clearotron 0.3.2-beta.7 → 0.3.2-beta.8

package/driver/engine/probe.mjs

@@ -54,8 +54,8 @@
 // The one place the real adapter is exercised, it is pointed at `driver/test/mock-claude.mjs` through
 // `CLEAROTRON_CLAUDE_PATH` — the same offline fixture the engine tests already spawn.
 
-import { ENGINE_BINARIES, DEFAULT_ENGINE_ID, engineAdapterSpecifier } from "../driver.config.mjs";
-import { resolveAuthMode } from "./auth.mjs";
+import { ENGINE_BINARIES, DEFAULT_ENGINE_ID, engineAdapterSpecifier, resolveEngineProgram } from "../driver.config.mjs";
+import { resolveAuthMode, CLOUD_SETTINGS, CLOUD_CREDENTIAL_CHECK } from "./auth.mjs";
 
 /** Six words. Short enough to be free in practice, and it still requires a real completed turn. */
 export const PROBE_PROMPT = "Reply with the single word: ok.";
@@ -90,44 +90,97 @@ const tail = (s) => {
   return t.length > DETAIL_CHARS ? `…${t.slice(-DETAIL_CHARS)}` : t;
 };
 
+/**
+ * An engine instruction that names its program (`run \`claude\` once…`, `claude setup-token`), rewritten to
+ * name the copy that will actually run when that copy is the one Clearotron installed. That copy is not on
+ * PATH, so for it the bare word is a command the reader's shell cannot
+ * find, at the one step nobody can do for them. Any other copy is on PATH or named by path already, and
+ * the text is returned unchanged.
+ *
+ * HERE, AND RE-EXPORTED BY SETUP. Setup's own screens used it and the probe's sign-in advice, which doctor
+ * and the run door print, did not, so after setup's install doctor told the reader to run a `claude` their
+ * shell does not have. The probe cannot import the wizard, so the one copy lives on this side.
+ */
+export function namingProgram(text, eng, bin) {
+  if (!text || bin?.source !== "installed" || !bin.path) return text;
+  const program = /\s/.test(bin.path) ? `"${bin.path}"` : bin.path;
+  return String(text).replace(new RegExp(`(^|\`)${eng.fallback}(?=[\\s\`]|$)`, "g"), (_, before) => `${before}${program}`);
+}
+
 // THE HEADLESS ROUTE, WHERE THE ENGINE HAS ONE. The interactive sign-in is the one thing a server with no
 // browser cannot do, and it was the only remedy this offered — including to a box that had configured the
 // route built for servers. The engine table already carries that route; this reads it rather than a copy.
-const signInLine = (engine) => {
+//
+// `program` is the copy that ran ({ source, path }, or null), and every command run ON THIS MACHINE is named
+// through `namingProgram`. The token route's command can run on any machine, so it keeps the bare word,
+// with this machine's copy named beside it, as setup names it.
+const signInLine = (engine, program = null) => {
   const spec = ENGINE_BINARIES[engine];
-  const base = spec?.signIn ?? "sign the CLI in";
+  const base = spec?.signIn ? namingProgram(spec.signIn, spec, program) : "sign the CLI in";
   const h = spec?.headless;
   // Both forms the wizard already offers, read off the same table: a TOKEN route is run elsewhere and
-  // carried here by variable; a DEVICE route is run on this box and signs it in directly.
+  // carried here by variable; a DEVICE route is run on this machine and signs it in directly. The route is
+  // named by where a sign-in can be completed, as INSTALL.md's sign-in table names it.
   if (!h?.cmd) return base;
+  const here = namingProgram(h.cmd, spec, program);
   return h.tokenEnv
-    ? `${base} — or, on a box with no browser, run \`${h.cmd}\` on any machine you can sign in on and set the token it prints as ${h.tokenEnv} in this install's environment file`
-    : `${base} — or, on a box with no browser, run \`${h.cmd}\` here`;
+    ? `${base} — or, on a machine you cannot complete a sign-in on, run \`${h.cmd}\` on any machine you can sign in on${here !== h.cmd ? ` (on this one, \`${here}\`)` : ""} and set the token it prints as ${h.tokenEnv} in this install's environment file`
+    : `${base} — or, on a machine you cannot complete a sign-in on, run \`${here}\` here`;
 };
 
+/**
+ * Who refused the credentials and what to check, for a turn paid through an API key or a cloud account:
+ * `{ who, what, check }`, or null on a subscription, whose remedy is the sign-in above. `auth` is the
+ * resolver's answer for the turn ({ mode, cloud }). Names only, never a value.
+ *
+ * THE SIGN-IN IS A SUBSCRIPTION'S REMEDY AND NO OTHER'S. A cloud that refuses the credentials, or a key the
+ * vendor refuses, answers 401 or 403 like a signed-out program, and the advice was to run the program once
+ * and sign in: nothing to sign in to on a cloud, and a sign-in the adapter would not use under a key.
+ */
+export function credentialCheck(engine, auth) {
+  if (auth?.mode === "cloud") {
+    const c = CLOUD_CREDENTIAL_CHECK[auth.cloud];
+    return c ? { who: c.who, what: "the credentials", check: c.check } : null;
+  }
+  const spec = ENGINE_BINARIES[engine];
+  if (auth?.mode === "api-key" && spec?.apiKeyEnv) return { who: spec.vendor, what: "the API key", check: spec.apiKeyEnv };
+  return null;
+}
+const capitalised = (s) => s.charAt(0).toUpperCase() + s.slice(1);
+
 /**
  * One verdict from one turn. PURE — no clock, no filesystem, no process.
  *
  * `tuple` is the engine's normalized return (engine/CONTRACT.md §1); `error` is a THROW, which is a
  * distinct class and not a returned failure: `openai-agent.runTurn` throws for both of its auth shapes
  * (resolveAuthMode on api-key-without-key, and the auth.json refusal) rather than settling a tuple.
+ *
+ * `auth` is how the turn was paid for (resolveAuthMode's `{ mode, cloud }`) and `program` the copy that ran
+ * (`{ source, path }`); both only shape the advice, never the mode, so the run door refuses exactly what it
+ * refused before. Absent, the advice is the subscription's, naming the bare program word.
  */
-export function classifyProbe({ engine, tuple = null, error = null, timeoutSec = PROBE_TIMEOUT_SEC } = {}) {
+export function classifyProbe({ engine, tuple = null, error = null, timeoutSec = PROBE_TIMEOUT_SEC, auth = null, program = null } = {}) {
   const id = String(engine ?? "").trim().toLowerCase();
   const v = (mode, basis, headline, fix, extra = {}) =>
     ({ ok: false, engine: id, mode, basis, headline, fix, detail: null, ...extra });
 
   // ── a THROW ────────────────────────────────────────────────────────────────────────────────────────
-  // The thrown text is relayed VERBATIM as the fix wherever the thrower already says what to do. Those
-  // messages were written by the module that owns the decision (auth.mjs owns the billing refusal, the
-  // codex adapter owns `codex login`); paraphrasing them here creates a second wording that drifts.
+  // The thrown text is relayed as the fix wherever the thrower already says what to do. Those messages
+  // were written by the module that owns the decision (auth.mjs owns the billing refusal, the codex
+  // adapter owns `codex login`); paraphrasing them here creates a second wording that drifts.
+  //
+  // ONE CHANGE ONLY, AND ONLY TO A SIGN-IN: the program's name. The codex adapter refuses a subscription
+  // with no sign-in by throwing "run `codex login`" before it starts anything, which is the commonest way a
+  // signed-out Codex reaches this line. Relayed as thrown, that told a reader whose only copy is the one
+  // setup installed, which is not on PATH, to run a command their shell does not have. `namingProgram`
+  // rewrites the bare word for that copy and leaves every other copy's text as it was thrown.
   if (error) {
     const msg = String(error?.message ?? error);
-    if (/=api-key but/i.test(msg))
+    if (error?.billingRefusal === true || /=api-key but/i.test(msg))   // auth.mjs marks every billing refusal
       return v("auth-misconfigured", "config",
-        `${id} cannot start: the billing mode this box declares has no key`, msg, { detail: null });
+        `${id} cannot start: ${/=api-key but/i.test(msg) ? "the billing mode this box declares has no key" : "the billing setting this box declares is refused"}`, msg, { detail: null });
     if (SIGNED_OUT_RE.test(msg))
-      return v("signed-out", "config", `${id} is not signed in`, msg);
+      return v("signed-out", "config", `${id} is not signed in`, ENGINE_BINARIES[id] ? namingProgram(msg, ENGINE_BINARIES[id], program) : msg);
     if (TIER_RE.test(msg))
       return v("tier-unavailable", "config", `${id} cannot reach the model it was asked for`, tierFix(id, msg));
     return v("failed", "throw", `${id} could not run a turn`, msg);
@@ -144,7 +197,11 @@ export function classifyProbe({ engine, tuple = null, error = null, timeoutSec =
   // which pipe this happened to look at.
   const detail = tail(tuple.stderr) ?? tail(tuple.stdout);
 
-  if (tuple.code === 0) return { ok: true, engine: id, mode: "ok", basis: "completed-turn", headline: `${id} completed a turn`, fix: null, detail: null };
+  // A completed turn names what served it, the model and the provider as the program reported them, and
+  // null where it named neither, so a proof says which model and whose account it proved.
+  if (tuple.code === 0) return { ok: true, engine: id, mode: "ok", basis: "completed-turn", headline: `${id} completed a turn`, fix: null, detail: null,
+    served: typeof tuple.modelWire === "string" && tuple.modelWire ? tuple.modelWire : null,
+    provider: typeof tuple.providerWire === "string" && tuple.providerWire ? tuple.providerWire : null };
 
   // spawn itself failed. The filesystem preflight normally catches this first; when it does not, say so
   // in the binary's own vocabulary rather than as a mysterious engine fault.
@@ -163,9 +220,15 @@ export function classifyProbe({ engine, tuple = null, error = null, timeoutSec =
       { resetsAt: s.resetsAt ?? null, detail });
   }
 
+  // THE MODE STAYS `signed-out` UNDER EVERY WAY OF PAYING, because the run door refuses on the mode and a
+  // refused credential is as much this machine's to fix as a signed-out program. Only the words follow how
+  // the turn is paid for.
+  const refused = credentialCheck(id, auth);
   if (SIGNED_OUT_RE.test(text))
-    return v("signed-out", "text-match", `${id} is not signed in`,
-      `Sign in: ${signInLine(id)}, then run this again. Setup does not do it for you — the CLI owns its own login.`, { detail });
+    return refused
+      ? v("signed-out", "text-match", `${capitalised(refused.who)} refused ${refused.what}`, `check ${refused.check}, then run this again.`, { detail })
+      : v("signed-out", "text-match", `${id} is not signed in`,
+        `Sign in: ${signInLine(id, program)}, then run this again. Setup does not do it for you — the CLI owns its own login.`, { detail });
 
   if (TIER_RE.test(text))
     return v("tier-unavailable", "text-match", `${id} cannot reach the model it was asked for`, tierFix(id, text), { detail });
@@ -179,7 +242,9 @@ export function classifyProbe({ engine, tuple = null, error = null, timeoutSec =
   // from the shape rather than read from a message.
   if (s.noStreamEvents)
     return v("signed-out", "startup-class", `${id} exited before it produced anything`,
-      `That is the signed-out shape, so start there: ${signInLine(id)}, then run this again. The engine's stderr below is the diagnosis if it is something else.`, { detail });
+      refused
+        ? `That is what refused credentials look like, so start there: check ${refused.check}, then run this again. The engine's stderr below is the diagnosis if it is something else.`
+        : `That is the signed-out shape, so start there: ${signInLine(id, program)}, then run this again. The engine's stderr below is the diagnosis if it is something else.`, { detail });
 
   return v("failed", "nonzero-exit", `${id} ran but the turn failed (exit ${tuple.code})`,
     "The engine's stderr below is the whole story; a turn that starts and fails is not a configuration this check can name.", { detail });
@@ -292,11 +357,15 @@ export function probeWeatherWarning(verdict) {
  * and a caller building the environment it hands this module fills from it. `doctor` kept a second copy
  * that had dropped both credentials, so it filled a probe environment without the very token it then
  * reported missing. Exported so there is nothing left to copy.
+ *
+ * The cloud a Claude turn is sent to and paid through is on it too (`CLOUD_SETTINGS`, from auth.mjs).
+ * Without those names a cloud answered in setup would pass the resolver, which reads the caller's
+ * environment, and never reach the turn, which reads this process's: a proof of an account no run bills.
  */
 export function engineEnvKeys() {
   return [...new Set(["CLEAROTRON_AI", ...Object.values(ENGINE_BINARIES)
     .flatMap((s) => [s.env, s.authEnv, s.apiKeyEnv, s.headless?.tokenEnv])
-    .filter(Boolean)])];
+    .filter(Boolean), ...CLOUD_SETTINGS])];
 }
 
 function applyEngineEnv(env) {
@@ -346,6 +415,12 @@ async function defaultLoadAdapter(engine) {
 /**
  * Run the probe and return a verdict. Never throws for a configuration fault — a caller that wants a
  * refusal calls `preflightEngineTurn`, and a caller that wants to report calls this.
+ *
+ * `program` is the copy the caller has already found and is running (`{ source, path }`), for a caller
+ * that knows more about it than its setting says. Setup pins the program setting to the absolute path of
+ * the copy it proves, so the turn runs exactly that copy; resolved from that setting alone, the copy setup
+ * installed reads as a path the reader set, and the advice then named the bare word that copy does not
+ * answer to. Without it, the probe resolves the copy itself.
  */
 export async function probeEngineTurn({
   env = process.env,
@@ -354,6 +429,7 @@ export async function probeEngineTurn({
   loadAdapter = defaultLoadAdapter,
   timeoutSec = PROBE_TIMEOUT_SEC,
   stallSec = PROBE_STALL_SEC,
+  program: knownProgram = null,
 } = {}) {
   const id = String(env.CLEAROTRON_AI || DEFAULT_ENGINE_ID).trim().toLowerCase();
   if (!ENGINE_BINARIES[id]) {
@@ -366,8 +442,10 @@ export async function probeEngineTurn({
     };
   }
 
-  // The billing-mode door, before anything spawns — a fail-loud config error must not cost a turn.
-  try { resolveAuthMode({ engineName: id, env }); }
+  // The billing-mode door, before anything spawns — a fail-loud config error must not cost a turn. Its
+  // answer is kept: a refusal from a cloud or of a key is advised on differently from a signed-out program.
+  let auth;
+  try { auth = resolveAuthMode({ engineName: id, env }); }
   catch (e) { return classifyProbe({ engine: id, error: e, timeoutSec }); }
 
   let turn = injectedRunTurn;
@@ -377,11 +455,20 @@ export async function probeEngineTurn({
   }
 
   const restore = applyEngineEnv(env);
+  let program = null;
   try {
+    // THE COPY THAT RUNS, resolved the way the adapter resolves it: by the one resolver, inside the
+    // environment the turn runs in. The sign-in advice names it when it is the copy Clearotron installed,
+    // which is not on PATH. AFTER applyEngineEnv, NEVER BEFORE: the resolver reads this process's
+    // environment, and the caller's program setting is only there from that line until `restore()`, so above
+    // it this would name whatever copy the shell happened to point at. Inside the try, so the `finally` puts
+    // the environment back whatever it does. A resolver that cannot answer leaves the bare word.
+    if (knownProgram?.path) program = { source: knownProgram.source ?? null, path: knownProgram.path };
+    else try { const r = resolveEngineProgram(id); program = r.resolved ? { source: r.source, path: r.resolved } : null; } catch { /* the bare word */ }
     const tuple = await turn({ message: PROBE_PROMPT, model: PROBE_MODEL, thinking: PROBE_THINKING, timeoutSec, stallSec });
-    return classifyProbe({ engine: id, tuple, timeoutSec });
+    return classifyProbe({ engine: id, tuple, timeoutSec, auth, program });
   } catch (e) {
-    return classifyProbe({ engine: id, error: e, timeoutSec });
+    return classifyProbe({ engine: id, error: e, timeoutSec, auth, program });
   } finally {
     restore();
   }

package/driver/findings-model.mjs

@@ -1732,7 +1732,7 @@ function validateNet(f, ord, mode) {
 // This file's header says `findings_` = a top-level shape defect, `finding_` = a specific finding/field,
 // and by that rule this token would be `finding_net_chained` alongside finding_net_missing /
 // finding_net_invalid / finding_net_prescriptive. It is `findings_net_chained` instead, because the
-// convention is about ROUTING and routing disagrees. pipeline.mjs:3161 reads:
+// convention is about ROUTING and routing disagrees. pipeline.mjs reads:
 //
 //     const eligible = /^invalid_file:/.test(fail) && /:finding_[a-z]/.test(fail) && !/:findings_/.test(fail);
 //

package/driver/flag-snapshot.mjs

@@ -129,7 +129,7 @@ const truthy = (v) => ["1", "true", "yes", "on"].includes(String(v ?? "").trim()
  * `capturedAt` is supplied rather than read from the clock so this stays testable and so a caller can
  * stamp it from the same instant it stamps everything else.
  */
-export function buildFlagSnapshot(env, { capturedAt, registerProvider = null, registerCanCount = null, registerTerritories = undefined, engine = undefined, providers = undefined }) {
+export function buildFlagSnapshot(env, { capturedAt, registerProvider = null, registerLabel = null, registerCanCount = null, registerTerritories = undefined, engine = undefined, providers = undefined }) {
   const flags = {};
   // Written unconditionally, true or false to a count: a reader must be able to tell "this snapshot
   // tracks no flags" from "this snapshot lost its flags", and `flags: {}` alone cannot say which.
@@ -181,6 +181,12 @@ export function buildFlagSnapshot(env, { capturedAt, registerProvider = null, re
     register: registerProvider
       ? {
         provider: registerProvider,
+        // The register's own DISPLAY label ("Signa"), beside the key the engine switches on ("signa").
+        // A door that names the register to a client must not print the key, and capabilities — where
+        // the label lives — is a provider module this process may not be able to import. Same split as
+        // `territories` directly below: the writer runs in the engine environment and resolves it once.
+        // Omitted rather than guessed when the writer had none, and every reader falls back to the key.
+        ...(registerLabel ? { label: registerLabel } : {}),
         canCount: registerCanCount,
         ...(registerTerritories === undefined ? {} : { territories: registerTerritories }),
       }
@@ -335,9 +341,9 @@ export function postureDisagreement(snapshot, live) {
   // the better answer for a reader: "found" against "not found" says it without a legend.
   const found = (v) => (v === true ? "found" : v === false ? "not found" : null);
   differ("engine program", found(snapshot.engine?.binaryPresent), found(live.engine?.binaryPresent),
-    "whether a NEW search can start — the engine that last ran and this deployment do not agree that the "
-    + "engine program can be found, so one screen offers a search the other refuses. Restart the engine "
-    + "service so it re-reads its PATH, or install the CLI where the service can see it");
+    "whether a NEW search can start — the services, when they last started, and this deployment do not agree "
+    + "that the engine program can be found, so one screen offers a search the other refuses. Restart the "
+    + "services so they look again; if they still disagree, `clearotron doctor` says which side to fix and how");
 
   // Flags: compare only names BOTH sides declare, for the same reason `differ` skips absent values —
   // a build that adds a flag must not read as every older capture disagreeing with it.
@@ -425,6 +431,22 @@ export function registerTerritoriesFor(snapshot) {
   return Array.isArray(v) ? v.filter((n) => typeof n === "string") : undefined;
 }
 
+/**
+ * The wired register's DISPLAY label, for a sentence a client reads — `null` when the snapshot does not
+ * carry one, which every snapshot written before this shipped does not.
+ *
+ * FALLS BACK TO THE PROVIDER KEY rather than to nothing: a door that names the register is better off
+ * saying "signa" than saying nothing at all, and the caller decides whether a key is good enough to
+ * print. It is deliberately NOT title-cased on the way out — "uspto-local" title-cased is worse prose
+ * than the key, and inventing a display name is the provider module's job, not this reader's.
+ */
+export function registerLabelFor(snapshot) {
+  const l = snapshot?.register?.label;
+  if (typeof l === "string" && l.trim()) return l.trim();
+  const p = snapshot?.register?.provider;
+  return typeof p === "string" && p.trim() ? p.trim() : null;
+}
+
 /**
  * What this instance searches. THREE answers, exactly as `registerTerritoriesFor` above:
  *
@@ -535,11 +557,12 @@ export async function livePosture({ env = process.env } = {}) {
   const { REGISTER_PROVIDER } = await import("./driver.config.mjs");
   const { capabilitiesFor } = await import("./register-capabilities.mjs");
   const canCount = (() => { try { return capabilitiesFor(REGISTER_PROVIDER).countProbe !== "none"; } catch { return null; } })();
+  const label = (() => { try { return capabilitiesFor(REGISTER_PROVIDER).label ?? null; } catch { return null; } })();
   const { coveredTerritoryNames } = await import("./register-coverage.mjs");
   const territories = await (async () => { try { return await coveredTerritoryNames(capabilitiesFor(REGISTER_PROVIDER)); } catch { return undefined; } })();
   const { engineInventory, providerInventory } = await import("./config-inventory.mjs");
   return buildFlagSnapshot(env, {
-    capturedAt: new Date().toISOString(), registerProvider: REGISTER_PROVIDER, registerCanCount: canCount,
+    capturedAt: new Date().toISOString(), registerProvider: REGISTER_PROVIDER, registerLabel: label, registerCanCount: canCount,
     registerTerritories: territories,
     engine: engineInventory(env), providers: providerInventory(env),
   });

package/driver/gateway.mjs

@@ -817,7 +817,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     followup = false,   // #5b: this run is a warm-resume / followup (escalation, envelope close, frame-reopen
                         // sweep) — a hard-wall timeout breaks after ONE attempt (a 1.5× extension can't fit
                         // an already-over-budget resume; the caller records the coverage-limited deferral).
-    excludeTools, bandSize,   // copper-lattice re-route: tool names dropped from this stage's allowedTools
+    excludeTools, bandSize, derivedLimit = null,   // copper-lattice re-route: tool names dropped from this stage's allowedTools
   } = opts;
   if (!message) throw new Error(`runStage(${name}): message is required`);
   if (!sessionKey) throw new Error(`runStage(${name}): sessionKey is required`);
@@ -1145,17 +1145,17 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // it; the log was already saying what the code believed.
     //
     // TWO FIELDS, NEVER COLLAPSED INTO ONE:
-    //   modelUsed   — the requested resolution. Unchanged in meaning and unchanged in value, because
-    //                 run-economics.mjs and tokens.mjs both read it and a field that quietly changes
-    //                 what it means is its own corruption.
-    //   modelActual — the id the WIRE reported (engine tuple `modelWire`), or NULL when the stream
-    //                 never said: an engine that does not emit one (codex), a turn killed before any
-    //                 event, a spawn error. It NEVER falls back to the requested alias.
-    // `modelBasis` names which of the two the row can defend: "actual" or "unknown". There is no third
-    // state in which a requested value is dressed as an observed one.
+    //   modelUsed   — the requested resolution, unchanged in meaning and value: run-economics.mjs and
+    //                 tokens.mjs both read it, and a field that quietly changes meaning is its own corruption.
+    //   modelActual — the id the WIRE reported (engine tuple `modelWire`), or NULL when the stream never
+    //                 said: an engine that does not emit one (codex), a turn killed before any event, a
+    //                 spawn error. It NEVER falls back to the requested alias, and `modelBasis` ("actual" or
+    //                 "unknown") never dresses a requested value as an observed one. `providerReported` is
+    //                 the provider word the same stream gave (tuple `providerWire`), null on the same terms.
     const modelRequested = engine.resolveModelId ? engine.resolveModelId(model) : resolveModel(model);
     const modelActual = (typeof turn.modelWire === "string" && turn.modelWire) ? turn.modelWire : null;
     const modelBasis = modelActual ? "actual" : "unknown";
+    const providerReported = (typeof turn.providerWire === "string" && turn.providerWire) ? turn.providerWire : null;
     // WHETHER THE OBSERVED ID NAMES A FIXED BUILD. `modelBasis: "actual"` says the provider answered,
     // not that the answer is pinned: two of the three tiers come back as undated aliases the provider
     // may repoint, and recorded beside a dated one they read identically. null when there is nothing to
@@ -1171,9 +1171,13 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
     // "written before anybody asked", which is the distinction the field exists for. One spawn per
     // binary per process; a probe never throws, because taking down a dispatch to record a version
     // would be a worse defect than the gap it closes.
+    // `source` says WHICH copy served (explicit / path / installed), and it is attached here, outside the
+    // probe's cache: that cache is keyed by the file, and one file can be reached by more than one route.
     const cli = (() => {
-      try { return probeCliVersion(preflightEngineBinary(process.env)?.resolved ?? null); }
-      catch (e) { return { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160) }; }
+      try {
+        const pre = preflightEngineBinary(process.env);
+        return { ...probeCliVersion(pre?.resolved ?? null), source: pre?.source ?? null };
+      } catch (e) { return { version: null, probe: "unreadable", why: String(e?.message ?? e).slice(0, 160), source: null }; }
     })();
     if (modelActual) lastModelWire = modelActual;                       // — never overwritten with null
     // The comparison is by FAMILY (driver.config modelFamily), because `--model haiku` legitimately comes
@@ -1294,7 +1298,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           attempt, key, agent, model,
           modelUsed: (lastModelUsed = engine.resolveModelId ? engine.resolveModelId(model) : resolveModel(model)),
           // Same billing stamp as the attempt row, written on the same terms — see the note there.
-          engine: engine.name, writeBoundary: writeBoundaryOf(engine), authMode: auth.mode, apiBilled: auth.apiBilled === true,
+          engine: engine.name, writeBoundary: writeBoundaryOf(engine), authMode: auth.mode, apiBilled: auth.apiBilled === true, cloud: auth.cloud ?? null,
           code: rt.code, wall: rt.wall, timeoutSec: effTimeout,
           // — same rename as the attempt row above. This row already carries the driver's verdict as
           // `repairOutcome` (only "repaired" is success), so it needs no `ok`; what it lacked was any mark
@@ -1638,8 +1642,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         //   modelMismatch — true/false when both sides name a family, null when either does not.
         // Written even on the rows where they are null, so "this engine cannot report" stays visibly
         // different from "this record predates the gauge".
-        modelActual, modelBasis, modelSnapshot, modelMismatch,
-        cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}),
+        modelActual, modelBasis, modelSnapshot, modelMismatch, providerReported,
+        cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}), cliSource: cli.source,
         // W3 billing telemetry: which engine ran + the RESOLVED billing mode (subscription vs api-key). This
         // records INTENT (the mode the engine was configured to bill under), not independent billing evidence
         // — the actual proof is the provider console (claude's stream also reports apiKeySource; codex does
@@ -1653,7 +1657,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // "every telemetry field is written unconditionally, so 'did not happen' stays distinguishable
         // from 'not recorded'" (instrumentation-house-rule.test.mjs). A run must be able to STATE that it
         // billed subscription, not merely fail to state that it billed API.
-        engine: engine.name, writeBoundary: writeBoundaryOf(engine), authMode: auth.mode, apiBilled: auth.apiBilled === true,
+        engine: engine.name, writeBoundary: writeBoundaryOf(engine), authMode: auth.mode, apiBilled: auth.apiBilled === true, cloud: auth.cloud ?? null,
         // build 2 — THIS attempt is the fresh dispatch bought by discarding a warm session that
         // reproduced its own failure. Exact, not cumulative: a `warmEscalatedAt > 0` test would mark
         // every later attempt too the moment the ladder is deepened, and the row would stop meaning
@@ -1743,6 +1747,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
         // null (not 0, and not absent) on an engine that cannot report them, so "this adapter does not
         // measure" stays visibly different from "this turn called no tools" — see toolGauge.
         ...toolGauge(turn), band: bandSize ?? undefined,
+        inputBytes: derivedLimit?.inputBytes ?? undefined, derivedLimitSec: derivedLimit?.sec ?? undefined,
         // AD-4 emitted-vs-landed, UNCONDITIONAL (was success-only, which made a failed attempt's mid-write
         // artifact invisible): `output` = what LANDED on disk after this attempt (null when the stage has no
         // expected file); `wrote` = whether THIS attempt emitted it (see the computation above the runDir
@@ -1776,8 +1781,8 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           event: "attempt", stage: name, attempt, of: maxRetries + 1, ok: !fail, fail: fail ?? null,
           //: the spine carries the same pair as the per-stage log, or the two disagree about what
           // ran. `model` stays the requested resolution (its existing readers); `modelActual` is the wire.
-          model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch,
-          cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}),
+          model: modelRequested, modelActual, modelBasis, modelSnapshot, modelMismatch, providerReported,
+          cliVersion: cli.version, cliVersionProbe: cli.probe, ...(cli.why ? { cliVersionWhy: cli.why } : {}), cliSource: cli.source,
           wrote, warm: warm || undefined, warmEscalated: attempt === warmEscalatedAt || undefined,
           rescued: rescued ?? undefined, killed: killed || undefined,
           quiescentMs: Number.isFinite(quiescentMs) ? Math.round(quiescentMs) : undefined,   // — see the per-stage row
@@ -1789,7 +1794,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           // archived runs actually reads, and the question "has this box ever billed API" could not be
           // answered from it because the pair was only ever on the per-stage log. Written unconditionally,
           // like everything else here: a subscription run states `false`.
-          authMode: auth.mode, apiBilled: auth.apiBilled === true,
+          authMode: auth.mode, apiBilled: auth.apiBilled === true, cloud: auth.cloud ?? null,
           //: the spine carries the POINTER and the sha, not the text — enough to find the file and
           // to tell two attempts apart without opening either.
           dispatch: dispatch?.file ?? null, dispatchSha: dispatch?.sha ?? null,
@@ -1806,6 +1811,7 @@ async function runStageLadder(name, opts, stageCodexHome = null) {
           wall, outputTokens: usage?.output ?? null, tokensPerSec: tokensPerSec(usage, wall),
           // — the spine carries them too, or a round has to join two files to ask why a stage was slow.
           ...toolGauge(turn), band: bandSize ?? undefined,
+        inputBytes: derivedLimit?.inputBytes ?? undefined, derivedLimitSec: derivedLimit?.sec ?? undefined,
           formRepairs: formRepairsThisAttempt || undefined,   //, see the stage row above
         });
       } catch { /* telemetry best-effort — never fail a turn over a journal line */ }

package/driver/jx-lanes.mjs

@@ -280,6 +280,25 @@ export const jxBillingStamp = (executorSource, result = null) => {
   // NO VENDOR ON THE RESULT MEANS NO DISPATCH HAPPENED. A fixture, an injected executor, or a
   // configuration the engine door refused all return without one, and none of them is provider-billed.
   // Saying so in its own words beats "unknown", which is indistinguishable from an unstamped legacy row.
-  if (executorSource !== "engine" || !result?.vendor) return { engine: "not-provider-billed", authMode: "not-provider-billed" };
-  return { engine: result.vendor, authMode: result.authMode ?? "not-provider-billed" };
+  if (executorSource !== "engine" || !result?.vendor) return { engine: "not-provider-billed", authMode: "not-provider-billed", cloud: null };
+  return { engine: result.vendor, authMode: result.authMode ?? "not-provider-billed", cloud: result.cloud ?? null };   // cloud: which account a cloud mode bills
+};
+
+// ── What a jx ledger row says about the model ─────────────────────────────────────────────────────────
+// The `model` on these rows is the id the program reported for the turn (jx-turn.mjs reads it off the
+// wire), not a tier asked for, so a row that names one also carries it as `modelActual`, the name every
+// attempt row uses for a served id. That is what the report's list of models reads; without it, a model
+// that did only this work was left off the report.
+//
+// A TURN THAT RAN AND NAMED NO MODEL STILL RAN. The Claude program answered it itself, or the stream never
+// said, or the turn was killed first: the program reports no id. Such a row used to carry neither field,
+// and every reader took a row with no `model` for a call that was never made, so the turn's attempt and
+// any tokens it reported fell out of the run's totals, and a run made only of such turns read as one where
+// nothing was looked at. It now records `modelActual: null`, the stage rows' own words for "a turn ran and
+// named no model", and tokens.mjs counts it as an attempt. Only a real dispatch writes it, by the rule
+// jxBillingStamp states: no vendor on the result means no dispatch, so a fixture, an injected executor or
+// a configuration the engine door refused writes neither field.
+export const jxModelFields = (executorSource, result = null) => {
+  if (result?.model) return { model: result.model, modelActual: result.model };
+  return jxBillingStamp(executorSource, result).engine === "not-provider-billed" ? {} : { modelActual: null };
 };

package/driver/jx-units.mjs

@@ -34,7 +34,7 @@
 import { readFileSync, writeFileSync, renameSync, appendFileSync, mkdirSync, existsSync } from "node:fs";
 import { join } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
-import { LANGUAGE_LANES, SERP_LANES, isMirrorHost, canonicalTerm, jxBillingStamp } from "./jx-lanes.mjs";
+import { LANGUAGE_LANES, SERP_LANES, isMirrorHost, canonicalTerm, jxBillingStamp, jxModelFields } from "./jx-lanes.mjs";
 import { jxKey, MAX_LANE_ATTEMPTS } from "./jx.mjs";
 import { abbrev } from "./repair-contract.mjs";
 import { kebab } from "./search-policy.mjs";
@@ -137,6 +137,9 @@ function foldRetryable(ctx, lane) {
 // spend real tokens that no per-run total ever sees (they did, until 2026-07-28).
 //
 // …and the BILLING PATH rides with them — see jxBillingStamp in jx-lanes.mjs.
+//
+// …and so does what the turn said about the model: the id it reported, or that it ran and named none —
+// see jxModelFields in jx-lanes.mjs.
 function ledgerRow(runDir, row) {
   try { appendFileSync(driverDir(runDir, "jx-completions.jsonl"), JSON.stringify(row) + "\n"); } catch { /* receipts best-effort */ }
 }
@@ -392,7 +395,7 @@ export async function runJxSerpGrid(ctx, job, opts = {}, { runLog = () => {}, no
       ledgerRow(run.runDir, { ts: new Date().toISOString(), lane, mark: markName, unit: "serp-judge", executor: judgeSource,
         ...jxBillingStamp(judgeSource, jr),
         took_ms: jr?.tookMs ?? (Date.now() - started), ok: Boolean(jr?.ok), judged: jr?.ok ? (jr.judgments?.length ?? 0) : 0,
-        ...(jr?.model ? { model: jr.model } : {}),
+        ...jxModelFields(judgeSource, jr),
         ...(jr?.usage ? { usage: jr.usage } : {}), ...(jr?.ok ? {} : { cause: String(jr?.cause ?? "unknown").slice(0, 300) }) });
       if (!jr?.ok) { judgeDegraded = String(jr?.cause ?? "unknown").slice(0, 200); break; }
       const byId = new Map(jr.judgments.map((j) => [j.id, j]));
@@ -524,7 +527,7 @@ export async function runJxNativeread(ctx, job, opts = {}, { runLog = () => {},
     ledgerRow(run.runDir, { ts: new Date().toISOString(), lane, mark: markName, unit: "nativeread", executor: source,
       ...jxBillingStamp(source, r),
       took_ms: r?.tookMs ?? (Date.now() - started), ok: Boolean(r?.ok), items: r?.ok ? (r.items?.length ?? 0) : 0,
-      ...(r?.model ? { model: r.model } : {}),
+      ...jxModelFields(source, r),
       ...(r?.usage ? { usage: r.usage } : {}), ...(r?.ok ? {} : { cause: String(r?.cause ?? "unknown").slice(0, 300) }) });
     if (!r?.ok) {
       degradeUnit(run.runDir, key, st.attempts, r?.cause ?? "unknown");

package/driver/jx.mjs

@@ -14,7 +14,7 @@
 import { readFileSync, writeFileSync, renameSync, appendFileSync } from "node:fs";
 import { join } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
-import { decideJxLanes, candidateRefusal, canonicalTerm, romanizationSpellings, LANGUAGE_LANES, jxBillingStamp } from "./jx-lanes.mjs";
+import { decideJxLanes, candidateRefusal, canonicalTerm, romanizationSpellings, LANGUAGE_LANES, jxBillingStamp, jxModelFields } from "./jx-lanes.mjs";
 import { cnipaSubgroupsForClasses, cnipaEditionLabel } from "./jx-subclass.mjs";   // — replaces the hand-written seed table
 import { kebab } from "./search-policy.mjs";
 import { JX_PROVIDERS } from "./driver.config.mjs";
@@ -512,7 +512,9 @@ export async function runJxCandidateFold(ctx, job, opts = {}, { runLog = () => {
       const row = { ts: new Date().toISOString(), lane, mark: markName, executor: source, ...jxBillingStamp(source, r),
         took_ms: r?.tookMs ?? (Date.now() - started), ok: Boolean(r?.ok),
         candidates: r?.ok ? (r.candidates?.length ?? 0) : 0,
-        ...(r?.model ? { model: r.model } : {}),
+        // the model the turn reported, as `model` and `modelActual`, or `modelActual: null` for a turn
+        // that ran and named none — see jxModelFields.
+        ...jxModelFields(source, r),
         ...(r?.usage ? { usage: r.usage } : {}), ...(r?.ok ? {} : { cause: String(r?.cause ?? "unknown").slice(0, 300) }) };
       try { appendFileSync(ledgerPath, JSON.stringify(row) + "\n"); } catch { /* receipts best-effort */ }
       // Before the degraded-lane `continue` below: a lane that FAILED still ran a turn, and the model