# Eve capacity and denial-of-wallet evidence

Task 15.6 is admitted only when the machine-verifiable record at
`eve-sota-capacity-budget/2026-09-16.json` passes its semantic verifier, schema,
focused unit and route tests, live Redis concurrency tests, watcher and
operation policy tests, typecheck, build, lint, and formatting gates.

The assistant reserves its estimated output before provider dispatch in one
atomic operation across task, session, actor, tenant, fleet, and channel scopes.
The task ceiling also binds the seven-call maximum (six normal calls plus one
validation repair). The turn input is bounded by UTF-8 bytes. Successful turns
settle the reservation to actual output; failed reconciliation keeps the more
conservative estimate charged. Production cannot fall back to process-local
state when Redis is absent.

Watchers retain separate finite evaluation, delivery, delivery-attempt, token,
and micro-USD budgets. Their operation policy also bounds concurrency, retries,
deadlines, and durable-outbox depth. The shared BFF rate limiter makes the
window/block decision atomically in Redis and returns `Retry-After` on refusal.

## Boundary

Output tokens are a denial-of-wallet capacity proxy, not a dollar-denominated
provider invoice. Generation spend has its own gate. Tenant scope applies when a
tenant is present; member-plan scope applies when a finite member allowance is
supplied, while operators have a finite operator ceiling. Local development uses
a conformance-equivalent in-memory store, but production requires Redis. The
defaults are safe finite ceilings, not production traffic or SLO claims, and
operators must tune them from observed demand without making them unbounded.