bareloop 0.32.0 → 0.34.0

package/src/monthly.js

@@ -8,21 +8,22 @@
 // The limit REFUSES, never warns; the page and the chat can never raise it (a person
 // edits it by hand in Settings — src/config.js).
 //
-// A run still IN FLIGHT (a spine with `job-start`, no `job-end`, and a spine file written to
-// within DIED_MTIME_MS — the panel's own died rule) is counted at its full leg cap, not its
-// spend so far: `checkMonthlyRoom` reserves what the run may still spend, so two runs cannot
-// both start against a limit only one of them fits. A died run (stale spine) counts its floor.
-// The one exception is the spine a RESUME continues (`resumingSpine`): it counts its real spend
-// only, because the resume's own leg cap is the remainder and already covers its unspent cap.
-// Only the refusal check reserves; the Money tab keeps showing real spend (`usd`).
+// HOLD UNTIL DONE (hamr 2026-09-30): a run CLAIMS its whole leg cap when it starts (`claimRun`: append
+// the run's row FIRST, carrying its `pid` and `capUsd`, then read the list — only the claims ABOVE its row
+// count, so whoever runs first holds) and holds it until it is done. While the row's pid is a live bareloop runner the
+// run is counted at max(spend so far, capUsd) however quiet its spine; a run with a `job-end` counts
+// its real spend; a claim whose process is gone counts its floor and is settled — with an attributed
+// `settled` entry — by whichever later run finds it (the first note wins). An older row with no `pid` keeps the spine
+// mtime rule (a fresh spine, written to within DIED_MTIME_MS, is in flight) — `runIsAlive`, src/runlist.js, the
+// one "is this run alive" rule the panel's glyph shares. Only the refusal check
+// reserves; the Money tab keeps showing real spend (`usd`).
 //
 // Honesty: a run whose spend is not fully known (a died/still-running spine, an unpriced
 // round, a missing spine file) makes the month total an "at least" figure — never a clean
 // number. The refusal text stays exactly `Max $X (monthly limit)`; `atLeast` travels beside it.
-import { existsSync, statSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { existsSync } from 'node:fs';
 import { readConfig, configPath, ConfigError } from './config.js';
-import { readRunList, DIED_MTIME_MS } from './runlist.js';
+import { readRunList, appendRun, appendRunEvent, isLiveRunner, runIsAlive } from './runlist.js';
 import { parseJsonl } from './replayio.js';
 import { SPEND_RECORD_TYPES, spendProvenance, floorsFromRecords } from './ledger.js';
 import { findRow } from './providerrows.js';
@@ -140,46 +141,64 @@ export function legTokens(records) {
 
 /**
  * What the refusal check counts for one run: its spend, unless it is IN FLIGHT (`job-start`, no
- * `job-end`, spine written to within DIED_MTIME_MS of `nowMs`), when it is the larger of that
+ * `job-end`, `runIsAlive` for a row with no pid — the pid-bearing rows are held by `readLegs`), when it is the larger of that
  * spend and the leg's own cap — the signed `budgetUsd` on the spine's `job-start` less the fold
  * a resumed leg inherited (`priorSpentUsd`), the same figure the run-start seam computes
  * (`legCapUsd`, src/userrun.js). A spine that records no `budgetUsd` reserves nothing extra.
  * @param {any[]} records
- * @param {string} spinePath
+ * @param {import('./runlist.js').RunRow} row
  * @param {number} nowMs
  * @param {number} usd the leg's spend so far
  * @returns {number}
  */
-function inFlightCapUsd(records, spinePath, nowMs, usd) {
+function inFlightCapUsd(records, row, nowMs, usd) {
   if (records.some((r) => r && r.type === 'job-end')) return usd;
   const start = records.find((r) => r && r.type === 'job-start') ?? null;
   if (!start || !(typeof start.budgetUsd === 'number' && Number.isFinite(start.budgetUsd))) return usd;
-  let mtimeMs;
-  try { mtimeMs = statSync(spinePath).mtimeMs; } catch { return usd; }
-  if (nowMs - mtimeMs > DIED_MTIME_MS) return usd; // stale — died, counts its floor
+  if (!runIsAlive(row, nowMs)) return usd; // stale — died, counts its floor
   const fold = typeof start.priorSpentUsd === 'number' && Number.isFinite(start.priorSpentUsd) ? start.priorSpentUsd : 0;
   return Math.max(usd, Math.max(0, start.budgetUsd - fold));
 }
 
+/**
+ * The rows listed EARLIER in the run list than `runid`'s own row (file order is claim order). No
+ * `runid`, or a runid not in the list, = every row.
+ * @param {import('./runlist.js').RunRow[]} rows
+ * @param {string} [runid]
+ * @returns {import('./runlist.js').RunRow[]}
+ */
+function rowsAbove(rows, runid) {
+  if (runid === undefined) return rows;
+  const i = rows.findIndex((r) => r.runid === runid);
+  return i < 0 ? rows : rows.slice(0, i);
+}
+
 /**
  * Every listed run as one {@link Leg}. The ONE reader the month total, the all-time total
  * and the per-provider figures share.
- * @param {{ home?: string, now?: () => number, resumingSpine?: string|null }} [opts] `now` = the clock for the in-flight test; `resumingSpine` = the spine a resume continues: that leg reserves its spend only, never its unspent cap (the resume's own leg cap is that remainder)
+ * @param {{ home?: string, now?: () => number, aboveRunid?: string, thisMonthOnly?: boolean }} [opts] `now` = the clock for the no-pid in-flight test; `aboveRunid` = read only the runs listed EARLIER in the file than that run (a claim yields to the claims above it, never below); `thisMonthOnly` = do not parse the spine of a run listed in another local month (the refusal check drops it anyway) unless its claim is still held
  * @returns {Leg[]}
  */
 export function readLegs(opts = {}) {
   const nowMs = (opts.now ?? Date.now)();
-  const { rows } = readRunList({ home: opts.home });
-  const resuming = typeof opts.resumingSpine === 'string' ? resolve(opts.resumingSpine) : null;
+  const { rows: allRows, events } = readRunList({ home: opts.home });
+  const rows = rowsAbove(allRows, opts.aboveRunid);
+  const settled = new Set(events.filter((e) => e.type === 'settled').map((e) => e.runid));
   /** @type {Leg[]} */
   const legs = [];
   for (const row of rows) {
     const at = new Date(row.at);
     const base = { at, provider: null, baseUrl: null, model: null, wallMs: null, wallComplete: false, usd: 0, complete: false, tokens: 0, vouchedRounds: 0, otherRounds: 0, reservedUsd: 0, unreadable: true };
-    if (Number.isNaN(at.getTime()) || !existsSync(row.spine)) { legs.push(base); continue; }
+    // Rule 2 (hold-until-done): a row that carries its runner's `pid` is HELD at its cap while that
+    // pid is a live bareloop runner, however quiet its spine — killed = process gone, not silence.
+    // An older row with no `pid` keeps the spine-mtime rule (`inFlightCapUsd`), never guessed alive.
+    const hasPid = Number.isInteger(row.pid);
+    const heldCap = hasPid && !settled.has(row.runid) && typeof row.capUsd === 'number' && Number.isFinite(row.capUsd) && runIsAlive(row, nowMs) ? row.capUsd : null;
+    if (opts.thisMonthOnly && heldCap === null && !Number.isNaN(at.getTime()) && !sameLocalMonth(at, new Date(nowMs))) continue;
+    if (Number.isNaN(at.getTime()) || !existsSync(row.spine)) { legs.push({ ...base, reservedUsd: heldCap ?? 0 }); continue; }
     /** @type {any[]} */
     let records;
-    try { records = parseJsonl(row.spine).records; } catch { legs.push(base); continue; }
+    try { records = parseJsonl(row.spine).records; } catch { legs.push({ ...base, reservedUsd: heldCap ?? 0 }); continue; }
     const start = records.find((r) => r && r.type === 'job-start') ?? null;
     const leg = legSpend(records);
     const prov = spendProvenance(records);
@@ -196,7 +215,8 @@ export function readLegs(opts = {}) {
       tokens: legTokens(records),
       vouchedRounds: prov.vouched.rounds,
       otherRounds: prov.guessed.rounds + prov.unpriced.rounds + prov.unknown.rounds,
-      reservedUsd: resuming !== null && resolve(row.spine) === resuming ? leg.usd : inFlightCapUsd(records, row.spine, nowMs, leg.usd),
+      reservedUsd: hasPid ? (records.some((r) => r && r.type === 'job-end') || heldCap === null ? leg.usd : Math.max(leg.usd, heldCap))
+        : inFlightCapUsd(records, row, nowMs, leg.usd),
       unreadable: false,
     });
   }
@@ -211,8 +231,8 @@ export function readLegs(opts = {}) {
 const sameLocalMonth = (at, now) => at.getFullYear() === now.getFullYear() && at.getMonth() === now.getMonth();
 
 /**
- * @param {{ home?: string, now?: () => number, resumingSpine?: string|null }} [opts] `resumingSpine`: see {@link readLegs}
- * @returns {{ usd: number, atLeast: boolean, runs: number, reservedUsd: number }} `usd` = real spend (the Money tab's figure); `reservedUsd` = the same with in-flight runs at their cap (the refusal check's)
+ * @param {{ home?: string, now?: () => number, aboveRunid?: string }} [opts] `aboveRunid`: see {@link readLegs}
+ * @returns {{ usd: number, atLeast: boolean, runs: number, reservedUsd: number, heldUsd: number, heldRuns: number }} `usd` = real spend (the Money tab's figure); `reservedUsd` = the same with in-flight runs at their cap (the refusal check's); `heldUsd` = what in-progress runs set aside beyond what they have spent (`reservedUsd - usd`), over `heldRuns` runs
  */
 export function monthSpend(opts = {}) {
   const nowDate = new Date((opts.now ?? Date.now)());
@@ -220,17 +240,20 @@ export function monthSpend(opts = {}) {
   let reservedUsd = 0;
   let atLeast = false;
   let runs = 0;
-  for (const leg of readLegs({ home: opts.home, now: opts.now, resumingSpine: opts.resumingSpine })) {
+  let heldUsd = 0;
+  let heldRuns = 0;
+  for (const leg of readLegs({ home: opts.home, now: opts.now, aboveRunid: opts.aboveRunid, thisMonthOnly: true })) {
     // an unreadable date could belong to this month — unknown, never dropped
     if (Number.isNaN(leg.at.getTime())) { atLeast = true; continue; }
     if (!sameLocalMonth(leg.at, nowDate)) continue;
     runs += 1;
-    if (leg.unreadable) { atLeast = true; continue; }
+    if (leg.unreadable) { atLeast = true; reservedUsd += leg.reservedUsd; if (leg.reservedUsd > 0) { heldUsd += leg.reservedUsd; heldRuns += 1; } continue; }
     usd += leg.usd;
     reservedUsd += leg.reservedUsd;
+    if (leg.reservedUsd > leg.usd) { heldUsd += leg.reservedUsd - leg.usd; heldRuns += 1; }
     if (!leg.complete) atLeast = true;
   }
-  return { usd, atLeast, runs, reservedUsd };
+  return { usd, atLeast, runs, reservedUsd, heldUsd, heldRuns };
 }
 
 /**
@@ -302,6 +325,8 @@ export function spendSummary(opts = {}) {
  * @property {number|null} leftUsd what is left this month (null = no limit set)
  * @property {number|null} limitUsd the person's monthly limit (null = none)
  * @property {boolean} atLeast the month's spend is a floor, so `leftUsd` is a ceiling
+ * @property {number} [heldUsd] what run(s) in progress have set aside beyond their spend so far (present when a limit is set)
+ * @property {number} [heldRuns] how many runs hold it
  */
 
 /**
@@ -321,32 +346,84 @@ export function monthlyLimitOf(config, home) {
 }
 
 /**
- * Does a run with this $ cap fit in what is left this month (running jobs counted at their full cap, except the spine a resume continues — `resumingSpine` — which counts its real spend)? No limit set (key absent or null) = ok, no check; a limit that is present but not a
+ * Does a run with this $ cap fit in what is left this month (a run still held counts at its full cap)? No limit set (key absent or null) = ok, no check; a limit that is present but not a
  * number above 0 throws `ConfigError`.
  * Compared in whole cents. Also throws `ConfigError` when config.json is unreadable — a gate
  * whose own instrument is broken refuses; it never silently runs with no limit.
- * @param {{ capUsd: number, home?: string, now?: () => number, resumingSpine?: string|null }} args
+ * @param {{ capUsd: number, home?: string, now?: () => number, aboveRunid?: string }} args `aboveRunid`: count only the claims listed above that run (a claim in progress)
  * @returns {MonthlyRoom}
  */
-export function checkMonthlyRoom({ capUsd, home, now, resumingSpine }) {
+export function checkMonthlyRoom({ capUsd, home, now, aboveRunid }) {
   const cfg = readConfig({ home });
   if (cfg.problem) throw new ConfigError(cfg.problem);
   const limit = monthlyLimitOf(cfg.config, home);
   if (limit === null) {
     return { ok: true, leftUsd: null, limitUsd: null, atLeast: false };
   }
-  const spent = monthSpend({ home, now, resumingSpine });
+  const spent = monthSpend({ home, now, aboveRunid });
   const leftCents = Math.max(0, Math.floor((limit - spent.reservedUsd) * 100 + 1e-6));
-  const capCents = Math.ceil((Number.isFinite(capUsd) ? capUsd : 0) * 100 - 1e-6);
-  return { ok: capCents <= leftCents, leftUsd: leftCents / 100, limitUsd: limit, atLeast: spent.atLeast };
+  const capCents = Math.ceil(capUsd * 100 - 1e-6); // a non-finite cap never fits (NaN/Infinity compare false) — never read as $0
+  return { ok: capCents <= leftCents, leftUsd: leftCents / 100, limitUsd: limit, atLeast: spent.atLeast, heldUsd: spent.heldUsd, heldRuns: spent.heldRuns };
 }
 
 /**
- * The ONE refusal text, everywhere (CLI, panel cap note, panel Sign refusal).
+ * The ONE refusal text, everywhere (CLI, panel cap note, panel Sign refusal). When run(s) in progress hold
+ * part of the limit, the same line says how much.
  * @param {MonthlyRoom} room
  * @returns {string|null} null when the run fits
  */
 export function monthlyRefusalText(room) {
   if (room.ok || room.leftUsd === null) return null;
-  return `Max $${room.leftUsd.toFixed(2)} (monthly limit)`;
+  const max = `Max $${room.leftUsd.toFixed(2)}`;
+  if (!room.heldRuns || !room.heldUsd || room.heldUsd <= 0) return `${max} (monthly limit)`;
+  return `${max} (monthly limit, $${room.heldUsd.toFixed(2)} held by ${room.heldRuns > 1 ? 'runs' : 'a run'} in progress)`;
+}
+
+/**
+ * Close every claim ABOVE `aboveRunid` (file order) whose process is gone: a pid-bearing run row with no
+ * `settled` entry whose pid is not a live bareloop runner gets `{ type: 'settled', by: <closer>, reason:
+ * 'process gone', spentUsd: <its spine's floor>, spendComplete: false }` appended — so every claim gets a
+ * write-back, attributed. Two runs may both close the same dead claim; readers take the FIRST note.
+ * @param {{ home?: string, by: string, aboveRunid?: string }} args `by` = the run doing the closing
+ * @returns {number} how many notes were appended
+ */
+export function settleDeadClaims({ home, by, aboveRunid }) {
+  const { rows, events } = readRunList({ home });
+  const settled = new Set(events.filter((e) => e.type === 'settled').map((e) => e.runid));
+  let n = 0;
+  for (const row of rowsAbove(rows, aboveRunid)) {
+    if (!Number.isInteger(row.pid) || settled.has(row.runid) || isLiveRunner(/** @type {number} */ (row.pid))) continue;
+    let spentUsd = 0;
+    try { spentUsd = legSpend(parseJsonl(row.spine).records).usd; } catch { /* no spine: nothing was recorded spent */ }
+    appendRunEvent({ runid: row.runid, type: 'settled', by, reason: 'process gone', spentUsd, spendComplete: false, at: new Date().toISOString() }, { home });
+    n += 1;
+  }
+  return n;
+}
+
+/**
+ * The CLAIM (hamr 2026-09-30: whoever runs first claims the limit and holds it; no lock file, records
+ * only): the run APPENDS its row first (`row` carries its `pid` and `capUsd`), then reads the run list.
+ * Only the claims ABOVE its own row count — a live one is held at its cap (a dead one is closed with an
+ * attributed note and counts its real spend); rows below yield to it. If `capUsd` fits, it runs; if not
+ * it appends `{type:'released', reason:'refused'}` and reports the refusal, nothing spent. No limit set =
+ * no claim (`claimed: false`; the caller lists the run as it always did). An unreadable config, or a row
+ * that cannot be written, throws `ConfigError` — the gate refuses, never reads "no limit".
+ * @param {{ row: import('./runlist.js').RunRow, capUsd: number, home?: string, now?: () => number }} args
+ * @returns {{ room: MonthlyRoom, claimed: boolean }}
+ */
+export function claimRun({ row, capUsd, home, now }) {
+  const cfg = readConfig({ home });
+  if (cfg.problem) throw new ConfigError(cfg.problem);
+  if (monthlyLimitOf(cfg.config, home) === null) return { room: { ok: true, leftUsd: null, limitUsd: null, atLeast: false }, claimed: false };
+  try { appendRun(row, { home }); } catch (/** @type {any} */ e) {
+    throw new ConfigError(`cannot write this run's claim to the run list (${e.message})`);
+  }
+  settleDeadClaims({ home, by: row.runid, aboveRunid: row.runid });
+  const room = checkMonthlyRoom({ capUsd, home, now, aboveRunid: row.runid });
+  if (!room.ok) {
+    try { appendRunEvent({ runid: row.runid, type: 'released', by: row.runid, reason: 'refused', at: new Date().toISOString() }, { home }); } catch { /* the refusal stands; a stranded row of a dead process is closed by the next run */ }
+    return { room, claimed: false };
+  }
+  return { room, claimed: true };
 }

package/src/panel/authorroutes.js

@@ -34,6 +34,17 @@ export function mintToken() {
   return randomBytes(24).toString('hex');
 }
 
+/**
+ * The ONE Host check: the request names this panel's own bind address. A page on another
+ * origin reaching the panel through a rebound DNS name sends that name as Host, so it fails here.
+ * @param {import('node:http').IncomingMessage} req
+ * @param {{port: number}} o
+ * @returns {{ok: true}|{ok: false, reason: string}}
+ */
+export function checkHostGuard(req, { port }) {
+  return req.headers.host === `127.0.0.1:${port}` ? { ok: true } : { ok: false, reason: 'wrong Host' };
+}
+
 /**
  * `true` when a request may reach ANY route in this file — the token header
  * plus an Origin/Host that names this exact bind address. `req.headers`
@@ -48,10 +59,9 @@ export function checkHumanGuard(req, { token, port }) {
   if (got !== token) return { ok: false, reason: 'missing or wrong token' };
   const want = `127.0.0.1:${port}`;
   const origin = req.headers.origin;
-  const host = req.headers.host;
   if (typeof origin === 'string' && origin.length > 0) {
     if (origin !== `http://${want}` && origin !== `https://${want}`) return { ok: false, reason: 'wrong Origin' };
-  } else if (host !== want) {
+  } else if (!checkHostGuard(req, { port }).ok) {
     return { ok: false, reason: 'wrong Host (and no Origin header)' };
   }
   return { ok: true };

package/src/panel/authorsession.js

@@ -20,7 +20,8 @@
 // `src/panel/server.js`'s POST routes). Nothing here changes what a step
 // means or what an answer does — only where the answer comes from.
 
-import { applyConfiguredKey, keyNameFor, modelChoiceFor, rowsForHome } from '../providerrows.js';
+import { applyConfiguredKey, judgeRatesFor, keyNameFor, modelChoiceFor, ratesFor, rowsForHome } from '../providerrows.js';
+import { ConfigError } from '../config.js';
 import {
   mkdirSync, existsSync, writeFileSync, readdirSync,
 } from 'node:fs';
@@ -310,6 +311,15 @@ export function createSession(card, deps = {}) {
     const draftKeyName = keyNameFor(modelChoice.provider, modelChoice.baseUrl, keyCfg, modelChoice.name).name;
     const apiKey = draftEnv[providerEntry.envKey];
     if (!apiKey) { refuse(`${draftKeyName} not set. Stopped — nothing spent.`); return; }
+    // the customer's own price on this row (USD per 1M in config.json), resolved once here at $0 and
+    // handed to every model call this session makes; a bad price refuses, never falls back to the guess
+    /** @type {ReturnType<typeof ratesFor>} */
+    let draftPrice = null;
+    try { draftPrice = ratesFor(modelChoice.provider, modelChoice.baseUrl, keyCfg, modelChoice.name); } catch (e) {
+      if (!(e instanceof ConfigError)) throw e;
+      refuse(`${e.message}. Stopped — nothing spent.`);
+      return;
+    }
     const keyProblem = apiKeyProblem(apiKey);
     if (keyProblem) { refuse(`${draftKeyName} ${keyProblem}. Stopped — nothing spent.`); return; }
 
@@ -422,8 +432,8 @@ export function createSession(card, deps = {}) {
     // `provider` for the model boundary) and/or `scout` (bypassing the real
     // paid scout) so it can drive the REAL confirm turn/ask()/revise/hash
     // machinery below with a deterministic fake, never a live provider call.
-    const generate = deps.generate ?? makeLoopGenerate(provider);
-    const confirmGenerate = deps.confirmGenerate ?? makeLoopGenerate(provider, { system: CONFIRM_SYSTEM });
+    const generate = deps.generate ?? makeLoopGenerate(provider, { rates: draftPrice?.rates ?? null });
+    const confirmGenerate = deps.confirmGenerate ?? makeLoopGenerate(provider, { system: CONFIRM_SYSTEM, rates: draftPrice?.rates ?? null });
 
     state.phase = 'drafting';
     state.progressLabel = 'drafting';
@@ -437,6 +447,7 @@ export function createSession(card, deps = {}) {
       questions: questionsFor(verdictType),
       writeScope, provider, generate,
       ceilingUsd: card.capUsd,
+      rates: draftPrice?.rates ?? null,
       onPhase, onCall,
       ask, confirmGenerate, isRepo: true, langResult,
       ...(deps.scout ? { scout: deps.scout } : {}),
@@ -470,7 +481,16 @@ export function createSession(card, deps = {}) {
     const judges = closeJudges(spec.closeDecl);
     const judge = judges ? resolveJobJudge(spec, modelChoice.provider, resolveWorkerModel) : null;
     let judgeProvider = null;
+    /** @type {ReturnType<typeof ratesFor>} */
+    let judgePrice = null;
     if (judge) {
+      try {
+        judgePrice = judgeRatesFor(judge, modelChoice.provider, modelChoice.baseUrl, draftPrice, keyCfg);
+      } catch (e) {
+        if (!(e instanceof ConfigError)) throw e;
+        refuse(`${e.message} — refusing before gate 4 spends anything`);
+        return;
+      }
       const judgeKeyValue = env.JUDGE_API_KEY ?? (judge.provider === modelChoice.provider ? draftEnv : applyConfiguredKey(env, judge.provider, undefined, keyCfg, judge.model))[resolveProvider(judge.provider).envKey];
       const judgeKeyProblem = judgeKeyValue ? apiKeyProblem(judgeKeyValue) : null;
       if (!judgeKeyValue || judgeKeyProblem) {
@@ -486,7 +506,7 @@ export function createSession(card, deps = {}) {
     const signing = await prepareSigningFn({
       spec, workdir: prep.tree, seedRef: authored.seedRef, timeoutMs,
       shellCapUsd: spec.budgetUsd, ceilingUsd: card.capUsd, priorCalls: [...metered],
-      judgeLoop: judgeProvider ? (o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system }) : null,
+      judgeLoop: judgeProvider ? (o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgePrice?.rates ?? null }) : null,
       judgeModel: judge?.model ?? null,
       onJudgeCost: (c) => onCall({ label: `${c.label}:${c.id}`, costUsd: c.costUsd, unpricedRounds: c.unpricedRounds }),
     });

package/src/panel/server.js

@@ -25,12 +25,12 @@
 // for every cap/threshold: a shell never widens what it was asked to do).
 
 import { createServer } from 'node:http';
-import { readFileSync, existsSync, statSync } from 'node:fs';
+import { readFileSync, existsSync } from 'node:fs';
 import {
   dirname, join, basename, relative, isAbsolute, sep,
 } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { readRunList, DIED_MTIME_MS } from '../runlist.js';
+import { readRunList, DIED_MTIME_MS, runIsAlive } from '../runlist.js';
 import {
   replayOne, parseJsonl, resolveSiblings, isSidecarByName,
 } from '../replayio.js';
@@ -39,7 +39,7 @@ import { runBehaviour } from '../behaviour.js';
 import { SPEND_RECORD_TYPES, floorsFromRecords } from '../ledger.js';
 import { jobSpecHash } from '../job.js';
 import { confirmProtections } from '../authorflow.js';
-import { createAuthorRoutes, mintToken } from './authorroutes.js';
+import { createAuthorRoutes, mintToken, checkHostGuard } from './authorroutes.js';
 import { createSettingsRoutes } from './settingsroutes.js';
 
 const HERE = dirname(fileURLToPath(import.meta.url));
@@ -137,9 +137,9 @@ export function checkTypeTitle(verdictType, atIso) {
   return null;
 }
 
-// DIED (hamr's ruling B, 2026-09-25): a run with no `job-end` is `died` [?], never [✗], once its
-// spine file's mtime is older than DIED_MTIME_MS — the constant and its full comment live in
-// src/runlist.js (the monthly limit reads the same rule); re-exported here for the panel's callers.
+// DIED (hamr's ruling B, 2026-09-25): a run with no `job-end` is `died` [?], never [✗], once nothing is
+// running it — `runIsAlive` (src/runlist.js: the row's pid first, the spine-mtime rule DIED_MTIME_MS only
+// for a row with no pid; the monthly limit reads the same rule); the constant is re-exported here for the panel's callers.
 export { DIED_MTIME_MS };
 
 /**
@@ -231,12 +231,12 @@ export function formatTimestamp(ts) {
  * fields, which assume a `job-end` exists) — the ONE owner of this
  * derivation, used by every caller below (`/api/runs`, `/api/runs/:id`) so
  * the two never drift apart.
- * @param {string} spinePath
+ * @param {import('../runlist.js').RunRow} row the run's listed row (its pid, else its spine's mtime, says whether it is still running)
  * @param {any[]} records raw parsed spine records (already read once by the caller)
  * @param {string|null} outcome `replayRun`'s own `summary.outcome`
  * @returns {{died: boolean, why: string|null, spendFloorUsd: number|null, wallFloorMs: number|null}}
  */
-function deriveDeath(spinePath, records, outcome) {
+function deriveDeath(row, records, outcome) {
   const notDied = {
     died: false, why: null, spendFloorUsd: null, wallFloorMs: null,
   };
@@ -245,9 +245,7 @@ function deriveDeath(spinePath, records, outcome) {
   // out to be a died run or one that is genuinely still running (build item
   // 6): computed here, once, before the died/still-running branch below.
   const floors = floorsFromRecords(records);
-  let mtimeMs;
-  try { mtimeMs = statSync(spinePath).mtimeMs; } catch { return { ...notDied, ...floors }; }
-  if (Date.now() - mtimeMs <= DIED_MTIME_MS) return { ...notDied, ...floors }; // still fresh — genuinely `running`, not died
+  if (runIsAlive(row)) return { ...notDied, ...floors }; // something is still running it — genuinely `running`, not died
 
   const withTs = records.filter((r) => r && typeof r === 'object' && typeof r.ts === 'string');
   const last = withTs.length ? withTs[withTs.length - 1] : null;
@@ -300,7 +298,7 @@ function summarizeRow(row) {
     };
   }
   const line = summarizeForAllLine(summary);
-  const death = deriveDeath(row.spine, rawRecords, summary.outcome);
+  const death = deriveDeath(row, rawRecords, summary.outcome);
   return {
     runid: row.runid,
     job: row.job,
@@ -395,7 +393,7 @@ export function getRunDetail(runid, opts = {}) {
   const auditPath = resolveAuditPathForRow(row, rawSpineRecords);
   const summary = replayOne(row.spine, { auditPathOverride: auditPath });
   const timelineKind = summary.timelineKind;
-  const death = deriveDeath(row.spine, rawSpineRecords, summary.outcome);
+  const death = deriveDeath(row, rawSpineRecords, summary.outcome);
   // judgeModel (Summary box "judge:" line): the FIRST `judge-round`'s own
   // `model` field (src/planrun.js:1704's `onJudgeCost` emit) — a soft-green
   // close's own paid judge seam, distinct from the worker `model` above.
@@ -1746,6 +1744,13 @@ export function handleRequest(req, res, opts) {
   }
   const { pathname } = url;
 
+  // every read names the panel's own address as Host — no token needed to read, but another origin's
+  // page (a rebound DNS name) must not be able to fetch the run list
+  if ((method === 'GET' || method === 'HEAD') && !checkHostGuard(req, { port: opts.port }).ok) {
+    sendText(res, 403, 'wrong Host — this panel answers only at its own 127.0.0.1 address');
+    return;
+  }
+
   if (method !== 'GET' && method !== 'HEAD') {
     const routes = routesFor(opts, pathname);
     if (routes) {

package/src/planrun.js

@@ -762,6 +762,10 @@ ${scoutBlob || '(no scout notes)'}`;
  *   `false` → the drafter has no tools, so a native session would report NO cost — return a
  *   metered claude-json TEXT provider (`--output-format json`, `parse:'claude-json'`) instead,
  *   so its spend is never invisible. The Loop path (`anthropic-api`) never touches this.
+ * @param {{in: number, out: number}|null} [opts.rates] the customer's own price for the worker's key row (USD per
+ *   1K tokens, `ratesFor`) — handed to the one Loop that drives worker, scout and planner rounds, so they read
+ *   `rateSource:'caller'`; null = bare-agent's built-in guess. Not applied to a native (CLI) session, which reports its own cost.
+ * @param {{in: number, out: number}|null} [opts.judgeRates] the same, for the judge's Loop
  * @param {string|null} [opts.judgeModel] softgreen — WHICH model that judge provider drives
  *   (PRD item 32.1). Resolved by the CALLER (`resolveJudge`, src/judged.js: the spec's signed
  *   `judge` override, else the job's own worker model), never pinned in this library. It
@@ -983,7 +987,7 @@ ${scoutBlob || '(no scout notes)'}`;
  *   'branch-red' | 'cap-halt' | 'wall-halt' | 'provider-red' | 'interpreter-red' |
  *   'step-stalled' | 'hitl-pause' | 'hitl-decision-red' | `step-red:<id>`
  */
-export async function runPlan(job, { workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, emit, remainingUsd, isUnpriced = () => false, spendComplete = () => true, capRuns = 3, strikeLimit = STRIKE_LIMIT, closeTimeoutMs, closeDir = null, maxStepRounds = 40, layerRoot = false, readShim = false, scout = true, scoutRounds = SCOUT_ROUNDS, bridge = null, now, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, priorSpentUsd = 0, reviewDoor = null, doorRerun = null, resumable = true }) {
+export async function runPlan(job, { workdir, provider, nativeProvider, providerFor, judgeProvider = null, judgeModel = null, rates = null, judgeRates = null, emit, remainingUsd, isUnpriced = () => false, spendComplete = () => true, capRuns = 3, strikeLimit = STRIKE_LIMIT, closeTimeoutMs, closeDir = null, maxStepRounds = 40, layerRoot = false, readShim = false, scout = true, scoutRounds = SCOUT_ROUNDS, bridge = null, now, priorWallMs = 0, resumeSeed = null, resumeGrades = [], resumeReplans = null, resumeBranch = null, humanRuling = null, heldRuling = null, priorSpentUsd = 0, reviewDoor = null, doorRerun = null, resumable = true }) {
   // MEMORY-CACHE: what the read shim (src/readshim.js) saved THIS run, summed across
   // every mkWorker's own shim instance (scout, drafter, each step's worker, the fix
   // worker) — one accumulator closed over by all of them, because the shim's ledger
@@ -1687,7 +1691,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
       // ride, so `runJob`'s ONE ledger accounts a close's spend exactly as it accounts
       // an attempt's (a budget funds the attempt PLUS its close), and a null cost trips
       // the same F6 pricing halt rather than being laundered into $0.
-      judgeLoop: judgeProvider ? (/** @type {{system: string}} */ o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system }) : null,
+      judgeLoop: judgeProvider ? (/** @type {{system: string}} */ o) => defaultJudgeLoop({ provider: judgeProvider, system: o.system, rates: judgeRates }) : null,
       // the seam's other half (PRD item 32.1) — WHICH model that loop drives. Passed
       // through untouched: this module resolves no judge, exactly as it constructs no
       // provider. `runJudgedFloor` stops as a wiring gap when it is absent rather than
@@ -1704,11 +1708,9 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         stage: c.stage, path: c.path, attempt: c.attempt, label: c.label, model: c.model,
         costUsd: c.costUsd, unpricedRounds: c.unpricedRounds,
         // BA-21 provenance, through the SAME helper the worker rounds use — this record
-        // is on `spendProvenance`'s read list (src/ledger.js), so a judge-round that
-        // never carried the field would read UNKNOWN forever inside the readout built to
-        // expose exactly this seam. NAMED, not papered over: the judge cost payload
-        // (src/kinds.js `onJudgeCost({...})`) does not carry `rateSource` today, so it
-        // still reads UNKNOWN — correctly — until that payload forwards it too.
+        // is on `spendProvenance`'s read list (src/ledger.js). The judge cost payload
+        // (src/kinds.js `onJudgeCost`) forwards the field when the judge Loop carried it
+        // (`defaultJudgeLoop`); a loop that metered no rate leaves the key absent (UNKNOWN).
         ...rateSourceFields(c),
       }),
     })
@@ -2750,7 +2752,7 @@ export async function runPlan(job, { workdir, provider, nativeProvider, provider
         }
         return onLlmResult(arg);
       };
-      self = new Loop({ provider: loopProvider, system, policy, onLlmResult: metered, onToolResult: onToolOutcome });
+      self = new Loop({ provider: loopProvider, system, policy, onLlmResult: metered, onToolResult: onToolOutcome, ...(rates ? { rates } : {}) });
       return self;
     };
     /** @param {string} prompt @param {typeof toolDefs} [defs] */

package/src/providerrows.js

@@ -10,7 +10,7 @@
 // `applyConfiguredKey` / `modelChoiceFor` below — no second lookup exists. Key VALUES
 // never pass through here — only names.
 import { resolveProvider } from './providers.js';
-import { readConfig } from './config.js';
+import { readConfig, ConfigError } from './config.js';
 import { filledKeyNames } from './keysfile.js';
 
 /** DeepSeek's OpenAI-shaped endpoint (the same string the panel's Model menu used). */
@@ -73,6 +73,9 @@ export function defaultsFor(envName) {
  * @property {string} name the model id Chat uses ('' = not offered in Chat)
  * @property {string} provider the `src/providers.js` table entry (the API shape's id)
  * @property {string} baseUrl the saved Base URL ('' = the shape's default host)
+ * @property {unknown} [priceInPerM] the customer's own price, USD per 1M input tokens — carried RAW
+ *   (present only when the config row names it); {@link ratesFor} is the one place that validates it
+ * @property {unknown} [priceOutPerM] the same, for output tokens
  */
 
 /**
@@ -90,6 +93,8 @@ export function keyRows({ filled, config }) {
       name: typeof s.name === 'string' ? s.name : d.name,
       provider: SHAPES.some((x) => x.id === s.shape) ? s.shape : d.shape,
       baseUrl: typeof s.baseUrl === 'string' ? s.baseUrl : d.baseUrl,
+      ...(Object.hasOwn(s, 'priceInPerM') ? { priceInPerM: s.priceInPerM } : {}),
+      ...(Object.hasOwn(s, 'priceOutPerM') ? { priceOutPerM: s.priceOutPerM } : {}),
     };
   });
 }
@@ -215,3 +220,84 @@ export function applyConfiguredKey(env, provider, baseUrl, rows, model) {
   if (!k.chosen && value !== 'null') return env;
   return { ...env, [k.builtIn]: usableKey(value) };
 }
+
+/**
+ * A per-1M price for a readout: two decimals at least ($1.20), more when the number needs them so a
+ * tiny price never rounds to $0.00 or $0.01 ($0.006, $0.0004).
+ * @param {number} n USD per 1M tokens
+ * @returns {string}
+ */
+function perMoney(n) {
+  const shown = String(n);
+  if (!shown.includes('e') && (shown.split('.')[1] ?? '').length >= 2) return `$${shown}`;
+  if (shown.includes('e')) return `$${n.toFixed(12).replace(/0+$/, '').replace(/\.$/, '')}`;
+  return `$${n.toFixed(2)}`;
+}
+
+/**
+ * The one readout line for a resolved customer price, preview and run tail alike:
+ * `yours: in $0.006 / out $1.20 per 1M tokens (DEEPSEEK_API_KEY row)`. A 0 / 0 price is accepted (the price
+ * is the customer's) but the line says so: every round then books $0, so spend and limits read $0.
+ * @param {{ inPerM: number, outPerM: number, envName: string }} price a {@link ratesFor} result
+ * @returns {string}
+ */
+export function priceReadout(price) {
+  const zero = price.inPerM === 0 && price.outPerM === 0 ? ' — WARNING: this price is $0, so spend and limits read $0' : '';
+  return `yours: in ${perMoney(price.inPerM)} / out ${perMoney(price.outPerM)} per 1M tokens (${price.envName} row)${zero}`;
+}
+
+/**
+ * The customer's own price for the row a `(provider, baseUrl[, model])` identity belongs to —
+ * the SAME row match {@link keyNameFor} uses (`findRow`), so the price and the key always come
+ * from one row. `null` = no price set (the run keeps bare-agent's built-in guess, byte-identical
+ * to before). Both fields or neither, each a finite number >= 0, USD per 1M tokens; anything
+ * else throws `ConfigError` naming the row and field — a bad price never silently falls back to
+ * the guess. `rates` is bare-agent's `Loop({ rates })` shape (USD per 1K); `inPerM`/`outPerM`
+ * are what a readout prints.
+ * @param {string|null|undefined} provider
+ * @param {string|null|undefined} baseUrl
+ * @param {readonly KeyRow[]} rows
+ * @param {string|null|undefined} [model]
+ * @returns {{ rates: { in: number, out: number }, inPerM: number, outPerM: number, envName: string }|null}
+ */
+export function ratesFor(provider, baseUrl, rows, model) {
+  const row = findRow(rows, { provider, baseUrl, model });
+  if (!row) return null;
+  const hasIn = row.priceInPerM !== undefined;
+  const hasOut = row.priceOutPerM !== undefined;
+  if (!hasIn && !hasOut) return null;
+  if (hasIn !== hasOut) {
+    throw new ConfigError(`keys.${row.envName} sets ${hasIn ? 'priceInPerM' : 'priceOutPerM'} but not ${hasIn ? 'priceOutPerM' : 'priceInPerM'} — set both prices (USD per 1M tokens) or neither`);
+  }
+  for (const field of /** @type {const} */ (['priceInPerM', 'priceOutPerM'])) {
+    const v = row[field];
+    if (!(typeof v === 'number' && Number.isFinite(v) && v >= 0)) {
+      throw new ConfigError(`keys.${row.envName}.${field} must be a number, 0 or more (USD per 1M tokens) — fix it in config.json or remove both price lines`);
+    }
+  }
+  const inPerM = /** @type {number} */ (row.priceInPerM);
+  const outPerM = /** @type {number} */ (row.priceOutPerM);
+  return { rates: { in: inPerM / 1000, out: outPerM / 1000 }, inPerM, outPerM, envName: row.envName };
+}
+
+/**
+ * The price a judge's rounds are booked at. A price belongs to the MODEL's row: when the judge is
+ * the worker's own provider it calls the worker's endpoint, so a row on that endpoint NAMED for the
+ * judge's model prices it ({@link ratesFor}); a judge model that is absent or names no row there
+ * keeps the worker's price (the worker's row, or none = the guess). A different provider resolves
+ * on its own default endpoint, as before. A bad price on the resolved row throws like `ratesFor`.
+ * The judge's KEY is chosen elsewhere (`applyConfiguredKey`, by the worker's model), so the two
+ * can come from different rows — same provider + endpoint, judge model naming another row.
+ * @param {{ provider: string, model?: string|null }} judge
+ * @param {string|null|undefined} workerProvider
+ * @param {string|null|undefined} workerBaseUrl
+ * @param {ReturnType<typeof ratesFor>} workerPrice what the worker's own rounds are booked at
+ * @param {readonly KeyRow[]} rows
+ * @returns {ReturnType<typeof ratesFor>}
+ */
+export function judgeRatesFor(judge, workerProvider, workerBaseUrl, workerPrice, rows) {
+  if (judge.provider !== workerProvider) return ratesFor(judge.provider, undefined, rows, judge.model);
+  const want = endpointOf(judge.provider, workerBaseUrl);
+  const named = judge.model ? rows.some((r) => r.provider === judge.provider && endpointOf(r.provider, r.baseUrl) === want && r.name === judge.model) : false;
+  return named ? ratesFor(judge.provider, workerBaseUrl, rows, judge.model) : workerPrice;
+}