## ADDED Requirements

### Requirement: Planner proxy enforces effective Host token budgets before provider invocation
The Cloud planner-decision endpoint SHALL atomically reserve a conservative
bounded token amount before invoking its provider for an authenticated Host
using Cloud planner transport with an effective token budget, and SHALL reject
the request without invoking the provider when the reservation would exceed
the remaining budget.

#### Scenario: Budget permits a planner decision
- **WHEN** the Host has sufficient budget after used and reserved tokens are
  considered
- **THEN** the endpoint creates a reservation and invokes the configured
  provider exactly once

#### Scenario: Budget is exhausted
- **WHEN** a next planner decision would exceed the Host's effective budget
- **THEN** the endpoint returns a structured failure without invoking the
  configured provider

### Requirement: Planner proxy settles provider-reported token usage without duplicating planner decision content
The Cloud planner-decision endpoint SHALL settle its reservation to the
provider-reported token usage when available and SHALL retain only non-secret
metering metadata in its usage event, never raw prompt text, screenshot bytes,
provider credentials, or session/lease secrets. This does not constrain the
separate bounded planner-decision history defined by `cloud-planner-proxy`.

#### Scenario: Provider response includes usage
- **WHEN** the configured provider returns a valid tool-call decision and
  token-usage metadata
- **THEN** the endpoint records and returns the decision, settles the Host's
  reservation to the reported usage, and records a usage event without request
  text or screenshot bytes

#### Scenario: Usage is indeterminate after failure
- **WHEN** a reservation exists but the endpoint cannot determine provider
  usage after a transport failure
- **THEN** the reservation remains until bounded expiry cleanup rather than
  being released as unused