Summary

When a provider's budget is exhausted, the pre-dispatch gate (#4800/#4801) rejects the entire call before the FallbackDriver gets a chance to try alternative providers. A Moonshot-exhausted agent with an ollama fallback configured gets blocked entirely instead of falling back.

Proposed design

Inject a ProviderBudgetChecker trait (defined in librefang-llm-driver, the trait crate) into FallbackChain. Before each provider attempt, check its budget. If exhausted, skip to next provider. Stamp actual_provider on CompletionResponse so usage is recorded against the provider that actually served the request.

Key components:

1. ProviderBudgetChecker trait in librefang-llm-driver (avoids circular dep)
2. FallbackChain checks budget per-provider before calling driver
3. KernelBudgetChecker implements the trait using MeteringEngine
4. actual_provider: Option<String> on CompletionResponse → AgentLoopResult → UsageRecord
5. Remove the pre-dispatch provider gate from messaging.rs (the chain handles it internally now)

Related

• fix(kernel): provider budget checked post-call only — streaming leaks tokens past exhausted budgets #4800, fix(kernel): pre-dispatch provider budget gate prevents streaming token leak #4801 (pre-dispatch gate — current fix, but blocks fallback)
• feat(kernel): provider-aware token budget with pre-dispatch gating #4757 (closed — attempted BudgetGatedDriver but wiring was incomplete)
• check_quota / record_usage time-of-check / time-of-use race — concurrent calls pass quota then each charge #3736 (TOCTOU race — fixed with reserve/settle)