@rulvar/core 1.110.0 → 1.112.0

package/dist/index.d.ts

@@ -824,6 +824,15 @@ interface EntryBillingFold {
   * semantics. False folds the aggregate slices, the historical basis.
   */
   fullyAttributed: boolean;
+  /**
+  * The models this fold priced per call: record sums equal slice sums
+  * counter for counter under the symmetric per-model key (RV604).
+  * Published so a row builder can honor the same decision (RV703): a
+  * covered model's rows are exactly its records, so no per-slice
+  * remainder may be fabricated for it; recomputing coverage elsewhere
+  * is how the phantom-remainder skew was born.
+  */
+  coveredModels: ReadonlySet<ModelRef>;
 }
 /**
 * The billing fold over one terminal entry (RV504), shared by the
@@ -3160,6 +3169,15 @@ declare function quotaRuleKey(rule: QuotaRule): string;
 * so ordinary JavaScript after the constructor (a pushed rule, a
 * reassigned cap) can no longer change a decision, a bucket key, or a
 * recorded fingerprint.
+*
+* A set containing two rules with the same canonical content key is
+* refused typed (RV704): the memory reference buckets by rule INDEX
+* (each copy counts independently, the full cap admits) while the
+* store references bucket by rule KEY (one shared bucket is debited
+* once per matching copy, half the cap admits), so the same duplicated
+* configuration admitted differently per storage. Refusing it at the
+* shared construction chokepoint is what keeps equal configurations
+* equal on every storage.
 */
 declare function snapshotQuotaRules(rules: readonly QuotaRule[], site?: string): readonly QuotaRule[];
 /** True when every dimension the rule pins matches the request. */

package/dist/index.js

@@ -2532,7 +2532,8 @@ function priceEntryBilling(entry, priceUsd) {
 			servedBy,
 			usage
 		})),
-		fullyAttributed
+		fullyAttributed,
+		coveredModels: covered
 	};
 }
 /**
@@ -8542,16 +8543,22 @@ function costReportFromJournal(entries, priceUsd) {
 * and per-row `allocatedUsd` is the additive column whose flat sum
 * reproduces `totalUsd` exactly in every case.
 *
-* Coverage is loss-free by construction: an entry whose records do not
-* cover its usage total (a resume restored from a checkpoint written
-* before the ledger shipped) contributes an `unattributed` remainder
-* row, and an entry with no records at all (written before the ledger
-* shipped, or a fully replayed invocation) contributes one
-* `unattributed` row per usage slice. Missing provider ids are marked,
-* never dropped: a finished call without one reconciles as
-* `missing-provider-id`, a failed or severed call without one as
-* `unconfirmed` (the provider may or may not have billed it; there is
-* no id to match).
+* Coverage is loss-free by construction: a model whose records do not
+* cover its usage (a resume restored from a checkpoint written before
+* the ledger shipped) contributes an `unattributed` remainder row per
+* slice, and an entry with no records at all (written before the
+* ledger shipped, or a fully replayed invocation) contributes one
+* `unattributed` row per usage slice. A COVERED model contributes no
+* remainder rows at all (RV703): its rows are exactly its records, the
+* same per-model decision the billing fold makes, so a role mismatch
+* between records and slices (the schema-extract default splits one
+* model's usage by role while the record carries one role, or none)
+* can no longer fabricate a phantom row that breaks the
+* `rowUsdNonAdditive: false` promise and siphons allocation from the
+* real call. Missing provider ids are marked, never dropped: a
+* finished call without one reconciles as `missing-provider-id`, a
+* failed or severed call without one as `unconfirmed` (the provider
+* may or may not have billed it; there is no id to match).
 *
 * Pricing happens at fold time from the table you pass, exactly like
 * CostReport. For historical stability against price-table updates,
@@ -8577,6 +8584,12 @@ const USAGE_FIELDS = [
 * model: the whole-entry remainder was published under `entry.servedBy`,
 * so a slice with no records left its allocation pool rowless and the
 * dust pass moved its dollars onto another model's row.
+*
+* Consulted only for UNCOVERED models (RV703): coverage is a per-model
+* decision, so a covered model's slices never reach this arithmetic.
+* The per-role subtraction here against the per-model coverage key was
+* exactly the mismatch that fabricated a phantom remainder whenever a
+* covered model's record roles differed from its slice roles.
 */
 function sliceRemainder(slice, records) {
 	const remainder = {
@@ -8686,7 +8699,8 @@ function invoiceFromJournal(entries, priceUsd, options) {
 	let everyEntryFullyAttributed = true;
 	for (const entry of entries) {
 		if (entry.status === "running" || entry.usage === void 0) continue;
-		if (!priceEntryBilling(entry, priceUsd).fullyAttributed) everyEntryFullyAttributed = false;
+		const billing = priceEntryBilling(entry, priceUsd);
+		if (!billing.fullyAttributed) everyEntryFullyAttributed = false;
 		const abandoned = entry.kind !== "resolution" && entry.kind !== "abandon" && abandonFold.isAbandoned(entry.ref ?? entry.seq);
 		const base = {
 			entrySeq: entry.seq,
@@ -8737,6 +8751,7 @@ function invoiceFromJournal(entries, priceUsd, options) {
 		}
 		let remainderOrdinal = records.length + 1;
 		for (const slice of entryUsageSlices(entry)) {
+			if (billing.coveredModels.has(slice.servedBy)) continue;
 			const remainder = sliceRemainder(slice, records);
 			if (remainder === void 0) continue;
 			const usd = rowUsd(priceUsd, slice.servedBy, remainder, entry.seq);
@@ -9271,9 +9286,25 @@ function quotaRuleKey(rule) {
 * so ordinary JavaScript after the constructor (a pushed rule, a
 * reassigned cap) can no longer change a decision, a bucket key, or a
 * recorded fingerprint.
+*
+* A set containing two rules with the same canonical content key is
+* refused typed (RV704): the memory reference buckets by rule INDEX
+* (each copy counts independently, the full cap admits) while the
+* store references bucket by rule KEY (one shared bucket is debited
+* once per matching copy, half the cap admits), so the same duplicated
+* configuration admitted differently per storage. Refusing it at the
+* shared construction chokepoint is what keeps equal configurations
+* equal on every storage.
 */
 function snapshotQuotaRules(rules, site = "quota rules") {
 	validateQuotaRules(rules, site);
+	const firstIndexByKey = /* @__PURE__ */ new Map();
+	rules.forEach((rule, index) => {
+		const key = quotaRuleKey(rule);
+		const first = firstIndexByKey.get(key);
+		if (first !== void 0) throw new ConfigError(`${site}[${String(index)}] duplicates ${site}[${String(first)}] (rule key ${key}): identical rules occupy independent buckets in memory but share one key-debited bucket on keyed storage, so one configuration would admit differently per store; delete the duplicate`);
+		firstIndexByKey.set(key, index);
+	});
 	return Object.freeze(rules.map((rule) => Object.freeze({
 		...rule.provider === void 0 ? {} : { provider: rule.provider },
 		...rule.model === void 0 ? {} : { model: rule.model },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.110.0",
+  "version": "1.112.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",