Record attributable coding usage with explicit unknown cost

[witbrock]

Merge decision: ready — the existing DGX controller can retain attempt-bound token observations and task-local deduplicated subtotals, with explicit incomplete coverage and unknown cost.

User outcome

Native task #V#task_agent_5e9a7e747de3831975ba3e06798dcadf asks for coding-attempt usage without treating subscription consumption as an invoice. Previously canonical attempts exposed timing and unknown cost but no usage. A supported fresh DGX exec now retains input/cached-input/output counters, root thread identity, available turn identity and an event-stream digest on its existing canonical attempt.

Material changes

• Capture only an unambiguous single-root-turn exec stream through the trusted controller. Preserve configured model separately from unknown provider-observed identity. Exclude nested child/tool totals; unsupported streams remain unknown.
• Persist through the existing task service and project through existing task reads. Replayed receipts are idempotent; repeated thread aggregates count once; conflicting thread observations are excluded rather than guessed as deltas. Cached input is not added twice.
• Keep timing/completion independent of optional accounting persistence. Cost remains unknown with null amount/currency; no API price estimate or actual charge is manufactured.
• Inspect the operator-owned VS Code bridge and replay its existing timing patch. It binds a consumer thread but has no task-specific token receipt, so the shared adapter records unknown coverage and the thread reference. No bridge installation or live configuration is changed.

Evidence

• 58 tests passed using PDM: test_coding_execution_usage.py, test_task_execution_timing.py, and test_codex_von_retry.py, with VON_USE_MOCK_DB=1 and the inspected operator source supplied through CODING_TIMING_MAC_BRIDGE_SOURCE.
• Supported controller launch/stdout capture/result/message path followed by canonical service read-back, repeated delivery, retry deduplication, malformed/absent usage, child records, conflicting aggregates, and accounting-persistence failure.
• Both operator patch replay cases passed against source SHA-256 a665516dfe918b6e77046867721ad471c787535bf5e8a92d7aa677c57f19df5b.
• Ruff checks passed for the new usage module/tests and modified canonical service; minimum Python 3.11 syntax check passed for 1,582 files; PDM lock check and diff whitespace check passed.

Ship boundary

Minimum evidence is the isolated supported-controller path and canonical read-back; these tests do not claim live provider billing reconciliation or installed adapter activation. Stop-ship conditions are double counting, invented charges or accounting blocking timing. None was observed.

Task-wide coverage remains partial; interactive bridge usage remains unknown. Usage persistence failures are reported and can be retried by replaying the existing finish method, without another consumer. No historical backfill, cross-task billing ledger, subscription/account/credential change or public deployment is included. The task does not request deployment. The controller owns canonical task updates and completion messaging.