counter. */
+	summary(toolCallsUsed) {
+		const byTool = {};
+		for (const [name, count] of [...this.byTool.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) byTool[name] = count;
+		return {
+			toolCallsUsed,
+			distinctSignatures: this.signatureExecutions.size,
+			repeatedCalls: this.repeated,
+			duplicateResultCalls: this.duplicateResults,
+			deniedRepeats: this.denied,
+			byTool,
+			...this.config.maxCallsPerTool === void 0 ? {} : { deniedToolCap: this.deniedToolCap },
+			...this.config.toolUnits === void 0 ? {} : { toolUnitsUsed: this.unitsUsed }
+		};
+	}
+};
+/** The soft notice thresholds over maxToolCalls, in ascending order. */
+const TOOL_BUDGET_NOTICE_THRESHOLDS = [.5, .8];
+/**
+* Which notice thresholds `used` calls out of `max` have crossed
+* (ceil-based, so a threshold fires no earlier than its exact fraction).
+*/
+function crossedNoticeThresholds(used, max) {
+	return TOOL_BUDGET_NOTICE_THRESHOLDS.filter((threshold) => used >= Math.ceil(threshold * max)).map((threshold) => threshold);
 }
 /**
-* The concrete ModelChoice of one rung attempt: each attempt is an
-* ordinary agent scope whose CanonicalModelSpec is that rung's
-* `{ kind: 'model' }` form.
+* The model-visible budget notice. Deterministic for a given usage
+* count, so a recorded conversation rebuilds byte-identically on
+* resume and replay.
 */
-function ladderRungChoice(ladder, index) {
-	const rung = ladder.rungs[index];
-	if (rung === void 0) throw new ConfigError(`rung ${String(index)} is not declared on a ${String(ladder.rungs.length)}-rung ladder`);
-	return {
-		model: rung.model,
-		effort: rung.effort
-	};
+function toolBudgetNoticeText(used, max) {
+	const remaining = Math.max(0, max - used);
+	return `Tool budget notice: ${String(used)} of ${String(max)} tool calls used; ${String(remaining)} remaining. Prioritize the highest value calls and finish with what you have.`;
 }
 //#endregion
-//#region src/runtime/usage-limits.ts
+//#region src/runtime/no-progress.ts
 /**
-* UsageLimits (M1-T06): normative limit vocabulary and the per-spawn merge.
+* The no-progress abort class (M3-T08): an engine-defined detector
+* journaled as a first-class terminal abort distinct from user
+* cancellation (a cancelled entry always reruns; a no-progress abort
+* must replay, or every resume would re-pay the stuck turns). The
+* interim heuristic is committed: N consecutive
+* turns without tool calls or artifact deltas, N = 3; the broader
+* heuristic stays OQ-15, revisited on dogfood traces.
 *
-* Full contract: https://docs.rulvar.com/guide/agents. Expiry of maxTurns, maxToolCalls,
-* or timeoutMs produces the terminal status 'limit' (paid partial work);
-* streamIdleTimeoutMs expiry is a retryable transport-class AgentError,
-* never 'limit'. The run-level deadline is RunOptions.deadlineAt, not a
-* UsageLimits field.
-*/
-const DEFAULT_MAX_TURNS = 32;
-const DEFAULT_STREAM_IDLE_TIMEOUT_MS = 12e4;
-/**
-* Limits merge per spawn: AgentOpts.limits over profile limits over engine
-* defaults.limits.
+* Encoding: the abort is the agent's
+* terminal entry with status 'limit', an error payload carrying
+* abortClass 'no-progress', and memoizeOutcome stamped by the ENGINE on
+* the terminal entry, so the frozen memoize-limit rule replays it on
+* every subsequent resume without a live rerun. In M3 the runtime has no
+* per-turn artifact channel, so the tool-call test subsumes artifact
+* deltas; per-turn artifact producers arrive with M4 compaction.
 */
-function mergeUsageLimits(call, profile, engine) {
-	const pick = (key) => call?.[key] ?? profile?.[key] ?? engine?.[key];
-	const merged = {
-		maxTurns: pick("maxTurns") ?? 32,
-		streamIdleTimeoutMs: pick("streamIdleTimeoutMs") ?? 12e4
-	};
-	const maxToolCalls = pick("maxToolCalls");
-	if (maxToolCalls !== void 0) merged.maxToolCalls = maxToolCalls;
-	const maxOutputTokensPerTurn = pick("maxOutputTokensPerTurn");
-	if (maxOutputTokensPerTurn !== void 0) merged.maxOutputTokensPerTurn = maxOutputTokensPerTurn;
-	const timeoutMs = pick("timeoutMs");
-	if (timeoutMs !== void 0) merged.timeoutMs = timeoutMs;
-	const noProgressTurns = pick("noProgressTurns");
-	if (noProgressTurns !== void 0) merged.noProgressTurns = noProgressTurns;
-	const toolBudgetNotices = pick("toolBudgetNotices");
-	if (toolBudgetNotices !== void 0) merged.toolBudgetNotices = toolBudgetNotices;
-	const maxRepeatedToolSignature = pick("maxRepeatedToolSignature");
-	if (maxRepeatedToolSignature !== void 0) merged.maxRepeatedToolSignature = maxRepeatedToolSignature;
-	const maxNoNewEvidenceCalls = pick("maxNoNewEvidenceCalls");
-	if (maxNoNewEvidenceCalls !== void 0) merged.maxNoNewEvidenceCalls = maxNoNewEvidenceCalls;
-	const maxCallsPerTool = pick("maxCallsPerTool");
-	if (maxCallsPerTool !== void 0) merged.maxCallsPerTool = maxCallsPerTool;
-	const toolUnits = pick("toolUnits");
-	if (toolUnits !== void 0) merged.toolUnits = toolUnits;
-	const finalizationReserve = pick("finalizationReserve");
-	if (finalizationReserve !== void 0) merged.finalizationReserve = finalizationReserve;
-	return merged;
-}
+/** The committed no-progress detector N. */
+const DEFAULT_NO_PROGRESS_TURNS = 3;
 /**
-* Validates one UsageLimits layer at its intake boundary (v1.34.0
-* review P2-3): a malformed field (NaN, Infinity, a negative, a
-* fraction) is a typed ConfigError before the merge, before any journal
-* entry, and before any provider dispatch. `site` names the layer in the
-* error text (e.g. `RunOptions.limits`). Counts are positive integers
-* (maxToolCalls may be 0: a spawn that must not call tools).
-* streamIdleTimeoutMs is handed to setTimeout as-is, so it is bounded by
-* the Node timer maximum like RetryPolicy delays; timeoutMs is a
-* wall-clock comparison, so it has no upper bound. Every present field
-* is checked; absent fields keep their defaults.
+* Counts consecutive progress-free turns. A turn with at least one tool
+* call (or, later, an artifact delta) resets the streak; a turn with
+* neither lengthens it; the detector trips when the streak reaches the
+* threshold AND the loop would otherwise continue.
 */
-function validateUsageLimits(limits, site) {
-	if (limits.maxTurns !== void 0) requirePositiveInteger(limits.maxTurns, `${site}.maxTurns`);
-	if (limits.maxToolCalls !== void 0) requireNonNegativeInteger(limits.maxToolCalls, `${site}.maxToolCalls`);
-	if (limits.maxOutputTokensPerTurn !== void 0) requirePositiveInteger(limits.maxOutputTokensPerTurn, `${site}.maxOutputTokensPerTurn`);
-	if (limits.timeoutMs !== void 0) requirePositiveInteger(limits.timeoutMs, `${site}.timeoutMs`);
-	if (limits.streamIdleTimeoutMs !== void 0) requireTimerDelayMs(limits.streamIdleTimeoutMs, `${site}.streamIdleTimeoutMs`);
-	if (limits.noProgressTurns !== void 0) requirePositiveInteger(limits.noProgressTurns, `${site}.noProgressTurns`);
-	if (limits.toolBudgetNotices !== void 0 && typeof limits.toolBudgetNotices !== "boolean") throw new ConfigError(`${site}.toolBudgetNotices must be a boolean; got ${typeof limits.toolBudgetNotices}`);
-	if (limits.maxRepeatedToolSignature !== void 0) requirePositiveInteger(limits.maxRepeatedToolSignature, `${site}.maxRepeatedToolSignature`);
-	if (limits.maxNoNewEvidenceCalls !== void 0) requirePositiveInteger(limits.maxNoNewEvidenceCalls, `${site}.maxNoNewEvidenceCalls`);
-	if (limits.maxCallsPerTool !== void 0) {
-		const caps = limits.maxCallsPerTool;
-		if (typeof caps !== "object" || caps === null || Array.isArray(caps)) throw new ConfigError(`${site}.maxCallsPerTool must be a record of per-tool caps`);
-		for (const [name, cap] of Object.entries(caps)) requireNonNegativeInteger(cap, `${site}.maxCallsPerTool['${name}']`);
+var NoProgressDetector = class {
+	streakInternal = 0;
+	threshold;
+	constructor(threshold) {
+		this.threshold = threshold ?? 3;
 	}
-	if (limits.toolUnits !== void 0) {
-		const units = limits.toolUnits;
-		if (typeof units !== "object" || units === null || Array.isArray(units)) throw new ConfigError(`${site}.toolUnits must be { max, costs? }`);
-		const { max, costs } = units;
-		requirePositiveInteger(max, `${site}.toolUnits.max`);
-		if (costs !== void 0) {
-			if (typeof costs !== "object" || costs === null || Array.isArray(costs)) throw new ConfigError(`${site}.toolUnits.costs must be a record of per-tool costs`);
-			for (const [name, cost] of Object.entries(costs)) requireNonNegativeInteger(cost, `${site}.toolUnits.costs['${name}']`);
-		}
+	get streak() {
+		return this.streakInternal;
 	}
-	if (limits.finalizationReserve !== void 0) {
-		const reserve = limits.finalizationReserve;
-		if (typeof reserve !== "object" || reserve === null || Array.isArray(reserve)) throw new ConfigError(`${site}.finalizationReserve must be { maxOutputTokens? }`);
-		const { maxOutputTokens } = reserve;
-		if (maxOutputTokens !== void 0) requirePositiveInteger(maxOutputTokens, `${site}.finalizationReserve.maxOutputTokens`);
+	/** Records one completed model turn. */
+	recordTurn(progress) {
+		if (progress.toolCalls > 0 || (progress.artifactDeltas ?? 0) > 0) this.streakInternal = 0;
+		else this.streakInternal += 1;
 	}
-}
-//#endregion
-//#region src/runtime/model-retry.ts
-var ModelRetry = class extends Error {
-	data;
-	constructor(message, opts) {
-		super(message);
-		this.name = "ModelRetry";
-		if (opts?.data !== void 0) this.data = opts.data;
+	get tripped() {
+		return this.streakInternal >= this.threshold;
+	}
+	describe() {
+		return `no-progress abort after ${this.streakInternal} consecutive turns without tool calls or artifact deltas (threshold ${this.threshold}; https://docs.rulvar.com/guide/agents#the-agent-loop-and-turns)`;
 	}
 };
-/** Bounded semantic retries per tool call chain. */
-const DEFAULT_MODEL_RETRY_ATTEMPTS = 2;
 //#endregion
-//#region src/runtime/escalation.ts
-const ESCALATE_TOOL_NAME = "escalate";
+//#region src/runtime/structured-output.ts
+/** The synthesized forced-tool contract name. */
+const EMIT_RESULT_TOOL = "emit_result";
 /**
-* The escalate tool's exact request schema. costToDate and salvage
-* MUST NOT appear here: additionalProperties false rejects model-authored
-* values for them at argument validation.
+* Applies the selected tier to an outgoing request. Native rides
+* ChatRequest.schema; forced-tool synthesizes a single emit_result tool
+* with toolChoice pinned to it; prompt injects the schema into the last
+* user message.
 */
-const ESCALATION_REQUEST_SCHEMA = {
-	type: "object",
-	additionalProperties: false,
-	required: [
-		"kind",
-		"scopeDelta",
-		"revisedEstimate"
-	],
-	properties: {
-		kind: { enum: [
-			"scope_bigger",
-			"scope_different",
-			"blocked_with_evidence"
-		] },
-		scopeDelta: { type: "string" },
-		revisedEstimate: {
-			type: "object",
-			additionalProperties: false,
-			required: ["usd", "turns"],
-			properties: {
-				usd: {
-					type: "number",
-					minimum: 0
-				},
-				turns: {
-					type: "integer",
-					minimum: 0
-				}
-			}
-		},
-		blockers: {
-			type: "array",
-			items: { type: "string" }
-		},
-		proposedDecomposition: {
-			type: "array",
-			items: { type: "object" }
-		}
-	}
-};
-/** The full-report schema applied BEFORE append. */
-const ESCALATION_REPORT_SCHEMA = {
-	type: "object",
-	additionalProperties: false,
-	required: [
-		"kind",
-		"scopeDelta",
-		"revisedEstimate",
-		"blockers",
-		"proposedDecomposition",
-		"costToDate",
-		"salvage"
-	],
-	properties: {
-		kind: { enum: [
-			"scope_bigger",
-			"scope_different",
-			"blocked_with_evidence"
-		] },
-		scopeDelta: { type: "string" },
-		revisedEstimate: {
-			type: "object",
-			additionalProperties: false,
-			required: ["usd", "turns"],
-			properties: {
-				usd: {
-					type: "number",
-					minimum: 0
-				},
-				turns: {
-					type: "integer",
-					minimum: 0
-				}
-			}
-		},
-		blockers: {
-			type: "array",
-			items: { type: "string" }
-		},
-		proposedDecomposition: {
-			type: "array",
-			items: { type: "object" }
-		},
-		costToDate: {
-			type: "object",
-			additionalProperties: false,
-			required: ["usd", "turns"],
-			properties: {
-				usd: { type: "number" },
-				turns: {
-					type: "integer",
-					minimum: 0
-				}
-			}
-		},
-		salvage: {
-			type: "object",
-			additionalProperties: false,
-			required: ["transcriptRef", "artifacts"],
-			properties: {
-				transcriptRef: { type: "string" },
-				artifacts: {
-					type: "array",
-					items: { type: "string" }
-				},
-				worktreePatchRef: { type: "string" }
-			}
-		}
+function applyStructuredOutputTier(req, tier, schema) {
+	if (tier === "native") return {
+		...req,
+		schema
+	};
+	if (tier === "forced-tool") {
+		const contract = {
+			name: EMIT_RESULT_TOOL,
+			description: "Emit the final structured result. Call exactly once with the complete answer.",
+			parameters: schema
+		};
+		return {
+			...req,
+			tools: [...req.tools ?? [], contract],
+			toolChoice: { name: EMIT_RESULT_TOOL }
+		};
 	}
-};
-/**
-* The engine opt-in tool: registered through the
-* same path as any tool under escalation opt-in of EITHER flavor (the
-* worker's only authoring channel for a report), never available without
-* opt-in, and dispatched through the same permission chain. The loop
-* intercepts accepted calls; execute is unreachable by construction.
-*/
-function escalateTool() {
-	return tool({
-		name: ESCALATE_TOOL_NAME,
-		description: "Escalate to the owner of this task: the scope is bigger than estimated, materially different, or blocked with evidence. Escalating ends your turn loop; include everything the owner needs to decide.",
-		parameters: ESCALATION_REQUEST_SCHEMA,
-		execute: () => {
-			throw new Error("escalate is intercepted by the agent runtime, never executed");
-		}
+	const instruction = "Respond with a single JSON value that validates against this JSON Schema, with no surrounding prose and no code fences:\n" + JSON.stringify(schema);
+	const messages = [...req.messages];
+	const last = messages[messages.length - 1];
+	if (last !== void 0 && last.role === "user") messages[messages.length - 1] = {
+		role: "user",
+		parts: [...last.parts, {
+			type: "text",
+			text: instruction
+		}]
+	};
+	else messages.push({
+		role: "user",
+		parts: [{
+			type: "text",
+			text: instruction
+		}]
 	});
-}
-/** Validates the runtime-completed report BEFORE append; returns issues. */
-async function validateEscalationReport(report) {
-	const validation = await validateSchemaSpec(ESCALATION_REPORT_SCHEMA, report);
-	return validation.valid ? [] : validation.issues;
+	return {
+		...req,
+		messages
+	};
 }
 /**
-* countsAgainstLimit derivation (XF-06): true iff
-* scope_bigger; scope_different and blocked_with_evidence are exempt and
-* never debit the escalation counter.
+* Extracts the structured-output candidate from a collected turn per tier.
+* Returns `undefined` when the turn carries no candidate (for example the
+* model answered prose without the forced tool call).
 */
-function countsAgainstLimit(kind) {
-	return kind === "scope_bigger";
+function extractCandidate(turn, tier) {
+	if (tier === "forced-tool") {
+		const call = turn.toolCalls.find((c) => c.name === EMIT_RESULT_TOOL);
+		return call === void 0 ? void 0 : { raw: call.args };
+	}
+	const text = turn.text.trim();
+	if (text === "") return;
+	try {
+		return { raw: JSON.parse(text) };
+	} catch {
+		const extracted = extractFirstJsonValue(text);
+		return extracted === void 0 ? void 0 : { raw: extracted };
+	}
+}
+/** Best-effort extraction of the first complete JSON object or array in prose. */
+function extractFirstJsonValue(text) {
+	const start = text.search(/[[{]/);
+	if (start === -1) return;
+	const open = text[start];
+	const close = open === "{" ? "}" : "]";
+	let depth = 0;
+	let inString = false;
+	let escaped = false;
+	for (let i = start; i < text.length; i += 1) {
+		const ch = text[i];
+		if (inString) {
+			if (escaped) escaped = false;
+			else if (ch === "\\") escaped = true;
+			else if (ch === "\"") inString = false;
+			continue;
+		}
+		if (ch === "\"") inString = true;
+		else if (ch === open) depth += 1;
+		else if (ch === close) {
+			depth -= 1;
+			if (depth === 0) try {
+				return JSON.parse(text.slice(start, i + 1));
+			} catch {
+				return;
+			}
+		}
+	}
+}
+/** The bounded re-prompt message sent back to the model on a validation miss. */
+function formatRePrompt(issues, attempt, maxAttempts) {
+	return {
+		role: "user",
+		parts: [{
+			type: "text",
+			text: `Your previous answer did not validate against the required schema (attempt ${attempt} of ${maxAttempts}). Issues:\n${issues.slice(0, 16).map((issue) => {
+				const path = issue.path === void 0 || issue.path.length === 0 ? "" : ` (at ${issue.path.map((seg) => String(typeof seg === "object" ? seg.key : seg)).join(".")})`;
+				return `- ${issue.message}${path}`;
+			}).join("\n")}\nRespond again with ONLY a corrected JSON value that validates.`
+		}]
+	};
 }
 //#endregion
-//#region src/runtime/no-progress.ts
+//#region src/runtime/agent-loop.ts
 /**
-* The no-progress abort class (M3-T08): an engine-defined detector
-* journaled as a first-class terminal abort distinct from user
-* cancellation (a cancelled entry always reruns; a no-progress abort
-* must replay, or every resume would re-pay the stuck turns). The
-* interim heuristic is committed: N consecutive
-* turns without tool calls or artifact deltas, N = 3; the broader
-* heuristic stays OQ-15, revisited on dogfood traces.
+* Agent runtime v1 (M1-T06): the single subagent loop shared by every
+* orchestration mode. A model turn; structured output in three tiers with
+* client validation and a bounded re-prompt; typed AgentResult; beyond the
+* configured policy the runtime never throws: failures become typed
+* AgentResult statuses. Tool dispatch, checkpoints, and compaction arrive
+* with M3/M4; the escalated status arrives in M3 as the flagged breaking
+* change.
 *
-* Encoding: the abort is the agent's
-* terminal entry with status 'limit', an error payload carrying
-* abortClass 'no-progress', and memoizeOutcome stamped by the ENGINE on
-* the terminal entry, so the frozen memoize-limit rule replays it on
-* every subsequent resume without a live rerun. In M3 the runtime has no
-* per-turn artifact channel, so the tool-call test subsumes artifact
-* deltas; per-turn artifact producers arrive with M4 compaction.
-*/
-/** The committed no-progress detector N. */
-const DEFAULT_NO_PROGRESS_TURNS = 3;
-/**
-* Counts consecutive progress-free turns. A turn with at least one tool
-* call (or, later, an artifact delta) resets the streak; a turn with
-* neither lengthens it; the detector trips when the streak reaches the
-* threshold AND the loop would otherwise continue.
+* Docs: https://docs.rulvar.com/guide/agents (agent runtime binding);
+* https://docs.rulvar.com/guide/model-routing (roles, tiers, refusal).
 */
-var NoProgressDetector = class {
-	streakInternal = 0;
-	threshold;
-	constructor(threshold) {
-		this.threshold = threshold ?? 3;
-	}
-	get streak() {
-		return this.streakInternal;
-	}
-	/** Records one completed model turn. */
-	recordTurn(progress) {
-		if (progress.toolCalls > 0 || (progress.artifactDeltas ?? 0) > 0) this.streakInternal = 0;
-		else this.streakInternal += 1;
-	}
-	get tripped() {
-		return this.streakInternal >= this.threshold;
-	}
-	describe() {
-		return `no-progress abort after ${this.streakInternal} consecutive turns without tool calls or artifact deltas (threshold ${this.threshold}; https://docs.rulvar.com/guide/agents#the-agent-loop-and-turns)`;
-	}
+function isEscalated(r) {
+	return r.status === "escalated";
+}
+/** Reason marker distinguishing a budget-ceiling abort from host cancellation. */
+const BUDGET_ABORT_REASON = "rulvar:budget-ceiling";
+const ZERO_USAGE$1 = {
+	inputTokens: 0,
+	outputTokens: 0,
+	cacheReadTokens: 0,
+	cacheWriteTokens: 0
 };
-//#endregion
-//#region src/runtime/permission-chain.ts
-/**
-* The layered permission chain (M3-T03): the single approval surface for
-* every tool dispatch, regardless of tool origin. The order is fixed and
-* normative: hooks -> deny rules -> ask rules -> canUseTool -> terminal
-* default (allow unless needsApproval, then ask). Evaluation is
-* short-circuit; unconfigured layers are skipped. Rules never yield
-* allow: allow is only ever falling through to canUseTool or the
-* terminal default.
-*
-* Full contract: https://docs.rulvar.com/guide/tools.
-* Risk presets, the argv shell matcher, domain rules, and the
-* audit/dry-run surface land in M5.
-*/
-/**
-* Merges the engine-wide config and the profile config into one chain.
-* Layers concatenate engine-first; since rules only deny or ask, ordering
-* within a layer cannot change the verdict. The
-* profile's canUseTool wins over the engine's (a single slot by
-* construction). A declared preset compiles INTO the same layers, after
-* the host-authored rules, never as a fifth layer (M5-T05).
-*/
-function compilePermissionChain(engine, profile) {
-	const preset = profile?.preset === void 0 ? {
-		deny: [],
-		ask: []
-	} : compilePermissionPreset(profile.preset);
-	const deny = [
-		...engine?.deny ?? [],
-		...profile?.deny ?? [],
-		...preset.deny
-	];
-	const ask = [
-		...engine?.ask ?? [],
-		...profile?.ask ?? [],
-		...preset.ask
-	];
-	const canUseTool = profile?.canUseTool ?? engine?.canUseTool;
-	return {
-		hooks: [...engine?.hooks ?? [], ...profile?.hooks ?? []],
-		deny,
-		ask,
-		...canUseTool === void 0 ? {} : { canUseTool }
+const wallRandom = Math.random.bind(globalThis);
+function addUsage$1(total, turn) {
+	const sum = {
+		inputTokens: total.inputTokens + turn.inputTokens,
+		outputTokens: total.outputTokens + turn.outputTokens,
+		cacheReadTokens: total.cacheReadTokens + turn.cacheReadTokens,
+		cacheWriteTokens: total.cacheWriteTokens + turn.cacheWriteTokens
 	};
-}
-/** The command text an argv rule matches against. */
-function commandOf(input) {
-	if (typeof input === "string") return input;
-	if (typeof input === "object" && input !== null) {
-		const command = input.command;
-		if (typeof command === "string") return command;
-	}
-}
-function ruleMatches(rule, toolName, risk, input) {
-	if ("risk" in rule) {
-		const risks = Array.isArray(rule.risk) ? rule.risk : [rule.risk];
-		if (risks.includes("undeclared") && risk === void 0) return true;
-		return risk !== void 0 && risks.includes(risk);
-	}
-	if ("domains" in rule) return false;
-	if (!(Array.isArray(rule.tool) ? rule.tool : [rule.tool]).includes(toolName)) return false;
-	if ("argv" in rule) {
-		const command = commandOf(input);
-		if (command === void 0) return false;
-		const patterns = Array.isArray(rule.argv) ? rule.argv : [rule.argv];
-		return lexShellCommand(command).some((segment) => !segment.unmatchable && patterns.some((pattern) => matchArgvPattern(pattern, segment.argv)));
-	}
-	return true;
+	const reasoning = (total.reasoningTokens ?? 0) + (turn.reasoningTokens ?? 0);
+	if (reasoning > 0) sum.reasoningTokens = reasoning;
+	return sum;
 }
 /**
-* Advisory domain-rule matches for the audit payload:
-* reported, never enforced in the current release.
+* The Usage invariant is verified at the adapter boundary: inputTokens is
+* the FULL prompt including cache reads and writes.
 */
-function advisoryMatches(chain, toolName) {
-	return [...chain.deny, ...chain.ask].filter((rule) => "domains" in rule && rule.tool === toolName);
-}
 /**
-* Unmatchable segments (command/process substitution, here-docs) yield
-* ask, ALWAYS, for any tool that has argv rules.
+* The full canonical invariant at the adapter boundary (v1.20.0 review
+* P1-1): every count finite, integral, and nonnegative, and the cache
+* subsets inside the input. One violation message covers every adapter,
+* injected clients and mocks included; the financial invariant never
+* depends on the good faith of an external transport.
 */
-function argvUnmatchableAsk(chain, toolName, input) {
-	if (![...chain.deny, ...chain.ask].some((rule) => "argv" in rule && (Array.isArray(rule.tool) ? rule.tool : [rule.tool]).includes(toolName))) return false;
-	const command = commandOf(input);
-	if (command === void 0) return true;
-	return lexShellCommand(command).some((segment) => segment.unmatchable);
+function usageInvariantViolation(usage, adapterId) {
+	const violations = usageViolations(usage);
+	if (violations.length === 0) return;
+	return `adapter '${adapterId}' violated the Usage invariant: ${violations.join("; ")}`;
 }
-/** A stub ToolContext for offline (dry-run) evaluations. */
-function offlineContext(toolName) {
-	return {
-		runId: "dry-run",
-		spanId: `dry-run-${toolName}`,
-		agent: { agentType: "" },
-		cwd: process.cwd(),
-		isolation: "none",
-		signal: new AbortController().signal,
-		log: () => void 0
+async function streamTurn(adapter, req, options) {
+	const idle = new AbortController();
+	const all = [...options.signals, idle.signal];
+	if (options.budgetSignal !== void 0) all.push(options.budgetSignal);
+	const combined = AbortSignal.any(all);
+	const turn = {
+		text: "",
+		toolCalls: []
 	};
-}
-/**
-* Evaluates the chain for one dispatch, or OFFLINE against a
-* hypothetical call by tool name (the dry-run API: nothing executes;
-* shells and tests read the verdict, the
-* deciding layer, and the matched rule). Hooks run in deterministic
-* registration order; { modifiedInput } substitutes the input and
-* continues; the first decisive verdict wins. The returned input is what
-* execute receives and what the approval identity hashes (post hook
-* modification). Advisory domain-rule matches
-* ride every verdict for the audit payload.
-*/
-async function evaluatePermission(chain, tool, input, ctx) {
-	const def = typeof tool === "string" ? {
-		name: tool,
-		needsApproval: false
-	} : tool;
-	const risk = typeof tool === "string" ? void 0 : tool.risk;
-	const context = ctx ?? offlineContext(def.name);
-	const advisory = advisoryMatches(chain, def.name);
-	const withAdvisory = (verdict) => advisory.length === 0 ? verdict : {
-		...verdict,
-		advisory
+	const pendingArgs = /* @__PURE__ */ new Map();
+	let usage = ZERO_USAGE$1;
+	let reported = ZERO_USAGE$1;
+	let usageViolation;
+	let sawFinish = false;
+	let finish;
+	let providerMetadata;
+	let wireError;
+	let idleTimer;
+	const armIdle = () => {
+		if (idleTimer !== void 0) clearTimeout(idleTimer);
+		idleTimer = setTimeout(() => idle.abort("rulvar:stream-idle"), options.idleTimeoutMs);
 	};
-	let effective = input;
-	for (const hook of chain.hooks) {
-		const verdict = await hook(def.name, effective, context);
-		if (verdict === void 0) continue;
-		if (verdict === "allow" || verdict === "deny" || verdict === "ask") return withAdvisory({
-			verdict,
-			decidedBy: "hook",
-			input: effective
-		});
-		effective = verdict.modifiedInput;
-	}
-	for (const rule of chain.deny) if (ruleMatches(rule, def.name, risk, effective)) return withAdvisory({
-		verdict: "deny",
-		decidedBy: "deny-rule",
-		rule,
-		input: effective
-	});
-	for (const rule of chain.ask) if (ruleMatches(rule, def.name, risk, effective)) return withAdvisory({
-		verdict: "ask",
-		decidedBy: "ask-rule",
-		rule,
-		input: effective
-	});
-	if (argvUnmatchableAsk(chain, def.name, effective)) return withAdvisory({
-		verdict: "ask",
-		decidedBy: "ask-rule",
-		input: effective
-	});
-	if (chain.canUseTool !== void 0) {
-		const verdict = await chain.canUseTool(def.name, effective, context);
-		if (verdict === "allow") return withAdvisory({
-			verdict: "allow",
-			decidedBy: "canUseTool",
-			input: effective
-		});
-		if (verdict === "deny") return withAdvisory({
-			verdict: "deny",
-			decidedBy: "canUseTool",
-			input: effective
-		});
-		effective = verdict.modifiedInput;
-	}
-	if (def.needsApproval) return withAdvisory({
-		verdict: "ask",
-		decidedBy: "default",
-		input: effective
-	});
-	return withAdvisory({
-		verdict: "allow",
-		decidedBy: "default",
-		input: effective
-	});
+	try {
+		armIdle();
+		for await (const event of adapter.stream(req, combined)) {
+			armIdle();
+			switch (event.type) {
+				case "text-delta":
+					turn.text += event.text;
+					options.onDelta?.(event.text);
+					break;
+				case "reasoning-delta":
+					options.onDelta?.(event.text);
+					break;
+				case "tool-call-start":
+					pendingArgs.set(event.id, {
+						name: event.name,
+						argsText: ""
+					});
+					break;
+				case "tool-call-delta": {
+					const pending = pendingArgs.get(event.id);
+					if (pending !== void 0) pending.argsText += event.argsTextDelta;
+					break;
+				}
+				case "tool-call-end": {
+					const pending = pendingArgs.get(event.id);
+					turn.toolCalls.push({
+						id: event.id,
+						name: pending?.name ?? "",
+						args: event.args
+					});
+					pendingArgs.delete(event.id);
+					break;
+				}
+				case "usage": {
+					const cleaned = {};
+					for (const field of [
+						"inputTokens",
+						"outputTokens",
+						"cacheReadTokens",
+						"cacheWriteTokens",
+						"reasoningTokens"
+					]) {
+						const value = event.usage[field];
+						if (value === void 0) continue;
+						if (Number.isInteger(value) && value >= 0) cleaned[field] = value;
+						else {
+							usageViolation ??= `mid-stream usage event carried invalid ${field} (${String(value)})`;
+							cleaned[field] = sanitizeTokenCount(value);
+						}
+					}
+					usage = {
+						...usage,
+						...cleaned
+					};
+					const delta = {
+						inputTokens: cleaned.inputTokens ?? 0,
+						outputTokens: cleaned.outputTokens ?? 0,
+						cacheReadTokens: cleaned.cacheReadTokens ?? 0,
+						cacheWriteTokens: cleaned.cacheWriteTokens ?? 0
+					};
+					if (cleaned.reasoningTokens !== void 0) delta.reasoningTokens = cleaned.reasoningTokens;
+					reported = addUsage$1(reported, delta);
+					options.onUsage?.(delta);
+					break;
+				}
+				case "finish":
+					sawFinish = true;
+					finish = event.finish;
+					usage = event.usage;
+					providerMetadata = event.providerMetadata;
+					break;
+				case "error":
+					wireError = event.error;
+					break;
+			}
+			if (sawFinish || wireError !== void 0) break;
+		}
+	} catch (thrown) {
+		if (!combined.aborted) wireError = {
+			code: "agent",
+			message: thrown instanceof Error ? thrown.message : String(thrown),
+			retryable: true,
+			data: { kind: "transport" }
+		};
+	} finally {
+		if (idleTimer !== void 0) clearTimeout(idleTimer);
+	}
+	if (combined.aborted && !sawFinish && wireError === void 0) {
+		const aborted = options.budgetSignal?.aborted === true ? "budget" : idle.signal.aborted ? "idle" : "external";
+		const outcome = {
+			turn,
+			usage,
+			reported,
+			usageApprox: true,
+			aborted
+		};
+		if (finish !== void 0) outcome.finish = finish;
+		if (usageViolation !== void 0) outcome.usageViolation = usageViolation;
+		return outcome;
+	}
+	if (!sawFinish && wireError === void 0) wireError = {
+		code: "agent",
+		message: `adapter '${adapter.id}' stream ended without a terminal finish or error event; the adapter contract requires exactly one per stream, so the partial turn is discarded as a retryable transport fault`,
+		retryable: true,
+		data: { kind: "transport" }
+	};
+	const outcome = {
+		turn,
+		usage,
+		reported,
+		usageApprox: !sawFinish
+	};
+	if (finish !== void 0) outcome.finish = finish;
+	if (usageViolation !== void 0) outcome.usageViolation = usageViolation;
+	if (providerMetadata !== void 0) outcome.providerMetadata = providerMetadata;
+	if (wireError !== void 0) outcome.wireError = wireError;
+	return outcome;
+}
+function classifyWireError(wire) {
+	const data = wire.data ?? {};
+	const error = {
+		kind: data.kind === "rate-limit" || wire.code === "rate-limit" ? "rate-limit" : data.kind ?? "transport",
+		retryable: wire.retryable
+	};
+	if (typeof data.retryAfterMs === "number") error.retryAfterMs = data.retryAfterMs;
+	return error;
+}
+function buildRequest(resolved, messages, limits, tools) {
+	const req = {
+		model: resolved.model,
+		messages
+	};
+	if (resolved.wireEffort !== void 0) req.effort = resolved.wireEffort;
+	if (resolved.providerOptions !== void 0) req.providerOptions = resolved.providerOptions;
+	if (limits.maxOutputTokensPerTurn !== void 0) req.maxOutputTokens = limits.maxOutputTokensPerTurn;
+	if (tools !== void 0 && tools.length > 0) req.tools = tools;
+	return req;
 }
-//#endregion
-//#region src/runtime/structured-output.ts
-/** The synthesized forced-tool contract name. */
-const EMIT_RESULT_TOOL = "emit_result";
 /**
-* Applies the selected tier to an outgoing request. Native rides
-* ChatRequest.schema; forced-tool synthesizes a single emit_result tool
-* with toolChoice pinned to it; prompt injects the schema into the last
-* user message.
+* Cheap deterministic prompt-size estimate (about four serialized
+* characters per token) for the layer-2b output bound. Never used for
+* identity, accounting, or anything the journal records.
 */
-function applyStructuredOutputTier(req, tier, schema) {
-	if (tier === "native") return {
-		...req,
-		schema
-	};
-	if (tier === "forced-tool") {
-		const contract = {
-			name: EMIT_RESULT_TOOL,
-			description: "Emit the final structured result. Call exactly once with the complete answer.",
-			parameters: schema
-		};
+function estimateInputTokens(messages) {
+	let chars = 0;
+	for (const msg of messages) chars += JSON.stringify(msg.parts).length;
+	return Math.ceil(chars / 4);
+}
+/**
+* Layer 2b at the wire boundary: clamps the outgoing request's
+* maxOutputTokens to what the remaining budget affords from the serving
+* model. The clamp uses the heuristic prompt estimate; the DENIAL does
+* not: a turn is refused (BudgetExhaustedError, never dispatched) only
+* when the remainder cannot buy even ONE output token at zero input,
+* which is exact. Denying on the estimate would kill turns the budget
+* still funds, including the DEF-7 forced finish paid from the released
+* finalize reserve; when the estimate says the prompt alone spends the
+* remainder, the turn dispatches with a one-token output floor and the
+* exact layers (2 and 3) settle the difference. A no-op without a hook
+* or when the hook reports no bound. The clamp touches only the wire
+* request, exactly like limits.maxOutputTokensPerTurn above it; identity
+* is computed at the ctx layer and never sees it.
+*/
+function applyOutputBudget(req, target, budget) {
+	const hook = budget?.maxAffordableOutputTokens;
+	if (hook === void 0) return req;
+	const affordable = hook(target.resolved.ref, estimateInputTokens(req.messages));
+	if (affordable === void 0) return req;
+	if (affordable < 1) {
+		const zeroInputAffordable = hook(target.resolved.ref, 0);
+		if (zeroInputAffordable !== void 0 && zeroInputAffordable < 1) throw new BudgetExhaustedError(`the remaining budget cannot afford one output token from ${target.resolved.ref}; the turn was not dispatched`);
 		return {
 			...req,
-			tools: [...req.tools ?? [], contract],
-			toolChoice: { name: EMIT_RESULT_TOOL }
+			maxOutputTokens: 1
 		};
 	}
-	const instruction = "Respond with a single JSON value that validates against this JSON Schema, with no surrounding prose and no code fences:\n" + JSON.stringify(schema);
-	const messages = [...req.messages];
-	const last = messages[messages.length - 1];
-	if (last !== void 0 && last.role === "user") messages[messages.length - 1] = {
-		role: "user",
-		parts: [...last.parts, {
-			type: "text",
-			text: instruction
-		}]
-	};
-	else messages.push({
-		role: "user",
-		parts: [{
-			type: "text",
-			text: instruction
-		}]
-	});
-	return {
+	if (req.maxOutputTokens === void 0 || affordable < req.maxOutputTokens) return {
 		...req,
-		messages
+		maxOutputTokens: affordable
 	};
+	return req;
 }
 /**
-* Extracts the structured-output candidate from a collected turn per tier.
-* Returns `undefined` when the turn carries no candidate (for example the
-* model answered prose without the forced tool call).
+* The output-truncation abort message (v1.9.0 follow-up review). The
+* constraint is named neutrally as the turn's output token allowance:
+* the effective request cap can come from limits.maxOutputTokensPerTurn,
+* the budget clamp above, or the adapter's own default, and the provider
+* can also cut at its model maximum with no request cap at all.
 */
-function extractCandidate(turn, tier) {
-	if (tier === "forced-tool") {
-		const call = turn.toolCalls.find((c) => c.name === EMIT_RESULT_TOOL);
-		return call === void 0 ? void 0 : { raw: call.args };
-	}
-	const text = turn.text.trim();
-	if (text === "") return;
-	try {
-		return { raw: JSON.parse(text) };
-	} catch {
-		const extracted = extractFirstJsonValue(text);
-		return extracted === void 0 ? void 0 : { raw: extracted };
-	}
+/**
+* The deterministic synthesis instruction appended (as a user message)
+* to the finalize REQUEST only, never to the durable transcript. A
+* transcript that simply ends at an assistant message reads to a real
+* model as a fresh conversation opening, so an uninstructed synthesis
+* call can replace the loop's correct answer with a greeting (v1.18.0
+* review P1-1); the extract arm has carried its own instruction since
+* M4, and this is its finalize twin. The wording is part of the wire
+* request: keep it stable.
+*/
+const FINALIZE_SYNTHESIS_INSTRUCTION = "Write the final answer to the original request, synthesized only from the conversation and tool results above. Do not start a new conversation and do not add greetings; respond with the final answer only.";
+function outputTruncatedMessage(invocation) {
+	return `the ${invocation} ended at its output token allowance (finish reason 'max-tokens') before producing visible output; raise limits.maxOutputTokensPerTurn, reduce the reasoning effort, or free budget for the turn (https://docs.rulvar.com/guide/agents#output-truncation)`;
 }
-/** Best-effort extraction of the first complete JSON object or array in prose. */
-function extractFirstJsonValue(text) {
-	const start = text.search(/[[{]/);
-	if (start === -1) return;
-	const open = text[start];
-	const close = open === "{" ? "}" : "]";
-	let depth = 0;
-	let inString = false;
-	let escaped = false;
-	for (let i = start; i < text.length; i += 1) {
-		const ch = text[i];
-		if (inString) {
-			if (escaped) escaped = false;
-			else if (ch === "\\") escaped = true;
-			else if (ch === "\"") inString = false;
-			continue;
-		}
-		if (ch === "\"") inString = true;
-		else if (ch === open) depth += 1;
-		else if (ch === close) {
-			depth -= 1;
-			if (depth === 0) try {
-				return JSON.parse(text.slice(start, i + 1));
-			} catch {
-				return;
-			}
-		}
-	}
-}
-/** The bounded re-prompt message sent back to the model on a validation miss. */
-function formatRePrompt(issues, attempt, maxAttempts) {
+/**
+* Builds the turn's canonical assistant message. Retained provider-raw
+* parts go at the HEAD: on both first-class providers the retained
+* blocks (thinking blocks, reasoning items) precede the turn's text and
+* tool calls, and head placement reproduces that order on re-projection
+* (M4-T02).
+*/
+function assistantMsg(turn, retained = []) {
+	const parts = [...retained];
+	if (turn.text !== "") parts.push({
+		type: "text",
+		text: turn.text
+	});
+	for (const call of turn.toolCalls) parts.push({
+		type: "tool-call",
+		id: call.id,
+		name: call.name,
+		args: call.args
+	});
 	return {
-		role: "user",
-		parts: [{
-			type: "text",
-			text: `Your previous answer did not validate against the required schema (attempt ${attempt} of ${maxAttempts}). Issues:\n${issues.slice(0, 16).map((issue) => {
-				const path = issue.path === void 0 || issue.path.length === 0 ? "" : ` (at ${issue.path.map((seg) => String(typeof seg === "object" ? seg.key : seg)).join(".")})`;
-				return `- ${issue.message}${path}`;
-			}).join("\n")}\nRespond again with ONLY a corrected JSON value that validates.`
-		}]
+		role: "assistant",
+		parts
 	};
 }
-//#endregion
-//#region src/runtime/exploration.ts
 /**
-* Exploration guards (RV-210, first slice): the engine-side counters that
-* make an oscillating tool loop visible and boundable. The published gap:
-* an agent that repeats the byte-identical tool call, or keeps receiving
-* pages it has already seen, burns its whole tool budget with zero signal
-* and dies as a bare 'limit' terminal; the no-progress detector never
-* trips because tool calls reset it.
-*
-* Three opt-in UsageLimits fields drive this module:
-*
-* - `maxRepeatedToolSignature`: how many times the SAME signature (tool
-*   name + RFC 8785 canonical args) may execute per invocation. The call
-*   that would exceed it is not dispatched; the model receives a typed
-*   error tool result instead (visible, bounded, never terminal), and the
-*   denial does not consume the tool budget.
-* - `maxNoNewEvidenceCalls`: how many consecutive successful executions
-*   may return only already-seen result digests before the loop aborts as
-*   status 'limit' with abortClass 'exploration' (paid partial work; the
-*   executed results stand and the terminal memoizes like every
-*   engine-decided abort).
-* - `toolBudgetNotices`: soft 50%/80% thresholds over `maxToolCalls`,
-*   surfaced to the model as a plain user message with the exact
-*   remaining count, so pacing is possible before the hard cap.
-*
-* Determinism: signatures and digests derive from the canonical JCS
-* serialization; values JCS cannot serialize never match anything (a
-* unique signature; a fresh-evidence result), so the guards fail open,
-* never spuriously. On resume the guard state is rebuilt from the
-* restored checkpoint messages (successful executions only, and only the
-* window a compaction kept), which is the same source the model itself
-* sees; enforcement is engine-side and live-only, while a replayed
-* guard abort is re-stamped from the journaled terminal like every other
-* abort class.
+* Executes one model-issued tool call to a tool-result part. Failures are
+* surfaced to the model as error tool results and never thrown past
+* policy: unknown names, argument-validation issues, ModelRetry (bounded
+* per tool call chain), NonSerializableValueError, and arbitrary execute
+* throws all land as { isError: true } results.
 */
-/** The docs anchor cited by guard denials and the guard abort. */
-const GUARD_DOCS_URL = "https://docs.rulvar.com/guide/agents#exploration-guards";
-/** True when any exploration guard field asks for tracking. */
-function explorationTrackingEnabled(limits) {
-	return limits.maxRepeatedToolSignature !== void 0 || limits.maxNoNewEvidenceCalls !== void 0 || limits.toolBudgetNotices === true || limits.maxCallsPerTool !== void 0 || limits.toolUnits !== void 0;
-}
-function digestOf$1(value) {
+async function executeToolCall(options) {
+	const { call, runtime } = options;
+	const def = runtime.defs.find((candidate) => candidate.name === call.name);
+	const startedAt = options.now();
+	const finish = (result, outcome) => {
+		options.events?.emit({
+			type: "tool:end",
+			toolName: call.name,
+			outcome,
+			durationMs: options.now() - startedAt,
+			...options.audit
+		});
+		const part = {
+			type: "tool-result",
+			id: call.id,
+			name: call.name,
+			result
+		};
+		if (outcome !== "ok") part.isError = true;
+		return part;
+	};
+	if (def === void 0) return finish({ error: `unknown tool '${call.name}'` }, "error");
+	const validation = await validateSchemaSpec(def.parameters, call.args);
+	if (!validation.valid) return finish({
+		error: `arguments for '${call.name}' failed validation`,
+		issues: validation.issues.map((issue) => issue.message)
+	}, "error");
 	try {
-		return createHash("sha256").update(jcsSerialize(value), "utf8").digest("hex");
-	} catch {
-		return;
-	}
-}
-var ExplorationGuard = class {
-	config;
-	signatureExecutions = /* @__PURE__ */ new Map();
-	seenDigests = /* @__PURE__ */ new Set();
-	byTool = /* @__PURE__ */ new Map();
-	noNewEvidenceStreak = 0;
-	executed = 0;
-	repeated = 0;
-	duplicateResults = 0;
-	denied = 0;
-	deniedToolCap = 0;
-	unitsUsed = 0;
-	unserializableSeq = 0;
-	constructor(config) {
-		this.config = config;
-	}
-	/**
-	* The canonical signature: tool name + JCS args. Args JCS cannot
-	* serialize get a unique per-occurrence signature, so they never
-	* repeat and the guard fails open.
-	*/
-	signatureOf(name, args) {
-		try {
-			return `${name}\u0000${jcsSerialize(args ?? null)}`;
-		} catch {
-			this.unserializableSeq += 1;
-			return `${name}\u0000<unserializable:${String(this.unserializableSeq)}>`;
+		let value;
+		if (def.executor === "inprocess") value = await def.execute(validation.value, runtime.contextFor(call.name));
+		else if (runtime.executeExternal !== void 0) value = await runtime.executeExternal(def, validation.value, options.ordinal);
+		else return finish({ error: `tool '${call.name}' declares executor '${def.executor}' but no executor is registered` }, "error");
+		const serialized = toJournalValue(value === void 0 ? null : value, `tool '${call.name}'`);
+		options.retryCounts.delete(call.name);
+		return finish(serialized, "ok");
+	} catch (thrown) {
+		if (thrown instanceof ModelRetry) {
+			const used = options.retryCounts.get(call.name) ?? 0;
+			options.retryCounts.set(call.name, used + 1);
+			const exhausted = used >= options.maxModelRetries;
+			return finish({
+				error: thrown.message,
+				...thrown.data === void 0 ? {} : { data: thrown.data },
+				...exhausted ? { retriesExhausted: true } : {}
+			}, "error");
 		}
+		if (thrown instanceof NonSerializableValueError) return finish({ error: thrown.message }, "error");
+		return finish({ error: thrown instanceof Error ? thrown.message : String(thrown) }, "error");
 	}
-	/**
-	* Rebuilds guard state from restored checkpoint messages: assistant
-	* tool-call parts paired with their successful tool results by id.
-	* Error results (denials, tool failures) are skipped, so a resume
-	* never over-counts; a compaction naturally narrows the window to
-	* what the model itself still sees.
-	*/
-	restore(messages) {
-		const callsById = /* @__PURE__ */ new Map();
-		for (const msg of messages) for (const part of msg.parts) if (part.type === "tool-call") callsById.set(part.id, {
-			name: part.name,
-			args: part.args
+}
+/**
+* Runs one agent to a typed AgentResult. Never throws past policy: every
+* failure mode becomes a typed status on the result.
+*/
+async function runAgent(options) {
+	const now = options.now ?? realNow;
+	const startedAt = now();
+	const limits = options.limits;
+	const maxSchemaAttempts = (options.schemaRetryAttempts ?? 2) + 1;
+	const events = options.events;
+	const agentType = options.agentType ?? "";
+	const messages = [{
+		role: "user",
+		parts: [{
+			type: "text",
+			text: options.prompt
+		}]
+	}];
+	let totalUsage = ZERO_USAGE$1;
+	const primaryRole = options.role ?? "loop";
+	const usageByPhaseModel = /* @__PURE__ */ new Map();
+	const addPhaseUsage = (role, ref, usage) => {
+		const key = `${role}\u0000${ref}`;
+		const prior = usageByPhaseModel.get(key);
+		usageByPhaseModel.set(key, {
+			role,
+			servedBy: ref,
+			usage: addUsage$1(prior?.usage ?? ZERO_USAGE$1, usage)
 		});
-		else if (part.type === "tool-result" && part.isError !== true) {
-			const call = callsById.get(part.id);
-			if (call === void 0) continue;
-			this.recordExecution(call.name, call.args, part.result, true);
-		}
-	}
-	/**
-	* The pre-dispatch verdict: denies the call that would exceed its
-	* tool's maxCallsPerTool cap, then the call that would exceed
-	* maxRepeatedToolSignature executions of the same signature. A denial
-	* never consumes maxToolCalls or tool units.
-	*/
-	beforeExecute(name, args) {
-		const cap = this.config.maxCallsPerTool?.[name];
-		if (cap !== void 0) {
-			const executions = this.byTool.get(name) ?? 0;
-			if (executions >= cap) {
-				this.deniedToolCap += 1;
-				return {
-					deny: true,
-					guard: "per-tool-cap",
-					executions,
-					reason: `exploration guard: '${name}' already executed ${String(executions)} time(s) this invocation (maxCallsPerTool ${String(cap)}). Use what you have or a different tool (${GUARD_DOCS_URL}).`
-				};
-			}
-		}
-		const max = this.config.maxRepeatedToolSignature;
-		if (max === void 0) return { deny: false };
-		const executions = this.signatureExecutions.get(this.signatureOf(name, args)) ?? 0;
-		if (executions < max) return { deny: false };
-		this.denied += 1;
-		return {
-			deny: true,
-			guard: "repeated-signature",
-			executions,
-			reason: `exploration guard: this exact '${name}' call already executed ${String(executions)} time(s) this invocation (maxRepeatedToolSignature ${String(max)}). Reuse the earlier result or change the arguments (${GUARD_DOCS_URL}).`
+	};
+	const providerCalls = [];
+	let invocationCounter = 0;
+	let transportRetries = 0;
+	const roleUsageSnapshot = (role) => {
+		const snapshot = /* @__PURE__ */ new Map();
+		for (const [key, slice] of usageByPhaseModel) if (slice.role === role) snapshot.set(key, slice.usage);
+		return snapshot;
+	};
+	const usageDelta = (after, before) => {
+		const base = before ?? ZERO_USAGE$1;
+		const delta = {
+			inputTokens: Math.max(0, after.inputTokens - base.inputTokens),
+			outputTokens: Math.max(0, after.outputTokens - base.outputTokens),
+			cacheReadTokens: Math.max(0, after.cacheReadTokens - base.cacheReadTokens),
+			cacheWriteTokens: Math.max(0, after.cacheWriteTokens - base.cacheWriteTokens)
 		};
-	}
+		const reasoning = (after.reasoningTokens ?? 0) - (base.reasoningTokens ?? 0);
+		if (reasoning > 0) delta.reasoningTokens = reasoning;
+		return delta;
+	};
+	const beginPhase = (role, model) => {
+		invocationCounter += 1;
+		events?.emit({
+			type: "agent:phase:start",
+			agentType,
+			label: options.label,
+			role,
+			model,
+			invocation: invocationCounter
+		});
+		return {
+			invocation: invocationCounter,
+			role,
+			model,
+			before: roleUsageSnapshot(role),
+			startedAtMs: now(),
+			retriesBefore: transportRetries
+		};
+	};
+	const endPhase = (phase, outcome, servedModel) => {
+		let phaseUsage = ZERO_USAGE$1;
+		let phaseUsd = 0;
+		for (const [key, slice] of usageByPhaseModel) {
+			if (slice.role !== phase.role) continue;
+			const delta = usageDelta(slice.usage, phase.before.get(key));
+			phaseUsage = addUsage$1(phaseUsage, delta);
+			const priced = options.priceUsd?.(slice.servedBy, delta) ?? 0;
+			if (Number.isFinite(priced) && priced > 0) phaseUsd += priced;
+		}
+		const retries = transportRetries - phase.retriesBefore;
+		events?.emit({
+			type: "agent:phase:end",
+			agentType,
+			label: options.label,
+			role: phase.role,
+			model: servedModel ?? phase.model,
+			invocation: phase.invocation,
+			durationMs: Math.max(0, now() - phase.startedAtMs),
+			usage: phaseUsage,
+			costUsd: phaseUsd,
+			outcome,
+			...retries > 0 ? { retries } : {}
+		});
+	};
+	const phaseOutcome = () => status === "error" || status === "cancelled" ? "error" : "ok";
+	let turns = 0;
+	let schemaAttempts = 0;
+	let output = null;
+	let status = "ok";
+	let finishedViaTool = false;
+	let agentError;
+	let errorMessage;
+	let usageApprox = false;
+	let toolCallsUsed = 0;
+	let escalationRequest;
+	let abortClass;
 	/**
-	* Records one dispatched execution and answers whether the
-	* no-new-evidence guard trips. Only successful results feed the
-	* evidence chain: an error result neither resets nor lengthens it
-	* (repeated failing calls are the signature guard's job), and a
-	* result JCS cannot digest counts as fresh evidence.
+	* Set at a tool-budget expiry when limits.finalizationReserve is
+	* configured (P1.1); the reserve turn itself runs at ONE site after
+	* the loop ends (the pending-turn path trips before the dispatch
+	* machinery below is even defined), inside the still-open loop phase.
 	*/
-	afterExecute(name, args, result, isError) {
-		return this.recordExecution(name, args, result, !isError);
-	}
-	recordExecution(name, args, result, successful) {
-		this.executed += 1;
-		this.byTool.set(name, (this.byTool.get(name) ?? 0) + 1);
-		if (this.config.toolUnits !== void 0) this.unitsUsed += this.config.toolUnits.costs?.[name] ?? 1;
-		const signature = this.signatureOf(name, args);
-		const prior = this.signatureExecutions.get(signature) ?? 0;
-		if (prior > 0) this.repeated += 1;
-		this.signatureExecutions.set(signature, prior + 1);
-		if (!successful) return false;
-		const digest = digestOf$1(result);
-		if (digest === void 0 || !this.seenDigests.has(digest)) {
-			if (digest !== void 0) this.seenDigests.add(digest);
-			this.noNewEvidenceStreak = 0;
-			return false;
+	let reserveRequest;
+	const noProgress = new NoProgressDetector(limits.noProgressTurns);
+	const guard = explorationTrackingEnabled(limits) ? new ExplorationGuard(limits) : void 0;
+	/**
+	* The exact limiter behind a tool-budget expiry, with its counts: the
+	* wording rides the finalization-reserve instruction and the 'limit'
+	* terminal's errorMessage (P1.1 criterion: the terminal names the
+	* limiter, never a bare status).
+	*/
+	const toolBudgetDetail = (limiter) => {
+		if (limiter === "maxToolCalls") return `maxToolCalls (${String(toolCallsUsed)}/${String(limits.maxToolCalls ?? 0)})`;
+		const max = limits.toolUnits?.max ?? 0;
+		const used = guard === void 0 ? max : guard.summary(toolCallsUsed).toolUnitsUsed ?? max;
+		return `toolUnits (${String(used)}/${String(max)})`;
+	};
+	if (limits.toolBudgetNotices === true && limits.maxToolCalls === void 0) events?.emit({
+		type: "log",
+		level: "warn",
+		msg: "toolBudgetNotices is enabled but maxToolCalls is not set; the notices are inert"
+	});
+	const firedNotices = /* @__PURE__ */ new Set();
+	/**
+	* Pushes the soft tool-budget notice when an unfired threshold has
+	* been crossed (one message per boundary, carrying the exact counts,
+	* so the model can pace itself before the hard cap). The notice is an
+	* ordinary user message: it rides checkpoints and transcripts, so a
+	* resume never re-fires a threshold the restored count already
+	* crossed.
+	*/
+	const maybePushBudgetNotice = () => {
+		if (limits.toolBudgetNotices !== true || limits.maxToolCalls === void 0) return;
+		const crossed = crossedNoticeThresholds(toolCallsUsed, limits.maxToolCalls).filter((threshold) => !firedNotices.has(threshold));
+		if (crossed.length === 0) return;
+		for (const threshold of crossed) firedNotices.add(threshold);
+		messages.push({
+			role: "user",
+			parts: [{
+				type: "text",
+				text: toolBudgetNoticeText(toolCallsUsed, limits.maxToolCalls)
+			}]
+		});
+	};
+	const modelRetryCounts = /* @__PURE__ */ new Map();
+	let lastTurnUsage = {
+		inputTokens: 0,
+		outputTokens: 0
+	};
+	let compactionDisabled = false;
+	const compactionPoints = [];
+	let servedBy = options.resolved.ref;
+	const restored = await options.checkpoint?.load();
+	if (restored !== void 0) {
+		messages.length = 0;
+		messages.push(...restored.messages);
+		turns = restored.turns;
+		totalUsage = usageViolations(restored.usage).length === 0 ? restored.usage : sanitizeUsage(restored.usage);
+		toolCallsUsed = restored.toolCallsUsed;
+		schemaAttempts = restored.schemaAttempts;
+		compactionPoints.push(...restored.compaction);
+		const restoredSlices = restored.usageByModel ?? [{
+			servedBy,
+			usage: totalUsage
+		}];
+		for (const slice of restoredSlices) {
+			const sliceUsage = usageViolations(slice.usage).length === 0 ? slice.usage : sanitizeUsage(slice.usage);
+			addPhaseUsage(slice.role ?? primaryRole, slice.servedBy, sliceUsage);
+			options.budget?.onUsage(sliceUsage, slice.servedBy);
 		}
-		this.duplicateResults += 1;
-		this.noNewEvidenceStreak += 1;
-		const max = this.config.maxNoNewEvidenceCalls;
-		return max !== void 0 && this.noNewEvidenceStreak >= max;
+		for (const record of restored.providerCalls ?? []) providerCalls.push(usageViolations(record.usage).length === 0 ? record : {
+			...record,
+			usage: sanitizeUsage(record.usage)
+		});
+		guard?.restore(messages);
+		if (limits.toolBudgetNotices === true && limits.maxToolCalls !== void 0) for (const threshold of crossedNoticeThresholds(toolCallsUsed, limits.maxToolCalls)) firedNotices.add(threshold);
 	}
+	const usageSlices = () => [...usageByPhaseModel.values()].map(({ role, servedBy: sliceServedBy, usage }) => ({
+		servedBy: sliceServedBy,
+		usage,
+		role
+	}));
 	/**
-	* True once the spent tool units reached the weighted budget: the
-	* loop's pre-dispatch check, mirroring maxToolCalls (terminal 'limit',
-	* paid partial work). Never true without toolUnits configured.
+	* Every slice priced at ITS OWN model's rate. An unpriced model
+	* contributes zero here and surfaces through CostReport.unpriced, never
+	* as a silent zero.
 	*/
-	unitsExhausted() {
-		return this.config.toolUnits !== void 0 && this.unitsUsed >= this.config.toolUnits.max;
-	}
-	/** The abort message for a tripped no-new-evidence guard. */
-	describeTrip() {
-		return `exploration guard: ${String(this.noNewEvidenceStreak)} consecutive tool calls returned no new evidence (maxNoNewEvidenceCalls ${String(this.config.maxNoNewEvidenceCalls ?? this.noNewEvidenceStreak)}; every result was already seen this invocation). The executed work is kept; narrow the scope, vary the queries, or raise the limit (${GUARD_DOCS_URL}).`;
-	}
-	/** The structured summary; `toolCallsUsed` is the loop's own counter. */
-	summary(toolCallsUsed) {
-		const byTool = {};
-		for (const [name, count] of [...this.byTool.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) byTool[name] = count;
-		return {
+	const priceRecordedUsage = () => {
+		const price = options.priceUsd;
+		if (price === void 0) return 0;
+		let usd = 0;
+		for (const slice of usageByPhaseModel.values()) {
+			const sliceUsd = price(slice.servedBy, slice.usage) ?? 0;
+			if (Number.isFinite(sliceUsd) && sliceUsd > 0) usd += sliceUsd;
+		}
+		return usd;
+	};
+	const saveBoundary = async (pending) => {
+		if (options.checkpoint === void 0) return;
+		await options.checkpoint.save({
+			v: 1,
+			messages: [...messages],
+			turns,
+			usage: totalUsage,
+			usageByModel: usageSlices(),
 			toolCallsUsed,
-			distinctSignatures: this.signatureExecutions.size,
-			repeatedCalls: this.repeated,
-			duplicateResultCalls: this.duplicateResults,
-			deniedRepeats: this.denied,
-			byTool,
-			...this.config.maxCallsPerTool === void 0 ? {} : { deniedToolCap: this.deniedToolCap },
-			...this.config.toolUnits === void 0 ? {} : { toolUnitsUsed: this.unitsUsed }
-		};
-	}
-};
-/** The soft notice thresholds over maxToolCalls, in ascending order. */
-const TOOL_BUDGET_NOTICE_THRESHOLDS = [.5, .8];
-/**
-* Which notice thresholds `used` calls out of `max` have crossed
-* (ceil-based, so a threshold fires no earlier than its exact fraction).
-*/
-function crossedNoticeThresholds(used, max) {
-	return TOOL_BUDGET_NOTICE_THRESHOLDS.filter((threshold) => used >= Math.ceil(threshold * max)).map((threshold) => threshold);
-}
-/**
-* The model-visible budget notice. Deterministic for a given usage
-* count, so a recorded conversation rebuilds byte-identically on
-* resume and replay.
-*/
-function toolBudgetNoticeText(used, max) {
-	const remaining = Math.max(0, max - used);
-	return `Tool budget notice: ${String(used)} of ${String(max)} tool calls used; ${String(remaining)} remaining. Prioritize the highest value calls and finish with what you have.`;
-}
-//#endregion
-//#region src/runtime/agent-loop.ts
-/**
-* Agent runtime v1 (M1-T06): the single subagent loop shared by every
-* orchestration mode. A model turn; structured output in three tiers with
-* client validation and a bounded re-prompt; typed AgentResult; beyond the
-* configured policy the runtime never throws: failures become typed
-* AgentResult statuses. Tool dispatch, checkpoints, and compaction arrive
-* with M3/M4; the escalated status arrives in M3 as the flagged breaking
-* change.
-*
-* Docs: https://docs.rulvar.com/guide/agents (agent runtime binding);
-* https://docs.rulvar.com/guide/model-routing (roles, tiers, refusal).
-*/
-function isEscalated(r) {
-	return r.status === "escalated";
-}
-/** Reason marker distinguishing a budget-ceiling abort from host cancellation. */
-const BUDGET_ABORT_REASON = "rulvar:budget-ceiling";
-const ZERO_USAGE$1 = {
-	inputTokens: 0,
-	outputTokens: 0,
-	cacheReadTokens: 0,
-	cacheWriteTokens: 0
-};
-const wallRandom = Math.random.bind(globalThis);
-function addUsage$1(total, turn) {
-	const sum = {
-		inputTokens: total.inputTokens + turn.inputTokens,
-		outputTokens: total.outputTokens + turn.outputTokens,
-		cacheReadTokens: total.cacheReadTokens + turn.cacheReadTokens,
-		cacheWriteTokens: total.cacheWriteTokens + turn.cacheWriteTokens
-	};
-	const reasoning = (total.reasoningTokens ?? 0) + (turn.reasoningTokens ?? 0);
-	if (reasoning > 0) sum.reasoningTokens = reasoning;
-	return sum;
-}
-/**
-* The Usage invariant is verified at the adapter boundary: inputTokens is
-* the FULL prompt including cache reads and writes.
-*/
-/**
-* The full canonical invariant at the adapter boundary (v1.20.0 review
-* P1-1): every count finite, integral, and nonnegative, and the cache
-* subsets inside the input. One violation message covers every adapter,
-* injected clients and mocks included; the financial invariant never
-* depends on the good faith of an external transport.
-*/
-function usageInvariantViolation(usage, adapterId) {
-	const violations = usageViolations(usage);
-	if (violations.length === 0) return;
-	return `adapter '${adapterId}' violated the Usage invariant: ${violations.join("; ")}`;
-}
-async function streamTurn(adapter, req, options) {
-	const idle = new AbortController();
-	const all = [...options.signals, idle.signal];
-	if (options.budgetSignal !== void 0) all.push(options.budgetSignal);
-	const combined = AbortSignal.any(all);
-	const turn = {
-		text: "",
-		toolCalls: []
-	};
-	const pendingArgs = /* @__PURE__ */ new Map();
-	let usage = ZERO_USAGE$1;
-	let reported = ZERO_USAGE$1;
-	let usageViolation;
-	let sawFinish = false;
-	let finish;
-	let providerMetadata;
-	let wireError;
-	let idleTimer;
-	const armIdle = () => {
-		if (idleTimer !== void 0) clearTimeout(idleTimer);
-		idleTimer = setTimeout(() => idle.abort("rulvar:stream-idle"), options.idleTimeoutMs);
-	};
-	try {
-		armIdle();
-		for await (const event of adapter.stream(req, combined)) {
-			armIdle();
-			switch (event.type) {
-				case "text-delta":
-					turn.text += event.text;
-					options.onDelta?.(event.text);
-					break;
-				case "reasoning-delta":
-					options.onDelta?.(event.text);
-					break;
-				case "tool-call-start":
-					pendingArgs.set(event.id, {
-						name: event.name,
-						argsText: ""
-					});
-					break;
-				case "tool-call-delta": {
-					const pending = pendingArgs.get(event.id);
-					if (pending !== void 0) pending.argsText += event.argsTextDelta;
-					break;
-				}
-				case "tool-call-end": {
-					const pending = pendingArgs.get(event.id);
-					turn.toolCalls.push({
-						id: event.id,
-						name: pending?.name ?? "",
-						args: event.args
-					});
-					pendingArgs.delete(event.id);
-					break;
-				}
-				case "usage": {
-					const cleaned = {};
-					for (const field of [
-						"inputTokens",
-						"outputTokens",
-						"cacheReadTokens",
-						"cacheWriteTokens",
-						"reasoningTokens"
-					]) {
-						const value = event.usage[field];
-						if (value === void 0) continue;
-						if (Number.isInteger(value) && value >= 0) cleaned[field] = value;
-						else {
-							usageViolation ??= `mid-stream usage event carried invalid ${field} (${String(value)})`;
-							cleaned[field] = sanitizeTokenCount(value);
-						}
-					}
-					usage = {
-						...usage,
-						...cleaned
-					};
-					const delta = {
-						inputTokens: cleaned.inputTokens ?? 0,
-						outputTokens: cleaned.outputTokens ?? 0,
-						cacheReadTokens: cleaned.cacheReadTokens ?? 0,
-						cacheWriteTokens: cleaned.cacheWriteTokens ?? 0
-					};
-					if (cleaned.reasoningTokens !== void 0) delta.reasoningTokens = cleaned.reasoningTokens;
-					reported = addUsage$1(reported, delta);
-					options.onUsage?.(delta);
-					break;
-				}
-				case "finish":
-					sawFinish = true;
-					finish = event.finish;
-					usage = event.usage;
-					providerMetadata = event.providerMetadata;
-					break;
-				case "error":
-					wireError = event.error;
-					break;
-			}
-			if (sawFinish || wireError !== void 0) break;
-		}
-	} catch (thrown) {
-		if (!combined.aborted) wireError = {
-			code: "agent",
-			message: thrown instanceof Error ? thrown.message : String(thrown),
-			retryable: true,
-			data: { kind: "transport" }
-		};
-	} finally {
-		if (idleTimer !== void 0) clearTimeout(idleTimer);
-	}
-	if (combined.aborted && !sawFinish && wireError === void 0) {
-		const aborted = options.budgetSignal?.aborted === true ? "budget" : idle.signal.aborted ? "idle" : "external";
-		const outcome = {
-			turn,
-			usage,
-			reported,
-			usageApprox: true,
-			aborted
-		};
-		if (finish !== void 0) outcome.finish = finish;
-		if (usageViolation !== void 0) outcome.usageViolation = usageViolation;
-		return outcome;
-	}
-	if (!sawFinish && wireError === void 0) wireError = {
-		code: "agent",
-		message: `adapter '${adapter.id}' stream ended without a terminal finish or error event; the adapter contract requires exactly one per stream, so the partial turn is discarded as a retryable transport fault`,
-		retryable: true,
-		data: { kind: "transport" }
-	};
-	const outcome = {
-		turn,
-		usage,
-		reported,
-		usageApprox: !sawFinish
-	};
-	if (finish !== void 0) outcome.finish = finish;
-	if (usageViolation !== void 0) outcome.usageViolation = usageViolation;
-	if (providerMetadata !== void 0) outcome.providerMetadata = providerMetadata;
-	if (wireError !== void 0) outcome.wireError = wireError;
-	return outcome;
-}
-function classifyWireError(wire) {
-	const data = wire.data ?? {};
-	const error = {
-		kind: data.kind === "rate-limit" || wire.code === "rate-limit" ? "rate-limit" : data.kind ?? "transport",
-		retryable: wire.retryable
-	};
-	if (typeof data.retryAfterMs === "number") error.retryAfterMs = data.retryAfterMs;
-	return error;
-}
-function buildRequest(resolved, messages, limits, tools) {
-	const req = {
-		model: resolved.model,
-		messages
-	};
-	if (resolved.wireEffort !== void 0) req.effort = resolved.wireEffort;
-	if (resolved.providerOptions !== void 0) req.providerOptions = resolved.providerOptions;
-	if (limits.maxOutputTokensPerTurn !== void 0) req.maxOutputTokens = limits.maxOutputTokensPerTurn;
-	if (tools !== void 0 && tools.length > 0) req.tools = tools;
-	return req;
-}
-/**
-* Cheap deterministic prompt-size estimate (about four serialized
-* characters per token) for the layer-2b output bound. Never used for
-* identity, accounting, or anything the journal records.
-*/
-function estimateInputTokens(messages) {
-	let chars = 0;
-	for (const msg of messages) chars += JSON.stringify(msg.parts).length;
-	return Math.ceil(chars / 4);
-}
-/**
-* Layer 2b at the wire boundary: clamps the outgoing request's
-* maxOutputTokens to what the remaining budget affords from the serving
-* model. The clamp uses the heuristic prompt estimate; the DENIAL does
-* not: a turn is refused (BudgetExhaustedError, never dispatched) only
-* when the remainder cannot buy even ONE output token at zero input,
-* which is exact. Denying on the estimate would kill turns the budget
-* still funds, including the DEF-7 forced finish paid from the released
-* finalize reserve; when the estimate says the prompt alone spends the
-* remainder, the turn dispatches with a one-token output floor and the
-* exact layers (2 and 3) settle the difference. A no-op without a hook
-* or when the hook reports no bound. The clamp touches only the wire
-* request, exactly like limits.maxOutputTokensPerTurn above it; identity
-* is computed at the ctx layer and never sees it.
-*/
-function applyOutputBudget(req, target, budget) {
-	const hook = budget?.maxAffordableOutputTokens;
-	if (hook === void 0) return req;
-	const affordable = hook(target.resolved.ref, estimateInputTokens(req.messages));
-	if (affordable === void 0) return req;
-	if (affordable < 1) {
-		const zeroInputAffordable = hook(target.resolved.ref, 0);
-		if (zeroInputAffordable !== void 0 && zeroInputAffordable < 1) throw new BudgetExhaustedError(`the remaining budget cannot afford one output token from ${target.resolved.ref}; the turn was not dispatched`);
-		return {
-			...req,
-			maxOutputTokens: 1
-		};
-	}
-	if (req.maxOutputTokens === void 0 || affordable < req.maxOutputTokens) return {
-		...req,
-		maxOutputTokens: affordable
-	};
-	return req;
-}
-/**
-* The output-truncation abort message (v1.9.0 follow-up review). The
-* constraint is named neutrally as the turn's output token allowance:
-* the effective request cap can come from limits.maxOutputTokensPerTurn,
-* the budget clamp above, or the adapter's own default, and the provider
-* can also cut at its model maximum with no request cap at all.
-*/
-/**
-* The deterministic synthesis instruction appended (as a user message)
-* to the finalize REQUEST only, never to the durable transcript. A
-* transcript that simply ends at an assistant message reads to a real
-* model as a fresh conversation opening, so an uninstructed synthesis
-* call can replace the loop's correct answer with a greeting (v1.18.0
-* review P1-1); the extract arm has carried its own instruction since
-* M4, and this is its finalize twin. The wording is part of the wire
-* request: keep it stable.
-*/
-const FINALIZE_SYNTHESIS_INSTRUCTION = "Write the final answer to the original request, synthesized only from the conversation and tool results above. Do not start a new conversation and do not add greetings; respond with the final answer only.";
-function outputTruncatedMessage(invocation) {
-	return `the ${invocation} ended at its output token allowance (finish reason 'max-tokens') before producing visible output; raise limits.maxOutputTokensPerTurn, reduce the reasoning effort, or free budget for the turn (https://docs.rulvar.com/guide/agents#output-truncation)`;
-}
-/**
-* Builds the turn's canonical assistant message. Retained provider-raw
-* parts go at the HEAD: on both first-class providers the retained
-* blocks (thinking blocks, reasoning items) precede the turn's text and
-* tool calls, and head placement reproduces that order on re-projection
-* (M4-T02).
-*/
-function assistantMsg(turn, retained = []) {
-	const parts = [...retained];
-	if (turn.text !== "") parts.push({
-		type: "text",
-		text: turn.text
-	});
-	for (const call of turn.toolCalls) parts.push({
-		type: "tool-call",
-		id: call.id,
-		name: call.name,
-		args: call.args
-	});
-	return {
-		role: "assistant",
-		parts
-	};
-}
-/**
-* Executes one model-issued tool call to a tool-result part. Failures are
-* surfaced to the model as error tool results and never thrown past
-* policy: unknown names, argument-validation issues, ModelRetry (bounded
-* per tool call chain), NonSerializableValueError, and arbitrary execute
-* throws all land as { isError: true } results.
-*/
-async function executeToolCall(options) {
-	const { call, runtime } = options;
-	const def = runtime.defs.find((candidate) => candidate.name === call.name);
-	const startedAt = options.now();
-	const finish = (result, outcome) => {
-		options.events?.emit({
-			type: "tool:end",
-			toolName: call.name,
-			outcome,
-			durationMs: options.now() - startedAt,
-			...options.audit
-		});
-		const part = {
-			type: "tool-result",
-			id: call.id,
-			name: call.name,
-			result
-		};
-		if (outcome !== "ok") part.isError = true;
-		return part;
-	};
-	if (def === void 0) return finish({ error: `unknown tool '${call.name}'` }, "error");
-	const validation = await validateSchemaSpec(def.parameters, call.args);
-	if (!validation.valid) return finish({
-		error: `arguments for '${call.name}' failed validation`,
-		issues: validation.issues.map((issue) => issue.message)
-	}, "error");
-	try {
-		let value;
-		if (def.executor === "inprocess") value = await def.execute(validation.value, runtime.contextFor(call.name));
-		else if (runtime.executeExternal !== void 0) value = await runtime.executeExternal(def, validation.value, options.ordinal);
-		else return finish({ error: `tool '${call.name}' declares executor '${def.executor}' but no executor is registered` }, "error");
-		const serialized = toJournalValue(value === void 0 ? null : value, `tool '${call.name}'`);
-		options.retryCounts.delete(call.name);
-		return finish(serialized, "ok");
-	} catch (thrown) {
-		if (thrown instanceof ModelRetry) {
-			const used = options.retryCounts.get(call.name) ?? 0;
-			options.retryCounts.set(call.name, used + 1);
-			const exhausted = used >= options.maxModelRetries;
-			return finish({
-				error: thrown.message,
-				...thrown.data === void 0 ? {} : { data: thrown.data },
-				...exhausted ? { retriesExhausted: true } : {}
-			}, "error");
-		}
-		if (thrown instanceof NonSerializableValueError) return finish({ error: thrown.message }, "error");
-		return finish({ error: thrown instanceof Error ? thrown.message : String(thrown) }, "error");
-	}
-}
-/**
-* Runs one agent to a typed AgentResult. Never throws past policy: every
-* failure mode becomes a typed status on the result.
-*/
-async function runAgent(options) {
-	const now = options.now ?? realNow;
-	const startedAt = now();
-	const limits = options.limits;
-	const maxSchemaAttempts = (options.schemaRetryAttempts ?? 2) + 1;
-	const events = options.events;
-	const agentType = options.agentType ?? "";
-	const messages = [{
-		role: "user",
-		parts: [{
-			type: "text",
-			text: options.prompt
-		}]
-	}];
-	let totalUsage = ZERO_USAGE$1;
-	const primaryRole = options.role ?? "loop";
-	const usageByPhaseModel = /* @__PURE__ */ new Map();
-	const addPhaseUsage = (role, ref, usage) => {
-		const key = `${role}\u0000${ref}`;
-		const prior = usageByPhaseModel.get(key);
-		usageByPhaseModel.set(key, {
-			role,
-			servedBy: ref,
-			usage: addUsage$1(prior?.usage ?? ZERO_USAGE$1, usage)
-		});
-	};
-	const providerCalls = [];
-	let invocationCounter = 0;
-	let transportRetries = 0;
-	const roleUsageSnapshot = (role) => {
-		const snapshot = /* @__PURE__ */ new Map();
-		for (const [key, slice] of usageByPhaseModel) if (slice.role === role) snapshot.set(key, slice.usage);
-		return snapshot;
-	};
-	const usageDelta = (after, before) => {
-		const base = before ?? ZERO_USAGE$1;
-		const delta = {
-			inputTokens: Math.max(0, after.inputTokens - base.inputTokens),
-			outputTokens: Math.max(0, after.outputTokens - base.outputTokens),
-			cacheReadTokens: Math.max(0, after.cacheReadTokens - base.cacheReadTokens),
-			cacheWriteTokens: Math.max(0, after.cacheWriteTokens - base.cacheWriteTokens)
-		};
-		const reasoning = (after.reasoningTokens ?? 0) - (base.reasoningTokens ?? 0);
-		if (reasoning > 0) delta.reasoningTokens = reasoning;
-		return delta;
-	};
-	const beginPhase = (role, model) => {
-		invocationCounter += 1;
-		events?.emit({
-			type: "agent:phase:start",
-			agentType,
-			label: options.label,
-			role,
-			model,
-			invocation: invocationCounter
-		});
-		return {
-			invocation: invocationCounter,
-			role,
-			model,
-			before: roleUsageSnapshot(role),
-			startedAtMs: now(),
-			retriesBefore: transportRetries
-		};
-	};
-	const endPhase = (phase, outcome, servedModel) => {
-		let phaseUsage = ZERO_USAGE$1;
-		let phaseUsd = 0;
-		for (const [key, slice] of usageByPhaseModel) {
-			if (slice.role !== phase.role) continue;
-			const delta = usageDelta(slice.usage, phase.before.get(key));
-			phaseUsage = addUsage$1(phaseUsage, delta);
-			const priced = options.priceUsd?.(slice.servedBy, delta) ?? 0;
-			if (Number.isFinite(priced) && priced > 0) phaseUsd += priced;
-		}
-		const retries = transportRetries - phase.retriesBefore;
-		events?.emit({
-			type: "agent:phase:end",
-			agentType,
-			label: options.label,
-			role: phase.role,
-			model: servedModel ?? phase.model,
-			invocation: phase.invocation,
-			durationMs: Math.max(0, now() - phase.startedAtMs),
-			usage: phaseUsage,
-			costUsd: phaseUsd,
-			outcome,
-			...retries > 0 ? { retries } : {}
-		});
-	};
-	const phaseOutcome = () => status === "error" || status === "cancelled" ? "error" : "ok";
-	let turns = 0;
-	let schemaAttempts = 0;
-	let output = null;
-	let status = "ok";
-	let finishedViaTool = false;
-	let agentError;
-	let errorMessage;
-	let usageApprox = false;
-	let toolCallsUsed = 0;
-	let escalationRequest;
-	let abortClass;
-	/**
-	* Set at a tool-budget expiry when limits.finalizationReserve is
-	* configured (P1.1); the reserve turn itself runs at ONE site after
-	* the loop ends (the pending-turn path trips before the dispatch
-	* machinery below is even defined), inside the still-open loop phase.
-	*/
-	let reserveRequest;
-	const noProgress = new NoProgressDetector(limits.noProgressTurns);
-	const guard = explorationTrackingEnabled(limits) ? new ExplorationGuard(limits) : void 0;
-	/**
-	* The exact limiter behind a tool-budget expiry, with its counts: the
-	* wording rides the finalization-reserve instruction and the 'limit'
-	* terminal's errorMessage (P1.1 criterion: the terminal names the
-	* limiter, never a bare status).
-	*/
-	const toolBudgetDetail = (limiter) => {
-		if (limiter === "maxToolCalls") return `maxToolCalls (${String(toolCallsUsed)}/${String(limits.maxToolCalls ?? 0)})`;
-		const max = limits.toolUnits?.max ?? 0;
-		const used = guard === void 0 ? max : guard.summary(toolCallsUsed).toolUnitsUsed ?? max;
-		return `toolUnits (${String(used)}/${String(max)})`;
-	};
-	if (limits.toolBudgetNotices === true && limits.maxToolCalls === void 0) events?.emit({
-		type: "log",
-		level: "warn",
-		msg: "toolBudgetNotices is enabled but maxToolCalls is not set; the notices are inert"
-	});
-	const firedNotices = /* @__PURE__ */ new Set();
-	/**
-	* Pushes the soft tool-budget notice when an unfired threshold has
-	* been crossed (one message per boundary, carrying the exact counts,
-	* so the model can pace itself before the hard cap). The notice is an
-	* ordinary user message: it rides checkpoints and transcripts, so a
-	* resume never re-fires a threshold the restored count already
-	* crossed.
-	*/
-	const maybePushBudgetNotice = () => {
-		if (limits.toolBudgetNotices !== true || limits.maxToolCalls === void 0) return;
-		const crossed = crossedNoticeThresholds(toolCallsUsed, limits.maxToolCalls).filter((threshold) => !firedNotices.has(threshold));
-		if (crossed.length === 0) return;
-		for (const threshold of crossed) firedNotices.add(threshold);
-		messages.push({
-			role: "user",
-			parts: [{
-				type: "text",
-				text: toolBudgetNoticeText(toolCallsUsed, limits.maxToolCalls)
-			}]
-		});
-	};
-	const modelRetryCounts = /* @__PURE__ */ new Map();
-	let lastTurnUsage = {
-		inputTokens: 0,
-		outputTokens: 0
-	};
-	let compactionDisabled = false;
-	const compactionPoints = [];
-	let servedBy = options.resolved.ref;
-	const restored = await options.checkpoint?.load();
-	if (restored !== void 0) {
-		messages.length = 0;
-		messages.push(...restored.messages);
-		turns = restored.turns;
-		totalUsage = usageViolations(restored.usage).length === 0 ? restored.usage : sanitizeUsage(restored.usage);
-		toolCallsUsed = restored.toolCallsUsed;
-		schemaAttempts = restored.schemaAttempts;
-		compactionPoints.push(...restored.compaction);
-		const restoredSlices = restored.usageByModel ?? [{
-			servedBy,
-			usage: totalUsage
-		}];
-		for (const slice of restoredSlices) {
-			const sliceUsage = usageViolations(slice.usage).length === 0 ? slice.usage : sanitizeUsage(slice.usage);
-			addPhaseUsage(slice.role ?? primaryRole, slice.servedBy, sliceUsage);
-			options.budget?.onUsage(sliceUsage, slice.servedBy);
-		}
-		for (const record of restored.providerCalls ?? []) providerCalls.push(usageViolations(record.usage).length === 0 ? record : {
-			...record,
-			usage: sanitizeUsage(record.usage)
-		});
-		guard?.restore(messages);
-		if (limits.toolBudgetNotices === true && limits.maxToolCalls !== void 0) for (const threshold of crossedNoticeThresholds(toolCallsUsed, limits.maxToolCalls)) firedNotices.add(threshold);
-	}
-	const usageSlices = () => [...usageByPhaseModel.values()].map(({ role, servedBy: sliceServedBy, usage }) => ({
-		servedBy: sliceServedBy,
-		usage,
-		role
-	}));
-	/**
-	* Every slice priced at ITS OWN model's rate. An unpriced model
-	* contributes zero here and surfaces through CostReport.unpriced, never
-	* as a silent zero.
-	*/
-	const priceRecordedUsage = () => {
-		const price = options.priceUsd;
-		if (price === void 0) return 0;
-		let usd = 0;
-		for (const slice of usageByPhaseModel.values()) {
-			const sliceUsd = price(slice.servedBy, slice.usage) ?? 0;
-			if (Number.isFinite(sliceUsd) && sliceUsd > 0) usd += sliceUsd;
-		}
-		return usd;
-	};
-	const saveBoundary = async (pending) => {
-		if (options.checkpoint === void 0) return;
-		await options.checkpoint.save({
-			v: 1,
-			messages: [...messages],
-			turns,
-			usage: totalUsage,
-			usageByModel: usageSlices(),
-			toolCallsUsed,
-			schemaAttempts,
-			compaction: [...compactionPoints],
-			...providerCalls.length === 0 ? {} : { providerCalls: [...providerCalls] },
-			...pending === void 0 ? {} : { pending }
-		});
-	};
-	const toPendingRecords = (parts) => parts.filter((part) => part.type === "tool-result").map((part) => ({
-		id: part.id,
-		name: part.name,
-		result: part.result,
-		...part.isError === true ? { isError: true } : {}
-	}));
-	/**
-	* Gates and executes one turn's tool calls in source order. priorParts
-	* carries results already executed before a mid-turn suspension; the
-	* pending state checkpointed at an ask verdict stores RAW model args so
-	* a resume re-runs the chain (hooks apply exactly once) and re-matches
-	* the same approval identity.
-	*/
-	const runToolCalls = async (calls, priorParts) => {
-		const runtime = options.tools;
-		if (runtime === void 0) return {
-			parts: priorParts,
-			limitHit: false
+			schemaAttempts,
+			compaction: [...compactionPoints],
+			...providerCalls.length === 0 ? {} : { providerCalls: [...providerCalls] },
+			...pending === void 0 ? {} : { pending }
+		});
+	};
+	const toPendingRecords = (parts) => parts.filter((part) => part.type === "tool-result").map((part) => ({
+		id: part.id,
+		name: part.name,
+		result: part.result,
+		...part.isError === true ? { isError: true } : {}
+	}));
+	/**
+	* Gates and executes one turn's tool calls in source order. priorParts
+	* carries results already executed before a mid-turn suspension; the
+	* pending state checkpointed at an ask verdict stores RAW model args so
+	* a resume re-runs the chain (hooks apply exactly once) and re-matches
+	* the same approval identity.
+	*/
+	const runToolCalls = async (calls, priorParts) => {
+		const runtime = options.tools;
+		if (runtime === void 0) return {
+			parts: priorParts,
+			limitHit: false
 		};
 		const parts = [...priorParts];
 		const errorPart = (call, payload) => {
@@ -12791,140 +12390,1006 @@ var AdmissionController = class {
 				statsBefore
 			};
 		}
-		if (depth > this.maxDepth) return {
-			verdict: {
-				kind: "reject",
-				reason: { code: "depth" }
-			},
-			statsBefore
-		};
-		if (childrenBefore >= this.maxChildrenPerNode) return {
-			verdict: {
-				kind: "reject",
-				reason: { code: "quota" }
-			},
-			statsBefore
-		};
-		if (this.maxTotalSpawns !== void 0 && this.admittedTotal >= this.maxTotalSpawns) return {
-			verdict: {
-				kind: "reject",
-				reason: { code: "lifetime" }
-			},
-			statsBefore
-		};
-		let childCeilingUsd;
-		const parentRemainder = this.budget.remainderOf(spec.parentAccountScope);
-		if (parentRemainder !== void 0) {
-			const fractionCap = this.childBudgetFraction * parentRemainder;
-			childCeilingUsd = spec.budgetUsd === void 0 ? fractionCap : Math.min(spec.budgetUsd, fractionCap);
-		} else if (spec.budgetUsd !== void 0) childCeilingUsd = spec.budgetUsd;
-		let reserveUsd = spec.estCostUsd ?? this.flatReserveUsd;
-		if (childCeilingUsd !== void 0) reserveUsd = Math.min(reserveUsd, childCeilingUsd);
-		const reserve = { reserveUsd };
-		if (childCeilingUsd !== void 0) reserve.childCeilingUsd = childCeilingUsd;
-		if (this.budget.spawnHeadroom <= 0) return {
-			verdict: {
-				kind: "reject",
-				reason: { code: "lifetime" }
-			},
-			statsBefore
+		if (depth > this.maxDepth) return {
+			verdict: {
+				kind: "reject",
+				reason: { code: "depth" }
+			},
+			statsBefore
+		};
+		if (childrenBefore >= this.maxChildrenPerNode) return {
+			verdict: {
+				kind: "reject",
+				reason: { code: "quota" }
+			},
+			statsBefore
+		};
+		if (this.maxTotalSpawns !== void 0 && this.admittedTotal >= this.maxTotalSpawns) return {
+			verdict: {
+				kind: "reject",
+				reason: { code: "lifetime" }
+			},
+			statsBefore
+		};
+		let childCeilingUsd;
+		const parentRemainder = this.budget.remainderOf(spec.parentAccountScope);
+		if (parentRemainder !== void 0) {
+			const fractionCap = this.childBudgetFraction * parentRemainder;
+			childCeilingUsd = spec.budgetUsd === void 0 ? fractionCap : Math.min(spec.budgetUsd, fractionCap);
+		} else if (spec.budgetUsd !== void 0) childCeilingUsd = spec.budgetUsd;
+		let reserveUsd = spec.estCostUsd ?? this.flatReserveUsd;
+		if (childCeilingUsd !== void 0) reserveUsd = Math.min(reserveUsd, childCeilingUsd);
+		const reserve = { reserveUsd };
+		if (childCeilingUsd !== void 0) reserve.childCeilingUsd = childCeilingUsd;
+		if (this.budget.spawnHeadroom <= 0) return {
+			verdict: {
+				kind: "reject",
+				reason: { code: "lifetime" }
+			},
+			statsBefore
+		};
+		if (commitReserve) try {
+			this.budget.admitSpawn(reserveUsd, spec.parentAccountScope);
+		} catch {
+			return {
+				verdict: {
+					kind: "reject",
+					reason: { code: "budget" }
+				},
+				statsBefore
+			};
+		}
+		else {
+			const remainder = this.budget.remainderOf(spec.parentAccountScope);
+			const projection = this.projectedDispatchReserveUsd(spec);
+			if (remainder !== void 0 && (remainder <= 0 || remainder < projection + (spec.pendingReserveUsd ?? 0))) return {
+				verdict: {
+					kind: "reject",
+					reason: { code: "budget" }
+				},
+				statsBefore
+			};
+		}
+		this.childrenOf.set(nodeKey, childrenBefore + 1);
+		this.admittedTotal += 1;
+		const lineage = evaluated.decision.lineage;
+		this.registerLineageAdmit(lineage.logicalTaskId);
+		let spawnUnitsAfter = this.budget.spawnHeadroom;
+		if (this.terminationAccount !== void 0) {
+			const debited = this.terminationAccount.debitSpawn({
+				logicalTaskId: lineage.logicalTaskId,
+				isNew: spec.lineage === void 0,
+				ladderLength: spec.ladderLength ?? 1
+			});
+			if (!debited.ok) return {
+				verdict: {
+					kind: "reject",
+					reason: { code: "termination_exhausted" }
+				},
+				statsBefore
+			};
+			spawnUnitsAfter = debited.spawnUnitsAfter;
+		}
+		return {
+			verdict: {
+				kind: "admit",
+				reserve,
+				spawnUnitsAfter,
+				lineage: {
+					logicalTaskId: lineage.logicalTaskId,
+					isNew: spec.lineage === void 0,
+					depth
+				}
+			},
+			statsBefore,
+			nodeId: this.mintId(),
+			lineage,
+			...this.terminationAccount === void 0 ? {} : { ladderLength: spec.ladderLength ?? 1 }
+		};
+	}
+	/**
+	* Resume roll-forward for an orchestrator child (M6-T07): restores the
+	* children-quota counter only. The budget seed already counts settled
+	* agent dispatches, and an in-flight child re-commits its reserve
+	* through the ctx.agent dispatch path.
+	*/
+	recoverChild(nodeKey) {
+		this.childrenOf.set(nodeKey, (this.childrenOf.get(nodeKey) ?? 0) + 1);
+		this.admittedTotal += 1;
+	}
+	/**
+	* Resume roll-forward for a child that already SETTLED before the
+	* resume: re-registers the counters (maxChildrenPerNode, the lifetime
+	* cap, statsBefore fidelity) without committing any reserve; the spend
+	* itself sits in the root ledger seed.
+	*/
+	recoverSettled(parentAccountScope) {
+		this.budget.admitRecovered(0, parentAccountScope);
+		this.childrenOf.set(parentAccountScope, (this.childrenOf.get(parentAccountScope) ?? 0) + 1);
+		this.admittedTotal += 1;
+	}
+	/**
+	* Resume roll-forward for an admission whose decision entry exists but
+	* whose child has NOT settled: re-applies the recorded reserve and
+	* counters without re-evaluating any limit (replay never
+	* re-evaluates admission; reserves are recovered, never
+	* re-estimated).
+	*/
+	recoverInFlight(parentAccountScope, verdict) {
+		if (verdict.kind === "reject") return;
+		const reserveUsd = verdict.kind === "reuse_full" ? 0 : verdict.reserve.reserveUsd;
+		this.budget.admitRecovered(reserveUsd, parentAccountScope);
+		this.childrenOf.set(parentAccountScope, (this.childrenOf.get(parentAccountScope) ?? 0) + 1);
+		this.admittedTotal += 1;
+	}
+};
+//#endregion
+//#region src/engine/scheduler.ts
+/**
+* Scheduler and concurrency (M1-T08): the per-run semaphore with a FIFO
+* queue (default 12 concurrent model calls). The engine lifetime spawn cap
+* is enforced by the budget layer at admission; parallel/pipeline
+* composition semantics live with ctx.
+* Per-provider concurrency keys land with M4.
+*/
+/** FIFO semaphore; default per-run width is 12. */
+const DEFAULT_PER_RUN_CONCURRENCY = 12;
+var Semaphore = class {
+	limit;
+	active = 0;
+	waiters = [];
+	/**
+	* `limit` must be a positive integer: anything else (NaN included) is
+	* a typed ConfigError. Before this gate a NaN limit made
+	* `active < limit` permanently false, so the first acquire queued
+	* forever and the run could not settle, not even through cancel()
+	* (v1.34.0 review P2-4). Unlimited is expressed by not constructing a
+	* semaphore, never by a sentinel limit.
+	*/
+	constructor(limit) {
+		requirePositiveInteger(limit, "Semaphore limit");
+		this.limit = limit;
+	}
+	get pending() {
+		return this.waiters.length;
+	}
+	/**
+	* Acquires a slot, resolving in FIFO order. `onQueued` fires only when
+	* the caller actually has to wait (feeds the agent:queued event).
+	* An aborted `signal` releases the caller from the queue without a
+	* slot: the returned release is a no-op, the remaining waiters keep
+	* their FIFO positions, and the caller proceeds to observe its own
+	* aborted signal (the model layers refuse dispatch under an aborted
+	* signal, so no provider call follows). Cancellation can therefore
+	* always drain a queued run (v1.34.0 review P2-4).
+	*/
+	async acquire(onQueued, signal) {
+		if (this.active < this.limit) {
+			this.active += 1;
+			return () => this.release();
+		}
+		if (signal?.aborted === true) return () => void 0;
+		onQueued?.();
+		const waiter = {
+			resolve: () => void 0,
+			aborted: false
+		};
+		const wait = new Promise((resolve) => {
+			waiter.resolve = resolve;
+		});
+		this.waiters.push(waiter);
+		let onAbort;
+		if (signal !== void 0) {
+			onAbort = () => {
+				const index = this.waiters.indexOf(waiter);
+				if (index === -1) return;
+				this.waiters.splice(index, 1);
+				waiter.aborted = true;
+				waiter.resolve();
+			};
+			signal.addEventListener("abort", onAbort, { once: true });
+		}
+		try {
+			await wait;
+		} finally {
+			if (signal !== void 0 && onAbort !== void 0) signal.removeEventListener("abort", onAbort);
+		}
+		if (waiter.aborted) return () => void 0;
+		this.active += 1;
+		return () => this.release();
+	}
+	async withSlot(fn, onQueued, signal) {
+		const release = await this.acquire(onQueued, signal);
+		try {
+			return await fn();
+		} finally {
+			release();
+		}
+	}
+	release() {
+		this.active -= 1;
+		const next = this.waiters.shift();
+		if (next !== void 0) next.resolve();
+	}
+};
+//#endregion
+//#region src/engine/preflight.ts
+const ANY_TOOL = "(any)";
+function resolveServing(spec) {
+	if (spec === void 0) return;
+	if (typeof spec === "string") return spec;
+	if ("model" in spec) return spec.model;
+	return spec.ladder.rungs[spec.ladder.startTier]?.model;
+}
+/**
+* Per-tool executed-call ceilings from the merged limits: for every
+* tool a per-tool cap or a unit cost names (plus the '(any)' tool that
+* nothing names, unit cost 1), the smallest of maxCallsPerTool[T],
+* floor(toolUnits.max / cost(T)) for a positive cost (a zero cost is
+* free), and maxToolCalls.
+*/
+function toolCeilingsOf(limits) {
+	const names = /* @__PURE__ */ new Set();
+	for (const name of Object.keys(limits.maxCallsPerTool ?? {})) names.add(name);
+	for (const name of Object.keys(limits.toolUnits?.costs ?? {})) names.add(name);
+	const rows = [];
+	for (const tool of [...[...names].sort(), ANY_TOOL]) {
+		const terms = [];
+		const cap = tool === ANY_TOOL ? void 0 : limits.maxCallsPerTool?.[tool];
+		if (cap !== void 0) terms.push({
+			boundBy: "maxCallsPerTool",
+			ceiling: cap
+		});
+		if (limits.toolUnits !== void 0) {
+			const cost = tool === ANY_TOOL ? 1 : limits.toolUnits.costs?.[tool] ?? 1;
+			if (cost > 0) terms.push({
+				boundBy: "toolUnits",
+				ceiling: Math.floor(limits.toolUnits.max / cost)
+			});
+		}
+		if (limits.maxToolCalls !== void 0) terms.push({
+			boundBy: "maxToolCalls",
+			ceiling: limits.maxToolCalls
+		});
+		if (terms.length === 0) {
+			rows.push({
+				tool,
+				ceiling: null
+			});
+			continue;
+		}
+		const min = terms.reduce((best, term) => term.ceiling < best.ceiling ? term : best);
+		rows.push({
+			tool,
+			ceiling: min.ceiling,
+			boundBy: min.boundBy
+		});
+	}
+	return rows;
+}
+function validateSpawnSpec(spec, index) {
+	const site = `preflight.spawns[${index}]`;
+	if (spec.limits !== void 0) validateUsageLimits(spec.limits, `${site}.limits`);
+	if (spec.estCost !== void 0) requireNonNegativeNumber(spec.estCost, `${site}.estCost`);
+	if (spec.estInputTokens !== void 0) requireNonNegativeInteger(spec.estInputTokens, `${site}.estInputTokens`);
+	if (spec.count !== void 0) requirePositiveInteger(spec.count, `${site}.count`);
+}
+/**
+* Computes the preflight report: the effective merged limits per
+* declared spawn, the layer-1 admission projection over the declared
+* wave, the per-tool and weighted-unit bottleneck ordering, the
+* concurrency and quota exposure at the declared estimates, and the
+* linter findings. Pure: no engine is constructed, no store is opened,
+* no adapter stream is dispatched, and no journal entry is written.
+*/
+function preflightEstimate(input) {
+	const engine = input.engine ?? {};
+	const defaults = engine.defaults ?? {};
+	if (defaults.limits !== void 0) validateUsageLimits(defaults.limits, "preflight.engine.defaults.limits");
+	if (input.run?.limits !== void 0) validateUsageLimits(input.run.limits, "preflight.run.limits");
+	if (input.orchestrator?.limits !== void 0) validateUsageLimits(input.orchestrator.limits, "preflight.orchestrator.limits");
+	const findings = [];
+	const say = (finding) => {
+		findings.push(finding);
+	};
+	const adapters = new Map((engine.adapters ?? []).map((adapter) => [adapter.id, adapter]));
+	const capsOf = (ref) => {
+		const { adapterId, model } = parseModelRef(ref);
+		return adapters.get(adapterId)?.caps(model);
+	};
+	const pricingOf = (ref) => resolvePricing(ref, engine.pricing, capsOf(ref)?.pricing);
+	const ceilingUsd = input.run?.budgetUsd;
+	const flatReserveUsd = engine.budgetDefaults?.flatReserveUsd ?? .5;
+	const lifetimeSpawnCap = engine.budgetDefaults?.lifetimeSpawnCap ?? 500;
+	const childBudgetFraction = engine.budgetDefaults?.childBudgetFraction ?? .3;
+	const maxDepth = engine.budgetDefaults?.maxDepth ?? 1;
+	const perRun = engine.concurrency?.perRun ?? 12;
+	const runLimits = mergeUsageLimits(void 0, input.run?.limits, defaults.limits);
+	let orchestratorEcho;
+	let reservedForFinalizationUsd = 0;
+	let effectiveCapUsd;
+	if (input.orchestrator !== void 0) {
+		const spec = input.orchestrator.budget;
+		const fraction = spec?.capFraction ?? .2;
+		const fromFraction = ceilingUsd === void 0 ? void 0 : fraction * ceilingUsd;
+		const bounds = [spec?.capUsd, fromFraction].filter((bound) => bound !== void 0);
+		effectiveCapUsd = bounds.length === 0 ? void 0 : Math.min(...bounds);
+		const finalizeTurns = spec?.finalizeTurns ?? 2;
+		const finalizeReserveUsd = spec?.finalizeReserveUsd ?? finalizeTurns * flatReserveUsd;
+		const reserveCommitted = input.orchestrator.extension === true;
+		if (reserveCommitted) reservedForFinalizationUsd = finalizeReserveUsd;
+		orchestratorEcho = {
+			...effectiveCapUsd === void 0 ? {} : { effectiveCapUsd },
+			finalizeReserveUsd,
+			finalizeTurns,
+			reserveCommitted
 		};
-		if (commitReserve) try {
-			this.budget.admitSpawn(reserveUsd, spec.parentAccountScope);
-		} catch {
-			return {
-				verdict: {
-					kind: "reject",
-					reason: { code: "budget" }
-				},
-				statsBefore
+		if (spec?.capUsd !== void 0 && spec.capFraction === void 0 && effectiveCapUsd !== void 0 && effectiveCapUsd < spec.capUsd) say({
+			severity: "warning",
+			code: "orchestrator-cap-fraction-bound",
+			message: `orchestrator budget.capUsd ${spec.capUsd.toFixed(4)} USD is bounded to ${effectiveCapUsd.toFixed(4)} USD by the default capFraction 0.2 of the run ceiling; pass capFraction: 1.0 to make capUsd the sole bound`
+		});
+		if (input.orchestrator.extension === true && effectiveCapUsd !== void 0 && effectiveCapUsd < finalizeReserveUsd) say({
+			severity: "error",
+			code: "orchestrator-cap-below-finalize-reserve",
+			message: `effectiveCap ${effectiveCapUsd.toFixed(4)} USD is below the finalize reserve ${finalizeReserveUsd.toFixed(4)} USD: the run would refuse to start`
+		});
+	}
+	const spawnSpecs = input.spawns ?? [];
+	spawnSpecs.forEach(validateSpawnSpec);
+	const spawnReports = [];
+	const units = [];
+	for (const spec of spawnSpecs) {
+		const role = spec.role ?? "loop";
+		const label = spec.label ?? role;
+		const count = spec.count ?? 1;
+		const profile = spec.profile === void 0 ? void 0 : defaults.profiles?.[spec.profile];
+		if (spec.profile !== void 0 && profile === void 0) say({
+			severity: "error",
+			code: "unknown-profile",
+			message: `spawn '${label}' names profile '${spec.profile}', which defaults.profiles does not register`,
+			spawn: label
+		});
+		const limits = mergeUsageLimits(spec.limits, profile?.limits, defaults.limits);
+		const servedBy = resolveServing(spec.model ?? profile?.routing?.[role] ?? profile?.model ?? defaults.routing?.[role]);
+		if (servedBy === void 0) say({
+			severity: "error",
+			code: "unrouted-role",
+			message: `spawn '${label}' resolves no model for role '${role}': the run would fail with a ConfigError at spawn time; set a model, a profile model, or defaults.routing.${role}`,
+			spawn: label
+		});
+		const caps = servedBy === void 0 ? void 0 : capsOf(servedBy);
+		const pricing = servedBy === void 0 ? void 0 : pricingOf(servedBy);
+		const unpriced = servedBy !== void 0 && pricing === void 0;
+		let reserveSource;
+		let reserveUsd;
+		if (unpriced && spec.estCost === void 0 && profile?.estCost === void 0) {
+			reserveSource = "unpriced-zero";
+			reserveUsd = 0;
+		} else {
+			reserveSource = spec.estCost !== void 0 ? "estCost" : profile?.estCost !== void 0 ? "profile-estCost" : spec.estInputTokens !== void 0 && caps?.pricing !== void 0 ? "priced-estimate" : "flat-default";
+			reserveUsd = admissionReserveUsd({
+				...spec.estCost === void 0 ? {} : { estCost: spec.estCost },
+				...profile?.estCost === void 0 ? {} : { profileEstCost: profile.estCost },
+				...spec.estInputTokens === void 0 ? {} : { inputTokens: spec.estInputTokens },
+				...caps === void 0 ? {} : { caps },
+				...limits.maxOutputTokensPerTurn === void 0 ? {} : { maxOutputTokensPerTurn: limits.maxOutputTokensPerTurn },
+				flatReserveUsd
+			});
+		}
+		const outputBound = caps === void 0 ? limits.maxOutputTokensPerTurn : limits.maxOutputTokensPerTurn === void 0 ? caps.maxOutputTokens : Math.min(caps.maxOutputTokens, limits.maxOutputTokensPerTurn);
+		if (caps !== void 0 && limits.maxOutputTokensPerTurn !== void 0 && limits.maxOutputTokensPerTurn > caps.maxOutputTokens) say({
+			severity: "warning",
+			code: "output-cap-above-model",
+			message: `spawn '${label}' sets maxOutputTokensPerTurn ${String(limits.maxOutputTokensPerTurn)} above the model's maxOutputTokens ${String(caps.maxOutputTokens)}: the model clamp wins`,
+			spawn: label
+		});
+		const turnFloorUsd = pricing === void 0 || outputBound === void 0 ? void 0 : priceUsdOf(pricing, {
+			inputTokens: spec.estInputTokens ?? 0,
+			outputTokens: outputBound,
+			cacheReadTokens: 0,
+			cacheWriteTokens: 0
+		});
+		const toolCeilings = toolCeilingsOf(limits);
+		const overall = toolCeilings.reduce((best, row) => row.ceiling === null ? best : best === null ? row.ceiling : Math.max(best, row.ceiling), null);
+		const executedToolCallCeiling = limits.maxToolCalls !== void 0 && (overall === null || limits.maxToolCalls < overall) ? limits.maxToolCalls : overall;
+		for (const row of toolCeilings) {
+			if (row.tool === ANY_TOOL) continue;
+			const cost = limits.toolUnits?.costs?.[row.tool];
+			if (cost !== void 0 && cost > 0 && limits.toolUnits !== void 0 && cost > limits.toolUnits.max) {
+				say({
+					severity: "warning",
+					code: "tool-unaffordable",
+					message: `spawn '${label}' prices tool '${row.tool}' at ${String(cost)} units against toolUnits.max ${String(limits.toolUnits.max)}: the tool can never execute`,
+					spawn: label
+				});
+				continue;
+			}
+			if (row.boundBy === "toolUnits" && row.ceiling !== null) {
+				const nominal = limits.maxToolCalls;
+				const cap = limits.maxCallsPerTool?.[row.tool];
+				if (nominal !== void 0 && row.ceiling < nominal || cap !== void 0 && row.ceiling < cap) say({
+					severity: "warning",
+					code: "weighted-units-bind-first",
+					message: `spawn '${label}': toolUnits is the first bottleneck for '${row.tool}': ${String(row.ceiling)} executed calls (cost ${String(limits.toolUnits?.costs?.[row.tool] ?? 1)} of max ${String(limits.toolUnits?.max ?? 0)})` + (nominal === void 0 ? "" : ` while maxToolCalls suggests ${String(nominal)}`),
+					spawn: label
+				});
+			}
+			const cap = limits.maxCallsPerTool?.[row.tool];
+			if (cap !== void 0 && cap > 0 && row.ceiling !== null && row.boundBy !== "maxCallsPerTool") say({
+				severity: "info",
+				code: "per-tool-cap-unreachable",
+				message: `spawn '${label}': maxCallsPerTool['${row.tool}'] ${String(cap)} can never bind: ${row.boundBy ?? "another limiter"} already stops at ${String(row.ceiling)}`,
+				spawn: label
+			});
+		}
+		if (limits.finalizationReserve !== void 0 && limits.maxToolCalls === void 0 && limits.toolUnits === void 0) say({
+			severity: "warning",
+			code: "inert-finalization-reserve",
+			message: `spawn '${label}' sets finalizationReserve without maxToolCalls or toolUnits: no tool budget limiter exists for it to fire on`,
+			spawn: label
+		});
+		if (limits.toolBudgetNotices === true && limits.maxToolCalls === void 0) say({
+			severity: "warning",
+			code: "inert-tool-budget-notices",
+			message: `spawn '${label}' sets toolBudgetNotices without maxToolCalls: the notices never fire`,
+			spawn: label
+		});
+		if (unpriced && ceilingUsd !== void 0) say({
+			severity: "warning",
+			code: "unpriced-under-ceiling",
+			message: `spawn '${label}' is served by '${servedBy ?? ""}' with no price row: the ${ceilingUsd.toFixed(4)} USD run ceiling does NOT bound it and its admission reserve is zero`,
+			spawn: label
+		});
+		spawnReports.push({
+			label,
+			role,
+			count,
+			...servedBy === void 0 ? {} : { servedBy },
+			...unpriced ? { unpriced: true } : {},
+			limits,
+			admissionReserveUsd: reserveUsd,
+			reserveSource,
+			...outputBound === void 0 ? {} : { maxOutputTokensPerTurn: outputBound },
+			...turnFloorUsd === void 0 ? {} : { turnFloorUsd },
+			executedToolCallCeiling,
+			toolCeilings
+		});
+		for (let i = 0; i < count; i += 1) {
+			const unit = {
+				label: count === 1 ? label : `${label}#${String(i + 1)}`,
+				tokensFloor: (spec.estInputTokens ?? 0) + (outputBound ?? 0)
 			};
+			if (servedBy !== void 0) {
+				const { adapterId, model } = parseModelRef(servedBy);
+				unit.provider = adapterId;
+				unit.model = model;
+			}
+			if (turnFloorUsd !== void 0) unit.turnFloorUsd = turnFloorUsd;
+			units.push(unit);
 		}
+	}
+	if (input.orchestrator !== void 0) {
+		const servedBy = resolveServing(defaults.routing?.orchestrate);
+		if (servedBy === void 0) say({
+			severity: "error",
+			code: "unrouted-role",
+			message: "the orchestrator resolves no model for role 'orchestrate': set defaults.routing.orchestrate or an orchestrate model on the call",
+			spawn: "orchestrator"
+		});
 		else {
-			const remainder = this.budget.remainderOf(spec.parentAccountScope);
-			const projection = this.projectedDispatchReserveUsd(spec);
-			if (remainder !== void 0 && (remainder <= 0 || remainder < projection + (spec.pendingReserveUsd ?? 0))) return {
-				verdict: {
-					kind: "reject",
-					reason: { code: "budget" }
-				},
-				statsBefore
+			const caps = capsOf(servedBy);
+			const pricing = pricingOf(servedBy);
+			const orchLimits = mergeUsageLimits(input.orchestrator.limits, void 0, defaults.limits);
+			const outputBound = caps === void 0 ? orchLimits.maxOutputTokensPerTurn : orchLimits.maxOutputTokensPerTurn === void 0 ? caps.maxOutputTokens : Math.min(caps.maxOutputTokens, orchLimits.maxOutputTokensPerTurn);
+			const { adapterId, model } = parseModelRef(servedBy);
+			const unit = {
+				label: "orchestrator",
+				provider: adapterId,
+				model,
+				tokensFloor: outputBound ?? 0
 			};
-		}
-		this.childrenOf.set(nodeKey, childrenBefore + 1);
-		this.admittedTotal += 1;
-		const lineage = evaluated.decision.lineage;
-		this.registerLineageAdmit(lineage.logicalTaskId);
-		let spawnUnitsAfter = this.budget.spawnHeadroom;
-		if (this.terminationAccount !== void 0) {
-			const debited = this.terminationAccount.debitSpawn({
-				logicalTaskId: lineage.logicalTaskId,
-				isNew: spec.lineage === void 0,
-				ladderLength: spec.ladderLength ?? 1
+			if (pricing !== void 0 && outputBound !== void 0) unit.turnFloorUsd = priceUsdOf(pricing, {
+				inputTokens: 0,
+				outputTokens: outputBound,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0
 			});
-			if (!debited.ok) return {
-				verdict: {
-					kind: "reject",
-					reason: { code: "termination_exhausted" }
-				},
-				statsBefore
-			};
-			spawnUnitsAfter = debited.spawnUnitsAfter;
+			units.push(unit);
 		}
-		return {
-			verdict: {
-				kind: "admit",
-				reserve,
-				spawnUnitsAfter,
-				lineage: {
-					logicalTaskId: lineage.logicalTaskId,
-					isNew: spec.lineage === void 0,
-					depth
-				}
-			},
-			statsBefore,
-			nodeId: this.mintId(),
-			lineage,
-			...this.terminationAccount === void 0 ? {} : { ladderLength: spec.ladderLength ?? 1 }
+	}
+	const wave = [];
+	let committed = 0;
+	let spawned = 0;
+	let children = 0;
+	const admitAgainstRoot = (reserveUsd) => {
+		if (ceilingUsd === void 0) return true;
+		const held = committed + reservedForFinalizationUsd;
+		return !(held >= ceilingUsd || held + reserveUsd > ceilingUsd);
+	};
+	if (input.orchestrator !== void 0) {
+		const reserveUsd = flatReserveUsd;
+		let deniedBy;
+		if (spawned >= lifetimeSpawnCap) deniedBy = "spawn-cap";
+		else if (effectiveCapUsd !== void 0 && reserveUsd > effectiveCapUsd) deniedBy = "orchestrator-cap";
+		else if (!admitAgainstRoot(reserveUsd)) deniedBy = "budget";
+		wave.push({
+			label: "orchestrator",
+			reserveUsd,
+			admitted: deniedBy === void 0,
+			...deniedBy === void 0 ? {} : { deniedBy }
+		});
+		if (deniedBy === void 0) {
+			committed += reserveUsd;
+			spawned += 1;
+		} else if (deniedBy === "orchestrator-cap") say({
+			severity: "error",
+			code: "orchestrator-cap-below-reserve",
+			message: `the orchestrator's own admission reserve ${reserveUsd.toFixed(4)} USD does not fit its effective cap ${(effectiveCapUsd ?? 0).toFixed(4)} USD: the run cannot start`
+		});
+	}
+	const maxSpawns = input.orchestrator?.maxSpawns;
+	for (const report of spawnReports) for (let i = 0; i < report.count; i += 1) {
+		const label = report.count === 1 ? report.label : `${report.label}#${String(i + 1)}`;
+		const reserveUsd = report.admissionReserveUsd;
+		let deniedBy;
+		if (spawned >= lifetimeSpawnCap) deniedBy = "spawn-cap";
+		else if (maxSpawns !== void 0 && children >= maxSpawns) deniedBy = "orchestrator-max-spawns";
+		else if (!admitAgainstRoot(reserveUsd)) deniedBy = "budget";
+		wave.push({
+			label,
+			reserveUsd,
+			admitted: deniedBy === void 0,
+			...deniedBy === void 0 ? {} : { deniedBy }
+		});
+		if (deniedBy === void 0) {
+			committed += reserveUsd;
+			spawned += 1;
+			children += 1;
+		}
+	}
+	const admitted = wave.filter((row) => row.admitted).length;
+	const denied = wave.length - admitted;
+	if (wave.length > 0 && denied > 0) {
+		const deniedLabels = wave.filter((row) => !row.admitted).map((row) => row.label);
+		if (admitted === 0) say({
+			severity: "error",
+			code: "nothing-admitted",
+			message: `the declared wave admits NOTHING: every spawn is denied (${deniedLabels.join(", ")}); no paid work can start`
+		});
+		else say({
+			severity: "warning",
+			code: "partial-admission",
+			message: `the declared wave admits ${String(admitted)} of ${String(wave.length)} spawns; denied before any work: ${deniedLabels.join(", ")}`
+		});
+	}
+	if (ceilingUsd === void 0 && wave.length > 0) say({
+		severity: "info",
+		code: "no-usd-ceiling",
+		message: "the run has no budgetUsd ceiling: only turn, tool, and time limits bound spend, and the whole declared wave admits"
+	});
+	const declaredUnits = units.length;
+	const maxInFlight = declaredUnits === 0 ? perRun : Math.min(perRun, declaredUnits);
+	const perProviderCaps = engine.concurrency?.perProvider;
+	const perProvider = {};
+	const byProvider = /* @__PURE__ */ new Map();
+	for (const unit of units) {
+		if (unit.provider === void 0) continue;
+		const list = byProvider.get(unit.provider) ?? [];
+		list.push(unit);
+		byProvider.set(unit.provider, list);
+	}
+	for (const [provider, list] of [...byProvider.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+		const cap = perProviderCaps?.[provider];
+		const inFlight = Math.min(list.length, maxInFlight, cap ?? Number.POSITIVE_INFINITY);
+		perProvider[provider] = {
+			inFlight,
+			requestsPerWave: inFlight,
+			tokensPerWaveFloor: [...list].sort((a, b) => b.tokensFloor - a.tokensFloor).slice(0, inFlight).reduce((sum, unit) => sum + unit.tokensFloor, 0)
 		};
 	}
-	/**
-	* Resume roll-forward for an orchestrator child (M6-T07): restores the
-	* children-quota counter only. The budget seed already counts settled
-	* agent dispatches, and an in-flight child re-commits its reserve
-	* through the ctx.agent dispatch path.
-	*/
-	recoverChild(nodeKey) {
-		this.childrenOf.set(nodeKey, (this.childrenOf.get(nodeKey) ?? 0) + 1);
-		this.admittedTotal += 1;
+	const pricedTurns = units.map((unit) => unit.turnFloorUsd).filter((usd) => usd !== void 0).sort((a, b) => b - a).slice(0, maxInFlight);
+	const overshootOneTurnFloorUsd = pricedTurns.length === 0 ? void 0 : pricedTurns.reduce((sum, usd) => sum + usd, 0);
+	if (ceilingUsd !== void 0 && overshootOneTurnFloorUsd !== void 0 && units.length > 0) say({
+		severity: "info",
+		code: "overshoot-exposure",
+		message: `past a ceiling crossing, up to ${String(Math.min(maxInFlight, units.length))} in-flight turns may still complete: at least ${overshootOneTurnFloorUsd.toFixed(4)} USD past the ${ceilingUsd.toFixed(4)} USD ceiling at the declared estimates, growing with prompt size`
+	});
+	const quotaConfigured = engine.quota !== void 0;
+	if (!quotaConfigured && maxInFlight > 1 && units.length > 0) say({
+		severity: "info",
+		code: "no-quota",
+		message: `no shared quota limiter is configured while up to ${String(maxInFlight)} turns run concurrently: provider-side rate limits are unprotected (createEngine quota)`
+	});
+	if (input.quotaRules !== void 0) input.quotaRules.forEach((rule, index) => {
+		let requests = 0;
+		let tokens = 0;
+		for (const unit of units) {
+			if (unit.provider === void 0 || unit.model === void 0) continue;
+			if (quotaRuleMatches(rule, {
+				provider: unit.provider,
+				model: unit.model,
+				...engine.quota?.tenant === void 0 ? {} : { tenant: engine.quota.tenant },
+				estimate: {
+					requests: 1,
+					inputTokens: 0
+				}
+			})) {
+				requests += 1;
+				tokens += unit.tokensFloor;
+			}
+		}
+		const dims = [
+			rule.provider === void 0 ? void 0 : `provider=${rule.provider}`,
+			rule.model === void 0 ? void 0 : `model=${rule.model}`,
+			rule.tenant === void 0 ? void 0 : `tenant=${rule.tenant}`
+		].filter((dim) => dim !== void 0).join(" ");
+		const name = dims === "" ? `rule[${String(index)}]` : `rule[${String(index)}] (${dims})`;
+		if (rule.requestsPerMinute !== void 0 && requests > rule.requestsPerMinute) say({
+			severity: "warning",
+			code: "quota-requests-below-wave",
+			message: `${name}: the declared wave holds ${String(requests)} matching dispatches against requestsPerMinute ${String(rule.requestsPerMinute)}: expect synthetic rate-limit denials and backoff inside one window`
+		});
+		if (rule.tokensPerMinute !== void 0 && tokens > rule.tokensPerMinute) say({
+			severity: "warning",
+			code: "quota-tokens-below-wave",
+			message: `${name}: the declared wave demands at least ${String(tokens)} tokens against tokensPerMinute ${String(rule.tokensPerMinute)}: expect estimate-driven throttling inside one window`
+		});
+	});
+	const severityRank = {
+		error: 0,
+		warning: 1,
+		info: 2
+	};
+	findings.sort((a, b) => severityRank[a.severity] - severityRank[b.severity]);
+	return {
+		concurrency: {
+			perRun,
+			...perProviderCaps === void 0 ? {} : { perProvider: { ...perProviderCaps } }
+		},
+		budget: {
+			...ceilingUsd === void 0 ? {} : { ceilingUsd },
+			flatReserveUsd,
+			lifetimeSpawnCap,
+			childBudgetFraction,
+			maxDepth,
+			...orchestratorEcho === void 0 ? {} : { orchestrator: orchestratorEcho }
+		},
+		quota: {
+			configured: quotaConfigured,
+			...engine.quota?.tenant === void 0 ? {} : { tenant: engine.quota.tenant },
+			...input.quotaRules === void 0 ? {} : { rules: input.quotaRules.length }
+		},
+		runLimits,
+		spawns: spawnReports,
+		admission: {
+			...ceilingUsd === void 0 ? {} : { ceilingUsd },
+			reservedForFinalizationUsd,
+			wave,
+			admitted,
+			denied
+		},
+		exposure: {
+			maxInFlight,
+			...overshootOneTurnFloorUsd === void 0 ? {} : { overshootOneTurnFloorUsd },
+			perProvider
+		},
+		findings
+	};
+}
+//#endregion
+//#region src/engine/run-profiles.ts
+/**
+* The shipped presets (fast / standard / deep / ultra "and similar").
+* Data only; a review-time assertion checks the
+* engine has zero behavioral branches keyed on these names.
+*/
+const RUN_PROFILES = {
+	fast: {
+		effortByRole: {
+			orchestrate: "low",
+			plan: "low",
+			summarize: "low",
+			extract: "low"
+		},
+		perRunConcurrency: 16,
+		permissionPreset: "standard",
+		lifetimeSpawnCap: 64,
+		maxDepth: 1
+	},
+	standard: {
+		effortByRole: {
+			orchestrate: "high",
+			plan: "high",
+			summarize: "low",
+			extract: "low"
+		},
+		perRunConcurrency: 12,
+		permissionPreset: "standard",
+		lifetimeSpawnCap: 500,
+		maxDepth: 1
+	},
+	deep: {
+		effortByRole: {
+			orchestrate: "high",
+			plan: "high",
+			summarize: "medium",
+			extract: "medium"
+		},
+		perRunConcurrency: 8,
+		permissionPreset: "standard",
+		lifetimeSpawnCap: 500,
+		maxDepth: 2
+	},
+	ultra: {
+		effortByRole: {
+			orchestrate: "max",
+			plan: "max",
+			summarize: "high",
+			extract: "high"
+		},
+		perRunConcurrency: 8,
+		permissionPreset: "strict",
+		lifetimeSpawnCap: 500,
+		maxDepth: 3
+	}
+};
+/** Looks up a shipped RunProfile by name; undefined for unknown names. */
+function runProfile(name) {
+	return RUN_PROFILES[name];
+}
+//#endregion
+//#region src/model/concurrency.ts
+/**
+* Per-provider concurrency keys (M4-T07): a keyed limiter beside the
+* router, ENGINE-scoped (keys constrain calls
+* across a single engine per adapter). The Appendix A default is
+* unlimited: an embeddable library must not surprise-throttle hosts, so
+* the per-run semaphore stays the only default bound and provider 429s
+* ride RetryPolicy; hosts with known tier limits opt in per adapter id
+* via createEngine concurrency.perProvider.
+*
+* This keyed limiter bounds PARALLELISM inside one engine only. Two
+* processes sharing one API key coordinate through the QuotaLimiter
+* SPI instead (RV-215, createEngine `quota`): rate and volume live
+* there, in shared storage; in-flight slots live here.
+*/
+var KeyedLimiter = class {
+	semaphores = /* @__PURE__ */ new Map();
+	constructor(caps) {
+		for (const [key, limit] of Object.entries(caps ?? {})) this.semaphores.set(key, new Semaphore(limit));
 	}
-	/**
-	* Resume roll-forward for a child that already SETTLED before the
-	* resume: re-registers the counters (maxChildrenPerNode, the lifetime
-	* cap, statsBefore fidelity) without committing any reserve; the spend
-	* itself sits in the root ledger seed.
-	*/
-	recoverSettled(parentAccountScope) {
-		this.budget.admitRecovered(0, parentAccountScope);
-		this.childrenOf.set(parentAccountScope, (this.childrenOf.get(parentAccountScope) ?? 0) + 1);
-		this.admittedTotal += 1;
+	/** Queue depth for one key (0 for unlimited keys); telemetry only. */
+	pending(key) {
+		return this.semaphores.get(key)?.pending ?? 0;
 	}
 	/**
-	* Resume roll-forward for an admission whose decision entry exists but
-	* whose child has NOT settled: re-applies the recorded reserve and
-	* counters without re-evaluating any limit (replay never
-	* re-evaluates admission; reserves are recovered, never
-	* re-estimated).
+	* Runs `fn` under the key's semaphore; keys without a configured cap
+	* run unlimited (no queueing, no overhead). An aborted `signal` frees
+	* a queued caller without a slot (the Semaphore contract), so run
+	* cancellation drains provider queues too (v1.34.0 review P2-4).
 	*/
-	recoverInFlight(parentAccountScope, verdict) {
-		if (verdict.kind === "reject") return;
-		const reserveUsd = verdict.kind === "reuse_full" ? 0 : verdict.reserve.reserveUsd;
-		this.budget.admitRecovered(reserveUsd, parentAccountScope);
-		this.childrenOf.set(parentAccountScope, (this.childrenOf.get(parentAccountScope) ?? 0) + 1);
-		this.admittedTotal += 1;
+	async withSlot(key, fn, onQueued, signal) {
+		const semaphore = this.semaphores.get(key);
+		if (semaphore === void 0) return fn();
+		return semaphore.withSlot(fn, onQueued, signal);
 	}
 };
 //#endregion
+//#region src/model/profile-card.ts
+function toolNamesOf(profile) {
+	return (profile.tools ?? []).map((entry) => {
+		if (typeof entry === "string") return `${entry} (registered toolset)`;
+		if ("kind" in entry && entry.kind === "tool") return entry.name;
+		return `${entry.id}:* (tool source)`;
+	});
+}
+/**
+* Renders the registry into the shared agent vocabulary card. Sorted,
+* deterministic, byte-stable; an empty registry renders explicitly so
+* the planner never guesses at unregistered agentTypes. When the engine
+* registers toolsets, their names render as a closing line (v1.17.0
+* review P1-3): those are the ONLY values valid as string entries of a
+* tools option, so the planner never invents a registry name.
+*/
+function profileCard(profiles, toolsets) {
+	const toolsetNames = Object.keys(toolsets ?? {}).sort();
+	const toolsetsLine = toolsetNames.length === 0 ? void 0 : `Registered toolsets (valid string entries of a tools option): ${toolsetNames.join(", ")}.`;
+	const names = Object.keys(profiles ?? {}).sort();
+	if (profiles === void 0 || names.length === 0) {
+		const empty = "Agent profiles: none registered. Calls take no agentType.";
+		return toolsetsLine === void 0 ? empty : `${empty}\n${toolsetsLine}`;
+	}
+	const lines = ["Agent profiles (agentType values):"];
+	for (const name of names) {
+		const profile = profiles[name];
+		const description = profile.description ?? "no description";
+		lines.push(`- ${name}: ${description}`);
+		const toolNames = toolNamesOf(profile);
+		if (toolNames.length > 0) lines.push(`  tools: ${toolNames.join(", ")}`);
+		if (profile.taskClass !== void 0) lines.push(`  taskClass: ${profile.taskClass}`);
+		if (profile.estCost !== void 0) lines.push(`  estCost: ${profile.estCost.toFixed(2)} USD`);
+		if (profile.escalation !== void 0) lines.push(`  escalation: flavor ${profile.escalation.flavor ?? "A"} (opt-in)`);
+	}
+	if (toolsetsLine !== void 0) lines.push(toolsetsLine);
+	return lines.join("\n");
+}
+//#endregion
+//#region src/runtime/permission-chain.ts
+/**
+* The layered permission chain (M3-T03): the single approval surface for
+* every tool dispatch, regardless of tool origin. The order is fixed and
+* normative: hooks -> deny rules -> ask rules -> canUseTool -> terminal
+* default (allow unless needsApproval, then ask). Evaluation is
+* short-circuit; unconfigured layers are skipped. Rules never yield
+* allow: allow is only ever falling through to canUseTool or the
+* terminal default.
+*
+* Full contract: https://docs.rulvar.com/guide/tools.
+* Risk presets, the argv shell matcher, domain rules, and the
+* audit/dry-run surface land in M5.
+*/
+/**
+* Merges the engine-wide config and the profile config into one chain.
+* Layers concatenate engine-first; since rules only deny or ask, ordering
+* within a layer cannot change the verdict. The
+* profile's canUseTool wins over the engine's (a single slot by
+* construction). A declared preset compiles INTO the same layers, after
+* the host-authored rules, never as a fifth layer (M5-T05).
+*/
+function compilePermissionChain(engine, profile) {
+	const preset = profile?.preset === void 0 ? {
+		deny: [],
+		ask: []
+	} : compilePermissionPreset(profile.preset);
+	const deny = [
+		...engine?.deny ?? [],
+		...profile?.deny ?? [],
+		...preset.deny
+	];
+	const ask = [
+		...engine?.ask ?? [],
+		...profile?.ask ?? [],
+		...preset.ask
+	];
+	const canUseTool = profile?.canUseTool ?? engine?.canUseTool;
+	return {
+		hooks: [...engine?.hooks ?? [], ...profile?.hooks ?? []],
+		deny,
+		ask,
+		...canUseTool === void 0 ? {} : { canUseTool }
+	};
+}
+/** The command text an argv rule matches against. */
+function commandOf(input) {
+	if (typeof input === "string") return input;
+	if (typeof input === "object" && input !== null) {
+		const command = input.command;
+		if (typeof command === "string") return command;
+	}
+}
+function ruleMatches(rule, toolName, risk, input) {
+	if ("risk" in rule) {
+		const risks = Array.isArray(rule.risk) ? rule.risk : [rule.risk];
+		if (risks.includes("undeclared") && risk === void 0) return true;
+		return risk !== void 0 && risks.includes(risk);
+	}
+	if ("domains" in rule) return false;
+	if (!(Array.isArray(rule.tool) ? rule.tool : [rule.tool]).includes(toolName)) return false;
+	if ("argv" in rule) {
+		const command = commandOf(input);
+		if (command === void 0) return false;
+		const patterns = Array.isArray(rule.argv) ? rule.argv : [rule.argv];
+		return lexShellCommand(command).some((segment) => !segment.unmatchable && patterns.some((pattern) => matchArgvPattern(pattern, segment.argv)));
+	}
+	return true;
+}
+/**
+* Advisory domain-rule matches for the audit payload:
+* reported, never enforced in the current release.
+*/
+function advisoryMatches(chain, toolName) {
+	return [...chain.deny, ...chain.ask].filter((rule) => "domains" in rule && rule.tool === toolName);
+}
+/**
+* Unmatchable segments (command/process substitution, here-docs) yield
+* ask, ALWAYS, for any tool that has argv rules.
+*/
+function argvUnmatchableAsk(chain, toolName, input) {
+	if (![...chain.deny, ...chain.ask].some((rule) => "argv" in rule && (Array.isArray(rule.tool) ? rule.tool : [rule.tool]).includes(toolName))) return false;
+	const command = commandOf(input);
+	if (command === void 0) return true;
+	return lexShellCommand(command).some((segment) => segment.unmatchable);
+}
+/** A stub ToolContext for offline (dry-run) evaluations. */
+function offlineContext(toolName) {
+	return {
+		runId: "dry-run",
+		spanId: `dry-run-${toolName}`,
+		agent: { agentType: "" },
+		cwd: process.cwd(),
+		isolation: "none",
+		signal: new AbortController().signal,
+		log: () => void 0
+	};
+}
+/**
+* Evaluates the chain for one dispatch, or OFFLINE against a
+* hypothetical call by tool name (the dry-run API: nothing executes;
+* shells and tests read the verdict, the
+* deciding layer, and the matched rule). Hooks run in deterministic
+* registration order; { modifiedInput } substitutes the input and
+* continues; the first decisive verdict wins. The returned input is what
+* execute receives and what the approval identity hashes (post hook
+* modification). Advisory domain-rule matches
+* ride every verdict for the audit payload.
+*/
+async function evaluatePermission(chain, tool, input, ctx) {
+	const def = typeof tool === "string" ? {
+		name: tool,
+		needsApproval: false
+	} : tool;
+	const risk = typeof tool === "string" ? void 0 : tool.risk;
+	const context = ctx ?? offlineContext(def.name);
+	const advisory = advisoryMatches(chain, def.name);
+	const withAdvisory = (verdict) => advisory.length === 0 ? verdict : {
+		...verdict,
+		advisory
+	};
+	let effective = input;
+	for (const hook of chain.hooks) {
+		const verdict = await hook(def.name, effective, context);
+		if (verdict === void 0) continue;
+		if (verdict === "allow" || verdict === "deny" || verdict === "ask") return withAdvisory({
+			verdict,
+			decidedBy: "hook",
+			input: effective
+		});
+		effective = verdict.modifiedInput;
+	}
+	for (const rule of chain.deny) if (ruleMatches(rule, def.name, risk, effective)) return withAdvisory({
+		verdict: "deny",
+		decidedBy: "deny-rule",
+		rule,
+		input: effective
+	});
+	for (const rule of chain.ask) if (ruleMatches(rule, def.name, risk, effective)) return withAdvisory({
+		verdict: "ask",
+		decidedBy: "ask-rule",
+		rule,
+		input: effective
+	});
+	if (argvUnmatchableAsk(chain, def.name, effective)) return withAdvisory({
+		verdict: "ask",
+		decidedBy: "ask-rule",
+		input: effective
+	});
+	if (chain.canUseTool !== void 0) {
+		const verdict = await chain.canUseTool(def.name, effective, context);
+		if (verdict === "allow") return withAdvisory({
+			verdict: "allow",
+			decidedBy: "canUseTool",
+			input: effective
+		});
+		if (verdict === "deny") return withAdvisory({
+			verdict: "deny",
+			decidedBy: "canUseTool",
+			input: effective
+		});
+		effective = verdict.modifiedInput;
+	}
+	if (def.needsApproval) return withAdvisory({
+		verdict: "ask",
+		decidedBy: "default",
+		input: effective
+	});
+	return withAdvisory({
+		verdict: "allow",
+		decidedBy: "default",
+		input: effective
+	});
+}
+//#endregion
 //#region src/orchestrator/finish-validators.ts
 /**
 * Deterministic host validation of the orchestrator finish result (the
@@ -18440,4 +18905,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, invoiceFromJournal, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceAuditTrail, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, invoiceFromJournal, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, preflightEstimate, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceAuditTrail, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };