@coreplane/switchboard 1.254.1 → 1.256.0

package/dist/assets/deploy/hooks/prepare-commit-msg

@@ -0,0 +1,17 @@
+#!/bin/sh
+# The agent trailer (docs/reference/specs/execution.md): every commit made in a
+# Switchboard image carries `Co-Authored-By: <bot pair>`, so the agent's hand
+# stays visible even when the author is the requester. The pair is read from
+# GIT_COMMITTER_NAME/GIT_COMMITTER_EMAIL at commit time — the bot fills them
+# per exec — so the image stays installation-agnostic; without them the
+# image's own git identity stands (its fallback address is off the GitHub
+# domain, so it never renders as a GitHub account). Idempotent: a message that
+# already carries this exact trailer is left unchanged; a foreign
+# Co-Authored-By does not stop it (the identity rewrite scrubs those).
+set -e
+msg="$1"
+name="${GIT_COMMITTER_NAME:-$(git config user.name || true)}"
+email="${GIT_COMMITTER_EMAIL:-$(git config user.email || true)}"
+[ -n "$name" ] && [ -n "$email" ] || exit 0
+git interpret-trailers --in-place --if-exists addIfDifferent \
+  --trailer "Co-Authored-By: $name <$email>" "$msg"

package/dist/assets/deploy/secrets.manifest.json

@@ -34,6 +34,18 @@
       "optional": true,
       "note": "Anthropic Admin API key (sk-ant-admin…) for the LLM-spend layer of GET /costs. Absent, /costs shows the Cloudflare side only."
     },
+    {
+      "name": "OPENROUTER_MANAGEMENT_KEY",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "OpenRouter management key for the openrouter biller's invoice tie-out on GET /costs (providers.openrouter.invoiceKeyEnv). Never the inference key. Absent, that biller shows no invoice."
+    },
+    {
+      "name": "OPENAI_ADMIN_KEY",
+      "workers": ["bot"],
+      "optional": true,
+      "note": "OpenAI admin key for the openai biller's invoice tie-out on GET /costs (providers.openai.invoiceKeyEnv). Never the inference key. Absent, that biller shows no invoice."
+    },
     {
       "name": "BRAVE_SEARCH_API_KEY",
       "workers": ["bot"],

package/dist/assets/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "switchboard",
-  "version": "1.254.1",
+  "version": "1.256.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "switchboard",
-      "version": "1.254.1",
+      "version": "1.256.0",
       "license": "Apache-2.0",
       "workspaces": [
         "web",
@@ -20445,7 +20445,7 @@
     },
     "packages/switchboard": {
       "name": "@coreplane/switchboard",
-      "version": "1.254.1",
+      "version": "1.256.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@earendil-works/pi-ai": "0.85.1",

package/dist/assets/package.json

@@ -1,6 +1,6 @@
 {
   "name": "switchboard",
-  "version": "1.254.1",
+  "version": "1.256.0",
   "private": true,
   "description": "Mention it in Slack and an agent reviews the PR, ships the fix, or answers the question — on the model you choose, with its tools running where you decide.",
   "license": "Apache-2.0",

package/dist/assets/source.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.254.1",
-  "commit": "48a9a480354e503b8fea59dc926f94132cf79756",
-  "builtAt": "2026-09-19T21:28:07.753Z"
+  "version": "1.256.0",
+  "commit": "fd814ee9ad2421f38178b15103d49ff4d9c5eb7c",
+  "builtAt": "2026-09-20T04:37:22.536Z"
 }

package/dist/assets/src/agents/registry.ts

@@ -47,6 +47,14 @@ export function machineNeedsRepo(machine: MachineClass): boolean {
 export const IDENTITIES = ["none", "read", "write"] as const;
 export type Identity = (typeof IDENTITIES)[number];
 
+/** The model tiers a preset may run on (the one-door plan's tiers rule): the
+ *  `fast` tier is the router's own model (`routing.model`), everything else is
+ *  `strong`. Each preset declares its allowed set below (`AgentDef.tiers`);
+ *  a parent choosing a child's model at spawn is held to the child preset's
+ *  set, and escalation is a new run — a run's tier is fixed at dispatch. */
+export const MODEL_TIERS = ["fast", "strong"] as const;
+export type ModelTier = (typeof MODEL_TIERS)[number];
+
 /** The wall clocks live in `src/core/budgets.ts` (docs/decisions/0046): a
  *  preset's ask, the turn cap derived from it and every allowance are rows
  *  there, and this registry reads them. Re-exported for the readers that
@@ -89,6 +97,12 @@ export interface AgentDef {
    *  worktree flag and the token the sandbox env and the `repo-cold` vet mint
    *  read this, through the run's effective profile. */
   identity: Identity;
+  /** The model tiers this preset may run on (`MODEL_TIERS`): what a parent's
+   *  spawn — and the operator's bind — may put in the child's request slot.
+   *  A preset that writes code (`coding`, `ship`, `review`) never includes
+   *  `fast`: a wrong approval or a wrong edit costs more than the tokens
+   *  saved; `explore` and `research` read, and may run fast. */
+  tiers: readonly ModelTier[];
   /** Whether the request router (docs/reference/specs/routing-and-config.md
    *  item 21) may pick this preset for a plain message. Absent means yes: the
    *  router's table is rendered from this registry. `false` keeps a preset
@@ -240,6 +254,31 @@ Keep notes with the \`notes\` tool: one short document, replaced whole each time
 // classes are by duration, the project's own scripts and CI say which is which.
 export const CHECKS_BY_COST = `CHECKS BY COST — push before the expensive ones. Every check you might run has a cost class: seconds (a formatter or a linter on the files you touched, one test file, a docs, link or spec check, the typecheck of one package) or minutes (the whole test suite, a build, a dependency install, an end-to-end or full verification). Know a command's class before you run it — from the project's own scripts and CI configuration, from how long it took last time, or by the class above when you have nothing better. Prove each change with the cheapest check that can prove it, matched to the change's scope and scoped to the changed set — the tests nearest your change, the touched project's typecheck, the changed files' formatting, never the whole tree: a documentation change gets the documentation checks, one module gets its own tests, a shared type gets the typecheck. Every CI pipeline runs the tests, the types, the formatting and the full verification on your push, so you never run them again: you validate and fix your own change before pushing, at the changed-set scope. Passing the full test suite and the full typecheck is NOT part of your criteria: CI is that gate and the only place they run — on a shared machine they cost minutes that every other run pays for. As soon as the change exists and those checks pass, commit and push — the pushed branch is the deliverable, and an unpushed tree does not survive the run's end. Beyond the changed set, use judgement about what this change needs rather than a checklist, fixing forward with further commits and pushes. Never start an operation whose expected duration does not fit the time you have left minus what a commit, a push and the description need: push what there is and say plainly what is unverified instead. At the wind-down note, commit and push what compiles, say what does not, then answer. ${TIMEOUT_ON_LONG_COMMANDS} The description's validation names exactly what ran; what did not run is CI's to gate, and you say so.`;
 
+// Every coding prompt carries this verbatim, right after the checks-by-cost
+// rule (docs/reference/specs/agent-coding.md item 13; issue 1796): the fast
+// gates before every push, each the changed-set form with its command named,
+// and the full verification named as CI's gate. The paragraph lived in the
+// ship contract's first instruction alone, so every ask that was not a plan
+// unit had to repeat it by hand or watch the run spend most of its budget on
+// the whole suite or the full verification before its first push (issue 1909
+// measured three such command shapes at 85–95 % of a child's life). One
+// constant, one text: the three coding variants carry the same bytes, the
+// contract's first instruction points here instead of re-stating it
+// (src/core/ship/contract.ts), and no requester repeats it. Unlike the
+// checks-by-cost rule above, this paragraph names its commands on purpose —
+// children handed only the classes chose wrong in both directions — and a
+// repository on another stack maps each gate by its class.
+export const TOUCHED_TESTS_COMMAND = "`npx vitest run` on the test files you touched, by name,";
+
+export const FAST_GATES_BEFORE_PUSH =
+  "THE FAST GATES, before every push — each scoped to the changed set, never the whole project: " +
+  `${TOUCHED_TESTS_COMMAND} once (never \`--changed\`, never a directory: on a moving base that is most of the suite), ` +
+  "`tsc --noEmit -p` the touched tsconfig under `NODE_OPTIONS=--max-old-space-size=6144`, " +
+  "`npx prettier --check` on the changed files, `npm run hygiene:check` and `npm run specs:check` — " +
+  "then your judgement on what else this change needs, not a longer checklist. The full verification is " +
+  "CI's gate — `npm run verify` runs there on your push, never here: push a head early and let CI judge it, " +
+  "fixing forward with further commits and pushes.";
+
 const CODING_SYSTEM = `You are Switchboard's coding agent, operating from a Slack request.
 
 You work inside a dedicated workspace directory with bash, read_file, and write_file tools. ${SANDBOX_TOOLCHAIN}
@@ -262,6 +301,8 @@ Workflow for shipping a PR:
 
 ${CHECKS_BY_COST}
 
+${FAST_GATES_BEFORE_PUSH}
+
 ${NEVER_MERGE}
 
 ${UNIT_CONTRACT}
@@ -309,6 +350,8 @@ Workflow for shipping a change:
 
 ${CHECKS_BY_COST}
 
+${FAST_GATES_BEFORE_PUSH}
+
 ${NEVER_MERGE}
 
 ${UNIT_CONTRACT}
@@ -352,6 +395,8 @@ Workflow for shipping a change:
 
 ${CHECKS_BY_COST}
 
+${FAST_GATES_BEFORE_PUSH}
+
 ${NEVER_MERGE}
 
 ${UNIT_CONTRACT}
@@ -664,6 +709,7 @@ const WORK_PRESETS = {
     identity: "none",
     maxTokens: 16000,
     ...loopBudget("general"),
+    tiers: ["fast", "strong"],
   },
   coding: {
     name: "coding",
@@ -678,6 +724,7 @@ const WORK_PRESETS = {
     // `config set channel efforts.coding=…`, or `effort:` per request).
     machine: "repo-resident",
     identity: "write", // pushes branches and opens pull requests
+    tiers: ["strong"], // code-writing never runs fast (the one-door plan's tiers rule)
     // Never routed: a plain write ask deserves the coding → review loop, so
     // the router's table offers `ship` in coding's seat — a routed ship runs
     // a generated one-unit plan whose merge is a person's, never the runner's.
@@ -693,6 +740,7 @@ const WORK_PRESETS = {
     toolset: "readonly",
     machine: "repo-resident",
     identity: "read", // a read-scoped token and a read-only worktree: it cannot post or push from inside
+    tiers: ["strong"], // a wrong finding costs a merge decision: reviews never run fast
     maxTokens: 64000,
     ...loopBudget("review"), // a safety net — typical reviews land in ~5 minutes
     effort: "medium", // fast turns; one big-context pass does the deep work
@@ -717,6 +765,7 @@ const WORK_PRESETS = {
     toolset: "full",
     machine: "repo-resident",
     identity: "write",
+    tiers: ["strong"], // the pipeline's children write and review code: never fast
     // Routable: a routed ship runs a generated one-unit plan whose merge is a
     // person's (`merge: person`) and never a seeded plan (the hand-off refuses
     // a routed `plan <path>.md` naming `agent:ship`), so a wrong route costs a
@@ -733,6 +782,7 @@ const WORK_PRESETS = {
     toolset: "web",
     machine: "none", // web I/O only; no workspace is provisioned
     identity: "none",
+    tiers: ["fast", "strong"], // reads and reports: may run fast
     maxTokens: 24000,
     ...loopBudget("research"),
     effort: "medium",
@@ -747,6 +797,7 @@ const WORK_PRESETS = {
     // review depends on: a two-hour job shares no container with anyone.
     machine: "repo-cold",
     identity: "read", // a read-scoped token: it can clone and read, never push — whatever the caller holds
+    tiers: ["fast", "strong"], // reads and reports: may run fast
     maxTokens: 64000,
     ...loopBudget("explore"),
     // No built-in effort: the deployment decides, as for coding.
@@ -761,6 +812,7 @@ export const AGENTS: Record<string, AgentDef> = {
       "Coordinates other runs: spawns child runs as the requester — each in a thread of its own, under their permissions — follows them, and reports. No workspace or shell.",
     system: conductorSystem(Object.values(WORK_PRESETS)),
     toolset: "conductor",
+    tiers: ["fast", "strong"], // reads and coordinates: may run fast
     // Nothing is provisioned and no credential minted: the run tools call the
     // dispatcher, the GitHub reads are REST in the bot process.
     machine: "none",

package/dist/assets/src/core/budgets.ts

@@ -46,6 +46,20 @@ export const CONFIRMATION_TTL_MS = 10 * MINUTE_MS;
  *  and only loses answers. People answer a question in minutes to hours. */
 export const QUESTION_TTL_MS = DAY_MS;
 
+/** How long a resolved author binding is reused before the stored `{ login,
+ *  id }` pair is re-read from GitHub (docs/decisions/0062;
+ *  docs/reference/specs/authorization.md item 18). The commit identity pairs
+ *  are resolved per EXEC (`gitIdentityEnvs`), and the pi harness's log polls,
+ *  FIFO sends and file writes ride the same executor — without a cache a
+ *  write run costs one `GET /user/<id>` per command, drawing down the
+ *  installation's shared rate limit for a freshness nothing needs: the
+ *  identity rewrite re-reads the binding fresh before the PR opens, so a
+ *  rename is caught there whatever this window holds. Read by `bindingOf`
+ *  (`src/execution/authorBinding.ts`) for the resolved pair and the rename
+ *  refusal alike (one `[identity]` line per window, not one per exec); a read
+ *  that FAILED is never cached — the next read asks again. */
+export const AUTHOR_BINDING_TTL_MS = 15 * MINUTE_MS;
+
 /** How long a dispatch's FIRST attach to a resident — a fresh run's, or a
  *  resumed run's re-attach to its recorded worktree — waits for the resident
  *  to wake when the Worker typed its refusal as the platform's transient
@@ -172,6 +186,13 @@ export const FLOORS: Readonly<Record<RoundKind, number>> = {
  *  when the remainder allows it. */
 export const MERGE_WAIT_ASK_MINUTES = 60;
 
+/** The provider retry ladder (issue 1932): the backoff before each retry of a
+ *  transient model-call failure — a gateway 5xx, a stream cut before
+ *  `message_stop`, a gateway timeout. Three attempts with growing waits,
+ *  charged to the run's lease; the waits stay small next to the run's minutes
+ *  because the observed blips are edge transients of seconds. */
+export const PROVIDER_RETRY_BACKOFFS_MS = [5_000, 15_000, 45_000] as const;
+
 /** A hosted ship parent's deadline margin past the pipeline's wall clock
  *  (record 0060): the row's `state.hosting.until` is the hand-off time plus
  *  the instance's `caps.maxMinutes` plus this hour, absorbing the runner's own
@@ -183,8 +204,11 @@ export const HOSTED_DEADLINE_MARGIN_MINUTES = 60;
  *  and the pause before a busy spawn is asked again. */
 export const SHIP_WAIT = { marginMinutes: 5, chunkMinutes: 5, mergeChunkMinutes: 5, busyRetryMinutes: 2 } as const;
 
-/** The plane's table (docs/decisions/0064): how long a finished run stays on it. */
-export const PLANE = { recentMinutes: 60 } as const;
+/** The plane's table (docs/decisions/0064): how long a finished run stays on
+ *  it, a reservation's window, and the default re-ask cadence — how often a
+ *  silent resident something waits on is probed (`plane.reaskMinutes`
+ *  overrides it per deployment). */
+export const PLANE = { recentMinutes: 60, reservationMinutes: 2, reaskMinutes: 2 } as const;
 
 /** The named amounts a lease holds back, in minutes. Each stands for a step
  *  every run or round pays: `provision` is attach and restore before the
@@ -473,6 +497,15 @@ export const DEFAULT_GRANT: Grant = { renewals: 0 };
  *  in one message before a plan should carry it. */
 export const GRANT_RENEWALS_MAX = 12;
 
+// ---- the structured-answer seam (record 0067: a violation is re-asked) ----
+
+/** The most re-asks one structured ask may make (`askStructured`,
+ *  src/core/dispatch/structured.ts): a named violation is quoted back to the
+ *  same model at most this many times; the next violation is the caller's
+ *  declared floor. A count, not a duration — the caller's one timeout covers
+ *  the whole loop. */
+export const STRUCTURED_RETRIES_MAX = 2;
+
 // ---- the idle unit (record 0051: a pipeline idles instead of ending) ----
 
 /** `ship.idleDays`' default: zero — today's endings byte for byte. It moves to

package/dist/assets/src/core/coordinator/contract.ts

@@ -347,6 +347,11 @@ export interface CoordinatorInstance {
    *  attempt ended reruns the units not merged under `plan-<plan-id>-<attempt>`);
    *  absent for the first. */
   attempt?: number;
+  /** The hard stop's mark (record 0060; issue 1924): written when the hosted
+   *  parent is sealed, read by the runner before every unit start and before
+   *  every child spawn — it honours the mark by ending the remaining units
+   *  `stopped` and running nothing more. */
+  stop?: { at: number };
 }
 
 export interface UnitSegment {
@@ -491,6 +496,7 @@ export function isCoordinatorInstance(v: unknown): v is CoordinatorInstance {
   if (!isOptionalText(r.runId) || !isOptionalText(r.label)) return false;
   if (r.verbosity !== undefined && !isVerbosity(r.verbosity)) return false;
   if (r.attempt !== undefined && !(Number.isInteger(r.attempt) && (r.attempt as number) >= 2)) return false;
+  if (r.stop !== undefined && !(isObject(r.stop) && isFinite(r.stop.at))) return false;
   return true;
 }
 

package/dist/assets/src/core/coordinator/driver.ts

@@ -209,6 +209,9 @@ interface PlanFacts {
   generated: boolean;
   /** The runs page base the bot answered: the report links a child's write-up to its run page with it. */
   runPageBase?: string;
+  /** The hard stop's mark (record 0060; issue 1924): the hosted parent was
+   *  sealed, so the walk ends the remaining units stopped and runs nothing more. */
+  stopped: boolean;
   repo: string;
   base: string;
   caps: ShipCaps;
@@ -263,6 +266,7 @@ function readPlan(a: BotAnswer): PlanFacts {
     idleDays: readIdleDays(b.idleDays),
     generated: b.generated === true,
     ...(typeof b.runPageBase === "string" && b.runPageBase.length > 0 ? { runPageBase: b.runPageBase } : {}),
+    stopped: b.stopped === true,
     repo: b.repo,
     base: b.base,
     caps: { maxRounds: b.caps.maxRounds, maxMinutes: b.caps.maxMinutes },
@@ -288,6 +292,9 @@ function spawnReturn(step: string, a: BotAnswer): StepReturn {
     return { type: "spawn", step, outcome: alreadySpawned === true ? "alreadySpawned" : "spawned", runId, at };
   if (a.status === 409 && error === "busy")
     return { type: "spawn", step, outcome: "busy", ...(typeof runId === "string" ? { runId } : {}), at };
+  // The hosted parent's hard stop (record 0060; issue 1924): the spawn is
+  // refused over the instance row's stop mark, and the unit ends stopped.
+  if (a.status === 409 && error === "stopped") return { type: "spawn", step, outcome: "stopped", at };
   if (a.status === 403 && typeof error === "string")
     return {
       type: "spawn",
@@ -306,7 +313,14 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
   const run = a.body.run;
   if (a.body.ok !== true || !isRecord(run) || typeof run.finished !== "boolean")
     throw new UnreadableAnswer("read-record", a, "run");
-  if (!run.finished) return { type: "read-record", step, run: { finished: false }, at: a.body.at };
+  // The hard stop's mark, as the bot's answer carries it (record 0060; issue
+  // 1924): a finished child's unit ends stopped on it.
+  const stopped = a.body.stopped === true ? { stopped: true as const } : {};
+  // The interrupted child restarted from its request (issue 1903): the bot
+  // answers the live successor's id, and the machine keeps the wait on it.
+  const restarted = typeof a.body.restartedAs === "string" ? { restartedAs: a.body.restartedAs } : {};
+  if (!run.finished)
+    return { type: "read-record", step, run: { finished: false }, ...stopped, ...restarted, at: a.body.at };
   if (typeof run.status !== "string") throw new UnreadableAnswer("read-record", a, "status");
   // The typed artifacts as the bot's record carries them — shape-checked where
   // they were written (the run record's validator), read here as they are.
@@ -326,10 +340,13 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
     leaseStartedAt,
     costUsd,
     handoffLists,
+    failure,
+    interruption,
   } = facts;
   return {
     type: "read-record",
     step,
+    ...stopped,
     run: {
       finished: true,
       status: run.status as Extract<ChildFacts, { finished: true }>["status"],
@@ -348,6 +365,14 @@ function readRecordReturn(step: string, a: BotAnswer): StepReturn {
       ...(typeof leaseStartedAt === "number" ? { leaseStartedAt } : {}),
       ...(typeof costUsd === "number" || costUsd === null ? { costUsd } : {}),
       ...(handoffLists !== undefined ? { handoffLists } : {}),
+      // The failure by name (run-history item 57), shape-checked: a
+      // `provider_transient` drives the round-0 re-run (agent-ship item 9).
+      ...(isRecord(failure) && typeof failure.kind === "string" ? { failure: { kind: failure.kind } } : {}),
+      // What ended an interrupted child (issue 1876): the ending's sentence
+      // names the cause instead of claiming a bot restart for every one.
+      ...(interruption === "bot_restart" || interruption === "container_replaced" || interruption === "sandbox_fault"
+        ? { interruption }
+        : {}),
     },
     at: a.body.at,
   };
@@ -453,7 +478,11 @@ function mergeReturn(step: string, a: BotAnswer): StepReturn {
     return { type: "merge", step, outcome: "merged", by: "other", sha, mergedAt, at };
   if (ok === true && outcome === "merged" && typeof sha === "string")
     return { type: "merge", step, outcome: "merged", sha, at };
-  if (ok === true && (outcome === "pending" || outcome === "refused") && typeof reason === "string")
+  if (
+    ok === true &&
+    (outcome === "pending" || outcome === "refused" || outcome === "enqueued" || outcome === "removed") &&
+    typeof reason === "string"
+  )
     return { type: "merge", step, outcome, reason, at };
   throw new UnreadableAnswer("merge", a, "outcome");
 }
@@ -642,7 +671,12 @@ async function perform(
         answerOf(
           "merge",
           await step.do(action.step, STEP_CONFIG, () =>
-            call(bot, "merge", { ...tag, prNumber: action.prNumber, headSha: action.headSha }),
+            call(bot, "merge", {
+              ...tag,
+              prNumber: action.prNumber,
+              headSha: action.headSha,
+              ...(action.queued === true ? { queued: true } : {}),
+            }),
           ),
         ),
       );
@@ -807,6 +841,11 @@ async function runUnit(
   }
 }
 
+/** The report of a unit the hard stop ended before it ran (record 0060; issue 1924). */
+function stoppedReport(unit: string): string {
+  return `⏹ Stopped: the pipeline's hosted parent was hard-stopped, so ${unit} was ended without running. Re-issue the plan naming the remaining units to run them.`;
+}
+
 function blockedReport(unit: string, dep: string, depEnding: string): string {
   if (depEnding === "blocked")
     return `⛔ Blocked: ${unit} waits on ${dep}, which is blocked itself. Re-issue the plan naming the remaining units once it is resolved.`;
@@ -877,6 +916,18 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
   let cursor = openPlanCursor(graph);
   const endings: Record<string, string> = {};
   for (;;) {
+    // The hard stop's mark (record 0060; issue 1924), read before every unit
+    // start: the walk ends every unit not yet ended `stopped` — the rows say
+    // why they never ran — and starts nothing more. A stop that lands once
+    // every unit has ended changes nothing: there is nothing left to end.
+    if (plan.stopped) {
+      for (const id of cursor.order.filter((u) => endings[u] === undefined)) {
+        endings[id] = "stopped";
+        const body = { parentInstanceId: instanceId, unit: id, ending: { kind: "stopped", report: stoppedReport(id) } };
+        await step.do(`${id}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));
+      }
+      break;
+    }
     const [next] = readyUnits(graph, cursor);
     if (next === undefined) break;
     cursor = startUnit(graph, cursor, next);
@@ -914,8 +965,9 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
   // Blocked units, in the plan's order: each told its own ending, so the rows
   // and the summary say why it never ran. Every blocked unit's ending is known
   // before any report is rendered — a plan may list a dependent before the
-  // dependency that blocks it.
-  const blocked = cursor.order.filter((id) => cursor.status[id] === "blocked");
+  // dependency that blocks it. A stopped walk skips this: every unended unit
+  // was already ended `stopped` above, and its cursor never finishes.
+  const blocked = plan.stopped ? [] : cursor.order.filter((id) => cursor.status[id] === "blocked");
   for (const id of blocked) endings[id] = "blocked";
   for (const id of blocked) {
     const node = graph.units.find((u) => u.id === id)!;
@@ -927,7 +979,8 @@ async function walk(step: StepRunner, bot: CoordinatorBot, instanceId: string):
     };
     await step.do(`${id}/end`, STEP_CONFIG, () => call(bot, "unit-end", body));
   }
-  if (!cursorFinished(cursor)) throw new Error(`the plan's cursor did not finish: ${JSON.stringify(cursor.status)}`);
+  if (!plan.stopped && !cursorFinished(cursor))
+    throw new Error(`the plan's cursor did not finish: ${JSON.stringify(cursor.status)}`);
   return {
     instance: instanceId,
     ...(plan.planId !== undefined ? { planId: plan.planId } : {}),

package/dist/assets/src/core/costs.ts

@@ -762,12 +762,19 @@ export interface BillerTieOutDay {
   invoiceUsd?: number;
   invoiceFeeUsd?: number;
   invoiceByokUsd?: number;
-  /** The summed `model.turn` dollars whose ref names this block. */
+  /** The summed `model.turn` dollars whose ref names this block — the meter's
+   *  charged figure from each turn's own `usd` (the provider's, the operator's
+   *  or the registry's price at the time), never the price table's repricing
+   *  the dimension views show (`buildCostsByReport`). */
   attributedUsd: number;
   /** The summed BYOK fees — the half an aggregator's `usage` ties against. */
   attributedFeeUsd?: number;
   /** `attributedUsd − attributedFeeUsd` — the half `byok_usage_inference` ties against. */
   attributedUpstreamUsd?: number;
+  /** The day's tokens whose turns carried no `usd` (null or absent) — spend the
+   *  attributed side could not count, so a gap against the invoice is explained
+   *  rather than silent. Absent when every turn was priced. */
+  unpricedTokens?: number;
 }
 
 /** One biller's daily tie-out over the range. */
@@ -784,15 +791,20 @@ const billerOfRef = (ref: string): string | undefined => (ref.includes("/") ? pa
 
 /**
  * Pure: each biller's invoice compared with the summed `model.turn` rows whose
- * ref names that block, per UTC day of the range. An aggregator's invoice
- * halves (`feeUsd`, `byokUsd`) sit beside the summed fees and the remainder. A
- * model whose `usd` is null or absent (unpriced, or from before the meter row)
- * contributes nothing to `attributedUsd` — an understated side is honest, an
- * invented one is not, so a day the source returned no row for keeps its
+ * ref names that block, per UTC day of the range. The attributed side is the
+ * meter's charged figure — each turn's own `usd`, never the price table's
+ * repricing. An aggregator's invoice halves (`feeUsd`, `byokUsd`) sit beside
+ * the summed fees and the remainder. A model whose `usd` is null or absent
+ * (unpriced, or from before the meter row) contributes nothing to
+ * `attributedUsd` — its tokens are counted as the day's `unpricedTokens`
+ * instead, so the understated side is visible: honest, never invented — and
+ * a day the source returned no row for keeps its
  * invoice side absent (the page renders —): the source holds closed days only,
  * and a trailing uninvoiced day beside real spend is not a $0 invoice. A day
- * with neither an invoice row nor a nonzero attributed figure is dropped; a
- * biller without a source (`invoice: false`) ties out against nothing.
+ * with no invoice row, no nonzero attributed figure and no unpriced tokens is
+ * dropped — but unpriced spend alone keeps its day, so the token count renders
+ * instead of vanishing; a biller without a source (`invoice: false`) ties out
+ * against nothing.
  */
 export function buildBillerTieOuts(
   billers: ReadonlyArray<{ name: string; invoice: boolean }>,
@@ -801,16 +813,22 @@ export function buildBillerTieOuts(
   range: DateRange,
 ): BillerTieOut[] {
   return billers.map(({ name, invoice }) => {
-    const attributed = new Map<string, { usd: number; fee: number; hasFee: boolean }>();
+    const attributed = new Map<string, { usd: number; fee: number; hasFee: boolean; unpricedTokens: number }>();
     for (const cell of cells) {
       if (cell.day < range.from || cell.day > range.to) continue;
       for (const [ref, m] of Object.entries(cell.usage.byModel)) {
         if (billerOfRef(ref) !== name) continue;
-        const day = attributed.get(cell.day) ?? { usd: 0, fee: 0, hasFee: false };
-        if (typeof m.usd === "number") day.usd += m.usd;
-        if (m.feeUsd !== undefined) {
-          day.fee += m.feeUsd;
-          day.hasFee = true;
+        const day = attributed.get(cell.day) ?? { usd: 0, fee: 0, hasFee: false, unpricedTokens: 0 };
+        // An unpriced model's feeUsd is skipped with its usd: adding the fee
+        // alone would drive attributedUpstreamUsd (usd − fee) negative.
+        if (typeof m.usd === "number") {
+          day.usd += m.usd;
+          if (m.feeUsd !== undefined) {
+            day.fee += m.feeUsd;
+            day.hasFee = true;
+          }
+        } else {
+          day.unpricedTokens += m.inputTokens + m.outputTokens + m.cacheReadTokens + m.cacheWriteTokens;
         }
         attributed.set(cell.day, day);
       }
@@ -820,7 +838,7 @@ export function buildBillerTieOuts(
       for (const d of invoices[name] ?? []) if (d.date >= range.from && d.date <= range.to) invoiced.set(d.date, d);
     const dates = [...new Set([...attributed.keys(), ...invoiced.keys()])].sort().filter((date) => {
       const a = attributed.get(date);
-      return invoiced.has(date) || (a !== undefined && (a.usd !== 0 || a.hasFee));
+      return invoiced.has(date) || (a !== undefined && (a.usd !== 0 || a.hasFee || a.unpricedTokens > 0));
     });
     const days: BillerTieOutDay[] = dates.map((date) => {
       const a = attributed.get(date);
@@ -832,6 +850,7 @@ export function buildBillerTieOuts(
         ...(inv?.byokUsd !== undefined ? { invoiceByokUsd: inv.byokUsd } : {}),
         attributedUsd: a?.usd ?? 0,
         ...(a?.hasFee ? { attributedFeeUsd: a.fee, attributedUpstreamUsd: a.usd - a.fee } : {}),
+        ...(a !== undefined && a.unpricedTokens > 0 ? { unpricedTokens: a.unpricedTokens } : {}),
       };
     });
     return {
@@ -922,7 +941,11 @@ export class OpenAICostsSource implements LlmInvoiceSource {
         next_page?: string | null;
       };
       for (const bucket of body.data ?? []) {
-        const date = new Date(num(bucket.start_time) * 1000).toISOString().slice(0, 10);
+        // A bucket without a finite start_time is skipped, never dated to epoch 0;
+        // out-of-range buckets are dropped like the OpenRouter source's rows.
+        if (typeof bucket.start_time !== "number" || !Number.isFinite(bucket.start_time)) continue;
+        const date = new Date(bucket.start_time * 1000).toISOString().slice(0, 10);
+        if (date < range.from || date > range.to) continue;
         for (const r of bucket.results ?? []) {
           const currency = str(r.amount?.currency).toLowerCase();
           if (currency !== "usd") throw new Error(`openai organization costs: unexpected currency ${currency || "?"}`);