pi-background-tasks 2.1.2 → 2.1.4

package/src/core/fusion/artifacts.ts

@@ -7,12 +7,18 @@ import { replaceFileDurable } from '../durable-fs.js';
 import {
   EMPTY_FUSION_USAGE,
   FUSION_COMMITTED_RESULT_SCHEMA_VERSION,
+  FUSION_FAILURE_SUMMARY_SCHEMA_VERSION,
   FUSION_MANIFEST_SCHEMA_VERSION,
   FUSION_VALIDATE_CANDIDATE_CONTRACT_EVENT_SCHEMA_VERSION,
   FusionError,
   cloneFusionUsage,
   type FusionArtifactManifest,
   type FusionArtifactRef,
+  type FusionFailureArtifactClassification,
+  type FusionFailureAttemptMetadata,
+  type FusionFailureEvidenceArtifact,
+  type FusionFailureSummaryV1,
+  type FusionRunProgress,
   type FusionAttemptArtifactRecord,
   type FusionBudgetPlanV1,
   type FusionCalibrationViolation,
@@ -318,6 +324,210 @@ function artifactRefSha256Hex(value: string): string {
   return hex;
 }
 
+/** A manifest artifact reference is always one safe basename below its run directory. */
+export function assertFusionArtifactBasename(name: string): string {
+  if (
+    name.length === 0 ||
+    name !== basename(name) ||
+    name.includes('/') ||
+    name.includes('\\') ||
+    name === '.' ||
+    name === '..' ||
+    Buffer.byteLength(name, 'utf8') > 255
+  ) {
+    throw errorForArtifact(`invalid fusion artifact name: ${name}`);
+  }
+  return name;
+}
+
+export const FUSION_FAILURE_SUMMARY_INLINE_MESSAGE_BYTES = 1024;
+export const FUSION_FAILURE_SUMMARY_ATTEMPT_CAP = 12;
+export const FUSION_FAILURE_SUMMARY_EVIDENCE_CAP = 24;
+export const FUSION_FAILURE_SUMMARY_MAX_BYTES = 32 * 1024;
+
+function compareArtifactText(left: string, right: string): number {
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+
+interface FusionProgressManifest {
+  state: FusionState;
+  artifacts: Readonly<Record<string, FusionArtifactRef>>;
+  attempts: readonly {
+    stage: FusionStage;
+    slot?: 1 | 2 | 3 | undefined;
+    status: 'completed' | 'failed' | 'cancelled';
+    child_created: boolean;
+  }[];
+  usage: FusionUsage;
+}
+
+function failureStageProgress(
+  manifest: FusionProgressManifest,
+  stage: FusionStage,
+): FusionRunProgress['candidates'] {
+  const attempts = manifest.attempts.filter((attempt) => attempt.stage === stage);
+  const created = attempts.filter((attempt) => attempt.child_created).length;
+  const completed = attempts.filter(
+    (attempt) => attempt.child_created && attempt.status === 'completed',
+  ).length;
+  const failed = attempts.filter(
+    (attempt) => attempt.child_created && attempt.status === 'failed',
+  ).length;
+  const cancelled = attempts.filter(
+    (attempt) => attempt.child_created && attempt.status === 'cancelled',
+  ).length;
+  const completedByState =
+    stage === 'candidate'
+      ? completed >= 3
+      : stage === 'evaluation'
+        ? manifest.artifacts['evaluation.json'] !== undefined ||
+          manifest.state === 'evaluation_complete' ||
+          manifest.state === 'merging' ||
+          manifest.state === 'completed'
+        : manifest.artifacts['merged.md'] !== undefined || manifest.state === 'completed';
+  const progress: FusionRunProgress['candidates'] = {
+    status: completedByState ? 'completed' : created === 0 ? 'not_started' : 'incomplete',
+    attempts_recorded: attempts.length,
+    children_created: created,
+    children_completed: completed,
+    children_failed: failed,
+    children_cancelled: cancelled,
+  };
+  if (stage === 'candidate') {
+    const createdSlots = new Set(
+      attempts.flatMap((attempt) =>
+        attempt.child_created && attempt.slot !== undefined ? [attempt.slot] : [],
+      ),
+    );
+    progress.not_started_slots = 3 - createdSlots.size;
+  }
+  return progress;
+}
+
+/** Derive terminal progress solely from the durable manifest. */
+export function buildFusionRunProgress(manifest: FusionProgressManifest): FusionRunProgress {
+  return {
+    manifest_state: manifest.state,
+    candidates: failureStageProgress(manifest, 'candidate'),
+    evaluation: failureStageProgress(manifest, 'evaluation'),
+    merge: failureStageProgress(manifest, 'merge'),
+    usage_so_far: cloneFusionUsage(manifest.usage),
+  };
+}
+
+function terminalMessageMetadata(message: string): FusionFailureSummaryV1['failure']['message'] {
+  const bytes = Buffer.from(message, 'utf8');
+  return {
+    byte_length: bytes.length,
+    sha256: sha256Buffer(bytes),
+    ...(bytes.length <= FUSION_FAILURE_SUMMARY_INLINE_MESSAGE_BYTES
+      ? { inline_message: message }
+      : { omission_reason: 'exceeds_inline_message_bytes_cap' as const }),
+  };
+}
+
+function failureArtifactClassification(
+  name: string,
+  ref: FusionArtifactRef,
+  manifest: FusionArtifactManifest,
+): FusionFailureArtifactClassification {
+  for (const attempt of manifest.attempts) {
+    if (attempt.response_path === name) {
+      return ref.byte_length === 0 && attempt.status !== 'completed'
+        ? 'empty_rejected_output'
+        : 'complete_stage_output';
+    }
+    if (attempt.partial_response_path === name) return 'partial_stage_output';
+    if (attempt.output_recovery?.original_response_path === name) return 'oversized_original';
+  }
+  return 'evidence_only';
+}
+
+function failureAttemptMetadata(manifest: FusionArtifactManifest): readonly FusionFailureAttemptMetadata[] {
+  return manifest.attempts
+    .map((attempt) => ({
+      stage: attempt.stage,
+      ...(attempt.slot === undefined ? {} : { slot: attempt.slot }),
+      attempt: attempt.attempt,
+      status: attempt.status,
+      child_created: attempt.child_created,
+    }))
+    .sort((left, right) =>
+      compareArtifactText(left.stage, right.stage) ||
+      (left.slot ?? 0) - (right.slot ?? 0) ||
+      left.attempt - right.attempt,
+    );
+}
+
+export function buildFusionFailureSummary(input: {
+  manifest: FusionArtifactManifest;
+  terminalError: FusionError;
+  progress: FusionRunProgress;
+  terminalState: Exclude<FusionTerminalState, 'completed'>;
+  createdAt: string;
+}): FusionFailureSummaryV1 {
+  if (
+    (input.terminalState !== 'failed' && input.terminalState !== 'cancelled') ||
+    input.manifest.state !== input.terminalState
+  ) {
+    throw errorForArtifact('failure summary requires a matching failed/cancelled terminal manifest');
+  }
+  if (input.manifest.error !== input.terminalError.message) {
+    throw errorForArtifact('failure summary terminal error does not match the durable manifest');
+  }
+  if (canonicalJson(input.progress) !== canonicalJson(buildFusionRunProgress(input.manifest))) {
+    throw errorForArtifact('failure summary progress does not match the durable terminal manifest');
+  }
+  if (input.manifest.artifacts['failure-summary.json'] !== undefined) {
+    throw errorForArtifact('failure summary already exists in the terminal manifest');
+  }
+  const attempts = failureAttemptMetadata(input.manifest);
+  const evidence: FusionFailureEvidenceArtifact[] = Object.entries(input.manifest.artifacts)
+    .map(([name, ref]) => ({
+      name: assertFusionArtifactBasename(name),
+      classification: failureArtifactClassification(name, ref, input.manifest),
+      ref: { ...ref },
+    }))
+    .sort((left, right) => compareArtifactText(left.name, right.name));
+  return {
+    schema_version: FUSION_FAILURE_SUMMARY_SCHEMA_VERSION,
+    run_id: input.manifest.run_id,
+    workflow: input.manifest.workflow,
+    source: input.manifest.source,
+    terminal_state: input.terminalState,
+    created_at: input.createdAt,
+    answer: { present: false, reason: 'run_did_not_commit' },
+    failure: {
+      code: input.terminalError.code,
+      ...(input.terminalError.stage === undefined ? {} : { stage: input.terminalError.stage }),
+      ...(input.terminalError.slot === undefined ? {} : { slot: input.terminalError.slot }),
+      ...(input.terminalError.attempt === undefined
+        ? {}
+        : { attempt: input.terminalError.attempt }),
+      child_created: input.terminalError.childCreated,
+      message: terminalMessageMetadata(input.terminalError.message),
+    },
+    progress: input.progress,
+    usage_so_far: cloneFusionUsage(input.manifest.usage),
+    attempts: {
+      listed: attempts.filter((_attempt, index) => index < FUSION_FAILURE_SUMMARY_ATTEMPT_CAP),
+      omitted_count:
+        attempts.length - Math.min(attempts.length, FUSION_FAILURE_SUMMARY_ATTEMPT_CAP),
+    },
+    evidence_artifacts: {
+      listed: evidence.filter((_artifact, index) => index < FUSION_FAILURE_SUMMARY_EVIDENCE_CAP),
+      omitted_count:
+        evidence.length - Math.min(evidence.length, FUSION_FAILURE_SUMMARY_EVIDENCE_CAP),
+    },
+    remediation_ids: [
+      'inspect_manifest_bound_evidence',
+      'inspect_terminal_error',
+      'split_or_reduce_work',
+      'retry_same_route_after_operator_review',
+    ],
+  };
+}
+
 export class FusionArtifactStore {
   private readonly runDirAbs: string;
   private readonly runDirDisplay: string;
@@ -534,6 +744,59 @@ export class FusionArtifactStore {
     });
   }
 
+  /**
+   * Writes the terminal evidence summary exactly once after writeError has made
+   * the manifest terminal. The summary deliberately contains refs only, never
+   * stage-output bodies.
+   */
+  async writeFailureSummary(summary: FusionFailureSummaryV1): Promise<FusionArtifactRef> {
+    if (
+      this.manifest.state !== 'failed' &&
+      this.manifest.state !== 'cancelled'
+    ) {
+      throw errorForArtifact('failure summary requires a failed/cancelled terminal manifest');
+    }
+    if (summary.terminal_state !== this.manifest.state) {
+      throw errorForArtifact('failure summary terminal state does not match the manifest');
+    }
+    if (
+      summary.run_id !== this.manifest.run_id ||
+      summary.workflow !== this.manifest.workflow ||
+      summary.source !== this.manifest.source
+    ) {
+      throw errorForArtifact('failure summary identity does not match the terminal manifest');
+    }
+    if (
+      summary.answer?.present !== false ||
+      summary.answer.reason !== 'run_did_not_commit'
+    ) {
+      throw errorForArtifact('failure summary must assert that no answer was committed');
+    }
+    if (this.manifest.error === undefined || this.manifest.artifacts['error.json'] === undefined) {
+      throw errorForArtifact('failure summary requires durable terminal error evidence');
+    }
+    if (
+      canonicalJson(summary.failure.message) !==
+      canonicalJson(terminalMessageMetadata(this.manifest.error))
+    ) {
+      throw errorForArtifact('failure summary terminal error metadata does not match the manifest');
+    }
+    if (canonicalJson(summary.progress) !== canonicalJson(buildFusionRunProgress(this.snapshot()))) {
+      throw errorForArtifact('failure summary progress does not match the terminal manifest');
+    }
+    if (canonicalJson(summary.usage_so_far) !== canonicalJson(this.manifest.usage)) {
+      throw errorForArtifact('failure summary usage does not match the terminal manifest');
+    }
+    if (this.manifest.artifacts['failure-summary.json'] !== undefined) {
+      throw errorForArtifact('failure summary is already bound in the manifest');
+    }
+    const bytes = Buffer.from(`${canonicalJson(summary)}\n`, 'utf8');
+    if (bytes.length > FUSION_FAILURE_SUMMARY_MAX_BYTES) {
+      throw errorForArtifact('failure summary exceeds its bounded diagnostics artifact limit');
+    }
+    return this.writeArtifact('failure-summary.json', bytes);
+  }
+
   async recordChildAttempt(input: RecordFusionChildAttemptInput): Promise<void> {
     const prefix = attemptPrefix(input.result.stage, input.result.slot, input.result.attempt);
     await this.writeArtifact(`${prefix}.system-prompt.txt`, input.systemPrompt);
@@ -664,6 +927,7 @@ export class FusionArtifactStore {
     });
   }
 
+  /** Writes a durable artifact then binds its exact bytes in the manifest. */
   private async writeArtifact(name: string, data: Buffer | string): Promise<FusionArtifactRef> {
     const absPath = this.artifactPath(name);
     const ref = await writePrivateFile(absPath, data);
@@ -674,9 +938,7 @@ export class FusionArtifactStore {
   }
 
   private artifactPath(name: string): string {
-    if (name.length === 0 || name.includes('/') || name.includes('\\')) {
-      throw errorForArtifact(`invalid fusion artifact name: ${name}`);
-    }
+    assertFusionArtifactBasename(name);
     const absPath = join(this.runDirAbs, name);
     if (!pathInside(this.runDirAbs, absPath)) {
       throw errorForArtifact(`fusion artifact path escapes run directory: ${name}`);

package/src/core/fusion/child-protocol.ts

@@ -21,25 +21,21 @@ export const FUSION_TOOL_CALL_SEAL_SCHEMA_VERSION =
   'pi-background-tasks.fusion-tool-call-seal.v1' as const;
 export const FUSION_TOOL_CALL_SEAL_SUFFIX = '.seal.json';
 export const FUSION_RUNTIME_GUARD_SCHEMA_VERSION =
-  'pi-background-tasks.fusion-runtime-guard.v1' as const;
+  'pi-background-tasks.fusion-runtime-guard.v2' as const;
 export const FUSION_RUNTIME_GUARD_PREFIX = '\u001ePI_FUSION_RUNTIME_GUARD ';
 export const FUSION_CHILD_MAX_PROVIDER_REQUESTS = 128;
 export const FUSION_CHILD_MAX_TOOL_CALLS = 192;
-export const FUSION_CHILD_MIN_OUTPUT_RESERVE_TOKENS = 32_768;
-export const FUSION_CHILD_SAFETY_RESERVE_TOKENS = 4_096;
 
 /**
  * Aggregate ceiling on tool-result bytes a single candidate child may accumulate.
  *
- * The byte ceiling complements the runtime provider-payload governor and tool/request
- * count limits. It remains an independent bound on total tool material even when Pi
- * compaction keeps each individual provider request within the route context window.
+ * The byte ceiling complements the tool/request count limits and pre-spawn stage
+ * budgets. It remains an independent bound on total tool material across the child run.
  */
 export const FUSION_CHILD_MAX_TOTAL_TOOL_RESULT_BYTES = 8 * 1024 * 1024;
 
 export type FusionRuntimeGuardCode =
   | 'provider_request_limit'
-  | 'provider_request_budget'
   | 'provider_payload_invalid'
   | 'claude_cache_policy'
   | 'tool_call_limit';
@@ -53,11 +49,6 @@ export interface FusionRuntimeGuardRecord {
   tool_call_count: number;
   payload_bytes: number;
   payload_sha256: string;
-  estimated_input_tokens: number;
-  context_window_tokens: number;
-  reserved_output_tokens: number;
-  safety_reserve_tokens: number;
-  allowed_input_tokens: number;
   message: string;
 }
 

package/src/core/fusion/orchestrator.ts

@@ -5,6 +5,8 @@ import { FUSION_BUDGET_POLICY, FusionBudget } from './budget.js';
 import { assertChildOutputWithinContract } from './output-contract.js';
 import {
   FusionArtifactStore,
+  buildFusionFailureSummary,
+  buildFusionRunProgress as deriveFusionRunProgress,
   type CreateFusionArtifactStoreOptions,
   type RecordFusionFailedAttemptInput,
 } from './artifacts.js';
@@ -40,9 +42,7 @@ import {
   FUSION_VALIDATE_CANDIDATE_SCHEMA_VERSION,
   FusionError,
   addFusionUsage,
-  cloneFusionUsage,
   createEmptyFusionUsage,
-  type FusionArtifactManifest,
   type FusionCalibrationViolation,
   type FusionCapability,
   type FusionCanonicalInputV3,
@@ -176,58 +176,7 @@ function asFusionError(error: unknown, artifactDir: string, messageOverride?: st
   });
 }
 
-function fusionStageProgress(
-  manifest: FusionArtifactManifest,
-  stage: FusionStage,
-): FusionRunProgress['candidates'] {
-  const attempts = manifest.attempts.filter((attempt) => attempt.stage === stage);
-  const created = attempts.filter((attempt) => attempt.child_created).length;
-  const completed = attempts.filter(
-    (attempt) => attempt.child_created && attempt.status === 'completed',
-  ).length;
-  const failed = attempts.filter(
-    (attempt) => attempt.child_created && attempt.status === 'failed',
-  ).length;
-  const cancelled = attempts.filter(
-    (attempt) => attempt.child_created && attempt.status === 'cancelled',
-  ).length;
-  const completedByState =
-    stage === 'candidate'
-      ? completed >= 3
-      : stage === 'evaluation'
-        ? manifest.artifacts['evaluation.json'] !== undefined ||
-          manifest.state === 'evaluation_complete' ||
-          manifest.state === 'merging' ||
-          manifest.state === 'completed'
-        : manifest.artifacts['merged.md'] !== undefined || manifest.state === 'completed';
-  const progress: FusionRunProgress['candidates'] = {
-    status: completedByState ? 'completed' : created === 0 ? 'not_started' : 'incomplete',
-    attempts_recorded: attempts.length,
-    children_created: created,
-    children_completed: completed,
-    children_failed: failed,
-    children_cancelled: cancelled,
-  };
-  if (stage === 'candidate') {
-    const createdSlots = new Set(
-      attempts.flatMap((attempt) =>
-        attempt.child_created && attempt.slot !== undefined ? [attempt.slot] : [],
-      ),
-    );
-    progress.not_started_slots = 3 - createdSlots.size;
-  }
-  return progress;
-}
-
-export function buildFusionRunProgress(manifest: FusionArtifactManifest): FusionRunProgress {
-  return {
-    manifest_state: manifest.state,
-    candidates: fusionStageProgress(manifest, 'candidate'),
-    evaluation: fusionStageProgress(manifest, 'evaluation'),
-    merge: fusionStageProgress(manifest, 'merge'),
-    usage_so_far: cloneFusionUsage(manifest.usage),
-  };
-}
+export { buildFusionRunProgress } from './artifacts.js';
 
 function formatFusionRunStage(name: string, stage: FusionRunProgress['candidates']): string {
   const notStarted =
@@ -237,7 +186,31 @@ function formatFusionRunStage(name: string, stage: FusionRunProgress['candidates
   return `${name}=${stage.status} (${String(stage.children_created)} created, ${String(stage.children_completed)} completed, ${String(stage.children_failed)} failed, ${String(stage.children_cancelled)} cancelled${notStarted})`;
 }
 
-export function formatFusionRunProgress(progress: FusionRunProgress): string {
+export function summaryUnavailableNote(error: unknown): string {
+  const detail = errorText(error);
+  const detailBytes = Buffer.from(detail, 'utf8');
+  if (detailBytes.length > 1024) {
+    return 'failure-summary.json unavailable after terminal publication; write failure detail omitted because it exceeds the 1024-byte diagnostic cap.';
+  }
+  return `failure-summary.json unavailable after terminal publication: ${detail}`;
+}
+
+function withSummaryUnavailableNote(error: FusionError, summaryError: unknown): FusionError {
+  const details: FusionErrorDetails = {
+    code: error.code,
+    transient: error.transient,
+    childCreated: error.childCreated,
+  };
+  if (error.artifactDir !== undefined) details.artifactDir = error.artifactDir;
+  if (error.stage !== undefined) details.stage = error.stage;
+  if (error.slot !== undefined) details.slot = error.slot;
+  if (error.attempt !== undefined) details.attempt = error.attempt;
+  if (error.budget !== undefined) details.budget = error.budget;
+  if (error.runProgress !== undefined) details.runProgress = error.runProgress;
+  return new FusionError(`${error.message}\n${summaryUnavailableNote(summaryError)}`, details);
+}
+
+function formatFusionRunProgress(progress: FusionRunProgress): string {
   const usage = progress.usage_so_far;
   const optionalUsage = [
     usage.cacheWrite1h === undefined ? undefined : `cacheWrite1h=${String(usage.cacheWrite1h)}`,
@@ -962,9 +935,26 @@ export class FusionOrchestrator {
         terminalError = withRunProgress(
           error,
           store.artifactDir,
-          buildFusionRunProgress(store.snapshot()),
+          deriveFusionRunProgress(store.snapshot()),
         );
-        await store.writeError(cancelled ? 'cancelled' : 'failed', terminalError.message);
+        const terminalState = cancelled ? 'cancelled' : 'failed';
+        await store.writeError(terminalState, terminalError.message);
+        // The terminal manifest/error are authoritative. Summary persistence is
+        // subordinate and intentionally attempted once from that fresh snapshot.
+        try {
+          const terminalManifest = store.snapshot();
+          await store.writeFailureSummary(
+            buildFusionFailureSummary({
+              manifest: terminalManifest,
+              terminalError,
+              progress: deriveFusionRunProgress(terminalManifest),
+              terminalState,
+              createdAt: terminalManifest.updated_at,
+            }),
+          );
+        } catch (summaryError) {
+          terminalError = withSummaryUnavailableNote(terminalError, summaryError);
+        }
       } catch (artifactError) {
         throw withTerminalArtifactFailure(error, store.artifactDir, artifactError);
       }

package/src/core/fusion/pi-child.ts

@@ -9,10 +9,8 @@ import {
   FUSION_CANDIDATE_OUTPUT_RECOVERY_PATH_ENV,
   FUSION_CHILD_MAX_PROVIDER_REQUESTS,
   FUSION_CHILD_MAX_TOOL_CALLS,
-  FUSION_CHILD_MIN_OUTPUT_RESERVE_TOKENS,
   FUSION_CHILD_RESULT_PREFIX,
   FUSION_CHILD_RESULT_SCHEMA_VERSION,
-  FUSION_CHILD_SAFETY_RESERVE_TOKENS,
   FUSION_CHILD_SETTLEMENT_PREFIX,
   FUSION_CHILD_SETTLEMENT_SCHEMA_VERSION,
   FUSION_RESEARCH_ENABLED_ENV,
@@ -854,7 +852,6 @@ function parseChildResultMetadata(value: unknown): FusionChildResultMetadata {
 
 const FUSION_RUNTIME_GUARD_CODES = new Set<FusionRuntimeGuardCode>([
   'provider_request_limit',
-  'provider_request_budget',
   'provider_payload_invalid',
   'claude_cache_policy',
   'tool_call_limit',
@@ -885,11 +882,6 @@ export function parseFusionRuntimeGuard(stderr: Buffer): FusionRuntimeGuardRecor
         'tool_call_count',
         'payload_bytes',
         'payload_sha256',
-        'estimated_input_tokens',
-        'context_window_tokens',
-        'reserved_output_tokens',
-        'safety_reserve_tokens',
-        'allowed_input_tokens',
         'message',
       ],
       'fusion runtime guard',
@@ -914,57 +906,13 @@ export function parseFusionRuntimeGuard(stderr: Buffer): FusionRuntimeGuardRecor
       tool_call_count: requireUsageInteger(record, 'tool_call_count', 'fusion runtime guard'),
       payload_bytes: requireUsageInteger(record, 'payload_bytes', 'fusion runtime guard'),
       payload_sha256: requireSha256(record, 'payload_sha256', 'fusion runtime guard'),
-      estimated_input_tokens: requireUsageInteger(
-        record,
-        'estimated_input_tokens',
-        'fusion runtime guard',
-      ),
-      context_window_tokens: requireUsageInteger(
-        record,
-        'context_window_tokens',
-        'fusion runtime guard',
-      ),
-      reserved_output_tokens: requirePositiveSafeInteger(
-        record,
-        'reserved_output_tokens',
-        'fusion runtime guard',
-      ),
-      safety_reserve_tokens: requirePositiveSafeInteger(
-        record,
-        'safety_reserve_tokens',
-        'fusion runtime guard',
-      ),
-      allowed_input_tokens: requireUsageInteger(
-        record,
-        'allowed_input_tokens',
-        'fusion runtime guard',
-      ),
       message: requireNonBlankString(record, 'message', 'fusion runtime guard'),
     };
-    if (frame.code !== 'provider_payload_invalid') {
-      if (frame.context_window_tokens === 0) {
-        throw new Error('fusion runtime guard.context_window_tokens must be positive');
+    const emptyPayloadHash = createHash('sha256').update(Buffer.alloc(0)).digest('hex');
+    if (frame.code === 'claude_cache_policy' || frame.code === 'provider_payload_invalid') {
+      if (frame.payload_bytes !== 0 || frame.payload_sha256 !== emptyPayloadHash) {
+        throw new Error('fusion runtime guard invalid-payload evidence mismatch');
       }
-      const expectedAllowed =
-        frame.context_window_tokens - frame.reserved_output_tokens - frame.safety_reserve_tokens;
-      if (expectedAllowed < 0 || frame.allowed_input_tokens !== expectedAllowed) {
-        throw new Error('fusion runtime guard allowed-input arithmetic mismatch');
-      }
-    }
-    if (frame.code === 'claude_cache_policy') {
-      if (
-        frame.payload_bytes !== 0 ||
-        frame.payload_sha256 !== createHash('sha256').update(Buffer.alloc(0)).digest('hex') ||
-        frame.estimated_input_tokens !== 0
-      ) {
-        throw new Error('fusion runtime guard Claude cache policy payload evidence mismatch');
-      }
-    }
-    if (
-      frame.code === 'provider_request_budget' &&
-      frame.estimated_input_tokens <= frame.allowed_input_tokens
-    ) {
-      throw new Error('fusion runtime guard provider budget code has no token overage');
     }
     if (
       frame.code === 'provider_request_limit' &&
@@ -976,11 +924,7 @@ export function parseFusionRuntimeGuard(stderr: Buffer): FusionRuntimeGuardRecor
       if (frame.tool_call_count <= FUSION_CHILD_MAX_TOOL_CALLS) {
         throw new Error('fusion runtime guard tool call limit was not exceeded');
       }
-      if (
-        frame.payload_bytes !== 0 ||
-        frame.payload_sha256 !== createHash('sha256').update(Buffer.alloc(0)).digest('hex') ||
-        frame.estimated_input_tokens !== 0
-      ) {
+      if (frame.payload_bytes !== 0 || frame.payload_sha256 !== emptyPayloadHash) {
         throw new Error('fusion runtime guard tool call limit payload evidence mismatch');
       }
     }
@@ -1178,22 +1122,7 @@ export function assertFusionRuntimeGuardMatchesModel(
     );
   }
   if (routeUnknown && guard.code !== 'provider_payload_invalid') {
-    throw new Error('fusion runtime guard omitted the route for a capacity-backed refusal');
-  }
-  if (guard.code === 'provider_payload_invalid') return;
-  const expectedReservedOutput = Math.max(
-    FUSION_CHILD_MIN_OUTPUT_RESERVE_TOKENS,
-    model.maxOutputTokens,
-  );
-  const expectedAllowedInput =
-    model.contextWindow - expectedReservedOutput - FUSION_CHILD_SAFETY_RESERVE_TOKENS;
-  if (
-    guard.context_window_tokens !== model.contextWindow ||
-    guard.reserved_output_tokens !== expectedReservedOutput ||
-    guard.safety_reserve_tokens !== FUSION_CHILD_SAFETY_RESERVE_TOKENS ||
-    guard.allowed_input_tokens !== expectedAllowedInput
-  ) {
-    throw new Error('fusion runtime guard capacity evidence does not match the resolved route');
+    throw new Error('fusion runtime guard omitted the route for a route-bound refusal');
   }
 }
 
@@ -2417,7 +2346,9 @@ export async function runPiChild(options: RunPiChildOptions): Promise<FusionChil
               ? 'child_exit_failed'
               : runtimeGuard.code === 'claude_cache_policy'
                 ? 'child_cache_policy_invalid'
-                : 'child_runtime_budget_exceeded',
+                : runtimeGuard.code === 'provider_payload_invalid'
+                  ? 'child_runtime_payload_invalid'
+                  : 'child_runtime_limit_exceeded',
             options,
           ),
           state.cleanupErrors,