# Supervised worker fan-out

User goal: inspect an implementation, repair the proven defect, and obtain an independent audit.

1. The driver calls `spawn_worker` for a read-only investigator with `difficulty=medium`, a narrow workspace grant, explicit limited/unlimited values for every worker budget dimension, and acceptance criteria requiring exact file evidence and a falsifiable reproducer.
2. After `collect`, the driver inspects the cited seam and calls `spawn_worker` for one implementer. Its acceptance criteria name the behavior, targeted test, and allowed files. The driver keeps the implementer's selected model for the later audit floor.
3. If acceptance changes while the implementer is running, the driver calls `revise_contract`; `steer` is conversation and never changes the contract. The ledger shows `pending`; the supervisor delivers the revised canonical capsule only after generation-correlated `agent_settled`, then records `delivered`.
4. The driver calls `collect`. A candidate report can remain `running` when evidence, `report_schema`, `acceptance_check`, budget, or human approval blocks the Gate.
5. The driver calls `spawn_worker` for an auditor with the implementer's exact `audits_worker_id`; the runtime floors auditor capability at that implementer's model. The auditor receives read-only authority and acceptance criteria requiring fresh evidence, not agreement with the implementer.
6. The driver reruns the decisive check, reconciles any ambiguity explicitly, and owns the final response.

At every step, `list_workers` is the authoritative view. `stall.silent` and `stall.no_progress` are running-only observations; neither authorizes nudge, redelivery, retry, or cancellation. `blocked` means the RPC child declared `wait_for_input` with a reason and correlation, never a guess from prose or silence; wake it only with the exact correlation on steer, revision, or granted peer delivery. Contract, Ledger, Lease/launch, Gate, and Delivery remain separate; requested capability is not a launch grant.