@bytesbrains/cruise-worker 0.0.0-stage → 0.12.0

package/migrations/0090_board_followups_2026_10.sql

@@ -0,0 +1,196 @@
+-- Five frontier rows, the xAI rows re-cited, and a Mistral re-host retired
+-- (#534, #559 — the model board's 2026-09-24 and 2026-10-01 follow-ups).
+--
+-- This migration catalogues and prices. It staffs no lane: a member nobody has
+-- measured makes the lane's capability `null` (`src/lanes.ts`), so restaffing
+-- the coding lanes with Opus 5.5 and GPT-6.1 Sol is a later migration, after a
+-- conformance run has written their flags — the 0077 → 0088 order.
+--
+-- Every figure fetched 2026-10-02 UTC from the host's own pages, cited per row.
+-- Not the board: both issues say so, and #79 / #122 say why.
+--
+-- ## Left out, and why
+--
+-- **`gpt-6-sol`** (#534). OpenAI's starting points replaced it with
+-- `gpt-6.1-sol` on 2026-09-29 (#559) at the same headline rate, so cataloguing
+-- it a week later would add a row whose only future is a disable.
+--
+-- **Gemini 2.5, Gemini 3.1 Flash-Lite, Claude Sonnet 4.5, Groq's Llama rows**
+-- (#534, #559). None is in this catalogue, so the access limits, shutdown dates
+-- and enterprise gating the board reported reach nothing here. The Groq rows
+-- held are the two gpt-oss models (0053), which the gating does not name.
+--
+-- **Gemini 3.8 Flash's window** (#559). The board corrected its rounding to
+-- 1M / 64K; 0049 already holds the page's 1,048,576 / 65,536.
+--
+-- **Perplexity Sonar** (#559). 0058 priced `perplexity/sonar*` per request, but
+-- no `models` or `upstreams` row was ever written, so those components price a
+-- model nothing can route. The end of Sonar's Chat Completions support on
+-- 2026-09-27 changes nothing that serves; it does mean the next person to add
+-- Perplexity starts from the Agent API, not from 0058's rows.
+
+-- ── OpenAI ────────────────────────────────────────────────────────────────────
+-- https://developers.openai.com/api/docs/models/gpt-6.1-sol
+-- https://developers.openai.com/api/docs/models/gpt-6-luna
+--
+-- Both: window 1,050,000, max output 128,000, and the long-context rule 0049
+-- and 0077 already hold — prompts over 272K input tokens pay 2x input and
+-- cache and 1.5x output for the whole request, so `prompt_tokens_from` is
+-- 272001. Batch / Flex are not written, for 0049's reason.
+--
+--   gpt-6.1-sol  $2 / $10, cached $0.10 — a 5% cache read, which is #559's
+--                "deeper discount". Effort accepts low, medium, high, xhigh,
+--                max: **`none` and `minimal` are refused upstream**. Cruise
+--                passes `reasoning_effort` through unchanged
+--                (`src/chat-openai-responses.ts`), so a caller sending `none`
+--                gets OpenAI's 400 — a property of the request, not of a lane,
+--                and not something conformance can measure for every caller.
+--   gpt-6-luna   $0.10 / $0.50, cached $0.01. Effort accepts `none`.
+--
+-- Both match `isOpenAIReasoningModel` (`^(gpt-6|gpt-5\.6)`), so their tool calls
+-- take the `/v1/responses` adapter #545 built for gpt-6-astra with no code here.
+-- `data_retention` is `retained` on the same guide 0049 and 0077 cite.
+INSERT INTO models (id, upstream_id, upstream_model, max_context, max_output,
+                    data_retention, data_retention_source, data_retention_as_of) VALUES
+  ('openai/gpt-6.1-sol', 'openai', 'gpt-6.1-sol', 1050000, 128000,
+   'retained', 'https://developers.openai.com/api/docs/guides/your-data', '2026-10-02'),
+  ('openai/gpt-6-luna',  'openai', 'gpt-6-luna',  1050000, 128000,
+   'retained', 'https://developers.openai.com/api/docs/guides/your-data', '2026-10-02');
+
+INSERT INTO price_observations
+  (observed_at, model, effective_from, prompt_tokens_from, peak_utc,
+   input_micros_per_mtok, output_micros_per_mtok, cached_input_micros_per_mtok, source, note)
+VALUES
+  ('2026-10-02 00:00:00', 'openai/gpt-6.1-sol', '2026-10-02',      0, '',
+    2000000, 10000000,  100000, 'https://developers.openai.com/api/docs/models/gpt-6.1-sol',
+   'First observation: GPT-6.1 Sol (#559, 0090).'),
+  ('2026-10-02 00:00:00', 'openai/gpt-6.1-sol', '2026-10-02', 272001, '',
+    4000000, 15000000,  200000, 'https://developers.openai.com/api/docs/models/gpt-6.1-sol',
+   'Long-context tier: >272K input tokens, 2x input/cache and 1.5x output for the whole request.'),
+  ('2026-10-02 00:00:00', 'openai/gpt-6-luna',  '2026-10-02',      0, '',
+     100000,   500000,   10000, 'https://developers.openai.com/api/docs/models/gpt-6-luna',
+   'First observation: GPT-6 Luna (#534, 0090).'),
+  ('2026-10-02 00:00:00', 'openai/gpt-6-luna',  '2026-10-02', 272001, '',
+     200000,   750000,   20000, 'https://developers.openai.com/api/docs/models/gpt-6-luna',
+   'Long-context tier: >272K input tokens, 2x input/cache and 1.5x output for the whole request.');
+
+-- ── Anthropic ─────────────────────────────────────────────────────────────────
+-- https://platform.claude.com/docs/en/models/opus-5-5/overview
+-- https://platform.claude.com/docs/en/models/sonnet-5-5/overview
+--
+-- Both: window 1M, max output 128K, no long-context tier on either page.
+-- `cached_input` is the cache *read* rate, as in 0053; the write rates have a
+-- component (0058) and no reader yet.
+--
+--   claude-opus-5-5    $4 / $20, cache read $0.20 — 5% of input, which the
+--                      page flags as this model's exception to the usual 10%.
+--   claude-sonnet-5-5  $2 / $10, cache read $0.20.
+--
+-- **What both narrow, and which of it Cruise sees** (#534, #559, and the pages):
+--
+--   - Forced tool use — `tool_choice` `any` or a named `tool` — returns 400.
+--     Conformance sends no `tool_choice`, so `tools = 1` will be measured true
+--     and a lane will promise tools to a caller whose forced request then 400s
+--     and falls back. That is a gap in the suite, not in this row, and has its
+--     own issue rather than a guess written here.
+--   - Thinking cannot be disabled (Opus 5.5; Sonnet 5.5's floor is
+--     `between_tools`). `src/messages-translate.ts` already drops `thinking`
+--     on the way in, so Cruise never asks for it off.
+--   - Thinking blocks are tied to the producing model and account. The same
+--     file returns no `thinking` blocks to the caller, so no history replays
+--     one across tenant keys.
+--   - Sonnet 5.5 refuses a non-default `temperature`, `top_p` or `top_k` with
+--     400. Callers that send one get the host's answer, as with any 400.
+--
+-- `retained` on the privacy page 0053 quoted, unchanged for these rows.
+INSERT INTO models (id, upstream_id, upstream_model, max_context, max_output,
+                    data_retention, data_retention_source, data_retention_as_of) VALUES
+  ('anthropic/claude-opus-5-5',   'anthropic', 'claude-opus-5-5',   1000000, 128000,
+   'retained', 'https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training', '2026-10-02'),
+  ('anthropic/claude-sonnet-5-5', 'anthropic', 'claude-sonnet-5-5', 1000000, 128000,
+   'retained', 'https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training', '2026-10-02');
+
+INSERT INTO price_observations
+  (observed_at, model, effective_from, prompt_tokens_from, peak_utc,
+   input_micros_per_mtok, output_micros_per_mtok, cached_input_micros_per_mtok, source, note)
+VALUES
+  ('2026-10-02 00:00:00', 'anthropic/claude-opus-5-5',   '2026-10-02', 0, '',
+    4000000, 20000000, 200000, 'https://platform.claude.com/docs/en/models/opus-5-5/overview',
+   'First observation: Claude Opus 5.5 (#534, 0090). Cache read is 0.05x base on this model, which the page states explicitly.'),
+  ('2026-10-02 00:00:00', 'anthropic/claude-sonnet-5-5', '2026-10-02', 0, '',
+    2000000, 10000000, 200000, 'https://platform.claude.com/docs/en/models/sonnet-5-5/overview',
+   'First observation: Claude Sonnet 5.5 (#559, 0090).');
+
+-- Web search at $10 per 1,000, as 0058 wrote for every Claude row it held —
+-- re-read on the tool's page the same day.
+INSERT INTO price_components
+  (observed_at, model, effective_from, component, variant, micros, per, source, note)
+VALUES
+  ('2026-10-02 00:00:00', 'anthropic/claude-opus-5-5',   '2026-10-02', 'search', '', 10000000, 1000,
+   'https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool', 'First observation (0090).'),
+  ('2026-10-02 00:00:00', 'anthropic/claude-sonnet-5-5', '2026-10-02', 'search', '', 10000000, 1000,
+   'https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool', 'First observation (0090).');
+
+-- ── xAI ───────────────────────────────────────────────────────────────────────
+-- https://docs.x.ai/developers/pricing — where `docs.x.ai/docs/models`, 0053's
+-- source, now lives (#534).
+--
+-- `grok-4.7`: window 500k, same rates as `grok-4.6`, the same "< 200k" /
+-- "≥ 200k" boundary 0053 wrote as `prompt_tokens_from` 200000. xAI offers no
+-- Batch API for it, which Cruise does not use. No max output stated, so NULL
+-- and `checkLimits` derives one (0023). `retained` on the page 0061 read for
+-- every xAI row, re-read today: stored 30 days for abuse review, *"never trains
+-- on your API inputs or outputs without your explicit permission."*
+INSERT INTO models (id, upstream_id, upstream_model, max_context, max_output,
+                    data_retention, data_retention_source, data_retention_as_of) VALUES
+  ('grok/grok-4.7', 'grok', 'grok-4.7', 500000, NULL,
+   'retained', 'https://docs.x.ai/developers/faq/security', '2026-10-02');
+
+-- The four rows 0053 sourced to the old URL, re-read on the new page: **every
+-- figure unchanged**. A re-observation rather than an edit, since
+-- `price_observations` is append-only (0048) — the old rows keep the URL they
+-- were read from, and these say where the same numbers are read today.
+INSERT INTO price_observations
+  (observed_at, model, effective_from, prompt_tokens_from, peak_utc,
+   input_micros_per_mtok, output_micros_per_mtok, cached_input_micros_per_mtok, source, note)
+VALUES
+  ('2026-10-02 00:00:00', 'grok/grok-4.7',       '2026-10-02',      0, '',
+   2000000,  6000000,  500000, 'https://docs.x.ai/developers/pricing', 'First observation: Grok 4.7 (#534, 0090).'),
+  ('2026-10-02 00:00:00', 'grok/grok-4.7',       '2026-10-02', 200000, '',
+   4000000, 12000000, 1000000, 'https://docs.x.ai/developers/pricing', 'Long-prompt tier, stated as prompts at or above 200k tokens.'),
+  ('2026-10-02 00:00:00', 'grok/grok-4.6',       '2026-10-02',      0, '',
+   2000000,  6000000,  500000, 'https://docs.x.ai/developers/pricing', 'Re-read at the moved URL (#534, 0090); unchanged.'),
+  ('2026-10-02 00:00:00', 'grok/grok-4.6',       '2026-10-02', 200000, '',
+   4000000, 12000000, 1000000, 'https://docs.x.ai/developers/pricing', 'Re-read at the moved URL (#534, 0090); unchanged.'),
+  ('2026-10-02 00:00:00', 'grok/grok-4.5',       '2026-10-02',      0, '',
+   2000000,  6000000,  300000, 'https://docs.x.ai/developers/pricing', 'Re-read at the moved URL (#534, 0090); unchanged.'),
+  ('2026-10-02 00:00:00', 'grok/grok-4.5',       '2026-10-02', 200000, '',
+   4000000, 12000000,  600000, 'https://docs.x.ai/developers/pricing', 'Re-read at the moved URL (#534, 0090); unchanged.'),
+  ('2026-10-02 00:00:00', 'grok/grok-4.3',       '2026-10-02',      0, '',
+   1250000,  2500000,  200000, 'https://docs.x.ai/developers/pricing', 'Re-read at the moved URL (#534, 0090); unchanged.'),
+  ('2026-10-02 00:00:00', 'grok/grok-4.3',       '2026-10-02', 200000, '',
+   2500000,  5000000,  400000, 'https://docs.x.ai/developers/pricing', 'Re-read at the moved URL (#534, 0090); unchanged.'),
+  ('2026-10-02 00:00:00', 'grok/grok-build-0.1', '2026-10-02',      0, '',
+   1000000,  2000000,  200000, 'https://docs.x.ai/developers/pricing', 'Re-read at the moved URL (#534, 0090); unchanged.'),
+  ('2026-10-02 00:00:00', 'grok/grok-build-0.1', '2026-10-02', 200000, '',
+   2000000,  4000000,  400000, 'https://docs.x.ai/developers/pricing', 'Re-read at the moved URL (#534, 0090); unchanged.');
+
+-- ── Mistral's GLM 5.2 re-host ─────────────────────────────────────────────────
+-- Mistral deprecated its hosted `zai-glm-5-2` on 2026-09-29 and retires it on
+-- 2026-10-31 (#559; https://docs.mistral.ai/getting-started/models/). It has
+-- never served here either: every request to it has been a 403 on a Labs
+-- entitlement this account lacks (0041, and `src/doctor-upstreams.ts`). No
+-- migration put it in a lane or a fallback chain; a chain written since through
+-- `fallback:set` is data in that database, and a disabled member is skipped.
+--
+-- Disabled, never deleted: the ledger may name it. Mistral's replacement, GLM
+-- 5.3 as a third-party model, is not added — Cruise already reaches GLM 5.3 on
+-- Workers AI (0040), and a second re-host of another lab's weights is the thing
+-- `upstreams.md` says to add only when nothing else carries the model. The
+-- price row stays, for 0062's reason: append-only, and unreachable is not free.
+UPDATE models
+   SET enabled            = 0,
+       measured_at        = NULL,
+       measured_by        = NULL,
+       measurement_source = NULL
+ WHERE id = 'mistral/zai-glm-5-2';

package/migrations/0091_opus_5_5_coding_lanes.sql

@@ -0,0 +1,43 @@
+-- Claude Opus 5.5 takes Opus 5's seat in the four coding lanes (#534).
+--
+-- 0090 catalogued it; conformance run 36993727932 (dispatched 2026-10-02 UTC,
+-- narrowed to 0090's five rows) measured it on both environments: every check
+-- passed — chat, usage, tools, parallel tools, streaming, json_schema, vision,
+-- truncation. Measured before staffed, which is the 0077 → 0088 order: an
+-- unmeasured member would make each lane's capability `null` (`src/lanes.ts`).
+--
+-- A swap, not an addition: same position, same `quality_rank` 1. Anthropic
+-- holds two rank-1 seats in each lane already (Fable 5.1 and Opus 5), and Opus
+-- 5.5 is the newer model at a lower price ($4 / $20 against $5 / $25), so
+-- keeping Opus 5 beside it would add a member no allocation should prefer.
+-- Opus 5 stays catalogued and routable when pinned — Anthropic lists it as
+-- active — and disable-never-delete is about rows, not seats.
+--
+-- **GPT-6.1 Sol is not staffed.** The same run passed it on seven checks and
+-- failed vision on both environments (asked the colour of a red image, it said
+-- "Brown" on production and "Orange" on staging). A lane's capability is the
+-- intersection of its members, so seating it would take vision off every coding
+-- lane — screenshots through Claude Code included. `gpt-5.6-sol` keeps its seat
+-- until a re-measurement says otherwise.
+--
+-- What Opus 5.5 narrows and this lane inherits: forced `tool_choice` returns
+-- 400, which Fable 5.1 already does in every one of these lanes, and which
+-- conformance cannot see (#570). Thinking blocks are never returned to callers
+-- (`src/messages-translate.ts`), so its model-tied blocks do not replay.
+--
+-- Two statements for 0089's reason: `lane_members` is keyed (lane_id,
+-- model_id) and the control plane can rewrite a lane's members
+-- (`src/lanes-write.ts`), so an environment where Opus 5.5 was already added
+-- to one of these lanes would fail a bare UPDATE and stop the migration.
+-- OR IGNORE skips that row and the DELETE takes Opus 5 out either way.
+--
+-- Selection policy is unchanged.
+
+UPDATE OR IGNORE lane_members
+   SET model_id = 'anthropic/claude-opus-5-5'
+ WHERE lane_id IN ('bb/agentic-coding', 'bb/builder', 'bb/hunter', 'bb/code-review')
+   AND model_id = 'anthropic/claude-opus-5';
+
+DELETE FROM lane_members
+ WHERE lane_id IN ('bb/agentic-coding', 'bb/builder', 'bb/hunter', 'bb/code-review')
+   AND model_id = 'anthropic/claude-opus-5';

package/migrations/0092_deepseek_peak_holidays.sql

@@ -0,0 +1,83 @@
+-- DeepSeek's peak does not apply on Chinese public holidays (#569).
+--
+-- Read 2026-10-02 UTC at https://api-docs.deepseek.com/quick_start/pricing:
+--
+--   Peak:     "01:00 - 04:00 and 06:00 - 10:00 UTC, Monday through Friday,
+--              excluding Chinese public holidays."
+--   Off-peak: "All other hours are off-peak, including weekends and Chinese
+--              public holidays in full."
+--
+-- 0039 taught `peak_utc` the weekdays. It cannot say "excluding", so a weekday
+-- holiday was reserved and billed at 2x — the weekend bug 0039 fixed, in the
+-- shape of a calendar. Found by the model board's 2026-09-24 pass (#534) and
+-- confirmed on the page, during Golden Week, which was being over-billed as it
+-- was read. How the exemption is applied, and why a UTC date is the right key
+-- for these windows, is on `src/peak-calendar.ts`.
+--
+-- ## Which days
+--
+-- DeepSeek does not list them. The list is the State Council's own notice,
+-- 国务院办公厅关于2026年部分节假日安排的通知 (国办发明电〔2025〕7号, 2025-11-04),
+-- https://www.gov.cn/zhengce/zhengceku/202511/content_7047091.htm, read
+-- 2026-10-02 UTC. Every 放假 (rest) day it names is written, weekends included:
+-- they decide nothing under `mon-fri@`, and leaving them out would make this
+-- table a partial copy of the notice rather than the notice.
+--
+-- Two readings, both taken literally and both stated so the first invoice that
+-- disagrees is a correction rather than a surprise:
+--
+--   - **"Public holidays" is the whole 放假 period**, swapped days included
+--     (10-06 and 10-07 are rest days only because 09-20 and 10-10 are worked).
+--     The notice names them as one break and DeepSeek says "in full"; reading
+--     only the statutory days would bill a day the country is off at peak.
+--   - **Make-up workdays (上班) are not added as peak.** 2026's fall on a Sunday
+--     and a Saturday (01-04, 02-14, 02-28, 05-09, 09-20, 10-10), and the page
+--     says Monday through Friday. A Saturday worked in China is still a
+--     Saturday on DeepSeek's page.
+--
+-- Earlier 2026 dates are written too. Nothing re-prices a settled request — the
+-- ledger keeps what it charged — so they change no bill; they are here so the
+-- table answers "was this a holiday" for the whole year, not only from today.
+--
+-- **2027 is not here.** Its notice is published around November; a row written
+-- before it exists would be a guess. Until a migration adds it, 2027's holidays
+-- bill at peak — over-counting, the safe direction for a cap, and the same
+-- drift this migration closes. The next notice is a calendar item, not an
+-- incident.
+
+CREATE TABLE peak_exempt_days (
+  upstream_id  TEXT NOT NULL REFERENCES upstreams(id),
+  day          TEXT NOT NULL CHECK (day GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]'),
+  note         TEXT NOT NULL,
+  source       TEXT NOT NULL,
+  observed_at  TEXT NOT NULL,
+  PRIMARY KEY (upstream_id, day)
+);
+
+INSERT INTO peak_exempt_days (upstream_id, day, note, source, observed_at)
+WITH notice(day, note) AS (VALUES
+  ('2026-01-01', '元旦 New Year'),          ('2026-01-02', '元旦 New Year'),
+  ('2026-01-03', '元旦 New Year'),
+  ('2026-02-15', '春节 Spring Festival'),   ('2026-02-16', '春节 Spring Festival'),
+  ('2026-02-17', '春节 Spring Festival'),   ('2026-02-18', '春节 Spring Festival'),
+  ('2026-02-19', '春节 Spring Festival'),   ('2026-02-20', '春节 Spring Festival'),
+  ('2026-02-21', '春节 Spring Festival'),   ('2026-02-22', '春节 Spring Festival'),
+  ('2026-02-23', '春节 Spring Festival'),
+  ('2026-04-04', '清明节 Qingming'),        ('2026-04-05', '清明节 Qingming'),
+  ('2026-04-06', '清明节 Qingming'),
+  ('2026-05-01', '劳动节 Labour Day'),      ('2026-05-02', '劳动节 Labour Day'),
+  ('2026-05-03', '劳动节 Labour Day'),      ('2026-05-04', '劳动节 Labour Day'),
+  ('2026-05-05', '劳动节 Labour Day'),
+  ('2026-06-19', '端午节 Dragon Boat'),     ('2026-06-20', '端午节 Dragon Boat'),
+  ('2026-06-21', '端午节 Dragon Boat'),
+  ('2026-09-25', '中秋节 Mid-Autumn'),      ('2026-09-26', '中秋节 Mid-Autumn'),
+  ('2026-09-27', '中秋节 Mid-Autumn'),
+  ('2026-10-01', '国庆节 National Day'),    ('2026-10-02', '国庆节 National Day'),
+  ('2026-10-03', '国庆节 National Day'),    ('2026-10-04', '国庆节 National Day'),
+  ('2026-10-05', '国庆节 National Day'),    ('2026-10-06', '国庆节 National Day'),
+  ('2026-10-07', '国庆节 National Day')
+)
+SELECT 'deepseek', day, note,
+       'https://www.gov.cn/zhengce/zhengceku/202511/content_7047091.htm',
+       '2026-10-02 00:00:00'
+  FROM notice;

package/migrations/0093_tool_choice_forced.sql

@@ -0,0 +1,26 @@
+-- Whether a model answers a forced `tool_choice`, measured apart from `tools` (#570).
+--
+-- Claude Fable 5.1 (measured 2026-09-12, `src/chat-anthropic-structured.ts`),
+-- Opus 5.5 and Sonnet 5.5 (their own model pages) call a tool when allowed and
+-- answer 400 when `tool_choice` forces one: `"required"` or a named function,
+-- which reach Anthropic as `any` / `tool`. `tool_call` sends no `tool_choice`,
+-- so all three measured `tools = 1`, and Fable and Opus 5.5 are rank-1 members
+-- of all four coding lanes (0091). A caller forcing a call got a wasted chain
+-- slot through a lane and the 400 itself when pinned, with nothing in
+-- `/v1/models` to say so.
+--
+-- A column like the five 0007 made, tri-state and written only by
+-- conformance (`tool_choice_forced`, `src/conformance.ts`). NULL until
+-- measured, and NULL **fails closed**: the gate refuses a request that forces
+-- `tool_choice` for a model nobody has checked (`src/capabilities.ts`).
+--
+-- ## Which is why the order of the rollout is load-bearing
+--
+-- Every row starts NULL. Deploy the Worker that reads this before a
+-- conformance run has measured the column, and every forced request on every
+-- model is refused. So: this migration, then a conformance run (the script
+-- writes the flag; the deployed Worker passes `tool_choice` through and the
+-- conformance key is exempt from the gate), then the Worker. The column alone
+-- is inert under the Worker that predates it.
+
+ALTER TABLE models ADD COLUMN tool_choice_forced INTEGER CHECK (tool_choice_forced IN (0, 1));

package/migrations/0094_board_followups_2026_10_08.sql

@@ -0,0 +1,115 @@
+-- Claude Haiku 5.5 catalogued, and Sonnet 5.5's cache read re-priced
+-- (#591 — the model board's 2026-10-08 follow-ups).
+--
+-- Catalogues and prices; staffs no lane, for 0090's reason: an unmeasured
+-- member makes a lane's capability `null` (`src/lanes.ts`). Haiku 5.5 is the
+-- issue's candidate for `bb/chat-assistant` and `bb/extraction`, and that is a
+-- later migration, after conformance has written its flags — the 0077 → 0088
+-- order.
+--
+-- Every figure fetched 2026-10-08 UTC from Anthropic's own pages, cited per
+-- row. Not the board: #591 says so, and #79 / #122 say why.
+--
+-- ## Left out, and why
+--
+-- **Claude Haiku 4.5 going Legacy.** Its page reads "Active (legacy)",
+-- retirement "Not sooner than October 15, 2026", and no retirement date has
+-- been announced. Nothing to write until one is: no migration put
+-- `anthropic/claude-haiku-4-5-20251001` in a lane or a fallback chain, and its
+-- prices are unchanged ($1 / $5, cache read $0.10). When a date is announced it
+-- is 0090's GLM shape — disable on the date, never delete.
+--
+-- **OpenAI's Decisions API and Perplexity's `pplx-decider-v1.1-27b`.** Both
+-- are candidates for `typed-decisions`, which is not a job in
+-- `docs/vocabulary.md`, and both are a separate endpoint rather than a chat
+-- completion — a route and a vocabulary decision, not a catalogue row. The
+-- Decisions API also bills apart from `openai/gpt-6-luna` on Responses, so
+-- 0090's row prices nothing it would serve.
+--
+-- **meraGPT `state-decider-1`, Perplexity's Agent API presets.** Neither host
+-- has an `upstreams` row here (0090 on Perplexity), so a price change reaches
+-- nothing that routes.
+
+-- ── Claude Haiku 5.5 ──────────────────────────────────────────────────────────
+-- https://platform.claude.com/docs/en/models/haiku-5-5/overview
+--
+-- Released 2026-10-07. Window 1M, max output 128K, no dated id: the API id is
+-- `claude-haiku-5-5` and the page names no alias.
+--
+-- **Priced by prompt length, for the whole request** — the first Claude row
+-- here that is. Every rate on the page is stated twice, "for prompts up to
+-- 100,000 tokens" and "for prompts over 100,000 tokens", so the second row
+-- starts at `prompt_tokens_from` 100001, as 0090 wrote "over 272K" as 272001:
+--
+--   ≤ 100K   $0.10 / $0.50, cache read $0.01
+--   > 100K   $0.50 / $2.50, cache read $0.05   — 5x on every line
+--
+-- At a 5x step, `resolvePrice` choosing the short row for a long prompt is an
+-- 80% under-count, so the test pins both sides of the boundary. Cache writes ($0.125 / $0.20 by TTL, and 5x
+-- above 100K) have no column, as 0053 records.
+--
+-- **What it narrows, and which of it Cruise sees:**
+--
+--   - A non-default `temperature`, `top_p` or `top_k` returns 400 — the
+--     Sonnet 5.5 rule 0090 recorded. Callers sending one get the host's answer.
+--   - Manual extended thinking (`budget_tokens`) returns 400 and adaptive
+--     thinking is on by default. Cruise sends no `budget_tokens` to Anthropic
+--     anywhere in `src/`, and `src/messages-translate.ts` drops `thinking` on
+--     the way in, so neither reaches the host from us.
+--   - Thinking blocks work only in the producing account. The same file
+--     returns none to the caller, so no history replays one across keys.
+--   - Forced `tool_choice` is not stated either way on this page. 0093 made it
+--     a measured column, NULL until conformance writes it, and NULL fails
+--     closed — so the row cannot over-promise it.
+--   - Its tokenizer counts the same text as ~30% more tokens than Haiku 4.5.
+--     Cruise bills from the host's reported usage, so that is a price fact, not
+--     a metering bug, and a lane comparison by headline rate understates it.
+--
+-- `retained` on the privacy page 0053 and 0090 quoted, unchanged for this row.
+INSERT INTO models (id, upstream_id, upstream_model, max_context, max_output,
+                    data_retention, data_retention_source, data_retention_as_of) VALUES
+  ('anthropic/claude-haiku-5-5', 'anthropic', 'claude-haiku-5-5', 1000000, 128000,
+   'retained', 'https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training', '2026-10-08');
+
+INSERT INTO price_observations
+  (observed_at, model, effective_from, prompt_tokens_from, peak_utc,
+   input_micros_per_mtok, output_micros_per_mtok, cached_input_micros_per_mtok, source, note)
+VALUES
+  ('2026-10-08 00:00:00', 'anthropic/claude-haiku-5-5', '2026-10-08',      0, '',
+    100000,  500000, 10000, 'https://platform.claude.com/docs/en/models/haiku-5-5/overview',
+   'First observation: Claude Haiku 5.5 (#591, 0094). Prompts up to 100,000 tokens.'),
+  ('2026-10-08 00:00:00', 'anthropic/claude-haiku-5-5', '2026-10-08', 100001, '',
+    500000, 2500000, 50000, 'https://platform.claude.com/docs/en/models/haiku-5-5/overview',
+   'Long-prompt tier: prompts over 100,000 tokens pay 5x on every line, for the whole request.');
+
+-- Web search at $10 per 1,000, as 0058 and 0090 wrote for every Claude row,
+-- re-read on the tool's page today.
+INSERT INTO price_components
+  (observed_at, model, effective_from, component, variant, micros, per, source, note)
+VALUES
+  ('2026-10-08 00:00:00', 'anthropic/claude-haiku-5-5', '2026-10-08', 'search', '', 10000000, 1000,
+   'https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool', 'First observation (0094).');
+
+-- ── Claude Sonnet 5.5: cache read halved ──────────────────────────────────────
+-- https://platform.claude.com/docs/en/release-notes/overview, 2026-10-07:
+-- *"We've lowered the price of prompt cache reads on Claude Sonnet 5.5 from
+-- $0.20 USD to $0.10 USD per million tokens: 0.05x the base input price
+-- instead of 0.1x. Cache writes and all other prices are unchanged."*
+--
+-- The model's own page now prints $0.10 too, so the two agree — #591 reported
+-- the pricing table still showing $0.20, and the release note is cited because
+-- it carries the date. A new observation effective that day rather than an
+-- edit: `price_observations` is append-only (0048), and requests served
+-- 2026-10-02 → 06 were billed at $0.20, which was the price then.
+--
+-- Until this deploys, a cache read on this row is billed $0.10 / MTok over
+-- the host. No migration has put it in a lane (0091 staffed Opus 5.5, not
+-- Sonnet), so only a request naming it could have paid that; the ledger says
+-- whether one did.
+INSERT INTO price_observations
+  (observed_at, model, effective_from, prompt_tokens_from, peak_utc,
+   input_micros_per_mtok, output_micros_per_mtok, cached_input_micros_per_mtok, source, note)
+VALUES
+  ('2026-10-08 00:00:00', 'anthropic/claude-sonnet-5-5', '2026-10-07', 0, '',
+   2000000, 10000000, 100000, 'https://platform.claude.com/docs/en/release-notes/overview',
+   'Cache read lowered to $0.10 (0.05x base) on 2026-10-07; all other rates unchanged (#591, 0094).');

package/migrations/0095_request_compression.sql

@@ -0,0 +1,43 @@
+-- Request compression: the project's setting and the ledger's two figures
+-- (#593). Spec: docs/compression.md.
+--
+-- ## `projects.compress`
+--
+-- Whether this project's requests have their tool outputs compressed. On the
+-- project rather than the lane: a `bb/` lane serves every tenant, so a lane
+-- operator choosing a lossy rewrite of other tenants' prompts is the widening
+-- the cache keeps away from callers, moved to a different party; and the
+-- saving lands on the project's bill, so the project is who buys it.
+--
+-- **0 for every project, existing and new.** Compression is lossy and off at
+-- every level by default. A project is switched on through
+-- `PUT /admin/projects/{project}/compression`, audited like a budget. It also
+-- does nothing while the platform's `COMPRESS_MODE` is `off`, which is the
+-- kill switch and the production default.
+--
+-- ## `ledger.compress_bytes_before` / `compress_bytes_after`
+--
+-- The UTF-8 length of the body sent to the served candidate, built from the
+-- caller's tool outputs and from the compressed ones. Measured, not
+-- estimated: the provider's billed input tokens are the *after* figure, and
+-- the counterfactual bill was never measured, so the byte delta is the fact
+-- and any money figure is derived from it and labelled so.
+--
+-- **NULL when compression did not run** — off at any level, a conformance
+-- key, a request with no tool output, or a compressor that threw. Equal when
+-- it ran and saved nothing. That keeps "off" and "ran and saved 0" two
+-- different rows, which #593 asked for by name. No default, so every existing
+-- row reads NULL, which is what it was.
+--
+-- ## Order
+--
+-- This, then the Worker. The Worker that predates the columns never reads
+-- them; the Worker that reads them before this migration fails every key
+-- lookup on the missing `projects.compress` column.
+
+ALTER TABLE projects ADD COLUMN compress INTEGER NOT NULL DEFAULT 0 CHECK (compress IN (0, 1));
+
+ALTER TABLE ledger ADD COLUMN compress_bytes_before INTEGER
+  CHECK (compress_bytes_before IS NULL OR compress_bytes_before >= 0);
+ALTER TABLE ledger ADD COLUMN compress_bytes_after INTEGER
+  CHECK (compress_bytes_after IS NULL OR compress_bytes_after >= 0);

package/migrations/0096_lane_compress.sql

@@ -0,0 +1,36 @@
+-- A tenant lane can make compression its default (#608, follow-up to #593).
+-- Spec: docs/compression.md, "The flag".
+--
+-- ## Why a lane, after 0095 said the project
+--
+-- 0095 put the setting on the project and left the lane for when a job turned
+-- out to need it. The dogfood run (#593 slice 6) is that case: the saving
+-- depends on the job, not the project. Agent tool loops send `role: "tool"`
+-- messages full of logs and JSON; review traffic sends diffs as user text and
+-- must never be shortened. The lane is where a job is named, so "compress by
+-- default on `<tenant>/coding`" is the natural way to say it.
+--
+-- ## Tenant lanes only, and the schema says so
+--
+-- 0095's reason against a lane setting still holds for `bb/`: a platform lane
+-- serves every tenant, so whoever runs it would be choosing a lossy rewrite of
+-- other tenants' prompts. On `<tenant>/<slug>` the tenant owns both the lane
+-- and every project that can call it, so the choice stays inside one tenant.
+-- `updateLane` refuses it on a global lane with a 400; the CHECK is the same
+-- rule where a write that skipped the route cannot get past it. Create needs
+-- no check of its own: `laneIdFor` refuses any `bb/` id with a 403 before a
+-- create reaches the insert.
+--
+-- ## 0 for every lane, existing and new
+--
+-- Lossy, so off by default at every level, as 0095. A lane switched on does
+-- nothing while `COMPRESS_MODE` is `off`, and `x-cruise-compress: off` and a
+-- conformance key still win over it (`decideCompression`).
+--
+-- ## Order
+--
+-- This, then the Worker. The Worker that predates the column never reads it;
+-- the Worker that reads it before this migration fails every lane lookup.
+
+ALTER TABLE lanes ADD COLUMN compress INTEGER NOT NULL DEFAULT 0
+  CHECK (compress IN (0, 1) AND (compress = 0 OR tenant_id IS NOT NULL));

package/migrations/0097_tenant_default_compress.sql

@@ -0,0 +1,34 @@
+-- A tenant-wide compression default (#614, follow-up to #593 and #608).
+-- Spec: docs/compression.md, "The flag".
+--
+-- ## What it is
+--
+-- The starting state of every project and lane the tenant creates from now
+-- on. 0095 put the switch on the project and 0096 on the tenant's lanes; this
+-- is the one switch for the whole account, so a tenant that wants compression
+-- everywhere does not flip it once per project and once per lane.
+--
+-- ## Stamped at creation, never read live
+--
+-- The way `default_selection_policy` works (0066, #288). `createProject` reads
+-- the column inside its own insert and `createLane` reads it when a create
+-- names no `compress`, and the concrete value goes in the new row. Nothing on
+-- the request path consults this column. Turning it on therefore switches on
+-- no existing project or lane: compression is lossy, and one setting quietly
+-- rewriting every project's traffic is the widening this repository refuses
+-- everywhere else. Existing ones are changed one by one, by name, through the
+-- routes that already exist.
+--
+-- ## 0 for every tenant, existing and new
+--
+-- Off by default at every level, as 0095 and 0096. A tenant provisioned after
+-- this reads 0 by the column default, so `tenants.ts` needs no change.
+--
+-- ## Order
+--
+-- This, then the Worker. The Worker that predates the column never reads it;
+-- the Worker that reads it before this migration fails every settings read
+-- and every project create.
+
+ALTER TABLE tenants ADD COLUMN default_compress INTEGER NOT NULL DEFAULT 0
+  CHECK (default_compress IN (0, 1));

package/migrations/0098_ledger_session.sql

@@ -0,0 +1,47 @@
+-- The run a request belonged to, on the ledger (#617).
+--
+-- ## Why
+--
+-- A caller already names its run in `x-cruise-session` (#394) — an agent tenant's
+-- builder sends `agent-<runId>` on every request — and until now the name
+-- reached KV as an affinity pin and nothing else. So a question about one run
+-- ("what did compression save on run 412?", agents#860) could only
+-- be answered by matching timestamps against the run's log, which two
+-- concurrent runs on one project defeat. A column answers it exactly, and the
+-- compression figures (0095) are the first reader.
+--
+-- ## `ledger.session_digest`
+--
+-- `sha256(x-cruise-session)` in lowercase hex, never the value. The affinity
+-- key hashes it for the reason `src/affinity.ts` gives — a run id is a caller
+-- secret of sorts and must not sit in storage in the clear — and the ledger
+-- outlives a one-hour pin by years, so the reason is stronger here, not
+-- weaker. Unsalted, unlike `account`, on purpose: whoever holds the run id
+-- must be able to find its rows (`npm run ledger -- --session <id>` hashes
+-- what it is given), and a salt only the Worker holds would make the column
+-- write-only. A digest of a guessable id is confirmable by someone with the
+-- ledger and the guess, which is the same exposure `cache_digest` (0072)
+-- accepted.
+--
+-- Recorded whenever the header was sent and valid, lane or pinned model: the
+-- header is ignored for *routing* on a pinned model, but the run is still the
+-- run. NULL when no header was sent, and on every existing row — no default.
+--
+-- ## Index
+--
+-- Partial, because most traffic sends no session and those rows should cost
+-- the index nothing. Digest first: the one who asks holds a run id, not
+-- necessarily the project it ran under. The rollup groups by project, so a
+-- run id two tenants happen to share reads as two lines, never one sum.
+--
+-- ## Order
+--
+-- This, then the Worker. The Worker before this never names the column; the
+-- one after it fails every ledger insert without it.
+
+ALTER TABLE ledger ADD COLUMN session_digest TEXT
+  CHECK (session_digest IS NULL OR (length(session_digest) = 64 AND session_digest NOT GLOB '*[^0-9a-f]*'));
+
+CREATE INDEX IF NOT EXISTS idx_ledger_session
+  ON ledger (session_digest, project_id)
+  WHERE session_digest IS NOT NULL;