mixdog 0.9.166 → 0.9.167

package/src/runtime/shared/llm/cost.mjs

@@ -4,14 +4,15 @@
  * Pricing is pulled from the LiteLLM catalog (already warmed by providers/
  * agent bootstrap). All four token slots — input / output / cacheRead /
  * cacheWrite — are multiplied by their matching $/M rate from the catalog
- * and summed. Missing rates are treated as 0 (no extrapolation).
+ * and summed. A missing rate for a used token slot leaves the cost unknown.
  *
  * The catalog is looked up synchronously: if it has not been warmed yet
- * (fresh process, first call), this returns 0 without blocking. The next
+ * (fresh process, first call), this returns an unknown price. The next
  * call will pick up the cache.
  */
 
-import { getModelMetadataSync } from '../../agent/orchestrator/providers/model-catalog.mjs';
+import { getModelMetadataSync, resolveModelPricingIdentity } from '../../agent/orchestrator/providers/model-catalog.mjs';
+import { PRICING_RATE_KEYS, ratesForPrompt } from '../../agent/orchestrator/providers/model-pricing-rates.mjs';
 
 // OpenAI OAuth / OpenAI API / Gemini report `input_tokens` as the total prompt token
 // count *including* the cached portion (inclusive). Anthropic reports the
@@ -47,10 +48,29 @@ export function priceUsage(args) {
     const cached = n(args.cacheReadTokens);
     const written = n(args.cacheWriteTokens);
     const inclusive = args.inputTokensInclusive ?? isInclusiveProvider(args.provider);
-    const input = args.uncachedInputTokens != null ? n(args.uncachedInputTokens)
+    const input = args.inputTokensKnown === false ? 0 : args.uncachedInputTokens != null ? n(args.uncachedInputTokens)
         : inclusive ? Math.max(0, n(args.inputTokens) - cached - written) : n(args.inputTokens);
-    const meta = getModelMetadataSync(args.model, args.provider);
-    if (!meta) return { input, costUsd: null, rates: null };
+    const identity = resolveModelPricingIdentity(args.model, args.provider, args);
+    const meta = getModelMetadataSync(identity.pricingModel, args.provider);
+    const provenance = {
+        ...identity,
+        pricingProvider: meta?.pricingProvider || identity.pricingProvider,
+        pricingSource: meta?.pricingSource || null,
+        ...(args.inputTokensKnown === false ? { inputTokensKnown: false } : {}),
+        ...(args.fast ? { fast: true } : {}),
+        ...(args.serviceTier ? { serviceTier: args.serviceTier } : {}),
+    };
+    if (args.inputTokensKnown === false || !meta) return {
+        input, costUsd: null,
+        rates: { ...provenance, unpricedReason: args.inputTokensKnown === false ? 'unmeasured-input' : 'model-not-found' },
+    };
+    const promptTokens = input + cached + written;
+    if (args.historicalAggregate && (meta.pricingTiers?.some((tier) => promptTokens > tier.aboveInputTokens)
+        || (meta.longContextThreshold && promptTokens >= meta.longContextThreshold))) {
+        // A daily sum cannot establish which individual requests crossed a
+        // context boundary. Do not price the whole day as one huge prompt.
+        return { input, costUsd: null, rates: { ...provenance, unpricedReason: 'request-boundaries-unavailable' } };
+    }
     let multiplier = 1;
     if (meta.longContextThreshold && input + cached + written >= meta.longContextThreshold) {
         multiplier *= meta.longContextMultiplier || 1;
@@ -64,11 +84,16 @@ export function priceUsage(args) {
             && ((h >= 1 && h < 4) || (h >= 6 && h < 10));
         if (!peak) multiplier *= meta.offPeakMultiplier;
     }
-    if (args.model === 'claude-opus-4-8' && (args.fast || args.serviceTier === 'fast')) multiplier *= 2;
-    const keys = ['inputCostPerM', 'outputCostPerM', 'cacheReadCostPerM', 'cacheWriteCostPerM'];
+    if (identity.pricingModel === 'claude-opus-4-8' && (args.fast || args.serviceTier === 'fast')) multiplier *= 2;
+    const keys = PRICING_RATE_KEYS;
     const tokens = [input, n(args.outputTokens), cached, written];
-    const rates = Object.fromEntries(keys.map((key) => [key, meta[key] == null ? null : meta[key] * multiplier]));
-    if (tokens.some((amount, i) => amount > 0 && rates[keys[i]] === null)) {
+    const tierRates = ratesForPrompt(meta, promptTokens);
+    const rates = { ...provenance, ...Object.fromEntries(keys.map((key) =>
+        [key, tierRates[key] == null ? null : tierRates[key] * multiplier])) };
+    const missingRates = keys.filter((key, i) => tokens[i] > 0 && rates[key] === null);
+    if (missingRates.length) {
+        rates.unpricedReason = 'missing-rate';
+        rates.missingRates = missingRates;
         return { input, costUsd: null, rates };
     }
     const costUsd = tokens.reduce((sum, amount, i) => sum + amount * (rates[keys[i]] ?? 0), 0) / 1_000_000;

package/src/runtime/shared/llm/usage-accounting.mjs

@@ -1,5 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { getUsageLedger, makeUsageRecord } from './usage-ledger.mjs';
+import { withUsageContext } from './usage-context.mjs';
 
 /**
  * Runs at the common provider boundary, not inside optional diagnostic IO.
@@ -23,6 +24,8 @@ export async function accountProviderSend(provider, instance, send, model, opts
         const row = makeUsageRecord({
             id: result.responseId ? undefined : requestId,
             ts: Date.now(), provider, model: result.model || model,
+            requestedModel: model,
+            pricingModel: result.pricingModel,
             sessionId: opts.sessionId || opts.session?.id,
             sourceType: opts.session?.sourceType || opts.sourceType || opts.requestKind || '',
             inputTokens: usage.inputTokens,
@@ -47,7 +50,14 @@ export async function accountProviderSend(provider, instance, send, model, opts
         }
     };
     let result;
-    try { result = await send(); }
+    try {
+        result = await withUsageContext({
+            provider, requestedModel: model,
+            sessionId: opts.sessionId || opts.session?.id,
+            sourceType: opts.session?.sourceType || opts.sourceType || opts.requestKind || '',
+            inputTokensInclusive: instance.constructor?.inputExcludesCache !== true,
+        }, send);
+    }
     catch (error) {
         // Only provider-reported partial usage is recordable; never invent
         // tokens for a failed request or reinterpret an error as a success.

package/src/runtime/shared/llm/usage-context.mjs

@@ -0,0 +1,6 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+
+// The selected route owns accounting identity, not an inner transport adapter.
+const context = new AsyncLocalStorage();
+export const withUsageContext = (identity, send) => context.run(identity, send);
+export const currentUsageContext = () => context.getStore();

package/src/runtime/shared/llm/usage-ledger-import.mjs

@@ -29,6 +29,8 @@ export function importTraceRow(row) {
         : /^\d+$/.test(String(row.ts)) ? Number(row.ts) : Date.parse(row.ts);
     return makeUsageRecord({
         ts, provider, model: row.model,
+        requestedModel: row.requested_model || payload.requested_model,
+        pricingModel: row.pricing_model || payload.pricing_model,
         inputTokens: input, outputTokens: output,
         uncachedInputTokens: raw ? row.uncached_input_tokens ?? payload.uncached_input_tokens : undefined,
         cacheReadTokens: raw ? row.cached_tokens : row.cacheReadTokens,
@@ -61,6 +63,7 @@ export function repriceRestoredDays(original) {
                     uncachedInputTokens: bucket.input, outputTokens: bucket.output,
                     cacheReadTokens: bucket.cacheRead, cacheWriteTokens: bucket.cacheWrite,
                     historical: true,
+                    historicalAggregate: true,
                 });
                 bucket.costUsd = price.costUsd ?? 0;
                 bucket.costBilled = 0;
@@ -145,6 +148,8 @@ export async function readOriginalTrace(dataDir, until) {
             SELECT ts,kind,model,session_id,input_tokens,output_tokens,cached_tokens,cache_write_tokens,
                 duration_ms,jsonb_build_object(
                     'provider',payload->'provider',
+                    'requested_model',payload->'requested_model',
+                    'pricing_model',payload->'pricing_model',
                     'uncached_input_tokens',payload->'uncached_input_tokens',
                     'response_id',payload->'response_id',
                     'service_tier',payload->'service_tier',

package/src/runtime/shared/llm/usage-ledger-repair.mjs

@@ -0,0 +1,109 @@
+import { createHash } from 'node:crypto';
+import { mkdtempSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { DatabaseSync } from 'node:sqlite';
+import { priceUsage } from './cost.mjs';
+import { usageRouteKind } from './usage-ledger.mjs';
+import { normalizeUsageMeasurement } from './usage-measurement.mjs';
+
+// Excludes only the two fields a repair may change: route attribution and price.
+export function usageLedgerIntegrity(db) {
+    const hash = createHash('sha256');
+    let records = 0;
+    for (const row of db.prepare(`SELECT id,ts,day,session,input,output,cache_read,cache_write,duration_ms
+        FROM usage_events ORDER BY id`).iterate()) {
+        hash.update(JSON.stringify({ ...row, id: Buffer.from(row.id).toString('hex') }));
+        records++;
+    }
+    return { records, sha256: hash.digest('hex') };
+}
+
+/**
+ * Bounded correction. Automatic use can only revisit unpriced records and
+ * takes a coherent backup under the writer reservation before its first write.
+ * Provider overrides require operator evidence; unknown model aliases are NOT
+ * inferred. Existing known prices remain fixed unless the billing route changes.
+ */
+export function repairUsageLedger(ledger, {
+    throughTs, providerOverrides = {}, price = priceUsage, onlyUnpriced = false, backup = false,
+} = {}) {
+    if (!Number.isSafeInteger(throughTs) || throughTs <= 0) throw new Error('Repair requires an explicit timestamp bound');
+    for (const [from, to] of Object.entries(providerOverrides)) {
+        if (!from || typeof to !== 'string' || !to) throw new Error('Invalid provider correction');
+    }
+    if (onlyUnpriced && Object.keys(providerOverrides).length) throw new Error('Automatic repricing cannot change providers');
+    const db = ledger.db;
+    db.exec('BEGIN IMMEDIATE');
+    try {
+        const before = usageLedgerIntegrity(db);
+        const insertRoute = db.prepare('INSERT OR IGNORE INTO usage_routes(signature) VALUES (?)');
+        const findRoute = db.prepare('SELECT id FROM usage_routes WHERE signature=?');
+        const update = db.prepare('UPDATE usage_events SET route=?,cost_usd=? WHERE id=?');
+        const report = { reattributed: 0, repriced: 0, stillUnpriced: 0, changes: {} };
+        const changes = [];
+        const rows = db.prepare(`SELECT e.*,r.signature FROM usage_events e
+            JOIN usage_routes r ON r.id=e.route WHERE e.ts<=?
+            ${onlyUnpriced ? "AND e.cost_usd IS NULL AND json_extract(r.signature,'$[4]')='unpriced'" : ''}`).all(throughTs);
+        for (const row of rows) {
+            const signature = JSON.parse(row.signature);
+            const originalProvider = signature[0];
+            const provider = Object.hasOwn(providerOverrides, originalProvider)
+                ? providerOverrides[originalProvider] : originalProvider;
+            const moved = provider !== originalProvider;
+            const kind = moved ? usageRouteKind(provider) : signature[2];
+            let cost = row.cost_usd;
+            const oldRates = signature[5] ? JSON.parse(signature[5]) : null;
+            if (moved || signature[4] === 'unpriced') {
+                const priced = kind === 'local' ? { costUsd: 0, rates: null } : price({
+                    provider, model: signature[1], pricingModel: oldRates?.pricingModel,
+                    requestedModel: oldRates?.requestedModel,
+                    inputTokensKnown: oldRates?.inputTokensKnown === false
+                        || normalizeUsageMeasurement(provider, { turns: 1 }).unmeasuredTurns ? false : undefined,
+                    uncachedInputTokens: row.input, outputTokens: row.output,
+                    cacheReadTokens: row.cache_read, cacheWriteTokens: row.cache_write,
+                    fast: oldRates?.fast, serviceTier: oldRates?.serviceTier,
+                    ts: row.ts, historical: true,
+                });
+                cost = priced.costUsd;
+                if (cost !== null && (!Number.isFinite(cost) || cost < 0)) throw new Error('Invalid repair price');
+                signature[4] = kind === 'local' ? 'local' : cost === null ? 'unpriced'
+                    : kind === 'oauth' || kind === 'quota-api' ? 'subscription' : 'catalog';
+                signature[5] = priced.rates ? JSON.stringify(priced.rates) : null;
+                if (row.cost_usd === null && cost !== null) report.repriced++;
+            }
+            signature[0] = provider;
+            signature[2] = kind;
+            if (moved) report.reattributed++;
+            if (cost === null) report.stillUnpriced++;
+            const encoded = JSON.stringify(signature);
+            if (encoded === row.signature && cost === row.cost_usd) continue;
+            changes.push({ row, encoded, cost });
+            const key = `${originalProvider} → ${provider} / ${signature[1]}`;
+            report.changes[key] = (report.changes[key] || 0) + 1;
+        }
+        if (changes.length && backup && ledger.path !== ':memory:') {
+            const directory = mkdtempSync(join(dirname(ledger.path), 'pricing-backup-'));
+            report.backupPath = join(directory, 'ledger.sqlite');
+            const reader = new DatabaseSync(ledger.path, { readOnly: true });
+            try { reader.prepare('VACUUM INTO ?').run(report.backupPath); }
+            finally { reader.close(); }
+        }
+        for (const { row, encoded, cost } of changes) {
+            insertRoute.run(encoded);
+            update.run(findRoute.get(encoded).id, cost, row.id);
+        }
+        if (changes.length) ledger.rebuildIndexes();
+        const after = usageLedgerIntegrity(db);
+        if (before.records !== after.records || before.sha256 !== after.sha256) {
+            throw new Error('Repair changed immutable request records');
+        }
+        if (changes.length) ledger.set('lastUsageRepair', JSON.stringify({
+            at: Date.now(), throughTs, providerOverrides, ...report, integrity: after,
+        }));
+        db.exec('COMMIT');
+        return { ...report, integrity: after };
+    } catch (error) {
+        db.exec('ROLLBACK');
+        throw error;
+    }
+}

package/src/runtime/shared/llm/usage-ledger.mjs

@@ -162,9 +162,7 @@ export function makeUsageRecord(args) {
     const ts = Number(args.ts ?? Date.now());
     if (!Number.isSafeInteger(ts) || ts <= 0) throw new Error('Usage requires a valid timestamp');
     const kind = args.kind || usageRouteKind(provider);
-    const priced = args.inputTokensKnown === false
-        ? { input: 0, costUsd: null, rates: null }
-        : priceUsage({ ...args, provider, model, ts });
+    const priced = priceUsage({ ...args, provider, model, ts });
     const supplied = args.costUsd !== null && args.costUsd !== undefined && args.costUsd !== ''
         && Number.isFinite(Number(args.costUsd)) && Number(args.costUsd) >= 0;
     // OAuth/quota plans have value, not per-request invoices. A backend's
@@ -181,7 +179,10 @@ export function makeUsageRecord(args) {
         costUsd,
         costSource: kind === 'local' ? 'local' : costUsd === null ? 'unpriced'
             : subscription ? 'subscription' : reported ? 'provider' : 'catalog',
-        rates: reported ? null : priced.rates,
+        rates: reported || kind === 'local' ? {
+            requestedModel: priced.rates.requestedModel, pricingModel: priced.rates.pricingModel,
+            pricingProvider: provider, pricingSource: kind === 'local' ? 'local' : 'provider',
+        } : priced.rates,
         responseId: text(args.responseId),
         origin: args.origin || 'live',
         durationMs: number(args.durationMs),
@@ -192,6 +193,7 @@ export function makeUsageRecord(args) {
 
 export class UsageLedger {
     constructor(path) {
+        this.path = path;
         if (path !== ':memory:') mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
         this.db = new DatabaseSync(path);
         this.db.exec('PRAGMA busy_timeout=5000; PRAGMA journal_mode=WAL; PRAGMA synchronous=FULL; PRAGMA foreign_keys=ON;');
@@ -253,6 +255,27 @@ export class UsageLedger {
         this.db.prepare('INSERT OR IGNORE INTO metadata VALUES (?,?)').run('liveSince', String(ts));
     }
 
+    indexRecord(row, rank) {
+        const conversation = isConversationUsageSource(row.sourceType);
+        this.daily.run(row.day, rank, row.provider, row.model, row.kind, row.costSource,
+            Number(conversation), 1, row.input, row.output, row.cacheRead, row.cacheWrite,
+            row.costUsd ?? 0, row.durationMs, Number(row.origin !== 'live'));
+        if (conversation && row.sessionId) this.session.run(row.day, rank, row.sessionId,
+            row.input + row.output + row.cacheRead + row.cacheWrite);
+    }
+
+    // Caller owns the transaction; only derived indexes are rebuilt.
+    rebuildIndexes() {
+        this.db.exec('DELETE FROM daily; DELETE FROM day_sessions;');
+        for (const row of this.db.prepare('SELECT * FROM events').iterate()) {
+            this.indexRecord({
+                ...row, sourceType: row.source_type, sessionId: row.session_id,
+                costSource: row.cost_source, costUsd: row.cost_usd,
+                cacheRead: row.cache_read, cacheWrite: row.cache_write, durationMs: row.duration_ms,
+            }, row.rank);
+        }
+    }
+
     record(rows) {
         let inserted = 0;
         this.db.exec('BEGIN IMMEDIATE');
@@ -266,12 +289,7 @@ export class UsageLedger {
                     rates: row.rates ? JSON.stringify(row.rates) : null,
                     duration_ms: row.durationMs, rank,
                 })) continue;
-                const conversation = isConversationUsageSource(row.sourceType);
-                this.daily.run(row.day, rank, row.provider, row.model, row.kind, row.costSource,
-                    Number(conversation), 1, row.input, row.output, row.cacheRead, row.cacheWrite,
-                    row.costUsd ?? 0, row.durationMs, Number(row.origin !== 'live'));
-                if (conversation && row.sessionId) this.session.run(row.day, rank, row.sessionId,
-                    row.input + row.output + row.cacheRead + row.cacheWrite);
+                this.indexRecord(row, rank);
                 if (row.origin === 'live' && !this.get('liveSince')) this.set('liveSince', row.ts);
                 inserted += 1;
             }
@@ -298,13 +316,14 @@ export class UsageLedger {
     }
 
     /** Read cached amounts; group retained attribution separately for distinct sessions. */
-    rollup({ hourlyDay = null, fromDay = '0000-01-01', toDay = '9999-12-31' } = {}) {
+    rollup({ hourlyDay = null, fromDay = '0000-01-01', toDay = '9999-12-31',
+        fromMs = null, toMs = null } = {}) {
         const days = {};
         const hourly = hourlyDay ? { rows: [], unallocated: [] } : null;
-        const fromTs = fromDay === '0000-01-01' ? 0 : new Date(`${fromDay}T00:00:00`).getTime();
+        const fromTs = fromMs ?? (fromDay === '0000-01-01' ? 0 : new Date(`${fromDay}T00:00:00`).getTime());
         const end = toDay === '9999-12-31' ? null : new Date(`${toDay}T00:00:00`);
         if (end) end.setDate(end.getDate() + 1);
-        const toTs = end ? end.getTime() : Number.MAX_SAFE_INTEGER;
+        const toTs = toMs == null ? (end ? end.getTime() : Number.MAX_SAFE_INTEGER) : toMs + 1;
         const empty = () => ({
             turns: 0, input: 0, output: 0, cacheRead: 0, cacheWrite: 0, costUsd: 0,
             costBilled: 0, costEstimated: 0, costKnownTurns: 0, durationMs: 0, durationTurns: 0,
@@ -335,17 +354,34 @@ export class UsageLedger {
             const end = new Date(start);
             end.setDate(end.getDate() + 1);
             hourly.rows = this.db.prepare(`
-                SELECT e.ts,e.provider,e.source_type,e.input,e.output,e.cost_usd
+                SELECT e.ts,e.provider,e.source_type,e.input,e.output,e.cache_read,e.cache_write,e.cost_usd
                 FROM events e JOIN (${best}) b USING(day,provider,model,rank)
                 WHERE e.ts>=? AND e.ts<? ORDER BY e.ts
-            `).all(fromDay, toDay, start.getTime(), end.getTime()).map((row) => {
-                const usage = normalizeUsageMeasurement(row.provider,
-                    { turns: 1, input: row.input, costUsd: row.cost_usd });
-                return { ...row, input: usage.input, cost_usd: usage.costUsd,
-                    unmeasuredTurns: usage.unmeasuredTurns || 0 };
+            `).all(fromDay, toDay, fromMs == null ? start.getTime() : fromTs,
+                toMs == null ? end.getTime() : toTs).map((row) => {
+                const usage = normalizeUsageMeasurement(row.provider, { turns: 1, input: row.input,
+                    cacheRead: row.cache_read, cacheWrite: row.cache_write, costUsd: row.cost_usd });
+                return { ...row, input: usage.input, cache_read: usage.cacheRead, cache_write: usage.cacheWrite,
+                    cost_usd: usage.costUsd, unmeasuredTurns: usage.unmeasuredTurns || 0 };
             });
         }
-        for (const row of this.db.prepare(`SELECT d.* FROM daily d JOIN (${best}) b USING(day,provider,model,rank)`).all(fromDay, toDay)) {
+        // Partial calendar days must be rebuilt from retained timestamps;
+        // cached whole-day totals would include usage outside a rolling window.
+        const amounts = fromMs == null
+            ? this.db.prepare(`SELECT d.* FROM daily d JOIN (${best}) b USING(day,provider,model,rank)`).all(fromDay, toDay)
+            : this.db.prepare(`
+                SELECT e.day,e.rank,e.provider,e.model,e.kind,e.cost_source,e.source_type,
+                    COUNT(*) AS turns,SUM(e.input) AS input,SUM(e.output) AS output,
+                    SUM(e.cache_read) AS cache_read,SUM(e.cache_write) AS cache_write,
+                    SUM(e.cost_usd) AS cost_usd,SUM(e.duration_ms) AS duration_ms,
+                    MAX(e.origin!='live') AS imported
+                FROM events e JOIN (${best}) b USING(day,provider,model,rank)
+                WHERE e.ts>=? AND e.ts<?
+                GROUP BY e.day,e.rank,e.provider,e.model,e.kind,e.cost_source,e.source_type
+            `).all(fromDay, toDay, fromTs, toTs).map((row) => ({
+                ...row, conversation: isConversationUsageSource(row.source_type),
+            }));
+        for (const row of amounts) {
             const day = days[row.day] ||= { ...empty(), models: {}, sessions: {}, conversation: empty() };
             const key = `${row.provider}/${row.model}`;
             const route = day.models[key] ||= {
@@ -395,6 +431,9 @@ export class UsageLedger {
                 }
             }
         }
+        // Timeless legacy totals cannot establish membership in a 24-hour window.
+        // They remain available in the calendar/history views.
+        if (fromMs != null) return hourly ? { days, hourly } : { days };
         for (const row of this.db.prepare('SELECT day,document FROM legacy_days WHERE day BETWEEN ? AND ?').all(fromDay, toDay)) {
             const legacy = normalizeLegacyUsageDay(JSON.parse(row.document));
             const day = days[row.day];

package/src/runtime/shared/llm/usage-pricing-refresh.mjs

@@ -0,0 +1,26 @@
+import { pricingCatalogRevisionSync } from '../../agent/orchestrator/providers/model-catalog.mjs';
+import { repairUsageLedger } from './usage-ledger-repair.mjs';
+
+const checked = new WeakMap();
+
+function pendingFingerprint(ledger, revision) {
+    const pending = ledger.db.prepare(`SELECT COUNT(*) AS count,MAX(e.ts) AS latest
+        FROM usage_events e JOIN usage_routes r ON r.id=e.route
+        WHERE e.cost_usd IS NULL AND json_extract(r.signature,'$[4]')='unpriced'
+        AND e.ts<=?`).get(Date.now());
+    return { count: pending.count, key: `${revision}:${pending.count}:${pending.latest}` };
+}
+
+/** Price-table changes revisit unknown costs, never overwrite a known bill or
+ * estimate. New unknown records also get checked without polling old rows on
+ * every dashboard render. Failed repairs are not marked successful. */
+export function refreshUnpricedUsage(ledger) {
+    const revision = pricingCatalogRevisionSync();
+    const pending = pendingFingerprint(ledger, revision);
+    if (!pending.count || checked.get(ledger) === pending.key) return { skipped: true };
+    const result = repairUsageLedger(ledger, {
+        throughTs: Date.now(), onlyUnpriced: true, backup: true,
+    });
+    checked.set(ledger, pendingFingerprint(ledger, revision).key);
+    return result;
+}

package/src/runtime/shared/llm/usage-rollup.mjs

@@ -104,39 +104,35 @@ export function isConversationUsageSource(sourceType) {
 }
 
 function emptyRouteTotals() {
-  return { turns: 0, input: 0, output: 0, cacheRead: 0, cacheWrite: 0, costUsd: 0 };
+  return { turns: 0, input: 0, output: 0, cacheRead: 0, cacheWrite: 0, costUsd: 0,
+    costBilled: 0, costEstimated: 0, costKnownTurns: 0 };
 }
 
 function emptyTurnTotals() {
   return {
     ...emptyRouteTotals(),
-    // Priced by the provider itself vs derived from the model catalog. A
-    // subscription turn is never invoiced per token, so merging the two would
-    // present a guess as a bill.
-    costBilled: 0,
-    costEstimated: 0,
-    costKnownTurns: 0,
     durationMs: 0,
     durationTurns: 0,
   };
 }
 
-function addRouteTotals(target, turn) {
+function addRouteTotals(target, turn, { priced, billed } = {}) {
   target.turns += turn.turns;
   target.input += turn.input;
   target.output += turn.output;
   target.cacheRead += turn.cacheRead;
   target.cacheWrite += turn.cacheWrite;
   target.costUsd = round6(target.costUsd + turn.costUsd);
-}
-
-function addTurnTotals(target, turn, { priced, billed, durationMs }) {
-  addRouteTotals(target, turn);
   if (priced) {
     target.costKnownTurns += 1;
     if (billed) target.costBilled = round6(target.costBilled + turn.costUsd);
     else target.costEstimated = round6(target.costEstimated + turn.costUsd);
   }
+}
+
+function addTurnTotals(target, turn, pricing) {
+  addRouteTotals(target, turn, pricing);
+  const { durationMs } = pricing;
   if (durationMs > 0) {
     target.durationMs += durationMs;
     target.durationTurns += 1;
@@ -181,6 +177,11 @@ function readRouteTotals(raw, target) {
   target.cacheRead = num(raw?.cacheRead);
   target.cacheWrite = num(raw?.cacheWrite);
   target.costUsd = round6(num(raw?.costUsd));
+  target.costBilled = round6(num(raw?.costBilled));
+  target.costEstimated = round6(raw?.costEstimated == null
+    ? Math.max(0, target.costUsd - target.costBilled) : num(raw.costEstimated));
+  target.costKnownTurns = raw?.costKnownTurns == null
+    ? (target.costUsd > 0 ? target.turns : 0) : num(raw.costKnownTurns);
   return target;
 }
 
@@ -311,7 +312,8 @@ export function foldUsageRollup(current, summary, now = Date.now()) {
   // costSource 'none' means neither the provider nor the catalog priced this
   // turn; counting it keeps the surface honest about partial cost coverage.
   const pricing = {
-    priced: Boolean(costSource) && costSource !== 'none',
+    priced: summary?.costUsd != null && Number.isFinite(Number(summary.costUsd))
+      && !['', 'none', 'unpriced'].includes(costSource),
     billed: costSource === 'provider',
     durationMs: num(summary?.durationMs),
   };
@@ -340,10 +342,10 @@ export function foldUsageRollup(current, summary, now = Date.now()) {
   if (known || Object.keys(day.models).length < MAX_MODELS_PER_DAY) {
     const bucket = known ? day.models[modelKey] : emptyModel(provider, model);
     bucket.kind = cleanId(summary?.providerKind) || bucket.kind;
-    addRouteTotals(bucket, turn);
+    addRouteTotals(bucket, turn, pricing);
     if (conversation) {
       if (!bucket.conversation) bucket.conversation = emptyRouteTotals();
-      addRouteTotals(bucket.conversation, turn);
+      addRouteTotals(bucket.conversation, turn, pricing);
     }
     day.models[modelKey] = bucket;
   }

package/src/runtime/shared/native-asset.mjs

@@ -10,6 +10,7 @@ import {
   readFileSync, readdirSync, renameSync, rmSync,
 } from 'node:fs';
 import { join } from 'node:path';
+import { readJsonSafe } from './json-file.mjs';
 import {
   downloadToFileWithRetry,
   MAX_NATIVE_BINARY_DOWNLOAD_BYTES,
@@ -26,9 +27,7 @@ export function binSuffix() {
   return process.platform === 'win32' ? '.exe' : '';
 }
 
-export function readJsonOrNull(path) {
-  try { return JSON.parse(readFileSync(path, 'utf8')); } catch { return null; }
-}
+export { readJsonSafe as readJsonOrNull };
 
 export function validSha256(value) {
   return typeof value === 'string' && /^[a-f0-9]{64}$/i.test(value);
@@ -73,7 +72,7 @@ export function validReleaseAsset(manifest, pkey, { name, tagPrefix }) {
 
 export function readBundledManifest(bundledPath, options = {}) {
   if (options.bundledManifest) return options.bundledManifest;
-  return existsSync(bundledPath) ? readJsonOrNull(bundledPath) : null;
+  return existsSync(bundledPath) ? readJsonSafe(bundledPath) : null;
 }
 
 export async function fetchRemoteManifest(url, { fetch: fetchFn = fetch, label = '[native-asset]' } = {}) {

package/src/runtime/shared/object.mjs

@@ -5,3 +5,7 @@
 export function hasOwn(value, key) {
   return value != null && Object.hasOwn(value, key);
 }
+
+export function isPlainObject(value) {
+  return !!value && typeof value === 'object' && !Array.isArray(value);
+}

package/src/runtime/shared/pg-schema-db.mjs

@@ -0,0 +1,21 @@
+/** Lazy per-dataDir PG handle: one in-flight init, bootstrap lock, retry after failure. */
+export function createPgSchemaDb({ schema, ddl, defaultDataDir, ensurePg, withLock }) {
+  const ready = new Map();
+  return async function getDb(dataDir = defaultDataDir()) {
+    if (ready.has(dataDir)) return ready.get(dataDir);
+    const p = (async () => {
+      const { db, pool } = await ensurePg(dataDir, { schema });
+      // Serialize CREATE TABLE across concurrent first-boot processes on the
+      // same cluster-global advisory lock the adapter uses for schema bootstrap.
+      await withLock(pool, () => db.exec(ddl));
+      return db;
+    })();
+    ready.set(dataDir, p);
+    try {
+      return await p;
+    } catch (err) {
+      ready.delete(dataDir); // let the next call retry after a transient failure
+      throw err;
+    }
+  };
+}

package/src/runtime/shared/plugin-metadata.mjs

@@ -1,3 +1,5 @@
+import { isPlainObject } from './object.mjs';
+
 // Display-only manifest metadata, shared by registry and session status.
 // Keep malformed values empty instead of leaking "[object Object]" into UI.
 function text(value) {
@@ -5,7 +7,7 @@ function text(value) {
 }
 
 function object(value) {
-  return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+  return isPlainObject(value) ? value : {};
 }
 
 function authorText(value) {

package/src/runtime/shared/resource-admission.mjs

@@ -1,7 +1,7 @@
 import { freemem, totalmem } from 'node:os';
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { requestMemoryPressureSnapshot } from './memory-snapshot.mjs';
-import { positiveInt } from './numbers.mjs';
+import { nonNegativeInt, positiveInt } from './numbers.mjs';
 
 const MB = 1024 * 1024;
 
@@ -29,11 +29,6 @@ export function normalizePriority(value) {
 }
 
 
-function nonNegativeInt(value, fallback) {
-  const parsed = Math.floor(Number(value));
-  return Number.isFinite(parsed) && parsed >= 0 ? parsed : fallback;
-}
-
 function envLimits(env = process.env) {
   return {
     maxAgents: positiveInt(env.MIXDOG_MAX_CONCURRENT_AGENTS, RESOURCE_ADMISSION_DEFAULTS.maxAgents),

package/src/runtime/shared/schedules-db.mjs

@@ -12,16 +12,11 @@
  */
 
 import { ensurePgInstance, withSchemaBootstrapLock } from '../memory/lib/pg/adapter.mjs';
+import { createPgSchemaDb } from './pg-schema-db.mjs';
 import { resolvePluginData } from './plugin-paths.mjs';
 
 const SCHEMA = 'scheduler';
 
-// ---------------------------------------------------------------------------
-// Lazy connection + one-shot idempotent DDL (keyed per resolved dataDir).
-// ---------------------------------------------------------------------------
-
-const _ready = new Map(); // dataDir → Promise<db>
-
 const DDL = `
 CREATE TABLE IF NOT EXISTS scheduler.schedules (
   name           text PRIMARY KEY,
@@ -61,24 +56,13 @@ ALTER TABLE scheduler.schedules ADD COLUMN IF NOT EXISTS last_success_at timesta
 ALTER TABLE scheduler.schedules ADD COLUMN IF NOT EXISTS last_failed_at timestamptz;
 `;
 
-async function getDb(dataDir = resolvePluginData()) {
-  if (_ready.has(dataDir)) return _ready.get(dataDir);
-  const p = (async () => {
-    const { db, pool } = await ensurePgInstance(dataDir, { schema: SCHEMA });
-    // Serialize the CREATE TABLE across concurrent first-boot processes on the
-    // same cluster-global advisory lock the adapter uses for schema bootstrap,
-    // so racing first calls can't run the DDL simultaneously.
-    await withSchemaBootstrapLock(pool, () => db.exec(DDL));
-    return db;
-  })();
-  _ready.set(dataDir, p);
-  try {
-    return await p;
-  } catch (err) {
-    _ready.delete(dataDir); // let the next call retry DDL after a transient failure
-    throw err;
-  }
-}
+const getDb = createPgSchemaDb({
+  schema: SCHEMA,
+  ddl: DDL,
+  defaultDataDir: resolvePluginData,
+  ensurePg: ensurePgInstance,
+  withLock: withSchemaBootstrapLock,
+});
 
 // ---------------------------------------------------------------------------
 // Row <-> def mapping

package/src/runtime/shared/schema-value-error.d.mts

@@ -0,0 +1,2 @@
+export function schemaStringLength(value: string): number;
+export function schemaValueError(value: unknown, schema: Record<string, unknown>, path: string): string | null;