clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/driver/register-plan.mjs

@@ -573,7 +573,194 @@ export function mintSupplementalQid({ prefix, term, used }) {
  *                  driver/register-capabilities.mjs). Omitted ⇒ the pre-phase-3 corsearch-shaped
  *                  behaviour, byte-identical (no entry gains a key, no jurisdiction is translated).
  */
-export function compileRegisterPlan({ manifest, job, form = null, skillVersion = "", capabilities = null, unavailableOffices = [] }) {
+/**
+ * The receipt that ARMS the house-element exclusion, and the only thing that may.
+ *
+ * A SEPARATE FILE FROM THE FRAME'S PROPOSAL, deliberately, and for the reason the digest's accounting
+ * stamp is separate from its facts: the proposal is what a model said, the receipt is what the register
+ * answered, and a reader who cannot tell those apart cannot tell a judgement from evidence. Absent means
+ * the question was never asked, which is the same as unverified and excludes nothing.
+ */
+export const HOUSE_ELEMENT_RECEIPT = "house-element.json";
+
+/**
+ * Verify that the client actually owns the proposed house element, on the register, by owner.
+ *
+ * IT SITS BESIDE THE TRANSFORM IT GATES, for the reason `accountingArmed` sits beside the refusal it
+ * arms: the gate and the thing gated go stale together or not at all, and a reader meeting one finds the
+ * other. Nothing else may arm this exclusion.
+ *
+ * FAIL-CLOSED ON EVERY PATH, and that is the whole design. The frame PROPOSED this element from its
+ * reading of the matter; acting on the proposal alone would drop an element from a client's search on a
+ * model's assertion, and an element nobody swept is a clean report over unswept ground — the one defect
+ * that reaches a client as a confident wrong answer rather than as a visible failure. So every way of
+ * not knowing lands in the same place: not verified, no exclusion, the element searched in full, and a
+ * reason on the receipt saying which way it was. An outage, an unknown client name, a lookup that threw,
+ * a dead registration, a registration in some other class — none of them excludes anything.
+ *
+ * `lookup` is injected, exactly as `runOwnerChecks` takes its `exec` and `countRegisterHits` its
+ * `counter`: the fixture path that makes this product testable at no cost covers this call too, and a
+ * test never reaches a provider. NEVER THROWS and never rejects.
+ *
+ * @param owners  the client's own names — the profile's trading names and the matter's customer. Empty
+ *                is a real answer and it means NOT VERIFIED: with no name to match an owner against,
+ *                "the client owns it" cannot be established by anything this function can see.
+ * @returns the receipt, always. `verified: true` is the only value that may arm an exclusion.
+ */
+export async function verifyHouseElementOwnership({
+  element, classes = [], owners = [], lookup, now = () => new Date().toISOString(),
+}) {
+  const el = String(element ?? "").trim();
+  const wanted = (Array.isArray(classes) ? classes : []).map(String).map((c) => c.trim()).filter(Boolean);
+  const names = (Array.isArray(owners) ? owners : []).map((o) => String(o ?? "").trim()).filter(Boolean);
+  const receipt = (verified, reason, records = []) =>
+    ({ verified, element: el, owners_checked: names, classes: wanted, records, reason, ts: now() });
+
+  if (!el) return receipt(false, "house_element_absent: nothing was proposed");
+  if (!names.length)
+    return receipt(false, "client_owner_unknown: this run holds no trading name for the client, so an owner on the register cannot be matched to it");
+  if (!wanted.length)
+    return receipt(false, "instructed_classes_absent: ownership is only decisive in the classes the matter is instructed in");
+  if (typeof lookup !== "function")
+    return receipt(false, "lookup_unavailable: no register lookup was wired, so ownership was never asked");
+
+  let rows = [];
+  try {
+    const r = await lookup({ element: el, owners: names, classes: wanted });
+    if (!r?.ok) return receipt(false, `lookup_did_not_answer: ${String(r?.reason ?? "no reason given").slice(0, 200)}`);
+    rows = Array.isArray(r.records) ? r.records : [];
+  } catch (e) {
+    return receipt(false, `lookup_threw: ${String(e?.message ?? e).slice(0, 200)}`);
+  }
+
+  // A MATCH IS ALL THREE AT ONCE — the client's own name, alive, in an instructed class. Checking them
+  // separately would let a dead registration in class 9 and a live one in class 25 held by someone else
+  // combine into an ownership nobody has.
+  const norm = (v) => String(v ?? "").toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+  const ours = names.map(norm).filter(Boolean);
+  const live = (st) => { const t = norm(st); return Boolean(t) && !/(dead|expired|cancell?ed|withdrawn|refused|lapsed|abandoned)/.test(t); };
+  const matched = rows.filter((r) => {
+    const owner = norm(r?.owner_name);
+    if (!owner || !ours.some((o) => owner === o || owner.includes(o) || o.includes(owner))) return false;
+    if (!live(r?.status)) return false;
+    const rc = (Array.isArray(r?.classes) ? r.classes : []).map(String).map((c) => c.trim());
+    return rc.some((c) => wanted.includes(c));
+  });
+
+  if (!matched.length)
+    return receipt(false, `no_live_owned_registration: ${rows.length} record(s) came back and none is a live registration held by this client in an instructed class`, []);
+  // The records are the EVIDENCE the report states the exclusion on, so they ride the receipt.
+  return receipt(true, `verified: ${matched.length} live registration(s) held by this client in an instructed class`,
+    matched.map((r) => ({ record_id: String(r?.record_id ?? r?.uri ?? ""), owner_name: String(r?.owner_name ?? ""),
+      status: String(r?.status ?? ""), classes: (Array.isArray(r?.classes) ? r.classes : []).map(String) })));
+}
+
+/**
+ * The manifest with the client's own house element taken out of the conflict analysis. PURE.
+ *
+ * THE DEFECT (production run, 2026-09-16). The mark was the client's own famous house mark followed by
+ * a tagline. `dominant_element` was the house element, so the machine-built one-letter mutation forms
+ * were built from it — and because those mutations are ordinary short words they pull every mark
+ * containing them across four registers. Two such queries put 1,154 records into a 2,146-record band,
+ * 54% of it, reachable from nothing else. The reviewing lawyer's method for the same matter was three
+ * searches: the whole phrase, the shorter phrase, the last word alone.
+ *
+ * WHAT IS NOT DONE HERE, AND IT IS THE POINT. This does not decide that the client owns the element —
+ * it is called only where the driver has already verified ownership on the register by owner and written
+ * its receipt. A `house` argument that arrived from a model's assertion would be an element nobody
+ * searched because a model said it was safe.
+ *
+ * THE WHOLE PHRASE SURVIVES, and that is the lawyer's method rather than a softening of it. `mark` is
+ * untouched, so the exact search for the full phrase still runs. What stops is treating the house
+ * element as an AXIS — its mutations, its forms, its own dominant-element sweep — because that is where
+ * the band came from, not from the one exact query.
+ *
+ * Returns `{ manifest, confirmation, refused }`. `refused` non-null means the exclusion was NOT applied
+ * and the returned manifest is the input: the caller plans as it would have with no receipt at all.
+ */
+export function excludeHouseElement(manifest, house) {
+  const element = String(house?.element ?? "").trim();
+  const remainder = String(house?.remainder ?? "").trim();
+  const keep = (why) => ({ manifest, confirmation: null, refused: why });
+  if (!element || !remainder) return keep("house_element_incomplete");
+
+  const words = remainder.split(/\s+/).filter(Boolean);
+  // ── THE FLOOR IS THE JOIN TO THIS MANIFEST'S OWN MARK ───────────────────────────────────────────
+  //
+  // The direction that reaches a client is naming too MUCH as the house element: ownership verifies
+  // perfectly, nothing distinctive is left, and no count downstream catches it because "queries on the
+  // house element: 0" is satisfied by a plan holding no queries at all. The frame refuses the shapes it
+  // can see — an empty remainder, a remainder equal to the element, an element containing it.
+  //
+  // WHAT THE FRAME CANNOT SEE IS THIS MARK. The proposal is made against the matter, the exclusion is
+  // applied against a compiled manifest, and nothing until here has joined the two. A remainder that is
+  // not part of the mark being planned means the receipt and the manifest are describing different
+  // things — a re-frame, a second ratified form, a resumed run whose manifest moved — and cutting the
+  // dominant element down to a word that is not in the mark would leave the plan searching something
+  // the client never applied for. So the exclusion applies only where both halves are in the mark.
+  const lcMark = String(manifest?.mark ?? "").toLowerCase();
+  if (!lcMark) return keep("house_element_no_mark_to_join");
+  if (!lcMark.includes(remainder.toLowerCase())) return keep("house_element_remainder_not_in_mark");
+  if (!lcMark.includes(element.toLowerCase())) return keep("house_element_not_in_mark");
+
+  const lcEl = element.toLowerCase();
+  const lcWords = words.map((w) => w.toLowerCase());
+  // A word of the remainder, by word boundary rather than by containment: `includes` would count the
+  // remainder word "on" inside an unrelated mutation and keep a query this exists to drop.
+  const namesRemainder = (v) => {
+    const t = String(v ?? "").toLowerCase();
+    return lcWords.some((w) => new RegExp(`(^|[^\\p{L}\\p{N}])${w.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}([^\\p{L}\\p{N}]|$)`, "u").test(t));
+  };
+
+  // THE DOMINANT WORD OF THE REMAINDER: longest, ties broken by the LAST of them. The lawyer's own
+  // phrasing was "the last word alone", and on the matter that produced this the two agree; longest is
+  // the better rule where they do not, because a trailing article is last and carries nothing.
+  let dominant = words[0];
+  for (const w of words) if (w.length >= dominant.length) dominant = w;
+
+  const variants = (Array.isArray(manifest?.variants) ? manifest.variants : []).filter((v) => namesRemainder(v?.value));
+  const next = {
+    ...manifest,
+    // UNTOUCHED: the exact search for the full phrase is the first of the lawyer's three.
+    mark: manifest?.mark,
+    dominant_element: dominant,
+    elements: (Array.isArray(manifest?.elements) ? manifest.elements : []).filter((e) => String(e?.value ?? "").trim().toLowerCase() !== lcEl),
+    // The shorter phrase is the second of the three, and it has to be PUSHED: with `dominant_element`
+    // now a single word and `mark` the full phrase, nothing else in the compile would search the
+    // remainder as a phrase on its own.
+    // `exact-phrase` because that is what it is, and because the category vocabulary is CLOSED —
+    // `parseVariantManifestModel` refuses anything outside it, so a descriptive category invented here
+    // would fail the manifest on its way into the compile.
+    variants: [{ category: "exact-phrase", value: remainder,
+      rationale: "the distinctive remainder once the client's own registered element is set aside" },
+      ...variants],
+  };
+  // REQUIREMENT 3: the element is still checked ONCE, as a confirmation of the client's own live
+  // registrations rather than as a conflict search — so the exclusion is evidenced on the report by a
+  // query that ran, not by a sentence saying one would have.
+  const confirmation = { axis: "incumbent-class", predicate: "owner", term: element,
+    expected_kind: "enumerate", provenance: "mark", house_element_confirmation: true };
+  return { manifest: next, confirmation, refused: null };
+}
+
+export function compileRegisterPlan({ manifest, job, form = null, skillVersion = "", capabilities = null, unavailableOffices = [], houseElement = null }) {
+  // ── AN EXCLUDED ELEMENT'S FORM BAND MUST BE UNREACHABLE, NOT MERELY UNASKED-FOR ─────────────────
+  //
+  // THE DEFECT THIS CLOSES, found by following the seam rather than by a failing arm. `bandFor` falls
+  // back to `elements[0]` when it cannot find the element it was asked for. The house-element exclusion
+  // changes `dominant_element` to the remainder's dominant word — a word the form neighbourhood, derived
+  // earlier from the original manifest, may carry no band for. The lookup would then MISS and the
+  // fallback would hand back the first element's band, which is the house element's: the exclusion would
+  // appear to work, `dominant_element` would read correctly on the plan, and the one-letter mutation
+  // floor of the very element being excluded would compile anyway. Silently, and it is the whole flood.
+  //
+  // So the element is removed from the form document here, where every `bandFor` call in this compile
+  // reads it. Unreachable beats un-asked-for: a fallback cannot select what is not there.
+  if (houseElement && form?.elements) {
+    const lcHouse = String(houseElement).trim().toLowerCase();
+    const kept = form.elements.filter((e) => String(e?.element ?? "").trim().toLowerCase() !== lcHouse);
+    form = { ...form, elements: kept };
+  }
   const classes = (job?.classes ?? []).map(String).filter(Boolean);
   if (!classes.length) throw new Error("register_plan_classes_missing: a plan is always class-scoped — compile with the matter's in-scope Nice classes");
   const caps = capabilities ?? null;
@@ -792,7 +979,7 @@ export function compileRegisterPlan({ manifest, job, form = null, skillVersion =
   // visible from the definition rather than inferred from an absence.
   const STRIPPED_CATEGORIES = new Set(["phonetic", "transliteration", "visual"]);
   // — THE DOCTRINE'S OWN DISPATCH TABLE, NOW BINDABLE. The universal-categories table
-  // (prelim-variants SKILL.md) states the mode per tag: `exact-element` sweeps default, `plural-root`
+  // (clearance-variants SKILL.md) states the mode per tag: `exact-element` sweeps default, `plural-root`
   // is a root (the contains match is its whole purpose), and `formative-family` is "never exact-only".
   // Until the enum accepted these tags the mandate bound to nothing — measured: three root-shaped
   // strings dispatched exact, 4/2/4 records, the family they exist to reach retrieved zero times.

package/driver/registry-fidelity.mjs

@@ -15,7 +15,7 @@
 // ordering, and renewal/expiry cycle arithmetic (renewals fall at year 10/20/… from registration — the
 // check that catches "registration 2013 … renewed 2025" from the document alone).
 
-import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, openSync, readSync, closeSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, openSync, readSync, closeSync } from "node:fs"; import { runPrefixSpellings } from "../shared/pre-rename-spellings.mjs";
 import { join } from "node:path";
 import { driverDir, ensureDriverDir } from "../shared/driver-dir.mjs";   // — one definition of where `_driver/` is
 import { ledgerPath, runRecordLogPath, ledgerDeprecationNotice, retiredGlobalRecordLogNotice }
@@ -34,8 +34,8 @@ function stripGatewayNs(s) {
   return typeof s === "string" ? s.replace(/^agent:[^:]+:/, "") : "";
 }
 function rowMatchesRun(row, runPrefix) {
-  return stripGatewayNs(row.sessionKey).startsWith(runPrefix)
-      || stripGatewayNs(row.sessionId ?? "").startsWith(runPrefix);
+  return runPrefixSpellings(runPrefix).some((rp) => stripGatewayNs(row.sessionKey).startsWith(rp)
+      || stripGatewayNs(row.sessionId ?? "").startsWith(rp));   // either spelling: a run resumed across the rename
 }
 
 

package/driver/repair-composers.mjs

@@ -586,7 +586,7 @@ export const REPAIR_COMPOSERS = [
     //
     // `samplesForStage` IS REQUIRED, and for the reason `*:lint-repair`'s note above gives rather than the
     // one it looks like: a `stage: "*"` composer is walked for EVERY recording stage, so the fixed sample's
-    // `record_frame_diff` is read as an order handed to blind-frame, matter-frame, prelim-variants,
+    // `record_frame_diff` is read as an order handed to blind-frame, matter-frame, clearance-variants,
     // report-overview, report-card and doubt-closure — six ordered-but-not-granted findings that are
     // artifacts of the SAMPLE, not of the tree. At dispatch the tool is always the walking stage's own,
     // because it is derived from `out`. Removing this hook reproduces all six.

package/driver/repair-contract.mjs

@@ -116,7 +116,7 @@ export function failingTarget(lastFail, files = []) {
   if (!named) return null;
   const list = (Array.isArray(files) ? files : [files]).filter(Boolean).map(String);
   if (list.length <= 1) return list[0] ?? null;
-  // longest suffix match wins: "x/register-findings.md" identifies ".../prelim-search/x/register-findings.md"
+  // longest suffix match wins: "x/register-findings.md" identifies ".../clearance-search/x/register-findings.md"
   const hit = list.find((f) => f === named || f.endsWith(`/${named}`) || named.endsWith(`/${f}`));
   return hit ?? null;
 }

package/driver/replay-archive.mjs

@@ -22,14 +22,14 @@
 // an INTENDED fix (then --update on the merged result).
 //
 // Env: CLEAROTRON_REPLAY_ROOTS  colon-separated corpus roots
-//        (default: <workspaceRoot>/workspace-*/studio/prelim-search — live slugs + archive/)
-//      CLEAROTRON_REPLAY_SNAPSHOT  snapshot path (default: ~/.prelim-replay-snapshot.json)
+//        (default: <workspaceRoot>/workspace-*/studio/clearance-search — live slugs + archive/)
+//      CLEAROTRON_REPLAY_SNAPSHOT  snapshot path (default: ~/.clearance-replay-snapshot.json)
 
 import "../shared/env-local.mjs";   // — FIRST: the CLEAROTRON_* translation must land before any
                                      // module-top capture below it evaluates. A call in this file's BODY
                                      // would run too late — that was the repair that left this open.
 import { readFileSync, writeFileSync, readdirSync, existsSync, statSync } from "node:fs";
-import { join, basename } from "node:path";
+import { join, basename } from "node:path"; import { studioDirFor } from "../shared/pre-rename-spellings.mjs";
 import { DRIVER_DIR, driverDir } from "../shared/driver-dir.mjs";   //
 import { homedir } from "node:os";
 import { validators } from "./verify.mjs";
@@ -62,7 +62,7 @@ function looksLikeRunDir(p) {
   return n.includes(DRIVER_DIR) || n.some((f) => FILE_CHECKS[f]);
 }
 
-// Corpus roots → sorted run dirs. Layout per root (a workspace's studio/prelim-search):
+// Corpus roots → sorted run dirs. Layout per root (a workspace's studio/clearance-search):
 //   <slug>/<date>-<codename>/                      (live slugs)
 //   archive/<YYYY-MM>/<slug>/<date>-<codename>/    (archived)
 export function discoverRuns(roots) {
@@ -219,12 +219,12 @@ function main() {
   const args = new Set(process.argv.slice(2));
   // ON-DISK NAME, NOT A PRODUCT NAME: an install that never set the variable already has this file, so
   // renaming the default points the reader at one that does not exist. Ruling.
-  const snapshotPath = process.env.CLEAROTRON_REPLAY_SNAPSHOT || join(homedir(), ".prelim-replay-snapshot.json");
+  const snapshotPath = process.env.CLEAROTRON_REPLAY_SNAPSHOT || [join(homedir(), ".prelim-replay-snapshot.json"), join(homedir(), ".clearance-replay-snapshot.json")].find((f, i) => i === 1 || existsSync(f));   // the file the install already has wins
   const roots = process.env.CLEAROTRON_REPLAY_ROOTS
     ? process.env.CLEAROTRON_REPLAY_ROOTS.split(":").filter(Boolean)
     : names(config.workspaceRoot)
         .filter((d) => config.agentIdFromWorkspaceName(d) != null)
-        .map((d) => join(config.workspaceRoot, d, "studio", "prelim-search"));
+        .map((d) => studioDirFor(join(config.workspaceRoot, d)));
 
   const runDirs = discoverRuns(roots);
   if (!runDirs.length) {

package/driver/report-overview-record.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // report-overview-record.mjs — the recording transport for the report shell.
 //
-// Conversion 4, after blind-frame, skeptic, frame-diff, matter-frame and prelim-variants
+// Conversion 4, after blind-frame, skeptic, frame-diff, matter-frame and clearance-variants
 //. It is the FIRST conversion whose artifact a client reads. report-overview.md is not an internal
 // input that a later stage consumes — it is the front-matter and the Actions section of the delivered
 // report, so a render defect here reaches a lawyer's desk rather than a test log.
@@ -181,7 +181,7 @@ export function renderReportOverview(model, identity) {
   const id = identity ?? {};
   const fm = [
     "---",
-    "type: prelim-clearance",
+    "type: clearance-clearance",
     id.matter ? `matter: ${id.matter}` : "",
     id.title ? `title: ${id.title}` : "",
     id.client ? `client: ${id.client}` : "",

package/driver/result-noun-fields.mjs

@@ -81,8 +81,8 @@ export const RESULT_NOUN_FIELDS = Object.freeze([
       + "is the fact the disclosure downstream depends on" },
   { file: "driver/pipeline.mjs", noun: "settled", sites: 5, atWriteSite: 4, verdict: "result",
     why: "counts off the union and the doubt ledger" },
-  { file: "driver/pipeline.mjs", noun: "verified", sites: 3, atWriteSite: 1, verdict: "result",
-    why: "`rows.filter(r => r.verified).length`, where each row's flag is `srRecords.has(senior.uri)` — a lookup, not a call" },
+  { file: "driver/pipeline.mjs", noun: "verified", sites: 4, atWriteSite: 2, verdict: "result",
+    why: "two sites, both measured states rather than calls returning. (1) `rows.filter(r => r.verified).length`, where each row's flag is `srRecords.has(senior.uri)` — a lookup, not a call. (2) the house-element ownership row's `verified: receipt.verified`, which the verifier sets only where a returned register record matched the client's own name AND was live AND carried an instructed class; the lookup CALL returning is a separate field on the same receipt (`reason`), and an unanswered lookup writes this false" },
   { file: "driver/repairs.mjs", noun: "closed", sites: 2, atWriteSite: 1, verdict: "result",
     why: "`effect.closed`, measured against `effect.asked`" },
   { file: "driver/repairs.mjs", noun: "outcome", sites: 1, atWriteSite: 1, verdict: "result",

package/driver/run-economics.mjs

@@ -14,11 +14,14 @@
 // the provider's four separately-priced token kinds.)
 //
 // ── WHAT A "DISPATCH" IS ──────────────────────────────────────────────────────────────────────────
-// One model invocation: one row in `_driver/<stage>.jsonl` carrying a `model` (gateway.mjs writes one
-// per ATTEMPT, so retries are separate dispatches and retry waste is counted, not averaged away). The
-// direct-API jx lanes bypass the gateway and write `_driver/jx-completions.jsonl` in the same
-// {model, usage} shape; they are dispatches too, under stage `jx-completions`. `run.jsonl` is skipped
-// (run events, not dispatches) — same file selection as tokens.mjs, deliberately.
+// One model invocation: one row in `_driver/<stage>.jsonl` that tokens.mjs's `isAttemptRow` counts as
+// a provider attempt (gateway.mjs writes one per ATTEMPT, so retries are separate dispatches and retry
+// waste is counted, not averaged away). The direct-API jx lanes bypass the gateway and write
+// `_driver/jx-completions.jsonl` in the same {model, usage} shape; they are dispatches too, under stage
+// `jx-completions`. `run.jsonl` is skipped (run events, not dispatches) — same file selection as
+// tokens.mjs, deliberately, and the SAME ROW TEST as tokens.mjs, imported rather than copied: a jx row
+// whose turn ran and named no model carries no `model`, only `modelActual: null`, and a census that still
+// asked for a `model` counted no dispatch and no tokens for a turn the token rollup counted with both.
 //
 // ── ZERO SEMANTICS: THE THING THIS MODULE EXISTS TO GET RIGHT ─────────────────────────────────────
 // tokens.mjs sums `usage` with `u.output || 0`, so a dispatch whose usage is null contributes zero AND
@@ -32,7 +35,7 @@
 //   measured   — the dispatch journalled a usage object (from the provider's own result envelope)
 //   streamed   — usage present but RECONSTRUCTED from the stream (`signals.usageStreamed`), because the
 //                turn died before its result event. A real measurement, a weaker one, counted apart.
-//   unmeasured — the row is a dispatch (it has a model) and carries no usage at all. THE KILLED TURNS.
+//   unmeasured — the row is a dispatch and carries no usage at all. THE KILLED TURNS.
 // `tokensComplete` is false whenever `unmeasured > 0`, at run level and per stage, and
 // `unmeasuredDispatches[]` names which ones so a reader can see what the total is missing.
 //
@@ -92,14 +95,18 @@
 // so a per-record basis is the only honest shape. `tokens.mjs` keys its rollup on the requested alias
 // for the same reason and is likewise untouched.
 //
-// Pure by contract: `runEconomics()` reads the run dir and nothing else — no env, no config, no network,
-// no driver imports. `stampRunEconomics()` is the only part that writes.
+// Pure by contract: `runEconomics()` reads the run dir and nothing else — no env, no config, no network.
+// Its only driver import is the attempt-row test it shares with tokens.mjs; the log and status writers
+// serve `stampRunEconomics()`, the only part that writes.
 
 import { readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { runLog, note } from "./log.mjs";
 import { writeRunStatus } from "./progress.mjs";
+// tokens.mjs imports this module too (isCodeSide, stampRunEconomics). The cycle is safe because each side
+// reads the other's bindings only inside functions, never while the module is loading.
+import { isAttemptRow } from "./tokens.mjs";
 
 /**
  * The provider's separately-priced token kinds, in the driver's own `usage` vocabulary (gateway.mjs /
@@ -178,7 +185,23 @@ function billingKeyOf(rec) {
   // is rather than dragged into "unknown" beside genuinely unstamped legacy rows.
   const engine = isCodeSide(rec) ? "code" : String(rec.engine ?? "unknown");
   const authMode = isCodeSide(rec) ? "not-provider-billed" : String(rec.authMode ?? "unknown");
-  const model = String(rec.modelUsed ?? rec.model ?? "unknown");
+  // A TURN THAT NAMED NO MODEL (a jx row with `modelActual: null` and no `model`) is keyed the way the
+  // token rollup keys it (modelKey in tokens.mjs): `<engine>/no-model-reported`, a name that says the
+  // model is missing. Read through the old `?? "unknown"` it landed beside legacy rows nobody stamped,
+  // and its byBilling bucket named a different model from the rollup's byModel for the same turn.
+  //
+  // A COPY OF modelKey's RULE, NOT A SHARED ONE: tokens.mjs does not export it. So the test for "no stamp"
+  // is modelKey's own, a non-empty string `modelUsed`, and not `modelUsed == null`: under that looser test
+  // a row stamped `modelUsed: ""` keyed its bucket as the empty string while the rollup keyed the same
+  // turn `<engine>/no-model-reported`. Two copies of one rule drifting apart is how the census and the
+  // rollup came to disagree about what an attempt is, so the tests hold these two copies to each other on
+  // the rows the engine writes. They still part on a row no writer produces: no model and no engine, or
+  // engine `anthropic-agent`. This key names the missing model there, while modelKey resolves the absent
+  // model through the catalog before it asks whether one exists, and buckets the row as `undefined`.
+  const stamped = typeof rec.modelUsed === "string" && rec.modelUsed;
+  const model = !stamped && typeof rec.model !== "string"
+    ? `${typeof rec.engine === "string" && rec.engine ? rec.engine : "unknown"}/no-model-reported`
+    : String(rec.modelUsed ?? rec.model ?? "unknown");
   return { engine, authMode, model, key: `${engine}|${authMode}|${model}` };
 }
 
@@ -223,11 +246,19 @@ function foldBilling(bucketMap, rec, cls) {
 // future engine whose name began that way, which is how a vendor claim becomes a guess. An engine this
 // table does not know is reported BY NAME and blocks the single-vendor claim, because "I do not know who
 // billed this" and "one vendor" are different answers and only one of them is safe to print.
+//
+// THE NATIVE-LANGUAGE ROWS STAMP THE VENDOR ITSELF. jxBillingStamp (jx-lanes.mjs) writes as the row's
+// engine the provider the engine door resolved, `anthropic` or `openai` (engine/auth.mjs), so those two
+// names are engines this table must place. Without them an Anthropic-only run with a native-language turn
+// named `anthropic` as an engine that bills to no vendor, in the same sentence that named anthropic as its
+// one vendor. Two exact names, still a closed table.
 export const ENGINE_VENDORS = Object.freeze({
   "anthropic-agent": "anthropic",
   "anthropic-direct": "anthropic",
   "anthropic-completions": "anthropic",
   "openai-agent": "openai",
+  "anthropic": "anthropic",
+  "openai": "openai",
 });
 /** The vendor an engine bills to, or null when the table does not name one. */
 export const vendorOf = (engine) => ENGINE_VENDORS[String(engine ?? "")] ?? null;
@@ -469,7 +500,7 @@ export function runEconomics(runDir, { now = null, bytesPerOutputToken = BYTES_P
     let sawDeclaredNoOutput = false;
 
     for (const rec of rows) {
-      if (!rec || typeof rec.model !== "string") continue;   // only dispatch rows carry a model
+      if (!isAttemptRow(rec)) continue;   // only provider attempts are dispatches (tokens.mjs, isAttemptRow)
       const cls = classesOf(rec.usage);
       const streamed = cls != null && rec.signals?.usageStreamed === true;