audit-tools 0.33.9 → 0.33.11

package/dist/shared/quota/types.d.ts

@@ -45,12 +45,17 @@ export interface QuotaStateEntry {
     last_429_at: string | null;
     consecutive_429_count?: number;
     /**
-     * Learned tokens→percent slope (EWMA) for the token-budget gate, keyed PER
-     * WINDOW LABEL (e.g. "session", "weekly"). `slope = Δtokens / Δpercent` where
-     * percent = remaining_pct*100. Windows scale on different denominators, so
-     * each learns its own slope; the gate multiplies the right slope by that
-     * window's remaining percent to get its token budget and takes the MIN across
-     * a pool's own windows. Absent until observed (cold start).
+     * Learned tokens→percent slope (EWMA), keyed by `windowSlopeKey(scope, label)`
+     * (e.g. "account:session", "model:session") — NOT by bare label: an account-scoped
+     * and a model-scoped window can share a group name while pricing different
+     * allowances. `slope = Δtokens / Δpercent` where percent = remaining_pct*100.
+     * Windows scale on different denominators, so each learns its own slope.
+     *
+     * Two consumers, and the distinction matters: the slope prices each window's
+     * remaining percent into a token budget for REPORTING (the MIN across a pool's
+     * windows), and it is the exchange rate ADMISSION uses to convert a packet's tokens
+     * into a draw against a percent-denominated window. Absent until observed (cold
+     * start), which reads as `calibrating`.
      */
     tokens_per_pct?: Record<string, number>;
     /**
@@ -90,6 +95,41 @@ export interface QuotaBindingWindow {
     /** The window's own remaining token budget (the value that won the MIN). */
     budget: number;
 }
+/**
+ * One quota window's remaining allowance, expressed in THAT WINDOW'S OWN UNIT, as
+ * the metering unit admission reserves against. This is what replaces the MIN
+ * collapse as the basis for admission: the MIN survives only for REPORTING which
+ * window binds ({@link QuotaBindingWindow}).
+ *
+ * ⚠ There is no unit shared across windows, which is the whole reason this is a
+ * list rather than a number. A 5-hour `session` and a 7-day `weekly` scale on
+ * different denominators, so the same N tokens is a different fraction of each.
+ *
+ * `unit` is decided per window, by what the provider actually reported:
+ *  - `tokens` — the window reported an ABSOLUTE `tokens_remaining`. Tokens are
+ *    directly commensurable here because no exchange rate is involved, so even an
+ *    account-scoped window shared by N models can meter in tokens.
+ *  - `percent` — only `remaining_pct` is known, priced through the pool's own
+ *    learned `tokensPerPct`. This is REQUIRED for an account-scoped percent window:
+ *    N models share one percent allowance but each converts its tokens at its OWN
+ *    rate, so percent is the only unit in which their draws are comparable.
+ *
+ * A window that can be priced in NEITHER unit is not represented here at all — it
+ * sets `calibrating`, which routes the pool through the cold-start clamp rather
+ * than being waved through unmetered.
+ */
+export interface WindowBudget {
+    /** Which partition the allowance belongs to — decided at the producer, never re-derived. */
+    scope: import("./quotaSource.js").QuotaWindowScope;
+    label: string;
+    /** Remaining allowance, in `unit`. */
+    budget: number;
+    unit: "tokens" | "percent";
+    /** Tokens per percentage point for this pool+window. Present iff `unit === "percent"`. */
+    tokensPerPct?: number;
+    /** The window's reset, carried for wall reporting. */
+    reset_at: string | null;
+}
 export interface WaveSchedule {
     max_concurrent: number;
     estimated_wave_tokens: number;
@@ -118,6 +158,17 @@ export interface WaveSchedule {
      * time when there is no cooldown. Absent/null at cold start / no live snapshot.
      */
     binding_window?: QuotaBindingWindow | null;
+    /**
+     * Every window this pool must fit inside, each in its own unit — the METERING
+     * basis. Admission reserves against ALL of them (all-or-nothing); an account-scoped
+     * entry is shared with every sibling model on the credential, which is what stops N
+     * models on one account from each admitting against their own copy of one allowance.
+     *
+     * Empty/absent when there is no live snapshot, or on the cooldown path where budget
+     * derivation is skipped entirely — admission then falls back to a single pool-keyed
+     * constraint carrying the scalar budget, i.e. exactly the pre-partition behaviour.
+     */
+    window_budgets?: WindowBudget[];
     /** Tokens already in flight against this pool when the wave was sized (0 default). */
     in_flight_tokens?: number;
     /**

package/dist/shared/quota/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,iBAAiB,mIAQ5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,sCAAoC,CAAC;AACvE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,gCAAgC,kHAY3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;EAM5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;EAQtB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC1C;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,mFAO/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,eAAe,CAAC;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,EAAE,cAAc,CAAC;IAChC,sBAAsB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qBAAqB,CAAC,EAAE,OAAO,kBAAkB,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC7E;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,cAAc,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC3C,sFAAsF;IACtF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,SAAS,GAAG,cAAc,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,iBAAiB,mIAQ5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,eAAO,MAAM,qBAAqB,sCAAoC,CAAC;AACvE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,gCAAgC,kHAY3C,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,gCAAgC,CACxC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;EAM5B,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;EAQtB,CAAC;AACZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC1C;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,mFAO/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,YAAY;IAC3B,4FAA4F;IAC5F,KAAK,EAAE,OAAO,kBAAkB,EAAE,gBAAgB,CAAC;IACnD,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC3B,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,eAAe,CAAC;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,eAAe,EAAE,cAAc,CAAC;IAChC,sBAAsB,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,qBAAqB,CAAC,EAAE,OAAO,kBAAkB,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC7E;;;OAGG;IACH,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B;;;;;OAKG;IACH,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;OAIG;IACH,cAAc,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC3C;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,YAAY,EAAE,CAAC;IAChC,sFAAsF;IACtF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,eAAO,MAAM,kBAAkB;;;;;;;;;EAKpB,CAAC;AACZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,mBAAmB;IAClC;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,SAAS,GAAG,cAAc,GAAG,SAAS,GAAG,OAAO,CAAC;IAC1D,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B"}

package/dist/shared/quota/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/shared/quota/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,iBAAiB;IACjB,uBAAuB;IACvB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAGvE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC;IACrD,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,wEAAwE;IACxE,yEAAyE;IACzE,mBAAmB;IACnB,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,eAAe;CAChB,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,EAAE,gCAAgC;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC;KACD,MAAM,EAAE,CAAC;AAmCZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,KAAK;IACL,KAAK;IACL,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,MAAM;CACP,CAAC,CAAC;AA2DH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/shared/quota/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,iBAAiB;IACjB,uBAAuB;IACvB,iBAAiB;IACjB,WAAW;IACX,kBAAkB;IAClB,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAGvE,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,IAAI,CAAC;IACrD,WAAW;IACX,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,wEAAwE;IACxE,yEAAyE;IACzE,mBAAmB;IACnB,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,eAAe;CAChB,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,EAAE,gCAAgC;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvD,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC;KACD,MAAM,EAAE,CAAC;AAwCZ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,KAAK;IACL,KAAK;IACL,cAAc;IACd,UAAU;IACV,kBAAkB;IAClB,MAAM;CACP,CAAC,CAAC;AA0GH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/shared/quota/windowConstraints.d.ts

@@ -0,0 +1,56 @@
+import type { AdmitConstraint } from "./reservationLedger.js";
+import type { QuotaWindowScope } from "./quotaSource.js";
+import type { WindowBudget } from "./types.js";
+/**
+ * The ledger key one window meters against.
+ *
+ *  - `account` → `(accountKey, label)`: ONE allowance shared by every model on the
+ *    credential. `accountKey` comes from the PRODUCER (`CapacityPool.accountKey`,
+ *    set from the source declaration) — it is deliberately NOT derived here from
+ *    `poolId`, because an explicitly declared `source.id` is returned verbatim as the
+ *    pool key and carries no recoverable credential. Parsing it back out is what kept
+ *    the motivating `nim-nano`/`nim-super` case broken across five rounds.
+ *  - `model` → `(poolId, label)`: applies to this model alone; sharing it would
+ *    falsely throttle siblings the limit does not cover.
+ *
+ * ⚠ The two are NAMESPACED (`acct:` / `pool:`). Without that they collide whenever
+ * `accountKey === poolId` — which is exactly the unattributable-source fallback — and
+ * an account-scoped and a model-scoped window sharing a label would silently meter as
+ * one allowance, destroying the partition on the pool class that most needs it.
+ */
+export declare function windowResourceKey(scope: QuotaWindowScope, label: string, poolId: string, accountKey: string): string;
+/**
+ * What `tokens` costs against one window, in that window's own unit. Returns null
+ * when the window cannot price the draw — a `percent` window whose learned slope is
+ * missing or non-positive. A null must never be silently treated as free: the caller
+ * drops the whole pool to the cold-start path rather than admitting unmetered.
+ */
+export declare function windowCost(window: WindowBudget, tokens: number): number | null;
+/**
+ * Build the constraint array a packet of `tokens` must clear to be admitted on this
+ * pool — one constraint per window, all-or-nothing at the ledger.
+ *
+ * An EMPTY `windows` list falls back to a single pool-keyed constraint carrying
+ * `fallbackBudget` — the no-live-signal case (no snapshot, or the cooldown path where
+ * derivation is skipped). ⚠ The fallback MUST be the pool's own scalar budget, not
+ * `+Infinity`: a caller still holding a finite `remaining_token_budget` would
+ * otherwise have its ceiling silently discarded and over-admit. In production the two
+ * coincide (no windows ⇒ null budget ⇒ unbounded), so this is the belt that stops a
+ * future divergence from failing open.
+ *
+ * A window that cannot price the draw is DROPPED from the array and reported in
+ * `unpriced`, so the caller can refuse rather than admit against a partial set —
+ * silently omitting it would meter the packet against fewer allowances than apply to
+ * it, which is the fail-open direction.
+ */
+export interface PoolConstraintResolution {
+    constraints: AdmitConstraint[];
+    /**
+     * Windows that apply to the packet but could not price it. NON-EMPTY MEANS REFUSE:
+     * admitting on `constraints` alone would meter the packet against fewer allowances
+     * than actually bind it.
+     */
+    unpriced: WindowBudget[];
+}
+export declare function windowConstraintsFor(poolId: string, accountKey: string, windows: WindowBudget[] | undefined, tokens: number, fallbackBudget?: number): PoolConstraintResolution;
+//# sourceMappingURL=windowConstraints.d.ts.map

package/dist/shared/quota/windowConstraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowConstraints.d.ts","sourceRoot":"","sources":["../../../src/shared/quota/windowConstraints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAe/C;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM9E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,YAAY,EAAE,GAAG,SAAS,EACnC,MAAM,EAAE,MAAM,EACd,cAAc,GAAE,MAAiC,GAChD,wBAAwB,CAsB1B"}

package/dist/shared/quota/windowConstraints.js

@@ -0,0 +1,71 @@
+// The one place that turns a pool's per-window allowances into ledger constraints.
+//
+// Both admission paths go through here — the host grant (`admissionLoop`) and the
+// in-process rolling engine (`rollingDispatch`). That is deliberate: the metering
+// PARTITION is decided at the producer (`WindowBudget.scope` and
+// `CapacityPool.accountKey`) and merely CARRIED here, because the moment a call site
+// composes its own resource key from pool identity it is re-deriving the partition —
+// which is what five refused repair rounds each did differently and each got wrong.
+//
+// (`rollingDispatch` keeps a literal single-constraint fallback for the case where no
+// resolver is wired at all; that is an absence-of-config path, not a second
+// derivation.)
+/**
+ * The ledger key one window meters against.
+ *
+ *  - `account` → `(accountKey, label)`: ONE allowance shared by every model on the
+ *    credential. `accountKey` comes from the PRODUCER (`CapacityPool.accountKey`,
+ *    set from the source declaration) — it is deliberately NOT derived here from
+ *    `poolId`, because an explicitly declared `source.id` is returned verbatim as the
+ *    pool key and carries no recoverable credential. Parsing it back out is what kept
+ *    the motivating `nim-nano`/`nim-super` case broken across five rounds.
+ *  - `model` → `(poolId, label)`: applies to this model alone; sharing it would
+ *    falsely throttle siblings the limit does not cover.
+ *
+ * ⚠ The two are NAMESPACED (`acct:` / `pool:`). Without that they collide whenever
+ * `accountKey === poolId` — which is exactly the unattributable-source fallback — and
+ * an account-scoped and a model-scoped window sharing a label would silently meter as
+ * one allowance, destroying the partition on the pool class that most needs it.
+ */
+export function windowResourceKey(scope, label, poolId, accountKey) {
+    return scope === "account" ? `acct:${accountKey}::${label}` : `pool:${poolId}::${label}`;
+}
+/**
+ * What `tokens` costs against one window, in that window's own unit. Returns null
+ * when the window cannot price the draw — a `percent` window whose learned slope is
+ * missing or non-positive. A null must never be silently treated as free: the caller
+ * drops the whole pool to the cold-start path rather than admitting unmetered.
+ */
+export function windowCost(window, tokens) {
+    const draw = Math.max(0, tokens);
+    if (window.unit === "tokens")
+        return draw;
+    const slope = window.tokensPerPct;
+    if (typeof slope !== "number" || !Number.isFinite(slope) || slope <= 0)
+        return null;
+    return draw / slope;
+}
+export function windowConstraintsFor(poolId, accountKey, windows, tokens, fallbackBudget = Number.POSITIVE_INFINITY) {
+    if (!windows || windows.length === 0) {
+        return {
+            constraints: [{ resourceKey: poolId, budget: fallbackBudget, cost: Math.max(0, tokens) }],
+            unpriced: [],
+        };
+    }
+    const constraints = [];
+    const unpriced = [];
+    for (const window of windows) {
+        const cost = windowCost(window, tokens);
+        if (cost === null) {
+            unpriced.push(window);
+            continue;
+        }
+        constraints.push({
+            resourceKey: windowResourceKey(window.scope, window.label, poolId, accountKey),
+            budget: window.budget,
+            cost,
+        });
+    }
+    return { constraints, unpriced };
+}
+//# sourceMappingURL=windowConstraints.js.map

package/dist/shared/quota/windowConstraints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"windowConstraints.js","sourceRoot":"","sources":["../../../src/shared/quota/windowConstraints.ts"],"names":[],"mappings":"AAIA,mFAAmF;AACnF,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,iEAAiE;AACjE,qFAAqF;AACrF,qFAAqF;AACrF,oFAAoF;AACpF,EAAE;AACF,sFAAsF;AACtF,4EAA4E;AAC5E,eAAe;AAEf;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAuB,EACvB,KAAa,EACb,MAAc,EACd,UAAkB;IAElB,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,UAAU,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,KAAK,KAAK,EAAE,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAAoB,EAAE,MAAc;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpF,OAAO,IAAI,GAAG,KAAK,CAAC;AACtB,CAAC;AA6BD,MAAM,UAAU,oBAAoB,CAClC,MAAc,EACd,UAAkB,EAClB,OAAmC,EACnC,MAAc,EACd,iBAAyB,MAAM,CAAC,iBAAiB;IAEjD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,WAAW,EAAE,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YACzF,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,SAAS;QACX,CAAC;QACD,WAAW,CAAC,IAAI,CAAC;YACf,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC;YAC9E,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AACnC,CAAC"}

package/dist/shared/types/providerConfirmation.d.ts

@@ -94,6 +94,21 @@ export interface ProviderConfirmationInput {
 export interface HostModelCostEntry {
     /** Host model id — the dispatch cost-position key. */
     model_id: string;
+    /**
+     * The conversation host this tier belongs to — the provider half of the gate's
+     * `backendIdentity`, stamped at write time from `resolveConversationHostProvider`.
+     *
+     * RECORDED rather than re-derived at read time on purpose: a confirmation written
+     * under one host may be read under another, and re-deriving would then qualify the
+     * tier with the *reading* host — silently attributing the operator's decision to a
+     * backend they never confirmed.
+     *
+     * Optional ONLY so a confirmation written before this field existed still parses.
+     * Absent ⇒ the tier contributes no gate key at all (`confirmedBackendKeys`), which
+     * is fail-SAFE: the gate re-asks, and the answer records the provider. Falling back
+     * to the bare `model_id` instead would be the bypass this field exists to close.
+     */
+    provider?: ResolvedProviderName;
     /** Blended $/Mtok from models.dev, or `null` when unpriceable. Advisory. */
     blended_price_usd_per_mtok: number | null;
     /** Operator-confirmed 0-based cost position (rung 1 of costRank). */
@@ -114,6 +129,17 @@ export interface SourcePoolCostEntry {
     source_id: string;
     /** The source's provider transport (e.g. `openai-compatible`). */
     provider: string;
+    /**
+     * The backend ACTUALLY SERVING the model when this source is a proxied lane
+     * (e.g. `nim` behind a `claude-worker` transport) — the provider half of the
+     * gate's `backendIdentity`, and the same field `apiPool` keys the quota ledger on.
+     *
+     * Persisted because the CONFIRMED side must be able to reproduce the identity the
+     * DELTA computes; without it a proxied lane the operator confirmed would re-delta
+     * forever, which is exactly the livelock that deferred this fix before.
+     * Absent for a direct source, where the transport IS the backend.
+     */
+    backend_provider?: string;
     /**
      * The source's model id — the DISPATCH cost-position key (a proxy-sourced source's
      * namespaced `provider/model`, or a plain source model). Absent when the source
@@ -149,7 +175,11 @@ export interface SourcePoolCostEntry {
  * fields regardless of intent. Unrepresentable, not guarded.
  */
 export interface PersistedPoolEntry {
-    /** Canonical provider name. Half of the gate's `model_id ?? name` compare key. */
+    /**
+     * Canonical provider name. The provider half of the gate's `backendIdentity`
+     * compare key — a configured provider is its own backend, with no proxy
+     * indirection to unwrap.
+     */
     name: ResolvedProviderName;
     /**
      * The reach half, branded `never` so it is genuinely UNREPRESENTABLE here.

package/dist/shared/types/providerConfirmation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/types/providerConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAM3E;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,EAAG,OAAgB,CAAC;AAMrE;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,EAC9C,gCAAyC,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,cAAc,EAAE,OAAO,mCAAmC,CAAC;IAC3D;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,mEAAmE;IACnE,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,uFAAuF;IACvF,cAAc,EAAE,OAAO,CAAC;IACxB,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,gDAAgD;AAChD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,kFAAkF;IAClF,IAAI,EAAE,oBAAoB,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,kBAAkB,CAAC,EAAE,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,0BAA0B,CAAC,EAAE,KAAK,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,kDAAkD;IAClD,eAAe,EAAE,cAAc,CAAC;IAChC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB"}
+{"version":3,"file":"providerConfirmation.d.ts","sourceRoot":"","sources":["../../../src/shared/types/providerConfirmation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAM3E;;;;;;;GAOG;AACH,eAAO,MAAM,oCAAoC,EAAG,OAAgB,CAAC;AAMrE;;;;;;;GAOG;AACH,eAAO,MAAM,mCAAmC,EAC9C,gCAAyC,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,sDAAsD;IACtD,cAAc,EAAE,OAAO,mCAAmC,CAAC;IAC3D;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,mEAAmE;IACnE,OAAO,CAAC,EAAE,oBAAoB,EAAE,CAAC;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,4EAA4E;IAC5E,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,wFAAwF;IACxF,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,uFAAuF;IACvF,cAAc,EAAE,OAAO,CAAC;IACxB,yFAAyF;IACzF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,gDAAgD;AAChD;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,IAAI,EAAE,oBAAoB,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,KAAK,CAAC;IACxB,kBAAkB,CAAC,EAAE,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,KAAK,CAAC;IACjB,MAAM,CAAC,EAAE,KAAK,CAAC;IACf,0BAA0B,CAAC,EAAE,KAAK,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,+BAA+B;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,kDAAkD;IAClD,eAAe,EAAE,cAAc,CAAC;IAChC;;;OAGG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,cAAc,EAAE,OAAO,oCAAoC,CAAC;IAC5D,yDAAyD;IACzD,YAAY,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,aAAa,EAAE,kBAAkB,EAAE,CAAC;IACpC;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC;CACxB"}

package/docs/audit-pkg/operator-guide.md

@@ -36,7 +36,10 @@ Shared install files:
 - `.audit-code/install/SKILL.md`
 - `.audit-code/install/GETTING-STARTED.md`
 - `.audit-code/install/manifest.json`
-- `.audit-tools/audit/session-config.json` when no backend fallback config exists
+
+Separately, `.audit-tools/audit/session-config.json` is created with defaults the first time
+`next-step`/`advance-audit` runs and no config file yet exists — this happens lazily during an
+audit run, not during `install`/`ensure` bootstrap.
 
 Host-specific files may include:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "audit-tools",
-  "version": "0.33.9",
+  "version": "0.33.11",
   "private": false,
   "license": "ISC",
   "description": "Portable hybrid code auditing + remediation orchestrators for arbitrary repositories.",