@gethelio/proxy 0.9.0 → 0.10.0

package/dist/cli.js

@@ -142,9 +142,9 @@ var policyActionSchema = z.enum([
   "dry_run"
 ]);
 var ruleApprovalSchema = z.object({
-  channel: z.string(),
+  channel: z.string().min(1),
   timeout: durationSchema.optional(),
-  delegates: z.array(z.string()).optional(),
+  delegates: z.array(z.string().min(1)).optional(),
   escalation_after: durationSchema.optional()
 }).strict();
 var evidenceSchema = z.object({
@@ -226,22 +226,80 @@ var policiesSchema = z.object({
    */
   hot_reload: z.boolean().optional()
 }).strict();
+var budgetContributorSchema = z.object({
+  tool: z.string().min(1),
+  // picomatch glob, same engine as match.tool
+  field: z.string().min(1)
+  // dot-path into tool arguments, e.g. "$.amount"
+}).strict();
+var budgetSchema = z.object({
+  // The name is embedded in bucket keys (`budget:<name>:<scope>`) and, later,
+  // ledger rows — constrain it so keys stay parseable and scope classification
+  // (e.g. the sender-key cardinality guard) cannot be confused by delimiters.
+  name: z.string().min(1).max(64).regex(/^[a-zA-Z0-9_-]+$/, {
+    message: 'Budget names may only contain letters, digits, "_" and "-"'
+  }),
+  limit: z.number().positive(),
+  currency: z.string().min(1),
+  /** A sliding duration ("1h", "7d") or "session" (a depleting pot per session key). */
+  window: z.union([durationSchema, z.literal("session")]),
+  key: z.enum(["global", "session", "sender_id"]).default("global"),
+  /**
+   * What a breach does: `deny` blocks the call outright; `require_approval`
+   * raises one composite break-glass ticket per call listing every breached
+   * budget, and the call proceeds only on an explicit approval.
+   */
+  on_exceed: z.enum(["deny", "require_approval"]).default("deny"),
+  /**
+   * Break-glass ticket routing (same shape as rule-level `approval`). Only
+   * valid with `on_exceed: require_approval`; when omitted, tickets fall
+   * back to the dashboard channel and the global `approval.timeout`. Note
+   * that `default_on_timeout` never applies to budget tickets — they fail
+   * closed on timeout regardless (money gates do not fail open).
+   */
+  approval: ruleApprovalSchema.optional(),
+  /** Session windows only: idle time before a session pot is collected. Default 24h. */
+  idle_ttl: durationSchema.optional(),
+  contributors: z.array(budgetContributorSchema).min(1)
+}).strict().superRefine((budget, ctx) => {
+  if (budget.approval !== void 0 && budget.on_exceed !== "require_approval") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["approval"],
+      message: 'budget approval config only applies with on_exceed: "require_approval" \u2014 with on_exceed: "deny" it is dead config. Remove it or switch on_exceed.'
+    });
+  }
+  if (budget.window === "session" && budget.key === "global") {
+    ctx.addIssue({
+      code: "custom",
+      path: ["key"],
+      message: 'window: "session" requires key: "session" or "sender_id" \u2014 a global bucket with session lifetime never replenishes and never ends. Pick a per-session or per-sender scope, or use a duration window.'
+    });
+  }
+  if (budget.window !== "session" && budget.idle_ttl !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["idle_ttl"],
+      message: 'idle_ttl only applies to window: "session" budgets. Duration windows expire entries on their own; remove idle_ttl.'
+    });
+  }
+});
 var slackChannelSchema = z.object({
   type: z.literal("slack"),
-  name: z.string().optional(),
+  name: z.string().min(1).optional(),
   bot_token: z.string(),
   signing_secret: z.string(),
   channel: z.string()
 });
 var webhookChannelSchema = z.object({
   type: z.literal("webhook"),
-  name: z.string().optional(),
+  name: z.string().min(1).optional(),
   url: z.string(),
   secret: z.string().optional()
 });
 var dashboardChannelSchema = z.object({
   type: z.literal("dashboard"),
-  name: z.string().optional()
+  name: z.string().min(1).optional()
 });
 var approvalChannelSchema = z.discriminatedUnion("type", [
   slackChannelSchema,
@@ -278,20 +336,23 @@ var helioConfigBaseSchema = z.object({
   dashboard: dashboardSchema.prefault({}),
   environment: z.string().optional(),
   policies: policiesSchema.prefault({}),
+  // Budgets sit beside policies deliberately: they are the second half of the
+  // governance declaration (policy decision → budget gate), not plumbing.
+  budgets: z.array(budgetSchema).default([]),
   approval: approvalSchema.prefault({}),
   audit: auditSchema.prefault({}),
   sdk: sdkSchema.prefault({})
 });
 var helioConfigSchema = helioConfigBaseSchema.superRefine((cfg, ctx) => {
   const hasConfiguredEnvironment = typeof cfg.environment === "string" && cfg.environment.trim().length > 0;
-  const requiresSecret = cfg.policies.flag_destructive === "require_approval" || cfg.policies.on_tool_drift === "require_approval" || cfg.policies.rules.some((rule) => rule.action === "require_approval");
+  const requiresSecret = cfg.policies.flag_destructive === "require_approval" || cfg.policies.on_tool_drift === "require_approval" || cfg.policies.rules.some((rule) => rule.action === "require_approval") || cfg.budgets.some((budget) => budget.on_exceed === "require_approval");
   const hasSecret = hasDashboardApiSecret(cfg.dashboard.api_secret);
   if (requiresSecret) {
     if (!hasSecret) {
       ctx.addIssue({
         code: "custom",
         path: ["dashboard", "api_secret"],
-        message: 'dashboard.api_secret is required when any rule uses require_approval or policies.flag_destructive or policies.on_tool_drift is "require_approval". Generate one with: `openssl rand -hex 32` and set it under `dashboard.api_secret` in your helio.yaml. (See docs/approvals.md.)'
+        message: 'dashboard.api_secret is required when any rule uses require_approval, any budget uses on_exceed: require_approval, or policies.flag_destructive or policies.on_tool_drift is "require_approval". Generate one with: `openssl rand -hex 32` and set it under `dashboard.api_secret` in your helio.yaml. (See docs/approvals.md.)'
       });
     }
   }
@@ -309,6 +370,86 @@ var helioConfigSchema = helioConfigBaseSchema.superRefine((cfg, ctx) => {
       message: "dashboard.host must be a loopback address (127.0.0.1, localhost, or ::1) when dashboard.allow_open_mode is true and dashboard.api_secret is unset."
     });
   }
+  const channelTypeByKey = /* @__PURE__ */ new Map([["dashboard", "dashboard"]]);
+  for (const [channelIndex, channel] of cfg.approval.channels.entries()) {
+    const key = channel.name ?? channel.type;
+    if (key === "dashboard" && channel.type !== "dashboard") {
+      ctx.addIssue({
+        code: "custom",
+        path: ["approval", "channels", channelIndex, channel.name ? "name" : "type"],
+        message: 'The channel key "dashboard" is reserved for the built-in dashboard channel. Pick a different name.'
+      });
+      continue;
+    }
+    if (channelTypeByKey.has(key) && !(key === "dashboard" && channel.type === "dashboard")) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["approval", "channels", channelIndex, channel.name ? "name" : "type"],
+        message: `Duplicate approval channel key "${key}". Channels register under name ?? type \u2014 give each channel a unique name.`
+      });
+      continue;
+    }
+    channelTypeByKey.set(key, channel.type);
+  }
+  const knownChannelKeys = new Set(channelTypeByKey.keys());
+  const resolvesToDashboard = (key) => channelTypeByKey.get(key) === "dashboard";
+  const seenBudgetNames = /* @__PURE__ */ new Set();
+  for (const [budgetIndex, budget] of cfg.budgets.entries()) {
+    if (seenBudgetNames.has(budget.name)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["budgets", budgetIndex, "name"],
+        message: `Duplicate budget name "${budget.name}". Budget names are the identity that preserves accrued spend across config edits \u2014 each budget needs its own.`
+      });
+    }
+    seenBudgetNames.add(budget.name);
+    if (!cfg.sdk.enabled && budget.key === "sender_id") {
+      ctx.addIssue({
+        code: "custom",
+        path: ["budgets", budgetIndex, "key"],
+        message: 'budget key "sender_id" requires the SDK sideband (sdk.enabled: true) \u2014 sender_id is supplied by hook adapters and is absent on the MCP path.'
+      });
+    }
+    const budgetChannel = budget.approval?.channel;
+    if (budgetChannel && !knownChannelKeys.has(budgetChannel)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["budgets", budgetIndex, "approval", "channel"],
+        message: `Unknown approval channel "${budgetChannel}". Add it to approval.channels (type or name), or use "dashboard".`
+      });
+    }
+    for (const [delegateIndex, delegate] of (budget.approval?.delegates ?? []).entries()) {
+      if (!knownChannelKeys.has(delegate)) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["budgets", budgetIndex, "approval", "delegates", delegateIndex],
+          message: `Unknown delegate channel "${delegate}". Delegates must reference configured approval channel names.`
+        });
+      }
+    }
+    if (budget.on_exceed === "require_approval" && !cfg.dashboard.enabled) {
+      const effectiveChannel = budget.approval?.channel ?? "dashboard";
+      if (resolvesToDashboard(effectiveChannel)) {
+        ctx.addIssue({
+          code: "custom",
+          path: budget.approval?.channel !== void 0 ? ["budgets", budgetIndex, "approval", "channel"] : ["budgets", budgetIndex, "on_exceed"],
+          message: "This budget routes break-glass tickets to the dashboard channel, but dashboard.enabled is false \u2014 the ticket could never be resolved and would always time out. Enable the dashboard or route approval.channel to a Slack channel."
+        });
+      }
+      const escalationAfterMs = budget.approval?.escalation_after !== void 0 ? parseDuration(budget.approval.escalation_after) : void 0;
+      const effectiveTimeoutMs = parseDuration(budget.approval?.timeout ?? cfg.approval.timeout);
+      const escalationCanFire = escalationAfterMs !== void 0 && escalationAfterMs > 0 && escalationAfterMs < effectiveTimeoutMs;
+      for (const [delegateIndex, delegate] of (budget.approval?.delegates ?? []).entries()) {
+        if (escalationCanFire && knownChannelKeys.has(delegate) && resolvesToDashboard(delegate)) {
+          ctx.addIssue({
+            code: "custom",
+            path: ["budgets", budgetIndex, "approval", "delegates", delegateIndex],
+            message: "This budget escalates break-glass tickets to a dashboard channel, but dashboard.enabled is false \u2014 the delegate could never resolve the ticket. Enable the dashboard or delegate to a Slack channel."
+          });
+        }
+      }
+    }
+  }
   const hasWebhookChannel = cfg.approval.channels.some((channel) => channel.type === "webhook");
   if (hasWebhookChannel && !cfg.dashboard.enabled) {
     ctx.addIssue({
@@ -317,13 +458,6 @@ var helioConfigSchema = helioConfigBaseSchema.superRefine((cfg, ctx) => {
       message: "dashboard.enabled must be true when approval.channels includes a webhook channel. Webhook notifications require the dashboard sideband approval API."
     });
   }
-  const knownChannelKeys = /* @__PURE__ */ new Set(["dashboard"]);
-  for (const channel of cfg.approval.channels) {
-    knownChannelKeys.add(channel.type);
-    if (channel.name) {
-      knownChannelKeys.add(channel.name);
-    }
-  }
   for (const [ruleIndex, rule] of cfg.policies.rules.entries()) {
     if (rule.match.environment !== void 0 && !hasConfiguredEnvironment) {
       ctx.addIssue({
@@ -499,6 +633,75 @@ function diffReloadBoundary(previous, next) {
   }
   return { restartRequiredPaths };
 }
+function findUnroutableApprovalReferences(policy, budgets, surface) {
+  const problems = [];
+  const known = (key) => surface.channelTypes.has(key);
+  const isDashboardKey = (key) => surface.channelTypes.get(key) === "dashboard";
+  const escalationCanFire = (approval) => {
+    const timeoutMs = approval.timeoutMs ?? surface.defaultApprovalTimeoutMs;
+    return approval.escalationAfterMs !== void 0 && approval.escalationAfterMs > 0 && approval.escalationAfterMs < timeoutMs;
+  };
+  const needsRunningDashboard = (key, label, via) => {
+    if (isDashboardKey(key) && !surface.dashboardEnabled) {
+      problems.push(
+        `${label} ${via} the dashboard channel, but the running process has no dashboard server`
+      );
+    }
+  };
+  for (const rule of policy.rules) {
+    if (rule.action !== "require_approval") {
+      continue;
+    }
+    if (rule.match.metadata !== void 0) continue;
+    const label = rule.name ? `rule "${rule.name}"` : `rule[${String(rule.index)}]`;
+    const approval = rule.approval;
+    const effectiveChannel = approval?.channel ?? "dashboard";
+    if (!known(effectiveChannel)) {
+      problems.push(`${label} references approval channel "${effectiveChannel}"`);
+    } else {
+      needsRunningDashboard(effectiveChannel, label, "routes approvals to");
+    }
+    if (approval && escalationCanFire(approval)) {
+      for (const delegate of approval.delegates ?? []) {
+        if (!known(delegate)) {
+          problems.push(`${label} references delegate channel "${delegate}"`);
+        } else {
+          needsRunningDashboard(delegate, label, "escalates approvals to");
+        }
+      }
+    }
+  }
+  if (policy.flagDestructive === "require_approval" && !surface.dashboardEnabled) {
+    problems.push(
+      "policies.flag_destructive: require_approval routes approvals to the dashboard channel, but the running process has no dashboard server"
+    );
+  }
+  if (policy.onToolDrift === "require_approval" && !surface.dashboardEnabled) {
+    problems.push(
+      "policies.on_tool_drift: require_approval routes approvals to the dashboard channel, but the running process has no dashboard server"
+    );
+  }
+  for (const budget of budgets) {
+    if (budget.onExceed !== "require_approval") continue;
+    const label = `budget "${budget.name}"`;
+    const effectiveChannel = budget.approval?.channel ?? "dashboard";
+    if (!known(effectiveChannel)) {
+      problems.push(`${label} references approval channel "${effectiveChannel}"`);
+    } else {
+      needsRunningDashboard(effectiveChannel, label, "routes break-glass tickets to");
+    }
+    if (budget.approval && escalationCanFire(budget.approval)) {
+      for (const delegate of budget.approval.delegates ?? []) {
+        if (!known(delegate)) {
+          problems.push(`${label} references delegate channel "${delegate}"`);
+        } else {
+          needsRunningDashboard(delegate, label, "escalates break-glass tickets to");
+        }
+      }
+    }
+  }
+  return problems;
+}
 
 // src/policy/parser.ts
 import picomatch from "picomatch";
@@ -753,10 +956,52 @@ function checkSemanticWarnings(rule, index, warnings) {
   }
 }
 
+// src/budget/parser.ts
+import picomatch2 from "picomatch";
+var DEFAULT_IDLE_TTL_MS = 864e5;
+var BudgetParseError = class extends Error {
+  budgetName;
+  constructor(message, budgetName) {
+    super(`Budget "${budgetName}": ${message}`);
+    this.name = "BudgetParseError";
+    this.budgetName = budgetName;
+  }
+};
+function compileBudgets(budgets) {
+  return budgets.map((budget) => ({
+    name: budget.name,
+    limit: budget.limit,
+    currency: budget.currency,
+    window: budget.window === "session" ? {
+      kind: "session",
+      idleTtlMs: budget.idle_ttl ? parseDuration(budget.idle_ttl) : DEFAULT_IDLE_TTL_MS
+    } : { kind: "duration", windowMs: parseDuration(budget.window) },
+    windowRaw: budget.window,
+    key: budget.key,
+    onExceed: budget.on_exceed,
+    ...budget.approval !== void 0 && { approval: compileApproval(budget.approval) },
+    contributors: budget.contributors.map(
+      (contributor) => compileContributor(contributor, budget.name)
+    )
+  }));
+}
+function compileContributor(contributor, budgetName) {
+  try {
+    const test = picomatch2(contributor.tool, { dot: true });
+    return { tool: { pattern: contributor.tool, test }, field: contributor.field };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    throw new BudgetParseError(
+      `invalid contributor glob "${contributor.tool}": ${message}`,
+      budgetName
+    );
+  }
+}
+
 // src/config/watcher.ts
 var ConfigWatcher = class {
   configPath;
-  onPolicyReload;
+  onReload;
   onError;
   initialConfig;
   env;
@@ -765,7 +1010,7 @@ var ConfigWatcher = class {
   debounceTimer = null;
   constructor(options) {
     this.configPath = options.configPath;
-    this.onPolicyReload = options.onPolicyReload;
+    this.onReload = options.onReload;
     this.onError = options.onError;
     this.initialConfig = options.initialConfig;
     this.env = options.env;
@@ -807,8 +1052,9 @@ var ConfigWatcher = class {
     try {
       const config = await loadConfig(this.configPath, this.env);
       const { policy, warnings } = compilePolicies(config.policies);
+      const budgets = compileBudgets(config.budgets);
       const restartRequiredPaths = this.initialConfig !== void 0 ? diffReloadBoundary(this.initialConfig, config).restartRequiredPaths : [];
-      this.onPolicyReload(policy, warnings, restartRequiredPaths);
+      this.onReload(policy, warnings, restartRequiredPaths, budgets);
     } catch (err) {
       if (err instanceof Error) {
         this.onError(err);
@@ -829,6 +1075,7 @@ import { Hono } from "hono";
 // src/mcp/types.ts
 var PARSE_ERROR = -32700;
 var INVALID_REQUEST = -32600;
+var INVALID_PARAMS = -32602;
 var INTERNAL_ERROR = -32603;
 function makeJsonRpcError(id, code, message) {
   return {
@@ -2459,6 +2706,9 @@ function evaluatePolicy(policy, ctx) {
   };
 }
 
+// src/policy/governed-forwarder.ts
+import { randomUUID as randomUUID2 } from "crypto";
+
 // src/evidence/grounding.ts
 function checkEvidence(store, sessionId, requirements) {
   if (requirements.length === 0) {
@@ -2866,19 +3116,20 @@ function extractTools(body) {
 
 // src/feedback/self-repair.ts
 function ruleInfo(rule) {
+  const index = rule?.index ?? null;
   return {
     rule: rule?.name ?? null,
-    ruleIndex: rule?.index ?? null
+    ruleIndex: index,
+    rule_index: index
   };
 }
 function buildPolicyDeniedFeedback(decision) {
-  const { rule, ruleIndex } = ruleInfo(decision.matchedRule);
-  const suggestion = decision.matchedRule?.feedback?.suggestion ?? decision.matchedRule?.feedback?.message ?? `This action was denied by policy${rule ? ` (rule: "${rule}")` : ""}. Review the policy configuration or use an allowed tool instead.`;
+  const info = ruleInfo(decision.matchedRule);
+  const suggestion = decision.matchedRule?.feedback?.suggestion ?? decision.matchedRule?.feedback?.message ?? `This action was denied by policy${info.rule ? ` (rule: "${info.rule}")` : ""}. Review the policy configuration or use an allowed tool instead.`;
   return {
     blocked: true,
     reason: "policy_denied",
-    rule,
-    ruleIndex,
+    ...info,
     action: "deny",
     policy_reason: decision.reason,
     suggestion,
@@ -2886,14 +3137,13 @@ function buildPolicyDeniedFeedback(decision) {
   };
 }
 function buildEvidenceMissingFeedback(decision, evidenceResult, dependencyResult) {
-  const { rule, ruleIndex } = ruleInfo(decision.matchedRule);
+  const info = ruleInfo(decision.matchedRule);
   const missing = evidenceResult?.missing ?? [];
   const suggestion = missing.length === 1 ? `Call the ${String(missing[0])} tool first to provide the required evidence, then retry this action.` : `Call the following tools first to provide the required evidence: ${missing.join(", ")}. Then retry this action.`;
   return {
     blocked: true,
     reason: "evidence_missing",
-    rule,
-    ruleIndex,
+    ...info,
     action: "deny",
     missing_evidence: missing,
     expired_evidence: evidenceResult?.expired ?? [],
@@ -2903,14 +3153,13 @@ function buildEvidenceMissingFeedback(decision, evidenceResult, dependencyResult
   };
 }
 function buildEvidenceExpiredFeedback(decision, evidenceResult, dependencyResult) {
-  const { rule, ruleIndex } = ruleInfo(decision.matchedRule);
+  const info = ruleInfo(decision.matchedRule);
   const expired = evidenceResult?.expired ?? [];
   const suggestion = expired.length === 1 ? `Evidence from ${String(expired[0])} has expired. Call it again to refresh the evidence, then retry this action.` : `Evidence from the following tools has expired: ${expired.join(", ")}. Call them again to refresh, then retry this action.`;
   return {
     blocked: true,
     reason: "evidence_expired",
-    rule,
-    ruleIndex,
+    ...info,
     action: "deny",
     missing_evidence: evidenceResult?.missing ?? [],
     expired_evidence: expired,
@@ -2920,14 +3169,13 @@ function buildEvidenceExpiredFeedback(decision, evidenceResult, dependencyResult
   };
 }
 function buildDependencyMissingFeedback(decision, evidenceResult, dependencyResult) {
-  const { rule, ruleIndex } = ruleInfo(decision.matchedRule);
+  const info = ruleInfo(decision.matchedRule);
   const missing = dependencyResult?.missing ?? [];
   const suggestion = missing.length === 1 ? `Call the ${String(missing[0])} tool first before attempting this action.` : `Call the following tools first: ${missing.join(", ")}. Then retry this action.`;
   return {
     blocked: true,
     reason: "dependency_missing",
-    rule,
-    ruleIndex,
+    ...info,
     action: "deny",
     missing_evidence: evidenceResult?.missing ?? [],
     expired_evidence: evidenceResult?.expired ?? [],
@@ -2937,13 +3185,12 @@ function buildDependencyMissingFeedback(decision, evidenceResult, dependencyResu
   };
 }
 function buildApprovalDeniedFeedback(decision, deniedBy, denialReason) {
-  const { rule, ruleIndex } = ruleInfo(decision.matchedRule);
+  const info = ruleInfo(decision.matchedRule);
   const suggestion = decision.matchedRule?.feedback?.suggestion ?? decision.matchedRule?.feedback?.message ?? `This action was denied by ${deniedBy}.${denialReason ? ` Reason: ${denialReason}.` : ""} Contact them for details or use an alternative approach.`;
   return {
     blocked: true,
     reason: "approval_denied",
-    rule,
-    ruleIndex,
+    ...info,
     action: "require_approval",
     denied_by: deniedBy,
     denial_reason: denialReason ?? null,
@@ -2952,14 +3199,13 @@ function buildApprovalDeniedFeedback(decision, deniedBy, denialReason) {
   };
 }
 function buildApprovalTimeoutFeedback(decision, timeoutMs) {
-  const { rule, ruleIndex } = ruleInfo(decision.matchedRule);
+  const info = ruleInfo(decision.matchedRule);
   const timeoutSeconds = Math.round(timeoutMs / 1e3);
   const suggestion = decision.matchedRule?.feedback?.suggestion ?? decision.matchedRule?.feedback?.message ?? `Approval request timed out after ${String(timeoutSeconds)}s. Try again or contact an approver directly.`;
   return {
     blocked: true,
     reason: "approval_timeout",
-    rule,
-    ruleIndex,
+    ...info,
     action: "require_approval",
     timeout_seconds: timeoutSeconds,
     suggestion,
@@ -2967,41 +3213,38 @@ function buildApprovalTimeoutFeedback(decision, timeoutMs) {
   };
 }
 function buildClientDisconnectedFeedback(decision) {
-  const { rule, ruleIndex } = ruleInfo(decision.matchedRule);
+  const info = ruleInfo(decision.matchedRule);
   const suggestion = decision.matchedRule?.feedback?.suggestion ?? decision.matchedRule?.feedback?.message ?? "The client disconnected before this request completed. Retry with a stable connection.";
   return {
     blocked: true,
     reason: "client_disconnected",
-    rule,
-    ruleIndex,
+    ...info,
     action: "require_approval",
     suggestion,
     retry_allowed: true
   };
 }
 function buildShutdownCancelledFeedback(decision) {
-  const { rule, ruleIndex } = ruleInfo(decision.matchedRule);
+  const info = ruleInfo(decision.matchedRule);
   const suggestion = decision.matchedRule?.feedback?.suggestion ?? decision.matchedRule?.feedback?.message ?? "The proxy was shut down while this request was awaiting approval (for example during deploy/restart). Retry once the proxy is healthy.";
   return {
     blocked: true,
     reason: "shutdown_cancelled",
-    rule,
-    ruleIndex,
+    ...info,
     action: "require_approval",
     suggestion,
     retry_allowed: true
   };
 }
 function buildRateLimitedFeedback(decision, result) {
-  const { rule, ruleIndex } = ruleInfo(decision.matchedRule);
+  const info = ruleInfo(decision.matchedRule);
   const windowSeconds = Math.round(result.windowMs / 1e3);
   const resetAt = new Date(result.resetAtMs).toISOString();
   const suggestion = decision.matchedRule?.feedback?.suggestion ?? decision.matchedRule?.feedback?.message ?? `Rate limit exceeded (${String(result.current)}/${String(result.limit)} calls in ${String(windowSeconds)}s window). Retry after ${resetAt} or reduce call frequency.`;
   return {
     blocked: true,
     reason: "rate_limited",
-    rule,
-    ruleIndex,
+    ...info,
     action: "rate_limit",
     current_calls: result.current,
     max_calls: result.limit,
@@ -3016,8 +3259,7 @@ function buildToolDriftFeedback(drift, action) {
   return {
     blocked: true,
     reason: "tool_definition_drift",
-    rule: null,
-    ruleIndex: null,
+    ...ruleInfo(void 0),
     action,
     drifted_aspects: aspects,
     suggestion: `The definition of "${drift.toolName}" changed upstream (${aspects.join(", ")}) after Helio baselined it. An operator must review the change; restarting the proxy re-baselines, or the upstream can revert the change.`,
@@ -3025,15 +3267,14 @@ function buildToolDriftFeedback(drift, action) {
   };
 }
 function buildSpendLimitedFeedback(decision, result, currency) {
-  const { rule, ruleIndex } = ruleInfo(decision.matchedRule);
+  const info = ruleInfo(decision.matchedRule);
   const windowSeconds = Math.round(result.windowMs / 1e3);
   if (result.reason === "invalid_amount") {
     const field = decision.matchedRule?.limits?.maxSpend?.field ?? "amount";
     return {
       blocked: true,
       reason: "spend_limited",
-      rule,
-      ruleIndex,
+      ...info,
       action: "spend_limit",
       current_spend: result.currentSpend,
       max_spend: result.limit,
@@ -3049,8 +3290,7 @@ function buildSpendLimitedFeedback(decision, result, currency) {
   return {
     blocked: true,
     reason: "spend_limited",
-    rule,
-    ruleIndex,
+    ...info,
     action: "spend_limit",
     current_spend: result.currentSpend,
     max_spend: result.limit,
@@ -3061,86 +3301,506 @@ function buildSpendLimitedFeedback(decision, result, currency) {
     retry_allowed: true
   };
 }
+function breachBlock(entry) {
+  return {
+    name: entry.budget.name,
+    limit: entry.budget.limit,
+    spent: entry.spent,
+    remaining: entry.remaining,
+    attempted_amount: entry.amount,
+    currency: entry.budget.currency,
+    window: entry.budget.windowRaw,
+    on_exceed: entry.budget.onExceed,
+    reset_at: entry.resetAtMs === null ? null : new Date(entry.resetAtMs).toISOString()
+  };
+}
+function buildBudgetExceededFeedback(decision, breaches, failures) {
+  const info = ruleInfo(decision.matchedRule);
+  const budgets = [
+    ...breaches.map(breachBlock),
+    ...failures.map((failure) => ({
+      name: failure.budget.name,
+      limit: failure.budget.limit,
+      spent: failure.spent,
+      remaining: failure.remaining,
+      attempted_amount: null,
+      currency: failure.budget.currency,
+      window: failure.budget.windowRaw,
+      on_exceed: failure.budget.onExceed,
+      reset_at: failure.resetAtMs === null ? null : new Date(failure.resetAtMs).toISOString(),
+      reason: "invalid_amount"
+    }))
+  ];
+  const suggestion = failures.length > 0 ? `Budget ${failures.map((f) => `"${f.budget.name}"`).join(", ")} could not read a valid spend amount from this call. Retry with a non-negative finite amount in the expected field.` : `Budget ${breaches.map((b) => `"${b.budget.name}"`).join(", ")} would be exceeded by this call. Wait for the window to reset or reduce the amount.`;
+  const retryAllowed = breaches.every((entry) => entry.budget.window.kind === "duration");
+  return {
+    blocked: true,
+    reason: "budget_exceeded",
+    ...info,
+    action: "budget",
+    budgets,
+    suggestion,
+    retry_allowed: retryAllowed
+  };
+}
+function buildBudgetApprovalDeniedFeedback(decision, breaches, deniedBy, denialReason) {
+  const info = ruleInfo(decision.matchedRule);
+  const names = breaches.map((b) => `"${b.budget.name}"`).join(", ");
+  return {
+    blocked: true,
+    reason: "budget_exceeded",
+    ...info,
+    action: "budget",
+    denied_by: deniedBy,
+    denial_reason: denialReason ?? null,
+    budgets: breaches.map(breachBlock),
+    suggestion: `The budget overage on ${names} was denied by ${deniedBy}.${denialReason ? ` Reason: ${denialReason}.` : ""} Wait for the window to reset, reduce the amount, or contact them for details.`,
+    retry_allowed: false
+  };
+}
+function buildBudgetApprovalTimeoutFeedback(decision, breaches, timeoutMs) {
+  const info = ruleInfo(decision.matchedRule);
+  const timeoutSeconds = Math.round(timeoutMs / 1e3);
+  const names = breaches.map((b) => `"${b.budget.name}"`).join(", ");
+  return {
+    blocked: true,
+    reason: "budget_exceeded",
+    ...info,
+    action: "budget",
+    timeout_seconds: timeoutSeconds,
+    budgets: breaches.map(breachBlock),
+    suggestion: `The break-glass request for ${names} timed out after ${String(timeoutSeconds)}s (budget approvals never fail open). Try again or contact an approver directly.`,
+    retry_allowed: true
+  };
+}
 
-// src/policy/governed-forwarder.ts
-var POLICY_DENIED = -32001;
-var GovernedForwarder = class {
-  inner;
-  policy;
-  environment;
-  auditWriter;
-  evidenceStore;
-  approvalRouter;
-  rateLimiter;
-  spendLimiter;
-  annotationCache = new ToolAnnotationCache();
-  agentKeyWarned = false;
-  senderKeyWarned = false;
-  constructor(inner, policy, options) {
-    this.inner = inner;
-    this.policy = policy;
-    this.environment = options?.environment;
-    this.auditWriter = options?.auditWriter;
-    this.evidenceStore = options?.evidenceStore;
-    this.approvalRouter = options?.approvalRouter;
-    this.rateLimiter = options?.rateLimiter;
-    this.spendLimiter = options?.spendLimiter;
-    if (this.evidenceStore) {
-      this.evidenceStore.setAllowedEvidenceKeys(collectAllowedEvidenceKeys(policy));
+// src/policy/spend-limiter.ts
+function spendBucketKey(baseKey, ruleIndex) {
+  return `${baseKey}:rule:${String(ruleIndex)}`;
+}
+var RULE_SUFFIX_RE = /:rule:(\d+)$/;
+var SpendLimiter = class {
+  buckets = /* @__PURE__ */ new Map();
+  now;
+  onWarning;
+  warningThreshold;
+  timer = null;
+  closed = false;
+  constructor(options = {}) {
+    this.now = options.now ?? Date.now;
+    this.onWarning = options.onWarning;
+    this.warningThreshold = options.warningThreshold ?? 0.8;
+    const intervalMs = options.cleanupIntervalMs ?? 6e4;
+    if (intervalMs > 0) {
+      this.timer = setInterval(() => {
+        this.cleanup();
+      }, intervalMs);
+      this.timer.unref();
     }
   }
+  // -------------------------------------------------------------------------
+  // Core operations
+  // -------------------------------------------------------------------------
   /**
-   * Swap the compiled policy atomically and reconcile limit bucket state
-   * against the new configuration.
-   *
-   * Rate and spend limit buckets are preserved when their underlying rule
-   * config is unchanged — this is what makes a benign hot-reload (e.g. a
-   * `vim :w` with no real edits, or a whitespace-only config change) safe:
-   * operators do not get a surprise zero of their live rate/spend state
-   * mid-window. Buckets whose config changed or whose rule was removed are
-   * evicted by the limiters' `reconcile()` methods, so the next check
-   * lazy-creates a fresh bucket under the new config.
+   * Check and optionally record a spend against the limit.
    *
-   * See `packages/proxy/src/policy/rate-limiter.ts` and `spend-limiter.ts`
-   * for the per-bucket compare-and-evict semantics.
+   * Evicts expired entries, sums remaining amounts, then checks:
+   * - Under limit (currentSpend + amount <= limit): records and returns `allowed: true`
+   * - Would exceed: does NOT record (rejected spends don't consume budget)
    */
-  updatePolicy(policy) {
-    this.policy = policy;
-    if (this.evidenceStore) {
-      this.evidenceStore.setAllowedEvidenceKeys(collectAllowedEvidenceKeys(policy));
+  check(params) {
+    const { key, amount, limit, windowMs } = params;
+    const now = this.now();
+    const windowStart = now - windowMs;
+    if (!Number.isFinite(amount) || amount < 0) {
+      const existing = this.buckets.get(key);
+      const activeEntries = existing ? existing.entries.filter((e) => e.timestamp > windowStart) : [];
+      const currentSpend2 = activeEntries.reduce((sum, e) => sum + e.amount, 0);
+      const oldest = activeEntries[0];
+      return {
+        allowed: false,
+        currentSpend: currentSpend2,
+        limit,
+        windowMs,
+        resetAtMs: oldest ? oldest.timestamp + windowMs : 0,
+        reason: "invalid_amount"
+      };
     }
-    if (this.rateLimiter) {
-      const rateConfigs = [];
-      for (const rule of policy.rules) {
-        const limits = rule.limits;
-        if (limits?.maxCalls !== void 0 && limits.windowMs !== void 0) {
-          rateConfigs.push({ maxCalls: limits.maxCalls, windowMs: limits.windowMs });
-        }
-      }
-      this.rateLimiter.reconcile(rateConfigs);
+    let bucket = this.buckets.get(key);
+    if (!bucket) {
+      bucket = { entries: [], limit, currency: "", windowMs };
+      this.buckets.set(key, bucket);
     }
-    if (this.spendLimiter) {
-      const spendConfigs = [];
-      for (const rule of policy.rules) {
-        const maxSpend = rule.limits?.maxSpend;
-        if (maxSpend) {
-          spendConfigs.push({
-            limit: maxSpend.limit,
-            currency: maxSpend.currency,
-            windowMs: maxSpend.windowMs
-          });
-        }
-      }
-      this.spendLimiter.reconcile(spendConfigs);
+    bucket.limit = limit;
+    bucket.windowMs = windowMs;
+    bucket.entries = bucket.entries.filter((e) => e.timestamp > windowStart);
+    const currentSpend = bucket.entries.reduce((sum, e) => sum + e.amount, 0);
+    if (currentSpend + amount > limit) {
+      const oldest = bucket.entries[0];
+      return {
+        allowed: false,
+        currentSpend,
+        limit,
+        windowMs,
+        resetAtMs: oldest ? oldest.timestamp + windowMs : 0
+      };
     }
-  }
-  /**
-   * Prime the annotation cache by fetching tools/list directly from upstream.
-   *
-   * This path is intended for startup warm-up and intentionally bypasses policy
-   * and audit handling. Runtime tools/list requests still flow through forward().
-   *
-   * When the inner forwarder exposes `forwardInternal` (duck-typed), the prime
+    bucket.entries.push({ timestamp: now, amount });
+    const newSpend = currentSpend + amount;
+    const resetAtMs = (bucket.entries[0]?.timestamp ?? now) + windowMs;
+    if (this.onWarning && newSpend / limit >= this.warningThreshold) {
+      this.safeWarn({
+        key,
+        current_spend: newSpend,
+        limit,
+        currency: bucket.currency,
+        window_ms: windowMs,
+        reset_at_ms: resetAtMs
+      });
+    }
+    return {
+      allowed: true,
+      currentSpend: newSpend,
+      limit,
+      windowMs,
+      resetAtMs
+    };
+  }
+  /**
+   * Unconditionally record a spend against the limit.
+   *
+   * Unlike check(), this always appends the amount — even when it pushes the
+   * window past the limit — because the spend it represents has already been
+   * incurred. The sideband peeks at /evaluate and commits here at /audit once
+   * the external call ran (issue #12, D3).
+   *
+   * Throws on a negative or non-finite amount: such amounts are rejected at
+   * /evaluate, so one reaching record() is a logic bug we surface loudly rather
+   * than silently corrupt the sliding-window sum. Warnings fire only while the
+   * post-append spend stays within the limit (parity with check()).
+   */
+  record(params) {
+    const { key, amount, limit, windowMs } = params;
+    if (!Number.isFinite(amount) || amount < 0) {
+      throw new RangeError(
+        `SpendLimiter.record() received an invalid amount (${String(amount)}); invalid amounts must be rejected at /evaluate, never committed`
+      );
+    }
+    const now = this.now();
+    const windowStart = now - windowMs;
+    let bucket = this.buckets.get(key);
+    if (!bucket) {
+      bucket = { entries: [], limit, currency: "", windowMs };
+      this.buckets.set(key, bucket);
+    }
+    bucket.limit = limit;
+    bucket.windowMs = windowMs;
+    bucket.entries = bucket.entries.filter((e) => e.timestamp > windowStart);
+    bucket.entries.push({ timestamp: now, amount });
+    const currentSpend = bucket.entries.reduce((sum, e) => sum + e.amount, 0);
+    const resetAtMs = (bucket.entries[0]?.timestamp ?? now) + windowMs;
+    if (this.onWarning && currentSpend <= limit && currentSpend / limit >= this.warningThreshold) {
+      this.safeWarn({
+        key,
+        current_spend: currentSpend,
+        limit,
+        currency: bucket.currency,
+        window_ms: windowMs,
+        reset_at_ms: resetAtMs
+      });
+    }
+    return {
+      allowed: currentSpend <= limit,
+      currentSpend,
+      limit,
+      windowMs,
+      resetAtMs
+    };
+  }
+  /**
+   * Check the spend limit without recording the spend (non-destructive).
+   *
+   * Used by dry-run mode to determine what would happen without consuming
+   * budget in the bucket.
+   */
+  peek(params) {
+    const { key, amount, limit, windowMs } = params;
+    const now = this.now();
+    const windowStart = now - windowMs;
+    const bucket = this.buckets.get(key);
+    if (!Number.isFinite(amount) || amount < 0) {
+      const activeEntries2 = bucket ? bucket.entries.filter((e) => e.timestamp > windowStart) : [];
+      const currentSpend2 = activeEntries2.reduce((sum, e) => sum + e.amount, 0);
+      const oldest2 = activeEntries2[0];
+      return {
+        allowed: false,
+        currentSpend: currentSpend2,
+        limit,
+        windowMs,
+        resetAtMs: oldest2 ? oldest2.timestamp + windowMs : 0,
+        reason: "invalid_amount"
+      };
+    }
+    if (!bucket) {
+      const wouldExceed = amount > limit;
+      return {
+        allowed: !wouldExceed,
+        currentSpend: wouldExceed ? 0 : amount,
+        limit,
+        windowMs,
+        resetAtMs: now + windowMs
+      };
+    }
+    const activeEntries = bucket.entries.filter((e) => e.timestamp > windowStart);
+    const currentSpend = activeEntries.reduce((sum, e) => sum + e.amount, 0);
+    if (currentSpend + amount > limit) {
+      const oldest2 = activeEntries[0];
+      return {
+        allowed: false,
+        currentSpend,
+        limit,
+        windowMs,
+        resetAtMs: oldest2 ? oldest2.timestamp + windowMs : 0
+      };
+    }
+    const newSpend = currentSpend + amount;
+    const oldest = activeEntries[0];
+    return {
+      allowed: true,
+      currentSpend: newSpend,
+      limit,
+      windowMs,
+      resetAtMs: oldest ? oldest.timestamp + windowMs : now + windowMs
+    };
+  }
+  /**
+   * Set the display currency for a key. Called by the governed forwarder
+   * after check() so dashboard reads include the currency label.
+   */
+  setCurrency(key, currency) {
+    const bucket = this.buckets.get(key);
+    if (bucket) bucket.currency = currency;
+  }
+  // -------------------------------------------------------------------------
+  // Read operations (for dashboard API)
+  // -------------------------------------------------------------------------
+  /** Get the current state of a single key. Returns undefined if not tracked. */
+  getKeyState(key) {
+    const bucket = this.buckets.get(key);
+    if (!bucket) return void 0;
+    const windowStart = this.now() - bucket.windowMs;
+    bucket.entries = bucket.entries.filter((e) => e.timestamp > windowStart);
+    if (bucket.entries.length === 0) {
+      this.buckets.delete(key);
+      return void 0;
+    }
+    const currentSpend = bucket.entries.reduce((sum, e) => sum + e.amount, 0);
+    return {
+      key,
+      current_spend: currentSpend,
+      limit: bucket.limit,
+      currency: bucket.currency,
+      window_ms: bucket.windowMs,
+      reset_at_ms: (bucket.entries[0]?.timestamp ?? 0) + bucket.windowMs
+    };
+  }
+  /** List all tracked keys with their current state. */
+  listKeyStates() {
+    const states = [];
+    for (const key of [...this.buckets.keys()]) {
+      const state = this.getKeyState(key);
+      if (state) states.push(state);
+    }
+    return states;
+  }
+  // -------------------------------------------------------------------------
+  // Maintenance
+  // -------------------------------------------------------------------------
+  /** Sweep all buckets: remove expired entries, delete empty buckets. */
+  cleanup() {
+    const now = this.now();
+    for (const [key, bucket] of this.buckets) {
+      const windowStart = now - bucket.windowMs;
+      bucket.entries = bucket.entries.filter((e) => e.timestamp > windowStart);
+      if (bucket.entries.length === 0) {
+        this.buckets.delete(key);
+      }
+    }
+  }
+  /** Clear all spend limit state. Called on policy hot-reload. */
+  reset() {
+    this.buckets.clear();
+  }
+  /**
+   * Reconcile bucket state against a new policy's spend configuration.
+   *
+   * Walks every existing bucket and checks whether its last-seen
+   * `{ limit, currency, windowMs }` tuple still appears in `validConfigs`.
+   * Buckets whose config is unchanged are left untouched — cumulative spend
+   * and elapsed-window progress are preserved across hot-reloads. Buckets
+   * whose config is gone (rule changed or removed) are evicted so the next
+   * check lazy-creates a fresh bucket under the new config.
+   *
+   * Keys built by {@link spendBucketKey} carry the owning rule's index, and
+   * for those the tuple must match at THAT index (`config.ruleIndex`): a
+   * reorder that shifts a spend rule's index evicts its old-index bucket
+   * instead of leaving an orphan no rule reads again — or worse, letting
+   * whatever rule now sits at that index adopt another rule's accrued spend.
+   * Un-suffixed keys keep the tuple-anywhere match.
+   *
+   * Currency is part of the tuple because a USD→EUR switch is a meaningful
+   * policy change — the same numeric limit buys a different amount of real
+   * spend, so the bucket must reset. This replaces the old `reset()` call
+   * on every hot-reload, which wiped all state even when the matching rule
+   * was unchanged.
+   */
+  reconcile(validConfigs) {
+    const valid = /* @__PURE__ */ new Set();
+    const byIndex = /* @__PURE__ */ new Map();
+    for (const config of validConfigs) {
+      const tuple = `${String(config.limit)}|${config.currency}|${String(config.windowMs)}`;
+      if (config.ruleIndex === void 0) {
+        valid.add(tuple);
+      } else {
+        byIndex.set(config.ruleIndex, tuple);
+      }
+    }
+    for (const [key, bucket] of this.buckets) {
+      const tuple = `${String(bucket.limit)}|${bucket.currency}|${String(bucket.windowMs)}`;
+      const suffix = RULE_SUFFIX_RE.exec(key);
+      const survives = suffix ? byIndex.get(Number(suffix[1])) === tuple : valid.has(tuple);
+      if (!survives) {
+        this.buckets.delete(key);
+      }
+    }
+  }
+  /** Stop the cleanup timer and mark as closed. */
+  /**
+   * Invoke the warning callback without letting a subscriber throw into the
+   * limiter's caller: a warning fires after state has already mutated, and a
+   * governed call must not be blocked (or double-charged on retry) by an
+   * observability bug.
+   */
+  safeWarn(state) {
+    if (!this.onWarning) return;
+    try {
+      this.onWarning(state);
+    } catch (err) {
+      console.error("[helio] limit warning subscriber threw:", err);
+    }
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+    this.buckets.clear();
+  }
+};
+
+// src/policy/governed-forwarder.ts
+var POLICY_DENIED = -32001;
+function blocked(result) {
+  return { proceed: false, result, approvalWaitMs: 0 };
+}
+function budgetChainBlock(entry, kind) {
+  return {
+    name: entry.budget.name,
+    bucket_key: entry.bucketKey,
+    allowed: entry.allowed,
+    amount: entry.amount,
+    spent: entry.spent,
+    limit: entry.budget.limit,
+    remaining: entry.remaining,
+    currency: entry.budget.currency,
+    ...kind ? { kind } : {},
+    ...entry.stale ? { stale: true } : {}
+  };
+}
+var GovernedForwarder = class {
+  inner;
+  policy;
+  environment;
+  auditWriter;
+  evidenceStore;
+  approvalRouter;
+  rateLimiter;
+  spendLimiter;
+  budgetEngine;
+  annotationCache = new ToolAnnotationCache();
+  agentKeyWarned = false;
+  senderKeyWarned = false;
+  constructor(inner, policy, options) {
+    this.inner = inner;
+    this.policy = policy;
+    this.environment = options?.environment;
+    this.auditWriter = options?.auditWriter;
+    this.evidenceStore = options?.evidenceStore;
+    this.approvalRouter = options?.approvalRouter;
+    this.rateLimiter = options?.rateLimiter;
+    this.spendLimiter = options?.spendLimiter;
+    this.budgetEngine = options?.budgetEngine;
+    if (this.evidenceStore) {
+      this.evidenceStore.setAllowedEvidenceKeys(collectAllowedEvidenceKeys(policy));
+    }
+  }
+  /**
+   * Swap the compiled policy atomically and reconcile limit bucket state
+   * against the new configuration.
+   *
+   * Rate and spend limit buckets are preserved when their underlying rule
+   * config is unchanged — this is what makes a benign hot-reload (e.g. a
+   * `vim :w` with no real edits, or a whitespace-only config change) safe:
+   * operators do not get a surprise zero of their live rate/spend state
+   * mid-window. Buckets whose config changed or whose rule was removed are
+   * evicted by the limiters' `reconcile()` methods, so the next check
+   * lazy-creates a fresh bucket under the new config.
+   *
+   * See `packages/proxy/src/policy/rate-limiter.ts` and `spend-limiter.ts`
+   * for the per-bucket compare-and-evict semantics.
+   */
+  updatePolicy(policy) {
+    this.policy = policy;
+    if (this.evidenceStore) {
+      this.evidenceStore.setAllowedEvidenceKeys(collectAllowedEvidenceKeys(policy));
+    }
+    if (this.rateLimiter) {
+      const rateConfigs = [];
+      for (const rule of policy.rules) {
+        const limits = rule.limits;
+        if (limits?.maxCalls !== void 0 && limits.windowMs !== void 0) {
+          rateConfigs.push({ maxCalls: limits.maxCalls, windowMs: limits.windowMs });
+        }
+      }
+      this.rateLimiter.reconcile(rateConfigs);
+    }
+    if (this.spendLimiter) {
+      const spendConfigs = [];
+      for (const rule of policy.rules) {
+        const maxSpend = rule.limits?.maxSpend;
+        if (maxSpend) {
+          spendConfigs.push({
+            limit: maxSpend.limit,
+            currency: maxSpend.currency,
+            windowMs: maxSpend.windowMs,
+            // Spend bucket keys are rule-discriminated (spendBucketKey), so
+            // reconcile must match tuples at the owning rule's index.
+            ruleIndex: rule.index
+          });
+        }
+      }
+      this.spendLimiter.reconcile(spendConfigs);
+    }
+  }
+  /**
+   * Prime the annotation cache by fetching tools/list directly from upstream.
+   *
+   * This path is intended for startup warm-up and intentionally bypasses policy
+   * and audit handling. Runtime tools/list requests still flow through forward().
+   *
+   * When the inner forwarder exposes `forwardInternal` (duck-typed), the prime
    * request is routed through it so session-enforcing servers (e.g. Streamable
    * HTTP upstreams) receive the request on the managed internal session rather
    * than as a sessionless call that they would reject with HTTP 400.
@@ -3243,13 +3903,24 @@ var GovernedForwarder = class {
       metadata: null
     });
   }
-  async handleToolsCall(request) {
+  async handleToolsCall(original) {
     const startTime = performance.now();
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    let request;
+    try {
+      request = original.params === void 0 ? original : { ...original, params: structuredClone(original.params) };
+    } catch {
+      return makeErrorResult(
+        original,
+        INVALID_PARAMS,
+        "tools/call params must be JSON-serializable",
+        { blocked: true, reason: "invalid_params" }
+      );
+    }
     const params = request.params;
     const toolName = typeof params?.["name"] === "string" ? params["name"] : void 0;
     if (!toolName) {
-      return this.inner.forward(request);
+      return this.rejectNamelessToolsCall(request, params, timestamp, startTime);
     }
     const toolArguments = params?.["arguments"] && typeof params["arguments"] === "object" ? params["arguments"] : void 0;
     const {
@@ -3274,6 +3945,7 @@ var GovernedForwarder = class {
       currentAnnotations: this.annotationCache.getCurrent(toolName),
       driftEvent: this.annotationCache.getDrift(toolName)
     });
+    const auditRecordId = randomUUID2();
     let result;
     let approvalOutcome;
     let approvalWaitMs = 0;
@@ -3281,52 +3953,74 @@ var GovernedForwarder = class {
     let rateLimitResult;
     let spendLimitResult;
     let forwardingError;
+    let forwarded = false;
+    let budgetsChain;
+    let budgetApproval;
     try {
       if (isDryRun) {
         result = this.handleDryRun(request, decision, toolName, toolArguments, evidenceBlocked);
-      } else if (sessionBlocked) {
-        result = this.makeSessionRequiredBlockResult(request, decision);
-      } else if (evidenceBlocked) {
-        result = this.makeEvidenceBlockResult(request, decision, evidenceResult, dependencyResult);
-      } else if (driftBlocked && driftEvent) {
-        result = this.makeDriftBlockResult(request, driftEvent);
-      } else if (decision.action === "allow") {
-        result = await this.inner.forward(request);
-      } else if (decision.action === "deny") {
-        result = this.makeDenyResult(request, decision);
-      } else if (decision.action === "require_approval") {
-        if (!this.approvalRouter) {
-          result = this.makeUnsupportedResult(request, decision, toolName);
-        } else {
-          const approvalResult = await this.handleApproval(
-            request,
-            decision,
-            toolName,
-            toolArguments
-          );
-          result = approvalResult.result;
-          approvalOutcome = approvalResult.outcome;
-          approvalWaitMs = approvalResult.approvalWaitMs;
-          approvalContext = approvalResult.approvalContext;
-        }
-      } else if (decision.action === "rate_limit") {
-        if (!this.rateLimiter) {
-          result = this.makeUnsupportedResult(request, decision, toolName);
-        } else {
-          const rlResult = await this.handleRateLimit(request, decision, toolName);
-          result = rlResult.result;
-          rateLimitResult = rlResult.rateLimitResult;
-        }
-      } else if (decision.action === "spend_limit") {
-        if (!this.spendLimiter) {
-          result = this.makeUnsupportedResult(request, decision, toolName);
+      } else {
+        const gate = decision.action === "require_approval" && this.approvalRouter ? await this.handleApproval(request, decision, toolName, toolArguments) : this.resolveActionGate(request, decision, toolName, toolArguments, {
+          sessionBlocked,
+          evidenceBlocked,
+          driftBlocked,
+          driftEvent,
+          evidenceResult,
+          dependencyResult
+        });
+        approvalOutcome = gate.approvalOutcome;
+        approvalWaitMs = gate.approvalWaitMs;
+        approvalContext = gate.approvalContext;
+        rateLimitResult = gate.rateLimitResult;
+        spendLimitResult = gate.spendLimitResult;
+        if (!gate.proceed) {
+          result = gate.result;
         } else {
-          const slResult = await this.handleSpendLimit(request, decision, toolName, toolArguments);
-          result = slResult.result;
-          spendLimitResult = slResult.spendLimitResult;
+          const budgetGate = this.gateBudgets(request, decision, toolName, toolArguments);
+          budgetsChain = budgetGate.chain;
+          let budgetBlock;
+          if (budgetGate.kind === "approval") {
+            const held = await this.handleBudgetApproval(
+              request,
+              decision,
+              toolName,
+              toolArguments,
+              budgetGate
+            );
+            budgetApproval = held.audit;
+            approvalWaitMs += held.waitMs;
+            if (!held.proceed) budgetBlock = held.result;
+          }
+          if (budgetGate.kind === "blocked") {
+            result = budgetGate.result;
+          } else if (budgetBlock) {
+            result = budgetBlock;
+          } else {
+            let ledgerBlock;
+            try {
+              budgetsChain = budgetGate.commit?.(auditRecordId) ?? budgetsChain;
+            } catch (ledgerError) {
+              const reason = ledgerError instanceof Error ? ledgerError.message : String(ledgerError);
+              console.error(
+                `[helio] Budget ledger write failed for tool "${toolName}"; blocking the call: ${reason}`
+              );
+              ledgerBlock = makeErrorResult(request, INTERNAL_ERROR, "budget ledger write failed", {
+                blocked: true,
+                reason: "budget_ledger_write_failed",
+                failure_class: "budget_ledger_write_failed",
+                failure_reason: reason
+              });
+              budgetsChain = [{ ledger_write_failed: true, reason }];
+            }
+            if (ledgerBlock) {
+              result = ledgerBlock;
+            } else {
+              gate.commitRuleLimit?.();
+              forwarded = true;
+              result = await this.inner.forward(request);
+            }
+          }
         }
-      } else {
-        result = this.makeDenyResult(request, decision);
       }
     } catch (error) {
       forwardingError = error instanceof Error ? error : new Error(String(error));
@@ -3335,19 +4029,18 @@ var GovernedForwarder = class {
         failure_reason: forwardingError.message
       });
     }
-    const wasForwarded = this.wasForwardedUpstream(
-      decision,
-      approvalOutcome,
-      rateLimitResult,
-      spendLimitResult
-    );
-    if (wasForwarded && !isDryRun && this.evidenceStore && request.sessionId && toolName) {
-      const succeeded = !hasJsonRpcError(result);
-      this.evidenceStore.recordToolCall(request.sessionId, toolName, succeeded);
+    try {
+      if (forwarded && !isDryRun && this.evidenceStore && request.sessionId && toolName) {
+        const succeeded = !hasJsonRpcError(result);
+        this.evidenceStore.recordToolCall(request.sessionId, toolName, succeeded);
+      }
+    } catch (err) {
+      console.error("[helio] dependency tracking failed after forward:", err);
     }
     const totalDurationMs = performance.now() - startTime;
-    this.writeAuditRecord(
+    this.writeAuditRecordSafely(
       request,
+      auditRecordId,
       timestamp,
       toolName,
       toolArguments,
@@ -3356,6 +4049,7 @@ var GovernedForwarder = class {
       totalDurationMs,
       approvalWaitMs,
       flaggedDestructive,
+      forwarded,
       evidenceResult,
       dependencyResult,
       evidenceBlocked,
@@ -3363,12 +4057,320 @@ var GovernedForwarder = class {
       approvalContext,
       rateLimitResult,
       spendLimitResult,
+      budgetsChain,
+      budgetApproval,
       isDryRun,
       forwardingError,
       driftEvent ? { event: driftEvent, mode: driftMode } : void 0
     );
     return result;
   }
+  /**
+   * Await the composite break-glass ticket for a budget overage (issue #14).
+   *
+   * The ticket is routed by the BUDGET's approval config (first breached
+   * budget in config order), never the matched rule's. Deviation from rule
+   * approvals, by design: timeout ALWAYS fails closed — `default_on_timeout:
+   * allow` would forward an unapproved overage, and recording it as
+   * `approved_overage` would be a lie while not recording it would corrupt
+   * the pot. Money gates do not fail open.
+   */
+  async handleBudgetApproval(request, decision, toolName, toolArguments, gate) {
+    const router = this.approvalRouter;
+    const approvalStart = performance.now();
+    const outcome = await router.submit(
+      {
+        tool_name: toolName,
+        tool_input: toolArguments ?? {},
+        matched_rule: decision.matchedRule,
+        session_id: request.sessionId ?? null,
+        breached_budgets: gate.breachContexts,
+        approval: gate.approval
+      },
+      request.signal
+    );
+    const waitMs = performance.now() - approvalStart;
+    const ticket = outcome.ticketId ? router.getTicket(outcome.ticketId) : void 0;
+    const denialReason = outcome.status === "denied" && outcome.reason ? outcome.reason : void 0;
+    const audit = {
+      outcome,
+      ...denialReason ? { denialReason } : {},
+      ...ticket?.escalated_at ? { escalatedAt: ticket.escalated_at, escalatedTo: [...ticket.escalated_to ?? []] } : {}
+    };
+    if (outcome.status === "approved" || outcome.status === "break_glass") {
+      if (request.signal?.aborted) {
+        return {
+          proceed: false,
+          result: this.makeClientDisconnectedBlockResult(request, decision),
+          audit,
+          waitMs
+        };
+      }
+      return { proceed: true, audit, waitMs };
+    }
+    if (outcome.status === "denied") {
+      const feedback2 = buildBudgetApprovalDeniedFeedback(
+        decision,
+        gate.breaches,
+        outcome.resolvedBy,
+        outcome.reason
+      );
+      return {
+        proceed: false,
+        result: makeErrorResult(
+          request,
+          POLICY_DENIED,
+          `Budget overage denied by ${outcome.resolvedBy}`,
+          { ...feedback2 }
+        ),
+        audit,
+        waitMs
+      };
+    }
+    if (outcome.status === "client_disconnected" || request.signal?.aborted) {
+      return {
+        proceed: false,
+        result: this.makeClientDisconnectedBlockResult(request, decision),
+        audit,
+        waitMs
+      };
+    }
+    if (outcome.status === "shutdown_cancelled") {
+      const feedback2 = buildShutdownCancelledFeedback(decision);
+      return {
+        proceed: false,
+        result: makeErrorResult(
+          request,
+          POLICY_DENIED,
+          "Budget approval cancelled by proxy shutdown",
+          { ...feedback2 }
+        ),
+        audit,
+        waitMs
+      };
+    }
+    const feedback = buildBudgetApprovalTimeoutFeedback(decision, gate.breaches, outcome.timeoutMs);
+    return {
+      proceed: false,
+      result: makeErrorResult(request, POLICY_DENIED, "Budget approval timed out", {
+        ...feedback
+      }),
+      audit,
+      waitMs
+    };
+  }
+  /** writeAuditRecord, isolated: an audit-writer bug must not reject the response. */
+  writeAuditRecordSafely(...args) {
+    try {
+      this.writeAuditRecord(...args);
+    } catch (err) {
+      console.error("[helio] audit record write failed:", err);
+    }
+  }
+  /**
+   * Everything the non-approval action branches decide, minus the forward
+   * itself. Deliberately SYNCHRONOUS: the caller must reach the phase-3
+   * commits without yielding to the microtask queue, or concurrent calls
+   * could double-spend a peeked limiter slot. The approval branch (the only
+   * one that genuinely waits) is dispatched by the caller directly.
+   */
+  resolveActionGate(request, decision, toolName, toolArguments, pipeline) {
+    if (pipeline.sessionBlocked) {
+      return blocked(this.makeSessionRequiredBlockResult(request, decision));
+    }
+    if (pipeline.evidenceBlocked) {
+      return blocked(
+        this.makeEvidenceBlockResult(
+          request,
+          decision,
+          pipeline.evidenceResult,
+          pipeline.dependencyResult
+        )
+      );
+    }
+    if (pipeline.driftBlocked && pipeline.driftEvent) {
+      return blocked(this.makeDriftBlockResult(request, pipeline.driftEvent));
+    }
+    switch (decision.action) {
+      case "allow":
+        return { proceed: true, approvalWaitMs: 0 };
+      case "deny":
+        return blocked(this.makeDenyResult(request, decision));
+      case "require_approval":
+        return blocked(this.makeUnsupportedResult(request, decision, toolName));
+      case "rate_limit":
+        if (!this.rateLimiter) {
+          return blocked(this.makeUnsupportedResult(request, decision, toolName));
+        }
+        return this.handleRateLimit(request, decision, toolName);
+      case "spend_limit":
+        if (!this.spendLimiter) {
+          return blocked(this.makeUnsupportedResult(request, decision, toolName));
+        }
+        return this.handleSpendLimit(request, decision, toolName, toolArguments);
+      default:
+        return blocked(this.makeDenyResult(request, decision));
+    }
+  }
+  /**
+   * Phase 2: check every budget the call feeds, all-or-nothing (issue #14).
+   *
+   * Any `on_exceed: deny` breach (or invalid amount) denies and records
+   * NOTHING on any budget — rejected calls never consume budget anywhere.
+   * Breaches that are all `on_exceed: require_approval` yield the `approval`
+   * variant: one composite break-glass ticket per call, and only an explicit
+   * approval commits (breached budgets as `approved_overage`). On proceed,
+   * the returned `commit` records every charge together (ledger rows first,
+   * atomically, referencing the pre-generated audit id).
+   */
+  gateBudgets(request, decision, toolName, toolArguments) {
+    const engine = this.budgetEngine;
+    if (!engine) return { kind: "proceed" };
+    const { charges, failures } = engine.resolveCharges({
+      toolName,
+      toolArguments,
+      sessionId: request.sessionId ?? null,
+      senderId: null
+      // adapter context; absent on the MCP path
+    });
+    if (charges.length === 0 && failures.length === 0) return { kind: "proceed" };
+    const peek = charges.length > 0 ? engine.peekAll(charges) : { allowed: true, entries: [] };
+    const breaches = peek.entries.filter((entry) => !entry.allowed);
+    const anyHardDeny = failures.length > 0 || breaches.some((entry) => entry.budget.onExceed === "deny");
+    if (breaches.length > 0) engine.reportBreaches(breaches);
+    if (anyHardDeny) {
+      if (failures.length > 0) {
+        console.error(
+          `[helio] Warning: budget ${failures.map((f) => `"${f.budget.name}"`).join(", ")} could not resolve a valid amount for tool "${toolName}", denying request`
+        );
+      }
+      const feedback = buildBudgetExceededFeedback(decision, breaches, failures);
+      const message = failures.length > 0 ? `Budget denied: invalid amount for ${failures.map((f) => `"${f.budget.name}"`).join(", ")}` : `Budget exceeded: ${breaches.map((entry) => `"${entry.budget.name}"`).join(", ")}`;
+      return {
+        kind: "blocked",
+        result: makeErrorResult(request, POLICY_DENIED, message, { ...feedback }),
+        chain: [
+          ...peek.entries.map((entry) => budgetChainBlock(entry)),
+          ...failures.map((failure) => ({
+            name: failure.budget.name,
+            bucket_key: failure.bucketKey,
+            allowed: false,
+            reason: failure.reason,
+            spent: failure.spent,
+            limit: failure.budget.limit,
+            remaining: failure.remaining,
+            currency: failure.budget.currency
+          }))
+        ]
+      };
+    }
+    const peekBlockByName = new Map(
+      peek.entries.map((entry) => [entry.budget.name, budgetChainBlock(entry)])
+    );
+    const commit = (auditRecordId, kinds) => engine.recordAll(charges, {
+      kind: "spend",
+      ...kinds ? { kinds } : {},
+      auditRecordId,
+      origin: "mcp",
+      toolName,
+      timestampIso: (/* @__PURE__ */ new Date()).toISOString()
+    }).map((entry) => {
+      const kind = kinds?.get(entry.budget.name) ?? "spend";
+      const frozen = peekBlockByName.get(entry.budget.name);
+      return entry.stale && frozen ? { ...frozen, kind, stale: true } : budgetChainBlock(entry, kind);
+    });
+    if (breaches.length > 0) {
+      if (!this.approvalRouter) {
+        console.error(
+          `[helio] Budget ${breaches.map((b) => `"${b.budget.name}"`).join(", ")} requires break-glass approval but no approval router is configured; denying request`
+        );
+        const feedback = buildBudgetExceededFeedback(decision, breaches, []);
+        return {
+          kind: "blocked",
+          result: makeErrorResult(
+            request,
+            POLICY_DENIED,
+            `Budget exceeded: ${breaches.map((entry) => `"${entry.budget.name}"`).join(", ")}`,
+            { ...feedback }
+          ),
+          chain: peek.entries.map((entry) => budgetChainBlock(entry))
+        };
+      }
+      const kinds = new Map(
+        breaches.map((entry) => [entry.budget.name, "approved_overage"])
+      );
+      return {
+        kind: "approval",
+        chain: peek.entries.map((entry) => budgetChainBlock(entry)),
+        commit: (auditRecordId) => commit(auditRecordId, kinds),
+        breaches,
+        breachContexts: breaches.map((entry) => ({
+          name: entry.budget.name,
+          limit: entry.budget.limit,
+          spent: entry.spent,
+          attempted_amount: entry.amount,
+          currency: entry.budget.currency,
+          window: entry.budget.windowRaw
+        })),
+        approval: breaches[0]?.budget.approval ?? { channel: "dashboard" }
+      };
+    }
+    return {
+      kind: "proceed",
+      chain: peek.entries.map((entry) => budgetChainBlock(entry)),
+      commit: (auditRecordId) => commit(auditRecordId)
+    };
+  }
+  /**
+   * Reject a `tools/call` that carries no usable tool name and record it.
+   *
+   * The rejection is its own audit shape, not a governed decision: no rule was
+   * evaluated, so it is written directly (like {@link writeDriftAuditRecord})
+   * rather than threaded through {@link writeAuditRecord}, whose
+   * `PolicyDecision.action` union has no `rejected` member and whose
+   * forwarded-upstream logic does not apply. The raw `params` are preserved in
+   * `tool_input` so an investigator can see exactly what a lenient upstream
+   * could have keyed off.
+   */
+  rejectNamelessToolsCall(request, params, timestamp, startTime) {
+    const result = makeErrorResult(
+      request,
+      INVALID_PARAMS,
+      "tools/call requires a string params.name",
+      { blocked: true, reason: "missing_tool_name" }
+    );
+    if (this.auditWriter) {
+      const toolInput = { raw_params: params ?? null };
+      this.auditWriter.pushImmediate({
+        timestamp,
+        session_id: request.sessionId ?? null,
+        agent_id: null,
+        environment: this.environment ?? null,
+        tool_name: "<nameless>",
+        tool_input: toolInput,
+        policy_decision: "rejected",
+        block_reason: "missing_tool_name",
+        matched_rule: null,
+        matched_rule_index: null,
+        evidence_chain: null,
+        approval_status: null,
+        approved_by: null,
+        upstream_response: null,
+        upstream_error: null,
+        upstream_http_status: null,
+        upstream_latency_ms: null,
+        total_duration_ms: performance.now() - startTime,
+        approval_wait_ms: 0,
+        proxy_compute_ms: performance.now() - startTime,
+        flagged_destructive: false,
+        dry_run: false,
+        record_kind: "tool_call",
+        origin: "mcp",
+        metadata: null
+      });
+    }
+    return result;
+  }
   async handleApproval(request, decision, toolName, toolArguments) {
     const router = this.approvalRouter;
     const approvalStart = performance.now();
@@ -3392,81 +4394,126 @@ var GovernedForwarder = class {
         escalated_to: [...ticket.escalated_to ?? []]
       } : {}
     } : void 0;
-    let result;
     if (outcome.status === "approved" || outcome.status === "break_glass") {
       if (request.signal?.aborted) {
-        result = this.makeClientDisconnectedBlockResult(request, decision);
-      } else {
-        result = await this.inner.forward(request);
-      }
-    } else if (outcome.status === "denied") {
-      const feedback = buildApprovalDeniedFeedback(decision, outcome.resolvedBy, outcome.reason);
-      const message = decision.matchedRule?.feedback?.message ?? `Approval denied by ${outcome.resolvedBy}`;
-      result = makeErrorResult(request, POLICY_DENIED, message, { ...feedback });
-    } else if (outcome.status === "client_disconnected") {
-      result = this.makeClientDisconnectedBlockResult(request, decision);
-    } else if (outcome.status === "shutdown_cancelled") {
-      const feedback = buildShutdownCancelledFeedback(decision);
-      const message = decision.matchedRule?.feedback?.message ?? "Approval cancelled by proxy shutdown";
-      result = makeErrorResult(request, POLICY_DENIED, message, { ...feedback });
-    } else {
-      if (router.defaultOnTimeout === "allow" && !request.signal?.aborted) {
-        result = await this.inner.forward(request);
-      } else if (request.signal?.aborted) {
-        result = this.makeClientDisconnectedBlockResult(request, decision);
-      } else {
-        const feedback = buildApprovalTimeoutFeedback(decision, outcome.timeoutMs);
-        const message = decision.matchedRule?.feedback?.message ?? `Approval timed out`;
-        result = makeErrorResult(request, POLICY_DENIED, message, { ...feedback });
+        return {
+          proceed: false,
+          result: this.makeClientDisconnectedBlockResult(request, decision),
+          approvalOutcome: outcome,
+          approvalWaitMs,
+          approvalContext
+        };
       }
+      return { proceed: true, approvalOutcome: outcome, approvalWaitMs, approvalContext };
+    }
+    if (outcome.status === "denied") {
+      const feedback2 = buildApprovalDeniedFeedback(decision, outcome.resolvedBy, outcome.reason);
+      const message2 = decision.matchedRule?.feedback?.message ?? `Approval denied by ${outcome.resolvedBy}`;
+      return {
+        proceed: false,
+        result: makeErrorResult(request, POLICY_DENIED, message2, { ...feedback2 }),
+        approvalOutcome: outcome,
+        approvalWaitMs,
+        approvalContext
+      };
     }
-    return { result, outcome, approvalWaitMs, approvalContext };
+    if (outcome.status === "client_disconnected") {
+      return {
+        proceed: false,
+        result: this.makeClientDisconnectedBlockResult(request, decision),
+        approvalOutcome: outcome,
+        approvalWaitMs,
+        approvalContext
+      };
+    }
+    if (outcome.status === "shutdown_cancelled") {
+      const feedback2 = buildShutdownCancelledFeedback(decision);
+      const message2 = decision.matchedRule?.feedback?.message ?? "Approval cancelled by proxy shutdown";
+      return {
+        proceed: false,
+        result: makeErrorResult(request, POLICY_DENIED, message2, { ...feedback2 }),
+        approvalOutcome: outcome,
+        approvalWaitMs,
+        approvalContext
+      };
+    }
+    if (router.defaultOnTimeout === "allow" && !request.signal?.aborted) {
+      return { proceed: true, approvalOutcome: outcome, approvalWaitMs, approvalContext };
+    }
+    if (request.signal?.aborted) {
+      return {
+        proceed: false,
+        result: this.makeClientDisconnectedBlockResult(request, decision),
+        approvalOutcome: outcome,
+        approvalWaitMs,
+        approvalContext
+      };
+    }
+    const feedback = buildApprovalTimeoutFeedback(decision, outcome.timeoutMs);
+    const message = decision.matchedRule?.feedback?.message ?? `Approval timed out`;
+    return {
+      proceed: false,
+      result: makeErrorResult(request, POLICY_DENIED, message, { ...feedback }),
+      approvalOutcome: outcome,
+      approvalWaitMs,
+      approvalContext
+    };
   }
-  async handleRateLimit(request, decision, toolName) {
+  handleRateLimit(request, decision, toolName) {
     const limiter = this.rateLimiter;
     const limits = decision.matchedRule?.limits;
     if (!limits?.maxCalls || !limits.windowMs) {
-      const result2 = this.makePolicyMisconfiguredResult(
+      const result = this.makePolicyMisconfiguredResult(
         request,
         decision,
         `Policy misconfigured: rate_limit rule for "${toolName}" requires limits.max_calls and limits.window`
       );
       return {
-        result: result2,
+        proceed: false,
+        result,
+        approvalWaitMs: 0,
         rateLimitResult: { allowed: false, current: 0, limit: 0, windowMs: 0, resetAtMs: 0 }
       };
     }
     const key = this.buildLimitKey(limits.key, toolName, request);
-    const rateLimitResult = limiter.check({
-      key,
-      maxCalls: limits.maxCalls,
-      windowMs: limits.windowMs
-    });
-    let result;
-    if (rateLimitResult.allowed) {
-      result = await this.inner.forward(request);
-    } else {
+    const params = { key, maxCalls: limits.maxCalls, windowMs: limits.windowMs };
+    const rateLimitResult = limiter.peek(params);
+    if (!rateLimitResult.allowed) {
       const feedback = buildRateLimitedFeedback(decision, rateLimitResult);
       const message = decision.matchedRule?.feedback?.message ?? `Rate limit exceeded for ${key}`;
-      result = makeErrorResult(request, POLICY_DENIED, message, { ...feedback });
+      return {
+        proceed: false,
+        result: makeErrorResult(request, POLICY_DENIED, message, { ...feedback }),
+        approvalWaitMs: 0,
+        rateLimitResult
+      };
     }
-    return { result, rateLimitResult };
+    return {
+      proceed: true,
+      approvalWaitMs: 0,
+      rateLimitResult,
+      commitRuleLimit: () => {
+        limiter.record(params);
+      }
+    };
   }
-  async handleSpendLimit(request, decision, toolName, toolArguments) {
+  handleSpendLimit(request, decision, toolName, toolArguments) {
     const limiter = this.spendLimiter;
     const maxSpend = decision.matchedRule?.limits?.maxSpend;
     if (!maxSpend) {
-      const result2 = this.makePolicyMisconfiguredResult(
+      const result = this.makePolicyMisconfiguredResult(
         request,
         decision,
         `Policy misconfigured: spend_limit rule for "${toolName}" requires limits.max_spend`
       );
       return {
-        result: result2,
+        proceed: false,
+        result,
+        approvalWaitMs: 0,
         spendLimitResult: { allowed: false, currentSpend: 0, limit: 0, windowMs: 0, resetAtMs: 0 }
       };
     }
-    const key = this.buildLimitKey(maxSpend.key, toolName, request);
+    const key = this.buildSpendLimitKey(maxSpend.key, toolName, request, decision.matchedRule.index);
     const rawAmount = resolvePath(maxSpend.field, toolArguments ?? {});
     if (typeof rawAmount !== "number") {
       console.error(
@@ -3482,39 +4529,45 @@ var GovernedForwarder = class {
         reason: "invalid_amount"
       };
       const feedback = buildSpendLimitedFeedback(decision, invalidAmount, maxSpend.currency);
-      const result2 = makeErrorResult(
+      const result = makeErrorResult(
         request,
         POLICY_DENIED,
         `Spend limit denied: invalid amount for field "${maxSpend.field}"`,
         { ...feedback }
       );
       return {
-        result: result2,
+        proceed: false,
+        result,
+        approvalWaitMs: 0,
         spendLimitResult: invalidAmount
       };
     }
-    const spendLimitResult = limiter.check({
-      key,
-      amount: rawAmount,
-      limit: maxSpend.limit,
-      windowMs: maxSpend.windowMs
-    });
+    const params = { key, amount: rawAmount, limit: maxSpend.limit, windowMs: maxSpend.windowMs };
+    const spendLimitResult = limiter.peek(params);
     if (spendLimitResult.reason === "invalid_amount") {
       console.error(
         `[helio] Warning: spend limit field "${maxSpend.field}" resolved to invalid amount (${String(rawAmount)}) for tool "${toolName}" (rule: ${decision.matchedRule.name ?? "unnamed"}), denying request`
       );
-    } else {
-      limiter.setCurrency(key, maxSpend.currency);
     }
-    let result;
-    if (spendLimitResult.allowed) {
-      result = await this.inner.forward(request);
-    } else {
+    if (!spendLimitResult.allowed) {
       const feedback = buildSpendLimitedFeedback(decision, spendLimitResult, maxSpend.currency);
       const message = spendLimitResult.reason === "invalid_amount" ? `Spend limit denied: invalid amount for field "${maxSpend.field}"` : decision.matchedRule.feedback?.message ?? `Spend limit exceeded for ${key} (${maxSpend.currency})`;
-      result = makeErrorResult(request, POLICY_DENIED, message, { ...feedback });
+      return {
+        proceed: false,
+        result: makeErrorResult(request, POLICY_DENIED, message, { ...feedback }),
+        approvalWaitMs: 0,
+        spendLimitResult
+      };
     }
-    return { result, spendLimitResult };
+    return {
+      proceed: true,
+      approvalWaitMs: 0,
+      spendLimitResult,
+      commitRuleLimit: () => {
+        limiter.record(params);
+        limiter.setCurrency(key, maxSpend.currency);
+      }
+    };
   }
   /**
    * Handle dry-run mode: compute what would have happened without forwarding
@@ -3553,7 +4606,12 @@ var GovernedForwarder = class {
                 wouldForward = false;
                 limitsOk = false;
               } else {
-                const key = this.buildLimitKey(maxSpend.key, toolName, request);
+                const key = this.buildSpendLimitKey(
+                  maxSpend.key,
+                  toolName,
+                  request,
+                  decision.matchedRule.index
+                );
                 const peekResult = this.spendLimiter.peek({
                   key,
                   amount: rawAmount,
@@ -3568,7 +4626,42 @@ var GovernedForwarder = class {
           break;
       }
     }
-    return this.makeDryRunResult(request, decision, wouldForward, evidenceSatisfied, limitsOk);
+    let budgets;
+    if (wouldForward && this.budgetEngine) {
+      const { charges, failures } = this.budgetEngine.resolveCharges({
+        toolName,
+        toolArguments,
+        sessionId: request.sessionId ?? null,
+        senderId: null
+      });
+      if (failures.length > 0 || charges.length > 0) {
+        const peek = charges.length > 0 ? this.budgetEngine.peekAll(charges) : { allowed: true, entries: [] };
+        const ok = failures.length === 0 && peek.allowed;
+        wouldForward &&= ok;
+        limitsOk &&= ok;
+        budgets = [
+          ...peek.entries.map((entry) => budgetChainBlock(entry)),
+          ...failures.map((failure) => ({
+            name: failure.budget.name,
+            bucket_key: failure.bucketKey,
+            allowed: false,
+            reason: failure.reason,
+            spent: failure.spent,
+            limit: failure.budget.limit,
+            remaining: failure.remaining,
+            currency: failure.budget.currency
+          }))
+        ];
+      }
+    }
+    return this.makeDryRunResult(
+      request,
+      decision,
+      wouldForward,
+      evidenceSatisfied,
+      limitsOk,
+      budgets
+    );
   }
   /** Construct a limit bucket key based on the configured key type. */
   buildLimitKey(keyType, toolName, request) {
@@ -3596,19 +4689,17 @@ var GovernedForwarder = class {
         return `tool:${toolName}`;
     }
   }
-  /** Determine if the request was actually forwarded to the upstream MCP server. */
-  wasForwardedUpstream(decision, approvalOutcome, rateLimitResult, spendLimitResult) {
-    return decision.action === "allow" || approvalOutcome?.status === "approved" || approvalOutcome?.status === "break_glass" || approvalOutcome?.status === "timeout" && this.approvalRouter?.defaultOnTimeout === "allow" || rateLimitResult?.allowed === true || spendLimitResult?.allowed === true;
+  /**
+   * Construct a spend bucket key via the shared {@link spendBucketKey}
+   * composer — see its doc for why spend buckets are rule-discriminated.
+   * Rate buckets keep the undiscriminated keys.
+   */
+  buildSpendLimitKey(keyType, toolName, request, ruleIndex) {
+    return spendBucketKey(this.buildLimitKey(keyType, toolName, request), ruleIndex);
   }
-  writeAuditRecord(request, timestamp, toolName, toolArguments, decision, result, totalDurationMs, approvalWaitMs, flaggedDestructive, evidenceResult, dependencyResult, evidenceBlocked, approvalOutcome, approvalContext, rateLimitResult, spendLimitResult, isDryRun, forwardingError, drift) {
+  writeAuditRecord(request, auditRecordId, timestamp, toolName, toolArguments, decision, result, totalDurationMs, approvalWaitMs, flaggedDestructive, forwarded, evidenceResult, dependencyResult, evidenceBlocked, approvalOutcome, approvalContext, rateLimitResult, spendLimitResult, budgetsChain, budgetApproval, isDryRun, forwardingError, drift) {
     if (!this.auditWriter) return;
-    const wasForwarded = this.wasForwardedUpstream(
-      decision,
-      approvalOutcome,
-      rateLimitResult,
-      spendLimitResult
-    );
-    const actuallyForwarded = wasForwarded && !isDryRun;
+    const actuallyForwarded = forwarded && !isDryRun;
     const hadForwardingError = forwardingError !== void 0;
     let upstreamError = null;
     const upstreamHttpStatus = actuallyForwarded && !hadForwardingError ? result.response.status : null;
@@ -3626,12 +4717,13 @@ var GovernedForwarder = class {
       upstreamError = "invalid spend amount";
     }
     let evidenceChain = buildEvidenceChain(evidenceResult, dependencyResult, evidenceBlocked);
-    if (approvalOutcome?.status === "break_glass" && "reason" in approvalOutcome) {
+    const breakGlassOutcome = approvalOutcome?.status === "break_glass" ? approvalOutcome : budgetApproval?.outcome.status === "break_glass" ? budgetApproval.outcome : void 0;
+    if (breakGlassOutcome && "reason" in breakGlassOutcome) {
       evidenceChain = {
         ...evidenceChain ?? {},
         break_glass: {
-          reason: approvalOutcome.reason,
-          invoked_by: approvalOutcome.resolvedBy
+          reason: breakGlassOutcome.reason,
+          invoked_by: breakGlassOutcome.resolvedBy
         }
       };
     }
@@ -3641,6 +4733,22 @@ var GovernedForwarder = class {
         approval: { ...approvalContext }
       };
     }
+    if (budgetApproval && budgetApproval.outcome.ticketId) {
+      const outcome = budgetApproval.outcome;
+      evidenceChain = {
+        ...evidenceChain ?? {},
+        budget_approval: {
+          ticket_id: outcome.ticketId,
+          status: outcome.status,
+          ..."resolvedBy" in outcome ? { resolved_by: outcome.resolvedBy } : {},
+          ...budgetApproval.denialReason ? { denial_reason: budgetApproval.denialReason } : {},
+          ...budgetApproval.escalatedAt ? {
+            escalated_at: budgetApproval.escalatedAt,
+            escalated_to: budgetApproval.escalatedTo ?? []
+          } : {}
+        }
+      };
+    }
     if (rateLimitResult) {
       evidenceChain = {
         ...evidenceChain ?? {},
@@ -3666,6 +4774,12 @@ var GovernedForwarder = class {
         }
       };
     }
+    if (budgetsChain && budgetsChain.length > 0) {
+      evidenceChain = {
+        ...evidenceChain ?? {},
+        budgets: budgetsChain
+      };
+    }
     if (drift) {
       evidenceChain = {
         ...evidenceChain ?? {},
@@ -3688,8 +4802,11 @@ var GovernedForwarder = class {
       matched_rule: decision.matchedRule?.name ?? null,
       matched_rule_index: decision.matchedRule?.index ?? null,
       evidence_chain: evidenceChain,
-      approval_status: approvalOutcome?.status ?? null,
-      approved_by: approvalOutcome && "resolvedBy" in approvalOutcome ? approvalOutcome.resolvedBy : null,
+      // The approval columns describe the rule gate when one ran; on a
+      // budget-only ticket (no rule approval) they carry the break-glass
+      // outcome so a human-denied overage reads as denied here too.
+      approval_status: (approvalOutcome ?? budgetApproval?.outcome)?.status ?? null,
+      approved_by: approvedByOf(approvalOutcome ?? budgetApproval?.outcome),
       upstream_response: actuallyForwarded && !hadForwardingError ? result.response.body : null,
       upstream_error: upstreamError,
       upstream_http_status: upstreamHttpStatus,
@@ -3703,11 +4820,11 @@ var GovernedForwarder = class {
       origin: "mcp",
       metadata: null
     };
-    const isEnforcementDecision = !isDryRun && (!wasForwarded || approvalOutcome !== void 0);
+    const isEnforcementDecision = !isDryRun && (!forwarded || approvalOutcome !== void 0 || budgetApproval !== void 0);
     if (isEnforcementDecision) {
-      this.auditWriter.pushImmediate(record);
+      this.auditWriter.pushImmediate(record, auditRecordId);
     } else {
-      this.auditWriter.push(record);
+      this.auditWriter.push(record, auditRecordId);
     }
   }
   makeDriftBlockResult(request, drift) {
@@ -3738,21 +4855,21 @@ var GovernedForwarder = class {
     const message = decision.matchedRule ? `Action "${action}" matched by ${decision.matchedRule.name ? `"${decision.matchedRule.name}"` : `rule[${String(decision.matchedRule.index)}]`} is not yet supported` : `Destructive tool "${toolName ?? "unknown"}" requires approval (flag_destructive policy)`;
     return makeErrorResult(request, POLICY_DENIED, message, {
       blocked: true,
-      rule: decision.matchedRule?.name ?? null,
-      ruleIndex: decision.matchedRule?.index ?? null,
+      ...ruleInfo(decision.matchedRule),
       action,
       reason: decision.reason,
       unsupported: true
     });
   }
-  makeDryRunResult(request, decision, wouldForward, evidenceSatisfied, limitsOk) {
+  makeDryRunResult(request, decision, wouldForward, evidenceSatisfied, limitsOk, budgets) {
     const payload = {
       dry_run: true,
       would_forward: wouldForward,
       policy_decision: decision.action,
       matched_rule: decision.matchedRule?.name ?? null,
       evidence_satisfied: evidenceSatisfied,
-      limits_ok: limitsOk
+      limits_ok: limitsOk,
+      ...budgets ? { budgets } : {}
     };
     const body = {
       jsonrpc: "2.0",
@@ -3820,6 +4937,9 @@ function makeErrorResult(request, code, message, data) {
   };
   return { response, durationMs: 0 };
 }
+function approvedByOf(outcome) {
+  return outcome && "resolvedBy" in outcome ? outcome.resolvedBy : null;
+}
 function hasJsonRpcError(result) {
   const body = result.response.body;
   return body?.["error"] !== void 0;
@@ -3853,9 +4973,9 @@ function extractBlockReason(result) {
   if (!data || data["blocked"] !== true) return null;
   return typeof data["reason"] === "string" ? data["reason"] : null;
 }
-function buildEvidenceChain(evidenceResult, dependencyResult, blocked) {
+function buildEvidenceChain(evidenceResult, dependencyResult, blocked2) {
   if (!evidenceResult && !dependencyResult) return null;
-  const chain = { blocked: blocked ?? false };
+  const chain = { blocked: blocked2 ?? false };
   if (evidenceResult) {
     chain["evidence"] = {
       required: [...evidenceResult.found, ...evidenceResult.missing, ...evidenceResult.expired],
@@ -3929,7 +5049,7 @@ var RateLimiter = class {
     const current = bucket.timestamps.length;
     const resetAtMs = (bucket.timestamps[0] ?? now) + windowMs;
     if (this.onWarning && current / maxCalls >= this.warningThreshold) {
-      this.onWarning({ key, current, limit: maxCalls, window_ms: windowMs, reset_at_ms: resetAtMs });
+      this.safeWarn({ key, current, limit: maxCalls, window_ms: windowMs, reset_at_ms: resetAtMs });
     }
     return {
       allowed: true,
@@ -3942,372 +5062,83 @@ var RateLimiter = class {
   /**
    * Unconditionally record a call against the rate limit.
    *
-   * Unlike check(), this always appends the timestamp — even when the bucket
-   * is already at/over the limit — because the call it represents has already
-   * executed. The sideband splits decision from execution: /evaluate peeks
-   * (non-destructive), and /audit calls record() once the external call ran,
-   * so refusing to record at the limit (as check() does) would let real calls
-   * escape accounting and under-count subsequent peeks. (issue #12, D3.)
-   *
-   * Warnings fire only while the post-append count stays within the limit —
-   * exact parity with check(), which never warns on its over-limit path — so a
-   * burst of over-limit audits cannot flood the dashboard's limit_warning feed.
-   */
-  record(params) {
-    const { key, maxCalls, windowMs } = params;
-    const now = this.now();
-    const windowStart = now - windowMs;
-    let bucket = this.buckets.get(key);
-    if (!bucket) {
-      bucket = { timestamps: [], maxCalls, windowMs };
-      this.buckets.set(key, bucket);
-    }
-    bucket.maxCalls = maxCalls;
-    bucket.windowMs = windowMs;
-    bucket.timestamps = bucket.timestamps.filter((ts) => ts > windowStart);
-    bucket.timestamps.push(now);
-    const current = bucket.timestamps.length;
-    const resetAtMs = (bucket.timestamps[0] ?? now) + windowMs;
-    if (this.onWarning && current <= maxCalls && current / maxCalls >= this.warningThreshold) {
-      this.onWarning({ key, current, limit: maxCalls, window_ms: windowMs, reset_at_ms: resetAtMs });
-    }
-    return {
-      allowed: current <= maxCalls,
-      current,
-      limit: maxCalls,
-      windowMs,
-      resetAtMs
-    };
-  }
-  /**
-   * Check the rate limit without recording the call (non-destructive).
-   *
-   * Used by dry-run mode to determine what would happen without consuming
-   * a slot in the bucket.
-   */
-  peek(params) {
-    const { key, maxCalls, windowMs } = params;
-    const now = this.now();
-    const windowStart = now - windowMs;
-    const bucket = this.buckets.get(key);
-    if (!bucket) {
-      return {
-        allowed: true,
-        current: 1,
-        limit: maxCalls,
-        windowMs,
-        resetAtMs: now + windowMs
-      };
-    }
-    const activeCount = bucket.timestamps.filter((ts) => ts > windowStart).length;
-    if (activeCount >= maxCalls) {
-      const oldest2 = bucket.timestamps.find((ts) => ts > windowStart) ?? 0;
-      return {
-        allowed: false,
-        current: activeCount,
-        limit: maxCalls,
-        windowMs,
-        resetAtMs: oldest2 + windowMs
-      };
-    }
-    const oldest = bucket.timestamps.find((ts) => ts > windowStart) ?? now;
-    return {
-      allowed: true,
-      current: activeCount + 1,
-      limit: maxCalls,
-      windowMs,
-      resetAtMs: oldest + windowMs
-    };
-  }
-  // -------------------------------------------------------------------------
-  // Read operations (for dashboard API)
-  // -------------------------------------------------------------------------
-  /** Get the current state of a single key. Returns undefined if not tracked. */
-  getKeyState(key) {
-    const bucket = this.buckets.get(key);
-    if (!bucket) return void 0;
-    const windowStart = this.now() - bucket.windowMs;
-    bucket.timestamps = bucket.timestamps.filter((ts) => ts > windowStart);
-    if (bucket.timestamps.length === 0) {
-      this.buckets.delete(key);
-      return void 0;
-    }
-    return {
-      key,
-      current: bucket.timestamps.length,
-      limit: bucket.maxCalls,
-      window_ms: bucket.windowMs,
-      reset_at_ms: (bucket.timestamps[0] ?? 0) + bucket.windowMs
-    };
-  }
-  /** List all tracked keys with their current state. */
-  listKeyStates() {
-    const states = [];
-    for (const key of [...this.buckets.keys()]) {
-      const state = this.getKeyState(key);
-      if (state) states.push(state);
-    }
-    return states;
-  }
-  // -------------------------------------------------------------------------
-  // Maintenance
-  // -------------------------------------------------------------------------
-  /** Sweep all buckets: remove expired timestamps, delete empty buckets. */
-  cleanup() {
-    const now = this.now();
-    for (const [key, bucket] of this.buckets) {
-      const windowStart = now - bucket.windowMs;
-      bucket.timestamps = bucket.timestamps.filter((ts) => ts > windowStart);
-      if (bucket.timestamps.length === 0) {
-        this.buckets.delete(key);
-      }
-    }
-  }
-  /** Clear all rate limit state. Called on policy hot-reload. */
-  reset() {
-    this.buckets.clear();
-  }
-  /**
-   * Reconcile bucket state against a new policy's limit configuration.
-   *
-   * Walks every existing bucket and checks whether its last-seen
-   * `{ maxCalls, windowMs }` tuple still appears anywhere in `validConfigs`.
-   * Buckets whose config is still present are left untouched — counters and
-   * elapsed-window progress are preserved across hot-reloads. Buckets whose
-   * config is gone (rule changed or removed) are evicted so the next check
-   * lazy-creates a fresh bucket under the new config.
-   *
-   * This is the compare-and-evict semantic that replaces the old `reset()`
-   * call on every hot-reload, which wiped all state even when the matching
-   * rule was unchanged.
-   */
-  reconcile(validConfigs) {
-    const valid = /* @__PURE__ */ new Set();
-    for (const config of validConfigs) {
-      valid.add(`${String(config.maxCalls)}|${String(config.windowMs)}`);
-    }
-    for (const [key, bucket] of this.buckets) {
-      const tuple = `${String(bucket.maxCalls)}|${String(bucket.windowMs)}`;
-      if (!valid.has(tuple)) {
-        this.buckets.delete(key);
-      }
-    }
-  }
-  /** Stop the cleanup timer and mark as closed. */
-  close() {
-    if (this.closed) return;
-    this.closed = true;
-    if (this.timer) {
-      clearInterval(this.timer);
-      this.timer = null;
-    }
-    this.buckets.clear();
-  }
-};
-
-// src/policy/spend-limiter.ts
-var SpendLimiter = class {
-  buckets = /* @__PURE__ */ new Map();
-  now;
-  onWarning;
-  warningThreshold;
-  timer = null;
-  closed = false;
-  constructor(options = {}) {
-    this.now = options.now ?? Date.now;
-    this.onWarning = options.onWarning;
-    this.warningThreshold = options.warningThreshold ?? 0.8;
-    const intervalMs = options.cleanupIntervalMs ?? 6e4;
-    if (intervalMs > 0) {
-      this.timer = setInterval(() => {
-        this.cleanup();
-      }, intervalMs);
-      this.timer.unref();
-    }
-  }
-  // -------------------------------------------------------------------------
-  // Core operations
-  // -------------------------------------------------------------------------
-  /**
-   * Check and optionally record a spend against the limit.
-   *
-   * Evicts expired entries, sums remaining amounts, then checks:
-   * - Under limit (currentSpend + amount <= limit): records and returns `allowed: true`
-   * - Would exceed: does NOT record (rejected spends don't consume budget)
-   */
-  check(params) {
-    const { key, amount, limit, windowMs } = params;
-    const now = this.now();
-    const windowStart = now - windowMs;
-    if (!Number.isFinite(amount) || amount < 0) {
-      const existing = this.buckets.get(key);
-      const activeEntries = existing ? existing.entries.filter((e) => e.timestamp > windowStart) : [];
-      const currentSpend2 = activeEntries.reduce((sum, e) => sum + e.amount, 0);
-      const oldest = activeEntries[0];
-      return {
-        allowed: false,
-        currentSpend: currentSpend2,
-        limit,
-        windowMs,
-        resetAtMs: oldest ? oldest.timestamp + windowMs : 0,
-        reason: "invalid_amount"
-      };
-    }
-    let bucket = this.buckets.get(key);
-    if (!bucket) {
-      bucket = { entries: [], limit, currency: "", windowMs };
-      this.buckets.set(key, bucket);
-    }
-    bucket.limit = limit;
-    bucket.windowMs = windowMs;
-    bucket.entries = bucket.entries.filter((e) => e.timestamp > windowStart);
-    const currentSpend = bucket.entries.reduce((sum, e) => sum + e.amount, 0);
-    if (currentSpend + amount > limit) {
-      const oldest = bucket.entries[0];
-      return {
-        allowed: false,
-        currentSpend,
-        limit,
-        windowMs,
-        resetAtMs: oldest ? oldest.timestamp + windowMs : 0
-      };
-    }
-    bucket.entries.push({ timestamp: now, amount });
-    const newSpend = currentSpend + amount;
-    const resetAtMs = (bucket.entries[0]?.timestamp ?? now) + windowMs;
-    if (this.onWarning && newSpend / limit >= this.warningThreshold) {
-      this.onWarning({
-        key,
-        current_spend: newSpend,
-        limit,
-        currency: bucket.currency,
-        window_ms: windowMs,
-        reset_at_ms: resetAtMs
-      });
-    }
-    return {
-      allowed: true,
-      currentSpend: newSpend,
-      limit,
-      windowMs,
-      resetAtMs
-    };
-  }
-  /**
-   * Unconditionally record a spend against the limit.
-   *
-   * Unlike check(), this always appends the amount — even when it pushes the
-   * window past the limit — because the spend it represents has already been
-   * incurred. The sideband peeks at /evaluate and commits here at /audit once
-   * the external call ran (issue #12, D3).
+   * Unlike check(), this always appends the timestamp — even when the bucket
+   * is already at/over the limit — because the call it represents has already
+   * executed. The sideband splits decision from execution: /evaluate peeks
+   * (non-destructive), and /audit calls record() once the external call ran,
+   * so refusing to record at the limit (as check() does) would let real calls
+   * escape accounting and under-count subsequent peeks. (issue #12, D3.)
    *
-   * Throws on a negative or non-finite amount: such amounts are rejected at
-   * /evaluate, so one reaching record() is a logic bug we surface loudly rather
-   * than silently corrupt the sliding-window sum. Warnings fire only while the
-   * post-append spend stays within the limit (parity with check()).
+   * Warnings fire only while the post-append count stays within the limit —
+   * exact parity with check(), which never warns on its over-limit path — so a
+   * burst of over-limit audits cannot flood the dashboard's limit_warning feed.
    */
   record(params) {
-    const { key, amount, limit, windowMs } = params;
-    if (!Number.isFinite(amount) || amount < 0) {
-      throw new RangeError(
-        `SpendLimiter.record() received an invalid amount (${String(amount)}); invalid amounts must be rejected at /evaluate, never committed`
-      );
-    }
+    const { key, maxCalls, windowMs } = params;
     const now = this.now();
     const windowStart = now - windowMs;
     let bucket = this.buckets.get(key);
     if (!bucket) {
-      bucket = { entries: [], limit, currency: "", windowMs };
+      bucket = { timestamps: [], maxCalls, windowMs };
       this.buckets.set(key, bucket);
     }
-    bucket.limit = limit;
+    bucket.maxCalls = maxCalls;
     bucket.windowMs = windowMs;
-    bucket.entries = bucket.entries.filter((e) => e.timestamp > windowStart);
-    bucket.entries.push({ timestamp: now, amount });
-    const currentSpend = bucket.entries.reduce((sum, e) => sum + e.amount, 0);
-    const resetAtMs = (bucket.entries[0]?.timestamp ?? now) + windowMs;
-    if (this.onWarning && currentSpend <= limit && currentSpend / limit >= this.warningThreshold) {
-      this.onWarning({
-        key,
-        current_spend: currentSpend,
-        limit,
-        currency: bucket.currency,
-        window_ms: windowMs,
-        reset_at_ms: resetAtMs
-      });
+    bucket.timestamps = bucket.timestamps.filter((ts) => ts > windowStart);
+    bucket.timestamps.push(now);
+    const current = bucket.timestamps.length;
+    const resetAtMs = (bucket.timestamps[0] ?? now) + windowMs;
+    if (this.onWarning && current <= maxCalls && current / maxCalls >= this.warningThreshold) {
+      this.safeWarn({ key, current, limit: maxCalls, window_ms: windowMs, reset_at_ms: resetAtMs });
     }
     return {
-      allowed: currentSpend <= limit,
-      currentSpend,
-      limit,
+      allowed: current <= maxCalls,
+      current,
+      limit: maxCalls,
       windowMs,
       resetAtMs
     };
   }
   /**
-   * Check the spend limit without recording the spend (non-destructive).
+   * Check the rate limit without recording the call (non-destructive).
    *
    * Used by dry-run mode to determine what would happen without consuming
-   * budget in the bucket.
+   * a slot in the bucket.
    */
   peek(params) {
-    const { key, amount, limit, windowMs } = params;
+    const { key, maxCalls, windowMs } = params;
     const now = this.now();
     const windowStart = now - windowMs;
     const bucket = this.buckets.get(key);
-    if (!Number.isFinite(amount) || amount < 0) {
-      const activeEntries2 = bucket ? bucket.entries.filter((e) => e.timestamp > windowStart) : [];
-      const currentSpend2 = activeEntries2.reduce((sum, e) => sum + e.amount, 0);
-      const oldest2 = activeEntries2[0];
-      return {
-        allowed: false,
-        currentSpend: currentSpend2,
-        limit,
-        windowMs,
-        resetAtMs: oldest2 ? oldest2.timestamp + windowMs : 0,
-        reason: "invalid_amount"
-      };
-    }
     if (!bucket) {
-      const wouldExceed = amount > limit;
       return {
-        allowed: !wouldExceed,
-        currentSpend: wouldExceed ? 0 : amount,
-        limit,
+        allowed: true,
+        current: 1,
+        limit: maxCalls,
         windowMs,
         resetAtMs: now + windowMs
       };
     }
-    const activeEntries = bucket.entries.filter((e) => e.timestamp > windowStart);
-    const currentSpend = activeEntries.reduce((sum, e) => sum + e.amount, 0);
-    if (currentSpend + amount > limit) {
-      const oldest2 = activeEntries[0];
+    const activeCount = bucket.timestamps.filter((ts) => ts > windowStart).length;
+    if (activeCount >= maxCalls) {
+      const oldest2 = bucket.timestamps.find((ts) => ts > windowStart) ?? 0;
       return {
         allowed: false,
-        currentSpend,
-        limit,
+        current: activeCount,
+        limit: maxCalls,
         windowMs,
-        resetAtMs: oldest2 ? oldest2.timestamp + windowMs : 0
+        resetAtMs: oldest2 + windowMs
       };
     }
-    const newSpend = currentSpend + amount;
-    const oldest = activeEntries[0];
+    const oldest = bucket.timestamps.find((ts) => ts > windowStart) ?? now;
     return {
       allowed: true,
-      currentSpend: newSpend,
-      limit,
+      current: activeCount + 1,
+      limit: maxCalls,
       windowMs,
-      resetAtMs: oldest ? oldest.timestamp + windowMs : now + windowMs
+      resetAtMs: oldest + windowMs
     };
   }
-  /**
-   * Set the display currency for a key. Called by the governed forwarder
-   * after check() so dashboard reads include the currency label.
-   */
-  setCurrency(key, currency) {
-    const bucket = this.buckets.get(key);
-    if (bucket) bucket.currency = currency;
-  }
   // -------------------------------------------------------------------------
   // Read operations (for dashboard API)
   // -------------------------------------------------------------------------
@@ -4316,19 +5147,17 @@ var SpendLimiter = class {
     const bucket = this.buckets.get(key);
     if (!bucket) return void 0;
     const windowStart = this.now() - bucket.windowMs;
-    bucket.entries = bucket.entries.filter((e) => e.timestamp > windowStart);
-    if (bucket.entries.length === 0) {
+    bucket.timestamps = bucket.timestamps.filter((ts) => ts > windowStart);
+    if (bucket.timestamps.length === 0) {
       this.buckets.delete(key);
       return void 0;
     }
-    const currentSpend = bucket.entries.reduce((sum, e) => sum + e.amount, 0);
     return {
       key,
-      current_spend: currentSpend,
-      limit: bucket.limit,
-      currency: bucket.currency,
+      current: bucket.timestamps.length,
+      limit: bucket.maxCalls,
       window_ms: bucket.windowMs,
-      reset_at_ms: (bucket.entries[0]?.timestamp ?? 0) + bucket.windowMs
+      reset_at_ms: (bucket.timestamps[0] ?? 0) + bucket.windowMs
     };
   }
   /** List all tracked keys with their current state. */
@@ -4343,50 +5172,62 @@ var SpendLimiter = class {
   // -------------------------------------------------------------------------
   // Maintenance
   // -------------------------------------------------------------------------
-  /** Sweep all buckets: remove expired entries, delete empty buckets. */
+  /** Sweep all buckets: remove expired timestamps, delete empty buckets. */
   cleanup() {
     const now = this.now();
     for (const [key, bucket] of this.buckets) {
       const windowStart = now - bucket.windowMs;
-      bucket.entries = bucket.entries.filter((e) => e.timestamp > windowStart);
-      if (bucket.entries.length === 0) {
+      bucket.timestamps = bucket.timestamps.filter((ts) => ts > windowStart);
+      if (bucket.timestamps.length === 0) {
         this.buckets.delete(key);
       }
     }
   }
-  /** Clear all spend limit state. Called on policy hot-reload. */
+  /** Clear all rate limit state. Called on policy hot-reload. */
   reset() {
     this.buckets.clear();
   }
   /**
-   * Reconcile bucket state against a new policy's spend configuration.
+   * Reconcile bucket state against a new policy's limit configuration.
    *
    * Walks every existing bucket and checks whether its last-seen
-   * `{ limit, currency, windowMs }` tuple still appears in `validConfigs`.
-   * Buckets whose config is unchanged are left untouched — cumulative spend
-   * and elapsed-window progress are preserved across hot-reloads. Buckets
-   * whose config is gone (rule changed or removed) are evicted so the next
-   * check lazy-creates a fresh bucket under the new config.
+   * `{ maxCalls, windowMs }` tuple still appears anywhere in `validConfigs`.
+   * Buckets whose config is still present are left untouched — counters and
+   * elapsed-window progress are preserved across hot-reloads. Buckets whose
+   * config is gone (rule changed or removed) are evicted so the next check
+   * lazy-creates a fresh bucket under the new config.
    *
-   * Currency is part of the tuple because a USD→EUR switch is a meaningful
-   * policy change — the same numeric limit buys a different amount of real
-   * spend, so the bucket must reset. This replaces the old `reset()` call
-   * on every hot-reload, which wiped all state even when the matching rule
-   * was unchanged.
+   * This is the compare-and-evict semantic that replaces the old `reset()`
+   * call on every hot-reload, which wiped all state even when the matching
+   * rule was unchanged.
    */
   reconcile(validConfigs) {
     const valid = /* @__PURE__ */ new Set();
     for (const config of validConfigs) {
-      valid.add(`${String(config.limit)}|${config.currency}|${String(config.windowMs)}`);
+      valid.add(`${String(config.maxCalls)}|${String(config.windowMs)}`);
     }
     for (const [key, bucket] of this.buckets) {
-      const tuple = `${String(bucket.limit)}|${bucket.currency}|${String(bucket.windowMs)}`;
+      const tuple = `${String(bucket.maxCalls)}|${String(bucket.windowMs)}`;
       if (!valid.has(tuple)) {
         this.buckets.delete(key);
       }
     }
   }
   /** Stop the cleanup timer and mark as closed. */
+  /**
+   * Invoke the warning callback without letting a subscriber throw into the
+   * limiter's caller: a warning fires after state has already mutated, and a
+   * governed call must not be blocked (or double-charged on retry) by an
+   * observability bug.
+   */
+  safeWarn(state) {
+    if (!this.onWarning) return;
+    try {
+      this.onWarning(state);
+    } catch (err) {
+      console.error("[helio] limit warning subscriber threw:", err);
+    }
+  }
   close() {
     if (this.closed) return;
     this.closed = true;
@@ -4400,7 +5241,7 @@ var SpendLimiter = class {
 
 // src/audit/store.ts
 import Database from "better-sqlite3";
-import { randomUUID as randomUUID2 } from "crypto";
+import { randomUUID as randomUUID3 } from "crypto";
 import { chmodSync } from "fs";
 
 // src/upstream/response-summary.ts
@@ -4464,6 +5305,7 @@ function clampInt(value, fallback, min, max) {
 
 // src/audit/store.ts
 var DRIFT_EVENT_DECISIONS_SQL = "('tool_drift', 'tool_drift_reverted')";
+var NON_TOOL_DECISIONS_SQL = "('tool_drift', 'tool_drift_reverted', 'rejected')";
 var EXPORT_MAX_RECORDS = 1e4;
 var LIST_MAX_PAGE_SIZE = 1e3;
 var CREATE_TABLE_DDL = `
@@ -4654,6 +5496,7 @@ var AuditStore = class {
   insertStmt;
   retentionMs;
   includeResponses;
+  retentionSweepHooks = [];
   cleanupTimer = null;
   constructor(options) {
     this.db = new Database(options.path);
@@ -4671,12 +5514,51 @@ var AuditStore = class {
     const intervalMs = options.cleanupIntervalMs ?? 864e5;
     if (intervalMs > 0) {
       this.cleanupTimer = setInterval(() => {
-        this.purgeExpired();
+        this.runRetentionSweep();
         restrictAuditFilePerms(options.path);
       }, intervalMs);
       this.cleanupTimer.unref();
     }
   }
+  /**
+   * Register a hook to run on every retention sweep, receiving the sweep's
+   * cutoff. This is how co-resident tables (the budget ledger) join the
+   * store's single sweep schedule instead of running their own timers.
+   * Hooks registered after construction miss the constructor's initial
+   * purge — call {@link runRetentionSweep} once after registering to cover
+   * rows that aged out while the process was down.
+   */
+  onRetentionSweep(fn) {
+    this.retentionSweepHooks.push(fn);
+  }
+  /**
+   * One full retention sweep: purge expired audit records, then fire every
+   * registered hook with the sweep's cutoff. Hook failures degrade to a
+   * logged error — a broken co-resident purge must not stop the audit
+   * table's own retention.
+   */
+  runRetentionSweep() {
+    const ms = Date.now() - this.retentionMs;
+    const cutoff = { iso: new Date(ms).toISOString(), ms };
+    this.purgeBefore(cutoff.iso);
+    for (const hook of this.retentionSweepHooks) {
+      try {
+        hook(cutoff);
+      } catch (err) {
+        console.error("[helio] retention sweep hook failed:", err);
+      }
+    }
+  }
+  /**
+   * Package-internal: the store's open database handle, for components that
+   * co-locate their tables in the audit db (the budget ledger). Sharing the
+   * handle keeps one connection, one WAL domain, and one file-permission
+   * hardening pass. Not part of the public embedding API — do not re-export
+   * anything built on this from the package root.
+   */
+  get database() {
+    return this.db;
+  }
   /**
    * Validate that the on-disk audit schema contains all required canonical columns.
    *
@@ -4701,7 +5583,7 @@ var AuditStore = class {
    * @param id - Optional pre-generated ID (used by AuditWriter to share ID with SSE event bus).
    */
   insert(record, createdAt, id) {
-    const resolvedId = id ?? randomUUID2();
+    const resolvedId = id ?? randomUUID3();
     const now = createdAt ?? (/* @__PURE__ */ new Date()).toISOString();
     this.insertStmt.run({
       id: resolvedId,
@@ -4831,7 +5713,7 @@ var AuditStore = class {
          GROUP BY block_reason
          ORDER BY count DESC`
     ).all(...params);
-    const toolsClause = clause ? `${clause} AND policy_decision NOT IN ${DRIFT_EVENT_DECISIONS_SQL}` : `WHERE policy_decision NOT IN ${DRIFT_EVENT_DECISIONS_SQL}`;
+    const toolsClause = clause ? `${clause} AND policy_decision NOT IN ${NON_TOOL_DECISIONS_SQL}` : `WHERE policy_decision NOT IN ${NON_TOOL_DECISIONS_SQL}`;
     const top_tools = this.db.prepare(
       `SELECT tool_name, COUNT(*) as count
          FROM audit_records ${toolsClause}
@@ -4874,8 +5756,10 @@ var AuditStore = class {
   }
   /** Delete records older than the retention period. Returns the count of deleted records. */
   purgeExpired() {
-    const cutoff = new Date(Date.now() - this.retentionMs).toISOString();
-    const result = this.db.prepare("DELETE FROM audit_records WHERE created_at < ?").run(cutoff);
+    return this.purgeBefore(new Date(Date.now() - this.retentionMs).toISOString());
+  }
+  purgeBefore(cutoffIso) {
+    const result = this.db.prepare("DELETE FROM audit_records WHERE created_at < ?").run(cutoffIso);
     return result.changes;
   }
   /** Close the database and stop the cleanup timer. */
@@ -4889,7 +5773,7 @@ var AuditStore = class {
 };
 
 // src/audit/writer.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 var AuditWriter = class {
   store;
   bufferSize;
@@ -4924,7 +5808,7 @@ var AuditWriter = class {
    * is scheduled. This keeps request-path latency bounded even under bursty
    * write load.
    */
-  push(record, id = randomUUID3()) {
+  push(record, id = randomUUID4()) {
     if (this.closed) return;
     this.buffer.push({ id, record });
     this.onPush?.(record, id);
@@ -4940,7 +5824,7 @@ var AuditWriter = class {
    * A fatal-process crash still invokes the crash-drain hook, which calls
    * `flush()` synchronously before exit.
    */
-  pushImmediate(record, id = randomUUID3()) {
+  pushImmediate(record, id = randomUUID4()) {
     if (this.closed) return;
     this.buffer.push({ id, record });
     this.onPush?.(record, id);
@@ -5309,7 +6193,9 @@ import { createHash as createHash2 } from "crypto";
 var originSchema = z4.string().regex(/^[a-z0-9_-]{1,64}$/, "origin must match ^[a-z0-9_-]{1,64}$").default("sideband");
 var metadataSchema = z4.record(z4.string(), z4.unknown()).nullish();
 var toolDefinitionSchema = z4.object({
-  name: z4.string().min(1),
+  // Stored verbatim in pending entries and audit rows; capped so a
+  // caller-minted name cannot inflate the pending-entry footprint.
+  name: z4.string().min(1).max(256),
   description: z4.string().optional(),
   input_schema: z4.unknown().optional(),
   output_schema: z4.unknown().optional(),
@@ -5319,16 +6205,18 @@ var toolDefinitionSchema = z4.object({
 var evaluateBody = z4.object({
   origin: originSchema,
   adapter_version: z4.string().max(64).optional(),
-  agent_id: z4.string().nullish(),
-  session_id: z4.string().nullish(),
+  // Stored in pending entries and limit bucket keys; capped (like origin and
+  // adapter_version) so caller-minted ids cannot inflate memory unaccounted.
+  agent_id: z4.string().max(128).nullish(),
+  session_id: z4.string().max(256).nullish(),
   tool: toolDefinitionSchema,
   arguments: z4.record(z4.string(), z4.unknown()).optional(),
   metadata: metadataSchema
 });
 var installScanBody = z4.object({
   origin: originSchema,
-  agent_id: z4.string().nullish(),
-  session_id: z4.string().nullish(),
+  agent_id: z4.string().max(128).nullish(),
+  session_id: z4.string().max(256).nullish(),
   package: z4.object({
     name: z4.string().min(1),
     version: z4.string().optional(),
@@ -5588,7 +6476,7 @@ function createSidebandApp(store, options = {}) {
 }
 
 // src/sideband/governance-service.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 
 // src/sideband/errors.ts
 var GovernanceConfigError = class extends Error {
@@ -5616,6 +6504,7 @@ var GovernanceService = class {
   approvalRouter;
   rateLimiter;
   spendLimiter;
+  budgetEngine;
   auditWriter;
   approvalTimeoutMs;
   ttlMs;
@@ -5648,6 +6537,7 @@ var GovernanceService = class {
     this.approvalRouter = options.approvalRouter;
     this.rateLimiter = options.rateLimiter;
     this.spendLimiter = options.spendLimiter;
+    this.budgetEngine = options.budgetEngine;
     this.auditWriter = options.auditWriter;
     this.approvalTimeoutMs = options.approvalTimeoutMs ?? 3e5;
     this.ttlMs = options.ttlMs ?? 6e5;
@@ -5681,7 +6571,12 @@ var GovernanceService = class {
     if (inputBytes > MAX_TOOL_INPUT_BYTES) {
       return { status: 413, body: { error: "tool_input_too_large" } };
     }
-    const entryBytes = inputBytes + byteLength(req.metadata ?? {});
+    const entryBytes = inputBytes + byteLength(req.metadata ?? {}) + byteLength({
+      tool: req.tool.name,
+      agent_id: req.agent_id,
+      session_id: req.session_id,
+      origin: req.origin
+    });
     if (!this.caches.has(req.origin) && this.caches.size >= MAX_ORIGINS) {
       return { status: 400, body: { error: "origin_limit_exceeded" } };
     }
@@ -5712,11 +6607,21 @@ var GovernanceService = class {
       agentId: req.agent_id ?? void 0
     });
     const { decision } = pipeline;
-    const evaluationId = randomUUID4();
+    const evaluationId = randomUUID5();
     const timestampIso = new Date(this.now()).toISOString();
     let wire;
-    let limitPlan;
+    const plans = [];
     let limitsBlock;
+    const reservedThisCall = [];
+    const reserve = (key) => {
+      const preexisting = this.senderKeys.has(key);
+      if (!this.reserveSenderKey(key)) return false;
+      if (!preexisting && this.senderKeys.has(key)) reservedThisCall.push(key);
+      return true;
+    };
+    const releaseReservations = () => {
+      for (const key of reservedThisCall) this.senderKeys.delete(key);
+    };
     const senderId = senderIdOf(req.metadata);
     if (pipeline.isDryRun) {
       wire = "dry_run";
@@ -5726,23 +6631,97 @@ var GovernanceService = class {
       wire = "require_approval";
     } else if (decision.action === "rate_limit") {
       const planned = this.planRate(decision, toolName, req.session_id, senderId);
-      if (planned?.plan && !this.reserveSenderKey(planned.plan.key)) {
+      if (planned?.plan && !reserve(planned.plan.key)) {
         return { status: 503, body: { error: "limit_capacity_exhausted" } };
       }
-      limitPlan = planned?.plan;
+      if (planned?.plan) plans.push(planned.plan);
       limitsBlock = planned?.block ? { rate: planned.block } : void 0;
       wire = planned?.allowed ? "allow" : "rate_limited";
     } else if (decision.action === "spend_limit") {
       const planned = this.planSpend(decision, toolName, req.session_id, req.arguments, senderId);
-      if (planned?.plan && !this.reserveSenderKey(planned.plan.key)) {
+      if (planned?.plan && !reserve(planned.plan.key)) {
         return { status: 503, body: { error: "limit_capacity_exhausted" } };
       }
-      limitPlan = planned?.plan;
+      if (planned?.plan) plans.push(planned.plan);
       limitsBlock = planned?.block ? { spend: planned.block } : void 0;
       wire = planned?.allowed ? "allow" : "spend_limited";
     } else {
       wire = "allow";
     }
+    let budgetsBlock;
+    let budgetDryRunOk = true;
+    let budgetDenial;
+    let budgetBreachContexts;
+    let budgetBreachEntries;
+    let budgetTicketTimeoutMs;
+    let budgetTriggeredApproval = false;
+    if (this.budgetEngine && (wire === "allow" || wire === "require_approval" || wire === "dry_run")) {
+      const { charges, failures } = this.budgetEngine.resolveCharges({
+        toolName,
+        toolArguments: req.arguments,
+        sessionId: req.session_id,
+        senderId
+      });
+      if (charges.length > 0 || failures.length > 0) {
+        const peek = charges.length > 0 ? this.budgetEngine.peekAll(charges) : { allowed: true, entries: [] };
+        budgetsBlock = [
+          ...peek.entries.map((entry2) => budgetWireBlock(entry2)),
+          ...failures.map((failure) => budgetFailureBlock(failure))
+        ];
+        const breaches = peek.entries.filter((entry2) => !entry2.allowed);
+        const canBreakGlass = this.approvalRouter !== void 0 && breaches.every((entry2) => entry2.budget.onExceed === "require_approval");
+        if (failures.length > 0 || breaches.length > 0 && !canBreakGlass) {
+          budgetDryRunOk = false;
+          if (wire !== "dry_run") {
+            releaseReservations();
+            plans.length = 0;
+            wire = "budget_exceeded";
+            budgetDenial = {
+              breached: breaches.map((entry2) => entry2.budget.name),
+              invalid: failures.map((failure) => failure.budget.name)
+            };
+            if (breaches.length > 0) this.budgetEngine.reportBreaches(breaches);
+          }
+        } else {
+          if (breaches.length > 0) budgetDryRunOk = false;
+          if (wire !== "dry_run") {
+            for (const [index, charge] of charges.entries()) {
+              if (!reserve(charge.bucketKey)) {
+                releaseReservations();
+                return { status: 503, body: { error: "limit_capacity_exhausted" } };
+              }
+              plans.push({
+                kind: "budget",
+                budget: charge.budget,
+                bucketKey: charge.bucketKey,
+                amount: charge.amount,
+                generation: charge.generation,
+                breached: peek.entries[index]?.allowed === false
+              });
+            }
+            if (breaches.length > 0) {
+              budgetBreachEntries = breaches;
+              budgetBreachContexts = breaches.map((entry2) => ({
+                name: entry2.budget.name,
+                limit: entry2.budget.limit,
+                spent: entry2.spent,
+                attempted_amount: entry2.amount,
+                currency: entry2.budget.currency,
+                window: entry2.budget.windowRaw
+              }));
+              budgetTicketTimeoutMs = breaches[0]?.budget.approval?.timeoutMs;
+              if (wire === "allow") {
+                budgetTriggeredApproval = true;
+                wire = "require_approval";
+              }
+            }
+          }
+        }
+      }
+    }
+    if (budgetsBlock) {
+      limitsBlock = { ...limitsBlock ?? {}, budgets: budgetsBlock };
+    }
     const matchedRuleName = decision.matchedRule?.name ?? null;
     const matchedRuleIndex = decision.matchedRule?.index ?? null;
     const responseBody = {
@@ -5752,15 +6731,27 @@ var GovernanceService = class {
       matched_rule: matchedRuleName,
       matched_rule_index: matchedRuleIndex
     };
-    if (isBlocking(wire)) {
+    if (shouldAttachFeedback(wire, decision)) {
       responseBody["feedback"] = buildFeedback(decision.matchedRule, decision.reason);
     }
+    if (wire === "require_approval" && budgetTriggeredApproval && budgetBreachContexts) {
+      responseBody["feedback"] = {
+        message: `Budget ${budgetBreachContexts.map((b) => `"${b.name}"`).join(", ")} would be exceeded by this call; break-glass approval required`,
+        suggestion: "Await the approval decision, reduce the amount, or wait for the window to reset."
+      };
+    }
+    if (wire === "budget_exceeded" && budgetDenial) {
+      responseBody["feedback"] = {
+        message: budgetDenial.invalid.length > 0 ? `Budget ${budgetDenial.invalid.map((n) => `"${n}"`).join(", ")} could not read a valid spend amount from this call` : `Budget ${budgetDenial.breached.map((n) => `"${n}"`).join(", ")} would be exceeded by this call`,
+        suggestion: budgetDenial.invalid.length > 0 ? "Retry with a non-negative finite amount in the expected field." : "Wait for the window to reset or reduce the amount."
+      };
+    }
     if (limitsBlock) responseBody["limits"] = limitsBlock;
     if (wire === "dry_run") {
       responseBody["dry_run"] = {
-        would_forward: decision.action === "allow" && !pipeline.evidenceBlocked,
+        would_forward: decision.action === "allow" && !pipeline.evidenceBlocked && budgetDryRunOk,
         evidence_satisfied: !pipeline.evidenceBlocked,
-        limits_ok: true
+        limits_ok: budgetDryRunOk
       };
     }
     if (pipeline.driftEvent) {
@@ -5792,6 +6783,12 @@ var GovernanceService = class {
       });
       return { status: 200, body: responseBody };
     }
+    const budgetsAtEvaluate = plans.some((plan) => plan.kind === "budget") ? structuredClone(budgetsBlock) : void 0;
+    const totalBytes = entryBytes + planBytes(plans) + (budgetsAtEvaluate ? byteLength(budgetsAtEvaluate) : 0);
+    if (this.pendingBytes + totalBytes > this.maxPendingBytes) {
+      releaseReservations();
+      return { status: 503, body: { error: "evaluation_backlog_full" } };
+    }
     let approvalTicketId;
     let ticketTimeoutAtMs;
     if (wire === "require_approval") {
@@ -5801,14 +6798,18 @@ var GovernanceService = class {
           "[helio] invariant violation: require_approval decision without an approvalRouter"
         );
       }
-      const timeoutMs = decision.matchedRule?.approval?.timeoutMs ?? this.approvalTimeoutMs;
+      const timeoutMs = (decision.action === "require_approval" ? decision.matchedRule?.approval?.timeoutMs : budgetTicketTimeoutMs) ?? this.approvalTimeoutMs;
       const ticket = router.createNativeTicket({
         tool_name: toolName,
-        tool_input: req.arguments ?? {},
+        // Cloned: the ticket is what the APPROVER sees, and a direct
+        // embedder mutating its arguments object after /evaluate must not
+        // rewrite it (same guard as the pending entry's evidence below).
+        tool_input: structuredClone(req.arguments ?? {}),
         matched_rule: decision.matchedRule,
         session_id: req.session_id,
         origin: req.origin,
-        timeout_ms: timeoutMs
+        timeout_ms: timeoutMs,
+        breached_budgets: budgetBreachContexts
       });
       approvalTicketId = ticket.id;
       ticketTimeoutAtMs = this.now() + timeoutMs;
@@ -5817,6 +6818,7 @@ var GovernanceService = class {
         timeout_ms: timeoutMs,
         resolve_path: `/approval/${ticket.id}/resolve`
       };
+      if (budgetBreachEntries) this.budgetEngine?.reportBreaches(budgetBreachEntries);
     }
     const entry = {
       evaluationId,
@@ -5824,22 +6826,27 @@ var GovernanceService = class {
       agentId: req.agent_id,
       sessionId: req.session_id,
       toolName,
-      toolInput: req.arguments ?? {},
-      metadata: req.metadata,
+      // Cloned: direct embedders share these references and could otherwise
+      // mutate the audit evidence (and desync the byte accounting) after
+      // admission. The HTTP route always builds fresh objects; this guards
+      // the library surface.
+      toolInput: structuredClone(req.arguments ?? {}),
+      metadata: req.metadata === null ? null : structuredClone(req.metadata),
       action: decision.action,
       matchedRuleName,
       matchedRuleIndex,
       flaggedDestructive: pipeline.flaggedDestructive,
-      limitPlan,
+      plans,
+      budgetsAtEvaluate,
       approvalTicketId,
       timestampIso,
       createdAtMs: this.now(),
       evaluationExpiresAtMs: this.now() + this.ttlMs,
       ticketTimeoutAtMs,
-      bytes: entryBytes
+      bytes: totalBytes
     };
     this.pending.set(evaluationId, entry);
-    this.pendingBytes += entryBytes;
+    this.pendingBytes += totalBytes;
     if (approvalTicketId) this.ticketToEvaluation.set(approvalTicketId, evaluationId);
     return { status: 200, body: responseBody };
   }
@@ -5883,20 +6890,20 @@ var GovernanceService = class {
     let approvedBy = null;
     let approvalContext;
     if (entry.approvalTicketId) {
-      const ticket = this.getTicketStatus(entry.approvalTicketId);
-      const status = ticket?.status;
-      if (!status || status === "pending") {
+      this.snapshotTicketResolution(entry);
+      const resolution = entry.ticketResolution;
+      if (!resolution) {
         return { status: 409, body: { error: "approval_unresolved" } };
       }
-      approvalStatus = status;
-      approvedBy = ticket.resolved_by ?? null;
-      if (ticket.denial_reason || ticket.escalated_at) {
+      approvalStatus = resolution.status;
+      approvedBy = resolution.resolvedBy;
+      if (resolution.denialReason || resolution.escalatedAt) {
         approvalContext = {
           ticket_id: entry.approvalTicketId,
-          ...ticket.denial_reason ? { denial_reason: ticket.denial_reason } : {},
-          ...ticket.escalated_at ? {
-            escalated_at: ticket.escalated_at,
-            escalated_to: [...ticket.escalated_to ?? []]
+          ...resolution.denialReason ? { denial_reason: resolution.denialReason } : {},
+          ...resolution.escalatedAt ? {
+            escalated_at: resolution.escalatedAt,
+            escalated_to: [...resolution.escalatedTo ?? []]
           } : {}
         };
       }
@@ -5905,20 +6912,32 @@ var GovernanceService = class {
       if (!Number.isFinite(req.actual_amount) || req.actual_amount < 0) {
         return { status: 400, body: { error: "invalid_actual_amount" } };
       }
-      if (entry.limitPlan?.kind !== "spend") {
+      const hasMoneyPlan = entry.plans.some(
+        (plan) => plan.kind === "spend" || plan.kind === "budget"
+      );
+      if (!hasMoneyPlan) {
         return { status: 400, body: { error: "no_spend_rule" } };
       }
     }
     const callHappened = req.status === "success" || req.status === "error";
-    let limitsChain;
-    if (callHappened && entry.limitPlan) {
-      limitsChain = this.commitLimit(entry.limitPlan, req.actual_amount);
+    if (entry.commitState && entry.commitState.payloadHash !== payloadHash) {
+      return { status: 409, body: { error: "evaluation_conflict" } };
+    }
+    const auditId = entry.commitState?.auditId ?? randomUUID5();
+    let limitsChain = entry.commitState?.limitsChain;
+    if (callHappened && entry.plans.length > 0 && !entry.commitState) {
+      limitsChain = this.commitPlans(entry, req.actual_amount, auditId, approvalStatus);
+      entry.commitState = { auditId, limitsChain, payloadHash };
+    } else if (!callHappened && !entry.commitState && entry.budgetsAtEvaluate) {
+      limitsChain = { ...limitsChain ?? {}, budgets: entry.budgetsAtEvaluate };
     }
+    const budgetBreachBlocked = !callHappened && entry.action !== "require_approval" && (approvalStatus === "denied" || approvalStatus === "timeout") && entry.plans.some((plan) => plan.kind === "budget" && plan.breached);
     if (callHappened && this.evidenceStore && entry.sessionId) {
       this.evidenceStore.recordToolCall(entry.sessionId, entry.toolName, req.status === "success");
     }
     const evidenceOutcomes = this.populateEvidence(req, entry);
-    const auditId = this.writeAudit({
+    this.writeAudit({
+      id: auditId,
       timestampIso: entry.timestampIso,
       origin: entry.origin,
       agentId: entry.agentId,
@@ -5927,6 +6946,7 @@ var GovernanceService = class {
       toolInput: entry.toolInput,
       metadata: entry.metadata,
       action: entry.action,
+      budgetBreachBlocked,
       wire: entry.action === "require_approval" ? "require_approval" : "allow",
       matchedRuleName: entry.matchedRuleName,
       matchedRuleIndex: entry.matchedRuleIndex,
@@ -6015,7 +7035,7 @@ var GovernanceService = class {
       return { status: 400, body: { error: "reserved_metadata_key", key: reserved } };
     }
     this.touchAdapter(req.origin);
-    const evaluationId = randomUUID4();
+    const evaluationId = randomUUID5();
     const toolName = `install:${req.package.source ?? "pkg"}:${req.package.name}`;
     const verdict = this.evaluateInstall(req);
     const denied = verdict.decision === "deny";
@@ -6167,6 +7187,7 @@ var GovernanceService = class {
     if (!resolved) {
       return { status: 409, body: { error: "already_resolved" } };
     }
+    if (entry) this.snapshotTicketResolution(entry);
     return { status: 200, body: { ok: true } };
   }
   // -------------------------------------------------------------------------
@@ -6192,7 +7213,7 @@ var GovernanceService = class {
    * closed, so an emptied bucket frees its slot without waiting for the sweep.
    */
   reserveSenderKey(key) {
-    if (!key.startsWith("sender:")) return true;
+    if (!isSenderScopedKey(key)) return true;
     if (this.senderKeys.has(key)) return true;
     if (this.hasLiveBucket(key)) {
       this.senderKeys.add(key);
@@ -6210,8 +7231,9 @@ var GovernanceService = class {
     if (this.senderKeys.size === 0) return;
     const inUse = /* @__PURE__ */ new Set();
     for (const entry of this.pending.values()) {
-      if (entry.limitPlan && entry.limitPlan.key.startsWith("sender:")) {
-        inUse.add(entry.limitPlan.key);
+      for (const plan of entry.plans) {
+        const key = plan.kind === "budget" ? plan.bucketKey : plan.key;
+        if (isSenderScopedKey(key)) inUse.add(key);
       }
     }
     for (const key of this.senderKeys) {
@@ -6226,7 +7248,7 @@ var GovernanceService = class {
    * an emptied bucket IS the prune-on-touch mechanism.
    */
   hasLiveBucket(key) {
-    return this.rateLimiter?.getKeyState(key) !== void 0 || this.spendLimiter?.getKeyState(key) !== void 0;
+    return this.rateLimiter?.getKeyState(key) !== void 0 || this.spendLimiter?.getKeyState(key) !== void 0 || this.budgetEngine?.hasBucket(key) === true;
   }
   close() {
     if (this.closed) return;
@@ -6251,7 +7273,17 @@ var GovernanceService = class {
     if (now >= entry.evaluationExpiresAtMs) {
       if (entry.approvalTicketId) {
         this.approvalRouter?.resolveNativeTicket(entry.approvalTicketId, "timeout");
+        this.snapshotTicketResolution(entry);
       }
+      const resolution = entry.ticketResolution;
+      const approvalContext = entry.approvalTicketId && resolution && (resolution.denialReason || resolution.escalatedAt) ? {
+        ticket_id: entry.approvalTicketId,
+        ...resolution.denialReason ? { denial_reason: resolution.denialReason } : {},
+        ...resolution.escalatedAt ? {
+          escalated_at: resolution.escalatedAt,
+          escalated_to: [...resolution.escalatedTo ?? []]
+        } : {}
+      } : void 0;
       const auditId = this.writeAudit({
         timestampIso: entry.timestampIso,
         origin: entry.origin,
@@ -6267,6 +7299,10 @@ var GovernanceService = class {
         flaggedDestructive: entry.flaggedDestructive,
         dryRun: false,
         recordKind: "evaluation_expired",
+        approvalStatus: resolution?.status ?? null,
+        approvedBy: resolution?.resolvedBy ?? null,
+        approvalContext,
+        limitsChain: !entry.commitState && entry.budgetsAtEvaluate ? { budgets: entry.budgetsAtEvaluate } : void 0,
         sidebandUnreported: true
       });
       this.discardPending(entry);
@@ -6283,6 +7319,7 @@ var GovernanceService = class {
     }
     if (entry.approvalTicketId && entry.ticketTimeoutAtMs !== void 0 && now >= entry.ticketTimeoutAtMs) {
       this.approvalRouter?.resolveNativeTicket(entry.approvalTicketId, "timeout");
+      this.snapshotTicketResolution(entry);
     }
     return "active";
   }
@@ -6303,6 +7340,18 @@ var GovernanceService = class {
   getTicketStatus(ticketId) {
     return this.approvalRouter?.getTicket(ticketId);
   }
+  /** Latch the entry's ticket resolution while the ticket still exists. */
+  snapshotTicketResolution(entry) {
+    if (entry.ticketResolution || !entry.approvalTicketId) return;
+    const ticket = this.getTicketStatus(entry.approvalTicketId);
+    if (!ticket || ticket.status === "pending") return;
+    entry.ticketResolution = {
+      status: ticket.status,
+      resolvedBy: ticket.resolved_by ?? null,
+      ...ticket.denial_reason ? { denialReason: ticket.denial_reason } : {},
+      ...ticket.escalated_at ? { escalatedAt: ticket.escalated_at, escalatedTo: [...ticket.escalated_to ?? []] } : {}
+    };
+  }
   planRate(decision, toolName, sessionId, senderId) {
     const limits = decision.matchedRule?.limits;
     if (!this.rateLimiter || !limits?.maxCalls || !limits.windowMs) {
@@ -6328,7 +7377,10 @@ var GovernanceService = class {
   planSpend(decision, toolName, sessionId, args, senderId) {
     const maxSpend = decision.matchedRule?.limits?.maxSpend;
     if (!this.spendLimiter || !maxSpend) return { allowed: true };
-    const key = buildLimitKey(maxSpend.key, toolName, sessionId, senderId);
+    const key = spendBucketKey(
+      buildLimitKey(maxSpend.key, toolName, sessionId, senderId),
+      decision.matchedRule.index
+    );
     const rawAmount = resolvePath(maxSpend.field, args ?? {});
     if (typeof rawAmount !== "number" || !Number.isFinite(rawAmount) || rawAmount < 0) {
       return { allowed: false, block: { reason: "invalid_amount", limit: maxSpend.limit } };
@@ -6357,47 +7409,88 @@ var GovernanceService = class {
       allowed: peek.allowed
     };
   }
-  /** Commit a limit plan at /audit time and return the evidence_chain block. */
-  commitLimit(plan, actualAmount) {
-    if (plan.kind === "rate" && this.rateLimiter && plan.limits.maxCalls && plan.limits.windowMs) {
-      const r = this.rateLimiter.record({
-        key: plan.key,
-        maxCalls: plan.limits.maxCalls,
-        windowMs: plan.limits.windowMs
-      });
-      return {
-        rate_limit: {
-          allowed: r.allowed,
-          current: r.current,
-          limit: r.limit,
-          window_ms: r.windowMs,
-          reset_at_ms: r.resetAtMs
+  /** Commit every plan of one call at /audit time; returns the chain blocks. */
+  commitPlans(entry, actualAmount, auditId, approvalStatus) {
+    let chain;
+    const budgetPlans = entry.plans.filter((plan) => plan.kind === "budget");
+    if (budgetPlans.length > 0 && this.budgetEngine) {
+      const kinds = new Map(
+        budgetPlans.filter((plan) => plan.breached && approvalStatus === "approved").map((plan) => [plan.budget.name, "approved_overage"])
+      );
+      const snapshots = this.budgetEngine.recordAll(
+        budgetPlans.map((plan) => ({
+          budget: plan.budget,
+          bucketKey: plan.bucketKey,
+          amount: actualAmount ?? plan.amount,
+          generation: plan.generation
+        })),
+        {
+          kind: "spend",
+          ...kinds.size > 0 ? { kinds } : {},
+          auditRecordId: auditId,
+          origin: entry.origin,
+          toolName: entry.toolName,
+          timestampIso: new Date(this.now()).toISOString()
         }
+      );
+      const frozenByName = new Map(
+        (entry.budgetsAtEvaluate ?? []).map((block) => [block["name"], block])
+      );
+      chain = {
+        ...chain ?? {},
+        budgets: snapshots.map((snapshot) => {
+          const kind = kinds.get(snapshot.budget.name) ?? "spend";
+          const frozen = frozenByName.get(snapshot.budget.name);
+          return snapshot.stale && frozen ? { ...frozen, kind, stale: true } : budgetWireBlock(snapshot, kind);
+        })
       };
     }
-    if (plan.kind === "spend" && this.spendLimiter && plan.limits.maxSpend) {
-      const amount = actualAmount ?? plan.amount ?? 0;
-      const r = this.spendLimiter.record({
-        key: plan.key,
-        amount,
-        limit: plan.limits.maxSpend.limit,
-        windowMs: plan.limits.maxSpend.windowMs
-      });
-      this.spendLimiter.setCurrency(plan.key, plan.limits.maxSpend.currency);
-      return {
-        spend_limit: {
-          allowed: r.allowed,
-          current_spend: r.currentSpend,
-          limit: r.limit,
-          window_ms: r.windowMs,
-          reset_at_ms: r.resetAtMs
-        }
-      };
+    for (const plan of entry.plans) {
+      if (plan.kind === "budget") {
+        continue;
+      }
+      if (plan.kind === "rate" && this.rateLimiter && plan.limits.maxCalls && plan.limits.windowMs) {
+        const r = this.rateLimiter.record({
+          key: plan.key,
+          maxCalls: plan.limits.maxCalls,
+          windowMs: plan.limits.windowMs
+        });
+        chain = {
+          ...chain ?? {},
+          rate_limit: {
+            allowed: r.allowed,
+            current: r.current,
+            limit: r.limit,
+            window_ms: r.windowMs,
+            reset_at_ms: r.resetAtMs
+          }
+        };
+      }
+      if (plan.kind === "spend" && this.spendLimiter && plan.limits.maxSpend) {
+        const amount = actualAmount ?? plan.amount ?? 0;
+        const r = this.spendLimiter.record({
+          key: plan.key,
+          amount,
+          limit: plan.limits.maxSpend.limit,
+          windowMs: plan.limits.maxSpend.windowMs
+        });
+        this.spendLimiter.setCurrency(plan.key, plan.limits.maxSpend.currency);
+        chain = {
+          ...chain ?? {},
+          spend_limit: {
+            allowed: r.allowed,
+            current_spend: r.currentSpend,
+            limit: r.limit,
+            window_ms: r.windowMs,
+            reset_at_ms: r.resetAtMs
+          }
+        };
+      }
     }
-    return void 0;
+    return chain;
   }
   writeAudit(args) {
-    const id = randomUUID4();
+    const id = args.id ?? randomUUID5();
     if (!this.auditWriter) return id;
     const blockReason = deriveBlockReason(args);
     let evidenceChain = args.limitsChain ?? null;
@@ -6450,6 +7543,7 @@ function deriveBlockReason(args) {
   if (args.recordKind === "evaluation_expired") return null;
   if (args.recordKind === "install_scan") return args.wire === "deny" ? "install_denied" : null;
   if (args.dryRun) return null;
+  if (args.budgetBreachBlocked) return "budget_exceeded";
   if (args.approvalStatus === "denied") return "approval_denied";
   if (args.approvalStatus === "timeout") return "approval_timeout";
   if (args.approvalStatus === "cancelled") return "cancelled";
@@ -6460,6 +7554,8 @@ function deriveBlockReason(args) {
       return "rate_limited";
     case "spend_limited":
       return "spend_limited";
+    case "budget_exceeded":
+      return "budget_exceeded";
     default:
       return null;
   }
@@ -6470,10 +7566,15 @@ function buildFeedback(rule, reason) {
   return suggestion ? { message, suggestion } : { message };
 }
 function isBlocking(wire) {
-  return wire === "deny" || wire === "rate_limited" || wire === "spend_limited";
+  return wire === "deny" || wire === "rate_limited" || wire === "spend_limited" || wire === "budget_exceeded";
+}
+function shouldAttachFeedback(wire, decision) {
+  if (isBlocking(wire)) return true;
+  const gating = wire === "require_approval" || wire === "dry_run";
+  return gating && decision.action !== "allow" && decision.matchedRule?.feedback != null;
 }
 function isTerminalAtEvaluate(wire) {
-  return wire === "deny" || wire === "rate_limited" || wire === "spend_limited" || wire === "dry_run";
+  return wire === "deny" || wire === "rate_limited" || wire === "spend_limited" || wire === "budget_exceeded" || wire === "dry_run";
 }
 function policyCanRequireApproval(policy) {
   if (policy.flagDestructive === "require_approval" || policy.onToolDrift === "require_approval") {
@@ -6526,9 +7627,62 @@ function toMcpToolDef(tool) {
 function byteLength(value) {
   return Buffer.byteLength(canonicalize(value), "utf8");
 }
+function isSenderScopedKey(key) {
+  if (key.startsWith("sender:")) return true;
+  if (!key.startsWith("budget:")) return false;
+  const scope = key.slice("budget:".length);
+  const sep = scope.indexOf(":");
+  return sep !== -1 && scope.slice(sep + 1).startsWith("sender:");
+}
+function budgetWireBlock(entry, kind) {
+  return {
+    ...kind ? { kind } : {},
+    name: entry.budget.name,
+    limit: entry.budget.limit,
+    spent: entry.spent,
+    remaining: entry.remaining,
+    attempted_amount: entry.amount,
+    currency: entry.budget.currency,
+    window: entry.budget.windowRaw,
+    on_exceed: entry.budget.onExceed,
+    allowed: entry.allowed,
+    reset_at_ms: entry.resetAtMs,
+    ...entry.stale ? { stale: true } : {}
+  };
+}
+function budgetFailureBlock(failure) {
+  return {
+    name: failure.budget.name,
+    limit: failure.budget.limit,
+    spent: failure.spent,
+    remaining: failure.remaining,
+    attempted_amount: null,
+    currency: failure.budget.currency,
+    window: failure.budget.windowRaw,
+    on_exceed: failure.budget.onExceed,
+    allowed: false,
+    reason: "invalid_amount",
+    reset_at_ms: failure.resetAtMs
+  };
+}
+function planBytes(plans) {
+  let total = 0;
+  for (const plan of plans) {
+    total += byteLength(
+      plan.kind === "budget" ? {
+        kind: plan.kind,
+        name: plan.budget.name,
+        key: plan.bucketKey,
+        amount: plan.amount,
+        breached: plan.breached
+      } : { kind: plan.kind, key: plan.key, amount: plan.amount ?? 0 }
+    );
+  }
+  return total;
+}
 
 // src/approval/queue.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var ApprovalQueue = class {
   tickets = /* @__PURE__ */ new Map();
   now;
@@ -6558,7 +7712,7 @@ var ApprovalQueue = class {
     if (this.closed) throw new Error("ApprovalQueue is closed");
     const now = this.now();
     const ticket = {
-      id: randomUUID5(),
+      id: randomUUID6(),
       tool_name: params.tool_name,
       tool_input: params.tool_input,
       matched_rule: params.matched_rule,
@@ -6568,6 +7722,9 @@ var ApprovalQueue = class {
       requested_at: new Date(now).toISOString(),
       timeout_at: new Date(now + params.timeout_ms).toISOString(),
       timeout_ms: params.timeout_ms,
+      // Absent (not empty) on plain rule tickets: presence is the marker a
+      // future standing-approval store must exclude (issue #127).
+      ...params.breached_budgets?.length ? { breached_budgets: params.breached_budgets } : {},
       status: "pending",
       notification_failures: []
     };
@@ -6671,8 +7828,9 @@ var ApprovalRouter = class {
       return { status: "denied", resolvedBy: "system", reason: "Router is closed", ticketId: "" };
     }
     const rule = params.matched_rule;
-    const timeoutMs = rule?.approval?.timeoutMs ?? this.defaultTimeoutMs;
-    const channelName = rule?.approval?.channel ?? "dashboard";
+    const approvalConfig = params.approval ?? rule?.approval;
+    const timeoutMs = approvalConfig?.timeoutMs ?? this.defaultTimeoutMs;
+    const channelName = approvalConfig?.channel ?? "dashboard";
     const ticket = this.queue.add({
       tool_name: params.tool_name,
       tool_input: params.tool_input,
@@ -6680,7 +7838,8 @@ var ApprovalRouter = class {
       rule_index: rule?.index ?? null,
       channel_name: channelName,
       session_id: params.session_id,
-      timeout_ms: timeoutMs
+      timeout_ms: timeoutMs,
+      breached_budgets: params.breached_budgets
     });
     this.onSubmit?.(ticket);
     const outcome = await new Promise((resolve2) => {
@@ -6698,8 +7857,8 @@ var ApprovalRouter = class {
       }, timeoutMs);
       timer.unref();
       let escalationTimer;
-      const delegates = rule?.approval?.delegates;
-      const escalationAfterMs = rule?.approval?.escalationAfterMs;
+      const delegates = approvalConfig?.delegates;
+      const escalationAfterMs = approvalConfig?.escalationAfterMs;
       if (escalationAfterMs !== void 0 && escalationAfterMs > 0 && escalationAfterMs < timeoutMs) {
         escalationTimer = setTimeout(() => {
           if (!this.pending.has(ticket.id)) return;
@@ -6775,7 +7934,8 @@ var ApprovalRouter = class {
       rule_index: rule?.index ?? null,
       channel_name: `${NATIVE_CHANNEL_PREFIX}${params.origin}`,
       session_id: params.session_id,
-      timeout_ms: timeoutMs
+      timeout_ms: timeoutMs,
+      breached_budgets: params.breached_budgets
     });
     this.onSubmit?.(ticket);
     return ticket;
@@ -6953,6 +8113,7 @@ ${safeInput}
   if (ticket.session_id) {
     detailLines.push(`*Session:* \`${sanitizeCodeSpanContent(ticket.session_id)}\``);
   }
+  const budgetBlocks = buildBudgetBlocks(ticket);
   return [
     {
       type: "header",
@@ -6962,6 +8123,7 @@ ${safeInput}
       type: "section",
       text: { type: "mrkdwn", text: detailLines.join("\n") }
     },
+    ...budgetBlocks,
     {
       type: "context",
       elements: [
@@ -6988,8 +8150,56 @@ ${safeInput}
           action_id: `helio_deny:${ticket.id}`
         }
       ]
-    }
-  ];
+    }
+  ];
+}
+var MAX_SECTION_TEXT = 2900;
+var MAX_BUDGET_SECTIONS = 40;
+function buildBudgetBlocks(ticket) {
+  const breached = ticket.breached_budgets;
+  if (!breached?.length) return [];
+  const lines = breached.map(
+    (b) => `\u2022 \`${sanitizeCodeSpanContent(b.name)}\` \u2014 ${String(b.spent)}/${String(b.limit)} ${sanitizeMrkdwnText(b.currency)} spent, attempting +${String(b.attempted_amount)} (${sanitizeMrkdwnText(b.window)} window)`
+  );
+  const sections = [];
+  let current = "*Breached budgets (approval spends past the limit):*";
+  let pendingLines = 0;
+  let rendered = 0;
+  let capped = false;
+  for (const line of lines) {
+    if (current.length + 1 + line.length > MAX_SECTION_TEXT) {
+      sections.push(current);
+      if (sections.length >= MAX_BUDGET_SECTIONS) {
+        capped = true;
+        break;
+      }
+      current = line;
+      pendingLines = 1;
+    } else {
+      current = `${current}
+${line}`;
+      pendingLines += 1;
+    }
+    rendered += 1;
+  }
+  if (!capped && pendingLines > 0) sections.push(current);
+  const blocks = sections.map((text) => ({
+    type: "section",
+    text: { type: "mrkdwn", text }
+  }));
+  const omitted = lines.length - rendered;
+  if (omitted > 0) {
+    blocks.push({
+      type: "context",
+      elements: [
+        {
+          type: "mrkdwn",
+          text: `\u2026and ${String(omitted)} more breached budget${omitted === 1 ? "" : "s"} \u2014 the approval ticket carries the full list (approvals REST API / dashboard).`
+        }
+      ]
+    });
+  }
+  return blocks;
 }
 var SlackChannel = class {
   type = "slack";
@@ -7488,10 +8698,821 @@ function createApprovalApp(router, queue, options) {
   return app;
 }
 
+// src/budget/engine.ts
+function kindOf(meta, budgetName) {
+  return meta.kinds?.get(budgetName) ?? meta.kind;
+}
+function isBudgetPersistence(sink) {
+  const candidate = sink;
+  return typeof candidate.readMeta === "function" && typeof candidate.readAllMeta === "function" && typeof candidate.writeMeta === "function" && typeof candidate.writeMetaBatch === "function" && typeof candidate.maxEventEpoch === "function" && typeof candidate.replayDurationEvents === "function" && typeof candidate.replaySessionBuckets === "function" && typeof candidate.recordBucketGc === "function";
+}
+var NOOP_LEDGER = { commitAll: () => {
+} };
+var BudgetEngine = class {
+  budgets = /* @__PURE__ */ new Map();
+  /** budget name → bucket key → bucket. */
+  state = /* @__PURE__ */ new Map();
+  /** budget name → config generation; bumped whenever the pot resets. */
+  generations = /* @__PURE__ */ new Map();
+  now;
+  ledger;
+  /** The sink again, when it carries the full persistence contract. */
+  persistence;
+  onCommit;
+  onBreach;
+  timer = null;
+  closed = false;
+  hydrated = false;
+  constructor(options = {}) {
+    this.now = options.now ?? Date.now;
+    this.ledger = options.ledger ?? NOOP_LEDGER;
+    this.persistence = isBudgetPersistence(this.ledger) ? this.ledger : null;
+    this.onCommit = options.onCommit;
+    this.onBreach = options.onBreach;
+    for (const budget of options.budgets ?? []) {
+      this.budgets.set(budget.name, budget);
+      this.generations.set(budget.name, 1);
+    }
+    const intervalMs = options.cleanupIntervalMs ?? 6e4;
+    if (intervalMs > 0) {
+      this.timer = setInterval(() => {
+        this.gc();
+      }, intervalMs);
+      this.timer.unref();
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Gate operations
+  // -------------------------------------------------------------------------
+  /**
+   * Resolve which budgets a call feeds and how much it charges each.
+   *
+   * A budget participates when any contributor glob matches the tool name;
+   * the FIRST matching contributor (config order) supplies the amount field.
+   * A missing, non-numeric, negative, or non-finite amount fails closed as a
+   * `failures` entry — the caller must deny the call.
+   */
+  resolveCharges(ctx) {
+    const charges = [];
+    const failures = [];
+    for (const budget of this.budgets.values()) {
+      const contributor = budget.contributors.find((c) => c.tool.test(ctx.toolName));
+      if (!contributor) continue;
+      const raw = resolvePath(contributor.field, ctx.toolArguments ?? {});
+      if (typeof raw !== "number" || !Number.isFinite(raw) || raw < 0) {
+        const bucketKey = this.bucketKey(budget, ctx);
+        const nowMs = this.now();
+        const bucket = this.liveBucket(budget, bucketKey, nowMs);
+        const spent = bucket ? this.spentOf(budget, bucket, nowMs) : 0;
+        failures.push({
+          budget,
+          bucketKey,
+          reason: "invalid_amount",
+          spent,
+          remaining: Math.max(0, budget.limit - spent),
+          // null is reserved for session pots on the wire; an empty duration
+          // bucket resets one window from now.
+          resetAtMs: budget.window.kind === "duration" ? bucket && bucket.entries.length > 0 ? (bucket.entries[0]?.timestampMs ?? nowMs) + budget.window.windowMs : nowMs + budget.window.windowMs : null
+        });
+        continue;
+      }
+      charges.push({
+        budget,
+        bucketKey: this.bucketKey(budget, ctx),
+        amount: raw,
+        generation: this.generations.get(budget.name) ?? 0
+      });
+    }
+    return { charges, failures };
+  }
+  /** Check every charge without mutating. All-or-nothing: one deny flips `allowed`. */
+  peekAll(charges) {
+    const entries = charges.map((charge) => this.snapshot(charge));
+    return { allowed: entries.every((entry) => entry.allowed), entries };
+  }
+  /**
+   * Commit every charge of one call: ledger first (one atomic batch), then
+   * in-memory state, then the commit events. A sink throw propagates and
+   * leaves ALL in-memory buckets untouched — no partial commit, ever.
+   * Recording is unconditional past the sink (an approved overage
+   * legitimately pushes a bucket past its limit).
+   */
+  recordAll(charges, meta) {
+    const nowMs = this.now();
+    const current = [];
+    const stale = [];
+    for (const charge of charges) {
+      if (this.generations.get(charge.budget.name) === charge.generation) {
+        current.push(charge);
+      } else {
+        stale.push(charge);
+        console.error(
+          `[helio] Budget "${charge.budget.name}": an in-flight charge outlived a config change; its amount is ledgered under the old generation but does not count against the current pot`
+        );
+      }
+    }
+    this.ledger.commitAll(
+      charges.map((charge) => ({
+        budget_name: charge.budget.name,
+        bucket_key: charge.bucketKey,
+        kind: kindOf(meta, charge.budget.name),
+        amount: charge.amount,
+        currency: charge.budget.currency,
+        tool_name: meta.toolName,
+        origin: meta.origin,
+        audit_record_id: meta.auditRecordId,
+        timestamp: meta.timestampIso,
+        timestamp_ms: nowMs,
+        generation: charge.generation
+      }))
+    );
+    const snapshots = [];
+    for (const charge of current) {
+      const bucket = this.bucketFor(charge.budget.name, charge.bucketKey);
+      if (charge.budget.window.kind === "duration") {
+        this.evictExpired(bucket, charge.budget.window.windowMs, nowMs);
+        bucket.entries.push({ timestampMs: nowMs, amount: charge.amount });
+      } else {
+        bucket.total += charge.amount;
+      }
+      bucket.lastActivityMs = nowMs;
+      snapshots.push(this.snapshot(charge, { postRecord: true }));
+    }
+    for (const charge of stale) {
+      const liveBudget = this.budgets.get(charge.budget.name) ?? charge.budget;
+      snapshots.push({ ...this.snapshot({ ...charge, budget: liveBudget }), stale: true });
+    }
+    for (let i = 0; i < current.length; i++) {
+      const charge = current[i];
+      const snapshot = snapshots[i];
+      if (!charge || !snapshot || !this.onCommit) continue;
+      try {
+        this.onCommit({
+          name: charge.budget.name,
+          bucket_key: charge.bucketKey,
+          kind: kindOf(meta, charge.budget.name),
+          amount: charge.amount,
+          spent: snapshot.spent,
+          remaining: snapshot.remaining,
+          limit: charge.budget.limit,
+          currency: charge.budget.currency,
+          utilization: snapshot.spent / charge.budget.limit
+        });
+      } catch (err) {
+        console.error("[helio] budget onCommit subscriber threw:", err);
+      }
+    }
+    return snapshots;
+  }
+  /**
+   * Fire one `onBreach` event per breached entry. Called by the doors at the
+   * moment a peek outcome actually denies the call or raises the composite
+   * break-glass ticket (never for dry-run peeks, never for invalid-amount
+   * failures — those are input errors, not breaches). Subscriber throws are
+   * isolated: a dashboard bug must never affect a gate outcome.
+   */
+  reportBreaches(entries) {
+    if (!this.onBreach) return;
+    for (const entry of entries) {
+      try {
+        this.onBreach({
+          name: entry.budget.name,
+          bucket_key: entry.bucketKey,
+          on_exceed: entry.budget.onExceed,
+          attempted_amount: entry.amount,
+          spent: entry.spent,
+          limit: entry.budget.limit,
+          currency: entry.budget.currency
+        });
+      } catch (err) {
+        console.error("[helio] budget onBreach subscriber threw:", err);
+      }
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Lifecycle
+  // -------------------------------------------------------------------------
+  /**
+   * Rebuild in-memory state from the ledger. Call once at startup, after
+   * construction and before serving traffic; a no-op when the configured
+   * sink does not carry the persistence contract (in-memory mode).
+   *
+   * Per configured budget, `budget_meta` decides:
+   * - no row → first boot for this name: mint epoch 1, nothing to replay;
+   * - a different `{limit, currency, window, key}` tuple → the config
+   *   changed while down: bump the epoch, replay nothing (the same reset a
+   *   live tuple-changing reload performs, extended across restarts). Old
+   *   rows keep their epoch — history stays queryable, replay ignores it;
+   * - a matching tuple → replay at the meta epoch: duration windows rebuild
+   *   entry lists from a window lookback (bit-equivalent to never having
+   *   restarted), session windows rebuild still-live pots (idle-TTL bound)
+   *   from their post-GC-watermark lifetime sums.
+   *
+   * Meta writes here propagate failures: a ledger that cannot record epochs
+   * at startup must fail the boot loudly, the same posture as the audit
+   * store's schema assertion.
+   */
+  hydrate() {
+    if (!this.persistence) return;
+    if (this.hydrated) return;
+    this.hydrated = true;
+    const nowMs = this.now();
+    const metaByName = new Map(
+      this.persistence.readAllMeta().map((meta) => [meta.budget_name, meta])
+    );
+    for (const budget of this.budgets.values()) {
+      const meta = metaByName.get(budget.name);
+      if (!meta) {
+        const epoch = this.persistence.maxEventEpoch(budget.name) + 1;
+        this.persistence.writeMeta(metaOf(budget, epoch));
+        this.generations.set(budget.name, epoch);
+        continue;
+      }
+      if (metaTupleChanged(meta, budget)) {
+        const epoch = Math.max(meta.epoch, this.persistence.maxEventEpoch(budget.name)) + 1;
+        this.persistence.writeMeta(metaOf(budget, epoch));
+        this.generations.set(budget.name, epoch);
+        continue;
+      }
+      this.generations.set(budget.name, meta.epoch);
+      if (budget.window.kind === "duration") {
+        const events = this.persistence.replayDurationEvents(
+          budget.name,
+          meta.epoch,
+          nowMs - budget.window.windowMs
+        );
+        for (const event of events) {
+          const bucket = this.bucketFor(budget.name, event.bucket_key);
+          bucket.entries.push({ timestampMs: event.timestamp_ms, amount: event.amount });
+          bucket.lastActivityMs = event.timestamp_ms;
+        }
+      } else {
+        const liveAfterMs = nowMs - budget.window.idleTtlMs;
+        for (const row of this.persistence.replaySessionBuckets(budget.name, meta.epoch)) {
+          if (row.last_activity_ms >= liveAfterMs) {
+            const bucket = this.bucketFor(budget.name, row.bucket_key);
+            bucket.total = row.total;
+            bucket.lastActivityMs = row.last_activity_ms;
+          } else if (row.total > 0) {
+            this.persistence.recordBucketGc(budget.name, row.bucket_key, nowMs);
+          }
+        }
+      }
+    }
+    for (const [name, meta] of metaByName) {
+      if (this.budgets.has(name)) continue;
+      const maxEventEpoch = this.persistence.maxEventEpoch(name);
+      if (maxEventEpoch < meta.epoch) continue;
+      this.persistence.writeMeta({ ...meta, epoch: Math.max(meta.epoch, maxEventEpoch) + 1 });
+    }
+  }
+  /**
+   * Swap budget configs on hot-reload. Identity is the NAME: removed names
+   * drop their live buckets; a changed `{limit, currency, window, key}` tuple
+   * resets the budget's buckets (a different pool or scope structure);
+   * everything else — contributors, on_exceed — applies to the accrued state
+   * as-is, because those edits do not change what was already spent.
+   *
+   * Persist-before-swap: every epoch this reload mints lands in
+   * `budget_meta` in ONE transaction BEFORE any memory changes. A throw
+   * rejects the whole reload — the caller keeps the previous config — so
+   * disk and memory can never diverge; a failed reload simply never
+   * happened, and no later restart can misread it. (A swallow-and-continue
+   * posture here would let an A→B reload with a failed flush resurrect the
+   * retired A pot after a revert-and-restart.)
+   *
+   * Removed names mint too: an in-flight charge frozen before the removal
+   * must go stale, or its commit would recreate hidden bucket state for a
+   * budget that no longer exists — and without the on-disk tombstone, a
+   * restart with the budget back in the config would resurrect the
+   * pre-removal pot that the removal had reset. Generations for removed
+   * names are kept (not deleted) so a later re-add keeps counting up.
+   *
+   * @throws When the epoch flush fails; the engine is unchanged.
+   */
+  reconcile(next) {
+    const nextByName = new Map(next.map((budget) => [budget.name, budget]));
+    const mints = [];
+    for (const [name, budget] of nextByName) {
+      const current = this.budgets.get(name);
+      if (!current || tupleChanged(current, budget)) {
+        mints.push({ name, tuple: budget, epoch: this.nextEpoch(name) });
+      }
+    }
+    for (const [name, removed] of this.budgets) {
+      if (nextByName.has(name)) continue;
+      mints.push({ name, tuple: removed, epoch: this.nextEpoch(name) });
+    }
+    if (this.persistence && mints.length > 0) {
+      this.persistence.writeMetaBatch(mints.map((mint) => metaOf(mint.tuple, mint.epoch)));
+    }
+    for (const mint of mints) {
+      this.state.delete(mint.name);
+      this.generations.set(mint.name, mint.epoch);
+    }
+    this.budgets = nextByName;
+  }
+  /** Sweep: collect idle session pots, evict expired duration entries. */
+  gc() {
+    const nowMs = this.now();
+    for (const [name, buckets] of this.state) {
+      const budget = this.budgets.get(name);
+      if (!budget) {
+        this.state.delete(name);
+        continue;
+      }
+      for (const [key, bucket] of buckets) {
+        if (budget.window.kind === "session") {
+          if (nowMs - bucket.lastActivityMs > budget.window.idleTtlMs) {
+            if (this.persistence) {
+              try {
+                this.persistence.recordBucketGc(name, key, nowMs);
+              } catch (err) {
+                console.error(
+                  `[helio] Budget "${name}": failed to record the GC watermark for "${key}"; keeping the idle pot until the next sweep:`,
+                  err
+                );
+                continue;
+              }
+            }
+            buckets.delete(key);
+          }
+        } else {
+          this.evictExpired(bucket, budget.window.windowMs, nowMs);
+          if (bucket.entries.length === 0) buckets.delete(key);
+        }
+      }
+      if (buckets.size === 0) this.state.delete(name);
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Read surface
+  // -------------------------------------------------------------------------
+  /**
+   * Wire-ready state for `GET /api/budgets`. Configured budgets appear even
+   * with zero live buckets, so the dashboard shows every pot at headroom.
+   */
+  listStates() {
+    const nowMs = this.now();
+    return [...this.budgets.values()].map((budget) => {
+      const buckets = [];
+      for (const key of [...this.state.get(budget.name)?.keys() ?? []]) {
+        const bucket = this.liveBucket(budget, key, nowMs);
+        if (!bucket) continue;
+        const spent = this.spentOf(budget, bucket, nowMs);
+        buckets.push({
+          bucket_key: key,
+          spent,
+          remaining: Math.max(0, budget.limit - spent),
+          reset_at_ms: budget.window.kind === "duration" ? (bucket.entries[0]?.timestampMs ?? nowMs) + budget.window.windowMs : null,
+          last_activity_ms: bucket.lastActivityMs
+        });
+      }
+      return {
+        name: budget.name,
+        limit: budget.limit,
+        currency: budget.currency,
+        window: budget.windowRaw,
+        key: budget.key,
+        on_exceed: budget.onExceed,
+        buckets
+      };
+    });
+  }
+  /** Whether any budget holds a live bucket under `key` (cardinality probes). */
+  hasBucket(key) {
+    const nowMs = this.now();
+    for (const name of [...this.state.keys()]) {
+      const budget = this.budgets.get(name);
+      if (!budget) continue;
+      if (this.liveBucket(budget, key, nowMs)) return true;
+    }
+    return false;
+  }
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+    this.state.clear();
+  }
+  // -------------------------------------------------------------------------
+  // Internals
+  // -------------------------------------------------------------------------
+  /**
+   * The next epoch for a name: one past the highest that memory, the meta
+   * row, or the rows themselves have seen. Pure — the caller applies it to
+   * `generations` only after the mint is durable. The meta consult matters
+   * for names this process has no memory of (a hot-reload re-add after a
+   * restart); the rows consult is a backstop against historical divergence
+   * (rows at an epoch no meta row records) — minting from memory or meta
+   * alone could collide into an epoch that already has rows and replay them
+   * into a different pot.
+   */
+  nextEpoch(name) {
+    const memory = this.generations.get(name) ?? 0;
+    const disk = this.persistence ? Math.max(this.persistence.readMeta(name)?.epoch ?? 0, this.persistence.maxEventEpoch(name)) : 0;
+    return Math.max(memory, disk) + 1;
+  }
+  /**
+   * The key format is part of the ON-DISK contract: hydrate rebuilds buckets
+   * from `budget_events.bucket_key` verbatim, so renaming any segment here
+   * would strand every persisted bucket of an unchanged tuple as an
+   * unreachable ghost (displayed, never charged). Changing the format
+   * requires folding a format version into the epoch decision.
+   */
+  bucketKey(budget, ctx) {
+    switch (budget.key) {
+      case "session":
+        return `budget:${budget.name}:session:${ctx.sessionId ?? "unknown"}`;
+      case "sender_id":
+        return `budget:${budget.name}:sender:${ctx.senderId ?? "unknown"}`;
+      case "global":
+        return `budget:${budget.name}:global`;
+    }
+  }
+  bucketFor(name, key) {
+    let buckets = this.state.get(name);
+    if (!buckets) {
+      buckets = /* @__PURE__ */ new Map();
+      this.state.set(name, buckets);
+    }
+    let bucket = buckets.get(key);
+    if (!bucket) {
+      bucket = { entries: [], total: 0, lastActivityMs: this.now() };
+      buckets.set(key, bucket);
+    }
+    return bucket;
+  }
+  evictExpired(bucket, windowMs, nowMs) {
+    const windowStart = nowMs - windowMs;
+    bucket.entries = bucket.entries.filter((entry) => entry.timestampMs > windowStart);
+  }
+  /**
+   * Fetch a bucket for reading, evicting expired duration entries first and
+   * pruning the bucket if nothing is left. Reads must never see (or keep
+   * alive, via `hasBucket`-driven capacity slots) state the window has
+   * already expired — expiry is lazy on read, not just on the sweep timer.
+   */
+  liveBucket(budget, key, nowMs) {
+    const buckets = this.state.get(budget.name);
+    const bucket = buckets?.get(key);
+    if (!bucket || !buckets) return void 0;
+    if (budget.window.kind === "duration") {
+      this.evictExpired(bucket, budget.window.windowMs, nowMs);
+      if (bucket.entries.length === 0) {
+        buckets.delete(key);
+        if (buckets.size === 0) this.state.delete(budget.name);
+        return void 0;
+      }
+    }
+    return bucket;
+  }
+  spentOf(budget, bucket, nowMs) {
+    if (budget.window.kind === "session") return bucket.total;
+    const windowStart = nowMs - budget.window.windowMs;
+    return bucket.entries.reduce(
+      (sum, entry) => entry.timestampMs > windowStart ? sum + entry.amount : sum,
+      0
+    );
+  }
+  snapshot(charge, options = {}) {
+    const nowMs = this.now();
+    const bucket = this.liveBucket(charge.budget, charge.bucketKey, nowMs);
+    const accrued = bucket ? this.spentOf(charge.budget, bucket, nowMs) : 0;
+    const spent = accrued;
+    const checkedAgainst = options.postRecord ? accrued - charge.amount : accrued;
+    const resetAtMs = charge.budget.window.kind === "duration" ? bucket && bucket.entries.length > 0 ? (bucket.entries[0]?.timestampMs ?? nowMs) + charge.budget.window.windowMs : nowMs + charge.budget.window.windowMs : null;
+    return {
+      budget: charge.budget,
+      bucketKey: charge.bucketKey,
+      amount: charge.amount,
+      allowed: checkedAgainst + charge.amount <= charge.budget.limit,
+      spent,
+      remaining: Math.max(0, charge.budget.limit - spent),
+      resetAtMs
+    };
+  }
+};
+function metaOf(budget, epoch) {
+  return {
+    budget_name: budget.name,
+    limit_amount: budget.limit,
+    currency: budget.currency,
+    window: budget.windowRaw,
+    key: budget.key,
+    epoch
+  };
+}
+function metaTupleChanged(meta, budget) {
+  return meta.limit_amount !== budget.limit || meta.currency !== budget.currency || meta.window !== budget.windowRaw || meta.key !== budget.key;
+}
+function tupleChanged(a, b) {
+  return a.limit !== b.limit || a.currency !== b.currency || a.windowRaw !== b.windowRaw || a.key !== b.key;
+}
+
+// src/budget/ledger.ts
+import Database2 from "better-sqlite3";
+import { randomUUID as randomUUID7 } from "crypto";
+var CREATE_TABLES_DDL = `
+CREATE TABLE IF NOT EXISTS budget_meta (
+  budget_name  TEXT PRIMARY KEY,
+  limit_amount REAL NOT NULL,
+  currency     TEXT NOT NULL,
+  window       TEXT NOT NULL,
+  key          TEXT NOT NULL,
+  epoch        INTEGER NOT NULL,
+  updated_at   TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS budget_events (
+  id              TEXT PRIMARY KEY,
+  budget_name     TEXT NOT NULL,
+  epoch           INTEGER NOT NULL,
+  bucket_key      TEXT NOT NULL,
+  kind            TEXT NOT NULL,
+  amount          REAL NOT NULL,
+  currency        TEXT NOT NULL,
+  tool_name       TEXT NOT NULL,
+  origin          TEXT NOT NULL,
+  audit_record_id TEXT,
+  timestamp       TEXT NOT NULL,
+  timestamp_ms    INTEGER NOT NULL,
+  created_at      TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS budget_bucket_gc (
+  budget_name  TEXT NOT NULL,
+  bucket_key   TEXT NOT NULL,
+  gc_after_ms  INTEGER NOT NULL,
+  PRIMARY KEY (budget_name, bucket_key)
+);
+`;
+var CREATE_INDEX_DDL2 = `
+CREATE INDEX IF NOT EXISTS idx_budget_events_replay
+  ON budget_events (budget_name, epoch, bucket_key, timestamp_ms);
+CREATE INDEX IF NOT EXISTS idx_budget_events_timestamp_ms
+  ON budget_events (timestamp_ms);
+`;
+var BUDGET_TABLES = ["budget_meta", "budget_events", "budget_bucket_gc"];
+var INSERT_EVENT_SQL = `
+INSERT INTO budget_events (
+  id, budget_name, epoch, bucket_key, kind, amount, currency,
+  tool_name, origin, audit_record_id, timestamp, timestamp_ms, created_at
+) VALUES (
+  @id, @budget_name, @epoch, @bucket_key, @kind, @amount, @currency,
+  @tool_name, @origin, @audit_record_id, @timestamp, @timestamp_ms, @created_at
+)
+`;
+var UPSERT_META_SQL = `
+INSERT INTO budget_meta (budget_name, limit_amount, currency, window, key, epoch, updated_at)
+VALUES (@budget_name, @limit_amount, @currency, @window, @key, @epoch, @updated_at)
+ON CONFLICT (budget_name) DO UPDATE SET
+  limit_amount = excluded.limit_amount,
+  currency     = excluded.currency,
+  window       = excluded.window,
+  key          = excluded.key,
+  epoch        = excluded.epoch,
+  updated_at   = excluded.updated_at
+`;
+var UPSERT_GC_SQL = `
+INSERT INTO budget_bucket_gc (budget_name, bucket_key, gc_after_ms)
+VALUES (@budget_name, @bucket_key, @gc_after_ms)
+ON CONFLICT (budget_name, bucket_key) DO UPDATE SET
+  gc_after_ms = excluded.gc_after_ms
+`;
+var REPLAY_DURATION_SQL = `
+SELECT bucket_key, amount, timestamp_ms
+FROM budget_events
+WHERE budget_name = ? AND epoch = ? AND timestamp_ms > ?
+ORDER BY timestamp_ms ASC, rowid ASC
+`;
+var REPLAY_SESSION_SQL = `
+SELECT e.bucket_key AS bucket_key,
+       SUM(CASE WHEN e.timestamp_ms >= COALESCE(g.gc_after_ms, 0) THEN e.amount ELSE 0 END) AS total,
+       MAX(e.timestamp_ms) AS last_activity_ms
+FROM budget_events e
+LEFT JOIN budget_bucket_gc g
+  ON g.budget_name = e.budget_name AND g.bucket_key = e.bucket_key
+WHERE e.budget_name = ? AND e.epoch = ?
+GROUP BY e.bucket_key
+ORDER BY e.bucket_key ASC
+`;
+var LIST_EVENTS_SQL = `
+SELECT id, budget_name, bucket_key, kind, amount, currency, tool_name,
+       origin, audit_record_id, timestamp, timestamp_ms, created_at
+FROM budget_events
+WHERE budget_name = ?
+ORDER BY timestamp_ms DESC, rowid DESC
+LIMIT ? OFFSET ?
+`;
+var COUNT_EVENTS_SQL = "SELECT COUNT(*) AS total FROM budget_events WHERE budget_name = ?";
+var LIST_EVENTS_DEFAULT_LIMIT = 50;
+function describeColumn(column) {
+  return `"${column.type}${column.notnull ? " NOT NULL" : ""}${column.pk ? " PRIMARY KEY" : ""}"`;
+}
+var BudgetLedger = class {
+  db;
+  now;
+  insertEventStmt;
+  upsertMetaStmt;
+  upsertGcStmt;
+  readMetaStmt;
+  readAllMetaStmt;
+  maxEventEpochStmt;
+  replayDurationStmt;
+  replaySessionStmt;
+  listEventsStmt;
+  countEventsStmt;
+  commitTxn;
+  writeMetaTxn;
+  purgeTxn;
+  constructor(options) {
+    this.db = options.database;
+    this.now = options.now ?? Date.now;
+    this.db.exec(CREATE_TABLES_DDL);
+    this.assertRequiredSchema();
+    this.db.exec(CREATE_INDEX_DDL2);
+    this.insertEventStmt = this.db.prepare(INSERT_EVENT_SQL);
+    this.upsertMetaStmt = this.db.prepare(UPSERT_META_SQL);
+    this.upsertGcStmt = this.db.prepare(UPSERT_GC_SQL);
+    this.readMetaStmt = this.db.prepare(
+      "SELECT budget_name, limit_amount, currency, window, key, epoch FROM budget_meta WHERE budget_name = ?"
+    );
+    this.readAllMetaStmt = this.db.prepare(
+      "SELECT budget_name, limit_amount, currency, window, key, epoch FROM budget_meta"
+    );
+    this.maxEventEpochStmt = this.db.prepare(
+      "SELECT COALESCE(MAX(epoch), 0) AS epoch FROM budget_events WHERE budget_name = ?"
+    );
+    this.replayDurationStmt = this.db.prepare(REPLAY_DURATION_SQL);
+    this.replaySessionStmt = this.db.prepare(REPLAY_SESSION_SQL);
+    this.listEventsStmt = this.db.prepare(LIST_EVENTS_SQL);
+    this.countEventsStmt = this.db.prepare(COUNT_EVENTS_SQL);
+    const purgeEventsStmt = this.db.prepare("DELETE FROM budget_events WHERE timestamp_ms < ?");
+    const purgeGcStmt = this.db.prepare("DELETE FROM budget_bucket_gc WHERE gc_after_ms < ?");
+    this.purgeTxn = this.db.transaction((cutoffMs) => ({
+      events: purgeEventsStmt.run(cutoffMs).changes,
+      watermarks: purgeGcStmt.run(cutoffMs).changes
+    }));
+    this.writeMetaTxn = this.db.transaction((metas) => {
+      for (const meta of metas) this.writeMeta(meta);
+    });
+    this.commitTxn = this.db.transaction((rows) => {
+      const createdAt = new Date(this.now()).toISOString();
+      for (const row of rows) {
+        this.insertEventStmt.run({
+          id: randomUUID7(),
+          budget_name: row.budget_name,
+          epoch: row.generation,
+          bucket_key: row.bucket_key,
+          kind: row.kind,
+          amount: row.amount,
+          currency: row.currency,
+          tool_name: row.tool_name,
+          origin: row.origin,
+          audit_record_id: row.audit_record_id,
+          timestamp: row.timestamp,
+          timestamp_ms: row.timestamp_ms,
+          created_at: createdAt
+        });
+      }
+    });
+  }
+  /**
+   * Validate the on-disk budget schema against the canonical DDL — column
+   * NAMES, declared TYPES, NOT NULL constraints, and PRIMARY KEYS — with the
+   * same clean-break recovery contract as the audit table (store.ts):
+   * pre-1.0 local databases are deleted, not migrated. Types matter beyond
+   * presence: a `timestamp_ms` with TEXT affinity would make every replay
+   * and retention comparison lexicographic ('900' > '1000'), silently
+   * resurrecting expired spend. The canonical shape is derived by executing
+   * the DDL itself in a scratch database, so the assertion cannot drift
+   * from what the DDL creates. Extra columns in the live table are
+   * tolerated (forward compatibility, matching the audit store's posture).
+   */
+  assertRequiredSchema() {
+    const canonical = new Database2(":memory:");
+    let mismatches;
+    try {
+      canonical.exec(CREATE_TABLES_DDL);
+      mismatches = [];
+      for (const table of BUDGET_TABLES) {
+        const expected = canonical.pragma(`table_info(${table})`);
+        const live = new Map(
+          this.db.pragma(`table_info(${table})`).map((col) => [col.name, col])
+        );
+        for (const column of expected) {
+          const actual = live.get(column.name);
+          if (!actual) {
+            mismatches.push(`${table}.${column.name} (missing)`);
+            continue;
+          }
+          if (actual.type !== column.type || actual.notnull !== column.notnull || actual.pk !== column.pk) {
+            mismatches.push(
+              `${table}.${column.name} (found ${describeColumn(actual)}, expected ${describeColumn(column)})`
+            );
+          }
+        }
+      }
+    } finally {
+      canonical.close();
+    }
+    if (mismatches.length === 0) return;
+    const dbPath = this.db.name;
+    throw new Error(
+      `[helio] Budget ledger schema mismatch: incompatible columns ${mismatches.join(", ")}. This local database was created by an older Helio build. Delete "${dbPath}", "${dbPath}-wal", and "${dbPath}-shm", then restart Helio.`
+    );
+  }
+  // -------------------------------------------------------------------------
+  // BudgetPersistence
+  // -------------------------------------------------------------------------
+  /** Persist every row of one call in a single transaction (all or nothing). */
+  commitAll(rows) {
+    this.commitTxn(rows);
+  }
+  readMeta(budgetName) {
+    return this.readMetaStmt.get(budgetName);
+  }
+  readAllMeta() {
+    return this.readAllMetaStmt.all();
+  }
+  maxEventEpoch(budgetName) {
+    const { epoch } = this.maxEventEpochStmt.get(budgetName);
+    return epoch;
+  }
+  writeMeta(meta) {
+    this.upsertMetaStmt.run({
+      budget_name: meta.budget_name,
+      limit_amount: meta.limit_amount,
+      currency: meta.currency,
+      window: meta.window,
+      key: meta.key,
+      epoch: meta.epoch,
+      updated_at: new Date(this.now()).toISOString()
+    });
+  }
+  /** All of one reload's epoch mints in a single transaction (all or nothing). */
+  writeMetaBatch(metas) {
+    this.writeMetaTxn(metas);
+  }
+  replayDurationEvents(budgetName, epoch, sinceMs) {
+    return this.replayDurationStmt.all(budgetName, epoch, sinceMs);
+  }
+  replaySessionBuckets(budgetName, epoch) {
+    return this.replaySessionStmt.all(budgetName, epoch);
+  }
+  recordBucketGc(budgetName, bucketKey, gcAfterMs) {
+    this.upsertGcStmt.run({
+      budget_name: budgetName,
+      bucket_key: bucketKey,
+      gc_after_ms: gcAfterMs
+    });
+  }
+  // -------------------------------------------------------------------------
+  // Dashboard read surface
+  // -------------------------------------------------------------------------
+  /**
+   * One page of a budget's spend history for the dashboard, newest first.
+   * `limit` defaults to 50 and clamps to `LIST_MAX_PAGE_SIZE`; `offset`
+   * floors at 0. An unknown budget name simply lists nothing (names are
+   * config, not secrets — no 404 semantics on hot-reload races).
+   */
+  listEvents(budgetName, page) {
+    const limit = Math.min(
+      Math.max(Math.trunc(page.limit ?? LIST_EVENTS_DEFAULT_LIMIT), 1),
+      LIST_MAX_PAGE_SIZE
+    );
+    const offset = Math.max(Math.trunc(page.offset ?? 0), 0);
+    const events = this.listEventsStmt.all(budgetName, limit, offset);
+    const { total } = this.countEventsStmt.get(budgetName);
+    return { events, total };
+  }
+  // -------------------------------------------------------------------------
+  // Retention
+  // -------------------------------------------------------------------------
+  /**
+   * Purge events past the retention cutoff (event-time milliseconds — the
+   * same axis every replay query filters on, so the retention bound and the
+   * replay bound cannot diverge). Watermarks older than the cutoff prune
+   * with the same statement's cutoff: every row such a watermark could
+   * filter has `timestamp_ms <= gc_after_ms < cutoffMs` and is deleted here
+   * too, so the watermark guards nothing and is safe to drop.
+   *
+   * Called from the audit store's retention sweep (one sweep schedule); the
+   * cutoff is computed once per sweep by the store.
+   */
+  purgeExpired(cutoffMs) {
+    return this.purgeTxn(cutoffMs);
+  }
+};
+
 // src/dashboard/api.ts
 import { readFileSync } from "fs";
 import { join } from "path";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 import { Hono as Hono8 } from "hono";
 import { HTTPException as HTTPException2 } from "hono/http-exception";
 import { z as z8 } from "zod";
@@ -7710,6 +9731,10 @@ var auditQuerySchema = z8.object({
   channel_id: optionalQueryString,
   sender_id: optionalQueryString
 });
+var budgetEventsQuerySchema = z8.object({
+  limit: clampedQueryInt(50, 1, LIST_MAX_PAGE_SIZE),
+  offset: clampedQueryInt(0, 0, Number.MAX_SAFE_INTEGER)
+});
 var analyticsQuerySchema = z8.object({
   from: optionalQueryString,
   to: optionalQueryString
@@ -7782,7 +9807,8 @@ function createDashboardAppWithLifecycle(deps, options) {
     spendLimiter,
     evidenceStore,
     eventBus,
-    adapterLiveness
+    adapterLiveness,
+    budgets
   } = deps;
   const apiSecret = options?.apiSecret;
   const sessionStore = apiSecret ? new DashboardSessionStore({ secret: apiSecret, ttlMs: SESSION_TTL_MS }) : void 0;
@@ -8004,6 +10030,22 @@ function createDashboardAppWithLifecycle(deps, options) {
   app.get("/api/adapters", (c) => {
     return c.json({ adapters: adapterLiveness?.listAdapters() ?? [] });
   });
+  app.get("/api/budgets", (c) => {
+    return c.json({ budgets: budgets?.listStates() ?? [] });
+  });
+  app.get("/api/budgets/:name/events", (c) => {
+    const query = budgetEventsQuerySchema.parse(c.req.query());
+    const page = budgets?.listEvents(c.req.param("name"), {
+      limit: query.limit,
+      offset: query.offset
+    }) ?? { events: [], total: 0 };
+    return c.json({
+      data: page.events,
+      total: page.total,
+      limit: query.limit,
+      offset: query.offset
+    });
+  });
   app.get("/api/analytics", (c) => {
     const query = analyticsQuerySchema.parse(c.req.query());
     const now = /* @__PURE__ */ new Date();
@@ -8045,7 +10087,7 @@ function createDashboardAppWithLifecycle(deps, options) {
   app.get("/api/events", (c) => {
     return streamSSE(c, async (stream) => {
       if (closed) return;
-      const connId = randomUUID6();
+      const connId = randomUUID8();
       let streamClosed = false;
       let stopHeartbeat = () => {
       };
@@ -8074,7 +10116,7 @@ function createDashboardAppWithLifecycle(deps, options) {
         void stream.writeSSE({
           event: eventType,
           data: JSON.stringify(data),
-          id: randomUUID6()
+          id: randomUUID8()
         }).then(() => {
           const conn = activeConnections.get(connId);
           if (conn) conn.lastWrite = Date.now();
@@ -8120,7 +10162,9 @@ var EVENT_TYPES = [
   "approval_requested",
   "approval_resolved",
   "limit_warning",
-  "approval_notification_failed"
+  "approval_notification_failed",
+  "budget_update",
+  "budget_breached"
 ];
 var DashboardEventBus = class {
   emitter = new EventEmitter();
@@ -8169,6 +10213,20 @@ var DashboardEventBus = class {
 function isLoopbackHost2(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "::1";
 }
+function warnIfBudgetWindowExceedsRetention(config, log = console.error) {
+  const retentionMs = parseDuration(config.audit.retention);
+  let warned = false;
+  for (const budget of config.budgets) {
+    const horizonMs = budget.window === "session" ? parseDuration(budget.idle_ttl ?? "24h") : parseDuration(budget.window);
+    const horizonLabel = budget.window === "session" ? `idle_ttl ${budget.idle_ttl ?? "24h"}` : `window ${budget.window}`;
+    if (horizonMs <= retentionMs) continue;
+    log(
+      `[helio] Warning: budget "${budget.name}" has ${horizonLabel}, longer than audit.retention ${config.audit.retention}. The spend ledger is purged on the retention sweep, so a restart can forget in-window spend and re-open the pot. Raise audit.retention or shorten the budget window.`
+    );
+    warned = true;
+  }
+  return warned;
+}
 function warnIfWebhookChannelUnreachable(config, log = console.error) {
   const hasWebhookChannel = config.approval.channels.some((ch) => ch.type === "webhook");
   const localOnlyDashboard = config.dashboard.enabled && isLoopbackHost2(config.dashboard.host);
@@ -8202,6 +10260,26 @@ function warnIfNoEnforcement(policy, log = console.error) {
   return true;
 }
 
+// src/shutdown.ts
+async function closeResources(resources) {
+  resources.annotationPrime?.stop();
+  resources.configWatcher?.close();
+  resources.approvalRouter?.close();
+  resources.approvalQueue?.close();
+  resources.closeDashboardApp?.();
+  resources.eventBus?.close();
+  if (resources.dashboardHandle) await resources.dashboardHandle.close();
+  if (resources.sidebandHandle) await resources.sidebandHandle.close();
+  await resources.handle.close();
+  resources.governanceService?.close();
+  resources.rateLimiter?.close();
+  resources.spendLimiter?.close();
+  resources.budgetEngine?.close();
+  resources.evidenceStore?.close();
+  resources.auditWriter?.close();
+  if (resources.closeForwarder) await resources.closeForwarder();
+}
+
 // src/crash-drain.ts
 var hooks = [];
 var draining = false;
@@ -8427,12 +10505,18 @@ async function startCommand(configPath, options) {
     const label = w.ruleName ? `rule "${w.ruleName}"` : `rule ${String(w.ruleIndex)}`;
     console.error(`Warning: policy ${label}: ${w.message}`);
   }
+  const budgets = compileBudgets(config.budgets);
   const eventBus = new DashboardEventBus();
   const auditStore = new AuditStore({
     path: config.audit.path,
     retention: config.audit.retention,
     includeResponses: config.audit.include_responses
   });
+  const budgetLedger = new BudgetLedger({ database: auditStore.database });
+  auditStore.onRetentionSweep((cutoff) => {
+    budgetLedger.purgeExpired(cutoff.ms);
+  });
+  auditStore.runRetentionSweep();
   const auditWriter = new AuditWriter({
     store: auditStore,
     onPersist: (record, id) => {
@@ -8468,6 +10552,7 @@ async function startCommand(configPath, options) {
   const evidenceStore = new EvidenceStore();
   const approvalQueue = new ApprovalQueue();
   const channels = createChannels(config.approval.channels);
+  const runtimeChannelTypes = new Map([...channels].map(([key, ch]) => [key, ch.type]));
   const approvalRouter = new ApprovalRouter({
     defaultTimeoutMs: parseDuration(config.approval.timeout),
     defaultOnTimeout: config.approval.default_on_timeout,
@@ -8515,13 +10600,25 @@ async function startCommand(configPath, options) {
       });
     }
   });
+  const budgetEngine = new BudgetEngine({
+    budgets,
+    ledger: budgetLedger,
+    onCommit: (event) => {
+      eventBus.emit("budget_update", event);
+    },
+    onBreach: (event) => {
+      eventBus.emit("budget_breached", event);
+    }
+  });
+  budgetEngine.hydrate();
   const governedForwarder = new GovernedForwarder(forwarder, policy, {
     environment: config.environment,
     auditWriter,
     evidenceStore,
     approvalRouter,
     rateLimiter,
-    spendLimiter
+    spendLimiter,
+    budgetEngine
   });
   const annotationPrime = await startAnnotationPrimeLoop(governedForwarder);
   const hasSlackChannels = [...channels.values()].some((ch) => ch.type === "slack");
@@ -8560,6 +10657,7 @@ async function startCommand(configPath, options) {
       approvalRouter,
       rateLimiter,
       spendLimiter,
+      budgetEngine,
       auditWriter,
       approvalTimeoutMs: parseDuration(config.approval.timeout),
       ttlMs: parseDuration(config.sdk.evaluation_ttl)
@@ -8585,7 +10683,13 @@ async function startCommand(configPath, options) {
         eventBus,
         // Adapter liveness for GET /api/adapters (issue #126); undefined
         // unless the SDK sideband is enabled → endpoint serves an empty list.
-        adapterLiveness: governanceService
+        adapterLiveness: governanceService,
+        // Budget read surface (issue #14): live pot states from the engine,
+        // spend history from the ledger.
+        budgets: {
+          listStates: () => budgetEngine.listStates(),
+          listEvents: (name, page) => budgetLedger.listEvents(name, page)
+        }
       },
       {
         apiSecret: config.dashboard.api_secret,
@@ -8637,12 +10741,17 @@ async function startCommand(configPath, options) {
   warnIfWebhookChannelUnreachable(config);
   warnIfSdkSidebandExposed(config);
   warnIfDashboardOpenMode(config);
+  warnIfBudgetWindowExceedsRetention(config);
   const channelCount = config.approval.channels.length;
   console.error(
     `Approvals: timeout ${config.approval.timeout}, default on timeout: ${config.approval.default_on_timeout}, ${String(channelCount)} channel${channelCount !== 1 ? "s" : ""} configured`
   );
   console.error(`Rate limits: enabled`);
   console.error(`Spend limits: enabled`);
+  const budgetCount = budgets.length;
+  console.error(
+    `Budgets: ${String(budgetCount)} configured${budgetCount > 0 ? ` (${budgets.map((b) => b.name).join(", ")})` : ""}`
+  );
   if (policy.dryRun) {
     console.error(`Dry-run: ENABLED (no requests will be forwarded to upstream)`);
   }
@@ -8653,9 +10762,24 @@ async function startCommand(configPath, options) {
     configWatcher = new ConfigWatcher({
       configPath,
       initialConfig: config,
-      onPolicyReload: (newPolicy, reloadWarnings, restartRequiredPaths) => {
+      onReload: (newPolicy, reloadWarnings, restartRequiredPaths, newBudgets) => {
+        const unroutable = findUnroutableApprovalReferences(newPolicy, newBudgets, {
+          channelTypes: runtimeChannelTypes,
+          dashboardEnabled: config.dashboard.enabled,
+          defaultApprovalTimeoutMs: parseDuration(config.approval.timeout)
+        });
+        if (unroutable.length > 0) {
+          throw new Error(
+            `approval routing is not available in the running process (restart required to apply approval.channels/dashboard changes): ${unroutable.join("; ")}`
+          );
+        }
+        budgetEngine.reconcile(newBudgets);
         governedForwarder.updatePolicy(newPolicy);
         governanceService?.updatePolicy(newPolicy);
+        const budgetTotal = newBudgets.length;
+        console.error(
+          `[helio] Budgets reloaded: ${String(budgetTotal)} budget${budgetTotal !== 1 ? "s" : ""}`
+        );
         const count = newPolicy.rules.length;
         console.error(
           `[helio] Policy reloaded: ${String(count)} rule${count !== 1 ? "s" : ""} (default: ${newPolicy.defaultAction})`
@@ -8675,7 +10799,9 @@ async function startCommand(configPath, options) {
         }
       },
       onError: (error) => {
-        console.error(`[helio] Config reload failed (keeping current policy): ${error.message}`);
+        console.error(
+          `[helio] Config reload failed (keeping current configuration): ${error.message}`
+        );
       }
     });
     configWatcher.start();
@@ -8697,6 +10823,7 @@ async function startCommand(configPath, options) {
     approvalQueue,
     rateLimiter,
     spendLimiter,
+    budgetEngine,
     closeDashboardApp,
     dashboardHandle,
     eventBus,
@@ -8726,6 +10853,7 @@ async function validateCommand(configPath) {
       const label = w.ruleName ? `rule "${w.ruleName}"` : `rule ${String(w.ruleIndex)}`;
       console.error(`Warning: policy ${label}: ${w.message}`);
     }
+    compileBudgets(config.budgets);
     if (config.dashboard.enabled && !getBundledDashboardDistPath()) {
       console.error(
         "Invalid config: dashboard.enabled is true but bundled dashboard assets are missing. " + DASHBOARD_ASSETS_RECOVERY_MESSAGE_FOR_VALIDATE
@@ -8816,7 +10944,7 @@ function writeCsv(records) {
     console.log(values.join(","));
   }
 }
-function registerShutdown(handle, annotationPrime, closeForwarder, auditWriter, configWatcher, sidebandHandle, evidenceStore, approvalRouter, approvalQueue, rateLimiter, spendLimiter, closeDashboardApp, dashboardHandle, eventBus, governanceService) {
+function registerShutdown(handle, annotationPrime, closeForwarder, auditWriter, configWatcher, sidebandHandle, evidenceStore, approvalRouter, approvalQueue, rateLimiter, spendLimiter, budgetEngine, closeDashboardApp, dashboardHandle, eventBus, governanceService) {
   let isShuttingDown = false;
   const shutdown = () => {
     if (isShuttingDown) return;
@@ -8827,24 +10955,24 @@ function registerShutdown(handle, annotationPrime, closeForwarder, auditWriter,
       process.exit(1);
     }, SHUTDOWN_TIMEOUT_MS);
     forceShutdownTimer.unref();
-    const closeAll = async () => {
-      if (annotationPrime) annotationPrime.stop();
-      if (configWatcher) configWatcher.close();
-      if (closeDashboardApp) closeDashboardApp();
-      if (eventBus) eventBus.close();
-      if (governanceService) governanceService.close();
-      if (rateLimiter) rateLimiter.close();
-      if (spendLimiter) spendLimiter.close();
-      if (approvalRouter) approvalRouter.close();
-      if (approvalQueue) approvalQueue.close();
-      if (dashboardHandle) await dashboardHandle.close();
-      if (sidebandHandle) await sidebandHandle.close();
-      await handle.close();
-      if (evidenceStore) evidenceStore.close();
-      if (auditWriter) auditWriter.close();
-      if (closeForwarder) await closeForwarder();
-    };
-    void closeAll().then(() => {
+    void closeResources({
+      handle,
+      annotationPrime,
+      closeForwarder,
+      auditWriter,
+      configWatcher,
+      sidebandHandle,
+      evidenceStore,
+      approvalRouter,
+      approvalQueue,
+      rateLimiter,
+      spendLimiter,
+      budgetEngine,
+      closeDashboardApp,
+      dashboardHandle,
+      eventBus,
+      governanceService
+    }).then(() => {
       clearTimeout(forceShutdownTimer);
       process.exit(0);
     }).catch((err) => {