[Masterplanner25]

Closes #873.

What was there

_resume_target_vm builds a child VM when a resume needs a rebuild (#328). #868
taught that child what it may do and who it works for, and deliberately left
the third question — how much may it consume — for its own decision.

Measured with every bound set non-default, five were lost:

Bound	Parent	Child
max_steps	1,000,000	None
deadline	set	None
max_memory_bytes	999,999,999	None
max_frames	4,321	10,000
task_step_budget	777	None (correct)

max_frames is the subtlest: it did not become None, it became more than the
host asked for. So a guest escaped every bound by parking and resuming:

300 ms budget  -> 8 resumes, ~800 ms of work, PASSED
5,000 steps    -> ~270,000 instructions,      PASSED

The assumption in the issue was wrong

I wrote in #873 that the wall-clock half was the weaker of the two, on the
grounds that a deadline is absolute so time spent in the child has already
passed for the parent. Running it says otherwise. The deadline is consulted
every 100 instructions, and a program doing eight resume_workflow calls never
executes 100 more — so it is never re-checked, and nothing self-limits. That
measurement is why this covers both halves rather than just the counter.

Two kinds of bound

A ceiling is a property of the run — an absolute instant, a stack depth, an
RSS figure — and copies straight across. max_steps is a counter measured
against instructions_executed, so the child gets the remainder and its usage is
charged back when the resume returns.

Without the charge-back the split is decorative: six resumes fitted a budget
sized for one. RepeatedResumesAccumulate pins that, with a control asserting one
resume does still fit the same budget — otherwise it would pass on a build
where any resume fails.

max(0, budget - spent), not or None: an exhausted parent must hand down
zero, which record_instruction treats as already exceeded. Collapsing it to
None would turn "no budget left" into "unbounded", which is the bug rather than
a tidier spelling of it.

task_step_budget is deliberately excluded — it is the scheduler's per-coroutine
fairness allowance (scheduler.py sets and clears it around a resume), not a host
bound, and a VM starting fresh work is not inside a slice.

Two dispatch sites, not one

builtin_resume_workflow and builtin_resume_goal each had the same four lines.
The charge-back would have gone into one of them — which is the shape this file's
history is made of — so both now go through VM._dispatch_resume.
charge_run_bounds runs in a finally: a resume that raises is still charged,
because an uncharged failure is a free retry and a guest that can fail cheaply has
no budget at all.

Behaviour change, stated

A resume costs ~99 ms (median of six, measured) and the nodus run default is
200 ms. So a script doing two or more resumes under the default now times out
where it previously overran in silence. nodus run --time-limit N (seconds) is the
fix, as it already is for anything needing more than 200 ms. A single resume still
fits. The changelog entry says this needs a "not additive" row in CLAUDE.md
at release; that table is populated per release, so it is flagged rather than
pre-written.

Tests

tests/test_resume_run_bounds.py, 12 tests. Six per-decision neuters, restoring
from saved byte copies:

BASELINE (fixed tree)                            32 passed
no bounds inherited at all (the 5.14 rule)       RED   4 failed
inherit_run_bounds is a no-op                    RED   5 failed
the step budget is a fresh allowance, not a split RED   2 failed
an exhausted parent hands down unlimited         RED   1 failed
no charge-back (per-call split only)             RED   2 failed
memory ceiling dropped from the list             RED   1 failed
RESTORED                                         32 passed

The last one is worth noting: it fails only the individually-named test, not
the list-driven one — because deleting a name from RUN_BOUND_ATTRIBUTES removes
the propagation and the comparison together. Same unfalsifiable shape as
input_fn in #868, handled the same way.

One test-authoring bug caught on the way: parking with a host function in the
source made every resume fail with Undefined function: _cap and report no
steps, because a resume re-executes the persisted source to rebind
declarations. The harness parks through print instead, which removes the class.

Checks

• targeted set (resume bounds, host state, authority, reject-and-revise,
  checkpoint resume, rebuild, key order, workflow framework, capability
  coverage, VM attribute budget): 119 passed; goal/checkpoint suites
  covering resume_goal: 22 passed
• no new VM attributes, so PyPy's 80-attribute cliff (PyPy throughput regressed ~9x in v5.6.0 (d18fc60, #488) — a JIT cliff no CPython benchmark can see #702, goal budget has two dimensions and no extension point: no way to bound a loop by spend #488) is
  untouched — test_vm_attribute_budget.py passes
• ruff clean · mypy src/nodus/ clean
• nodus_gate --all green, all ten phases · release probes 130/130

🤖 Generated with Claude Code