Recovery accounting transaction

Chose request-owned cumulative usage and ordered Codex quota accumulators over mutating each response because failed-continuation metadata must survive recovery without escaping the rollback boundary. Merge validated failed-terminal and recovered metadata inside the recovery try; overflow must synchronously route through fixed recall failure, preserving only previously validated accounting and never converting failure into completion.