@chibitek/chibi 0.1.158 → 0.1.161

package/dist-server/server/engine-failover.js

@@ -1,3 +1,37 @@
+// Silent automatic failover (docs/chibitek/engine-tiers.md, step 2).
+//
+// A turn whose engine runs out of its usage allowance, turns out to be
+// signed out, goes fully silent, or fails in any other way, is not failed:
+// the engine rests and the same turn runs on the next engine of the bot's
+// ladder at the same level, at most two tries per turn. No chat message is
+// added; the client shows a small banner that fades (src/lib/engine-switch.ts).
+//
+// Modelled on OpenRouter's routing (docs/chibitek/engine-tiers.md): any
+// error is a reason to try the next candidate, not only the ones we have
+// learned to recognise. Recognised failures (a usage limit, a failed or
+// dead sign-in, a stall, a rate limit, a reasonless 400) rest the engine
+// for as long as that cause lasts; anything else is `provider_error`, which
+// rests it briefly (a circuit breaker) so it is not hammered. Every error an
+// engine reports while its turn is watched is held, so the person never sees
+// a provider's raw words for a failure the next engine recovers from.
+// This module is the part that watches a turn's events:
+//
+//   - While a turn is tracked, the engine's own report of the limit (a
+//     runtime.error, or the text a CLI prints in place of a reply, which the
+//     drivers mark `synthetic`) is held back instead of delivered. So is a
+//     reply that starts the way an agent's billing error does (Hermes answers
+//     "Billing or credits exhausted: HTTP 402: ..." as ordinary text and ends
+//     the turn as a success): it waits until the reply is complete, and if it
+//     is that error, with no tool run, the turn counts as failed.
+//   - When the turn completes failed with a held (or recognisable) limit,
+//     `onFailure` decides: it either moves the turn to another engine, and
+//     returns the one record that says so (turn.engine_failover), or it stops
+//     the turn with one plain line naming the resting engines.
+//   - A turn that ends any other way gets everything it held, in order.
+//
+// The server wires `onFailure` to the ladder, the resting store and
+// startTurn (server/index.ts); everything here is pure bookkeeping.
+import { newEventId } from "./contracts.js";
 import { classifyEngineFailure, isCredentialDead, mayBeReplyFailure, replyEngineFailure, statedReset } from "./engine-failure.js";
 /** The two-try cap: at most this many engines take part in one turn, the
  * first and one switch. Every failed attempt counts toward it, whatever the
@@ -15,10 +49,10 @@ export const NO_ANSWER_FAILURE = "The engine ended the turn without an answer.";
 function unrecognisedFailure(turn) {
     return { kind: "provider_error", message: turn.lastError ?? NO_ANSWER_FAILURE };
 }
-/** Ways a turn ends failed that are not the engine's fault: the person (or
- * the harness on their behalf) stopped it. Every other failed end moves the
- * turn to the next engine. */
-const NOT_A_PROVIDER_FAILURE = new Set(["interrupted", "cancelled"]);
+/** Stops that must not dispatch the request again: cancellation or a broken
+ * checkpoint whose accepted prompt may already have executed actions.
+ * The next explicit turn rebuilds that checkpoint from retained history. */
+const NOT_A_PROVIDER_FAILURE = new Set(["interrupted", "cancelled", "invalid_checkpoint"]);
 export class FailoverGate {
     turns = new Map();
     onFailure;
@@ -224,3 +258,9 @@ export function restingLine(engines, formatTime, computer, options = {}) {
         return `${parts[0]}, and no other engine at the same level is free, so this turn stopped.${hint}`;
     return `Every engine this bot can use is resting, so this turn stopped: ${parts.join(", ")}.${hint}`;
 }
+/** A new harness event about the same provider turn as `event`. */
+export const eventBase = (event) => ({
+    eventId: newEventId(), provider: event.provider, threadId: event.threadId, createdAt: new Date().toISOString(),
+    ...(event.providerInstanceId ? { providerInstanceId: event.providerInstanceId } : {}), ...(event.turnId ? { turnId: event.turnId } : {}),
+});
+export const restTime = (at) => new Date(at).toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit" });

package/dist-server/server/engine-failure.js

@@ -160,9 +160,9 @@ export function classifyEngineFailure(text, now = Date.now()) {
     return null;
 }
 // Hermes returns billing and expired-login refusals as successful reply text.
-const REPLY_FAILURE_HEADS = ["login expired", "error: nonretriableerror:", "billing or credits exhausted", "http 402:", "error: http 402:", "api error: http 402:"];
+const REPLY_FAILURE_HEADS = ["login expired", "error: nonretriableerror:", "billing or credits exhausted", "http 402:", "error: http 402:", "api error: http 402:", "usage limit reached"];
 const REPLY_FAILURE = [
-    /^billing or credits exhausted\b/i,
+    /^billing or credits exhausted\b|^usage limit reached\b[\s\S]*\b(?:quota|limit will reset|resets? (?:in|at|on))\b/i, // the second: a quota page as the reply (2026-10-26)
     // A bare "HTTP 402:" at the head counts only with the provider's own
     // billing words after it.
     /^(?:(?:api )?error:\s*)?http 402:[\s\S]*\b(?:positive balance|insufficient (?:balance|credits?|funds)|add (?:credits|balance|funds)|top-?up|credits? (?:exhausted|depleted))\b/i,

package/dist-server/server/harness-import/history.js

@@ -11,7 +11,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { pathToFileURL } from "node:url";
-import { attachmentBytesUsed, ATTACHMENTS_DIR, ATTACHMENTS_MAX_BYTES, deleteAttachment, extensionForFileMime, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, saveFile, saveImage, } from "../attachments.js";
+import { attachmentBytesAvailable, ATTACHMENTS_DIR, deleteAttachment, extensionForFileMime, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, saveFile, saveImage, } from "../attachments.js";
 import { redactSecretsInText } from "../redact.js";
 import { existingBots, importIdentity, mergedBotOf, sourceRefFor } from "./apply.js";
 import { GROKBOT_HISTORY_ALLOWLIST } from "./grokbot.js";
@@ -31,7 +31,7 @@ const MAX_STORE_BYTES = 2 * 1024 * 1024 * 1024;
 /** The real attachment directory, through the same save calls uploads use. */
 export function historyAttachmentStore() {
     return {
-        usedBytes: attachmentBytesUsed,
+        availableBytes: attachmentBytesAvailable,
         has(uploadId, extension) {
             try {
                 return statSync(join(ATTACHMENTS_DIR, `${uploadId}${extension}`)).isFile();
@@ -421,7 +421,7 @@ export function planBotHistory(sourceId, entries, ctx) {
         hidden: cleaner.hidden(),
     };
 }
-export const defaultHistoryBudget = (usedBytes) => Math.max(0, ATTACHMENTS_MAX_BYTES - usedBytes - HISTORY_QUOTA_MARGIN_BYTES);
+export const defaultHistoryBudget = (availableBytes) => Math.max(0, availableBytes - HISTORY_QUOTA_MARGIN_BYTES);
 /** Which files to copy: images first, then documents, newest first, until
  * the budget is spent. A file already in Atomic costs nothing. */
 export function allocateFiles(input, budget, stored) {
@@ -608,7 +608,7 @@ const storedCheck = (store) => (file) => {
 export function previewHistory(root, result, deps, options) {
     const source = options.source ?? GROKBOT_HISTORY;
     const targets = historyTargets(result, deps.bots());
-    const budget = options.budget ?? defaultHistoryBudget(deps.attachments.usedBytes());
+    const budget = options.budget ?? defaultHistoryBudget(deps.attachments.availableBytes());
     const empty = { threads: 0, messages: 0, files: { copied: 0, copiedBytes: 0, skipped: 0, skippedBytes: 0 } };
     if (!options.requested) {
         return { requested: false, available: targets.filter((target) => source.available(root, target.sourceId, options.fs)).length, bots: [], totals: empty, budgetBytes: budget };
@@ -698,7 +698,7 @@ export async function applyHistory(root, result, deps, options = {}) {
             out.hiddenMessages += plan.hidden;
         }
     }
-    const budget = options.budget ?? defaultHistoryBudget(deps.attachments.usedBytes());
+    const budget = options.budget ?? defaultHistoryBudget(deps.attachments.availableBytes());
     const stored = storedCheck(deps.attachments);
     const allocation = allocateFiles(work.flatMap((item) => item.threads.flatMap(({ thread }) => thread.messages.flatMap((message) => message.files))), budget, stored);
     out.files.tooLarge = allocation.tooLarge.size;

package/dist-server/server/harness-import/test-fixtures.js

@@ -276,7 +276,7 @@ export function fakeHistoryDeps(options = {}) {
         },
         deleteThread: (_botId, threadId) => state.threads.delete(threadId),
         attachments: {
-            usedBytes: () => state.used,
+            availableBytes: () => 512 * 1024 * 1024 - state.used,
             has: (uploadId, extension) => state.files.has(`/attachments/${uploadId}${extension}`),
             saveImage: (bytes, mime, uploadId) => {
                 const path = pathFor(uploadId, mime);

package/dist-server/server/index.js

@@ -1,3 +1,6 @@
+import { invalidateBrokenCheckpoint } from "./checkpoint-recovery.js";
+import { createModelExpectation, ModelEvidenceLedger } from "./model-evidence-context.js";
+import { reactToMessage } from "./message-reactions.js";
 import { hasUnboundGoalGuard, goalGuardForEvent, addGoalGuard, removeGoalGuard, runPersonalGoalTurn, updatePersonalGoalReceipt } from "./personal-goal-turn.js";
 import { PersonalGoalRuntime, receiveGoalCommand } from "./personal-goal-runtime.js";
 import { personalGoalInstructions } from "./personal-goals.js";
@@ -46,7 +49,8 @@ import { validateBotCwd } from "./bot-cwd.js";
 import { ATTACHMENTS_DIR, attachmentExists, cleanupStaleAttachmentPartials, deleteAttachment, extensionForMime, FILE_MAX_BYTES, IMAGE_MAX_BYTES, readAttachment, saveFile, saveImage, saveImageUpload, validateAttachmentUploadId, } from "./attachments.js";
 import { companyCheck, companyContext } from "./company-document-check.js";
 import { messageFileDisposition, messageFileDownloadName, messageAttachmentName, messageFileRoots, messageImageTargetAt, messageReferencesFile, openMessageFile, } from "./message-file.js";
-import { avatarGenerationRequestSchema, avatarGenerationStateMatches, generateAvatarImage, avatarImageStatus, snapshotAvatarGenerationState, } from "./avatar-image.js";
+import { avatarGenerationRequestSchema, avatarGenerationStateMatches, avatarImageStatus, snapshotAvatarGenerationState } from "./avatar-image.js";
+import { generateRoutedAvatar, installAvatarSubscriptionRoute } from "./avatar-subscription.js";
 import { fitsOnOneLine, parseBotProfilePatch } from "./bot-profile.js";
 import { groupTurnCwd } from "./room-cwd.js";
 import { RepoRegistry } from "./repos.js";
@@ -304,7 +308,7 @@ import { createNexusMemoryRoutes } from "./routes/nexus-memory.js";
 import { createBoardRoutes } from "./routes/board.js";
 import { readBoardFromNexus } from "./board/nexus-board.js";
 import { LocalModelInventory, localModePlacement, machineMemory } from "./local-models-mode.js";
-import { FailoverGate, MAX_ENGINES_PER_TURN, continuationNote, restingLine } from "./engine-failover.js";
+import { eventBase, restTime, FailoverGate, MAX_ENGINES_PER_TURN, continuationNote, restingLine } from "./engine-failover.js";
 import { enterSessionFallback, onSessionFallback, ownOrFallback, sessionFallbackSpentLine, withoutSubscription } from "./session-fallback.js";
 import { TURN_ERROR_CATEGORIES } from "../shared/runtime-events.js";
 import { EngineProbes, PROBE_PROMPT, isProbeThread, probeThreadId } from "./engine-probe.js";
@@ -487,6 +491,7 @@ function customDomainStatus() {
     };
 }
 const registry = new ProviderRegistry(BUILT_IN_DRIVERS);
+installAvatarSubscriptionRoute(() => registry.instances());
 // Engines installed from Settings live under the data directory and win over
 // any other copy on PATH.
 registerEnginesBinDir();
@@ -3564,6 +3569,9 @@ const roomFailoverTurns = new Map();
  * default (a resting engine's stand-in, a failover): the ledger books it. */
 const roomTurnSelections = new Map();
 const turnEngineOverrides = new Map();
+const modelEvidence = new ModelEvidenceLedger(DATA_DIR);
+const modelExpectation = createModelExpectation({ get store() { return store; }, get registry() { return registry; }, turnEngineOverrides, roomTurnSelections,
+    speakerBot: threadId => groupSpeakers.get(threadId)?.botId, enginePlan, botClassChoices });
 const failoverGate = new FailoverGate((turn, completion) => engineFailover(turn, completion));
 /** An approval shows a shell command as the model meant it: the RTK add-on's
  * launcher, which engines that take RTK as instructions put in front of
@@ -3582,9 +3590,16 @@ bus.setGate((published) => {
         return [];
     }
     const event = withoutRtkInSummary(published);
+    if (!shouldIgnoreProviderEvent(event))
+        modelEvidence.observe(event, () => modelExpectation(event.threadId, event.providerInstanceId, event.provider));
     // [jev-verifier] note a failover turn that finished, before the gate forgets it.
     const jevCandidate = jevAnswerCheckCandidate(event);
     const delivered = failoverGate.filter(event);
+    // Gate-generated switches never re-enter publish; preserve their evidence too.
+    for (const out of delivered)
+        if (out.type === "turn.engine_failover" && out !== event) {
+            modelEvidence.observe(out, () => modelExpectation(out.threadId, out.providerInstanceId, out.provider));
+        }
     if (jevCandidate)
         setImmediate(() => void jevAnswerCheck(jevCandidate));
     for (const out of delivered)
@@ -3603,12 +3618,6 @@ function noteEngineBack(event) {
     const model = selection?.instanceId === instanceId ? selection.model : undefined;
     engineRests.noteBack(instanceId, candidate ? engineAccount(candidate) : undefined, candidate ? restScope(candidate, model) : undefined);
 }
-/** A new harness event about the same provider turn as `event`. */
-const eventBase = (event) => ({
-    eventId: newEventId(), provider: event.provider, threadId: event.threadId, createdAt: new Date().toISOString(),
-    ...(event.providerInstanceId ? { providerInstanceId: event.providerInstanceId } : {}), ...(event.turnId ? { turnId: event.turnId } : {}),
-});
-const restTime = (at) => new Date(at).toLocaleTimeString("en-GB", { hour: "2-digit", minute: "2-digit" });
 /** Rest a refused engine and continue on an eligible engine, or show an actionable line. */
 function engineFailover(turn, completion) {
     const failure = turn.failure;
@@ -8162,22 +8171,20 @@ bus.subscribe((event) => {
             });
             break;
         case "runtime.error":
+            if (bot)
+                invalidateBrokenCheckpoint(store, bot.id, event.providerInstanceId ? registry.get(event.providerInstanceId)?.driverKind : undefined, event);
             if (event.message?.trim())
                 lastTurnError.set(event.threadId, event.message.trim().slice(0, 300));
             pushMessage({
                 role: "bot",
                 kind: "activity",
-                // The category travels with the line so every surface words it the
-                // same way; an error line is never a lost connection either way.
+                // Keep the category consistent across surfaces.
                 // The harness's own stop line is kept whole: it ends with where to fix
                 // the account, which a 160-character cut would drop.
                 tool: { name: `error: ${event.message.slice(0, event.category === "account" || event.category === "failover_exhausted" ? 600 : 160)}`, ok: false, setup: event.setup, ...(event.terminal ? { terminal: true } : {}),
                     ...(event.category ? { errorCategory: event.category } : {}) },
             });
-            // a setup error means the engine could not even start: the bot is
-            // dead until something changes, not merely idle. The next successful
-            // dispatch moves it to working; turn.completed (which follows a setup
-            // failure) is told to leave "dead" alone.
+            // Setup failures remain dead until a later successful dispatch.
             if (event.setup && bot)
                 store.setTaskActivity(bot.id, event.threadId, "dead");
             break;
@@ -9825,6 +9832,7 @@ async function startTurn(botId, text, opts) {
     // thread, so this is the one moment the ledger's "who asked" may change.
     if (opts?.trigger)
         turnTriggers.set(threadId, opts.trigger);
+    const expectedModel = modelExpectation(threadId);
     // The engine the ladder chose becomes the thread's model, as a person's
     // switch would; the thread stays tier-managed for its next turn.
     if (tierSelection && JSON.stringify(tierSelection) !== JSON.stringify(task.modelSelection)) {
@@ -9849,6 +9857,8 @@ async function startTurn(botId, text, opts) {
     // busy flips immediately so the composer locks; the dispatch itself runs
     // in the background — box provisioning can take ~90s and must never
     // hang the HTTP request
+    const evidenceAttemptId = expectedModel ? modelEvidence.begin({ ...expectedModel, requestedModel: model,
+        instanceId: instance.instanceId, provider: instance.driverKind }, Boolean(failover)) : undefined;
     const dispatchClaimId = randomUUID();
     const resourceOwner = { threadId, generation: dispatchClaimId };
     turnResourceOwners.set(threadId, resourceOwner);
@@ -10889,6 +10899,8 @@ async function startTurn(botId, text, opts) {
             }
         }
         catch (e) {
+            if (evidenceAttemptId)
+                modelEvidence.finishDispatch(threadId, evidenceAttemptId);
             handoffs.abandon(threadId, dispatchClaimId);
             failoverGate.untrack(threadId, dispatchClaimId);
             if (failoverTurns.get(threadId)?.generation === dispatchClaimId)
@@ -20478,14 +20490,7 @@ const handleRequest = async (req, res) => {
         // emoji reactions — works on any thread (1:1 or room)
         m = path.match(/^\/api\/threads\/([\w-]+)\/messages\/([\w-]+)\/reactions$/);
         if (m && method === "POST") {
-            const body = await readBody(req);
-            const emoji = String(body.emoji ?? "").slice(0, 8);
-            if (!emoji)
-                return json(res, 400, { error: "emoji required" });
-            const patched = store.toggleReaction(m[1], m[2], emoji, typeof body.by === "string" ? body.by : "user");
-            if (!patched)
-                return json(res, 404, { error: "no such message" });
-            return json(res, 200, { message: patched });
+            return reactToMessage(store, req, res, m[1], m[2]);
         }
         if (path === "/api/sidebar-sections" && method === "GET") {
             return json(res, 200, { sections: store.sections });
@@ -20598,13 +20603,13 @@ const handleRequest = async (req, res) => {
             const profile = parseBotProfilePatch(body.profile, true);
             if (!profile.ok)
                 return json(res, 400, { error: profile.error });
-            const checked = avatarGenerationRequestSchema.safeParse({ prompt: body.prompt });
+            const checked = avatarGenerationRequestSchema.safeParse({ prompt: body.prompt, source: body.source });
             if (!checked.success)
                 return json(res, 400, { error: checked.error.message });
             const { prompt } = checked.data;
-            const generated = await generateAvatarImage(cfg, {
+            const generated = await generateRoutedAvatar(cfg, registry.instances(), {
                 name: profile.patch.name ?? "", title: profile.patch.title ?? "", description: profile.patch.description ?? "",
-            }, prompt);
+            }, prompt, checked.data.source);
             // A preview belongs to the draft. Upload it through the existing image
             // endpoint only when the user commits the new bot or its defaults.
             return json(res, 200, { dataUrl: `data:${generated.mime};base64,${generated.bytes.toString("base64")}` });
@@ -20855,7 +20860,7 @@ const handleRequest = async (req, res) => {
             if (!parsed.success) {
                 return json(res, 400, { error: `prompt must be at most 400 characters` });
             }
-            const generated = await generateAvatarImage(cfg, existing, parsed.data.prompt);
+            const generated = await generateRoutedAvatar(cfg, registry.instances(), existing, parsed.data.prompt, parsed.data.source);
             const current = store.bot(existing.id);
             if (!current)
                 return json(res, 404, { error: "no such bot" });
@@ -21836,6 +21841,15 @@ const handleRequest = async (req, res) => {
                 return json(res, 404, { error: "no such bot" });
             return json(res, 200, previewSystemPrompt(bot, { privateOwner: privateOwnerFor(auth) }));
         }
+        m = path.match(/^\/api\/bots\/([\w-]+)\/model-evidence$/);
+        if (m && method === "GET") {
+            const thread = requestedTaskBot(m[1], url.searchParams.get("threadId") ?? undefined);
+            const range = parseUsageRange(url.searchParams.get("from"), url.searchParams.get("to"));
+            if (!range)
+                return json(res, 400, { error: "Provide a date range of at most one year" });
+            res.setHeader("cache-control", "no-store");
+            return json(res, 200, modelEvidence.query(m[1], thread.threadId, range.from, range.to));
+        }
         m = path.match(/^\/api\/bots\/([\w-]+)\/model-classes$/);
         if (m && method === "GET") {
             const thread = requestedTaskBot(m[1], url.searchParams.get("threadId") ?? undefined);

package/dist-server/server/message-reactions.js

@@ -0,0 +1,11 @@
+import { isReactionEmoji } from "../shared/emoji.js";
+import { json, readBody } from "./harness/http.js";
+export async function reactToMessage(store, req, res, threadId, messageId) {
+    const body = await readBody(req);
+    if (!isReactionEmoji(body.emoji))
+        return json(res, 400, { error: "Choose one emoji" });
+    const message = store.toggleReaction(threadId, messageId, body.emoji, "user");
+    if (!message)
+        return json(res, 404, { error: "no such message" });
+    return json(res, 200, { message });
+}

package/dist-server/server/model-evidence-context.js

@@ -0,0 +1,18 @@
+export { ModelEvidenceLedger } from "./model-evidence.js";
+// Snapshot the same class choices the model picker displays before routing mutates the task.
+import { threadEngineMode } from "../shared/engine-tiers.js";
+export function createModelExpectation(context) {
+    return (threadId, instanceId, provider) => {
+        const profile = context.store.botByThread(threadId) ?? context.store.bot(context.speakerBot(threadId) ?? "");
+        if (!profile)
+            return null;
+        const task = context.store.taskByThread(profile.id, threadId);
+        const selection = context.turnEngineOverrides.get(threadId) ?? context.roomTurnSelections.get(threadId) ?? task?.modelSelection ?? profile.modelSelection;
+        const modelClass = context.enginePlan(profile, threadId).modelClass;
+        const mode = threadEngineMode(profile, task ?? {});
+        const preview = mode.kind === "pinned" ? undefined : context.botClassChoices(profile, threadId).options.find(option => option.modelClass === modelClass);
+        return { botId: profile.id, threadId, label: `${mode.kind === "tier" ? "Automatic: " : ""}${modelClass} · ${preview?.label ?? selection.model}`, modelClass,
+            model: preview?.selection?.model ?? selection.model, requestedModel: selection.model,
+            instanceId: instanceId ?? selection.instanceId, provider: provider ?? context.registry.get(selection.instanceId)?.driverKind ?? "unknown" };
+    };
+}

package/dist-server/server/model-evidence.js

@@ -0,0 +1,145 @@
+// Name: model-evidence; author: Atomic Engineering; date: 2026-10-27.
+// Append-only identity history beside the existing usage ledger, without prompts.
+import { randomUUID } from "node:crypto";
+import { mkdirSync, appendFileSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { modelEvidenceMetrics } from "../shared/model-evidence.js";
+export { modelEvidenceMetrics };
+const safe = (value) => typeof value === "string" && /^[\w .:/@+()[\]-]{1,200}$/u.test(value) ? value : undefined;
+export class ModelEvidenceLedger {
+    active = new Map();
+    byTurn = new Map();
+    failures = 0;
+    dataDir;
+    constructor(dataDir) { this.dataDir = dataDir; }
+    begin(expected, continuation = false) {
+        const prior = this.active.get(expected.threadId);
+        const attempt = { expected: { ...expected, ...(continuation && prior ? { label: prior.expected.label, modelClass: prior.expected.modelClass, model: prior.expected.model } : {}) }, logicalTurnId: continuation && prior ? prior.logicalTurnId : randomUUID(), attemptId: randomUUID() };
+        this.active.set(expected.threadId, attempt);
+        this.write(attempt, { kind: "dispatch", level: expected.requestedModel || expected.model ? "requested-only" : "unknown" });
+        return attempt.attemptId;
+    }
+    finishDispatch(threadId, attemptId) {
+        const attempt = this.active.get(threadId);
+        if (attempt?.attemptId === attemptId)
+            this.write(attempt, { kind: "completed", level: "unknown", ok: false, reason: "dispatch ended before provider completion" });
+    }
+    write(attempt, fields) {
+        const row = { ...attempt.expected, version: 1, id: randomUUID(), at: new Date().toISOString(),
+            logicalTurnId: attempt.logicalTurnId, attemptId: attempt.attemptId, ...(attempt.turnId ? { turnId: attempt.turnId } : {}), ...fields };
+        try {
+            const directory = join(this.dataDir, "model-evidence");
+            mkdirSync(directory, { recursive: true, mode: 0o700 });
+            appendFileSync(join(directory, `${row.at.slice(0, 7)}.jsonl`), JSON.stringify(row) + "\n", { mode: 0o600 });
+        }
+        catch {
+            this.failures++;
+            if (this.failures === 1)
+                console.error("[model-evidence] Cannot persist model history; queries will report incomplete evidence.");
+        }
+    }
+    observe(event, expectation) {
+        if (!["turn.started", "session.started", "model.evidence", "model.call", "turn.retrying", "turn.engine_failover", "session.model-fallback", "turn.completed", "session.exited"].includes(event.type))
+            return;
+        const turnKey = event.turnId ? JSON.stringify([event.threadId, event.providerInstanceId ?? event.provider, event.turnId]) : undefined;
+        let attempt = turnKey ? this.byTurn.get(turnKey) : undefined;
+        if (!attempt) {
+            attempt = this.active.get(event.threadId);
+            if (!attempt || (event.type === "turn.started" && attempt.turnId && attempt.turnId !== event.turnId)) {
+                const expected = expectation();
+                if (!expected)
+                    return;
+                this.begin(expected);
+                attempt = this.active.get(event.threadId);
+            }
+            if (event.turnId) {
+                attempt.turnId = event.turnId;
+                this.byTurn.set(turnKey, attempt);
+            }
+        }
+        const base = { provider: event.provider, instanceId: event.providerInstanceId ?? attempt.expected.instanceId };
+        switch (event.type) {
+            case "turn.started":
+                this.write(attempt, { ...base, kind: "start", level: "requested-only" });
+                break;
+            case "model.call":
+                this.write(attempt, { ...base, kind: "call", level: "unknown", callId: event.callId });
+                break;
+            case "model.evidence":
+                this.write(attempt, { ...base, kind: "evidence", level: safe(event.model) ? event.level : "unknown",
+                    ...(safe(event.model) ? { reportedModel: safe(event.model) } : {}), callId: event.callId, responseId: safe(event.responseId) });
+                break;
+            case "session.started":
+                this.write(attempt, { ...base, kind: "evidence", level: safe(event.model) ? event.modelEvidenceLevel ?? "requested-only" : "unknown", reportedModel: safe(event.model) });
+                break;
+            case "turn.retrying": {
+                this.write(attempt, { ...base, kind: "retry", level: "unknown", reason: safe(event.reason) });
+                // CLI retries reuse their native turn id, but are distinct attempts.
+                this.begin(attempt.expected, true);
+                const retry = this.active.get(event.threadId);
+                retry.turnId = event.turnId;
+                if (turnKey)
+                    this.byTurn.set(turnKey, retry);
+                break;
+            }
+            case "turn.engine_failover":
+            case "session.model-fallback":
+                this.write(attempt, { ...base, kind: "fallback", level: "unknown", reason: safe(event.reason) ?? "provider fallback" });
+                break;
+            case "turn.completed":
+                this.write(attempt, { ...base, kind: "completed", level: "unknown", ok: event.ok });
+                break;
+            case "session.exited":
+                this.write(attempt, { ...base, kind: "exited", level: "unknown" });
+                break;
+        }
+        // ponytail: bounded correlation cache; durable history remains on disk.
+        if (this.byTurn.size > 10000)
+            this.byTurn.delete(this.byTurn.keys().next().value);
+        if (this.active.size > 10000)
+            this.active.delete(this.active.keys().next().value);
+    }
+    query(botId, threadId, from, to) {
+        const directory = join(this.dataDir, "model-evidence");
+        const rows = [];
+        let incomplete = this.failures > 0;
+        let files = [];
+        try {
+            files = readdirSync(directory).filter(file => /^\d{4}-\d{2}\.jsonl$/.test(file)).sort();
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                incomplete = true;
+        }
+        for (const file of files) {
+            if (file.slice(0, 7) < from.toISOString().slice(0, 7) || file.slice(0, 7) > to.toISOString().slice(0, 7))
+                continue;
+            try {
+                for (const line of readFileSync(join(directory, file), "utf8").split("\n").filter(Boolean)) {
+                    try {
+                        const row = JSON.parse(line);
+                        if (row.version !== 1 || !row.logicalTurnId || !row.attemptId) {
+                            incomplete = true;
+                            continue;
+                        }
+                        if (row.botId === botId && row.threadId === threadId && row.at >= from.toISOString() && row.at <= to.toISOString())
+                            rows.push(row);
+                    }
+                    catch {
+                        incomplete = true;
+                    }
+                }
+            }
+            catch {
+                incomplete = true;
+            }
+        }
+        const latestDispatch = rows.findLast(row => row.kind === "dispatch");
+        const latest = latestDispatch && rows.findLast(row => row.attemptId === latestDispatch.attemptId);
+        // Late exit/events from an older attempt must not settle a newer attempt.
+        const running = latest && !rows.some(row => row.attemptId === latest.attemptId && ["completed", "exited"].includes(row.kind));
+        return { rows, metrics: modelEvidenceMetrics(rows), incomplete, writeFailures: this.failures,
+            current: running && this.active.has(threadId) ? latest.logicalTurnId : null,
+            interrupted: Boolean(running && !this.active.has(threadId)), last: latest?.logicalTurnId ?? null };
+    }
+}