Function push_chunk_bounded 

pub fn push_chunk_bounded(
    acc: &mut Vec<ToolCallChunk>,
    running_bytes: &mut u64,
    chunk: ToolCallChunk,
    max_total_bytes: u64,
    max_chunks: u64,
) -> Result<(), KernelError>

Fallible per-chunk push for KernelError-returning accumulators. Denies before materializing past max_total_bytes (StreamBytes) OR past max_chunks retained chunks (StreamChunks), and maps a failed allocation under strict overcommit to a typed deny (Allocation) rather than an abort.

The chunk-count bound closes the tiny-chunk gap in the byte-only bound: a connector using this as its advertised accumulation-time limit could otherwise accept millions of tiny chunks that each stay under max_total_bytes while acc retains millions of ToolCallChunk objects (and receipt signing later allocates a hash per chunk). Both caps use 0 = unlimited.