Enforce active app-server token limits and retain partial usage on termination #690

Observed failure

On current source 4a5a711b971fac854c6fdfe23722949aca3c686c, a real supervised Codex app-server Researcher had a 220,000 hard-token run budget, 1,000-second run limit and 240-second child timeout. It inspected the supplied current Git source with 28 completed commands (all exit0), then timed out after242207ms without its final report or a terminal turn usage record. No implementation/review acceptance follows.

The retained trace contains479 valid JSONRPC rows and28 thread/tokenUsage/updated notices. The latest correlated cumulative notice reports1,296,475 total tokens:1,287,714 input including1,219,968 cached input,8,761 output including4,288 reasoning. This is an observed partial lower bound, not final complete usage or an invoice. Cached tokens are a subset of input and must not be added twice.

The supervisor failed closed for acceptance and stopped further dispatch, but reported usage unavailable (jsonl_invalid) and charged only the16,384-token reservation. The trace is valid app-server JSONRPC; interpreting it as CLI JSONL after losing the timed-out AppServerOutcome is misleading. The configured hard-token ceiling did not stop active consumption, and the reservation undercounts the observed partial total. This must be fixed before another costly run relies on that ceiling.

Acceptance

• Derive and bind an active child/turn token grant from the trusted supervisor's remaining budget. React during app-server execution to correlated, validated cumulative usage, cancel/drain on breach and stop new dispatch. Report unavoidable already-inflight overshoot honestly; do not advertise an absolute provider spending guarantee.
• Retain authentic partial identity, usage and command observations on timeout/cancellation/protocol failure. Distinguish app-server termination from invalid CLI JSONL. Missing terminal evidence keeps usage incomplete and acceptance false.
• Settle at least the observed partial token lower bound without double counting cumulative updates or cached input; unknown model/pricing must not become a zero-dollar claim. Preserve the incomplete-usage stop.
• Reject foreign-thread/turn, malformed, nonmonotonic, overflow or tampered telemetry. Test stopping/accounting with deterministic transports and retain all read-only/no-delegation, containment, command authentication and default review-lens gates.

This is an active budget/accounting defect, distinct from #677 placeholder prices, #678 observed-model pricing, #680 review completion and #689 source-input preflight. The current measurement is terminal, no paid retry is running and no PR is merged on this evidence.