Module governor 

The token governor (RFC 0026 §7, plan §3.17): windowed, durable token/ request budgets that pace how fast an instance burns intelligence, with the tactics wait | slow | degrade | refuse | fail when a window is exhausted.

• Windows — intelligence.budget.windows[]: {per: second|minute|hour| day|week, tokens?, requests?, reset?}. Every window is a fixed window aligned to its unit (a rolling second|minute|hour window is the current unit-aligned bucket; a calendar day|week window resets at reset HH:MMZ, default 00:00Z, weeks on Monday). Counters {index, tokens, requests} are durable in the manifest (RFC 0025 §3.3): a restart never re-opens a spent daily budget.
• Scopes — the instance governor plus optional sub-budgets per run / conversation / principal (Governor::admit takes the applicable scoped budgets); the tightest applicable window wins.
• Reservation — admit reserves an estimate against every window; the reported usage settles it (replacing the estimate).
• Lifetime — lifetime_tokens is the hard ceiling (always fail).

Pure and clock-injected (now_ms) — the runtime feeds it, the manifest stores it, agent://budget reads it.

Structs

Governor

The governor: the instance scope + named sub-scopes.

WindowState

One window’s durable counters.

Enums

Admission

The verdict of an admission request.

Functions

parse_reset

Parse HH:MMZ (or HH:MM) into ms after midnight.