@event4u/agent-config 16.5.0 → 17.0.0

package/src/scripts/ai_council/kind_flip.ts

@@ -0,0 +1,221 @@
+#!/usr/bin/env node
+/**
+ * Per-kind flip of typed hands to the free route (free-hands 6.3).
+ *
+ * A kind is served by a free route only after the shadow ledger clears both
+ * pre-registered bars for it: `free-hands-quality-held` (free failure rate at
+ * most the paid rate + 5 pp, and below the 0.3 escalation kill) and
+ * `free-hands-limit-relief` (paid tokens avoided minus the head's verify tokens
+ * above zero in every shadow week). Missing or underpowered data is "not
+ * ready" — never a flip.
+ *
+ * A flipped kind whose free-routed asks reach the kill reverts on its own and
+ * stays reverted: the same shadow data that was outvoted by live data does not
+ * flip it back, so a re-flip needs the record cleared by a person. Every flip
+ * and every reversion is an event in gitignored runtime state, with one line a
+ * claim row can cite. This module never edits `docs/CLAIMS.md`.
+ *
+ * Usage: ./scripts-run src/scripts/ai_council/kind_flip [--apply] [--audit-dir <dir>]
+ */
+
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+import { readShadowLedger, shadowReport, SHADOW_CALL_CAP, type KindShadowStats } from './free_hand_shadow.js';
+import { HAND_KINDS, isHandKind, isUnpaid, ROUTE_BILLINGS, type HandKind, type RouteBilling, type VerifyVerdict } from '../_lib/hand_kinds.js';
+
+/** The escalation kill registered on `ask_economy`; the quality claim's second half. */
+export const ESCALATION_KILL = 0.3;
+export const QUALITY_MARGIN = 0.05;
+/** The A5 cap shared evenly across the kinds; below it a kind's rates settle nothing. */
+export const MIN_SHADOW_PER_KIND = Math.floor(SHADOW_CALL_CAP / HAND_KINDS.length);
+/** Free-routed asks a flipped kind needs before its live rate may revert it. */
+export const REVERT_MIN_SAMPLE = 30;
+
+import { isKindFlipped, KIND_FLIPS_RELPATH } from './kind_flip_state.js';
+export { isKindFlipped, KIND_FLIPS_RELPATH } from './kind_flip_state.js';
+
+export interface FlipVerdict {
+    readonly ready: boolean;
+    readonly reasons: string[];
+}
+
+export function flipVerdict(s: KindShadowStats | undefined): FlipVerdict {
+    if (s === undefined) return { ready: false, reasons: ['no shadow data'] };
+    const reasons: string[] = [];
+    if (s.n < MIN_SHADOW_PER_KIND) reasons.push(`underpowered: ${String(s.n)} of ${String(MIN_SHADOW_PER_KIND)} shadow calls`);
+    if (s.free_rate > s.paid_rate + QUALITY_MARGIN) {
+        reasons.push(`quality margin: free ${s.free_rate.toFixed(3)} > paid ${s.paid_rate.toFixed(3)} + ${String(QUALITY_MARGIN)}`);
+    }
+    if (s.free_rate >= ESCALATION_KILL) reasons.push(`kill: free ${s.free_rate.toFixed(3)} >= ${String(ESCALATION_KILL)}`);
+    if (s.weeks.length === 0 || s.weeks.some((w) => w.net <= 0)) reasons.push('relief: a shadow week without net relief after verify tokens');
+    return { ready: reasons.length === 0, reasons };
+}
+
+/** One free-routed typed ask after a flip, as the head recorded its verify. */
+export interface FreeObservation {
+    readonly kind: HandKind;
+    readonly verified: VerifyVerdict;
+    readonly ts: string;
+}
+
+const _BILLINGS: ReadonlySet<string> = new Set<string>(ROUTE_BILLINGS);
+
+/** The free-routed asks among orchestration audit lines. */
+export function observationsFromAuditLines(lines: readonly Record<string, unknown>[]): FreeObservation[] {
+    const out: FreeObservation[] = [];
+    for (const l of lines) {
+        const o = (l['orchestration'] ?? {}) as Record<string, unknown>;
+        const billing = o['route_billing'];
+        const verified = o['verified'];
+        if (o['route_taken'] !== 'ask' || !isHandKind(o['hand_kind']) || typeof l['ts'] !== 'string') continue;
+        if (typeof billing !== 'string' || !_BILLINGS.has(billing) || !isUnpaid(billing as RouteBilling)) continue;
+        if (verified !== 'pass' && verified !== 'fail' && verified !== 'skipped') continue;
+        out.push({ kind: o['hand_kind'] as HandKind, verified, ts: l['ts'] });
+    }
+    return out;
+}
+
+export interface FlipEvent {
+    readonly ts: string;
+    readonly kind: HandKind;
+    readonly to: 'free' | 'paid';
+    readonly n: number;
+    readonly free_rate: number;
+    readonly line: string;
+}
+
+interface KindState {
+    readonly route: 'free' | 'paid';
+    readonly since: string;
+    readonly reverted?: true;
+}
+
+interface Store {
+    kinds: Partial<Record<HandKind, KindState>>;
+    events: FlipEvent[];
+}
+
+function _path(stateRoot: string): string {
+    return path.join(stateRoot, KIND_FLIPS_RELPATH);
+}
+
+function _read(stateRoot: string): Store {
+    try {
+        const raw = JSON.parse(fs.readFileSync(_path(stateRoot), 'utf8')) as Partial<Store>;
+        return { kinds: raw.kinds ?? {}, events: Array.isArray(raw.events) ? raw.events : [] };
+    } catch {
+        return { kinds: {}, events: [] };
+    }
+}
+
+function _write(stateRoot: string, store: Store): void {
+    const target = _path(stateRoot);
+    fs.mkdirSync(path.dirname(target), { recursive: true });
+    const tmp = `${target}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, `${JSON.stringify(store, null, 2)}\n`, 'utf8');
+    fs.renameSync(tmp, target);
+}
+
+
+function _flipLine(kind: HandKind, day: string, s: KindShadowStats): string {
+    return (
+        `free-hands-quality-held: ${kind} flipped to the free route on ${day} — shadow n=${String(s.n)}, ` +
+        `free ${s.free_rate.toFixed(3)} vs paid ${s.paid_rate.toFixed(3)}, net relief ${String(s.net)} tokens`
+    );
+}
+
+function _revertLine(kind: HandKind, day: string, n: number, rate: number): string {
+    return (
+        `free-hands-quality-held: ${kind} reverted to the paid route on ${day} — free failure rate ` +
+        `${rate.toFixed(3)} over ${String(n)} free-routed asks >= kill ${String(ESCALATION_KILL)}`
+    );
+}
+
+/** The live breach that reverts a flipped kind: free-routed asks since the flip, at or above the kill. */
+function _revertOf(kind: HandKind, state: KindState, live: readonly FreeObservation[]): { n: number; rate: number } | null {
+    const since = live.filter((o) => o.kind === kind && o.ts >= state.since);
+    if (since.length < REVERT_MIN_SAMPLE) return null;
+    // A `skipped` verify on a free return counts as an escalation, as in the claim.
+    const rate = since.filter((o) => o.verified !== 'pass').length / since.length;
+    return rate >= ESCALATION_KILL ? { n: since.length, rate } : null;
+}
+
+export interface ApplyInput {
+    readonly shadow: readonly KindShadowStats[];
+    readonly live: readonly FreeObservation[];
+    readonly now?: Date;
+}
+
+/** Flip the ready kinds, revert the breaching ones; returns this pass's events. */
+export function applyFlips(stateRoot: string, input: ApplyInput): FlipEvent[] {
+    const store = _read(stateRoot);
+    const now = input.now ?? new Date();
+    const ts = now.toISOString();
+    const day = ts.slice(0, 10);
+    const events: FlipEvent[] = [];
+    for (const kind of HAND_KINDS) {
+        const state = store.kinds[kind];
+        if (state?.route === 'free') {
+            const breach = _revertOf(kind, state, input.live);
+            if (breach === null) continue;
+            store.kinds[kind] = { route: 'paid', since: ts, reverted: true };
+            events.push({ ts, kind, to: 'paid', n: breach.n, free_rate: breach.rate, line: _revertLine(kind, day, breach.n, breach.rate) });
+            continue;
+        }
+        if (state?.reverted === true) continue;
+        const s = input.shadow.find((x) => x.kind === kind);
+        if (s === undefined || !flipVerdict(s).ready) continue;
+        store.kinds[kind] = { route: 'free', since: ts };
+        events.push({ ts, kind, to: 'free', n: s.n, free_rate: s.free_rate, line: _flipLine(kind, day, s) });
+    }
+    if (events.length > 0) {
+        store.events.push(...events);
+        _write(stateRoot, store);
+    }
+    return events;
+}
+
+function _auditLines(dir: string): Record<string, unknown>[] {
+    let files: string[];
+    try {
+        files = fs.readdirSync(dir).filter((f) => f.endsWith('.jsonl'));
+    } catch {
+        return [];
+    }
+    const out: Record<string, unknown>[] = [];
+    for (const f of files) {
+        for (const line of fs.readFileSync(path.join(dir, f), 'utf8').split('\n')) {
+            if (line.trim() === '') continue;
+            try {
+                out.push(JSON.parse(line) as Record<string, unknown>);
+            } catch {
+                /* a torn line is skipped */
+            }
+        }
+    }
+    return out;
+}
+
+export async function main(argv: readonly string[], cwd: string = process.cwd()): Promise<number> {
+    const i = argv.indexOf('--audit-dir');
+    const { DEFAULT_DIR } = await import('../orchestration_record.js');
+    const auditDir = i >= 0 && argv[i + 1] !== undefined ? argv[i + 1]! : path.join(cwd, DEFAULT_DIR);
+    const shadow = shadowReport(readShadowLedger(cwd));
+    if (argv.includes('--apply')) {
+        for (const e of applyFlips(cwd, { shadow, live: observationsFromAuditLines(_auditLines(auditDir)) })) {
+            process.stdout.write(`${e.line}\n`);
+        }
+    }
+    for (const kind of HAND_KINDS) {
+        const v = flipVerdict(shadow.find((s) => s.kind === kind));
+        const route = isKindFlipped(cwd, kind) ? 'free' : 'paid';
+        process.stdout.write(`  ${kind}: ${route}${v.ready ? '' : ` · not ready: ${v.reasons.join('; ')}`}\n`);
+    }
+    return 0;
+}
+
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+    void main(process.argv.slice(2)).then((code) => process.exit(code));
+}

package/src/scripts/ai_council/kind_flip_state.ts

@@ -0,0 +1,19 @@
+/**
+ * Where a hand kind's flip is stored, and the one read the per-prompt nudge
+ * needs. Apart from `kind_flip.ts`, whose shadow-report imports would put the
+ * whole measurement path into the hook bundle.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+
+export const KIND_FLIPS_RELPATH = path.join('agents', 'runtime', 'state', 'hand-kind-flips.json');
+
+/** Unreadable or absent state is "not flipped". */
+export function isKindFlipped(stateRoot: string, kind: string): boolean {
+    try {
+        const raw = JSON.parse(fs.readFileSync(path.join(stateRoot, KIND_FLIPS_RELPATH), 'utf8')) as { kinds?: Record<string, { route?: unknown }> };
+        return raw.kinds?.[kind]?.route === 'free';
+    } catch {
+        return false;
+    }
+}

package/src/scripts/ai_council/learn_low_impact_preview.ts

@@ -4,14 +4,15 @@
  * Ported from the retired Python `src/scripts/ai_council/learn_low_impact_preview.py`
  * (ADR-200 — Python→TS migration, Phase 1).
  *
- * Default invocation is `--preview`: build a structured plan describing
- * which Validated entries would be upstreamed to the package seed without
- * opening a PR. `--apply` (handled by the agent, not this module) is the
- * explicit opt-in that triggers the actual upstream-contribute PR flow.
+ * The command is read-only: it builds a structured plan describing which
+ * Validated entries would be worth upstreaming, and opens nothing. The
+ * `--apply` flag that once drove an upstream PR from here was retired on
+ * 2026-10-13 — it wrote into a package seed file that is not in the tree,
+ * and a second outward route would be a second set of guarantees. The one
+ * gated outward step is `self-repair:release`.
  *
  * The module is import-light by design — pure parsing + redaction + diff
- * rendering. PR creation lives in the `upstream-contribute` skill;
- * this module only hands the agent the material to surface.
+ * rendering. It hands the agent the material to surface and nothing else.
  */
 
 import * as fs from 'node:fs';
@@ -22,6 +23,24 @@ import {
     redact_low_impact_entry,
 } from './redact_low_impact_entry.js';
 
+/**
+ * The package-side seed the preview diffs against — the one place a CALLER
+ * reads this literal from, so no caller restates it. The privacy floor names
+ * the same path for its own purpose, which is a lock rather than a second
+ * source: the rule has to name what it locks.
+ *
+ * The file is deliberately NOT in the tree: the package ships no seed
+ * corpus, `_readSeedPhrases` treats a missing seed as an empty set, and the
+ * preview therefore diffs against an empty baseline. The path is still
+ * named here, and locked by `low-impact-corpus-privacy-floor`, so that a
+ * seed reappearing arrives already under the privacy floor.
+ *
+ * It is RELATIVE. A caller resolves it against the package root; resolving it
+ * against an arbitrary cwd would let a same-named file in a consumer project
+ * mark entries `already_seeded` and suppress them silently.
+ */
+export const PACKAGE_SEED_PATH = 'data/low-impact-decisions-seed.md';
+
 // Python: re.compile(r"^last-upstreamed:\s*([0-9a-f]{6,40}|0+)\s*$",
 //                     re.IGNORECASE | re.MULTILINE)
 // \s is Unicode in Python; emulate via the explicit Unicode whitespace class.
@@ -57,10 +76,10 @@ export class RefusedEntry {
 }
 
 /**
- * Structured preview for `/memory learn-low-impact --preview`.
+ * Structured preview for `/memory learn-low-impact`.
  *
- * Consumed by the agent which renders the human-facing preview block,
- * then waits for explicit `--apply` before invoking `upstream-contribute`.
+ * Consumed by the agent which renders the human-facing preview block. The
+ * command ends there: it opens nothing and sends nothing.
  */
 export class LearnLowImpactPreview {
     readonly promoted: readonly PreviewEntry[];
@@ -97,10 +116,14 @@ export class LearnLowImpactPreview {
     }
 
     /**
-     * True when `--apply` would actually open a PR.
+     * True when the promoted set is both non-empty and wholly clean — the
+     * shape an upstream contribution would need. Nothing here acts on it;
+     * `render()` reads it to decide which closing line to print.
      *
-     * Iron Law: any redactor refusal blocks the PR — the author must
-     * rephrase or drop the offending entry locally and re-run.
+     * The name predates the retirement of `--apply` and is kept because it
+     * is the published accessor; what changed is that no caller opens
+     * anything. Iron Law, unchanged: any redactor refusal blocks promotion —
+     * the author rephrases or drops the offending entry locally and re-runs.
      */
     get would_open_pr(): boolean {
         return this.promoted.length > 0 && this.refused.length === 0;
@@ -148,13 +171,17 @@ export class LearnLowImpactPreview {
         }
         if (this.refused.length > 0) {
             lines.push(
-                '> Refusals block the PR. Rephrase the entries locally' +
+                '> Refusals block promotion. Rephrase the entries locally' +
                     ' (or drop them) and re-run.',
             );
         } else if (this.promoted.length > 0) {
             lines.push(
-                '> Re-run with `--apply` to open the draft PR via' +
-                    ' `upstream-contribute`.',
+                // Deliberately no onward pointer. The outward ladder releases
+                // a RECORDED defect and nothing here opens a record, so a
+                // corpus entry cannot ride it today; naming a route the
+                // reader cannot take is worse than naming none.
+                '> This command sends nothing. Promoting an entry upstream is' +
+                    ' a separate, explicitly authorised decision.',
             );
         }
         // Python: "\n".join(lines).rstrip() + "\n"
@@ -162,11 +189,11 @@ export class LearnLowImpactPreview {
     }
 
     /**
-     * Source-project-stripped diff that `--apply` would propose.
+     * Source-project-stripped diff the preview proposes for a reader.
      *
      * Emits unified-diff-style `+` lines for each promoted phrase under the
-     * seed file's `## Validated` section. The agent uses this as the
-     * `upstream-contribute` patch body.
+     * seed file's `## Validated` section — material for a reader to judge,
+     * not a patch this command applies anywhere.
      */
     render_diff(): string {
         if (this.promoted.length === 0) {
@@ -187,7 +214,7 @@ export class LearnLowImpactPreview {
         const bodyLines: string[] = [
             `# ${title}`,
             '',
-            'Upstream from `/memory learn-low-impact --apply`.',
+            'Prepared from `/memory learn-low-impact`, which sends nothing.',
             '',
             '## Entries',
             '',
@@ -223,9 +250,10 @@ function _rstrip(s: string): string {
 /**
  * Return the set of normalised phrases already in the seed file.
  *
- * Missing seed file is not an error — it returns an empty set so the
- * first-ever upstream PR can seed the whole corpus. Reuses the strict
- * parser so the seed itself is contract-validated.
+ * Missing seed file is not an error — it returns an empty set, which is the
+ * standing case rather than an edge one: the package ships no seed, so every
+ * preview diffs against an empty baseline (see `PACKAGE_SEED_PATH`). Reuses
+ * the strict parser so a seed that does appear is contract-validated.
  */
 function _readSeedPhrases(seedPath: string): Set<string> {
     if (!fs.existsSync(seedPath)) {

package/src/scripts/ai_council/modification_review.ts

@@ -24,6 +24,12 @@
  */
 
 import { parse_stance_line } from './stance_tally.js';
+import {
+    SEAT_NO_FINAL_VERDICT,
+    deriveRatificationHeader,
+    type RatificationVerdict,
+    type SeatVerdict,
+} from '../_lib/ratification_artifact.js';
 
 /**
  * The closed vocabulary a seat may close on. Open it and a grep for a passing
@@ -66,7 +72,9 @@ export function seatConclusion(text: string): ModificationVerdictLabel | null {
 export function readSeatConclusions(
     replies: Readonly<Record<string, string>>,
 ): Record<string, ModificationVerdictLabel | null> {
-    const out: Record<string, ModificationVerdictLabel | null> = {};
+    // Prototype-free: on a plain object, assigning a seat named `__proto__`
+    // replaces the prototype and the seat silently disappears.
+    const out = Object.create(null) as Record<string, ModificationVerdictLabel | null>;
     for (const [seat, text] of Object.entries(replies)) {
         out[seat] = seatConclusion(text);
     }
@@ -74,7 +82,54 @@ export function readSeatConclusions(
 }
 
 /**
- * Derive the record's verdict. ONE rule, and the ORDER is the rule:
+ * A threshold that is not a positive integer is refused, never coerced. At zero
+ * or below, an empty council would satisfy it; a fraction or a non-finite value
+ * has no count of providers it could mean.
+ */
+function assertRequiredProviders(requiredProviders: number): void {
+    if (!Number.isInteger(requiredProviders) || requiredProviders < 1) {
+        throw new RangeError(
+            `requiredProviders must be a positive integer, got ${String(requiredProviders)}`,
+        );
+    }
+}
+
+/**
+ * Every seat value is checked at run time, because the declared type is erased
+ * and a seat map often arrives as parsed JSON. A value outside the closed
+ * vocabulary or `null` throws: counted, it would add a provider to the quorum
+ * and could fall through to acceptance.
+ */
+function concludedSeats(
+    seats: Readonly<Record<string, ModificationVerdictLabel | null>>,
+): [string, ModificationVerdictLabel][] {
+    const out: [string, ModificationVerdictLabel][] = [];
+    for (const [seat, value] of Object.entries(seats) as [string, unknown][]) {
+        if (value === null) continue;
+        if (
+            typeof value !== 'string' ||
+            !(MODIFICATION_VERDICT_LABELS as readonly string[]).includes(value)
+        ) {
+            throw new TypeError(
+                `seat ${JSON.stringify(seat)} carries ${JSON.stringify(value)}, not a modification verdict label or null`,
+            );
+        }
+        out.push([seat, value as ModificationVerdictLabel]);
+    }
+    return out;
+}
+
+/**
+ * Derive the review's DISPOSITION rule — what the run does next. It is not the
+ * artifact's `verdict` field: for one seat `ratified` and another without a
+ * final verdict this returns `non-convergent`, while the reader's
+ * `deriveRatificationHeader` returns `ratified` with one provider, and the
+ * reader refuses a record carrying this answer as `header-not-derived`.
+ * {@link deriveModificationOutcome} returns both answers under different names;
+ * this function stays exported, so that is a clearer interface, not an enforced
+ * one.
+ *
+ * ONE rule, and the ORDER is the rule:
  *
  *   1. any concluding seat on `refused`  → `refused`
  *   2. concluding providers < required   → `non-convergent`
@@ -90,11 +145,49 @@ export function deriveModificationVerdict(
     seats: Readonly<Record<string, ModificationVerdictLabel | null>>,
     requiredProviders: number,
 ): ModificationVerdict {
-    const concluded = Object.values(seats).filter(
-        (v): v is ModificationVerdictLabel => v !== null,
-    );
+    assertRequiredProviders(requiredProviders);
+    const concluded = concludedSeats(seats).map(([, v]) => v);
     if (concluded.includes('refused')) return 'refused';
     if (concluded.length < requiredProviders) return 'non-convergent';
     if (concluded.includes('ratified')) return 'ratified';
     return 'confirmed-non-expanding';
 }
+
+/**
+ * What a run does next. Never written into the artifact. A refusal and a short
+ * quorum stay apart because only the second is cured by asking again.
+ */
+export type ModificationDisposition = 'accepted' | 'refused' | 'quorum-short';
+
+export interface ModificationOutcome {
+    /** The header the record carries, from the one canonical derivation. */
+    header: { providers: string[]; verdict: RatificationVerdict };
+    /** Whether enough distinct providers concluded. */
+    quorumSatisfied: boolean;
+    disposition: ModificationDisposition;
+}
+
+/**
+ * The record's header and the run's disposition from one call, under different
+ * names. Throws a `RangeError` when `requiredProviders` is not a positive
+ * integer and a `TypeError` when a seat carries a value outside the vocabulary.
+ */
+export function deriveModificationOutcome(
+    seats: Readonly<Record<string, ModificationVerdictLabel | null>>,
+    requiredProviders: number,
+): ModificationOutcome {
+    assertRequiredProviders(requiredProviders);
+    const concluded = new Map(concludedSeats(seats));
+    const asSeatVerdicts = new Map<string, SeatVerdict>();
+    for (const seat of Object.keys(seats)) {
+        asSeatVerdicts.set(seat, concluded.get(seat) ?? SEAT_NO_FINAL_VERDICT);
+    }
+    const header = deriveRatificationHeader(asSeatVerdicts);
+    const quorumSatisfied = new Set(header.providers).size >= requiredProviders;
+    const verdict = deriveModificationVerdict(seats, requiredProviders);
+    let disposition: ModificationDisposition;
+    if (verdict === 'refused') disposition = 'refused';
+    else if (!quorumSatisfied || verdict === 'non-convergent') disposition = 'quorum-short';
+    else disposition = 'accepted';
+    return { header, quorumSatisfied, disposition };
+}

package/src/scripts/ai_council/necessity.ts

@@ -235,6 +235,7 @@ export function classify_necessity(
     prompt: string,
     lens = 'analysis',
     _invocation: Invocation = 'agent',
+    opts: { readonly ratePressure?: boolean } = {},
 ): ClassificationResult {
     const text = _pyStrip(prompt || '');
     if (!text) {
@@ -299,6 +300,12 @@ export function classify_necessity(
         rationale =
             `Lens \`${lens}\` is strict (expensive deliberation); ` +
             `borderline with zero \`necessary\` markers → unnecessary.`;
+    } else if (opts.ratePressure === true && verdict === 'borderline' && n_hits === 0) {
+        // Inside a host rate window every lens applies the strict bar.
+        verdict = 'unnecessary';
+        rationale =
+            'A recent host rate marker applies the strict bar; ' +
+            `borderline with zero \`necessary\` markers → unnecessary.`;
     }
 
     return new ClassificationResult({

package/src/scripts/ai_council/orchestrator.ts

@@ -30,12 +30,11 @@ export type { RunConsensusScoringOptions, RunPeerReviewOptions } from './orchest
 // existing importer of `run_consensus_scoring` is untouched.
 export { run_consensus_scoring } from './consensus_round.js';
 import {
-    record_spend as _record_daily_spend,
     today_spend_usd as _today_spend_usd,
     would_exceed as _would_exceed_daily,
 } from './budget_guard.js';
 import type {
-    ExternalAIClient} from './clients.js';
+    CliClient, ExternalAIClient} from './clients.js';
 import {
     DEFAULT_MAX_TOKENS,
     CouncilResponse
@@ -99,10 +98,12 @@ import {
     CostBudget,
     OverrunEvent,
     _breach,
+    breachErrorTag,
     _total_usd,
     type Spent,
 } from './spend_gate.js';
 import { callMember, renderResponseMeta } from './response_render.js';
+import { RoundReservations } from './round_reservations.js';
 import {
     _excTag,
     _metaGet,
@@ -498,6 +499,9 @@ export function consult(
             // health and structural validity are INDEPENDENT failure modes,
             // so refusing the retry would discard salvageable work for an
             // unrelated reason. Bounded by the retry's own spend gate.
+            // Non-blind: the seat is asked about its own reply, so it continues the session that wrote it.
+            const seat = member as Partial<Pick<CliClient, 'lastSession' | 'resumeNext'>>;
+            if (seat.lastSession !== undefined) seat.resumeNext = seat.lastSession;
             const rr = _run_round([member], repairQ, resolvedBudget, spent, {
                 table,
                 on_overrun,
@@ -589,6 +593,7 @@ function _run_round(
     };
 
     const results: CouncilResponse[] = [];
+    const reservations = new RoundReservations(budget);
     const estimates: CostEstimate[] | null =
         table !== null
             ? estimate(question, members, table, {
@@ -661,13 +666,10 @@ function _run_round(
                 : estimates
                   ? (estimates[idx] as CostEstimate)
                   : null;
-        const breach = _breach(est, spent, budget);
+        const breach = _breach(est, spent, budget) ?? reservations.reserve(est, member);
         if (breach !== null) {
             const breach_kind = breach;
-            const error_tag =
-                breach_kind === 'daily'
-                    ? 'daily_budget_exceeded'
-                    : 'cost_budget_exceeded';
+            const error_tag = breachErrorTag(breach_kind);
             // A seat that arrived here by escalating from an UNMETERED cli
             // call degrades to its own original failure — never to an abort,
             // and never to the round-wide short-circuit below. The reasoning,
@@ -717,7 +719,7 @@ function _run_round(
                 for (const left of members.slice(idx)) {
                     results.push(_aborted(left, error_tag));
                 }
-                return results;
+                return reservations.finish(results);
             }
         }
 
@@ -804,18 +806,13 @@ function _run_round(
             spent.usd += _total_usd(actual);
             // Ledger every billable response, bounded or not (ADR-279): a cap
             // decides whether the total is compared, never whether it is kept.
-            if (!response.error) {
-                _record_daily_spend(_total_usd(actual), effective.name, effective.model, {
-                    cache_read_input_tokens: response.cache_read_input_tokens,
-                    cache_creation_input_tokens: response.cache_creation_input_tokens,
-                    cache_ttl: '5m',
-                });
-            }
+            // With a daily ceiling set the seat's reservation is reconciled instead.
+            reservations.settle(response, effective, actual);
         }
         _stamp_transport_metadata(response, effective, actual_usd);
     }
 
-    return results;
+    return reservations.finish(results);
 }
 
 function _aborted(member: ExternalAIClient, reason: string): CouncilResponse {
@@ -855,6 +852,9 @@ function _stamp_transport_metadata(
     if (cost_usd !== null) {
         meta['cost_usd'] = Number(cost_usd);
     }
+    // A size-fit downgrade (`council_cli._size_fit_gate`) leaves the configured
+    // model and the reason on the member; they ride into the response here.
+    Object.assign(meta, _getattr(member, 'size_fit', null));
     response.metadata = meta;
 }