Zero-credit generation request still reaches provider before returning 402

We reproduced another credit-admission issue while benchmarking OpenSaaS with Kronowave Factory.

With an authenticated account set to 0 credits, we dispatched a native generation request while observing the provider boundary.

Observed result: HTTP response: 402 Provider requests: 1 Final credit balance: 0 New owned outputs: 0

The user-facing result is correct, but the generation request still reached the provider before the insufficient-credit condition stopped the workflow.

Expected behavior was for a zero-credit request to be rejected before any provider invocation.

We repaired the flow by reserving/checking credit atomically before provider work, then ran a fresh F0–F3 baseline and repeated the negative checks successfully.

We have the exact source identity, provider-boundary observation, database state, and repair evidence if useful.