Nested Codex Workers observe token budgets only after native-turn completion #714

Nested Codex Workers can consume more than the remaining run token allowance before MACO receives any usage observation. Admission reserves an estimate, while the terminal execution route exposes usage only when the native turn completes.

The behavior was observed on the PR #710 integration source, commit e66870bdd507fd4f732719ba0679e69e90ec277d. In a contained parent/two-Worker qualification, the configured run ceiling was 220,000 tokens. Before the second Worker started, 137,035 tokens had settled and 82,965 remained. Its 16,000-token admission reservation fit, but its sole terminal usage observation was 191,231 tokens. The final accounted total was 328,266, exceeding the ceiling by 108,266. No subsequent generation was dispatched. This is delayed observation, not duplicate accounting.

src/supervise/nested_worker_executor.rs reserves before invoking the runner and settles after it returns. ExternalAgentCommand::uses_live_app_server_budget in src/external_agent.rs covers the supported read-only and primary duplex app-server shapes; the managed writable terminal Worker is outside those shapes. The existing thread/tokenUsage/updated interruption path in src/codex_app_server.rs therefore does not control this Worker during its native turn.

To reproduce the relevant boundary, configure a real contained nested Codex run with two serial Workers, a finite token ceiling, and per-Worker reservation estimates smaller than actual consumption. Observe the settled allowance before the second dispatch, its usage events, and final accounting. Preserve the source/version and failed run evidence. A further provider attempt is not needed to establish the already observed incident.

Acceptance criteria:

• Use a supported within-turn usage/control boundary for eligible nested Workers, preserving their native workspace-write sandbox, path claims, containment, source identity and cancellation/reaping controls.
• Bind any live grant to the exact admitted invocation and reservation. Stop further work after observed exhaustion and settle trustworthy observations exactly once, including rejected completion and partial failure.
• Distinguish estimate-based admission, interruption after a usage notice, and any unsupported strict per-request spending guarantee. Do not claim a hard provider-call bound from terminal totals or increase estimates as a substitute for control.
• Add a production-route regression with multiple correlated usage observations and exhaustion, asserting interruption, no subsequent dispatch and correct accounting. Refuse unsupported required guarantees before provider release.
• Complete a finite real contained Worker qualification after the correction; preserve the original failure and complete the relevant formatting, lint and independent review gates.

This differs from #692, which addresses settlement ordering after a child returns, and #680, which addresses three-lens Researcher review completion. Actual monetary cost, per-request token boundaries and the model/effort actually served were not established by this incident.