clearotron 0.3.3 → 0.4.0-beta.1

package/driver/suite-census.json

@@ -101,7 +101,7 @@
         },
         "a-capability-gap-is-not-reopened.pipeline.test.mjs": {
           "tests": 1,
-          "asserts": 6,
+          "asserts": 8,
           "skips": 0,
           "todos": 0
         },
@@ -130,8 +130,8 @@
           "todos": 0
         },
         "a-change-a-reader-can-see-arrives-with-something-to-read.test.mjs": {
-          "tests": 23,
-          "asserts": 55,
+          "tests": 32,
+          "asserts": 82,
           "skips": 1,
           "todos": 0
         },
@@ -142,8 +142,8 @@
           "todos": 0
         },
         "a-check-that-could-not-look-does-not-report-a-drift.test.mjs": {
-          "tests": 10,
-          "asserts": 26,
+          "tests": 13,
+          "asserts": 37,
           "skips": 0,
           "todos": 0
         },
@@ -159,6 +159,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-clarivate-run-asks-each-question-and-fetches-each-record-once.test.mjs": {
+          "tests": 10,
+          "asserts": 28,
+          "skips": 0,
+          "todos": 0
+        },
         "a-class-the-client-reaches-is-added-and-costs-one-question.test.mjs": {
           "tests": 5,
           "asserts": 17,
@@ -220,8 +226,14 @@
           "todos": 0
         },
         "a-company-created-in-the-browser-is-a-whole-company.test.mjs": {
-          "tests": 11,
-          "asserts": 61,
+          "tests": 14,
+          "asserts": 75,
+          "skips": 0,
+          "todos": 0
+        },
+        "a-company-with-no-marketplaces-is-described-as-searched.test.mjs": {
+          "tests": 2,
+          "asserts": 4,
           "skips": 0,
           "todos": 0
         },
@@ -459,6 +471,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-follow-up-re-runs-only-what-is-missing.test.mjs": {
+          "tests": 4,
+          "asserts": 9,
+          "skips": 0,
+          "todos": 0
+        },
         "a-full-country-card-keeps-what-the-multi-country-card-shows.test.mjs": {
           "tests": 2,
           "asserts": 12,
@@ -561,6 +579,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-knockout-whose-counts-all-fail-pays-for-no-owner-lookup.test.mjs": {
+          "tests": 3,
+          "asserts": 12,
+          "skips": 0,
+          "todos": 0
+        },
         "a-link-in-the-workbook-is-not-banned-vocabulary.test.mjs": {
           "tests": 2,
           "asserts": 5,
@@ -621,6 +645,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-mixed-alphabet-look-alike-is-not-sent-where-the-register-drops-its-letters.test.mjs": {
+          "tests": 10,
+          "asserts": 45,
+          "skips": 0,
+          "todos": 0
+        },
         "a-model-of-the-current-generation-is-named-in-every-spelling.test.mjs": {
           "tests": 4,
           "asserts": 13,
@@ -659,10 +689,16 @@
         },
         "a-new-install-signs-in-with-its-own-passphrase.test.mjs": {
           "tests": 10,
-          "asserts": 57,
+          "asserts": 58,
           "skips": 1,
           "todos": 0
         },
+        "a-new-run-folder-is-closed-to-other-accounts.test.mjs": {
+          "tests": 5,
+          "asserts": 9,
+          "skips": 5,
+          "todos": 0
+        },
         "a-next-step-the-model-writes-comes-off-at-publish.test.mjs": {
           "tests": 12,
           "asserts": 28,
@@ -789,6 +825,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-range-deprecation-takes-exactly-the-named-versions.test.mjs": {
+          "tests": 7,
+          "asserts": 17,
+          "skips": 0,
+          "todos": 0
+        },
         "a-read-the-engine-could-not-answer-names-the-check.test.mjs": {
           "tests": 4,
           "asserts": 14,
@@ -915,6 +957,18 @@
           "skips": 0,
           "todos": 0
         },
+        "a-rehearsal-dry-runs-the-version-a-cut-would-publish.test.mjs": {
+          "tests": 10,
+          "asserts": 41,
+          "skips": 0,
+          "todos": 0
+        },
+        "a-release-carries-its-parts-list.test.mjs": {
+          "tests": 5,
+          "asserts": 27,
+          "skips": 0,
+          "todos": 0
+        },
         "a-release-is-announced-only-once-a-stranger-can-install-it.test.mjs": {
           "tests": 8,
           "asserts": 19,
@@ -957,6 +1011,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-run-asks-signa-each-question-once.test.mjs": {
+          "tests": 18,
+          "asserts": 83,
+          "skips": 0,
+          "todos": 0
+        },
         "a-run-records-the-tier-it-asked-for.test.mjs": {
           "tests": 5,
           "asserts": 18,
@@ -1077,6 +1137,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-state-change-from-another-site-is-refused.test.mjs": {
+          "tests": 15,
+          "asserts": 70,
+          "skips": 0,
+          "todos": 0
+        },
         "a-stop-is-read-once-more-before-anything-is-published.test.mjs": {
           "tests": 4,
           "asserts": 12,
@@ -1197,6 +1263,12 @@
           "skips": 2,
           "todos": 0
         },
+        "a-version-npm-is-still-validating-gets-its-entry-once-served.test.mjs": {
+          "tests": 20,
+          "asserts": 72,
+          "skips": 0,
+          "todos": 0
+        },
         "a-visible-line-is-written-for-the-client.test.mjs": {
           "tests": 11,
           "asserts": 24,
@@ -1323,6 +1395,12 @@
           "skips": 0,
           "todos": 0
         },
+        "an-audit-lists-only-its-own-companys-recall-checks.test.mjs": {
+          "tests": 4,
+          "asserts": 11,
+          "skips": 0,
+          "todos": 0
+        },
         "an-empty-config-store-overrides-nothing.test.mjs": {
           "tests": 5,
           "asserts": 29,
@@ -1708,8 +1786,8 @@
           "todos": 0
         },
         "client-door.test.mjs": {
-          "tests": 39,
-          "asserts": 168,
+          "tests": 40,
+          "asserts": 173,
           "skips": 1,
           "todos": 0
         },
@@ -1725,6 +1803,12 @@
           "skips": 0,
           "todos": 0
         },
+        "closing-the-terminal-stops-what-start-started.test.mjs": {
+          "tests": 2,
+          "asserts": 6,
+          "skips": 1,
+          "todos": 0
+        },
         "cn-scope-honesty.test.mjs": {
           "tests": 22,
           "asserts": 96,
@@ -2759,7 +2843,7 @@
         },
         "flag-snapshot.test.mjs": {
           "tests": 24,
-          "asserts": 82,
+          "asserts": 81,
           "skips": 0,
           "todos": 0
         },
@@ -3395,7 +3479,7 @@
         },
         "park-tells-the-truth.test.mjs": {
           "tests": 8,
-          "asserts": 20,
+          "asserts": 19,
           "skips": 0,
           "todos": 0
         },
@@ -3430,8 +3514,8 @@
           "todos": 0
         },
         "pipeline.mock.registergap.test.mjs": {
-          "tests": 6,
-          "asserts": 34,
+          "tests": 7,
+          "asserts": 43,
           "skips": 0,
           "todos": 0
         },
@@ -3442,8 +3526,8 @@
           "todos": 0
         },
         "pipeline.mock.test.mjs": {
-          "tests": 99,
-          "asserts": 827,
+          "tests": 103,
+          "asserts": 853,
           "skips": 0,
           "todos": 0
         },
@@ -3580,8 +3664,8 @@
           "todos": 0
         },
         "portal-service.test.mjs": {
-          "tests": 131,
-          "asserts": 712,
+          "tests": 132,
+          "asserts": 715,
           "skips": 1,
           "todos": 0
         },
@@ -3688,8 +3772,8 @@
           "todos": 0
         },
         "profiles.test.mjs": {
-          "tests": 48,
-          "asserts": 263,
+          "tests": 49,
+          "asserts": 272,
           "skips": 0,
           "todos": 0
         },
@@ -3959,7 +4043,7 @@
         },
         "register-capabilities.test.mjs": {
           "tests": 34,
-          "asserts": 268,
+          "asserts": 272,
           "skips": 0,
           "todos": 0
         },
@@ -4078,8 +4162,8 @@
           "todos": 0
         },
         "release-pipeline.test.mjs": {
-          "tests": 121,
-          "asserts": 456,
+          "tests": 123,
+          "asserts": 467,
           "skips": 0,
           "todos": 0
         },
@@ -4102,8 +4186,8 @@
           "todos": 0
         },
         "render.test.mjs": {
-          "tests": 162,
-          "asserts": 675,
+          "tests": 163,
+          "asserts": 681,
           "skips": 0,
           "todos": 0
         },
@@ -4276,8 +4360,8 @@
           "todos": 0
         },
         "run-economics.test.mjs": {
-          "tests": 25,
-          "asserts": 158,
+          "tests": 26,
+          "asserts": 161,
           "skips": 0,
           "todos": 0
         },
@@ -4379,7 +4463,7 @@
         },
         "runner.knockout-e2e.test.mjs": {
           "tests": 3,
-          "asserts": 115,
+          "asserts": 118,
           "skips": 0,
           "todos": 0
         },
@@ -5380,8 +5464,8 @@
           "todos": 0
         },
         "the-people-page-can-change-and-remove-a-person.test.mjs": {
-          "tests": 16,
-          "asserts": 80,
+          "tests": 17,
+          "asserts": 85,
           "skips": 0,
           "todos": 0
         },
@@ -5483,7 +5567,7 @@
         },
         "the-record-half-of-an-add-must-reach-git.test.mjs": {
           "tests": 11,
-          "asserts": 39,
+          "asserts": 40,
           "skips": 0,
           "todos": 0
         },
@@ -5609,7 +5693,7 @@
         },
         "the-seats-attestation-decides-the-use-source.test.mjs": {
           "tests": 5,
-          "asserts": 9,
+          "asserts": 10,
           "skips": 0,
           "todos": 0
         },
@@ -5631,6 +5715,12 @@
           "skips": 0,
           "todos": 0
         },
+        "the-shipped-services-may-not-gain-privileges.test.mjs": {
+          "tests": 4,
+          "asserts": 7,
+          "skips": 0,
+          "todos": 0
+        },
         "the-short-surfaces-quote-the-report.test.mjs": {
           "tests": 3,
           "asserts": 9,
@@ -5927,7 +6017,7 @@
         },
         "update-writes-only-inside-the-checkout.test.mjs": {
           "tests": 8,
-          "asserts": 29,
+          "asserts": 30,
           "skips": 0,
           "todos": 0
         },
@@ -6134,6 +6224,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-tool-the-listing-hides-cannot-be-called-by-name.test.mjs": {
+          "tests": 4,
+          "asserts": 10,
+          "skips": 0,
+          "todos": 0
+        },
         "account-audit-chain.test.mjs": {
           "tests": 10,
           "asserts": 48,
@@ -6267,8 +6363,8 @@
           "todos": 0
         },
         "http-handler.test.mjs": {
-          "tests": 20,
-          "asserts": 47,
+          "tests": 23,
+          "asserts": 58,
           "skips": 0,
           "todos": 0
         },
@@ -6316,7 +6412,7 @@
         },
         "ops-token.test.mjs": {
           "tests": 8,
-          "asserts": 39,
+          "asserts": 41,
           "skips": 0,
           "todos": 0
         },
@@ -6345,8 +6441,8 @@
           "todos": 0
         },
         "portal-trigger-wire.test.mjs": {
-          "tests": 1,
-          "asserts": 7,
+          "tests": 2,
+          "asserts": 11,
           "skips": 0,
           "todos": 0
         },
@@ -6375,8 +6471,8 @@
           "todos": 0
         },
         "scope.test.mjs": {
-          "tests": 27,
-          "asserts": 114,
+          "tests": 30,
+          "asserts": 121,
           "skips": 0,
           "todos": 0
         },
@@ -6734,8 +6830,8 @@
           "todos": 0
         },
         "profileFields.test.ts": {
-          "tests": 54,
-          "asserts": 173,
+          "tests": 55,
+          "asserts": 178,
           "skips": 0,
           "todos": 0
         },

package/driver/systemd/clearotron-client-mcp.service

@@ -65,6 +65,30 @@ Environment=CLEAROTRON_NO_ENV_FILE=1
 # itself REFUSES to bind a non-loopback address in token-only mode, with the reason printed. A unit file
 # is the wrong place to enforce it, because it enforces it only until somebody edits the unit.
 ExecStart=/usr/bin/node ${CLEAROTRON_CHECKOUT_DIR}/mcp-server/http-server-client.mjs
+# ── WHAT THIS SERVICE MAY NOT DO ─────────────────────────────────────────────────────────────────────
+# Neither this service nor any program the engine starts under it needs to gain privileges, create a
+# set-user-ID or set-group-ID file, switch its execution domain, take real-time scheduling or make a
+# system call of another architecture. These five are what a user unit applies on a machine that refuses
+# unprivileged user namespaces. PrivateTmp, ProtectSystem and ProtectHome are skipped there without a
+# word, so they are not written here, where they would read as protection that is not in force.
+# Measured 2026-09-23 with all five set: the process reads NoNewPrivs 1 and Seccomp 2, a knockout on each
+# engine is delivered, and a report folder created inside a set-group-ID pool still inherits the bit,
+# because the kernel sets it from the parent and RestrictSUIDSGID refuses only a mode that asks for it.
+NoNewPrivileges=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+RestrictRealtime=yes
+SystemCallArchitectures=native
+#
+# ── WHAT THIS SERVICE CREATES IS CLOSED TO OTHER ACCOUNTS ─────────────────────────────────────────────
+# Every file and folder this service or the engine creates comes out with no access for accounts outside
+# its group: run records, known-conflicts, outbox packets, archive folders, and whatever a later writer
+# adds, without a mode at each write site. Group write is kept on purpose: a store shared by a group, as
+# a set-group-ID checkout that several accounts pull into, must stay writable by that group, and 0027
+# would make each new folder there closed to the others. Measured 2026-09-23 with 0027: a knockout was
+# delivered and its report served, every new folder 750 and file 640, and a saved search on a shared
+# checkout would have created a folder the group could no longer write into.
+UMask=0007
 Restart=on-failure
 RestartSec=10
 

package/driver/systemd/clearotron-mcp-face.service

@@ -23,6 +23,30 @@ EnvironmentFile=%h/.env
 Environment=PATH=%h/.local/bin:%h/.npm-global/bin:/usr/local/bin:/usr/bin:/bin
 Environment=CLEAROTRON_NO_ENV_FILE=1
 ExecStart=/usr/bin/node ${CLEAROTRON_CHECKOUT_DIR}/mcp-server/http-server.mjs
+# ── WHAT THIS SERVICE MAY NOT DO ─────────────────────────────────────────────────────────────────────
+# Neither this service nor any program the engine starts under it needs to gain privileges, create a
+# set-user-ID or set-group-ID file, switch its execution domain, take real-time scheduling or make a
+# system call of another architecture. These five are what a user unit applies on a machine that refuses
+# unprivileged user namespaces. PrivateTmp, ProtectSystem and ProtectHome are skipped there without a
+# word, so they are not written here, where they would read as protection that is not in force.
+# Measured 2026-09-23 with all five set: the process reads NoNewPrivs 1 and Seccomp 2, a knockout on each
+# engine is delivered, and a report folder created inside a set-group-ID pool still inherits the bit,
+# because the kernel sets it from the parent and RestrictSUIDSGID refuses only a mode that asks for it.
+NoNewPrivileges=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+RestrictRealtime=yes
+SystemCallArchitectures=native
+#
+# ── WHAT THIS SERVICE CREATES IS CLOSED TO OTHER ACCOUNTS ─────────────────────────────────────────────
+# Every file and folder this service or the engine creates comes out with no access for accounts outside
+# its group: run records, known-conflicts, outbox packets, archive folders, and whatever a later writer
+# adds, without a mode at each write site. Group write is kept on purpose: a store shared by a group, as
+# a set-group-ID checkout that several accounts pull into, must stay writable by that group, and 0027
+# would make each new folder there closed to the others. Measured 2026-09-23 with 0027: a knockout was
+# delivered and its report served, every new folder 750 and file 640, and a saved search on a shared
+# checkout would have created a folder the group could no longer write into.
+UMask=0007
 Restart=on-failure
 RestartSec=10
 

package/driver/systemd/clearotron-portal.service

@@ -74,6 +74,30 @@ ExecStart=/usr/bin/node ${CLEAROTRON_CHECKOUT_DIR}/driver/portal-service.mjs
 # So the worker unit writes it and this one does not. `clearotron-worker.service` carries the
 # ExecStartPost, and a run refreshes it after every drain — both of those are the engine, which is whose
 # posture the row claims to report.
+# ── WHAT THIS SERVICE MAY NOT DO ─────────────────────────────────────────────────────────────────────
+# Neither this service nor any program the engine starts under it needs to gain privileges, create a
+# set-user-ID or set-group-ID file, switch its execution domain, take real-time scheduling or make a
+# system call of another architecture. These five are what a user unit applies on a machine that refuses
+# unprivileged user namespaces. PrivateTmp, ProtectSystem and ProtectHome are skipped there without a
+# word, so they are not written here, where they would read as protection that is not in force.
+# Measured 2026-09-23 with all five set: the process reads NoNewPrivs 1 and Seccomp 2, a knockout on each
+# engine is delivered, and a report folder created inside a set-group-ID pool still inherits the bit,
+# because the kernel sets it from the parent and RestrictSUIDSGID refuses only a mode that asks for it.
+NoNewPrivileges=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+RestrictRealtime=yes
+SystemCallArchitectures=native
+#
+# ── WHAT THIS SERVICE CREATES IS CLOSED TO OTHER ACCOUNTS ─────────────────────────────────────────────
+# Every file and folder this service or the engine creates comes out with no access for accounts outside
+# its group: run records, known-conflicts, outbox packets, archive folders, and whatever a later writer
+# adds, without a mode at each write site. Group write is kept on purpose: a store shared by a group, as
+# a set-group-ID checkout that several accounts pull into, must stay writable by that group, and 0027
+# would make each new folder there closed to the others. Measured 2026-09-23 with 0027: a knockout was
+# delivered and its report served, every new folder 750 and file 640, and a saved search on a shared
+# checkout would have created a folder the group could no longer write into.
+UMask=0007
 Restart=on-failure
 RestartSec=10
 

package/driver/systemd/clearotron-worker.service

@@ -78,6 +78,30 @@ ExecStartPost=-/usr/bin/node ${CLEAROTRON_CHECKOUT_DIR}/driver/flag-snapshot.mjs
 # main(). Until the deploy path calls the refresh, this ExecStartPost starts working on test and prod when
 # somebody runs it, not when the code lands. Recorded here because the next person wondering why the
 # last-run row is stale will read this file first.
+# ── WHAT THIS SERVICE MAY NOT DO ─────────────────────────────────────────────────────────────────────
+# Neither this service nor any program the engine starts under it needs to gain privileges, create a
+# set-user-ID or set-group-ID file, switch its execution domain, take real-time scheduling or make a
+# system call of another architecture. These five are what a user unit applies on a machine that refuses
+# unprivileged user namespaces. PrivateTmp, ProtectSystem and ProtectHome are skipped there without a
+# word, so they are not written here, where they would read as protection that is not in force.
+# Measured 2026-09-23 with all five set: the process reads NoNewPrivs 1 and Seccomp 2, a knockout on each
+# engine is delivered, and a report folder created inside a set-group-ID pool still inherits the bit,
+# because the kernel sets it from the parent and RestrictSUIDSGID refuses only a mode that asks for it.
+NoNewPrivileges=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+RestrictRealtime=yes
+SystemCallArchitectures=native
+#
+# ── WHAT THIS SERVICE CREATES IS CLOSED TO OTHER ACCOUNTS ─────────────────────────────────────────────
+# Every file and folder this service or the engine creates comes out with no access for accounts outside
+# its group: run records, known-conflicts, outbox packets, archive folders, and whatever a later writer
+# adds, without a mode at each write site. Group write is kept on purpose: a store shared by a group, as
+# a set-group-ID checkout that several accounts pull into, must stay writable by that group, and 0027
+# would make each new folder there closed to the others. Measured 2026-09-23 with 0027: a knockout was
+# delivered and its report served, every new folder 750 and file 640, and a saved search on a shared
+# checkout would have created a folder the group could no longer write into.
+UMask=0007
 Restart=on-failure
 RestartSec=10
 

package/driver/tokens.mjs

@@ -6,13 +6,14 @@
 // Each stage writes one record PER ATTEMPT to _driver/<stage>.jsonl with {model, usage, ...} (gateway.mjs).
 // This sums token counts across EVERY attempt (so retry waste is included) directly from `usage` —
 //
-// …and across every DIRECT-API call too. The jx lanes do not go through the gateway (they are
-// non-agentic Messages calls) and write their own `_driver/jx-completions.jsonl`; until 2026-07-28 those
-// rows named their counts `tokens` and carried no `model`, so the model gate below dropped every one of
-// them and a whole lane's spend was counted NOWHERE. They now write {model, usage} like any other row.
-// The `byStage` split keys off the filename, so the direct-API share stays recoverable as
+// …and across every native-language call too. The jx lanes do not go through the gateway (each turn runs
+// through the engine's own runTurn, engine/jx-turn.mjs) and write their own `_driver/jx-completions.jsonl`;
+// until 2026-07-28 those rows named their counts `tokens` and carried no `model`, so the model gate below
+// dropped every one of them and a whole lane's spend was counted NOWHERE. They now write {model, usage}
+// like any other row.
+// The `byStage` split keys off the filename, so the native-language share stays recoverable as
 // `byStage["jx-completions"]` — worth knowing when reading `attempts`, which counts model invocations
-// (agent turns AND single API calls), not gateway retries alone.
+// (stage turns AND single native-language turns), not gateway retries alone.
 // self-contained, so it also works on historical runs (their rows may carry a legacy costUsd; it is
 // ignored, never re-emitted). The run-level event log (_driver/run.jsonl) is skipped (it holds runLog
 // events, not stage-attempt usage). Best-effort by contract: an unreadable dir / bad line never throws —
@@ -68,27 +69,35 @@ function emptyAcc() {
  * turn (`engine.resolveModelId ?? resolveModel`) and stamps the answer on the row as `modelUsed`. So
  * this reads the stamp rather than re-deriving it — one resolution, at the point that knows.
  */
-function modelKey(rec) {
+export function modelKey(rec) {
   if (typeof rec.modelUsed === "string" && rec.modelUsed) return rec.modelUsed;
 
   // NO STAMP. Two different situations, and guessing the same way for both is what caused the bug.
   const engine = typeof rec.engine === "string" ? rec.engine : "";
 
-  // Rows predating the stamp, and the direct-API jx lanes, are Anthropic — that was the only engine
-  // when they were written, and the jx lanes name a bare claude id that resolveModel exists to
-  // normalise. Resolving keeps every historical rollup keyed exactly as it was.
-  if (!engine || engine === "anthropic-agent") return resolveModel(rec.model);
+  // A TURN THAT NAMED NO MODEL, a native-language row recording `modelActual: null` (see isAttemptRow),
+  // has no id at all. Its tokens still account, under a key that says the model is missing rather than
+  // one built from the absent field. Asked FIRST, so no row keys as `undefined` because the catalog was
+  // handed nothing to resolve.
+  if (typeof rec.model !== "string") return `${engine || "unknown"}/no-model-reported`;
+
+  // Rows predating the stamp are Anthropic — that was the only engine when they were written — and
+  // resolving keeps every historical rollup keyed exactly as it was.
+  //
+  // A NATIVE-LANGUAGE ROW IS STAMPED WITH ITS VENDOR, NOT AN ENGINE (jxBillingStamp in jx-lanes.mjs), and
+  // its `model` is the id that served the turn. An Anthropic one is normalised through the catalog like
+  // any served Claude id, so it keys as `anthropic/claude-haiku-4-5`, apart from a stage's
+  // `anthropic/claude-haiku` — the split ruled on and accepted with recording the tier. It used to fall
+  // to the branch below and key as `anthropic/unstamped:<id>`, a name for a missing stamp on a row that
+  // carries one. An OpenAI one keys as its served id, which is what an openai-agent stage row carries.
+  if (!engine || engine === "anthropic-agent" || engine === "anthropic") return resolveModel(rec.model);
+  if (engine === "openai") return rec.model;
 
   // Any OTHER engine with no stamp. The tier is not a model id and this catalog is not that engine's,
   // so there is no honest id to key under. Name the gap instead: the tokens still account (dropping
   // them would break byModel summing to total, and an invisible gap is the failure this file already
   // fixed once for byEngine), and the key says what is missing rather than asserting an Anthropic
   // model produced them.
-  //
-  // A TURN THAT NAMED NO MODEL, a native-language row recording `modelActual: null` (see isAttemptRow),
-  // has no id at all. Its tokens still account, under a key that says the model is missing rather than
-  // one built from the absent field. Such a row always carries its vendor's stamp, so it reaches here.
-  if (typeof rec.model !== "string") return `${engine || "unknown"}/no-model-reported`;
   return `${engine}/unstamped:${rec.model}`;
 }
 
@@ -154,7 +163,7 @@ export function rollupTokens(runDir) {
       // (different tokenizers, different accounting). Rolled up per engine, these stay comparable to
       // themselves over time, which is what a margin question actually needs.
       //
-      // A row carrying no stamp — one predating it, or a direct-API lane like jx-completions — buckets as
+      // A row carrying no stamp — one written before the stamps existed, jx-completions rows included — buckets as
       // "unknown" rather than being dropped, so `byEngine` always sums to `total` and the unattributed
       // share is VISIBLE. Dropping it would make the gap look like it did not exist.
       //

package/driver/turnaround-bands.mjs

@@ -62,7 +62,7 @@ export const TURNAROUND_BANDS = Object.freeze({
   }),
   clearance: Object.freeze({
     minutes: 120,
-    source: "owner benchmark 2026-08-04, corrected 2026-08-08 (#523) after three scenarios were found carrying their own estimates instead",
+    source: "owner benchmark 2026-08-04, corrected 2026-08-08 after three scenarios were found carrying their own estimates instead",
   }),
 });