openzoo 0.49.5 → 0.49.7

package/lib/proxy.js

@@ -14,7 +14,11 @@ import { evmTokenBalance } from './evm.js';
 import { bindCorpus, contextCacheDisabled, BIND_MIN_CHARS } from './hrr.js';
 import {
   loadBoundChars, noteCorpusLedger, filesForCorpus, readFilesForCorpus, boundAbsFromKeys,
-  createSpillStats, corpusCharsForSend, applySpillCut, msgText, hudDollarX,
+  createSpillStats, corpusCharsForSend, msgText, hudDollarX,
+  spillPricedLine,
+  planConversationBind, rememberSpillMemo, SPILL_CONTENT_ANCHOR_CHARS,
+  corpusRecall,
+  decideChatSpill, isOneShotCorpusAsk,
 } from './spill.js';
 import { rewritablePath, augmentModelList, ALIAS_IDS, rewriteChatModel, zooModelIds, CLASSIFY_MAX_TOKENS } from './models.js';
 import { forgetContext } from './contexts.js';
@@ -26,7 +30,7 @@ import { loadSessionSpend, saveSessionSpend } from './session.js';
 import { creditBalance, quotedPrices } from './info.js';
 import { subscriptionPublicView } from './subscription.js';
 import { priceHoldings } from './livestatus.js';
-import { receiptUsedCogs } from './racesettle.js';
+import { receiptUsedCogs, receiptDirectUsd } from './racesettle.js';
 import { rewriteWrapClientError } from './wrap.js';
 
 const HOP_BY_HOP = new Set([
@@ -423,51 +427,67 @@ async function spillTranscript(body, log, req, stats, extra = {}) {
     });
   };
 
-  if (msgs.length < 6) {
-    bindFilesInBackground('conversation under 6 messages, background');
-    return null;
-  }
-
   // LIVE SELF-TUNER. Env knobs seed the first cut; after cut+stub the proxy
   // scores the HUD dollar multiple (spill direct/billed) and retunes
   // keep/min-turns/budget (stubMore for SEARCH, not live file bodies)
   // in process memory so this request recuts when the green x is under 10.
   // No restart. OPENZOO_ADAPT=0 freezes the env defaults. The ask always
   // stays; we never drop below 2 real user/assistant turns to delete it.
+  //
+  // 1-model AND raced grokui AUTO both land here (same POST /chat/completions
+  // door). The old `msgs.length < 6` bail skipped fat 1-model hops � a 40k
+  // command-output turn with 4�5 messages never bound, so spent?direct.
+  // decideChatSpill is the shared gate: oversized ? bind prefix + system/tail
+  // + x-hrr-context; small ? passthrough. Race fields do not change it.
   const knownLedger = (sessionKey && spillMemo.get(sessionKey))
     || (sessionKey && sessionLedger.get(sessionKey))
     || null;
   const knownChars = knownLedger?.contextId
     ? (boundChars.get(knownLedger.contextId) || 0)
     : 0;
-  const adapted = applySpillCut(msgs, {
+  const decision = decideChatSpill(body, {
     corpusChars: knownChars,
     boundAbs: previouslyBoundAbs,
+    recall: corpusRecall(typeof knownLedger?.corpus === 'string' ? knownLedger.corpus : ''),
     log,
     persist: true,
     dollarX: extra.dollarX ?? hudDollarX(stats || {}),
     lastSend: extra.lastSend,
+    minPrefixChars: BIND_MIN_CHARS,
   });
-  if (adapted.cut <= adapted.firstSpillable) {
+  if (decision.mode === 'passthrough') {
+    bindFilesInBackground(decision.reason === 'no-cut'
+      ? 'no severable cut, files only'
+      : 'conversation under spill threshold, background');
+    return null;
+  }
+  if (decision.mode === 'stub-only') {
     bindFilesInBackground('no severable cut, files only');
     // Still forward stubbed/trimmed bodies so an un-severable storm is not
     // shipped at full size just because cutTranscript could not move.
-    if (adapted.stubbed?.dropped || adapted.stubbed?.stubbed) {
-      return {
-        body: Buffer.from(JSON.stringify({ ...body, messages: adapted.stubbed.messages })),
-        corpus: '',
-        reused: false,
-        savedBytes: 0,
-        sent: adapted.stubbed.messages.length,
-        msgs: msgs.length,
-      };
-    }
-    return null;
+    return {
+      body: Buffer.from(JSON.stringify({ ...body, messages: decision.forwarded })),
+      corpus: '',
+      reused: false,
+      savedBytes: 0,
+      sent: decision.forwarded.length,
+      msgs: msgs.length,
+    };
+  }
+  // oneshot is handled in maybeCacheCorpus; if we reach it here, bind the
+  // extracted corpus the same way as a transcript prefix.
+  if (decision.mode === 'oneshot' && !decision.adapted) {
+    decision.adapted = {
+      cut: msgs.length - 1,
+      firstSpillable: Math.max(0, msgs.findIndex((m) => m?.role !== 'system')),
+      stubbed: { messages: decision.forwarded, stubbed: 0, dropped: 0 },
+    };
   }
+  const adapted = decision.adapted;
   const { cut, firstSpillable } = adapted;
   const stubbed = adapted.stubbed;
 
-  const head = msgs.slice(0, firstSpillable);     // system block, always kept
+  const head = decision.head.length ? decision.head : msgs.slice(0, firstSpillable);     // system block, always kept
   // EVERY FILE THE AGENT TOUCHED, AT FULL SIZE.
   //
   // The saving ratio is corpus/sent, so on a fresh session — where the corpus
@@ -488,35 +508,24 @@ async function spillTranscript(body, log, req, stats, extra = {}) {
   //
   // FILES RIDE THE BACKGROUND, NEVER THE CRITICAL PATH.
   //
-  // The FIRST bind of a session is necessarily synchronous � the request cannot
-  // go until the context_id exists, because it travels as x-hrr-context. Folding
-  // file bytes into that bind put a 400KB upload in front of the caller's turn,
-  // which is the cold-bind stall this whole exercise was meant to remove: the
-  // bind endpoint measures 0.34-0.48s on a 613KB corpus, and that is 0.34-0.48s
-  // the user waits before a single token appears.
+  // The first conversation bind is also fire-and-forget: turn 1 may go out
+  // unspilled while the bind runs, then later turns recall a tail + contextId.
+  // Folding file bytes into a synchronous first bind used to put a 400KB
+  // upload in front of the caller's turn (0.34-0.48s on a 613KB corpus).
   //
-  // Nothing recalls a file during the turn that read it � the model already has
+  // Nothing recalls a file during the turn that read it � the model already has
   // the tool result in its window. Files are only worth having bound for the
-  // NEXT ask. So the conversation binds inline and the files are appended after
-  // the fact, off the clock.
-  const turns = msgs.slice(firstSpillable, cut).map(msgText).filter(Boolean).join('\n\n');
+  // NEXT ask, so they append after the conversation bind completes.
+  const turns = decision.prefix
+    || msgs.slice(firstSpillable, cut).map(msgText).filter(Boolean).join('\n\n');
   const corpus = turns;
-  if (!sessionKey) sessionKey = corpus.slice(0, 2048);
+  if (!sessionKey) sessionKey = corpus.slice(0, SPILL_CONTENT_ANCHOR_CHARS);
 
-  // FILES BIND EVEN WHEN THE CONVERSATION IS TOO SMALL TO SPILL.
-  //
-  // The threshold exists to stop us binding a two-line chat � it was never
-  // meant to gate FILES. But bailing here skipped them entirely, so a fresh
-  // session that reads a 200KB file bound nothing and scored 1.00x forever:
-  // OBSERVED on a live session that read files all turn and never produced a
-  // corpus, because its conversation stayed under the threshold the whole time.
-  //
-  // A file is worth binding on its own merit. So when the turns are too small
-  // to spill but files exist, bind the files anyway � in the background,
-  // against this session's context � and let this turn go unspilled. The corpus
-  // is then waiting for the next ask.
-  if (corpus.length <= BIND_MIN_CHARS) {
-    bindFilesInBackground('conversation under spill threshold, background');
+  // Conversation prefix binds at any size. BIND_MIN_CHARS only gates the
+  // one-shot corpus+question path in maybeCacheCorpus � a real but small
+  // early-turn prefix used to be discarded here ("only large ones").
+  if (!corpus) {
+    bindFilesInBackground('empty conversation prefix, files only');
     return null;
   }
 
@@ -524,7 +533,7 @@ async function spillTranscript(body, log, req, stats, extra = {}) {
   //
   // A transcript grows by one message per turn, so the whole-corpus hash misses
   // every time and the old code re-uploaded the ENTIRE prefix on every single
-  // turn — OBSERVED live: 0.4MB bound three turns running, a fresh context id
+  // turn � OBSERVED live: 0.4MB bound three turns running, a fresh context id
   // each time, while only a few KB was actually new. Bind cost grew with
   // conversation length and was re-paid per message.
   //
@@ -537,7 +546,7 @@ async function spillTranscript(body, log, req, stats, extra = {}) {
   // The anchor was the first 2KB of corpus, which works only because a
   // transcript's opening never changes. It is fragile in exactly the cases that
   // matter: two sessions that open identically (same system block, same first
-  // instruction — the norm for an agent) collide onto ONE bound context and
+  // instruction � the norm for an agent) collide onto ONE bound context and
   // interleave their histories, and any edit near the top of a transcript
   // silently orphans the binding and re-uploads the whole thing.
   //
@@ -545,60 +554,109 @@ async function spillTranscript(body, log, req, stats, extra = {}) {
   // back to the content anchor when it is not. Same memo, better key.
   // CAPTURED FROM A LIVE claude-cli/2.1.232 REQUEST, not guessed. The first
   // version of this checked x-session-id / x-claude-session-id /
-  // metadata.user_id — none of which Claude Code sends, so it silently fell
+  // metadata.user_id � none of which Claude Code sends, so it silently fell
   // back to the content anchor on every request and the feature did nothing.
   // The real header list is:
   //   anthropic-beta, anthropic-version, x-app, x-claude-code-session-id,
   //   x-stainless-*
-  const anchor = sessionKey;
-  const persisted = sessionKey ? sessionLedger.get(sessionKey) : null;
-  const prior = spillMemo.get(anchor) || (persisted?.contextId
-    ? { contextId: persisted.contextId, hash: persisted.hash || '', corpus: null, restored: true }
-    : null);
+  //
+  // COLD-BIND. Turn 1 may go unspilled (full messages, no x-hrr-context) while
+  // the first bind runs in the background � same spirit as file-bind, so the
+  // opening ask is not stalled. The in-flight/completed bind is memoized on
+  // the session key; later turns recall a tail + contextId. Subsequent
+  // appends stay fire-and-forget deltas.
+  let bindPlan = planConversationBind({
+    sessionKey,
+    corpus,
+    spillMemo,
+    sessionLedger,
+  });
+  const anchor = bindPlan.key || sessionKey;
+
+  if (bindPlan.action === 'cold-bind') {
+    const ready = bindCorpus(corpus, {
+      onStage: (stage, info) => {
+        if (stage === 'binding') log(`binding ${mb(info.bytes)}MB of transcript to holographic memory (background)...`);
+      },
+    }).then((b) => {
+      if (!b?.contextId) return b;
+      noteCorpusLedger(boundChars, {
+        contextId: b.contextId,
+        reused: false,
+        corpusChars: corpus.length,
+        deltaChars: 0,
+        fileChars: 0,
+        ...ledgerOpts(),
+      });
+      rememberSpillMemo(spillMemo, anchor, { corpus, contextId: b.contextId, hash: b.hash });
+      bindFilesInBackground('background', { appendTo: b.contextId, asAppend: true });
+      return b;
+    }).catch((e) => {
+      log(`bind failed (turn went unspilled): ${e.message}`);
+      const cur = spillMemo.get(anchor);
+      if (cur?.pending) spillMemo.delete(anchor);
+      return null;
+    });
+    rememberSpillMemo(spillMemo, anchor, { corpus, pending: true, ready });
+    return null;
+  }
+
+  if (bindPlan.action === 'await-pending') {
+    const finished = await bindPlan.ready.catch((e) => {
+      log(`bind failed (history may lag one turn): ${e.message}`);
+      return null;
+    });
+    if (!finished?.contextId) {
+      bindFilesInBackground('first bind failed, files only');
+      return null;
+    }
+    bindPlan = planConversationBind({
+      sessionKey: anchor,
+      corpus,
+      spillMemo,
+      sessionLedger,
+    });
+  }
+
+  if (bindPlan.action !== 'recall' || !bindPlan.contextId) {
+    bindFilesInBackground('no context yet, files only');
+    return null;
+  }
+
   let bind;
   let deltaChars = 0;
   let appended = false;
-  if (prior?.restored && prior.contextId) {
+  if (bindPlan.restored && bindPlan.contextId) {
     // Sidecar came back up: we still know the context_id and the accumulated
     // char count, but not the prior prefix string, so we cannot slice a delta.
     // Re-append the current prefix (some overlap is harmless) and keep the
-    // restored ledger � do not add corpus.length again.
+    // restored ledger � do not add corpus.length again.
     void bindCorpus(corpus, {
-      appendTo: prior.contextId,
+      appendTo: bindPlan.contextId,
       onStage: (stage, info) => {
-        if (stage === 'binding') log(`appending ${mb(info.bytes)}MB to ${prior.contextId} (restored session, background)`);
+        if (stage === 'binding') log(`appending ${mb(info.bytes)}MB to ${bindPlan.contextId} (restored session, background)`);
       },
     }).catch((e) => log(`append failed (history may lag one turn): ${e.message}`));
     appended = true;
-    bind = { contextId: prior.contextId, hash: prior.hash, reused: true, bytes: 0 };
-  } else if (prior && typeof prior.corpus === 'string' && corpus.startsWith(prior.corpus) && corpus.length > prior.corpus.length) {
-    const delta = corpus.slice(prior.corpus.length);
+    bind = { contextId: bindPlan.contextId, hash: bindPlan.hash, reused: true, bytes: 0 };
+  } else if (bindPlan.append && bindPlan.delta) {
+    const delta = bindPlan.delta;
     deltaChars = delta.length;
-    // FIRE AND FORGET. This delta is history for FUTURE turns � the answer
+    // FIRE AND FORGET. This delta is history for FUTURE turns � the answer
     // being generated right now is served from the tail plus what is already
     // bound, so waiting on the upload buys nothing and costs the user the
     // round trip on every single turn. The context id is already known, so
     // nothing is lost by not waiting for it.
-    //
-    // The FIRST bind is deliberately NOT async: the request must carry
-    // x-hrr-context, and that id does not exist until the bind returns. Firing
-    // that one off would send the opening turn with no context at all � a
-    // silently worse answer traded for a shorter pause, which is the wrong way
-    // round.
     void bindCorpus(delta, {
-      appendTo: prior.contextId,
+      appendTo: bindPlan.contextId,
       onStage: (stage, info) => {
-        if (stage === 'binding') log(`appending ${mb(info.bytes)}MB to ${prior.contextId} (delta, background)`);
+        if (stage === 'binding') log(`appending ${mb(info.bytes)}MB to ${bindPlan.contextId} (delta, background)`);
       },
     }).catch((e) => log(`append failed (history may lag one turn): ${e.message}`));
     appended = true;
-    bind = { contextId: prior.contextId, hash: prior.hash, reused: true, bytes: delta.length };
+    bind = { contextId: bindPlan.contextId, hash: bindPlan.hash, reused: true, bytes: delta.length };
   } else {
-    bind = await bindCorpus(corpus, {
-      onStage: (stage, info) => {
-        if (stage === 'binding') log(`binding ${mb(info.bytes)}MB of transcript to holographic memory...`);
-      },
-    });
+    bind = { contextId: bindPlan.contextId, hash: bindPlan.hash, reused: true, bytes: 0 };
   }
   // CONVERSATION LEDGER � every successful bind AND append, not only when
   // files exist. First bind initializes to the bound corpus size; each append
@@ -618,8 +676,7 @@ async function spillTranscript(body, log, req, stats, extra = {}) {
   // uploads each version exactly once no matter how often the agent re-reads it.
   // Read + readdir are inside setImmediate � they must not run before send().
   bindFilesInBackground('background', { appendTo: bind.contextId, asAppend: true });
-  spillMemo.set(anchor, { corpus, contextId: bind.contextId, hash: bind.hash });
-  if (spillMemo.size > 32) spillMemo.delete(spillMemo.keys().next().value);
+  rememberSpillMemo(spillMemo, anchor, { corpus, contextId: bind.contextId, hash: bind.hash });
   // Count the tail that is actually forwarded after stub/trim � older
   // continue-turn rounds after the ask may have been dropped, so
   // msgs.length - cut would keep lastSend growing with the raw pile.
@@ -671,7 +728,10 @@ async function spillTranscript(body, log, req, stats, extra = {}) {
   const topK = Math.max(4, Math.min(12, Math.round(budget / 320)));
 
   return {
-    body: Buffer.from(JSON.stringify({ ...body, messages: [...head, ...stubbed.messages.slice(cut)] })),
+    body: Buffer.from(JSON.stringify({
+      ...body,
+      messages: decision.forwarded || [...head, ...stubbed.messages.slice(cut)],
+    })),
     topK,
     contextId: bind.contextId,
     hash: bind.hash,
@@ -707,10 +767,10 @@ async function maybeCacheCorpus(req, bodyBuf, log, stats, extra = {}) {
   // the ask verbatim. Anything else (an agent transcript) falls through to the
   // transcript spill, which used to be a silent no-op.
   const last = msgs[msgs.length - 1];
-  const oneShot = typeof last?.content === 'string'
-    && last.content.length > BIND_MIN_CHARS
-    && last.content.lastIndexOf('\n\n') >= BIND_MIN_CHARS;
-  if (!oneShot) return spillTranscript(body, log, req, stats, extra);
+  // Same gate decideChatSpill uses � 1-model and race share it. zoo_ask
+  // stays on the corpus+question bind; everything else (including grokui
+  // AUTO, raced or not) falls through to spillTranscript ? decideChatSpill.
+  if (!isOneShotCorpusAsk(msgs, BIND_MIN_CHARS)) return spillTranscript(body, log, req, stats, extra);
   const cut = last.content.lastIndexOf('\n\n');
   const corpus = last.content.slice(0, cut);
   const ask = last.content.slice(cut + 2).trim();
@@ -793,7 +853,6 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
     say(`session restored: $${sessionSpent.toFixed(6)} � ${paidCalls} paid call${paidCalls === 1 ? '' : 's'}`);
   }
   process.on('exit', rememberSpend);
-  const MARKUP = 3; // confirmed constant, see .claude/wiki.md "Margin needs a like-for-like denominator"
   const noteQuote = (x) => {
     const billed = Number(x?.billedUsd);
     if (!Number.isFinite(billed) || billed < 0) return;
@@ -901,7 +960,13 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       refreshPrices();
       const money = walletMoney();
       res.writeHead(200, { 'content-type': 'application/json' });
+      // Same package.json the startup banner reads � grokui-app refuses to
+      // attach to a leftover :8402 whose version is older than it shipped with.
+      const { version } = JSON.parse(
+        readFileSync(new URL('../package.json', import.meta.url), 'utf8'),
+      );
       res.end(JSON.stringify({
+        version,
         spentUsd: sessionSpent, cogsUsd: sessionCogs, directUsd: sessionDirect, paidCalls,
         creditUsd, chainUsd: money.chainUsd, lastQuoteUsd,
         subscription: subscriptionPublicView(),
@@ -1519,30 +1584,20 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       if (paid && receipt) {
         if (receipt.ok && typeof receipt.billedUsd === 'number') {
           sessionSpent += receipt.billedUsd;
-          // cogs: no per-call field for it, but MARKUP is a known constant
-          // (3x — confirmed against the gateway's own margin math), and
-          // billedUsd = cogs * markup on a straight-markup call. Close enough
-          // on a counterfactual (leCore-discounted) call too since markup is
-          // still the ceiling those get capped against.
-          // Prefer the gateway's own cogsUsd. Deriving it as billedUsd/MARKUP
-          // is only correct on a straight-markup call: under counterfactual
-          // pricing billedUsd is min(direct×discount, markupUsd), so the
-          // division understates cost and overstates margin.
-          sessionCogs += receiptUsedCogs(receipt, MARKUP);
+          // Wallet path: no 3x. Prefer extra.cogsUsd / billedUsd / directUsd /
+          // savedUsd from the 402. billedUsd is the OpenRouter price (plus
+          // zoo's 33% of savings when the caller beat direct).
+          sessionCogs += receiptUsedCogs(receipt);
           noteQuote(receipt);
           // direct = what answering this WITHOUT the zoo would have cost. On an
           // attach call that is the whole bound corpus, which is why it can be
-          // orders of magnitude above what was billed. directUsd is exact and
-          // always present; savesVsDirect is the same number as a ratio.
+          // orders of magnitude above what was billed. Read extra.directUsd /
+          // extra.savedUsd; do not invent billed * 3.
           if (didSpill) {
             spill.spillSpend += receipt.billedUsd || 0;
-            spill.spillDirect += typeof receipt.directUsd === 'number' ? receipt.directUsd : (receipt.billedUsd || 0);
+            spill.spillDirect += receiptDirectUsd(receipt);
           }
-          sessionDirect += typeof receipt.directUsd === 'number'
-            ? receipt.directUsd
-            : typeof receipt.savesVsDirect === 'number'
-              ? receipt.savesVsDirect * receipt.billedUsd
-              : receipt.billedUsd;
+          sessionDirect += receiptDirectUsd(receipt);
           // The public-URL ceiling meters only public-origin spend — your own
           // local calls never eat into it.
           if (viaTunnel) tunnelSpent += receipt.billedUsd;
@@ -1599,23 +1654,19 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
         if (!paid && data?.x402 && typeof data.x402.billedUsd === 'number') {
           const x = data.x402;
           sessionSpent += x.billedUsd;
-          sessionCogs += receiptUsedCogs(x, MARKUP);
+          sessionCogs += receiptUsedCogs(x);
           noteQuote(x);
-          sessionDirect += typeof x.directUsd === 'number' ? x.directUsd : x.billedUsd;
+          sessionDirect += receiptDirectUsd(x);
           if (didSpill) {
             // THE number that settles why a spilled call did or did not save:
             // the gateway only prices a counterfactual when corpusTokens >
             // promptTokens, so a tail that rivals the corpus silently falls
-            // back to markup and direct collapses onto billed.
-            const lc = x.lecore || {};
-            // counterfactualTokensUsed is the basis the gateway ACTUALLY priced
-            // on. lecore.corpusTokens is often absent and reading it printed
-            // 'corpus ?' on calls that were pricing fine — which sent a whole
-            // night's debugging after a number that was never the input.
-            const basis = x.counterfactualTokensUsed ?? lc.corpusTokens;
-            log(`spill priced: ${x.pricing} · basis ${basis ?? '?'} tok vs sent ${lc.tokensBefore ?? '?'} -> ${lc.tokensAfter ?? '?'} · billed ${(x.billedUsd ?? 0).toFixed(5)} direct ${(x.directUsd ?? 0).toFixed(5)}`);
+            // back to at-cost and direct collapses onto billed.
+            // Tell-line prints the gateway's actual counterfactual only.
+            // Never fall back to lecore.corpusTokens (often == tokensBefore).
+            log(spillPricedLine(x));
             spill.spillSpend += x.billedUsd;
-            spill.spillDirect += typeof x.directUsd === 'number' ? x.directUsd : x.billedUsd;
+            spill.spillDirect += receiptDirectUsd(x);
           }
           paidCalls += 1;
           if (viaTunnel) tunnelSpent += x.billedUsd;
@@ -1665,15 +1716,14 @@ export async function startProxy({ silent = false, requireToken = null, sessionM
       const meterStreamed = (x) => {
         if (paid || typeof x?.billedUsd !== 'number') return;
         sessionSpent += x.billedUsd;
-        sessionCogs += receiptUsedCogs(x, MARKUP);
+        sessionCogs += receiptUsedCogs(x);
         noteQuote(x);
-        sessionDirect += typeof x.directUsd === 'number' ? x.directUsd : x.billedUsd;
+        sessionDirect += receiptDirectUsd(x);
         if (typeof x.actualUsd === 'number' && x.actualUsd >= 0) { sessionActual += x.actualUsd; actualCalls += 1; billedWithActual += x.billedUsd || 0; }
         if (didSpill) {
-          const lc = x.lecore || {};
-          log(`spill priced (streamed): ${x.pricing} · basis ${x.counterfactualTokensUsed ?? '?'} tok vs sent ${lc.tokensBefore ?? '?'} -> ${lc.tokensAfter ?? '?'} · billed ${(x.billedUsd ?? 0).toFixed(5)} direct ${(x.directUsd ?? 0).toFixed(5)}`);
+          log(spillPricedLine(x, { streamed: true }));
           spill.spillSpend += x.billedUsd;
-          spill.spillDirect += typeof x.directUsd === 'number' ? x.directUsd : x.billedUsd;
+          spill.spillDirect += receiptDirectUsd(x);
         }
         paidCalls += 1;
         if (viaTunnel) tunnelSpent += x.billedUsd;

package/lib/racesettle.js

@@ -155,13 +155,29 @@ export function capRaceByCredit(n, { creditUsd, quoteUsd } = {}) {
  * House cost from the receipt. Do not subtract race_unused — unused
  * grant-back is not a user refund, and shrinking cogs would hide house loss.
  * Does not clamp to billed — HUD embers when cogs exceed what was paid.
+ *
+ * Wallet path: there is no 3× markup. Prefer the gateway's cogsUsd; otherwise
+ * billedUsd (OpenRouter price, plus zoo's 33% of savings when the 402 has any).
  */
-export function receiptUsedCogs(x, markup = 3) {
+export function receiptUsedCogs(x) {
   if (!x || typeof x !== 'object') return 0;
-  const billedRaw = Number(x.billedUsd);
-  const billedOk = Number.isFinite(billedRaw) && billedRaw >= 0;
   if (typeof x.cogsUsd === 'number' && Number.isFinite(x.cogsUsd)) return x.cogsUsd;
-  return billedOk ? billedRaw / markup : 0;
+  const billedRaw = Number(x.billedUsd);
+  return Number.isFinite(billedRaw) && billedRaw >= 0 ? billedRaw : 0;
+}
+
+/** Counterfactual from the 402: extra.directUsd, else billed + savedUsd. */
+export function receiptDirectUsd(x) {
+  if (typeof x?.directUsd === 'number' && Number.isFinite(x.directUsd)) return x.directUsd;
+  const billed = Number(x?.billedUsd);
+  const billedOk = Number.isFinite(billed) && billed >= 0;
+  if (typeof x?.savedUsd === 'number' && Number.isFinite(x.savedUsd) && billedOk) {
+    return billed + x.savedUsd;
+  }
+  if (typeof x?.savesVsDirect === 'number' && Number.isFinite(x.savesVsDirect) && billedOk) {
+    return x.savesVsDirect * billed;
+  }
+  return billedOk ? billed : 0;
 }
 
 /**
@@ -169,12 +185,10 @@ export function receiptUsedCogs(x, markup = 3) {
  * first-call rewrite, never a race_unused user refund.
  * cogs is the house cost on that receipt (HUD embers when cogs > spent).
  */
-export function meterRaceReceipt(x, markup = 3) {
+export function meterRaceReceipt(x) {
   const billed = Number(x?.billedUsd);
   const spentUsd = Number.isFinite(billed) ? billed : 0;
-  const usedCogs = receiptUsedCogs(x, markup);
-  const direct = typeof x?.directUsd === 'number' ? x.directUsd : spentUsd;
-  return { spentUsd, cogsUsd: usedCogs, directUsd: direct };
+  return { spentUsd, cogsUsd: receiptUsedCogs(x), directUsd: receiptDirectUsd(x) };
 }
 
 export function inferRaceTier(models, fallback = 'medium') {