Task 15.6 is admitted only when the machine-verifiable record at
eve-sota-capacity-budget/2026-09-16.json passes its semantic verifier, schema,
focused unit and route tests, live Redis concurrency tests, watcher and
operation policy tests, typecheck, build, lint, and formatting gates.
The assistant reserves its estimated output before provider dispatch in one atomic operation across task, session, actor, tenant, fleet, and channel scopes. The task ceiling also binds the seven-call maximum (six normal calls plus one validation repair). The turn input is bounded by UTF-8 bytes. Successful turns settle the reservation to actual output; failed reconciliation keeps the more conservative estimate charged. Production cannot fall back to process-local state when Redis is absent.
Watchers retain separate finite evaluation, delivery, delivery-attempt, token,
and micro-USD budgets. Their operation policy also bounds concurrency, retries,
deadlines, and durable-outbox depth. The shared BFF rate limiter makes the
window/block decision atomically in Redis and returns Retry-After on refusal.
Boundary#
Output tokens are a denial-of-wallet capacity proxy, not a dollar-denominated provider invoice. Generation spend has its own gate. Tenant scope applies when a tenant is present; member-plan scope applies when a finite member allowance is supplied, while operators have a finite operator ceiling. Local development uses a conformance-equivalent in-memory store, but production requires Redis. The defaults are safe finite ceilings, not production traffic or SLO claims, and operators must tune them from observed demand without making them unbounded.