pi-background-tasks 2.3.0 → 2.4.2

package/docs/subsystems/docs-freshness-gate.md

@@ -12,14 +12,14 @@ covers_sources: []
 This authored section defines the boundary: documentation facts are extracted from package metadata and TypeScript ASTs, then generated into docs and the manifest. Unsupported syntax fails the gate rather than falling back to regex or stale hand-maintained inventories. Public registrations must remain unconditional top-level direct calls or use the one validated local tool-wrapper shape; host/method aliases, computed access, nested or conditional registration, wrapper chaining/passing, constructor helpers, ambiguous public metadata, destructured Pi parameters, and repeated imported registrars are rejected.
 
 <!-- pi-docs:begin name="docs-freshness-gate" generator="scripts/docs/generate.mjs" -->
-- Canonical package version: `2.3.0`
+- Canonical package version: `2.4.2`
 - Governed markdown docs: 42
 - Public surfaces extracted: 31
 - Governed production sources: 50
 - Tool contracts extracted: 11
-- Schema IDs extracted: 44
+- Schema IDs extracted: 46
 - Environment variable references extracted: 49
-- Behavioral attestation receipts not passing: 7
+- Behavioral attestation receipts not passing: 8
 - Receipt store: `docs/attestations.json`
 
 `npm run docs:verify` is read-only: it renders generated files twice in memory and compares them with committed bytes. `npm run docs:generate` is the only docs writer.

package/docs/subsystems/fusion.md

@@ -80,11 +80,11 @@ Evaluator, evaluator-repair, and merger always use capability `reason` and empty
 
 Research is targeted fetch, not search. The public caller declares exact non-duplicate public `http(s)` URLs and purposes. There is no browser, PDF reader, cache, search provider, page-recrawl loop, or domain allowlist.
 
-`fusion_web_fetch` is private to research children and has a closed `{url, extract?}` schema. It rejects credentials, non-http schemes, localhost/known-metadata names, and enumerated private/reserved address classes; vets all DNS answers against that classifier; pins the request to a vetted address; checks the response socket address; follows at most five re-vetted redirects; accepts only HTML/XHTML/plain text/Markdown; caps response bytes at 2 MiB and extracted output at 32 KiB; uses a 60 second deadline; strips script/style/noscript; and extracts text or Markdown. Source-policy admission also rejects literal Azure service address `168.63.129.16`, but the transport classifier does not currently special-case a public DNS/redirect target resolving to that address.
+`fusion_web_fetch` is private to research children and has a closed `{url, extract?}` schema. It rejects credentials, non-http schemes, localhost/known-metadata names, and enumerated private/reserved address classes; vets all DNS answers against that classifier; pins the request to a vetted address; checks the response socket address; follows at most five re-vetted redirects; accepts only HTML/XHTML/plain text/Markdown; caps response bytes at 4 MiB and extracted output at 32 KiB; uses one 90 second full-operation deadline across DNS, redirects, response transfer, and extraction; strips script/style/noscript; and extracts text or Markdown. Source-policy admission also rejects literal Azure service address `168.63.129.16`, but the transport classifier does not currently special-case a public DNS/redirect target resolving to that address.
 
 Research intentionally combines read-only file tools and network fetch in one child. This supports source-backed synthesis but is security-sensitive: operators must not supply secret-bearing URLs or ask children to put private data in URL strings. The package blocks common SSRF targets and credential URLs, but its deny rules are not an exhaustive network sandbox; fetched content remains untrusted and caller-declared public URLs can still disclose access through remote logs/timing.
 
-Inspect/research candidates write sealed tool-call audit logs. The log contains schema version, ordinal, tool name, argument/result byte counts and SHA-256 digests, status, duration, and fetch provenance. Raw arguments, raw results, page content, and rejected raw URLs are not persisted. The parent requires the log and seal, verifies hashes/counts/ordinals/status, enforces the 8 MiB aggregate result-byte cap, and rejects non-allowlisted tools. A child may attempt at most 192 tool calls; crossing that limit aborts the run, emits structured refusal evidence, and prevents a complete audit seal.
+Inspect/research candidates write sealed tool-call audit logs. The log contains schema version, ordinal, tool name, argument/result byte counts and SHA-256 digests, status, duration, and fetch provenance. Raw arguments, raw results, page content, and rejected raw URLs are not persisted. The parent requires the log and seal, verifies hashes/counts/ordinals/status, independently enforces both the 600-call and 32 MiB aggregate result-byte caps, and rejects non-allowlisted tools. A child may attempt at most 600 tool calls; crossing that limit aborts the run, emits structured refusal evidence, and prevents a complete audit seal.
 
 ## Child process isolation
 
@@ -92,7 +92,7 @@ Fusion never calls direct completion APIs. It launches direct child `pi --mode t
 
 Child text mode writes the final full answer to stdout. The private child extension emits compact reasoning-free metadata frames to stderr for finalized assistant messages: provider/model, stop reason, text block byte counts and hashes, aggregate text hash, the complete Pi `Usage` object (including Anthropic `cacheWrite1h` and provider-reported reasoning subsets), and a closed cache-policy observation. It governs every final `before_provider_request` payload after attribution and sanitization. For Anthropic routes, the child environment defaults `PI_CACHE_RETENTION` to `long` before provider serialization, so the attribution/Pi adapter creates system, final-tool, and final-conversation breakpoints with `ttl: "1h"`; inherited `PI_CACHE_RETENTION=short|none|long` remains explicit, and call-level `cacheRetention="none"` still wins for compaction. The final governor validates and normalizes those upstream-selected breakpoints, falls back to short when model compatibility rejects long retention, preserves no-marker compaction payloads, enforces Anthropic's four-breakpoint ceiling, and appends the subscription prompt-caching-scope beta idempotently. Its `effective_retention` field describes the final payload, not provider acceptance. Provider usage is preserved verbatim: `cacheWrite1h > 0` proves a one-hour write, but zero is inconclusive on subscription OAuth. Live normal-spawn and exact Fusion-child controls each observed a unique cache read after 370 idle seconds despite `cacheWrite1h = 0`; therefore payload observations prove request intent and `cacheRead` proves reuse, while neither zero telemetry nor a six-minute hit alone proves the full one-hour lifetime. Malformed controls or policy values abort before transport. Non-Anthropic payloads and child environments remain unchanged apart from the governor's existing JSON normalization.
 
-After cache normalization, the governor validates a stable JSON-object serialization and enforces the 128-provider-request execution limit. It does not estimate live payload tokens, subtract possible model output from the context window, or reject a request by payload size; Pi and the provider own live context handling after the pre-spawn Fusion stage checks. A provider-side context rejection remains a loud child failure and is never route-substituted or hidden. Pi's provider-hook behavior is characterized through the same `openai-codex-responses` transport adapter used by subscription Codex routes in a real local HTTP agent loop: transforms chain in extension load order and `ctx.abort()` prevents transport for the retained cache-policy and execution-limit refusals. Cache observations use `pi-background-tasks.fusion-claude-cache-observation.v1`, state requested/effective retention, source, breakpoint count, and provider-request ordinal, and are hash-bound inside `pi-background-tasks.fusion-child-result.v4` attempt event artifacts. At terminal `agent_settled`, the extension emits exactly one `pi-background-tasks.fusion-child-settlement.v3` frame binding the complete ordered metadata stream by count and SHA-256, the final record/hash, recovered retry-marker ordinals, and any one recovered oversized-original ordinal. The parent validates closed cache/output-contract evidence and increasing request ordinals, reconstructs stdout against the final metadata, requires final stop reason `stop`, verifies model identity, and preserves usage/cost exactly. Non-final `toolUse` records remain normal. A non-final `error` is accepted only when it is a zero-content, empty-hash, zero-usage retry marker, a later final `stop` exists, and the terminal settlement hash/accounts for that exact ordinal. Exactly one non-final `stop` is accepted only as a hash-bound oversized candidate original immediately followed by its same-session replacement. `length`, `aborted`, `pending`, final `error`, error records carrying text or usage, unbound non-final `stop`, missing/duplicate/tampered settlement, and settlement before terminal idleness all fail loudly.
+After cache normalization, the governor validates a stable JSON-object serialization and enforces the 550-provider-request execution limit. It does not estimate live payload tokens, subtract possible model output from the context window, or reject a request by payload size; Pi and the provider own live context handling after the pre-spawn Fusion stage checks. A provider-side context rejection remains a loud child failure and is never route-substituted or hidden. Pi's provider-hook behavior is characterized through the same `openai-codex-responses` transport adapter used by subscription Codex routes in a real local HTTP agent loop: transforms chain in extension load order and `ctx.abort()` prevents transport for the retained cache-policy and execution-limit refusals. Cache observations use `pi-background-tasks.fusion-claude-cache-observation.v1`, state requested/effective retention, source, breakpoint count, and provider-request ordinal, and are hash-bound inside `pi-background-tasks.fusion-child-result.v4` attempt event artifacts. At terminal `agent_settled`, the extension emits exactly one `pi-background-tasks.fusion-child-settlement.v3` frame binding the complete ordered metadata stream by count and SHA-256, the final record/hash, recovered retry-marker ordinals, and any one recovered oversized-original ordinal. The parent validates closed cache/output-contract evidence and increasing request ordinals, reconstructs stdout against the final metadata, requires final stop reason `stop`, verifies model identity, and preserves usage/cost exactly. Non-final `toolUse` records remain normal. A non-final `error` is accepted only when it is a zero-content, empty-hash, zero-usage retry marker, a later final `stop` exists, and the terminal settlement hash/accounts for that exact ordinal. Exactly one non-final `stop` is accepted only as a hash-bound oversized candidate original immediately followed by its same-session replacement. `length`, `aborted`, `pending`, final `error`, error records carrying text or usage, unbound non-final `stop`, missing/duplicate/tampered settlement, and settlement before terminal idleness all fail loudly.
 
 Fusion child environments strip session/model/provider variables plus metered credential/base-url variables for OpenRouter, OpenAI, Anthropic, Azure OpenAI, and generic Pi API credentials before launch. Frontier model routes are admitted only when the registry reports subscription OAuth for trusted `anthropic` or `openai-codex` endpoints. There is no fallback, model substitution, endpoint override, or metered API-key route.
 
@@ -102,7 +102,7 @@ Budget planning is per route and per stage. Every configured candidate, evaluato
 
 `budget-plan.json` uses `pi-background-tasks.fusion-budget-plan.v4` and records route capacities, stage forecasts for candidate/evaluation/evaluation-repair/merge, conditional repair reservation, warnings, blockers, empty-request counterfactuals, and remediation. Each route reserves the larger of Fusion's 32,768-token output contract reserve and the resolved model's declared maximum output; a model advertising a 128,000-token maximum therefore receives the full 128,000-token reserve. Fatal preflight blockers launch zero children. High utilization or worst-case reservation pressure is a warning when input still fits. Exact rendered prompt checks happen again immediately before candidate, evaluation, repair, and merge launches.
 
-Every candidate system prompt discloses the exact 49,152 JSON-rendered UTF-8 byte hard maximum and requires explicit limitations when the requested scope cannot fit. Output contracts are checked after durable attempt recording: candidate responses up to 48 KiB JSON-rendered bytes, evaluator up to 64 KiB, merger/final report up to 64 KiB, diagnostics contract 8 KiB, child stdout cap 32 MiB, child stderr cap 4 MiB.
+Every candidate system prompt discloses the exact 49,152 JSON-rendered UTF-8 byte hard maximum and requires explicit limitations when the requested scope cannot fit. Output contracts are checked after durable attempt recording: candidate responses up to 48 KiB JSON-rendered bytes, evaluator up to 64 KiB, merger/final report up to 64 KiB, diagnostics contract 8 KiB, child stdout cap 32 MiB, child stderr cap 16 MiB.
 
 When a candidate's first complete `stop` response exceeds 48 KiB, the private child extension durably preserves that full original, removes all active tools, and queues one `followUp` user message before `agent_settled`. The same live Pi process, route, model, and in-memory conversation may only compress/restructure its immediately previous answer; it may not investigate again. Pi text mode then emits only the replacement to stdout. A conforming replacement proceeds normally. A second oversized response hard-fails as `child_output_cap`, preserves both the original artifact and replacement partial response, and never queues another continuation. Cancellation during compression preserves any hash-verified original already written. Fusion never clips, silently forwards, or repairs output in a new child session.
 
@@ -120,7 +120,7 @@ For tool-enabled children, the private audit journal remains open across every l
 
 The four public Fusion tools return a background launch receipt after the readiness barrier. Tool-launched runs default to terminal notification plus follow-up wake; `/fusion` uses notification-only. The first successful `bg_result` retrieval durably claims and attaches complete Fusion usage exactly once; repeated retrieval returns the answer without duplicating session accounting. Running retrieval never waits.
 
-Cancellation and shutdown are loud and durable when a run store exists. The extension tracks active runs, managed tasks own their abort controllers, `bg_kill` and session shutdown abort them, and terminal task publication waits for workflow settlement. Child processes have a 30 minute wall timeout, 20 minute idle watchdog, SIGTERM grace, SIGKILL wait, process-group kill on POSIX, bounded stdout/stderr, and cleanup-error propagation.
+Cancellation and shutdown are loud and durable when a run store exists. The extension tracks active runs, managed tasks own their abort controllers, `bg_kill` and session shutdown abort them, and terminal task publication waits for workflow settlement. Child processes have a 50 minute wall timeout, 35 minute idle watchdog, SIGTERM grace, SIGKILL wait, process-group kill on POSIX, bounded stdout/stderr, and cleanup-error propagation.
 
 ## Troubleshooting
 
@@ -129,7 +129,7 @@ Cancellation and shutdown are loud and durable when a run store exists. The exte
 - Frontier/API route rejected: use Pi Anthropic or Codex subscription OAuth, not OpenAI/OpenRouter/Azure/API-key routes.
 - `prompt_budget_exceeded_forecast`: inspect `budget-plan.json`; the error says whether shortening the request can help or whether session history/scope/model context window is the blocker.
 - `prompt_budget_exceeded_measured`: an exact rendered prompt exceeded capacity after upstream output was known; split the workflow or choose a larger-context subscription route.
-- `child_runtime_limit_exceeded`: a child crossed the 128-provider-request or 192-tool-call execution limit. Inspect the failed tool seal and split an unbounded task rather than raising limits blindly.
+- `child_runtime_limit_exceeded`: a child crossed the 550-provider-request or 600-tool-call execution limit. Inspect the failed tool seal and split an unbounded task rather than raising limits blindly.
 - `child_runtime_payload_invalid`: the final provider payload could not be normalized as one stable JSON object. Fix the payload/provider integration; no fallback serialization is attempted.
 - `child_cache_policy_invalid`: `PI_CACHE_RETENTION` or Claude cache-control evidence was malformed. Use exactly `none`, `short`, or `long`; do not bypass cache-policy validation.
 - `child_output_cap` after candidate compression: inspect the final candidate response, its `response.oversized.*` original, and v4/v3 child protocol evidence. The single same-session no-tool compression attempt also exceeded 49,152 JSON-rendered bytes; split the task rather than truncating or starting a repair child.

package/docs/tools/bg_delegate.md

@@ -186,19 +186,24 @@ Budgets and limits:
 - route capacity is the declared context window minus reserves: `16,384` output, `8,192` framing, `4,096` safety tokens;
 - minimum usable input is `8,192` tokens;
 - launch admission measures the child system prompt plus the exact child prompt bytes that carry the seed;
-- runtime context is measured before each model call;
-- per-tool-result transcript cap: `64 KiB`;
-- aggregate tool-output cap: `64 MiB`;
-- answer capture cap value in the seed: `4 MiB`; current child code carries this limit but does not separately enforce it before packaging;
+- backed large prompts use route-family calibration; the plan also records a provable `1.00 B/token` counter-forecast for every byte class, including multibyte input;
+- `32,768` input tokens are protected for finalization, with an `8,192`-token low-runway trigger;
+- runtime context estimates are advisory and never masquerade as provider context truth;
+- tool results spill above `64 KiB` or earlier when retaining them would consume protected runway;
+- artifact range reads are bounded by remaining inline runway;
+- aggregate raw tool-output cap: `64 MiB`;
+- answer capture cap: `4 MiB`, enforced without committing a prefix;
 - timeout defaults to `1200s`.
 
-Artifacts are under `.pi/delegate/<session-id>-<pid>/<task-id>/` and include `seed.json`, `child-prompt.txt`, `context-omission-ledger.json`, `budget-plan.json`, `manifest.json`, `child-session/`, `spill/`, and later `result.json` / `outcome.json` when produced. Child stdout/stderr are captured through the background task output path; the delegate artifact constants include child stream filenames, but current launch/finalize code does not mirror streams into those delegate files.
+When protected runway becomes low, the child disables tools and is instructed to answer immediately from evidence already gathered. Pi and the provider—not the package estimator—own final live context admission. A genuine provider context rejection remains a loud failure and is never retried on another route.
+
+Artifacts are under `.pi/delegate/<session-id>-<pid>/<task-id>/` and include `seed.json`, `child-prompt.txt`, `context-omission-ledger.json`, `budget-plan.json`, `manifest.json`, `child-session/`, `spill/`, `runtime-budget.json`, and later `result.json` / `outcome.json` when produced. Child stdout/stderr are captured through the background task output path; terminal failures report that real merged output path when it exists and do not claim absent delegate-local stream files.
 
 ## Spilled tool output
 
-Oversized child tool results are written in full to `spill/...` artifacts and replaced in the transcript by receipts carrying path, byte length, SHA-256, tool name, call id, turn sequence, and source call index. The raw oversized payload is not forwarded as a fallback and is not truncated.
+Oversized child tool results are written in full to `spill/...` artifacts and replaced in the transcript by receipts carrying path, byte length, SHA-256, content format, tool name, call id, turn sequence, and source call index. Single text blocks retain their exact UTF-8 bytes; malformed lone-surrogate text fails loudly instead of being substituted. Multi-block and image-bearing results use a structured JSON envelope preserving text, block boundaries, MIME type, and complete base64 image data. The raw oversized payload is not forwarded as a fallback and is not truncated.
 
-Inside the child, `delegate_read_artifact({artifact, offset, length})` reads an exact byte range. It refuses path escape, negative/non-integer offsets, non-positive lengths, and reads past EOF rather than returning a short/clamped range.
+Inside the child, `delegate_read_artifact({artifact, offset, length})` reads an exact byte range and returns those bytes as base64. It refuses path escape, negative/non-integer offsets, non-positive lengths, and reads past EOF rather than returning a short/clamped range. Base64 prevents a range that splits a UTF-8 sequence from being silently changed to replacement characters.
 
 ## Completion
 

package/docs/tools/bg_result.md

@@ -11,7 +11,7 @@ covers_sources: []
 
 <!-- pi-docs:begin name="tool-contract-bg_result" generator="scripts/docs/generate.mjs" -->
 - Label: **Background Result**
-- Source: `src/delegate-extension.ts:515`
+- Source: `src/delegate-extension.ts:516`
 - Description: Retrieve a hash-verified result from a bg_delegate or background Fusion task. Never blocks: a running task returns a typed not-ready result. Oversized answers are never truncated.
 - Root schema: `object`; additionalProperties: `false`
 
@@ -124,7 +124,7 @@ Common delegate retrieval outcomes:
 - `result_too_large_for_inline` — explicit inline request exceeded the inline cap.
 - Fusion `summary_status:"integrity_failed"` — a terminal summary or its manifest binding failed verification; no summary metadata is trusted.
 
-Delegate errors include whether a child process was created, preserved artifact hints when known, and remediation text. Usage missing from the provider is reported as `unavailable`, not synthesized as zero. Fusion retrieval additionally fails on non-completed manifests, identity/schema drift, malformed usage/details, invalid UTF-8, or any manifest/result/merged hash or byte-length mismatch; failed/cancelled runs return their preserved terminal error rather than partial output.
+Delegate errors include whether a child process was created, preserved artifact hints that are checked for existence, the real merged task output path when available, and remediation text. Usage missing from the provider is reported as `unavailable`, not synthesized as zero. Fusion retrieval additionally fails on non-completed manifests, identity/schema drift, malformed usage/details, invalid UTF-8, or any manifest/result/merged hash or byte-length mismatch; failed/cancelled runs return their preserved terminal error rather than partial output.
 
 ## Parent outcome separation
 

package/docs/tools/fusion_research.md

@@ -147,8 +147,8 @@ The private `fusion_web_fetch` schema is closed: `{url, extract?: 'text'|'markdo
 - vets every DNS answer against the transport classifier, pins the request to a vetted address, and verifies the response socket address;
 - follows at most five redirects, revalidating each hop;
 - accepts only HTML/XHTML, plain text, and Markdown content;
-- caps response bytes at 2 MiB and extracted output at 32 KiB;
-- uses a 60 second deadline;
+- caps response bytes at 4 MiB and extracted output at 32 KiB;
+- uses one 90 second deadline across DNS, redirects, response transfer, and extraction;
 - strips script/style/noscript blocks and extracts text or Markdown with table preservation.
 
 Failures use typed error codes such as `invalid_url`, `unsupported_scheme`, `blocked_address`, `dns_failure`, `redirect_limit`, `redirect_blocked`, `response_too_large`, `unsupported_content_type`, `request_timeout`, `network_error`, `extraction_failed`, and `http_error`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-background-tasks",
-  "version": "2.3.0",
+  "version": "2.4.2",
   "description": "Pi extension for durable background shell tasks, read-only delegated agents, local attested Pi runs, and fixed-purpose Fusion workflows through child Pi processes.",
   "type": "module",
   "license": "ISC",

package/src/core/context/token-budget.ts

@@ -45,7 +45,11 @@ export const TOKEN_BUDGET_SEGMENT_KINDS = [
 ] as const;
 export type TokenBudgetSegmentKind = (typeof TOKEN_BUDGET_SEGMENT_KINDS)[number];
 
-export type TokenBudgetEstimatorScope = 'fusion' | 'delegate' | 'conservative';
+export type TokenBudgetEstimatorScope =
+  | 'fusion'
+  | 'delegate_launch'
+  | 'delegate'
+  | 'conservative';
 export type TokenBudgetDominantByteClass =
   | 'normal'
   | 'dense_ascii'
@@ -526,7 +530,7 @@ function rateSourceWarning(input: {
     return `model is not in the exact calibration backing set for family ${input.family}; using the provable 1.00 B/tok floor`;
   }
   if (input.source === 'delegate_conservative') {
-    return 'delegate scope withholds calibrated rates and uses the provable 1.00 B/tok profile for launch/runtime headroom';
+    return 'delegate launch/runtime uses the provable 1.00 B/tok profile when the prompt or route is below the backed large-prompt calibration domain';
   }
   if (input.source === 'explicit_conservative') {
     return 'explicit conservative scope uses the provable 1.00 B/tok profile';
@@ -569,7 +573,16 @@ function effectiveRateSource(input: {
       ? 'unbacked_model_floor'
       : 'unknown_provider_floor';
     effective = TOKEN_BUDGET_PROVABLE_RATE_X100;
-  } else if (input.scope === 'delegate') {
+  } else if (
+    input.scope === 'delegate' ||
+    (input.scope === 'delegate_launch' &&
+      (input.profile.concrete_known_bytes < TOKEN_BUDGET_LARGE_PROMPT_MIN_BYTES ||
+        (input.allowedInputTokens !== undefined &&
+          Math.floor(
+            (input.allowedInputTokens * TOKEN_BUDGET_DELEGATE_CONSERVATIVE_RATE_X100) /
+              TOKEN_BUDGET_RATE_SCALE,
+          ) < TOKEN_BUDGET_LARGE_PROMPT_MIN_BYTES)))
+  ) {
     source = 'delegate_conservative';
     effective = Math.min(configured, TOKEN_BUDGET_DELEGATE_CONSERVATIVE_RATE_X100);
   } else if (input.scope === 'conservative') {

package/src/core/delegate/artifacts.ts

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
 import { chmod, mkdir, open, readFile, rename, rm } from 'node:fs/promises';
 import { basename, isAbsolute, join, relative, sep } from 'node:path';
 import { canonicalJson } from '../attested-pi-run.js';
@@ -45,8 +46,7 @@ export const DELEGATE_ARTIFACT_NAMES = {
   outcome: 'outcome.json',
   result: DELEGATE_RESULT_PACKAGE_FILENAME,
   childPrompt: 'child-prompt.txt',
-  childStderr: 'child.stderr.txt',
-  childStdout: 'child.stdout.txt',
+  runtimeBudget: 'runtime-budget.json',
   error: 'error.json',
 } as const;
 
@@ -232,11 +232,6 @@ export class DelegateArtifactStore {
     return this.write(DELEGATE_ARTIFACT_NAMES.budgetPlan, `${canonicalJson(plan)}\n`);
   }
 
-  async writeChildStreams(stdout: Buffer, stderr: Buffer): Promise<void> {
-    await this.write(DELEGATE_ARTIFACT_NAMES.childStdout, stdout);
-    await this.write(DELEGATE_ARTIFACT_NAMES.childStderr, stderr);
-  }
-
   /** Commit the run. The rename performed here is the single success point. */
   async commitResult(pkg: DelegateResultPackageV1): Promise<DelegateArtifactRef> {
     const ref = await this.write(
@@ -251,17 +246,23 @@ export class DelegateArtifactStore {
     try {
       return await readFile(this.resultPathAbs, 'utf8');
     } catch (error) {
+      const diagnosticNames = [
+        DELEGATE_ARTIFACT_NAMES.error,
+        DELEGATE_ARTIFACT_NAMES.outcome,
+        DELEGATE_ARTIFACT_NAMES.runtimeBudget,
+        DELEGATE_ARTIFACT_NAMES.manifest,
+      ].filter((name) => existsSync(join(this.rootAbs, name)));
       throw new DelegateError(
-        `delegate result package is not present at ${join(this.rootDisplay, DELEGATE_ARTIFACT_NAMES.result)}; the child produced no committed answer`,
+        `delegate result package could not be read at ${join(this.rootDisplay, DELEGATE_ARTIFACT_NAMES.result)}; no committed answer is available (${error instanceof Error ? error.message : String(error)})`,
         {
           code: 'result_unavailable',
           childCreated: true,
           taskId: this.manifest.task_id,
           artifactDir: this.rootDisplay,
-          preserved: [this.rootDisplay],
-          remediation: [
-            'Inspect child.stderr.txt and error.json in the artifact directory for the recorded failure.',
-          ],
+          preserved: diagnosticNames,
+          remediation: diagnosticNames.length === 0
+            ? ['No diagnostic control artifact exists; inspect the background task merged output if one was created.']
+            : [`Inspect the existing delegate control artifacts: ${diagnosticNames.join(', ')}.`],
         },
       );
     }
@@ -353,6 +354,7 @@ export class DelegateArtifactStore {
       source_call_index: input.sourceCallIndex,
       byte_length: input.payload.length,
       sha256: sha256Bytes(input.payload),
+      content_format: 'opaque_bytes',
     };
   }
 

package/src/core/delegate/budget.ts

@@ -4,7 +4,6 @@ import {
   TOKEN_BUDGET_RATE_SCALE,
   estimateInputTokens,
   knownTextSegment,
-  maxKnownTextBytesForTokens,
   resolveTokenBudgetFamily,
   utf8ByteClassBreakdown,
   allowedInputTokens,
@@ -28,11 +27,15 @@ import {
  * A delegate child is a multi-turn, tool-using agent, so its budget has two
  * distinct phases rather than Fusion's single-shot stage forecast:
  *
- * 1. Launch admission checks the frozen seed, framing, and child system prompt.
- * 2. The runtime governor checks the complete retained input before each call.
+ * 1. Launch admission checks the frozen seed, framing, and child system prompt
+ *    with the same backed family calibration used by Fusion for large prompts.
+ * 2. A separate provable 1 B/token forecast sizes the transcript-growth runway
+ *    used for explicit tool-result spilling.
+ * 3. Runtime measurements are advisory. Package-owned growth is controlled
+ *    before transcript entry; Pi and the provider own live context handling.
  *
- * Nothing here clamps, downgrades, or silently reduces. An input that does not
- * fit is a typed refusal.
+ * Nothing here clips, substitutes, or silently reduces content. Tool bytes that
+ * do not fit the retained-growth runway are preserved as hashed spill artifacts.
  */
 
 /** Output tokens reserved so the child can always finish an answer. */
@@ -54,10 +57,14 @@ export const DELEGATE_DEFAULT_TIMEOUT_SECONDS = 1200;
 export const DELEGATE_MAX_TOOL_RESULT_BYTES = 64 * 1024;
 export const DELEGATE_MAX_TOTAL_TOOL_OUTPUT_BYTES = 64 * 1024 * 1024;
 export const DELEGATE_MAX_ANSWER_BYTES = 4 * 1024 * 1024;
+/** Input runway held back for a final no-tool answer after investigation. */
+export const DELEGATE_FINALIZATION_INPUT_RESERVE_TOKENS = 32 * 1024;
+/** Remaining retained-growth runway at which the child disables tools. */
+export const DELEGATE_FINALIZATION_TRIGGER_TOKENS = 8 * 1024;
 /** Answers at or under this serialize inline; larger ones degrade explicitly. */
 export const DELEGATE_INLINE_ANSWER_BYTES = 48 * 1024;
 
-export const DELEGATE_BUDGET_POLICY_ID = 'delegate-budget-policy-v2';
+export const DELEGATE_BUDGET_POLICY_ID = 'delegate-budget-policy-v3';
 
 export interface DelegateBudgetPolicyDescriptor {
   id: typeof DELEGATE_BUDGET_POLICY_ID;
@@ -68,7 +75,11 @@ export interface DelegateBudgetPolicyDescriptor {
   safety_reserve_tokens: number;
   min_usable_input_tokens: number;
   inline_answer_bytes: number;
-  estimator_scope: 'delegate';
+  finalization_input_reserve_tokens: number;
+  finalization_trigger_tokens: number;
+  launch_estimator_scope: 'calibrated_large_prompt';
+  retained_growth_estimator_scope: 'provable_1_byte_per_token';
+  live_provider_context_owner: 'pi_and_provider';
 }
 
 export const DELEGATE_BUDGET_POLICY: DelegateBudgetPolicyDescriptor = {
@@ -80,7 +91,11 @@ export const DELEGATE_BUDGET_POLICY: DelegateBudgetPolicyDescriptor = {
   safety_reserve_tokens: DELEGATE_SAFETY_RESERVE_TOKENS,
   min_usable_input_tokens: DELEGATE_MIN_USABLE_INPUT_TOKENS,
   inline_answer_bytes: DELEGATE_INLINE_ANSWER_BYTES,
-  estimator_scope: 'delegate',
+  finalization_input_reserve_tokens: DELEGATE_FINALIZATION_INPUT_RESERVE_TOKENS,
+  finalization_trigger_tokens: DELEGATE_FINALIZATION_TRIGGER_TOKENS,
+  launch_estimator_scope: 'calibrated_large_prompt',
+  retained_growth_estimator_scope: 'provable_1_byte_per_token',
+  live_provider_context_owner: 'pi_and_provider',
 };
 
 export interface DelegateAdmissionPlanV1 {
@@ -97,17 +112,22 @@ export interface DelegateAdmissionPlanV1 {
     rate_source: TokenBudgetRateSource;
     byte_capacity_utf8_bytes: number;
   };
-  seed_utf8_bytes: number;
-  seed_multibyte_utf8_bytes: number;
+  child_prompt_utf8_bytes: number;
+  child_prompt_multibyte_utf8_bytes: number;
   system_prompt_utf8_bytes: number;
   system_prompt_multibyte_utf8_bytes: number;
   launch_utf8_bytes: number;
   launch_input_tokens_upper_bound: number;
+  conservative_launch_input_tokens: number;
+  conservative_launch_fits: boolean;
   signed_headroom_tokens: number;
   utilization_basis_points: number;
+  retained_growth_budget_tokens: number;
+  finalization_input_reserve_tokens: number;
   byte_class_breakdown: TokenBudgetByteClassBreakdown;
   dominant_byte_class: EstimateInputTokensResult['rateSource']['dominant_byte_class'];
   estimate: EstimateInputTokensResult;
+  conservative_estimate: EstimateInputTokensResult;
   fits: boolean;
   limits: DelegateLimits;
 }
@@ -167,7 +187,7 @@ export function delegateAllowedInputTokens(route: DelegatePinnedRoute): number {
 
 export interface DelegateAdmissionInput {
   route: DelegatePinnedRoute;
-  seedSerialized: string;
+  childPrompt: string;
   childSystemPrompt: string;
   limits: DelegateLimits;
 }
@@ -176,20 +196,39 @@ export interface DelegateAdmissionInput {
 export function planDelegateAdmission(input: DelegateAdmissionInput): DelegateAdmissionPlanV1 {
   const allowed = delegateAllowedInputTokens(input.route);
   const family = routeFamily(input.route);
-  const seed = utf8ByteClassBreakdown(input.seedSerialized);
+  const childPrompt = utf8ByteClassBreakdown(input.childPrompt);
   const system = utf8ByteClassBreakdown(input.childSystemPrompt);
+  const segments = [knownTextSegment(input.childPrompt), knownTextSegment(input.childSystemPrompt)];
   const estimate = estimateInputTokens({
     family: family.family,
     calibrationBacked: family.backed,
     familyResolution: family.resolution,
     allowedInputTokens: allowed,
-    scope: 'delegate',
-    segments: [knownTextSegment(input.seedSerialized), knownTextSegment(input.childSystemPrompt)],
+    scope: 'delegate_launch',
+    segments,
   });
+  const conservativeEstimate = estimateInputTokens({
+    family: family.family,
+    calibrationBacked: family.backed,
+    familyResolution: family.resolution,
+    allowedInputTokens: allowed,
+    scope: 'conservative',
+    segments,
+  });
+  // `conservativeEstimate.tokens` intentionally uses the shared estimator's
+  // calibrated multibyte diagnostic rate. The counter-forecast published as
+  // "provable" must instead use that estimator's explicit 1 B/token ceiling
+  // for multibyte bytes as well as normal/dense bytes.
+  const provableConservativeLaunchTokens =
+    conservativeEstimate.advisory.input_tokens_if_multibyte_used_provable_ceiling;
   const byteCapacity = Math.floor(
     (allowed * estimate.rateSource.effective_rate_bytes_per_token_x100) / TOKEN_BUDGET_RATE_SCALE,
   );
-  const launchBytes = seed.bytes + system.bytes;
+  const launchBytes = childPrompt.bytes + system.bytes;
+  const retainedGrowthBudget = Math.max(
+    0,
+    allowed - estimate.tokens - DELEGATE_FINALIZATION_INPUT_RESERVE_TOKENS,
+  );
   return {
     schema_version: DELEGATE_BUDGET_PLAN_SCHEMA_VERSION,
     policy: DELEGATE_BUDGET_POLICY,
@@ -204,17 +243,22 @@ export function planDelegateAdmission(input: DelegateAdmissionInput): DelegateAd
       rate_source: estimate.rateSource,
       byte_capacity_utf8_bytes: byteCapacity,
     },
-    seed_utf8_bytes: seed.bytes,
-    seed_multibyte_utf8_bytes: seed.multibyteBytes,
+    child_prompt_utf8_bytes: childPrompt.bytes,
+    child_prompt_multibyte_utf8_bytes: childPrompt.multibyteBytes,
     system_prompt_utf8_bytes: system.bytes,
     system_prompt_multibyte_utf8_bytes: system.multibyteBytes,
     launch_utf8_bytes: launchBytes,
     launch_input_tokens_upper_bound: estimate.tokens,
+    conservative_launch_input_tokens: provableConservativeLaunchTokens,
+    conservative_launch_fits: provableConservativeLaunchTokens <= allowed,
     signed_headroom_tokens: allowed - estimate.tokens,
     utilization_basis_points: utilizationBasisPoints(estimate.tokens, allowed),
+    retained_growth_budget_tokens: retainedGrowthBudget,
+    finalization_input_reserve_tokens: DELEGATE_FINALIZATION_INPUT_RESERVE_TOKENS,
     byte_class_breakdown: estimate.byte_class_breakdown,
     dominant_byte_class: estimate.rateSource.dominant_byte_class,
     estimate,
+    conservative_estimate: conservativeEstimate,
     fits: estimate.tokens <= allowed,
     limits: input.limits,
   };
@@ -226,17 +270,15 @@ function rateWarningText(rateSource: TokenBudgetRateSource, qualifiedId: string)
 }
 
 function requiredByteReduction(plan: DelegateAdmissionPlanV1): number {
-  return Math.max(
-    0,
-    plan.launch_utf8_bytes -
-      maxKnownTextBytesForTokens({
-        family: plan.route.family,
-        calibrationBacked: plan.route.rate_source.backed,
-        familyResolution: plan.route.rate_source.model_resolution,
-        allowedInputTokens: plan.route.allowed_input_tokens,
-        scope: 'delegate',
-      }),
-  );
+  const variableTokens =
+    plan.route.allowed_input_tokens - plan.route.rate_source.affine_f_tokens;
+  const maximumBytes = variableTokens <= 0
+    ? 0
+    : Math.floor(
+        (variableTokens * plan.route.rate_source.effective_rate_bytes_per_token_x100) /
+          TOKEN_BUDGET_RATE_SCALE,
+      );
+  return Math.max(0, plan.launch_utf8_bytes - maximumBytes);
 }
 
 /**
@@ -249,7 +291,7 @@ export function assertDelegateAdmission(plan: DelegateAdmissionPlanV1): void {
   if (plan.fits) return;
   const overage = plan.launch_input_tokens_upper_bound - plan.route.allowed_input_tokens;
   throw new DelegateError(
-    `bg_delegate seed does not fit the pinned route before launch. Route ${plan.route.qualified_id} allows ${String(plan.route.allowed_input_tokens)} input tokens; the frozen seed plus the child system prompt measure ${String(plan.launch_utf8_bytes)} UTF-8 bytes (<= ${String(plan.launch_input_tokens_upper_bound)} input tokens), over by ${String(overage)} tokens. Estimator family ${plan.route.family}, source ${plan.route.rate_source.source}, backed=${String(plan.route.rate_source.backed)}, dominant_byte_class=${plan.dominant_byte_class}, rate ${String(plan.route.rate_source.effective_rate_bytes_per_token_x100)}/100 B/tok + ${String(plan.route.rate_source.affine_f_tokens)} tokens.${rateWarningText(plan.route.rate_source, plan.route.qualified_id)} Required reduction is at least ${String(requiredByteReduction(plan))} UTF-8 bytes. No child process, child session, or artifact was created. Nothing was clipped, dropped, or substituted.`,
+    `bg_delegate child prompt does not fit the pinned route before launch. Route ${plan.route.qualified_id} allows ${String(plan.route.allowed_input_tokens)} input tokens; the exact child prompt plus child system prompt measure ${String(plan.launch_utf8_bytes)} UTF-8 bytes (<= ${String(plan.launch_input_tokens_upper_bound)} input tokens), over by ${String(overage)} tokens. Estimator family ${plan.route.family}, source ${plan.route.rate_source.source}, backed=${String(plan.route.rate_source.backed)}, dominant_byte_class=${plan.dominant_byte_class}, rate ${String(plan.route.rate_source.effective_rate_bytes_per_token_x100)}/100 B/tok + ${String(plan.route.rate_source.affine_f_tokens)} tokens.${rateWarningText(plan.route.rate_source, plan.route.qualified_id)} Required reduction is at least ${String(requiredByteReduction(plan))} UTF-8 bytes. No child process, child session, or artifact was created. Nothing was clipped, dropped, or substituted.`,
     {
       code: 'seed_budget_exceeded',
       childCreated: false,
@@ -291,10 +333,13 @@ export interface DelegateGovernorVerdict {
 }
 
 /**
- * Runtime governor decision for one prospective model call.
+ * Advisory runtime measurement for one prospective model call.
  *
- * Pure and total, so the child guard can call it from inside a hook with no
- * possibility of throwing where a throw would be swallowed.
+ * This deliberately uses the calibrated large-prompt policy and never decides
+ * whether transport may occur. Fusion's BUG-185 proved that a package-local
+ * estimator must not reject a live provider payload by subtracting hypothetical
+ * output. The delegate child uses this result for evidence and graceful
+ * finalization while proactive spilling controls package-owned growth.
  */
 export function evaluateDelegateRuntimeBudget(
   measurement: DelegateRuntimeMeasurement,
@@ -307,7 +352,7 @@ export function evaluateDelegateRuntimeBudget(
     calibrationBacked: family.backed,
     familyResolution: family.resolution,
     allowedInputTokens: allowedTokens,
-    scope: 'delegate',
+    scope: 'delegate_launch',
     segments: [
       {
         kind: 'known_text',

package/src/core/delegate/launch.ts

@@ -380,7 +380,9 @@ export function buildDelegateChildSystemPrompt(seedPathHint: string): string {
     '',
     'You are inspect-only. You can read, search, and list files. You cannot run shell commands, edit or write files, reach the network, or start further delegates. Do not claim to have done so.',
     '',
-    'If a tool result is replaced by a spill receipt, the complete bytes are on disk and nothing was truncated. Use delegate_read_artifact with an exact offset and length when you genuinely need them.',
+    'If a tool result is replaced by a spill receipt, the complete encoded content is on disk and nothing was truncated. Use delegate_read_artifact with an exact offset and length when you genuinely need lossless base64 bytes, then interpret them using the receipt content_format.',
+    '',
+    'The child controls retained context by spilling tool results before they consume protected final-answer runway. A spill is not a failure. If a finalization-runway notice appears, all investigation tools are finished: stop investigating and answer immediately from the evidence already gathered.',
     '',
     'Finish with a single, direct, self-contained answer to the directive. Your final assistant message is the answer that will be returned to the parent.',
   ].join('\n');
@@ -468,7 +470,7 @@ export function preflightDelegateLaunch(input: DelegatePreflightInput): Delegate
     route: input.route,
     // The seed reaches the child inside its prompt, so the admission forecast
     // must measure the prompt that is actually sent, not the seed alone.
-    seedSerialized: childPrompt,
+    childPrompt,
     childSystemPrompt,
     limits,
   });

package/src/core/delegate/result-package.ts

@@ -247,6 +247,21 @@ function parseAttestations(
   });
 }
 
+function parseSpillContentFormat(
+  value: unknown,
+  taskId: string,
+): DelegateSpillReceipt['content_format'] {
+  if (value === undefined) return undefined;
+  if (
+    value !== 'single_text_utf8' &&
+    value !== 'tool_result_content_json_v1' &&
+    value !== 'opaque_bytes'
+  ) {
+    fail('delegate spill receipt content_format is invalid', 'child_result_invalid', taskId);
+  }
+  return value;
+}
+
 function parseSpillReceipts(value: unknown, taskId: string): readonly DelegateSpillReceipt[] {
   if (!Array.isArray(value))
     fail('delegate result package spilled_artifacts must be an array', 'child_result_invalid', taskId);
@@ -264,6 +279,7 @@ function parseSpillReceipts(value: unknown, taskId: string): readonly DelegateSp
       source_call_index: requireInteger(entry, 'source_call_index', taskId),
       byte_length: requireInteger(entry, 'byte_length', taskId),
       sha256: requireSha256(entry, 'sha256', taskId),
+      content_format: parseSpillContentFormat(entry['content_format'], taskId),
     };
   });
 }

package/src/core/delegate/runner.ts

@@ -160,6 +160,7 @@ export async function prepareDelegateLaunch(
       budget: {
         family: preflight.plan.route.family,
         rate_source: preflight.plan.route.rate_source,
+        conservative_rate_source: preflight.plan.conservative_estimate.rateSource,
       },
       extensionMode: input.extensionMode,
       autoDeliver: input.autoDeliver,
@@ -200,6 +201,9 @@ export interface EvaluateDelegateTerminalInput {
   /** Terminal status observed by the background task registry. */
   taskStatus: 'completed' | 'failed' | 'killed';
   taskError: string | undefined;
+  /** Real merged child output owned by the background-task registry. */
+  taskOutputPath?: string | undefined;
+  taskOutputAbsPath?: string | undefined;
 }
 
 /**
@@ -251,6 +255,21 @@ async function adjudicateDelegateTerminal(
       recorded?.message ??
       input.taskError ??
       'the delegate child exited without committing a result package';
+    const preserved = ['seed.json', 'budget-plan.json', 'child-terminal.json', 'runtime-budget.json']
+      .filter((name) => existsSync(join(input.artifactDirAbs, name)));
+    if (
+      input.taskOutputPath !== undefined &&
+      input.taskOutputAbsPath !== undefined &&
+      existsSync(input.taskOutputAbsPath)
+    ) {
+      preserved.push(input.taskOutputPath);
+    }
+    const diagnosticTargets = preserved.filter(
+      (name) => name === 'child-terminal.json' || name === 'runtime-budget.json' || name === input.taskOutputPath,
+    );
+    const diagnostic = diagnosticTargets.length === 0
+      ? 'No child terminal record or merged task output exists; inspect the preserved launch artifacts listed above.'
+      : `Inspect the preserved diagnostic evidence: ${diagnosticTargets.join(', ')}.`;
     const error = new DelegateError(
       `bg_delegate produced no committed answer: ${detail}`,
       {
@@ -258,9 +277,9 @@ async function adjudicateDelegateTerminal(
         childCreated: true,
         taskId: input.taskId,
         artifactDir: input.artifactDirAbs,
-        preserved: ['seed.json', 'budget-plan.json', 'child.stdout.txt', 'child.stderr.txt'],
+        preserved,
         remediation: [
-          'Inspect child.stderr.txt and child-terminal.json in the artifact directory.',
+          diagnostic,
           'No partial answer is returned; nothing was truncated to look like success.',
         ],
       },