@genesislcap/ai-assistant 15.6.2 → 15.7.0

package/src/channel/ai-activity-channel.ts

@@ -1,4 +1,4 @@
-import type { TurnFailureReason } from '@genesislcap/foundation-ai';
+import type { AIProviderType, TurnFailureReason } from '@genesislcap/foundation-ai';
 
 /**
  * Event map for the AI activity bus.
@@ -67,8 +67,62 @@ export interface AgenticActivityEvents {
    * driver dispose, and an agent handoff the detail is `undefined` — the historical shape,
    * kept byte-identical so subscribers that only care about the boundary can keep ignoring
    * it. Structured-cloneable so it survives the cross-tab BroadcastChannel hop.
+   *
+   * A `'budget-exhausted'` failure additionally carries `vendor` — the concrete
+   * vendor the walled turn resolved to (GENC-1464), which is NOT the same thing as
+   * the registry alias recorded on the debug-log entry. Optional and additive: a
+   * subscriber reading only `failureReason` is unaffected, and every other
+   * failure still emits the historical `{ failureReason }` with no `vendor` key.
+   * It exists so a later per-vendor budget model is an additive change rather
+   * than a retrofit — the vendor is known at the transport and at the driver, and
+   * was previously discarded between them.
+   *
+   * Note this topic is forwarded on the tab-scoped channel, so a wall hit in a
+   * popped-out window reaches the main window's subscribers too — which is why
+   * the assistant's blocked latch fires there as well. Correct for a shared spend
+   * cap; see `docs/migration-GENC-1464.md` §Scope.
    */
-  'tool-loop-end': { failureReason?: TurnFailureReason } | undefined;
+  'tool-loop-end':
+    | {
+        failureReason?: TurnFailureReason;
+        vendor?: AIProviderType;
+        /**
+         * Proxy-reported spend figures, present only on `budget-exhausted`. Carried
+         * here because this event — not the driver's return value — is what latches
+         * the blocked state for a wall hit INSIDE the tool loop (the common case):
+         * the publish happens in `sendMessage`'s `finally`, so it lands before the
+         * return-value seam and wins the latch. Without these the banner would fall
+         * back to the generic copy in exactly the path the figures were added for.
+         * Plain numbers + string keep the detail structured-cloneable for the
+         * cross-tab hop.
+         */
+        budget?: {
+          budgetUsd?: number;
+          spentUsd?: number;
+          vendorLabel: string;
+          /**
+           * The refusing vendor as a typed value: normalised from `vendorLabel`
+           * where a vendor claims that label, otherwise from the proxy's own
+           * `vendor` field on the 402 — so it can disagree with `vendorLabel`,
+           * which is what keeps attribution working behind a white-labelled or
+           * multiplexing gateway.
+           *
+           * Distinct from the detail's top-level `vendor` (the driver's
+           * last-resolved provider): this one comes from the transport that was
+           * actually refused, so it is the one a per-vendor latch trusts first.
+           */
+          vendor?: AIProviderType;
+          /**
+           * The proxy's verdict on whether any OTHER vendor it meters still has
+           * headroom. The one fact here a subscriber cannot work out for itself:
+           * the registry says which vendors EXIST, never which still have
+           * budget. A `false` is what stops the banner advising a switch to a
+           * vendor that is equally spent.
+           */
+          otherVendorAvailable?: boolean;
+        };
+      }
+    | undefined;
   /**
    * Fired when a tool handler hands a widget to the user mid-loop and parks awaiting it
    * (`requestInteraction`) — the turn is suspended between provider calls, with no request

package/src/components/chat-driver/chat-driver.test.ts

@@ -12,6 +12,8 @@ import type {
   TurnFailureReason,
 } from '@genesislcap/foundation-ai';
 import {
+  BudgetExhaustedError,
+  DEFAULT_BUDGET_EXHAUSTED_MESSAGE,
   isChatToolCallUnknown,
   MalformedFunctionCallError,
   ResponseTruncatedError,
@@ -2495,6 +2497,13 @@ const truncatedProvider = (): AIProvider => ({
   },
 });
 
+/** A provider refused for budget (deterministic, terminal — must not retry). */
+const budgetExhaustedProvider = (): AIProvider => ({
+  chat: async (): Promise<ChatMessage> => {
+    throw new BudgetExhaustedError('Anthropic', 25, 25.4, 'AI budget exhausted');
+  },
+});
+
 /** A provider that throws a generic error (the sendMessage catch-all → 'exception'). */
 const throwingProvider = (): AIProvider => ({
   chat: async (): Promise<ChatMessage> => {
@@ -2617,4 +2626,544 @@ outcome('a clean turn leaves the legacy shape byte-unchanged (no failureReason)'
   cap.stop();
 });
 
+// ── Budget exhaustion (GENC-1464) ──────────────────────────────────────────────
+
+outcome('budget-exhausted surfaces at both seams', async () => {
+  await assertSurfacesReason('budget', budgetExhaustedProvider(), 'budget-exhausted');
+});
+
+outcome('a budget wall is terminal — no transient retry, and actionable copy', async () => {
+  clearMetaEventRegistry();
+  let calls = 0;
+  const provider: AIProvider = {
+    chat: async (): Promise<ChatMessage> => {
+      calls += 1;
+      throw new BudgetExhaustedError('Anthropic', 25, 25.4);
+    },
+    // Resolvable vendor, so the per-vendor fields below are exercised.
+    getStatus: async () => ({ provider: 'anthropic', model: 'test-model' }),
+  };
+  const config = agent({
+    name: 'Static',
+    toolDefinitions: [def('noop')],
+    toolHandlers: { noop: async () => 'ok' },
+  });
+  const driver = makeDriver(config, provider, 'outcome-budget-once', outcomeBus);
+  const cap = captureLoopEnd();
+
+  const result: ChatDriverResult = await driver.sendMessage('go');
+
+  // The whole point of the typed branch: it sits BEFORE the transient-retry
+  // catch, so the driver must not burn MAX_SETUP_TRANSPORT_RETRIES attempts
+  // against a wall that no retry can clear.
+  assert.is(calls, 1, 'a budget wall is not retried — exactly one model call');
+  assert.is(
+    result.reason === 'done' ? result.failureReason : undefined,
+    'budget-exhausted',
+    'the turn ends with the budget-exhausted failure reason',
+  );
+
+  // The figures now reach the CALLER, not just the debug log — this is what lets
+  // the element render "$25.40 of $25" in its banner without catching the
+  // transport error itself.
+  const budget = result.reason === 'done' ? result.budget : undefined;
+  assert.is(budget?.budgetUsd, 25);
+  assert.is(budget?.spentUsd, 25.4);
+  assert.is(budget?.vendorLabel, 'Anthropic');
+
+  // The bus detail carries the resolved vendor beside the reason.
+  assert.is(cap.detail()!.failureReason, 'budget-exhausted');
+  assert.is((cap.detail() as { vendor?: string }).vendor, 'anthropic');
+  cap.stop();
+
+  const last = driver.getHistory().at(-1);
+  assert.ok(last?.role === 'assistant', 'turn ends with an assistant message');
+  // Identity, not substrings: the transcript bubble and the element's blocked
+  // banner now read from one shared const, and this is what pins them together.
+  assert.is(last!.content, DEFAULT_BUDGET_EXHAUSTED_MESSAGE);
+  assert.not.ok(
+    last!.content.includes('something went wrong'),
+    'must not fall through to the generic apology',
+  );
+
+  // The budget figures ride the debug-log entry so a support ticket can show them.
+  const err = getMetaEvents('outcome-budget-once').find((e) => e.type === 'turn.error');
+  assert.is(err!.detail?.budgetUsd, 25);
+  assert.is(err!.detail?.spentUsd, 25.4);
+  // The registry ALIAS and the VENDOR are different things; record both.
+  assert.is(err!.detail?.provider, 'test');
+  assert.is(err!.detail?.vendor, 'anthropic');
+});
+
+outcome('a non-budget failure emits the historical detail shape, with no vendor', async () => {
+  // Back-compat for subscribers that structurally compare the `tool-loop-end`
+  // detail: only a budget failure grew a field.
+  clearMetaEventRegistry();
+  const config = agent({
+    name: 'Static',
+    toolDefinitions: [def('noop')],
+    toolHandlers: { noop: async () => 'ok' },
+  });
+  const driver = makeDriver(config, throwingProvider(), 'outcome-vendor-compat', outcomeBus);
+  const cap = captureLoopEnd();
+
+  await driver.sendMessage('go');
+
+  assert.equal(cap.detail(), { failureReason: 'exception' }, 'no vendor key was added');
+  cap.stop();
+});
+
+outcome('a 402 with no figures still carries the vendor that refused it', async () => {
+  // The regression this pins: the driver used to drop the ENTIRE budget object
+  // when both figures were absent, and `vendorLabel` — the authoritative
+  // attribution source — went with it. The element then fell back to the
+  // driver's last-resolved provider, i.e. the PREVIOUS turn's vendor, and walled
+  // the wrong one. Three live shapes arrive here with no figures: a bare gateway
+  // 402, a code-only body, and the framed err frame whose figures are `null`.
+  clearMetaEventRegistry();
+  const provider: AIProvider = {
+    chat: async (): Promise<ChatMessage> => {
+      throw new BudgetExhaustedError('Anthropic');
+    },
+  };
+  const config = agent({
+    name: 'Static',
+    toolDefinitions: [def('noop')],
+    toolHandlers: { noop: async () => 'ok' },
+  });
+  const driver = makeDriver(config, provider, 'outcome-budget-nofigures', outcomeBus);
+  const cap = captureLoopEnd();
+
+  const result: ChatDriverResult = await driver.sendMessage('go');
+
+  const budget = result.reason === 'done' ? result.budget : undefined;
+  assert.ok(budget, 'a figure-less wall still reports who refused it');
+  assert.is(budget!.vendorLabel, 'Anthropic');
+  assert.is(budget!.vendor, 'anthropic');
+  // Still no figures — the element reads their ABSENCE as "leave any host-set
+  // banner copy alone", so they must not be invented.
+  assert.is(budget!.budgetUsd, undefined);
+  assert.is(budget!.spentUsd, undefined);
+  // Both seams, since the bus one lands first and wins the latch.
+  assert.is((cap.detail() as { budget?: { vendor?: string } }).budget?.vendor, 'anthropic');
+  cap.stop();
+  assert.is(result.reason === 'done' ? result.failureReason : undefined, 'budget-exhausted');
+});
+
+outcome('a wall with nothing to report at all still omits the budget key', async () => {
+  // The other direction: `budget` is present when there is something to say and
+  // absent when there is not, so presence keeps meaning something. No figures AND
+  // an unclaimed label leaves nothing to carry — and the element's fail-safe
+  // (block everything) is the correct outcome for an unattributable wall.
+  clearMetaEventRegistry();
+  const provider: AIProvider = {
+    chat: async (): Promise<ChatMessage> => {
+      throw new BudgetExhaustedError('Acme AI');
+    },
+  };
+  const config = agent({
+    name: 'Static',
+    toolDefinitions: [def('noop')],
+    toolHandlers: { noop: async () => 'ok' },
+  });
+  const driver = makeDriver(config, provider, 'outcome-budget-nothing', outcomeBus);
+
+  const result: ChatDriverResult = await driver.sendMessage('go');
+
+  assert.not.ok('budget' in result, 'nothing reportable → no budget key');
+  assert.is(result.reason === 'done' ? result.failureReason : undefined, 'budget-exhausted');
+});
+
+outcome('a figure-less wall attributes to the refusing transport, not the last turn', async () => {
+  // The exact failure: turn 1 runs on Gemini, turn 2's request is refused by
+  // Anthropic with a figure-less 402. `lastResolvedProvider` still says `gemini`,
+  // so the pre-fix driver reported Gemini and the user was told to switch to the
+  // vendor that had actually run out.
+  clearMetaEventRegistry();
+  let walled = false;
+  const provider: AIProvider = {
+    chat: async (): Promise<ChatMessage> => {
+      if (!walled) {
+        walled = true;
+        return { role: 'assistant', content: 'first turn, on Gemini' };
+      }
+      throw new BudgetExhaustedError('Anthropic');
+    },
+  };
+  // The registry resolves to Gemini, so `lastResolvedProvider` is `gemini` by the
+  // time the Anthropic wall lands — the disagreement has to be seeded to prove
+  // which source is believed.
+  const registry: AIProviderRegistry = {
+    get: () => provider,
+    default: () => provider,
+    defaultName: () => 'test',
+    names: () => ['test'],
+    getStatus: async () => ({ provider: 'gemini', model: 'gemini-test' }),
+    listStatuses: async () => [],
+  };
+  const driver = new ChatDriver(registry, {
+    sessionKey: 'outcome-budget-stale-vendor',
+    activityBus: outcomeBus,
+  });
+  driver.applyAgent(agent({ name: 'Static', toolDefinitions: [def('noop')], toolHandlers: {} }));
+
+  await driver.sendMessage('one');
+  const result: ChatDriverResult = await driver.sendMessage('two');
+
+  const budget = result.reason === 'done' ? result.budget : undefined;
+  assert.is(budget?.vendor, 'anthropic', 'the transport that said no, not the one before it');
+  const err = getMetaEvents('outcome-budget-stale-vendor').find((e) => e.type === 'turn.error');
+  assert.is(err!.detail?.vendor, 'anthropic', 'and the debug log agrees');
+});
+
+outcome("the proxy's own `vendor` rescues an unclaimed transport label", async () => {
+  // A multiplexing or white-labelled gateway fronts several upstreams behind one
+  // transport, so its static label names none of them. The 402's `vendor` is then
+  // the only thing that knows which pot was actually booked against — second
+  // opinion, never first: the transport's own label still wins where it resolves.
+  clearMetaEventRegistry();
+  const provider: AIProvider = {
+    chat: async (): Promise<ChatMessage> => {
+      throw new BudgetExhaustedError('Acme AI', undefined, undefined, undefined, {
+        serverVendor: 'Gemini',
+      });
+    },
+  };
+  const config = agent({
+    name: 'Static',
+    toolDefinitions: [def('noop')],
+    toolHandlers: { noop: async () => 'ok' },
+  });
+  const driver = makeDriver(config, provider, 'outcome-budget-server-vendor', outcomeBus);
+
+  const result: ChatDriverResult = await driver.sendMessage('go');
+
+  const budget = result.reason === 'done' ? result.budget : undefined;
+  assert.is(budget?.vendorLabel, 'Acme AI', 'the transport label is reported verbatim');
+  assert.is(budget?.vendor, 'gemini', 'and attribution still lands');
+});
+
+outcome("the proxy's `otherVendorAvailable` verdict reaches both seams", async () => {
+  // The one fact the element cannot re-derive: registry membership says which
+  // vendors EXIST, never which still have budget. It has to survive the trip.
+  clearMetaEventRegistry();
+  const provider: AIProvider = {
+    chat: async (): Promise<ChatMessage> => {
+      throw new BudgetExhaustedError('Anthropic', 25, 25, undefined, {
+        otherVendorAvailable: false,
+      });
+    },
+  };
+  const config = agent({
+    name: 'Static',
+    toolDefinitions: [def('noop')],
+    toolHandlers: { noop: async () => 'ok' },
+  });
+  const driver = makeDriver(config, provider, 'outcome-budget-other-vendor', outcomeBus);
+  const cap = captureLoopEnd();
+
+  const result: ChatDriverResult = await driver.sendMessage('go');
+
+  assert.is(
+    result.reason === 'done' ? result.budget?.otherVendorAvailable : undefined,
+    false,
+    'the return-value seam',
+  );
+  assert.is(
+    (cap.detail() as { budget?: { otherVendorAvailable?: boolean } }).budget?.otherVendorAvailable,
+    false,
+    'and the bus seam, which lands first and wins the latch',
+  );
+  cap.stop();
+});
+
+outcome('a host-supplied budgetExhaustedMessage replaces the transcript copy', async () => {
+  clearMetaEventRegistry();
+  const provider: AIProvider = {
+    chat: async (): Promise<ChatMessage> => {
+      throw new BudgetExhaustedError('Anthropic', 25, 25.4);
+    },
+  };
+  const driver = new ChatDriver(makeRegistry(provider), {
+    sessionKey: 'outcome-budget-custom',
+    activityBus: outcomeBus,
+    budgetExhaustedMessage: 'Contact ops@acme.com',
+  });
+  driver.applyAgent(agent({ name: 'Static', toolDefinitions: [def('noop')], toolHandlers: {} }));
+
+  await driver.sendMessage('go');
+
+  // The banner was already overridable; without this seam a white-labelled host
+  // got its own copy in the banner and 'contact Genesis' directly below it.
+  assert.is(driver.getHistory().at(-1)!.content, 'Contact ops@acme.com');
+});
+
+// ── A sub-agent's wall is terminal for the parent too (GENC-1464) ──────────────
+// `SubAgentFailureReason.budget_exhausted` is documented as "terminal for the
+// parent too". Nothing parent-side read it, so the parent's tool loop appended
+// the failed outcome as a tool result and called the model again — into the same
+// wall. With N batched delegations that was N doomed children AND a doomed parent
+// call, and the element's `failureReason === 'budget-exhausted'` latch never fired.
+
+/** A sub-agent whose own turn is refused for budget; the parent's turns are not. */
+const parentOkChildWalled = (): { parentCalls: () => number; provider: AIProvider } => {
+  let parentCalls = 0;
+  return {
+    parentCalls: () => parentCalls,
+    provider: {
+      chat: async (
+        _h: ChatMessage[],
+        _u: string,
+        options?: ChatRequestOptions,
+      ): Promise<ChatMessage> => {
+        const names = (options?.tools ?? []).map((t) => t.name);
+        if (names.includes('delegate')) {
+          parentCalls += 1;
+          return callsTool('delegate', `d${parentCalls}`);
+        }
+        throw new BudgetExhaustedError('Anthropic', 25, 25.4);
+      },
+    },
+  };
+};
+
+const walledWorker = (): AgentConfig =>
+  agent({
+    name: 'worker',
+    toolDefinitions: [def('finish')],
+    toolHandlers: { finish: async () => 'x' },
+  });
+
+outcome('a sub-agent budget wall ends the parent turn without another model call', async () => {
+  clearMetaEventRegistry();
+  const { parentCalls, provider } = parentOkChildWalled();
+  const parent = delegatingParent(walledWorker(), () => undefined);
+  const driver = makeDriver(parent, provider, 'outcome-subagent-budget', outcomeBus);
+
+  const result: ChatDriverResult = await driver.sendMessage('go');
+
+  assert.is(parentCalls(), 1, 'the parent never calls the model again after the wall');
+  assert.is(result.reason === 'done' ? result.failureReason : undefined, 'budget-exhausted');
+  assert.is(driver.getHistory().at(-1)!.content, DEFAULT_BUDGET_EXHAUSTED_MESSAGE);
+});
+
+outcome("a sub-agent's wall is attributed to the CHILD's vendor, not the parent's", async () => {
+  // A sub-agent can sit on a different vendor from its parent (`applyAgent` reads
+  // `config.provider`). The wall reaches the parent only as a tool result, so
+  // while the parent carried nothing but a boolean it reported
+  // `lastResolvedProvider` — its own vendor, i.e. precisely the one that did NOT
+  // refuse. Under a two-vendor registry that walls Gemini because an Anthropic
+  // child 402'd, and the host then blocks a composer that still had headroom.
+  clearMetaEventRegistry();
+  const { provider } = parentOkChildWalled();
+  // Seeded disagreement: the registry resolves Gemini, so the parent's
+  // `lastResolvedProvider` is `gemini` while the child is refused by Anthropic.
+  const registry: AIProviderRegistry = {
+    get: () => provider,
+    default: () => provider,
+    defaultName: () => 'test',
+    names: () => ['test'],
+    getStatus: async () => ({ provider: 'gemini', model: 'gemini-test' }),
+    listStatuses: async () => [],
+  };
+  const driver = new ChatDriver(registry, {
+    sessionKey: 'outcome-subagent-budget-vendor',
+    activityBus: outcomeBus,
+  });
+  driver.applyAgent(delegatingParent(walledWorker(), () => undefined));
+
+  const result: ChatDriverResult = await driver.sendMessage('go');
+
+  const budget = result.reason === 'done' ? result.budget : undefined;
+  assert.is(budget?.vendor, 'anthropic', "the child's refusing vendor survives the hop");
+  assert.is(budget?.budgetUsd, 25, "and so do the child's figures");
+  assert.is(budget?.spentUsd, 25.4);
+  const err = getMetaEvents('outcome-subagent-budget-vendor').find((e) => e.type === 'turn.error');
+  assert.is(err!.detail?.vendor, 'anthropic', 'and the debug log agrees');
+});
+
+outcome('N batched sub-agent calls still produce at most one doomed parent call', async () => {
+  clearMetaEventRegistry();
+  let parentCalls = 0;
+  const provider: AIProvider = {
+    chat: async (
+      _h: ChatMessage[],
+      _u: string,
+      options?: ChatRequestOptions,
+    ): Promise<ChatMessage> => {
+      const names = (options?.tools ?? []).map((t) => t.name);
+      if (names.includes('delegate')) {
+        parentCalls += 1;
+        return {
+          role: 'assistant',
+          content: '',
+          toolCalls: [
+            { id: 'd1', name: 'delegate', args: {} },
+            { id: 'd2', name: 'delegate', args: {} },
+          ],
+        };
+      }
+      throw new BudgetExhaustedError('Anthropic', 25, 25.4);
+    },
+  };
+  const parent = delegatingParent(walledWorker(), () => undefined);
+  const driver = makeDriver(parent, provider, 'outcome-subagent-budget-batched', outcomeBus);
+
+  const result: ChatDriverResult = await driver.sendMessage('go');
+
+  assert.is(parentCalls, 1);
+  assert.is(result.reason === 'done' ? result.failureReason : undefined, 'budget-exhausted');
+});
+
+outcome('a non-terminal sub-agent failure still lets the parent continue', async () => {
+  // The short-circuit is scoped strictly to the budget reason — every other
+  // SubAgentFailureReason is something the parent can legitimately recover from.
+  clearMetaEventRegistry();
+  let parentCalls = 0;
+  const provider: AIProvider = {
+    chat: async (
+      _h: ChatMessage[],
+      _u: string,
+      options?: ChatRequestOptions,
+    ): Promise<ChatMessage> => {
+      const names = (options?.tools ?? []).map((t) => t.name);
+      if (names.includes('delegate')) {
+        parentCalls += 1;
+        return parentCalls === 1
+          ? callsTool('delegate', 'd1')
+          : { role: 'assistant', content: 'carried on regardless' };
+      }
+      // The child answers in free text without calling its completion tool →
+      // `max_iterations`, a recoverable failure.
+      return { role: 'assistant', content: 'no structured result' };
+    },
+  };
+  let captured: unknown;
+  const parent = delegatingParent(walledWorker(), (o) => {
+    captured = o;
+  });
+  const driver = makeDriver(parent, provider, 'outcome-subagent-nonterminal', outcomeBus);
+
+  const result: ChatDriverResult = await driver.sendMessage('go');
+
+  assert.equal(captured, { ok: false, reason: 'max_iterations' });
+  assert.is(parentCalls, 2, 'the parent loop kept running');
+  assert.is(result.reason === 'done' ? result.failureReason : undefined, undefined);
+});
+
+outcome(
+  "a later unattributable child wall does not erase the first child's attribution",
+  async () => {
+    // Batched delegations: child A is refused by Anthropic WITH attribution,
+    // child B by a transport whose label no vendor claims (figure-less 402 → no
+    // BudgetDetail at all). A plain assignment let B's `undefined` clobber A's
+    // attribution, and the fallback then reported the PARENT's vendor — under a
+    // Gemini-resolving registry, precisely the vendor that did not refuse.
+    clearMetaEventRegistry();
+    let childCalls = 0;
+    const provider: AIProvider = {
+      chat: async (
+        _h: ChatMessage[],
+        _u: string,
+        options?: ChatRequestOptions,
+      ): Promise<ChatMessage> => {
+        const names = (options?.tools ?? []).map((t) => t.name);
+        if (names.includes('delegate')) {
+          return {
+            role: 'assistant',
+            content: '',
+            toolCalls: [
+              { id: 'd1', name: 'delegate', args: {} },
+              { id: 'd2', name: 'delegate', args: {} },
+            ],
+          };
+        }
+        childCalls += 1;
+        throw childCalls === 1
+          ? new BudgetExhaustedError('Anthropic', 25, 25.4)
+          : new BudgetExhaustedError('Acme AI'); // unclaimed label, no figures
+      },
+    };
+    const registry: AIProviderRegistry = {
+      get: () => provider,
+      default: () => provider,
+      defaultName: () => 'test',
+      names: () => ['test'],
+      getStatus: async () => ({ provider: 'gemini', model: 'gemini-test' }),
+      listStatuses: async () => [],
+    };
+    const driver = new ChatDriver(registry, {
+      sessionKey: 'outcome-subagent-budget-clobber',
+      activityBus: outcomeBus,
+    });
+    driver.applyAgent(delegatingParent(walledWorker(), () => undefined));
+
+    const result: ChatDriverResult = await driver.sendMessage('one');
+
+    const budget = result.reason === 'done' ? result.budget : undefined;
+    assert.is(budget?.vendor, 'anthropic', "child A's attribution survives child B's blank wall");
+  },
+);
+
+outcome(
+  'a fully unattributable child wall degrades vendor-agnostic, never to the parent',
+  async () => {
+    // When NO child wall carries attribution, the honest event is vendor-less.
+    // Falling back to `lastResolvedProvider` named the parent's vendor — walling
+    // BOTH vendors (the child's via its own tool-loop-end, the parent's via this
+    // one) and deriving `blocked` over headroom that still existed.
+    clearMetaEventRegistry();
+    const events: Array<{ vendor?: string } | undefined> = [];
+    const bus = new AgenticActivityBus();
+    bus.subscribe('tool-loop-end', (d) => events.push(d as { vendor?: string } | undefined));
+    // The provider must carry its own `getStatus` — `lastResolvedProvider` is
+    // stamped from the PROVIDER's status, not the registry's, and a status-less
+    // mock leaves it unset, which lets the buggy fallback pass vacuously (there
+    // is no wrong vendor to fall back to).
+    const provider: AIProvider = {
+      getStatus: async () => ({ provider: 'gemini', model: 'gemini-test' }),
+      chat: async (
+        _h: ChatMessage[],
+        _u: string,
+        options?: ChatRequestOptions,
+      ): Promise<ChatMessage> => {
+        const names = (options?.tools ?? []).map((t) => t.name);
+        if (names.includes('delegate')) return callsTool('delegate', 'd1');
+        // The CHILD's turn: refused by a transport whose label no vendor claims.
+        throw new BudgetExhaustedError('Acme AI'); // no figures either
+      },
+    } as AIProvider;
+    const registry: AIProviderRegistry = {
+      get: () => provider,
+      default: () => provider,
+      defaultName: () => 'test',
+      names: () => ['test'],
+      getStatus: async () => ({ provider: 'gemini', model: 'gemini-test' }),
+      listStatuses: async () => [],
+    };
+    const driver = new ChatDriver(registry, {
+      sessionKey: 'outcome-subagent-budget-agnostic',
+      activityBus: bus,
+    });
+    driver.applyAgent(delegatingParent(walledWorker(), () => undefined));
+
+    await driver.sendMessage('go');
+
+    // The PARENT's loop-end is the last one on the bus. It must carry the
+    // failure without naming the parent's (gemini) vendor.
+    const parentEnd = events.at(-1) as { failureReason?: string; vendor?: string } | undefined;
+    assert.is(parentEnd?.failureReason, 'budget-exhausted');
+    assert.is(parentEnd?.vendor, undefined, 'no vendor is better than the wrong vendor');
+    // The CHILD's folded-in turn.error legitimately carries its own best-effort
+    // self-attribution (its resolved provider really did make the refused call);
+    // the record this fix governs is the PARENT's short-circuit, tagged
+    // `via: 'sub-agent'`.
+    const err = getMetaEvents('outcome-subagent-budget-agnostic').find(
+      (e) => e.type === 'turn.error' && e.detail?.via === 'sub-agent',
+    );
+    assert.ok(err, "the parent's short-circuit recorded the wall");
+    assert.is(err!.detail?.vendor, undefined, 'and named no vendor rather than the wrong one');
+  },
+);
+
 outcome.run();