@opengeni/worker-bundle 2.2.0-canary.36844267522001 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/worker-bundle",
-  "version": "2.2.0-canary.36844267522001",
+  "version": "2.2.0",
   "description": "OpenGeni worker entry and reusable embedded lifecycle, shipped with a release-coherent pre-bundled Temporal workflow artifact.",
   "license": "Apache-2.0",
   "repository": {
@@ -54,25 +54,25 @@
   },
   "dependencies": {
     "@llamaindex/liteparse": "2.14.2",
-    "@opengeni/agent-proto": "^0.6.0-canary.36844267522001",
-    "@opengeni/capabilities": "^0.3.4-canary.36844267522001",
-    "@opengeni/codemode": "^0.6.5-canary.36844267522001",
-    "@opengeni/codex": "^0.2.29-canary.36844267522001",
-    "@opengeni/config": "^3.1.1-canary.36844267522001",
-    "@opengeni/contracts": "^5.4.0-canary.36844267522001",
-    "@opengeni/core": "^5.0.0-canary.36844267522001",
-    "@opengeni/db": "^6.2.0-canary.36844267522001",
-    "@opengeni/documents": "^0.8.37-canary.36844267522001",
-    "@opengeni/events": "^0.4.35-canary.36844267522001",
-    "@opengeni/github": "^0.8.0-canary.36844267522001",
-    "@opengeni/jev": "^0.2.0-canary.36844267522001",
-    "@opengeni/network": "^0.3.1-canary.36844267522001",
-    "@opengeni/observability": "^0.8.35-canary.36844267522001",
-    "@opengeni/runtime": "^4.3.0-canary.36844267522001",
-    "@opengeni/sdk": "^7.4.0-canary.36844267522001",
-    "@opengeni/storage": "^0.2.136-canary.36844267522001",
-    "@opengeni/tool-gateway": "^0.1.16-canary.36844267522001",
-    "@opengeni/xai-subscription": "^0.1.4-canary.36844267522001",
+    "@opengeni/agent-proto": "^0.6.0",
+    "@opengeni/capabilities": "^0.3.4",
+    "@opengeni/codemode": "^0.6.5",
+    "@opengeni/codex": "^0.2.29",
+    "@opengeni/config": "^3.1.1",
+    "@opengeni/contracts": "^5.4.0",
+    "@opengeni/core": "^5.0.0",
+    "@opengeni/db": "^6.2.0",
+    "@opengeni/documents": "^0.8.37",
+    "@opengeni/events": "^0.4.35",
+    "@opengeni/github": "^0.8.0",
+    "@opengeni/jev": "^0.2.0",
+    "@opengeni/network": "^0.3.1",
+    "@opengeni/observability": "^0.8.35",
+    "@opengeni/runtime": "^4.3.0",
+    "@opengeni/sdk": "^7.4.0",
+    "@opengeni/storage": "^0.2.136",
+    "@opengeni/tool-gateway": "^0.1.16",
+    "@opengeni/xai-subscription": "^0.1.4",
     "@temporalio/activity": "^1.17.0",
     "@temporalio/client": "^1.17.0",
     "@temporalio/worker": "^1.17.0",

package/src/activities/agent-run-admission.ts

@@ -1,16 +1,10 @@
 import { configuredStaticUsageLimits, type Settings } from "@opengeni/config";
 import { modelFundingForAdmission } from "@opengeni/core";
-import {
-  checkWorkspaceAllowance,
-  getBillingBalance,
-  isCodexBilledTurn,
-  sumUsageQuantity,
-} from "@opengeni/db";
+import { getBillingBalance, isCodexBilledTurn, sumUsageQuantity } from "@opengeni/db";
 import type { ControlActivityServices } from "./types";
 
 export type AgentRunAdmissionDenial =
   | "insufficient_credits"
-  | "allowance_exhausted"
   | "monthly_model_cost_limit"
   | "monthly_agent_run_limit";
 
@@ -22,8 +16,6 @@ export async function agentRunAdmissionDenial(
     workspaceId: string;
     model: string;
     requestedAgentRuns: number;
-    /** The accepted work's causal human, not the scheduler/service caller. */
-    initiatingHumanSubjectId?: string | null;
   },
 ): Promise<AgentRunAdmissionDenial | null> {
   const codexBilled = await isCodexBilledTurn({
@@ -54,14 +46,6 @@ export async function agentRunAdmissionDenial(
       if (balance.balanceMicros <= 0) return "insufficient_credits";
     }
   }
-  if (!externallyBilled) {
-    const refusal = await checkWorkspaceAllowance(services.db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      subjectId: input.initiatingHumanSubjectId ?? null,
-    });
-    if (refusal) return refusal.code;
-  }
   if (
     services.settings.usageLimitsMode !== "static" &&
     services.settings.usageLimitsMode !== "managed"

package/src/activities/agent-turn/admission.ts

@@ -1,4 +1,4 @@
-import { checkWorkspaceAllowance, getBillingBalance, sumUsageQuantity } from "@opengeni/db";
+import { getBillingBalance, sumUsageQuantity } from "@opengeni/db";
 import {
   configuredStaticUsageLimits,
   resolveTurnExecutionPolicyV1,
@@ -8,7 +8,6 @@ import { selectCodexCredentialId } from "@opengeni/codex";
 import { directPersonalConnectionSubjectId } from "@opengeni/core";
 import type { TurnActivityServices as ActivityServices } from "../types";
 import {
-  type AllowanceExhaustedRefusal,
   type SessionEvent,
   type SessionTurn,
   type ToolAuthNeededPayload,
@@ -244,65 +243,12 @@ export class BudgetExhaustedError extends Error {
   constructor(
     message: string,
     readonly serializedRunState: string | null,
-    readonly allowance: AllowanceRefusal | null = null,
   ) {
     super(message);
     this.name = "BudgetExhaustedError";
   }
 }
 
-export type AllowanceRefusal = AllowanceExhaustedRefusal;
-
-/** Account allowance exhaustion is recoverable state, never a provider failure. */
-export class AllowanceExhaustedError extends Error {
-  readonly code = "allowance_exhausted";
-
-  constructor(readonly refusal: AllowanceRefusal) {
-    super(refusal.message);
-    this.name = "AllowanceExhaustedError";
-  }
-}
-
-/** Revalidate between paid calls without replaying provider work or reserving credits. */
-export async function ensureRunAllowedBetweenModelCalls(input: {
-  settings: Settings;
-  db: ActivityServices["db"];
-  accountId: string;
-  workspaceId: string;
-  isExternallyBilledTurn: boolean;
-  entitlements?: ActivityServices["entitlements"];
-  chargesOpenGeniCredits: boolean;
-  countsTowardTokenCap: boolean;
-  initiatingHumanSubjectId: string | null;
-  serializedRunState?: () => string | null;
-}): Promise<void> {
-  try {
-    await ensureRunAllowed(
-      input.settings,
-      input.db,
-      input.accountId,
-      input.workspaceId,
-      input.isExternallyBilledTurn,
-      input.entitlements,
-      input.chargesOpenGeniCredits,
-      input.countsTowardTokenCap,
-      input.initiatingHumanSubjectId,
-    );
-  } catch (limitError) {
-    let serializedRunState: string | null = null;
-    try {
-      serializedRunState = input.serializedRunState?.() ?? null;
-    } catch {
-      // Durable history remains authoritative when the SDK state cannot serialize.
-    }
-    throw new BudgetExhaustedError(
-      limitError instanceof Error ? limitError.message : String(limitError),
-      serializedRunState,
-      limitError instanceof AllowanceExhaustedError ? limitError.refusal : null,
-    );
-  }
-}
-
 // Exported for unit testing the external-billing bypass (codex-billing.test.ts); not
 // part of the activity surface. Takes the accepted policy's billing attribution and
 // the optional §7.5 P3 host `entitlements` port (when bound, its `admitRun` REPLACES
@@ -316,7 +262,6 @@ export async function ensureRunAllowed(
   entitlements?: ActivityServices["entitlements"],
   chargesOpenGeniCredits = !isExternallyBilledTurn,
   countsTowardTokenCap = !isExternallyBilledTurn,
-  initiatingHumanSubjectId: string | null = null,
 ): Promise<void> {
   // Upstream settlement and workspace-facing cost are independent. External
   // metering skips the token cap; free/subscription/workspace cost skips the
@@ -357,14 +302,6 @@ export async function ensureRunAllowed(
       throw new Error("insufficient OpenGeni credits");
     }
   }
-  if (chargesOpenGeniCredits) {
-    const refusal = await checkWorkspaceAllowance(db, {
-      accountId,
-      workspaceId,
-      subjectId: initiatingHumanSubjectId,
-    });
-    if (refusal) throw new AllowanceExhaustedError(refusal);
-  }
   if (settings.usageLimitsMode === "static" || settings.usageLimitsMode === "managed") {
     const limits = configuredStaticUsageLimits(settings);
     if (limits.maxMonthlyAgentRunsPerWorkspace) {

package/src/activities/agent-turn/claim.ts

@@ -62,8 +62,6 @@ import {
   turnExecutionPolicyBillingIdentity,
   legacyTurnExecutionPolicyInput,
   ensureRunAllowed,
-  AllowanceExhaustedError,
-  type AllowanceRefusal,
 } from "./admission";
 import { providerRecoveryCountFromMetadata, isWorkerShutdownCancellation } from "./errors";
 import { throwIfTurnOperationCancelled, waitForTurnOperation } from "./sandbox-provision";
@@ -370,27 +368,20 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
   // bypass OpenGeni credit/token gates)
   // AND the optional host `entitlements` port (when bound, its admitRun replaces
   // the local credit read). Unset port → today's local-ledger path.
-  let allowanceRefusal: AllowanceRefusal | null = null;
-  try {
-    await waitForTurnOperation(
-      ensureRunAllowed(
-        capabilitySettings,
-        db,
-        input.accountId,
-        input.workspaceId,
-        billingState.isExternallyBilledTurn,
-        entitlements,
-        billingState.chargesOpenGeniCredits,
-        billingState.countsTowardTokenCap,
-        turn.initiatingHumanSubjectId,
-      ),
-      cancellationSignal,
-      undefined,
-    );
-  } catch (error) {
-    if (!(error instanceof AllowanceExhaustedError)) throw error;
-    allowanceRefusal = error.refusal;
-  }
+  await waitForTurnOperation(
+    ensureRunAllowed(
+      capabilitySettings,
+      db,
+      input.accountId,
+      input.workspaceId,
+      billingState.isExternallyBilledTurn,
+      entitlements,
+      billingState.chargesOpenGeniCredits,
+      billingState.countsTowardTokenCap,
+    ),
+    cancellationSignal,
+    undefined,
+  );
   // Setup (variableSet load, MCP connects, sandbox restore) does not
   // stream and so never observes cancellation on its own; these explicit
   // checks let a graceful shutdown checkpoint the turn before the worker is
@@ -523,9 +514,6 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
       ...(inputSettlement.suppressGoalContinuation !== undefined
         ? { suppressGoalContinuation: inputSettlement.suppressGoalContinuation }
         : {}),
-      ...(inputSettlement.allowanceGoalPause
-        ? { allowanceGoalPause: inputSettlement.allowanceGoalPause }
-        : {}),
       events: inputs,
       ...(runState ? { runState } : {}),
       ...(compactionRequestFailure ? { compactionRequestFailure } : {}),
@@ -587,36 +575,6 @@ export async function claimTurnAttempt(deps: ClaimTurnDeps): Promise<ClaimTurnOu
     durationSeconds: (performance.now() - activityStarted) / 1_000,
   });
   const turnStartSettlementStartedAt = performance.now();
-  if (allowanceRefusal) {
-    // Claim has frozen the exact human, but no provider or sandbox has started.
-    // Use the same terminal valve as a post-response stop, retaining a usable
-    // session and a visible typed refusal instead of manufacturing a failure.
-    if (
-      !(await eventing.settle({
-        events: [
-          { type: "usage.exhausted", payload: allowanceRefusal },
-          {
-            type: "turn.completed",
-            payload: {
-              output: "",
-              segmentLimit: "budget_exhausted",
-              ...allowanceRefusal,
-            },
-          },
-          { type: "session.status.changed", payload: { status: "idle" } },
-        ],
-        turnStatus: "completed",
-        sessionStatus: "idle",
-        activeTurnId: null,
-        allowanceGoalPause: { rationale: allowanceRefusal.message },
-      }))
-    ) {
-      return { exit: claimedResult({ status: "cancelled" }) };
-    }
-    control.turnMetricOutcome = "completed";
-    control.activityStatus = "idle";
-    return { exit: claimedResult({ status: "idle" }) };
-  }
   if (
     !(await eventing.settle({
       events: [

package/src/activities/agent-turn/claude-usage-observer.ts

@@ -35,17 +35,6 @@ export async function createClaudeUsageObserver(
       .map(async (provider) => {
         const scope: Scope =
           provider.kind === "claude-subscription-workspace" ? "workspace" : "organization";
-        const binding = provider.anthropic?.credentialBinding;
-        if (binding && provider.apiKey)
-          return [
-            provider.id,
-            {
-              scope,
-              token: provider.apiKey,
-              expectedConnectionId: binding.connectionId,
-              expectedCredentialVersion: binding.credentialVersion,
-            },
-          ] as const;
         const credential = await readCredential(scope).catch(() => null);
         if (!credential || credential.token !== provider.apiKey) return null;
         return [
@@ -60,7 +49,7 @@ export async function createClaudeUsageObserver(
       }),
   );
   const captured = new Map(bindings.filter((binding) => binding !== null));
-  const observe = (providerId: string, response: Response) => {
+  return (providerId: string, response: Response) => {
     const binding = captured.get(providerId);
     if (!binding) return;
     const { scope, ...identity } = binding;
@@ -87,25 +76,4 @@ export async function createClaudeUsageObserver(
           : {}),
       });
   };
-  return Object.assign(observe, {
-    binding(providerId: string) {
-      return captured.get(providerId);
-    },
-    renew(
-      providerId: string,
-      credential: {
-        token: string;
-        connectionId: string;
-        credentialVersion: number;
-      },
-    ) {
-      const binding = captured.get(providerId);
-      if (
-        binding &&
-        binding.expectedConnectionId === credential.connectionId &&
-        binding.expectedCredentialVersion === credential.credentialVersion
-      )
-        captured.set(providerId, { ...binding, token: credential.token });
-    },
-  });
 }

package/src/activities/agent-turn/failure-settlement.ts

@@ -1536,16 +1536,12 @@ export async function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgent
     if (
       !(await eventing.settle!({
         events: [
-          ...(error.allowance
-            ? [{ type: "usage.exhausted" as const, payload: error.allowance }]
-            : []),
           {
             type: "turn.completed",
             payload: {
               output: "",
               segmentLimit: "budget_exhausted",
               detail: error.message,
-              ...(error.allowance ?? {}),
             },
           },
           { type: "session.status.changed", payload: { status: "idle" } },
@@ -1553,7 +1549,6 @@ export async function settleTurnFailure(deps: TurnFailureDeps): Promise<RunAgent
         turnStatus: "completed",
         sessionStatus: "idle",
         activeTurnId: null,
-        ...(error.allowance ? { allowanceGoalPause: { rationale: error.allowance.message } } : {}),
       }))
     ) {
       return claimedResult({ status: "cancelled" });

package/src/activities/agent-turn/run-credentials.ts

@@ -28,8 +28,6 @@ import {
   type loadWorkspaceEnvironmentForRunWithCredentials,
 } from "../environment";
 import type { mergeResourceRefs } from "../common";
-import type { withFirstPartyTools } from "../goals";
-import { expandMcpAccountRoutes } from "../mcp-account-routes";
 import { startGitCredentialRenewalLoop } from "../git-credential-renewal";
 import {
   RUN_CREDENTIAL_EXPIRY_LEAD_MS,
@@ -76,7 +74,6 @@ import type {
 
 export type PrepareRunCredentialsDeps = {
   localMcpServerIds?: readonly string[];
-  turnTools: ReturnType<typeof withFirstPartyTools>;
   input: RunAgentTurnInput;
   settings: Settings;
   db: ActivityServices["db"];
@@ -156,14 +153,6 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
   const platformGitResources = turnResources.filter(
     (resource) => resource.kind !== "repository" || repositoryHasExplicitGitConnection(resource),
   );
-  // Credential targets follow the same accepted-account narrowing as execution.
-  // A canonical connection without an accepted account does not execute, and
-  // account-qualified aliases never inherit an attachment's product headers.
-  const accountRoutes = expandMcpAccountRoutes({
-    settings: runSettings,
-    tools: deps.turnTools,
-    bindings: turn.mcpAccountBindings,
-  });
 
   const runCredentialResolver =
     effectiveRunCredentialBackend === "none" || effectiveRunCredentialBackend === "selfhosted"
@@ -171,11 +160,10 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
       : await waitForTurnOperation(
           bindRunCredentialResolver({
             db,
-            settings: accountRoutes.settings,
+            settings: runSettings,
             initiatingHumanSubjectId: turn.initiatingHumanSubjectId ?? null,
             connectionCredentials: connectionCredentials ?? null,
             localMcpServerIds: deps.localMcpServerIds ?? [],
-            effectiveTools: accountRoutes.tools,
             accountId: input.accountId,
             workspaceId: input.workspaceId,
             session,
@@ -226,9 +214,9 @@ export async function prepareRunCredentials(deps: PrepareRunCredentialsDeps) {
     : null;
   const runMcpCredentials = new RunMcpCredentials(
     selectedSessionRemoteMcpTargets(
-      accountRoutes.settings,
+      runSettings,
       session.mcpServers ?? [],
-      accountRoutes.tools,
+      turn.tools ?? [],
       (deps.localMcpServerIds ?? []).map((id) => ({ id })),
     ),
     {

package/src/activities/agent-turn/run.ts

@@ -3,8 +3,6 @@ import {
   readActiveSandbox,
   getWorkspaceCredentialProvider,
   loadClaudeSubscriptionUsageCredential,
-  resolveClaudeSubscriptionCredential,
-  ClaudeSubscriptionReconnectRequired,
 } from "@opengeni/db";
 import { routingEnabled } from "../../sandbox-routing";
 import { createKnowledgeSourceSyncActivities } from "../knowledge-source-sync";
@@ -28,7 +26,6 @@ import {
 import {
   REMOTE_COMPACTION_V2_BETA_FEATURE,
   REMOTE_COMPACTION_V2_IMPLEMENTATION,
-  awaitModelCallAdmission,
   materializeSandboxFileDownloads,
   sandboxFileDownloadFailureNote,
   type SandboxFileDownload,
@@ -381,14 +378,12 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
       getModelRunSettings: () => eventing.modelRunSettings,
       getExecutionGeneration: () => attempt.executionGeneration,
     });
-    const checkpointBeforeProviderDispatch = async () => {
-      await awaitModelCallAdmission();
-      await checkpointHistoryBeforeProviderDispatch(historySink, {
+    const checkpointBeforeProviderDispatch = () =>
+      checkpointHistoryBeforeProviderDispatch(historySink, {
         effectiveSandboxBackend: eventing.modelRunSettings.sandboxBackend,
         routingEnabled: routingEnabled(settings),
         readActiveSandbox: () => readActiveSandbox(db, input.workspaceId, input.sessionId),
       });
-    };
 
     try {
       const claimed = await claimTurnAttempt({
@@ -937,30 +932,7 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
               }),
           );
           const withClaudeUsage = <T>(fn: () => Promise<T>): Promise<T> =>
-            withClaudeUsageObserver(claudeUsageObserver, fn, async (providerId, headers) => {
-              const binding = claudeUsageObserver.binding(providerId);
-              if (!binding) return headers;
-              const credential = await resolveClaudeSubscriptionCredential(
-                db,
-                settings,
-                {
-                  accountId: input.accountId,
-                  workspaceId: input.workspaceId,
-                  scope: binding.scope,
-                },
-                {
-                  expectedConnectionId: binding.expectedConnectionId,
-                  expectedCredentialVersion: binding.expectedCredentialVersion,
-                },
-              );
-              if (!credential) return headers; // A replaced connection never lends its new token to this turn.
-              if ("reconnectRequired" in credential)
-                throw new ClaudeSubscriptionReconnectRequired();
-              claudeUsageObserver.renew(providerId, credential);
-              headers.set("authorization", `Bearer ${credential.token}`);
-              headers.delete("x-api-key");
-              return headers;
-            });
+            withClaudeUsageObserver(claudeUsageObserver, fn);
           const withCodex = <T>(fn: () => Promise<T>): Promise<T> =>
             codexContext ? codexRequestStorage.run(codexContext, fn) : fn();
           const withProviderRequestContext = <T>(fn: () => Promise<T>): Promise<T> =>
@@ -1203,7 +1175,6 @@ export function createRunAgentTurnActivity(services: () => Promise<ActivityServi
           );
 
           const runCredentials = await prepareRunCredentials({
-            turnTools,
             localMcpServerIds: installedApiIntegrations.map((integration) => integration.serverId),
             input,
             settings,

package/src/activities/agent-turn/stream-attempt.ts

@@ -90,14 +90,14 @@ import {
   type SessionTurn,
 } from "@opengeni/contracts";
 import { createModelCheckpointMemoryCollector } from "../../model-checkpoint-memory-collector";
-import { createModelCallAdmission } from "./model-call-admission";
 
 import {
   assertWorkspaceHumanInputAllowed,
   stableHumanInputRequestId,
   stableInteractionInterventionId,
   stableInteractionInterventionOperationId,
-  ensureRunAllowedBetweenModelCalls,
+  BudgetExhaustedError,
+  ensureRunAllowed,
 } from "./admission";
 import {
   compactionFailureReason,
@@ -235,7 +235,6 @@ export type TurnStreamAttemptDeps = {
   groupBoxBackend: Settings["sandboxBackend"];
   turnExecutionPolicy: TurnExecutionPolicyV1;
   turn: Pick<SessionTurn, "initiator" | "initiatorContext"> & {
-    initiatingHumanSubjectId: string | null;
     id: string;
     executionGeneration: number;
     model: string;
@@ -584,39 +583,14 @@ export async function runTurnStreamAttempt(
   // durably: the reply a wait-ended human turn records on turn.completed.
   let latestAssistantMessageText: string | null = null;
   let workerPreparationTotalRecorded = false;
-  const revalidateModelCallAdmission = async () => {
-    await historySink.reconcileConversationTruth({ requireDurable: true });
-    await ensureRunAllowedBetweenModelCalls({
-      settings,
-      db,
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      isExternallyBilledTurn: billingState.isExternallyBilledTurn,
-      entitlements,
-      chargesOpenGeniCredits: billingState.chargesOpenGeniCredits,
-      countsTowardTokenCap: billingState.countsTowardTokenCap,
-      initiatingHumanSubjectId: turn.initiatingHumanSubjectId,
-    });
-  };
   const runStreamAttempt = async (options: {
     requireTerminalModelResponse: boolean;
   }): Promise<RunAgentTurnResult> => {
     if (!runInput) {
       throw new Error("Run input was not prepared");
     }
-    // The previous stream was persisted before compaction; the sink is now
-    // seeded from its durable replacement. Do not reconcile the old prefix
-    // against that replacement while checking the next stream's admission.
-    eventing.stream = undefined;
-    // Compaction commits its paid usage and replacement history before this
-    // boundary, both during preparation and in-activity recovery. Revalidate
-    // the accepted turn's frozen human before another stream can dispatch.
-    if (options.requireTerminalModelResponse) await revalidateModelCallAdmission();
-    const modelCallAdmission = createModelCallAdmission({
-      signal: runtimeCancellationSignal,
-      admit: revalidateModelCallAdmission,
-    });
     const responseCountBeforeStream = modelResponseState.responseCount;
+    eventing.stream = undefined;
     eventing.batcher = null;
     // The SDK emits every processed call item for one model response before
     // it emits any result for that response. Keep that response-local batch
@@ -832,8 +806,6 @@ export async function runTurnStreamAttempt(
         }
         attempt.modelRequestStarted = true;
         return await runtime.runStream(agent, runInput!, eventing.modelRunSettings, {
-          beforeModelRequest: modelCallAdmission.beforeModelRequest,
-          onModelResponse: modelCallAdmission.onModelResponse,
           signal: runtimeCancellationSignal,
           sandboxEnvironment,
           onModelVisibleContext: async (snapshot) => {
@@ -969,13 +941,7 @@ export async function runTurnStreamAttempt(
     if (leases.xai.lost) {
       throw new Error("xAI credential lease expired before the model run");
     }
-    try {
-      eventing.stream = await withProviderRequestContext(runStreamOnce);
-    } catch (error) {
-      modelCallAdmission.fail(error);
-      modelCallAdmission.close();
-      throw error;
-    }
+    eventing.stream = await withProviderRequestContext(runStreamOnce);
     // Bounded provider label for the streaming SLIs — the resolved registry
     // provider id (or the built-in OpenAI/Azure provider), never a raw
     // user-supplied model string.
@@ -1128,22 +1094,35 @@ export async function runTurnStreamAttempt(
           await historySink.reconcileConversationTruth();
           turnLifecycleMetricsFor(observability).progress({ attemptId: input.attemptId });
           modelCheckpointMemoryCollector.schedule(observability);
-          await ensureRunAllowedBetweenModelCalls({
-            settings,
-            db,
-            accountId: input.accountId,
-            workspaceId: input.workspaceId,
-            isExternallyBilledTurn: billingState.isExternallyBilledTurn,
-            entitlements,
-            chargesOpenGeniCredits: billingState.chargesOpenGeniCredits,
-            countsTowardTokenCap: billingState.countsTowardTokenCap,
-            initiatingHumanSubjectId: turn.initiatingHumanSubjectId,
-            serializedRunState: () =>
-              media.compactMediaRunState(String(eventing.stream!.state.toString())),
-          });
+          try {
+            await ensureRunAllowed(
+              settings,
+              db,
+              input.accountId,
+              input.workspaceId,
+              billingState.isExternallyBilledTurn,
+              entitlements,
+              billingState.chargesOpenGeniCredits,
+              billingState.countsTowardTokenCap,
+            );
+          } catch (limitError) {
+            // Capture the run state at the boundary so the budget valve in
+            // the outer catch can end this segment gracefully with full
+            // conversation context preserved for the post-top-up resume.
+            let serializedRunState: string | null = null;
+            try {
+              serializedRunState = media.compactMediaRunState(
+                String(eventing.stream.state.toString()),
+              );
+            } catch {
+              serializedRunState = null;
+            }
+            throw new BudgetExhaustedError(
+              limitError instanceof Error ? limitError.message : String(limitError),
+              serializedRunState,
+            );
+          }
         }
-        // Release only after both the debit and frozen-human admission finish.
-        modelCallAdmission.settle(next.value);
         const durableSdkEvent = generatedImageReceipt
           ? compactGeneratedImageSdkEvent(next.value, generatedImageReceipt)
           : next.value;
@@ -1417,7 +1396,6 @@ export async function runTurnStreamAttempt(
         }
       }
     } catch (error) {
-      modelCallAdmission.fail(error);
       // Event processing can fail while SDK completion is still pending.
       // Close this stream before any failure publication; a legitimate
       // compaction retry may start a new, independently fenced generation.
@@ -1473,7 +1451,6 @@ export async function runTurnStreamAttempt(
       }
       throw error;
     } finally {
-      modelCallAdmission.close();
       if (!streamDone) {
         // ReadableStream cancellation synchronously trips the Agents SDK's
         // abort controller, but its returned promise may wait for an
@@ -1857,9 +1834,6 @@ export async function runTurnStreamAttempt(
   ) {
     return claimedResult({ status: "cancelled" });
   }
-  // Preparation may have spent the last allowance on a completed summary.
-  // Neither the title sidecar nor ordinary inference may dispatch afterward.
-  await revalidateModelCallAdmission();
   if (
     turn.source !== "compaction" &&
     generateSessionTitleInParallel &&