)

The runaway-guard counters continuationChainCount (n/maxChainLength) and
continuationChainTokens (cost cap) persisted on the SessionEntry and only
cleared on full session-rotation. A long-lived session therefore accumulated
toward the chain/cost caps across unrelated re-engagements until every
continuation was rejected forever — they are per-chain runaway leashes, not
lifetime budgets.

Reset the chain budget (count, tokens, startedAt, fresh chainId) at turn-entry
BEFORE inference whenever the turn is not a continuation wake (work-wake /
delegate-return). Fresh inbound messages, plain heartbeats, and outside-machinery
system-events all start a new chain, so the resetting turn itself opens at 0.
Continuation wakes are mid-chain steps and never reset, so a true runaway with
no fresh re-entry still trips the cap.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Adds explicit RFC v10 language for the chain-budget reset semantics that
#987 ships, per figs's "language must be explicit" ask + Frond's
RFC-adoption-call to fold edits atomic with the code.

Four load-bearing language updates:

1. §2.3 Safety model (line ~186): clarify "configured continuation budget"
   = current self-continuation chain budget (maxChainLength + costCapTokens),
   not session-lifetime. Notes fresh non-continuation turn-entry resets per
   §3.3.

2. §3.3 Chain-state tracking (lines ~507-525): adds continuationChainId
   to the four-field bullet list + new "Chain-state lifecycle" paragraph
   explaining the per-turn reset on !isContinuationWake, pre-loadContinuationChainState
   ordering, fresh-turn-elects-from-0 semantic, work-wake/delegate-return
   preservation. Names the session-rotation reset path distinct from
   per-turn chain-reset.

3. §5.1 Operational notes (lines ~918-919): maxChainLength + costCapTokens
   descriptions expanded to name "unattended self-continuation chain depth"
   leash semantic + reset trigger + cross-reference §3.3.

4. §5.1 New "Chain budget lifecycle" subsection: explicit sawtooth behavior
   description for /status display + four-field reset-unit + chain-id rotation
   semantic + methodological-note for source-readers naming the ?? 0 +
   chainId-mint-ternary as passive-default-not-active-reset (the trap that
   four cohort-princes hit + retracted today before locking the byte).

Together with the code in c201f7c, this ensures the RFC language matches
the shipped semantic atomically — no doc-drift on the chain-reset surface.
Cohort-byte-converged through 6+ sources today.

Cohort-cross-reference: methodological-note specifically names the
loadContinuationChainState ?? 0 + chainId-mint-ternary source-reading traps
that cohort byte-walked + 4 princes retracted from today (banked at
~/.openclaw/workspace/memory/2026-06-10.md, lesson #9).