@rulvar/core 1.99.1 → 1.101.0

package/dist/index.d.ts

@@ -3636,8 +3636,16 @@ interface ExplorationSummary {
 * visible BEFORE the terminal 'limit' a starved worker would settle
 * with. Attached to the full AgentResult and to the live `agent:end`
 * event whenever maxToolCalls, toolUnits, or toolBudgetExtension is
-* configured. Live telemetry only, exactly like transportRetries: never
-* journaled, absent on a replayed result.
+* configured. The snapshot itself never journals, but since RV509 it
+* has a durable subset: an extension grant and the finalization-window
+* entry journal as decision entries the moment they fire, a
+* crash-resume restores them from the journal, and a replayed result
+* carries `used` (from the terminal checkpoint), the granted `cap`,
+* `extensionsGranted`, and `finalizationWindowEntered` whenever the
+* invocation journaled at least one such decision. Every other field
+* (unitsUsed/unitsMax, noticesFired, finalizationReserveUsed, limiter,
+* and the cap of a grant-free run) is live-only fidelity, exactly like
+* transportRetries, and stays absent on replay.
 */
 interface ToolBudgetSummary {
   /** Executed tool calls (the loop's own counter). */
@@ -3999,6 +4007,10 @@ type WorkflowEvent = {
   replayed?: boolean;
 } & WorkflowEventBody;
 //#endregion
+//#region src/runtime/exploration.d.ts
+/** The budget dimension a finalization window statement names (RV302). */
+type FinalizationWindowBudget = "tool calls" | "tool units";
+//#endregion
 //#region src/runtime/no-progress.d.ts
 /**
 * The no-progress abort class (M3-T08): an engine-defined detector
@@ -4202,8 +4214,11 @@ interface UsageLimits {
   * set to false, only when at least one novel tool result digest arrived
   * since the previous grant (the exploration guard's evidence chain).
   * Each grant is announced to the model as a plain user message with the
-  * exact new counts, so pacing stays possible; on resume the grants
-  * re-derive conservatively from the restored executed-call count.
+  * exact new counts, so pacing stays possible. Under the engine, each
+  * grant also journals a decision entry the moment it fires (RV509), so
+  * a resume restores granted-but-unspent extensions from the journal
+  * (the conservative executed-call derivation remains the floor beneath
+  * a lost journal tail) and a replayed result reports the grants.
   * Extends maxToolCalls only, never toolUnits. Off by default: the
   * grant notices enter the conversation, so enabling it changes
   * recorded model requests.
@@ -4227,9 +4242,12 @@ interface UsageLimits {
   * free bookkeeping tools); the engine terminal tool is always
   * admitted regardless. With toolBudgetExtension configured, remaining
   * money converts into a grant BEFORE any window refusal, so the
-  * window binds only when the extension is exhausted or denied. Off by
-  * default: the refusals and the notice enter the conversation, so
-  * enabling it changes recorded model requests.
+  * window binds only when the extension is exhausted or denied. Under
+  * the engine, the entry journals a decision entry the moment it fires
+  * (RV509), so the summary's finalizationWindowEntered survives resume
+  * and replay even when a later grant moved the counts back out of the
+  * window. Off by default: the refusals and the notice enter the
+  * conversation, so enabling it changes recorded model requests.
   */
   finalizationWindow?: {
     /** How many trailing executed calls (or units) the window reserves. */reserveCalls: number; /** Tool names allowed inside the window; default: zero-cost tools. */
@@ -4692,6 +4710,36 @@ interface RunAgentOptions<S extends SchemaSpec = JsonSchema> {
     minEntries: number;
     enforce?: "warn" | "refuse";
   };
+  /**
+  * The durable parallel of the tool budget summary (RV509): the caller
+  * journals an extension grant and the finalization-window entry as
+  * decision entries at the moment each fires, and hands the state read
+  * back from those entries into `restored` on a dangling-dispatch
+  * resume. A restored grant is honored as granted (the model was
+  * already promised the raised cap), never re-admitted or re-announced,
+  * and a restored window entry keeps the summary's
+  * finalizationWindowEntered truthful even when a later grant moved the
+  * counts back out of the window. The hooks are fire-and-forget from
+  * the loop's view; pressure notices stay events and are never
+  * journaled. Absent, the loop is byte-identical to before.
+  */
+  toolBudgetDurability?: {
+    restored?: {
+      extensionsGranted: number;
+      finalizationWindowEntered: boolean;
+    };
+    onExtensionGrant?: (grant: {
+      grant: number;
+      maxExtensions: number;
+      toolCallsUsed: number;
+      cap: number;
+    }) => void;
+    onWindowEntry?: (entry: {
+      remaining: number;
+      reserveCalls: number;
+      budget: FinalizationWindowBudget;
+    }) => void;
+  };
   /** Emits agent:stream deltas when true (telemetry only). */
   stream?: boolean;
   /** Host or sibling cancellation. */
@@ -7861,6 +7909,32 @@ interface OrchestrateSynthesis {
   * accordingly).
   */
   context?: "digests" | "full";
+  /**
+  * The conditional synthesis gate (RV510, the ninth comparison
+  * experiment: synthesis returned the byte-identical draft after
+  * 101.3 s and 0.5512 USD, 57.3% of post-fan-in wall time). With
+  * `true`, before the 'single' synthesis span starts the coordination
+  * draft is run through the FULL declared finish contract (the same
+  * `finishValidation.validators` that would bind the synthesis
+  * finish): a draft that passes skips the synthesis invocation
+  * entirely under a journaled 'orchestrator_synthesis_skip' decision
+  * with reason 'synthesis_skipped_by_valid_draft' (the existing skip
+  * vocabulary; the info log and the acceptance envelope carry it), and
+  * a resume rolls the journaled skip forward with zero paid calls. A
+  * draft that fails any validator goes to synthesis exactly as before,
+  * with the repair budget untouched (the gate is a pre-pass, never a
+  * journaled validation verdict). Deterministic by construction: only
+  * the declared contract judges, never a semantic delta heuristic.
+  * Requires `finishValidation` (a ConfigError at intake otherwise:
+  * without a contract there is nothing to judge the draft valid by),
+  * which transitively limits it to mode 'single'. With a configured
+  * `budget.synthesisReserveUsd` the held money is released unconsumed
+  * on the skip and no reserve lifecycle journals: there was no
+  * synthesis invocation to account. Default false: the gate, the
+  * decision entry, and the envelope field are all absent, byte for
+  * byte.
+  */
+  skipWhenDraftValid?: boolean;
 }
 /**
 * The deterministic reconciliation envelope an 'incremental' synthesis
@@ -7895,15 +7969,22 @@ interface IncrementalSynthesisResult {
 * notes were already paid during the run; the skipped step is the free
 * deterministic reconciliation). 'synthesis_skipped_by_budget_cap': the
 * orchestrator budget cap froze the plan, and a capped run settles
-* through the reserved finalizer, never synthesis. The reason is frozen
-* into the journaled decision that caused the skip (the acceptance
-* decision or the budget-cap decision), spread into the typed
-* FailRunError data on the failing paths, and announced by an info
-* 'orchestrator synthesis skipped' log event; it is absent everywhere
-* when synthesis is not configured or actually ran, so existing runs
-* stay byte identical.
-*/
-type OrchestrateSynthesisSkipReason = "synthesis_skipped_by_acceptance" | "synthesis_skipped_by_budget_cap";
+* through the reserved finalizer, never synthesis.
+* 'synthesis_skipped_by_valid_draft' (RV510): the opt-in
+* `synthesis.skipWhenDraftValid` gate ran the coordination draft
+* through the full declared finish contract and every validator
+* passed, so the synthesis invocation had nothing to add and never
+* started; unlike the other two reasons the run still settles ok with
+* the draft as its result. The reason is frozen into the journaled
+* decision that caused the skip (the acceptance decision, the
+* budget-cap decision, or the 'orchestrator_synthesis_skip' decision),
+* spread into the typed FailRunError data on the failing paths and
+* into the acceptance envelope on the valid-draft path, and announced
+* by an info 'orchestrator synthesis skipped' log event; it is absent
+* everywhere when synthesis is not configured or actually ran, so
+* existing runs stay byte identical.
+*/
+type OrchestrateSynthesisSkipReason = "synthesis_skipped_by_acceptance" | "synthesis_skipped_by_budget_cap" | "synthesis_skipped_by_valid_draft";
 declare const ORCHESTRATE_WORKFLOW_NAME = "rulvar-orchestrate";
 /**
 * Resolves per-spawn dispatch options against the engine registries
@@ -10330,4 +10411,4 @@ interface SandboxBridge {
 declare const SANDBOX_AGENT_OPT_KEYS: readonly string[];
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentProfileTemplateOptions, AgentResult, AgentResultMeta, AgentStatus, type AppliedPricingRow, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditCategory, AuditRecord, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, type CriticalPath, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DataKeyProvider, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DedupedClaims, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EngineQuotaConfig, EngineQuotaRuntime, EntryBillingFold, EntryBillingUnit, EntryKind, EntryRef, EntryStatus, EnvelopeEncryption, EnvelopeEncryptionOptions, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, EvidenceContract, type EvidenceRef, type ExecKeyDerivation, type ExecutorRegistry, type ExplorationSummary, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FencedCodeMode, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishContract, FinishContractCitations, FinishContractGoldenReject, FinishContractManifest, FinishInfo, FinishSelfTestFailure, FinishSelfTestFixtures, FinishSelfTestReport, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, IncrementalSynthesisResult, InvalidResolutionError, InvocationRole, type InvocationTable, InvoiceExport, InvoicePricingProvenance, InvoiceReconciliation, InvoiceRow, type IsolatedExecContext, type IsolatedExecRequest, type IsolatedExecutorTag, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JOURNAL_ENVELOPE_MARKER, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, type JournalPricingSnapshot, JournalSerializationContext, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, MemoryQuotaLimiter, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestrateSynthesis, OrchestrateSynthesisSkipReason, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PreflightAdmissionRow, PreflightFinding, PreflightInput, PreflightOrchestratorSpec, PreflightReport, PreflightSpawnReport, PreflightSpawnSpec, PreflightToolCeiling, PriceTable, PricedUsage, type Pricing, type PricingTier, ProgressReport, type ProviderAdapter, ProviderCallRecord, QUOTA_WINDOW_MS, QualityFloors, QuotaCounters, type QuotaDecision, type QuotaEstimate, type QuotaLimiter, type QuotaReservationRequest, QuotaRule, QuotaWindowSnapshot, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, RateLimitObservation, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, RepeatedClaim, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, RepositoryResearchToolset, RepositoryResearchToolsetOptions, ResearchAgentProfileOptions, ResearchAgentProfileResult, ResearchEvidenceEntry, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, RunExport, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, SecretMasker, SectionMatchMode, Semaphore, SerializationHook, Settled, SettlementError, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, type ToolBudgetSummary, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, type ToolExecutorProvider, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, finishContract, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, invoiceFromJournal, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, preflightEstimate, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceAuditTrail, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, sectionCitationsValidator, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotUsage, spawnDepthOf, stripFencedBlocks, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentProfileTemplateOptions, AgentResult, AgentResultMeta, AgentStatus, type AppliedPricingRow, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditCategory, AuditRecord, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, type CriticalPath, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_CITATION_SAMPLE, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_CALLS_PER_ENTRY, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_EVIDENCE_OVERHEAD_CALLS, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DataKeyProvider, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DedupedClaims, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EngineQuotaConfig, EngineQuotaRuntime, EntryBillingFold, EntryBillingUnit, EntryKind, EntryRef, EntryStatus, EnvelopeEncryption, EnvelopeEncryptionOptions, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, EvidenceContract, type EvidenceRef, type ExecKeyDerivation, type ExecutorRegistry, type ExplorationSummary, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FencedCodeMode, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, type FinalizationWindowBudget, FinishContract, FinishContractCitations, FinishContractGoldenReject, FinishContractManifest, FinishInfo, FinishSelfTestFailure, FinishSelfTestFixtures, FinishSelfTestReport, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, IncrementalSynthesisResult, InvalidResolutionError, InvocationRole, type InvocationTable, InvoiceExport, InvoicePricingProvenance, InvoiceReconciliation, InvoiceRow, type IsolatedExecContext, type IsolatedExecRequest, type IsolatedExecutorTag, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JOURNAL_ENVELOPE_MARKER, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, type JournalPricingSnapshot, JournalSerializationContext, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, MemoryQuotaLimiter, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestrateSynthesis, OrchestrateSynthesisSkipReason, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PreflightAdmissionRow, PreflightFinding, PreflightInput, PreflightOrchestratorSpec, PreflightReport, PreflightSpawnReport, PreflightSpawnSpec, PreflightToolCeiling, PriceTable, PricedUsage, type Pricing, type PricingTier, ProgressReport, type ProviderAdapter, ProviderCallRecord, QUOTA_WINDOW_MS, QualityFloors, QuotaCounters, type QuotaDecision, type QuotaEstimate, type QuotaLimiter, type QuotaReservationRequest, QuotaRule, QuotaWindowSnapshot, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, RateLimitObservation, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, RepeatedClaim, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, RepositoryResearchToolset, RepositoryResearchToolsetOptions, ResearchAgentProfileOptions, ResearchAgentProfileResult, ResearchEvidenceEntry, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, RunExport, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, SecretMasker, SectionMatchMode, Semaphore, SerializationHook, Settled, SettlementError, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, type ToolBudgetSummary, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, type ToolExecutorProvider, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispatchProjectionReserveUsd, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, finishContract, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, headingStructureValidator, identityJcs, implementationAgentProfile, invoiceFromJournal, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, journalPricingSnapshot, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, orchestratorAdmissionEstCostUsd, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, preflightEstimate, priceEntryBilling, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceAuditTrail, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, sectionCitationsValidator, selectStructuredOutputTier, selfTestFinishValidation, shouldCompact, snapshotUsage, spawnDepthOf, stripFencedBlocks, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, wordCountValidator, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/dist/index.js

@@ -10918,9 +10918,10 @@ async function runAgent(options) {
 	* 84-call cap while 38% of the USD ceiling sat unspent. A grant at the
 	* expiry converts that headroom into `increment` more executed calls,
 	* bounded by `maxExtensions`, admitted only with money remaining and
-	* (by default) new evidence since the last grant. Grants re-derive
-	* conservatively from the restored executed-call count on resume, so
-	* nothing new is journaled or checkpointed.
+	* (by default) new evidence since the last grant. Each grant reports
+	* through the durable decision hook (RV509) and restores on resume
+	* from the journaled decisions, with the conservative count
+	* derivation as the floor beneath a lost tail.
 	*/
 	const extension = limits.toolBudgetExtension;
 	let extensionGrants = 0;
@@ -10991,6 +10992,12 @@ async function runAgent(options) {
 		extensionGrants += 1;
 		extensionEvidenceAtLastGrant = guard?.evidenceCount() ?? 0;
 		const cap = limits.maxToolCalls + extensionGrants * extension.increment;
+		options.toolBudgetDurability?.onExtensionGrant?.({
+			grant: extensionGrants,
+			maxExtensions: extension.maxExtensions,
+			toolCallsUsed,
+			cap
+		});
 		pendingExtensionNotices.push(toolBudgetExtensionNoticeText(extensionGrants, extension.maxExtensions, toolCallsUsed, cap));
 		events?.emit({
 			type: "log",
@@ -11053,6 +11060,11 @@ async function runAgent(options) {
 		if (state === void 0) return;
 		windowEntered = true;
 		windowNoticeFired = true;
+		options.toolBudgetDurability?.onWindowEntry?.({
+			remaining: state.remaining,
+			reserveCalls: finalizationWindow.reserveCalls,
+			budget: state.budget
+		});
 		pendingWindowNotices.push(finalizationWindowNoticeText(state.remaining, finalizationWindow.reserveCalls, state.budget));
 		events?.emit({
 			type: "log",
@@ -11115,7 +11127,15 @@ async function runAgent(options) {
 			extensionGrants = Math.min(extension.maxExtensions, Math.ceil((toolCallsUsed - limits.maxToolCalls) / extension.increment));
 			extensionEvidenceAtLastGrant = guard?.evidenceCount() ?? 0;
 		}
-		if (windowActive() !== void 0) {
+		const durableRestored = options.toolBudgetDurability?.restored;
+		if (extension !== void 0 && durableRestored !== void 0) {
+			const journaled = Math.min(extension.maxExtensions, durableRestored.extensionsGranted);
+			if (journaled > extensionGrants) {
+				extensionGrants = journaled;
+				extensionEvidenceAtLastGrant = guard?.evidenceCount() ?? 0;
+			}
+		}
+		if (windowActive() !== void 0 || finalizationWindow !== void 0 && durableRestored?.finalizationWindowEntered === true) {
 			windowEntered = true;
 			windowNoticeFired = true;
 		}
@@ -13977,6 +13997,39 @@ function agentResultWire(result, fallbackMessage) {
 		}
 	};
 }
+/** The tool-budget decision vocabulary (RV509). */
+const TOOL_BUDGET_EXTENSION_DECISION = "tool_budget_extension";
+const FINALIZATION_WINDOW_DECISION = "finalization_window_entry";
+/**
+* The durable subset of a dispatch's ToolBudgetSummary, folded from the
+* decision entries bound to it (RV509). The grant ordinal, not the entry
+* count, carries the total: a crash can lose an entry's persist while
+* the count derivation still reproduces the grant, so ordinals may gap
+* but never repeat, and the highest one is the authoritative tally. The
+* cap is the effective cap the highest grant announced.
+*/
+function readToolBudgetDecisions(entries, targetRef) {
+	let extensionsGranted = 0;
+	let cap;
+	let finalizationWindowEntered = false;
+	for (const entry of entries) {
+		if (entry.kind !== "decision") continue;
+		const value = entry.value;
+		if (value?.targetRef !== targetRef) continue;
+		if (value.decisionType === TOOL_BUDGET_EXTENSION_DECISION && typeof value.grant === "number") {
+			if (value.grant > extensionsGranted) {
+				extensionsGranted = value.grant;
+				cap = typeof value.cap === "number" ? value.cap : void 0;
+			}
+		} else if (value.decisionType === FINALIZATION_WINDOW_DECISION) finalizationWindowEntered = true;
+	}
+	if (extensionsGranted === 0 && !finalizationWindowEntered) return;
+	return {
+		extensionsGranted,
+		...cap === void 0 ? {} : { cap },
+		finalizationWindowEntered
+	};
+}
 /** The workflow-defaults layer a Workflow value contributes, or nothing. */
 function workflowLayerOf(wf) {
 	const layer = {};
@@ -14355,11 +14408,13 @@ function createCtx(internals, rootWorkflow) {
 				if (stampedData?.exploration !== void 0) result.exploration = stampedData.exploration;
 			}
 			let replayedToolResults = [];
+			let replayedToolCallsUsed;
 			if (matched.kind === "replay" && terminal?.checkpointRef !== void 0) {
 				const blob = await internals.transcripts.get(terminal.checkpointRef);
 				const checkpoint = blob === null ? void 0 : decodeCheckpoint(blob);
 				if (checkpoint !== void 0) {
 					result.turns = checkpoint.turns;
+					replayedToolCallsUsed = checkpoint.toolCallsUsed;
 					if (result.status === "limit") {
 						const partialReport = latestProgressReport(checkpoint.messages);
 						if (partialReport !== void 0) result.partial = partialReport;
@@ -14370,6 +14425,16 @@ function createCtx(internals, rootWorkflow) {
 					}));
 				}
 			}
+			{
+				const durable = readToolBudgetDecisions(internals.replayer.snapshot(), matched.running.seq);
+				if (durable !== void 0 && replayedToolCallsUsed !== void 0) {
+					const restoredSummary = { used: replayedToolCallsUsed };
+					if (durable.cap !== void 0) restoredSummary.cap = durable.cap;
+					if (durable.extensionsGranted > 0) restoredSummary.extensionsGranted = durable.extensionsGranted;
+					if (durable.finalizationWindowEntered) restoredSummary.finalizationWindowEntered = true;
+					result.toolBudget = restoredSummary;
+				}
+			}
 			internals.events.emit({
 				type: "agent:start",
 				agentType,
@@ -14421,7 +14486,8 @@ function createCtx(internals, rootWorkflow) {
 				costUsd,
 				entryRef: terminal?.seq ?? matched.running.seq,
 				...terminal?.usageApprox === true ? { usageApprox: true } : {},
-				...result.exploration === void 0 ? {} : { exploration: result.exploration }
+				...result.exploration === void 0 ? {} : { exploration: result.exploration },
+				...result.toolBudget === void 0 ? {} : { toolBudget: result.toolBudget }
 			}, spanId, true);
 			for (const slice of replayPriced?.priced ?? []) bump(internals.cost.byModel, slice.servedBy, slice.usd);
 			for (const slice of replayPriced?.unpriced ?? []) internals.cost.unpriced.push({
@@ -14776,6 +14842,43 @@ function createCtx(internals, rootWorkflow) {
 		runAgentOptions.summarize = summarize;
 		if (profile?.compaction !== void 0) runAgentOptions.compaction = profile.compaction;
 		if (profile?.evidenceContract !== void 0) runAgentOptions.evidenceContract = profile.evidenceContract;
+		{
+			const durableRestored = readToolBudgetDecisions(internals.replayer.snapshot(), running.seq);
+			runAgentOptions.toolBudgetDurability = {
+				...durableRestored === void 0 ? {} : { restored: {
+					extensionsGranted: durableRestored.extensionsGranted,
+					finalizationWindowEntered: durableRestored.finalizationWindowEntered
+				} },
+				onExtensionGrant: (grant) => {
+					internals.replayer.appendSinglePhase({
+						scope: state.scope,
+						key: "",
+						kind: "decision",
+						status: "ok",
+						spanId,
+						value: {
+							decisionType: TOOL_BUDGET_EXTENSION_DECISION,
+							targetRef: running.seq,
+							...grant
+						}
+					});
+				},
+				onWindowEntry: (entry) => {
+					internals.replayer.appendSinglePhase({
+						scope: state.scope,
+						key: "",
+						kind: "decision",
+						status: "ok",
+						spanId,
+						value: {
+							decisionType: FINALIZATION_WINDOW_DECISION,
+							targetRef: running.seq,
+							...entry
+						}
+					});
+				}
+			};
+		}
 		if (loopFallbacks.length > 0) runAgentOptions.fallbacks = loopFallbacks;
 		if (retryPolicy !== void 0) runAgentOptions.retry = { policy: retryPolicy };
 		if (internals.quota !== void 0) {
@@ -16870,6 +16973,11 @@ function validateOrchestrateOptions(opts) {
 		if (synthesis.dedupeClaims !== void 0 && typeof synthesis.dedupeClaims !== "boolean") throw new ConfigError("orchestrate synthesis.dedupeClaims must be a boolean; got " + typeof synthesis.dedupeClaims);
 		const symmetry = synthesis;
 		if (symmetry.exposeChildResultTools !== void 0 && typeof symmetry.exposeChildResultTools !== "boolean") throw new ConfigError("orchestrate synthesis.exposeChildResultTools must be a boolean; got " + typeof symmetry.exposeChildResultTools);
+		const conditional = synthesis;
+		if (conditional.skipWhenDraftValid !== void 0) {
+			if (typeof conditional.skipWhenDraftValid !== "boolean") throw new ConfigError("orchestrate synthesis.skipWhenDraftValid must be a boolean; got " + typeof conditional.skipWhenDraftValid);
+			if (conditional.skipWhenDraftValid && opts.finishValidation === void 0) throw new ConfigError("orchestrate synthesis.skipWhenDraftValid requires finishValidation: without a declared finish contract there is nothing to judge the draft valid by");
+		}
 		if (symmetry.context !== void 0 && symmetry.context !== "digests" && symmetry.context !== "full") throw new ConfigError("orchestrate synthesis.context must be 'digests' or 'full'; got " + JSON.stringify(symmetry.context));
 		if (synthesis.noteLimits !== void 0) validateUsageLimits(synthesis.noteLimits, "orchestrate synthesis.noteLimits");
 		if (synthesis.effort !== void 0 && ![
@@ -17877,6 +17985,24 @@ function makeOrchestratorWorkflow(goal, opts) {
 			if (decision.contractHash !== void 0) return decision.contractHash === hash;
 			return internals.replayer.snapshot().filter((entry) => entry.kind === "decision" && entry.scope === callingState.scope && entry.value?.decisionType === "orchestrator_finish_validation_bundle").length <= 1;
 		};
+		/**
+		* The children snapshot (RV-202): spawn order, pure reads of the
+		* records the orchestrator already tracks, so validators can hold
+		* a finish result (or the RV510 draft pre-pass) against the
+		* evidence the children produced. Only the JOURNALED verdict of
+		* validateFinish survives; on replay the snapshot is never rebuilt
+		* because the entry is read by call id there.
+		*/
+		const validationChildren = () => {
+			const salvageOutputOn = opts?.acceptance?.acceptValidatedTerminalOutputOnLimit === true;
+			return [...records.values()].sort((a, b) => a.spawnOrdinal - b.spawnOrdinal).map((record) => ({
+				handle: record.handle,
+				nodeId: record.nodeId,
+				status: record.settled?.status ?? "running",
+				text: record.settled === void 0 ? "" : serializeChildOutput(record.settled),
+				...salvageOutputOn && record.settled?.status === "limit" && record.settled.output !== null && record.settled.output !== void 0 ? { salvageableOutput: true } : {}
+			}));
+		};
 		const validateFinish = async (call) => {
 			if (validationSpec === void 0) return { ok: true };
 			const maxRepairs = validationSpec.maxRepairs ?? 1;
@@ -17884,18 +18010,10 @@ function makeOrchestratorWorkflow(goal, opts) {
 			let decision = known.find((candidate) => candidate.callId === call.id);
 			if (decision === void 0) {
 				const result = call.result ?? null;
-				const salvageOutputOn = opts?.acceptance?.acceptValidatedTerminalOutputOnLimit === true;
-				const children = [...records.values()].sort((a, b) => a.spawnOrdinal - b.spawnOrdinal).map((record) => ({
-					handle: record.handle,
-					nodeId: record.nodeId,
-					status: record.settled?.status ?? "running",
-					text: record.settled === void 0 ? "" : serializeChildOutput(record.settled),
-					...salvageOutputOn && record.settled?.status === "limit" && record.settled.output !== null && record.settled.output !== void 0 ? { salvageableOutput: true } : {}
-				}));
 				const input = {
 					result,
 					text: typeof result === "string" ? result : JSON.stringify(result),
-					children
+					children: validationChildren()
 				};
 				const failed = [];
 				for (const validator of validationSpec.validators) {
@@ -18289,11 +18407,75 @@ function makeOrchestratorWorkflow(goal, opts) {
 		* facts; absent everywhere when no reserve is configured.
 		*/
 		let synthesisReserveLifecycle;
+		/**
+		* Set exactly when the RV510 gate skipped the synthesis span (live
+		* pass and resume roll-forward alike); the acceptance envelope
+		* reports the machine reason through it.
+		*/
+		let synthesisSkippedByValidDraft = false;
 		const runSynthesis = async (draft) => {
 			const spec = opts?.synthesis;
 			if (spec === void 0) return draft;
 			await recoveryDone;
 			if (spec.mode === "incremental") return await reconcileIncremental(draft, spec);
+			if (spec.skipWhenDraftValid === true && validationSpec !== void 0) {
+				const skipKey = "synthesis-draft-valid-skip";
+				const announceSkip = (entryRef) => {
+					internals.events.emit({
+						type: "log",
+						level: "info",
+						msg: "orchestrator synthesis skipped",
+						data: {
+							reason: "synthesis_skipped_by_valid_draft",
+							skipDecisionRef: entryRef
+						}
+					}, callingState.spanId);
+				};
+				const prior = internals.replayer.snapshot().find((entry) => entry.kind === "decision" && entry.scope === callingState.scope && entry.key === skipKey);
+				if (prior !== void 0) {
+					synthesisSkippedByValidDraft = true;
+					announceSkip(prior.seq);
+					return draft;
+				}
+				const draftValue = draft ?? null;
+				const input = {
+					result: draftValue,
+					text: typeof draftValue === "string" ? draftValue : JSON.stringify(draftValue),
+					children: validationChildren()
+				};
+				let allPassed = true;
+				for (const validator of validationSpec.validators) {
+					let verdict;
+					try {
+						verdict = validator.validate(input);
+					} catch (thrown) {
+						throw new ConfigError(`finish validator '${validator.name}' threw instead of returning a verdict during the skipWhenDraftValid pre-pass: ` + (thrown instanceof Error ? thrown.message : String(thrown)));
+					}
+					if (!verdict.ok) {
+						allPassed = false;
+						break;
+					}
+				}
+				if (allPassed) {
+					const skipEntry = await internals.replayer.appendSinglePhase({
+						scope: callingState.scope,
+						key: skipKey,
+						kind: "decision",
+						status: "ok",
+						spanId: internals.spans.mint(callingState.spanId),
+						site: "orchestrator-synthesis-skip",
+						value: {
+							decisionType: "orchestrator_synthesis_skip",
+							reason: "synthesis_skipped_by_valid_draft",
+							validators: validationSpec.validators.map((validator) => validator.name)
+						}
+					});
+					if (orchestratorAccount !== void 0 && (opts?.budget?.synthesisReserveUsd ?? 0) > 0) internals.budget.releaseSynthesisReserve(orchestratorAccount);
+					synthesisSkippedByValidDraft = true;
+					announceSkip(skipEntry.seq);
+					return draft;
+				}
+			}
 			const exposeTools = spec.exposeChildResultTools === true;
 			const fullContext = spec.context === "full";
 			const synthesisToolNames = /* @__PURE__ */ new Set([FINISH_TOOL_NAME, ...exposeTools ? [GET_CHILD_RESULT_TOOL_NAME, READ_CHILD_ARTIFACT_TOOL_NAME] : []]);
@@ -18643,7 +18825,8 @@ function makeOrchestratorWorkflow(goal, opts) {
 			...decision.salvagedPartialChildren === void 0 ? {} : { salvagedPartialChildren: decision.salvagedPartialChildren },
 			...decision.salvagedTerminalOutputChildren === void 0 ? {} : { salvagedTerminalOutputChildren: decision.salvagedTerminalOutputChildren },
 			...envelopeSchemaRecovered === 0 ? {} : { schemaRecoveredFinishExchanges: envelopeSchemaRecovered },
-			...synthesisReserveLifecycle === void 0 ? {} : { synthesisReserve: synthesisReserveLifecycle }
+			...synthesisReserveLifecycle === void 0 ? {} : { synthesisReserve: synthesisReserveLifecycle },
+			...synthesisSkippedByValidDraft ? { synthesisSkipped: "synthesis_skipped_by_valid_draft" } : {}
 		};
 	});
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.99.1",
+  "version": "1.101.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",