@remnic/bench 9.7.4 → 9.7.6

package/dist/index.js

@@ -5886,9 +5886,51 @@ import { createHash as createHash4 } from "crypto";
 import { mkdir as mkdir2, open, readFile as readFile3, rename as rename2, rmdir, unlink as unlink2, writeFile as writeFile2 } from "fs/promises";
 import os from "os";
 import path3 from "path";
-var ONE_MILLION = 1e6;
-var CREDIT_EPSILON = 1e-9;
+
+// src/benchmark-run-blocked-error.ts
+var BenchmarkRunBlockReason = {
+  InfrastructureUnavailable: "infrastructure_unavailable",
+  ManualReconciliationRequired: "manual_reconciliation_required",
+  SpendHeadroomExhausted: "spend_headroom_exhausted",
+  SpendCeilingExceeded: "spend_ceiling_exceeded",
+  ResourceLocked: "resource_locked"
+};
+var BENCHMARK_RUN_BLOCKED_ERROR_CODE = "REMNIC_BENCHMARK_RUN_BLOCKED";
+var BLOCK_REASONS = new Set(
+  Object.values(BenchmarkRunBlockReason)
+);
+var BenchmarkRunBlockedError = class extends Error {
+  code = BENCHMARK_RUN_BLOCKED_ERROR_CODE;
+  reason;
+  constructor(reason, message, options) {
+    super(message, options);
+    this.name = "BenchmarkRunBlockedError";
+    this.reason = reason;
+  }
+};
+function findBenchmarkRunBlockedError(error) {
+  const visited = /* @__PURE__ */ new Set();
+  let current = error;
+  while (typeof current === "object" && current !== null) {
+    if (visited.has(current)) {
+      return void 0;
+    }
+    visited.add(current);
+    const candidate = current;
+    if (candidate.code === BENCHMARK_RUN_BLOCKED_ERROR_CODE && typeof candidate.reason === "string" && BLOCK_REASONS.has(candidate.reason)) {
+      return current;
+    }
+    current = candidate.cause;
+  }
+  return void 0;
+}
+function isBenchmarkRunBlockedError(error) {
+  return findBenchmarkRunBlockedError(error) !== void 0;
+}
+
+// src/providers/codex-credit-budget.ts
 var MAX_BOUNDED_CALL_CREDITS = 300;
+var LEGACY_LEDGER_FLOAT_DRIFT_TOLERANCE = 1e-9;
 var SOL_MODEL = /^gpt-5\.6-sol$/i;
 var CREDIT_RATES = [
   [/^gpt-5\.6-sol$/i, { input: 125, cachedInput: 12.5, output: 750 }],
@@ -5901,6 +5943,10 @@ var CREDIT_RATES = [
   [/^gpt-5\.2$/i, { input: 43.75, cachedInput: 4.375, output: 350 }]
 ];
 var completionQueue = Promise.resolve();
+var failNextSettledLockWriteForTest = false;
+var failNextOwnedLockRemovalForTest = false;
+var failNextLedgerSetupForTest = false;
+var failNextLedgerWriteForTest = false;
 var CodexCreditAccountingError = class extends Error {
   constructor(message) {
     super(message);
@@ -5914,26 +5960,34 @@ var CodexCreditDispatchError = class extends Error {
   }
 };
 async function reconcileCodexCreditLedger(args) {
-  if (args.originalBudgetBalanceConfirmed !== true) {
-    throw new Error(
-      "Codex credit reconciliation requires confirmation that the observed balance belongs to the ledger's original budget"
-    );
+  if (args.sameAccountConfirmed !== true) {
+    throw new Error("Codex credit reconciliation requires confirmation that both balances belong to the same account");
   }
-  if (args.noCreditsAddedOrRefundedConfirmed !== true) {
-    throw new Error(
-      "Codex credit reconciliation requires confirmation that no credits were added or refunded after the original budget was established"
-    );
+  if (args.snapshotsBracketBlockedEventConfirmed !== true) {
+    throw new Error("Codex credit reconciliation requires confirmation that the snapshots bracket the blocked event");
+  }
+  if (args.balanceSettledConfirmed !== true) {
+    throw new Error("Codex credit reconciliation requires confirmation that the displayed balances are settled");
   }
-  if (args.accountWideUnattributedChargeAccepted !== true) {
+  if (args.noCreditsAddedOrRefundedConfirmed !== true) {
     throw new Error(
-      "Codex credit reconciliation requires acknowledgment that all unexplained account activity will be charged as account-wide unattributed spend"
+      "Codex credit reconciliation requires confirmation that no credits were added or refunded between snapshots"
     );
   }
   if (!isSha256(args.priorLedgerSha256)) {
     throw new Error("priorLedgerSha256 must be a lowercase SHA-256 digest");
   }
-  if (!Number.isFinite(args.observedRemainingCredits) || args.observedRemainingCredits < 0) {
-    throw new Error("observedRemainingCredits must be a finite non-negative number");
+  const beforeAccountBalance = parseExactDecimal(args.beforeAccountBalance, "beforeAccountBalance");
+  const afterAccountBalance = parseExactDecimal(args.afterAccountBalance, "afterAccountBalance");
+  const observedAccountDebit = subtractExactDecimals(beforeAccountBalance, afterAccountBalance);
+  if (observedAccountDebit.startsWith("-")) {
+    throw new Error("afterAccountBalance exceeds beforeAccountBalance; reconciliation refused");
+  }
+  const localBudgetChargeUnits = observedAccountDebit === "0" ? 0 : MAX_BOUNDED_CALL_CREDITS;
+  if (localBudgetChargeUnits > 0 && args.noInterveningCodexActivityConfirmed !== true) {
+    throw new Error(
+      "a positive account-wide debit requires confirmation that no other Codex activity occurred between snapshots"
+    );
   }
   const affectedRunId = parseRequiredRunId(args.affectedRunId, "affectedRunId");
   const ledgerPath = path3.resolve(expandHomeRelativePath(args.ledgerPath));
@@ -5946,7 +6000,11 @@ async function reconcileCodexCreditLedger(args) {
   const lockPath = `${ledgerPath}.lock`;
   let lock;
   try {
-    await mkdir2(path3.dirname(lockPath), { recursive: true, mode: 448 });
+    try {
+      await prepareLedgerDirectory(lockPath);
+    } catch (error) {
+      throw infrastructureUnavailableError(error);
+    }
     lock = await acquireLedgerLock(lockPath);
     const contents = await readFile3(ledgerPath);
     const currentSha256 = sha256(contents);
@@ -5955,74 +6013,81 @@ async function reconcileCodexCreditLedger(args) {
         `Codex credit ledger changed since operator observation: expected ${args.priorLedgerSha256}, found ${currentSha256}; obtain a fresh ledger hash and remaining balance`
       );
     }
-    const ledger = parseLedger(JSON.parse(contents.toString("utf8")));
-    if (!ledger.blockedReason) {
+    const ledger = parseLedger(JSON.parse(contents.toString("utf8")), contents);
+    if (!ledger.blockedEvent) {
       throw new Error("Codex credit ledger is not blocked; reconciliation is not permitted");
     }
-    if (args.observedRemainingCredits > ledger.budgetCredits) {
-      throw new Error("observedRemainingCredits cannot exceed the ledger budget");
+    if (ledger.blockedEvent.runId && ledger.blockedEvent.runId !== affectedRunId) {
+      throw new Error(
+        `affectedRunId does not match the blocked event run ID ${JSON.stringify(ledger.blockedEvent.runId)}`
+      );
     }
-    const rawUnattributedCredits = ledger.budgetCredits - args.observedRemainingCredits - ledger.spentCredits;
-    if (!Number.isFinite(rawUnattributedCredits) || rawUnattributedCredits < -CREDIT_EPSILON) {
+    const plannedSpendCeilingNanounits = budgetUnitsToNanounits(ledger.budgetUnits) - budgetUnitsToNanounits(ledger.reserveUnits);
+    const spentNanounits = ledgerSpentNanounits(ledger);
+    const localBudgetChargeNanounits = budgetUnitsToNanounits(localBudgetChargeUnits);
+    if (plannedSpendCeilingNanounits - spentNanounits < localBudgetChargeNanounits) {
       throw new Error(
-        "observedRemainingCredits implies less spend than the ledger already records; reconciliation refused"
+        `reconciliation requires ${localBudgetChargeUnits} local budget units but only ${nanounitsToBudgetUnits(
+          plannedSpendCeilingNanounits > spentNanounits ? plannedSpendCeilingNanounits - spentNanounits : 0n
+        )} remain below the planned-spend ceiling`
       );
     }
-    const unattributedCredits = Math.abs(rawUnattributedCredits) <= CREDIT_EPSILON ? 0 : rawUnattributedCredits;
-    const observedSpentCredits = ledger.spentCredits + unattributedCredits;
+    const totalSpentNanounits = spentNanounits + localBudgetChargeNanounits;
+    const totalSpentUnits = nanounitsToBudgetUnits(totalSpentNanounits);
     const at = (/* @__PURE__ */ new Date()).toISOString();
-    const reconciliation = {
+    const affectedBlockedEvent = ledger.blockedEvent;
+    const resolution = {
       at,
-      basis: "operator-observed-original-budget-balance",
-      attribution: "account-wide-unattributed",
+      basis: "operator-observed-account-balance-delta",
+      attribution: "account-wide-observation-window",
       priorLedgerSha256: currentSha256,
-      originalBudgetCredits: ledger.budgetCredits,
-      priorRecordedSpentCredits: ledger.spentCredits,
-      observedRemainingCredits: args.observedRemainingCredits,
-      credits: normalizeZero(unattributedCredits),
+      priorRecordedSpentUnits: nanounitsToBudgetUnits(spentNanounits),
+      priorEntryCount: ledger.entries.length,
+      beforeAccountBalance,
+      afterAccountBalance,
+      observedAccountDebit,
+      localBudgetChargeUnits,
       confirmations: {
-        observedBalanceBelongsToOriginalBudget: true,
+        sameAccount: true,
+        snapshotsBracketBlockedEvent: true,
+        balanceSettled: true,
         noCreditsAddedOrRefunded: true,
-        accountWideUnattributedChargeAccepted: true
+        ...args.noInterveningCodexActivityConfirmed === true ? { noInterveningCodexActivity: true } : {}
       },
-      affectedBlockedEvent: {
-        runId: affectedRunId,
-        blockedReason: ledger.blockedReason
-      }
+      affectedRunId,
+      affectedBlockedEvent
     };
     const nextLedger = {
       ...ledger,
-      spentCredits: observedSpentCredits,
-      reconciliations: [...ledger.reconciliations ?? [], reconciliation],
-      blockedReason: void 0
+      spentUnits: totalSpentUnits,
+      resolutions: [...ledger.resolutions ?? [], resolution],
+      blockedEvent: void 0
     };
-    await writeLedger(ledgerPath, nextLedger);
-    await writeLockState(lock, "settled");
-    const nextContents = await readFile3(ledgerPath);
+    const committed = await writeLedger(ledgerPath, nextLedger);
+    await bestEffortSettleLock(lock);
     return {
-      schemaVersion: 1,
+      schemaVersion: 2,
       priorLedgerSha256: currentSha256,
-      ledgerSha256: sha256(nextContents),
+      ledgerSha256: committed.sha256,
       at,
-      attribution: "account-wide-unattributed",
+      attribution: "account-wide-observation-window",
       affectedRunId,
-      originalBudgetCredits: ledger.budgetCredits,
-      priorRecordedSpentCredits: ledger.spentCredits,
-      observedRemainingCredits: args.observedRemainingCredits,
-      unattributedCredits: reconciliation.credits,
-      totalSpentCredits: observedSpentCredits,
-      totalRemainingCredits: args.observedRemainingCredits,
-      affectedBlockedEventSha256: sha256(
-        JSON.stringify(reconciliation.affectedBlockedEvent)
-      )
+      priorRecordedSpentUnits: nanounitsToBudgetUnits(spentNanounits),
+      beforeAccountBalance,
+      afterAccountBalance,
+      observedAccountDebit,
+      localBudgetChargeUnits,
+      totalSpentUnits,
+      remainingPlannedSpendUnits: nanounitsToBudgetUnits(plannedSpendCeilingNanounits - totalSpentNanounits),
+      affectedBlockedEventSha256: sha256(JSON.stringify(affectedBlockedEvent))
     };
   } finally {
     try {
       if (lock) {
         try {
-          await lock.close();
+          await bestEffortCloseLock(lock);
         } finally {
-          await removeOwnedLedgerLock(lockPath);
+          await bestEffortRemoveOwnedLedgerLock(lockPath);
         }
       }
     } finally {
@@ -6033,18 +6098,13 @@ async function reconcileCodexCreditLedger(args) {
 function resolveCodexCreditBudgetConfig(env = process.env, fallbackRunId) {
   const rawBudget = env.REMNIC_BENCH_CODEX_CREDIT_BUDGET?.trim();
   if (!rawBudget) return void 0;
-  const budgetCredits = parsePositiveNumber(
-    rawBudget,
-    "REMNIC_BENCH_CODEX_CREDIT_BUDGET"
-  );
+  const budgetCredits = parsePositiveNumber(rawBudget, "REMNIC_BENCH_CODEX_CREDIT_BUDGET");
   const reserveCredits = parseNonNegativeNumber(
     env.REMNIC_BENCH_CODEX_CREDIT_RESERVE?.trim() ?? "473",
     "REMNIC_BENCH_CODEX_CREDIT_RESERVE"
   );
   if (reserveCredits >= budgetCredits) {
-    throw new Error(
-      "REMNIC_BENCH_CODEX_CREDIT_RESERVE must be smaller than REMNIC_BENCH_CODEX_CREDIT_BUDGET"
-    );
+    throw new Error("REMNIC_BENCH_CODEX_CREDIT_RESERVE must be smaller than REMNIC_BENCH_CODEX_CREDIT_BUDGET");
   }
   if (reserveCredits < MAX_BOUNDED_CALL_CREDITS) {
     throw new Error(
@@ -6052,18 +6112,14 @@ function resolveCodexCreditBudgetConfig(env = process.env, fallbackRunId) {
     );
   }
   const ledgerPath = path3.resolve(
-    expandHomeRelativePath(
-      env.REMNIC_BENCH_CODEX_CREDIT_LEDGER?.trim() || ".remnic/bench/codex-credit-ledger.json"
-    )
+    expandHomeRelativePath(env.REMNIC_BENCH_CODEX_CREDIT_LEDGER?.trim() || ".remnic/bench/codex-credit-ledger.json")
   );
   const runId = parseOptionalRunId(env.REMNIC_BENCH_RUN_ID) ?? parseOptionalRunId(fallbackRunId);
   return {
     budgetCredits,
     reserveCredits,
     ledgerPath,
-    allowSol: /^(?:1|true|yes|on)$/i.test(
-      env.REMNIC_BENCH_CODEX_ALLOW_SOL?.trim() ?? ""
-    ),
+    allowSol: /^(?:1|true|yes|on)$/i.test(env.REMNIC_BENCH_CODEX_ALLOW_SOL?.trim() ?? ""),
     ...runId ? { runId } : {}
   };
 }
@@ -6071,6 +6127,12 @@ async function runWithinCodexCreditBudget(args) {
   if (!args.config) {
     return (await args.run()).value;
   }
+  try {
+    budgetUnitsToNanounits(args.config.budgetCredits);
+    budgetUnitsToNanounits(args.config.reserveCredits);
+  } catch (error) {
+    throw infrastructureUnavailableError(error);
+  }
   const previous = completionQueue;
   let release;
   completionQueue = new Promise((resolve) => {
@@ -6081,21 +6143,36 @@ async function runWithinCodexCreditBudget(args) {
   let lock;
   let dispatchStarted = false;
   let accountingSettled = false;
+  let ledgerCommitted = false;
   try {
-    await mkdir2(path3.dirname(lockPath), { recursive: true, mode: 448 });
+    try {
+      await prepareLedgerDirectory(lockPath);
+    } catch (error) {
+      throw infrastructureUnavailableError(error);
+    }
     lock = await acquireLedgerLock(lockPath);
     assertModelAllowed(args.model, args.config);
     const ledger = await readLedger(args.config);
-    if (ledger.blockedReason) {
-      throw new Error(
-        `Codex credit ledger is blocked pending manual reconciliation: ${ledger.blockedReason}`
+    if (ledger.blockedEvent) {
+      throw new BenchmarkRunBlockedError(
+        BenchmarkRunBlockReason.ManualReconciliationRequired,
+        "Codex credit ledger requires manual reconciliation.",
+        { cause: new Error(`Private ledger block: ${ledger.blockedEvent.reason}`) }
       );
     }
-    const usableCredits = args.config.budgetCredits - args.config.reserveCredits;
-    const dispatchHeadroom = usableCredits - ledger.spentCredits;
-    if (dispatchHeadroom < MAX_BOUNDED_CALL_CREDITS) {
-      throw new Error(
-        `Codex credit budget cannot safely dispatch another call: ${ledger.spentCredits.toFixed(3)} spent; ${dispatchHeadroom.toFixed(3)} remains below the ${usableCredits.toFixed(3)} planned-spend ceiling, but ${MAX_BOUNDED_CALL_CREDITS.toFixed(3)} credits of worst-case call headroom are required.`
+    const usableNanounits = budgetUnitsToNanounits(args.config.budgetCredits) - budgetUnitsToNanounits(args.config.reserveCredits);
+    const usableCredits = nanounitsToBudgetUnits(usableNanounits);
+    const spentNanounits = ledgerSpentNanounits(ledger);
+    const dispatchHeadroomNanounits = usableNanounits - spentNanounits;
+    if (dispatchHeadroomNanounits < budgetUnitsToNanounits(MAX_BOUNDED_CALL_CREDITS)) {
+      throw new BenchmarkRunBlockedError(
+        BenchmarkRunBlockReason.SpendHeadroomExhausted,
+        "Codex credit budget lacks conservative dispatch headroom.",
+        {
+          cause: new Error(
+            `${nanounitsToBudgetUnits(spentNanounits)} local units spent; ${nanounitsToBudgetUnits(dispatchHeadroomNanounits)} available; ${MAX_BOUNDED_CALL_CREDITS} required.`
+          )
+        }
       );
     }
     await writeLockState(lock, "in-flight");
@@ -6105,42 +6182,74 @@ async function runWithinCodexCreditBudget(args) {
       result = await args.run();
     } catch (error) {
       if (error instanceof CodexCreditDispatchError) {
-        await writeLockState(lock, "settled");
-        accountingSettled = true;
-      } else {
-        const blockedLedger = {
-          ...ledger,
-          blockedReason: error instanceof CodexCreditAccountingError ? error.message : `Codex dispatch outcome is unknown after an unexpected error: ${safeErrorMessage(error)}`
-        };
-        await writeLedger(args.config.ledgerPath, blockedLedger);
-        await writeLockState(lock, "settled");
         accountingSettled = true;
+        await bestEffortSettleLock(lock);
+        throw new BenchmarkRunBlockedError(
+          BenchmarkRunBlockReason.InfrastructureUnavailable,
+          "Codex CLI infrastructure was unavailable before dispatch.",
+          { cause: error }
+        );
       }
-      throw error;
+      const blockedLedger = {
+        ...ledger,
+        blockedEvent: {
+          at: (/* @__PURE__ */ new Date()).toISOString(),
+          ...args.config.runId ? { runId: args.config.runId } : {},
+          model: args.model,
+          reason: error instanceof CodexCreditAccountingError ? error.message : `Codex dispatch outcome is unknown after an unexpected error: ${safeErrorMessage(error)}`
+        }
+      };
+      try {
+        await writeLedger(args.config.ledgerPath, blockedLedger);
+      } catch (persistenceError) {
+        throw accountingPersistenceBlockedError(persistenceError, error);
+      }
+      ledgerCommitted = true;
+      accountingSettled = true;
+      await bestEffortSettleLock(lock);
+      throw new BenchmarkRunBlockedError(
+        BenchmarkRunBlockReason.ManualReconciliationRequired,
+        "Codex usage accounting is uncertain; manual reconciliation is required.",
+        {
+          cause: error
+        }
+      );
     }
-    const credits = calculateCodexCredits(args.model, result.usage);
-    const nextSpent = ledger.spentCredits + credits;
+    const creditNanounits = calculateCodexBudgetNanounits(args.model, result.usage);
+    const credits = nanounitsToBudgetUnits(creditNanounits);
+    const nextSpentNanounits = spentNanounits + creditNanounits;
+    const nextSpent = nanounitsToBudgetUnits(nextSpentNanounits);
     const nextLedger = {
       ...ledger,
-      spentCredits: nextSpent,
+      spentUnits: nextSpent,
       entries: [
         ...ledger.entries,
         {
           at: (/* @__PURE__ */ new Date()).toISOString(),
           model: args.model,
-          credits,
+          budgetUnits: credits,
           ...args.config.runId ? { runId: args.config.runId } : {},
           ...result.usage
         }
       ]
     };
-    await writeLedger(args.config.ledgerPath, nextLedger);
-    await writeLockState(lock, "settled");
+    try {
+      await writeLedger(args.config.ledgerPath, nextLedger);
+    } catch (error) {
+      throw accountingPersistenceBlockedError(error);
+    }
+    ledgerCommitted = true;
     accountingSettled = true;
-    args.onUsagePersisted?.(result.usage);
-    if (nextSpent > usableCredits) {
-      throw new Error(
-        `Codex planned-spend ceiling exceeded by completed call: ${nextSpent.toFixed(3)} > ${usableCredits.toFixed(3)} credits. Usage was persisted; stop the benchmark immediately.`
+    await bestEffortSettleLock(lock);
+    try {
+      args.onUsagePersisted?.(result.usage);
+    } catch {
+    }
+    if (nextSpentNanounits > usableNanounits) {
+      throw new BenchmarkRunBlockedError(
+        BenchmarkRunBlockReason.SpendCeilingExceeded,
+        "Codex planned-spend ceiling was exceeded by committed usage.",
+        { cause: new Error(`${nextSpent} local units spent exceeds the ${usableCredits} planned ceiling.`) }
       );
     }
     return result.value;
@@ -6148,10 +6257,10 @@ async function runWithinCodexCreditBudget(args) {
     try {
       if (lock) {
         try {
-          await lock.close();
+          await bestEffortCloseLock(lock);
         } finally {
-          if (!dispatchStarted || accountingSettled) {
-            await removeOwnedLedgerLock(lockPath);
+          if (!dispatchStarted || accountingSettled || ledgerCommitted) {
+            await bestEffortRemoveOwnedLedgerLock(lockPath);
           }
         }
       }
@@ -6165,11 +6274,13 @@ async function acquireLedgerLock(lockPath) {
     try {
       await mkdir2(lockPath, { mode: 448 });
     } catch (error) {
-      if (error.code !== "EEXIST") throw error;
+      if (error.code !== "EEXIST") throw infrastructureUnavailableError(error);
       const owner = await readLockOwner(lockPath);
       if (!owner || isProcessAlive(owner.pid) || owner.phase === "in-flight") {
-        throw new Error(
-          `Codex credit ledger is locked${owner?.phase === "in-flight" ? " with unreconciled in-flight usage" : " by another benchmark process"} (${lockPath}); refusing credit spend.`
+        throw resourceLockedError(
+          new Error(
+            `Codex credit ledger is locked${owner?.phase === "in-flight" ? " with unreconciled in-flight usage" : " by another benchmark process"} (${lockPath}); refusing credit spend.`
+          )
         );
       }
       await reclaimStaleLedgerLock(lockPath, owner);
@@ -6186,10 +6297,10 @@ async function acquireLedgerLock(lockPath) {
       await unlink2(lockOwnerPath(lockPath)).catch(() => void 0);
       await rmdir(lockHeldPath(lockPath)).catch(() => void 0);
       await rmdir(lockPath).catch(() => void 0);
-      throw error;
+      throw infrastructureUnavailableError(error);
     }
   }
-  throw new Error(`Unable to acquire Codex credit ledger lock (${lockPath})`);
+  throw resourceLockedError(new Error(`Unable to acquire Codex credit ledger lock (${lockPath})`));
 }
 async function readLockOwner(lockPath) {
   try {
@@ -6206,14 +6317,17 @@ async function reclaimStaleLedgerLock(lockPath, expectedOwner) {
   try {
     await rmdir(lockHeldPath(lockPath));
   } catch (error) {
-    throw new Error(
-      `Codex credit ledger stale-lock reclamation is already claimed or incomplete (${lockPath}); refusing credit spend: ${safeErrorMessage(error)}`
+    throw resourceLockedError(
+      new Error(
+        `Codex credit ledger stale-lock reclamation is already claimed or incomplete (${lockPath}); refusing credit spend: ${safeErrorMessage(error)}`,
+        { cause: error }
+      )
     );
   }
   const currentOwner = await readLockOwner(lockPath);
   if (!currentOwner || currentOwner.pid !== expectedOwner.pid || currentOwner.phase !== expectedOwner.phase || isProcessAlive(currentOwner.pid) || currentOwner.phase === "in-flight") {
-    throw new Error(
-      `Codex credit ledger owner changed during stale-lock reclamation (${lockPath}); refusing credit spend.`
+    throw resourceLockedError(
+      new Error(`Codex credit ledger owner changed during stale-lock reclamation (${lockPath}); refusing credit spend.`)
     );
   }
   await unlink2(lockOwnerPath(lockPath));
@@ -6231,6 +6345,10 @@ function lockHeldPath(lockPath) {
   return path3.join(lockPath, "held");
 }
 async function writeLockState(lock, phase) {
+  if (phase === "settled" && failNextSettledLockWriteForTest) {
+    failNextSettledLockWriteForTest = false;
+    throw new Error("injected settled lock-state failure");
+  }
   const contents = `${JSON.stringify({
     pid: process.pid,
     phase,
@@ -6259,12 +6377,8 @@ function parseCodexJsonlUsage(output) {
       if (event.type !== "turn.completed" || !event.usage) continue;
       const inputTokens = readCounter(event.usage.input_tokens);
       const outputTokens = readCounter(event.usage.output_tokens);
-      const cachedInputTokens = readOptionalCounter(
-        event.usage.cached_input_tokens
-      );
-      const reasoningOutputTokens = readOptionalCounter(
-        event.usage.reasoning_output_tokens
-      );
+      const cachedInputTokens = readOptionalCounter(event.usage.cached_input_tokens);
+      const reasoningOutputTokens = readOptionalCounter(event.usage.reasoning_output_tokens);
       if (inputTokens !== void 0 && outputTokens !== void 0 && cachedInputTokens !== void 0 && reasoningOutputTokens !== void 0) {
         usage = {
           inputTokens,
@@ -6278,29 +6392,38 @@ function parseCodexJsonlUsage(output) {
   }
   return usage;
 }
-function calculateCodexCredits(model, usage) {
+function calculateCodexBudgetUnits(model, usage) {
+  return nanounitsToBudgetUnits(calculateCodexBudgetNanounits(model, usage));
+}
+function calculateCodexBudgetNanounits(model, usage) {
   const rate = resolveRate(model);
   const cached = Math.min(usage.inputTokens, usage.cachedInputTokens);
   const uncached = usage.inputTokens - cached;
-  return (uncached * rate.input + cached * rate.cachedInput + usage.outputTokens * rate.output) / ONE_MILLION;
+  return BigInt(uncached) * rateNanounitsPerToken(rate.input) + BigInt(cached) * rateNanounitsPerToken(rate.cachedInput) + BigInt(usage.outputTokens) * rateNanounitsPerToken(rate.output);
 }
 async function buildCodexCreditReceipt(ledgerPath, runId) {
   const resolvedPath = path3.resolve(expandHomeRelativePath(ledgerPath));
   const contents = await readFile3(resolvedPath);
-  const ledger = parseLedger(JSON.parse(contents.toString("utf8")));
+  const ledger = parseLedger(JSON.parse(contents.toString("utf8")), contents);
   const normalizedRunId = parseOptionalRunId(runId);
-  const reconciliations = ledger.reconciliations ?? [];
-  const cumulative = summarizeLedgerEntries(ledger.entries, reconciliations);
+  const spentNanounits = ledgerSpentNanounits(ledger);
+  const budgetNanounits = budgetUnitsToNanounits(ledger.budgetUnits);
+  const reserveNanounits = budgetUnitsToNanounits(ledger.reserveUnits);
+  const cumulative = summarizeLedgerEntries(
+    ledger.entries,
+    ledger.resolutions ?? [],
+    ledger.legacyReconciliations ?? []
+  );
   const runEntries = normalizedRunId ? ledger.entries.filter((entry) => entry.runId === normalizedRunId) : [];
   return {
-    schemaVersion: 1,
+    schemaVersion: 2,
     ledgerSha256: sha256(contents),
-    budgetCredits: ledger.budgetCredits,
-    reserveCredits: ledger.reserveCredits,
-    plannedSpendCeilingCredits: ledger.budgetCredits - ledger.reserveCredits,
-    totalSpentCredits: ledger.spentCredits,
-    totalRemainingCredits: ledger.budgetCredits - ledger.spentCredits,
-    blocked: ledger.blockedReason !== void 0,
+    budgetUnits: ledger.budgetUnits,
+    reserveUnits: ledger.reserveUnits,
+    plannedSpendCeilingUnits: nanounitsToBudgetUnits(budgetNanounits - reserveNanounits),
+    totalSpentUnits: nanounitsToBudgetUnits(spentNanounits),
+    remainingBudgetUnits: nanounitsToBudgetUnits(budgetNanounits - spentNanounits),
+    blocked: ledger.blockedEvent !== void 0,
     cumulative,
     ...normalizedRunId ? {
       run: {
@@ -6320,52 +6443,85 @@ function resolveRate(model) {
   return match[1];
 }
 function assertModelAllowed(model, config) {
-  resolveRate(model);
+  try {
+    resolveRate(model);
+  } catch (error) {
+    throw new BenchmarkRunBlockedError(
+      BenchmarkRunBlockReason.InfrastructureUnavailable,
+      "Configured Codex model is unsupported by the bounded budget.",
+      { cause: error }
+    );
+  }
   if (SOL_MODEL.test(model) && !config.allowSol) {
-    throw new Error(
-      "gpt-5.6-sol is disabled for bounded benchmark runs because it is the most expensive GPT-5.6 tier. Use gpt-5.6-terra or gpt-5.6-luna, or explicitly set REMNIC_BENCH_CODEX_ALLOW_SOL=1."
+    throw new BenchmarkRunBlockedError(
+      BenchmarkRunBlockReason.InfrastructureUnavailable,
+      "Configured Codex model is disallowed by bounded-budget policy.",
+      {
+        cause: new Error(
+          "gpt-5.6-sol is disabled for bounded benchmark runs because it is the most expensive GPT-5.6 tier. Use gpt-5.6-terra or gpt-5.6-luna, or explicitly set REMNIC_BENCH_CODEX_ALLOW_SOL=1."
+        )
+      }
     );
   }
 }
 async function readLedger(config) {
   try {
-    const parsed = parseLedger(
-      JSON.parse(await readFile3(config.ledgerPath, "utf8"))
-    );
-    if (parsed.budgetCredits !== config.budgetCredits || parsed.reserveCredits !== config.reserveCredits) {
+    const contents = await readFile3(config.ledgerPath);
+    const parsed = parseLedger(JSON.parse(contents.toString("utf8")), contents);
+    if (parsed.budgetUnits !== config.budgetCredits || parsed.reserveUnits !== config.reserveCredits) {
       throw new Error("ledger schema or budget does not match this run");
     }
     return parsed;
   } catch (error) {
     if (error.code !== "ENOENT") {
-      throw new Error(`Invalid Codex credit ledger at ${config.ledgerPath}: ${String(error)}`);
+      throw new BenchmarkRunBlockedError(
+        BenchmarkRunBlockReason.ManualReconciliationRequired,
+        "Codex credit ledger is invalid or incompatible with this run.",
+        { cause: new Error(`Invalid Codex credit ledger at ${config.ledgerPath}: ${String(error)}`, { cause: error }) }
+      );
     }
     return {
-      schemaVersion: 1,
-      budgetCredits: config.budgetCredits,
-      reserveCredits: config.reserveCredits,
-      spentCredits: 0,
+      schemaVersion: 2,
+      budgetUnits: config.budgetCredits,
+      reserveUnits: config.reserveCredits,
+      spentUnits: 0,
       entries: []
     };
   }
 }
-function parseLedger(parsed) {
-  const entryCredits = Array.isArray(parsed.entries) ? parsed.entries.reduce(
-    (sum, entry) => sum + (typeof entry?.credits === "number" ? entry.credits ?? 0 : 0),
-    0
-  ) : Number.NaN;
-  const reconciliationCredits = parsed.reconciliations === void 0 ? 0 : Array.isArray(parsed.reconciliations) ? parsed.reconciliations.reduce(
-    (sum, reconciliation) => sum + (typeof reconciliation?.credits === "number" ? reconciliation.credits ?? 0 : 0),
-    0
-  ) : Number.NaN;
-  if (parsed.schemaVersion !== 1 || typeof parsed.budgetCredits !== "number" || !Number.isFinite(parsed.budgetCredits) || parsed.budgetCredits <= 0 || typeof parsed.reserveCredits !== "number" || !Number.isFinite(parsed.reserveCredits) || parsed.reserveCredits < 0 || parsed.reserveCredits >= parsed.budgetCredits || typeof parsed.spentCredits !== "number" || !Number.isFinite(parsed.spentCredits) || parsed.spentCredits < 0 || !Array.isArray(parsed.entries) || !parsed.entries.every(isLedgerEntry) || parsed.reconciliations !== void 0 && (!Array.isArray(parsed.reconciliations) || !parsed.reconciliations.every(
-    (reconciliation) => isLedgerReconciliationWithinBudget(reconciliation, parsed.budgetCredits)
-  )) || Math.abs(entryCredits + reconciliationCredits - parsed.spentCredits) > 1e-9 || parsed.blockedReason !== void 0 && typeof parsed.blockedReason !== "string") {
+function parseLedger(parsed, sourceContents) {
+  if (isLedgerV1(parsed)) return migrateLedgerV1(parsed, sourceContents);
+  if (!parsed || typeof parsed !== "object") throw new Error("ledger schema is invalid");
+  const candidate = parsed;
+  if (candidate.schemaVersion !== 2 || !isPositiveFinite(candidate.budgetUnits) || !isSupportedBudgetUnits(candidate.budgetUnits) || !isNonNegativeFinite(candidate.reserveUnits) || !isSupportedBudgetUnits(candidate.reserveUnits) || candidate.reserveUnits >= candidate.budgetUnits || !isNonNegativeFinite(candidate.spentUnits) || !Array.isArray(candidate.entries) || !candidate.entries.every(isLedgerEntry) || candidate.resolutions !== void 0 && (!Array.isArray(candidate.resolutions) || !candidate.resolutions.every(isLedgerResolution)) || candidate.legacyReconciliations !== void 0 && (!Array.isArray(candidate.legacyReconciliations) || !candidate.legacyReconciliations.every(isLedgerReconciliationV1)) || !isLedgerSpentConsistent(candidate) || !isResolutionHistoryConsistent(candidate) || !isMigrationWitnessConsistent(candidate) || candidate.blockedEvent !== void 0 && !isBlockedEvent(candidate.blockedEvent) || candidate.migratedFromV1Sha256 !== void 0 && !isSha256(candidate.migratedFromV1Sha256)) {
     throw new Error("ledger schema is invalid");
   }
-  return parsed;
+  return candidate;
+}
+function isLedgerV1(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  const entries = candidate.entries;
+  const reconciliations = candidate.reconciliations;
+  return candidate.schemaVersion === 1 && isPositiveFinite(candidate.budgetCredits) && isSupportedBudgetUnits(candidate.budgetCredits) && isNonNegativeFinite(candidate.reserveCredits) && isSupportedBudgetUnits(candidate.reserveCredits) && candidate.reserveCredits < candidate.budgetCredits && isNonNegativeFinite(candidate.spentCredits) && Array.isArray(entries) && entries.every(isLedgerEntryV1) && (reconciliations === void 0 || Array.isArray(reconciliations) && reconciliations.every((item) => isLedgerReconciliationWithinBudgetV1(item, candidate.budgetCredits))) && isLedgerV1SpentConsistent(candidate) && (candidate.blockedReason === void 0 || typeof candidate.blockedReason === "string" && candidate.blockedReason.length > 0);
 }
-function isLedgerReconciliation(value) {
+function migrateLedgerV1(ledger, sourceContents) {
+  const source = sourceContents ? Buffer.from(sourceContents).toString("utf8") : `${JSON.stringify(ledger)}
+`;
+  const spentUnits = nanounitsToBudgetUnits(ledgerV1SpentNanounits(ledger));
+  return {
+    schemaVersion: 2,
+    budgetUnits: ledger.budgetCredits,
+    reserveUnits: ledger.reserveCredits,
+    spentUnits,
+    entries: ledger.entries.map(({ credits, ...entry }) => ({ ...entry, budgetUnits: credits })),
+    ...ledger.reconciliations?.length ? { legacyReconciliations: ledger.reconciliations } : {},
+    migratedFromV1Sha256: sha256(source),
+    migrationWitnessV1: { source },
+    ...ledger.blockedReason ? { blockedEvent: { reason: ledger.blockedReason } } : {}
+  };
+}
+function isLedgerReconciliationV1(value) {
   if (!value || typeof value !== "object") return false;
   const candidate = value;
   const forbiddenUsageFields = [
@@ -6377,26 +6533,118 @@ function isLedgerReconciliation(value) {
     "outputTokens",
     "reasoningOutputTokens"
   ];
-  return forbiddenUsageFields.every((field) => !Object.prototype.hasOwnProperty.call(candidate, field)) && isIsoTimestamp(candidate.at) && candidate.basis === "operator-observed-original-budget-balance" && candidate.attribution === "account-wide-unattributed" && isSha256(candidate.priorLedgerSha256) && typeof candidate.originalBudgetCredits === "number" && Number.isFinite(candidate.originalBudgetCredits) && candidate.originalBudgetCredits > 0 && typeof candidate.priorRecordedSpentCredits === "number" && Number.isFinite(candidate.priorRecordedSpentCredits) && candidate.priorRecordedSpentCredits >= 0 && typeof candidate.observedRemainingCredits === "number" && Number.isFinite(candidate.observedRemainingCredits) && candidate.observedRemainingCredits >= 0 && typeof candidate.credits === "number" && Number.isFinite(candidate.credits) && candidate.credits >= 0 && candidate.confirmations?.observedBalanceBelongsToOriginalBudget === true && candidate.confirmations.noCreditsAddedOrRefunded === true && candidate.confirmations.accountWideUnattributedChargeAccepted === true && isValidStoredRunId(candidate.affectedBlockedEvent?.runId) && typeof candidate.affectedBlockedEvent?.blockedReason === "string" && candidate.affectedBlockedEvent.blockedReason.length > 0;
+  return forbiddenUsageFields.every((field) => !Object.prototype.hasOwnProperty.call(candidate, field)) && isIsoTimestamp(candidate.at) && candidate.basis === "operator-observed-original-budget-balance" && candidate.attribution === "account-wide-unattributed" && isSha256(candidate.priorLedgerSha256) && typeof candidate.originalBudgetCredits === "number" && Number.isFinite(candidate.originalBudgetCredits) && candidate.originalBudgetCredits > 0 && isSupportedBudgetUnits(candidate.originalBudgetCredits) && typeof candidate.priorRecordedSpentCredits === "number" && Number.isFinite(candidate.priorRecordedSpentCredits) && candidate.priorRecordedSpentCredits >= 0 && isSupportedBudgetUnits(candidate.priorRecordedSpentCredits) && typeof candidate.observedRemainingCredits === "number" && Number.isFinite(candidate.observedRemainingCredits) && candidate.observedRemainingCredits >= 0 && isSupportedBudgetUnits(candidate.observedRemainingCredits) && typeof candidate.credits === "number" && Number.isFinite(candidate.credits) && candidate.credits >= 0 && isSupportedBudgetUnits(candidate.credits) && candidate.confirmations?.observedBalanceBelongsToOriginalBudget === true && candidate.confirmations.noCreditsAddedOrRefunded === true && candidate.confirmations.accountWideUnattributedChargeAccepted === true && isValidStoredRunId(candidate.affectedBlockedEvent?.runId) && typeof candidate.affectedBlockedEvent?.blockedReason === "string" && candidate.affectedBlockedEvent.blockedReason.length > 0;
 }
-function isLedgerReconciliationWithinBudget(value, budget) {
-  return typeof budget === "number" && isLedgerReconciliation(value) && value.originalBudgetCredits === budget && value.observedRemainingCredits <= budget && value.credits <= budget && Math.abs(
-    value.priorRecordedSpentCredits + value.credits + value.observedRemainingCredits - budget
-  ) <= 1e-9;
+function isLedgerReconciliationWithinBudgetV1(value, budget) {
+  return typeof budget === "number" && isLedgerReconciliationV1(value) && value.originalBudgetCredits === budget && value.observedRemainingCredits <= budget && value.credits <= budget && Math.abs(value.priorRecordedSpentCredits + value.credits + value.observedRemainingCredits - budget) <= 1e-9;
+}
+function isLedgerResolution(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return isIsoTimestamp(candidate.at) && candidate.basis === "operator-observed-account-balance-delta" && candidate.attribution === "account-wide-observation-window" && isSha256(candidate.priorLedgerSha256) && isNonNegativeFinite(candidate.priorRecordedSpentUnits) && Number.isSafeInteger(candidate.priorEntryCount) && candidate.priorEntryCount >= 0 && typeof candidate.beforeAccountBalance === "string" && isExactDecimal(candidate.beforeAccountBalance) && typeof candidate.afterAccountBalance === "string" && isExactDecimal(candidate.afterAccountBalance) && typeof candidate.observedAccountDebit === "string" && isExactDecimal(candidate.observedAccountDebit) && subtractExactDecimals(candidate.beforeAccountBalance, candidate.afterAccountBalance) === candidate.observedAccountDebit && (candidate.localBudgetChargeUnits === 0 || candidate.localBudgetChargeUnits === MAX_BOUNDED_CALL_CREDITS) && (candidate.observedAccountDebit === "0" ? candidate.localBudgetChargeUnits === 0 : candidate.localBudgetChargeUnits === MAX_BOUNDED_CALL_CREDITS) && candidate.confirmations?.sameAccount === true && candidate.confirmations.snapshotsBracketBlockedEvent === true && candidate.confirmations.balanceSettled === true && candidate.confirmations.noCreditsAddedOrRefunded === true && (candidate.observedAccountDebit === "0" || candidate.confirmations.noInterveningCodexActivity === true) && isValidStoredRunId(candidate.affectedRunId) && isBlockedEvent(candidate.affectedBlockedEvent) && (candidate.affectedBlockedEvent.runId === void 0 || candidate.affectedBlockedEvent.runId === candidate.affectedRunId);
+}
+function isResolutionHistoryConsistent(ledger) {
+  const resolutions = ledger.resolutions ?? [];
+  if (resolutions.length === 0) return true;
+  const legacyNanounits = sumBudgetUnitNanounits(
+    (ledger.legacyReconciliations ?? []).map((reconciliation) => reconciliation.credits)
+  );
+  let priorResolutionNanounits = 0n;
+  let priorEntryCount = 0;
+  const seenHashes = /* @__PURE__ */ new Set();
+  for (let index = 0; index < resolutions.length; index += 1) {
+    const resolution = resolutions[index];
+    if (!resolution) return false;
+    if (seenHashes.has(resolution.priorLedgerSha256)) return false;
+    seenHashes.add(resolution.priorLedgerSha256);
+    if (resolution.priorEntryCount < priorEntryCount || resolution.priorEntryCount > ledger.entries.length)
+      return false;
+    const entriesBeforeResolution = ledger.entries.slice(0, resolution.priorEntryCount);
+    const expectedPriorSpentNanounits = sumBudgetUnitNanounits(entriesBeforeResolution.map((entry) => entry.budgetUnits)) + legacyNanounits + priorResolutionNanounits;
+    if (budgetUnitsToNanounits(resolution.priorRecordedSpentUnits) !== expectedPriorSpentNanounits) return false;
+    if (!(index === 0 && isDirectV1PredecessorResolution(ledger, resolution))) {
+      const priorLedger = {
+        ...ledger,
+        spentUnits: resolution.priorRecordedSpentUnits,
+        entries: entriesBeforeResolution,
+        resolutions: index > 0 ? resolutions.slice(0, index) : void 0,
+        blockedEvent: resolution.affectedBlockedEvent
+      };
+      if (sha256(serializeLedger(priorLedger)) !== resolution.priorLedgerSha256) return false;
+    }
+    priorResolutionNanounits += budgetUnitsToNanounits(resolution.localBudgetChargeUnits);
+    priorEntryCount = resolution.priorEntryCount;
+  }
+  return true;
+}
+function isMigrationWitnessConsistent(ledger) {
+  if (!ledger.migratedFromV1Sha256 && !ledger.migrationWitnessV1) return true;
+  if (!ledger.migratedFromV1Sha256 || !ledger.migrationWitnessV1) return false;
+  const source = ledger.migrationWitnessV1.source;
+  if (typeof source !== "string" || sha256(source) !== ledger.migratedFromV1Sha256) return false;
+  let predecessor;
+  try {
+    predecessor = JSON.parse(source);
+  } catch {
+    return false;
+  }
+  if (!isLedgerV1(predecessor)) return false;
+  if (predecessor.budgetCredits !== ledger.budgetUnits || predecessor.reserveCredits !== ledger.reserveUnits)
+    return false;
+  if (JSON.stringify(predecessor.reconciliations ?? []) !== JSON.stringify(ledger.legacyReconciliations ?? [])) {
+    return false;
+  }
+  const migratedEntries = predecessor.entries.map(({ credits, ...entry }) => ({ ...entry, budgetUnits: credits }));
+  const firstResolution = ledger.resolutions?.[0];
+  const entriesAtMigration = firstResolution ? ledger.entries.slice(0, firstResolution.priorEntryCount) : ledger.entries.slice(0, migratedEntries.length);
+  if (JSON.stringify(migratedEntries) !== JSON.stringify(entriesAtMigration.slice(0, migratedEntries.length))) {
+    return false;
+  }
+  return true;
+}
+function isDirectV1PredecessorResolution(ledger, resolution) {
+  if (!ledger.migratedFromV1Sha256 || !ledger.migrationWitnessV1) return false;
+  let predecessor;
+  try {
+    predecessor = JSON.parse(ledger.migrationWitnessV1.source);
+  } catch {
+    return false;
+  }
+  return isLedgerV1(predecessor) && resolution.priorEntryCount === predecessor.entries.length && resolution.priorLedgerSha256 === ledger.migratedFromV1Sha256 && budgetUnitsToNanounits(resolution.priorRecordedSpentUnits) === ledgerV1SpentNanounits(predecessor) && predecessor.blockedReason === resolution.affectedBlockedEvent.reason;
+}
+function isBlockedEvent(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return typeof candidate.reason === "string" && candidate.reason.length > 0 && (candidate.at === void 0 || isIsoTimestamp(candidate.at)) && (candidate.runId === void 0 || isValidStoredRunId(candidate.runId)) && (candidate.model === void 0 || typeof candidate.model === "string" && candidate.model.length > 0);
+}
+function isLedgerEntryV1(entry) {
+  if (!entry || typeof entry !== "object") return false;
+  const candidate = entry;
+  return isLedgerEntryCommon(candidate) && isNonNegativeFinite(candidate.credits) && isSupportedBudgetUnits(candidate.credits) && isEntryCreditConsistentV1(candidate);
 }
 function isLedgerEntry(entry) {
   if (!entry || typeof entry !== "object") return false;
   const candidate = entry;
-  return typeof candidate.at === "string" && typeof candidate.model === "string" && candidate.model.length > 0 && typeof candidate.credits === "number" && Number.isFinite(candidate.credits) && candidate.credits >= 0 && (candidate.runId === void 0 || isValidStoredRunId(candidate.runId)) && readCounter(candidate.inputTokens) !== void 0 && readCounter(candidate.cachedInputTokens) !== void 0 && readCounter(candidate.outputTokens) !== void 0 && readCounter(candidate.reasoningOutputTokens) !== void 0 && (candidate.cachedInputTokens ?? 0) <= (candidate.inputTokens ?? 0) && isEntryCreditConsistent(candidate);
+  return isIsoTimestamp(candidate.at) && typeof candidate.model === "string" && candidate.model.length > 0 && isNonNegativeFinite(candidate.budgetUnits) && (candidate.runId === void 0 || isValidStoredRunId(candidate.runId)) && readCounter(candidate.inputTokens) !== void 0 && readCounter(candidate.cachedInputTokens) !== void 0 && readCounter(candidate.outputTokens) !== void 0 && readCounter(candidate.reasoningOutputTokens) !== void 0 && (candidate.cachedInputTokens ?? 0) <= (candidate.inputTokens ?? 0) && isEntryBudgetUnitConsistent(candidate);
 }
-function isEntryCreditConsistent(entry) {
+function isLedgerEntryCommon(candidate) {
+  return isIsoTimestamp(candidate.at) && typeof candidate.model === "string" && candidate.model.length > 0 && (candidate.runId === void 0 || isValidStoredRunId(candidate.runId)) && readCounter(candidate.inputTokens) !== void 0 && readCounter(candidate.cachedInputTokens) !== void 0 && readCounter(candidate.outputTokens) !== void 0 && readCounter(candidate.reasoningOutputTokens) !== void 0 && (candidate.cachedInputTokens ?? 0) <= (candidate.inputTokens ?? 0);
+}
+function isEntryCreditConsistentV1(entry) {
   try {
-    return Math.abs(calculateCodexCredits(entry.model, entry) - entry.credits) <= 1e-9;
+    return Math.abs(calculateCodexBudgetUnits(entry.model, entry) - entry.credits) <= 1e-9;
   } catch {
     return false;
   }
 }
-function summarizeLedgerEntries(entries, reconciliations = []) {
+function isEntryBudgetUnitConsistent(entry) {
+  try {
+    return Math.abs(calculateCodexBudgetUnits(entry.model, entry) - entry.budgetUnits) <= 1e-9;
+  } catch {
+    return false;
+  }
+}
+function summarizeLedgerEntries(entries, resolutions = [], legacyReconciliations = []) {
   const byModel = /* @__PURE__ */ new Map();
   for (const entry of entries) {
     const modelEntries = byModel.get(entry.model) ?? [];
@@ -6406,17 +6654,18 @@ function summarizeLedgerEntries(entries, reconciliations = []) {
   const totals = summarizeUsage(entries);
   return {
     calls: entries.length,
-    credits: entries.reduce((sum, entry) => sum + entry.credits, 0) + reconciliations.reduce((sum, reconciliation) => sum + reconciliation.credits, 0),
-    unattributedReconciliationCount: reconciliations.length,
-    unattributedReconciledCredits: reconciliations.reduce(
-      (sum, reconciliation) => sum + reconciliation.credits,
-      0
+    budgetUnits: nanounitsToBudgetUnits(
+      sumBudgetUnitNanounits(entries.map((entry) => entry.budgetUnits)) + sumBudgetUnitNanounits(resolutions.map((resolution) => resolution.localBudgetChargeUnits)) + sumBudgetUnitNanounits(legacyReconciliations.map((reconciliation) => reconciliation.credits))
+    ),
+    accountBalanceResolutionCount: resolutions.length + legacyReconciliations.length,
+    conservativeResolutionChargeUnits: nanounitsToBudgetUnits(
+      sumBudgetUnitNanounits(resolutions.map((resolution) => resolution.localBudgetChargeUnits)) + sumBudgetUnitNanounits(legacyReconciliations.map((reconciliation) => reconciliation.credits))
     ),
     ...totals,
     models: [...byModel.entries()].sort(([left], [right]) => left.localeCompare(right)).map(([model, modelEntries]) => ({
       model,
       calls: modelEntries.length,
-      credits: modelEntries.reduce((sum, entry) => sum + entry.credits, 0),
+      budgetUnits: nanounitsToBudgetUnits(sumBudgetUnitNanounits(modelEntries.map((entry) => entry.budgetUnits))),
       ...summarizeUsage(modelEntries)
     }))
   };
@@ -6433,14 +6682,23 @@ function summarizeUsage(entries) {
   );
 }
 async function writeLedger(filePath, ledger) {
+  if (failNextLedgerWriteForTest) {
+    failNextLedgerWriteForTest = false;
+    throw new Error(`injected ledger write failure for ${filePath}`);
+  }
   await mkdir2(path3.dirname(filePath), { recursive: true, mode: 448 });
   const tempPath = `${filePath}.${process.pid}.tmp`;
-  await writeFile2(tempPath, `${JSON.stringify(ledger, null, 2)}
-`, {
+  const contents = serializeLedger(ledger);
+  await writeFile2(tempPath, contents, {
     encoding: "utf8",
     mode: 384
   });
   await rename2(tempPath, filePath);
+  return { contents, sha256: sha256(contents) };
+}
+function serializeLedger(ledger) {
+  return `${JSON.stringify(ledger, null, 2)}
+`;
 }
 function readCounter(value) {
   return Number.isSafeInteger(value) && value >= 0 ? value : void 0;
@@ -6451,6 +6709,55 @@ function readOptionalCounter(value) {
 function safeErrorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
+function resourceLockedError(cause) {
+  const original = cause instanceof Error ? cause : new Error("Codex credit ledger lock acquisition failed.");
+  return new BenchmarkRunBlockedError(
+    BenchmarkRunBlockReason.ResourceLocked,
+    "Codex credit ledger resource is locked.",
+    { cause: original }
+  );
+}
+function infrastructureUnavailableError(cause) {
+  const original = cause instanceof Error ? cause : new Error("Codex ledger infrastructure setup failed.");
+  return new BenchmarkRunBlockedError(
+    BenchmarkRunBlockReason.InfrastructureUnavailable,
+    "Codex ledger infrastructure is unavailable.",
+    { cause: original }
+  );
+}
+function accountingPersistenceBlockedError(persistenceError, underlyingRunError) {
+  const persistenceCause = persistenceError instanceof Error ? persistenceError : new Error("Codex ledger persistence failed.");
+  const cause = underlyingRunError === void 0 ? persistenceCause : new AggregateError(
+    [persistenceCause, underlyingRunError],
+    "Codex ledger persistence failed after an uncertain dispatch outcome."
+  );
+  return new BenchmarkRunBlockedError(
+    BenchmarkRunBlockReason.ManualReconciliationRequired,
+    "Codex usage accounting could not be persisted; manual reconciliation is required.",
+    { cause }
+  );
+}
+async function prepareLedgerDirectory(lockPath) {
+  if (failNextLedgerSetupForTest) {
+    failNextLedgerSetupForTest = false;
+    throw new Error(`injected setup failure for ${lockPath}`);
+  }
+  await mkdir2(path3.dirname(lockPath), { recursive: true, mode: 448 });
+}
+async function bestEffortSettleLock(lock) {
+  await writeLockState(lock, "settled").catch(() => void 0);
+}
+async function bestEffortCloseLock(lock) {
+  await lock.close().catch(() => void 0);
+}
+async function bestEffortRemoveOwnedLedgerLock(lockPath) {
+  if (failNextOwnedLockRemovalForTest) {
+    failNextOwnedLockRemovalForTest = false;
+    failNextLedgerSetupForTest = false;
+    return;
+  }
+  await removeOwnedLedgerLock(lockPath).catch(() => void 0);
+}
 function expandHomeRelativePath(value) {
   if (value === "~") return os.homedir();
   if (value.startsWith("~/") || value.startsWith("~\\")) {
@@ -6472,6 +6779,94 @@ function parseNonNegativeNumber(value, name) {
   }
   return parsed;
 }
+function isPositiveFinite(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0;
+}
+function isNonNegativeFinite(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+function isSupportedBudgetUnits(value) {
+  if (typeof value !== "number") return false;
+  try {
+    budgetUnitsToNanounits(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var BUDGET_UNIT_SCALE = 1e9;
+function rateNanounitsPerToken(rate) {
+  const scaled = rate * 1e3;
+  if (!Number.isSafeInteger(scaled)) throw new Error("Codex credit rate exceeds nanounit precision");
+  return BigInt(scaled);
+}
+function budgetUnitsToNanounits(value) {
+  if (!Number.isFinite(value) || value < 0) throw new Error("budget units must be finite and non-negative");
+  const fixed = value.toFixed(9);
+  if (Number(fixed) !== value) {
+    throw new Error("budget units exceed supported nanounit precision");
+  }
+  const [integer = "0", fraction = ""] = fixed.split(".");
+  const nanounits = BigInt(integer) * BigInt(BUDGET_UNIT_SCALE) + BigInt(fraction.padEnd(9, "0"));
+  if (nanounits > BigInt(Number.MAX_SAFE_INTEGER)) throw new Error("budget units exceed safe integer range");
+  return nanounits;
+}
+function nanounitsToBudgetUnits(value) {
+  return Number(value) / BUDGET_UNIT_SCALE;
+}
+function sumBudgetUnitNanounits(values) {
+  return values.reduce((sum, value) => sum + budgetUnitsToNanounits(value), 0n);
+}
+function ledgerV1SpentNanounits(ledger) {
+  return sumBudgetUnitNanounits(ledger.entries.map((entry) => entry.credits)) + sumBudgetUnitNanounits((ledger.reconciliations ?? []).map((reconciliation) => reconciliation.credits));
+}
+function isLedgerV1SpentConsistent(ledger) {
+  try {
+    const exactSpentNanounits = ledgerV1SpentNanounits(ledger);
+    if (exactSpentNanounits > BigInt(Number.MAX_SAFE_INTEGER)) return false;
+    const exactSpentUnits = nanounitsToBudgetUnits(exactSpentNanounits);
+    return Math.abs(exactSpentUnits - ledger.spentCredits) <= LEGACY_LEDGER_FLOAT_DRIFT_TOLERANCE;
+  } catch {
+    return false;
+  }
+}
+function ledgerSpentNanounits(ledger) {
+  return sumBudgetUnitNanounits(ledger.entries.map((entry) => entry.budgetUnits)) + sumBudgetUnitNanounits((ledger.resolutions ?? []).map((resolution) => resolution.localBudgetChargeUnits)) + sumBudgetUnitNanounits((ledger.legacyReconciliations ?? []).map((reconciliation) => reconciliation.credits));
+}
+function isLedgerSpentConsistent(ledger) {
+  try {
+    return budgetUnitsToNanounits(ledger.spentUnits) === ledgerSpentNanounits(ledger);
+  } catch {
+    return false;
+  }
+}
+function parseExactDecimal(value, name) {
+  if (typeof value !== "string" || value !== value.trim() || !isExactDecimal(value)) {
+    throw new Error(`${name} must be a non-negative plain decimal string`);
+  }
+  return value;
+}
+function isExactDecimal(value) {
+  return /^(?:0|[1-9]\d*)(?:\.\d+)?$/.test(value) && value.length <= 128;
+}
+function subtractExactDecimals(before, after) {
+  const beforeParts = splitExactDecimal(before);
+  const afterParts = splitExactDecimal(after);
+  const scale = Math.max(beforeParts.fraction.length, afterParts.fraction.length);
+  const beforeScaled = BigInt(`${beforeParts.integer}${beforeParts.fraction.padEnd(scale, "0")}`);
+  const afterScaled = BigInt(`${afterParts.integer}${afterParts.fraction.padEnd(scale, "0")}`);
+  const difference = beforeScaled - afterScaled;
+  const sign = difference < 0n ? "-" : "";
+  const digits = (difference < 0n ? -difference : difference).toString().padStart(scale + 1, "0");
+  if (scale === 0) return `${sign}${digits}`;
+  const integer = digits.slice(0, -scale);
+  const fraction = digits.slice(-scale).replace(/0+$/, "");
+  return fraction ? `${sign}${integer}.${fraction}` : `${sign}${integer}`;
+}
+function splitExactDecimal(value) {
+  const [integer, fraction = ""] = value.split(".");
+  return { integer: integer ?? "", fraction };
+}
 function parseOptionalRunId(value) {
   const runId = value?.trim();
   if (!runId) return void 0;
@@ -6503,9 +6898,6 @@ function isSha256(value) {
 function sha256(value) {
   return createHash4("sha256").update(value).digest("hex");
 }
-function normalizeZero(value) {
-  return Object.is(value, -0) ? 0 : value;
-}
 function isIsoTimestamp(value) {
   if (typeof value !== "string") return false;
   try {
@@ -10303,7 +10695,15 @@ var CodexCliProvider = class {
       resolveBenchmarkRunId()
     );
     if (creditBudget) {
-      await this.assertChatGptCreditAuth();
+      try {
+        await this.assertChatGptCreditAuth();
+      } catch (error) {
+        throw new BenchmarkRunBlockedError(
+          BenchmarkRunBlockReason.InfrastructureUnavailable,
+          "Codex CLI ChatGPT authentication is unavailable for this bounded benchmark run.",
+          { cause: error }
+        );
+      }
     }
     const maxAttempts = normalizeCodexCliMaxAttempts(
       creditBudget ? 1 : this.config.retryOptions?.maxAttempts
@@ -10455,6 +10855,10 @@ ${result.stderr}`
       }
       return { ok: true, verdict, telemetry };
     } catch (error) {
+      const blocked = findBenchmarkRunBlockedError(error);
+      if (blocked) {
+        throw blocked;
+      }
       const aborted = isCodexStructuredJudgeAbort(error, request.signal);
       const errorCode = aborted ? "aborted" : "transport_error";
       return {
@@ -16282,7 +16686,11 @@ async function llmJudgeScoreDetailed(judge, question, predicted, expected) {
       tokens: { input: 0, output: 0 },
       latencyMs: durationMs
     };
-  } catch {
+  } catch (error) {
+    const blocked = findBenchmarkRunBlockedError(error);
+    if (blocked) {
+      throw blocked;
+    }
     return {
       score: deterministicJudgeFallback(predicted, expected),
       tokens: { input: 0, output: 0 },
@@ -16302,7 +16710,11 @@ async function llmBinaryJudgeScoreDetailed(judge, prompt, fallback) {
   const startedAt = performance.now();
   try {
     return await judge.scoreBinaryPrompt(prompt);
-  } catch {
+  } catch (error) {
+    const blocked = findBenchmarkRunBlockedError(error);
+    if (blocked) {
+      throw blocked;
+    }
     return {
       score: deterministicJudgeFallback(fallback.predicted, fallback.expected),
       tokens: { input: 0, output: 0 },
@@ -20247,37 +20659,51 @@ async function executePlanTrials(ctx, trials, options) {
     }
     return;
   }
-  const results = new Array(trials.length);
-  const completed = new Array(trials.length).fill(false);
-  let nextTrialIndex = 0;
-  let nextEmitIndex = 0;
-  const emitCompletedPrefix = () => {
-    while (completed[nextEmitIndex]) {
-      appendCompletedTask(ctx, options.tasks, results[nextEmitIndex]);
-      nextEmitIndex += 1;
+  for (let batchStart = 0; batchStart < trials.length; batchStart += options.trialConcurrency) {
+    const batch = trials.slice(
+      batchStart,
+      batchStart + options.trialConcurrency
+    );
+    const settled = await Promise.allSettled(
+      batch.map(
+        (trial) => executeTrialWithFailure(
+          ctx,
+          trial,
+          options.planIndex,
+          options.answerSupportGate
+        )
+      )
+    );
+    const unexpectedRejection = settled.find(
+      (result) => result.status === "rejected" && findBenchmarkRunBlockedError(result.reason) === void 0
+    );
+    if (unexpectedRejection) {
+      throw unexpectedRejection.reason;
     }
-  };
-  const worker = async () => {
-    while (true) {
-      const trialIndex = nextTrialIndex;
-      nextTrialIndex += 1;
-      if (trialIndex >= trials.length) {
-        return;
+    const terminalOffset = settled.findIndex(
+      (result) => result.status === "rejected" && findBenchmarkRunBlockedError(result.reason) !== void 0
+    );
+    const emitLimit = terminalOffset < 0 ? settled.length : terminalOffset;
+    for (let offset = 0; offset < emitLimit; offset += 1) {
+      const result = settled[offset];
+      if (result?.status !== "fulfilled") {
+        throw new Error(
+          `PublishedBenchmarkHarness: concurrent trial ${batchStart + offset} did not settle before canonical emission.`
+        );
       }
-      results[trialIndex] = await executeTrialWithFailure(
-        ctx,
-        trials[trialIndex],
-        options.planIndex,
-        options.answerSupportGate
-      );
-      completed[trialIndex] = true;
-      emitCompletedPrefix();
+      appendCompletedTask(ctx, options.tasks, result.value);
     }
-  };
-  const workerCount = Math.min(options.trialConcurrency, trials.length);
-  await Promise.all(
-    Array.from({ length: workerCount }, () => worker())
-  );
+    if (terminalOffset >= 0) {
+      const terminalResult = settled[terminalOffset];
+      const terminalError = terminalResult?.status === "rejected" ? findBenchmarkRunBlockedError(terminalResult.reason) : void 0;
+      if (!terminalError) {
+        throw new Error(
+          `PublishedBenchmarkHarness: concurrent trial ${batchStart + terminalOffset} lost its terminal error before canonical emission.`
+        );
+      }
+      throw terminalError;
+    }
+  }
 }
 function appendCompletedTask(ctx, tasks, task) {
   tasks.push(task);
@@ -20288,6 +20714,10 @@ async function executeTrialWithFailure(ctx, trial, planIndex, answerSupportGate)
   try {
     return await executeTrial(ctx, trial, answerSupportGate);
   } catch (err) {
+    const blocked = findBenchmarkRunBlockedError(err);
+    if (blocked) {
+      throw blocked;
+    }
     const message = err instanceof Error ? err.message : String(err);
     console.error(`  [WARN] harness trial plan-${planIndex}/${trialId} failed: ${message}`);
     return {
@@ -20532,6 +20962,10 @@ async function assessRecallSupport(ctx, trial, recalledText) {
     validateRecallSupportAssessment(assessment);
     return assessment;
   } catch (error) {
+    const blocked = findBenchmarkRunBlockedError(error);
+    if (blocked) {
+      throw blocked;
+    }
     return {
       status: "backend_failure",
       reason: error instanceof Error ? error.message : String(error)
@@ -20599,6 +21033,9 @@ async function scoreTrialJudge(ctx, trial, answeredText) {
   );
 }
 function answerWithTrialFallback(trial, recalledText, error) {
+  if (isBenchmarkRunBlockedError(error)) {
+    throw error;
+  }
   const fallback = trial.answerFallback?.({
     question: trial.question,
     recalledText,
@@ -44580,6 +45017,7 @@ export {
   buildProviderFreeLoCoMoRetrievalConfig,
   buildSchemaTierFixture,
   buildSchemaTierSmokeFixture,
+  calculateCodexBudgetUnits,
   calendarFixture,
   canonicalJsonStringify,
   captureLoCoMoRetrievalTrace,