[htayj]

Fixes #144

Problem

An inference failure without reported usage fails the mission and cancels other supervised work. Responses that omit usage already block the mission, but also cancel admitted work. Unknown spend should prevent new mission work without cancelling children already running.

Fix

• mission--settle-inference retains the failure report and unknown accounting, then blocks without cancelling running operations. Known token overspend still exhausts the mission and cancels work.
• mission--operation-draining-p, mission--admit and mission-agent-terminal-p allow only a live, uncancelled child of the exact blocked mission to continue. Existing deadlines, budgets and cancellation checks apply.
• mission-task-job-run, agent--tool-thread-function and tool-execution-invoke :around preserve the admitted child's identity across execution boundaries. mission--supervise rechecks cancellation at registration.
• task-orchestrator-start-jobs refuses new mission children before consuming session or pool identity, including queued tasks that have not started.
• mission--account-inference settles known zero usage when unwinding before the supervised provider callback starts. After callback entry, missing usage is unknown; settlement is exactly once.

Tests

• The child-draining case in mission-inference-tests.lisp runs a real child through a gated tool while another streaming request fails without usage. It verifies BLOCKED, refusal of new children, successful child continuation, retained failure evidence and unknown usage, exact known charges, and complete reservation settlement.
• test-mission-inference-cancel-before-dispatch verifies known zero usage and complete reservation settlement when cancellation prevents provider dispatch.
• The existing interruption case expects BLOCKED rather than FAILED when a request ends without usage.

Validation

On 0.67.10 (1b3f325b), Linux x86-64, SBCL 2.6.6; candidate 66e77f35:

• ./script/check --source passes on unchanged upstream and this PR.
• mission-inference RED/GREEN on the same 9 cases / 63 checks: unchanged 1b3f325b production with only this PR's test changes fails 3 cases / 11 checks (exit 1); this PR passes all 63 checks (exit 0). The RED failures are test-mission-inference-unknown-drains-child, test-mission-inference-cancel-before-dispatch, and test-mission-inference-unknown-and-interruption-cleanup.
• Full ./script/check: 1,246 cases / 16,874 checks / 2 failed cases; unchanged upstream: 1,244 cases / 16,857 checks / the same 2 failed cases. Both exit 1; source and recovery checks pass. Failures: test-telemetry-subprocess-deadlines (libcrypto.so.3 reopen) and test-model-catalog-standalone-http (bounded-body assertion).
• Historical 0.67.8 probe matrix: 120 runs passed all other assertions; late dispatch was recorded separately in 60 runs. Cancel-after-registration late dispatch was reproduced on unchanged upstream (5/5); the deadline timings were not A/B-attributed.

[luciusmagn]

merged via rebase, thank you!