Reserve worker spend durably before governed dispatch

Assistant: codex
Assistant-Model: gpt-5.6-luna
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

rein_aharness/claim_loop.py

@@ -38,6 +38,7 @@ from rein_aharness.execution_cancel import (
 from rein_aharness.glas_execution import (
     GLAS_APPROACH,
     GlasExecutionError,
+    GlasSpendError,
     execute_profiled_run,
     normalise_execution_evidence_for_close,
 )
@@ -50,6 +51,7 @@ from rein_aharness.repository_transaction import (
     RepositoryTransaction,
     RepositoryTransactionError,
 )
+from rein_aharness.spend_admission import SpendAdmissionError, worker_spend
 from rein_aharness.taskspec import TaskSpecError
 from rein_aharness.ops_run_client import (
     ActivityCoreOpsClient,
@@ -292,6 +294,16 @@ def process_one(
     if replay.quarantined:
         logger.error("quarantined %s close evidence entries", replay.quarantined)
 
+    try:
+        spend = worker_spend(cfg)
+        if spend is not None:
+            spend.preflight()
+    except SpendAdmissionError as exc:
+        return ProcessResult(
+            claimed=False, retry_full_interval=True,
+            ok=False, reason=f"spend admission refused: {exc}",
+        )
+
     try:
         claimed = client.claim(limit=1)
     except OpsRunError as exc:
@@ -329,6 +341,16 @@ def process_one(
                 }
             },
         )
+    if spend is not None and not run.harness_profile_ref:
+        reason = "spend admission requires a governed harness profile"
+        try:
+            closed = client.fail(run.id, error=reason, reopen=False,
+                                 result={"ok": False, "reason": reason})
+        except OpsRunError:
+            return ProcessResult(claimed=True, run_id=run.id, ok=False,
+                                 reason="spend route refusal close failed")
+        return ProcessResult(claimed=True, run_id=run.id, ok=False,
+                             reason=reason, ops_state=closed.state)
     approach = GLAS_APPROACH if run.harness_profile_ref else select_approach(run)
     logger.info(
         "claimed run_id=%s approach=%s title=%r labels=%s",
@@ -590,9 +612,9 @@ def _process_profiled_run_active(
         execution_reason = _bounded_reason(
             f"refused: {exc}", default="repository transaction refused"
         )
-    except GlasExecutionError:
-        execution_error = "GlasExecutionError"
-        execution_reason = "profiled execution failed (GlasExecutionError)"
+    except GlasExecutionError as exc:
+        execution_error = type(exc).__name__
+        execution_reason = str(exc) if isinstance(exc, GlasSpendError) else "profiled execution failed (GlasExecutionError)"
 
     if tx is not None and tx.baseline is not None:
         tx_evidence = tx.evidence()