## ADDED Requirements

### Requirement: Planner proxy enforces effective Host token budgets before provider invocation
The Cloud planner-decision endpoint SHALL atomically reserve a conservative
bounded token amount before invoking its provider for an authenticated Host
using Cloud planner transport with an effective token budget, and SHALL reject
the request without invoking the provider when the reservation would exceed
the remaining budget.

#### Scenario: Budget permits a planner decision
- **WHEN** the Host has sufficient budget after used and reserved tokens are
  considered
- **THEN** the endpoint creates a reservation and invokes the configured
  provider exactly once

#### Scenario: Budget is exhausted
- **WHEN** a next planner decision would exceed the Host's effective budget
- **THEN** the endpoint returns a structured failure without invoking the
  configured provider

### Requirement: Planner proxy settles provider-reported token usage without persisting prompts
The Cloud planner-decision endpoint SHALL settle its reservation to the
provider-reported token usage when available and SHALL retain only non-secret
metering metadata, never the raw prompt, screenshot, provider credentials, or
session/lease secret.

#### Scenario: Provider response includes usage
- **WHEN** the configured provider returns a valid tool-call decision and
  token-usage metadata
- **THEN** the endpoint records and returns the decision, settles the Host's
  reservation to the reported usage, and does not durably store request text
  or screenshot bytes

#### Scenario: Usage is indeterminate after failure
- **WHEN** a reservation exists but the endpoint cannot determine provider
  usage after a transport failure
- **THEN** the reservation remains until bounded expiry cleanup rather than
  being released as unused