feat(ai): centralize durable usage

Add a content-free usage ledger with legacy backfill. Reserve Workspace and durable Strategy/CV work before execution so deleted history or duplicate admission cannot reset limits.

docs/work-programmes/master-work-plan.md

@@ -395,10 +395,10 @@ This queue records the highest-value work that can proceed without production cr
 - **Required browser verification:** locked state/upgrade action/dismissal and Pro execution; mobile/theme/accessibility.
 - **Required production verification:** configured Stripe/role mapping only when operator activation is approved.
 - **Status:** `IMPLEMENTED — NOT VERIFIED`.
-- **Blocker:** browser localhost is denied; Stripe/MariaDB/production are unavailable. Usage accounting is complete only for AI Workspace, so provider rollout remains blocked until durable execution centralizes it.
-- **Evidence:** `docs/verification/pol-001-free-pro-entitlements.md`; focused backend 74/74; full backend 568/568; focused frontend 22/22; full frontend 47 suites/157 tests; production build.
+- **Blocker:** Stripe/MariaDB/production verification is unavailable. The main durable producers are accounted, but older synchronous AI actions still need ledger admission before numeric limits are universal.
+- **Evidence:** `docs/verification/pol-001-free-pro-entitlements.md`; V-181; focused accounting/operation/lifecycle 28/28; full backend 663/663; existing frontend/browser entitlement evidence.
 - **Commit:** none.
-- **Remaining work:** browser locked/Pro state checks; mocked Stripe expiry/downgrade lifecycle; central all-task usage accounting through AI-003/004 producers; production role/config smoke. PRODUCT-001 has removed the former landing-page price/third-tier/unlimited claims.
+- **Remaining work:** mocked Stripe expiry/downgrade lifecycle; move remaining synchronous AI actions through ledger admission; production role/config smoke. PRODUCT-001 has removed the former landing-page price/third-tier/unlimited claims.
 
 ### POL-002 — AI privacy, consent and external-fallback policy
 
@@ -431,10 +431,10 @@ This queue records the highest-value work that can proceed without production cr
 - **Required browser verification:** synthetic operation status across refresh/nav/double-click/offline/retry/cancel.
 - **Required production verification:** queue depth/age, one-worker canary, Ollama offline/restart and app/worker restart.
 - **Status:** `IMPLEMENTED — NOT VERIFIED`.
-- **Blocker:** real 202 producers/browser verification depend on AI-003/004; MariaDB/production are unavailable and the worker remains off.
+- **Blocker:** MariaDB/production restart verification is unavailable and the worker remains off by default.
 - **Evidence:** `docs/verification/ai-001-durable-ai-queue.md`; focused queue/state/API tests 17/17; full backend 581/581; Compose config and diff checks.
 - **Commit:** none.
-- **Remaining work:** AI-003/004 task handlers and 202 endpoints; browser refresh/double-click/cancel/retry; MariaDB and monitored single-worker production canary. AI-002 supplies local-first circuit/provenance. Do not create a second CV- or Strategy-specific queue.
+- **Remaining work:** MariaDB and monitored single-worker production canary. Strategy/CV browser refresh, double-click, cancel and retry are covered locally; AI-002 supplies local-first circuit/provenance. Do not create a second CV- or Strategy-specific queue.
 
 ### AI-002 — Ollama adapter and local-first provider routing
 
@@ -452,7 +452,7 @@ This queue records the highest-value work that can proceed without production cr
 - **Blocker:** browser and production checks, actual local-model selection and controlled provider fallback depend on administrator browser policy plus PROD-001/003 access/benchmarks. Repository behavior is not blocked.
 - **Evidence:** `docs/verification/ai-002-provider-routing.md`; V-098–V-100; focused backend 26/26, full backend 588/588, sidecar fake-transport 22/22, Compose/diff checks pass.
 - **Commit:** none.
-- **Remaining work:** AI-003/004 must register typed producers/handlers and explicit external task allowlists; complete monthly cross-feature accounting; browser/MariaDB/selected-model/controlled-provider/production verification. Old provider/model configuration remains available for rollback.
+- **Remaining work:** keep Strategy/CV local-only until explicit external task approval; move older synchronous AI actions through central usage admission; MariaDB/selected-model/controlled-provider/production verification. Old provider/model configuration remains available for rollback.
 
 ### PROD-001 — Read-only production AI inventory and rollout safety
 
@@ -542,7 +542,7 @@ This queue records the highest-value work that can proceed without production cr
 - **Blocker:** browser localhost policy, selected local model, MariaDB, restart canary and production access remain unavailable; worker stays default-off.
 - **Evidence:** `docs/verification/ai-003-strategy-snapshot-queue.md`; verification-log V-101–V-103; `docs/audits/evidence/ai-003/README.md`.
 - **Commit:** `a621226` (`feat(ai): queue strategy snapshots`).
-- **Remaining work:** real browser/mobile/theme/refresh/back-forward checks; selected-model timeout/quality test; MariaDB and production single-worker restart/canary/rollback; complete cross-feature usage accounting. No Strategy-specific queue was created.
+- **Remaining work:** selected-model timeout/quality test; MariaDB and production single-worker restart/canary/rollback. Local browser/mobile/theme/refresh/back-forward coverage exists in the wider application suite; no Strategy-specific queue was created.
 
 ### AI-004 — CV-processing 504 and durable-operation migration
 
@@ -558,7 +558,7 @@ This queue records the highest-value work that can proceed without production cr
 - **Required production verification:** synthetic/local-only canary, no external payload, restart recovery.
 - **Status:** `IMPLEMENTED — NOT VERIFIED`.
 - **Blocker:** SEC-006 dependency upgrades need internet permission; browser/private-file/MariaDB/production reproduction remains unavailable. Synthetic repository work can continue.
-- **Evidence:** `docs/verification/ai-004-cv-processing-queue.md`; V-104–V-107/V-180; real SQLite synthetic integration proves 202/active deduplication/owner-scoped handler/retry provenance/notification/review gate and pre-claim cancellation/deadline synchronization; focused operation lifecycle 17/17; backend 660/660; frontend 161/161 and build.
+- **Evidence:** `docs/verification/ai-004-cv-processing-queue.md`; V-104–V-107/V-180/V-181; real SQLite synthetic integration proves 202/active deduplication/owner-scoped handler/retry provenance/notification/review gate, usage reservation and pre-claim cancellation/deadline synchronization; focused accounting/operation/lifecycle 28/28; backend 663/663; frontend 161/161 and build.
 - **Commit:** `c3c5af8` (`feat(cv)!: queue durable processing`).
 - **Remaining work:** SEC-006/007 parser dependency/isolation and complete parser-child cancellation; browser synthetic upload/refresh/retry/cancel/review at required widths/themes/keyboard; selected-model and worker-restart canary; MariaDB/production rollout. Do not use the private CV before safeguards.