ouroboros/docs/architecture/06-agent-core.md

# 6. Agent Core

This chapter maps execution and cognition inside a worker: task lifecycle, tools, context fitting, safety and runtime mode, reviews, delegated custody, planning, deep self-review, reflection, memory and project focus, skills, external tools and budgets. Pooled tasks and direct turns, including consciousness wakes, enter `OuroborosAgent`'s tool loop (`loop.py`); reviews and post-task operations use separate executors. Shared contracts do not make these paths one loop.

### Task lifecycle

A queued task enters through a reviewed transport, is admitted by the supervisor queue (§5) and runs in `OuroborosAgent`; each direct-chat turn runs on its own in-process agent, tracked by the process-local `DirectActivityRegistry`, and creates no `PENDING`/`RUNNING` queue record (§3). The root pipeline (`agent_task_pipeline.py`) captures the task contract and immutable context core, runs the loop, preserves a delivery candidate, stores the result (`task_results/<id>.json`, every write stamped `_schema_version: 1`; an unstamped, future, malformed or retired-key row is quarantined by `task_result_schema.py` with its id kept occupied) and artifacts, emits lifecycle and usage evidence, performs the root-only post-task work (`post_task_synthesis.py`, checkpointed by `post_task_checkpoint.py`) and publishes the typed outcome. Queue admission proves only that asynchronous work was durably accepted; completion, objective satisfaction, artifact finality, verification and review acceptance remain separate facts. The loop's tally rides `loop_outcome.usage` while the top-level `total_rounds`/`prompt_tokens`/`completion_tokens` are the ledger's answer (`reconstruct_task_cost`); an internal exception is `failure.kind = "runtime"`, never a fabricated provider failure, and a capture the crash lost is reported unknown, never as zero counters.

The separate review and post-task executors (`review_execution.py`, the post-task pipeline) use the same evidence and context contracts. `supervisor/cognitive_operations.py` tracks in-flight LLM, review, VLM and tool work as typed `cognitive_operation` leases for the idle rail; deadlines, budgets, cancellation and absolute ceilings remain independent.

Between the sends of one loop execution the transcript is append-only — each send a prefix extension of the previous — because OpenAI-family caches reuse a request only when it is a byte-prefix of the next, so a replaced tail or a rewritten earlier message discards the whole conversation cache. `transcript_prefix.py` records and never blocks: `unsent_in_previous_send` allows `_append_or_merge_user_content` to merge only a tail absent from the last observed send; an absent slot or missing observation means unknown, so the producer appends a new row, compaction seams stamp `sanction_rewrite`, and a break is the `prompt_prefix_break` checkpoint fact (`kind` = `system_rewritten` | `tail_replaced` | `rewritten` | `shrunk`, plus `sanctioned_by`; a context-fit reprojection after a real overflow is an ordinary break). The observation follows a usable ordinary model response; it is not a ledger of every physical send, and existing image eviction is unchanged. A `FINAL ANSWER:` line is latched every round as the latest typed candidate, so review, nudge and forced-finalization paths never erase a structured answer; marker prompting is gated on `task_contract.answer_protocol="final_answer_line"` (`answer_protocol_active`) while the latch and extractor stay unconditional, and `outcomes.extract_final_answer` refuses the outcome-tier ledger identifiers as answers — internal enum vocabulary is never a deliverable.

`model_execution` is a compact projection of the last ordinary solve response the loop accepted (text or tool calls), selected from marked `llm_call_refs`; it keeps the initially requested model/local route, the route used and the provider's own label separate, and empty responses, forced finalization, review and post-task calls cannot replace it. Result, terminal frame, history and card share it without changing dispatch or claiming final-answer authorship; the terminal `task_summary` keeps it when the full result ages out, and a current result or live card outranks that fallback. After tool work, host-driven fallback or model-wait model changes record an authoring handover. The successor's first tool-less response gets one recovery round with delivery-control JSON held; a second yields `execution=degraded` and `authoring_handover_incomplete`. Ordinary no-tool turns and explicit model changes stay unchanged. Verification and skill checks still run; later tools clear only this warning, preserving incident and recovery history. Each handover gets one recovery prompt under ordinary stop, deadline and budget limits.

`DeliveryCandidate` is retained before verification or review so a later notice, reviewer failure, deadline or provider outage cannot erase a useful answer. `outcomes.py` combines the execution, objective, review, artifact and child-absorption axes without converting one into another — the terminal custody overlay (`outcomes.custody_debt_axes`) is an instance of that rule, not an exception; verify-before-done receipts and exact artifact references are host-attested evidence, and declarations or answer prose are no substitute. Individual failed tool calls alone do not degrade a delivered answer: unresolved calls retain their typed signal/exit evidence in `execution.unresolved_tool_errors`, cosmetic errors keep their separate bucket, and either kind adds `residual_tool_errors_without_review` when the canonical objective is `not_evaluated`, including after delivery/child-state normalization. Host acceptance or qualified Advisory author completion establishes objective success; unresolved FAIL/DEGRADED verdicts, empty or failed execution, provider failure, deadlines, incomplete delivery, deferred children and failed artifact verification keep their own outcome rules. A forced exit may publish the best current candidate only with its typed rail and evidence-freshness disclosure, and lifecycle may remain `completed` while the objective or review axis records a best-effort or unaccepted result. Custody debt heals from the write side while the stored `reason_code` may not be rewritten, so the owner-facing Reason line resolves the code at RENDER time — the custody warning only while the row's own `delegated_runs_unreconciled` list is non-empty, else the execution reason, both when both are real; a healed debt is never restored, and the debt is a warning beside the rail cause, never a replacement for it — as is every standing limitation of the same answer (deferred child results; a plan review still open at delivery, worded by the outcome class recorded on `execution.plan_review` when there is one), which the normal rail types on the result exactly as the forced rails do, so one clause per fact reaches the card, the durable row and Ouroboros's own memory.

Host plan/orphan disclosures ride beside the model answer as `terminal_host_notice`; delivery sends the model answer alone and the disclosure stays a field of the result (an owed pre-upgrade notice row still replays as the untyped System row it was), and the custody audit is its own typed row (`terminal_custody_notice` on the send event → `system_type="custody_notice"`, `card_row="timeline"`, its own owed delivery id), so the open-delegation fact is a row of the task's card and the unreconciled-runs note never enters the assistant text. CLI gets one host-labelled status (`terminal_host_notice_text`); external Presence speech excludes host notices (chapter 12). Stored answer bytes do not change: the answer keeps its hash and its real PASS or FAIL when only the notice changes, and equal text cannot revive a superseded verdict. Every reader that hands a result on — synthesis, parent handoff, `get_task_result`/`wait_task`/`wait_tasks`, the `task:<id>` plan-evidence reader — carries the notice as a separate field, and the child-result and plan-evidence hashes include it, so a changed child limitation invalidates an old parent disposition or an old review. A host-salvaged terminal is labelled, not hidden: the durable row carries `Preserved intermediate output (not a final answer):` plus the bounded excerpt every terminal row uses, the untruncated copy stays with `get_task_result` and the stop receipt, and only a row written to the chat the stop receipt itself reached (`cancel_receipt.delivered_chat_id`, recorded after a successful send) reduces to its label beside the pointer; the two durable writes are not atomic, and no writer trades its only pointer for the label. One event is disclosed once, at the layer that owns it: the forced orphan note leaves a child to its own terminal row only where that row reached the reader the note addresses, and a rail that ended a routing turn is named by that turn's own row, never inferred from another layer's stamp.

The delivery-control protocol is resolved here and only here (DEVELOPMENT keeps the rule and points here). The candidate carries sticky loop-local provenance that its lineage has seen a host-issued delivery-control episode; without one, exact JSON is ordinary text. In a marked lineage both the ordinary and the forced resolver intercept recognizable whole-body envelopes and balanced trailing protocol attempts — valid `keep` resolves to the retained candidate, valid `replace` to `full_answer`, anything malformed preserves the retained candidate. Both strip one whole-body fence and treat a balanced protocol object at the very END of prose as a protocol attempt (`utils.extract_trailing_json_object` + `loop_delivery._parse_delivery_control_body`); the trailing-object rule deliberately refuses substring scanning, because quoted protocol literals mid-prose are legitimate text, so a control object quoted mid-prose stays prose and a truncated trailing fragment remains prose. During an ordinary acceptance continuation, `finalization_control="acceptance_feedback"` makes a complete revised answer ordinary prose and keeps `keep`/`replace`/`pending_review` optional. Prose resets the pending-review choice to `wait`; it never means `finish`. An outstanding effect, owner-revision or child-action control retains its stricter rule, and unread owner source still requires acknowledgement. Empty or recognizable malformed control bodies retain the candidate rather than becoming its replacement. The ordinary resolver takes one repair round then degraded-preserve; the forced resolver resolves purely and never re-loops — malformation preserves the retained candidate with the typed `delivery_control_degraded` reason, which is this forced rail's own code, while the ordinary repair path records `invalid_delivery_control_after_repair`. Every degradation carries the cause it computed: `outcomes.derive_loop_outcome` falls back to `delivery_control_degraded` only for a degradation that reports no cause and publishes the `loop_outcome.degraded`/`degraded_reason` pair the benchmark ledgers read. A malformed attempt in a marked lineage never leaks JSON, even after the transient latch clears. Presence forced calls (turn or root, not ceiling-only child) always arm `presence_finish`; original bytes reject duplicate keys (chapter 12).

The child-absorption gate is an action gate: while undispositioned direct children remain, the loop HOLDS the candidate (`child_absorption_or_revision_required`) instead of arming the JSON-only control instruction — the hold-vs-arm split exists so the model never receives two contradictory instructions in one round. A typed keep cannot close the gate; after the one bounded reminder it forces the best-effort `children_unabsorbed` rail with a current `id [status] sha256` listing. The absorption digest's `## child` header carries the child's typed custody debt (`delegated_runs_unreconciled`, bounded, with a `get_task_result` pointer) as visibility only — the parent's authority over that patch is exactly the orphan rule, and a child's debt never relabels the root card (DESIGN §4). Finalizing over an UNDISPOSED OWN delegated patch is deliberately NOT gated: the consequence is disclosed where the decision is made (the `integrate_delegated_patch` schema, the apply receipts) and lands as the additive Done-with-warnings custody overlay rather than a hold; a pre-finalization reminder and propagation of child custody debt into the acceptance-subtree snapshot remain disclosed deferred gaps.

Provider death is the one forced rail that is NOT a best-effort completion: it salvages the best available text but stamps `infra_failed`, so the task terminalizes `failed` with the typed `provider_unavailable` reason and an immediate "provider outage — NOT completed" owner notification; a waited-out transport outage reaches the same rail through its deterministic no-resend branch (`transport_unavailable_no_resend`, or `provider_outcome_unknown_no_resend` when the round still holds a transport-death repeat record). The rail makes its one forced model call only while a call can still land: a transport that spent its same-model retry wall stamps `_llm_retry_wall_exhausted`, a no-call gate beside `context_overflow` and `provider_outcome_unknown`, so the forced rail never re-pays a second retry window over a proven-dead provider (disclosed residual: the marker is a last-invocation bool on the shared usage dict). Terminal delivery preserves producer authorship: `terminal_provider_notice` is host presentation beside the raw result, and receipts and secondary System incidents carry the wait duration, finalization cause and unknown-outcome warning and never recommend a blind rerun. Every forced rail stamps one closed-vocabulary producer word at the single forced-finalization sink: `model_final` for complete model text (host-authored notices stay separate), `host_notice` for host-written terminal text (an owner System row, never automatic external Presence speech), and `host_salvage` only on the provider-death rail, where managed/direct delivery replaces the text with the enriched outage receipt and the full bytes stay in task details. Missing origin stays unknown; `agent.py` resets it on host text replacement. Presence synthesis seals the recorded adapter body and internal result separately (chapter 12), never a delivery receipt.

Finalization controls are typed owner-mailbox entries, not injected owner prose. The supervisor may request one bounded tool-less answer, salvage the last persisted assistant text, and retain a full canonical copy when a preview would truncate it. A grace episode has one durable control and can be revoked atomically when the task itself resumes; descendant activity does not count as the task's own progress. A process that cannot be killed remains visibly running, and custody checks prevent another runtime instance from reaping work it does not own.

Disclosed cancel-lifecycle residuals (deliberate): a cascade over a tree with no resolvable lineage chat whose typed handoff-row append ALSO fails still settles; an empty-intent release can add liveness noise to a foreign claim's forensic trail (bounded by the generation fences); cascade postcondition timing can flake under heavy load (the watchdog re-feeds — one retry, never a lost teardown); and the cost projection of a task whose delegated runs stayed open may read `cost_usd=0`/`cost_final=true` while a run is still live — the disclosure line names the open runs.

#### Task acceptance

Host-enforced task acceptance is a root-owned completion coach, not the P3 commit gate. `off` disables it; `auto` and `required` review observable effects, typed deliverables/criteria, and an explicit root `task_acceptance_review` nomination, read-only research included. Queue membership alone does not qualify; ordinary conversation, exploration or cognitive-memory updates alone do not qualify in `auto`, and no prose or tool-count classifier decides their meaning. Child reviews remain advisory evidence superseded by the root decision.

The explicit call nominates the complete ready result and returns `deferred_to_host_acceptance`, `authoritative=false`; after the whole tool-result block the host advances the same acceptance operation ordinary final delivery uses, and early feedback does not seal the task. Main authors the effective criteria; the paid subject is result bytes, criteria and material effects, so a status question preserves a running review while a new criterion can buy review of unchanged text. A reviewer panel is advice for its author, never a signature on bytes the reviewers did not read: the wave wakes the original Main through the mailbox at its quorum and again when the last slot settles, each wake carrying each reviewer's own verdict (`acceptance_settlement.announce_acceptance_settlement`). The optional answer control is prepared before either ready-feedback shortcut, so a settled panel or queued wake skips parking without losing control provenance. Mailbox readiness is distinct from owner authority: transport and waits wake for all entries, while acceptance source capture, acknowledgement and final sealing use the drain's typed owner/control boundary; system, descendant, independent-task and peer-task messages alone imply no owner revision, while owner/principal messages, quiz answers and typed owner controls keep their handling. Only a still-pending panel may park the turn; `acceptance_settlement.awaited_panel_has_settled` lets the next round, control repair included, run once it settled. Final delivery without re-nomination uses the same task-panel feedback whether ready or pending; delivered feedback stays on its exact `review_runs` row, never in phantom pending state. For a pending panel Main waits (the default; the only option under blocking; Cyber Pro: Main's final response is its decision) or consciously finishes through the delivery control's `pending_review` key; a panel that settled PASS on the earlier revision accepts the task on the reviewers' word (`previous_revision_accepted`, said on the owner row) only when nothing but the answer text changed — same owner source, criteria and material evidence — while a changed subject or any other settled verdict hands delivery to the ordinary path with the collected verdicts in its dialogue history. Before a new panel or any capacity refusal, every recorded still-pending panel of the same root is collected at $0 over its recorded request and roster (`review_dispatch.reconcile_pending_acceptance_runs`), so a re-authored subject cannot discard verdicts the tree already bought; they enter the next panel's dialogue history. Stop, missing custody and unfinished work keep their observed outcomes.

The host-collected `repo_diff` uses one bytes capture (`repo_diff_capture.capture_repo_diff`) for preview (`review_evidence_sections.collect_turn_diff`) and source (`artifacts.materialize_repo_diff_evidence`); a legacy partial preview without its capture stays unavailable, never certified by a later read. git writes to a private spool under a real subprocess timeout; memory holds a bounded prefix per section, the rest stays on the spool for retention. Every gap — nonzero exit, timeout, unreadable repository, memory cut, undecodable run — is stated: an unreadable diff is a gap, never an empty (clean) tree. A root PROVEN plain (`.git` and `HEAD` both absent by lstat of the root alone; any entry, even a broken gitfile, or an unreadable or missing root stays Git-required) is `applicable=false`, complete, without a Git call — no baseline, never a clean tree, no `source_unavailable` partial — and its preparation identity is a bounded content hash (files by content, symlinks by target, no traversal, nested `.git` skipped; special, unreadable or over-bound material is unknown); Git retargeting variables are scrubbed and the root's parent is the discovery ceiling, so no foreign repository is captured. Two never-interchangeable identities leave it: the EXACT bytes, streamed into the private observability CAS (`retain_private_capture` → `repo_diff_capture.write_blob_stream`, 0700/0600, host-forensic, never published; a failed retention is disclosed, not implied), and the REDACTED text projection, decoded and redacted WHOLE per section before any presentation cut so no credential straddles a cut (marked diff lines redact by BODY, file headers kept; a PEM block in a hunk is masked WHOLE by the existing `secret_masking` pattern), carried by the packet, the actor-readable `repo_diff_source_ref` and every owner surface. The packet's `repo_diff_capture` publishes applicability, digest, size, gaps and whether raw bytes were retained, never bytes or a handle; readable hunks of binary, non-UTF-8 and mixed patches stay beside located gaps, an undecodable run being a located mark, not content. Git stderr, exception diagnostics, failed or timed-out stdout and bound-cut sections are withheld from public projections (a failed process can end inside a secret) though privately retainable; complete sections and gap metadata are redacted before cuts. Small complete captures are retained privately by `collect_turn_diff`, larger ones by the exact-source consumer (or locally without one); spools are released on projection or later-section failure, and a half-created spool pair closes what it opened.

Local packet preparation failures have their own material identity (`acceptance_preparation.preparation_source_identity`), fixed before packet budgeting, subject hashing or assembly: semantic criteria, canonical receipt content, artifact bytes, child results, service-finalization facts and the repository or plain-folder content inventory — never the paid delivery fingerprint, tool history or indices, repeated writes, staging of unchanged bytes, candidate prose, owner-message counts or exception text. A proven unborn symbolic HEAD uses the empty-tree base; other Git failures stay unavailable. Incomplete or unreadable material is explicitly unknown; lost availability keeps the last known identity, failed attempts and spent retries (a transient unknown never reopens preparation), and size/mtime never certifies equality. Changed material or criteria reopen it; otherwise one more attempt needs an explicit source-bound `acceptance_retry` (`material_change`, `repair_evidence`, `owner_retry`) after the current failed attempt was exposed: the host resolves the current `owner_source_sha256` or an existing verification receipt's exact content (index = locator only), Main judges substance, rationale and basis are no grant identities, a spent source grants nothing again, and a retry beside a terminal author stance is refused. The paid identity is unchanged.

Feedback exposure binds the responding Main request, incident and attempt. Informed Advisory finish or Blocking unfinished stop retains the answer without rebuilding evidence, bound to that attempt, answer and owner acknowledgement with material rechecked; only root auto/required acceptance qualifies, never child/off lanes or outstanding action gates. Reconcile, dispatch and application keep separate stages and paid/unknown custody; preparation failure authorizes no resend. `loop_delivery._delivery_evidence_state` and its `observed_delivery_evidence` reader serve retention, nomination, post-tool, controls, publication, forced exits and stance merge. Failed reads yield UNKNOWN (empty), preserving the last known fingerprint and revision. An answer retained over unknown evidence remains one candidate across unchanged repeats, with keep allowed but no verified subject: `evidence_current=false`, `evidence_status=unavailable_local_preparation`, empty subject hash, unaccepted binding. Unknown subject rebinding revokes current approval; authoritative UNKNOWN cannot qualify for keep. Forced exit preserves text unaccepted with an unreadable-evidence notice. Publication hash failure has the same projection. The host acceptance pass accounts the incident; retention never opens one.

Local decisions carry `origin=local_acceptance_preparation` without rewriting reviewer decisions. Publication follows §10: settlements remain visible; delayed snapshots cannot erase newer warnings or resurrect resolved ones. Binding and admission alone are not dispatch; a processing failure after handoff or around existing custody carries `origin=host_acceptance_processing` beside the real runs, never as fabricated critic findings. The incident rides the existing acceptance decision and `review_projection.acceptance_incident`, panel or none; `derive_loop_outcome` projects an unresolved preparation terminal as unfinished/blocked in Blocking (forced rails included) while Advisory keeps best effort with stronger rails, unfinished stops and earlier critic failures visible. Cards and history show the concise warning and expanded detail (completion stays the only notification); resolution clears the warning, keeps history, and a first-attempt success on repaired material resolves the previous warning under its original incident id and attempt count. The final cause states both the local failure and the terminal rail without inventing reviewer rework.

A completed reviewer from an older plan wave is attached as a historical supplement through the locked task-result writer and exact producer CAS: it never rewrites the original verdict, aggregate, closure, author dispositions or current-wave pointer, settles its historical cost without another cycle, and reaches a terminal parent without a new model turn. Task acceptance has the same twin: a panel that settles after its task is terminal is collected at $0 over the recorded operation, republished on the task's review projection with a host-composed `late_settlement` note (the verdict, the revision it covered, settled after the terminal; honest about a reviewer whose physical outcome is still unknown) and announced once in the task's room as a System row stamped `card_row="reviews"` (`acceptance_settlement.attach_late_acceptance_settlement`, deduped by delivery id) — a timeline item of the card, read by the next turn from chat history; no model turn starts.

Before an eligible panel runs, `supervisor/queue_transitions.py` closes subtask admission under `_queue_lock` (transport: §10 invariant 25) and `task_status.find_child_tasks` proves the subtree quiescent; a fence that refused or never answered buys no model round — the panel runs on the disclosed rail `admission_fence_available=false`. Early settlement releases the fence; final delivery seals ingress by the queue's typed answer (`loop_delivery._seal_admission_before_delivery`: the worker's own earlier seal, a real owner follow-up, or no answer — delivered with `admission_released=false` and, where blocking reviewers approved, noted `admission_close_unconfirmed`); a changed subject reopens review, keeping the earlier one. Reads use the canonical `budget_drive_root`. The reviewer packet carries verbatim owner directives, the full contract and criteria, canonical deliverable identity, terminal child state, verification receipts, artifact references, touched-skill lifecycle facts (visibility, never a gate) and an explicit omissions manifest; a required component that cannot be assembled makes the affected actor `DEGRADED`, never a silently smaller prompt. The packet is SIZED against the quorum's real windows (the `reviewer_window`/`review_synthesis.quorum_input_token_limit` seam the triad and plan review use), resolved once per task so the bytes cannot drift between the binding build and the staleness rebuild. Non-core sections shed through a DISCLOSED ladder — predecessor authority envelope, trajectory tail and its results, artifact previews, agent-supplied evidence, last a diff preview that keeps the durable `repo_diff_source_ref` — each shed a row in `omissions_manifest`. A slot whose window cannot hold the rendered prompt is a typed `$0 not_dispatched` row while the rest of the panel reviews; a packet still overflowing after every shed stamps `__immutable_core_overflow__` naming the oversized sections and refuses the panel without spending. `__unresolved_partial_artifacts__` withholds packet rows only for a tool result whose exact source is genuinely `source_unavailable` (a retrieving row reads the source itself); a budget shed with a durable, actor-resolvable source ref is an omission, never an unresolved partial.

The packet is delivery-conditional; the FULL packet is not. Every triad row reaches the panel as configured (`reviewer_slot_config.triad_delivery_slots`): a packet (`api_chat`) row receives the assembled packet; a retrieving row receives the route-owned work order `acceptance_retrieving.acceptance_retrieving_work_order` writes onto `ReviewRequest.slot_session_tasks` — the same task-stable contract and output contract (`review_execution.review_output_contract` as `policy["output_contract"]`), absolute pointers to the task's ACTIVE workspace (`review_repo_dirs_for`'s subject root, never the governance repo, as `session_root`) and its result, artifacts and receipts, and the packet in the form its delivery can use. An agent-session row gets the FULL packet (its run is unobserved by the host, so the packet is its only attested view) with the disclosure that access outside the workspace is not guaranteed and a refused read is absence of evidence, not of the artifact; a native inspection row gets the packet WITHOUT its freely degradable tail (tool-trajectory rows and artifact previews, manifested as `retrieving_delivery` omissions) plus the real data root (`policy["native_data_root"]`), as its episode reads those sources itself (`host_file_read_attestation: host_observed`). Reviewer `evidence_refs` resolve against the FULL packet on every delivery, never the rendered projection, so a retrieving row citing a real receipt is clean like a packet row. The wave budget gate prices API money only and DECIDES on one work-order send per paid row (a session row rides the owner's subscription, unpriced); that admission is the whole money rule (no rounds multiplier, no second read-only pricing pass), so a panel's cost is bounded at dispatch by the per-send wallet binding, not predicted; only a floor that does not fit is refused `review_wave_budget_insufficient`, and a packet row's second physical send for format repair never buys a retrieving row a second episode or session. Child-task and `off`-mode acceptance stay advisory and run packet rows only.

Paid identity binds that semantic subject together with substantive nonempty obligation dispositions (`acceptance_paid_identity`); forensic source hashes and ingress counters alone do not buy a panel. A resubmit with the same paid identity reuses its recorded verdict for free: a clean replay can authorize acceptance, a non-clean replay keeps its verdict and the `identical_acceptance_refused` outcome — no repeated payment, and no cosmetic edit needed when real criteria or evidence change.

The configured slots are independent actors with adaptive quorum (`config.adaptive_quorum`: 2-of-N for N≥3, both for N=2, a single reviewer as loud `single_reviewer_no_diversity`; a fewer-responded shortfall stays a loud infra quorum failure); each receives one substantive interaction on its bound route — at most two physical sends for a packet row, one bounded episode for a native row, one delegated session for a session row — and a retrieving verdict is equally authoritative. Transport status, parse status, semantic verdict, criterion support, route, quorum contribution and binding hashes stay distinct, so an unavailable or malformed response cannot masquerade as a negative judgment; a panel that refuses before any transport projects `not_dispatched` on every row and on the panel, and a slot released at the dispatch barrier projects `awaiting` for transport and parse until it settles — distinct from `success`, `timeout` and `provider_transport_error`, never a failure or a verdict. `PASS`/`FAIL`/`DEGRADED` are reviewer verdicts; the host-owned completion decision is separately `accepted`, `revision_requested` or `finalized_unaccepted`, written only by `loop_acceptance._set_acceptance_decision`. A clean quorum supplies critic approval; an informed Advisory author finish supplies separate current-author authority. Neither changes the original verdict. Material FAIL and typed unavailable outcomes reach Main before it chooses how to respond, including after the last paid panel; a no-quorum outcome with real minority findings retains that partial feedback. A terminal technical failure keeps `reason=review_degraded` when no permitted author completion follows.

A clean criterion is evidence-resolved, not only well argued: reviewer `evidence_refs` must be exact members of the packet's enumerable reference vocabulary, and a claim id resolves only through `acceptance_support_refs` linked to a passing host receipt for that claim. Agent-supplied, declared-intent, unattested and non-resolving sections never certify success; an OPEN plan wave binds nothing — its claims are disclosed as `acceptance_claims_source='none_open_plan_wave'` beside a non-binding `plan_claims_exhibit` inside `DECLARED_INTENT_SECTIONS`, so citing it never resolves and the task is distinguishable from one that never had claims. An unresolved reference keeps the actor's record for audit but removes its clean contribution (`criteria_refs_unresolved`). This total, fail-closed resolver is why the task cannot certify itself by echoing its expected outcome.

Actionable findings enter the durable obligation dialogue with stable identity: fix, rebut with an evidence-bearing disposition, or ask the reviewers to declare the issue unreachable or a stable disagreement. A re-raise must name an existing obligation id or is disclosed as new; a valid rebuttal retires the row, an invalid one reopens it with both positions preserved, and the reviewer's `reviewer_rebuttal_response` rides into the next panel's catalog so it can tell "already answered" from "never answered". Each panel receives the bounded `acceptance_dialogue_history` OUTSIDE the hashed evidence material — so reading the history cannot mint a fresh paid binding.

Every received review outcome permits ordinary author inspection, correction or rebuttal, including the last finite panel. `loop_acceptance.merge_agent_acceptance_stance` binds `author_action=finish|stop` to the actual outcome exposed in Main's request and its current tool/owner-directive state; only queueing feedback or predeclaring a decision is insufficient. `loop_acceptance_review._finish_advisory_author` permits informed Advisory completion on unchanged or revised work after criticism or disclosed review unavailability, even when paid capacity remains. The current author hash stays separate from the critic hash/verdict. Under Blocking, corrections may be retained and the attempt stopped, but disputed advancement still requires fresh reviewer approval; a later independently initiated task can resume under its own admission, never an automatic root or budget reset. `stop` means unfinished work and grants no approval. The earlier-revision PASS rule for final task-message delivery above remains distinct; it grants no new commit, plan or skill authority. Typed `dialogue_status` votes retain the reviewer's position: invalid votes abstain, material-free continue is `continue_without_findings`, and zero valid votes is `inconclusive`. A terminal opinion may close another critique of that case, but cannot suppress feedback or choose the author's stop. Auto and Required share these enforcement rules once eligible; explicit task-local response limits and real task rails remain. Cyber retains its own BIBLE P0/P3 authority without rewriting verdict, cost or custody.

Pacing predicts no review duration: a task has three host-owned rails — a deadline, a paid-cycle cap and a wallet — and a panel starts iff the cycle cap has room, the wallet can buy one work-order send per paid row, and MORE than the configured floor (`OUROBOROS_ACCEPTANCE_REVIEW_EST_SEC`, never below 200 s) remains above the finalization reserve; that floor applies only to a new critic. Author reaction uses ordinary remaining task time above the existing finalization reserve, budget, cancellation and round limits, without a reviewer-sized floor or adaptive multiplier. The two refusals remain `review_skipped_deadline_reserve` and `improvement_window_inside_reserve` for their respective owners. `task_pacing` owns both predicates (`review_launch_allowed`, `improvement_pass_allowed`); the launch rule is evaluated ONCE per panel, at loop admission before a panel is built — the paid dispatch claim (`review_dispatch.task_acceptance_paid_dispatch_stamp`) checks cancellation and the paid-cycle wallet only, and no other surface evaluates time. That claim is minted in the locked `task_results.task_acceptance_review_accounting` at first physical reviewer dispatch, and a claim without a recoverable terminal host run is UNKNOWN, never permission to re-dispatch — the double-spend fence. Once launched, a review is clamped to the owner deadline and the task ceiling with the per-send money fence: a panel the deadline cuts is a typed DEGRADED outcome, never a free skip. Disclosed residual: a panel whose evidence build consumed the margin after admission still dispatches and may be cut, and packet repair/retry sends and native rounds mean the total is NOT bounded to one floor wave. Panel durations are `task_acceptance_review_timing` telemetry (`delivery`, `deliveries`, `native_rounds`, `native_rows`) that no gate reads back; the structured review axis is mirrored as top-level `review_status`. A revision row names the pass it starts and the causes the wave recorded, never the aggregate word as its own explanation — a DEGRADED wave that still fed an improvement capsule is not the no-quorum terminal that shares the word.

A forced turn sends the round's exact tool envelope — same schemas, same server-web flag — so the provider prefix stays a cache hit; "tool-less" describes the instruction and the host, which executes no call, so a reply that still asks for a tool, with or without prose, is incomplete on every rail and degrades through the host fallback path instead of publishing as the model's final. Every forced rail uses the common terminal recorder; an eligible task with no panel run records an eligible bypass with zero runs and the rail's trigger. No forced rail can take another model round, so a dangling `revision_requested` terminalizes as `finalized_unaccepted` (`revision_unavailable_on_forced_rail`) on EVERY forced rail through one shared helper, naming the prior reason; `accepted` and `finalized_unaccepted` decisions are never overwritten, no bypass reason is stamped over a panel that ran, and the pair stays outside the blocked-terminal set so the objective remains best_effort. The forced `children_unabsorbed` rail still runs the panel for an acceptance-eligible root with a quiescent subtree, with the undispositioned-children debt in its evidence, keeping a forced delivery distinct from both clean acceptance and no-panel-warranted. A superseded panel remains an audit row with its `run_count` intact; `pending_delivery_acceptance` is a transient eligibility, never a terminal state. The root's post-task phases use the minimal `root_phase_checkpoint`: startup replays only a durable `pending_once` phase, and an indeterminate `running` phase is disclosed as degraded rather than replaying paid work. A deadline or late unread message retains unaccepted work rather than claiming a new subject was reviewed.

#### Headless finalization and workspace patch capture

A workspace task's completion compares against the captured preflight base — task-local commits stay in the delta, not `git diff HEAD` — and the patch is bound to `task_constraint.base_sha`; a moved HEAD fails closed only for `self_worktree` (a shared tree relies on reverse-patch verification), and an unborn repo diffs against the canonical empty tree. `workspace_patch_capture.py` streams the tracked binary diff plus admitted untracked files under the pure rules of `workspace_patch_rules.py` (5 MiB per untracked file; `untracked_capture_veto_reason` is the one composite the patch and the delegated-run execution snapshot both ask), excluding each vetoed entry with a per-file reason; otherwise eligible oversized or binary untracked outputs ride complete manifest+zip file artifacts, and tracked files whose old or current size exceeds 50 MiB stay in the same file-reference manifest instead of a giant Git patch. Generated output (`dist/`, `build/`) is governed by the project's own `.gitignore`, honoured through `--exclude-standard`, not by a host name rule — git-ignored files are outside the capture universe and are not listed as exclusions, because a project whose deliverable IS its build output must not have it silently dropped; a sensitive-looking untracked credential is excluded per-file and disclosed as `sensitive_blocked`. `workspace_patch.json` is written for EVERY workspace finalization, no-change and failed included, and is the truth source for CLI strict-patch (it distinguishes omitted, no-op and failed); `workspace.patch` exists only for `ready_with_changes`. A forked or empty child drive under `data/state/headless_tasks/<task_id>/data` is execution state: the result copies back to the canonical root, declared artifacts rebase to `data/task_results/artifacts/<task_id>/`, and once the canonical result is terminal a late copy-back cannot overwrite the parent-owned terminal marker or the cost/round/token fields. The startup prune (`headless.prune_headless_task_drives`, after prior-process custody) removes a child drive only when the canonical parent is terminal, artifact finalization is terminal, retention has elapsed, the recorded child path matches the expected directory and no child-ref promotion is pending — everything needed after deletion must cross the canonical handoff before a task is presented as settled. The capture manifest explains its acting/admission/empty-tree/capture base and current branch/upstream observations; these do not establish task authorship or change application-patch bytes. An auxiliary comparison uses explicit `vcs_diff(base=..., head=...)` inputs rather than guessing a target. The CLI contract stays in §1 CLI / Headless Boundary.

#### Owner routing verbs

`promote_chat_to_task`, `route_to_project`, `steer_task` and `ensure_project_scope` ride one receipt rail: an act succeeds only once its token-matched supervisor facts are durable in the task result, queue snapshot, annotation or mailbox authority; among several possible tasks the LLM chooses, code auto-delivers only the unambiguous one-target case, and an unconfirmed or stale receipt fails visibly instead of launching a second root. Receipts are retained per `(owner message, routing token)`: an earlier act's receipt stays readable by its token (`chat_annotation_receipt`) while the message's latest row is the UI projection and the picker's liveness test. A KNOWN rejection returns `rejected` with its reason, never a timeout, so `UNCONFIRMED` keeps its one meaning: no matching receipt exists. A receipt proves admission, not completion; an unread indicator proves a visible revision, not memory isolation.

WHO is speaking is ONE host-minted fact on the event (`control_routing._routing_issuer`; the model has no argument): an OWNER TURN (a direct turn the owner door stamped: `is_direct_chat` and `run_origin.owner_ingress`) or a TASK speaking for itself (a promoted root inherits the stamp as ancestry, not as issuer; a root relaying an owner message it just drained; a consciousness wake-up, a Presence event or the auto-resume template on the direct lane, which nobody typed — a wake's promotes mint consciousness roots inheriting its origin, ledger category and autonomy level). An owner turn's steer travels as owner text: `[Message from my human]`, the owner corpus, the generation bump that supersedes a reviewed answer, the room veto from the registry lane of the issuing chat (a Project room reaches its own roots, Main every host-listed root) and the owner acknowledgement. A task's own words NEVER travel as owner text: they go through the one task-message writer `forward_to_worker` also uses, as `independent_task` provenance, to any host-listed active independent root (hidden roots included, no room veto; a Presence sender only to its own binding's work, chapter 12), render as `[Message from independent task <id>]`, enter no owner corpus (`owner_source_sha256` and the acceptance premises stay the owner's), carry no attachments, and are confirmed WRITTEN or refused with the host's reason. A relay keys and publishes its acknowledgement on the owner message it drained; other task acts use their own synthetic receipt id without a chat acknowledgement. Neither receipt grants owner authority; author and target ride the receipt and one `task_message_routed` Logs row, and the receiver's `task_message_injected` row names the sender. Independent roots learn the roster from a `[INDEPENDENT_ROOTS]` TAIL note (`peer_roster.py`, `ROSTER_NOTE_CAP` = 40 rows shown, the cut disclosed), appended only when the roster changed and never merged into a sent row. Rows identify live direct conversations without claiming an owner initiator; messaging one is the model's call. A root may publish one bounded `update_focus(text, source_ref)` record, exposed in grouped notes and paginated `live_roots` and retained by `recent_tasks` on dormant results. A `source_ref` names a reader; `update_focus` answers it through that reader under the caller's registry admission (`disabled_tools` included) and retains the exact answer (≤256 KiB) write-once on the canonical root as `focus.source_handle`, a native `task_source` ref peers read from any drive via `get_task_result(include_focus_source=True, focus_source_sha256=…)` against the PHYSICAL author's record: the digest selects the immutable historical file, so no later focus or retry can substitute its evidence (the roster's `retained_source`); a refusing reader or changed snapshot refuses the focus (`FOCUS_SOURCE_UNRESOLVED`), and the roster drops a settled root's focus. Focus has authored time separate from host observation and carries no TTL or owner authority. Explicit authorized project journal/workpad reads return exactly the requested source; foreign scoped writes refuse; children/Presence keep their capability ceiling.

`steer_task` relays the owner's exact ingress bytes only on the turn's FIRST routing act, while it still acts on the message that started it; the window ends with the latest owner message the turn DRAINED (`ToolContext.last_owner_delivery`, stamped at the loop's mailbox drain; a message only written to the mailbox ends nothing) or with a landed promote/route/steer receipt already on the origin message (a refused or unconfirmed act carried nothing, so the next act still relays). Past either, the turn RELAYS its own words and its receipt is keyed on the message relayed (the drained delivery's own client id, else the synthetic `agent-steer:<routing token>` id), never again on an origin this turn already routed. An agent-authored steer belonging to no owner message earns its receipt under that synthetic id, confirmable through the same `routing_wait` poll; no chat row carries the id and the owner message's own receipt (what a later decision turn reads) stands. Each steer's mailbox entry is keyed by its routing token, so several instructions under one origin are several deliveries while a retried emit of one steer stays one.

Every promote/route refusal names its typed reason; producers holding a fact beyond the code (the workspace family, source and attachment staging, persistence failures, the project fence) add `detail`, the cause with its repair (self-explanatory codes such as `duplicate_task_id` or `worker_pool_unavailable` get no prose), and `_persist_promote_rejection` is the single durable writer. `workspace_admission.workspace_repair_hint` composes the workspace repair from the typed source of the refused folder; an empty Project whose genesis provisioning fails is typed `workspace_provisioning_failed` on the promotion path, never a fallback onto the system repo. The exact Ouroboros repository root named as `workspace_root` is the documented default, mapped to the `workspace="none"` sentinel and disclosed; a subfolder of the repository, the data drive and every `/api/tasks`, Presence and `source` caller stay refused, typed. Who is told follows who can narrate: a tool-issued act gets its receipt, error row and `detail`, and the model narrates; a host-issued act (`host_initiated`) gets ONE typed System row (`task_not_started`, or `task_start_unconfirmed` for an unconfirmed admission) in the chat the owner wrote in, from the one publication boundary `_handle_promote_chat_to_task` wraps around every outcome, never a bubble in Ouroboros's voice. A steering refusal whose owner act carries no owner-message receipt uses `steer_not_delivered` through `supervisor/steering.py::_refusal_row`, in the issuing chat. The Project start row is announced only once the task is enqueued. An admitted promote reports the destination the admission receipt returns, not the requested `project_id`/`project_name` (an implicit scope is re-resolved under the origin claim lock, §6 Project binding by task and by origin); a promote landing in a project other than the one the request's work already has says so: promote stays a free choice, disclosed. A promote by a root whose Swarm planning obligation is still UNMET (`force_plan` with no plan wave recorded, `owner_hurry.unmet_force_plan_obligation`) carries the obligation onto the new root and releases the promoter in the admission transaction (`supervisor/plan_obligation.py`), disclosed in the result; a met obligation moves nothing, and `ensure_project_scope` keeps it.

A routing/promote decision turn receives host-built ground truth (each project's registry `working_dir` plus bounded typed projections of the lane's recent ROOT results and live roots, never raw result text) through the registry row's durable `last_task_result_id` pointer, stamped by ROOTS only, with a bounded scan fallback; only the absent-pointer case writes back (a failing non-empty pointer is usually a split-drive result mid copy-back). A swarm child is not offered (reachable through its root) and counts as its own omission instead of evicting a root. The list is a HINT sized by `runtime_limits` and scoped to the lane that receives it (a pooled task holds none and names any id it read through `recent_tasks`/`get_task_result`); the door is the predicate in §10 on the result itself, never on the caller's room or the landing project, and a helper predecessor or a landing outside the predecessor's project is disclosed in the receipt (`_predecessor_notes`), a free choice like the second-project note. `list_projects`, `route_to_project` and the promote receipt read the project registry through the canonical data root, because a task on a forked execution drive never carries `state/projects.json`. A routing receipt on the SAME owner message is a fact, never a ban: a second root stays the model's judgment.

### Tool capability and execution

`tool_capabilities.py` is the SSOT for the tool classes (core, meta, cognitive-memory, parallel-safe, stateful-browser, untruncated, capped-result, reviewed-mutative) and the child allowlists, which remain deliberately narrower principals. `tool_policy.py` chooses the initial capability set; `ToolRegistry` remains the execution authority; `loop_tool_execution.py` owns timeouts, concurrency, live evidence, result handling and mutative ceilings. Ordinary top-level presets share one built-in name surface: project focus changes the default target, while root policy, runtime mode, task-contract disables, credentials, resources, selected-resource bindings and delegated-child profiles narrow independently — a registered or discoverable tool is not thereby callable for a particular target. Nothing disappears silently: lazy discovery returns an explicit capability omission or `CAPABILITY_UNAVAILABLE`; a policy-filtered REGISTERED tool (a contract-disabled extension/MCP name included) is "hidden by policy: <reason>" (`ToolRegistry.policy_hidden_reason`), never "Not found". A name dispatch cannot run gets one answer (`ToolRegistry._name_miss_result`): its typed reason plus the callable names of the ONE namespace it addresses (`tool_policy.tool_namespace`), or above 12 their count and `list_available_tools(namespace=…)`, never another namespace's or a hidden name. `list_available_tools` (`tools/tool_discovery.py`, bound by the loop) reads `schemas()` in every mode; `loaded` is residency, not availability.

Outcome classification keeps policy refusal separate from execution failure, so an expected authority boundary never becomes the task's headline failure: `user_files_path_blocked`, `cwd_blocked` and `artifact_output_undeclared` are typed non-failure surfaces, while a declared output that cannot be registered is the genuine `artifact_output_error`. The identifier register (`tool_result._EXACT_IDENTIFIER_CODES`) applies the same rule: a typed refusal is recorded as a refusal, never as `ok`. It covers the whole routing family (`STEER_REJECTED`/`STEER_UNCONFIRMED`, `PROMOTE_REJECTED`/`PROMOTE_UNCONFIRMED`, `ROUTE_REJECTED`/`ROUTE_UNCONFIRMED`, `ROUTING_UNCONFIRMED`, `NEEDS_MANUAL_TARGET`), so a promote or route that scheduled nothing is never read as a SUCCESSFUL call; a `_REJECTED` result carries its `(reason: detail)`, and the refusal stays visible to the agent (`is_error`) without degrading the execution axis — the host refused, the agent did not fail. File discovery distinguishes a confinement refusal (an error), a failed listing (a failure) and a path holding nothing — a MISS (`LIST_FILES_NOT_FOUND`, a warning beside `DATA_NOT_YET_CREATED`) that leaves the rest of the outcome uncoloured, because the recovery scan credits only a later success on the same target. The delegate tools (`delegate_start`, `delegate_wait`, `delegate_cancel`, `delegate_answer`) reach the same register from the producer side: `delegate_shared._fail` writes the `ok: false` + `host_code` envelope BESIDE the domain payload (whose `reason` keeps its own vocabulary), so every substrate refusal (daemon, ownership, containment, cancel, subscription window) is RECORDED as a refusal, never counted as a successful call — mapped to `TOOL_REPORTED_FAILURE` (never degrading), a malformed call to `TOOL_ARG_ERROR` (degrades, feeds reflection), never to a timeout or a generic tool error — and a terminal run in state `failed` or `cancelled` is a SUCCESSFUL observation of an unsuccessful leaf.

Tool API v2 exposes neutral canonical names directly (`read_file`, `list_files`, `search_code`, `write_file`, `edit_text`, `edit_batch`, `apply_patch`, `run_command`, `run_script`, `verify_and_record`, service tools, `commit_reviewed`, `vcs_*`, `schedule_subagent`, `manage_schedules`, `schedule_followup`, `wait_task`, `wait_tasks`); legacy public names are neither exposed nor translated. `search_code` uses one basename-glob selector, including comma brace alternatives, before ripgrep or the Python fallback reads allowed files; selected-file count and content matches remain separate facts. The file tools share a path-based public ABI; payload-borne paths (`edit_batch` entries, `apply_patch` targets) miss the dispatch seam that rewrites a `path` ARG, so both ends canonicalize through `tool_access.canonical_repo_relative_path` — one normalization contract keeps a guard from judging `repo/BIBLE.md` while the write lands on `BIBLE.md` — and `_ROOT_ARG_REPO_WRITE_TOOLS` is the single set every repo-write fence keys on. `verify_and_record` (`tools/verify.py`) runs the declared check through the SAME pre-execution guards as the process tools — a post-execution check cannot gate a receipt already written — and appends a host-attested receipt to `<drive_root>/task_results/artifacts/<task_id>/verification_receipts.jsonl` (`expected_match`: substring by default, `exact`, `exact_line`, `json_equals`, `bytes_equal`); it reads only public task info, reports an owner-settings change as a typed note and never auto-reverts it (a revert cannot prove causation), and `delegation_zero_run` writes only `incomplete`/`unknown`, after the custody scan proves no open run.

#### Resource roots and physical file identity

Filesystem tool output is self-locating: results use canonical `root:path` labels and `run_command`/`run_script` echo the resolved `cwd`. A direct Project room selects one active physical folder for reads, writes, edits, process cwd, VCS and delegation; governance stays at `system_repo`, and a missing folder keeps its selected address with an availability note, never a fallback to Ouroboros source. Plain folders support ordinary file/process work and directory delegation (`delegate_directory.py`); Git-only snapshot and integration paths fail typed when their target lacks Git. Physical file resolution preserves the requested address: an absolute path inside any selected base normalizes to that base, an absolute path with no root binds to the permitted root holding it, an outside absolute path is refused before `safe_relpath` can turn it into a similarly named file, and the repo basename-prefix, lineage and delegated-artifact read redirects share the resolver guards and handlers use (`ToolContext.repo_path`/`drive_path`). A Docker workspace's mapped backend absolute address (`workspace_executor.map_backend_path`) is accepted only inside `active_workspace`; other roots and unmapped absolute paths stay confined.

`user_files` is the first-class root for user-visible files under the owner's home (the Ouroboros repo and runtime control plane are refused); `task_drive` is task-scoped scratch; `artifact_store` is task-scoped under `data/task_results/artifacts/<task_id>/`, created lazily on a write or output registration, where deliverables written through `user_files` or declared process `outputs` are copied for audit, and a rewritten user-visible file keeps its prior copy under `task_results/artifact_versions/<task_id>/` (§1 tree). `subagent_projects` and `deliverables` grant `read`/`list`/`search` only; a read-only child reads `deliverables` and its lineage's (parent/root, each also on its own non-symlinked headless drive) `task_drive`/`artifact_store`, never a sibling's; a continuation also reads the `task_drive`/`artifact_store` of the one predecessor its contract names (`predecessor_authority.source.task_id`, one hop, read-only; a child carrying the envelope reads it too) (issue #1232); a top-level task writes the Deliverables container through `user_files`. Process admission keeps the original argv and the prepared physical target, and that one binding serves every other authorized destination; command words, script examples and unknown interpreter effects establish no write intent — the selected Safety Supervisor receives the full task source (§6 Safety and runtime mode) — and the post-execution shell audit is observational: no replay, rollback, interpreter or attribution proof. Invalid path-like prose yields no finding. A failed audit adds a bounded diagnostic (typed results record its exception class in `output_audit_unavailable`) while keeping stdout/stderr and completed exit, signal, timeout and runtime facts; it cannot invent a spawn failure or undeclared output. Computed targets stay a disclosed parser limit, not grounds for a new semantic scanner.

#### Credential fence and byte masking

Ordinary-mode protection of credentials, Bible and identity keys on PHYSICAL owner locations, source operands and actual VCS metadata, never on names: ordinary project names such as `tokens.json`, `credentials.json`, `.nojekyll` or `.well-known` do not identify host credential stores, and an owner's input or output is never refused on a SUFFIX or a WORD in a file name — on attachment ingest, on export/Deliverables, on a `user_files` mutation or in the git lanes — beside the exact-name and retained dotenv-tail rules. The enumerated physical owner stores (`credential_shapes.owner_credential_locations`) are the mutation-fence authority; path-selected attachment ingest checks exact credential leaves and credential/control directory components; ordinary `.config`, `Library`, `settings.json` and exact `~/.ssh/config` mutations need no special authority; ordinary git capture adds content evidence (`workspace_patch_capture.pem_private_key_reason`, shared by the patch, the coop checkpoint and the attached-folder snapshot). This is not blanket protection for all credential stores: unlisted locations such as `.cargo/credentials.toml`, `.terraform.d/credentials.tfrc.json` and `.kaggle/kaggle.json` keep ordinary root configuration access, and children keep source visibility for ordinary `auth/`/`tokens/` paths and public PEM certificates. `core_secret_paths.restricted_data_roots` anchors owner/control checks on the child, canonical parent and configured admission roots, shared with vision/media; runtime secret/control entries keep their predicate even inside the project. Reads and searches share ONE byte masker in every scope: restricted repository views mask known token formats and complete PEM private-key blocks while ordinary long identifiers, hashes and source bodies pass, so search and read deliver the same bytes; owner-home output does not mask opaque runs either, and known credential bytes stay masked on delivered views.

#### Web access mechanisms (three distinct paths — do not conflate)

The three web paths differ in who chooses the query, which model reasons, which authority performs the fetch, and where evidence is recorded:

| path | reasoning model | fetch authority | evidence |
|---|---|---|---|
| Main-loop native search (provider server tool, attached only when the main-loop setting allows) | the same solve model decides whether to search; no second model enters the scaffold | provider-side | citations and request counts fold into `llm_usage` and the task's host-attested retrieval fact (context for acceptance, never a criterion by itself); absence means only that this path recorded no search; the provider-side query is not available to the host and is not claimed as logged |
| `web_search` function tool | a provider-backed call can introduce a second model and its own cost | the configured web-search route or a keyless retrieval backend, executed by `ToolRegistry` | arguments and bounded results in `tools.jsonl`; never native-search usage on the answering call |
| Browser tools (`browse_page`, `browser_action`) | the main loop | a local stateful Playwright session that can fetch or act on arbitrary pages | arguments and result previews as tool evidence; browser state and local action semantics are not equivalent to either retrieval path |

For ordinary delegated profiles the URL, route, private-range and control-plane guards apply to local-readonly and acting children alike (target policy: `browser_policy.py`, §6 MCP and browser-facing external tools); a Cyber-effective acting child inherits the selected access while explicit task restrictions remain. A concrete private origin is reachable only through host-established `resource_policy.allowed_origins`: ordinary Main/root scheduling names it in `schedule_subagent`, delegated and external Presence callers can only inherit or narrow it (`tools/control_subagent_spec.py`), and the origin normalizer rejects paths, credentials and wildcards. Of the delegated profiles only a valid acting child may run JavaScript `evaluate`, on its current page; acting children keep the pre-existing shell-to-loopback `/ws` route without WebSocket authentication. This separation is methodological authority: an evaluation or acceptance claim must name the path used.

#### Context fitting, retry, and compaction

`config.get_context_mode()` is the effective Main sizing/rendering source and `config.get_owner_context_mode()` the persistent owner-intent/P3 source; they differ only during the auto-Low compatibility window (`context_mode_compat.py`). `prompts/SYSTEM.md` and `BIBLE.md` are tier-0 and full in every projection (`context_layout.TIER0_ALWAYS_FULL`). In Max, `ARCHITECTURE.md` is full-resident for every Main task class because it is Ouroboros's capability/tools/access map (economy comes from dropping the handbook for external work, never from hiding the map), and `DEVELOPMENT.md` follows the active repository binding: full when the work targets Ouroboros's own body, a visible on-demand pointer for a bound external workspace or an API/CLI/scheduled external surface (explicit `context_requires_development`/`context_requires_self_body_docs` flags override the binding). In Low and Nano BOTH books are replaced by their book navigation (`context_layout.book_navigation`: the authored chapter introductions plus each chapter's heading index with line ranges into the PHYSICAL chapter file, because the composed book exists only in the prompt and an offset into it would address the wrong bytes), and a subagent child receives that navigation of both books in every mode, against BIBLE P1's wording (issue #1026). Disclosed residual: Low and Nano do not consult the explicit per-task `context_requires_self_body_docs` flag, although the per-task requirement should win in either direction (issue #1019).

The one path that trims tier-0 is the local-model overflow compactor (`llm_local.py`, re-exported by `llm.py`): when a local window cannot hold the prompt it replaces every `## ` section outside its keep list with an omission notice — SYSTEM.md sections (hence the prompt's load-bearing floor lives in its preamble) and the knowledge index (the one disclosed exception to the always-loaded index) — keeping Identity, Shared understanding and the dynamic memory sections (Scratchpad included), and raises `LocalContextTooLargeError` rather than truncate silently. Disclosed defect, not design: BIBLE.md's own `## Principle` headings are not on that keep list, so the compactor also cuts the principle bodies (issue #1018).

`context_fit.py` renders Max, Low and Nano projections from one immutable core and measures each ordinary Main candidate on one labelled density basis (`context_fit.estimate_context_prompt_tokens`) against the selected route capacity, while budget reservation keeps RAW chars because over-counting money is the safe direction. Owner Nano uses its compact source view and bounded output target; Low adds an elastic 200K total-context economy target (`context_budget.py`); crossing either target is never a synthetic failure. With unknown capacity, owner Max gets one honest Max call while owner Low or Nano may reclaim toward its known target. Predicted pressure retains the selected document projection and may request one deficit-sized mutable-history pass; only an actual provider overflow authorizes task-local Low, and one same-route semantic recovery is permitted only when the final candidate has the same route, round and response reserve and strictly fewer context-bearing bytes. Owner mode and P3 applicability never change. `context_health.build_health_invariants` runs ONCE per task attempt, so the Health Invariants block is a task-start snapshot; its delegated-run lines are visible to every task but ownership-aware, so a non-owner is never handed a call that structurally refuses (§6 Delegated subagents).

`context_compaction.py` is a requested materializer, not a second threshold, timer or retry authority. The helper-summarized path selects a positive-reclaim prefix of completed assistant-call plus contiguous matching-result units; owner turns and malformed, interrupted or visually opaque units stay verbatim, and an unfinished Anthropic native unit is ineligible. A non-empty selection first writes an exact private checkpoint, then summarizes complete, gap-free hashed map/fold input; independent covered units may apply while a failed unit stays raw, and opaque custody never enters summarizer text. No eligible positive reclaim means no checkpoint, no summarizer call and no transcript mutation; the one route+round latch prevents repeating the same automatic pass.

Main also uses this materializer for an actor-authored working view. At the existing successful-response boundary, after retry/reprepare/fallback and before returned tools execute, `compact_context.record_context_view` retains the canonical source and active schemas; the acceptance observer still sees the separate send projection. `compact_context` can retain exact inspected unit IDs, restore checkpoint sources, or pair an authored note with an explicit `keep_last_n` count. IDs take precedence; note-only keeps raw units, and count-only uses the helper path. Original source bytes remain retrievable, newer owner/tool messages stay untouched, and no helper model rewrites the authored note. The completed tool boundary measures the full proposed messages, schemas and receipt through Main's existing fit arithmetic; estimates are disclosed, not new capacity or economy-target admission gates. Actual overflow retains its existing recovery. Publication updates the view and schemas together; no-op observation leaves cache identity and the live turn unchanged.

Ouroboros stores one provider-neutral, function-shaped conversation. OpenRouter omits the neutral `tool_choice="auto"` while building the physical request, before request-wire identity is bound, so an implicit API default cannot become an unsupported parameter under strict routing. Direct OpenAI agent/tool traffic stays on Chat Completions: `openai_chat_custom.py` translates only the physical copy into Chat custom tools and normalizes returned custom calls back into canonical function calls; the dialect ladder is fixed at custom/function/none (ordinals 1/2/3), only an exact dialect rejection advances a rung, the custom→function control-flow fallback is never learned as a durable dialect action, and the compatibility layer never migrates the conversation to Responses or changes the model/provider/API surface. Direct Anthropic tool turns keep a private route-bound receipt with the complete native assistant `content`, replayed byte-for-byte on the immediately matching same-route continuation and scrubbed on any provider, endpoint, API-surface or model change; opaque values never reach summarizer or public projections. Owner-requested `none` is sent as `thinking.type=disabled`; no guessed legacy `budget_tokens` mapping is invented.

`request_wire_recovery.py` is the single provider-neutral adaptation driver for both exception and HTTP-200 body-error shapes, keyed on one credential-free exact route/profile: only bounded `set_value`, `drop_field` and registered `replace_dialect` actions, at most eight per call. A learnable reactive action becomes durable — the 14-day cross-process store `state/request_wire_compatibility.json` — only when a semantically valid normalized response is bound to the exact settled physical-attempt capture; provider prose cannot switch routes. Disclosure needs only the identity half: the candidate a RETURNED response carried is disclosed as `usage.request_wire` once its capture passes the exact-identity check (`request_wire_attempt.validate_wire_attempt_identity`), because a ledger write that fails after the provider answered cannot unmake which request shape was sent; the finalizer's place on the successful-return path is what proves a response arrived, and money keeps its own authority in the attempt ledger, so an unsettled attempt discloses but never teaches. Disclosures aggregate in order as bounded `request_wire_history` — not the physical-attempt ledger; `state/usage_attempts.jsonl` remains the complete monetary authority. Private custom-argument receipts never enter stored history or public observability.

Retry budgets are failure-class specific: empty/incomplete responses and transient 429/5xx failures may retry the same model with deadline-bounded backoff; auth, quota, permanent bad requests and confirmed oversize fail fast; exhausted compatibility returns to the configured model fallback chain rather than becoming a second router. `LLMClient` keeps leading system messages authoritative and demotes later notices to visibly marked user notices.

Transport failures are classified by physical-attempt custody; each class has its own owner and rails. A REMOTE pre-dispatch failure is `transport_unavailable` (`loop_llm_call.classify_llm_exception`: released custody, $0, on a non-local provider). It takes one physical attempt per call; pacing belongs to the round-level wait episode (`ouroboros/loop_transport.py`), which tries the fallback chain once only when `USE_LOCAL_FALLBACK` makes it local (remote candidates never dial over a proven dead egress), waits (durable `network_wait` events, progress that keeps the idle rail alive, owner-interruptible backoff), then redials the SAME round for free. A managed task waits as long as its existing rails allow — owner deadline minus the dispatch-admission reserve, budget, Stop, absolute ceiling; never a new setting, and `OUROBOROS_TRANSIENT_RETRY_MAX` bounds only transient PROVIDER failures — and its exhaustion is its terminal result. The interactive class (every turn stamped direct-chat: owner chat, Presence turns, consciousness wake-ups) waits the same way but has no queue rails and ordinarily no owner deadline, so its episode is bounded by the task idle timeout (`OUROBOROS_TASK_IDLE_TIMEOUT_SEC`) measured from each episode's entry: it limits idle WAITING only and never cancels in-flight work, the shorter of it and an explicit deadline binds, the durable `ended` detail names the expired rail (`interactive_wait_window_exhausted`, or the deadline's own), and exhaustion emits an owner note alongside the provider-outage terminal. Closing `network_wait` rows exist only for cooperative exits — an external kill, Panic, crash or direct-turn hard stop leaves none — so correlate a confirmed `task_done` or durable terminal result; silence never proves completion.

The mid-flight class is `provider_outcome_unknown`: a dispatched request with no terminal provider fact keeps its unresolved monetary bound and is never resent. A NEW logical request afterwards needs a unique host-attested input, granted per caller class. Ordinary managed tasks and native API children use the upstream-observation continuation (§6 Review delivery), whose wait admits a marked new physical attempt on observed connectivity. A configured-session supervisor with exactly one live delegated leaf latches a durable unknown-provider hold (`ouroboros/delegate_hold.py`, closing any transport episode as `network_wait ended / hold_latched`) and parks in the ordinary `supervised_wait`, resuming in a NEW round only on a meaningful leaf wake whose receipt is that input (control wakes and an ineligible hold grant nothing; budget admission stays fail-closed on the unresolved bound); without a hold it uses the managed continuation. Interactive primary rounds get the bounded transport-death repeat below: no-effect by construction (no Host-executed tool or correspondent action can stem from the failed attempt; priced read-only provider-owned retrieval may rerun; §12), not an event retry. Every other surface — forced-final, fallback-chain candidates, review actors, safety, probes, web search, consolidation/summary/reflection, external-harness delegated runs — keeps no-resend (budget 0, or never enters `call_llm_with_retry`); an unknown outcome not typed as a transport death is never resent.

The transport-death repeat rail: a typed death (`transport_custody.is_retryable_transport_death` — httpx `ReadError`/`WriteError`/`RemoteProtocolError` through the explicit `__cause__` chain, or a requests wrapper carrying `ProtocolError`/`RemoteDisconnected`; never a timeout, a provider status/body error, a pre-dispatch failure, a local provider or a loopback route) lets the PRIMARY main-loop round dispatch alone (`_dispatch_round_model`, `transport_death_retries`) repeat the SAME logical request at most twice per round. Each repeat is a NEW physical attempt with its own ledger row, and the earlier rows stay `unresolved` at their upper bound (a fully dead round reserves up to three: honest accounting over a cheaper rail). A round record (`execution_id:round:round_idx`) counts the repeats and names the class the terminal reports; `llm_non_retryable_same_request` marks only the exhaustion. A current typed `finalize_now` control or the deadline can refuse a not-yet-sent repeat (`finalize_control_pending` names the control case); the round then exits through the unknown no-resend terminal. A round holding a repeat record sends nothing but those typed-death repeats: a repeat failing with any other class ends the round on the same terminal — no transient burst, empty-response retry, compaction retry, forced-final dial, fallback chain or local-only pass — because the earlier request may still be live; only a repeat that never left the host (released custody) stays the free wait episode's to redial, and when that window closes the terminal is still `provider_outcome_unknown_no_resend`.

Retry rails nest, each with its own owner and bound; the table exists so the multiplication is visible in one place (a physical send is always its own `execute_physical_attempt` lifecycle, whichever rail asked for it):

| Rail | Owner | Bound | What it repeats |
|---|---|---|---|
| SDK `max_retries` | client construction (`net_transport.py`, `llm.py`) | 0 everywhere | nothing: every physical send is visible to the ledger |
| request-wire recovery ladder | `request_wire_recovery.py` inside one `LLMClient.chat` | at most eight typed compatibility actions per call | a rejected request in a corrected wire shape |
| transport-death repeat | `call_llm_with_retry`, primary round dispatch only | ≤2 per round, 4 s then 8 s deadline-aware backoff | a dispatched request that died with a typed transport death, as a new attempt |
| transient burst | `call_llm_with_retry` | `OUROBOROS_TRANSIENT_RETRY_MAX` attempts per call (the outer ceiling of the same loop) | typed 408/429/5xx and empty/incomplete responses |
| round redial | `loop_transport.py` wait episode | a managed task: owner deadline, budget, Stop, absolute ceiling; an interactive turn: the task idle timeout measured from episode entry (`OUROBOROS_TASK_IDLE_TIMEOUT_SEC`), or an explicit deadline when that is shorter | a released ($0) pre-dispatch failure of the same round |
| served-model redo | `llm_substitution.py` inside one `chat_claudexor` | `OUROBOROS_SERVED_MODEL_REDOS` per call, and none under a pin, an admitted candidate, a spent send budget or a spent owner window | a round the engine says another model answered, as a new operation. It nests inside the rails above, so a repeat granted by one of them starts a call whose redo budget begins again |
| review physical rail | `review_substrate.py`, `review_native_episode.py` | 2 sends per packet or session actor on the P3/acceptance surfaces; a native-retrieval slot carries no send count (its bounds are the episode's own, enumerated below); no rail elsewhere | a released review send, never an unknown one |

The cached OpenAI-compatible clients, the no-proxy per-call clients and the web-search clients share one transport factory (`net_transport.py`) that sets platform-guarded TCP keepalive socket options — on Linux and Darwin the idle threshold, probe interval and probe count from `config.py` (Darwin: `TCP_KEEPALIVE`, not XNU's 75 s × 8 default), on every other platform (Windows included) `SO_KEEPALIVE` alone — so a NAT/VPN mapping silently dropped during a long silent reasoning stretch is detected by kernel probes instead of hanging until the read timeout. When any proxy httpx would honor is configured, the cached and web-search clients skip the explicit transport (httpx env-proxy mounts require it absent). Disclosed residual: proxy-routed installs, the Anthropic-native `requests` lane, every non-Linux/non-Darwin platform and a handful of library clients run without keepalive tuning.

Main-loop model cognition is a separate typed in-flight fact: immediately before each exact provider-call seam the worker sends a direct supervisor `started` event bound to the exact attempt, execution, round, call and retry, and every terminal sends the matching fact, so a stale terminal from an earlier retry or attempt cannot clear the current row. The supervisor keeps only that process-local active row, with no elapsed-time expiry, consulted only by the idle predicate. `OUROBOROS_LLM_TRANSPORT_READ_TIMEOUT_SEC` (default 2700 s) is a configurable dead-socket bound, not a cognition deadline; deadline, budget, cancellation and the absolute ceiling remain independent hard axes.

OpenAI-compatible response choices keep their outer `finish_reason` as the bounded observational usage fact `response_finish_reason`; it never enters canonical history and changes neither the empty-response classifier nor retry policy. The trusted provider canary accepts a schema-valid native tool call even when the assistant also returns text (length/hash recorded as warning telemetry); a malformed native argument, invalid schema or missing call remains a red contract failure — no prose parser, salvage, provider hop or unbounded retry.

Prompt caching is stable-first: governance and task-stable contracts precede mutable evidence, review builders disclose the stable/dynamic boundary, untrusted payloads stay outside the governance cache block, and `context_fit.seal_task_transcript` owns the single message-side breakpoint (the task-contract boundary until a rolling tool-result seal qualifies, migrated in the same call so the four-breakpoint cap can never drop it). OpenRouter derives its sticky session from stable policy/model and a copied first-user content projection without cache or host-only metadata, so moving a seal in either direction does not change the session. Explicit review affinity and provider-reroute rotation retain their precedence. Provider-specific cache hints are sent only where supported and receive one exact retry without the rejected hint; rejection evidence is durable and route-specific. Gateway response-cache recovery is narrower and reactive: only a main-loop `provider_incomplete_response` arms a fresh-response request for later attempts, and only the generic `openai-compatible` route renders LiteLLM's `extra_body.cache.no-cache` control — direct providers and OpenRouter never receive it, and no URL/model heuristic exists.

#### Vision and local image evidence

`analyze_screenshot` and `vlm_query` are bounded secondary-model calls through `LLMClient.vision_query`; `view_image` attaches a local image natively. Send-time image routing (`vision_routing.py`: inline vision, captions or placeholders) works on a per-send copy and never mutates canonical history. Model-wait reprepare starts from that canonical source, preserves original images and prepares the new route's send projection; a typed invalid native continuation retains its existing reset without replacing the source with captions. Image payloads are validated, capped/downscaled and confined to readable roots derived from the Tool API policy matrix plus the protected-artifact rule. `vision.attach_local_image_to_context` is the single attachment seam for explicit `view_image` and the typed `auto_attach_image` opt-in — same durable copy, trust boundary and live-image eviction budget; auto-attachment failure is non-fatal. The loader's own refusals are typed `TOOL_ARG_ERROR` results (a policy owner's refusal keeps that owner's typed marker), so a known failure is recorded as one. Vision/local-media tools are not web tools and may be withheld by the task contract. The uploads and skill-output roots resolve through the task's canonical data owner and count as independent image admission before user-home confinement, per-path secret/owner-state/project-store/protected-artifact checks still applied; an admitted image is copied into the task's `uploads/views` before same-round attachment, so the original and its retained copy both stay available to explicit readers.

#### Background consciousness and Evolution

Background Consciousness is Ouroboros taking a turn in its own Main chat when nobody wrote to it. There is no second mode: a wake-up is an ORDINARY Main direct turn (`_is_direct_chat`) with the same system prompt, context builder, tool loop, chat log, activity block and usage ledger, so consciousness structurally cannot count its context, its money or its tools differently from Main. Only three things are new: an alarm clock, a wake-up MESSAGE that stands where the owner's words would be (`prompts/CONSCIOUSNESS.md` rendered by `consciousness_wake.py` from existing readers, never silently cut), and the three owner settings beside the existing interval bounds. The alarm (`consciousness.py`) owns no thread: the supervisor pass calls `tick(now)`, whose ordered typed outcomes are disabled → a live wake → a live owner direct turn → not yet due → the rolling-24h allowance (an unreadable ledger is the disclosed skip `allowance_unknown`, never a silent block) → an owner chat must be bound → launch through `supervisor.workers.handle_wake_direct`. The next wake is last finish + interval (`set_next_wakeup` or the default, clamped into the owner's [min, max]; a failed or unadmitted wake doubles it up to max), `notify(reason)` pulls it forward to one shared floor, an owner message never wakes it, and a wake's own finish never re-arms it. Version awareness stays ambient: every task's and wake-up's Runtime context carries `official_update` (running version versus the official target at the last fetching check, plus the update letter, `update_letter.py`); no check forces a wake, and mentioning an update to the owner is the mind's judgment.

The rendered wake message puts the fresh cause and settled facts before outstanding cards. Failed/cancelled or host-authored Presence terminals stay visible even on the direct-turn lane, with their stored outcome, task pointer and deferred work reference; ordinary owner direct turns and the wake's own turn stay excluded. This exposes an external failure without starting another wake or prescribing recovery: consciousness inspects the task and actual delivery through existing tools. Cards in `open` and `expired_terminal` retain late-answer semantics, explicit state, age and bounded preview. `consciousness_last_wake_at` preserves the factual boundary across restart; the best-effort in-memory trigger may fall back to heartbeat.

Observe retains a narrow positive path. `consciousness_authority.OBSERVE_ARGUMENT_NARROWED` is the set of mutating-table names Observe still SEES, because each has a genuine read-only or own-work use that withholding the name would destroy along with the mutation: `schedule_subagent` and `delegate_start` for read-only research, `write_file`/`edit_text`/`journal_write`/`workpad_write` for its own notes, and `cancel_task` for the children it started. What such a name may be ASKED to do is decided by one predicate, `observe_argument_refusal`, which the dispatch guard consults directly — no fail-open wrapper, because a policy that cannot be consulted must not read as permission. It refuses a write root outside `task_drive`/`artifact_store`, a mutative `write_surface`/`may_mutate`, and a delegated session asked for `workspace_write` or a payload selector; an OMITTED access is the read-only shape (`_derive_authority` pins it) and stays allowed. `cancel_task` is the one name whose narrowing needs durable lineage, not arguments, so it rides the tool's EXISTING own-child custody check (`join_ledger._cancel_task`), the same seam a delegated task meets: Observe may stop the children it started, never the owner's running work. A read-only child may delegate further read-only descendants under the inherited depth cap but never passes a mutating delegation budget onward (`delegation_may_mutate`). `manage_schedules` (`tools/followup.py`, beside `schedule_followup` — one module for the two tools over one table) is argument-aware, not name-wide: the root turn may list and change, a delegated task may only list, and a Presence conversation gets neither — Presence authority is not expanded here.

Three facts distinguish a wake-up from an owner's turn, and all three ride its metadata. Its ORIGIN is `metadata.initiator == "consciousness"`, inherited by everything the wake starts: it labels every surface; the wake speaks to other tasks as a task (`[Message from independent task <id>]`), never as the owner, because no owner door stamped it. Its AUTHORITY is the owner's autonomy level (`metadata.consciousness_autonomy`, owned by `consciousness_authority.py`): Observe researches, keeps internal memory/project notes, stops the children it started, inspects and governs existing schedules through the audited narrow surface, and may delegate read-only research, while the dispatch guard refuses owner-file, source, skill/settings and publication writes; Act (the default) is everything the runtime mode allows except editing Ouroboros's own code and prompts, evolution, restart and settings; Full adds evolution. A level has two structural consequences — an exception list in `task_contract.disabled_tools` and a per-task `runtime_mode_cap` of `light` below Full — plus, at Observe, the argument-level narrowing of the names it keeps (`observe_argument_refusal`); for a consciousness-origin task that list binds at DISPATCH ONLY, so the wake's tool schemas and cached prompt prefix stay byte-identical to an owner turn's while a withheld call is refused when it is made: the typed dispatch refusal is the mechanism, and the wake message names the level. The stricter of install mode and cap binds at the repo-mutation, protected-path, `start_service` and shell-write gates, at the acting-child write surface and subagent patch integration, and in a started task's Runtime block, so the owner's level holds even on a Cyber Pro install; a capped tree is refused a self_worktree child and a system-repo patch integration in every install mode, the mutative-subagent toggle included. Its MONEY is one rolling 24-hour allowance covering the wake-ups and every root tree they started, read off the usage ledger (`consciousness_allowance.py`) by the alarm before it wakes and by the ONE admission door (`supervisor/queue.py::enqueue_task`) before any work it asks for starts — no separate "consciousness task" type, only the existing tools through the existing door; a Presence cycle a wake starts (Act and above) is an independent root outside this allowance. What is left of the allowance (capped by the owner's per-task cap) is the wake tree's graceful ceiling (`root_cost_ceiling_usd`, inherited by its members): the in-task stop lands a planning margin before it while the ledger fence stays at the owner's per-task cap, so a wake never dies before its first call; a remainder at or below that margin counts as exhausted.

An active campaign owns an explicit objective, campaign id, transaction and task claim (`supervisor/evolution_lifecycle.py`); `evolution_mode_enabled` is only its scheduling projection. Dispatch, review, commit, publication and restart revalidate that exact authority: a restored row without a live uncommitted claim is cancelled, a reviewed commit binds to the claim by exact SHA before publication, and if authority changes after commit the commit moves to a private inspection ref and any attempt-created tag leaves the normal namespace, without resetting concurrent index/worktree edits; exact terminal replay resumes only incomplete effects, never double-counting. The restart-verify claim (`state/pending_restart_verify.json`; one writer helper serves the supervisor's evolution restart and the agent's `restart` tool) is written whether the supervisor restarts automatically — `OUROBOROS_EVOLUTION_AUTO_RESTART` off skips only the restart — so the owner's manual restart verifies the cycle by exact claim rather than by the weaker markerless reconcile.

Campaign cleanup is deterministic and custody-aware: a no-op or abandoned cycle may restore the transaction base while preserving dirty/ahead work in recorded stash or local refs, and cleanup is skipped when another task, a live test or the operator kill-switch makes reset unsafe. A byte-identical diff whose last terminal is a review-verdict block is refused for free from the first block; changing the diff, or a rebuttal whose content hash is new to the streak, creates a new paid reviewable case, and the shared cycle cap bounds paid triad+scope cycles per root task. Checkpoint and outcome rows (`evolution_checkpoints.py`, append-only) preserve git/memory identity, cost, rounds and explicit omissions so the promotion loop learns from failed and absorbed cycles. An agent-requested restart first drains heartbeat-fresh running tasks up to its configured bound, then fails closed rather than cut another task silently.

Post-task evolution is owner-gated and default-off (`post_task_evolution.py`): the worker may recommend one backlog item by writing a durable request — never enqueuing or enabling evolution itself, and never from an evolution, deep-self-review or subagent task — and only the supervisor's idle tick converts it into one normal campaign cycle. Its CLOSED-objective projection distinguishes absorbed/abandoned objectives from this attempt's typed review-cap or unavailable-review stop: a temporary review block does not permanently prohibit reconsideration. Retained task sources remain discoverable, without scheduling a retry or resetting campaign counters. An owner stop closes the campaign, clears queued requests, persists the `evolution_owner_stopped` flag, and cannot be autonomously reversed. Evolution is hard-blocked in `light` runtime mode at the owner and post-task start entry points, again at idle campaign enqueue, and again at assignment (§5); it uses the normal task/review path in `advanced` or `pro`.

Loop self-checkpoints remain plain user-message reminders: a second structured, tool-less reflection protocol in the hot loop produced unusable records and destroyed cache continuity. The reminder's recent-call list carries each call's recorded outcome and, for a failed call, the first line of what the tool answered — host facts only, no threshold, no repetition verdict and no stop. It is built from `llm_trace.tool_calls`, so name, arguments and outcome come from ONE record: joining the visible transcript to the trace by call id cannot be made sound, because providers reuse ids (GigaChat answers `call_0` every round) while compaction removes whole units from anywhere, so a surviving call was printed carrying an evicted namesake's error — by id, and still by (id, tool) when both calls were the same tool. Without a trace the transcript's calls render with no outcome, not a borrowed one. Durable learning belongs to the post-task reflection flow (§6 Post-task reflection).

### Safety and runtime mode

Tool dispatch uses the registered capability, the explicit task/resource contract and one prepared physical target. Explicit task resources and the actual Git target are host facts, distinct from any semantic judgment about the call; this is not an OS sandbox.

Runtime mode is effective Access and a self-modification ladder. Light refuses mutation of the Ouroboros repository and control plane (`LIGHT_MODE_BLOCKED`; skill payloads under their own root stay editable) while user deliverables outside them remain buildable; Advanced evolves the application layer but not the protected set owned by `runtime_mode_policy.py` — `SAFETY_CRITICAL_PATHS`, frozen contracts, release/managed invariants, one policy shared by the registry, git tools and gateway guards, refusing typed `CORE_PROTECTION_BLOCKED`; Pro may write that set, announced by `CORE_PATCH_NOTICE`, and its commit still passes the normal triad + scope gate. `runtime_mode_policy.mode_has_unrestricted_agency` derives Cyber authority from effective Access; saved next-boot settings never rewrite a running task or a prior request. In Cyber Pro, internal review and Safety findings are advice under BIBLE P0/P3: configured enforcement, independent assessments and the decision to proceed remain distinct facts. Real unavailable resources, malformed executable forms and external errors remain failures, not invented success, and an explicit read-only assignment keeps its meaning.

Process admission preserves the original argv and the resolved cwd. Command words, quoted source examples and unknown interpreter effects are not proof of a forbidden action: `shell_parse.py` and `tools/write_shape.py` supply observed targets and syntax facts, never permission judgments. The Safety Supervisor (`safety.py`) judges each call from the complete retained initial and later owner directives, the task contract, the task constraint and the prepared resource target; the bounded newest-first recent-conversation view (`_SAFETY_CONTEXT_CHAR_BUDGET`, omission marker reserved inside the budget) supplements that source and never replaces it. Coverage is `OUROBOROS_SAFETY_MODE` Full/Light/Off over each tool's `TOOL_POLICY` entry (`skip`, `check`, `check_conditional`; an unknown tool falls to `DEFAULT_POLICY` = `check`): policy-skip tools and established safe conditional subjects make no call in any mode, Light additionally skips conditional checks, Off skips every Supervisor call, and every waved-through check leaves a durable `safety_mode_skip` event. `full → light → off` is a decreasing coverage ladder, so outside Cyber Pro a downward step is owner-only (`POST /api/owner/safety-mode`). A selected assessment runs on the light-model route. No second consent store, appeal pass or repeated execution exists.

Foreground commands, scripts and run-kind verification accept `env_from_settings` through the same Settings-selection authority as service startup. `tools/process_facts.py` resolves references once after admission and masks diagnostics before result and receipt persistence. Foreground execution keeps its inherited environment; Docker transports target values through inert host aliases, so target PATH or DOCKER_HOST cannot reconfigure the host client. Verification matches raw output before masking. Python selection uses the effective child environment without a version probe; wrapper and non-local backend resolution remain unknown when not established. The existing Node health check runs after gates with the selected PATH.

#### Safety Supervisor outcomes

The first line of a Supervisor result is the typed outcome. SAFE passes silently; SUSPICIOUS allows the call with `SAFETY_WARNING`; DANGEROUS, an unrecognised status, a failed check and an answer still unparseable after one repair retry (`safety_parse_retry`, `safety_parse_failed`) block with `SAFETY_VIOLATION`. Outside Cyber that warning/refusal stands; Cyber records a negative or unavailable assessment as advice (`SAFETY_ADVICE`, durable `safety_advisory` event) without manufacturing SAFE. A provider 429 is an infrastructure fact about the Supervisor, not a verdict about the call: after one deadline-capped retry the call is blocked with the typed non-verdict `SAFETY_UNAVAILABLE`, which tells the agent to retry the same call rather than reword it, and a confirmed storm arms a process-local latch (`_SAFETY_STORM_COOLDOWN_SEC`) that answers in-window checks without a provider call, because re-probing from the highest-frequency light-model consumer would amplify the storm it reports; each is a durable `safety_check_rate_limited` event, while a structured insufficient-quota refusal stays PERMANENT and blocks as a verdict. The serialized subject has its own 250,000-character budget (`_SAFETY_SUBJECT_CHAR_BUDGET`, rendered `ensure_ascii=False`): an over-budget subject is refused fail-closed with `SAFETY_SUBJECT_TOO_LARGE_BLOCKED` plus a durable `safety_subject_too_large` event — never truncated, because anything past a cut would run unreviewed. Only the no-backend cases fail open with `SAFETY_WARNING` (no provider key and no local lane; a remote key that does not cover the light model's provider, with no local lane; a local runtime chosen as FALLBACK that fails or is rate-limited), so a misconfigured runtime does not hard-block every unknown tool; an explicitly primary local runtime (`USE_LOCAL_LIGHT`) that fails is a real `SAFETY_VIOLATION`.

Registry dispatch passes its prepared binding into `start_service`; a direct handler consults the same Supervisor only when no prepared registry binding was supplied. Each admitted process effect executes once; post-execution settings/repository observations annotate the original result and never repeat or roll back the operation.

Outside Cyber Pro, read-only shell git is allowed everywhere; mutating shell git only when its resolved target lies outside the Ouroboros system repository and runtime data drives (`git_shell_policy.py`; network-disabled tasks still fence network git). Acting `self_worktree` children remain read-only because patch capture requires an unmoved HEAD. `git init`/`git clone` are judged by destination, relative destinations and path-valued retargeting flags included; `resolve_shell_cwd` supplies the same canonical cwd to target checks and execution, and command text is not an independent runtime-file permission classifier. The generic Tool API VCS family (`vcs_status`, `vcs_diff`, `vcs_pull_ff`, `vcs_restore`, `vcs_revert`) defaults to `root=active_workspace` and accepts explicit `root=system_repo`; protected Ouroboros path names constrain generic restore/revert only on the explicit system target, so a project's own `BIBLE.md` or `contracts/` remains ordinary project content, while `preflight_review`, `commit_reviewed`/`vcs_commit_reviewed`, `vcs_rollback` and promotion remain system-repository lifecycles. `vcs_diff` without refs retains unstaged/staged behavior; `base` compares a resolved local tree to the worktree or index, while `base` plus `head` compares two local trees. Results name requested refs, exact tree IDs and comparison kind, without fetching or implying a merge-base comparison.

Outside Cyber Pro, a task contract may declare `resource_policy.protected_artifacts[]` as execute-only black boxes (`protected_artifacts.py`): registry guards allow the declared execution but refuse reads, copies, hashes, static inspection and trace/debug wrappers over those paths. Light-mode cognitive writes are redirected to `update_identity`, `update_scratchpad` or `knowledge_write` instead of raw memory-file edits; a corrected cognitive redirect is advisory, while an ignored user-file root correction remains a blocking deliverable failure.

### Review delivery

`review_execution_projection.review_actor_progress_text` says in one sentence per row who the reviewer is (the frozen route display name), what it was asked for at start, and at settlement whether it answered, how it ran (the observed harness, model and account, or that this was not reported), or why it did not (the engine's reported sentence, quoted; a spent window's reset instant); a `$0` refusal reads as not sent. Requested effort/model is not provider-observed truth; duplicate model slots keep distinct identities in the record. No global last-execution record supplies task progress authority; no code, id or custody state reaches the row.

Review delivery has two closed route kinds in `review_execution.py`: `api_chat` and `agent_session`; vendor and harness names are route targets, not new kinds. A slot is bound to one immutable route before its first send and never falls back to another transport — a route that cannot deliver raises on its own slot (`ReviewRouteUnavailable`). The API executor memoizes the assembled review messages, so its durable prompt record and its at-most-two physical sends share the same bytes; one logical interaction may spend one bounded second send on transport or empty-output recovery, never while a dispatched outcome is unknown (task acceptance may also spend it on malformed-format repair). That two-send rail belongs to the PACKET api row: a native tool-round episode carries no send count — its bounds are the ones below — and neither retrieving delivery is sent a format-repair resend, because their executors canonicalize their own answers. The hosted-agent executor starts one read-only delegated session through the shared Claudexor nanny (route-owned instructions and retrieval pointers, its own tools, no assembled API pack); extraction canonicalizes the collected transcript and never launches a second session, and custody, cancellation, full-artifact recovery and settlement stay on the delegated transport contract (§6 Delegated subagents). Mutating external coding work uses the delegated subagent path. The Claude Agent SDK gateway is retired; two residues stay on purpose: `reviewer_slot_config.py` migrates legacy Claude-SDK advisory targets at parse time (`_migrate_sdk_advisory_target`; an unmapped target is typed `legacy_claude_sdk_target_unmapped`), and the legacy filename `tools/claude_advisory_review.py` hosts the live generic advisory gate.

A session reads with its harness's own tools. `review_session_reads.session_read_facts` derives diagnostic `harness_observed` ranges from completed calls in `attempts/*/events.jsonl`, using the same manifest and range vocabulary as native reads with weaker provenance: an inferred shell range does not attest the exact bytes the model saw. Simple standalone `cat`/`nl`, `sed -n`, `head`/`tail` and bounded file reads have modeled extents; compound commands, pipelines, redirections and searches do not. File reads without enough range information, including ordinary Cursor `read`/`view_file`, stay unobserved, as do missing or unparsable journals. These limits never invalidate the answer, remove a response from quorum or trigger another review. Changed candidate bytes remain a source-gap diagnostic; publication binding is independently checked by the commit gate.

#### Native tool-round episode

`review_native_episode.py` (`NativeToolRoundReviewExecutor`) delivers every retrieving API row: configured-subagent reviewers on any surface, plus every scope, deep-review and advisory API row. Scope declares `ReviewSlot.native_retrieval_override` through `review_substrate.scope_delivery_rows`; deep review and advisory bind the episode directly. One episode is one logical review attempt: `chat(tools=…)` rounds against a fresh instance-local inspection registry (`read_file`, `list_files`, `search_code`, `query_code`, `vcs_status`, `vcs_diff`, `compact_context`; the `local_readonly_subagent` constraint, network off) until the reviewer answers. There is no round cap (P13; the retired round-cap key: §11.4). The bounds are four. The SEND bound `review_native_transcript_bound` is min(owner ceiling `OUROBOROS_REVIEW_NATIVE_MAX_TRANSCRIPT_CHARS`, the reviewer window's density-calibrated capacity in chars) measured as the wire size of the next send (serialized messages plus tool schemas, recomputed after every append) and enforced before every provider call. The owner `deadline_at` (passed by commit triad, scope, advisory and task acceptance) binds together with the slot's independent logical window: each send's transport timeout is clamped to the window remainder and a spent window refuses before dispatch. Each inspection call adds the loop's per-tool timeout, narrowed by the inherited dispatch deadline; past it the call is abandoned as `native_tool_abandoned` on an `error` receipt. The paid ledger prices every physical send as its own attempt. Mandatory reading never raises the send bound: a surface's `policy["native_mandatory_read_chars"]` declares the whole required surface, which the reviewer reads through successive working views (`compact_context` authors a new view; the data plane is the host's empty scratch unless the surface opts into `policy["native_data_root"]`, and only the scratch is removed at episode end); when one view cannot hold the declaration the shortfall is disclosed typed as `native_mandatory_read_disclosure` = `native_multiple_windows_required` beside the declared chars (`native_mandatory_read_bound` is a separate advisory estimate — never a floor, a grant or a refusal). A surface may also declare `policy["native_required_sources"]`; exact host-observed intervals and byte-identical inline delivery fold into `native_read_coverage`. Missing or unobserved reading remains diagnostic evidence beside the verdict, never an episode stop, lost quorum seat, commit block or automatic paid repeat (§6 Scope review by retrieval).

Typed ends: a bound that leaves no room below the first send is a pre-send refusal (`native_bound_below_first_send`), as is a registry without projectable inspection schemas (`native_inspection_unavailable`); both are `not_dispatched` ($0) in review custody and leave the receipt keys (resolved model/provider) empty, so the public execution wire never mints a native run that never sent. The host posts one `[EPISODE_BUDGET]` landing notice per working view at `NATIVE_LANDING_FRACTION` (80%) of the bound, and every tool result is clamped to the room left below it so no single read can jump past the bound; exhaustion is a typed refusal (`native_transcript_cap_exceeded`) for verdict shapes and a disclosed `native_incomplete` product for the report shape. A round carrying tool calls but no well-formed one and no prose is the malformed end `native_round_without_progress` (a progress floor, never a ceiling); an empty answer stays the episode's honest end on the empty-response rail. An episode that ran paid rounds is dispatched (settled) in custody whatever exception ended it — deadline, transport or the paid ledger (`budget_exhausted`). Every end — delivered, refused or errored — leaves one `review_native_episode` custody row and its facts on the actor usage (`failure_custody` for the error actor). The default output contract of a retrieving row follows the surface's output shape (`triad_review.default_output_contract`) unless the surface hands over its own `policy["output_contract"]`.

Native read evidence rides the actor usage as `native_tool_receipts` (`outcome` = executed/refused/error/withheld, `host_file_read_attestation: host_observed`); an executed `read_file` receipt carries `start_line`, `end_line`, `total_lines`, `eof`, `opened_path` and `opened_root` from the reader's own stamp (`ctx.last_read_view` in `tools/core_file_tools.py`; `tests/test_native_tool_round_executor.py` pins the writers), so a bounded read is distinguished from full coverage without trusting the model's path spelling — a missing stamp proves no extent. Every native end publishes `native_rounds`, `native_tool_calls`, `native_transcript_chars` (last physical send), `native_transcript_bound`, `native_transcript_refused_chars` when a next send did not fit, `native_landing_notified` (posted) versus `native_landing_sent` (physically sent), `native_end_reason`, `native_custody_row`, `native_view_changes` and `native_history_source`; a non-delivering or incomplete end after any assistant round also keeps `native_terminal_round`, a bounded, redacted, structurally valid JSON copy of the envelope and tool results that ended the episode, because receipts alone cannot reconstruct it. These facts survive on failed actors through `failure_custody`, deadline, ledger and transport ends included.

#### Late completion and typed refusals

Late review completion is retained in the operation-addressed prompt/response CAS (`review_substrate.py`, `review_custody.py`): the response manifest stamps the complete producer outcome with the original task/root, attempt, slot/route, operation, subject, contract and roster/epoch binding, so exact reconciliation verifies that source and runs the existing surface reducer without a second paid attempt; pending, unreadable, mismatched and unknown outcomes keep custody and their full source references. Plan waves carry their dispatched set, health epoch and operation ids through the same path; free replay spends no new cycle. Skill Review reserves every chunk digest/retry key and slot operation id in `review_job.review_wave` before paid dispatch and keeps that binding in terminal history; the next authorized call may record `review_resume_of` only for the immediately preceding unsuperseded wave with identical task/root/attempt, skill/state roots, group, content, contract, rebuttal and chunks, and then reaggregates complete CAS at the original wave id without another paid stamp, even at the cycle cap. Missing or partial producers stay pending, unstarted chunks acquire no verdict authority from their reserved ids, and a new task/root, changed material/contract/rebuttal, superseding lifecycle or explicit cancellation cannot inherit the old wave. Late completion alone never revives a job or enables a skill: review-state persistence, grants/dependencies and enablement keep their lifecycle guards.

Terminal task delivery and later inspection derive a bounded host notice from the delegated-custody audit after cleanup — confirmed terminal cancellations, live runs, unresolved invocation ids and undisposed patches stay distinct — beside unchanged model text and continuation narrative, so a later cancellation never rewrites historical authorship or the answer hash. A valid acceptance PASS with partial, missing or rejected criteria remains a parseable contributing verdict; only the clean/applied host decision can authorize objective completion.

Malformed structured slot configuration is refused at save and is a typed loud review-time failure on every surface — commit triad, scope, advisory, plan, skill review, deep self-review (`deep_review_slot()` raises; `run_deep_self_review` returns the typed `deep_self_review_unavailable` result instead of a report) and task acceptance (a typed DEGRADED panel, `reviewer_slot_config_invalid`); no surface silently chooses the opposite route or a default panel. Technical failure and commit permission are separate facts: producers keep the failure origin (context, delivery, format or window authority) beside the original status, source and findings, the shared physical exception projection keeps budget/admission and authority refusals distinct, and what each enforcement mode permits after such a failure is the protocol's rule (DEVELOPMENT "Review & Commit Protocol"); neither path changes quorum, and custody, Stop/deadline, ownership and candidate binding stay independent. Contributor slot evidence retains configured-subagent identity while its stored wire uses the mutually exclusive reference-or-route form, preserving native retrieval and its API budget admission.

### Usage ledger substrate vs. accounting policy

The startup seal audit selects its bounded manifest set before reading live attempt rows; missing live ids share one lazily validated archive-id set for the whole audit (an UNKNOWN result included) while forward checks continue independently, and the next audit refreshes that observation through the unchanged archive reader and its integrity/cache checks — no per-manifest archive traversal, no change to monetary authority or archive retention.

`usage_ledger.py` owns the durable append-only physical-attempt ledger (cross-process locking, sequence and transition validation, append+fsync, replay, loud tail quarantine); `usage_accounting.py` is the one-way policy layer above it (pricing, reservations, settlement, scopes, budget fences, imports, projections, admission), and the substrate never imports policy. The boundary means a pricing or budget-policy change cannot redefine valid ledger storage, and a locking or repair change cannot silently change what an attempt costs; compatibility events, state mirrors, task fields and UI projections may carry attempt ids and derived totals but never become a second charge source. `_usage_response.py` is the one NORMALIZER of a provider's usage block for accounting (its importers are `usage_accounting.py` and `loop_llm_call.py`), where a zero-usage body error settles at a confirmed $0 to release the reservation, so a provider storm cannot manufacture phantom budget exhaustion. Not the only READER of that block: every provider adapter reads the raw `usage` dict for its own response envelope, so a "consolidation" there would centralize a read that was never centralized.

### Caller-owned subscription model calls

`claudexor::<source>=<model>` selects a model operation in the Ouroboros-owned engine, not an Agent Run: `LLMClient` dispatches sync and async calls through `llm_claudexor.py` before the OpenAI-compatible filtering/retries, and Ouroboros keeps its SYSTEM, BIBLE, canonical messages, tool selection and execution. The raw-model adapter is Codex; connected Claude/Cursor and other harnesses keep their Agent capabilities, and direct API keys keep their existing routes. Every main-loop execution of one install sends the same Codex cache key (`llm_claudexor.cache_key_for_model`: per data root and model, projected to `prompt_cache_key` and the `session_id` header), so a new task, child or consciousness cycle is served the governance prefix its predecessors already cached; per-execution turn states ride `nativeContinuation` unchanged under that shared session.

`ClaudexorGateway` uses purpose-bound byte uploads, one idempotent operation ID, status/result reads, cancellation and explicit result acknowledgement. Claudexor performs at most one generation per operation: a lost local HTTP reply rejoins the same operation, and an unknown provider outcome never authorizes another generation. It shares its managed profile with Agent sessions — the adapter reads current access credentials while the official CLI keeps refresh ownership — and no shared external engine, relay process, copied operator auth store or public OpenAI-compatible endpoint. Metadata helpers use `read_owned_gateway` (owned-only discovery and handshake; they never install or start the engine); actual model calls and explicit lifecycle actions use `ensure_owned_gateway`.

Failure evidence: before creating an operation the host discovers the catalog's `captureFailureEvidence=true` query and freezes that choice for the invocation, same-key rejoin after control loss included (older catalogs keep the legacy request; the serving runtime pin remains the independent adoption boundary). A supporting engine puts every received failed-response byte and processing exception — incomplete responses and HTTP refusal bodies too — in the private result, which the observability CAS retains before ACK; usage and events carry only compact problem context, and a received prefix never claims the missing provider tail. A coherent provider terminal whose message cannot be normalized keeps its outcome, route and usage: the operation fails `response_rejected`, the host settles the reported usage and raises the non-repeatable `stream_rejected` class — no unknown-outcome recovery, no healthy account marked failed. `ClaudexorModelError.display_message` adds sanitized typed `vendorCode`/`parameter` details to the error event and terminal preview only after classification; unknown outcomes expose no provider details.

Money and bytes: physical attempts stay in the usage ledger, where exact zero cash, known charges, estimates and unknown cash remain distinct — a subscription is not evidence of zero cost. Claudexor removes terminal request bytes and acknowledged result bytes, an unacknowledged ready result expires after 30 days, and compact operation receipts survive body deletion, so an expired read cannot start a new generation. Model-purpose resources are not valid Agent attachments. Private continuation envelopes stay in canonical history but out of public/summarizer projections; their reuse is bound to the actual source/model/profile/account identity.

Image capability comes from the selected role/account's model catalog, not the global model-id overlay; main send preparation, browser image attachment, captions and registered VLM tools share that reader. Missing metadata stays unknown — image input is retained for the real call rather than silently omitted on a cold engine — while a confirmed text-only model keeps the caption/capability-gap behavior, and text-only messages and image-off mode never read the image catalog.

The send copy omits foreign provider envelope metadata such as `stop_reason` (canonical history retains it), preserves a nonempty `refusal` as assistant text even when the provider supplied no ordinary content, and normalizes all-text tool results so moving the message-side cache boundary never rewrites bytes already sent (non-text blocks stay intact). For the same reason the transcript is append-only between the sends of one execution: compaction is the one sanctioned rewrite, stamped at its seams, and `ouroboros/transcript_prefix.py` records every other break (a context-fit reprojection after a real overflow included) as a `prompt_prefix_break` checkpoint instead of blocking the send. Only the exact `model_request_invalid` create refusal proves validation failed before command admission; a generic HTTP error or failed status read cannot prove non-dispatch.

#### The live turn slot

Beside assistant-level history the engine keeps ONE live turn per model client session, and its opaque token is transport, not content: it belongs to the caller that is running, not to any stored message. So the caller owns a single mutable slot (`llm_claudexor.ModelTurnState`) that rides the ordinary `LLMClient.chat` parameters to the engine boundary, the only writer — a dispatched durable result replaces the value, a released `invalid_continuation` repair clears it together with message envelopes; other non-dispatched, unknown or legacy-shaped outcomes preserve it. Holding state never licenses another generation, and silence about a turn never ends one. WHY a slot rather than the transcript: the live turn survives compaction that drops the messages and outlives a body that fails after its headers, so the last stored assistant envelope would rebuild the wrong lifetime. One `run_llm_loop` invocation is one turn (rounds, owner steering, acceptance follow-up, forced finalization, quota waits and reprepares continue it; a next loop and a cold restart start empty), and a consciousness wake-up is one such ordinary turn keyed by its own task id. A dispatch that leaves this transport for a direct API or local route ends the turn at the caller and never revives it on return; the engine alone compares route identity. Opting in requires a serving engine at `config.CLAUDEXOR_MODEL_TURN_STATE_MIN_VERSION`, read from the last SUCCESSFUL handshake — a failed probe never un-proves it, so concurrent status polling of that singleton cannot change the shape a running caller sends — and an older or not-yet-observed engine keeps the legacy request shape instead of risking a schema refusal. The token is never usage, an event, a progress note or a task card; mechanism in the `llm_claudexor.py` docstring.

#### Roles, accounts and context

Model roles own account pins and context assertions through `OUROBOROS_MODEL_ACCOUNTS` and `OUROBOROS_MODEL_CONTEXT_WINDOWS`; ordered fallback entries keep their original ordinal, reviewers and configured actors reuse their route credential fields, and identical Main/Light or reviewer model strings never imply identical roles or accounts. Auto uses the largest advertised window of the exact account route, not CLI compaction thresholds; a manual value is a sizing assertion, not a provider unlock or reviewer authority; unknown capacity stays unknown, and input size, response reservation and capacity are separate. Each operation records its submitted options beside the engine's applied options (an absent applied report stays explicitly unknown), and the first changed reasoning effort of each model in a task produces one typed owner-visible notice. An account change rebinds preparation before another physical send; ordinary sends, prospective wrap-up payloads and forced final replies share one acting-role/account binding, and prospective subscription accounting uses the dispatch serializer, not an OpenAI-compatible approximation. The final header identifies the responding model/account; a paid review that ends incomplete retains its full report and custody with that classification, never switches to another delivery or inherits the previous route's window.

Host-authored sampling defaults stay separate from explicit parameters: review requests carry `default_temperature` as a hint each effective API route resolves at dispatch, raw model operations use their provider default, and an explicit `temperature` (zero included) is preserved and may be refused. Routes without structured output use the existing safety text-JSON parser, repair and refusal path — no new safety bypass. Ordinary confirmed provider errors keep each helper's previous handling, while quota, owner interruption and unknown physical custody propagate without becoming a helper result or verdict.

#### Quota and auth waits

`model_wait.py` holds confirmed quota/auth waits inside the live call. Typed owner actions use the existing mailbox and the `/api/decisions` family `model_wait:<task>:<wait>`; task-result rows are projections, not restartable stack checkpoints or a second attempt ledger, and metadata polling makes no generation. Auto may prefer the last successful same-route account unless it got a status-null or typed per-subject refusal this execution. An HTTP vendor quota refusal of a named account is re-asked with the same payload, no preference; a pre-dispatch verdict never is; only its `poolCause` proves the pool spent; an account chosen twice stops rotation, claiming nothing. Pin never rotates. A route may also answer with ANOTHER model than the one requested, with no error and nothing in the account's quota: the engine states that as a typed fact on its completed result, and the transport never accepts such an answer as the round. It is retained and acknowledged like any other answer, so the horizon it would have run under stays reconstructible, but it adopts no turn state, runs no tool call, and is replaced by a NEW operation that names no account — the engine, which deprioritises that account for a while, alone chooses where every redo lands. `OUROBOROS_SERVED_MODEL_REDOS` bounds those redos; a pinned account names one account, an already admitted candidate is bound to exact bytes, and an actor with no send left on a bounded budget would otherwise read that rail's own budget error instead of this refusal, and a spent owner window buys no further send, so none of those is asked again. An outcome nobody knows is never a substitution: the transport raises it before the rail sees a result, so the existing unknown-custody fence, not this budget, governs what happens next. Each discarded generation's retention and acknowledgement state travels with its durable row, so a failed one is visible rather than assumed. A discarded generation teaches the density witness nothing, because a witness belongs to the model that produced it. Once no redo is available the typed `model_substituted` refusal reaches the caller, which is an ordinary cross-model fallback trigger for a root and a typed failure for an exact-route child; it never cools the requested model, because one substituting account says nothing about the model. The first substitution of each model in a task also becomes one timeline row of that task's card. The rule covers this transport only: an Agent-session delegation is a separate engine capability with its own model evidence. Fallback keeps one attempt per model and a 120-second cooldown; on quota each configured route runs before the owner wait, opened from the retained refusal (no generation first); an intermediate fallback's own refusal remains the wait/retry route if a later fallback fails differently; nothing sleeps to a reset; inline Presence never waits (typed refusal; safe retry proof: §12). A temporary switch affects only the wait; Settings persistence, acceptance and task application remain distinct. Fallback Local remains a group-wide setting: a one-role persistence request may change model/account only when Local is unchanged, a different Local choice is task-only, and permanent group changes remain in Models. The current task-attempt identity selects actionable wait rows; a failed mailbox delivery retries the same accepted request without authoring a new one; terminal mailbox cleanup waits for post-task synthesis and pending accepted attachment promotion to settle.

`ouroboros/gateway/task_model_wait.py` owns model-wait decision effects and the bounded settings-writer receipts; `task_decision.answer_decision` returns `(status, payload)` to both the Web and authenticated Host Service transports (they supply the installation root — no synthetic HTTP request or parallel owner registry); `supervisor/task_model_wait.py` projects worker events and quota clocks through the existing supervisor, and `ouroboros/gateway/decision_contracts.py` owns the decision-family vocabulary. Quota pauses use union duration across simultaneous waits and do not consume internal execution time, while explicit calendar deadlines remain fixed; the worker and project-write ownership stay held (a one-worker queue waits), completed tools and reviewer results remain on the same live stack, closing a browser does not stop the wait, and stopping the Ouroboros process ends this continuation guarantee. Image tools retain the tracked VLM child: `vision_process.py` carries typed errors, physical capture, cancellation and operation checkpoints across that process boundary, and a lost child result remains unknown, never free.

A consciousness wake-up is an ordinary direct turn (`handle_wake_direct`): the same direct-turn registration, model wait, Stop and bounded interactive transport-death repeats as an owner's turn, an ordinary task result, and no background owner, locked memory, pause or stop event of its own. The alarm clock only decides when the next turn starts.

#### Streams and transport waits

Main remote completions stream (`llm_stream.py`), assembled inside the physical send closure before accounting settles: a complete stream yields the same normalized response shape as JSON; a partial stream never yields a usable tool call or answer, and its exact wire bytes and partial assembly stay in private CAS through the `physical_stream` manifest and attempt id. The assembler is strict about completeness, tolerant about form: on the Chat path identity scalars and metadata keep their first value, index gaps are forgiven and every forgiven fact is disclosed in the stream receipt (`anomalies`); the native Messages assembler rejects post-terminal shape (non-contiguous blocks, an unsigned thinking block, an incomplete tool block). A complete-but-unusable stream settles with its usage as a provider error (`stream_rejected`); unknown-outcome continuation is reserved for a stream that never reached its terminal frame (a lost socket, a malformed mid-stream native frame), and a complete response with absent final usage still has unknown money. Comments/pings do not define cognitive deadlines; every recovery candidate checks inherited calendar and quota-adjusted execution bounds before reservation, after preparation and at dispatch, and HTTP phase bounds stay distinct from the overall logical wait.

An ordinary managed task whose provider outcome becomes unknown stays in the transport-wait episode (`loop_transport.py`); the old attempt and its unreported cost remain unknown. After non-generating upstream observation, a user-role `[SYSTEM NOTICE]` supplies explicit recovery input for one new physical attempt under the existing budget, cancellation, owner deadline and absolute ceiling. An attempt that fails again, is unknown after dispatch or released before it — and a free redial that crosses dispatch and dies unknown — returns to the same episode: the backoff keeps growing (4→60 s), one redial is counted per wait iteration, an unknown repeat re-arms the probe's freshness bound at that latest failure and refreshes custody, one `continued` row names the transition (`continuation_outcome_unknown`, `continuation_transport_unavailable`, `redial_outcome_unknown`), and no cap on continuations — budget, deadline and Stop are the only stops. Finished tools are retained. Configured-session supervisors prefer their live-leaf hold (`delegate_hold.py`), then use this same recovery for their own model; reading a result or disposing a patch is not a condition for cognition. Direct turns keep their separate contract; manual Restart/Panic gains no resume authority. Recovery is proved by provider provenance, never by a local handshake: direct remote endpoints are observed through HEAD under the same no-proxy policy, reusing the ordinary connection allowance for every socket phase narrowed by the owner remainder and holding no cognitive in-flight lease; subscription metadata qualifies only when the catalog reports generic `provenance="provider_http"` with an original `observedAt` after wait entry for the selected source/model and effective profile/account fingerprint — cached reuse never advances that timestamp, and a static or pre-outage catalog cannot prove recovery. Capability discovery remains authoritative, not a new core provider table. Loss of the Claudexor control connection keeps reading the same accepted model operation across endpoint rediscovery, without creating another operation.

### Delegated subagents (Claudexor transport + the nanny)

Ordinary delegation requests no extra engine review panel; new ordinary runs on Claudexor 3.9.8+ default to no panel — a version boundary of the behavior, not a second release pin. The start receipt's `engine_version` is the handshaken serving version, distinct from the release pin; engine review outcome, execution success, the parent's integration decision and Ouroboros review gates remain separate facts. Delegated snapshot capture stays relative to its recorded baseline: committed bytes can be captured with a disclosed `head_moved`, the instruction still forbids committing, and the distinct `self_worktree` unchanged-HEAD check is preserved.

Children coordinate through `tree_note` and `tree_read`; read-only children can read/list the project-scoped knowledge store without writing its index; only the parent may use `override_delegation_constraint`, and a `review_requested` note carries an exact evidence reference/hash and wakes the parent without starting a paid cycle. Read-only and acting children alike hold the descendant-scoped `forward_to_worker`, `peek_task`, `cancel_task` and `discard_child_result` controls, and recursive delegation never widens filesystem, budget, depth, deadline, commit or owner authority. `forward_to_worker` also reaches the child's parent or a sibling (same parent and root) as `peer_task` provenance, its prefix naming the stamped `relation` (`sibling`|`parent`): context-only, relay refused, 8000-char bound. `delegation_budget` governs descendants (`may_delegate`, `may_fan_out`, additive depth provenance; a free-form intent note is never authority); persisted admission facts outrank later Settings changes, and a lower permitted depth is reported `capability_reduced`, never a silent flat tree.

**Registry.** `configured_subagents.py` owns `OUROBOROS_SUBAGENTS`: strict `{enabled, items}`, at most ten rows with hidden `subagent_id`, route-handle name (§3 Available subagents), any-language `recommended_use`, normalized API/session route, optional effort, account pin, access and row `enabled`. Session access defaults to `full` or the owner's `workspace_write`; snapshots lacking access retain workspace_write. Legacy env inputs fail closed. Row `enabled` defaults true, rejects nonbooleans and serializes only false, preserving fingerprints/receipts. Off rows retain configuration but leave catalog, alternatives, legacy matching, local autostart and reviewer resolution. Explicit selection returns `subagent_disabled`, distinct from global `subagents_disabled` and live unavailability. Tools take handle or stored id; roster edits refuse twins; records name their own engine. Captured snapshots never consult live settings. Descriptions guide the LLM, never host ranking/keyword routing; exact selection starts that route or refuses without substitution.

**Scheduling.** `schedule_subagent` requires `subagent_id`, a focused `objective` and `expected_output`; the remaining public fields describe child-local context, constraints, capability needs, write surface, narrower deadline, delegation budget and acceptance claims. `access=inherit` (default or omitted) preserves the configured session access; `readonly|workspace_write` can only lower it. API-model rows ignore this field with a result disclosure; `write_surface` stays the read/write authority. There is no model-visible lane/executor axis and no public `effort` override: the selected row is the complete execution choice, lineage/bounds/route/budget are host-derived, and omission never inherits the parent's acceptance claims. `subagent_runtime.select_subagent_snapshot` copies an immutable snapshot of the exact enabled row into the child task: an `api_model` row becomes an ordinary recursive API child on that exact model/effort, an `agent_session` row an ordinary recursive Ouroboros nanny on that exact external route. Burst cash (each sibling launched before the first sibling's first response pays its own prefix write on cache-write-priced routes) is disclosed in the tool description as an affordance, never scheduled by the host; so is an exchange of addressed turns, stated in `objective`/`constraints` (never a contract field or host section; no stage, topology or participant count fixed). The old lane/executor resolver serves only old durable records: for historical lane envelopes `schedule_subagent` reports the requested lane only (effective facts remain on the dispatched child record), and a task carrying `configured_subagent` goes straight to `subagent_runtime`, so legacy policy cannot reinterpret an active selection.

**Waiting on children.** `wait_task`/`get_task_result` return the full single-child handoff (verification receipts red/masked-first, exact omitted count); `wait_tasks` stays batch-compact: `task_id, status, child_result_sha256, outcome_axes, result, terminal_host_notice when present, trace_summary, capability_delta when the child has something to disclose, duplicate_of`, plus the nullable cost-finality pair `accounted_upper_bound_usd`/`cost_final` and, when the child's envelope carries one, `execution_evidence` (§11.1); the retired `cost_usd` spelling is tolerated only when reading stored rows, never emitted. Both use `task_status.SETTLED_STATUSES`, and a pending cancellation is the typed `cancel_state: "pending"` projection, never completion. A batch wait that expires with children still running returns the typed `wait_expired_with_live_children` block (live child ids, requested window, clamp ceiling): facts only, no advisory text, no host floor on the next window (how long to wait is the mind's call, BIBLE P13); an id this tree never minted stays `unknown_task_id`, never a live child. An optional `known_result_sha256` / `known_result_sha256_by_task` compares the join-ledger semantic result identity (`join_ledger.py`; `CHILD_RESULT_STALE`): an exact match returns `result_unchanged` without the repeated text while status, costs, outcome and custody facts stay; no persistent seen-state is inferred. `await_messages(timeout_sec)` holds the worker slot until an unread mailbox entry or its bounded window, delivers nothing and takes no lease: the in-flight tool lease spares the idle rail and its close stamps progress.

**What a delegated run costs.** Claudexor reports the amount in `summary.spendUsd` and its exactness in `summary.spendEstimated`; `delegate_custody.disclosed_spend` is the single reader of the pair, so the ledger row and the payload the nanny relays cannot tell different stories. Runs ask `authPreference: subscription` explicitly, because the engine default falls back to a paid key invisibly. Four cases:

| disclosure | ledger | finality |
|---|---|---|
| disclosed settled zero | `0.0` (`subscription_session` row) | `cost_final=true` — the proven free session |
| disclosed settled charge | the amount | final |
| estimated amount | the amount | `cost_final=false` — an estimated zero is not a proven free session |
| undisclosed | `cost_usd: null`, increments `unknown_unmetered` | drops `cost_final` for the projection |

An undisclosed spend contributes `0.0` to `accounted_usd` — inventing a conservative bound would fabricate a number the harness never gave (BIBLE P1) — so a `TOTAL_BUDGET` fence cannot stop spend it was never told about; the honest consequence is loss of finality, not a guessed charge.

**What a delegated run READ.** Harnesses count input tokens with incompatible conventions, so `settle_run` carries the engine's own normalized split, `summary.inputTokenUsage`, onto the `subscription_session` row as the optional `input_token_usage` object: `total_tokens`, `cache_read_tokens`, `cache_write_tokens`, each a nonnegative integer or `null` for unknown. `record_subscription_session` is the one validator and writer: all three keys are required together, and a partial, extra-keyed, negative or fractional object is unknown as a WHOLE, not repaired field by field, because a repaired counter reads exactly like a measured one. An engine that reports nothing leaves the row unchanged, and the object stays OUT of the idempotent row identity, so an engine that starts reporting never rewrites or duplicates a session already settled without it; the legacy `prompt_tokens`/`cached_tokens` axes keep their own meanings, compaction never folds these idempotency-bearing rows, and direct physical attempts take no copy.

**The nanny model.** An `agent_session` subagent is an ordinary recursive task-tree child acting as a **nanny** supervising at most one active bounded external leaf. The task node keeps lineage, authority, deadline, budget, acceptance, cancellation and descendants; the harness process stays a non-recursive tool leaf: session rows never flatten the task tree into harness processes. The nanny is the host: verification receipts stay host-authored, and harness output is a claim to check, never proof. A nanny-to-nanny chain through `schedule_subagent` is the host-attested realization of a nested subscription swarm, each level one metered supervisor task plus one free harness run; `schedule_subagent.requested_depth` is the typed ABSOLUTE request counted from the root, telemetry that never narrows the configured caps, while the legacy `depth_remaining` envelope keeps its narrowing semantics (both disclosed on the contract), and the root's `swarm_efficiency.depth` block reports requested, permitted and achieved. A nanny terminal names BOTH routes as separate facts: the host's own `model_execution` carries its model, provider and last typed error (`last_llm_error_kind`), each `terminal_runs` row the leaf's model, profile and selected actor, so a nanny that died on its own lane is never read as a verdict about the leaf, and a leaf half whose reconciliation was never persisted is omitted, not guessed. Harness-agnostic by construction: the row holds an opaque Claudexor target, Ouroboros asks for an access profile derived from task authority and lets Claudexor choose the mechanism; no harness-name branch selects a capability or fallback in core dispatch, and login-wire asymmetries stay presentation adapters in `gateway/claudexor_accounts.py`.

**Transport.** `gateways/claudexor.py` is pure transport (descriptor read, `/v2` handshake, the `config.CLAUDEXOR_MIN_VERSION` 3.2.0 floor). The daemon bearer token grants the entire `/v2` surface, so it never leaves this module, and the HTTP client runs `trust_env=False` so an ambient proxy cannot intercept the loopback control plane. Production starts obtain a handshaken owned gateway from `claudexor_daemon.ensure_owned_gateway` — exact reviewed engine/Node pins (`claudexor_runtime.py`; the reviewed pin IS the next-spawn selection — no mutable `current` pointer, no background updater — and `OUROBOROS_CLAUDEXOR_BIN` is the explicit operator override), never a PATH install. Keeping lifecycle above transport keeps account status side-effect-free and harness mechanisms out of Ouroboros (`claudexor_daemon.py`/`claudexor_runtime.py` docstrings; stop path, spawn latch and typed start failures: §9). Native child processes are contained by env token (`process_containment.py`, `OURO_PROC_CONTAINER_*`), because a surviving descendant can become invisible to parent-child traversal once its controller exits; an alive-or-undeterminable member is an honest hard-block answer, never a kill guarantee.

**Custody is durable, because the run is not ours to kill.** A delegated run lives inside the daemon and survives our worker, so the AUTHORITY is the durable `delegate_run_*` custody rows (`delegate_run_started` and friends) on the canonical/budget root (`ouroboros/delegate_custody.py`), read by every replay-class consumer through `custody_rows` — the process-local memo in `delegate_custody_memo.py` (the `_usage_rows_memo` shape: an ordered `(st_dev, st_ino, consumed, st_mtime_ns)` fingerprint of the folded chain prefix, only appended bytes folded later, a refold on any doubt, a bypass and never a cache while the chain is unreadable; the rows stay the authority, each process pays one cold fold, a durable compact projection is the next step); one compact incident projection, `<drive_root>/logs/containment_faults.jsonl`, exists because the event log grows without bound and a tail-bounded scan can bury an unresolved fault. A lookup answers OWNED, FOREIGN or UNKNOWN — collapsing UNKNOWN into "not yours" made a restarted owner indistinguishable from an intruder. An ABSENT custody log is a positively established clean state; an EXISTING-but-unreadable one audits as `delegated_run_state_unknown:custody_log_unreadable`, never cleanly reconciled. Every INTENDED start mints a fresh per-intention invocation UUID as the wire `Idempotency-Key`; the content hash is only the LOOKUP identity — a content-stable wire key would hand a deliberate re-run the finished old run — and reuse happens only by explicit token (`pending_invocation_id`/`retry_of`, replaying the STORED canonical body under the SAME key). The complete replay envelope lives unredacted in the existing private observability CAS, written before `delegate_run_start_requested`; the event carries `request_ref` and `prompt_chars`, keeping a large reviewer packet out of every custody scan (the memo swaps a legacy inline body for a locator `delegate_pending.request_body` re-reads). `delegate_pending.request_body` resolves legacy inline first, then verifies the CAS reference for both invocation readers. JSON values and the canonical request digest stay unchanged, including the thread fields needed to reproduce its wire projection; a missing/corrupt blob leaves the request unknown while preserving pending custody identity for start blockers, terminal audits and snapshot retention; recovery retains that invocation without POSTing. Known pending review tokens take the same missing-request path, while absent or definitely refused skill-review records keep their existing fresh-retry behavior. Pending scans resolve only surviving invocations, while legacy event/archive bytes remain untouched. `reconcile_orphaned_runs` visits every open run whose owning task left the live set and settles the terminal ones, but it CANCELS only behind a deliberate verdict: a durable owner result that is readable, truly terminal and finished by the task's own decision. A custody row carries its owner's kind, and task association confers no lifecycle authority: a run a review surface registered (`RunCustody.review_owned`, durable `source` under the review substrate) belongs to its panel, bounded by the slot window and its own `maxSeconds`, so the sweep spares it unless the owner task was itself cancelled — a `left_live` row names the panel, and a task that consciously finished under a running acceptance panel keeps its reviewer alive; a pending review invocation is likewise retained, never re-posted by the generic recovery, because the review substrate owns its rejoin. The owner-cancel kill boundary STATES the verdict it is about to write, because it audits custody before that write, so an owner cancellation stops the paid run at the boundary, not at the next sweep. A provider or transport death, a worker crash, a missing or unreadable result all SPARE the run, left live with a durable `left_live` reconciliation row: an undignified nanny death must not kill a healthy paid run, and "unknown" is exactly that case. `maxSeconds` is the damage limitation for a spared orphan, never custody. SETTLED is published before registration retirement, after the ledger row lands; settlement and registration retirement are separate durable duties, a failed retirement stays replayable on `project_owned` for the later sweep, and writing `settled` over a suppressed ledger failure would turn a lock timeout into a permanent leak. A start whose row did not land reports `started_uncustodied`: no supervision, no replacement, until the original run is proven absent or terminal.

**No terminal or cancel claim without a verified receipt.** `delegate_cancel` returns `confirmed` (read back terminal), `requested`, `failed` or `containment_fault_run_may_still_be_live`; the last two hold a durable CRITICAL containment fault until a receipt or settlement clears it — an overpowered run that may still be alive is an incident, not a reassuring string — and the state read decides, so a refused control is never a verdict about the RUN. One `daemon_says_absent` predicate decides everywhere that a 404 is the daemon ANSWERING that the resource is gone (scoped to the daemon that answered), never a failure to find out; custody closes such a run `delegate_run_closed_absent` (unreachable, not settled), inventing no terminal detail, usage or spend. Results are delivered, not severed: `delegate_wait` stages the whole terminal detail atomically under `task_drive/delegated_runs/<run>.json` with a typed `output_delivery` block, and cut fields are renamed `*_preview` so a partial read of head-truncated JSON fails loudly instead of looking like an answer.

**Four nanny verbs** (`tools/delegate.py`): `delegate_start`, `delegate_wait`, `delegate_cancel`, `delegate_answer`. There is no fake `hurry`: the transport supports cancel and answers, not in-place steering. `delegate_shared._fail` adds `ok: false` and `host_code` without replacing the payload; `_owned_run` retains its durable OWNED/FOREIGN/UNKNOWN boundary for wait/cancel/answer. Start selects an exact session `subagent_id` (API ids refused), or recovery-only `retry_of`. `subagent_bootstrap` starts the configured nanny's snapshotted leaf through `delegate_start(prompt="")` before its first model round, without waiting (`configured_session_started`); the model chooses `delegate_wait`. Recovery adoption precedes zero-run/unknown fences because a prior run may be live; a fence-wake outranks terminalization.

A definite refusal needs a typed cause, no custody handle and either producer `definitely_unrun` or `_DEFINITE_UNRUN_REASONS`; it ends UNRUN at $0. Ambiguity wakes the model: uncertain live work cannot become a zero-spend terminal. Unsupported readonly/payload geometry (`directory_execution_unavailable`) and unregistered roots refuse before start with durable start-blocked evidence; the nanny registers first and retires owned registrations at settlement (`delegate_registration_policy`). The payload selector names authority through fresh `ResolvedResourceBinding(skill_payload.write)`, never grants it. Actor replacement/zero-run fences exclude `review_owned` runs: those belong to review custody, while settlement, money, containment and registration still see all runs. New delegation readers join the consumer matrix in `tests/test_custody_owner_kinds.py`.

**Finite leaf continuation** (`delegate_continuation.py`): engine `maxSeconds` cancellation settles as `outcome_reason=wall_clock_exceeded`, replayed as `terminal_reason`. Explicit `continue_from=<run_id>` admits a NEW run/cap/key only for the caller's settled run with that confirmed cause, full output read to EOF, captured patch applied/rejected without ambiguity, and unchanged actor/route/access/mode/isolation/authority target. Stop/Panic, owner deadline, user cancel, failure and unknown endings refuse. `continuation_of` and the host block retain predecessor/cause/disposition and the prior run's recorded access, so a mutating run that captured no patch is described as having written in place (its effects already on the target), never as read-only; the model authors remaining work in `prompt`. No session state transfers; `delegate_recovery.NO_RESUME_CAUSES` stays unchanged.

**Execution evidence.** `delegate_evidence.task_execution_evidence` projects the custody rows read-side; `delegate_start_attempted` counts blocked and uncustodied attempts too, so a refused-but-obedient nanny is never disclosed as nudge-ignoring (`nanny_nudge_recorded`). `applied_access_profiles` is read off SETTLED rows only (empty = no receipt disclosed it, never "no access"); `acceptance_patch_dispositions` is the bounded section over `delegate_run_patch_verdict` rows (cap 20 with the exact omitted count, `unreviewed_delegated_apply` headline) whose absence means NO disposition was recorded, never "reviewed clean"; an unreadable custody log is the typed `evidence_read_failed` marker, never an empty-therefore-clean section.

**Work orders.** The compiler (`subagent_work_order.py`) sends the entire chosen assignment, preserving context and instruction roles without an arbitrary host-size cutoff: direct starts carry the normalized host contract once in `instructions` (`delegate_start_instructions.py`; the separately hashed coordination appendix is absent from the host pre-start) and the chosen assignment separately in `prompt`, and coordination context stays complete. Real native/HTTP limits return their actual failure with the original input and any pending invocation retained. Exact-source readers stay optional capabilities; incomplete source coverage never authorizes a terminal PASS or apply (`delegate_source_coverage.py`). Legacy partial starts keep their exact renderer digest, source-interval validation and stored-body retry; removing partial-start production certifies no incomplete old run and launches no duplicate after ambiguous dispatch.

**Supervision.** `delegate_wait` is model-visible as an event-only sleep, not a caller-sized poll: `delegate_supervision.supervised_wait` renews bounded transport windows in host code at zero LLM calls, and only a meaningful event (settlement, interaction, fault, addressed message, child signal, control, recovery judgment) becomes a coalesced durable wake, replayed across worker interruption until acknowledged; deadline, ceiling, budget and cancellation stay outer bounds. Every receipt and wake carries one host-rendered `coordination_context` (intent, time remaining, root-tree spend, active descendants, remaining paid acceptance capacity) (facts for LLM judgment, never thresholds), observed READ-ONLY, so a metadata-poor task reports `time.state = "not_set"` instead of latching an anchor from a poll. Polling writes nothing of its own beyond the canonical usage-ledger reader's bounded maintenance, identical for every reader: the torn-tail quarantine after a SINGLE crash mid-append (one verbatim row in `state/usage_attempts.quarantine.jsonl`, one `usage_ledger_tail_quarantined` event), the empty `state/` lock directory on a never-initialized root, and owner-aware `usage_attempts.lock` recovery (§1 Platform substrate); an absent ledger is that reader's known-zero; a crash inside the quarantine repair can leave the sink torn (a disclosed residual). A requested future inspection (`checkpoint_after_sec`) wakes once and is consumed by any earlier real event: no cadence, stall classifier or hidden polling. An observation the transport could not complete is a quiet renewal carrying its typed reason, never a refusal that spends a model round: `observation_read_timeout` is our own read bound expiring against a live daemon (quiet, nothing more), `daemon_unreachable` a socket that carried no answer, the only half worth an owner line, delivered once per episode with one recovery line on the supervising task's own progress surface. The beat stays three seconds with no backoff, durable counter or outage latch, and deadline, ceiling, budget and cancellation still cut a long unobserved stretch. On a wake the nanny holds its full tool surface and the parent's captured model/effort. Nanny economics are structurally quiet: only `BASELINE_RESET_TOOLS` (`delegate_start`/`schedule_subagent`) reset the burn baseline, and coordination verbs never buy metered silence (`nanny_pacing.py`).

**A run's question is the nanny's to answer.** Supervision wakes immediately with typed `status="waiting_on_user"` on a NEW `pendingInteractions` entry instead of burning the engine's answer timeout in dead polling; answer keys are echoed verbatim into `delegate_answer` (custody-gated like cancel, relaying the engine's typed outcomes: `subscription_window_exhausted` carries `reset_at`; a transport death or 5xx is `delivery_unknown`), and delivered interaction ids are acknowledged only after transcript injection, so a question neither re-triggers a round nor disappears across recovery; every waiting payload states `continuation: same_session` (an answer resumes THIS session; each turn paid). A question above the nanny's authority escalates to the nearest live ancestor. The codex lane has no mid-run channel: a terminal with `outcome_facts.reason=input_required` (`continuation: new_physical_run`) is answered by a plain new `delegate_start(subagent_id=..., prompt=...)`, never the engine's rerun verb, which would start a run outside this task's custody trail.

**Recovery is exact and cause-specific, not generic task resurrection.** Only a proven non-signal worker crash (or a planned self-restart's typed handoff) lets a successor adopt the exact run or pending invocation, before any LLM call or new start; anything ambiguous returns typed recovery-required, never a duplicate mutator; owner restart, panic, signals, deadlines and cancellation are explicit no-resume causes (`delegate_recovery.py`; `delegate_pending.py` replays a pending invocation under its original key and body). When no physical run exists and none can be started, the model may finish only with a typed zero-run receipt (`verify_and_record`) after custody proves nothing is open; a session actor's terminal is CLEAN only through its own physical leaf or that receipt ("completed direct child ⇒ clean" does not exist), and `physical_leaf_not_started` rides the terminal projection as an incomplete/unknown execution axis. An unknown-provider hold (`delegate_hold.py`) parks the nanny in the supervised wait until the leaf wakes and never resends.

**Configured dispatch is exact** (`subagent_runtime.resolve_configured_actor_dispatch`, resolved at dispatch, the last moment route availability is current): a bad choice returns a typed reason, current alternatives and any reset time with `host_fallback: false`; the host never ranks alternatives, converts session work to API work or picks the first healthy row. The WHY is recorded so no redesign undoes it: selecting an `agent_session` row IS the parent's typed LLM decision that this work executes on the harness, the FLOOR the host hardcodes (truth, money, authorship), while topology, decomposition and supervision judgment remain the model's CEILING (BIBLE P13/P5). At completion `actual_substrate` derives only from custody rows; a typed startup refusal never authorizes work on a different substrate: another session route or API fallback is an explicit LLM-selected start.

**Route health.** `subagents.route_health` is the one health reader for dispatcher, nanny and review slots, and it does not guess admission: the doctor `status` describes only the DEFAULT credential store while real accounts live in the engine's credential-profile pool, so admission is the engine's, whose start POST answers an empty pool with its own typed refusal (`credential_pool_exhausted` + earliest reset) at $0; the gateway types it as a timer-healing window, scheduled on its reset like a spent subscription window, only when `resetsAt` is dated; an undated (structural) pool stays a plain `ClaudexorUnavailable`. `enabled` is honored as `route_disabled` (the owner's switch, not an observation); the other structural refusals are `route_not_in_capability_catalog`, an access-profile mismatch, `engine_rejects_delegated_marker` and positively proven quota exhaustion. A fully-used ratio needs a valid future reset before it can refuse a route; an incomplete reading delegates admission to the engine and never certifies available quota; explicit active cooldowns bind. Review slots inherit "the engine decides", never a silent fallback onto metered API spend: on the `auto` lane a dead daemon keeps the native fallback with its visible marker, while "daemon alive, pool empty" is discovered at the engine and disclosed. The model sees a semi-stable facts-only catalog (`model_visible_subagent_catalog`); invalid, list-disabled or all-rows-off configuration projects nothing; dispatch is the live check.

Historical helper observations use `state/subagent_last_delegation.json`, owned by `subagent_history.py`. Task finalization joins configured API actors to their own attempts, preserving requested pins and observed routes/accounts; fallback success never certifies the failed route, nor does code/test failure condemn a provider. Sparse pre-response failures stay in usage/history/raw events; served-call trace references retain received response-backed calls, including incomplete responses. Foreground/recovered session terminals and typed start failures carry original effort/processing through `RunCustody`/`STARTED`/`START_FAILED` facts, without history-only archive reads; missing options stay unknown, distinct from captured defaults. Pre-invocation bootstrap refusals keep their source; reviewers keep separate receipts. Known occurrence and first observation differ: replay neither refreshes age nor replaces newer dated evidence; definite evidence may resolve an unknown start. `MAX_CONFIGURED_SUBAGENTS` bounds latest actor rows, with old single receipts readable. Dynamic Runtime context and owner UI consume history without changing catalog, admission, quota, dispatch or ranking.

**Read-only and mutating session rows share one nanny transport.** The only difference is the run shape, whose ONE owner is `subagents.delegated_run_shape`, asked one question — is this an acting child? — by `tools/delegate._derive_authority` (live `ToolContext`) and by `resolve_configured_actor_dispatch` (configured snapshot); a shape re-derived in two places drifts unsafely in exactly one branch.

| task authority | access | mode | isolation | `execution.delegated` |
|---|---|---|---|---|
| acting subagent (valid write surface) | captured `full` or `workspace_write` | `agent` | `live` | `true` |
| Ordinary root with a validated external workspace or a selected Project room | captured `full` or `workspace_write` | `agent` | `live` | `true` |
| top-level task selecting an exact skill payload (`root="skill_payload"`) | captured `full` or `workspace_write` | `agent` | `live` | `true` |
| anything else, including a fail-closed subagent or an invocation lowered to readonly | `readonly` | `ask` | envelope (default) | not sent |

WHERE a mutating run's changes are destined is the second, separate record — the host-derived **mutation authority** (`tools/delegate_integration._mutation_authority` / `_payload_mutation_authority`, re-exported by `tools/delegate`), never model-supplied:

| source | `target_root` derivation | `capture_mode` |
|---|---|---|
| `acting_constraint` | the child's own `task_constraint.write_root`, required to equal the genuinely ACTIVE workspace root | `delegated_snapshot` |
| `external_workspace_root` | the root task's validated external workspace or selected Project room | `delegated_snapshot` |
| `skill_payload` | the exact payload the fresh `skill_payload.write` binding resolved | `delegated_snapshot` |
| `readonly` | ordinary active root (nothing to write) | `none` |

A payload target gets a standalone private Git snapshot (`subagent_worktrees.provision_payload_snapshot`): the live payload is never initialized as Git, and capture trusts nothing under the child-writable snapshot's `.git`. Disposition (`integrate_payload_patch`) applies a live, index-free `git apply` in no-repository mode under a whole-payload content-hash CAS (drift = typed conflict; identical content = idempotent applied); `GIT_CEILING_DIRECTORIES` is pinned at the payload's resolved PARENT (git still searches the ceiling entry itself, and an ancestor Git worktree above the runtime data root could otherwise make git skip every hunk at rc=0), and reserved paths refuse the WHOLE apply as `blocked_reserved_paths` with the candidate preserved. The post-apply outcome set is complete: a live loader hash equal to the recorded RESULT hash is the success; a hash equal to the recorded BASELINE hash with a non-empty touched set is a provable non-mutation that RESOLVES the apply intent (typed `INTEGRATE_APPLY_NO_OP`, the `apply_no_op` arm: no success, no disposition, no reconcile queued, retry lane open); anything else is the ambiguous mismatch, whose intent stays PENDING and whose reconcile marker IS queued (the payload did mutate). A successful apply queues the extension reconcile (`request_extension_reconcile`) and the skill's review goes STALE pending fresh `skill_preflight`/`skill_review`; a run whose ONLY change is a mode flip is already refused at CAPTURE time as `unreviewable_metadata_change`, so a live hash still equal to the baseline means nothing was written.

**A mutating run normally executes in a PRIVATE EXECUTION SNAPSHOT** (metered children keep sharing the tree; their patches integrate through `integrate_subagent_patch`: sha256-bound, 3-way `--index`, protected-path gated, genesis refused, `coop_already_in_tree` a no-op). At `delegate_start` the host snapshots tracked, staged and eligible untracked state, deciding sensitive/credential vetoes BEFORE hashing (`git add -A` would put secrets such as `.env` in the shared object database). Git's binary verdict for the whole untracked inventory comes from one index-versus-worktree `git diff --numstat` over a scratch index (two when empty files need their attribute verdict; `workspace_patch_capture.untracked_binary_verdicts`, shared with patch capture; a failed batch falls back to the per-file verdict with a warning), never one process per file by design. The machine-wide worktree ops lock (`subagent_worktrees._ops_lock`) guards SHARED metadata only — the registry file, a target's `.git/worktrees` and its baseline pin — held twice, briefly (row FIRST, then the ref, then `worktree add --no-checkout`, so a crash after the row is GC-nameable); the acting `self_worktree` lane is split the same way (`worktree add --no-checkout -b` + branch under the lock, `reset --hard --no-recurse-submodules` and deletion outside it — the body's own `post-checkout` hook no longer fires at provision either), and only the boot-time `prune_orphans` sweep and the millisecond genesis `git init` still do their work under it; listing, classifying, hashing, populating (`reset --hard --no-recurse-submodules`: what `worktree add` runs internally, minus the target's `post-checkout` hook), copying the source's exact bytes over the checkout and one `update-index` re-recording their stat (a CRLF-converting checkout otherwise leaves every such file "modified" in the child's `git status`) run outside it (issue #1241: one 67k-file provision held the lock 40 minutes and every other mutating start timed out). A held lock refuses typed (`cause: lock_busy` + the holder's pid/task/op), a SIGKILLed holder is evicted by the owner-aware stale check, every refused snapshot provision is `definitely_unrun` with a durable `START_FAILED` row, and the start receipt discloses `snapshot` size/time. Disclosed residuals: the registry read-modify-write under the lock is O(registered rows, their per-file baseline maps included — moving those maps out of the row is a follow-up), and every eligible untracked text file is hashed into the TARGET's own object database, where it stays unreachable after the snapshot is removed until that repository's own gc. The baseline is pinned by `refs/ouroboros/delegated/` and checked out as a detached worktree; `scope.root` stays the authority target and `execution.workspaceRoot` names the snapshot. The host appends a separate typed binding after the immutable work order: the snapshot is writable and the authority is read-only until integration. Directory-copy runs use the engine-created copy and never the source folder. Full native access has no filesystem sandbox; the binding names the writable root but does not enforce it. Terminal capture records authority drift as evidence: ready-no-changes stays no-change with unknown authorship, while ready-with-changes keeps its private artifact and the locked baseline proof decides integration. Nested Git directories are excluded and disclosed; skill payloads use content-hash CAS. The binding is durable before POST and retry replays it; a GC-collected snapshot is a typed `execution_snapshot_missing` refusal. Worktrees live in `state/subagent_worktrees.json`; removal is explicit or custody-cross-checked startup GC, fail-closed on unreadable custody. The run still uses `live` from the engine view, so the scoped-HOME/`delegated` marker below applies.

At terminal, `delegate_wait` captures the run's diff against the baseline durably into the task's artifact store; NOTHING reaches the target automatically: the nanny explicitly applies or rejects through `integrate_delegated_patch`. Git and skill captures are whole-result operations: omitted `paths` and an exact empty list select the same captured result, disclosed when explicit; nonempty selectors stay directory-only. Engine-directory empty/subset semantics are unchanged. The staging substrate differs: a GIT workspace target applies under the repo git lock after PROVING no touched path drifted from `baseline_sha` (a plain `git apply` relocates hunks by offset; the touched-path set is read from `git apply --numstat` in BOTH directions, each naming only the paths it writes), then applies and STAGES, never commits. A SKILL-PAYLOAD target captures through the payload adapter over a parent-owned trusted index and applies LIVE into the non-Git payload: nothing is staged into any active root and no `.git` or index is created in the payload. The protected-path gate applies only when the target IS the Ouroboros body; a conflict (proven drift) is owned by the still-running nanny, with snapshot and patch persisting until explicit resolution or discard. Mutation rides an apply-intent protocol: a durable `delegate_run_patch_apply_started` row lands before any tree mutation, so on replay a pending intent without a disposition answers typed `INTEGRATE_DELEGATED_APPLY_AMBIGUOUS`, resolved only by explicit `acknowledge_ambiguous=true`, while the provably non-mutating outcomes (a lock error, proven baseline drift, a failed apply, a verified revert, a baseline-equal payload hash) RESOLVE the intent. `patch_verdict.py` is the ONE verdict writer for both pipelines: subjects are minted `run_<rid>` by the writer, never prefix-matched by readers, and each decision lands twice (artifact plus typed `delegate_run_patch_verdict` custody row), a failed artifact write disclosed on the row. `artifacts.delegated_capture_read_target` narrowly rebinds `artifact_store` READS for the owning task's own `delegated_runs/` prefix, and `delegate_shared.orphan_capture_read_target` extends the same read-only, one-directory READ to the terminal-owner ORPHAN the disposition rule authorizes (confirmed by `orphan_disposition_status`), so the actor that may dispose a patch can inspect it without wider write authority. A read-only child stays in Claudexor's default envelope: one transport with one derived difference, not a second pipeline.

**Terminal reconciliation captures only over PROVEN terminality, and `patch_captured` means "a usable artifact exists".** When the owner task is gone, a settled mutating run's diff is captured through `delegate_integration.capture_terminal_patch_for_drive`, capture only, never an apply: the decision stays with an owner, and the obligation stays visible (`delegate_custody.undisposed_patches`) until the durable `PATCH_DISPOSED` row clears it. The obligation is held by the THING (the run's custody rows and the target itself), not by the task that created it, so a terminal owner's run keeps its debt visible and disposable instead of locking the target forever. While the owner task is LIVE, only that identity may dispose its captured patch; once it is terminal, any live TOP-LEVEL task may. Apply requires the caller's active Git root or fresh payload binding to equal the run's recorded target, or, for an ORPHAN only, to CONTAIN it while both lie under the host-minted subagent-projects root (the swarm aggregator shape: `<project>/contributions/<track>` clones the host already checkpoint-commits), every apply-path guard unchanged. Reject requires only the owner's proven terminality: it releases a dead task's locks and snapshot without fresh target authority. The `PATCH_DISPOSED` disposition row records who did it as `disposed_by_task_id`, and the `delegated_runs_unreconciled` projection stays the evidence trail the sweep heals. An owner whose terminality cannot be proven (task result missing, unreadable, or still an unreaped `running` row) keeps the lock, with no time-based release. A run closed absent or left unreadable captures NOTHING (across the provisioning boundary the child may still be alive and writing; an eager capture would freeze an incomplete patch and serve it forever); the snapshot stays preserved for capture-on-demand, and `patch_captured` is minted only over a ready manifest so a failed manifest leaves every retry point open.

**The stored `delegated_runs_unreconciled` projection is healed only from the write side, at four seams.** `delegated_custody_unreconciled` is the disclosure a task carries when it wrote its terminal result while one of its OWN delegated runs was neither applied nor rejected; a review-owned run is never one of them, so a task whose only open runs are its reviewers audits clean and carries no custody notice (the review projection's `late_result_pending` discloses a still-running panel). The overlay is ADDITIVE (`outcomes.custody_debt_axes`): it merges an objective WARNING and sets the top-level reason code but never rewrites the derived execution, review, objective or artifacts axes (the paid verdicts the task earned survive); a rail truncation code from `BEST_EFFORT_REASON_CODES` keeps the single Reason line (a round-limit or budget-exhausted victim is more usefully labelled by its truncation). While the debt is open the task reads Done with warnings, not Failed (the raw code stays typed on the row); the debt list lives on `delegated_runs_unreconciled` plus the `delegate_terminal_reconciliation` envelope. The stored code stays historical; the owner-facing Reason line is resolved at render time by the Task lifecycle rule: host rows in `project_dialogue._custody_debt_reason`, the browser card in `log_events.taskReasonDetail`, both from the stored list the live `task_done` event copies from the row (`agent_task_pipeline._custody_debt_event_fields`), so no surface infers a debt it was never given. Disclosed residuals: a provider-death terminal carrying custody debt shows the custody code on its one Reason line while the debt is open and remains Failed (the devtools-only infra codes are not in the runtime best-effort set); a CLEAN derived outcome plus custody debt does not increment `evolution_consecutive_failures` (a warning is not a failure); and `project_dialogue` derives failed/degraded from axis STATUSES only, never `objective.warning`, so a custody-debt child reads as a plain success there. Readers serve the stored projection (projection-over-replay, no live custody join), so a run settled after its task's terminal write stays stale until one of four seams: the periodic sweep refreshes tasks named in its own reconcile outcomes; the boot backfill (`delegate_terminal.backfill_terminal_reconciliations`, once per generation) re-audits stored terminal rows still carrying a disclosure; the cursor pass (`delegate_terminal.refresh_recently_settled_terminals`, a durable byte-offset cursor `state/delegate_terminal_refresh_cursor.json` over the append-only custody log, 5 MB per tick) catches terminal-boundary settlements no outcome-driven refresh can reach; or a kill path clears a stale list. Every refresh is audit-only in both directions (unreadable custody proves nothing) and never rewrites `reason_code` or recomputes the frozen `delegated_runs_*` counters: counters stay a historical snapshot while `actual_substrate` and the envelope mirror are rewritten from live custody, current liveness lives in the `delegate_terminal_reconciliation` envelope, and patch debt survives every refresh as `patch:<run_id>`, never a blind clear.

Disclosed delegated-isolation residuals (deliberate): a live top-level task with a different active root may reject and release another dead task's snapshot; the orphan-apply widening by containment means the disposer's blast radius grows to exactly the host-minted descendants the checkpoint-commit already writes; an orphan disposed by a non-owner writes its verdict artifact and `delegate_run_patch_verdict` row under the DISPOSER's task while the capture directory and the `PATCH_DISPOSED` row keep the OWNER's task id (readers key verdicts by `run_<rid>`, but the owner's acceptance packet will not list that verdict); a GC-lost snapshot or permanently failing capture discloses in a typed refusal that its obligation can never be satisfied; the baseline is worktree-primary; the git lock is task-drive scoped, so two nannies integrating into the SAME external tree can interleave apply+stage (the drift check makes the loser's apply a typed conflict); and a credential-shaped file the CHILD creates fails the whole patch instead of shipping a partial diff.

**A mutating run requests its captured native profile, reads back what it got, and DISCLOSES the gap instead of refusing the work.** Full requests no filesystem sandbox; the private snapshot owns delivery, not OS confinement. The owned gateway creates a scoped full-access grant only when no trust record exists; an existing denial is preserved and addressable by lowering the invocation or capping the row. Grants persist per scope like stable project registrations; no automatic trust cleanup is implied. Workspace-write keeps its boundary disclosure. In place because Claudexor otherwise hands the harness the operator's real `$HOME`, which holds the daemon token (a compromised child could start its own runs at any access level). Four facts, one mechanism. (1) The `execution.delegated: true` marker rides in the same record as `isolation: live`, built from `delegated_run_shape` in one place, so one cannot be sent without the other. (2) The version floor is about the SCHEMA: `config.CLAUDEXOR_DELEGATED_MARKER_MIN_VERSION` (3.3.0) is the oldest engine whose strict `RunExecution` accepts `delegated`; below it the start is a 400 and no run exists (`route_health` blocks dispatcher and nanny identically before a token is spent). Read-only delegation sends no marker and keeps the 3.2.0 transport floor; an engine between the two floors serves read-only and refuses mutating. The floor is a schema fact, never a containment fact (the OS boundary is platform-dependent, a build declares one version everywhere); threat model and measured bands: `docs/DELEGATED_ADMISSION.md`. (3) What was APPLIED is asked of the attempt, never of the OS: `delegate_wait` reads `harness_home_isolated`, `confinement_mechanism` and the proven denied path from the attempt record (`gateways.claudexor.attempt_containment`, `delegate_containment.py`); `sys.platform` appears nowhere in the decision. (4) A missing boundary is disclosed (durable `delegate_run_unconfined` event, the child's instructions, the parent's terminal payload), not refused (the child already holds a shell in this worktree; cutting the lane on every boundary-less host costs more than it prevents); a home nested under the operator's own is disclosed-unconfined (`home_nested_under_operator_home`), never relabelled as isolation. A recorded FALSE is still a fault: `harness_home_isolated: false`, or a scoped home that IS the operator's own, cancels as a typed containment fault exactly like a widened access profile (those two exact facts are the WHOLE breach rule); a MISSING home fact is neither breach nor proof, so unproven is REPORTED.

**Delegated authority cannot widen.** Start exposes `prompt`, session `subagent_id`, `max_seconds`, lowering-only `access` (`readonly`/`workspace_write`), recovery `retry_of`, continuation `continue_from` and the payload selector; continuation refuses beside retry/payload selection. No mode/isolation/scope argument exists. Retry preserves route/root/access/permissions; host instructions remain unforgeable. Native process access never overrides task constraints or the assigned edit target. Reviewers remain readonly/ask even if an actor row allows writes. Every fetched detail passes `_containment_breach`, checking both access and harness HOME because Claudexor derives effective access rather than echoing the request. Wider access cancels as `access_profile_widened`; narrower access is valid.

**Read provenance on the accounts surface.** `GET /api/claudexor/status` carries a `reads` block (`ClaudexorStatusReads`: `catalog`/`accounts`/`quota`, each `ok`|`not_read`|`failed`) (the owned daemon starts lazily): an idle daemon serves empty collections under a 200, and "no account connected" must not be inferred from a collection that was never read: `ok` makes the matching collection authoritative (empty means empty); one parity-tested client reader (`facetReadState`) applies the same rule, and the aggregate `daemon.state` is never the negative answer. Login jobs: the daemon stays the sole process/fence authority and reconcile is an explicit POST, never passive polling (`gateway/claudexor_accounts.py`; the route inventory is its §1 row and §4).

### Git and commit review

`tools/git.py` owns repository writes, staging, reviewed commit, rollback or restore, tags, push and CI follow-up; its leaves are `git_plumbing.py`, `git_repo_edit.py`, `git_vcs_ops.py`, `git_review_cycle.py` (staging plus the advisory/triad/scope review and the reviewed-material binding the commit gate consumes) and `git_evolution.py` (campaign authority at the reviewed-commit and publication boundaries). File-edit tools validate their own atomic write shape. `mutation_attribution.py` captures the root-task baseline and projects the clean-at-baseline system-repository delta plus an explicitly adopted predecessor's exact retained changes — a changed pre-existing dirty path, a stale or missing baseline, or a failed scan blocks automatic staging; `commit_reviewed(paths=None)` stages only that attributed candidate, explicit paths must be a subset, an empty candidate returns `GIT_NO_ATTRIBUTED_CHANGES`, and managed update transactions keep their separate typed whole-tree authority. At startup a later independently initiated task may adopt exact retained candidates from its host-validated predecessor source in the same repository. `predecessor_adoption` preserves the observed dirty baseline and original source; terminal quiescence, unchanged path content and unchanged per-path base are required, while unrelated dirty work stays excluded. Missing fingerprints or size-only observations establish no transfer, and adoption grants no review approval or automatic new task. Commit preparation verifies the exact local working-branch ref before an unambiguous checkout: a missing ref refuses without changing the current branch, index or files (remote guessing and implicit branch creation are disabled), detached work retains the `checkout -B <branch> HEAD` recovery, and managed assisted merges retain transaction-owned precommit verification.

A reviewed commit is bound to one staged fingerprint. A cheap LLM-first advisory pass may run before the expensive gates; it is advisory, and skipping it never skips independently applicable tests, triad, applicable scope review, aggregation or exact-SHA binding. The hermetic preflight runs the candidate in a disposable worktree and data root; triad and scope inspect the same staged snapshot, aggregation preserves actor evidence and obligations, and any mutation stales the binding. Managed exception: a managed-update resolution commit reviews the declared M0→S subject (`tools/review_subject.py`) and the commit gate binds S to the exact index write-tree the fingerprint pins. External review wrappers report readiness but do not grant commit authority. The exact binding includes the `git write-tree` SHA, ordered `HEAD` and `MERGE_HEAD` parents, indexed VERSION, expected `v{VERSION}` tag, any existing tag target, and the binary staged-diff hash; after commit, tree, parents, VERSION and tag target are re-read before success or push is recorded, and an existing release tag is never silently accepted or retargeted. `release_sync.sync_release_metadata` projects version carriers during ordinary commit preparation; `VERSION_CARRIER_SPANS`/`substitute_carrier_spans` is the ONE span primitive the managed-update resolver and the commit-triad pack cut share, and `carrier_only_change` names a carrier changed only inside its declared version spans. Durable review state keeps attempts, obligations, readiness debt, raw actor evidence, and the final commit or tag binding; raw advisory output lives in `state/advisory_review.json` (selected by `snapshot_hash`/`ts`), not in `review_status(include_raw=true)`, which exposes raw triad and scope attempt evidence; `commit_gate.py` classifies review blocks, refuses an identical verdict, counts paid cycles against the ceiling and fingerprints the review contract. BIBLE supplies review authority, CHECKLISTS supplies criteria, and Development supplies the procedure; snapshot identity, advisory coverage or audited-skip evidence, deterministic results, actor evidence, and final Git identity must all describe the same material.

Material ordinary Advisory commit review returns the complete outcome and exact `review_reference` before commit, tag or push. The author may correct, accept unchanged bytes, request another permitted review or stop. Explicit `commit_reviewed`/`vcs_commit_reviewed` continuation with that reference and `author_disposition` binds the current attributed candidate, reruns independent required preflight/tests and exact Git checks, and dispatches no critic. The author record references the original attempt instead of rewriting its subject or paid facts. Settled handback is `reviewed/review_only`; actual pending custody remains `reviewing/late_wait` and collectible. Clean supported review keeps its one-call path; Blocking gets no author override. Evolution receipts record actual `triad_scope_status`, never infer PASS from a successful Git commit.

#### Commit review evidence

`review_evidence.capture_commit_review_evidence` freezes selected browser/vision calls and same-round automatic image-attachment observations, explicit unavailable-image gaps included, after cheap/free admission and before preflight/triad/scope. The borrowed loop trace and original call refs retain exact redacted arguments/results and the immediately following visible response in the same execution, excluding provider thinking; the original context binding is restored through the attempt's `_LoopExitContext` cleanup even if `tools._ctx` changes while the loop runs. Adjacency never attests visual inspection. One canonical task source handle holds the selected UTF-8 view, its initial exhibit within `_ACCEPT_NOTES_CAP` with counts, completeness and source identity: native reviewers read artifact-store ranges under the real canonical root, sessions receive byte-identical bytes in ignored `.review-drive/<task>/<sha>.txt`, and packet-only reviewers receive a bounded, explicitly partial view when needed; existing request evidence/refs and the preflight execution `evidence_source_ref` bind it. A pending rejoin restores the same source, a recorded empty selection included, and carries it from preflight into triad/scope without selecting new trace. Commit cleanup waits for physical custody; standalone or uncertain views remain retained without a new cleanup registry.

#### Hermetic preflight proof

The hermetic runner (`preflight_runner.py`) alone mints `ctx._preflight_test_proof`, after actual green lanes and containment; it binds the assembled checkout tree and installed index, effective pass specs, isolated environment (`test_environment.py` owns writable roots), and the invoked/resolved interpreter and active Node identity (a Python symlink's invocation path selects its venv). The candidate is ONE hardened raw-bytes `git diff --binary … HEAD` capture, because a staged+unstaged diff pair cannot faithfully materialize unmerged entries; a capture/apply failure is the typed `PREFLIGHT_CANDIDATE_ASSEMBLY` block, never a test verdict. The node lane runs first (`preflight_node.py`: bundled signed node then PATH, floor 20.11; `PREFLIGHT_NODE_MISSING`/`PREFLIGHT_NODE_TOO_OLD` hard blocks and `NODE_TESTS_FAILED` on a red suite, never a silent skip), then the two-pass parallel/serial pytest split under one budget (`LANE_EXCLUSION_EXPR` is the marker-lane SSOT); a dead xdist worker or a missing required plugin is a distinct named block, never a retry or silent serial fallback. Equivalent ordinary and managed checks reuse that process-held proof only after their distinct baseline checks; a phase label alone cannot establish equivalence. Every workload binds HEAD, because even an unmarked default-lane test may inspect committed files or history: repeated preflights can reuse an unchanged subject, creating a commit changes HEAD and requires a new run, a skip or no-suite `None` is not a green proof, and a restart loses the proof and reruns the suite. Creation and reuse emit `preflight_test_proof` observations through the existing event log, naming the task, HEAD, tree, index and workload fingerprint; an unavailable log falls back to an explicit diagnostic, never a test failure or a new authority source. Managed `tests_evidence` is forensics, not reuse authority. Unproven lane teardown retains the temp tree and Git registration (`_release_hermetic_tree`), including raised lanes; deleting inputs beneath surviving processes would destroy custody.

#### Commit advisory cycle

`preflight_review(commit_message="...", deterministic_only=True, source="worktree" | "index")` returns a release-only diagnostic report before sync, staging, custody/state access, provider checks, tests or fingerprints. `commit_admission.release_metadata_diagnostics` owns source acquisition and reports all independent applicable `findings` plus `unavailable` sources; `release_sync.release_metadata_findings` reuses the carrier validators, release grammar and P9 history counters. The report identifies its source and status (`clean`, `blocked`, `unavailable` or `not_applicable`), gives no review freshness, and writes no review history. It checks the selected VERSION, not a future release. VERSION/README absence and failed reads are unavailable evidence; an absent optional older carrier stays optional, while a readable malformed carrier is a finding. Coverage is release metadata only, not syntax, structural size, tests or critic review; size policy stays warning-only locally.

Standalone advisory retains automatic carrier sync and worktree reads. Prepared advisory follows the commit gate's whole-index applicability, regardless of a narrower paths hint, including partial staging and the version-neutral carve; standalone documentation-only scope stays exempt. A present malformed VERSION is now a finding, not a silent skip. Optional[str] wrappers format the complete release findings, separating unavailable evidence from defects. Author continuation uses the shared name-status formatter and unavailable classification. Changelog prose, history trimming and version allocation remain deliberate.

Advisory availability is evaluated from the current configured slot and route, never inferred from a stale stored verdict: a disabled advisory slot is an audited bypass, an `api_chat` row requires provider credentials for its RESOLVED model, an `agent_session` row a resolvable session route. `claude_advisory_review.preflight_review` (callable `advisory_review` alias) owns that admission policy: an `api_chat` row rides the native tool-round episode (§6 Review stack), an `agent_session` row the session review executor; a native episode that ends on its own transcript bound — keyed on the structured `native_transcript_cap_exceeded` code, never on message text — reaches the caller as the typed non-blocking `ADVISORY_SKIPPED` with reason `native_transcript_bound_exceeded`, carrying the bound, refused chars and paid rounds, and every episode exception keeps `failure_custody()` as the advisory meta's `usage`, never an empty `{}`. The retrieving advisory brief carries a touched-path manifest instead of duplicated file bodies and applies the shared span-only release-carrier cut over HEAD→working-tree, with the same `PACK EXCLUSION NOTE`; omitted bodies remain readable through its own tools. Governance comes from the shared tiers (§6 Governance delivery). If the commit advisory is unavailable, the commit gate runs its compensating hermetic preflight only when tests remain independently applicable (not explicitly skipped, diff not documentation-only). Readiness projections receive only an exact repo/hash-matched advisory record and keep its failed status and freshness.

The reviewed-commit cycle (`git_review_cycle`) checks authorization and unresolved prior work before mechanical preparation and staging, binds the exact candidate before free-cycle/budget admission, runs a needed preflight inline with the full rebuttal and applicable tests, and revalidates the index and worktree snapshot before triad/scope; it owns entry-point resets and pending/blocked finalization, and its custody check joins current reviewer facts with the strict durable advisory record before index cleanup, an interruption before local metadata was updated included. `AdvisoryRunRecord.execution_pending` preserves physical custody for history retention and the external wrapper; `blocks_preflight` separately tracks logical admission. An explicit audited bypass releases that admission while retaining the original task, invocation, source and unknown physical outcome; late results update their original history row without superseding the newer bypass. Free advisory replay still checks freshness and buys no automatic preflight; stale coverage requires an explicit audited skip with applicable compensating tests preserved.

`AdvisoryRunRecord.execution` binds delegated preflight intent and candidate to the existing invocation token before POST and retains terminal usage/receipt evidence on failure; `delegate_custody.invocation_record` owns the immutable request, full prompt included — no second prompt store. An exact pending rejoin restores that request through the shared executor: a delivery-kind change cannot replace an unresolved session, same-session model/profile changes still rejoin the canonical request, and changed, foreign or lost identity is refused before preparation, naming the mismatched fields; `review_status` projects the recorded rejoin intent and execution identifiers through the public secret redactor without exposing the private reviewer prompt. Failed checkpoint writes cannot dispatch; unresolved rows survive history trimming. Only a corroborated `failed_definite` invocation discharges a stranded logical checkpoint automatically — age, missing identifiers and unreadable state cannot prove never-started work — and an audited skip never posts a replacement preflight. Released history stays eligible for an exact delegated rejoin but does not lock a later explicit standalone request for different intent or evidence; an unchanged audited bypass can satisfy the freshness shortcut without a new model call, naming the actual bypassed status. Native preflight uses its executor's end-event and monetary custody, with no separate advisory operation checkpoint or native resume protocol; a returned unknown physical outcome remains failed evidence on the existing refusal and audited-skip paths, and a hard process death has no native exact-rejoin handle. The external wrapper runs the same cycle, exports the real advisory record to `advisory.txt`, and preserves a pending checkout without restaging.

### Review stack

`review_cycles.py` owns the shared paid-cycle ceiling `OUROBOROS_REVIEW_MAX_CYCLES` (a positive integer or `unlimited`; anything else fails closed to the shipped default). One number, four gate meanings: paid reviewer-panel cycles per task for plan review; paid panel runs per task for acceptance, independently of ordinary author responses; paid triad-plus-scope cycles per ROOT task for the commit gate, counted from the attempt ledger at DISPATCH so the ceiling counts money and only undispatched attempts stay outside it; paid panel dispatches for skill review. Byte-identical material replays each gate's recorded verdict for free under that gate's identity. Physically dispatched technical failures consume capacity; undispatched refusal and collection do not. The last allowed panel still permits author reaction. An explicit task-local `max_improvement_passes=p` retains its p author responses and p+1 paid ceiling; without that override N creates no N−1 response limit. `unlimited` removes only the paid count, not ordinary task rails.

For skill review, convergence guidance to the reviewer and retry coaching to the author use the group's `review_round`, so revising payload bytes does not reset the coaching. `snapshot_attempt` remains the separate ordinal shown in history and headers; free replay keeps its exact material and contract identity. A paid-ceiling refusal names author finish only where the existing enforcement predicate permits it.

Review waiting has six independent axes:

| axis | bound |
|---|---|
| transport | dead-socket read bound |
| operation | typed active-operation lease |
| logical | slot/task deadline |
| policy | budget / cancellation |
| absolute | task ceiling |
| aftermath | late-result custody |

#### Physical custody

`review_custody.py` is the small worker-lifecycle seam under `review_substrate.py`: it schedules no tasks and keeps no second timing ledger. Parallel slots hold independent operation ids; the active-operation map only keeps a live physical call from reading as idle — deadline, budget, cancellation or ceiling still wins. Delegated-session expiry uses the verified cancel path; API/thread calls disclose `in_flight` and reconcile a late answer before the same retry identity can dispatch again, and a settled terminal API error stays in the cycle's replayable actor roster, so a sibling can neither erase its terminal fact nor buy a duplicate physical call. Physical custody is proved by the capture/operation state, never by the synthetic operation id, in `usage_accounting`'s vocabulary: only `reserved`/`released` proves pre-dispatch, a positive capture outranks a contradictory synthetic label, and `dispatched`/`unresolved` without a typed terminal HTTP status stays custody-lost/no-resend. Custody never infers pre-dispatch provenance from Python's implicit `__context__` (a fallback raised inside a prior provider handler inherits that earlier attempt): only an explicit `__cause__` or typed transport metadata can release a paid row. A retry token without a durable invocation is custody-lost on every delegated review surface, and a durable token is valid only for its recorded surface, slot and operation. Retry identity is the explicit material/cycle identity when supplied — mutable prompt or history is deliberately not part of it, while a changed snapshot, owner intent, reviewer route or admitted cycle mints a new one.

Timeouts compose, never override: send-time VLM captioning keeps its direct 90-second provider cap and Anthropic's direct route its 120-second provider default — neither is a generic review-reasoning cutoff — and the whole hierarchy is narrowed inside the owner deadline and finalization reserve before dispatch. A returned provider response or typed terminal error is settled even with an empty body, so bounded repair/retry may apply; a dead socket after dispatch is `provider_outcome_unknown` and cannot trigger another paid route. A spent owner window yields a typed `$0 not_dispatched` row before fan-out; under blocking enforcement an in-flight triad row stays pending rather than becoming a final quorum verdict, and a primary call at the deadline boundary enters the local finalization rail (`deadline_local`), not a provider-outage relabel. A reviewed commit has no independent outer tool cutoff: the foreground caller keeps custody until settlement.

#### Paid stamp and owner custody

The `paid` fact behind the cycle ceiling is recorded WRITE-AHEAD at physical dispatch (`review_dispatch.py`): a gate installs one once-only `ReviewPaidStamp` for its wave, and each delivery stamps at its own boundary — a packet api row at the usage ledger's physical-attempt transition, a native episode on each paid send, a session before its replayable `START_REQUESTED` row. Assembly-only refusals exit before that seam, so a $0 attempt stays outside every ceiling, and neither a worker outliving its logical caller nor a crash after dispatch can lose the durable fact. The stamp is idempotent across the concurrent triad and scope callers, so no side's transport starts before the paid fact is durable; commit review and task acceptance treat a failed write as fail-CLOSED, skill review only when resuming a wave, other callers keep fail-open accounting. Task acceptance binds a strict exact-hash tree-wallet claim to that same stamp on every delivery its rows run — one idempotent claim per panel, because the paid identity is material, not route; a wallet or cancellation veto at the claim releases the reservation and no reviewer transport proceeds on any row (the launch floor is evaluated once, at loop admission: §6 Task lifecycle). Disclosed residual: a compatibility transport that raises with positive physical capture without having entered the canonical marker is stamped after the send; if the tree's last paid cycle is consumed concurrently at that late stamp, the wallet refusal replaces the captured exception and the substrate may resend.

Before either parallel surface starts, one locked write records `paid=True` plus both complete slot rosters and operation ids in the commit-attempt row; a delegated slot patches its reserved row with `pending_invocation_id` before the provider POST. Exact resume preserves rows and tokens; a missing or mismatched operation is `custody_lost` under every enforcement mode. The stamp records the process-custody server session and pid owning the reviewer threads (`review_owner_custody.py`): owner-loss is proven by pid death, never elapsed time — a TTL would convert waiting into resend authority, and starting another Agent is not evidence this owner died. Tokenless rows settle as typed infrastructure failure only after a death seam confirms that exact pid gone, and a legacy row without owner identity stays fail-closed. Plan review re-enters a recorded in-flight cycle only through exact live custody or complete operation-addressed CAS for its recorded dispatched rows; a delegated poll that loses transport after a run id exists preserves the exact durable invocation for retry custody rather than cancelling a healthy unknown run.

Per-row delivery is configured only through the structured reviewer-slot SSOT (`reviewer_slot_config.py`); the older per-row route envs are retired and ignored. The one shared session target is `OUROBOROS_REVIEW_SESSION_ROUTE` (`review_execution.REVIEW_SESSION_ROUTE_ENV`), an opaque `harness[=model][:effort]` spec that falls back to `OUROBOROS_SUBAGENT_HARNESS` when unset, so one delegated route is configured once; a set but unparseable value turns review sessions OFF with a warning rather than silently re-routing them onto the subagent route.

#### Surfaces and money admission

The review surfaces:

- Advisory pre-review (`claude_advisory_review.py`) — a cheap, staleness-aware error-finding pass; the audited skip covers only advisory admission, never authoritative review, test policy or snapshot binding.
- Triad diff review (`tools/review.py`) — configured reviewer slots cover the Repo Commit Checklist with JSON findings under `config.adaptive_quorum` (the same SSOT as scope/plan/skill/acceptance review).
- Scope review (`tools/scope_review.py`) — intent/scope/coupling across the whole repository by retrieval on every row, in every context mode; the exact candidate, required-source manifest and diagnostic reading coverage stay distinct from substantive findings and configured enforcement (§6 Scope review by retrieval).
- Parallel orchestration (`tools/parallel_review.py`) — two-phase admission: the triad packet is assembled and fit-checked and every scope brief is prepared before any reviewer is dispatched, so a deterministic assembly block anywhere dispatches nothing and spends $0 everywhere (a lane paid while its sibling was doomed is real money for a half-verdict). Money admission (`tools/review_admission.py`: `commit_gate_paid_seats` / `admit_commit_gate_wave`) is all-or-nothing and scope-first: every PAID seat of the wave — the blocking scope seats FIRST, then the triad — is priced with the reservation math `reserve_attempt` will apply (its exact first send, including native work-order and tool schemas, plus its own output reservation; later native rounds reserve themselves), under the usage scope its substrate sends under (`review_usage_category` + slot, so a warm split of the caller's transcript never stands in for a seat's cold prefix), against every fence `reserve_attempt` enforces — the global `TOTAL_BUDGET` remainder (unbounded when the owner set no finite global budget) and the task's CURRENT root fence — and admitted as ONE wave through `review_wave_budget_gate(surface="commit_gate")`. A wave that does not fit is a typed `$0 not_dispatched` record on every seat plus one `review_wave_budget_insufficient` event carrying `binding_axis` (`global` or `root`) and both remainders, and the block names the binding fence, the shortfall and the knob that moves it — never a half-dispatched panel whose non-blocking seats hold the money the blocking reviewer needs. Admission is a read-only pre-check without a wave-level hold: the per-seat reservation stays the enforcement, so money a concurrent task takes on the global axis between admission and a seat's reservation can still refuse that seat (disclosed residual). A paid seat is any api row (packet or native episode); an agent-session row rides the owner's subscription — its ledger row is written at settlement, never reserved — and is neither priced nor waited for. Every executor transition on the way to a seat runs under `contextvars.copy_context()`, so the usage scope the wave was admitted with — its bound root fence included — is the scope the reviewer rows reserve under; a settings reload that changes the per-task limit mid-turn changes neither side. An admission that raises is fail-open like the gate's own unknowns, but loud and typed (`review_wave_admission_unavailable`; the wave dispatches unadmitted). An admitted wave submits the scope seat first and starts the triad only once the scope seat's OWN reservation is on the ledger (nothing else releases the hold), bounded by `NESTED_SETTLEMENT_MARGIN_SEC` and by the scope seat itself; a hold that ends without observing it emits a typed `review_scope_lead_unobserved` event. Admission touches no transport or logical timeout contract.
- Shared helpers (`review_helpers.py`, `triad_review.py`) — packet/brief building, checklist loading, JSON extraction, usage events, obligations scaffolding and reviewer actor records.

A free refusal never wears the form of a verdict: a refusal that spent nothing is recorded as a typed `not_dispatched` fact plus its reason, never as a DEGRADED panel, a synthetic actor or a verdict. That is the one shape across every $0 exit — a plan-review locator the evidence policy cannot attach is a named omission row the panel is dispatched with, an acceptance packet that overflows takes the ladder rather than reporting a verdict, a truncated or self-pageable row names its cut, and a request never sent is one seat with `operation_state='not_dispatched'` that stays in the denominator.

Rationale: diff reviewers catch line-level mistakes; the scope reviewer catches cross-module contracts; running both on the same staged snapshot prevents one result from hiding the other. The managed-update exception reviews the same declared M0→S subject in both lanes. Task acceptance is a separate root-owned post-delivery system specified once under Task lifecycle; it shares `adaptive_quorum` and these transports, has no acceptance scope actor, and stores its verdict separately from the terminal result.

#### Session identity and advisory parsing

Session reviewer identity comes from `gateways.claudexor.final_attempt_facts`: the unique `final_attempt_id` row in the engine-owned `final/telemetry.yaml`, bound to the requested run id, and model, harness and credential profile are read from that SAME attempt. `summary.model`/`harnesses` echo requests, and summary route/auth projections may borrow earlier-attempt facts; none supplies a missing observation. Reviewer usage, last-execution views, delegated terminal payloads and settlement preserve known facts or explicit absence; the original custody/billing route remains the chosen authority, separate from the observed actor. No quorum rule or model-name mapping follows from this disclosure.

Advisory row parsing owns its `PASS|FAIL` and `critical|advisory` values at `preflight_review_run._is_checklist_array`, canonicalizing case and surrounding whitespace once for every consumer. An unknown verdict, or an unknown or missing FAIL severity, rejects the whole array into the bounded extraction rail; unresolved output stays `parse_failure` with its full source retained. PASS without a severity remains compatible and the separate genuine-empty-clean predicate is unchanged; an optional array validator lets the shared canonicalizer honor this surface contract without changing triad, object-verdict or report semantics. Canonicalization never changes the reviewer's judgment by searching the repository for words or identifiers.

#### Structural gates

Structural smoke gates are a deterministic BIBLE P3 codebase-size component. `ouroboros/review.py::iter_gated_modules` is the one source inventory for smoke, `codebase_health`, census and the UTF-8 byte gate (Python everywhere plus first-party `web/**/*.js`, vendored/minified excluded). `ouroboros/size_ratchet_manifest.py` is a generated, data-only debt register consumed through AST literals: exact module debt above 1600 lines, exact function debt above 300 lines, the 1001–1500 band with rationale authority, and exact byte debt above 200,000 UTF-8 bytes. `validate_size_ratchet` proves the live and staged manifests exact against their trees and shrink-only against the merge-aware committed authority — no first-parent history replay: the previous manifest resolves from `HEAD` or any of its parents, and a checkout with no committed manifest anywhere bootstraps from its own tree, so a fork whose local line predates the manifest is never condemned by inherited topology. Official-repository CI runs the blocking `size_ratchet` pytest lane while every local surface reports the same findings as warnings; two disclosed residuals — pairwise validation covers only the base→HEAD interval, and the official block presupposes branch protection. Within a validated pair, debt can shrink but cannot be swapped, re-entered, grow on the byte axis or survive stale. `MAX_TOTAL_FUNCTIONS` (`ouroboros/review.py`) remains the coarse runtime ceiling. `codebase_health` and review readiness also report informational headroom from that same inventory: runtime function count, LF-normalized module lines/UTF-8 bytes and function size against current limits. The overview prioritizes ordinary near-limit modules before registered debt; readiness selects touched paths. Debt and omitted rows are labelled. Positive capacity stays separate from warning findings and adds no gate or setting.

A deterministic hot-store growth invariant sits beside these gates: `agent_startup_checks.py::hot_store_growth_notes` (surfaced by `context_health.py::build_health_invariants` and once per worker boot) stats eight hot stores plus the `archive/chat_*.jsonl` aggregate — `state/usage_attempts.jsonl`, `logs/events.jsonl`, `logs/tools.jsonl`, `logs/supervisor.jsonl`, `logs/task_reflections.jsonl`, `logs/progress.jsonl`, `state/scheduled_tasks.json` and `state/skill_review_root_tasks.jsonl` — against justified byte thresholds in `ouroboros/context_budget.py` and emits a WARNING with a remediation pointer.

Three gen/verify inventories ride the same discipline as the size manifest (generator `scripts/regenerate_inventories.py`, verify `tests/test_generated_inventories.py`, staleness = red): the frozen-contracts inventory (`docs/inventories/FROZEN_CONTRACTS_INVENTORY.md`, a machine extraction of §11.1 with every owner/anchor path resolved against the tree and the `ouroboros/contracts/` package-coverage gap pinned), the data-layout inventory (`docs/inventories/DATA_LAYOUT_INVENTORY.md`, every entry of the §1 "Data layout" tree probed as a tracked repo path or a runtime-source literal, so a durable file renamed in code while its tree row survives turns red), and the facade inventory (`docs/inventories/FACADE_INVENTORY.md`, the AST-derived `noqa: F401` re-export surface with per-leaf domains from `ouroboros/domains.toml`).

#### Prompt size, density and windows

`review_helpers.REVIEW_PROMPT_TOKEN_BUDGET` bounds assembled inputs: triad packets, per-slot plan packets, task-acceptance packets and skill-review chunks with their own headroom. Scope and deep review assemble briefs, not repository packs; native sends use `review_native_transcript_bound` and reach other sources through tools. Every surface scales its output reserve to the route's usable window (`reviewer_window.window_scaled_reserves`); a reserve sized for a much larger window can otherwise consume all input room before a request reaches the provider.

Sizing is density-calibrated, not keyed to model names. `usage_accounting.execute_physical_attempt` records settled `(prompt_chars, prompt_tokens, route_fp)` witnesses in `capability_evidence.json`. Main uses the newest fresh exact-route witness, then exact-model witness, then neutral density; reviews use the densest fresh exact-model witness, which can undercut `COLD_START_TOKEN_DENSITY`. Stale, absent or cross-model evidence keeps the conservative floor. The witness TTL and bounded retention preserve both its densest support and recent observations. `calibrated_input_token_limit` combines the shared cap, measured density and absolute margin per call; triad, plan, acceptance and native transcript sizing consume it rather than freezing an import-time result.

Only the triad packet has a cold-start probe rung: `review_admission.density_probe_before_size_refusal` invokes `capability_evidence.cold_start_density_probe` when an irreducible packet exceeds a cold route's cap. One bounded slice of the actual prompt is sent on that exact model under `physical_attempt_limit(1)`; its witness buys one resize and fit pass. It never probes a warm route, retries the probe or runs when the packet fits. Progress and `review_density_probe` retain the attempt; a paid-ledger refusal is `budget_refused` and leaves the size refusal unchanged. This breaks the loop in which a request rejected before dispatch can never teach its tokenizer density.

`reviewer_window.resolve_reviewer_window` is the route-specific sizing source, with metadata probes serialized per route and limited by evidence TTL. There is no model-window table or window-authority floor. `ReviewerWindow.sizing_window` has a full-window sizing default for an unknown API window; raw subscription routes keep no numeric unknown-window assumption. `scope_window` adds its designated-default or conservative fallback and distinguishes confirmed, asserted, stale-unverifiable, designated-default and unknown provenance. `POST /api/owner/capability-ack` records an asserted window bound to one route fingerprint, invalidated by a route change; it sizes sends and grants no reviewer authority. A failed send supplies no verdict, while a small window alone does not remove a responding reviewer.

#### Scope review by retrieval

Every scope row retrieves in every context mode. A native API row preserves its configured identity, model, route, account pin, effort, processing preference and local-route flag while the surface selects inspection delivery; a session row uses its configured delegated session. The first review where a stored bare API row acquires episode semantics emits `review_scope_delivery_migrated` and writes `state/scope_delivery_migration.json`: changed cost and duration are disclosed before becoming an unexplained bill. Failure to write the marker repeats the notice later rather than failing review.

`review_admission.prepare_scope_review` builds each brief through `scope_review_session.build_scope_session_task`, without dispatch. It carries intent, rebuttal, history and open obligations; the touched-path dispositions and candidate sizes; the repository index; shared governance tiers and scope checklist; calibration/output contract; task evidence; and the required-source manifest. Stable governance precedes change-relative context for cache reuse. The full staged diff stays inline while the first send fits, measured by `native_first_send_chars` including schemas and wrapper. Otherwise it becomes one exact paged source in the task artifact store, with a byte-exact `.review-drive` view for a delegated session. An unavailable store is disclosed and keeps the diff inline. Native inline sizing uses the landing threshold within `scope_first_send_bound`; sessions use `SESSION_INLINE_DIFF_CEILING_CHARS` because the harness owns their context selection. A managed-update subject is the authoritative M0→S resolution delta, never a substitute `git diff --cached` over the two-parent candidate. Invalid roots, missing subjects and failed assembly remain typed pre-dispatch failures; only an irreducible first send reaches `native_bound_below_first_send`.

When context construction fails before dispatch, preparation best-effort appends one `scope_review_preparation_failed` row to the existing events log, whose normal sink forwards it live. It names the task, slot, final model and original `context_unavailable` reason. This is row-local preparation evidence, not a panel verdict; logging failure preserves the same typed result, and model-control exceptions still propagate before logging.

`scope_required_sources.py` declares the change-relative reading minimum: touched protected runtime, prompts and frozen contracts; protection-owned families (`GIT_OPS_FAMILY_PATHS` and tool-dispatch leaves); and declared Python/browser contract twins, with both sides included. An ordinary touched file needs no whole-body obligation because the diff already carries its complete change. Each readable row binds raw-byte `source_revision`, normalized-text `complete_sha256`/`complete_chars`, range basis and candidate tree. Deleted or renamed sources retain their exact baseline preimages; paged diffs join the same manifest; unavailable sources remain explicit rows. Byte-identical governance already inline is satisfied by delivery without another read. The final rows are shared by brief and policy, and `required_sources_ref` plus `SCOPE_REQUIRED_SOURCES_POLICY` bind the actual manifest and review-contract fingerprint, so old replay authority cannot survive a changed contract. This minimum never restricts the reviewer's further reading.

Coverage records what could be observed: native receipts match source identity, opened root/path and delivered character intervals; sessions fold weaker journal evidence over the same rows. States are `complete`, `incomplete` with missing ranges, `declared_empty` for an explicitly empty manifest, and `unobserved` when measurement is unavailable. A changed source is a `source_gap`; availability or inline delivery never proves understanding. `review_context_atlas.repository_index` supplies orientation only: compact tracked-path dispositions, collapsed excluded classes, touched-file and direct-importer facts (size, digest, language, symbols and imports, with bounded totals disclosed). It renders no bodies, spends nothing, writes nothing and never limits what the reviewer may open.

The scope reducer keeps received findings and counts responding reviewers through `config.adaptive_quorum` independently of coverage. Reading gaps remain actor and panel diagnostics: they cannot change status, block a commit or trigger another paid review. The agent judges whether a particular gap needs more reading. Substantive critical findings still follow `OUROBOROS_REVIEW_ENFORCEMENT`; an unanswered reviewer does not count, and an all-`not_dispatched` panel retains its assembly/admission failure. Oversize requests, route failures and candidate-binding failures never become PASS; budget, custody, deadline and ownership keep their separate contracts. Retrieval keeps the reading obligation proportional to the change while exposing the actual evidence, instead of letting total repository size decide whether review can occur. If the change cannot fit a reviewer, split the change rather than weaken the reviewer.

#### Governance delivery

`tools/governance_context.py` owns the shared tiers for triad, scope, advisory and deep review. Tier 1 carries the applicable CHECKLISTS section, BIBLE.md and CHECKLISTS_ARCHIVE.md inline in a stable prefix. Tier 2 selects the review-protocol chapter, DESIGN for `web/` changes and DEVELOPMENT chapters naming touched files, within `runtime_limits.REVIEW_GOVERNANCE_INLINE_SHARE` of the usable window. Tier 3 gives physical-source book navigation for ARCHITECTURE; packet triad rows can additionally inline relevant sections within the same share. Each non-inlined document has a manifest disposition and navigation pointer. Retrieving rows can follow those pointers; tool-less packet rows receive an index of material not delivered, never an instruction to call unavailable tools. A whole document with the same source identity is credited as `delivered_inline` without a duplicate read.

#### Guaranteed-fit ladder

The triad packet retains its one-pass fit sequence in `review_admission.fit_triad_prompt`: shorten the optional evidence projection, replace duplicated post-change snapshots with a touched-path note, then re-render the same pinned subject at `-U0` while preserving all file/hunk identities and added/removed lines. The cold-density rung above can precede this sequence once. Advisory briefs and triad packets share the disclosed span-only release-carrier cut; triad additionally omits governance bodies byte-identical to its inline prefix, while managed subjects retain full texts. Every omission is named, and an irreducible oversized packet is a typed refusal. Scope uses its paged exact subject instead; plan review sizes its typed specification and declared evidence per slot, retaining the constitutional material self-modification plans require.

### Planning, deep review, reflection, memory

Plan review, task acceptance, commit review, and deep self-review answer different questions and never inherit one another's authority: planning judges a proposed approach before implementation, task acceptance the delivered objective, commit review a staged self-change, deep self-review the whole system. Post-task reflection and memory persistence learn from execution but approve none of those boundaries.

#### Plan construction and review

`plan_task` reviews an INTENTION before the work starts — the same organ for code, research, deliverables, and actions (BIBLE P3). The obligation is constitutional and the finalization gate is structural (`owner_hurry.force_plan_decision`); the order in which a task asks, explores and plans is the mind's judgment, and no prompt choreographs it. The envelope carries the goal, the plan prose, and a typed domain-neutral SPEC: `in_scope`, `non_goals`, `acceptance_claims`, `invariants`, `decisions`, `deferred`, `affected_paths` (REQUIRED — the files the work will CHANGE, `[]` when none), `affected_resources` (the same question in words: systems, services, projects, people, never resolved as paths) and `evidence`. A spec without `affected_paths` is refused before any dispatch with the typed `PLAN_RESOURCE_FORM_REQUIRED`, which records nothing. `ouroboros/tools/plan_spec.py` validates and normalizes the full operative content without shortening or dropping anything, hashes it, and mints the only valid `breaks` targets (`goal`, `claim_N`, `invariant_N`, `decision_N`, `deferred_N`) positionally, because a caller-chosen id could shadow another target and corrupt what a blocking finding `breaks`. Governance documents always come from the system repository; declared targets and evidence resolve against `active_repo_dir_for(ctx)`, and a path escaping the active subject or an unreadable root is a named omission, never a silent gap.

ONE structural fact tiers the governance pack: `constitutional` is true iff a declared `affected_paths` locator resolves under the Ouroboros system repository, whether the file exists yet (creating `ouroboros/new_module.py` IS self-modification). Nothing else buys the pack: `affected_resources` is prose, and an `evidence` locator is something to LOOK AT — reading a repository file is not changing it — so system-repo reads are only named in the disclosure note. A constitutional plan carries BIBLE.md and ARCHITECTURE.md in full (inline on an `api_chat` row; mandatory full reads on a retrieving `agent_session` row); that packet is not tiered, so assembling it without either is a typed failure, never a disclosure. Every other plan carries the runtime heading-derived navigation maps (`context_layout.generate_doc_nav_map`, never a copy) plus resolvable pointers. There is no plan-kind taxonomy, no agent-declared `plan_class`, no planning scouts, and no assembled repository pack for a plan.

The ONE caller-facing strength axis is the envelope's optional `reviewer_effort`: the panel's effort for THIS order, placed on the default rung of each row's ladder (`reviewer_slot_config.row_effort`: an explicit per-row effort, then a compound Cursor/Agy route slug, then the declaration, then the owner's `OUROBOROS_EFFORT_REVIEW`) and passed as an ARGUMENT of `plan_review_slots` only, so every other review surface keeps reading the untouched rows. Effort is roster identity: a different declaration re-dispatches a paid panel within `OUROBOROS_REVIEW_MAX_CYCLES`, the same one replays free, and it is recorded per wave (`reviewer_effort`; `declared_effort` in the last-execution projection, apart from the row's saved effort). Against BIBLE P1 this is the review panel's strength for one order — the owner's setting is the default, Ouroboros may order stronger or weaker per envelope — never the core's own model, effort or horizon. Disclosed residual: a cheap panel's closed GREEN is earned authority for that envelope, and a later stronger order does not reopen it.

Declared evidence is resolved by `ouroboros/tools/plan_evidence.py` against exactly two roots — the active workspace and the system repository — with the shared sensitive-name policy on locator and target and the disclosed bounds `EVIDENCE_PER_ITEM_BYTES` / `EVIDENCE_TOTAL_BYTES`: every refused, missing, truncated, oversized, binary or URL locator becomes a typed omission row in the manifest (the host never fetches a URL); a locator may carry an exact range (`::lines=A-B`, `::bytes=A-B`, `::tail=N`, `::symbol=Name` for `.py` sources), and an oversized source is attached head-first with the cut named. A `need_evidence` locator a reviewer names is attached by the host on the next cycle through the same policy; what it cannot attach becomes a `[reviewer-requested]` omission row the panel is dispatched with, never a reason to run no reviewer. The manifest hash joins the spec hash and `constitutional` in the wave fingerprint, so changing what the reviewers can see changes the identity of the review — an attached locator makes the next envelope a new fingerprint, never an idempotent replay — while the root exploration log stays outside that identity. The evidence continuation uses a fresh full-packet dispatch only when no exact artifact reference exists, disclosed per slot as a `capability_delta`; an unreadable referenced artifact instead fails closed with `plan_review_exact_artifact_unavailable` and never mints replacement authority.

Own-room dialogue is automatic evidence: `ouroboros/dialogue_evidence.py` reads the complete retained room through `Memory.read_chat_generations` (rotated and consolidated history included) under the shared `project_dialogue.room_membership` predicate, plus the progress stream and addressed `owner_mailbox` entries — both speakers, options, quiz recommendations and answers, attachment names (the canonical manifest `label`), typed outcomes and sender/relay provenance. The winning quiz answer is written to canonical chat history as its structured block (after `record_answered`; an answered `quiz_closed` reply heals it), so eviction and mailbox cleanup never erase it and History shows it in the original card without a second bubble. Missing history, room binding and unstable capture remain explicit coverage gaps; acceptance freshness stays with the acceptance directives ledger, and planning consumes no separate directive section.

`ouroboros/tools/plan_dialogue.py` captures the redacted full room as an immutable `task_source` in existing artifact custody, bound to the author-request identity (goal, prose, spec, declared evidence, the constitutional fact). Identical author inputs and free collection reuse the recorded snapshot — progress, panel-settled messages and other room growth cannot buy a new panel — while a genuinely changed author request (a changed plan or an explicit evidence request) captures the current room. The wave fingerprint includes the snapshot digest; `dialogue_source_ref` and the author identity survive hot-index compaction and child promotion beside `spec_source_ref`; every result names the original capture and excludes later messages. `chat:<id>` and `chat:<id>@<sha256>` locators address the room and its recorded snapshots through `plan_evidence.resolve_evidence` with the same selectors, redaction and omission accounting; runtime files do not become general path evidence, and related Main/lineage rooms (bound siblings included) remain labelled pointers, never unsolicited inline neighbours.

`ouroboros/tools/plan_packet.py` keeps the current objective, spec and prose complete, and own dialogue bypasses the ordinary per-item/total evidence bounds. Delivery follows the per-delivery source contract: Packet/API slots receive all of it while their calibrated route window, governance and output reserves permit, otherwise the newest text plus the exact immutable omitted byte range; native retrieving slots fit under `review_native_transcript_bound` and the mandatory-reading declaration — native sizing measures the complete first request (`native_first_send_chars`, schemas and wrapper included) — with full artifact access through `native_data_root`; delegated sessions receive a mandatory full-read instruction and the complete redacted artifact outside `active_root`, their harness owns context selection (no host-invented numerical window or 1M claim), and an actual overflow is disclosed as exact coverage/omissions. File availability never attests that a reviewer read it all: plan review declares no required-source manifest to fold, so coverage stays declared/unobserved and a retrieving reviewer is recorded `host_file_read_attestation: unobserved`.

Slots come from `reviewer_slot_config` over the `review_execution._review_route_executor` seam. Reviewers return ONLY a typed findings array — `blocking` with a `breaks` id, `note`, or `need_evidence` with a locator the host attaches (or a spec id in `breaks` as a question to the author, who answers, escalates or defers it openly in the disposition); the HOST validates membership, demotes invalid findings with disclosure, keeps failed slots in the quorum denominator, and computes the aggregate — `GREEN`, `REVIEW_REQUIRED`, `REVISE_PLAN`, or the honest `DEGRADED` — through `config.adaptive_quorum`. No reviewer emits GREEN as authority. Premise criticism and simpler alternatives are optional brainstorming notes whose adoption is Ouroboros's; no mandatory competing plan, and repetition alone cannot promote advice to a blocker.

`plan_review_state` v2 inside the root task result is the bounded durable index: each wave records a hash-bound `task_source` reference to the full operative spec, the hashes, `constitutional`, validated findings, aggregate, dispositions and paid state (full waves, specs and manifests: `plan_review_artifacts.py`; review evidence stays redacted). State reads share the task-result writer's lock without rewriting JSON; source resolution starts after lock release. Current-authority readers restore the full spec before comparing plans or binding its `acceptance_claims` (`contracts/task_contract.effective_acceptance_claims`); compaction and child promotion retain both references, and an unavailable recorded source is a typed infrastructure failure, never empty claims or a new unpaid cycle. A v1 record is read-only (`legacy_v1_projection`; an OPEN v1 wave projects `legacy_open_requires_resubmission`, never auto-closed). A corrected full goal/plan/spec can be selected by an explicit `review_disposition.author_action` with author disposition and the referenced review fingerprint. `current_attempt.author_subject` holds its exact source and separate critic reference; `plan_review_artifacts.current_author_plan` restores it without a new wave, GREEN or paid cycle. Advisory finish can select its claims as `acceptance_claims_source=author_plan`, after ingress claims and through the existing receipt-support checks. Blocking can save and stop but cannot use the plan as approved; `closed_plan_review_wave` remains literal critic-closed authority. The gate and terminal disclosure follow the author's explicit `review_fingerprint` for historical critic outcome and pending custody as EVIDENCE INTO A GAP — a revised plan with no wave of its own stops reading `unavailable` — without granting that wave's closure to the revised plan: the enrichment fills only an ABSENT outcome and never moves the attempt's own lifecycle, because overwriting the status with `open` took the release back off an exhausted cap and off a degraded rail (an author permitted only to finish honestly was pushed back into a cycle it cannot buy), forcing `closed=False` contradicted `closed_plan_review_wave`, which still bound that wave, and replacing a current wave's own aggregate would let a historical verdict stand in for the one this plan earned. The projection therefore carries `historical_critic`, and both of `owner_hurry.py`'s renderers read it: the terminal disclosure labels that outcome as the earlier plan's instead of showing it as this plan's own, and the blocking reminder answers it with its own branch, because its outcome-keyed advice would otherwise send the agent to dispose a wave that cannot approve the revised bytes. A rail that forced finalization keeps its own sentence with the author clause appended, since returning the author decision alone hid `the cap is spent; the task ends blocked`; an author STOP carries `allow=True` under every enforcement, so it is excluded from the advisory-continuation sentence rather than described as work that proceeded — and because the projection's stop REPLACES the status, a rail that fired under a stop is not separately named, the stop being the fact that ended the task. The open-wave status reads `cycles_exhausted` from the attempt and the wave, because an author finish at a spent cap stamps only the attempt (`_apply_author_subject`, the one writer with no in-flight guard) and the gate otherwise held a task that may only finish honestly; that read is guarded by `custody_pending`, since a paid slot still working could yet close the wave and releasing then would trade an honest hold for a premature blocked terminal. Missing criticism stays unavailable, and author finish/stop stays separate. Disclosed gap: `web/modules/review_presentation.js::planReviewGroupFromTaskDetail` still selects the critic by the author's `review_fingerprint` and renders that aggregate as the group's own verdict, so the CARD can show an earlier plan's GREEN where the terminal disclosure says the revised plan has no verdict; the same projector also reads `rail_degraded` from the attempt but `cycles_exhausted` only from the wave, so an author finish at a spent cap on its own wave now releases the gate and reads blocked in the terminal while the card still shows the wave's aggregate. Both are one presentation gap needing its own change with browser verification, not a backend fact. Old-wave collection never replaces the selected author source. The first exact wave also stores the request policy and per-slot prepared inputs/fit sizes, which collection reuses unchanged — `native_mandatory_read_chars`, the review contract hash and the physical-operation binding never move with live exploration or owner clarification — and a historical wave without them is a typed source-unavailable result, never guessed values.

A fresh dispatch returns control at the dispatch barrier (`ReviewRequest.drain_deadline`, drain window 0): the wave is recorded open with typed `pending_dispatch` rows for the workers still running, whose custody stays with the recorded wave in the process (`review_custody`). A paid actor still physically in flight keeps the wave open as `DEGRADED` with `review_late_result_pending` even when the settled rows meet the arithmetic quorum, so a late blocking result cannot arrive after a false GREEN. When the last released slot settles, the settlement thread writes ONE system frame into the task's mailbox (`owner_mailbox.write_task_message`, provenance `system`) so the mind wakes exactly as for a child result; it never closes or aggregates the wave — collection is the sole wave writer (`plan_review_collect`). Task acceptance's twin announcements (its own quorum, completion) carry each reviewer's own verdict; the aggregate still comes only from collection.

Collection is the existing `review_disposition` mode addressed at the recorded wave (`items` may be `[]`): it reconciles process-local custody with drain window 0 over the wave's own recorded inputs — never re-reading the evidence, never changing the wave's identity — closes or advances the wave, pays the cycle once from the settled rows, and never waits; waiting longer is only the identical envelope resubmitted. A reconciliation re-records the packet that was physically DISPATCHED (each slot's `request_messages`, `session_task` for a retrieving row), never a rebuilt one, so a directive that arrived after the dispatch reaches the reviewers only in the next physically sent packet. A NEW review envelope over an in-flight wave first collects what has settled at $0, then supersedes it (reconcile-before-supersede) instead of being refused; late settlers attach as historical supplements, accounted once without another send. A wave with custody pending is never compacted out of the hot index.

An answer that has not arrived is a gap, never a failure or a verdict. The STORED wave is the fail-closed floor: an unanswered slot stays an `ok=False` row no quorum counts, and the open `DEGRADED` + `custody_pending` pair holds every gate with no fifth aggregate for older builds to refuse. Renderers read `plan_review_runtime.plan_wave_slot_census` before wording a slot: `awaiting` is `operation_state=pending_dispatch` only; `unresolved` is `in_flight`/`custody_lost`, named as unresolved on the line and by raw state in Reviews, never called waiting (`late_result_pending` is true for both); `uncollected` has a settled supplement not collected yet; `not_dispatched` is a $0 refusal, not a failure. Verdict and failure wording and the task's `degraded` stamp belong to collected slots only: a finish over an only-awaited wave or panel keeps its disclosure and records `awaiting` (`execution.plan_review`, review axis; `owner_hurry.plan_wave_only_awaited`, `_outcome_receipts.review_runs_only_awaited`). `owner_hurry.force_plan_decision` makes ONE free collection of the current pending wave in every enforcement mode, hurry too, then projects the returned state (`plan_review_collect.collect_before_gate`). Advisory and hurry keep their local release; collection updates disclosed facts, never permission to proceed. Context health reads the canonical wave, never collecting: `PLAN REVIEW WAVE OPEN` names its fingerprint, pending-slot count and snapshot timestamp (not a physical start, not a liveness lease) and disappears once collection clears custody.

Closure follows the finding class (`plan_spec.closure_after_disposition`) at initial synthesis and at later dispositions: GREEN and note-only REVIEW_REQUIRED close immediately in either enforcement mode; outstanding `need_evidence` closes through a disposition-only `plan_task` call (no model call, no cost: accept = answered, reject, defer = deferred openly; an answer reaches the reviewers on the next paid cycle, a revised envelope supersedes the wave with its open requests); a below-quorum blocking finding stays open; REVISE_PLAN is never closed by disposition — a subsequent paid delta review may evaluate a changed spec or a justified rejection when another cycle is available. A closed note-only wave still accepts voluntary `review_disposition` annotations through the same writer, spec/verdict and paid-cycle count fixed and the immutable predecessor retained: optional reasoning history, not a new plan gate, never another panel.

Paid cycles are bounded by the shared `OUROBOROS_REVIEW_MAX_CYCLES`; `cycles_paid` and the typed `cycles_exhausted` state count PAID cycles only. A wave is paid iff at least one reviewer slot was physically dispatched, and the proof is a settled row: a slot released at the barrier is $0 until its row proves the send, so the cycle is paid at collection, never at the barrier, and a nothing-dispatched wave of typed $0 skip rows stays unpaid and never replaces a paid predecessor. A barrier-dispatched panel is nevertheless committed money: while its wave is custody-pending and the cap has no room for another panel, a revised envelope first collects EVERY other custody-pending wave at $0 (`plan_review_collect.collect_before_supersede`) and, if the cap still has no room, is HELD with the typed `PLAN_REVIEW_IN_FLIGHT` refusal (`plan_review_collect.in_flight_hold`) so the current wave stays collectible (the per-case cap arithmetic: `plan_review_collect.py` docstrings). An identical envelope replays the recorded wave free, with one exception: an open wave whose blocking findings all carry valid reject dispositions may dispatch exactly one subsequent paid delta panel when another cycle is available.

Before fan-out the engine captures one panel health snapshot (`subagents.route_health`, route-level evidence): a slot with positive structural evidence of a spent lane becomes a $0 typed skip row that stays in the denominator; unknown health dispatches (fail-open). The wave records the health epoch and reviewer-roster fingerprint, and a recorded DEGRADED wave replays free only under an identical envelope, matching epoch and unchanged roster — otherwise another paid panel needs remaining cycle capacity (replay/epoch casuistry: `plan_review.py` docstrings). When the wave's own typed rows prove the quorum structurally unreachable, it carries `quorum_unreachable` plus the earliest recorded reset, and under blocking enforcement the finalization gate RELEASES while the review stays open: the agent may finalize `blocked_with_evidence` (reason `plan_review_quorum_unreachable`), wait through a one-shot `schedule_followup`, or ask the owner — the host adds facts only, never an answer template.

Under blocking an open wave otherwise holds implementation and an exhausted cap escalates as typed `review_cycles_exhausted` (free disposition and exact pending custody keep their rules); under advisory the agent may proceed with the wave open, after typed owner-visible `plan_review_advisory_open` events (one per announced outcome: the dispatch snapshot, then each settled failure with its code and reported cause) and with the open wave recorded in the task's state and result; the model-facing guidance, the `plan_task` description and the cap head say that the agent's own answer is where the open wave is stated, never that a host narrator will state it for it. A forced rail hands its ONE model call the same limitations as typed `key=value` facts inside `_prepare_forced_prompt`, so they are priced by the existing wrap-up reservation probe and no no-call rail gains a call. A hold the agent was told about that the owner's hurry then released reaches it once before its last word; every other gate transition already arrives through the agent's own `plan_task` result, the settled-wave task message, or that forced prompt. Unavailability, invalid state, budget refusal and deadline rails stay typed non-authoritative attempts, never substitutes for GREEN, and a reviewer request the host cannot attach is never refused before dispatch: the only $0 exits are those attempts, `not_dispatched` slot rows and the `pending_dispatch` rows of a barrier-released wave. Every disclosure states the wave's CURRENT state, names the late-result fact while a slot can still settle, never calls an open wave ended, and renders a rail with no recorded reason as absence, not an internal token.

#### Deep self-review

The retained report (`memory/deep_review.md`) is historical evidence, not a current-tree verdict: it records its actual `generated_at` time in the provenance header, and `source_revision=unknown` is explicit because these deliveries capture no frozen reviewed Git revision — neither a live HEAD nor a file mtime can fill that gap. Context quotes a disclosed 8,000-character excerpt, labels unknown legacy provenance, and leaves the stored report intact.

A task with `type=deep_self_review` bypasses the ordinary tool loop and calls `deep_self_review.run_deep_self_review` on its configured `deep_review` row. An absent row is synthesized as API from `OUROBOROS_MODEL_DEEP_SELF_REVIEW`; the tool and agent read the effective row. Every row retrieves, with two deliveries under `ReviewRequest(surface="deep_self_review")` and the shared execution seam:

- **Native inspection**: every `api_chat` row, bare or configured-subagent, runs `NativeToolRoundReviewExecutor` with the repository root and real runtime data root. The task carries the role/method, BIBLE.md and standing disclosures inline through the shared governance tiers, relevant rules within the inline share and reference-book navigation. Bounds are the route-sized working view, owner deadline and logical window, and paid ledger; exhaustion returns the retained draft with its actual incomplete end.
- **Delegated session**: `AgentSessionReviewExecutor` receives the same task and report contract (markdown, not an output schema), and reads through its harness. Inline delivery is recorded separately from the weaker or unobserved tool-reading provenance.

Both deliveries inline the seven-file memory whitelist byte-exact: identity, scratchpad, registry, WORLD, full knowledge index, patterns and improvement backlog. Every entry carries `inlined`, `missing`, `empty`, `oversized` or `read_error` in the task, `deep_review_memory` usage and the report header. Memory is the subject of this review and is supplied directly, not left to discovery. Matching inline governance is `delivered_inline`; additional native coverage comes from executed receipts matched by opened root/path and source identity, with `read`, `partial(fraction)`, `missing` and `unobserved` stated honestly. Reading gaps remain diagnostics and never invalidate a finished report.

Every delivered report has a sanitized host provenance comment and human line naming delivery, model, memory and omissions, coverage, incomplete status and attestation; native rows additionally carry rounds, calls, receipts, end reason, transcript and landing facts. `incomplete` reflects the delivery's actual interruption, independently of diagnostic reading gaps; session completeness stays unobserved. Each outcome (responded, empty or exception) records the row's last execution and memory fact, and `persist_call` retains prompt/response custody. Typed `deep_self_review_unavailable` or `deep_self_review_error` failures return `execution_status=infra_failed`, reach task/error records and leave the previous `memory/deep_review.md` intact; `BudgetExceeded` propagates to the agent's budget-pause rail.

Availability follows `deep_review_route`, never a window floor. An API row needs credentials for its actual routed model: a stored `openai/<slug>` can resolve to direct `openai::<slug>` when direct credentials exist and `OPENAI_BASE_URL` is unset, while a product `-pro` slug resolves to the direct default. Session rows require a healthy delegated route. These reviewers have no mutating tools and run no plan, acceptance or commit reviewers: the report is diagnostic memory, not implementation or publication authority. Retrieval enables a targeted whole-system survey across successive views without confusing an assembled packet with measured consideration of the whole system; exact sources remain accessible, and the record distinguishes supplied inline content, observed reads and unknown coverage.

#### Post-task reflection

Typed root post-task triggers decide whether a run warrants Experience Review. `reflection.generate_reflection` sends the Light route one open prompt with the EXACT initial text (never a prefix) and its host-recorded `task_inputs.run_origin` beside it (provenance, never by itself the accepted requirement) plus tool-use, error, review and child projections and the same frozen non-final cost snapshot the task summary uses; it runs outside the tool loop, records its own usage, and its failure never erases the delivered result or changes a review verdict. Its execution trace is the ALL-CALLS listing (`build_trace_summary(all_calls=True)`): every call in order with every argument, identical consecutive calls folded into one `×N` row with their rounds, the first line of a failed or repeated call's result, and one header count of rounds whose every call was non-ok — no positional window and no literal cut, because the consolidation seam fits the call to the Light route whenever that route's window is known (an unknown window sends the prompt unchecked — the accepted residual of enlarging it); the STORED `trace_summary` (task card, parents, children) stays the bounded two-argument preview. The trace row carries the `round_id` of the model round that issued the call (absent when unknown), when the listing really cut an argument value or a failed/repeated call's answer, the redacted per-call record is retained through `retain_memory_source` and named in the prompt as OPTIONAL reading (never a required source), and its claim states the STORED bounds on both axes, not completeness: an argument already passed `sanitize_tool_args_for_log` (an oversized value carries a marker with its length and sha) and a result is the stored actor-visible cap — more than the listing, which shows only the first line of a failed or repeated answer — a partial one naming its own `FULL_RESULT_SOURCE_JSON` or `FULL_RESULT_SOURCE_UNAVAILABLE`, with a call's recorded manifest named only when it has one — claiming results "in full" or an unconditional manifest overstated a cognitive artifact. Cut detection reads the ONE shared marker list (`artifacts.SANITIZER_OMISSION_MARKERS`), because a width test over already-sanitized args measured the widest argument in the task as a small one and retained nothing at all, while a hand-rolled subset missed the `_repr` and `_error` shapes whose arguments survive only in the call blob. Unavailable source retention is disclosed, error details group by full redacted content before display clipping, and post-task synthesis — the reflection, its Pattern Register update and the episodic summary — thinks at the owner's Task / Chat effort (`settings_scales.resolve_effort("task")`), never a literal. Admission to the Pattern Register is typed, not a word scan: it opens on a call the loop recorded as errored (its stamped `tool_result_code`, or the recorded status for a legacy row), on a producer fact naming a failure the ok status cannot carry (a preserved commit whose post-commit tests failed publishes `post_commit_tests`), on typed codes already stored with an entry, or on a genuinely FAILED child — a cancelled, soft-landed best-effort or degraded child is not a failure. Those failed-child classes reach the root through the child evidence the synthesis walk already collects and make the run error-bearing for both the trigger and the prompt's error details: children do not reflect, so a short clean root that delegated the work is the only place its child's failure can be learned from at all. Deliberately not "a reason code exists", which would open the register on every terminal.

A reflection lands where it durably belongs: a non-project root appends the full entry to the canonical `logs/task_reflections.jsonl`; a project-scoped root appends the full entry to its project drive and the canonical log receives only a bounded pointer row — full project text never enters the canonical log, which feeds future global context. A project-bound task's context includes a bounded labeled tail of its own project's reflections; the headless mirror drive of a split root is never the reflection home, and the Pattern Register update stays canonical in both cases. Every entry carries task identity, evidence, lessons, backlog candidates, and validated memory actions. `MEMORY_ACTIONS_JSON` permits only `scratchpad_append`, `knowledge_write`, and `identity_update_candidate`, at bounded count and size. `apply_memory_actions` routes accepted actions through provenance-preserving memory and knowledge APIs. An `identity_update_candidate` is recorded in the scratchpad for review and is never auto-written to `identity.md`. For a project-scoped task, reflection applies knowledge actions only (the project store by default, explicit global allowed); its scratchpad and identity-candidate actions are skipped because this automatic Light pass lacks the conversation's full view — the conversation writes identity and scratchpad from any room through its own tools. Reflection may propose a future campaign or backlog item, but it cannot enqueue, review, commit, or enable one.

The Pattern Register writer (`reflection._update_patterns`) REPLACES the whole document, so every decision input it reads is complete — the full current register, the exact initial text (`goal_exact`, beside the bounded `goal` display) and its `run_origin` and the whole reflection text; a prefix of a decision input can never authorize the rewrite, because a clipped clause can record the inverse of what the reflection concluded. `patterns` is a reserved global-only topic alongside `improvement-backlog` and `overview`: whichever room writes it, the register has ONE home on the canonical drive, the only one its writer and its readers (context assembly, deep self-review, the headless copy) address. Re-read, exact compare, history append and atomic replacement are one critical section outside the Light call; a register that moved under a losing writer is preserved and that task's learning is DROPPED with a warning naming the task, never retried against a source it did not decide from. A row's count is bumped once per observed episode, so two roots of one owner request bump it twice — the number counts episodes, not distinct requests.

The advisory rows a reflection or summary reads are ATTRIBUTED. Advisory runs are scoped by repository and several tasks legitimately review one checkout, so `collect_review_evidence` renders as `recent_advisory_runs` only the rows this task owns plus legacy rows carrying no owner (which stay unknown, never re-attributed); another task's rows reach the prompt under their own heading naming the owning task ids, and every row carries its owning task, attempt, phase and complete snapshot hash. Repository readiness (`current_repo`, open obligations, commit-readiness debt, the exact-snapshot match) stays repository-scoped, because that is what "can this checkout be committed" means. The split is keyed on ROW IDENTITY, never on a scope key: an empty repository key widens the candidate list to every advisory run on the drive, and the installation's history is not one task's record.

Only roots synthesize; `root_phase_checkpoint` makes paid synthesis at-most-once across restart, while children contribute evidence. Durable-result persistence owes the answer as `final:<tid>:<digest>` in `supervisor/terminal_delivery.py`'s bounded outbox (§5; normal/cancel/reap). `send_message` delivers immediately; the retained buffered copy shares its ID for durable dedupe. Replays use bounded backoff. Exhaustion/eviction preserves full text on disk, emits `terminal_delivery_exhausted` and a chat notice; external delivery remains at-least-once. Buffered `task_done` stays last to retain the slot/child drive during synthesis; a hung-synthesis reap need not lose the delivered answer. Project roots keep early answers in Project. Their canonical row and deferred Main mirror use `terminal_projection.settle_terminal_projection` via task-done/checkpoint/startup/maintenance; §3 "Main rows and host-stamped card rows" owns readiness, retirement and limits.

Synthesis receives a sealed final package from the durable result — the submitted final text, its artifact manifest and completion_observations. Full redacted action observations live in the canonical artifact store (`task.budget_drive_root or drive_root`), in the write-once `source_handles/context_checkpoints` store with verified `task_source` refs, before compact publication and outside deliverables and inferred readiness; their native reader `get_task_result(include_completion_source=true)` returns complete length/hash first, then explicit `source_start_char`/`source_end_char` ranges (`artifacts.text_source_range_projection`, the shared work-order range contract), with bytes, kind, path containment and SHA checked before any excerpt. Packet-only summary/reflection receive per-send-tool counts, each family's latest recorded return, and task-related skill readiness with coverage; full-source references are for later readers, not evidence the synthesizer has read. Positive observed facts correct error-trace impressions, while tool success does not prove owner receipt, empty material does not prove absence, and skill readiness does not attribute an owner's action to the task. Before context cleanup, `agent_task_pipeline.emit_task_results` also freezes `review_evidence.task_inputs` through `post_task_synthesis.capture_task_inputs`: `run_origin`, the existing task-local owner corpus, intact question/answer provenance and the canonical split-root verification-receipt union. Summary and reflection receive the same complete redacted content through `reflection.task_inputs_prompt_section`, separate from bounded trace/review excerpts. A zero return code is positive evidence; an unrelated later pass cannot resolve another check's failure. Peer proposals stay attributed, and unavailable input is not evidence that approval or verification never existed. Recovery uses these stored observations and inputs, not a later conversation. Summary trace pointers name the task and existing archive-aware reader (`ouroboros tasks watch <task_id> --jsonl`), not guessed flat log paths.

Pooled workers retain their slot until root post-task synthesis settles, for API-only and subscription tasks alike; early final-answer delivery keeps the response independent from that queue timing. Ordinary native post-work, including an inline Presence turn after its durable result is returned to the adapter, stays on its registered actor thread without a pooled worker slot: its `TaskModelWait` owner remains available through `POST_TASK_SYNTHESIS_INFLIGHT` after ordinary dialogue admission closes, detached server post-work binds its own live owner in the same registry, and the task mailbox stays available until the terminal post-task checkpoint. An open phase remains finalizing rather than appearing completed. Typed quota/auth waits resume only the unsettled call, stop or unknown outcomes degrade the phase without repeating finished stages, and restart recovery degrades an indeterminate `running` phase rather than replaying a possibly paid request.

#### Project registry and lease

A project is a focused working room, not an isolated sub-mind (§6 Durable memory and project focus). The projects registry (`projects_registry.py`, `data/state/projects.json`) owns immutable project identity, canonical chat id, optional working directory, lifecycle/tombstone state (`active|deleting|tombstoned`), routing generation and activity revision; admission persists the resolved project id in the task itself. An id minted from a DISPLAY name collapses dash runs and carries a short deterministic suffix when the name held characters the slug could not keep, so two different non-Latin names cannot share one project; the normalizer is unchanged, so existing ids are never re-slugged and stay reachable by their explicit id. `project_lease.py` serializes assignment of pooled roots by Project while allowing their own subagent trees; it is not a physical-folder lock and does not withhold tools from ordinary conversation. Binding/history files support routing and presentation, not the lease. Delete closes routing, cancels/quiesces the tree, and tombstones only after settlement, preserving everything for recovery.

#### Project binding by task and by origin

The durable binding is the SINGLE truth about a task's project: the in-task scope guard and `project_facts.resolve_project_id` read it FIRST, ahead of `task["project_id"]` and a worker's in-memory `ctx.project_id`, which are copies a mid-run conversion never reaches — a guard reading only the copy is how a task already bound to one project can mint a second, empty one. The same store also answers BY ORIGIN (`projects_registry.project_id_for_origin`, keyed on the ingress-captured `(chat_id, client_message_id)` stored in every binding's `source_ref`), because one owner message spawns several task ids — the turn that received it, the root it promoted, the timeout retry that replaced that root — and the project its WORK has belongs to all of them: a promote with no explicit target inherits the promoter's binding, then the origin's, before the in-memory scope copy, and its admission resolves the origin once more. A timeout retry is bound by the reaper inside its retry admission transaction (`worker_promotion.bind_retry_to_origin_project`, called by `task_reaper._run_retry_admission_transaction`): the predecessor's binding, then its origin, answer, and the retry reuses the stored origin by value, so retried work keeps its room instead of arriving in Main as a second convertible unit. That bind happens only after cancellation has lost the admission boundary, because a binding is immutable and a bound-but-never-admitted retry id would answer `project_id_for_task` forever; a retry suppressed by a cancelled or already-terminal root is never bound, and a refused bind or unreadable store leaves the retry unbound and discloses `project_binding_failed` rather than holding up the retry.

Every IMPLICIT claim — the UI conversion, that admission, the reaper's retry admission and the in-task `ensure_project_scope` — holds one process-local claim lock (`projects_registry.origin_claim_lock`) from the read of which Project the origin already names through to its own durable bind, while a naming model call stays OUTSIDE it, so two cards of one message clicked inside a naming window yield one Project and two bindings. Explicit `project_name`/`project_id`/`route_to_project` remain the model's choice (P13): a sibling that names a different room gets it, and the message's existing Project is never renamed from a task that does not belong to it. Legacy state where one origin names several active Projects resolves to the one whose task is still live, else the latest binding, disclosed as `project_origin_ambiguous`; continuations that carry no owner origin (`schedule_followup`, direct auto-resume, Presence promotion) stay per-task. An unreadable bindings store is disclosed once and read as "no binding" on every path: the refusal is reserved for the measured case, a readable binding to another project, and on BOTH conversion paths it precedes every side effect — no project row, lease mark, broadcast or announcement survives it: a UI conversion that named a DIFFERENT project id answers 409 naming the bound project by id and display name, the one-click conversion adopts that project instead, and a bind refused after the lease mark restores the lane with the same 409, so no lane keeps a project the binding does not name. One residual survives: a conflicting bind landing between the final re-read and the bind leaves behind the empty project row the request had already created, because the registry deliberately has no primitive that removes a row (delete tombstones the id permanently, which would cost the owner that id and display name forever); the row holds no task and no binding, and the owner deletes it like any other project. The lease mark is fill-only, except that a conversion which already holds the binding it is about to write moves the lane onto that binding.

#### In-task project scoping

`ensure_project_scope` (`tools/control_delegation.py`) can create or bind the current root to one project mid-execution: it persists the durable registry binding first, then marks the live queue/lease surface under the queue lock so the lease recognizes the running task as a lane occupant; it is idempotent for the same project, and a task BOUND elsewhere is renamed, not re-scoped — its scope call carries the requested display name to the project it already belongs to and creates nothing. The act rides the same receipt rail as the other routing verbs (§6 Task lifecycle) under its own synthetic `agent-steer:<token>` id: the tool scopes itself in memory at once (`journal_write` targets the project meanwhile) but its RESULT states only the durable outcome the supervisor recorded — `delivered` with the binding it re-reads, a typed `rejected` (bound elsewhere with the rename outcome, a refused bind, a registration failure), or `unconfirmed` when no receipt landed within the bounded wait; `persisted` on a routing receipt is true only when a row was written. A late bind after a lost acknowledgement is discoverable from the durable binding, which the next same-project call reads as already scoped. A planning obligation stays with the task on ensure. A project-SCOPED but unbound run keeps the older refusal, since there is no durable project to rename, and a child still cannot escape the inherited scope.

#### Durable memory and project focus

`context.py` assembles static governance, semi-stable memory, and dynamic task evidence without treating truncation as forgetting; the recent-activity sections are each task's OWN newest rows (progress 50 rendered; tools 20 selected, 10 rendered and 20 scanned for review markers; events 200 counted by type) through the bounded reader `jsonl_tail.py` (`Memory.read_task_recent`: a doubling live tail plus at most three newest archives), never a global tail filtered afterwards (issue #131), and their header's coverage line names the rows, the window and any unopened archives while `read_file` pages the rest; a subagent child gets the same three windows beside its `## Working sources` block, its tools and events read from its own execution drive (its worker rows; host-side rows such as waits stay in the canonical log, as the header says) and progress from the canonical log; the Development context matrix and `context_layout.py` own which reference form is resident. When the rendered scratchpad exceeds `SCRATCHPAD_SECTION_BUDGET_CHARS`, `context.py` keeps the newest whole blocks that fit and drops the oldest behind an in-band gap marker naming `memory/scratchpad.md` as the live source; no block is retired by a context build, and scratchpad replacement keeps its explicit summary and source-journal provenance.

`consolidator.py` publishes a block and advances its generation-aware cursor only after complete room draft and correction; a missing generation appends `[MEMORY GAP]` instead of resetting. `context_fit` measures Light against fresh route/account capacity and calibrated density; `llm_local` owns the local output reserve, and absent evidence stays unknown. `room_consolidation.py` processes each room separately and assembles sections deterministically. Both knowledge stages receive the entire current note and source episode; the corrector's complete read, not the draft's, binds revised entries. Older episodes cannot negate newer facts; model judgment governs supported corrections. Source range reads and CAS preserve old/new history. Startup compaction is a no-op; earlier digests cannot be reversed. A failed correction withholds the chunk and cursor.

Oversized sources split without clipping, including within an entry. `consolidation_retry` records source hash and a smaller same-route bound, invalidated by source/route/capacity/reserve changes. Era compression regroups rooms deterministically; failed eras retain blocks and legacy provenance stays unknown. `last_consolidation_error` clears after a failure-free advance. `pending_knowledge_nominations` records each source entry BEFORE note publication; an unrelated successful batch cannot remove one. Legacy `last_unpublished_nominations` persists. Health shows three distinct abbreviated source+position IDs and omitted count; full proposals live in `knowledge_history.jsonl`. Unreadable meta preserves debts and warns in Health; Nano pressure records no-progress instead of aborting Main. Invalid legacy receipts warn separately. Old digests and debts need explicit resolution. Spend remains nullable; model-control errors follow `propagate_model_error`.

Consolidation labels every chronological source message through `dialogue_provenance.RoomLabelResolver`, using the actual `chat_id`, never lineage `project_id`; one read-only registry snapshot supplies the window. Main is named only for the actual Main id, a resolved project uses its current registry name and stable chat id, and missing, unknown or ambiguous rooms stay explicit. Ephemeral formatter offsets carry the original room/author/direction/transport header into split continuations without parsing message bodies or duplicating their bytes. Room draft and correction prompts require meaningful decisions, approvals, outcomes and unresolved commitments of that room, retaining source distinctions (who decided, what was authorized, what stays owed) and one first-person Ouroboros voice. Length adapts to content within the existing output-token ceiling; no per-room word quota, semantic gate or absent room is imposed. Labels establish provenance, not summary success. The mixed Main recent view opts into the same labels; focused Project rendering, membership and explicit `chat_history` retain their existing behavior and bytes.

`knowledge.py` owns note reads, revision-checked writes and indexing; `tools/knowledge.py` exposes them. `knowledge_write(mode="edit", old_str=..., content=...)` replaces ONE body occurrence under the current revision, preserving other bytes and frontmatter. Missing/ambiguous anchors, absent notes and stale revisions refuse before writing. Character/heading deltas reach results, bounded there but complete in history. Edit adds storage capability, not a semantic writer policy; overwrite/append stay unchanged. Blank revision creates only a missing note. Malformed legacy preambles stay readable with uncertain metadata; missing linked notes remain unwritten.

Ouroboros remains one identity across Main, project rooms, and Background Consciousness: unified dialogue memory remains available to the one agent, while an executing project task preferentially receives its own thread, journal, workpad, and project knowledge. `project_facts.py` routes project facts to `projects/<id>/knowledge`; subagents inherit the root's resolved project id and never derive a new one; identity and the scratchpad are one canonical pair written from every room, with no per-project copy. Project `journal.jsonl` records curated milestones and `workpad.md` retains active working context (`tools/project_journal.py`); focused context includes the workpad in full and recent journal rows with a visible pointer to older entries. On root completion, only high-signal blockers, questions, and interface contracts are mirrored once from the ephemeral task-tree ledger into the durable journal, and a finished root whose effective working tree is not the registered `working_dir` writes one typed "work lives at <path> @ <sha>" journal row from facts the task record already holds. A project digest gives consciousness a concise completion signal without pretending to be the raw project memory.

### Skills and extensions

Skill capability grows through independent gates, each with its own module: discovery and manifest parsing (`skill_loader.py`, `contracts/skill_manifest.py`), content-hash-bound review (`skill_review.py` / `skill_review_runner.py`), owner grants, dependency reconciliation (`skill_dependencies.py`, `marketplace/isolated_deps.py`), enablement, readiness (`skill_readiness.py`) and execution (`tools/skill_exec.py`). Discovery establishes identity, source, provenance (`.self_authored.json`), conflicts and hash; it confers no trust. Review status, grants, enablement and dependency health stay independent durable facts under `data/state/skills/<name>/`; the gate sequence, payload buckets and marketplace/hub layer are §13's. `skill_readiness_for_execution()` composes review, hash, enablement, grants, dependencies and peer conflicts into phase-specific next actions and reads the mode-aware `gate_for` projection (`executable_review`), never a raw verdict string. The owner may attest their own skill, or a hash-verified official hub payload, to skip the expensive LLM review (`skill_owner_attestation.py`); the deterministic preflight floor still gates it. The model-facing catalogue (`list_skills`, the per-turn Installed Skills section) projects the same live extension facts as `/api/extensions`; each enablement change best-effort appends a typed `skill_enabled_changed` row to `logs/events.jsonl` naming the actor (empty for writers not yet labelled), and an append failure is logged and never blocks the enablement change. Cyber review failures remain visible advice; visibility, successful execution and review PASS are still different facts.

A skill may declare a reviewed `presence:` behavior profile: instructions, knowledge topics, runtime defaults and portable capability requests that installation-local selections resolve to exact targets. Admission requires the bound behavior skill installed, enabled, freshly reviewed and complete for every required request, then compiles one immutable positive capability ceiling copied through `task_contract`, so mutable skill/Settings state cannot broaden a live turn. An optional owner-local `workspace_root` (chosen through `configure_presence` or the Skills settings form, validated by `workspace_admission.validate_workspace_root`, frozen into the task's workspace contract) changes the file/process target while retaining canonical shared memory; it neither derives Project scope nor forks the data drive, and later edits and promotion/follow-up tasks keep the admitted folder rather than rereading mutable settings. A folder that has become unusable refuses the promotion typed (`workspace_unusable`, the repair in `detail` naming the profile) and writes no chat row — the public conversation's synthetic chat id is never spoken to.

`extension_loader.py` and the isolated-dependency layer load only a ready, hash-matching extension — in-process via `PluginAPIImpl`, isolated-dep/native ones as child-process proxies — and a review PASS alone proves neither dependencies installed nor a widget loadable. Per-skill health at `data/state/skills/<name>/health.json` is process-qualified: the server's observation is authoritative, a worker's is a handoff-qualified view.

`skill_lifecycle_queue.py` (§13) exposes queued/running/succeeded/failed plus stale metadata — stale is recovery evidence, not a fake unlock of a still-running thread. Scheduled work is reconciled by `resync_skill_schedules()` and runs only after `skill_readiness_for_execution()`; schedule evaluation is a DST-aware system on the shared cron/timezone contract. Evolution remains hard-blocked in `light` runtime mode (§5). The existing payload binding (`skill_payload_binding.resolve_skill_payload_base`) fills an omitted skill name or bucket from a valid selected normal/repair `TaskConstraint`; explicit selectors still have to resolve to its same physical payload, and collision, native-mutation and child-profile restrictions remain independent. A selected-skill repair (`skill_repair_admission.py`, §13) is admitted against an immutable `base_content_hash` and verifies the observed `expected_content_hash` before each payload write, advancing it after opaque process work without claiming authorship; drift makes the repair STALE — no long shell lock, no rollback, other writers never blocked. These separations let skills expand capability without turning discovery, a UI toggle or old review state into execution authority.

#### Skill publication

The passive installed-skill projection never launches Betterleaks and never claims the current bytes are publication-ready (`skill_publish_eligibility.py`). Selecting Publish calls `POST /api/skills/{skill}/publish-preflight` (`gateway/skill_publish.py`, read-only), which resolves one current payload, captures and scans its bytes, recomputes review staleness and returns exactly one backend-authored state (`ready`, `warnings`, `needs_attention`, `repairable`, `hard_block`); the browser only renders those facts, and only `hard_block` prevents task creation. The authoritative flow is:

`passive index (no scan) → selected preflight → explicit confirmation → ordinary managed task → immutable current capture with separate review provenance → payload scan → GitHub read-only planning → derived-output scans → first GitHub mutation → validated same-skill pull-request receipt → ordinary acceptance`

Publication validation and immutable capture share `skill_publish_eligibility.publication_author_acceptance`: fresh publishable critic authority or qualified current Advisory author authority. Blocking keeps fresh critic requirements; owner attestation alone is not that independent-review/author chain. The host PR checklist states original critic and current author/published hashes, referenced review basis and author rationale, without claiming a second independent review. Recorded findings retain their actual severity, including critical and partial-quorum findings; catalog hashes and PR receipts never become review PASS. Passive and selected preflight use the same authority, with current captured bytes authoritative in selected preflight.

Every outbound byte derives from the capture (`skill_publish_snapshot.py`); the mutable live payload is neither reread nor rehashed to authorize the transaction (no time-of-check/time-of-use drift). Outside Cyber Pro, literal Betterleaks `high` findings (`skill_publish_scanner.py`) block the current outbound call; lower or unknown confidence is a redacted warning. Cyber keeps scanner findings/failures and review status as independent advice; an unavailable scan does not invalidate an observed publication. Packaged installs resolve the bundled `betterleaks-standalone`; source checkouts resolve the managed runtime installed explicitly with `python -m ouroboros.betterleaks_runtime install` — Publish never downloads it. A top-level `skill_publish` task (`tools/skill_publish.py`) is accepted only when pre-truncation metadata holds a validated pull-request receipt for the requested skill and configured Hub repository; the receipt proves the observed publication and never manufactures review PASS. A definite failure before any submission-branch request fails an explicit Publish objective even under degraded review; a last-confirmed stage never proves the next request unsent, so a previous unknown branch/PR attempt or valid same-target receipt is preserved.

A failed envelope (`skill_publish_result.py`) names its cause beside the stage: `reason_code` (the failed stage — `fork_sync_failed` and siblings), a `repair_hint` chosen from producer evidence, and the transport's sanitized `error_detail` with `github_status`/`github_operation` read only from gh's own error shapes, never inferred from prose. Fork synchronization is mandatory before any branch, commit or PR mutation; ambiguous PR settlement is a read-only exact lookup. Publication metadata is read from the producer JSON before the shared ToolResult host-note separator, so appended route or safety notes cannot hide diagnostics or a receipt.

Owner lifecycle actions share `skill_lifecycle_actions.run_skill_action`: grant/toggle run in the lifecycle lane, local delete uses `skill_uninstall_state` (uninstall tombstones and authorized local deletion keep separate retention), and attestation keeps its deterministic floor in `skill_owner_attestation`. The host supplies actor identity and checks exact resource/revision plus an existing member chat message, answered quiz or owner-mailbox record when owner intent is needed; the model interprets that source, and a generated edit-and-review request confers no grant, attestation, deletion or enable authority. An enable with no explicit chat/quiz/mailbox source resolves the original owner source itself (a client `allow_enable` flag authorizes nothing, Presence ceilings come first, a newer owner disable in `enabled.json` wins), and a Repair review never auto-enables — the model chooses the ordinary `toggle_skill` call. There is no permission ledger and no HTTP impersonation; the auto-grant policy stays separate from enablement, and an explicit owner disable survives review and free replay. `skill_exec` returns the revision captured before its script launch, and extension tool receipts carry the descriptor's `content_hash` from the same publication as `extension_generation`, only after physical dispatch; neither is review PASS or a semantic test verdict.

Marketplace update keeps the owner's selected version through retries; `install.PayloadRollbackSnapshot` captures payload/environment and the affected lifecycle-state quintet for update and adopt alike, and the single restore path verifies the required reload before claiming `rolled_back`, preserves independent enablement/history, and never deletes an already restored payload after a failed state write. Catalog updates disclose exact version strings and infer no ordering. The atomic publication-record owner (`marketplace/provenance.py`) also clears locally: it compares the displayed `published` object before setting that section to `null`, preserving unknown siblings, and changes no GitHub PR or installed bytes.

### MCP and browser-facing external tools

`mcp_client.py` owns configured HTTP/SSE and local stdio MCP discovery and invocation (HTTP surface `gateway/mcp.py`; tools are named `mcp_<server>__<tool>`). HTTP/SSE entries validate URLs and auth headers, and URL userinfo is masked through the shared secret projection (`secret_masking.py` owns the exact MCP token placeholder shapes). Load-time placeholder repair runs before environment precedence, so a real environment credential is never mistaken for a wire mask, and only for recognized top-level Settings secrets — nested MCP values are never silently migrated. Stdio entries pass one executable `command` and an exact string `args` list to the MCP SDK without a shell; optional `cwd`, literal `env` and `env_from_settings` (environment name → existing setting key) resolve from the same saved configuration for discovery and calls. Unknown fields are retained with a visible not-applied warning while a valid server stays usable; invalid known fields or references produce `MCP_CONFIG_ERROR`; the response-only `auth_configured` flag never becomes configuration. Discovered tools join the selected initial capability envelope beside enabled, granted extension tools, behind the same `network` resource gate as on a managed task (`schemas()`, `get_schema_by_name` and `execute` agree on that), and a discovery failure is an explicit capability omission through `list_available_tools`, never a silent removal. The catalog lookup (`MCPManager.resolve_tool_name`) precedes the paid safety check: an unlisted name is `UNKNOWN_TOOL`, a disabled server or an unlisted catalog (health unknown) `MCP_UNAVAILABLE`, an allowlisted-out tool `ACCESS_BLOCKED`; none runs safety, transport or a refresh; hits recheck settings before Safety to honor revocation. Hints name only the addressed server's `raw → callable` pairs and an exact naming-rule identity (`mcp_client.naming_rule_matches`); nothing is ranked, aliased or dispatched, and raw names stay out of schema descriptions. Cyber metadata-target and configured `allowed_tools` filters do not veto an existing MCP call; descriptions and results remain untrusted data; every call still crosses registry, resource, safety, timeout and result-handling policy. Web-tool prohibition and network prohibition are distinct: `web=false` alone does not disable configured MCP or extensions, while an explicit `network=false` and tool disables are enforced at discovery and dispatch.

Browser tools are stateful and thread-sticky because Playwright sessions and greenlets have thread affinity; they cannot be scheduled as ordinary parallel stateless calls. A stateful-tool timeout therefore RETIRES the browser generation: the shared `browser_state` slot is replaced and the close runs on the owning thread once the hung call settles. Retired sessions are bounded in-process at `_RETIRED_GENERATIONS_MAX` per task, after which another session is a typed `BROWSER_BACKLOG_RETIRED_SESSIONS` refusal; generation isolation is best-effort under concurrent replacement (a fully closed class needs a process-isolated browser worker — disclosed future design). Model-driven in-page evaluation runs the supplied expression without substring guesses through `_evaluate_bounded`: Playwright's `evaluate` accepts no timeout, so the expression is raced against an in-page rejection, which bounds the ASYNC class honestly and no further — a synchronous event-loop block cannot be interrupted from inside the page, and the outer tool timeout remains the backstop. The caller's timeout also becomes the session default (`page.set_default_timeout`), floored on the action path so the five-second action default cannot strangle a capture. Chromium is the default; WebKit and device descriptors are targeted tools for a real Safari/iOS risk, not a universal acceptance matrix and not a claim that a narrow Chromium viewport is Safari-equivalent. First-party PR helpers are normal built-ins whose mutating operations stay subject to selected-root policy, runtime mode, delegated-child constraints, credentials and reviewed-publication authority.

Browser target policy is `browser_policy.py`: ordinary owner-control admission uses the actual HTTP request and three-valued service identity — never JavaScript substring guesses, no per-network-request LLM, no second policy engine. Cyber root/acting requests retain target and control reach; explicit read-only assignments keep their restricted contract. A live binding in `state/server_port.bindings.json` proves an endpoint ours; a service's missing snapshot can mean an older installation or failed publication, so its recorded facts still name what is EXPECTED — the integer `state/server_port` (the launcher's `state/server_process.json` can prove main), the Host Service configuration beside an expected main, and the local model's custody row with its live argv — and a matching expected endpoint whose process cannot be verified is refused as unknown, never treated as foreign (`server_process.runtime_service_identity`). Only a live snapshot of the same service supersedes its legacy expectation: main cannot vouch for Host Service. Unmeasurable POSIX identity never counts as proof. Every other port is an ordinary target, an unrelated application reusing an `/api/owner/...` pathname included — the owner-operation request shapes apply only at a proven or unknown Ouroboros endpoint — and a restricted target that DNS cannot classify is a typed `BROWSER_POLICY_UNAVAILABLE` refusal before navigation. Chromium and WebKit follow HTTP redirects natively and Playwright route callbacks see only the first URL of a chain, so `tools/browser.py` re-checks each document's `redirected_from` chain with the same target predicate before any page result: an allowed→blocked→allowed redirect withholds its content and refuses actions on that document, while the forbidden hop's request has already been dispatched — an owner-accepted, disclosed residual, not a pre-request or DNS-rebinding guarantee. Cookies, POST semantics, service workers and native redirects are untouched: no proxy, CDP fork, pre-probe or refetch.

### Budget tracking

`swarm_efficiency.fanout_count` counts observed fan-out emissions and `fanout_interval_sec_total` sums the wall-clock gaps between them, intermediate parent work included; new events emit `fanout_interval_sec`, and readers tolerate the retired `wave_count`, `inter_wave_latency_sec_total` and `inter_wave_latency_sec` without rewriting stored bytes. These observations never infer semantic work waves or child-wait time.

The time/cost/intrinsic pacing checkpoints carry `resource_facts`: incremental per-tool call/error counts and producer-reported duration intervals (which may overlap; unmeasured calls stay unknown), plus own-task, tree and delegated-tree ledger buckets (own and delegated explicitly overlap the tree total) and the shared unreserved global remainder. No argv, stdout, sleep/poll classification or new stop rule selects behavior, and prompt and checkpoint show the same facts.

`usage_accounting.py` owns monetary policy over the physical-attempt ledger. Each send gets an ID and `reserved → dispatched → settled | unresolved`, or pre-dispatch `reserved → released`. Only typed proof of no sent bytes (connection/pool failure) permits `dispatched → released`; timeouts/unknown errors remain unresolved. Each retry is a new attempt; SDK/stream boundaries are labelled opaque. Main/direct/child/scout/review/safety/synthesis/reflection/consciousness work, retries and opaque SDK calls are covered; root scopes count tree and post-task/review work once. External scripts/extensions with model credentials stay unknown/unmetered at host-observed opaque boundaries absent authoritative settlement.

`cost_projection.py` owns producer amounts/openness: `accounted_upper_bound_usd` = settled+reserved+unresolved, null is unknown, finality is never invented, and `COST_OPENNESS_FIELDS` accompanies amounts. Retired `cost_usd[_with_children]` stays read-only. `cost_presentation` binds amount/facts to one bucket (§11.1): `reconstruct_task_cost` owns own scope; root terminal/heartbeat/checkpoint/synthesis paths use root-tree, never falling from null subtree to own zero. `_usage_rows._summary`'s weighted `priced_rows`, `tracked_nonfinal_rows`, `accounting_open_rows` survive compaction. A price or retained bound evidences zero; empty/unpriced rows do not. Settled unpriced rows leave the known subtotal exact; estimates (zero included), retained bounds, open attempts and integrity gaps stay nonfinal. Terminal refresh/copyback, synthesis, heartbeat and history preserve scope; unknown never becomes sticky-final. Sums and `cost_final` are unchanged.

A proven abandoned send closes administratively as `settled` with `settle_reason="abandoned"`, `cost_usd=None` and `cost_final=false`: its reservation bound stays accounted, not confirmed spend, and the price remains non-final. A real late receipt may correct the same attempt once (`late_receipt`); a positive never-started receipt may instead release it through the existing `before_dispatch_failed:` seam. Ordinary terminal settlements and releases remain immutable. Full and incremental ledger validation preserve the same correction eligibility; compaction retains unresolved and abandoned chains for that exact-id join, while existing historical baseline groups remain aggregates (the full storage contract is [Usage-ledger compaction](../USAGE_COMPACTION.md)).

After cancellation custody, existing maintenance calls `server_maintenance._reconcile_abandoned_usage` for settled tasks with no live physical owner/open post-task synthesis; review attempts retain their review owner. `llm_claudexor.recover_model_attempt` reads retained terminal CAS or the exact operation via owned-only discovery, retains bytes before ACK and never starts/restarts/cancels bookkeeping work. Missing identity, live work or unreadable evidence defers. The money lock rechecks each row so real concurrent receipts win; no age cutoff, timer or ledger is added. Projection reconciliation includes compacted-baseline attribution, retaining retries after failed result writes/native late receipts. One bulk breakdown feeds task/root owners; foreign canonical budget roots stay separate. `events_task_done._refresh_terminal_task_cost` changes money fields only, without completion events or invented synthesis.

Summary/reflection/consolidation share a frozen ledger snapshot: settled subtree cost, reservations, unresolved bounds/counts, unknown exposure, integrity and non-final state. Final terminal checkpoint alone owns final cost; read failure is unavailable/null, never zero. No reconciliation LLM or parallel ledger exists. Cache-hit health uses only rounds carrying `cached_tokens`, and stays absent with insufficient samples: unmeasured is unknown, not zero, so providers lacking telemetry cannot dilute measured ratios. Unknown spend remains the existing `unknown_unmetered` field, not a third accounting status.

`root_phase_checkpoint.accounting` retains a cumulative ledger observation: root ID, accounted/reserved/unresolved amounts, non-final/unresolved counts, unknown exposure and integrity. Separate from own-cost and read-time `TaskCostBreakdown`, it survives public detail/recovery and canonical replica protection. The checkpoint owner refreshes it, including explicit null/unavailable on failure. These facts prove neither an invoice nor local paid-work closure; phase/execution ownership is independent.

**Planning threshold** (`task_pacing.py`). One unreserved `CostCeiling` (`disabled`, `active`, `exhausted_soft_land`, `unknown`) owns runtime `in_task_cost_ceiling` disclosure and loop checks. Roots use min(global-remainder percentage, root cap) minus margin; uncapped roots use starting wallet. Enabled descendants inherit that number, not later percentages. Disabled profiles disable only pacing; monetary admission stays independent and surfaces name the binding bound. Rooted tasks compare subtree spend/holds even without root caps; own-spend fallback is a disclosed lower bound.

`loop_budget._finish_tool_round_budget` and `_finish_no_tool_round_budget` share `_check_budget_limits` after unfinished spending rounds. No-tool tails, including cold Resume (`resume_point.budget_tail`), neither advance nanny baselines nor arm tool controls. Candidates survive; READY returns before this check without an extra paid final. Eligible actors pause, even before work on a soft threshold. Ineligible actors retain the priced terminal rail (`budget_wrapup_unaffordable` if it cannot fit); global rejection before work buys no call. Tool requests remain incomplete even beside `replace`.

Affordability probes reserve nothing; full-cap ledger admission decides. Unknown spend is not zero; unknown price fails open. `_usage_cache_splits.py` reuses settled provider/normalized-route/review-surface splits: cache loss reprices full write, expiry may under-reserve one write, competitors may consume room. Proxy stops/native images require exact transcript-copy pricing before service finalization. `task_pacing.main_loop_wire_options` owns wire options with no later payload additions. Identity drift refuses pre-send (`forced_candidate_drift`); terminal handling retries once unpredicated, still ledger-priced, so drift cannot lose the answer.

#### Exact budget pause and Resume

`budget_pause.py` pauses pooled/direct work under the SAME ID on global exhaustion, graceful ceiling, either last-fit stop, soft landing or refused dispatch, without a paid final. A missing task id/root/continuation owner keeps terminal behavior (`exact_pause_unavailable`). Increases never wake tasks.

| Owner | Ordered contract and reason |
|---|---|
| `request_pause`, `usage_accounting.reserve_attempt` | Close `DispatchFenced`; review POST/replay and Light extraction also refuse (`budget_pausing_no_send`, `budget_pausing_no_extraction`). Persist `pausing` before waiting (direct RUNNING stub if absent) so crash custody cannot replay ambiguous work; the reaper derives the crash-retry fence from its one pause-row read (`worker_health._complete_exact_budget_pause_after_death`), failing closed on unreadable evidence. |
| `local_producer_observation` | Hold the worker nonterminal until sent reviews settle through `review_custody` AND timed-out tool futures finish their late settlement callbacks (`register_tool_future`/`hold_tool_settlement`); `done()` alone is insufficient. Failed writes/producers publish `budget_pause_hold` on change and retry, never claim a pause or buy a final; a publication failing after quiescence retries the SAME prepared snapshot, discarded if a producer revives. Only Stop/Panic/deadline/cancel ends the hold as `abandoned`, via the loop's model-wait control rails (a no-call terminal, never a task exception); controls read the canonical budget root on split drives. |
| `observe_task_runs` | Re-read custody (the loop side resolves its own custody root; the grant reads it directly); unreadable is `custody_read=failed`, not empty. Pre-terminal subscription coverage is unproven, so unsettled runs request `cancel_and_verify`, retaining typed outcomes. Unknown stop permits no second writer. |
| `owner_wait.continuation_state` | Retains cognition, opaque acceptance/preparation, usage/rounds/clocks. `resume_point` keeps the budget tail and unanswered call IDs; Resume inserts execution-UNKNOWN host rows, never replays tools. Source/row precedes `BudgetPauseRequested`; no task_done/result/Main final. |
| `events_budget.install_exact_budget_pause` | Validate event/source; park RUNNING or `parkable_direct_task` in PENDING as `_budget_pause`, persist snapshot, then mark `paused`. Root scope fences the tree. Park, projection and grant share the queue lock; pause-id/state CAS turns late publication into `budget_pause_park_superseded`. Direct records keep `_is_direct_chat`, omit inline image bytes and release the local fence once the actor unwinds (the durable row owns the hold). Resumed direct work uses a pooled worker; `log_addressing.address_task_event` keeps the lane. Projection carries ledger cost planes; a live-pause canonical row outranks the child replica and the queue mirror in `task_status.effective_task_result`. |
| `worker_health._complete_exact_budget_pause_after_death`, `queue_snapshot._park_pausing_running_rows`, `workers.kill_workers` | Complete a saved pause after death/restart; shutdown leaves exact carriers/rows untouched (never `pending_parent_interrupted`); boot re-parks. Revoke an UNCONSUMED grant against its current identity and re-park; a CONSUMED grant takes terminal crash custody, never ordinary retry. Failed revocation keeps source/grant in a nonterminal hold (memory-only if unpersisted). |
| `budget_pause_restore_refusal`, `events_budget.budget_hold_fact` | Pauses restore at any snapshot age/stamp validity without wake. Missing/unreadable/mismatched/terminal records or sources, root acceptance or malformed snapshot fences retain `_budget_pause` under `_budget_pause_hold`, never drop/cancel. Regrant revalidates. |

**Owner grant.** `POST /api/tasks/{id}/resume` → `queue_transitions.resume_budget_paused_task` → `budget_resume.grant_exact_budget_resume`: require authoritative positive global/root headroom, readable source, clear cancel/restart/Panic/deadline/lifetime rails and an unpaused ancestor root; re-read failed custody. Root headroom is ONE fresh strict ledger read (`usage_accounting.refresh_root_accounting(strict=True)`): a cached snapshot after a failed read, an unreadable ledger or a degraded tree refuses typed; display readers keep a bounded-stale fallback. Pause ID/generation and `resume_generation` bind a single-use grant. `revoke_exact_budget_resume` re-parks after lost money/restart, keeps newer identities and retries unwritten revocation before regrant. `model_wait.execution_elapsed_seconds` subtracts quota-union and cumulative `paused_duration_sec`/`budget_paused_sec` from original `started_at` across continuations, owner waits included; None stays unlimited. Money/round/review wallets never reset.

**Descendant selection.** `events_budget.hold_root_resume_descendants` makes children eligible, not runnable: exact rows stay paused; zero-dispatch/fence-only siblings get `root_fence_lifted_pending_selection`, rebound to the current root grant on each Resume. `resume_child_task` (`budget_resume_child`, recorded `selected_by`) selects within lineage: root selects stored descendants, an intermediate parent only direct children; owner selection shares the path. With a live latch, `budget_fence_selected` binds one member to its fence generation, leaving siblings fenced; legacy root Resume selects only root; `reserve_attempt` admits the member selected against that exact fence. New root pauses invalidate pending child grants; assignment rechecks root grant and fence for exact grants and zero-dispatch selections (stale → unselected hold). Other roots/cancelled/completed/stopped members never revive.

**Consumption.** `resume_paused_loop` rejects spent/revoked/foreign grants and discloses drift/custody before effects; a consumption publication that fails HOLDS (`resume_grant_consumption_unwritable`; identities kept), a grant revoked underneath re-parks; never FAILED. Graceful Resume refreshes ledger-authorized headroom via the same strict tree read and admits ONE fitting reservation (`_second_reservation_fits`, `budget_resume_last_fit_admitted`), avoiding the early-margin re-pause. Hard exhaustion needs owner increase; full-cap admission binds. Browser/services/hidden state and crash recovery are not restored.

#### Monetary authority and projections

**Live global limit.** Agent readers share one resolver: saved settings first, re-parsed only on file change; failure (including refused benchmark pins) falls back to environment without caching failure. Workers refresh environment only at task start, so live file reads make every reservation/wallet follow current `TOTAL_BUDGET`; planning thresholds remain separate. Absent means shipped default; non-positive means unbounded and silences the loop global axis. Disclosed pre-existing gap: supervisor startup/reload still parse raw settings and treat absence as unlimited.

`pricing.py` uses bounded best-effort exact normalized-route lookup and provider catalog fields, never manual tables/prefix inheritance/fallback prices/admission allowlists. Unknown price admits while known spend fits: reserve None, settle from reported cost or later exact price, otherwise None/non-final. Only structural pre-generation evidence with zero usage permits confirmed-zero rejection/release, preventing phantom exhaustion during provider storms (`_usage_response.py` normalizes; adapters retain raw usage). `review_wave_admission` uses the same estimator and tighter global/root remainder as `reserve_attempt` before skill/plan/task/commit review; managed-update assisted apply reuses it before destructive merge. Unpayable slots bypass without model substitution. Unknown-priced slots disclose uncertainty without disabling priced siblings' admission.

Reservations retain applied `global_limit_usd`, explicit unbounded state and `global_limit_source`/`global_limit_revision` through transitions. Overrides inherit no foreign revision; legacy unknowns remain unknown. `usage_compaction.py` archives original rows beside the substrate, preserving sequence; commit requires identical NON-MONEY projections and decimal-identical money because six-decimal display rounding is not monetary equality. Policy abort emits `usage_ledger_compaction_skipped` with cause once per process/cause; name-tier refusal keeps `usage_ledger_compaction_refused`, making size warnings diagnosable.

`usage_ledger.py` owns one short cross-process lock for validation/reservation/transition/append/fsync; accounting imports it, never vice versa. Network I/O stays outside. Torn tails quarantine loudly; validated prefixes remain readable but degraded/non-final because paid work may be missing. Failed settlements retain dispatched/unresolved attempts; durable root-budget refusals clear on Resume only after proving no paid dispatch. `_usage_rows_memo.py` incrementally replays validated records, changing cost of reads, not meaning; append repairs a torn newline-less tail without losing earlier rows. `_usage_rows.py` owns pure arithmetic.

For a root task, `GET /api/tasks/{id}` derives `cost_breakdown` at read time from the same ledger (own, child, unattributed, disclosed delegated, subscription sessions, unknown/unmetered, finality, authority); it is never persisted, is not a third sum, and an unreadable or unattributable ledger omits the whole object rather than returning a confident zero. One physical reviewer send produces exactly one `llm_usage` row, emitted by the review substrate with that reviewer's wave and slot attribution (`skill_review_usage.py` is a read-only projection per `(review_skill, review_wave_id)`, not a second ledger), and a delegated session row reports its own route provider and resolved model, never an inferred one. `state.json`, task results, `llm_usage`, `/api/state` and `/api/cost-breakdown` are compatibility projections only; startup's resumable importer (`usage_legacy_import.py`) records source hashes, imports only attributable usage, and represents ambiguous history explicitly without rewriting source logs or fabricating attempts.