@coreplane/switchboard 1.251.0 → 1.252.0

package/dist/assets/src/core/modelPricing.ts

@@ -1,4 +1,6 @@
-import { parseModelRef } from "./provider.js";
+import { parseModelRef, type TokenUsage } from "./provider.js";
+import type { CardPrice } from "./modelCard.js";
+import type { ReportedCost } from "./modelProxy/usage.js";
 import type { ModelUsage, RunUsage } from "./runUsage.js";
 
 // The price of a model's tokens (docs/reference/specs/costs.md): one table
@@ -148,6 +150,105 @@ export function modelPriceOf(ref: string, prices: ModelPriceTable = NO_PRICES):
   return { input: list.input, output: list.output, cacheRead: list.cacheRead, cacheWrite: list.cacheWrite5m };
 }
 
+// ---- one turn, priced at the proxy (model-proxy.md item 6) -----------------------
+
+/** Which layer priced the turn: the provider's own reported cost, the
+ *  operator's table (`costs.prices` or a block's `models.<id>.price`), the
+ *  registry card (the Anthropic family list folds into this layer), or none —
+ *  an unpriced turn is never $0. */
+export type PriceSource = "provider" | "operator" | "registry" | "none";
+
+/** The meter row's dollars: `usd` when a layer priced the turn, `feeUsd` on a
+ *  BYOK turn (the aggregator's fee — inside `usd` when the vendor's charge was
+ *  reported beside it, otherwise beside the layer that priced the tokens),
+ *  and the layer. */
+export interface TurnPrice {
+  usd?: number;
+  feeUsd?: number;
+  priceSource: PriceSource;
+}
+
+/** What `priceTurn` reads of the run's model card: the ref the spans name,
+ *  the card's rate when a layer named one, and which layer did
+ *  (`ModelCard.provenance.price`). */
+export interface TurnPriceCard {
+  ref: string;
+  price?: CardPrice;
+  pricedBy?: "operator" | "registry" | "wire";
+}
+
+const turnTokensUsd = (u: TokenUsage, p: { input: number; output: number; cacheRead: number; cacheWrite: number }) =>
+  (u.inputTokens * p.input +
+    u.outputTokens * p.output +
+    (u.cacheReadTokens ?? 0) * p.cacheRead +
+    (u.cacheWriteTokens ?? 0) * p.cacheWrite) /
+  1_000_000;
+
+/** A card rate over one turn's counts, tiers by pi's rule (`calculateCost`):
+ *  the input side is input + cache reads + cache writes, and the WHOLE request
+ *  re-rates at the highest tier whose threshold it exceeds. */
+export function cardPriceUsd(usage: TokenUsage, price: CardPrice): number {
+  const inputSide = usage.inputTokens + (usage.cacheReadTokens ?? 0) + (usage.cacheWriteTokens ?? 0);
+  let rates: { input: number; output: number; cacheRead: number; cacheWrite: number } = price;
+  let matched = -1;
+  for (const tier of price.tiers ?? []) {
+    if (inputSide > tier.inputTokensAbove && tier.inputTokensAbove > matched) {
+      rates = tier;
+      matched = tier.inputTokensAbove;
+    }
+  }
+  return turnTokensUsd(usage, rates);
+}
+
+/**
+ * One turn's price, by record 0052's precedence: a provider-reported cost is
+ * stored as reported (`provider`; on BYOK the fee and the vendor's upstream
+ * charge sum into `usd` with `feeUsd` beside), else the operator's layer
+ * (`costs.prices` for the exact ref, or the card's operator-named rate), else
+ * the registry layer (the card's rate with its tiers, or the Anthropic family
+ * list — costs.md item 4b's fallback, folded here), else `none` — a turn no
+ * layer prices, and a stream broken before its usage arrived, stays unpriced.
+ */
+export function priceTurn(
+  card: TurnPriceCard,
+  reported: ReportedCost | undefined,
+  usage: TokenUsage | undefined,
+  prices: ModelPriceTable = NO_PRICES,
+): TurnPrice {
+  if (reported) {
+    if (!reported.byok) return { usd: reported.cost, priceSource: "provider" };
+    if (reported.upstreamCost !== undefined) {
+      return { usd: reported.cost + reported.upstreamCost, priceSource: "provider", feeUsd: reported.cost };
+    }
+    // A BYOK chunk without the vendor's charge: the fee is not the turn's
+    // dollars, so it rides beside whatever layer below prices the tokens —
+    // never as an authoritative figure that understates the turn.
+    return { ...priceTurn(card, undefined, usage, prices), feeUsd: reported.cost };
+  }
+  if (!usage) return { priceSource: "none" };
+  const operator = prices[card.ref];
+  if (operator) return { usd: turnTokensUsd(usage, operator), priceSource: "operator" };
+  if (card.price) {
+    return {
+      usd: cardPriceUsd(usage, card.price),
+      priceSource: card.pricedBy === "operator" ? "operator" : "registry",
+    };
+  }
+  const list = anthropicPriceOf(modelIdOf(card.ref));
+  if (list) {
+    return {
+      usd: turnTokensUsd(usage, {
+        input: list.input,
+        output: list.output,
+        cacheRead: list.cacheRead,
+        cacheWrite: list.cacheWrite5m,
+      }),
+      priceSource: "registry",
+    };
+  }
+  return { priceSource: "none" };
+}
+
 /** What a model's counted tokens cost at a price, USD. */
 export function modelUsageUsd(m: ModelUsage, p: ModelPrice): number {
   return (
@@ -211,6 +312,15 @@ export function llmUsdOfUsage(
   let unpricedTokens = 0;
   const byModel: Record<string, PricedModelUsage> = {};
   for (const [ref, m] of Object.entries(usage.byModel)) {
+    // A model whose spans priced their own turns (model-proxy item 6) keeps
+    // the recorded figure — a provider-reported cost beats any table — and
+    // null (a turn without a figure) reads as unpriced, never re-priced here.
+    if (m.usd !== undefined) {
+      if (m.usd === null) unpricedTokens += m.inputTokens + m.outputTokens + m.cacheReadTokens + m.cacheWriteTokens;
+      else usd += m.usd;
+      byModel[ref] = { ...m, usd: m.usd };
+      continue;
+    }
     const price = modelPriceOf(ref, prices);
     const priced = price ? modelUsageUsd(m, price) : undefined;
     if (priced === undefined) unpricedTokens += m.inputTokens + m.outputTokens + m.cacheReadTokens + m.cacheWriteTokens;

package/dist/assets/src/core/modelProxy/usage.ts

@@ -0,0 +1,88 @@
+// A provider's usage object as the proxy's meter reads it
+// (docs/reference/specs/model-proxy.md item 6): the three wire shapes the proxy
+// forwards — Anthropic's `message.usage`, the Chat Completions `usage` and the
+// Responses API's `usage` — each
+// normalized to the one `TokenUsage` every `model.turn` span carries. Undefined
+// unless both core counts are numbers: a malformed or absent usage never fails
+// a completion, it only leaves the turn unmetered. The first two readers were the
+// native adapters' until record 0032's series deleted the adapters; the proxy
+// is their one reader now.
+
+import type { TokenUsage } from "../provider.js";
+
+/** Anthropic `message.usage` → TokenUsage. */
+export function usageFromAnthropic(u: unknown): TokenUsage | undefined {
+  if (typeof u !== "object" || u === null) return undefined;
+  const o = u as Record<string, unknown>;
+  if (typeof o.input_tokens !== "number" || typeof o.output_tokens !== "number") return undefined;
+  const usage: TokenUsage = { inputTokens: o.input_tokens, outputTokens: o.output_tokens };
+  if (typeof o.cache_read_input_tokens === "number") usage.cacheReadTokens = o.cache_read_input_tokens;
+  if (typeof o.cache_creation_input_tokens === "number") usage.cacheWriteTokens = o.cache_creation_input_tokens;
+  return usage;
+}
+
+/** OpenAI-style `usage` → TokenUsage. `prompt_tokens_details.cached_tokens` is
+ *  the cache-read count where the server reports one. */
+export function usageFromOpenAI(u: unknown): TokenUsage | undefined {
+  if (typeof u !== "object" || u === null) return undefined;
+  const o = u as Record<string, unknown>;
+  if (typeof o.prompt_tokens !== "number" || typeof o.completion_tokens !== "number") return undefined;
+  const usage: TokenUsage = { inputTokens: o.prompt_tokens, outputTokens: o.completion_tokens };
+  const details = o.prompt_tokens_details;
+  if (typeof details === "object" && details !== null) {
+    const cached = (details as Record<string, unknown>).cached_tokens;
+    if (typeof cached === "number") usage.cacheReadTokens = cached;
+  }
+  return usage;
+}
+
+/** A provider-reported cost beside the counters (model-proxy.md item 6): the
+ *  OpenRouter final chunk's `usage.cost` in USD — on a BYOK turn (`is_byok`)
+ *  the aggregator's fee alone, with what the vendor billed the operator's own
+ *  key in `cost_details.upstream_inference_cost`. Read off the same usage
+ *  object the counters come from; a usage without a finite `cost` reports
+ *  none (Anthropic's wire never carries one). */
+export interface ReportedCost {
+  /** The figure as reported, stored as reported (record 0052). */
+  cost: number;
+  /** OpenRouter's `is_byok`: the turn billed the operator's own vendor key. */
+  byok?: boolean;
+  /** `cost_details.upstream_inference_cost`: the vendor's own charge on a BYOK turn. */
+  upstreamCost?: number;
+}
+
+/** The cost fields of one wire `usage` object, or undefined when it carries none. */
+export function reportedCostOf(u: unknown): ReportedCost | undefined {
+  if (typeof u !== "object" || u === null) return undefined;
+  const o = u as Record<string, unknown>;
+  if (typeof o.cost !== "number" || !Number.isFinite(o.cost)) return undefined;
+  const details = o.cost_details;
+  const upstream =
+    typeof details === "object" && details !== null
+      ? (details as Record<string, unknown>).upstream_inference_cost
+      : undefined;
+  return {
+    cost: o.cost,
+    ...(o.is_byok === true ? { byok: true } : {}),
+    ...(typeof upstream === "number" && Number.isFinite(upstream) ? { upstreamCost: upstream } : {}),
+  };
+}
+
+/** The Responses API's `usage` → TokenUsage. `input_tokens_details.cached_tokens`
+ *  is the cache-read count and `input_tokens_details.cache_write_tokens` the
+ *  cache-write count where a server reports one (OpenAI itself never does; a
+ *  gateway on the wire may). `output_tokens_details.reasoning_tokens` rides
+ *  inside `output_tokens` — the shape is read, never a fifth counter. */
+export function usageFromResponses(u: unknown): TokenUsage | undefined {
+  if (typeof u !== "object" || u === null) return undefined;
+  const o = u as Record<string, unknown>;
+  if (typeof o.input_tokens !== "number" || typeof o.output_tokens !== "number") return undefined;
+  const usage: TokenUsage = { inputTokens: o.input_tokens, outputTokens: o.output_tokens };
+  const details = o.input_tokens_details;
+  if (typeof details === "object" && details !== null) {
+    const { cached_tokens, cache_write_tokens } = details as Record<string, unknown>;
+    if (typeof cached_tokens === "number") usage.cacheReadTokens = cached_tokens;
+    if (typeof cache_write_tokens === "number") usage.cacheWriteTokens = cache_write_tokens;
+  }
+  return usage;
+}

package/dist/assets/src/core/modelRegistry.ts

@@ -23,7 +23,21 @@ export interface RegistryCard {
    *  not named (the card's reader applies pi's rule). */
   thinkingLevelMap?: Record<string, string | null>;
   input?: string[];
-  cost?: { input?: number; output?: number; cacheRead?: number; cacheWrite?: number };
+  cost?: {
+    input?: number;
+    output?: number;
+    cacheRead?: number;
+    cacheWrite?: number;
+    /** pi's long-context tiers: the whole request re-rates at the highest tier
+     *  whose threshold the input side (input + cache reads + cache writes) exceeds. */
+    tiers?: Array<{
+      inputTokensAbove?: number;
+      input?: number;
+      output?: number;
+      cacheRead?: number;
+      cacheWrite?: number;
+    }>;
+  };
   contextWindow?: number;
   maxTokens?: number;
   compat?: Record<string, unknown>;

package/dist/assets/src/core/refusal.ts

@@ -87,6 +87,7 @@ const CAUSE_OF = {
   ship_preflight_head_unknown: "system",
   ship_preflight_closed_resume: "request",
   ship_preflight_no_task: "request",
+  ship_preflight_base_missing: "request",
   // the plan hand-off's fifteen sentences (two share `plan_history_unavailable`)
   plan_base_unknown: "request",
   plan_routed_seed: "request",
@@ -102,13 +103,9 @@ const CAUSE_OF = {
   plan_runner_conflict: "system",
   plan_instance_orphaned: "system",
   plan_start_failed: "system",
-  // the directive and resolve parsers' thrown errors (A6 of the inventory)
-  directive_agent: "request",
-  directive_effort: "request",
-  directive_budget: "request",
-  directive_severity: "request",
-  directive_renewals: "request",
-  directive_verbosity: "request",
+  // the resolve parser's thrown errors (A6 of the inventory); the directive
+  // parser no longer refuses — a token whose value is outside its vocabulary
+  // is text (the interim grammar, src/directives.ts)
   provider_unknown: "request",
   // the model card's refusal (record 0052, model-proxy item 11): a control the
   // resolved card does not take, named before any card or model call

package/dist/assets/src/core/reviewVerdict.ts

@@ -108,6 +108,10 @@ export interface Finding {
   line?: number;
   /** One line naming the issue; the full explanation lives in the prose. */
   title: string;
+  /** Machine provenance: true only on a check finding the ship round's checks
+   *  step itself appended (ship/coordinator.ts `checkFinding`) — never set from
+   *  a reviewer's input, whatever id the reviewer chose. */
+  check?: true;
 }
 
 export interface ReviewVerdict {

package/dist/assets/src/core/runEvents.ts

@@ -397,6 +397,10 @@ export type ShipRoundOutcome =
   | "approve"
   | "request_changes"
   | "no_verdict"
+  /** The round's checks step read a failed check at the reviewed head (record
+   *  0055): the failures become check findings and the findings step runs as
+   *  for any changes-requested round. */
+  | "checks_failed"
   | "aborted"
   | "stopped"
   /** The coding round ended at its lease with the unit unfinished and the row
@@ -536,6 +540,11 @@ export type RunEvent =
       callId?: string;
       spanId?: string;
       logIndex?: number;
+      /** The bound the call itself declared, in ms (a bash `timeout`, clamped
+       *  by nothing here — pi runs an unbounded call until the loop's end).
+       *  The stall signal (docs/reference/specs/live-view.md item 32) marks a
+       *  call past it; absent when the call declared none. */
+      boundMs?: number;
       seq?: number;
       at?: number;
     }
@@ -671,8 +680,12 @@ export type RunEvent =
    *  and — for a repo run — the repo, ref, PR number and PR head as resolved
    *  BEFORE the first model turn (`RepoContext`). Published by the dispatcher
    *  right after `input`, once per run, so the run page can head its Request
-   *  block with linked `owner/repo · ref · #PR · sha`. Additive: every
-   *  consumer that only knows the other types keeps working. */
+   *  block with linked `owner/repo · ref · #PR · sha`. A HOSTED ship parent
+   *  (record 0060) carries a second one at the hand-off naming its runner
+   *  instance (`instanceId`): `run_meta` may repeat on such a run, and every
+   *  reader of a run's instance id resolves it from the LAST `run_meta`
+   *  carrying one. Additive: every consumer that only knows the other types
+   *  keeps working. */
   | {
       type: "run_meta";
       agent: string;
@@ -865,6 +878,23 @@ export type RunEvent =
    *  `coordinator_tag` is — so the thread's owner rule can find the instance
    *  from the page's ship run. Additive: unknown → ignored. */
   | { type: "ship_handoff"; instanceId: string; seq?: number; at?: number }
+  /** A coordinator child interrupted under a deploy roll (docs/reference/specs/run-history.md
+   *  item 47a): the run closes `interrupted` for a restart from its request —
+   *  a workspace lost across a bot roll, the resident's container replaced
+   *  with the relaunch refused — and the record says so as a typed fact
+   *  beside the `resumed`/`sandbox_restarted` notes, `reason` the refusal or
+   *  note in one line. Published straight to the registry by the reattach
+   *  path and the run loop's interruption; the parent's wait settles on its
+   *  Workflow twin (`child-interrupted-<runId>`) beside `run-finished-<runId>`
+   *  and confirms by `read-record`. Additive: unknown → ignored. */
+  | { type: "child_interrupted"; parentInstanceId: string; reason: string; seq?: number; at?: number }
+  /** A coordinator child resumed across a deploy roll (run-history item 47a):
+   *  the same run re-attached its workspace and carries on under its record,
+   *  tag and budget. Published straight to the registry by the reattach path;
+   *  the Workflow twin (`child-resumed-<runId>`) tells the parent's wait to
+   *  keep waiting rather than walk out the chunk asking. Additive: unknown →
+   *  ignored. */
+  | { type: "child_resumed"; parentInstanceId: string; summary: string; seq?: number; at?: number }
   /** The review post-step's outcome when the verdict landed
    *  (docs/reference/specs/agent-review.md item 18): the pull request it was
    *  posted to, the head it was pinned to (the carried head after a rebase,
@@ -905,6 +935,25 @@ export type RunEvent =
       seq?: number;
       at?: number;
     }
+  /** A hosted ship parent's unit fact (record 0060; docs/reference/specs/agent-ship.md
+   *  item 17): the runner's routes write it to the parent run through the
+   *  coordinator's `hostPublish` — `unit-start` publishes state `started` with
+   *  the unit's thread key and lead, `round` the round's outcome as the unit's
+   *  state, `unit-end` the ending's kind with its report — carrying the pull
+   *  request number when the unit's row knows one. The run page draws it as a
+   *  step whose detail is the report; the friction analyzer counts it as a
+   *  side fact, never activity. Additive: unknown → ignored. */
+  | {
+      type: "ship_unit";
+      unit: string;
+      state: string;
+      threadKey?: string;
+      lead?: string;
+      report?: string;
+      pr?: number;
+      seq?: number;
+      at?: number;
+    }
   /** The request router's decision (docs/reference/specs/routing-and-config.md
    *  item 21): the preset a plain message was routed to, the one-line reason
    *  the router gave (redacted, capped — the same text the card's `routed:`

package/dist/assets/src/core/runFriction.ts

@@ -413,8 +413,10 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
     // call that already produced its own tool pair, and artifact beside the
     // attach_file call (or the dispatcher's staging) that moved the file;
     // review_artifact, pr_description, pr_opened, review_posted, the ship_round
-    // boundaries and the router's route are published by the dispatcher/pipeline
-    // outside the model loop entirely. Counting any of them would distort the story.
+    // boundaries, the hosted parent's ship_unit facts (record 0060 — written by
+    // the runner's routes, not the model) and the router's route are published
+    // by the dispatcher/pipeline outside the model loop entirely. Counting any
+    // of them would distort the story.
     if (
       ev.type === "skill_use" ||
       ev.type === "artifact" ||
@@ -423,8 +425,11 @@ export function analyzeRunFriction(events: readonly RunEvent[], opts: FrictionOp
       ev.type === "pr_opened" ||
       ev.type === "coordinator_tag" ||
       ev.type === "ship_handoff" ||
+      ev.type === "child_interrupted" ||
+      ev.type === "child_resumed" ||
       ev.type === "review_posted" ||
       ev.type === "ship_round" ||
+      ev.type === "ship_unit" ||
       ev.type === "route" ||
       ev.type === "refusal" ||
       ev.type === "reference" ||

package/dist/assets/src/core/runLedger/types.ts

@@ -121,6 +121,17 @@ export interface LiveRunMeta {
  *  the checklist, the pushed branch, the review head, the infra counters). */
 export type RunState = Record<string, unknown>;
 
+/** A hosted ship parent's hosting fact on the row's state (record 0060): the
+ *  runner instance the run hosts and the deadline past which a reclaim closes
+ *  the row `interrupted` instead of re-hosting it. Set by the ship branch once
+ *  the instance exists; read by the boot reclaim. */
+export interface HostingState {
+  instanceId: string;
+  /** Epoch ms: the hand-off time plus the instance's `caps.maxMinutes` plus
+   *  `HOSTED_DEADLINE_MARGIN_MINUTES`. */
+  until: number;
+}
+
 export interface LiveRunRow {
   runId: string;
   threadKey: string;

package/dist/assets/src/core/runUsage.ts

@@ -23,6 +23,17 @@ export interface ModelUsage {
   outputTokens: number;
   cacheReadTokens: number;
   cacheWriteTokens: number;
+  /** The model's dollars summed from its turns' own `usd` attrs (the proxy's
+   *  meter row, model-proxy item 6): a number when every turn that counted
+   *  tokens carried one, null when such a turn lacked it (unpriced — a sum
+   *  that left counted tokens out would understate the model; a turn that
+   *  counted none, an errored call or a retry, leaves nothing out), absent on
+   *  a record whose turns predate the meter row (the price table then prices
+   *  the tokens, costs.md item 4b). */
+  usd?: number | null;
+  /** The distinct `priceSource` words the turns carried, sorted — what the
+   *  by-model view names as the source. Absent when no turn carried one. */
+  priceSources?: string[];
 }
 
 export interface RunUsage {
@@ -46,6 +57,14 @@ export const emptyUsage = (): RunUsage => ({ turns: 0, byModel: {} });
 /** The run's usage from its events: one `model.turn` span end per provider call. */
 export function usageOfEvents(events: readonly RunEvent[]): RunUsage {
   const usage = emptyUsage();
+  // The meter row per model (model-proxy item 6): the turns' own dollars and
+  // sources. `usd` sums only when every turn that counted tokens carried one —
+  // a turn that counted none (an upstream error, a retry the harness's SDK
+  // spent, a stream broken before its usage) has nothing a sum could leave
+  // out, so it never turns the model unpriced; a model none of whose turns
+  // carried price attrs stays without the fields (a record from before the
+  // meter row — the table prices it, costs.md item 4b).
+  const priced = new Map<string, { usd: number; pricedTurns: number; tokenTurns: number; sources: Set<string> }>();
   for (const e of events) {
     if (e.type !== "span_end" || e.name !== MODEL_TURN) continue;
     const attrs = (e.attrs ?? {}) as Record<string, unknown>;
@@ -57,6 +76,8 @@ export function usageOfEvents(events: readonly RunEvent[]): RunUsage {
       cacheReadTokens: 0,
       cacheWriteTokens: 0,
     };
+    const counted =
+      num(attrs.inputTokens) + num(attrs.outputTokens) + num(attrs.cacheReadTokens) + num(attrs.cacheWriteTokens);
     m.turns += 1;
     m.inputTokens += num(attrs.inputTokens);
     m.outputTokens += num(attrs.outputTokens);
@@ -64,38 +85,71 @@ export function usageOfEvents(events: readonly RunEvent[]): RunUsage {
     m.cacheWriteTokens += num(attrs.cacheWriteTokens);
     usage.byModel[model] = m;
     usage.turns += 1;
+    const hasUsd = typeof attrs.usd === "number" && Number.isFinite(attrs.usd);
+    const hasSource = typeof attrs.priceSource === "string" && attrs.priceSource !== "";
+    const p = priced.get(model) ?? { usd: 0, pricedTurns: 0, tokenTurns: 0, sources: new Set<string>() };
+    if (counted > 0) p.tokenTurns += 1;
+    if (hasUsd) {
+      p.usd += attrs.usd as number;
+      p.pricedTurns += 1;
+    }
+    if (hasSource) p.sources.add(attrs.priceSource as string);
+    priced.set(model, p);
+  }
+  for (const [model, p] of priced) {
+    if (p.pricedTurns === 0 && p.sources.size === 0) continue;
+    const m = usage.byModel[model]!;
+    m.usd = p.pricedTurns >= p.tokenTurns ? p.usd : null;
+    if (p.sources.size > 0) m.priceSources = [...p.sources].sort();
   }
   return usage;
 }
 
+/** The two sides' `usd` folded: a sum when both carry one, null when either
+ *  has an unpriced turn, absent when either predates the meter row (the whole
+ *  cell then prices from the table, never half a figure). */
+const foldUsd = (a: ModelUsage["usd"], b: ModelUsage["usd"]): ModelUsage["usd"] =>
+  a === undefined || b === undefined ? undefined : a === null || b === null ? null : a + b;
+
 export function addUsage(a: RunUsage, b: RunUsage): RunUsage {
   const out: RunUsage = { turns: a.turns + b.turns, byModel: {} };
   for (const src of [a.byModel, b.byModel]) {
     for (const [model, m] of Object.entries(src)) {
-      const acc = out.byModel[model] ?? {
-        turns: 0,
-        inputTokens: 0,
-        outputTokens: 0,
-        cacheReadTokens: 0,
-        cacheWriteTokens: 0,
-      };
+      const acc = out.byModel[model];
+      if (!acc) {
+        out.byModel[model] = { ...m, ...(m.priceSources ? { priceSources: [...m.priceSources] } : {}) };
+        continue;
+      }
       acc.turns += m.turns;
       acc.inputTokens += m.inputTokens;
       acc.outputTokens += m.outputTokens;
       acc.cacheReadTokens += m.cacheReadTokens;
       acc.cacheWriteTokens += m.cacheWriteTokens;
-      out.byModel[model] = acc;
+      const usd = foldUsd(acc.usd, m.usd);
+      if (usd === undefined) delete acc.usd;
+      else acc.usd = usd;
+      const sources = new Set([...(acc.priceSources ?? []), ...(m.priceSources ?? [])]);
+      if (sources.size > 0) acc.priceSources = [...sources].sort();
     }
   }
   return out;
 }
 
-const isModelUsage = (v: unknown): v is ModelUsage =>
-  typeof v === "object" &&
-  v !== null &&
-  (["turns", "inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens"] as const).every(
-    (k) => typeof (v as Record<string, unknown>)[k] === "number",
+const isModelUsage = (v: unknown): v is ModelUsage => {
+  if (typeof v !== "object" || v === null) return false;
+  const m = v as Record<string, unknown>;
+  if (
+    !["turns", "inputTokens", "outputTokens", "cacheReadTokens", "cacheWriteTokens"].every(
+      (k) => typeof m[k] === "number",
+    )
+  )
+    return false;
+  if (m.usd !== undefined && m.usd !== null && typeof m.usd !== "number") return false;
+  return (
+    m.priceSources === undefined ||
+    (Array.isArray(m.priceSources) && m.priceSources.every((s) => typeof s === "string"))
   );
+};
 
 export function isRunUsage(v: unknown): v is RunUsage {
   if (typeof v !== "object" || v === null) return false;

package/dist/assets/src/core/schedules.ts

@@ -379,6 +379,9 @@ export interface WatchdogSummary {
     action?: unknown;
     error?: string;
     disk?: unknown;
+    /** The resident's last memory reading (`{usedBytes, capBytes, percent, …}`,
+     *  resident-repos.md item 70) when it has one. */
+    memory?: unknown;
     /** What the pass did about the resident's refresh Workflow instance: `{id, action, why}`. */
     instance?: unknown;
   }>;

package/dist/assets/src/core/ship/contract.ts

@@ -439,28 +439,55 @@ export const TIMEOUT_ON_LONG_COMMANDS =
   "State a timeout on any command you expect to run longer than a minute: a timeout that reaches past the loop's " +
   "end is refused before the command runs, never cut midway.";
 
-/** The fast gates a plan child runs before every push, named one by one
- *  (agent-ship item 13; agent-coding item 9). "Its cheapest proving checks"
- *  left the choice to the child, and children chose wrong: prettier was
- *  reported clean while `format:check` was red, and hygiene imprints reached
- *  CI that `hygiene:check` would have caught locally. Naming the commands
- *  makes each gate a receipt — the exit line goes into the handoff's verified
- *  list, and a gate the child could not run is unproven, never claimed clean. */
+/** The fast gates a plan child runs before every push, named one by one and
+ *  each scoped to the changed set (agent-ship item 13; agent-coding item 9).
+ *  "Its cheapest proving checks" left the choice to the child, and children
+ *  chose wrong in both directions: prettier was reported clean while
+ *  `format:check` was red, hygiene imprints reached CI that `hygiene:check`
+ *  would have caught locally — and children ran the whole suite and the whole
+ *  typecheck on the shared resident, minutes each call, time-sliced against
+ *  every other run. So the gates are the changed-set forms, the full runs are
+ *  said to be CI's alone in the same breath, and each gate is a receipt — the
+ *  exit line goes into the PR description's validation table as the row's proof
+ *  (the handoff has no verified list; parseHandoff carries deviations, followUps,
+ *  unproven and landed), and a gate the child could not run goes under the
+ *  handoff's unproven list, never claimed clean. The tests compare against the
+ *  pull request's own base — `origin/<base>` — which the render substitutes
+ *  from the rebase's `onto` when the contract knows it. */
+/** The changed-set test command as the contract renders it before the base is
+ *  known; the render substitutes the unit's base for `<base>` (`renderFirstInstruction`). */
+export const CHANGED_SET_TEST_PLACEHOLDER = "`npx vitest run --changed origin/<base>`";
+
 export const FAST_GATES_BEFORE_PUSH =
-  "The fast gates, before every push: `npx prettier --check` on the changed files, `npm run hygiene:check`, " +
-  "`npm run specs:check`, and `tsc --noEmit` on the touched project under `NODE_OPTIONS=--max-old-space-size=6144`. " +
-  "Paste each command's exit line into the handoff's verified list; a gate you could not run goes under unproven " +
-  "and is never claimed clean.";
+  "The fast gates, before every push — each scoped to the changed set, never the whole project: " +
+  `${CHANGED_SET_TEST_PLACEHOLDER} (the pull request's base; or the touched test files), ` +
+  "`tsc --noEmit -p` the touched tsconfig under `NODE_OPTIONS=--max-old-space-size=6144`, " +
+  "`npx prettier --check` on the changed files, `npm run hygiene:check` and `npm run specs:check` — " +
+  "then your judgement on what else this change needs, not a longer checklist. Every CI pipeline runs the " +
+  "tests, the types, the formatting and the full verification on your push, so you never run them again: " +
+  "you validate and fix your own change before pushing, at the changed-set scope. Passing the full test suite " +
+  "and the full typecheck is NOT part of your criteria: CI is that gate and the only place they run — on a " +
+  "shared resident they cost minutes that every other run pays for. " +
+  "Paste each command's exit line into the PR description's validation table as the row's proof; a gate you " +
+  "could not run goes under the handoff's unproven list and is never claimed clean.";
 
 function renderFirstInstruction(rebase: ChildContract["rebase"]): string {
   const branch = rebase.branch ? `\`${rebase.branch}\`` : "the unit's branch";
   const onto = rebase.onto ? `\`${rebase.onto}\`` : "the merged parent";
+  // the changed-set test run compares against the unit's own base, which the
+  // contract knows as the rebase target; unknown, the placeholder stands
+  // split/join, never String.replace: a `$` in a branch name is literal text here
+  const gates = rebase.onto
+    ? FAST_GATES_BEFORE_PUSH.split(`${CHANGED_SET_TEST_PLACEHOLDER} (the pull request's base; or`).join(
+        `\`npx vitest run --changed origin/${rebase.onto}\` (or`,
+      )
+    : FAST_GATES_BEFORE_PUSH;
   return (
     `Rebase ${branch} onto ${onto} before any other work — the parent unit has merged and the base has moved; ` +
     `the only writes are your own on that branch. A conflict ends the unit: report it as the handoff and stop. ` +
-    `Push the branch as soon as the change exists and the fast gates pass — before the project's ` +
-    `full verification, which runs after that push with any fix as a further commit; an unpushed tree does not ` +
-    `survive the run's end. ${FAST_GATES_BEFORE_PUSH} Right before each push, fetch ${onto} again and rebase ` +
+    `Push the branch as soon as the change exists and the fast gates pass — the project's full verification ` +
+    `is CI's gate, run there after the push with any fix as a further commit; an unpushed tree does not ` +
+    `survive the run's end. ${gates} Right before each push, fetch ${onto} again and rebase ` +
     `once more if it moved while you worked, so the pull request is not born conflicting. At the wind-down note, ` +
     `commit and push what compiles, say what does not, then answer. ${TIMEOUT_ON_LONG_COMMANDS}`
   );