Expose HTTP transient retry control and preserve shared capacity

docs/api.md

@@ -50,6 +50,7 @@ copyable shape. At the HTTP adapter boundary, the smallest valid shape is:
 | `vars` | no | Object mapping template-variable names to strings. |
 | `model` | no | Runtime model-override object. |
 | `include_raw_output` | no | Include `raw_model_output` when true. |
+| `transient_retries` | no | Nonnegative additional transient attempt count for this run. Omitted or `null` inherits the configured engine value and then Promptkit's default; `0` disables additional attempts. |
 
 An input reference has a required `type` of `file` or `inline`. A `file`
 reference requires `uri`; an `inline` reference requires `body`.
@@ -92,6 +93,11 @@ Request decoding rejects malformed JSON, unknown fields at every request level,
 and trailing JSON tokens with `400 invalid_json`. A blank `prompt_id` returns
 `400 invalid_request`. Omitted or empty `inputs` are passed to Promptkit, which
 reports any definition-required or template-referenced inputs.
+`transient_retries` must be a JSON integer; a wrong type or noninteger number
+returns `400 invalid_json`, while a negative integer returns
+`400 invalid_request` before execution. A request override does not change the
+shared engine setting used by other requests. Promptkit owns eligible statuses,
+retry waits, and the separate transient budget for each repair generation.
 
 ### Success Response
 

docs/internal/adapters.md

@@ -63,6 +63,9 @@ The handler enforces transport limits and strict JSON decoding before mapping
 DTOs into `promptkit.RunRequest`, `promptkit.ArtifactRef`, and
 `promptkit.ExecutionTargetOverride`. On success it reads Promptkit artifact,
 validation, model, usage, and metadata values directly.
+The optional HTTP retry count maps to `RunRequest.TransientRetries` without
+mutating the shared engine. Negative values are rejected before invocation;
+Promptkit controls retries and backend admission for concurrent requests.
 
 Failure mapping uses `errors.Is` against Promptkit's public sentinels and the
 HTTP reader's Scriptorium-owned containment and size errors. Wrapped reader

docs/operations.md

@@ -114,7 +114,8 @@ transient provider statuses by default. Account for added calls, latency, and
 cost when planning capacity. Each repair generation has its own transient
 budget, separate from the structural repair count. Configure the engine budget
 with [`transient_retries`](config.md); `run` and `render` accept a request
-override described in the [CLI contract](cli.md). Omission inherits the engine
+override described in the [CLI contract](cli.md), and HTTP callers can select
+one through the [API contract](api.md). Omission inherits the engine
 setting and then Promptkit's default, while explicit zero disables additional
 attempts. Existing generation timeouts apply
 per attempt, while the caller context covers the complete operation. Provider

docs/roadmap/implementation.md

@@ -143,7 +143,7 @@ rendering continues to work. No application-owned retry/backoff loop exists.
 
 ## Stage 3: Expose HTTP Retry Control And Verify Shared Admission
 
-**Status: Pending.**
+**Status: Complete.**
 
 Selected interface: optional top-level JSON `transient_retries` integer on
 `POST /v1/runs`; omission/null inherits the engine, zero disables additional