@claudexor/orchestrator 3.17.2 → 3.19.0

package/dist/orchestrator.js

@@ -1,11 +1,11 @@
 import { applyWorkEnvelope, promptWithPointers as renderPromptWithPointers, threadContextPointer, } from "./prompt-framing.js";
 import { requestRefusalFailure } from "./runTerminalResults.js";
 import { delegationBeltFor } from "./delegationBelt.js";
-import { bindProcessingAdmission, processingAdmissionForLease, updateProcessingStreamHold, ProcessingBudgetAdmissionError, } from "./processing-dispatch.js";
+import { bindProcessingAdmission, processingAttemptCostEvidence, processingAdmissionForLease, updateProcessingStreamHold, ProcessingBudgetAdmissionError, } from "./processing-dispatch.js";
 import { cancelledCandidatesResult, emptyCandidateResult, failedCandidatesResult, } from "./candidateTerminals.js";
 import { existsSync } from "node:fs";
 import { effectiveAuthPreference, observeNativeSessionEvent, resumeSessionForProfile, rotateSpecOnTypedLimit, } from "./credential-profiles.js";
-import { OrchestratorCredentials, reviewerProfileResolver, rotatedSpecInLaneHome, } from "./orchestrator-credentials.js";
+import { AdmissionProfileProbes, OrchestratorCredentials, reviewerProfileResolver, rotatedSpecInLaneHome, } from "./orchestrator-credentials.js";
 import { accountPoolRows } from "./account-pool.js";
 import { writeRunTelemetryArtifact } from "./runTelemetryWriter.js";
 import { buildFileBackedSynthesisInput, materializeWinnerOutputs, stageFileBackedContext, writeCandidateAttemptArtifacts, } from "./candidateOutputs.js";
@@ -18,13 +18,13 @@ import { capabilityIntents } from "@claudexor/gateway";
 import { reviewCandidateRuns, resolveEngineReview, unreviewedCandidateEvidence, evaluateUnreviewedConvergence, } from "./candidateReview.js";
 import { join } from "node:path";
 import { finalizePlanRun, runCouncilPlan, writePlanHarnessFailure, } from "./planRun.js";
-import { runPlannerAttempt as executePlannerAttempt, } from "./plannerAttempt.js";
+import { runPlannerAttempt as executePlannerAttempt, plannerAttemptSummary, } from "./plannerAttempt.js";
 import { HarnessRunSpec, MAX_COUNCIL_MEMBERS_DEFAULT, ModeKind as ModeKindSchema, QuotaSnapshot as QuotaSnapshotSchema, isBlocking, makeOutcomeFacts, reviewAllowsApply, workStateVetoes, strictifyOutputSchema, estimateEffectiveAuthRoute, } from "@claudexor/schema";
 import { globalConfigDir, loadConfig } from "@claudexor/config";
 import { prepareRoutedProcessing, processingCostEvidence, prepareReviewerProcessing, } from "./processing-routing.js";
 import { acceptedTryOutput, AccessProfileIncompatibleError, AnswerAssembly, CLAUDEXOR_BROWSER_ARTIFACT_SUBDIR, countsAsAgentProgress, HarnessUnavailableError, summarizeDiffPaths as diffStats, withInactivityWatchdog, } from "@claudexor/core";
 import { assertRouteModelsAllowed, runModelGovernedRoute } from "./modelGovernance.js";
-import { authModeForCredentialRoute, authModeForPreference } from "./auth-route-classification.js";
+import { authModeForCredentialRoute, authModeForPreference, authRouteEvidenceFor, } from "./auth-route-classification.js";
 import { governRouteEffort } from "./effortGovernance.js";
 import { isFullAccess, RequestRequirementsResolver } from "./requestRequirements.js";
 import { activateDelegationParent } from "./delegation-parent-activation.js";
@@ -69,7 +69,7 @@ import { HarnessGateway } from "@claudexor/gateway";
 import { ReadinessLedger, evaluateConvergence, failureSignature, gatesPassed, reviewCandidate, runGates, } from "@claudexor/review";
 import { arbitrate } from "@claudexor/arbitration";
 import { buildSynthesisPlan, decideSynthesis } from "@claudexor/synthesis";
-import { attemptCostEvidence, billingKnowledgeForAuthRoute, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, explainRanking, loadHarnessMetrics, promptFingerprint, rankHarnesses, } from "@claudexor/budget";
+import { billingKnowledgeForAuthRoute, attemptUsageCostSettlement, BudgetLedger, isBudgetTerminal, RoutingPreflightError, explainRanking, loadHarnessMetrics, promptFingerprint, rankHarnesses, } from "@claudexor/budget";
 import { readTextSafe, appendLine, assertNoInlineSecretValues, hashJson, newId, noProjectRepoRoot, redactSecrets, safeInvoke, sha256, userConfigDir, } from "@claudexor/util";
 const LABELS = "ABCDEFGHIJ".split("");
 const NO_PROJECT_ROOT = noProjectRepoRoot();
@@ -489,9 +489,11 @@ export class Orchestrator {
             dropped.push(detail);
             droppedLanes.push({ harnessId, stage, detail });
         };
-        // One observation set for the whole admission pass, so two lanes cannot be
-        // judged against different vendor epochs.
+        // Initial lane readiness shares one quota observation. Selection and each
+        // physical dispatch still consume the latest exact-profile evidence.
         const vendorQuota = this.credentials.vendorQuotaObservations();
+        // Billing later reuses the probe that admitted each row (#260).
+        const admissionProbes = new AdmissionProfileProbes();
         const liveUnusable = this.deps.credentialUnusable?.() ?? [];
         for (const id of ids) {
             const adapter = this.deps.registry.get(id);
@@ -558,6 +560,7 @@ export class Orchestrator {
             // the profile's transport, so the default store's state is not the
             // routing truth). Capability/manifest gating above still applies.
             const profileAdapter = this.deps.registry.get(id);
+            const profileProbe = admissionProbes.record(profileAdapter?.probeCredentialProfile?.bind(profileAdapter));
             const explicitPin = this.credentials.effectiveProfileId(input, id);
             // Pins and bound/pool rows are checked against their own readiness.
             const rows = await this.credentials.admitRouteRows({
@@ -567,7 +570,7 @@ export class Orchestrator {
                 model: input.models?.[id] ?? cfgEntry?.default_model ?? null,
                 quota: vendorQuota,
                 unusable: liveUnusable,
-                probe: profileAdapter?.probeCredentialProfile?.bind(profileAdapter),
+                probe: profileProbe,
             });
             const profileAdmitted = rows.admitted;
             if (profileAdmitted) {
@@ -661,7 +664,7 @@ export class Orchestrator {
                     // the default store's sources apply only to profile-less runs.
                     authRouteEstimate: this.credentials.profileAuthRoute(input, id) ??
                         estimateEffectiveAuthRoute(this.authPreferenceForHarness(input.repoRoot, id, input.authPreference), status.authSources),
-                    quotaAdmission: { model: null, profile: null, route: null },
+                    quotaAdmission: { model: null, profile: null, route: null, profileVerification: null },
                     supportsSynthesize: manifest.capabilities.synthesize,
                     supportsInteractive: manifest.capabilities.interactive,
                     liveInput: manifest.capability_profile.live_input,
@@ -706,7 +709,7 @@ export class Orchestrator {
             const model = input.models?.[routed.adapter.id] ?? routed.settings?.defaultModel ?? null;
             let profile;
             try {
-                profile = await this.credentials.preflightProfile(input, routed.adapter.id, model, log, routed.authRouteEstimate);
+                profile = await this.credentials.preflightProfile(input, routed.adapter.id, model, log, routed.authRouteEstimate, admissionProbes);
             }
             catch (err) {
                 // AUTO drops typed lane-local unavailability only when a sibling
@@ -730,8 +733,16 @@ export class Orchestrator {
                             : routed.authRouteEstimate === "local_session"
                                 ? "vendor_native"
                                 : null;
+            const profileVerification = profile
+                ? await this.credentials.selectedProfileBillingVerification(profile, admissionProbes)
+                : null;
             return {
-                prepared: { ...routed, quotaAdmission: { model, profile, route } },
+                prepared: {
+                    ...routed,
+                    quotaAdmission: { model, profile, route, profileVerification },
+                    paidFallback: this.config(input.repoRoot).global.routing.paid_fallback,
+                    billingVerificationForProfile: (actual) => this.credentials.selectedProfileBillingVerification(actual),
+                },
                 refused: null,
             };
         }));
@@ -862,13 +873,14 @@ export class Orchestrator {
                 // engine default. Profile A's cooldown never excludes profile B or the
                 // default on the same harness and route.
                 const credentialSubjectId = r.quotaAdmission.profile?.profile_id ?? null;
-                // QA-034: the typed auth-route evidence (doctor source verification x the
-                // resolved route) is AUTHORITATIVE for billing knowledge in the router —
-                // a VERIFIED native route proves subscription_entitlement, so it survives
+                // QA-034: the typed auth-route evidence (the admitted profile's own
+                // verification, else doctor source verification, x the resolved route)
+                // is AUTHORITATIVE for billing knowledge in the router — a VERIFIED
+                // native route proves subscription_entitlement, so it survives
                 // paid_fallback:never and ranks with a real economy tuple instead of
                 // reading as unknown/paid. Absent (unknown route) falls back to the
                 // metric-derived billingKnowledge below.
-                const authRoute = this.authRouteEvidenceFor(authMode, status?.authSources ?? []);
+                const authRoute = authRouteEvidenceFor(authMode, status?.authSources ?? [], r.quotaAdmission.profileVerification);
                 const processingCost = processingCostEvidence(r.processing, authRoute ? billingKnowledgeForAuthRoute(authRoute) : "unknown", [`harness:${r.adapter.id}`, `profile:${credentialSubjectId ?? "default"}`]);
                 return {
                     harnessId: r.adapter.id,
@@ -968,30 +980,6 @@ export class Orchestrator {
             },
         };
     }
-    /**
-     * Typed auth-route evidence for one candidate (QA-034): the concrete
-     * credential route the resolved auth mode maps to, plus the doctor's
-     * verification for the source that route runs under. `local_session` →
-     * vendor_native + the native/OAuth source verification; `api_key` →
-     * managed_api_key + the key source verification. Unknown route → no evidence
-     * (the router keeps its conservative metric-derived billing). Verification is
-     * the source's typed verdict — never inferred from mere availability.
-     */
-    authRouteEvidenceFor(authMode, sources) {
-        const usable = (s) => s.availability === "available" && s.verification !== "failed";
-        if (authMode === "local_session") {
-            const native = sources.find((s) => usable(s) && (s.source === "native_session" || s.source === "oauth_token_env"));
-            return { route: "vendor_native", verification: native?.verification ?? "not_run" };
-        }
-        if (authMode === "api_key") {
-            const key = sources.find((s) => usable(s) &&
-                (s.source === "api_key_env" ||
-                    s.source === "api_key_flag" ||
-                    s.source === "provider_auth_file"));
-            return { route: "managed_api_key", verification: key?.verification ?? "not_run" };
-        }
-        return undefined;
-    }
     /**
      * Lazy ContextPack: built ONLY for the read-only report modes
      * (explore/plan/readonly_audit) that consume it. Persisted to
@@ -1234,6 +1222,8 @@ export class Orchestrator {
                 processing,
                 processingAdmission,
                 physicalDispatchStarted,
+                billingVerificationForProfile: (profile) => this.credentials.selectedProfileBillingVerification(profile),
+                paidFallback: this.config(runInput.repoRoot).global.routing.paid_fallback,
             });
             const result = buildContinuation(req);
             // Disclose on every lane and stamp the turn (INV-137: never silent).
@@ -1319,7 +1309,7 @@ export class Orchestrator {
         const sessionFields = runInput
             ? await this.sessionSpecFields(runInput, adapter.id, knobs.model, log, routed.authRouteEstimate, routed.quotaAdmission)
             : undefined;
-        const processingAdmission = processingAdmissionForLease(ledger, processingLease.id, adapter.id, attemptId, processingLease.onDenied);
+        const processingAdmission = processingAdmissionForLease(ledger, processingLease.lease, adapter.id, attemptId, processingLease.onDenied);
         const capturedProcessing = {
             processing_preference: contract.processing_preference,
             processing: knobs.processing?.receipt,
@@ -1327,7 +1317,7 @@ export class Orchestrator {
             processing_allow_paid: knobs.processingAllowPaid,
         };
         const laneContinuity = runInput
-            ? await this.resolveContinuity(runInput, adapter.id, sessionFields?.credential_profile?.profile_id ?? runInput.credentialProfileId ?? null, inPlaceEnvelope && !!sessionFields?.resume_session_id, sessionFields, store, paths, envelope.repo_root, log, capturedProcessing, processingAdmission, () => ledger.markPhysicalDispatchStarted(processingLease.id))
+            ? await this.resolveContinuity(runInput, adapter.id, sessionFields?.credential_profile?.profile_id ?? runInput.credentialProfileId ?? null, inPlaceEnvelope && !!sessionFields?.resume_session_id, sessionFields, store, paths, envelope.repo_root, log, capturedProcessing, processingAdmission, () => ledger.markPhysicalDispatchStarted(processingLease.lease.lease_id))
             : null;
         const artifactRelativeDir = routed.browserRequirement.effective
             ? (wsm.ensureArtifactDirectory(envelope), wsm.ownedArtifactRelativeDirectory(envelope))
@@ -1372,16 +1362,12 @@ export class Orchestrator {
         });
         if (runInput)
             this.credentials.stampProfileSelection(spec, runInput, adapter.id);
-        bindProcessingAdmission(spec, ledger, processingLease.id, adapter.id, attemptId, processingLease.onDenied, processingAdmission);
-        const billingInput = runInput ?? { repoRoot: contract.repo.root };
-        // Keep billing route-bound until admission observes the actual prepared
-        // profile. The resolver is evaluated per physical dispatch; preparedCost
-        // gives an actual profile precedence over this pool fallback.
-        spec.extra["routeBillingKnowledge"] = (actual) => actual.credential_profile?.credential_kind === "api_key"
-            ? "metered"
-            : actual.credential_profile
-                ? "subscription_entitlement"
-                : this.routeBillingKnowledge(billingInput, adapter.id);
+        bindProcessingAdmission(spec, ledger, processingLease.lease, adapter.id, attemptId, processingLease.onDenied, processingAdmission);
+        // Profile-less processing keeps its existing route estimate. Named rows
+        // receive their own verification at the shared physical-dispatch gate.
+        spec.extra["routeBillingKnowledge"] = (actual) => actual.credential_profile
+            ? "unknown"
+            : this.routeBillingKnowledge(runInput ?? { repoRoot: contract.repo.root }, adapter.id);
         if (interaction)
             spec.extra["interactionChannel"] = interaction;
         const workEnvelope = this.workReportEnvelopeFor(routed, contract, Boolean(interaction));
@@ -1554,7 +1540,8 @@ export class Orchestrator {
                     // gate and required-actions read a typed category, not a bare boolean.
                     harnessErrored = true;
                     errors.push(safeErrorMessage(err));
-                    if (err instanceof ProcessingBudgetAdmissionError) {
+                    if (err instanceof ProcessingBudgetAdmissionError ||
+                        err instanceof RoutingPreflightError) {
                         processingRefusal = err;
                         break;
                     }
@@ -1948,7 +1935,7 @@ export class Orchestrator {
                 attemptId,
                 intent: this.candidateIntent(input),
                 harnessId: routed.adapter.id,
-                cost: attemptCostEvidence(routed.adapter.id, attemptId, this.reservationEstimateUsd(input, i > 0), this.routeBillingKnowledge(input, routed.adapter.id), processingCostEvidence(routed.processing, this.routeBillingKnowledge(input, routed.adapter.id), [`harness:${routed.adapter.id}`])),
+                cost: processingAttemptCostEvidence(routed.adapter.id, attemptId, this.reservationEstimateUsd(input, i > 0), this.routeBillingKnowledge(input, routed.adapter.id, routed), routed.processing),
             });
             log.emit("budget.lease.created", {
                 granted: lease.granted,
@@ -1973,7 +1960,7 @@ export class Orchestrator {
                 routed,
                 attemptId,
                 label: `Candidate ${LABELS[i] ?? i + 1}`,
-                leaseId: lease.lease?.lease_id ?? "",
+                lease: lease.lease,
             });
         }
         const runsBySlot = new Array(slots.length);
@@ -1984,14 +1971,14 @@ export class Orchestrator {
         let candidateContinuationCount = 0;
         const runSlot = async (slot, slotIdx) => {
             if (input.signal?.aborted) {
-                ledger.cancel(slot.leaseId);
+                ledger.cancel(slot.lease.lease_id);
                 return;
             }
             // Leases are granted upfront (before spend exists); a worker still
             // re-checks the circuit breaker so queued slots beyond the parallel wave
             // do not start after earlier candidates already blew the hard cap.
             if (budgetStopped || ledger.tier() === "hard") {
-                ledger.cancel(slot.leaseId);
+                ledger.cancel(slot.lease.lease_id);
                 log.emit("budget.lease.created", {
                     granted: false,
                     reason: "budget exhausted (hard cap reached)",
@@ -2055,7 +2042,7 @@ export class Orchestrator {
                 });
                 harnessHome = this.harnessHomeFor(wsm, envelope, slot.routed, input);
                 const run = await this.runCandidateInEnvelope(slot.routed, envelope, slot.attemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, {
-                    id: slot.leaseId,
+                    lease: slot.lease,
                     onDenied: (denial) => {
                         budgetStopped = true;
                         budgetDenial ??= denial;
@@ -2065,14 +2052,14 @@ export class Orchestrator {
                     safeInvoke(input.onHarnessEvent, safeEv);
                     log.emit("harness.event", harnessEventPayload(adapter.id, slot.attemptId, safeEv));
                 }, input.signal, downgradeModel ?? undefined, input.effort, this.candidateIntent(input), log, effectiveWeb, this.interactionChannelFor(input, log, runId, taskId, slot.attemptId, adapter.id, slot.routed.supportsInteractive), (streamedUsd) => {
-                    ledger.updateHold(slot.leaseId, streamedUsd);
+                    ledger.updateHold(slot.lease.lease_id, streamedUsd);
                     if (ledger.tier() !== "hard")
                         return false;
                     budgetStopped = true;
                     return true;
                 }, input, requestedSingleCandidate, // W-C4 deltas: single-candidate chat lane only (racing = noise x N)
                 undefined, undefined, harnessHome);
-                ledger.settle(slot.leaseId, attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
+                ledger.settle(slot.lease.lease_id, attemptUsageCostSettlement(run.cost, run.costEstimated, run.attemptId, run.harnessId, run.telemetry.authMode, run.telemetry.usageCost));
                 log.emit("harness.completed", {
                     harness_id: adapter.id,
                     attempt_id: slot.attemptId,
@@ -2118,7 +2105,7 @@ export class Orchestrator {
                             attemptId: contAttemptId,
                             intent: this.candidateIntent(input),
                             harnessId: adapter.id,
-                            cost: attemptCostEvidence(adapter.id, contAttemptId, this.estimateUsdFloor(input.repoRoot), this.routeBillingKnowledge(input, adapter.id), processingCostEvidence(slot.routed.processing, this.routeBillingKnowledge(input, slot.routed.adapter.id), [`harness:${adapter.id}`])),
+                            cost: processingAttemptCostEvidence(adapter.id, contAttemptId, this.estimateUsdFloor(input.repoRoot), this.routeBillingKnowledge(input, adapter.id, slot.routed), slot.routed.processing),
                         });
                         if (contLease.granted) {
                             candidateContinuationCount += 1; // claim the one-shot only once it launches
@@ -2138,7 +2125,7 @@ export class Orchestrator {
                             const contLeaseId = contLease.lease?.lease_id ?? "";
                             try {
                                 const contRun = await this.runCandidateInEnvelope(slot.routed, envelope, contAttemptId, slot.label, contract, input.prompt, store, paths, wsm, ledger, {
-                                    id: contLeaseId,
+                                    lease: contLease.lease,
                                     onDenied: (denial) => {
                                         budgetStopped = true;
                                         budgetDenial ??= denial;
@@ -2197,7 +2184,7 @@ export class Orchestrator {
             }
             catch (err) {
                 const failureCost = AC.attemptFailureCost(err, "post-stream-error", 0);
-                ledger.settle(slot.leaseId, failureCost.settlement);
+                ledger.settle(slot.lease.lease_id, failureCost.settlement);
                 const message = safeErrorMessage(err);
                 const declared = declaredFailure(err);
                 const infraPhase = envelope === undefined ? "workspace" : "harness";
@@ -2404,7 +2391,7 @@ export class Orchestrator {
                 attemptId: "synth",
                 intent: "synthesize",
                 harnessId: synthRouted.adapter.id,
-                cost: attemptCostEvidence(synthRouted.adapter.id, "synth", this.reservationEstimateUsd(input), this.routeBillingKnowledge(input, synthRouted.adapter.id), processingCostEvidence(synthRouted.processing, this.routeBillingKnowledge(input, synthRouted.adapter.id), [`harness:${synthRouted.adapter.id}`])),
+                cost: processingAttemptCostEvidence(synthRouted.adapter.id, "synth", this.reservationEstimateUsd(input), this.routeBillingKnowledge(input, synthRouted.adapter.id, synthRouted), synthRouted.processing),
             });
             if (lease.granted) {
                 let envelope;
@@ -2431,7 +2418,7 @@ export class Orchestrator {
                     });
                     const synthHome = this.harnessHomeFor(wsm, envelope, synthRouted, input);
                     const run = await this.runCandidateInEnvelope(synthRouted, envelope, "synth", "Synthesis", contract, synthesisInput.prompt, store, paths, wsm, ledger, {
-                        id: lease.lease.lease_id,
+                        lease: lease.lease,
                         onDenied: (denial) => {
                             budgetStopped = true;
                             budgetDenial ??= denial;
@@ -3211,7 +3198,7 @@ export class Orchestrator {
                     attemptId,
                     intent: "repair",
                     harnessId: adapter.id,
-                    cost: attemptCostEvidence(adapter.id, attemptId, this.reservationEstimateUsd(input), this.routeBillingKnowledge(input, adapter.id), processingCostEvidence(routed.processing, this.routeBillingKnowledge(input, routed.adapter.id), [`harness:${adapter.id}`])),
+                    cost: processingAttemptCostEvidence(adapter.id, attemptId, this.reservationEstimateUsd(input), this.routeBillingKnowledge(input, adapter.id, routed), routed.processing),
                 });
                 if (!lease.granted) {
                     exhausted = true;
@@ -3230,7 +3217,7 @@ export class Orchestrator {
                         ...(knobs.ignored.length > 0 ? { ignored_settings: knobs.ignored } : {}),
                     });
                     run = await this.runCandidateInEnvelope(routed, envelope, attemptId, `Attempt ${attempt}`, contract, prompt, store, paths, wsm, ledger, {
-                        id: lease.lease.lease_id,
+                        lease: lease.lease,
                         onDenied: (denial) => {
                             exhausted = true;
                             processingBudgetDenial ??= denial;
@@ -3796,17 +3783,17 @@ export class Orchestrator {
     /** Bind private route/session preparation to the planner-attempt owner. */
     plannerAttemptDeps() {
         return {
-            billingKnowledge: (input, harnessId) => this.routeBillingKnowledge(input, harnessId),
+            billingKnowledge: (input, harnessId, routed) => this.routeBillingKnowledge(input, harnessId, routed),
             inactivityTimeoutMs: (repoRoot) => harnessInactivityTimeoutMs(this.config(repoRoot)),
             quotaEventSink: this.deps.quotaEventSink,
-            prepare: async (args) => {
+            prepare: async (args, processingAdmission, physicalDispatchStarted) => {
                 const { input, contract, taskId, runId, log, store, paths, routed, attemptId } = args;
                 const adapter = routed.adapter;
                 const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
                 const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
                 const sessionFields = await this.sessionSpecFields(input, adapter.id, knobs.model, log, routed.authRouteEstimate, routed.quotaAdmission);
                 const laneContinuity = args.laneRun
-                    ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, sessionFields.resume_session_id !== null, sessionFields, store, paths, this.execRootOf(input), log)
+                    ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, sessionFields.resume_session_id !== null, sessionFields, store, paths, this.execRootOf(input), log, this.harnessSpecKnobs(contract, knobs, args.intent), processingAdmission, physicalDispatchStarted)
                     : null;
                 const spec = HarnessRunSpec.parse({
                     session_id: newId("ses"),
@@ -3995,13 +3982,7 @@ export class Orchestrator {
                     // terminal names the refused route and does not read "all planners
                     // failed"; capture the typed denial for the budget classifier.
                     planBudgetDenial ??= outcome.budgetDenial ?? null;
-                    planAttempts.push({
-                        attemptId,
-                        harnessId: outcome.harnessId,
-                        status: outcome.status,
-                        outcomeClass: outcome.outcomeClass,
-                        error: outcome.error,
-                    });
+                    planAttempts.push(plannerAttemptSummary(outcome));
                     break;
                 }
                 if (outcome.telemetry)
@@ -4010,13 +3991,7 @@ export class Orchestrator {
                         harnessId: outcome.harnessId,
                         telemetry: outcome.telemetry,
                     });
-                planAttempts.push({
-                    attemptId,
-                    harnessId: outcome.harnessId,
-                    status: outcome.status,
-                    outcomeClass: outcome.outcomeClass,
-                    error: outcome.error,
-                });
+                planAttempts.push(plannerAttemptSummary(outcome));
                 if (outcome.status !== "success") {
                     if (outcome.telemetry?.effortResolution?.resolution === "rejected")
                         break;
@@ -4141,7 +4116,13 @@ export class Orchestrator {
     quotaSnapshotPreflight() {
         return [...(this.deps.quotaSnapshots?.() ?? [])].map((snapshot) => QuotaSnapshotSchema.parse(snapshot));
     }
-    routeBillingKnowledge(input, harnessId) {
+    routeBillingKnowledge(input, harnessId, routed) {
+        if (routed?.quotaAdmission.profile) {
+            return billingKnowledgeForAuthRoute({
+                route: routed.quotaAdmission.route,
+                verification: routed.quotaAdmission.profileVerification ?? "not_run",
+            });
+        }
         // A selected profile's credential_kind decides billing (round-18 #2).
         const profileRoute = this.credentials.profileAuthRoute(input, harnessId);
         if (profileRoute)
@@ -4173,9 +4154,7 @@ export class Orchestrator {
             // The reducer admits under a finite estimate floor (mirror of the n>1
             // scout reserve) so a subscription route is not refused for lacking a
             // cash quote.
-            attemptCostEvidence(harnessId, attemptId, this.estimateUsdFloor(input.repoRoot), this.routeBillingKnowledge(input, harnessId), processingCostEvidence(routed?.processing, this.routeBillingKnowledge(input, harnessId), [
-                `harness:${harnessId}`,
-            ])),
+            processingAttemptCostEvidence(harnessId, attemptId, this.estimateUsdFloor(input.repoRoot), this.routeBillingKnowledge(input, harnessId, routed), routed?.processing),
             buildSpec: async (routed, homeEnv, prompt, attemptId) => {
                 const knobs = this.routeSpecKnobs(routed, contract, undefined, input.effort);
                 const effectiveWeb = this.discloseWebUpgrade(log, routed, knobs.webPolicy, attemptId);
@@ -4349,7 +4328,7 @@ export class Orchestrator {
                 // (mirror of the candidate loop): the first top-level scout reserves
                 // without a floor; later scouts and every real Delegate child pass the
                 // repo floor because they overlap an existing family unit.
-                cost: attemptCostEvidence(adapter.id, attemptId, this.reservationEstimateUsd(input, opts.deepScan && idx > 0), this.routeBillingKnowledge(input, adapter.id), processingCostEvidence(routed.processing, this.routeBillingKnowledge(input, routed.adapter.id), [`harness:${adapter.id}`])),
+                cost: processingAttemptCostEvidence(adapter.id, attemptId, this.reservationEstimateUsd(input, opts.deepScan && idx > 0), this.routeBillingKnowledge(input, adapter.id, routed), routed.processing),
             });
             if (!lease.granted) {
                 log.emit("budget.lease.created", {
@@ -4378,6 +4357,10 @@ export class Orchestrator {
                 }
                 return { status: "budget_denied", reason: lease.reason ?? "budget lease denied" };
             }
+            const processingAdmission = processingAdmissionForLease(ledger, lease.lease, adapter.id, attemptId, (denial) => {
+                budgetStopped = true;
+                budgetDenial ??= denial;
+            });
             // As with planners, the granted lease owns profile/continuity/spec
             // preparation. Contain a pre-stream rejection as this attempt's failure;
             // parallel siblings can then finish before the shared HOME is disposed.
@@ -4398,7 +4381,7 @@ export class Orchestrator {
                 // scouts are excluded from laneRun); native resume is available only when
                 // this slot was granted the lane's recorded session.
                 const laneContinuity = laneRun
-                    ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, grantResume, sessionFields, store, paths, this.execRootOf(input), log)
+                    ? await this.resolveContinuity(input, adapter.id, sessionFields.credential_profile?.profile_id ?? input.credentialProfileId ?? null, grantResume, sessionFields, store, paths, this.execRootOf(input), log, this.harnessSpecKnobs(contract, knobs, opts.intent), processingAdmission, () => ledger.markPhysicalDispatchStarted(lease.lease.lease_id))
                     : null;
                 // D-16d: the continuation packet pointer rides after the lane pointer so
                 // the fresh session is re-grounded in the exhausted attempt's work.
@@ -4457,7 +4440,7 @@ export class Orchestrator {
                 const message = `read-only attempt setup failed: ${safeErrorMessage(preparation.error)}`;
                 AC.settleGrantedAttemptLease({
                     ledger,
-                    leaseId: lease.lease?.lease_id ?? "",
+                    leaseId: lease.lease.lease_id,
                     attemptId,
                     harnessId: adapter.id,
                     costUsd: 0,
@@ -4490,10 +4473,7 @@ export class Orchestrator {
             const { knobs, spec: preparedSpec, reportAbort, reportInteraction, readonlyWorkMode, attemptEventsPath, telemetry, } = preparation.value;
             let { answer } = preparation.value;
             let spec = preparedSpec;
-            bindProcessingAdmission(spec, ledger, lease.lease.lease_id, adapter.id, attemptId, (denial) => {
-                budgetStopped = true;
-                budgetDenial ??= denial;
-            });
+            bindProcessingAdmission(spec, ledger, lease.lease, adapter.id, attemptId, undefined, processingAdmission);
             const retryPolicy = transientRetryPolicy(this.config(input.repoRoot));
             let activeSessionId = spec.session_id;
             const live = liveAttempt(input, routed, paths, contract, attemptId, () => activeSessionId);
@@ -4595,7 +4575,8 @@ export class Orchestrator {
                     }
                     catch (err) {
                         harnessError = safeErrorMessage(err);
-                        if (err instanceof ProcessingBudgetAdmissionError) {
+                        if (err instanceof ProcessingBudgetAdmissionError ||
+                            err instanceof RoutingPreflightError) {
                             processingRefusal = err;
                             break;
                         }
@@ -4676,7 +4657,7 @@ export class Orchestrator {
                 input.signal?.removeEventListener("abort", onAbort);
                 AC.settleGrantedAttemptLease({
                     ledger,
-                    leaseId: lease.lease?.lease_id ?? "",
+                    leaseId: lease.lease.lease_id,
                     attemptId,
                     harnessId: adapter.id,
                     costUsd: cost,