@rulvar/core 1.63.0 → 1.65.0

package/dist/index.js

@@ -12246,6 +12246,20 @@ const DEFAULT_MAX_DEPTH = 1;
 const MAX_DEPTH_CEILING = 4;
 const DEFAULT_MAX_CHILDREN_PER_NODE = 16;
 const DEFAULT_CHILD_BUDGET_FRACTION = .3;
+/**
+* The ONE dispatch-projection reserve formula (the 1.63.0 experiment
+* review, P0.3): the spawn's declared estimate (a spawn tool has no
+* per-call estCost channel, so the estimate is the agentType profile's)
+* or the flat default, clamped by the explicit child budget when one
+* exists. This is the reserve the embedded layer-2 gate evaluates a
+* spawn_agent call against BEFORE dispatch, and the number
+* preflightEstimate projects for the same gate, so the linter and the
+* runtime cannot drift: both call this function.
+*/
+function dispatchProjectionReserveUsd(spec, flatReserveUsd) {
+	const base = spec.estCostUsd ?? flatReserveUsd;
+	return spec.budgetUsd === void 0 ? base : Math.min(base, spec.budgetUsd);
+}
 /** Nesting depth of a child scope: its workflow, agent, and plan-node segments. */
 function spawnDepthOf(childScope) {
 	return parseScopePath(childScope).filter((segment) => segment.kind === "workflow" || segment.kind === "agent" || segment.kind === "plan-node").length;
@@ -12390,11 +12404,13 @@ var AdmissionController = class {
 	* never materializes as an account and must not shrink the
 	* projection. The token-count-priced estimate of ctx.agent is
 	* unreachable here (async); a divergence there lands as a journaled
-	* dispatch rejection instead of a strand.
+	* dispatch rejection instead of a strand. Delegates to the exported
+	* {@link dispatchProjectionReserveUsd} so the live gate and
+	* preflightEstimate share ONE formula (the 1.63.0 experiment review,
+	* P0.3).
 	*/
 	projectedDispatchReserveUsd(spec) {
-		const base = spec.estCostUsd ?? this.flatReserveUsd;
-		return spec.budgetUsd === void 0 ? base : Math.min(base, spec.budgetUsd);
+		return dispatchProjectionReserveUsd(spec, this.flatReserveUsd);
 	}
 	admit(spec, options) {
 		const commitReserve = options?.commitReserve ?? true;
@@ -12565,1996 +12581,924 @@ var AdmissionController = class {
 	}
 };
 //#endregion
-//#region src/engine/scheduler.ts
+//#region src/model/profile-card.ts
+function toolNamesOf(profile) {
+	return (profile.tools ?? []).map((entry) => {
+		if (typeof entry === "string") return `${entry} (registered toolset)`;
+		if ("kind" in entry && entry.kind === "tool") return entry.name;
+		return `${entry.id}:* (tool source)`;
+	});
+}
 /**
-* Scheduler and concurrency (M1-T08): the per-run semaphore with a FIFO
-* queue (default 12 concurrent model calls). The engine lifetime spawn cap
-* is enforced by the budget layer at admission; parallel/pipeline
-* composition semantics live with ctx.
-* Per-provider concurrency keys land with M4.
+* Renders the registry into the shared agent vocabulary card. Sorted,
+* deterministic, byte-stable; an empty registry renders explicitly so
+* the planner never guesses at unregistered agentTypes. When the engine
+* registers toolsets, their names render as a closing line (v1.17.0
+* review P1-3): those are the ONLY values valid as string entries of a
+* tools option, so the planner never invents a registry name.
 */
-/** FIFO semaphore; default per-run width is 12. */
-const DEFAULT_PER_RUN_CONCURRENCY = 12;
-var Semaphore = class {
-	limit;
-	active = 0;
-	waiters = [];
-	/**
-	* `limit` must be a positive integer: anything else (NaN included) is
-	* a typed ConfigError. Before this gate a NaN limit made
-	* `active < limit` permanently false, so the first acquire queued
-	* forever and the run could not settle, not even through cancel()
-	* (v1.34.0 review P2-4). Unlimited is expressed by not constructing a
-	* semaphore, never by a sentinel limit.
-	*/
-	constructor(limit) {
-		requirePositiveInteger(limit, "Semaphore limit");
-		this.limit = limit;
-	}
-	get pending() {
-		return this.waiters.length;
-	}
-	/**
-	* Acquires a slot, resolving in FIFO order. `onQueued` fires only when
-	* the caller actually has to wait (feeds the agent:queued event).
-	* An aborted `signal` releases the caller from the queue without a
-	* slot: the returned release is a no-op, the remaining waiters keep
-	* their FIFO positions, and the caller proceeds to observe its own
-	* aborted signal (the model layers refuse dispatch under an aborted
-	* signal, so no provider call follows). Cancellation can therefore
-	* always drain a queued run (v1.34.0 review P2-4).
-	*/
-	async acquire(onQueued, signal) {
-		if (this.active < this.limit) {
-			this.active += 1;
-			return () => this.release();
-		}
-		if (signal?.aborted === true) return () => void 0;
-		onQueued?.();
-		const waiter = {
-			resolve: () => void 0,
-			aborted: false
-		};
-		const wait = new Promise((resolve) => {
-			waiter.resolve = resolve;
-		});
-		this.waiters.push(waiter);
-		let onAbort;
-		if (signal !== void 0) {
-			onAbort = () => {
-				const index = this.waiters.indexOf(waiter);
-				if (index === -1) return;
-				this.waiters.splice(index, 1);
-				waiter.aborted = true;
-				waiter.resolve();
-			};
-			signal.addEventListener("abort", onAbort, { once: true });
-		}
-		try {
-			await wait;
-		} finally {
-			if (signal !== void 0 && onAbort !== void 0) signal.removeEventListener("abort", onAbort);
-		}
-		if (waiter.aborted) return () => void 0;
-		this.active += 1;
-		return () => this.release();
-	}
-	async withSlot(fn, onQueued, signal) {
-		const release = await this.acquire(onQueued, signal);
-		try {
-			return await fn();
-		} finally {
-			release();
-		}
+function profileCard(profiles, toolsets) {
+	const toolsetNames = Object.keys(toolsets ?? {}).sort();
+	const toolsetsLine = toolsetNames.length === 0 ? void 0 : `Registered toolsets (valid string entries of a tools option): ${toolsetNames.join(", ")}.`;
+	const names = Object.keys(profiles ?? {}).sort();
+	if (profiles === void 0 || names.length === 0) {
+		const empty = "Agent profiles: none registered. Calls take no agentType.";
+		return toolsetsLine === void 0 ? empty : `${empty}\n${toolsetsLine}`;
 	}
-	release() {
-		this.active -= 1;
-		const next = this.waiters.shift();
-		if (next !== void 0) next.resolve();
+	const lines = ["Agent profiles (agentType values):"];
+	for (const name of names) {
+		const profile = profiles[name];
+		const description = profile.description ?? "no description";
+		lines.push(`- ${name}: ${description}`);
+		const toolNames = toolNamesOf(profile);
+		if (toolNames.length > 0) lines.push(`  tools: ${toolNames.join(", ")}`);
+		if (profile.taskClass !== void 0) lines.push(`  taskClass: ${profile.taskClass}`);
+		if (profile.estCost !== void 0) lines.push(`  estCost: ${profile.estCost.toFixed(2)} USD`);
+		if (profile.escalation !== void 0) lines.push(`  escalation: flavor ${profile.escalation.flavor ?? "A"} (opt-in)`);
 	}
-};
-//#endregion
-//#region src/engine/preflight.ts
-const ANY_TOOL = "(any)";
-function resolveServing(spec) {
-	if (spec === void 0) return;
-	if (typeof spec === "string") return spec;
-	if ("model" in spec) return spec.model;
-	return spec.ladder.rungs[spec.ladder.startTier]?.model;
+	if (toolsetsLine !== void 0) lines.push(toolsetsLine);
+	return lines.join("\n");
 }
+//#endregion
+//#region src/engine/internal.ts
+/** Registered by createCtx; keyed by the ctx object identity. */
+const ctxRuntimes = /* @__PURE__ */ new WeakMap();
 /**
-* Per-tool executed-call ceilings from the merged limits: for every
-* tool a per-tool cap or a unit cost names (plus the '(any)' tool that
-* nothing names, unit cost 1), the smallest of maxCallsPerTool[T],
-* floor(toolUnits.max / cost(T)) for a positive cost (a zero cost is
-* free), and maxToolCalls.
+* Internal AgentOpts channel (M6-T07): agentImpl reports the agent
+* dispatch seq (the spawn handle) through this symbol-keyed callback on
+* the running append, on a dangling redispatch, AND on the replay
+* branch, so the orchestrator learns handles that are stable across
+* resume. Never part of the public AgentOpts surface.
 */
-function toolCeilingsOf(limits) {
-	const names = /* @__PURE__ */ new Set();
-	for (const name of Object.keys(limits.maxCallsPerTool ?? {})) names.add(name);
-	for (const name of Object.keys(limits.toolUnits?.costs ?? {})) names.add(name);
-	const rows = [];
-	for (const tool of [...[...names].sort(), ANY_TOOL]) {
-		const terms = [];
-		const cap = tool === ANY_TOOL ? void 0 : limits.maxCallsPerTool?.[tool];
-		if (cap !== void 0) terms.push({
-			boundBy: "maxCallsPerTool",
-			ceiling: cap
-		});
-		if (limits.toolUnits !== void 0) {
-			const cost = tool === ANY_TOOL ? 1 : limits.toolUnits.costs?.[tool] ?? 1;
-			if (cost > 0) terms.push({
-				boundBy: "toolUnits",
-				ceiling: Math.floor(limits.toolUnits.max / cost)
-			});
-		}
-		if (limits.maxToolCalls !== void 0) terms.push({
-			boundBy: "maxToolCalls",
-			ceiling: limits.maxToolCalls
-		});
-		if (terms.length === 0) {
-			rows.push({
-				tool,
-				ceiling: null
-			});
-			continue;
-		}
-		const min = terms.reduce((best, term) => term.ceiling < best.ceiling ? term : best);
-		rows.push({
-			tool,
-			ceiling: min.ceiling,
-			boundBy: min.boundBy
-		});
-	}
-	return rows;
+const kOnRunning = Symbol("rulvar.onRunning");
+/**
+* Internal AgentOpts channel (M6-T07): names the terminal tool whose
+* accepted call ends the loop with status ok (the orchestrator finish
+* tool), plus the optional host validation hook over the accepted call
+* (the RV-204 finish validators). Never part of the public AgentOpts
+* surface.
+*/
+const kTerminalTool = Symbol("rulvar.terminalTool");
+/**
+* Internal AgentOpts channel (M7-T08): a transcript checkpoint ref the
+* fresh dispatch boots from (park/unpark continuation and the DEF-5
+* graft boot). Dangling redispatch checkpoints take precedence.
+*/
+const kBootCheckpoint = Symbol("rulvar.bootCheckpoint");
+/**
+* Internal AgentOpts channel: marks the orchestrator forced-finish
+* dispatch, whose spend draws from the released finalize reserve
+* (DEF-7). Settlement stamps the flag into the terminal's cost
+* attribution so the journal fold reproduces reserveUsedUsd.
+*/
+const kFinalizeReserve = Symbol("rulvar.finalizeReserve");
+/** Typed accessor used by the in-package consumers. */
+function runtimeOf(ctx) {
+	const runtime = ctxRuntimes.get(ctx);
+	if (runtime === void 0) throw new Error("ctx runtime missing: the ctx value was not created by createCtx (engine run context)");
+	return runtime;
 }
-function validateSpawnSpec(spec, index) {
-	const site = `preflight.spawns[${index}]`;
-	if (spec.limits !== void 0) validateUsageLimits(spec.limits, `${site}.limits`);
-	if (spec.estCost !== void 0) requireNonNegativeNumber(spec.estCost, `${site}.estCost`);
-	if (spec.estInputTokens !== void 0) requireNonNegativeInteger(spec.estInputTokens, `${site}.estInputTokens`);
-	if (spec.count !== void 0) requirePositiveInteger(spec.count, `${site}.count`);
+//#endregion
+//#region src/engine/spawn-events.ts
+function emitSpawnAdmitted(events, input) {
+	events.emit({
+		type: "spawn:admitted",
+		entryRef: input.entryRef,
+		verdict: input.verdict,
+		agentType: input.agentType,
+		logicalTaskId: input.logicalTaskId,
+		...input.spawnUnitsAfter === void 0 ? {} : { spawnUnitsAfter: input.spawnUnitsAfter }
+	}, input.spanId, input.replayed);
 }
+function emitSpawnRejected(events, input) {
+	events.emit({
+		type: "spawn:rejected",
+		...input.entryRef === void 0 ? {} : { entryRef: input.entryRef },
+		code: input.code,
+		agentType: input.agentType
+	}, input.spanId, input.replayed);
+}
+//#endregion
+//#region src/l0/long-timer.ts
 /**
-* Computes the preflight report: the effective merged limits per
-* declared spawn, the layer-1 admission projection over the declared
-* wave, the per-tool and weighted-unit bottleneck ordering, the
-* concurrency and quota exposure at the declared estimates, and the
-* linter findings. Pure: no engine is constructed, no store is opened,
-* no adapter stream is dispatched, and no journal entry is written.
+* Sliced timers for absolute wall-clock deadlines (v1.34.0 review P2-2).
+*
+* Node clamps a setTimeout delay above 2147483647 ms (about 24.8 days)
+* to 1 ms, so a naive timer for a far-future deadline fires immediately.
+* setLongTimeout never hands Node more than one MAX_TIMER_DELAY_MS
+* slice, re-checks the wall clock when a slice fires, and re-arms until
+* the clock actually reaches the deadline: firing a slice is never taken
+* as proof the deadline arrived. A deadline already in the past fires on
+* the next macrotask (delay 0), matching the plain setTimeout behavior
+* the callers had for near deadlines.
 */
-function preflightEstimate(input) {
-	const engine = input.engine ?? {};
-	const defaults = engine.defaults ?? {};
-	if (defaults.limits !== void 0) validateUsageLimits(defaults.limits, "preflight.engine.defaults.limits");
-	if (input.run?.limits !== void 0) validateUsageLimits(input.run.limits, "preflight.run.limits");
-	if (input.orchestrator?.limits !== void 0) validateUsageLimits(input.orchestrator.limits, "preflight.orchestrator.limits");
-	const findings = [];
-	const say = (finding) => {
-		findings.push(finding);
+/**
+* Schedules `onDue` for the absolute wall-clock instant `dueAtMs` as
+* reported by `now` (default Date.now), slicing delays beyond the Node
+* timer maximum.
+*/
+function setLongTimeout(onDue, dueAtMs, now = Date.now) {
+	let handle;
+	let cancelled = false;
+	const arm = () => {
+		const remaining = Math.max(0, dueAtMs - now());
+		handle = setTimeout(() => {
+			if (cancelled) return;
+			if (now() >= dueAtMs) {
+				onDue();
+				return;
+			}
+			arm();
+		}, Math.min(remaining, MAX_TIMER_DELAY_MS));
 	};
-	const adapters = new Map((engine.adapters ?? []).map((adapter) => [adapter.id, adapter]));
-	const capsOf = (ref) => {
-		const { adapterId, model } = parseModelRef(ref);
-		return adapters.get(adapterId)?.caps(model);
+	arm();
+	return { cancel: () => {
+		cancelled = true;
+		if (handle !== void 0) clearTimeout(handle);
+	} };
+}
+//#endregion
+//#region src/runtime/permission-chain.ts
+/**
+* The layered permission chain (M3-T03): the single approval surface for
+* every tool dispatch, regardless of tool origin. The order is fixed and
+* normative: hooks -> deny rules -> ask rules -> canUseTool -> terminal
+* default (allow unless needsApproval, then ask). Evaluation is
+* short-circuit; unconfigured layers are skipped. Rules never yield
+* allow: allow is only ever falling through to canUseTool or the
+* terminal default.
+*
+* Full contract: https://docs.rulvar.com/guide/tools.
+* Risk presets, the argv shell matcher, domain rules, and the
+* audit/dry-run surface land in M5.
+*/
+/**
+* Merges the engine-wide config and the profile config into one chain.
+* Layers concatenate engine-first; since rules only deny or ask, ordering
+* within a layer cannot change the verdict. The
+* profile's canUseTool wins over the engine's (a single slot by
+* construction). A declared preset compiles INTO the same layers, after
+* the host-authored rules, never as a fifth layer (M5-T05).
+*/
+function compilePermissionChain(engine, profile) {
+	const preset = profile?.preset === void 0 ? {
+		deny: [],
+		ask: []
+	} : compilePermissionPreset(profile.preset);
+	const deny = [
+		...engine?.deny ?? [],
+		...profile?.deny ?? [],
+		...preset.deny
+	];
+	const ask = [
+		...engine?.ask ?? [],
+		...profile?.ask ?? [],
+		...preset.ask
+	];
+	const canUseTool = profile?.canUseTool ?? engine?.canUseTool;
+	return {
+		hooks: [...engine?.hooks ?? [], ...profile?.hooks ?? []],
+		deny,
+		ask,
+		...canUseTool === void 0 ? {} : { canUseTool }
 	};
-	const pricingOf = (ref) => resolvePricing(ref, engine.pricing, capsOf(ref)?.pricing);
-	const ceilingUsd = input.run?.budgetUsd;
-	const flatReserveUsd = engine.budgetDefaults?.flatReserveUsd ?? .5;
-	const lifetimeSpawnCap = engine.budgetDefaults?.lifetimeSpawnCap ?? 500;
-	const childBudgetFraction = engine.budgetDefaults?.childBudgetFraction ?? .3;
-	const maxDepth = engine.budgetDefaults?.maxDepth ?? 1;
-	const perRun = engine.concurrency?.perRun ?? 12;
-	const runLimits = mergeUsageLimits(void 0, input.run?.limits, defaults.limits);
-	let orchestratorEcho;
-	let reservedForFinalizationUsd = 0;
-	let effectiveCapUsd;
-	if (input.orchestrator !== void 0) {
-		const spec = input.orchestrator.budget;
-		const fraction = spec?.capFraction ?? .2;
-		const fromFraction = ceilingUsd === void 0 ? void 0 : fraction * ceilingUsd;
-		const bounds = [spec?.capUsd, fromFraction].filter((bound) => bound !== void 0);
-		effectiveCapUsd = bounds.length === 0 ? void 0 : Math.min(...bounds);
-		const finalizeTurns = spec?.finalizeTurns ?? 2;
-		const finalizeReserveUsd = spec?.finalizeReserveUsd ?? finalizeTurns * flatReserveUsd;
-		const reserveCommitted = input.orchestrator.extension === true;
-		if (reserveCommitted) reservedForFinalizationUsd = finalizeReserveUsd;
-		orchestratorEcho = {
-			...effectiveCapUsd === void 0 ? {} : { effectiveCapUsd },
-			finalizeReserveUsd,
-			finalizeTurns,
-			reserveCommitted
-		};
-		if (spec?.capUsd !== void 0 && spec.capFraction === void 0 && effectiveCapUsd !== void 0 && effectiveCapUsd < spec.capUsd) say({
-			severity: "warning",
-			code: "orchestrator-cap-fraction-bound",
-			message: `orchestrator budget.capUsd ${spec.capUsd.toFixed(4)} USD is bounded to ${effectiveCapUsd.toFixed(4)} USD by the default capFraction 0.2 of the run ceiling; pass capFraction: 1.0 to make capUsd the sole bound`
-		});
-		if (input.orchestrator.extension === true && effectiveCapUsd !== void 0 && effectiveCapUsd < finalizeReserveUsd) say({
-			severity: "error",
-			code: "orchestrator-cap-below-finalize-reserve",
-			message: `effectiveCap ${effectiveCapUsd.toFixed(4)} USD is below the finalize reserve ${finalizeReserveUsd.toFixed(4)} USD: the run would refuse to start`
+}
+/** The command text an argv rule matches against. */
+function commandOf(input) {
+	if (typeof input === "string") return input;
+	if (typeof input === "object" && input !== null) {
+		const command = input.command;
+		if (typeof command === "string") return command;
+	}
+}
+function ruleMatches(rule, toolName, risk, input) {
+	if ("risk" in rule) {
+		const risks = Array.isArray(rule.risk) ? rule.risk : [rule.risk];
+		if (risks.includes("undeclared") && risk === void 0) return true;
+		return risk !== void 0 && risks.includes(risk);
+	}
+	if ("domains" in rule) return false;
+	if (!(Array.isArray(rule.tool) ? rule.tool : [rule.tool]).includes(toolName)) return false;
+	if ("argv" in rule) {
+		const command = commandOf(input);
+		if (command === void 0) return false;
+		const patterns = Array.isArray(rule.argv) ? rule.argv : [rule.argv];
+		return lexShellCommand(command).some((segment) => !segment.unmatchable && patterns.some((pattern) => matchArgvPattern(pattern, segment.argv)));
+	}
+	return true;
+}
+/**
+* Advisory domain-rule matches for the audit payload:
+* reported, never enforced in the current release.
+*/
+function advisoryMatches(chain, toolName) {
+	return [...chain.deny, ...chain.ask].filter((rule) => "domains" in rule && rule.tool === toolName);
+}
+/**
+* Unmatchable segments (command/process substitution, here-docs) yield
+* ask, ALWAYS, for any tool that has argv rules.
+*/
+function argvUnmatchableAsk(chain, toolName, input) {
+	if (![...chain.deny, ...chain.ask].some((rule) => "argv" in rule && (Array.isArray(rule.tool) ? rule.tool : [rule.tool]).includes(toolName))) return false;
+	const command = commandOf(input);
+	if (command === void 0) return true;
+	return lexShellCommand(command).some((segment) => segment.unmatchable);
+}
+/** A stub ToolContext for offline (dry-run) evaluations. */
+function offlineContext(toolName) {
+	return {
+		runId: "dry-run",
+		spanId: `dry-run-${toolName}`,
+		agent: { agentType: "" },
+		cwd: process.cwd(),
+		isolation: "none",
+		signal: new AbortController().signal,
+		log: () => void 0
+	};
+}
+/**
+* Evaluates the chain for one dispatch, or OFFLINE against a
+* hypothetical call by tool name (the dry-run API: nothing executes;
+* shells and tests read the verdict, the
+* deciding layer, and the matched rule). Hooks run in deterministic
+* registration order; { modifiedInput } substitutes the input and
+* continues; the first decisive verdict wins. The returned input is what
+* execute receives and what the approval identity hashes (post hook
+* modification). Advisory domain-rule matches
+* ride every verdict for the audit payload.
+*/
+async function evaluatePermission(chain, tool, input, ctx) {
+	const def = typeof tool === "string" ? {
+		name: tool,
+		needsApproval: false
+	} : tool;
+	const risk = typeof tool === "string" ? void 0 : tool.risk;
+	const context = ctx ?? offlineContext(def.name);
+	const advisory = advisoryMatches(chain, def.name);
+	const withAdvisory = (verdict) => advisory.length === 0 ? verdict : {
+		...verdict,
+		advisory
+	};
+	let effective = input;
+	for (const hook of chain.hooks) {
+		const verdict = await hook(def.name, effective, context);
+		if (verdict === void 0) continue;
+		if (verdict === "allow" || verdict === "deny" || verdict === "ask") return withAdvisory({
+			verdict,
+			decidedBy: "hook",
+			input: effective
 		});
+		effective = verdict.modifiedInput;
 	}
-	const spawnSpecs = input.spawns ?? [];
-	spawnSpecs.forEach(validateSpawnSpec);
-	const spawnReports = [];
-	const units = [];
-	for (const spec of spawnSpecs) {
-		const role = spec.role ?? "loop";
-		const label = spec.label ?? role;
-		const count = spec.count ?? 1;
-		const profile = spec.profile === void 0 ? void 0 : defaults.profiles?.[spec.profile];
-		if (spec.profile !== void 0 && profile === void 0) say({
-			severity: "error",
-			code: "unknown-profile",
-			message: `spawn '${label}' names profile '${spec.profile}', which defaults.profiles does not register`,
-			spawn: label
+	for (const rule of chain.deny) if (ruleMatches(rule, def.name, risk, effective)) return withAdvisory({
+		verdict: "deny",
+		decidedBy: "deny-rule",
+		rule,
+		input: effective
+	});
+	for (const rule of chain.ask) if (ruleMatches(rule, def.name, risk, effective)) return withAdvisory({
+		verdict: "ask",
+		decidedBy: "ask-rule",
+		rule,
+		input: effective
+	});
+	if (argvUnmatchableAsk(chain, def.name, effective)) return withAdvisory({
+		verdict: "ask",
+		decidedBy: "ask-rule",
+		input: effective
+	});
+	if (chain.canUseTool !== void 0) {
+		const verdict = await chain.canUseTool(def.name, effective, context);
+		if (verdict === "allow") return withAdvisory({
+			verdict: "allow",
+			decidedBy: "canUseTool",
+			input: effective
 		});
-		const limits = mergeUsageLimits(spec.limits, profile?.limits, defaults.limits);
-		const servedBy = resolveServing(spec.model ?? profile?.routing?.[role] ?? profile?.model ?? defaults.routing?.[role]);
-		if (servedBy === void 0) say({
-			severity: "error",
-			code: "unrouted-role",
-			message: `spawn '${label}' resolves no model for role '${role}': the run would fail with a ConfigError at spawn time; set a model, a profile model, or defaults.routing.${role}`,
-			spawn: label
+		if (verdict === "deny") return withAdvisory({
+			verdict: "deny",
+			decidedBy: "canUseTool",
+			input: effective
 		});
-		const caps = servedBy === void 0 ? void 0 : capsOf(servedBy);
-		const pricing = servedBy === void 0 ? void 0 : pricingOf(servedBy);
-		const unpriced = servedBy !== void 0 && pricing === void 0;
-		let reserveSource;
-		let reserveUsd;
-		if (unpriced && spec.estCost === void 0 && profile?.estCost === void 0) {
-			reserveSource = "unpriced-zero";
-			reserveUsd = 0;
-		} else {
-			reserveSource = spec.estCost !== void 0 ? "estCost" : profile?.estCost !== void 0 ? "profile-estCost" : spec.estInputTokens !== void 0 && caps?.pricing !== void 0 ? "priced-estimate" : "flat-default";
-			reserveUsd = admissionReserveUsd({
-				...spec.estCost === void 0 ? {} : { estCost: spec.estCost },
-				...profile?.estCost === void 0 ? {} : { profileEstCost: profile.estCost },
-				...spec.estInputTokens === void 0 ? {} : { inputTokens: spec.estInputTokens },
-				...caps === void 0 ? {} : { caps },
-				...limits.maxOutputTokensPerTurn === void 0 ? {} : { maxOutputTokensPerTurn: limits.maxOutputTokensPerTurn },
-				flatReserveUsd
-			});
-		}
-		const outputBound = caps === void 0 ? limits.maxOutputTokensPerTurn : limits.maxOutputTokensPerTurn === void 0 ? caps.maxOutputTokens : Math.min(caps.maxOutputTokens, limits.maxOutputTokensPerTurn);
-		if (caps !== void 0 && limits.maxOutputTokensPerTurn !== void 0 && limits.maxOutputTokensPerTurn > caps.maxOutputTokens) say({
-			severity: "warning",
-			code: "output-cap-above-model",
-			message: `spawn '${label}' sets maxOutputTokensPerTurn ${String(limits.maxOutputTokensPerTurn)} above the model's maxOutputTokens ${String(caps.maxOutputTokens)}: the model clamp wins`,
-			spawn: label
-		});
-		const turnFloorUsd = pricing === void 0 || outputBound === void 0 ? void 0 : priceUsdOf(pricing, {
-			inputTokens: spec.estInputTokens ?? 0,
-			outputTokens: outputBound,
-			cacheReadTokens: 0,
-			cacheWriteTokens: 0
-		});
-		const toolCeilings = toolCeilingsOf(limits);
-		const overall = toolCeilings.reduce((best, row) => row.ceiling === null ? best : best === null ? row.ceiling : Math.max(best, row.ceiling), null);
-		const executedToolCallCeiling = limits.maxToolCalls !== void 0 && (overall === null || limits.maxToolCalls < overall) ? limits.maxToolCalls : overall;
-		for (const row of toolCeilings) {
-			if (row.tool === ANY_TOOL) continue;
-			const cost = limits.toolUnits?.costs?.[row.tool];
-			if (cost !== void 0 && cost > 0 && limits.toolUnits !== void 0 && cost > limits.toolUnits.max) {
-				say({
-					severity: "warning",
-					code: "tool-unaffordable",
-					message: `spawn '${label}' prices tool '${row.tool}' at ${String(cost)} units against toolUnits.max ${String(limits.toolUnits.max)}: the tool can never execute`,
-					spawn: label
-				});
-				continue;
-			}
-			if (row.boundBy === "toolUnits" && row.ceiling !== null) {
-				const nominal = limits.maxToolCalls;
-				const cap = limits.maxCallsPerTool?.[row.tool];
-				if (nominal !== void 0 && row.ceiling < nominal || cap !== void 0 && row.ceiling < cap) say({
-					severity: "warning",
-					code: "weighted-units-bind-first",
-					message: `spawn '${label}': toolUnits is the first bottleneck for '${row.tool}': ${String(row.ceiling)} executed calls (cost ${String(limits.toolUnits?.costs?.[row.tool] ?? 1)} of max ${String(limits.toolUnits?.max ?? 0)})` + (nominal === void 0 ? "" : ` while maxToolCalls suggests ${String(nominal)}`),
-					spawn: label
-				});
-			}
-			const cap = limits.maxCallsPerTool?.[row.tool];
-			if (cap !== void 0 && cap > 0 && row.ceiling !== null && row.boundBy !== "maxCallsPerTool") say({
-				severity: "info",
-				code: "per-tool-cap-unreachable",
-				message: `spawn '${label}': maxCallsPerTool['${row.tool}'] ${String(cap)} can never bind: ${row.boundBy ?? "another limiter"} already stops at ${String(row.ceiling)}`,
-				spawn: label
-			});
+		effective = verdict.modifiedInput;
+	}
+	if (def.needsApproval) return withAdvisory({
+		verdict: "ask",
+		decidedBy: "default",
+		input: effective
+	});
+	return withAdvisory({
+		verdict: "allow",
+		decidedBy: "default",
+		input: effective
+	});
+}
+//#endregion
+//#region src/runtime/executor.ts
+/**
+* Isolated-executor dispatch helpers (RV-216). The engine routes a
+* non-inprocess tool call through the registered ToolExecutorProvider;
+* this module derives the stable per-call idempotency key the provider
+* receives, so an at-least-once retry of a side-effecting tool can be
+* folded into effectively-once.
+*
+* Public contract: https://docs.rulvar.com/guide/isolated-executor.
+*/
+/**
+* Derives the idempotency key for one isolated tool dispatch. The key is
+* a pure function of the run, the LOGICAL INVOCATION (the seq of the
+* containing agent's journal entry plus that call's ordinal within the
+* agent's tool loop), the tool name, and the JCS-canonical arguments.
+*
+* The logical-invocation component is what makes the key both stable and
+* distinguishing (v1.59.x review P0.4): the agent-entry seq and the
+* per-agent tool-call ordinal are journal- and checkpoint-stable, so a
+* crash-and-resume re-dispatch of the SAME logical call (the at-least-
+* once window between execution and the turn checkpoint) reuses the same
+* dispatch entry and the restored ordinal, and therefore the same key;
+* while two SEPARATE calls in one run, even with byte-identical
+* arguments, occupy different ordinals and never collide. Without it two
+* intended effects sharing arguments would fold into one under external
+* deduplication.
+*
+* The key never enters run identity (it is absent from every content key
+* and toolset hash); it exists only for the provider's own side-effect
+* deduplication.
+*/
+function deriveExecIdempotencyKey(runId, agentSeq, ordinal, tool, args) {
+	const canonical = jcsSerialize({
+		runId,
+		agentSeq,
+		ordinal,
+		tool,
+		args
+	});
+	return createHash("sha256").update(canonical, "utf8").digest("hex");
+}
+//#endregion
+//#region src/engine/scheduler.ts
+/**
+* Scheduler and concurrency (M1-T08): the per-run semaphore with a FIFO
+* queue (default 12 concurrent model calls). The engine lifetime spawn cap
+* is enforced by the budget layer at admission; parallel/pipeline
+* composition semantics live with ctx.
+* Per-provider concurrency keys land with M4.
+*/
+/** FIFO semaphore; default per-run width is 12. */
+const DEFAULT_PER_RUN_CONCURRENCY = 12;
+var Semaphore = class {
+	limit;
+	active = 0;
+	waiters = [];
+	/**
+	* `limit` must be a positive integer: anything else (NaN included) is
+	* a typed ConfigError. Before this gate a NaN limit made
+	* `active < limit` permanently false, so the first acquire queued
+	* forever and the run could not settle, not even through cancel()
+	* (v1.34.0 review P2-4). Unlimited is expressed by not constructing a
+	* semaphore, never by a sentinel limit.
+	*/
+	constructor(limit) {
+		requirePositiveInteger(limit, "Semaphore limit");
+		this.limit = limit;
+	}
+	get pending() {
+		return this.waiters.length;
+	}
+	/**
+	* Acquires a slot, resolving in FIFO order. `onQueued` fires only when
+	* the caller actually has to wait (feeds the agent:queued event).
+	* An aborted `signal` releases the caller from the queue without a
+	* slot: the returned release is a no-op, the remaining waiters keep
+	* their FIFO positions, and the caller proceeds to observe its own
+	* aborted signal (the model layers refuse dispatch under an aborted
+	* signal, so no provider call follows). Cancellation can therefore
+	* always drain a queued run (v1.34.0 review P2-4).
+	*/
+	async acquire(onQueued, signal) {
+		if (this.active < this.limit) {
+			this.active += 1;
+			return () => this.release();
 		}
-		if (limits.finalizationReserve !== void 0 && limits.maxToolCalls === void 0 && limits.toolUnits === void 0) say({
-			severity: "warning",
-			code: "inert-finalization-reserve",
-			message: `spawn '${label}' sets finalizationReserve without maxToolCalls or toolUnits: no tool budget limiter exists for it to fire on`,
-			spawn: label
-		});
-		if (limits.toolBudgetNotices === true && limits.maxToolCalls === void 0) say({
-			severity: "warning",
-			code: "inert-tool-budget-notices",
-			message: `spawn '${label}' sets toolBudgetNotices without maxToolCalls: the notices never fire`,
-			spawn: label
-		});
-		if (unpriced && ceilingUsd !== void 0) say({
-			severity: "warning",
-			code: "unpriced-under-ceiling",
-			message: `spawn '${label}' is served by '${servedBy ?? ""}' with no price row: the ${ceilingUsd.toFixed(4)} USD run ceiling does NOT bound it and its admission reserve is zero`,
-			spawn: label
-		});
-		spawnReports.push({
-			label,
-			role,
-			count,
-			...servedBy === void 0 ? {} : { servedBy },
-			...unpriced ? { unpriced: true } : {},
-			limits,
-			admissionReserveUsd: reserveUsd,
-			reserveSource,
-			...outputBound === void 0 ? {} : { maxOutputTokensPerTurn: outputBound },
-			...turnFloorUsd === void 0 ? {} : { turnFloorUsd },
-			executedToolCallCeiling,
-			toolCeilings
+		if (signal?.aborted === true) return () => void 0;
+		onQueued?.();
+		const waiter = {
+			resolve: () => void 0,
+			aborted: false
+		};
+		const wait = new Promise((resolve) => {
+			waiter.resolve = resolve;
 		});
-		for (let i = 0; i < count; i += 1) {
-			const unit = {
-				label: count === 1 ? label : `${label}#${String(i + 1)}`,
-				tokensFloor: (spec.estInputTokens ?? 0) + (outputBound ?? 0)
+		this.waiters.push(waiter);
+		let onAbort;
+		if (signal !== void 0) {
+			onAbort = () => {
+				const index = this.waiters.indexOf(waiter);
+				if (index === -1) return;
+				this.waiters.splice(index, 1);
+				waiter.aborted = true;
+				waiter.resolve();
 			};
-			if (servedBy !== void 0) {
-				const { adapterId, model } = parseModelRef(servedBy);
-				unit.provider = adapterId;
-				unit.model = model;
-			}
-			if (turnFloorUsd !== void 0) unit.turnFloorUsd = turnFloorUsd;
-			units.push(unit);
+			signal.addEventListener("abort", onAbort, { once: true });
+		}
+		try {
+			await wait;
+		} finally {
+			if (signal !== void 0 && onAbort !== void 0) signal.removeEventListener("abort", onAbort);
 		}
+		if (waiter.aborted) return () => void 0;
+		this.active += 1;
+		return () => this.release();
 	}
-	if (input.orchestrator !== void 0) {
-		const servedBy = resolveServing(defaults.routing?.orchestrate);
-		if (servedBy === void 0) say({
-			severity: "error",
-			code: "unrouted-role",
-			message: "the orchestrator resolves no model for role 'orchestrate': set defaults.routing.orchestrate or an orchestrate model on the call",
-			spawn: "orchestrator"
-		});
-		else {
-			const caps = capsOf(servedBy);
-			const pricing = pricingOf(servedBy);
-			const orchLimits = mergeUsageLimits(input.orchestrator.limits, void 0, defaults.limits);
-			const outputBound = caps === void 0 ? orchLimits.maxOutputTokensPerTurn : orchLimits.maxOutputTokensPerTurn === void 0 ? caps.maxOutputTokens : Math.min(caps.maxOutputTokens, orchLimits.maxOutputTokensPerTurn);
-			const { adapterId, model } = parseModelRef(servedBy);
-			const unit = {
-				label: "orchestrator",
-				provider: adapterId,
-				model,
-				tokensFloor: outputBound ?? 0
-			};
-			if (pricing !== void 0 && outputBound !== void 0) unit.turnFloorUsd = priceUsdOf(pricing, {
-				inputTokens: 0,
-				outputTokens: outputBound,
-				cacheReadTokens: 0,
-				cacheWriteTokens: 0
-			});
-			units.push(unit);
+	async withSlot(fn, onQueued, signal) {
+		const release = await this.acquire(onQueued, signal);
+		try {
+			return await fn();
+		} finally {
+			release();
 		}
 	}
-	const wave = [];
-	let committed = 0;
-	let spawned = 0;
-	let children = 0;
-	const admitAgainstRoot = (reserveUsd) => {
-		if (ceilingUsd === void 0) return true;
-		const held = committed + reservedForFinalizationUsd;
-		return !(held >= ceilingUsd || held + reserveUsd > ceilingUsd);
-	};
-	if (input.orchestrator !== void 0) {
-		const reserveUsd = flatReserveUsd;
-		let deniedBy;
-		if (spawned >= lifetimeSpawnCap) deniedBy = "spawn-cap";
-		else if (effectiveCapUsd !== void 0 && reserveUsd > effectiveCapUsd) deniedBy = "orchestrator-cap";
-		else if (!admitAgainstRoot(reserveUsd)) deniedBy = "budget";
-		wave.push({
-			label: "orchestrator",
-			reserveUsd,
-			admitted: deniedBy === void 0,
-			...deniedBy === void 0 ? {} : { deniedBy }
-		});
-		if (deniedBy === void 0) {
-			committed += reserveUsd;
-			spawned += 1;
-		} else if (deniedBy === "orchestrator-cap") say({
-			severity: "error",
-			code: "orchestrator-cap-below-reserve",
-			message: `the orchestrator's own admission reserve ${reserveUsd.toFixed(4)} USD does not fit its effective cap ${(effectiveCapUsd ?? 0).toFixed(4)} USD: the run cannot start`
-		});
-	}
-	const maxSpawns = input.orchestrator?.maxSpawns;
-	for (const report of spawnReports) for (let i = 0; i < report.count; i += 1) {
-		const label = report.count === 1 ? report.label : `${report.label}#${String(i + 1)}`;
-		const reserveUsd = report.admissionReserveUsd;
-		let deniedBy;
-		if (spawned >= lifetimeSpawnCap) deniedBy = "spawn-cap";
-		else if (maxSpawns !== void 0 && children >= maxSpawns) deniedBy = "orchestrator-max-spawns";
-		else if (!admitAgainstRoot(reserveUsd)) deniedBy = "budget";
-		wave.push({
-			label,
-			reserveUsd,
-			admitted: deniedBy === void 0,
-			...deniedBy === void 0 ? {} : { deniedBy }
-		});
-		if (deniedBy === void 0) {
-			committed += reserveUsd;
-			spawned += 1;
-			children += 1;
-		}
-	}
-	const admitted = wave.filter((row) => row.admitted).length;
-	const denied = wave.length - admitted;
-	if (wave.length > 0 && denied > 0) {
-		const deniedLabels = wave.filter((row) => !row.admitted).map((row) => row.label);
-		if (admitted === 0) say({
-			severity: "error",
-			code: "nothing-admitted",
-			message: `the declared wave admits NOTHING: every spawn is denied (${deniedLabels.join(", ")}); no paid work can start`
-		});
-		else say({
-			severity: "warning",
-			code: "partial-admission",
-			message: `the declared wave admits ${String(admitted)} of ${String(wave.length)} spawns; denied before any work: ${deniedLabels.join(", ")}`
-		});
-	}
-	if (ceilingUsd === void 0 && wave.length > 0) say({
-		severity: "info",
-		code: "no-usd-ceiling",
-		message: "the run has no budgetUsd ceiling: only turn, tool, and time limits bound spend, and the whole declared wave admits"
-	});
-	const declaredUnits = units.length;
-	const maxInFlight = declaredUnits === 0 ? perRun : Math.min(perRun, declaredUnits);
-	const perProviderCaps = engine.concurrency?.perProvider;
-	const perProvider = {};
-	const byProvider = /* @__PURE__ */ new Map();
-	for (const unit of units) {
-		if (unit.provider === void 0) continue;
-		const list = byProvider.get(unit.provider) ?? [];
-		list.push(unit);
-		byProvider.set(unit.provider, list);
+	release() {
+		this.active -= 1;
+		const next = this.waiters.shift();
+		if (next !== void 0) next.resolve();
 	}
-	for (const [provider, list] of [...byProvider.entries()].sort(([a], [b]) => a.localeCompare(b))) {
-		const cap = perProviderCaps?.[provider];
-		const inFlight = Math.min(list.length, maxInFlight, cap ?? Number.POSITIVE_INFINITY);
-		perProvider[provider] = {
-			inFlight,
-			requestsPerWave: inFlight,
-			tokensPerWaveFloor: [...list].sort((a, b) => b.tokensFloor - a.tokensFloor).slice(0, inFlight).reduce((sum, unit) => sum + unit.tokensFloor, 0)
+};
+//#endregion
+//#region src/engine/ctx.ts
+/**
+* Ctx primitives (M1-T07) plus the parallel/pipeline composition semantics
+* of the scheduler (M1-T08): the canonical authoring surface bound to the
+* journal write path, the model router, the agent runtime, and the
+* three-layer budget. M1 ships agent, parallel, pipeline, step, phase,
+* log, budget, and the deterministic shims; workflow/orchestrate/
+* awaitExternal/brief land with their milestones (M2/M6).
+*
+* Public contract: https://docs.rulvar.com/guide/workflows.
+*/
+/**
+* The rejection carrier of ctx.agent value-form calls: a real Error that
+* structurally satisfies the typed AgentError and carries the full
+* AgentResult for Settled mapping. Deliberately not a RulvarError:
+* AgentError is not in the closed code registry.
+*/
+var AgentCallError = class extends Error {
+	kind;
+	retryable;
+	retryAfterMs;
+	issues;
+	result;
+	scope;
+	entryRef;
+	constructor(message, result, scope, entryRef) {
+		super(message);
+		this.name = "AgentCallError";
+		const error = result.error ?? {
+			kind: "terminal",
+			retryable: false
 		};
+		this.kind = error.kind;
+		this.retryable = error.retryable;
+		if (error.retryAfterMs !== void 0) this.retryAfterMs = error.retryAfterMs;
+		if (error.issues !== void 0) this.issues = error.issues;
+		this.result = result;
+		this.scope = scope;
+		if (entryRef !== void 0) this.entryRef = entryRef;
 	}
-	const pricedTurns = units.map((unit) => unit.turnFloorUsd).filter((usd) => usd !== void 0).sort((a, b) => b - a).slice(0, maxInFlight);
-	const overshootOneTurnFloorUsd = pricedTurns.length === 0 ? void 0 : pricedTurns.reduce((sum, usd) => sum + usd, 0);
-	if (ceilingUsd !== void 0 && overshootOneTurnFloorUsd !== void 0 && units.length > 0) say({
-		severity: "info",
-		code: "overshoot-exposure",
-		message: `past a ceiling crossing, up to ${String(Math.min(maxInFlight, units.length))} in-flight turns may still complete: at least ${overshootOneTurnFloorUsd.toFixed(4)} USD past the ${ceilingUsd.toFixed(4)} USD ceiling at the declared estimates, growing with prompt size`
-	});
-	const quotaConfigured = engine.quota !== void 0;
-	if (!quotaConfigured && maxInFlight > 1 && units.length > 0) say({
-		severity: "info",
-		code: "no-quota",
-		message: `no shared quota limiter is configured while up to ${String(maxInFlight)} turns run concurrently: provider-side rate limits are unprotected (createEngine quota)`
-	});
-	if (input.quotaRules !== void 0) input.quotaRules.forEach((rule, index) => {
-		let requests = 0;
-		let tokens = 0;
-		for (const unit of units) {
-			if (unit.provider === void 0 || unit.model === void 0) continue;
-			if (quotaRuleMatches(rule, {
-				provider: unit.provider,
-				model: unit.model,
-				...engine.quota?.tenant === void 0 ? {} : { tenant: engine.quota.tenant },
-				estimate: {
-					requests: 1,
-					inputTokens: 0
-				}
-			})) {
-				requests += 1;
-				tokens += unit.tokensFloor;
-			}
+};
+/**
+* Projects a settled AgentResult's error to its wire form, carrying the
+* engine-decided abort class in data. AgentError itself has no data
+* field, so without this every projection past the terminal entry (the
+* run-level outcome.error, thrown AgentCallError wires, dropped items)
+* would keep only the message text and lose the typed class (v1.9.0
+* follow-up review).
+*/
+function agentResultWire(result, fallbackMessage) {
+	const wire = agentErrorToWire(result.error ?? {
+		kind: "terminal",
+		retryable: false
+	}, result.errorMessage ?? fallbackMessage);
+	if (result.abortClass === void 0) return wire;
+	const data = typeof wire.data === "object" && wire.data !== null && !Array.isArray(wire.data) ? wire.data : {};
+	return {
+		...wire,
+		data: {
+			...data,
+			abortClass: result.abortClass
 		}
-		const dims = [
-			rule.provider === void 0 ? void 0 : `provider=${rule.provider}`,
-			rule.model === void 0 ? void 0 : `model=${rule.model}`,
-			rule.tenant === void 0 ? void 0 : `tenant=${rule.tenant}`
-		].filter((dim) => dim !== void 0).join(" ");
-		const name = dims === "" ? `rule[${String(index)}]` : `rule[${String(index)}] (${dims})`;
-		if (rule.requestsPerMinute !== void 0 && requests > rule.requestsPerMinute) say({
-			severity: "warning",
-			code: "quota-requests-below-wave",
-			message: `${name}: the declared wave holds ${String(requests)} matching dispatches against requestsPerMinute ${String(rule.requestsPerMinute)}: expect synthetic rate-limit denials and backoff inside one window`
-		});
-		if (rule.tokensPerMinute !== void 0 && tokens > rule.tokensPerMinute) say({
-			severity: "warning",
-			code: "quota-tokens-below-wave",
-			message: `${name}: the declared wave demands at least ${String(tokens)} tokens against tokensPerMinute ${String(rule.tokensPerMinute)}: expect estimate-driven throttling inside one window`
-		});
-	});
-	const severityRank = {
-		error: 0,
-		warning: 1,
-		info: 2
 	};
-	findings.sort((a, b) => severityRank[a.severity] - severityRank[b.severity]);
-	return {
-		concurrency: {
-			perRun,
-			...perProviderCaps === void 0 ? {} : { perProvider: { ...perProviderCaps } }
-		},
-		budget: {
-			...ceilingUsd === void 0 ? {} : { ceilingUsd },
-			flatReserveUsd,
-			lifetimeSpawnCap,
-			childBudgetFraction,
-			maxDepth,
-			...orchestratorEcho === void 0 ? {} : { orchestrator: orchestratorEcho }
-		},
-		quota: {
-			configured: quotaConfigured,
-			...engine.quota?.tenant === void 0 ? {} : { tenant: engine.quota.tenant },
-			...input.quotaRules === void 0 ? {} : { rules: input.quotaRules.length }
-		},
-		runLimits,
-		spawns: spawnReports,
-		admission: {
-			...ceilingUsd === void 0 ? {} : { ceilingUsd },
-			reservedForFinalizationUsd,
-			wave,
-			admitted,
-			denied
-		},
-		exposure: {
-			maxInFlight,
-			...overshootOneTurnFloorUsd === void 0 ? {} : { overshootOneTurnFloorUsd },
-			perProvider
-		},
-		findings
+}
+/** The workflow-defaults layer a Workflow value contributes, or nothing. */
+function workflowLayerOf(wf) {
+	const layer = {};
+	if (wf.model !== void 0) layer.model = wf.model;
+	if (wf.routing !== void 0) layer.routing = wf.routing;
+	if (wf.effort !== void 0) layer.effort = wf.effort;
+	return Object.keys(layer).length === 0 ? void 0 : layer;
+}
+function defineWorkflow(meta, body) {
+	const wf = {
+		kind: "workflow",
+		name: meta.name,
+		errorPolicy: meta.errorPolicy ?? "strict",
+		...meta.model === void 0 ? {} : { model: meta.model },
+		...meta.routing === void 0 ? {} : { routing: meta.routing },
+		...meta.effort === void 0 ? {} : { effort: meta.effort },
+		body
+	};
+	if (meta.args !== void 0) return {
+		...wf,
+		argsSchema: meta.args
 	};
+	return wf;
+}
+function bump(map, key, usd) {
+	map.set(key, (map.get(key) ?? 0) + usd);
 }
-//#endregion
-//#region src/engine/run-profiles.ts
 /**
-* The shipped presets (fast / standard / deep / ultra "and similar").
-* Data only; a review-time assertion checks the
-* engine has zero behavioral branches keyed on these names.
-*/
-const RUN_PROFILES = {
-	fast: {
-		effortByRole: {
-			orchestrate: "low",
-			plan: "low",
-			summarize: "low",
-			extract: "low"
-		},
-		perRunConcurrency: 16,
-		permissionPreset: "standard",
-		lifetimeSpawnCap: 64,
-		maxDepth: 1
-	},
-	standard: {
-		effortByRole: {
-			orchestrate: "high",
-			plan: "high",
-			summarize: "low",
-			extract: "low"
-		},
-		perRunConcurrency: 12,
-		permissionPreset: "standard",
-		lifetimeSpawnCap: 500,
-		maxDepth: 1
-	},
-	deep: {
-		effortByRole: {
-			orchestrate: "high",
-			plan: "high",
-			summarize: "medium",
-			extract: "medium"
-		},
-		perRunConcurrency: 8,
-		permissionPreset: "standard",
-		lifetimeSpawnCap: 500,
-		maxDepth: 2
-	},
-	ultra: {
-		effortByRole: {
-			orchestrate: "max",
-			plan: "max",
-			summarize: "high",
-			extract: "high"
-		},
-		perRunConcurrency: 8,
-		permissionPreset: "strict",
-		lifetimeSpawnCap: 500,
-		maxDepth: 3
-	}
-};
-/** Looks up a shipped RunProfile by name; undefined for unknown names. */
-function runProfile(name) {
-	return RUN_PROFILES[name];
-}
-//#endregion
-//#region src/model/concurrency.ts
-/**
-* Per-provider concurrency keys (M4-T07): a keyed limiter beside the
-* router, ENGINE-scoped (keys constrain calls
-* across a single engine per adapter). The Appendix A default is
-* unlimited: an embeddable library must not surprise-throttle hosts, so
-* the per-run semaphore stays the only default bound and provider 429s
-* ride RetryPolicy; hosts with known tier limits opt in per adapter id
-* via createEngine concurrency.perProvider.
-*
-* This keyed limiter bounds PARALLELISM inside one engine only. Two
-* processes sharing one API key coordinate through the QuotaLimiter
-* SPI instead (RV-215, createEngine `quota`): rate and volume live
-* there, in shared storage; in-flight slots live here.
-*/
-var KeyedLimiter = class {
-	semaphores = /* @__PURE__ */ new Map();
-	constructor(caps) {
-		for (const [key, limit] of Object.entries(caps ?? {})) this.semaphores.set(key, new Semaphore(limit));
-	}
-	/** Queue depth for one key (0 for unlimited keys); telemetry only. */
-	pending(key) {
-		return this.semaphores.get(key)?.pending ?? 0;
-	}
-	/**
-	* Runs `fn` under the key's semaphore; keys without a configured cap
-	* run unlimited (no queueing, no overhead). An aborted `signal` frees
-	* a queued caller without a slot (the Semaphore contract), so run
-	* cancellation drains provider queues too (v1.34.0 review P2-4).
-	*/
-	async withSlot(key, fn, onQueued, signal) {
-		const semaphore = this.semaphores.get(key);
-		if (semaphore === void 0) return fn();
-		return semaphore.withSlot(fn, onQueued, signal);
-	}
-};
-//#endregion
-//#region src/model/profile-card.ts
-function toolNamesOf(profile) {
-	return (profile.tools ?? []).map((entry) => {
-		if (typeof entry === "string") return `${entry} (registered toolset)`;
-		if ("kind" in entry && entry.kind === "tool") return entry.name;
-		return `${entry.id}:* (tool source)`;
-	});
-}
-/**
-* Renders the registry into the shared agent vocabulary card. Sorted,
-* deterministic, byte-stable; an empty registry renders explicitly so
-* the planner never guesses at unregistered agentTypes. When the engine
-* registers toolsets, their names render as a closing line (v1.17.0
-* review P1-3): those are the ONLY values valid as string entries of a
-* tools option, so the planner never invents a registry name.
-*/
-function profileCard(profiles, toolsets) {
-	const toolsetNames = Object.keys(toolsets ?? {}).sort();
-	const toolsetsLine = toolsetNames.length === 0 ? void 0 : `Registered toolsets (valid string entries of a tools option): ${toolsetNames.join(", ")}.`;
-	const names = Object.keys(profiles ?? {}).sort();
-	if (profiles === void 0 || names.length === 0) {
-		const empty = "Agent profiles: none registered. Calls take no agentType.";
-		return toolsetsLine === void 0 ? empty : `${empty}\n${toolsetsLine}`;
-	}
-	const lines = ["Agent profiles (agentType values):"];
-	for (const name of names) {
-		const profile = profiles[name];
-		const description = profile.description ?? "no description";
-		lines.push(`- ${name}: ${description}`);
-		const toolNames = toolNamesOf(profile);
-		if (toolNames.length > 0) lines.push(`  tools: ${toolNames.join(", ")}`);
-		if (profile.taskClass !== void 0) lines.push(`  taskClass: ${profile.taskClass}`);
-		if (profile.estCost !== void 0) lines.push(`  estCost: ${profile.estCost.toFixed(2)} USD`);
-		if (profile.escalation !== void 0) lines.push(`  escalation: flavor ${profile.escalation.flavor ?? "A"} (opt-in)`);
-	}
-	if (toolsetsLine !== void 0) lines.push(toolsetsLine);
-	return lines.join("\n");
-}
-//#endregion
-//#region src/runtime/permission-chain.ts
-/**
-* The layered permission chain (M3-T03): the single approval surface for
-* every tool dispatch, regardless of tool origin. The order is fixed and
-* normative: hooks -> deny rules -> ask rules -> canUseTool -> terminal
-* default (allow unless needsApproval, then ask). Evaluation is
-* short-circuit; unconfigured layers are skipped. Rules never yield
-* allow: allow is only ever falling through to canUseTool or the
-* terminal default.
-*
-* Full contract: https://docs.rulvar.com/guide/tools.
-* Risk presets, the argv shell matcher, domain rules, and the
-* audit/dry-run surface land in M5.
-*/
-/**
-* Merges the engine-wide config and the profile config into one chain.
-* Layers concatenate engine-first; since rules only deny or ask, ordering
-* within a layer cannot change the verdict. The
-* profile's canUseTool wins over the engine's (a single slot by
-* construction). A declared preset compiles INTO the same layers, after
-* the host-authored rules, never as a fifth layer (M5-T05).
+* Completes a model-authored escalation request into the full report:
+* costToDate and salvage are runtime-filled, never model-filled. The
+* worktree patch ref lands after collect(); the pre-dispose preview for
+* flavor B decision-makers omits it.
 */
-function compilePermissionChain(engine, profile) {
-	const preset = profile?.preset === void 0 ? {
-		deny: [],
-		ask: []
-	} : compilePermissionPreset(profile.preset);
-	const deny = [
-		...engine?.deny ?? [],
-		...profile?.deny ?? [],
-		...preset.deny
-	];
-	const ask = [
-		...engine?.ask ?? [],
-		...profile?.ask ?? [],
-		...preset.ask
-	];
-	const canUseTool = profile?.canUseTool ?? engine?.canUseTool;
+function buildEscalationReport(request, result, worktreePatchRef) {
 	return {
-		hooks: [...engine?.hooks ?? [], ...profile?.hooks ?? []],
-		deny,
-		ask,
-		...canUseTool === void 0 ? {} : { canUseTool }
+		kind: request.kind,
+		scopeDelta: request.scopeDelta,
+		revisedEstimate: request.revisedEstimate,
+		blockers: request.blockers ?? [],
+		proposedDecomposition: request.proposedDecomposition ?? [],
+		costToDate: {
+			usd: result.costUsd,
+			turns: result.turns
+		},
+		salvage: {
+			transcriptRef: result.transcriptRef,
+			artifacts: (result.artifacts ?? []).map((artifact) => artifact.id),
+			...worktreePatchRef === void 0 ? {} : { worktreePatchRef }
+		}
 	};
 }
-/** The command text an argv rule matches against. */
-function commandOf(input) {
-	if (typeof input === "string") return input;
-	if (typeof input === "object" && input !== null) {
-		const command = input.command;
-		if (typeof command === "string") return command;
-	}
-}
-function ruleMatches(rule, toolName, risk, input) {
-	if ("risk" in rule) {
-		const risks = Array.isArray(rule.risk) ? rule.risk : [rule.risk];
-		if (risks.includes("undeclared") && risk === void 0) return true;
-		return risk !== void 0 && risks.includes(risk);
-	}
-	if ("domains" in rule) return false;
-	if (!(Array.isArray(rule.tool) ? rule.tool : [rule.tool]).includes(toolName)) return false;
-	if ("argv" in rule) {
-		const command = commandOf(input);
-		if (command === void 0) return false;
-		const patterns = Array.isArray(rule.argv) ? rule.argv : [rule.argv];
-		return lexShellCommand(command).some((segment) => !segment.unmatchable && patterns.some((pattern) => matchArgvPattern(pattern, segment.argv)));
-	}
-	return true;
-}
-/**
-* Advisory domain-rule matches for the audit payload:
-* reported, never enforced in the current release.
-*/
-function advisoryMatches(chain, toolName) {
-	return [...chain.deny, ...chain.ask].filter((rule) => "domains" in rule && rule.tool === toolName);
-}
 /**
-* Unmatchable segments (command/process substitution, here-docs) yield
-* ask, ALWAYS, for any tool that has argv rules.
+* Creates the per-run Ctx bound to `internals`. The current scope travels
+* through AsyncLocalStorage so parallel branches and pipeline stages keep
+* one ctx object while journaling under their own scope paths (I3:
+* structure from call-and-return only).
 */
-function argvUnmatchableAsk(chain, toolName, input) {
-	if (![...chain.deny, ...chain.ask].some((rule) => "argv" in rule && (Array.isArray(rule.tool) ? rule.tool : [rule.tool]).includes(toolName))) return false;
-	const command = commandOf(input);
-	if (command === void 0) return true;
-	return lexShellCommand(command).some((segment) => segment.unmatchable);
-}
-/** A stub ToolContext for offline (dry-run) evaluations. */
-function offlineContext(toolName) {
-	return {
-		runId: "dry-run",
-		spanId: `dry-run-${toolName}`,
-		agent: { agentType: "" },
-		cwd: process.cwd(),
-		isolation: "none",
-		signal: new AbortController().signal,
-		log: () => void 0
+function createCtx(internals, rootWorkflow) {
+	const als = new AsyncLocalStorage();
+	const sites = new ParallelSiteCounter();
+	const rootWorkflowLayer = rootWorkflow === void 0 ? void 0 : workflowLayerOf(rootWorkflow);
+	const rootState = {
+		scope: "",
+		spanId: internals.rootSpanId,
+		...rootWorkflowLayer === void 0 ? {} : { workflowLayer: rootWorkflowLayer }
 	};
-}
-/**
-* Evaluates the chain for one dispatch, or OFFLINE against a
-* hypothetical call by tool name (the dry-run API: nothing executes;
-* shells and tests read the verdict, the
-* deciding layer, and the matched rule). Hooks run in deterministic
-* registration order; { modifiedInput } substitutes the input and
-* continues; the first decisive verdict wins. The returned input is what
-* execute receives and what the approval identity hashes (post hook
-* modification). Advisory domain-rule matches
-* ride every verdict for the audit payload.
-*/
-async function evaluatePermission(chain, tool, input, ctx) {
-	const def = typeof tool === "string" ? {
-		name: tool,
-		needsApproval: false
-	} : tool;
-	const risk = typeof tool === "string" ? void 0 : tool.risk;
-	const context = ctx ?? offlineContext(def.name);
-	const advisory = advisoryMatches(chain, def.name);
-	const withAdvisory = (verdict) => advisory.length === 0 ? verdict : {
-		...verdict,
-		advisory
-	};
-	let effective = input;
-	for (const hook of chain.hooks) {
-		const verdict = await hook(def.name, effective, context);
-		if (verdict === void 0) continue;
-		if (verdict === "allow" || verdict === "deny" || verdict === "ask") return withAdvisory({
-			verdict,
-			decidedBy: "hook",
-			input: effective
-		});
-		effective = verdict.modifiedInput;
-	}
-	for (const rule of chain.deny) if (ruleMatches(rule, def.name, risk, effective)) return withAdvisory({
-		verdict: "deny",
-		decidedBy: "deny-rule",
-		rule,
-		input: effective
-	});
-	for (const rule of chain.ask) if (ruleMatches(rule, def.name, risk, effective)) return withAdvisory({
-		verdict: "ask",
-		decidedBy: "ask-rule",
-		rule,
-		input: effective
-	});
-	if (argvUnmatchableAsk(chain, def.name, effective)) return withAdvisory({
-		verdict: "ask",
-		decidedBy: "ask-rule",
-		input: effective
-	});
-	if (chain.canUseTool !== void 0) {
-		const verdict = await chain.canUseTool(def.name, effective, context);
-		if (verdict === "allow") return withAdvisory({
-			verdict: "allow",
-			decidedBy: "canUseTool",
-			input: effective
-		});
-		if (verdict === "deny") return withAdvisory({
-			verdict: "deny",
-			decidedBy: "canUseTool",
-			input: effective
-		});
-		effective = verdict.modifiedInput;
-	}
-	if (def.needsApproval) return withAdvisory({
-		verdict: "ask",
-		decidedBy: "default",
-		input: effective
-	});
-	return withAdvisory({
-		verdict: "allow",
-		decidedBy: "default",
-		input: effective
-	});
-}
-//#endregion
-//#region src/orchestrator/finish-validators.ts
-/**
-* Deterministic host validation of the orchestrator finish result (the
-* v1.40.0 improvement plan's RV-204 slice). A validator is plain
-* synchronous host code judging the finish({ result }) argument; the
-* orchestrator runtime runs the configured set on every schema valid
-* finish call, returns the failure reasons to the model as the call's
-* error tool result (a bounded repair turn), and fails the run with a
-* typed error when the repair bound is exhausted. Verdicts journal as
-* decision entries, so a resume rolls the SAME verdicts forward without
-* re-running validator code.
-*/
-const ok = { ok: true };
-function requireNonEmptyStrings(values, what) {
-	if (!Array.isArray(values) || values.length === 0) throw new ConfigError(`${what} must be a non empty array of strings`);
-	for (const value of values) if (typeof value !== "string" || value.length === 0) throw new ConfigError(`${what} must contain only non empty strings`);
-	return values;
-}
-/**
-* Requires every named section to appear LITERALLY in the result text
-* (a heading like 'FINDINGS' or any marker the goal demands). Default
-* name 'required-sections'; pass `name` to run several instances.
-*/
-function requiredSectionsValidator(options) {
-	const sections = requireNonEmptyStrings(options.sections, "requiredSectionsValidator sections");
-	return {
-		name: options.name ?? "required-sections",
-		validate: (input) => {
-			const missing = sections.filter((section) => !input.text.includes(section));
-			return missing.length === 0 ? ok : {
-				ok: false,
-				reasons: missing.map((section) => `required section '${section}' is missing`)
-			};
+	const current = () => als.getStore() ?? rootState;
+	const capsOf = (ref) => {
+		const colon = ref.indexOf(":");
+		const adapterId = ref.slice(0, colon);
+		const adapter = internals.adapters.get(adapterId);
+		if (adapter === void 0) {
+			const registered = [...internals.adapters.keys()].sort();
+			throw new ConfigError(`no adapter registered for '${adapterId}' (ModelRef '${ref}'); registered: ${registered.length === 0 ? "(none)" : registered.join(", ")}. Pass the adapter to createEngine, or route this role to a registered adapter through defaults.routing`);
 		}
+		return adapter.caps(ref.slice(colon + 1));
 	};
-}
-/**
-* Requires the result to be a JSON object carrying every named field
-* with a substantial value: present, not null, and not an empty or
-* whitespace only string (empty arrays, zero, and false COUNT as
-* present; emptiness rules beyond strings belong to a custom
-* validator). Default name 'required-fields'.
-*/
-function requiredFieldsValidator(options) {
-	const fields = requireNonEmptyStrings(options.fields, "requiredFieldsValidator fields");
-	return {
-		name: options.name ?? "required-fields",
-		validate: (input) => {
-			const result = input.result;
-			if (typeof result !== "object" || result === null || Array.isArray(result)) return {
-				ok: false,
-				reasons: ["the finish result is not a JSON object"]
-			};
-			const record = result;
-			const reasons = [];
-			for (const field of fields) {
-				const value = record[field];
-				if (value === void 0 || value === null) reasons.push(`required field '${field}' is missing`);
-				else if (typeof value === "string" && value.trim().length === 0) reasons.push(`required field '${field}' is empty`);
-			}
-			return reasons.length === 0 ? ok : {
-				ok: false,
-				reasons
-			};
-		}
+	const adapterOf = (resolved) => {
+		const adapter = internals.adapters.get(resolved.adapterId);
+		if (adapter === void 0) throw new ConfigError(`no adapter registered for '${resolved.adapterId}'`);
+		return adapter;
 	};
-}
-/** The default citation shape: a path with an extension, a colon, a line number. */
-const DEFAULT_CITATION_PATTERN = "[\\w./-]+\\.\\w+:\\d+";
-/** The default preserved share, the improvement plan's RV-202 gate. */
-const DEFAULT_EVIDENCE_MIN_SHARE = .95;
-const MAX_LISTED_CITATIONS = 20;
-function listCitations(values) {
-	return values.length <= MAX_LISTED_CITATIONS ? values.join(", ") : `${values.slice(0, MAX_LISTED_CITATIONS).join(", ")} and ${String(values.length - MAX_LISTED_CITATIONS)} more`;
-}
-/**
-* The RV-202 evidence preservation contract: the finish result must
-* PRESERVE the citations the children actually produced. Distinct
-* matches of `pattern` are collected across the outputs of children
-* settled 'ok' (spawn order); at least `minShare` of them (default
-* {@link DEFAULT_EVIDENCE_MIN_SHARE}, the plan's 95 percent gate,
-* compared as a ceiling on the required count so an exact boundary like
-* 19 of 20 passes) must appear literally in the result text. Zero child
-* citations pass vacuously. With `requireKnown: true` the contract also
-* runs in reverse: every citation in the RESULT must appear in some
-* child's output, so a fabricated but pattern valid citation is
-* rejected instead of silently counting as evidence. Rejection reasons
-* list the missing (and unknown) citations, capped at 20, so the repair
-* turn can restore them. Purely textual and deterministic; checking
-* that cited targets EXIST on disk is host territory (a custom
-* validator), not this contract. Default name 'evidence-preserved'.
-*/
-function evidencePreservedValidator(options) {
-	const pattern = options?.pattern ?? "[\\w./-]+\\.\\w+:\\d+";
-	const flags = options?.flags ?? "";
-	const globalFlags = flags.includes("g") ? flags : `${flags}g`;
-	try {
-		new RegExp(pattern, globalFlags);
-	} catch (thrown) {
-		throw new ConfigError(`evidencePreservedValidator pattern does not compile: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
+	function randValue(subtype, generate, key) {
+		const state = current();
+		const identity = key === void 0 ? {
+			kind: "rand",
+			subtype
+		} : {
+			kind: "rand",
+			subtype,
+			key
+		};
+		const matched = internals.replayer.match(state.scope, identity, "scoped");
+		if (matched.kind === "replay") return matched.terminal.value.value;
+		const value = generate();
+		const payload = {
+			subtype,
+			value
+		};
+		if (key !== void 0) payload.key = key;
+		internals.replayer.appendSinglePhase({
+			scope: state.scope,
+			key: deriveContentKey(identity),
+			kind: "rand",
+			status: "ok",
+			spanId: state.spanId,
+			value: payload
+		});
+		return value;
 	}
-	const minShare = options?.minShare ?? .95;
-	if (typeof minShare !== "number" || !Number.isFinite(minShare) || minShare <= 0 || minShare > 1) throw new ConfigError(`evidencePreservedValidator minShare must be a number in (0, 1]; got ${String(minShare)}`);
-	return {
-		name: options?.name ?? "evidence-preserved",
-		validate: (input) => {
-			const cited = /* @__PURE__ */ new Set();
-			for (const child of input.children ?? []) {
-				if (child.status !== "ok") continue;
-				for (const match of child.text.match(new RegExp(pattern, globalFlags)) ?? []) cited.add(match);
-			}
-			const reasons = [];
-			if (cited.size > 0) {
-				const missing = [...cited].filter((citation) => !input.text.includes(citation));
-				const preserved = cited.size - missing.length;
-				if (preserved < Math.ceil(minShare * cited.size - 1e-9)) reasons.push(`evidence preservation ${String(preserved)} of ${String(cited.size)} child citations is below the required share ${String(minShare)}; missing: ${listCitations(missing)}`);
-			}
-			if (options?.requireKnown === true) {
-				const fabricated = [...new Set(input.text.match(new RegExp(pattern, globalFlags)) ?? [])].filter((citation) => !cited.has(citation));
-				if (fabricated.length > 0) reasons.push(`unknown citations not present in any child report: ${listCitations(fabricated)}`);
-			}
-			return reasons.length === 0 ? ok : {
-				ok: false,
-				reasons
-			};
+	async function agentImpl(prompt, opts = {}) {
+		const state = current();
+		const agentType = opts.agentType ?? "";
+		let profile;
+		if (opts.agentType !== void 0) {
+			profile = internals.defaults.profiles?.[opts.agentType];
+			if (profile === void 0) throw new ConfigError(`unknown agentType '${opts.agentType}': register it under defaults.profiles`);
 		}
-	};
-}
-/**
-* Requires at least `min` matches of `pattern` in the result text (the
-* plan's citation and source count checks: a file:line pattern, a URL
-* pattern). The pattern compiles at construction (invalid patterns are a
-* ConfigError before any run exists) and matches globally; `min` is a
-* positive integer. Default name 'min-matches'; pass `name` to run
-* several instances, because names must be unique per orchestrate call.
-*/
-function minMatchesValidator(options) {
-	const flags = options.flags ?? "";
-	const globalFlags = flags.includes("g") ? flags : `${flags}g`;
-	try {
-		new RegExp(options.pattern, globalFlags);
-	} catch (thrown) {
-		throw new ConfigError(`minMatchesValidator pattern does not compile: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
-	}
-	if (!Number.isInteger(options.min) || options.min < 1) throw new ConfigError(`minMatchesValidator min must be a positive integer; got ${String(options.min)}`);
-	return {
-		name: options.name ?? "min-matches",
-		validate: (input) => {
-			const found = input.text.match(new RegExp(options.pattern, globalFlags))?.length ?? 0;
-			return found >= options.min ? ok : {
-				ok: false,
-				reasons: [`expected at least ${String(options.min)} matches of /${options.pattern}/${flags}; found ${String(found)}`]
-			};
-		}
-	};
-}
-//#endregion
-//#region src/orchestrator/handles.ts
-/**
-* The committed WakeDigest render budget (Appendix A: 400
-* chars per outputSummary row, the character measure; committed at M10
-* entry by adopting the implemented distillation cap unchanged, the
-* value frozen into every cassette since M6). One value serves both
-* stages: the deterministic distillation cap here and the digest
-* render default in orchestrate (renderBudgetChars).
-*/
-const WAKE_SUMMARY_RENDER_BUDGET_CHARS = 400;
-/**
-* The M6 outputSummary: a deterministic truncation of the child's
-* output (or error message), identical live and on replay (distillation
-* lives with the child, ordered by
-* spawn ordinal; the LLM distillation upgrade is M7 territory).
-*/
-function summarizeOutput(result) {
-	let raw;
-	if (result.status === "ok") raw = typeof result.output === "string" ? result.output : JSON.stringify(result.output ?? null);
-	else {
-		raw = result.errorMessage ?? `terminal status ${result.status}`;
-		if (result.partial !== void 0) raw = `${raw}; partial: ${JSON.stringify(result.partial)}`;
-	}
-	return truncateToBudget(raw, 400);
-}
-/** Folds one settled child into its digest (spawn-ordinal ordering is the caller's). */
-function digestOf(record, result) {
-	return {
-		nodeId: record.nodeId,
-		logicalTaskId: record.logicalTaskId,
-		status: result.status,
-		outputSummary: summarizeOutput(result),
-		costUsd: result.costUsd,
-		artifactsIndex: (result.artifacts ?? []).map((artifact) => artifact.id)
-	};
-}
-//#endregion
-//#region src/orchestrator/wake.ts
-/** The wait_for_events parameter schema (normative). */
-const WAIT_FOR_EVENTS_SCHEMA = {
-	type: "object",
-	additionalProperties: false,
-	required: ["triggers"],
-	properties: { triggers: {
-		type: "array",
-		minItems: 1,
-		items: { oneOf: [
-			{
-				type: "object",
-				additionalProperties: false,
-				required: ["kind"],
-				properties: { kind: { const: "quiescence" } }
-			},
-			{
-				type: "object",
-				additionalProperties: false,
-				required: ["kind"],
-				properties: {
-					kind: { const: "child_terminal" },
-					handles: {
-						type: "array",
-						items: {
-							type: "integer",
-							minimum: 1
-						}
+		const runFallbackAttempt = async (targetRef, trigger, decisionSpanId) => {
+			const fallback = opts.fallback;
+			if (internals.replayer.snapshot().find((entry) => {
+				if (entry.kind !== "decision") return false;
+				const value = entry.value;
+				return value?.decisionType === "model.fallback" && value.targetRef === targetRef;
+			}) === void 0) {
+				internals.events.emit({
+					type: "log",
+					level: "warn",
+					msg: `model.fallback: re-attempting on ${fallback.model} after ${trigger}`
+				}, decisionSpanId);
+				await internals.replayer.appendSinglePhase({
+					scope: state.scope,
+					key: "",
+					kind: "decision",
+					status: "ok",
+					spanId: decisionSpanId,
+					value: {
+						decisionType: "model.fallback",
+						targetRef,
+						trigger,
+						model: fallback.model,
+						...internals.pricingVersion === void 0 ? {} : { pricingVersion: internals.pricingVersion }
 					}
-				}
-			},
-			{
-				type: "object",
-				additionalProperties: false,
-				required: ["kind"],
-				properties: { kind: { const: "escalation" } }
-			},
-			{
-				type: "object",
-				additionalProperties: false,
-				required: ["kind", "percent"],
-				properties: {
-					kind: { const: "budget_threshold" },
-					percent: { enum: [50, 80] }
-				}
+				});
 			}
-		] }
-	} }
-};
-const WAIT_FOR_EVENTS_TOOL_NAME = "wait_for_events";
-/** The all-zero blocks of runs without the PlanRunner extension. */
-function emptyDigestBlocks() {
-	return {
-		planHash: "",
-		termination: {
-			revisionUnitsRemaining: 0,
-			spawnUnitsRemaining: 0,
-			perLineage: {},
-			phi: 0
-		},
-		budget: {
-			runSpentUsd: 0,
-			runCeilingUsd: 0,
-			orchestratorSpentUsd: 0,
-			orchestratorCapUsd: 0,
-			finalizeReserveUsd: 0,
-			orchestratorShare: 0,
-			softWarning: false
-		},
-		reuse: {
-			abandonedUsd: 0,
-			reclaimedUsd: 0,
-			netLostUsd: 0
-		}
-	};
-}
-//#endregion
-//#region src/orchestrator/spawn-tools.ts
-/** The spawn_agent parameter schema (normative). */
-const SPAWN_AGENT_SCHEMA = {
-	type: "object",
-	additionalProperties: false,
-	required: ["agentType", "prompt"],
-	properties: {
-		agentType: { type: "string" },
-		prompt: { type: "string" },
-		outputSchemaRef: { type: "string" },
-		toolsetRef: { type: "string" },
-		budgetUsd: {
-			type: "number",
-			exclusiveMinimum: 0
-		},
-		model_hint: {
-			type: "object",
-			additionalProperties: false,
-			properties: { startTier: {
-				type: "integer",
-				minimum: 0
-			} }
-		},
-		approach: {
-			type: "string",
-			maxLength: 64
-		},
-		lineage: {
-			type: "object",
-			additionalProperties: false,
-			required: ["continues", "causeRef"],
-			properties: {
-				continues: {
-					type: "string",
-					description: "LogicalTaskId to continue"
-				},
-				relation: { enum: [
-					"respawn",
-					"rung-retry",
-					"decompose-child",
-					"unpark-restart"
-				] },
-				causeRef: {
-					type: "integer",
-					minimum: 1,
-					description: "seq of the journal entry that caused the rebirth"
-				}
+			const { fallback: _fallback, routing: _routing, ...rest } = opts;
+			return agentImpl(prompt, {
+				...rest,
+				model: fallback.model
+			});
+		};
+		const isolation = opts.isolation ?? profile?.isolation ?? "none";
+		if (typeof isolation === "object" && isolation.kind === "worktree" && internals.isolation === void 0) throw new ConfigError("worktree isolation requires an IsolationProvider: pass defaults.isolation to createEngine");
+		const floorContext = {
+			...internals.floors === void 0 ? {} : { floors: internals.floors },
+			...profile?.taskClass === void 0 ? {} : { taskClass: profile.taskClass }
+		};
+		const callLayer = {};
+		if (opts.model !== void 0) callLayer.model = opts.model;
+		if (opts.routing !== void 0) callLayer.routing = opts.routing;
+		if (opts.effort !== void 0) callLayer.effort = opts.effort;
+		const profileLayer = {};
+		if (profile?.model !== void 0) profileLayer.model = profile.model;
+		if (profile?.routing !== void 0) profileLayer.routing = profile.routing;
+		if (profile?.effort !== void 0) profileLayer.effort = profile.effort;
+		const engineLayer = {};
+		if (internals.defaults.routing !== void 0) engineLayer.routing = internals.defaults.routing;
+		const workflowLayer = state.workflowLayer;
+		const telemetryNamespace = { agentType };
+		if (opts.label !== void 0) telemetryNamespace.label = opts.label;
+		const withTelemetry = (resolved) => ({
+			...resolved,
+			providerOptions: {
+				...resolved.providerOptions,
+				rulvar: telemetryNamespace
 			}
-		},
-		taskClass: { type: "string" }
-	}
-};
-/** parallel_agents wraps the spawn_agent params. */
-const PARALLEL_AGENTS_SCHEMA = {
-	type: "object",
-	additionalProperties: false,
-	required: ["tasks"],
-	properties: { tasks: {
-		type: "array",
-		minItems: 1,
-		items: { $ref: "#/$defs/spawnAgentParams" }
-	} },
-	$defs: { spawnAgentParams: SPAWN_AGENT_SCHEMA }
-};
-/** await_any and await_all share one parameter shape. */
-const AWAIT_SCHEMA = {
-	type: "object",
-	additionalProperties: false,
-	required: ["handles"],
-	properties: { handles: {
-		type: "array",
-		minItems: 1,
-		items: {
-			type: "integer",
-			minimum: 1
+		});
+		const primaryRole = opts.role ?? "loop";
+		const loopResolved = withTelemetry(resolveModelInvocation({
+			role: primaryRole,
+			call: callLayer,
+			profile: profileLayer,
+			workflow: workflowLayer,
+			engine: engineLayer,
+			capsOf,
+			...floorContext
+		}));
+		for (const scrub of loopResolved.scrubs) internals.events.emit({
+			type: "log",
+			level: "warn",
+			msg: scrub.detail
+		}, state.spanId);
+		let canonicalSchema;
+		let derivedSchemaHash = EMPTY_SCHEMA_HASH;
+		if (opts.schema !== void 0) {
+			canonicalSchema = canonicalizeSchema(projectToJsonSchema(opts.schema));
+			derivedSchemaHash = schemaHash(canonicalSchema);
 		}
-	} }
-};
-/** The cancel_agent parameter schema. */
-const CANCEL_AGENT_SCHEMA = {
-	type: "object",
-	additionalProperties: false,
-	required: ["handle"],
-	properties: {
-		handle: {
-			type: "integer",
-			minimum: 1
-		},
-		reason: { type: "string" }
-	}
-};
-/** Default and hard-max characters per child-result / artifact page. */
-const DEFAULT_CHILD_RESULT_PAGE_CHARS = 4e3;
-const MAX_CHILD_RESULT_PAGE_CHARS = 2e4;
-const PAGING_PROPS = {
-	offset: {
-		type: "integer",
-		minimum: 0
-	},
-	maxChars: {
-		type: "integer",
-		minimum: 1
-	}
-};
-const GET_CHILD_RESULT_SCHEMA = {
-	type: "object",
-	additionalProperties: false,
-	required: ["handle"],
-	properties: {
-		handle: {
-			type: "integer",
-			minimum: 1
-		},
-		...PAGING_PROPS
-	}
-};
-const READ_CHILD_ARTIFACT_SCHEMA = {
-	type: "object",
-	additionalProperties: false,
-	required: ["handle", "artifactId"],
-	properties: {
-		handle: {
-			type: "integer",
-			minimum: 1
-		},
-		artifactId: { type: "string" },
-		...PAGING_PROPS
-	}
-};
-const GET_CHILD_RESULT_TOOL_NAME = "get_child_result";
-const READ_CHILD_ARTIFACT_TOOL_NAME = "read_child_artifact";
-/** finish; result validates against the declared output schema. */
-const FINISH_SCHEMA = {
-	type: "object",
-	additionalProperties: false,
-	required: ["result"],
-	properties: {
-		result: { $comment: "validated against the declared output SchemaSpec of the orchestrate call; free-form JSON when none is declared" },
-		summary: { type: "string" }
-	}
-};
-const FINISH_TOOL_NAME = "finish";
-/**
-* Builds the mode (c) toolset over the per-call runtime. profileCardText
-* rides the spawn tools' descriptions so both modes speak one agent
-* vocabulary (M6-T04).
-*/
-function buildOrchestratorTools(runtime, profileCardText, options) {
-	const spawnAgent = tool({
-		name: "spawn_agent",
-		description: `Admit and schedule one child agent. ${profileCardText}`,
-		parameters: SPAWN_AGENT_SCHEMA,
-		execute: (input) => runtime.spawn(input)
-	});
-	const parallelAgents = tool({
-		name: "parallel_agents",
-		description: "Admit and schedule several children at once (submission order).",
-		parameters: PARALLEL_AGENTS_SCHEMA,
-		execute: async (input) => {
-			const tasks = input.tasks;
-			const handles = [];
-			for (const task of tasks) {
-				const spawned = await runtime.spawn(task);
-				handles.push(spawned.handle);
-			}
-			return { handles };
+		const escalation = opts.escalation ?? profile?.escalation;
+		if (escalation !== void 0) {
+			if (escalation.flavor === "B" && escalation.deadlineMs === void 0) throw new ConfigError("flavor 'B' escalation requires an explicit deadlineMs: the suspension deadline has no engine default");
+			if (escalation.deadlineMs !== void 0) requirePositiveInteger(escalation.deadlineMs, "escalation.deadlineMs");
+			if (escalation.minSpendUsd !== void 0) requireNonNegativeNumber(escalation.minSpendUsd, "escalation.minSpendUsd");
+			if (opts.result !== "full" && internals.onEscalation === void 0) throw new ConfigError("a spawn that opts into escalation from a plain value-form call needs an onEscalation hook (or use result: 'full')");
+			if (escalation.flavor === "B" && escalation.deadlineMs === void 0) throw new ConfigError("escalation flavor 'B' requires an explicit deadlineMs");
 		}
-	});
-	const awaitAny = tool({
-		name: "await_any",
-		description: "Wait for the FIRST of the handles to settle; returns its TaskDigest.",
-		parameters: AWAIT_SCHEMA,
-		execute: (input) => runtime.awaitAny(input.handles)
-	});
-	const awaitAll = tool({
-		name: "await_all",
-		description: "Wait for ALL handles to settle; returns their TaskDigests in handle order.",
-		parameters: AWAIT_SCHEMA,
-		execute: (input) => runtime.awaitAll(input.handles)
-	});
-	const cancelAgent = tool({
-		name: "cancel_agent",
-		description: "Cancel an in-flight child. Cancellation is caller intent: the entry journals cancelled and reruns on a later resume unless covered by abandon (M7).",
-		parameters: CANCEL_AGENT_SCHEMA,
-		execute: (input) => {
-			const params = input;
-			return runtime.cancel(params.handle, params.reason);
+		const declaredTools = opts.tools ?? profile?.tools ?? [];
+		const toolset = await resolveToolset(escalation === void 0 ? declaredTools : [...declaredTools, escalateTool()], { runId: internals.runId }, internals.defaults.toolsets, internals.executors === void 0 ? void 0 : new Set(Object.keys(internals.executors)));
+		const layers = [
+			callLayer,
+			profileLayer,
+			engineLayer
+		];
+		const toolsAvailable = toolset.contracts.length > 0;
+		const finalizeRouted = roleConfiguredInRouting("finalize", layers);
+		let extract;
+		if (opts.schema !== void 0 && canonicalSchema !== void 0) {
+			const extractResolved = withTelemetry(resolveModelInvocation({
+				role: "extract",
+				call: callLayer,
+				profile: profileLayer,
+				workflow: workflowLayer,
+				engine: engineLayer,
+				capsOf,
+				...floorContext
+			}));
+			const loopTier = selectStructuredOutputTier(capsOf(loopResolved.ref), canonicalSchema);
+			if (needsSeparateExtract({
+				schemaSet: true,
+				loopRef: loopResolved.ref,
+				extractRef: extractResolved.ref,
+				loopTier,
+				toolsAvailable,
+				finalizeRouted
+			})) {
+				extract = {
+					adapter: adapterOf(extractResolved),
+					resolved: extractResolved
+				};
+				for (const scrub of extractResolved.scrubs) internals.events.emit({
+					type: "log",
+					level: "warn",
+					msg: scrub.detail
+				}, state.spanId);
+			}
 		}
-	});
-	const waitForEvents = tool({
-		name: WAIT_FOR_EVENTS_TOOL_NAME,
-		description: "Sleep until a coalesced WakeDigest: quiescence (always armed), child_terminal, escalation, or budget_threshold at 50/80 percent. A trigger set that can never fire is a typed error.",
-		parameters: WAIT_FOR_EVENTS_SCHEMA,
-		execute: (input) => runtime.waitForEvents(input.triggers)
-	});
-	const finish = tool({
-		name: FINISH_TOOL_NAME,
-		description: "Terminate the orchestration with a result (run outcome ok).",
-		parameters: FINISH_SCHEMA,
-		execute: () => {
-			throw new Error("finish is intercepted by the agent runtime, never executed");
+		let finalize;
+		if (finalizeFires({
+			routed: finalizeRouted,
+			toolsAvailable
+		})) {
+			const finalizeResolved = withTelemetry(resolveModelInvocation({
+				role: "finalize",
+				call: callLayer,
+				profile: profileLayer,
+				workflow: workflowLayer,
+				engine: engineLayer,
+				capsOf,
+				...floorContext
+			}));
+			finalize = {
+				adapter: adapterOf(finalizeResolved),
+				resolved: finalizeResolved
+			};
+			for (const scrub of finalizeResolved.scrubs) internals.events.emit({
+				type: "log",
+				level: "warn",
+				msg: scrub.detail
+			}, state.spanId);
 		}
-	});
-	const tools = [
-		spawnAgent,
-		parallelAgents,
-		awaitAny,
-		awaitAll,
-		cancelAgent,
-		waitForEvents
-	];
-	if (options?.childResultTools === true) tools.push(tool({
-		name: GET_CHILD_RESULT_TOOL_NAME,
-		description: "Read a page of a SETTLED child's FULL output (the digest is truncated to 400 chars). Pages with offset and maxChars; the reply reports totalChars and hasMore.",
-		parameters: GET_CHILD_RESULT_SCHEMA,
-		execute: (input) => {
-			const p = input;
-			return runtime.getChildResult(p.handle, {
-				offset: p.offset,
-				maxChars: p.maxChars
+		let summarizeResolved;
+		try {
+			summarizeResolved = resolveModelInvocation({
+				role: "summarize",
+				call: callLayer,
+				profile: profileLayer,
+				workflow: workflowLayer,
+				engine: engineLayer,
+				capsOf,
+				...floorContext
+			});
+		} catch {
+			summarizeResolved = resolveModelInvocation({
+				role: "summarize",
+				call: callLayer,
+				profile: profileLayer,
+				workflow: workflowLayer,
+				engine: {
+					...engineLayer,
+					model: loopResolved.ref
+				},
+				capsOf,
+				...floorContext
 			});
 		}
-	}), tool({
-		name: READ_CHILD_ARTIFACT_TOOL_NAME,
-		description: "Read a page of a SETTLED child's artifact content by id (ids come from get_child_result or a digest). Pages with offset and maxChars.",
-		parameters: READ_CHILD_ARTIFACT_SCHEMA,
-		execute: (input) => {
-			const p = input;
-			return runtime.readChildArtifact(p.handle, p.artifactId, {
-				offset: p.offset,
-				maxChars: p.maxChars
-			});
-		}
-	}));
-	tools.push(finish);
-	return tools;
-}
-//#endregion
-//#region src/engine/internal.ts
-/** Registered by createCtx; keyed by the ctx object identity. */
-const ctxRuntimes = /* @__PURE__ */ new WeakMap();
-/**
-* Internal AgentOpts channel (M6-T07): agentImpl reports the agent
-* dispatch seq (the spawn handle) through this symbol-keyed callback on
-* the running append, on a dangling redispatch, AND on the replay
-* branch, so the orchestrator learns handles that are stable across
-* resume. Never part of the public AgentOpts surface.
-*/
-const kOnRunning = Symbol("rulvar.onRunning");
-/**
-* Internal AgentOpts channel (M6-T07): names the terminal tool whose
-* accepted call ends the loop with status ok (the orchestrator finish
-* tool), plus the optional host validation hook over the accepted call
-* (the RV-204 finish validators). Never part of the public AgentOpts
-* surface.
-*/
-const kTerminalTool = Symbol("rulvar.terminalTool");
-/**
-* Internal AgentOpts channel (M7-T08): a transcript checkpoint ref the
-* fresh dispatch boots from (park/unpark continuation and the DEF-5
-* graft boot). Dangling redispatch checkpoints take precedence.
-*/
-const kBootCheckpoint = Symbol("rulvar.bootCheckpoint");
-/**
-* Internal AgentOpts channel: marks the orchestrator forced-finish
-* dispatch, whose spend draws from the released finalize reserve
-* (DEF-7). Settlement stamps the flag into the terminal's cost
-* attribution so the journal fold reproduces reserveUsedUsd.
-*/
-const kFinalizeReserve = Symbol("rulvar.finalizeReserve");
-/** Typed accessor used by the in-package consumers. */
-function runtimeOf(ctx) {
-	const runtime = ctxRuntimes.get(ctx);
-	if (runtime === void 0) throw new Error("ctx runtime missing: the ctx value was not created by createCtx (engine run context)");
-	return runtime;
-}
-//#endregion
-//#region src/engine/spawn-events.ts
-function emitSpawnAdmitted(events, input) {
-	events.emit({
-		type: "spawn:admitted",
-		entryRef: input.entryRef,
-		verdict: input.verdict,
-		agentType: input.agentType,
-		logicalTaskId: input.logicalTaskId,
-		...input.spawnUnitsAfter === void 0 ? {} : { spawnUnitsAfter: input.spawnUnitsAfter }
-	}, input.spanId, input.replayed);
-}
-function emitSpawnRejected(events, input) {
-	events.emit({
-		type: "spawn:rejected",
-		...input.entryRef === void 0 ? {} : { entryRef: input.entryRef },
-		code: input.code,
-		agentType: input.agentType
-	}, input.spanId, input.replayed);
-}
-//#endregion
-//#region src/l0/long-timer.ts
-/**
-* Sliced timers for absolute wall-clock deadlines (v1.34.0 review P2-2).
-*
-* Node clamps a setTimeout delay above 2147483647 ms (about 24.8 days)
-* to 1 ms, so a naive timer for a far-future deadline fires immediately.
-* setLongTimeout never hands Node more than one MAX_TIMER_DELAY_MS
-* slice, re-checks the wall clock when a slice fires, and re-arms until
-* the clock actually reaches the deadline: firing a slice is never taken
-* as proof the deadline arrived. A deadline already in the past fires on
-* the next macrotask (delay 0), matching the plain setTimeout behavior
-* the callers had for near deadlines.
-*/
-/**
-* Schedules `onDue` for the absolute wall-clock instant `dueAtMs` as
-* reported by `now` (default Date.now), slicing delays beyond the Node
-* timer maximum.
-*/
-function setLongTimeout(onDue, dueAtMs, now = Date.now) {
-	let handle;
-	let cancelled = false;
-	const arm = () => {
-		const remaining = Math.max(0, dueAtMs - now());
-		handle = setTimeout(() => {
-			if (cancelled) return;
-			if (now() >= dueAtMs) {
-				onDue();
-				return;
-			}
-			arm();
-		}, Math.min(remaining, MAX_TIMER_DELAY_MS));
-	};
-	arm();
-	return { cancel: () => {
-		cancelled = true;
-		if (handle !== void 0) clearTimeout(handle);
-	} };
-}
-//#endregion
-//#region src/runtime/executor.ts
-/**
-* Isolated-executor dispatch helpers (RV-216). The engine routes a
-* non-inprocess tool call through the registered ToolExecutorProvider;
-* this module derives the stable per-call idempotency key the provider
-* receives, so an at-least-once retry of a side-effecting tool can be
-* folded into effectively-once.
-*
-* Public contract: https://docs.rulvar.com/guide/isolated-executor.
-*/
-/**
-* Derives the idempotency key for one isolated tool dispatch. The key is
-* a pure function of the run, the LOGICAL INVOCATION (the seq of the
-* containing agent's journal entry plus that call's ordinal within the
-* agent's tool loop), the tool name, and the JCS-canonical arguments.
-*
-* The logical-invocation component is what makes the key both stable and
-* distinguishing (v1.59.x review P0.4): the agent-entry seq and the
-* per-agent tool-call ordinal are journal- and checkpoint-stable, so a
-* crash-and-resume re-dispatch of the SAME logical call (the at-least-
-* once window between execution and the turn checkpoint) reuses the same
-* dispatch entry and the restored ordinal, and therefore the same key;
-* while two SEPARATE calls in one run, even with byte-identical
-* arguments, occupy different ordinals and never collide. Without it two
-* intended effects sharing arguments would fold into one under external
-* deduplication.
-*
-* The key never enters run identity (it is absent from every content key
-* and toolset hash); it exists only for the provider's own side-effect
-* deduplication.
-*/
-function deriveExecIdempotencyKey(runId, agentSeq, ordinal, tool, args) {
-	const canonical = jcsSerialize({
-		runId,
-		agentSeq,
-		ordinal,
-		tool,
-		args
-	});
-	return createHash("sha256").update(canonical, "utf8").digest("hex");
-}
-//#endregion
-//#region src/engine/ctx.ts
-/**
-* Ctx primitives (M1-T07) plus the parallel/pipeline composition semantics
-* of the scheduler (M1-T08): the canonical authoring surface bound to the
-* journal write path, the model router, the agent runtime, and the
-* three-layer budget. M1 ships agent, parallel, pipeline, step, phase,
-* log, budget, and the deterministic shims; workflow/orchestrate/
-* awaitExternal/brief land with their milestones (M2/M6).
-*
-* Public contract: https://docs.rulvar.com/guide/workflows.
-*/
-/**
-* The rejection carrier of ctx.agent value-form calls: a real Error that
-* structurally satisfies the typed AgentError and carries the full
-* AgentResult for Settled mapping. Deliberately not a RulvarError:
-* AgentError is not in the closed code registry.
-*/
-var AgentCallError = class extends Error {
-	kind;
-	retryable;
-	retryAfterMs;
-	issues;
-	result;
-	scope;
-	entryRef;
-	constructor(message, result, scope, entryRef) {
-		super(message);
-		this.name = "AgentCallError";
-		const error = result.error ?? {
-			kind: "terminal",
-			retryable: false
+		const summarize = {
+			adapter: adapterOf(summarizeResolved),
+			resolved: withTelemetry(summarizeResolved)
 		};
-		this.kind = error.kind;
-		this.retryable = error.retryable;
-		if (error.retryAfterMs !== void 0) this.retryAfterMs = error.retryAfterMs;
-		if (error.issues !== void 0) this.issues = error.issues;
-		this.result = result;
-		this.scope = scope;
-		if (entryRef !== void 0) this.entryRef = entryRef;
-	}
-};
-/**
-* Projects a settled AgentResult's error to its wire form, carrying the
-* engine-decided abort class in data. AgentError itself has no data
-* field, so without this every projection past the terminal entry (the
-* run-level outcome.error, thrown AgentCallError wires, dropped items)
-* would keep only the message text and lose the typed class (v1.9.0
-* follow-up review).
-*/
-function agentResultWire(result, fallbackMessage) {
-	const wire = agentErrorToWire(result.error ?? {
-		kind: "terminal",
-		retryable: false
-	}, result.errorMessage ?? fallbackMessage);
-	if (result.abortClass === void 0) return wire;
-	const data = typeof wire.data === "object" && wire.data !== null && !Array.isArray(wire.data) ? wire.data : {};
-	return {
-		...wire,
-		data: {
-			...data,
-			abortClass: result.abortClass
+		const failoverChainFor = (role, resolved) => (resolved.fallbacks ?? []).map((ref) => {
+			const fallbackLayer = { model: ref };
+			if (callLayer.effort !== void 0) fallbackLayer.effort = callLayer.effort;
+			const fallbackResolved = withTelemetry(resolveModelInvocation({
+				role,
+				call: fallbackLayer,
+				profile: profileLayer,
+				workflow: workflowLayer,
+				engine: engineLayer,
+				capsOf,
+				...floorContext
+			}));
+			return {
+				adapter: adapterOf(fallbackResolved),
+				resolved: fallbackResolved
+			};
+		});
+		const loopFallbacks = failoverChainFor(primaryRole, loopResolved);
+		if (extract !== void 0) {
+			const chain = failoverChainFor("extract", extract.resolved);
+			if (chain.length > 0) extract.fallbacks = chain;
 		}
-	};
-}
-/** The workflow-defaults layer a Workflow value contributes, or nothing. */
-function workflowLayerOf(wf) {
-	const layer = {};
-	if (wf.model !== void 0) layer.model = wf.model;
-	if (wf.routing !== void 0) layer.routing = wf.routing;
-	if (wf.effort !== void 0) layer.effort = wf.effort;
-	return Object.keys(layer).length === 0 ? void 0 : layer;
-}
-function defineWorkflow(meta, body) {
-	const wf = {
-		kind: "workflow",
-		name: meta.name,
-		errorPolicy: meta.errorPolicy ?? "strict",
-		...meta.model === void 0 ? {} : { model: meta.model },
-		...meta.routing === void 0 ? {} : { routing: meta.routing },
-		...meta.effort === void 0 ? {} : { effort: meta.effort },
-		body
-	};
-	if (meta.args !== void 0) return {
-		...wf,
-		argsSchema: meta.args
-	};
-	return wf;
-}
-function bump(map, key, usd) {
-	map.set(key, (map.get(key) ?? 0) + usd);
-}
-/**
-* Completes a model-authored escalation request into the full report:
-* costToDate and salvage are runtime-filled, never model-filled. The
-* worktree patch ref lands after collect(); the pre-dispose preview for
-* flavor B decision-makers omits it.
-*/
-function buildEscalationReport(request, result, worktreePatchRef) {
-	return {
-		kind: request.kind,
-		scopeDelta: request.scopeDelta,
-		revisedEstimate: request.revisedEstimate,
-		blockers: request.blockers ?? [],
-		proposedDecomposition: request.proposedDecomposition ?? [],
-		costToDate: {
-			usd: result.costUsd,
-			turns: result.turns
-		},
-		salvage: {
-			transcriptRef: result.transcriptRef,
-			artifacts: (result.artifacts ?? []).map((artifact) => artifact.id),
-			...worktreePatchRef === void 0 ? {} : { worktreePatchRef }
+		if (finalize !== void 0) {
+			const chain = failoverChainFor("finalize", finalize.resolved);
+			if (chain.length > 0) finalize.fallbacks = chain;
 		}
-	};
-}
-/**
-* Creates the per-run Ctx bound to `internals`. The current scope travels
-* through AsyncLocalStorage so parallel branches and pipeline stages keep
-* one ctx object while journaling under their own scope paths (I3:
-* structure from call-and-return only).
-*/
-function createCtx(internals, rootWorkflow) {
-	const als = new AsyncLocalStorage();
-	const sites = new ParallelSiteCounter();
-	const rootWorkflowLayer = rootWorkflow === void 0 ? void 0 : workflowLayerOf(rootWorkflow);
-	const rootState = {
-		scope: "",
-		spanId: internals.rootSpanId,
-		...rootWorkflowLayer === void 0 ? {} : { workflowLayer: rootWorkflowLayer }
-	};
-	const current = () => als.getStore() ?? rootState;
-	const capsOf = (ref) => {
-		const colon = ref.indexOf(":");
-		const adapterId = ref.slice(0, colon);
-		const adapter = internals.adapters.get(adapterId);
-		if (adapter === void 0) {
-			const registered = [...internals.adapters.keys()].sort();
-			throw new ConfigError(`no adapter registered for '${adapterId}' (ModelRef '${ref}'); registered: ${registered.length === 0 ? "(none)" : registered.join(", ")}. Pass the adapter to createEngine, or route this role to a registered adapter through defaults.routing`);
+		{
+			const chain = failoverChainFor("summarize", summarizeResolved);
+			if (chain.length > 0) summarize.fallbacks = chain;
 		}
-		return adapter.caps(ref.slice(colon + 1));
-	};
-	const adapterOf = (resolved) => {
-		const adapter = internals.adapters.get(resolved.adapterId);
-		if (adapter === void 0) throw new ConfigError(`no adapter registered for '${resolved.adapterId}'`);
-		return adapter;
-	};
-	function randValue(subtype, generate, key) {
-		const state = current();
-		const identity = key === void 0 ? {
-			kind: "rand",
-			subtype
-		} : {
-			kind: "rand",
-			subtype,
-			key
-		};
-		const matched = internals.replayer.match(state.scope, identity, "scoped");
-		if (matched.kind === "replay") return matched.terminal.value.value;
-		const value = generate();
-		const payload = {
-			subtype,
-			value
+		const retryPolicy = opts.retry ?? profile?.retry ?? internals.defaults.retry;
+		if (retryPolicy !== void 0) validateRetryPolicy(retryPolicy, opts.retry !== void 0 ? "the agent retry option" : profile?.retry !== void 0 ? `the retry of profile '${String(opts.agentType)}'` : "engine defaults.retry");
+		if (opts.estCost !== void 0) requireNonNegativeNumber(opts.estCost, "the agent estCost option");
+		if (opts.limits !== void 0) validateUsageLimits(opts.limits, "the agent limits option");
+		const identityInput = {
+			kind: "agent",
+			agentType,
+			modelSpec: loopResolved.canonical,
+			prompt: opts.key ?? prompt,
+			schemaHash: derivedSchemaHash,
+			toolsetHash: toolset.hash,
+			isolation
 		};
-		if (key !== void 0) payload.key = key;
-		internals.replayer.appendSinglePhase({
-			scope: state.scope,
-			key: deriveContentKey(identity),
-			kind: "rand",
-			status: "ok",
-			spanId: state.spanId,
-			value: payload
-		});
-		return value;
-	}
-	async function agentImpl(prompt, opts = {}) {
-		const state = current();
-		const agentType = opts.agentType ?? "";
-		let profile;
-		if (opts.agentType !== void 0) {
-			profile = internals.defaults.profiles?.[opts.agentType];
-			if (profile === void 0) throw new ConfigError(`unknown agentType '${opts.agentType}': register it under defaults.profiles`);
-		}
-		const runFallbackAttempt = async (targetRef, trigger, decisionSpanId) => {
-			const fallback = opts.fallback;
-			if (internals.replayer.snapshot().find((entry) => {
-				if (entry.kind !== "decision") return false;
-				const value = entry.value;
-				return value?.decisionType === "model.fallback" && value.targetRef === targetRef;
-			}) === void 0) {
-				internals.events.emit({
-					type: "log",
-					level: "warn",
-					msg: `model.fallback: re-attempting on ${fallback.model} after ${trigger}`
-				}, decisionSpanId);
-				await internals.replayer.appendSinglePhase({
-					scope: state.scope,
-					key: "",
-					kind: "decision",
-					status: "ok",
-					spanId: decisionSpanId,
-					value: {
-						decisionType: "model.fallback",
-						targetRef,
-						trigger,
-						model: fallback.model,
-						...internals.pricingVersion === void 0 ? {} : { pricingVersion: internals.pricingVersion }
+		const identityKey = deriveContentKey(identityInput);
+		const matched = internals.replayer.match(state.scope, identityInput, opts.replay ?? "scoped");
+		if (matched.kind === "replay" || matched.kind === "skip") {
+			opts[kOnRunning]?.(matched.running.seq);
+			const terminal = matched.kind === "replay" ? matched.terminal : matched.terminal;
+			const spanId = internals.spans.mint(state.spanId);
+			const usage = terminal?.usage ?? {
+				inputTokens: 0,
+				outputTokens: 0,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0
+			};
+			const replayPriced = terminal === void 0 ? void 0 : priceEntryUsage(terminal, (ref, sliceUsage) => internals.priceUsd(ref, sliceUsage));
+			const costUsd = replayPriced?.usd ?? 0;
+			const result = {
+				status: matched.kind === "skip" ? "skipped" : terminal?.status ?? "ok",
+				output: matched.kind === "skip" ? null : terminal?.value ?? null,
+				usage,
+				costUsd,
+				servedBy: terminal?.servedBy ?? loopResolved.ref,
+				turns: 0,
+				transcriptRef: terminal?.transcriptRef ?? ""
+			};
+			if (terminal?.error !== void 0) {
+				result.error = agentErrorFromWire(terminal.error);
+				result.errorMessage = terminal.error.message;
+			}
+			if (terminal?.artifacts !== void 0) result.artifacts = terminal.artifacts;
+			if (terminal?.providerCalls !== void 0) result.providerCalls = terminal.providerCalls;
+			if (terminal?.status === "escalated" && terminal.escalation !== void 0) result.escalation = terminal.escalation;
+			{
+				const stampedData = terminal?.error?.data;
+				if (stampedData?.abortClass !== void 0) result.abortClass = stampedData.abortClass;
+				if (stampedData?.exploration !== void 0) result.exploration = stampedData.exploration;
+			}
+			let replayedToolResults = [];
+			if (matched.kind === "replay" && terminal?.checkpointRef !== void 0) {
+				const blob = await internals.transcripts.get(terminal.checkpointRef);
+				const checkpoint = blob === null ? void 0 : decodeCheckpoint(blob);
+				if (checkpoint !== void 0) {
+					result.turns = checkpoint.turns;
+					if (result.status === "limit") {
+						const partialReport = latestProgressReport(checkpoint.messages);
+						if (partialReport !== void 0) result.partial = partialReport;
 					}
-				});
+					replayedToolResults = checkpoint.messages.filter((msg) => msg.role === "tool").flatMap((msg) => msg.parts).filter((part) => part.type === "tool-result").map((part) => ({
+						name: part.name,
+						isError: part.isError === true
+					}));
+				}
 			}
-			const { fallback: _fallback, routing: _routing, ...rest } = opts;
-			return agentImpl(prompt, {
-				...rest,
-				model: fallback.model
-			});
-		};
-		const isolation = opts.isolation ?? profile?.isolation ?? "none";
-		if (typeof isolation === "object" && isolation.kind === "worktree" && internals.isolation === void 0) throw new ConfigError("worktree isolation requires an IsolationProvider: pass defaults.isolation to createEngine");
-		const floorContext = {
-			...internals.floors === void 0 ? {} : { floors: internals.floors },
-			...profile?.taskClass === void 0 ? {} : { taskClass: profile.taskClass }
-		};
-		const callLayer = {};
-		if (opts.model !== void 0) callLayer.model = opts.model;
-		if (opts.routing !== void 0) callLayer.routing = opts.routing;
-		if (opts.effort !== void 0) callLayer.effort = opts.effort;
-		const profileLayer = {};
-		if (profile?.model !== void 0) profileLayer.model = profile.model;
-		if (profile?.routing !== void 0) profileLayer.routing = profile.routing;
-		if (profile?.effort !== void 0) profileLayer.effort = profile.effort;
-		const engineLayer = {};
-		if (internals.defaults.routing !== void 0) engineLayer.routing = internals.defaults.routing;
-		const workflowLayer = state.workflowLayer;
-		const telemetryNamespace = { agentType };
-		if (opts.label !== void 0) telemetryNamespace.label = opts.label;
-		const withTelemetry = (resolved) => ({
-			...resolved,
-			providerOptions: {
-				...resolved.providerOptions,
-				rulvar: telemetryNamespace
-			}
-		});
-		const primaryRole = opts.role ?? "loop";
-		const loopResolved = withTelemetry(resolveModelInvocation({
-			role: primaryRole,
-			call: callLayer,
-			profile: profileLayer,
-			workflow: workflowLayer,
-			engine: engineLayer,
-			capsOf,
-			...floorContext
-		}));
-		for (const scrub of loopResolved.scrubs) internals.events.emit({
-			type: "log",
-			level: "warn",
-			msg: scrub.detail
-		}, state.spanId);
-		let canonicalSchema;
-		let derivedSchemaHash = EMPTY_SCHEMA_HASH;
-		if (opts.schema !== void 0) {
-			canonicalSchema = canonicalizeSchema(projectToJsonSchema(opts.schema));
-			derivedSchemaHash = schemaHash(canonicalSchema);
-		}
-		const escalation = opts.escalation ?? profile?.escalation;
-		if (escalation !== void 0) {
-			if (escalation.flavor === "B" && escalation.deadlineMs === void 0) throw new ConfigError("flavor 'B' escalation requires an explicit deadlineMs: the suspension deadline has no engine default");
-			if (escalation.deadlineMs !== void 0) requirePositiveInteger(escalation.deadlineMs, "escalation.deadlineMs");
-			if (escalation.minSpendUsd !== void 0) requireNonNegativeNumber(escalation.minSpendUsd, "escalation.minSpendUsd");
-			if (opts.result !== "full" && internals.onEscalation === void 0) throw new ConfigError("a spawn that opts into escalation from a plain value-form call needs an onEscalation hook (or use result: 'full')");
-			if (escalation.flavor === "B" && escalation.deadlineMs === void 0) throw new ConfigError("escalation flavor 'B' requires an explicit deadlineMs");
-		}
-		const declaredTools = opts.tools ?? profile?.tools ?? [];
-		const toolset = await resolveToolset(escalation === void 0 ? declaredTools : [...declaredTools, escalateTool()], { runId: internals.runId }, internals.defaults.toolsets, internals.executors === void 0 ? void 0 : new Set(Object.keys(internals.executors)));
-		const layers = [
-			callLayer,
-			profileLayer,
-			engineLayer
-		];
-		const toolsAvailable = toolset.contracts.length > 0;
-		const finalizeRouted = roleConfiguredInRouting("finalize", layers);
-		let extract;
-		if (opts.schema !== void 0 && canonicalSchema !== void 0) {
-			const extractResolved = withTelemetry(resolveModelInvocation({
-				role: "extract",
-				call: callLayer,
-				profile: profileLayer,
-				workflow: workflowLayer,
-				engine: engineLayer,
-				capsOf,
-				...floorContext
-			}));
-			const loopTier = selectStructuredOutputTier(capsOf(loopResolved.ref), canonicalSchema);
-			if (needsSeparateExtract({
-				schemaSet: true,
-				loopRef: loopResolved.ref,
-				extractRef: extractResolved.ref,
-				loopTier,
-				toolsAvailable,
-				finalizeRouted
-			})) {
-				extract = {
-					adapter: adapterOf(extractResolved),
-					resolved: extractResolved
-				};
-				for (const scrub of extractResolved.scrubs) internals.events.emit({
-					type: "log",
-					level: "warn",
-					msg: scrub.detail
-				}, state.spanId);
-			}
-		}
-		let finalize;
-		if (finalizeFires({
-			routed: finalizeRouted,
-			toolsAvailable
-		})) {
-			const finalizeResolved = withTelemetry(resolveModelInvocation({
-				role: "finalize",
-				call: callLayer,
-				profile: profileLayer,
-				workflow: workflowLayer,
-				engine: engineLayer,
-				capsOf,
-				...floorContext
-			}));
-			finalize = {
-				adapter: adapterOf(finalizeResolved),
-				resolved: finalizeResolved
-			};
-			for (const scrub of finalizeResolved.scrubs) internals.events.emit({
-				type: "log",
-				level: "warn",
-				msg: scrub.detail
-			}, state.spanId);
-		}
-		let summarizeResolved;
-		try {
-			summarizeResolved = resolveModelInvocation({
-				role: "summarize",
-				call: callLayer,
-				profile: profileLayer,
-				workflow: workflowLayer,
-				engine: engineLayer,
-				capsOf,
-				...floorContext
-			});
-		} catch {
-			summarizeResolved = resolveModelInvocation({
-				role: "summarize",
-				call: callLayer,
-				profile: profileLayer,
-				workflow: workflowLayer,
-				engine: {
-					...engineLayer,
-					model: loopResolved.ref
-				},
-				capsOf,
-				...floorContext
-			});
-		}
-		const summarize = {
-			adapter: adapterOf(summarizeResolved),
-			resolved: withTelemetry(summarizeResolved)
-		};
-		const failoverChainFor = (role, resolved) => (resolved.fallbacks ?? []).map((ref) => {
-			const fallbackLayer = { model: ref };
-			if (callLayer.effort !== void 0) fallbackLayer.effort = callLayer.effort;
-			const fallbackResolved = withTelemetry(resolveModelInvocation({
-				role,
-				call: fallbackLayer,
-				profile: profileLayer,
-				workflow: workflowLayer,
-				engine: engineLayer,
-				capsOf,
-				...floorContext
-			}));
-			return {
-				adapter: adapterOf(fallbackResolved),
-				resolved: fallbackResolved
-			};
-		});
-		const loopFallbacks = failoverChainFor(primaryRole, loopResolved);
-		if (extract !== void 0) {
-			const chain = failoverChainFor("extract", extract.resolved);
-			if (chain.length > 0) extract.fallbacks = chain;
-		}
-		if (finalize !== void 0) {
-			const chain = failoverChainFor("finalize", finalize.resolved);
-			if (chain.length > 0) finalize.fallbacks = chain;
-		}
-		{
-			const chain = failoverChainFor("summarize", summarizeResolved);
-			if (chain.length > 0) summarize.fallbacks = chain;
-		}
-		const retryPolicy = opts.retry ?? profile?.retry ?? internals.defaults.retry;
-		if (retryPolicy !== void 0) validateRetryPolicy(retryPolicy, opts.retry !== void 0 ? "the agent retry option" : profile?.retry !== void 0 ? `the retry of profile '${String(opts.agentType)}'` : "engine defaults.retry");
-		if (opts.estCost !== void 0) requireNonNegativeNumber(opts.estCost, "the agent estCost option");
-		if (opts.limits !== void 0) validateUsageLimits(opts.limits, "the agent limits option");
-		const identityInput = {
-			kind: "agent",
-			agentType,
-			modelSpec: loopResolved.canonical,
-			prompt: opts.key ?? prompt,
-			schemaHash: derivedSchemaHash,
-			toolsetHash: toolset.hash,
-			isolation
-		};
-		const identityKey = deriveContentKey(identityInput);
-		const matched = internals.replayer.match(state.scope, identityInput, opts.replay ?? "scoped");
-		if (matched.kind === "replay" || matched.kind === "skip") {
-			opts[kOnRunning]?.(matched.running.seq);
-			const terminal = matched.kind === "replay" ? matched.terminal : matched.terminal;
-			const spanId = internals.spans.mint(state.spanId);
-			const usage = terminal?.usage ?? {
-				inputTokens: 0,
-				outputTokens: 0,
-				cacheReadTokens: 0,
-				cacheWriteTokens: 0
-			};
-			const replayPriced = terminal === void 0 ? void 0 : priceEntryUsage(terminal, (ref, sliceUsage) => internals.priceUsd(ref, sliceUsage));
-			const costUsd = replayPriced?.usd ?? 0;
-			const result = {
-				status: matched.kind === "skip" ? "skipped" : terminal?.status ?? "ok",
-				output: matched.kind === "skip" ? null : terminal?.value ?? null,
-				usage,
-				costUsd,
-				servedBy: terminal?.servedBy ?? loopResolved.ref,
-				turns: 0,
-				transcriptRef: terminal?.transcriptRef ?? ""
-			};
-			if (terminal?.error !== void 0) {
-				result.error = agentErrorFromWire(terminal.error);
-				result.errorMessage = terminal.error.message;
-			}
-			if (terminal?.artifacts !== void 0) result.artifacts = terminal.artifacts;
-			if (terminal?.providerCalls !== void 0) result.providerCalls = terminal.providerCalls;
-			if (terminal?.status === "escalated" && terminal.escalation !== void 0) result.escalation = terminal.escalation;
-			{
-				const stampedData = terminal?.error?.data;
-				if (stampedData?.abortClass !== void 0) result.abortClass = stampedData.abortClass;
-				if (stampedData?.exploration !== void 0) result.exploration = stampedData.exploration;
-			}
-			let replayedToolResults = [];
-			if (matched.kind === "replay" && terminal?.checkpointRef !== void 0) {
-				const blob = await internals.transcripts.get(terminal.checkpointRef);
-				const checkpoint = blob === null ? void 0 : decodeCheckpoint(blob);
-				if (checkpoint !== void 0) {
-					result.turns = checkpoint.turns;
-					if (result.status === "limit") {
-						const partialReport = latestProgressReport(checkpoint.messages);
-						if (partialReport !== void 0) result.partial = partialReport;
-					}
-					replayedToolResults = checkpoint.messages.filter((msg) => msg.role === "tool").flatMap((msg) => msg.parts).filter((part) => part.type === "tool-result").map((part) => ({
-						name: part.name,
-						isError: part.isError === true
-					}));
-				}
-			}
-			internals.events.emit({
-				type: "agent:start",
-				agentType,
-				label: opts.label,
-				model: loopResolved.ref,
-				role: primaryRole
-			}, spanId, true);
-			for (const toolResult of replayedToolResults) {
-				internals.events.emit({
-					type: "tool:start",
-					toolName: toolResult.name
-				}, spanId, true);
-				internals.events.emit({
-					type: "tool:end",
-					toolName: toolResult.name,
-					outcome: toolResult.isError ? "error" : "ok",
-					durationMs: 0
-				}, spanId, true);
+			internals.events.emit({
+				type: "agent:start",
+				agentType,
+				label: opts.label,
+				model: loopResolved.ref,
+				role: primaryRole
+			}, spanId, true);
+			for (const toolResult of replayedToolResults) {
+				internals.events.emit({
+					type: "tool:start",
+					toolName: toolResult.name
+				}, spanId, true);
+				internals.events.emit({
+					type: "tool:end",
+					toolName: toolResult.name,
+					outcome: toolResult.isError ? "error" : "ok",
+					durationMs: 0
+				}, spanId, true);
 			}
 			if (terminal !== void 0) entryUsageSlices(terminal).forEach((slice, index) => {
 				const priced = internals.priceUsd(slice.servedBy, slice.usage) ?? 0;
@@ -15724,216 +14668,592 @@ function dedupeRepeatedClaims(rows) {
 	};
 }
 //#endregion
-//#region src/orchestrator/orchestrate.ts
+//#region src/orchestrator/handles.ts
 /**
-* The mode (c) dynamic orchestrator (M6-T07/T08).
-*
-* Full contract: https://docs.rulvar.com/guide/adaptive-orchestration. An ordinary
-* workflow whose agent (role 'orchestrate') holds the typed spawn tools;
-* both surfaces (top-level orchestrate() and ctx.orchestrate) share this
-* one implementation, the nested surface riding ctx.workflow so the
-* AdmissionController clamps depth and budget for free.
-*
-* Resume semantics (the M6 gate): orchestrator turns checkpoint at every
-* turn boundary (mandatory for the orchestrate role); every spawn is an
-* ordinary kind 'agent' entry; a crashed orchestrate() restores its
-* history from the checkpoint and finds child results by content keys,
-* WITHOUT regenerating spawn decisions and without re-paying children.
-* Non-PlanRunner applicability: only the lifetime
-* cap, maxDepth, and the budget layers apply; no termination.init is
-* written; escalated children simply settle into their digests.
+* The committed WakeDigest render budget (Appendix A: 400
+* chars per outputSummary row, the character measure; committed at M10
+* entry by adopting the implemented distillation cap unchanged, the
+* value frozen into every cassette since M6). One value serves both
+* stages: the deterministic distillation cap here and the digest
+* render default in orchestrate (renderBudgetChars).
 */
-/** How many rejected finishes are repaired by default: the plan's repair once. */
-const DEFAULT_FINISH_MAX_REPAIRS = 1;
+const WAKE_SUMMARY_RENDER_BUDGET_CHARS = 400;
 /**
-* Default maxTurns of the synthesize invocation (RV-211): the finish
-* call plus headroom for one validator repair exchange.
+* The M6 outputSummary: a deterministic truncation of the child's
+* output (or error message), identical live and on replay (distillation
+* lives with the child, ordered by
+* spawn ordinal; the LLM distillation upgrade is M7 territory).
 */
-const DEFAULT_SYNTHESIS_MAX_TURNS = 4;
-/**
-* Default maxTurns of ONE incremental synthesis note (RV-211 remainder):
-* a note summarizes a single settled child into a bounded finish call,
-* so it needs less headroom than the full synthesis invocation.
-*/
-const DEFAULT_SYNTHESIS_NOTE_MAX_TURNS = 2;
-const ORCHESTRATE_WORKFLOW_NAME = "rulvar-orchestrate";
-/**
-* One page of a string, for the child result evidence tools: maxChars is
-* clamped to [1, MAX] and offset to [0, length], so a hostile or absent
-* paging argument can never throw or read past the end. The window is measured in
-* UTF-16 code units, the same unit the model counts, so hasMore and the
-* next offset are exact.
-*/
-function pageOf(content, rawOffset, rawMaxChars) {
-	const totalChars = content.length;
-	const offset = Math.min(Math.max(0, Math.trunc(rawOffset ?? 0)), totalChars);
-	const end = Math.min(offset + Math.min(Math.max(1, Math.trunc(rawMaxChars ?? 4e3)), MAX_CHILD_RESULT_PAGE_CHARS), totalChars);
+function summarizeOutput(result) {
+	let raw;
+	if (result.status === "ok") raw = typeof result.output === "string" ? result.output : JSON.stringify(result.output ?? null);
+	else {
+		raw = result.errorMessage ?? `terminal status ${result.status}`;
+		if (result.status === "limit" && result.output !== null && result.output !== void 0) {
+			const final = typeof result.output === "string" ? result.output : JSON.stringify(result.output);
+			raw = `${raw}; final: ${final}`;
+		}
+		if (result.partial !== void 0) raw = `${raw}; partial: ${JSON.stringify(result.partial)}`;
+	}
+	return truncateToBudget(raw, 400);
+}
+/** Folds one settled child into its digest (spawn-ordinal ordering is the caller's). */
+function digestOf(record, result) {
 	return {
-		totalChars,
-		offset,
-		content: content.slice(offset, end),
-		hasMore: end < totalChars
+		nodeId: record.nodeId,
+		logicalTaskId: record.logicalTaskId,
+		status: result.status,
+		outputSummary: summarizeOutput(result),
+		costUsd: result.costUsd,
+		artifactsIndex: (result.artifacts ?? []).map((artifact) => artifact.id)
 	};
 }
-/** The serialized full result of a settled child: the raw string, or JSON. */
-function serializeChildOutput(result) {
-	if (result.status !== "ok") {
-		const base = result.errorMessage ?? `terminal status ${result.status}`;
-		if (result.partial !== void 0) return JSON.stringify({
-			error: base,
-			partial: result.partial
-		});
-		return base;
-	}
-	return typeof result.output === "string" ? result.output : JSON.stringify(result.output ?? null);
+//#endregion
+//#region src/orchestrator/wake.ts
+/** The wait_for_events parameter schema (normative). */
+const WAIT_FOR_EVENTS_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["triggers"],
+	properties: { triggers: {
+		type: "array",
+		minItems: 1,
+		items: { oneOf: [
+			{
+				type: "object",
+				additionalProperties: false,
+				required: ["kind"],
+				properties: { kind: { const: "quiescence" } }
+			},
+			{
+				type: "object",
+				additionalProperties: false,
+				required: ["kind"],
+				properties: {
+					kind: { const: "child_terminal" },
+					handles: {
+						type: "array",
+						items: {
+							type: "integer",
+							minimum: 1
+						}
+					}
+				}
+			},
+			{
+				type: "object",
+				additionalProperties: false,
+				required: ["kind"],
+				properties: { kind: { const: "escalation" } }
+			},
+			{
+				type: "object",
+				additionalProperties: false,
+				required: ["kind", "percent"],
+				properties: {
+					kind: { const: "budget_threshold" },
+					percent: { enum: [50, 80] }
+				}
+			}
+		] }
+	} }
+};
+const WAIT_FOR_EVENTS_TOOL_NAME = "wait_for_events";
+/** The all-zero blocks of runs without the PlanRunner extension. */
+function emptyDigestBlocks() {
+	return {
+		planHash: "",
+		termination: {
+			revisionUnitsRemaining: 0,
+			spawnUnitsRemaining: 0,
+			perLineage: {},
+			phi: 0
+		},
+		budget: {
+			runSpentUsd: 0,
+			runCeilingUsd: 0,
+			orchestratorSpentUsd: 0,
+			orchestratorCapUsd: 0,
+			finalizeReserveUsd: 0,
+			orchestratorShare: 0,
+			softWarning: false
+		},
+		reuse: {
+			abandonedUsd: 0,
+			reclaimedUsd: 0,
+			netLostUsd: 0
+		}
+	};
 }
-/**
-* The orchestrate intake gate (v1.35.0 review P2-2): every numeric
-* option and the atCap literal validate SYNCHRONOUSLY at workflow
-* construction, shared by both surfaces (the top level orchestrate() throws
-* before a run exists; ctx.orchestrate throws before any journal entry,
-* provider call, or child dispatch). A NaN here previously disabled the
-* spawn cap (`spawnOrdinal >= NaN` is false forever) and the digest
-* render bound, and a negative finalize reserve WIDENED the soft cap
-* boundary instead of reserving from it.
-*/
-function validateOrchestrateOptions(opts) {
-	if (opts === void 0) return;
-	if (opts.maxSpawns !== void 0) requireNonNegativeInteger(opts.maxSpawns, "orchestrate maxSpawns");
-	if (opts.renderBudgetChars !== void 0) requireNonNegativeInteger(opts.renderBudgetChars, "orchestrate renderBudgetChars");
-	if (opts.acceptance !== void 0) {
-		const policy = opts.acceptance.childPolicy;
-		const minSuccessful = typeof policy === "object" && policy !== null && !Array.isArray(policy) ? policy.minSuccessful : void 0;
-		if (policy !== "all-ok" && minSuccessful === void 0) throw new ConfigError(`orchestrate acceptance.childPolicy must be 'all-ok' or { minSuccessful: N }; got ${JSON.stringify(policy)}`);
-		if (policy !== "all-ok") requirePositiveInteger(minSuccessful, "orchestrate acceptance.childPolicy.minSuccessful");
-		const acceptPartial = opts.acceptance.acceptPartialChildren;
-		if (acceptPartial !== void 0 && typeof acceptPartial !== "boolean") throw new ConfigError(`orchestrate acceptance.acceptPartialChildren must be a boolean; got ${typeof acceptPartial}`);
+//#endregion
+//#region src/orchestrator/spawn-tools.ts
+/** The spawn_agent parameter schema (normative). */
+const SPAWN_AGENT_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["agentType", "prompt"],
+	properties: {
+		agentType: { type: "string" },
+		prompt: { type: "string" },
+		outputSchemaRef: { type: "string" },
+		toolsetRef: { type: "string" },
+		budgetUsd: {
+			type: "number",
+			exclusiveMinimum: 0
+		},
+		model_hint: {
+			type: "object",
+			additionalProperties: false,
+			properties: { startTier: {
+				type: "integer",
+				minimum: 0
+			} }
+		},
+		approach: {
+			type: "string",
+			maxLength: 64
+		},
+		lineage: {
+			type: "object",
+			additionalProperties: false,
+			required: ["continues", "causeRef"],
+			properties: {
+				continues: {
+					type: "string",
+					description: "LogicalTaskId to continue"
+				},
+				relation: { enum: [
+					"respawn",
+					"rung-retry",
+					"decompose-child",
+					"unpark-restart"
+				] },
+				causeRef: {
+					type: "integer",
+					minimum: 1,
+					description: "seq of the journal entry that caused the rebirth"
+				}
+			}
+		},
+		taskClass: { type: "string" }
 	}
-	if (opts.finishValidation !== void 0) {
-		const fv = opts.finishValidation;
-		if (!Array.isArray(fv.validators) || fv.validators.length === 0) throw new ConfigError("orchestrate finishValidation.validators must be a non empty array of validators");
-		const seen = /* @__PURE__ */ new Set();
-		for (const candidate of fv.validators) {
-			const validator = candidate;
-			if (typeof validator.name !== "string" || validator.name.length === 0) throw new ConfigError("every orchestrate finish validator must carry a non empty string name");
-			if (typeof validator.validate !== "function") throw new ConfigError(`orchestrate finish validator '${validator.name}' has no validate function`);
-			if (seen.has(validator.name)) throw new ConfigError(`orchestrate finishValidation.validators names must be unique; '${validator.name}' repeats (pass name to the factory to run several instances)`);
-			seen.add(validator.name);
+};
+/** parallel_agents wraps the spawn_agent params. */
+const PARALLEL_AGENTS_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["tasks"],
+	properties: { tasks: {
+		type: "array",
+		minItems: 1,
+		items: { $ref: "#/$defs/spawnAgentParams" }
+	} },
+	$defs: { spawnAgentParams: SPAWN_AGENT_SCHEMA }
+};
+/** await_any and await_all share one parameter shape. */
+const AWAIT_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["handles"],
+	properties: { handles: {
+		type: "array",
+		minItems: 1,
+		items: {
+			type: "integer",
+			minimum: 1
 		}
-		if (fv.maxRepairs !== void 0) requireNonNegativeInteger(fv.maxRepairs, "orchestrate finishValidation.maxRepairs");
+	} }
+};
+/** The cancel_agent parameter schema. */
+const CANCEL_AGENT_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["handle"],
+	properties: {
+		handle: {
+			type: "integer",
+			minimum: 1
+		},
+		reason: { type: "string" }
 	}
-	if (opts.synthesis !== void 0) {
-		const synthesis = opts.synthesis;
-		if (synthesis.mode !== void 0 && synthesis.mode !== "single" && synthesis.mode !== "incremental") throw new ConfigError("orchestrate synthesis.mode must be 'single' or 'incremental'; got " + JSON.stringify(synthesis.mode));
-		if (synthesis.mode === "incremental" && opts.finishValidation !== void 0) throw new ConfigError("orchestrate synthesis.mode 'incremental' reconciles deterministically and has no model-composed final finish for finishValidation to bind; configure validators with mode 'single', or drop them");
-		if (synthesis.dedupeClaims !== void 0 && typeof synthesis.dedupeClaims !== "boolean") throw new ConfigError("orchestrate synthesis.dedupeClaims must be a boolean; got " + typeof synthesis.dedupeClaims);
-		if (synthesis.noteLimits !== void 0) validateUsageLimits(synthesis.noteLimits, "orchestrate synthesis.noteLimits");
-		if (synthesis.effort !== void 0 && ![
-			"low",
-			"medium",
-			"high",
-			"xhigh",
-			"max"
-		].includes(synthesis.effort)) throw new ConfigError(`orchestrate synthesis.effort must be one of 'low' | 'medium' | 'high' | 'xhigh' | 'max'; got ${JSON.stringify(synthesis.effort)}`);
-		if (synthesis.limits !== void 0) validateUsageLimits(synthesis.limits, "orchestrate synthesis.limits");
-		if (synthesis.instructions !== void 0 && typeof synthesis.instructions !== "string") throw new ConfigError(`orchestrate synthesis.instructions must be a string; got ${typeof synthesis.instructions}`);
-		if (synthesis.estCost !== void 0) requireNonNegativeNumber(synthesis.estCost, "orchestrate synthesis.estCost");
+};
+/** Default and hard-max characters per child-result / artifact page. */
+const DEFAULT_CHILD_RESULT_PAGE_CHARS = 4e3;
+const MAX_CHILD_RESULT_PAGE_CHARS = 2e4;
+const PAGING_PROPS = {
+	offset: {
+		type: "integer",
+		minimum: 0
+	},
+	maxChars: {
+		type: "integer",
+		minimum: 1
 	}
-	const spec = opts.budget;
-	if (spec === void 0) return;
-	if (spec.capUsd !== void 0) requireNonNegativeNumber(spec.capUsd, "orchestrate budget.capUsd");
-	if (spec.capFraction !== void 0) requireFraction(spec.capFraction, "orchestrate budget.capFraction");
-	if (spec.finalizeReserveUsd !== void 0) requireNonNegativeNumber(spec.finalizeReserveUsd, "orchestrate budget.finalizeReserveUsd");
-	if (spec.finalizeTurns !== void 0) requirePositiveInteger(spec.finalizeTurns, "orchestrate budget.finalizeTurns");
-	if (spec.atCap !== void 0 && spec.atCap !== "finish-with-partial" && spec.atCap !== "fail-run") throw new ConfigError(`orchestrate budget.atCap must be 'finish-with-partial' or 'fail-run'; got ${String(spec.atCap)}`);
-}
-function orchestratorPrompt(goal, maxSpawns, extensionLines) {
-	return [
-		"You are the orchestrator of a multi-agent run.",
-		`GOAL: ${goal}`,
-		"",
-		"Decompose the goal into child agents with spawn_agent or parallel_agents,",
-		"wait on their handles with await_any or await_all, cancel stragglers with",
-		"cancel_agent, and terminate with finish({ result }) when the goal is met.",
-		maxSpawns === void 0 ? "Spawn only what the goal needs." : `You may spawn at most ${String(maxSpawns)} children.`,
-		...extensionLines ?? []
-	].join("\n");
-}
+};
+const GET_CHILD_RESULT_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["handle"],
+	properties: {
+		handle: {
+			type: "integer",
+			minimum: 1
+		},
+		...PAGING_PROPS
+	}
+};
+const READ_CHILD_ARTIFACT_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["handle", "artifactId"],
+	properties: {
+		handle: {
+			type: "integer",
+			minimum: 1
+		},
+		artifactId: { type: "string" },
+		...PAGING_PROPS
+	}
+};
+const GET_CHILD_RESULT_TOOL_NAME = "get_child_result";
+const READ_CHILD_ARTIFACT_TOOL_NAME = "read_child_artifact";
+/** finish; result validates against the declared output schema. */
+const FINISH_SCHEMA = {
+	type: "object",
+	additionalProperties: false,
+	required: ["result"],
+	properties: {
+		result: { $comment: "validated against the declared output SchemaSpec of the orchestrate call; free-form JSON when none is declared" },
+		summary: { type: "string" }
+	}
+};
+const FINISH_TOOL_NAME = "finish";
 /**
-* The finish validation contract rides the PROMPT, never the toolset:
-* the finish tool definition stays byte identical in every
-* configuration, so the orchestrator toolset hash never moves (stricter
-* than the evidence tools opt in, which changes it by design).
+* Builds the mode (c) toolset over the per-call runtime. profileCardText
+* rides the spawn tools' descriptions so both modes speak one agent
+* vocabulary (M6-T04).
 */
-function finishValidationPromptLines(spec) {
-	if (spec === void 0) return [];
-	const names = spec.validators.map((validator) => validator.name).join(", ");
-	const repairs = spec.maxRepairs ?? 1;
-	return [`The host validates every finish({ result }) with deterministic validators: ${names}.`, "A rejected finish returns the failure reasons as the tool error result; repair the result and call finish again. " + (repairs === 0 ? "No repair attempt is granted: the first rejected finish fails the run." : repairs === 1 ? "At most one repair attempt is granted before the run fails." : `At most ${String(repairs)} repair attempts are granted before the run fails.`)];
+function buildOrchestratorTools(runtime, profileCardText, options) {
+	const spawnAgent = tool({
+		name: "spawn_agent",
+		description: `Admit and schedule one child agent. ${profileCardText}`,
+		parameters: SPAWN_AGENT_SCHEMA,
+		execute: (input) => runtime.spawn(input)
+	});
+	const parallelAgents = tool({
+		name: "parallel_agents",
+		description: "Admit and schedule several children at once (submission order).",
+		parameters: PARALLEL_AGENTS_SCHEMA,
+		execute: async (input) => {
+			const tasks = input.tasks;
+			const handles = [];
+			for (const task of tasks) {
+				const spawned = await runtime.spawn(task);
+				handles.push(spawned.handle);
+			}
+			return { handles };
+		}
+	});
+	const awaitAny = tool({
+		name: "await_any",
+		description: "Wait for the FIRST of the handles to settle; returns its TaskDigest.",
+		parameters: AWAIT_SCHEMA,
+		execute: (input) => runtime.awaitAny(input.handles)
+	});
+	const awaitAll = tool({
+		name: "await_all",
+		description: "Wait for ALL handles to settle; returns their TaskDigests in handle order.",
+		parameters: AWAIT_SCHEMA,
+		execute: (input) => runtime.awaitAll(input.handles)
+	});
+	const cancelAgent = tool({
+		name: "cancel_agent",
+		description: "Cancel an in-flight child. Cancellation is caller intent: the entry journals cancelled and reruns on a later resume unless covered by abandon (M7).",
+		parameters: CANCEL_AGENT_SCHEMA,
+		execute: (input) => {
+			const params = input;
+			return runtime.cancel(params.handle, params.reason);
+		}
+	});
+	const waitForEvents = tool({
+		name: WAIT_FOR_EVENTS_TOOL_NAME,
+		description: "Sleep until a coalesced WakeDigest: quiescence (always armed), child_terminal, escalation, or budget_threshold at 50/80 percent. A trigger set that can never fire is a typed error.",
+		parameters: WAIT_FOR_EVENTS_SCHEMA,
+		execute: (input) => runtime.waitForEvents(input.triggers)
+	});
+	const finish = tool({
+		name: FINISH_TOOL_NAME,
+		description: "Terminate the orchestration with a result (run outcome ok).",
+		parameters: FINISH_SCHEMA,
+		execute: () => {
+			throw new Error("finish is intercepted by the agent runtime, never executed");
+		}
+	});
+	const tools = [
+		spawnAgent,
+		parallelAgents,
+		awaitAny,
+		awaitAll,
+		cancelAgent,
+		waitForEvents
+	];
+	if (options?.childResultTools === true) tools.push(tool({
+		name: GET_CHILD_RESULT_TOOL_NAME,
+		description: "Read a page of a SETTLED child's FULL output (the digest is truncated to 400 chars). Pages with offset and maxChars; the reply reports totalChars and hasMore.",
+		parameters: GET_CHILD_RESULT_SCHEMA,
+		execute: (input) => {
+			const p = input;
+			return runtime.getChildResult(p.handle, {
+				offset: p.offset,
+				maxChars: p.maxChars
+			});
+		}
+	}), tool({
+		name: READ_CHILD_ARTIFACT_TOOL_NAME,
+		description: "Read a page of a SETTLED child's artifact content by id (ids come from get_child_result or a digest). Pages with offset and maxChars.",
+		parameters: READ_CHILD_ARTIFACT_SCHEMA,
+		execute: (input) => {
+			const p = input;
+			return runtime.readChildArtifact(p.handle, p.artifactId, {
+				offset: p.offset,
+				maxChars: p.maxChars
+			});
+		}
+	}));
+	tools.push(finish);
+	return tools;
 }
+//#endregion
+//#region src/orchestrator/orchestrate.ts
 /**
-* The partial-salvage contract rides the PROMPT exactly like finish
-* validation (RV-210 close-out): present only when
-* acceptance.acceptPartialChildren is set, so every other configuration
-* keeps byte-identical coordination prompts.
+* The mode (c) dynamic orchestrator (M6-T07/T08).
+*
+* Full contract: https://docs.rulvar.com/guide/adaptive-orchestration. An ordinary
+* workflow whose agent (role 'orchestrate') holds the typed spawn tools;
+* both surfaces (top-level orchestrate() and ctx.orchestrate) share this
+* one implementation, the nested surface riding ctx.workflow so the
+* AdmissionController clamps depth and budget for free.
+*
+* Resume semantics (the M6 gate): orchestrator turns checkpoint at every
+* turn boundary (mandatory for the orchestrate role); every spawn is an
+* ordinary kind 'agent' entry; a crashed orchestrate() restores its
+* history from the checkpoint and finds child results by content keys,
+* WITHOUT regenerating spawn decisions and without re-paying children.
+* Non-PlanRunner applicability: only the lifetime
+* cap, maxDepth, and the budget layers apply; no termination.init is
+* written; escalated children simply settle into their digests.
 */
-function acceptancePromptLines(acceptance) {
-	if (acceptance?.acceptPartialChildren !== true) return [];
-	return ["Partial salvage is on: a child that ends at its limit AFTER recording progress with report_progress counts as a partial success for acceptance; its digest carries the partial and get_child_result (when enabled) pages the full report. When the gap matters, respawn a NARROWED child carrying the partial instead of repeating the task."];
-}
+/** How many rejected finishes are repaired by default: the plan's repair once. */
+const DEFAULT_FINISH_MAX_REPAIRS = 1;
 /**
-* Resolves per-spawn dispatch options against the engine registries
-* (registered SchemaSpec and tool profile names; M7-T05). An
-* unknown ref is a typed ConfigError, surfaced as a tool error to the
-* orchestrator and never a run failure.
+* Default maxTurns of the synthesize invocation (RV-211): the finish
+* call plus headroom for one validator repair exchange.
 */
-function resolveDispatchOpts(spec, defaults) {
-	const opts = {};
-	if (spec.outputSchemaRef !== void 0) {
-		const schema = defaults.schemas?.[spec.outputSchemaRef];
-		if (schema === void 0) throw new ConfigError(`unknown outputSchemaRef '${spec.outputSchemaRef}': register it under defaults.schemas`);
-		opts.schema = schema;
-	}
-	if (spec.toolsetRef !== void 0) {
-		const tools = defaults.toolsets?.[spec.toolsetRef];
-		if (tools === void 0) throw new ConfigError(`unknown toolsetRef '${spec.toolsetRef}': register it under defaults.toolsets (https://docs.rulvar.com/guide/tools)`);
-		opts.tools = tools;
-	}
-	const extended = spec;
-	if (extended.isolation !== void 0) opts.isolation = extended.isolation;
-	if (extended.usageLimits !== void 0) opts.limits = extended.usageLimits;
-	if (extended.escalation !== void 0) opts.escalation = extended.escalation;
-	if (extended.bootCheckpointRef !== void 0) opts[kBootCheckpoint] = extended.bootCheckpointRef;
-	if (extended.model !== void 0) opts.model = extended.model;
-	if (extended.memoizeOutcome !== void 0) opts.memoizeOutcome = extended.memoizeOutcome;
-	if (extended.schema !== void 0 && opts.schema === void 0) opts.schema = extended.schema;
-	return opts;
-}
-function filterProfiles(registered, names) {
-	if (registered === void 0) return {};
-	if (names === void 0) return registered;
-	const filtered = {};
-	for (const name of names) if (registered[name] !== void 0) filtered[name] = registered[name];
-	return filtered;
-}
+const DEFAULT_SYNTHESIS_MAX_TURNS = 4;
 /**
-* Builds the orchestrator workflow: ONE implementation behind both
-* surfaces. The body wires the spawn tools over the per-call runtime,
-* recovers spawn records from the journal on resume, and runs the
-* orchestrator agent with the finish terminal tool.
+* Default maxTurns of ONE incremental synthesis note (RV-211 remainder):
+* a note summarizes a single settled child into a bounded finish call,
+* so it needs less headroom than the full synthesis invocation.
 */
-function makeOrchestratorWorkflow(goal, opts) {
-	validateOrchestrateOptions(opts);
-	return defineWorkflow({ name: ORCHESTRATE_WORKFLOW_NAME }, async (ctx) => {
-		const runtime = runtimeOf(ctx);
-		const { internals } = runtime;
-		if (internals.admission === void 0) throw new ConfigError("orchestrate requires the engine run context (createEngine)");
-		const admission = internals.admission;
-		const callingState = runtime.currentState();
-		const advertisedProfiles = filterProfiles(internals.defaults.profiles, opts?.profiles);
-		const spawnableProfiles = {};
-		const declaredLadderNames = [];
-		for (const [name, profile] of Object.entries(advertisedProfiles)) {
+const DEFAULT_SYNTHESIS_NOTE_MAX_TURNS = 2;
+const ORCHESTRATE_WORKFLOW_NAME = "rulvar-orchestrate";
+/**
+* One page of a string, for the child result evidence tools: maxChars is
+* clamped to [1, MAX] and offset to [0, length], so a hostile or absent
+* paging argument can never throw or read past the end. The window is measured in
+* UTF-16 code units, the same unit the model counts, so hasMore and the
+* next offset are exact.
+*/
+function pageOf(content, rawOffset, rawMaxChars) {
+	const totalChars = content.length;
+	const offset = Math.min(Math.max(0, Math.trunc(rawOffset ?? 0)), totalChars);
+	const end = Math.min(offset + Math.min(Math.max(1, Math.trunc(rawMaxChars ?? 4e3)), MAX_CHILD_RESULT_PAGE_CHARS), totalChars);
+	return {
+		totalChars,
+		offset,
+		content: content.slice(offset, end),
+		hasMore: end < totalChars
+	};
+}
+/** The serialized full result of a settled child: the raw string, or JSON. */
+function serializeChildOutput(result) {
+	if (result.status !== "ok") {
+		const base = result.errorMessage ?? `terminal status ${result.status}`;
+		const limitOutput = result.status === "limit" && result.output !== null && result.output !== void 0;
+		if (limitOutput || result.partial !== void 0) return JSON.stringify({
+			error: base,
+			...limitOutput ? { output: result.output } : {},
+			...result.partial === void 0 ? {} : { partial: result.partial }
+		});
+		return base;
+	}
+	return typeof result.output === "string" ? result.output : JSON.stringify(result.output ?? null);
+}
+/**
+* The orchestrate intake gate (v1.35.0 review P2-2): every numeric
+* option and the atCap literal validate SYNCHRONOUSLY at workflow
+* construction, shared by both surfaces (the top level orchestrate() throws
+* before a run exists; ctx.orchestrate throws before any journal entry,
+* provider call, or child dispatch). A NaN here previously disabled the
+* spawn cap (`spawnOrdinal >= NaN` is false forever) and the digest
+* render bound, and a negative finalize reserve WIDENED the soft cap
+* boundary instead of reserving from it.
+*/
+function validateOrchestrateOptions(opts) {
+	if (opts === void 0) return;
+	if (opts.maxSpawns !== void 0) requireNonNegativeInteger(opts.maxSpawns, "orchestrate maxSpawns");
+	if (opts.renderBudgetChars !== void 0) requireNonNegativeInteger(opts.renderBudgetChars, "orchestrate renderBudgetChars");
+	if (opts.acceptance !== void 0) {
+		const policy = opts.acceptance.childPolicy;
+		const minSuccessful = typeof policy === "object" && policy !== null && !Array.isArray(policy) ? policy.minSuccessful : void 0;
+		if (policy !== "all-ok" && minSuccessful === void 0) throw new ConfigError(`orchestrate acceptance.childPolicy must be 'all-ok' or { minSuccessful: N }; got ${JSON.stringify(policy)}`);
+		if (policy !== "all-ok") requirePositiveInteger(minSuccessful, "orchestrate acceptance.childPolicy.minSuccessful");
+		const acceptPartial = opts.acceptance.acceptPartialChildren;
+		if (acceptPartial !== void 0 && typeof acceptPartial !== "boolean") throw new ConfigError(`orchestrate acceptance.acceptPartialChildren must be a boolean; got ${typeof acceptPartial}`);
+		const acceptOutput = opts.acceptance.acceptValidatedTerminalOutputOnLimit;
+		if (acceptOutput !== void 0 && typeof acceptOutput !== "boolean") throw new ConfigError("orchestrate acceptance.acceptValidatedTerminalOutputOnLimit must be a boolean; got " + typeof acceptOutput);
+	}
+	if (opts.finishValidation !== void 0) {
+		const fv = opts.finishValidation;
+		if (!Array.isArray(fv.validators) || fv.validators.length === 0) throw new ConfigError("orchestrate finishValidation.validators must be a non empty array of validators");
+		const seen = /* @__PURE__ */ new Set();
+		for (const candidate of fv.validators) {
+			const validator = candidate;
+			if (typeof validator.name !== "string" || validator.name.length === 0) throw new ConfigError("every orchestrate finish validator must carry a non empty string name");
+			if (typeof validator.validate !== "function") throw new ConfigError(`orchestrate finish validator '${validator.name}' has no validate function`);
+			if (seen.has(validator.name)) throw new ConfigError(`orchestrate finishValidation.validators names must be unique; '${validator.name}' repeats (pass name to the factory to run several instances)`);
+			seen.add(validator.name);
+		}
+		if (fv.maxRepairs !== void 0) requireNonNegativeInteger(fv.maxRepairs, "orchestrate finishValidation.maxRepairs");
+	}
+	if (opts.synthesis !== void 0) {
+		const synthesis = opts.synthesis;
+		if (synthesis.mode !== void 0 && synthesis.mode !== "single" && synthesis.mode !== "incremental") throw new ConfigError("orchestrate synthesis.mode must be 'single' or 'incremental'; got " + JSON.stringify(synthesis.mode));
+		if (synthesis.mode === "incremental" && opts.finishValidation !== void 0) throw new ConfigError("orchestrate synthesis.mode 'incremental' reconciles deterministically and has no model-composed final finish for finishValidation to bind; configure validators with mode 'single', or drop them");
+		if (synthesis.dedupeClaims !== void 0 && typeof synthesis.dedupeClaims !== "boolean") throw new ConfigError("orchestrate synthesis.dedupeClaims must be a boolean; got " + typeof synthesis.dedupeClaims);
+		if (synthesis.noteLimits !== void 0) validateUsageLimits(synthesis.noteLimits, "orchestrate synthesis.noteLimits");
+		if (synthesis.effort !== void 0 && ![
+			"low",
+			"medium",
+			"high",
+			"xhigh",
+			"max"
+		].includes(synthesis.effort)) throw new ConfigError(`orchestrate synthesis.effort must be one of 'low' | 'medium' | 'high' | 'xhigh' | 'max'; got ${JSON.stringify(synthesis.effort)}`);
+		if (synthesis.limits !== void 0) validateUsageLimits(synthesis.limits, "orchestrate synthesis.limits");
+		if (synthesis.instructions !== void 0 && typeof synthesis.instructions !== "string") throw new ConfigError(`orchestrate synthesis.instructions must be a string; got ${typeof synthesis.instructions}`);
+		if (synthesis.estCost !== void 0) requireNonNegativeNumber(synthesis.estCost, "orchestrate synthesis.estCost");
+	}
+	const spec = opts.budget;
+	if (spec === void 0) return;
+	if (spec.capUsd !== void 0) requireNonNegativeNumber(spec.capUsd, "orchestrate budget.capUsd");
+	if (spec.capFraction !== void 0) requireFraction(spec.capFraction, "orchestrate budget.capFraction");
+	if (spec.finalizeReserveUsd !== void 0) requireNonNegativeNumber(spec.finalizeReserveUsd, "orchestrate budget.finalizeReserveUsd");
+	if (spec.finalizeTurns !== void 0) requirePositiveInteger(spec.finalizeTurns, "orchestrate budget.finalizeTurns");
+	if (spec.atCap !== void 0 && spec.atCap !== "finish-with-partial" && spec.atCap !== "fail-run") throw new ConfigError(`orchestrate budget.atCap must be 'finish-with-partial' or 'fail-run'; got ${String(spec.atCap)}`);
+}
+function orchestratorPrompt(goal, maxSpawns, extensionLines) {
+	return [
+		"You are the orchestrator of a multi-agent run.",
+		`GOAL: ${goal}`,
+		"",
+		"Decompose the goal into child agents with spawn_agent or parallel_agents,",
+		"wait on their handles with await_any or await_all, cancel stragglers with",
+		"cancel_agent, and terminate with finish({ result }) when the goal is met.",
+		maxSpawns === void 0 ? "Spawn only what the goal needs." : `You may spawn at most ${String(maxSpawns)} children.`,
+		...extensionLines ?? []
+	].join("\n");
+}
+/**
+* The finish validation contract rides the PROMPT, never the toolset:
+* the finish tool definition stays byte identical in every
+* configuration, so the orchestrator toolset hash never moves (stricter
+* than the evidence tools opt in, which changes it by design).
+*/
+function finishValidationPromptLines(spec) {
+	if (spec === void 0) return [];
+	const names = spec.validators.map((validator) => validator.name).join(", ");
+	const repairs = spec.maxRepairs ?? 1;
+	return [`The host validates every finish({ result }) with deterministic validators: ${names}.`, "A rejected finish returns the failure reasons as the tool error result; repair the result and call finish again. " + (repairs === 0 ? "No repair attempt is granted: the first rejected finish fails the run." : repairs === 1 ? "At most one repair attempt is granted before the run fails." : `At most ${String(repairs)} repair attempts are granted before the run fails.`)];
+}
+/**
+* The partial-salvage contract rides the PROMPT exactly like finish
+* validation (RV-210 close-out): present only when
+* acceptance.acceptPartialChildren is set, so every other configuration
+* keeps byte-identical coordination prompts.
+*/
+function acceptancePromptLines(acceptance) {
+	const lines = [];
+	if (acceptance?.acceptPartialChildren === true) lines.push("Partial salvage is on: a child that ends at its limit AFTER recording progress with report_progress counts as a partial success for acceptance; its digest carries the partial and get_child_result (when enabled) pages the full report. When the gap matters, respawn a NARROWED child carrying the partial instead of repeating the task.");
+	if (acceptance?.acceptValidatedTerminalOutputOnLimit === true) lines.push("Terminal-output salvage is on: a child that ends at its limit WITH a final answer (its finalization reserve summary, already validated against the declared output schema) counts as a successful child for acceptance; its digest carries it after the 'final:' marker and get_child_result (when enabled) pages it in full.");
+	return lines;
+}
+/**
+* Resolves per-spawn dispatch options against the engine registries
+* (registered SchemaSpec and tool profile names; M7-T05). An
+* unknown ref is a typed ConfigError, surfaced as a tool error to the
+* orchestrator and never a run failure.
+*/
+/**
+* The capped orchestrator's own admission estimate (the 1.63.0
+* experiment review, P0.3): the effective cap MINUS the finalize
+* carve-out already committed on the cap account, so the dispatch
+* admits at EXACT FILL by construction (a capped orchestrator can never
+* spend past its effectiveCap, and pricing the model's full
+* maxOutputTokens instead pinned small run ceilings at zero remainder;
+* the M12 checkpoint measured a self-solving orchestrator because no
+* child was ever admitted). Exported so the live dispatch and
+* preflightEstimate share ONE formula: both call this function.
+*/
+function orchestratorAdmissionEstCostUsd(effectiveCapUsd, committedFinalizeReserveUsd) {
+	return effectiveCapUsd - committedFinalizeReserveUsd;
+}
+function resolveDispatchOpts(spec, defaults) {
+	const opts = {};
+	if (spec.outputSchemaRef !== void 0) {
+		const schema = defaults.schemas?.[spec.outputSchemaRef];
+		if (schema === void 0) throw new ConfigError(`unknown outputSchemaRef '${spec.outputSchemaRef}': register it under defaults.schemas`);
+		opts.schema = schema;
+	}
+	if (spec.toolsetRef !== void 0) {
+		const tools = defaults.toolsets?.[spec.toolsetRef];
+		if (tools === void 0) throw new ConfigError(`unknown toolsetRef '${spec.toolsetRef}': register it under defaults.toolsets (https://docs.rulvar.com/guide/tools)`);
+		opts.tools = tools;
+	}
+	const extended = spec;
+	if (extended.isolation !== void 0) opts.isolation = extended.isolation;
+	if (extended.usageLimits !== void 0) opts.limits = extended.usageLimits;
+	if (extended.escalation !== void 0) opts.escalation = extended.escalation;
+	if (extended.bootCheckpointRef !== void 0) opts[kBootCheckpoint] = extended.bootCheckpointRef;
+	if (extended.model !== void 0) opts.model = extended.model;
+	if (extended.memoizeOutcome !== void 0) opts.memoizeOutcome = extended.memoizeOutcome;
+	if (extended.schema !== void 0 && opts.schema === void 0) opts.schema = extended.schema;
+	return opts;
+}
+function filterProfiles(registered, names) {
+	if (registered === void 0) return {};
+	if (names === void 0) return registered;
+	const filtered = {};
+	for (const name of names) if (registered[name] !== void 0) filtered[name] = registered[name];
+	return filtered;
+}
+/**
+* Builds the orchestrator workflow: ONE implementation behind both
+* surfaces. The body wires the spawn tools over the per-call runtime,
+* recovers spawn records from the journal on resume, and runs the
+* orchestrator agent with the finish terminal tool.
+*/
+function makeOrchestratorWorkflow(goal, opts) {
+	validateOrchestrateOptions(opts);
+	return defineWorkflow({ name: ORCHESTRATE_WORKFLOW_NAME }, async (ctx) => {
+		const runtime = runtimeOf(ctx);
+		const { internals } = runtime;
+		if (internals.admission === void 0) throw new ConfigError("orchestrate requires the engine run context (createEngine)");
+		const admission = internals.admission;
+		const callingState = runtime.currentState();
+		const advertisedProfiles = filterProfiles(internals.defaults.profiles, opts?.profiles);
+		const spawnableProfiles = {};
+		const declaredLadderNames = [];
+		for (const [name, profile] of Object.entries(advertisedProfiles)) {
 			const spec = profile.model;
 			if (spec !== void 0 && typeof spec !== "string" && "ladder" in spec) declaredLadderNames.push(name);
 			else spawnableProfiles[name] = profile;
@@ -16770,11 +16090,13 @@ function makeOrchestratorWorkflow(goal, opts) {
 			let decision = known.find((candidate) => candidate.callId === call.id);
 			if (decision === void 0) {
 				const result = call.result ?? null;
+				const salvageOutputOn = opts?.acceptance?.acceptValidatedTerminalOutputOnLimit === true;
 				const children = [...records.values()].sort((a, b) => a.spawnOrdinal - b.spawnOrdinal).map((record) => ({
 					handle: record.handle,
 					nodeId: record.nodeId,
 					status: record.settled?.status ?? "running",
-					text: record.settled === void 0 ? "" : serializeChildOutput(record.settled)
+					text: record.settled === void 0 ? "" : serializeChildOutput(record.settled),
+					...salvageOutputOn && record.settled?.status === "limit" && record.settled.output !== null && record.settled.output !== void 0 ? { salvageableOutput: true } : {}
 				}));
 				const input = {
 					result,
@@ -16843,7 +16165,7 @@ function makeOrchestratorWorkflow(goal, opts) {
 			role: "orchestrate",
 			result: "full",
 			tools,
-			...capState === void 0 ? {} : { estCost: capState.effectiveCapUsd - (orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.finalizeReserveUsd ?? 0) },
+			...capState === void 0 ? {} : { estCost: orchestratorAdmissionEstCostUsd(capState.effectiveCapUsd, orchestratorAccount === void 0 ? 0 : internals.budget.accountView(orchestratorAccount)?.finalizeReserveUsd ?? 0) },
 			...opts?.model === void 0 ? {} : { model: opts.model },
 			...opts?.limits === void 0 ? {} : { limits: opts.limits },
 			[kOnRunning]: (seq) => {
@@ -17156,151 +16478,912 @@ function makeOrchestratorWorkflow(goal, opts) {
 					...validationSpec === void 0 ? {} : { validate: validateFinish }
 				}
 			};
-			const synthesized = await runtime.runInScope(synthesisState, () => ctx.agent(prompt, synthesisOpts));
-			if (validationTermination !== void 0) throw validationTermination;
-			if (synthesized.status === "ok") return synthesized.output;
-			if (validationSpec !== void 0) throw new FailRunError(`the synthesis invocation terminated with status '${synthesized.status}'` + (synthesized.errorMessage === void 0 ? "" : `: ${synthesized.errorMessage}`) + "; finish validators are configured, so the unvalidated draft cannot stand", { data: {
-				source: "orchestrator_synthesis",
-				status: synthesized.status,
-				turnsUsed: synthesized.turns
-			} });
-			const fallbackKey = deriverV2.deriveKey({ kind: "orchestrator-synthesis-fallback" });
-			if (!internals.replayer.snapshot().some((entry) => entry.kind === "decision" && entry.key === fallbackKey)) await internals.replayer.appendSinglePhase({
-				scope: callingState.scope,
-				key: fallbackKey,
-				kind: "decision",
-				status: "ok",
-				spanId: internals.spans.mint(callingState.spanId),
-				site: "orchestrator-synthesis",
-				value: {
-					decisionType: "orchestrator_synthesis_fallback",
-					status: synthesized.status,
-					turnsUsed: synthesized.turns
-				}
-			});
-			internals.events.emit({
-				type: "log",
-				level: "warn",
-				msg: `the synthesis invocation terminated with status '${synthesized.status}'; falling back to the coordination draft (journaled decision 'orchestrator_synthesis_fallback')`
-			}, callingState.spanId);
-			return draft;
-		};
-		/**
-		* The settle at the cap: the JOURNALED cap decision drives the policy
-		* branch (its `fallback` field froze budget.atCap when the cap
-		* tripped), so a crash between the decision and its effect rolls the
-		* SAME outcome forward on resume, immune to drift of the live options.
-		* 'finish-with-partial' runs the reserved finalizer;
-		* 'fail-run' skips it and fails the run typed (v1.35.0 review P2-1:
-		* the policy used to be journaled and then ignored).
-		*/
-		const settleCapOutcome = async () => {
-			const capValue = internals.replayer.snapshot().find((entry) => entry.seq === capDecisionRef)?.value;
-			if (capValue?.fallback === "fail-run") throw new FailRunError(`the orchestrator budget cap was reached (decision entry ${String(capDecisionRef ?? -1)}) and budget.atCap is 'fail-run': the reserved finalizer is skipped and the run fails instead of returning a partial result`, { data: {
-				source: "orchestrator_budget_cap",
-				capDecisionRef: capDecisionRef ?? -1,
-				spentUsd: capValue.spentUsd ?? 0,
-				capUsd: capValue.capUsd ?? 0
-			} });
-			return await runForcedFinish();
-		};
-		const bootTermination = extensionTermination;
-		if (bootTermination !== void 0) throw bootTermination;
-		if (capDecisionRef !== void 0) return await settleCapOutcome();
-		if (validationSpec !== void 0) {
-			const priorRejection = validationDecisions().find((decision) => decision.verdict === "rejected");
-			if (priorRejection !== void 0) throw finishValidationError(priorRejection);
+			const synthesized = await runtime.runInScope(synthesisState, () => ctx.agent(prompt, synthesisOpts));
+			if (validationTermination !== void 0) throw validationTermination;
+			if (synthesized.status === "ok") return synthesized.output;
+			if (validationSpec !== void 0) throw new FailRunError(`the synthesis invocation terminated with status '${synthesized.status}'` + (synthesized.errorMessage === void 0 ? "" : `: ${synthesized.errorMessage}`) + "; finish validators are configured, so the unvalidated draft cannot stand", { data: {
+				source: "orchestrator_synthesis",
+				status: synthesized.status,
+				turnsUsed: synthesized.turns
+			} });
+			const fallbackKey = deriverV2.deriveKey({ kind: "orchestrator-synthesis-fallback" });
+			if (!internals.replayer.snapshot().some((entry) => entry.kind === "decision" && entry.key === fallbackKey)) await internals.replayer.appendSinglePhase({
+				scope: callingState.scope,
+				key: fallbackKey,
+				kind: "decision",
+				status: "ok",
+				spanId: internals.spans.mint(callingState.spanId),
+				site: "orchestrator-synthesis",
+				value: {
+					decisionType: "orchestrator_synthesis_fallback",
+					status: synthesized.status,
+					turnsUsed: synthesized.turns
+				}
+			});
+			internals.events.emit({
+				type: "log",
+				level: "warn",
+				msg: `the synthesis invocation terminated with status '${synthesized.status}'; falling back to the coordination draft (journaled decision 'orchestrator_synthesis_fallback')`
+			}, callingState.spanId);
+			return draft;
+		};
+		/**
+		* The settle at the cap: the JOURNALED cap decision drives the policy
+		* branch (its `fallback` field froze budget.atCap when the cap
+		* tripped), so a crash between the decision and its effect rolls the
+		* SAME outcome forward on resume, immune to drift of the live options.
+		* 'finish-with-partial' runs the reserved finalizer;
+		* 'fail-run' skips it and fails the run typed (v1.35.0 review P2-1:
+		* the policy used to be journaled and then ignored).
+		*/
+		const settleCapOutcome = async () => {
+			const capValue = internals.replayer.snapshot().find((entry) => entry.seq === capDecisionRef)?.value;
+			if (capValue?.fallback === "fail-run") throw new FailRunError(`the orchestrator budget cap was reached (decision entry ${String(capDecisionRef ?? -1)}) and budget.atCap is 'fail-run': the reserved finalizer is skipped and the run fails instead of returning a partial result`, { data: {
+				source: "orchestrator_budget_cap",
+				capDecisionRef: capDecisionRef ?? -1,
+				spentUsd: capValue.spentUsd ?? 0,
+				capUsd: capValue.capUsd ?? 0
+			} });
+			return await runForcedFinish();
+		};
+		const bootTermination = extensionTermination;
+		if (bootTermination !== void 0) throw bootTermination;
+		if (capDecisionRef !== void 0) return await settleCapOutcome();
+		if (validationSpec !== void 0) {
+			const priorRejection = validationDecisions().find((decision) => decision.verdict === "rejected");
+			if (priorRejection !== void 0) throw finishValidationError(priorRejection);
+		}
+		const promptLines = [
+			...extension?.promptLines?.() ?? [],
+			...finishValidationPromptLines(validationSpec),
+			...acceptancePromptLines(opts?.acceptance)
+		];
+		const result = await runtime.runInScope(orchestratorState, () => ctx.agent(orchestratorPrompt(goal, opts?.maxSpawns, promptLines.length === 0 ? void 0 : promptLines), agentOpts));
+		const liveTermination = extensionTermination;
+		if (liveTermination !== void 0) throw liveTermination;
+		if (capDecisionRef !== void 0) return await settleCapOutcome();
+		if (validationTermination !== void 0) throw validationTermination;
+		if (orchestratorAccount !== void 0) internals.cost.orchestrator.spentUsd = internals.budget.accountView(orchestratorAccount)?.spentUsd ?? 0;
+		if (result.status !== "ok") throw new ConfigError(`the orchestrator agent terminated with status '${result.status}'` + (result.errorMessage === void 0 ? "" : `: ${result.errorMessage}`));
+		if (opts?.acceptance === void 0) return await runSynthesis(result.output);
+		const acceptanceKey = "acceptance";
+		const priorAcceptance = internals.replayer.snapshot().find((entry) => entry.kind === "decision" && entry.scope === callingState.scope && entry.key === acceptanceKey);
+		let decision;
+		if (priorAcceptance !== void 0) decision = priorAcceptance.value;
+		else {
+			const childStatusCounts = {};
+			const degradedReasons = [];
+			const salvaged = [];
+			const salvagedOutput = [];
+			let hardDegraded = 0;
+			const acceptPartial = opts.acceptance.acceptPartialChildren === true;
+			const acceptOutput = opts.acceptance.acceptValidatedTerminalOutputOnLimit === true;
+			const sortedRecords = [...records.values()].sort((a, b) => a.spawnOrdinal - b.spawnOrdinal);
+			for (const record of sortedRecords) {
+				const status = record.settled?.status ?? "running";
+				childStatusCounts[status] = (childStatusCounts[status] ?? 0) + 1;
+				if (status === "ok") continue;
+				if (acceptOutput && status === "limit" && record.settled?.output !== null && record.settled?.output !== void 0) {
+					salvagedOutput.push(record.nodeId);
+					degradedReasons.push(`child ${record.nodeId} accepted with its validated terminal output (settled 'limit' after the finalization reserve summary)`);
+					continue;
+				}
+				if (acceptPartial && status === "limit" && record.settled?.partial !== void 0) {
+					salvaged.push(record.nodeId);
+					degradedReasons.push(`child ${record.nodeId} accepted as partial (settled 'limit' with a structured partial)`);
+					continue;
+				}
+				hardDegraded += 1;
+				degradedReasons.push(status === "running" ? `child ${record.nodeId} was still running when finish validated` : `child ${record.nodeId} settled '${status}'`);
+			}
+			const childPolicy = opts.acceptance.childPolicy;
+			const accepted = childPolicy === "all-ok" ? hardDegraded === 0 : (childStatusCounts.ok ?? 0) + salvaged.length + salvagedOutput.length >= childPolicy.minSuccessful;
+			decision = {
+				decisionType: "orchestrator_acceptance",
+				verdict: accepted ? "accepted" : "rejected",
+				completion: !accepted ? "rejected" : degradedReasons.length === 0 ? "complete" : "partial",
+				childPolicy,
+				childStatusCounts,
+				degradedReasons,
+				...salvaged.length === 0 ? {} : { salvagedPartialChildren: salvaged },
+				...salvagedOutput.length === 0 ? {} : { salvagedTerminalOutputChildren: salvagedOutput }
+			};
+			await internals.replayer.appendSinglePhase({
+				scope: callingState.scope,
+				key: acceptanceKey,
+				kind: "decision",
+				status: "ok",
+				spanId: internals.spans.mint(callingState.spanId),
+				site: "orchestrator-acceptance",
+				value: decision
+			});
+		}
+		if (decision.verdict === "rejected") {
+			const required = decision.childPolicy === "all-ok" ? "every child ok" : `at least ${String(decision.childPolicy.minSuccessful)} children ok`;
+			throw new FailRunError(`the orchestrator acceptance policy rejected the finish: ${String(decision.childStatusCounts.ok ?? 0)} children settled 'ok' but the policy requires ${required}; degraded: ${decision.degradedReasons.join("; ")}`, { data: {
+				source: "orchestrator_acceptance",
+				completion: "rejected",
+				childPolicy: decision.childPolicy,
+				childStatusCounts: decision.childStatusCounts,
+				degradedReasons: decision.degradedReasons,
+				...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
+				...decision.salvagedTerminalOutputChildren === void 0 ? {} : { salvagedTerminalOutputChildren: decision.salvagedTerminalOutputChildren }
+			} });
+		}
+		return {
+			result: await runSynthesis(result.output),
+			completion: decision.completion,
+			childStatusCounts: decision.childStatusCounts,
+			degradedReasons: decision.degradedReasons,
+			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
+			...decision.salvagedTerminalOutputChildren === void 0 ? {} : { salvagedTerminalOutputChildren: decision.salvagedTerminalOutputChildren }
+		};
+	});
+}
+/**
+* Top-level surface: creates a run. `runOptions` are the ordinary
+* engine {@link RunOptions} of the created run; in particular
+* `runOptions.budgetUsd` is the ROOT hard ceiling over the WHOLE tree
+* (the orchestrator and every child), immutable after start, while
+* `opts.budget` only shapes the orchestrator's own sub-account inside
+* that ceiling. The shortcut previously accepted no RunOptions at all,
+* so the canonical entry point could not set a root ceiling without
+* dropping to `engine.run(makeOrchestratorWorkflow(...))` (v1.18.0
+* review P1-5).
+*/
+function orchestrate(engine, goal, opts, runOptions) {
+	return engine.run(makeOrchestratorWorkflow(goal, opts), void 0, runOptions);
+}
+//#endregion
+//#region src/engine/preflight.ts
+const ANY_TOOL = "(any)";
+function resolveServing(spec) {
+	if (spec === void 0) return;
+	if (typeof spec === "string") return spec;
+	if ("model" in spec) return spec.model;
+	return spec.ladder.rungs[spec.ladder.startTier]?.model;
+}
+/**
+* Per-tool executed-call ceilings from the merged limits: for every
+* tool a per-tool cap or a unit cost names (plus the '(any)' tool that
+* nothing names, unit cost 1), the smallest of maxCallsPerTool[T],
+* floor(toolUnits.max / cost(T)) for a positive cost (a zero cost is
+* free), and maxToolCalls.
+*/
+function toolCeilingsOf(limits) {
+	const names = /* @__PURE__ */ new Set();
+	for (const name of Object.keys(limits.maxCallsPerTool ?? {})) names.add(name);
+	for (const name of Object.keys(limits.toolUnits?.costs ?? {})) names.add(name);
+	const rows = [];
+	for (const tool of [...[...names].sort(), ANY_TOOL]) {
+		const terms = [];
+		const cap = tool === ANY_TOOL ? void 0 : limits.maxCallsPerTool?.[tool];
+		if (cap !== void 0) terms.push({
+			boundBy: "maxCallsPerTool",
+			ceiling: cap
+		});
+		if (limits.toolUnits !== void 0) {
+			const cost = tool === ANY_TOOL ? 1 : limits.toolUnits.costs?.[tool] ?? 1;
+			if (cost > 0) terms.push({
+				boundBy: "toolUnits",
+				ceiling: Math.floor(limits.toolUnits.max / cost)
+			});
+		}
+		if (limits.maxToolCalls !== void 0) terms.push({
+			boundBy: "maxToolCalls",
+			ceiling: limits.maxToolCalls
+		});
+		if (terms.length === 0) {
+			rows.push({
+				tool,
+				ceiling: null
+			});
+			continue;
+		}
+		const min = terms.reduce((best, term) => term.ceiling < best.ceiling ? term : best);
+		rows.push({
+			tool,
+			ceiling: min.ceiling,
+			boundBy: min.boundBy
+		});
+	}
+	return rows;
+}
+function validateSpawnSpec(spec, index) {
+	const site = `preflight.spawns[${index}]`;
+	if (spec.limits !== void 0) validateUsageLimits(spec.limits, `${site}.limits`);
+	if (spec.estCost !== void 0) requireNonNegativeNumber(spec.estCost, `${site}.estCost`);
+	if (spec.estInputTokens !== void 0) requireNonNegativeInteger(spec.estInputTokens, `${site}.estInputTokens`);
+	if (spec.count !== void 0) requirePositiveInteger(spec.count, `${site}.count`);
+	if (spec.budgetUsd !== void 0) requireNonNegativeNumber(spec.budgetUsd, `${site}.budgetUsd`);
+}
+/**
+* Computes the preflight report: the effective merged limits per
+* declared spawn, the layer-1 admission projection over the declared
+* wave, the per-tool and weighted-unit bottleneck ordering, the
+* concurrency and quota exposure at the declared estimates, and the
+* linter findings. Pure: no engine is constructed, no store is opened,
+* no adapter stream is dispatched, and no journal entry is written.
+*/
+function preflightEstimate(input) {
+	const engine = input.engine ?? {};
+	const defaults = engine.defaults ?? {};
+	if (defaults.limits !== void 0) validateUsageLimits(defaults.limits, "preflight.engine.defaults.limits");
+	if (input.run?.limits !== void 0) validateUsageLimits(input.run.limits, "preflight.run.limits");
+	if (input.orchestrator?.limits !== void 0) validateUsageLimits(input.orchestrator.limits, "preflight.orchestrator.limits");
+	const findings = [];
+	const say = (finding) => {
+		findings.push(finding);
+	};
+	const adapters = new Map((engine.adapters ?? []).map((adapter) => [adapter.id, adapter]));
+	const capsOf = (ref) => {
+		const { adapterId, model } = parseModelRef(ref);
+		return adapters.get(adapterId)?.caps(model);
+	};
+	const pricingOf = (ref) => resolvePricing(ref, engine.pricing, capsOf(ref)?.pricing);
+	const ceilingUsd = input.run?.budgetUsd;
+	const flatReserveUsd = engine.budgetDefaults?.flatReserveUsd ?? .5;
+	const lifetimeSpawnCap = engine.budgetDefaults?.lifetimeSpawnCap ?? 500;
+	const childBudgetFraction = engine.budgetDefaults?.childBudgetFraction ?? .3;
+	const maxDepth = engine.budgetDefaults?.maxDepth ?? 1;
+	const perRun = engine.concurrency?.perRun ?? 12;
+	const runLimits = mergeUsageLimits(void 0, input.run?.limits, defaults.limits);
+	let orchestratorEcho;
+	let reservedForFinalizationUsd = 0;
+	let effectiveCapUsd;
+	if (input.orchestrator !== void 0) {
+		if (input.orchestrator.estInputTokens !== void 0) requireNonNegativeInteger(input.orchestrator.estInputTokens, "preflight.orchestrator.estInputTokens");
+		const spec = input.orchestrator.budget;
+		const fraction = spec?.capFraction ?? .2;
+		const fromFraction = ceilingUsd === void 0 ? void 0 : fraction * ceilingUsd;
+		const bounds = [spec?.capUsd, fromFraction].filter((bound) => bound !== void 0);
+		effectiveCapUsd = bounds.length === 0 ? void 0 : Math.min(...bounds);
+		const finalizeTurns = spec?.finalizeTurns ?? 2;
+		const finalizeReserveUsd = spec?.finalizeReserveUsd ?? finalizeTurns * flatReserveUsd;
+		const reserveCommitted = input.orchestrator.extension === true;
+		if (reserveCommitted) reservedForFinalizationUsd = finalizeReserveUsd;
+		orchestratorEcho = {
+			...effectiveCapUsd === void 0 ? {} : { effectiveCapUsd },
+			finalizeReserveUsd,
+			finalizeTurns,
+			reserveCommitted
+		};
+		if (spec?.capUsd !== void 0 && spec.capFraction === void 0 && effectiveCapUsd !== void 0 && effectiveCapUsd < spec.capUsd) say({
+			severity: "warning",
+			code: "orchestrator-cap-fraction-bound",
+			message: `orchestrator budget.capUsd ${spec.capUsd.toFixed(4)} USD is bounded to ${effectiveCapUsd.toFixed(4)} USD by the default capFraction 0.2 of the run ceiling; pass capFraction: 1.0 to make capUsd the sole bound`
+		});
+		if (input.orchestrator.extension === true && effectiveCapUsd !== void 0 && effectiveCapUsd < finalizeReserveUsd) say({
+			severity: "error",
+			code: "orchestrator-cap-below-finalize-reserve",
+			message: `effectiveCap ${effectiveCapUsd.toFixed(4)} USD is below the finalize reserve ${finalizeReserveUsd.toFixed(4)} USD: the run would refuse to start`
+		});
+	}
+	const spawnSpecs = input.spawns ?? [];
+	spawnSpecs.forEach(validateSpawnSpec);
+	const spawnReports = [];
+	/**
+	* The layer-2 spawn-gate inputs per report, in report order: the
+	* DECLARED estimate (estCost or the profile's; never the priced
+	* arm, which the embedded gate cannot reach) and the explicit spawn
+	* budget. Only an orchestrate wave consumes them.
+	*/
+	const waveGateInputs = [];
+	const units = [];
+	for (const spec of spawnSpecs) {
+		const role = spec.role ?? "loop";
+		const label = spec.label ?? role;
+		const count = spec.count ?? 1;
+		const profile = spec.profile === void 0 ? void 0 : defaults.profiles?.[spec.profile];
+		if (spec.profile !== void 0 && profile === void 0) say({
+			severity: "error",
+			code: "unknown-profile",
+			message: `spawn '${label}' names profile '${spec.profile}', which defaults.profiles does not register`,
+			spawn: label
+		});
+		const limits = mergeUsageLimits(spec.limits, profile?.limits, defaults.limits);
+		const servedBy = resolveServing(spec.model ?? profile?.routing?.[role] ?? profile?.model ?? defaults.routing?.[role]);
+		if (servedBy === void 0) say({
+			severity: "error",
+			code: "unrouted-role",
+			message: `spawn '${label}' resolves no model for role '${role}': the run would fail with a ConfigError at spawn time; set a model, a profile model, or defaults.routing.${role}`,
+			spawn: label
+		});
+		const caps = servedBy === void 0 ? void 0 : capsOf(servedBy);
+		const pricing = servedBy === void 0 ? void 0 : pricingOf(servedBy);
+		const unpriced = servedBy !== void 0 && pricing === void 0;
+		let reserveSource;
+		let reserveUsd;
+		if (unpriced && spec.estCost === void 0 && profile?.estCost === void 0) {
+			reserveSource = "unpriced-zero";
+			reserveUsd = 0;
+		} else {
+			reserveSource = spec.estCost !== void 0 ? "estCost" : profile?.estCost !== void 0 ? "profile-estCost" : spec.estInputTokens !== void 0 && caps?.pricing !== void 0 ? "priced-estimate" : "flat-default";
+			reserveUsd = admissionReserveUsd({
+				...spec.estCost === void 0 ? {} : { estCost: spec.estCost },
+				...profile?.estCost === void 0 ? {} : { profileEstCost: profile.estCost },
+				...spec.estInputTokens === void 0 ? {} : { inputTokens: spec.estInputTokens },
+				...caps === void 0 ? {} : { caps },
+				...limits.maxOutputTokensPerTurn === void 0 ? {} : { maxOutputTokensPerTurn: limits.maxOutputTokensPerTurn },
+				flatReserveUsd
+			});
+		}
+		const outputBound = caps === void 0 ? limits.maxOutputTokensPerTurn : limits.maxOutputTokensPerTurn === void 0 ? caps.maxOutputTokens : Math.min(caps.maxOutputTokens, limits.maxOutputTokensPerTurn);
+		if (caps !== void 0 && limits.maxOutputTokensPerTurn !== void 0 && limits.maxOutputTokensPerTurn > caps.maxOutputTokens) say({
+			severity: "warning",
+			code: "output-cap-above-model",
+			message: `spawn '${label}' sets maxOutputTokensPerTurn ${String(limits.maxOutputTokensPerTurn)} above the model's maxOutputTokens ${String(caps.maxOutputTokens)}: the model clamp wins`,
+			spawn: label
+		});
+		const turnFloorUsd = pricing === void 0 || outputBound === void 0 ? void 0 : priceUsdOf(pricing, {
+			inputTokens: spec.estInputTokens ?? 0,
+			outputTokens: outputBound,
+			cacheReadTokens: 0,
+			cacheWriteTokens: 0
+		});
+		const toolCeilings = toolCeilingsOf(limits);
+		const overall = toolCeilings.reduce((best, row) => row.ceiling === null ? best : best === null ? row.ceiling : Math.max(best, row.ceiling), null);
+		const executedToolCallCeiling = limits.maxToolCalls !== void 0 && (overall === null || limits.maxToolCalls < overall) ? limits.maxToolCalls : overall;
+		for (const row of toolCeilings) {
+			if (row.tool === ANY_TOOL) continue;
+			const cost = limits.toolUnits?.costs?.[row.tool];
+			if (cost !== void 0 && cost > 0 && limits.toolUnits !== void 0 && cost > limits.toolUnits.max) {
+				say({
+					severity: "warning",
+					code: "tool-unaffordable",
+					message: `spawn '${label}' prices tool '${row.tool}' at ${String(cost)} units against toolUnits.max ${String(limits.toolUnits.max)}: the tool can never execute`,
+					spawn: label
+				});
+				continue;
+			}
+			if (row.boundBy === "toolUnits" && row.ceiling !== null) {
+				const nominal = limits.maxToolCalls;
+				const cap = limits.maxCallsPerTool?.[row.tool];
+				if (nominal !== void 0 && row.ceiling < nominal || cap !== void 0 && row.ceiling < cap) say({
+					severity: "warning",
+					code: "weighted-units-bind-first",
+					message: `spawn '${label}': toolUnits is the first bottleneck for '${row.tool}': ${String(row.ceiling)} executed calls (cost ${String(limits.toolUnits?.costs?.[row.tool] ?? 1)} of max ${String(limits.toolUnits?.max ?? 0)})` + (nominal === void 0 ? "" : ` while maxToolCalls suggests ${String(nominal)}`),
+					spawn: label
+				});
+			}
+			const cap = limits.maxCallsPerTool?.[row.tool];
+			if (cap !== void 0 && cap > 0 && row.ceiling !== null && row.boundBy !== "maxCallsPerTool") say({
+				severity: "info",
+				code: "per-tool-cap-unreachable",
+				message: `spawn '${label}': maxCallsPerTool['${row.tool}'] ${String(cap)} can never bind: ${row.boundBy ?? "another limiter"} already stops at ${String(row.ceiling)}`,
+				spawn: label
+			});
+		}
+		if (limits.finalizationReserve !== void 0 && limits.maxToolCalls === void 0 && limits.toolUnits === void 0) say({
+			severity: "warning",
+			code: "inert-finalization-reserve",
+			message: `spawn '${label}' sets finalizationReserve without maxToolCalls or toolUnits: no tool budget limiter exists for it to fire on`,
+			spawn: label
+		});
+		if (limits.toolBudgetNotices === true && limits.maxToolCalls === void 0) say({
+			severity: "warning",
+			code: "inert-tool-budget-notices",
+			message: `spawn '${label}' sets toolBudgetNotices without maxToolCalls: the notices never fire`,
+			spawn: label
+		});
+		if (unpriced && ceilingUsd !== void 0) say({
+			severity: "warning",
+			code: "unpriced-under-ceiling",
+			message: `spawn '${label}' is served by '${servedBy ?? ""}' with no price row: the ${ceilingUsd.toFixed(4)} USD run ceiling does NOT bound it and its admission reserve is zero`,
+			spawn: label
+		});
+		spawnReports.push({
+			label,
+			role,
+			count,
+			...servedBy === void 0 ? {} : { servedBy },
+			...unpriced ? { unpriced: true } : {},
+			limits,
+			admissionReserveUsd: reserveUsd,
+			reserveSource,
+			...outputBound === void 0 ? {} : { maxOutputTokensPerTurn: outputBound },
+			...turnFloorUsd === void 0 ? {} : { turnFloorUsd },
+			executedToolCallCeiling,
+			toolCeilings
+		});
+		{
+			const declaredEstCostUsd = spec.estCost ?? profile?.estCost;
+			waveGateInputs.push({
+				...declaredEstCostUsd === void 0 ? {} : { estCostUsd: declaredEstCostUsd },
+				...spec.budgetUsd === void 0 ? {} : { budgetUsd: spec.budgetUsd }
+			});
+		}
+		for (let i = 0; i < count; i += 1) {
+			const unit = {
+				label: count === 1 ? label : `${label}#${String(i + 1)}`,
+				tokensFloor: (spec.estInputTokens ?? 0) + (outputBound ?? 0)
+			};
+			if (servedBy !== void 0) {
+				const { adapterId, model } = parseModelRef(servedBy);
+				unit.provider = adapterId;
+				unit.model = model;
+			}
+			if (turnFloorUsd !== void 0) unit.turnFloorUsd = turnFloorUsd;
+			units.push(unit);
+		}
+	}
+	let orchestratorReserveUsd;
+	if (input.orchestrator !== void 0) {
+		const servedBy = resolveServing(defaults.routing?.orchestrate);
+		if (servedBy === void 0) say({
+			severity: "error",
+			code: "unrouted-role",
+			message: "the orchestrator resolves no model for role 'orchestrate': set defaults.routing.orchestrate or an orchestrate model on the call",
+			spawn: "orchestrator"
+		});
+		else {
+			const caps = capsOf(servedBy);
+			const pricing = pricingOf(servedBy);
+			const orchLimits = mergeUsageLimits(input.orchestrator.limits, void 0, defaults.limits);
+			const outputBound = caps === void 0 ? orchLimits.maxOutputTokensPerTurn : orchLimits.maxOutputTokensPerTurn === void 0 ? caps.maxOutputTokens : Math.min(caps.maxOutputTokens, orchLimits.maxOutputTokensPerTurn);
+			const { adapterId, model } = parseModelRef(servedBy);
+			const unit = {
+				label: "orchestrator",
+				provider: adapterId,
+				model,
+				tokensFloor: outputBound ?? 0
+			};
+			if (pricing !== void 0 && outputBound !== void 0) unit.turnFloorUsd = priceUsdOf(pricing, {
+				inputTokens: 0,
+				outputTokens: outputBound,
+				cacheReadTokens: 0,
+				cacheWriteTokens: 0
+			});
+			units.push(unit);
+			if (effectiveCapUsd !== void 0) orchestratorReserveUsd = Math.max(0, orchestratorAdmissionEstCostUsd(effectiveCapUsd, reservedForFinalizationUsd));
+			else if (pricing === void 0) orchestratorReserveUsd = 0;
+			else orchestratorReserveUsd = admissionReserveUsd({
+				...input.orchestrator.estInputTokens === void 0 ? {} : { inputTokens: input.orchestrator.estInputTokens },
+				...caps === void 0 ? {} : { caps },
+				...orchLimits.maxOutputTokensPerTurn === void 0 ? {} : { maxOutputTokensPerTurn: orchLimits.maxOutputTokensPerTurn },
+				flatReserveUsd
+			});
+		}
+	}
+	const wave = [];
+	let committed = 0;
+	let spawned = 0;
+	let children = 0;
+	const admitAgainstRoot = (reserveUsd) => {
+		if (ceilingUsd === void 0) return true;
+		const held = committed + reservedForFinalizationUsd;
+		return !(held >= ceilingUsd || held + reserveUsd > ceilingUsd);
+	};
+	if (input.orchestrator !== void 0) {
+		const reserveUsd = orchestratorReserveUsd ?? flatReserveUsd;
+		let deniedBy;
+		if (spawned >= lifetimeSpawnCap) deniedBy = "spawn-cap";
+		else if (!admitAgainstRoot(reserveUsd)) deniedBy = "budget";
+		wave.push({
+			label: "orchestrator",
+			reserveUsd,
+			admitted: deniedBy === void 0,
+			...deniedBy === void 0 ? {} : { deniedBy }
+		});
+		if (deniedBy === void 0) {
+			committed += reserveUsd;
+			spawned += 1;
+		}
+	}
+	const maxSpawns = input.orchestrator?.maxSpawns;
+	const orchestrateWave = input.orchestrator !== void 0;
+	for (const [reportIndex, report] of spawnReports.entries()) {
+		const gate = waveGateInputs[reportIndex] ?? {};
+		for (let i = 0; i < report.count; i += 1) {
+			const label = report.count === 1 ? report.label : `${report.label}#${String(i + 1)}`;
+			const reserveUsd = report.admissionReserveUsd;
+			let deniedBy;
+			if (spawned >= lifetimeSpawnCap) deniedBy = "spawn-cap";
+			else if (maxSpawns !== void 0 && children >= maxSpawns) deniedBy = "orchestrator-max-spawns";
+			else {
+				if (orchestrateWave && ceilingUsd !== void 0) {
+					const remainder = ceilingUsd - committed - reservedForFinalizationUsd;
+					const projection = dispatchProjectionReserveUsd(gate, flatReserveUsd);
+					if (remainder <= 0 || remainder < projection) deniedBy = "budget";
+				}
+				if (deniedBy === void 0 && !admitAgainstRoot(reserveUsd)) deniedBy = "budget";
+			}
+			wave.push({
+				label,
+				reserveUsd,
+				admitted: deniedBy === void 0,
+				...deniedBy === void 0 ? {} : { deniedBy }
+			});
+			if (deniedBy === void 0) {
+				committed += reserveUsd;
+				spawned += 1;
+				children += 1;
+			}
+		}
+	}
+	const admitted = wave.filter((row) => row.admitted).length;
+	const denied = wave.length - admitted;
+	if (wave.length > 0 && denied > 0) {
+		const deniedLabels = wave.filter((row) => !row.admitted).map((row) => row.label);
+		if (admitted === 0) say({
+			severity: "error",
+			code: "nothing-admitted",
+			message: `the declared wave admits NOTHING: every spawn is denied (${deniedLabels.join(", ")}); no paid work can start`
+		});
+		else say({
+			severity: "warning",
+			code: "partial-admission",
+			message: `the declared wave admits ${String(admitted)} of ${String(wave.length)} spawns; denied before any work: ${deniedLabels.join(", ")}`
+		});
+	}
+	if (ceilingUsd === void 0 && wave.length > 0) say({
+		severity: "info",
+		code: "no-usd-ceiling",
+		message: "the run has no budgetUsd ceiling: only turn, tool, and time limits bound spend, and the whole declared wave admits"
+	});
+	const declaredUnits = units.length;
+	const maxInFlight = declaredUnits === 0 ? perRun : Math.min(perRun, declaredUnits);
+	const perProviderCaps = engine.concurrency?.perProvider;
+	const perProvider = {};
+	const byProvider = /* @__PURE__ */ new Map();
+	for (const unit of units) {
+		if (unit.provider === void 0) continue;
+		const list = byProvider.get(unit.provider) ?? [];
+		list.push(unit);
+		byProvider.set(unit.provider, list);
+	}
+	for (const [provider, list] of [...byProvider.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+		const cap = perProviderCaps?.[provider];
+		const inFlight = Math.min(list.length, maxInFlight, cap ?? Number.POSITIVE_INFINITY);
+		perProvider[provider] = {
+			inFlight,
+			requestsPerWave: inFlight,
+			tokensPerWaveFloor: [...list].sort((a, b) => b.tokensFloor - a.tokensFloor).slice(0, inFlight).reduce((sum, unit) => sum + unit.tokensFloor, 0)
+		};
+	}
+	const pricedTurns = units.map((unit) => unit.turnFloorUsd).filter((usd) => usd !== void 0).sort((a, b) => b - a).slice(0, maxInFlight);
+	const overshootOneTurnFloorUsd = pricedTurns.length === 0 ? void 0 : pricedTurns.reduce((sum, usd) => sum + usd, 0);
+	if (ceilingUsd !== void 0 && overshootOneTurnFloorUsd !== void 0 && units.length > 0) say({
+		severity: "info",
+		code: "overshoot-exposure",
+		message: `past a ceiling crossing, up to ${String(Math.min(maxInFlight, units.length))} in-flight turns may still complete: at least ${overshootOneTurnFloorUsd.toFixed(4)} USD past the ${ceilingUsd.toFixed(4)} USD ceiling at the declared estimates, growing with prompt size`
+	});
+	const quotaConfigured = engine.quota !== void 0;
+	if (!quotaConfigured && maxInFlight > 1 && units.length > 0) say({
+		severity: "info",
+		code: "no-quota",
+		message: `no shared quota limiter is configured while up to ${String(maxInFlight)} turns run concurrently: provider-side rate limits are unprotected (createEngine quota)`
+	});
+	if (input.quotaRules !== void 0) input.quotaRules.forEach((rule, index) => {
+		let requests = 0;
+		let tokens = 0;
+		for (const unit of units) {
+			if (unit.provider === void 0 || unit.model === void 0) continue;
+			if (quotaRuleMatches(rule, {
+				provider: unit.provider,
+				model: unit.model,
+				...engine.quota?.tenant === void 0 ? {} : { tenant: engine.quota.tenant },
+				estimate: {
+					requests: 1,
+					inputTokens: 0
+				}
+			})) {
+				requests += 1;
+				tokens += unit.tokensFloor;
+			}
+		}
+		const dims = [
+			rule.provider === void 0 ? void 0 : `provider=${rule.provider}`,
+			rule.model === void 0 ? void 0 : `model=${rule.model}`,
+			rule.tenant === void 0 ? void 0 : `tenant=${rule.tenant}`
+		].filter((dim) => dim !== void 0).join(" ");
+		const name = dims === "" ? `rule[${String(index)}]` : `rule[${String(index)}] (${dims})`;
+		if (rule.requestsPerMinute !== void 0 && requests > rule.requestsPerMinute) say({
+			severity: "warning",
+			code: "quota-requests-below-wave",
+			message: `${name}: the declared wave holds ${String(requests)} matching dispatches against requestsPerMinute ${String(rule.requestsPerMinute)}: expect synthetic rate-limit denials and backoff inside one window`
+		});
+		if (rule.tokensPerMinute !== void 0 && tokens > rule.tokensPerMinute) say({
+			severity: "warning",
+			code: "quota-tokens-below-wave",
+			message: `${name}: the declared wave demands at least ${String(tokens)} tokens against tokensPerMinute ${String(rule.tokensPerMinute)}: expect estimate-driven throttling inside one window`
+		});
+	});
+	const severityRank = {
+		error: 0,
+		warning: 1,
+		info: 2
+	};
+	findings.sort((a, b) => severityRank[a.severity] - severityRank[b.severity]);
+	return {
+		concurrency: {
+			perRun,
+			...perProviderCaps === void 0 ? {} : { perProvider: { ...perProviderCaps } }
+		},
+		budget: {
+			...ceilingUsd === void 0 ? {} : { ceilingUsd },
+			flatReserveUsd,
+			lifetimeSpawnCap,
+			childBudgetFraction,
+			maxDepth,
+			...orchestratorEcho === void 0 ? {} : { orchestrator: orchestratorEcho }
+		},
+		quota: {
+			configured: quotaConfigured,
+			...engine.quota?.tenant === void 0 ? {} : { tenant: engine.quota.tenant },
+			...input.quotaRules === void 0 ? {} : { rules: input.quotaRules.length }
+		},
+		runLimits,
+		spawns: spawnReports,
+		admission: {
+			...ceilingUsd === void 0 ? {} : { ceilingUsd },
+			reservedForFinalizationUsd,
+			wave,
+			admitted,
+			denied
+		},
+		exposure: {
+			maxInFlight,
+			...overshootOneTurnFloorUsd === void 0 ? {} : { overshootOneTurnFloorUsd },
+			perProvider
+		},
+		findings
+	};
+}
+//#endregion
+//#region src/engine/run-profiles.ts
+/**
+* The shipped presets (fast / standard / deep / ultra "and similar").
+* Data only; a review-time assertion checks the
+* engine has zero behavioral branches keyed on these names.
+*/
+const RUN_PROFILES = {
+	fast: {
+		effortByRole: {
+			orchestrate: "low",
+			plan: "low",
+			summarize: "low",
+			extract: "low"
+		},
+		perRunConcurrency: 16,
+		permissionPreset: "standard",
+		lifetimeSpawnCap: 64,
+		maxDepth: 1
+	},
+	standard: {
+		effortByRole: {
+			orchestrate: "high",
+			plan: "high",
+			summarize: "low",
+			extract: "low"
+		},
+		perRunConcurrency: 12,
+		permissionPreset: "standard",
+		lifetimeSpawnCap: 500,
+		maxDepth: 1
+	},
+	deep: {
+		effortByRole: {
+			orchestrate: "high",
+			plan: "high",
+			summarize: "medium",
+			extract: "medium"
+		},
+		perRunConcurrency: 8,
+		permissionPreset: "standard",
+		lifetimeSpawnCap: 500,
+		maxDepth: 2
+	},
+	ultra: {
+		effortByRole: {
+			orchestrate: "max",
+			plan: "max",
+			summarize: "high",
+			extract: "high"
+		},
+		perRunConcurrency: 8,
+		permissionPreset: "strict",
+		lifetimeSpawnCap: 500,
+		maxDepth: 3
+	}
+};
+/** Looks up a shipped RunProfile by name; undefined for unknown names. */
+function runProfile(name) {
+	return RUN_PROFILES[name];
+}
+//#endregion
+//#region src/model/concurrency.ts
+/**
+* Per-provider concurrency keys (M4-T07): a keyed limiter beside the
+* router, ENGINE-scoped (keys constrain calls
+* across a single engine per adapter). The Appendix A default is
+* unlimited: an embeddable library must not surprise-throttle hosts, so
+* the per-run semaphore stays the only default bound and provider 429s
+* ride RetryPolicy; hosts with known tier limits opt in per adapter id
+* via createEngine concurrency.perProvider.
+*
+* This keyed limiter bounds PARALLELISM inside one engine only. Two
+* processes sharing one API key coordinate through the QuotaLimiter
+* SPI instead (RV-215, createEngine `quota`): rate and volume live
+* there, in shared storage; in-flight slots live here.
+*/
+var KeyedLimiter = class {
+	semaphores = /* @__PURE__ */ new Map();
+	constructor(caps) {
+		for (const [key, limit] of Object.entries(caps ?? {})) this.semaphores.set(key, new Semaphore(limit));
+	}
+	/** Queue depth for one key (0 for unlimited keys); telemetry only. */
+	pending(key) {
+		return this.semaphores.get(key)?.pending ?? 0;
+	}
+	/**
+	* Runs `fn` under the key's semaphore; keys without a configured cap
+	* run unlimited (no queueing, no overhead). An aborted `signal` frees
+	* a queued caller without a slot (the Semaphore contract), so run
+	* cancellation drains provider queues too (v1.34.0 review P2-4).
+	*/
+	async withSlot(key, fn, onQueued, signal) {
+		const semaphore = this.semaphores.get(key);
+		if (semaphore === void 0) return fn();
+		return semaphore.withSlot(fn, onQueued, signal);
+	}
+};
+//#endregion
+//#region src/orchestrator/finish-validators.ts
+/**
+* Deterministic host validation of the orchestrator finish result (the
+* v1.40.0 improvement plan's RV-204 slice). A validator is plain
+* synchronous host code judging the finish({ result }) argument; the
+* orchestrator runtime runs the configured set on every schema valid
+* finish call, returns the failure reasons to the model as the call's
+* error tool result (a bounded repair turn), and fails the run with a
+* typed error when the repair bound is exhausted. Verdicts journal as
+* decision entries, so a resume rolls the SAME verdicts forward without
+* re-running validator code.
+*/
+const ok = { ok: true };
+function requireNonEmptyStrings(values, what) {
+	if (!Array.isArray(values) || values.length === 0) throw new ConfigError(`${what} must be a non empty array of strings`);
+	for (const value of values) if (typeof value !== "string" || value.length === 0) throw new ConfigError(`${what} must contain only non empty strings`);
+	return values;
+}
+/**
+* Requires every named section to appear LITERALLY in the result text
+* (a heading like 'FINDINGS' or any marker the goal demands). Default
+* name 'required-sections'; pass `name` to run several instances.
+*/
+function requiredSectionsValidator(options) {
+	const sections = requireNonEmptyStrings(options.sections, "requiredSectionsValidator sections");
+	return {
+		name: options.name ?? "required-sections",
+		validate: (input) => {
+			const missing = sections.filter((section) => !input.text.includes(section));
+			return missing.length === 0 ? ok : {
+				ok: false,
+				reasons: missing.map((section) => `required section '${section}' is missing`)
+			};
 		}
-		const promptLines = [
-			...extension?.promptLines?.() ?? [],
-			...finishValidationPromptLines(validationSpec),
-			...acceptancePromptLines(opts?.acceptance)
-		];
-		const result = await runtime.runInScope(orchestratorState, () => ctx.agent(orchestratorPrompt(goal, opts?.maxSpawns, promptLines.length === 0 ? void 0 : promptLines), agentOpts));
-		const liveTermination = extensionTermination;
-		if (liveTermination !== void 0) throw liveTermination;
-		if (capDecisionRef !== void 0) return await settleCapOutcome();
-		if (validationTermination !== void 0) throw validationTermination;
-		if (orchestratorAccount !== void 0) internals.cost.orchestrator.spentUsd = internals.budget.accountView(orchestratorAccount)?.spentUsd ?? 0;
-		if (result.status !== "ok") throw new ConfigError(`the orchestrator agent terminated with status '${result.status}'` + (result.errorMessage === void 0 ? "" : `: ${result.errorMessage}`));
-		if (opts?.acceptance === void 0) return await runSynthesis(result.output);
-		const acceptanceKey = "acceptance";
-		const priorAcceptance = internals.replayer.snapshot().find((entry) => entry.kind === "decision" && entry.scope === callingState.scope && entry.key === acceptanceKey);
-		let decision;
-		if (priorAcceptance !== void 0) decision = priorAcceptance.value;
-		else {
-			const childStatusCounts = {};
-			const degradedReasons = [];
-			const salvaged = [];
-			let hardDegraded = 0;
-			const acceptPartial = opts.acceptance.acceptPartialChildren === true;
-			const sortedRecords = [...records.values()].sort((a, b) => a.spawnOrdinal - b.spawnOrdinal);
-			for (const record of sortedRecords) {
-				const status = record.settled?.status ?? "running";
-				childStatusCounts[status] = (childStatusCounts[status] ?? 0) + 1;
-				if (status === "ok") continue;
-				if (acceptPartial && status === "limit" && record.settled?.partial !== void 0) {
-					salvaged.push(record.nodeId);
-					degradedReasons.push(`child ${record.nodeId} accepted as partial (settled 'limit' with a structured partial)`);
-					continue;
-				}
-				hardDegraded += 1;
-				degradedReasons.push(status === "running" ? `child ${record.nodeId} was still running when finish validated` : `child ${record.nodeId} settled '${status}'`);
+	};
+}
+/**
+* Requires the result to be a JSON object carrying every named field
+* with a substantial value: present, not null, and not an empty or
+* whitespace only string (empty arrays, zero, and false COUNT as
+* present; emptiness rules beyond strings belong to a custom
+* validator). Default name 'required-fields'.
+*/
+function requiredFieldsValidator(options) {
+	const fields = requireNonEmptyStrings(options.fields, "requiredFieldsValidator fields");
+	return {
+		name: options.name ?? "required-fields",
+		validate: (input) => {
+			const result = input.result;
+			if (typeof result !== "object" || result === null || Array.isArray(result)) return {
+				ok: false,
+				reasons: ["the finish result is not a JSON object"]
+			};
+			const record = result;
+			const reasons = [];
+			for (const field of fields) {
+				const value = record[field];
+				if (value === void 0 || value === null) reasons.push(`required field '${field}' is missing`);
+				else if (typeof value === "string" && value.trim().length === 0) reasons.push(`required field '${field}' is empty`);
 			}
-			const childPolicy = opts.acceptance.childPolicy;
-			const accepted = childPolicy === "all-ok" ? hardDegraded === 0 : (childStatusCounts.ok ?? 0) + salvaged.length >= childPolicy.minSuccessful;
-			decision = {
-				decisionType: "orchestrator_acceptance",
-				verdict: accepted ? "accepted" : "rejected",
-				completion: !accepted ? "rejected" : degradedReasons.length === 0 ? "complete" : "partial",
-				childPolicy,
-				childStatusCounts,
-				degradedReasons,
-				...salvaged.length === 0 ? {} : { salvagedPartialChildren: salvaged }
+			return reasons.length === 0 ? ok : {
+				ok: false,
+				reasons
 			};
-			await internals.replayer.appendSinglePhase({
-				scope: callingState.scope,
-				key: acceptanceKey,
-				kind: "decision",
-				status: "ok",
-				spanId: internals.spans.mint(callingState.spanId),
-				site: "orchestrator-acceptance",
-				value: decision
-			});
 		}
-		if (decision.verdict === "rejected") {
-			const required = decision.childPolicy === "all-ok" ? "every child ok" : `at least ${String(decision.childPolicy.minSuccessful)} children ok`;
-			throw new FailRunError(`the orchestrator acceptance policy rejected the finish: ${String(decision.childStatusCounts.ok ?? 0)} children settled 'ok' but the policy requires ${required}; degraded: ${decision.degradedReasons.join("; ")}`, { data: {
-				source: "orchestrator_acceptance",
-				completion: "rejected",
-				childPolicy: decision.childPolicy,
-				childStatusCounts: decision.childStatusCounts,
-				degradedReasons: decision.degradedReasons,
-				...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren }
-			} });
+	};
+}
+/** The default citation shape: a path with an extension, a colon, a line number. */
+const DEFAULT_CITATION_PATTERN = "[\\w./-]+\\.\\w+:\\d+";
+/** The default preserved share, the improvement plan's RV-202 gate. */
+const DEFAULT_EVIDENCE_MIN_SHARE = .95;
+const MAX_LISTED_CITATIONS = 20;
+function listCitations(values) {
+	return values.length <= MAX_LISTED_CITATIONS ? values.join(", ") : `${values.slice(0, MAX_LISTED_CITATIONS).join(", ")} and ${String(values.length - MAX_LISTED_CITATIONS)} more`;
+}
+/**
+* The RV-202 evidence preservation contract: the finish result must
+* PRESERVE the citations the children actually produced. Distinct
+* matches of `pattern` are collected across the outputs of children
+* settled 'ok' (spawn order); at least `minShare` of them (default
+* {@link DEFAULT_EVIDENCE_MIN_SHARE}, the plan's 95 percent gate,
+* compared as a ceiling on the required count so an exact boundary like
+* 19 of 20 passes) must appear literally in the result text. Zero child
+* citations pass vacuously. With `requireKnown: true` the contract also
+* runs in reverse: every citation in the RESULT must appear in some
+* child's output, so a fabricated but pattern valid citation is
+* rejected instead of silently counting as evidence. Rejection reasons
+* list the missing (and unknown) citations, capped at 20, so the repair
+* turn can restore them. Purely textual and deterministic; checking
+* that cited targets EXIST on disk is host territory (a custom
+* validator), not this contract. Default name 'evidence-preserved'.
+*/
+function evidencePreservedValidator(options) {
+	const pattern = options?.pattern ?? "[\\w./-]+\\.\\w+:\\d+";
+	const flags = options?.flags ?? "";
+	const globalFlags = flags.includes("g") ? flags : `${flags}g`;
+	try {
+		new RegExp(pattern, globalFlags);
+	} catch (thrown) {
+		throw new ConfigError(`evidencePreservedValidator pattern does not compile: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
+	}
+	const minShare = options?.minShare ?? .95;
+	if (typeof minShare !== "number" || !Number.isFinite(minShare) || minShare <= 0 || minShare > 1) throw new ConfigError(`evidencePreservedValidator minShare must be a number in (0, 1]; got ${String(minShare)}`);
+	return {
+		name: options?.name ?? "evidence-preserved",
+		validate: (input) => {
+			const cited = /* @__PURE__ */ new Set();
+			for (const child of input.children ?? []) {
+				if (child.status !== "ok" && child.salvageableOutput !== true) continue;
+				for (const match of child.text.match(new RegExp(pattern, globalFlags)) ?? []) cited.add(match);
+			}
+			const reasons = [];
+			if (cited.size > 0) {
+				const missing = [...cited].filter((citation) => !input.text.includes(citation));
+				const preserved = cited.size - missing.length;
+				if (preserved < Math.ceil(minShare * cited.size - 1e-9)) reasons.push(`evidence preservation ${String(preserved)} of ${String(cited.size)} child citations is below the required share ${String(minShare)}; missing: ${listCitations(missing)}`);
+			}
+			if (options?.requireKnown === true) {
+				const fabricated = [...new Set(input.text.match(new RegExp(pattern, globalFlags)) ?? [])].filter((citation) => !cited.has(citation));
+				if (fabricated.length > 0) reasons.push(`unknown citations not present in any child report: ${listCitations(fabricated)}`);
+			}
+			return reasons.length === 0 ? ok : {
+				ok: false,
+				reasons
+			};
 		}
-		return {
-			result: await runSynthesis(result.output),
-			completion: decision.completion,
-			childStatusCounts: decision.childStatusCounts,
-			degradedReasons: decision.degradedReasons,
-			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren }
-		};
-	});
+	};
 }
 /**
-* Top-level surface: creates a run. `runOptions` are the ordinary
-* engine {@link RunOptions} of the created run; in particular
-* `runOptions.budgetUsd` is the ROOT hard ceiling over the WHOLE tree
-* (the orchestrator and every child), immutable after start, while
-* `opts.budget` only shapes the orchestrator's own sub-account inside
-* that ceiling. The shortcut previously accepted no RunOptions at all,
-* so the canonical entry point could not set a root ceiling without
-* dropping to `engine.run(makeOrchestratorWorkflow(...))` (v1.18.0
-* review P1-5).
+* Requires at least `min` matches of `pattern` in the result text (the
+* plan's citation and source count checks: a file:line pattern, a URL
+* pattern). The pattern compiles at construction (invalid patterns are a
+* ConfigError before any run exists) and matches globally; `min` is a
+* positive integer. Default name 'min-matches'; pass `name` to run
+* several instances, because names must be unique per orchestrate call.
 */
-function orchestrate(engine, goal, opts, runOptions) {
-	return engine.run(makeOrchestratorWorkflow(goal, opts), void 0, runOptions);
+function minMatchesValidator(options) {
+	const flags = options.flags ?? "";
+	const globalFlags = flags.includes("g") ? flags : `${flags}g`;
+	try {
+		new RegExp(options.pattern, globalFlags);
+	} catch (thrown) {
+		throw new ConfigError(`minMatchesValidator pattern does not compile: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
+	}
+	if (!Number.isInteger(options.min) || options.min < 1) throw new ConfigError(`minMatchesValidator min must be a positive integer; got ${String(options.min)}`);
+	return {
+		name: options.name ?? "min-matches",
+		validate: (input) => {
+			const found = input.text.match(new RegExp(options.pattern, globalFlags))?.length ?? 0;
+			return found >= options.min ? ok : {
+				ok: false,
+				reasons: [`expected at least ${String(options.min)} matches of /${options.pattern}/${flags}; found ${String(found)}`]
+			};
+		}
+	};
 }
 //#endregion
 //#region src/engine/events.ts
@@ -18976,4 +19059,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, invoiceFromJournal, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, preflightEstimate, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceAuditTrail, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SettlementError, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, invoiceFromJournal, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, preflightEstimate, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceAuditTrail, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };