A round that exhausts its admission envelope finishes normally instead of stopping

[LucasWaki]

Found by the adversarial review of the genesis-loop change set, 11 September 2026.
Open at 492f2a4.

What happens

wb_orchestrator/external_runtime.py:83 classifies a ledger refusal as
infra:weekly_budget when the message mentions "weekly" or "overrun", and
infra:budget otherwise — the per-round admission envelope case.

wb_orchestrator/orchestrator.py:880 stops the run on infra:weekly_budget
only. infra:budget never sets _stop_reason and never aborts. The
cost_ceiling branch above it cannot cover the gap either: it compares
self._spent, a sum of actual row.cost_usd, against the plan ceiling, and a
refused admission spends nothing, so _spent does not grow.

Every remaining attempt therefore records infra:budget, the round is marked
finished, and wb run exits 0.

What this does and does not corrupt

Verified against the merged tree before filing, because the original report was
stronger than what the code does:

• measures.is_infrastructure matches any infra: prefix, so the cut attempts
  are excluded from the pass denominator, not counted as failures.
• caveats.for_run emits a sentence naming how many attempts stopped with an
  execution issue.

So the published rates are not contaminated and the exclusion is disclosed. The
defect is the run's own state: a round truncated by admission exhaustion reads as
a completed round rather than a stopped one, and nothing marks it resumable. A
reader comparing two rounds cannot tell that one of them stopped early.

Fix

See the correction in the comments before starting. The obvious one-line
branch on infra:budget is wrong: that kind is also the pinned outcome when a
single attempt exhausts its own scope cap (tests/test_external_customer.py:119),
so stopping the round on it would kill a round on the first per-attempt cap hit.
The root cause is that _budget_failure collapses the ledger's distinct "run
budget exhausted" and "scope budget exhausted" into one kind. Split those first,
then stop the round on the envelope kind only, with its own stop reason so resume
can tell it from the weekly case — the weekly case waits for Monday,
the envelope case does not. A test covering the envelope path is the missing half;
the weekly path already has one.

[LucasWaki]

Correction to the Fix section — the one-line branch would break a tested path.

Raised by the session that found the original, and verified here before amending.

infra:budget is not only the envelope-exhaustion kind. It is also the correct,
pinned outcome when a single attempt exhausts its own scope cap:

tests/test_external_customer.py:119
  test_customer_admission_refusal_has_no_dispatch_or_fictitious_unknown_receipt

  config, ledger, calls = setup(monkeypatch, tmp_path, [], cap=0.001)
  ...
  assert caught.value.kind == "infra:budget" and caught.value.retryable is False

_budget_failure (wb_orchestrator/external_runtime.py:80-83) splits on the
message text alone — "weekly" or "overrun" means infra:weekly_budget, and
everything else collapses into infra:budget. The ledger's distinct "run budget
exhausted" and "scope budget exhausted" are therefore indistinguishable by kind
at orchestrator.py:880.

So adding infra:budget to that branch would stop the entire round the first time
any one attempt hit its per-attempt cap — a worse defect than the one this issue
describes, and it would fail the test above.

The root cause is the conflation, not the missing branch. The order is:
give the two ledger refusals distinct kinds in _budget_failure, then stop the
round on the envelope kind only, and leave the scope-cap kind exactly as it
behaves today. The test above is the guard that the second half stays correct.