feat(workflows): budget duration enforcement + soft landing (B2, #2212)

[flora131]

Replacement for #2527 after the stacked-PR base branch was deleted. Same branch, now targeting main (B1 already merged).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Greptile Summary

This PR adds configurable workflow duration budgets, warning notices, budget-exhaustion handling, and persisted restoration. A reproduced notification-delivery issue remains in the budget-warning path: after a warning delivery fails, an unrelated workflow update can send the same warning again before its scheduled retry, creating duplicate warning cards and reconciliation work.

Confidence Score: 4/5

The change is not ready to merge until failed budget-warning deliveries remain deduplicated during their retry window.

The duplicate-delivery path was reproduced using the real lifecycle notification installation, store invalidation mechanism, rejected delivery handling, and retry scheduling.

Files Needing Attention: packages/workflows/src/extension/lifecycle-notifications.ts needs a retryable-delivery check in the budget-warning admission guard, plus regression coverage for an invalidation occurring before retry.

T-Rex Logs

What T-Rex did

• T-Rex produced a finding-comment-proof for a posted P1 finding.
• T-Rex produced a second finding-comment-proof for another posted P1 finding.
• T-Rex performed a general-contract-validation-proof to verify the budget-warning retryable guard scenario, including the before-test TypeScript repro and the after-test cleanup.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   Failed budget warnings can be delivered twice before their scheduled retry

   • Bug
     • After sendMessage rejects, the budget-warning key is added to retryableTerminalRuns. A subsequent unrelated store invalidation re-inspects the unchanged warning and sends it again immediately, resulting in duplicate warning cards/reconciliation turns and independent retry timers.
   • Cause
     • emitBudgetWarningOnce at packages/workflows/src/extension/lifecycle-notifications.ts:318 checks only deliveredTerminalRuns and pendingTerminalRuns. It omits retryableTerminalRuns, unlike terminal and control notice guards.
   • Fix
     • Add state.retryableTerminalRuns.has(key) to the budget-warning guard, matching the terminal/control admission checks, then retain a regression test covering rejection followed by invalidation before the retry timer fires.

   _{Ran code and verified through T-Rex}

Prompt To Fix All With AI

### Issue 1
packages/workflows/src/extension/lifecycle-notifications.ts:318
**Budget warning retries bypass delivery deduplication**

A rejected warning delivery puts its key in `retryableTerminalRuns`, but this admission guard only checks delivered and pending keys. If an unrelated store invalidation occurs before the retry timer fires, the unchanged warning is delivered again immediately, creating duplicate warning cards, duplicate reconciliation turns, and an additional retry timer. Include `retryableTerminalRuns.has(key)` in this guard, as the terminal and control notice paths already do.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "merge origin/main" | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
bastani	🟢 Ready	View Preview	Aug 19, 2026, 4:58 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[greptile-apps]

Budget warning retries bypass delivery deduplication

A rejected warning delivery puts its key in retryableTerminalRuns, but this admission guard only checks delivered and pending keys. If an unrelated store invalidation occurs before the retry timer fires, the unchanged warning is delivered again immediately, creating duplicate warning cards, duplicate reconciliation turns, and an additional retry timer. Include retryableTerminalRuns.has(key) in this guard, as the terminal and control notice paths already do.

Artifacts

Executable duplicate budget-warning delivery repro source

• A narrow Vitest test uses the real store and lifecycle installation to reject delivery, invalidate the snapshot, and assert duplicate admission before retry; the takeaway is that the suspected path is executable.

Passing output for duplicate budget-warning delivery repro

• The real Vitest command completed with one passing test and exit code 0 after asserting the retryable state, second send, and second retry timer; the takeaway is that duplicate delivery occurs.

Temporary test cleanup and artifact hash output

• The cleanup command confirmed the temporary test no longer exists under test/unit and recorded hashes for the saved proof files; the takeaway is that product and permanent test sources were not modified.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: packages/workflows/src/extension/lifecycle-notifications.ts
Line: 318

Comment:
**Budget warning retries bypass delivery deduplication**

A rejected warning delivery puts its key in `retryableTerminalRuns`, but this admission guard only checks delivered and pending keys. If an unrelated store invalidation occurs before the retry timer fires, the unchanged warning is delivered again immediately, creating duplicate warning cards, duplicate reconciliation turns, and an additional retry timer. Include `retryableTerminalRuns.has(key)` in this guard, as the terminal and control notice paths already do.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.