Module budget_kernel 

§Fase 72.b — the RateLease budget kernel.

The runtime for budget { rate/max … on Tool(X) } (§72.a). A RateLease is the refilling generalization of the lease_kernel’s τ-decay affine LeaseToken: where a LeaseToken is single-use and DECAYS to nothing, a RateLease is N-use and REFILLS — but the linearity invariant is the same, a consumed token is gone until it is refilled. This is what makes “no more than N external effects per period” a real linear contract rather than an advisory counter (the §72 doctrine effects_are_linear).

Two quota kinds, both PURE functions of (lease state, now):

• rate: → a token bucket of capacity limit, refilling continuously at limit / period tokens per second (so it permits a burst up to limit, then a steady rate). The §72.a default daemon starts full.
• max: → a fixed tumbling window: at most limit consumptions per period; the window rolls (counter resets) once period has elapsed since it opened. No intra-window refill — a hard cap.

Refill/roll is LAZY: every try_acquire brings the lease current from the elapsed wall-clock, so the decision never depends on a background tick’s granularity. RateLeaseKernel::tick is housekeeping (keeps available queries fresh + reaps), the refilling analogue of the lease kernel’s sweep / the reconcile loop’s periodic pass.

Structs

BudgetGate

§Fase 72.c — a daemon’s compiled budget { … } as a runnable gate. Holds one RateLease per quota (keyed by effect + kind), the on_exhausted policy, and an effect→keys index so the dispatch site can gate a tool emission by name. Built once when a budgeted daemon starts running its flow; the OSS reference is single-process (the §72.e enterprise layer swaps the in-process kernel for the per-tenant Redis RateLimiter behind the same gate shape).

RateLease

One quota’s live state: a refilling bucket (rate:) or a fixed window (max:). Construct via RateLease::rate / RateLease::max / RateLease::from_quota. Consume via RateLease::try_acquire.

RateLeaseKernel

An in-process registry of RateLeases, keyed by an opaque subject string (the §72.c dispatch gate composes the key from the budget’s scope + the effect + the quota kind, e.g. "daemon:Outbound:Tool(TelnyxCall):rate"). This is the OSS single-replica reference; the §72.e enterprise layer binds the per-tenant Redis RateLimiter for multi-replica enforcement.

RateLeaseSnapshot

§Fase 72.e — a RateLease’s persistable state (epoch-millis wire form). The enterprise supervisor stores one per quota subject key so budgets are cumulative across a daemon’s ticks. kind discriminates which fields are live (rate ⇒ tokens/last_refill_ms; max ⇒ window_start_ms/consumed).

Enums

AcquireOutcome

The result of attempting to consume one token from a RateLease. A pure function of the lease’s state + now.

BudgetPeriod

A budget quota’s renewal/window period. Closed catalog — the type checker (axon-T832) already rejected anything else at compile time.

GateDecision

The dispatch gate’s verdict for one budgeted effect emission.