ci / vet-and-test (pull_request) Successful in 53s
Why: the controlled A01 wrapper still allowed another paid request after a malformed tool terminal with returned Usage. Evidence: local SSE RED→GREEN tests cover invalid JSON, missing DONE, late errors, missing Usage, rejected checkpoints, cross-run stop and record-write failure; live-tag fake tests and full Backend vet/tests pass. Impact: diagnostic metadata and batch-wide fail-closed stop only; no new paid authorization or production route change. Refs: U3 r0.4 design; internal/server/work_checkpoint_eval_test.go