Module governor 

The token governor: windowed, durable token/request budgets that pace how fast an instance burns intelligence, with the tactics wait | slow | degrade | refuse | fail when a window is exhausted.

• Windows — intelligence.budget.windows[]: {per: second|minute|hour| day|week, tokens?, requests?, reset?}. Every window is a fixed window aligned to its unit (a rolling second|minute|hour window is the current unit-aligned bucket; a calendar day|week window resets at reset HH:MMZ, default 00:00Z, weeks on Monday). Counters {index, tokens, requests} are durable in the manifest: a restart never re-opens a spent daily budget.
• Scopes — the instance governor plus optional sub-budgets per run / conversation / principal (Governor::admit takes the applicable scoped budgets). Sub-scopes are checked before the instance and the first refusal decides, so a tighter sub-budget shapes the verdict — including which scope’s tactic applies.
• Reservation — admit reserves an estimate against every window; the reported usage settles it (replacing the estimate).
• Lifetime — lifetime_tokens is the hard ceiling (always fail).

Pure and clock-injected (now_ms) — the runtime feeds it, the manifest stores it, agent://budget reads it.

Structs

Governor

The governor: the instance scope + named sub-scopes.

WindowState

One window’s durable counters.

Enums

Admission

The verdict of an admission request.

Functions

parse_reset

Parse HH:MMZ (or HH:MM) into ms after midnight.