Ephemeral admission and accounting for one execution tree.

The handle is runtime-only: do not serialize it. Each node retains its own restrictions and every admission checks all ancestors atomically. Model slots are fail-fast, never held while tools or delegates run. Usage is reconciled by operation identity; this is not exactly-once execution of external effects. request_count counts admitted Model attempts (not necessarily HTTP requests for a custom Model); tool_calls counts exact batch reservations, not dispatches or successful effects. Terminal finalization is independent of metric coverage.

Deadlines stop admission and are propagated as native model/tool timeouts by the core. Arbitrary application callbacks are not preempted or sandboxed. A lost scope stops independently running descendants; the root caller detects loss at cooperative boundaries rather than having its application process killed.